fix(gates 1-11): gate-11 was dead fleet-wide, eight gates passed over an empty scope, and gate-10 excused itself from four real findings

[rubenvdlinde]

What this is

Every gate in the 1–11 band was put through an acceptance test: plant one textbook true positive of exactly what the gate exists to catch, in a real fleet repo; the gate must FAIL and NAME it; remove the plant and the prior verdict must return; a clean fixture must still PASS; and no subject in scope must read na, never PASS.

Two further arms were added because a plant only fires when the gate runs — it cannot reveal a crashed checker or a gate that excused itself.

Measured across four repo shapes: larpingapp (vue-router 3, standalone), docudesk, scholiq (vue-router 4, AppHost-adopting), nldesign (zero .vue, no router, frontend in js/), plus openregister and a 16-repo static sweep for every widening. Package under test reported by the runner's own line: [hydra-gates] gate package: <sha>.

Result

gate	planted TP	fired?	repaired?
1 spdx-headers	lib/ PHP with no @license/@copyright	✅ named it	empty scope → na
2 forbidden-patterns	var_dump ($x); · die; · exit;	❌ all three PASSed	rewritten over a masked copy
3 stub-scan	empty run() · marker comment · ignored $uid	✅ all three	empty scope → na
4 composer-audit	— (separates "no advisories" from "did not run")	✅	none needed
5 route-auth	routed method with no auth attribute	✅ — but declared a shipped file absent	two-root resolver
6 orphan-auth	zero-caller authz method	✅; quiet on one caller	none needed
7 no-admin-idor	IDOR under a fully-qualified attribute	❌ PASSed	FQ form recognised
8 unsafe-auth-resolver	tab-indented catch(\Throwable){return null;}	⚠️ fired by over-capture, flagged correct code	brace-walked
9 semantic-auth	#[NoAdminRequired] + requireAdmin()	✅ — but flagged the escalation branch	narrowed
10 initial-state	two-step getElementById → .dataset	❌ PASSed, then declared na over 4 real findings	widened surface + rule
11 admin-router	doriath /settings → AdminRoot in the real router	❌ PASSed — the gate was DEAD	routers discovered

gate-11 was dead fleet-wide

It read four hard-coded paths. One fleet app of fifteen has a file at any of them; the rest build their router in src/main.js. The doriath c7c72e9 defect re-planted verbatim into larpingapp's real router reported PASS; the identical line in src/router.js reported FAIL.

Proven on three shapes: larpingapp (new VueRouter), scholiq (createRouter, AppHost), nldesign (no router at all → na, verified honest). Anti-widening: the path rule resolves the enclosing route object, because a bare path: '/settings' grep flags openconnector's ADR-079 hand-off — the remediation — as the defect. 0 findings across 16 repos.

gate-10 declared na over a repo full of its own subject matter

nldesign's src/ holds one file, manifest.json. Its entire hand-written frontend is in js/. gate-10 announced "this repo ships no frontend" over a repo whose js/admin.js does exactly what it exists to catch:

var settingsEl = document.getElementById('nldesign-settings');
var tokenSets  = JSON.parse(settingsEl.getAttribute('data-token-sets'));

na removes a gate from coverage accounting, so this left the denominator. Surface is now src/ + js/, minus *.min.js.

Widening exposed a bug in my own two-step rule: one var btn = document.getElementById(...) put every btn in a 1700-line file into scope, including three forEach(function (btn) {...}) callbacks. An ambiguous name is now dropped — it can only under-report. 7 raw hits → 4, all genuine.

gate-5 called a file absent from inside the repository containing it

A\B\C PSR-4-maps to lib/A/B/CController.php, but the resolver rooted every namespaced name at lib/Controller/. On openregister — which ships the file — AppHost\Controller\GenericHealth#index was filed as "its auth attribute lives in the openregister package and is NOT visible from this repository." The gate punted to another package while standing in it, so two routed methods were judged by nobody. Both roots are now tried. Both resolve, both are correctly annotated, count unchanged at 10 — two unjudged endpoints surfaced with no invented finding. The AppHost consumer control still classifies its four absent generics as ADR-040-unresolved.

Eight gates passed over a scope they never opened

A README-only --scope-to-diff run produced PASS from gates 1, 2, 3, 5, 8, 9, 10, 11 — four of them authorization gates. All eight now say na with a reason (na not structural, per #268).

gate-9 flagged the escalation branch — and its advice was the regression

if (!isAdmin) { return 403; }          // admin IS required   -> true positive
if (!isAdmin) { if (!owner) 403; }     // admin NOT required  -> FALSE positive

Live on docudesk SigningController::cancelRequest (its own docudesk#100 fix) and procest InspectionChecklistController::submitResult. The printed remedy would have made per-user endpoints admin-only. Fleet 28 → 26; larpingapp's genuine downloadPdf finding preserved.

Two arms a planted defect cannot reach

• ARM 4 — an attribute-only change is a change. _filter_preexisting (gates 6, 7, 8 here — not 5/9) compares against the base ref. Before fix(gates): seven of gates 23-33 could not fail on their own subject matter #276 it began at the function NAME( line, so adding #[NoAdminRequired] above an unguarded method left the body byte-identical and the finding was suppressed. Verified both ways on one fixture: cdfbd7a → gate-7 PASS with the finding in .log.preexisting; 34370f6 → FAIL. Pinned for gate-7.
• ARM 5 — a broken interpreter is SKIPPED (wiring), never PASS. With python3 exiting 1, gates 2, 3, 10, 11 all skip. gate-3 is the control: it FAILS a real stub run() when python3 works.

Verified and left alone

gate-3's and gate-5's #269 repairs HOLD (inert $unused = 1; no longer closes gate-3; fail-safe delegation no longer trips it; prose does not satisfy gate-5; @auth admin-only <reason> does). gate-7 is CORRECTLY correlated — .github#160's anti-correlation does not reproduce. docudesk EmlPreviewController::preview is a genuine IDOR.

Fleet churn (measured)

gate	before	after
2	1	1
5	10 (openregister)	10
7	21	21
9	28	26 (2 FPs)
10	0	4 (all nldesign, all genuine)
11	0 (dead)	0 (live)

Full-tree verdicts vs cdfbd7a: larpingapp and scholiq identical; docudesk differs only by the gate-9 fix; nldesign gains gate-10 FAIL and gate-11 na — previously two greens over, respectively, four real defects and zero bytes.

Tests

Five new/extended suites in run-helper-suites.sh's discovery path (7 arms), mutation-checked against whole pre-fix files: pre-fix runner → 19 failures; src/-only surface → 2; single-root resolver → 2; pre-fix check_semantic_auth.py → 3; pre-fix check_no_admin_idor.py → 1. Full run: 56 passed, 0 failed, 2 pre-existing quarantines.

No waivers, @spec exclude, .skip, continue-on-error, baselines or threshold changes. Exemptions added are code-level, not prose-level: : never (a type PHP checks), a dataset key the same file writes, and an identifier that is also a parameter.