Regression proof

Two habits that each cost a CI round, or a reviewer's trust, every time they were skipped:

1. A gate passed only if its exit code was 0. Not if the output "looked clean".
2. A regression test counts only if it fails without the fix. A test that passes both ways would not have caught the bug.

Part 1: exit codes, never output

A pipe replaces a command's exit code with the last command's. Each of these really happened:

Rules:

• Run each gate as its own step, with no pipe, and capture the code: npm run lint > /tmp/lint.txt 2>&1; echo "lint=$?". Read the file only to explain a non-zero code.
• Run every gate even after one fails, so one report covers all of them. If the project has a single command that runs every CI gate and summarizes by exit code, use it.
• Never chain a commit or push after a gate with ;. Push in a separate step, after every gate reported 0.
• After a push, confirm the remote: git ls-remote origin refs/heads/<branch> must equal git rev-parse HEAD. Only then write "fixed in <sha>" anywhere.
• In a worktree you did not create, check git rev-parse --abbrev-ref @{upstream} first; a branch tracking origin/main pushes somewhere you did not intend, or not at all.
• Report codes, not adjectives: typecheck=0 lint=0 test=0, not "all green".

Part 2: the test must fail without the fix

Use this for any bug fix or false-positive fix that adds or changes a test.

1. Commit the work locally (it does not need to be pushed).
2. Make a scratch worktree at the merge base, outside the checkout:

   base=$(git merge-base origin/main HEAD)
   head=$(git rev-parse HEAD)
   git worktree add --detach /tmp/proof "$base"

3. Copy the branch's tests only into it: test files, fixtures and test helpers, nothing from the source tree. List what changed under the test directory, then check those paths out from the branch:

   git diff --name-only --diff-filter=AM "$base" "$head" -- tests/
   git -C /tmp/proof checkout "$head" -- <the test paths listed>

   Reuse the checkout's dependencies (a symlinked node_modules, the same virtualenv) unless the fix changed them.
4. Run only the new test there. Then run it on the branch.
5. Read the verdict:

6. Remove the worktree: git worktree remove --force /tmp/proof (--force because the copied tests are uncommitted changes there).

Put the verdict in the PR's test plan, with the command and both exit codes. Only proves is evidence that the test guards the bug.

Output

When reporting a change as done, give one line per gate with its exit code, the push check (remote head = <sha>), and for a fix, the proof verdict for each new test.