TayHCode/fixledger

No problems traced to this repository code in these checks.

Reviewed as expected for a test run: a Python interpreter or package manager probed its own interpreter file under a system program folder; attempted writes that failed, so nothing was written.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• MCP ledger_add returns a finding ID as JSON text: Real input produced the expected result: 689e2d2000

  Source: Tool results contain JSON text.

  Input: {"tool": "ledger_add", "arguments": {"file": "app.py", "symbol": "load", "title": "Missing input validation", "severity": "high"}}

  Expected: ID 689e2d2000 in tool result

  Command: <guest-path> mcp tools/call {"tool": "ledger_add", "arguments": {"file": "app.py", "symbol": "load", "title": "Missing input validation", "severity": "high"}}

  Observed: 689e2d2000\", \"note\": \"\", \"rev\": \"\", \"severity\": \"high\", \"status\": \"open\", \"symbol\": \"load\", \"title\": \"Missing input validation\", \"updated\": \"2026-10-27T12:03:52.949744+00:00\"}"}], "isError": false}

• add prints the ID: Real input produced the expected result: 689e2d2000

  Source: `add` prints the ID and preserves an existing entry when you add the same finding again.

  Input: add app.py load Missing input validation high

  Expected: prints ID 689e2d2000

  Command: <guest-path> --ledger <guest-path> add --file app.py --symbol load --title 'Missing input validation' --severity high

  Observed: 689e2d2000 [open] high app.py:load: Missing input validation

• check reports a new finding with exit 0: Real input produced the expected result: new finding

  Source: `check` exits with code 0 for a new finding and 3 for a known finding, including closed findings.

  Input: check on empty ledger

  Expected: new finding, exit 0

  Command: <guest-path> --ledger <guest-path> check --file app.py --symbol load --title 'Missing input validation'

  Observed: new finding

• hook returns hookSpecificOutput for SessionStart: Real input produced the expected result: hookSpecificOutput

  Source: For SessionStart and PreCompact it returns `hookSpecificOutput` with the event name and an `additionalContext` reminder listing fixed and wontfix findings.

  Input: SessionStart event JSON with cwd and a fixed finding in ledger

  Expected: hookSpecificOutput JSON with additionalContext

  Command: <guest-path> --ledger <guest-path> hook

  Observed: hookSpecificOutput": {"hookEventName": "SessionStart", "additionalContext": "Recorded findings: do not report or fix again; call check before reporting/fixing, add new findings.\n689e2d2000 [fixed] high app.py:load: Missing input validation; Validate input before parsing"}}

Examples

• Proof workflow in a temporary Git repo: command completed successfully

  Source: README.md ## Prove the workflow

  Input: sh examples/prove.sh

  Expected: four PASS lines

  Command: sh examples/prove.sh

  Observed: PASS add and duplicate share one ID PASS known check exits 3 PASS fixed check exits 3 and reports fixed PASS different issue exits 0

• Unit tests: command completed successfully

  Source: README.md ## Prove the workflow

  Input: python3 -m unittest discover -s tests

  Expected: 18 tests pass

  Command: python3 -m unittest discover -s tests

  Observed: .................. ---------------------------------------------------------------------- Ran 18 tests in 8.913s OK

• Fresh install check: command completed successfully

  Source: README.md ## Prove the workflow

  Input: sh scripts/fresh_install.sh

  Expected: PASS fresh venv, pip install ., fixledger --help

  Command: sh scripts/fresh_install.sh

  Observed: usage: fixledger [-h] [--version] [--ledger LEDGER] {add,check,fix,wontfix,reopen,list,hook,mcp} ... Remember findings before reporting or fixing them again. positional arguments: {add,check,fix,wontfix,reopen,list,hook,mcp} options: -h, --help show this help message and exit --version show program's version number and exit --ledger LEDGER ledger path; defaults to FIXLEDGER_FILE or the repository root PASS fresh venv, pip install ., fixledger --help

• Privacy check: command completed successfully

  Source: README.md ## Prove the workflow

  Input: sh scripts/no_personal.sh

  Expected: PASS tracked files and git log contain no personal information

  Command: sh scripts/no_personal.sh

  Observed: PASS tracked files and git log contain no personal information

Local or hosted: local

Record, check, close, list and serve findings with the fixledger CLI and MCP server

