Repository navigation
scan reads a corrupt manifest as empty, so --prune skips GC and reports success #1063
Description
[agent] Filed by the October 7 architecture audit campaign (core). Register: arch-audit register.
Kind: bug. Source: audit B55 (new finding), register C71.
Problem: scan reads .socket/manifest.json through ctx.ledgers().await.manifest; LoadedLedgers::view maps a parse error to None. GC then treats unreadable the same as missing and records nothing (scan/gc.rs#L234, #L313). The agent JSON dry-run previews against an empty manifest, so every row shows as added. The wet download path re-reads fail-closed.
Symptoms: none filed. Impact: scan --prune --json on a corrupt manifest exits 0 with status: success and an empty gc block, while repair fails and list/remove report manifest_invalid. updates[] and the rollout count every recorded patch as new, so a --max-new-patches cap can defer patches already recorded.
Proposed change: a fail-closed manifest accessor on ProjectContext for writers and previews; scan reports the C52 code (#931) and fails agent and GC runs on an unreadable manifest.
Size and scope: ledgers.rs, scan/mod.rs, scan/gc.rs; about 80 lines.
Acceptance criteria:
-
scan --prune --jsonandscan --dry-run --json --mode agentover a corrupt manifest exit 1 with the shared manifest error code. - Regression tests for both; existing scan/gc suites green.
Dependencies: pairs with #931 (one manifest-read error mapper) and #998.
Generated by Claude Code
Activity
mikolalysenko commentedon Oct 7, 2026
[agent] Triage: priority:p3 (general CLI). Pairs with #931 (manifest error codes) but is a separate defect (scan's GC/preview read path). No open PR references it.
Generated by Claude Code
mikolalysenko commentedon Oct 8, 2026
[agent] Re-checked on main @
830749f: still holds. The code has moved:LoadedLedgers::viewstill turns an unparseable manifest intoNone:ledgers.rs#L75-L82.scanreads update detection through that view:scan/mod.rs#L1880.read_manifesterror to the vendor-only summary:scan/gc.rs#L231-L234and#L310-L313.Generated by Claude Code
mikolalysenko commentedon Oct 9, 2026
v5 triage: P3, not a release blocker. Corrupt-manifest recovery is outside the valid-input v5 gate. Retain P3 without expanding the repair contract.
This follows the maintainer's release scope: one normally completing CLI instance, prioritizing valid-lockfile patch/install behavior, compatibility, and actionable CLI UX.
mikolalysenko commentedon Oct 9, 2026
[agent] I re-checked this on main @
31383f5. It still holds. BothscanGC passes still treat an unreadable manifest the same as a missing one (_ => return GcSummary::vendor_only(..)):scan/gc.rs#L234-L237;scan/gc.rs#L313-L316.The scan-side ledger reads still end in
.unwrap_or_default(), for examplescan/mod.rs#L1216.Generated by Claude Code
mikolalysenko commentedon Oct 28, 2026
[agent] Claiming this issue (with #998, #1123; shared root cause: commands decide "no manifest" with their own probes instead of read_manifest's NotFound-only rule, so unreadable or invalid manifests are treated as absent or judged by path spelling). Branch: agent/fix-manifest-presence-probe. Claim-ID: 2026-10-28T08:21:34Z-087f5c
Generated by Claude Code
mikolalysenko commentedon Oct 28, 2026
[agent] Draft PR: #1776
Generated by Claude Code
Fail closed when the manifest can't be read