Mindbridge ยท track status

TEST-TRUTH

Coverage that reads as present and cannot fail โ€” the suite is green about things it never checks: SQL with no real-DB test, fixtures that cannot discriminate, harness leakage.

Counts and priorities measured 2026-08-16 from gh issue list; regenerate prose as the track moves. This page has never been published โ€” verify live state before starting, and publish fresh per docs/status/artifacts.json.

Next โ†’#3016 Suggested-questions node-side tenant_id predicate is unproven โ€” the only p1; its hidden defect is a cross-tenant disclosure.
11 open โ€” one unproven cross-tenant predicate (the only p1), then silent-failure coverage holes, then harness leakage and rot; all one defect class: the suite is green about things it never checks.
Open workWhy this orderStanding rulings

Open work

Cross-tenant disclosure โ€” security-relevant
p1 #3016 Suggested-questions node-side tenant_id predicate is unproven โ€” no fixture has a second tenant to leak node-side predicate proven by nothing Enterprise
Security-relevant: the node-side tenant_id predicate in fetch_viewer_edges is proven by nothing, because clean_database truncates nodes_v2/edges_v2 per test so only the current tenant's rows exist โ€” no fixture seeds a second tenant that a missing predicate could leak. RLS may still catch it at the engine level, but that manual WHERE clause is currently proven by nothing. Fix: seed a second tenant with its own person, topic and edge, then assert the first tenant's viewer never sees the second tenant's node. The same gap applies to the sibling predicates in compute_idf_batch and fetch_org_wide_candidates.
Silent failure โ€” the suite is green about what it never checks
p2 #2928 search repos swallow every query error into an empty result โ€” a broken query is indistinguishable from "no matches" broken query reads as empty All
Four search methods catch Exception and return [], so a broken query and a genuinely empty result are the same value to AMA / Ask callers โ€” a query that silently stops returning rows reads as "no matches". DatabaseSchemaError is re-raised; everything else โ€” a malformed query, a parameter-binding error, a pgvector dimension mismatch, a timeout โ€” becomes [] plus a log line. The fix keeps the fail-closed behaviour but makes the degraded case observable (a degraded flag or a typed SearchUnavailableError), plus a test that a query error is distinguishable from an empty match set.
p2 #2996 find_or_create's duplicate-key race branch (_refetch_after_race) has no real-DB coverage race branch unproven; fails under concurrency Enterprise
The duplicate-key race branch (_refetch_after_race) has zero real-DB coverage โ€” replacing it with an unconditional raise leaves all 8 tests passing, so a regression surfaces only under production concurrency. It is the recovery path for two connector workers materializing the same (tenant_id, node_type, lower(canonical_name)) at once. The fix forces a real DuplicateKeyError against the live unique index rather than mocking it, then asserts find_or_create returns the pre-existing id.
p2 #3004 No real-DB test covers the FTS half of the hybrid RRF for semantic_search / search_messages FTS half of hybrid never exercised All
Nothing exercises the FTS half of the hybrid RRF for semantic_search / search_messages โ€” the two tests that looked like coverage were on the xfail list and never executed, and both were vacuous about the embedding they claimed. A non-vacuous test seeds two rows whose embeddings are equally distant from the query while only one shares lexemes, then asserts the lexeme-matching row is returned and outranks the other.
p2 #3010 test EMOJI_RE diverges from the production pattern in BOTH directions โ€” emoji assertions are narrower than they read emoji test diverges both directions Dev only
The test's own EMOJI_RE diverges from the production stripper in both directions โ€” narrower, so a regression is invisible (flags, ZWJ and zero-width ranges are stripped in production but unasserted), and broader, so a correct run could falsely fail (the test's single span swallows gaps production deliberately leaves). Importing the production pattern would make the assertion self-referential; the fix needs an independently spelled pattern.
p2 #3011 find_or_create_person_by_alias's canonical-name dedup step has zero real-DB coverage โ€” unreachable within a single ingestion run canonical dedup rung structurally dead Enterprise
The canonical-name dedup rung can be fully disabled and all 14 tests still pass โ€” NodeMaterializer calls find_or_create_person_by_alias once per already-deduped canonical name, so within one ingestion run the rung never has a pre-existing row to find. A regression shows up only as silently duplicated people across re-ingestion or multi-source folds. The test shape: ingest twice into the same tenant and assert the person count is unchanged and the ids are the same rows, not new ones.
p2 #3071 debt-ratchet is blind to growth below file_size_fail_loc โ€” a baselined file can grow silently up to the cap gate reports green over growth Dev only
The debt-ratchet iterates current sizes only, so a baselined file below the cap can grow silently โ€” it reported "held or shrank" after 16 lines of real growth. Measured: file_size_fail_loc = 800, and the one baseline entry at or below the cap (a file at 782) has an 18-line silent growth allowance. The fix iterates the union of baseline keys and current sizes, so a baselined file is always compared regardless of where it sits relative to the cap.
Harness leakage, stale artifacts, and the smaller holes
p3 #2927 test harness: an autouse fixture stamps the shared demo tenant's ms_tenant_id with no teardown autouse fixture pollutes shared tenant Dev only
An autouse fixture stamps the shared demo tenant's ms_tenant_id with no teardown โ€” the column is UNIQUE and the demo tenant has it NULL, so the pollution is ordering-dependent and already caused 14 duplicate-key errors under xdist. The fix converts it to a yield fixture that restores the prior value, or seeds a dedicated tenant instead of mutating demo.
p3 #3008 backend/tests/integration/{SUMMARY,README}.md describe test classes that no longer exist and contradict each other stale docs contradict each other Dev only
Two hand-maintained PASS/FAIL tables describe test classes that no longer exist and record the same test with opposite outcomes โ€” actively misleading for anyone triaging a failure. SUMMARY.md attributes the test to a class TestDataQuality that appears nowhere in backend/tests/. Fix by deleting the tables or generating them, not by hand-refreshing.
p3 #3014 No real-DB coverage for the single-word topic filter in suggested questions topic filter unreachable from fixture All
The single-word topic filter is unreachable from the fixture โ€” mutating both drop sites so the filter never fires leaves the suite 6/6, because every seeded topic is hyphenated and rendered multi-word by construction. Fix: seed a single-word topic and assert it is excluded, with a multi-word topic in the same test as the positive control.
p3 #3015 compute_idf_batch's SQL has no real-DB coverage โ€” short-circuiting it to {} passes every test short-circuited IDF SQL passes all All
Short-circuiting compute_idf_batch to {} passes every test and runs faster โ€” the service defaults every missing key to 1.0 (idf_map.get(target_id, 1.0)), so the join, the ln() arithmetic, and the tenant/tier scoping are unproven. The fix needs a ranking-sensitive fixture and asserts ordering โ€” a low-frequency/high-IDF node outranks a high-frequency one โ€” not membership.
Why is it in this order?

Priority label first, then issue number within a tier. The single p1 is the only item whose hidden defect is a cross-tenant disclosure โ€” its body flags it security-relevant โ€” while the rest are silent wrong-answer, silent-loss, and rot shapes. The p2s and the p3s are one defect class, so there is no evidence-backed finer ranking to invent; number is the honest tiebreak.

Deliberately ignored: issue age and creation date (the list spans 2026-08-01 through 08-05); how cheap or small a fix looks; how well understood the fix is; which drain batch or PR surfaced it โ€” every issue was filed by a drain pass, and that provenance does not rank it.

Standing rulings

None yet. track:test-truth's decided list in track-order.json is empty. A decision that should bind later sessions goes in that list; a question awaiting a ruling is raised via the needs:ruling label rather than resolved inline.