From 0dacf71c87fdf3ba993d6323f68c5993322334d9 Mon Sep 17 00:00:00 2001
From: bdeshi <bdeshi@bdeshi.space>
Date: Thu, 30 Jul 2026 01:30:11 +0600
Subject: [PATCH] harness: three gate fixes found by running against real code
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The allowlist parser stripped only whole-line comments, so an entry carrying the
reason it exists — the format allowed-deps.txt documents — failed the gate and
would have blocked every dependency ever added.

The interface{}/any advisory printed a line number instead of a filename when
only one file matched, because grep -n omits the name for a single file, and it
matched the word "any" in prose comments.

"Nesting past 4" fired at four tabs, which a closure inside a function reaches
unaided.
---
 HARNESS.md        | 2 +-
 scripts/verify.sh | 9 ++++++---
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/HARNESS.md b/HARNESS.md
index c7a9aae..ae76e28 100644
--- a/HARNESS.md
+++ b/HARNESS.md
@@ -82,7 +82,7 @@ load-bearing mechanism here, and the one with least machine enforcement, which i
 fails any `.go` change that does not touch `state.md`. That does not prove the counters are *right*;
 it makes forgetting them impossible, which is the real failure mode.
 
-**The dependency allowlist** names modules that are permitted, not required. Being listed is permission;
+**The dependency allowlist** names modules that are permitted, not required. `#` starts a comment anywhere on a line, including after an entry — the gate strips those, so an entry may carry the reason it exists. Being listed is permission;
 `DEPS_MAX` counts what `go.mod` actually pulls in. `scripts/allowed-deps.txt` is the list.
 
 **Budgets in `scripts/budgets.env`.** Two hard LOC ceilings, core and extensions, plus a dependency
diff --git a/scripts/verify.sh b/scripts/verify.sh
index 6f4d399..015d67a 100755
--- a/scripts/verify.sh
+++ b/scripts/verify.sh
@@ -219,7 +219,8 @@ direct=$(echo "$reqs" | awk '$2=="direct" {print $1}' | grep -v '^$' || true)
 total=$(echo "$reqs" | grep -cv '^$' || true)
 
 if [ -f scripts/allowed-deps.txt ]; then
-  allowed=$(grep -v '^[[:space:]]*#' scripts/allowed-deps.txt | grep -v '^[[:space:]]*$' || true)
+  # the file documents "# starts a comment", so strip trailing ones too, not just whole-line
+  allowed=$(sed 's/#.*//' scripts/allowed-deps.txt | sed 's/[[:space:]]*$//' | grep -v '^$' || true)
   unlisted=""
   for d in $direct; do
     echo "$allowed" | grep -qxF "$d" || unlisted="$unlisted $d"
@@ -364,9 +365,11 @@ if [ -n "$panics" ]; then bad "panic() outside cmd/ — request-time failure deg
 head_ "smells (advisory)"
 nowrap=$(echo "$gofiles" | xargs grep -n 'fmt\.Errorf(' 2>/dev/null | grep -v '%w' | wc -l | tr -d ' ')
 [ "${nowrap:-0}" -gt 0 ] && note "$nowrap fmt.Errorf without %w (wrap at package boundaries)"
-anyuse=$(echo "$gofiles" | grep -v '_test\.go$' | xargs grep -ln 'interface{}\|\bany\b' 2>/dev/null || true)
+# -H forces the filename even for a single file; comment lines are prose, where "any" is a word
+anyuse=$(echo "$gofiles" | grep -v '_test\.go$' | xargs grep -Hn 'interface{}\|\bany\b' 2>/dev/null |
+  grep -vE ':[[:space:]]*//' | grep -v 'map\[string\]any' | cut -d: -f1 | sort -u || true)
 [ -n "$anyuse" ] && note "interface{} or any present (no empty interface for flexibility): $(echo "$anyuse" | tr '\n' ' ')"
-deep=$(echo "$gofiles" | xargs awk '/^\t\t\t\t[^\t}]/ {print FILENAME; nextfile}' 2>/dev/null | sort -u || true)
+deep=$(echo "$gofiles" | xargs awk '/^\t\t\t\t\t[^\t}]/ {print FILENAME; nextfile}' 2>/dev/null | sort -u || true)
 [ -n "$deep" ] && note "nesting past 4 (conventions.md): $(echo "$deep" | tr '\n' ' ')"
 deadexp=$(echo "$gofiles" | grep '^\./internal/' | grep -v '_test\.go$' | xargs grep -hoE '^func [A-Z][A-Za-z0-9_]*' 2>/dev/null | awk '{print $2}' | sort -u |
   while read -r sym; do