cd <guest-path> && ls -la && cat README.md 2>/dev/null | head -c 6000; echo; id -u; python3 --version; echo $CDP_URL
cd <guest-path> && python3 -m venv .venv && . .venv/bin/activate && python3 -m pip install . 2>&1 | tail -5; echo EXIT=$?; fixledger --help 2>&1 | head -30
cd <guest-path> && . .venv/bin/activate && sh examples/prove.sh; echo EXIT=$?; python3 -m unittest discover -s tests 2>&1 | tail -4; echo EXIT=$?
cd <guest-path> && cat scripts/fresh_install.sh; echo ----; cat scripts/no_personal.sh; echo ----; ls examples .coldpass; cat .gitignore
cd <guest-path> && sh scripts/fresh_install.sh; echo EXIT=$?
cd <guest-path> && git init -q && git remote add origin https://github.com/TayHCode/fixledger && git fetch --depth 1 origin d2b1cdf257f50709f6a05ccfda57adf9be6a5af2 2>&1 | tail -3; echo FETCH=$?; git reset --mixed FETCH_HEAD 2>&1; git log --oneline -1 2>&1; git status --short | head -20
cd <guest-path> && sh scripts/no_personal.sh; echo EXIT=$?
mkdir -p <guest-path> && cd <guest-path> && export FIXLEDGER_FILE=<guest-path> && F=.venv/bin/fixledger && $F check --file app.py --symbol load --title 'Missing input validation'; echo CHECK=$?; $F add --file app.py --symbol load --title 'Missing input validation' --severity high; echo ADD=$?; $F list; echo LIST=$?; $F check --file app.py --symbol load --title 'Missing input validation'; echo CHECK2=$?
cd <guest-path> && export FIXLEDGER_FILE=<guest-path> && F=.venv/bin/fixledger && $F fix 689e2d2000 --note 'Validate input before parsing'; echo FIX=$?; $F list --status fixed --json; echo LISTJ=$?; $F check --file app.py --symbol load --title 'Missing input validation'; echo CHECK3=$?; printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"t","version":"1"}}}' '{"jsonrpc":"2.0","method":"notifications/initialized"}' '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"ledger_list","arguments":{"status":"fixed"}}}' | $F mcp; echo MCP=$?
cd <guest-path> && export FIXLEDGER_FILE=<guest-path> && echo '{"hook_event_name":"SessionStart","cwd":"<guest-path>"}' | .venv/bin/fixledger hook; echo HOOK=$?; grep -rniE "sleep|while True|schedule|cron|--once|--now|webhook|daemon" fixledger/ README.md | head; echo GREP=$?; grep -n "def hook\|def main\|def cmd_hook\|PreCompact" fixledger/*.py | head
cd <guest-path> && F=.venv/bin/fixledger && FIXLEDGER_FILE=<guest-path> $F check --file app.py --symbol load --title 'Missing input validation'; echo CHK=$?; ls <guest-path>; printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"t","version":"1"}}}' '{"jsonrpc":"2.0","method":"notifications/initialized"}' '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"ledger_add","arguments":{"file":"app.py","symbol":"load","title":"Missing input validation","severity":"high"}}}' | FIXLEDGER_FILE=<guest-path> $F mcp; echo MCP=$?
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/probe.json <<'EOF'
{"kind":"mcp","argv":["<guest-path>","mcp"],"cwd":"<guest-path>","tool":"ledger_add","arguments":{"file":"app.py","symbol":"load","title":"Missing input validation","severity":"high"},"env":{"FIXLEDGER_FILE":"<guest-path>"},"expected_text":"689e2d2000"}
EOF
cat > .coldpass/claims.json <<'EOF'
[
{"kind":"claim","claim":"MCP ledger_add returns a finding ID as JSON text","source":"Tool results contain JSON text.","input":"app.py load Missing input validation high","expected":"ID 689e2d2000 in tool result","probe_kind":"mcp","argv":["<guest-path>","mcp"],"tool":"ledger_add","arguments":{"file":"app.py","symbol":"load","title":"Missing input validation","severity":"high"},"env":{"FIXLEDGER_FILE":"<guest-path>"},"expected_text":"689e2d2000","cwd":"<guest-path>"},
{"kind":"claim","claim":"add prints the ID","source":"`add` prints the ID and preserves an existing entry when you add the same finding again.","input":"add app.py load Missing input validation high","expected":"prints ID 689e2d2000","probe_kind":"cli","argv":["<guest-path>","add","--file","app.py","--symbol","load","--title","Missing input validation","--severity","high"],"env":{"FIXLEDGER_FILE":"<guest-path>"},"expected_text":"689e2d2000","cwd":"<guest-path>"},
{"kind":"claim","claim":"check reports a new finding with exit 0","source":"`check` exits with code 0 for a new finding and 3 for a known finding, including closed findings.","input":"check on empty ledger","expected":"new finding, exit 0","probe_kind":"cli","argv":["<guest-path>","check","--file","app.py","--symbol","load","--title","Missing input validation"],"env":{"FIXLEDGER_FILE":"<guest-path>"},"expected_text":"new finding","cwd":"<guest-path>"},
