fix(proof): fail closed when inspect skips artefact files

[echobt]

Summary

Follow-up to squash-merged #267 (5efc405d). That merge landed the original five Harbor P1s but not the later skipped-file fix.

Greptile/T-Rex on #267: oversized regular files and files that raise OSError on stat() / read_bytes() were skipped while incomplete stayed false, so no_eval_short_circuit / no_tb4_hardcoding could pass despite markers in those files.

This PR marks the scan incomplete when a regular file is oversized, unreadable, or binary, so those off-limits rules fail closed.

Greptile

Every PR is reviewed by Greptile before merge. Config: .greptile/.

• Greptile has reviewed this PR; findings are fixed or answered
• If the bot was silent, I commented @greptileai review

Test plan

• deploy/guest/runners/rlm_fc_in_guest_harbor/tests/run.sh including oversized / stat-failed / read-failed / binary skipped-file regressions
• cargo test --workspace (adaptor-only change; CI)
• cargo fmt --all -- --check (CI)
• Clippy / deny / xtask gates if this PR touches crates they cover

Risk

Operators must re-bake or replace the live Harbor adaptor for inspect to change. No BASE_* env, deployed path, or crypto domain tag changes.

Naming

I did not rename BASE_* environment variables, deployed host paths
(/opt/base, /run/base, …), GHCR baseintelligence/base package names, or
base-*-v1 cryptographic domain tags, unless this PR’s purpose is a coordinated
cutover documented in docs/NAMING.md.

  

[cursor]

@greptileai

[greptile-apps]

Greptile Summary

Harbor artefact inspection now fails closed when regular files cannot be fully scanned. One diagnostic issue remains: unreadable and binary files are reported as file or byte limit failures, which can misdirect operators during remediation.

Confidence Score: 4/5

Safe to merge; the remaining issue affects the accuracy of failure diagnostics rather than the fail-closed inspection result.

The reproduced issue is limited to misleading operator evidence for incomplete scans caused by non-limit conditions.

Files Needing Attention: deploy/guest/runners/rlm_fc_in_guest_harbor/inspect_scan.py

T-Rex Logs

What T-Rex did

• T-Rex produced a finding-comment-proof for a posted P2 finding.
• T-Rex produced a second finding-comment-proof for another posted P2 finding.
• T-Rex validated the evidence by running the inspect-scan-failure-evidence-check script and examined the before-and-after logs, concluding the evidence conflates limit truncation with unreadable/stat-failed/binary cases.

_{Ran code and verified through T-Rex}

Comments Outside Diff (1)

1. General comment

   Off-limits failure evidence falsely attributes unreadable and binary artefacts to file/byte limits

   • Bug
     • When collect_artefact_text encounters a stat failure, read failure, or NUL-containing binary, it only returns incomplete=True. tick_rule then emits artefact scan incomplete (file/byte limit) for both off-limits rules. The executed check showed all three cases block the checklist but describe a limit condition that did not occur.
   • Cause
     • The incomplete boolean combines distinct reasons—file cap, total-byte cap, oversized file, stat/read error, and binary content—while _off_limits_incomplete hard-codes the single (file/byte limit) explanation.
   • Fix
     • Track the incomplete reason(s) in addition to the boolean and render accurate evidence, such as stat/read access failure or binary skipped; retain the fail-closed result for all incomplete scans.

   _{Ran code and verified through T-Rex}

_{Reviews (1): Last reviewed commit: "fix(proof): fail closed when inspect ski..." | Re-trigger Greptile}

[greptile-apps]

Report actual scan failure

Stat failures, read failures, and NUL-classified binary files set the same incomplete flag as file or byte limits. The later checklist evidence consequently says file/byte limit even when no limit was reached. This is a non-blocking diagnostic concern: operators investigating a rejected artefact are directed to the wrong cause, increasing time to remediate access or content problems. Retain the reason for an incomplete scan and report it in the failed off-limits evidence.

Artifacts

Evidence from the check

• The authored executable imports the repository scanner, runs a clean baseline and controlled failure branches, and asserts the resulting checklist evidence; it provides the reproducible test source.

Command output from the check

• The baseline command scanned a harmless text file and passed both off-limits rules with clean-absence evidence, establishing the comparison behavior.

Command output from the check

• The failure command exercised stat, read, and binary paths and showed every resulting failed rule claims a file/byte-limit condition; the evidence is misleading.

Command output from the check

• The repository diff check completed cleanly and status showed only validation artifacts, confirming repository source was not modified.

Command output from the check

• The Python compile command completed successfully for the inspected scanner module, confirming the executed target is syntactically valid.

_{Ran code and verified through T-Rex}