Finding
The Phase A blocked-data-plane validator walks the filesystem and skips every manifest or Rust source whose first path component is root target/. That correctly avoids ordinary build output, but it also ignores a deliberately force-tracked source or manifest in that tree. A tracked target/Cargo.toml can therefore activate a forbidden package, or tracked target/**/*.rs can carry a reserved source token, without failing the public contract gate.
Evidence
tools/render_phase_a.py:636-650 discovers Cargo.toml and *.rs with rglob and unconditionally skips paths where parts[0] == "target"..gitignore:15-18 makes the ordinary case low-risk, but Git permits git add --force target/...; the validator's authority is over the committed tree, not only normally-created files.- The merged negative matrix covers nested
crates/target/Cargo.toml and crates/dictyon/src/target/*.rs, proving nested components are scanned, but it has no root-target force-tracked case.
Why this matters
A filesystem exclusion is a proxy for “generated and untracked.” Those are not the same fact. The public guard should derive its scan set from repository identity so a committed activation cannot hide behind a directory name while ordinary untracked build output remains irrelevant.
Desired correction
- Enumerate tracked files from Git (NUL-safe) and scan every tracked
Cargo.toml and *.rs, regardless of whether a path component is named target.
- Keep untracked root build output outside the scan without maintaining path-name exceptions.
- Add force-tracked negative fixtures for root
target/Cargo.toml with an aliased forbidden dependency and root target/**/*.rs with a forbidden token.
- Retain the existing nested-target and ordinary-tree fixtures.
Done when: the gate rejects both force-tracked root-target activation cases, ignores ordinary untracked build output by construction, and its candidate set is replayable from Git rather than inferred from filesystem names.
Finding
The Phase A blocked-data-plane validator walks the filesystem and skips every manifest or Rust source whose first path component is root
target/. That correctly avoids ordinary build output, but it also ignores a deliberately force-tracked source or manifest in that tree. A trackedtarget/Cargo.tomlcan therefore activate a forbidden package, or trackedtarget/**/*.rscan carry a reserved source token, without failing the public contract gate.Evidence
tools/render_phase_a.py:636-650discoversCargo.tomland*.rswithrgloband unconditionally skips paths whereparts[0] == "target"..gitignore:15-18makes the ordinary case low-risk, but Git permitsgit add --force target/...; the validator's authority is over the committed tree, not only normally-created files.crates/target/Cargo.tomlandcrates/dictyon/src/target/*.rs, proving nested components are scanned, but it has no root-target force-tracked case.Why this matters
A filesystem exclusion is a proxy for “generated and untracked.” Those are not the same fact. The public guard should derive its scan set from repository identity so a committed activation cannot hide behind a directory name while ordinary untracked build output remains irrelevant.
Desired correction
Cargo.tomland*.rs, regardless of whether a path component is namedtarget.target/Cargo.tomlwith an aliased forbidden dependency and roottarget/**/*.rswith a forbidden token.Done when: the gate rejects both force-tracked root-target activation cases, ignores ordinary untracked build output by construction, and its candidate set is replayable from Git rather than inferred from filesystem names.