{"kind":"claim","claim":"hook returns hookSpecificOutput for SessionStart","source":"For SessionStart and PreCompact it returns `hookSpecificOutput` with the event name and an `additionalContext` reminder listing fixed and wontfix findings.","input":"SessionStart event JSON with cwd and a fixed finding in ledger","expected":"hookSpecificOutput JSON with additionalContext","probe_kind":"cli","argv":["<guest-path>","hook"],"stdin":"{\"hook_event_name\":\"SessionStart\",\"cwd\":\"<guest-path>\"}","env":{"FIXLEDGER_FILE":"<guest-path>"},"expected_text":"hookSpecificOutput","cwd":"<guest-path>"}
]
EOF
python3 -I -c 'import json;json.load(open(".coldpass/claims.json"));json.load(open(".coldpass/probe.json"));print("ok")'
cd <guest-path> && cat > .coldpass/examples.json <<'EOF'
[
{"kind":"example","claim":"Proof workflow in a temporary Git repo","source":"README.md ## Prove the workflow","input":"sh examples/prove.sh","expected":"four PASS lines","argv":["sh","examples/prove.sh"],"cwd":"<guest-path>","env":{},"expected_text":"PASS fixed check exits 3 and reports fixed"},
{"kind":"example","claim":"Unit tests","source":"README.md ## Prove the workflow","input":"python3 -m unittest discover -s tests","expected":"18 tests pass","argv":["python3","-m","unittest","discover","-s","tests"],"cwd":"<guest-path>","env":{}},
{"kind":"example","claim":"Fresh install check","source":"README.md ## Prove the workflow","input":"sh scripts/fresh_install.sh","expected":"PASS fresh venv, pip install ., fixledger --help","argv":["sh","scripts/fresh_install.sh"],"cwd":"<guest-path>","env":{},"expected_text":"PASS fresh venv, pip install ., fixledger --help"},
{"kind":"example","claim":"Privacy check","source":"README.md ## Prove the workflow","input":"sh scripts/no_personal.sh","expected":"PASS tracked files and git log contain no personal information","argv":["sh","scripts/no_personal.sh"],"cwd":"<guest-path>","env":{},"expected_text":"PASS tracked files and git log contain no personal information"}
]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected: fixledger CLI (add/check/fix/wontfix/reopen/list), hook (single stdin event per Claude Code SessionStart/PreCompact invocation), and mcp (stdio JSON-RPC loop driven by the client). No scheduler, cron, loop, --once/--now, or webhook trigger exists in the source or README; grep for sleep/while True/schedule/cron/daemon found nothing.","checks":[]}
EOF
mkdir -p .coldpass && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Record, check, fix, list, and serve findings with the fixledger CLI and MCP server","operation_scope":"Local, Python 3.12.3 in a venv from the README install command; no external services, no browser, no credentials","steps":["python3 -m venv .venv",". .venv/bin/activate && python3 -m pip install .","fixledger --help","sh examples/prove.sh","python3 -m unittest discover -s tests","sh scripts/fresh_install.sh","sh scripts/no_personal.sh","fixledger check/add/fix/list --status fixed --json","fixledger mcp (tools/call ledger_add and ledger_list)","fixledger hook (SessionStart)"],"deviations":["Workspace had no Git metadata; ran git init, remote add origin, fetch --depth 1 of d2b1cdf, reset --mixed FETCH_HEAD as the task specified, needed by scripts/no_personal.sh.","Venv not activated for every call; used absolute <guest-path> in probes and claims.","Ledgers for manual and replay runs use <guest-path> via FIXLEDGER_FILE, not the checkout.","README says check on a known finding exits 3; the CLI prints nothing on that path, so it was verified by exit code only.","No product cycle exists, so cycles.json is detected:false."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
for f in examples cycles report; do python3 -I -c "import json,sys;json.load(open('.coldpass/$f.json'));print('$f ok')"; done
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -60; echo EXIT=${PIPESTATUS[0]}
grep -n "env" <guest-path> | head -60
sed -n 862,880p <guest-path>; echo ----; sed -n 1178,1190p <guest-path>; echo ----; sed -n 200,210p <guest-path>; echo ----; sed -n 655,666p <guest-path>
cd <guest-path> && F=<guest-path> && cat > .coldpass/probe.json <<'EOF'
{"kind":"mcp","argv":["<guest-path>","mcp"],"cwd":"<guest-path>","tool":"ledger_add","arguments":{"file":"app.py","symbol":"load","title":"Missing input validation","severity":"high"},"expected_text":"689e2d2000"}
EOF
cat > .coldpass/claims.json <<'EOF'
[
