fix(fastpath+emit): one interpreter for the test floor, and honour its verdict

[khymerao]

Closes defect 1 of #12 and defect 3a of #15. (#16 folded in here - it keys on the same floor document and should be bisected with this.)

Two halves of one story: what a test_contract command means to its executor, and what the floor document means to its consumer.

---

1. One interpreter for one command list

The plugin runs the same resolved_commands[] under two different interpreters. Every external worker runs each command through a shell, byte-identically:

compound-v-run-codex-worker.sh:189   -- /bin/bash -c "$_tc_c"
cursor:203 · antigravity:196 · opencode:237

while the claude backend's tier-1 floor ran shlex.split(raw) as argv (compound-v-fastpath-run.py:1167,1177).

So a floor with a glob, $(...) or an && chain passes on a codex job and fails on a claude job of the same manifest. floor_command is documented only as string (execution-manifest.md:591) and the validator checks only its type (validate-manifest.py:2174), so neither spelling is wrong - the two backends simply disagree about what a manifest string means. argv is the odd one out, and nothing chose it: shlex.split arrived unremarked in 65114b08 and was carried forward in 2d178edd; no commit, doc or ADR mentions argv, shell or injection.

Every command now goes through the same /bin/bash -c the workers use.

An earlier revision shelled only strings containing metacharacters. That was worse: it added a third semantics, so pytest tests/{a,b} still meant one thing on codex and another here. The heuristic is gone.

{path} substitution is now shlex.quoted (:774), matching what referencing_tests already does at :741. Paths come from git diff of the worker's tree and are no longer inert once every command reaches a shell.

2. The receipt keeps the evidence

_run_supervised returns (rc, stdout_bytes); the caller wrote rc, _ = … and discarded it, so a failing floor recorded a bare exit code while holding the output that explains it.

The bounded tail now lands on checks[].output_tail, with stderr captured - a broken command (sh syntax error, module-not-found, ls: cannot access) prints there and nowhere else, which is exactly the "broken command vs broken test" ambiguity this exists for.

It is redacted through the canonical families imported from compound-v-memory.py (CONVENTIONS.md: imported, never redefined), and the docstring states the honest scope: PEM / sk- / ghp_ / AKIA / xox* are covered; password=, credentialed URLs and bare JWTs are not. This reduces what a committed receipt can leak; it does not eliminate it.

The tail never enters reasons[]: the emitter copies a reason matching "timeout after" into tests.failures[], previously_failing() reads that back and resolve_test_commands re-runs it - command output there would be a path from a test's stdout to the next run's shell.

3. The consumer half (emitter)

run_test_floor initialises every result {"passed": false, "merge_blocked": true} and ADR 0003 relies on it: "already merge-blocking and already fail-closed on an empty command", Consequences: "A job reporting no test command at all is a FAIL, not a pass." agents/spec-reviewer.md enforces the same in prose (NO_TEST_EVIDENCE - "Silence is not success").

build_review_spec gate 1 honours that field. _job_result_from did not: it reads the floor only through _tests_block_from_floor, which returns None when no check carries a checker, so merge_blocked: true was never consulted and the job kept the scope verdict's success. Same document, two consumers, opposite conclusions. Dogfood 14 moved the red half of that rule into this function; this is the empty half.

• The predicate is the manifest's declaration, not the resolved slice - the slice is absent exactly when resolution failed, the reachable case.
• tests is None is error (broken machinery), not blocked.
• The refusal carries the floor's own reasons into summary instead of falling back to the job title.
• Unchanged: an uncontracted manifest still records success with no tests object.

Frequency of this fail-open, stated honestly: never observed. 0 of 198 recorded results here and 0 of 17 in the reporting project. It is a latent fail-open found by reading, not a reproduced defect - an earlier revision claimed otherwise from a narrative I had not checked against the run record, and that claim is withdrawn.

Regressions considered

• No docs-only false positive. resolve_test_commands puts floor_command first at every tier and raises on an empty set, so a docs-only change still resolves to [floor_command] and produces a checks[] entry; tests_block is non-None and the empty-floor rule cannot fire.
• capture_stderr defaults False, so _git and every other caller are untouched.
• job_result.tests (schema additionalProperties: false) is unaffected: _tests_block_from_floor reads only checker/rc. output_tail lands only in receipts/<id>.gate.json, which V-memory does not index.
• The selftest invariant "the recorded spelling re-parses to the argv that ran" is updated: nothing is shlex-split on the way to execution any more, so the property is now "re-runnable through the same router".

Tests

fastpath --selftest PASSED; emitter 534/534 (was 526/526). Mutation-checked on both halves. Full scripts/*.py --selftest sweep, lint-frontmatter, rules-lint green locally.

Note on CI

The red Full test suite is tests/test-native-points.sh, which fails 2 PRECOMPACT rows on a clean main too - the hardcoded-date time bomb that #11 fixes. Not from this branch.