sipyourdrink-ltd/bernstein

Gap bernstein seal publish (src/bernstein/cli/commands/seal_cmd.py:149; docstring :12) submits a run's sealed head to an RFC 3161 timestamping authority and stores the token (build_rfc3161_anchor, src/bernstein/core/security/seal_anchor.py:183). "rfc3161" is the only anchor_kind (:79); SealAnchor carries token_b64 and tsa_url and nothing else (:111); verify_anchor (:264) knows only how to check a TSA token, and so does the standalone verifier (verify_cli/bernstein_verify/verify.py:543, _verify_manifest_anchor). #4205 asked for "an external append-only log or timestamping authority". The TSA half shipped in v3.19.2 (docs/release-notes/v3.19.2.md:24). The log half did not: a TSA token proves when a digest existed to anyone who trusts that TSA; it gives no inclusion proof against a log a stranger can audit, and a TSA that mis-issues leaves no trace anywhere. Two related mechanisms exist and neither closes this: witness co-signing of audit checkpoints is a private second party (src/bernste

Gap src/bernstein/core/security/audit_receipt.py projects an audit-chain range into three standard envelopes an off-the-shelf verifier already validates: cose (COSE_Sign1, RFC 9052, EdDSA — _build_cose_sign1, audit_receipt.py:247), intoto (DSSE + in-toto Statement, :288) and transparency (RFC 6962-style inclusion receipt, :368). The module docstring at :5-14 lists them. The run receipt does not get the same treatment. src/bernstein/core/replay/run_receipt.py writes run-receipt.json only (RUN_RECEIPT_FILENAME, :95), signed as a detached Ed25519 signature over the DSSE pre-authentication encoding of the binding block (_signature_preimage, :337; payload type application/vnd.bernstein.run-receipt+json, :92). Nothing under src/bernstein/core/replay/ mentions COSE (git grep -n "COSE\|cbor2" -- src/bernstein/core/replay/ is empty). The only verifiers that understand a run receipt are verify_run_receipt (:785) and the CLI command covered by tests/unit/test_verify_run_receipt_cmd.py. So an op

When a test file crashes instead of failing an assertion, the CI log shows thirty lines of unrelated stdout and nothing about the crash. The shard is red and there is no way to find out why without reproducing locally. This happened on a real run: Test (ubuntu-latest, Python 3.13, shard 1) reported FAIL [24/41] tests/unit/test_orchestrator.py (53.0s) with no counts after the duration, followed by several hundred lines of [SPAWNER-DEBUG] output from other tests. No traceback, no short test summary, no exit code — the whole job log contained no occurrence of failed, Traceback or AssertionError. Why the detail disappears scripts/run_tests.py::_extract_failure_sections starts collecting only when it sees a line containing FAILURES and ===, or containing short test summary. A file whose pytest process dies before printing either section produces neither marker, so the function returns empty and _print_failure_summary falls back to lines[-30:]. The suite runs with output uncaptured, so

Gap Two unrelated unit tests each do real, expensive, whole-repository work with no test-local timeout override, and both were seen exceeding the shared pytest-timeout budget under load across repeated full-suite runs (30 runs, 12 parallel workers each): tests/unit/test_test_impact_alias_edges.py::test_repo_worktree_change_selects_its_lifecycle_suite (L186-205) — calls discover_module_aliases(src) and build_compat_dep_map(_REPO_ROOT, src, [...], {"bernstein"}) against the real src/ and tests/unit/ trees (not a synthetic fixture tree), a full static-import scan of the whole repository. Failure: Failed: Timeout (>120.0s) from pytest-timeout (5 of 30 runs). tests/unit/scripts/test_check_empty_test_modules.py::test_repository_has_no_unexcused_empty_test_modules (L133-141) — calls check_module.build_report(), which (scripts/check_empty_test_modules.py:104-124, pytest_collect_count) spawns one subprocess.run([python, "-m", "pytest", path, "--collect-only", ...]) per candidate empty-look

Gap Four tests in tests/unit/test_worktree_symlinks.py failed in 2 of 6 repeated full-suite runs, always together, always on the same pytest-xdist worker, and always in the same run as a Failed: Timeout (>120.0s) in tests/unit/test_test_impact_alias_edges.py::test_repo_worktree_change_selects_its_lifecycle_suite (L187, real git-worktree subprocess work): TestWorktreeSymlinksFailures::test_cross_filesystem_symlink_warning (L162) TestWorktreeSymlinksFailures::test_other_symlinks_remain_unaffected_when_one_fails (L185) TestWorktreeSymlinksFailures::test_symlink_to_unresolvable_path_continues (L211) TestWorktreeSymlinksWindowsCaveats::test_windows_symlink_fails_gracefully_without_dev_mode (L336) All four fail on the same assertion shape: # tests/unit/test_worktree_symlinks.py:179 assert any("Failed to symlink" in r.message for r in caplog.records) The message comes from logger.warning(...) at src/bernstein/core/git/worktree.py:253. None of the four tests pin the capture level: they rely