From the round-3 review of #212.
Where: scripts/fleet/check_cards.py check() and classify().
If pinned_at_utc is later than now, age is negative, so the 14-day limit never applies. A grown card stays "grew" until the clock passes the typed pin plus 14 days: about 13 months for a one-year typo. The provenance test only checks that the value parses.
Fix:
- In the check, report AUDIT when the pin is later than now.
- In the provenance test, require the latest pinned commit date ≤
pinned_at_utc ≤ checked_at_utc.
From the round-3 review of #212.
Where:
scripts/fleet/check_cards.pycheck()andclassify().If
pinned_at_utcis later than now,ageis negative, so the 14-day limit never applies. A grown card stays "grew" until the clock passes the typed pin plus 14 days: about 13 months for a one-year typo. The provenance test only checks that the value parses.Fix:
pinned_at_utc≤checked_at_utc.