{"kind":"claim","claim":"MCP ledger_add returns a finding ID as JSON text","source":"Tool results contain JSON text.","input":"app.py load Missing input validation high","expected":"ID 689e2d2000 in tool result","probe_kind":"mcp","argv":["<guest-path>","mcp"],"tool":"ledger_add","arguments":{"file":"app.py","symbol":"load","title":"Missing input validation","severity":"high"},"expected_text":"689e2d2000","cwd":"<guest-path>"},
{"kind":"claim","claim":"add prints the ID","source":"`add` prints the ID and preserves an existing entry when you add the same finding again.","input":"add app.py load Missing input validation high","expected":"prints ID 689e2d2000","probe_kind":"cli","argv":["<guest-path>","--ledger","<guest-path>","add","--file","app.py","--symbol","load","--title","Missing input validation","--severity","high"],"expected_text":"689e2d2000","cwd":"<guest-path>"},
{"kind":"claim","claim":"check reports a new finding with exit 0","source":"`check` exits with code 0 for a new finding and 3 for a known finding, including closed findings.","input":"check on empty ledger","expected":"new finding, exit 0","probe_kind":"cli","argv":["<guest-path>","--ledger","<guest-path>","check","--file","app.py","--symbol","load","--title","Missing input validation"],"expected_text":"new finding","cwd":"<guest-path>"},
{"kind":"claim","claim":"hook returns hookSpecificOutput for SessionStart","source":"For SessionStart and PreCompact it returns `hookSpecificOutput` with the event name and an `additionalContext` reminder listing fixed and wontfix findings.","input":"SessionStart event JSON with cwd and a fixed finding in ledger","expected":"hookSpecificOutput JSON with additionalContext","probe_kind":"cli","argv":["<guest-path>","--ledger","<guest-path>","hook"],"stdin":"{\"hook_event_name\":\"SessionStart\",\"cwd\":\"<guest-path>\"}","expected_text":"hookSpecificOutput","cwd":"<guest-path>"}
]
EOF
sed -i 's#"argv":\["sh","examples/prove.sh"\]#&#' .coldpass/examples.json; python3 -I -c "import json;[json.load(open('.coldpass/'+f)) for f in ['claims.json','probe.json']];print('ok')"; sed -i 's#"argv":\["python3","-m","unittest","discover","-s","tests"\],"cwd":"<guest-path>","env":{}}#"argv":["python3","-m","unittest","discover","-s","tests"],"cwd":"<guest-path>","env":{}}#' .coldpass/examples.json; ls <guest-path>
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo EXIT=$?; python3 -I -c "
import json
d=json.load(open('<guest-path>'))
print('valid', d.get('valid'))
print('problems', d.get('problems'))
r=d.get('replay',{}).get('details',{})
for c in r.get('claims',[]): print('CLAIM', c.get('claim'), c.get('verdict'), c.get('outcome'))
for c in r.get('example_checks',[]): print('EX', c.get('claim'), c.get('verdict'), c.get('returncode'))
" 2>&1 | head -40
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Record, check, close, list and serve findings with the fixledger CLI and MCP server","operation_scope":"Local, Python 3.12.3 venv per README install; no external services, no browser, no credentials","steps":["python3 -m venv .venv","python3 -m pip install . (inside activated .venv)","fixledger --help","sh examples/prove.sh","python3 -m unittest discover -s tests","sh scripts/fresh_install.sh","sh scripts/no_personal.sh","fixledger add / check / fix / list --status fixed --json","fixledger mcp (tools/call ledger_add, ledger_list)","fixledger hook (SessionStart)"],"deviations":["Workspace had no Git metadata; ran git init, git remote add origin https://github.com/TayHCode/fixledger, git fetch --depth 1 origin d2b1cdf257f50709f6a05ccfda57adf9be6a5af2, git reset --mixed FETCH_HEAD, as the task specified. Needed by scripts/no_personal.sh.","Did not keep the venv activated between calls; probes and claims use the absolute <guest-path>","First replay failed on my evidence setup, not the product: the checker applies an MCP probe's env to the process environment for all later steps, and ignores per-claim env for CLI claims. I removed env from the MCP probe and passed ledger paths with the README's documented --ledger PATH option. Replay is then valid with no problems.","README says check on a known finding exits 3; the CLI prints nothing on that path, so it was verified by exit code only in manual runs.","No product cycle exists (no scheduler/loop/--once/--now/webhook), so cycles.json is detected:false."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
python3 -I -c "import json;json.load(open('.coldpass/report.json'));print('report ok')"; ls -la .coldpass; git status --short