Module held_out 

Held-out acceptance tests: written by a second author call after the visible ones, kept in the state directory — never in the worktree, never in an implementer’s input — red-checked on the checkpoint, and run over the final tree after an attempt that passed visibly. Only the scenario IDs of a failure reach a retry.

Structs

Discarded

A file the author wrote that was not kept, and why.

HeldOutFile

One kept held-out test file.

Manifest

What judged a task, stored beside the files’ contents.

Ran

One held-out file’s run.

Selection

The held-out sets a publication carries: exactly those whose manifest digest a task closed on the pushed head names in its evidence.

Tampered

A stored set that no longer matches what was recorded.

Constants

LIMIT

Held-out files per task, composition tests included.

REF_PREFIX

Where a unit’s published held-out sets live.

Functions

closed_on

The tasks of unit closed on head (ticked, with the commit carrying their verdict — the verifier’s discovery), each with the held-out digests its evidence names.

dir

Where a task’s held-out set lives: <project state>/held-out/<feature>/<task>.

leaked

Held-out literals in the attempt’s added lines that it could only have copied: not in the spec, the visible tests or the tree it started from . For a native attempt this never fires; for an external agent, which can read the state directory, it is the mechanical check.

literals

Literals a copied test would carry: quoted strings of 6+ characters and numbers with 4+ significant digits.

load_verified

The stored set, checked: the manifest must hash to expected and every file to its recorded hash.

named_digests

The digests a task commit’s evidence names: the signed held_out phase, else the commit’s Held-Out: trailer.

open_sealed

A sealed set, checked against its reference.

overlaid

The digests of the worktree-relative paths overlaid on wt_root now: Some(empty) when nothing is; None when a marker exists that cannot be read (then nothing untracked may be shown).

overlay_key

The SHA-256 a worktree-relative path is named by in the marker.

overlay_red

overlay_run for a red check: each distinct command also runs once on the tree without any held-out file, so a file is red only by the failing tests it adds (speccoder_core::verify::classify_red_added).

overlay_run

Writes each held-out file over the worktree, runs its command, and puts the tree back exactly as it was: no file of the set, nothing a test wrote, no changed judge input survives — a later attempt can read none of it. While it runs, the worktree’s marker hides the files from its views.

publication_store

The private repository publications are built in: a bare repository in the project’s state directory that borrows the project’s objects (objects/info/alternates), so the tip a publication is parented on resolves there while the held-out tests themselves never enter the project’s repository. Every attempt can read that repository’s refs and objects (git show, git fsck --unreachable, a script a check runs); none can read the state directory.

publish

Publishes a finished feature’s held-out sets in the private store (every task is closed then): publish_closed over the tasks the branch tip closes. Never pushed here; speccoder pr pushes it. Ok(None) when no closed task names a stored set.

publish_closed

Publishes selection as one commit under refs/speccoder/held-out/<unit> of the private store (publication_store): <key>/manifest.json and <key>/files/… of every set, parented on tip (the pushed branch) and on the ref’s previous commit, so the ref only grows and every push of it is a fast-forward. Ok(None) when nothing is selected.

push

Pushes commit (built in store) to remote’s refs/speccoder/held-out/<unit> from repo, reading the store’s objects as alternates: nothing is written to repo, no local ref either.

red_class

The red class of one held-out run: by what its file adds when the run without it is known, else by the run alone.

seal

Seals a held-out set keyed by (unit, requirement) — the entry point for sets decided before a run (a bug’s reproduction variants, a review’s oracle): the one store protocol, each manifest entry citing its statements or scenarios.

sealed_dir

Where a sealed set lives: <project state>/held-out/<unit>/req-<key>/ (run-time task sets stay at <unit>/<task>/).

select_closed

Selects, from every set stored for unit (whatever its key: a task’s today, a sealed set’s once the store holds them — one protocol), those whose manifest digest a closed task names. closed is (task, digests its evidence names). Each selected set is checked against its digest first; a tampered one is never published.

store

Stores the manifest and the kept files’ contents; returns the manifest’s hash. A previous set for the task is replaced.