go-gitreins-judge-post-commit-empty-diff-false-negative

Answer

Root cause. The GitReins evaluator builds the tier2 "code context" exclusively from the working tree:

_build_code_context = `git diff --cached` + `git diff`   # staged + unstaged only

A task created after the fix commits lands sees a clean tree → both diffs are empty → tier2's code-vs-noise filter finds no hunks → verdict not implemented for code that is committed and live. That is a deterministic false negative, not model nondeterminism.

Fix. Make the context base-relative: union of the committed diff since the task's base commit plus staged plus unstaged changes. The base is recorded on the task at creation (the "timing rule" becomes an enforced contract), with graceful fallbacks so pre-commit workflows and old tasks behave exactly as before.

class FixedEvaluator:
    """Context = `git diff <base> HEAD` + `git diff --cached` + `git diff`."""

    def _build_code_context(self, repo, task) -> str:
        parts = []
        base = self._resolve_base_sha(repo, task)
        if base is not None and _git_ok(repo, "rev-parse", "--verify", f"{base}^{{object}}"):
            # R1/R2/R4: committed work since the task's base commit
            parts.append(_git(repo, "diff", "--no-ext-diff", "--no-color", base, "HEAD"))
        # live working-tree changes are always included
        parts.append(_git(repo, "diff", "--cached", "--no-ext-diff", "--no-color"))
        parts.append(_git(repo, "diff", "--no-ext-diff", "--no-color"))
        return "\n".join(filter(None, parts))

    def _resolve_base_sha(self, repo, task) -> str | None:
        if task.base_sha:                                   # R1: recorded at task creation
            return task.base_sha
        if task.branch:                                     # R2: old tasks -> merge-base with upstream
            if _git_ok(repo, "rev-parse", "--verify", f"origin/{self.default_branch}"):
                mb = _git(repo, "merge-base", f"origin/{self.default_branch}", task.branch).strip()
                head = _git(repo, "rev-parse", task.branch).strip()
                if mb != head:
                    return mb
        if _git_ok(repo, "rev-parse", "--verify", "HEAD"):  # R4: root commit -> empty tree
            parents = _git(repo, "rev-list", "--parents", "-n", "1", "HEAD").split()
            if len(parents) == 1:
                return "4b825dc642cb6eb9a060e54bf8d69288fbee4904"  # git hash-object -t tree /dev/null
        return None                                         # R3: fallback = old behaviour

Resolution rules, each independently testable: - R1 — task.base_sha (recorded at creation) → git diff base HEAD. This is the real fix; it makes post-commit tasks evaluate their committed diff. - R2 — no base_sha on legacy tasks → infer merge-base(origin/<default>, branch) when the branch has commits beyond upstream. - R3 — unresolvable base → byte-identical to the old working-tree-only path (no regression for pre-commit runs). - R4 — single root commit → diff against the well-known empty-tree hash. - R5 — invalid/vanished base (force-push, shallow clone) → degrade to R3, never crash.

A Go equivalent (judge.Evaluator.BuildCodeContext + resolveBaseSHA) mirrors this logic for the go-… side — see /tmp/gitreins_fix/go_judge/judge.go.

Operationally the judge now self-heals: the old mitigation ("create tasks post-commit, verify manually, force task complete, re-judge once") is replaced by correct context construction — re-judging a false-negative task now deterministically sees the committed code and can PASS on the first corrected run instead of relying on ~25% coin flips. Keeping the manual control (build/vet/test + live proof) is still recommended as an independent AC check, but it is no longer required to rescue correct verdicts.