# C77 finding-coverage bug — the false PASS the fix closed

_Source: `system/caliber/docs/plans/2026-05-08-c77-finding-coverage-fix.md` (title ~L3; Objective ~L27-33;
Current behavior ~L57 + ~L77; Phase 1 ~L108-149). Sanitized: the four internal app slugs and their
specific git-drift states are generalized to "four FoundryOS apps" / "four distinct drift states" —
they are not load-bearing for this claim. See `manifest.json` → `redactions`._

## The plan's own framing of the bug

Plan title (`~L3`):

> "C77 finding-coverage fix — replace script-anchored `foundryRoot` resolution with cwd-first, so the
> scanner audits the operator-invoked repo (not the worktree where the script file lives)"

## The defect: a false PASS on the wrong root

C77 is the audit layer of a three-layer app-submodule-mutation-discipline chain (source-side prompts +
a close-session preflight gate + the C77 scanner). The first two layers shipped and were verified. The
audit layer had shipped too — but its finding coverage was never proven. From the Objective (`~L31`):

> **Caliber C77 audit:** shipped but **finding coverage NOT proven** — returns `PASS, findings: []`
> from main repo despite preflight surfacing 4 drift states. Audit layer is structurally present but
> functionally untested against drift.

The preflight gate (running from the same working directory) surfaced **four distinct drift states**
across **four FoundryOS apps** [app names and states redacted]. The C77 scanner, run from that same
directory, reported `findings: []` and a green verdict. From the Current behavior section (`~L77`):

> Result: `findings: []` regardless of what the **operator-invoked repo** actually contains. Verified
> empirically 2026-05-08 — main repo C77 returned PASS while preflight … (run from same cwd) surfaced
> 4 distinct drift states.

The mechanism (`~L57`): because the scanner anchored its root walk to the worktree where the script
file lived, it looked for initialized app submodules under the *worktree's* `apps/<app>/.git` — absent
in a fresh worktree — and skipped every app, "even when the operator invoked the script from
`<repo-root>` (main repo)."

## The fix

Phase 1a (`~L108-132`) replaces the resolver with cwd-first / script-fallback (see
`root-resolution-before-after.md`). Phase 1b (`~L134-149`), added on operator review, exposes the
resolution as three new report fields (see `evidence-fields.md`):

```js
targetRoot: foundryRoot,                                     // NEW — operator's audit target
scriptRoot: scriptRoot,                                      // NEW — where the scanner code lives
rootResolution: cwdRoot ? 'cwd-first' : 'script-fallback',  // NEW — which path resolved
```

The plan's rationale for emitting all three rather than just `targetRoot` (`~L155`): the fields are
added so "future misdirection bugs cannot hide" — a verdict now carries the identity of the repo it
was computed against.

## Status

The plan is recorded `status: complete` / `execution_status: complete` in its frontmatter; the fix is
present in the shipped scanner source at the cited lines. The plan lists a regression matrix (main repo
→ FAIL with the real findings; worktree → PASS; outside-FoundryOS → script-fallback PASS) as its
acceptance evidence.