fix(gate-47): a file the diff DELETES has no test to co-change (procest#867: 7 findings, all D)

[rubenvdlinde]

The defect, measured

check_security_cochange.changed_lines() runs git diff -U0 and returns added
and removed lines undifferentiated, so a - line scored identically to a
+ line. Three consequences:

• any deletion-only PR in any fleet repo reddens gate-47;
• the finding is unclosable from the app repo — it is keyed to a base
  already in history, and the remedy the gate asks for ("co-change a test")
  cannot be performed on a file that no longer exists;
• it self-clears on the next push once the base advances. That is the
  evidence disappearing, not a repair.

Reproduced against the current package (f935e2c) on procest#867, base
463181f0:

$ python3 scripts/lib/check_security_cochange.py 463181f0 <procest>
src/views/cases/components/ParticipantsSection.vue
src/views/cases/widgets/BevoegdhedenPanel.vue
src/views/complaints/ComplaintAnalyticsDashboard.vue
src/views/complaints/ComplaintDashboardWidget.vue
src/views/complaints/ComplaintDetail.vue
src/views/complaints/ComplaintList.vue
src/views/settings/tabs/KlachtcategorieenTab.vue

$ git diff --name-status -M 463181f0...HEAD -- <each of those>
D	src/views/cases/components/ParticipantsSection.vue
D	src/views/cases/widgets/BevoegdhedenPanel.vue
D	src/views/complaints/ComplaintAnalyticsDashboard.vue
D	src/views/complaints/ComplaintDashboardWidget.vue
D	src/views/complaints/ComplaintDetail.vue
D	src/views/complaints/ComplaintList.vue
D	src/views/settings/tabs/KlachtcategorieenTab.vue

All seven are D. The only matched line in each was the deleted
requesttoken: OC.requestToken header of a removed src/views/** component.

The change

scan() now reads git diff --name-status -M once — the call rename_map
was already making — and skips paths git reports as deleted outright.

     files = changed_files(base_ref, cwd)
     has_test = any(is_test_path(f) for f in files)
-    renames = rename_map(base_ref, cwd)
+    records = name_status(base_ref, cwd)
+    renames = renames_from(records)
+    deleted = deletions_from(records)
     security: list[str] = []
     for f in files:
+        if f in deleted:
+            continue
         if is_security_path(f):

rename_map() keeps its signature and behaviour; it is now a one-line wrapper
over the shared reader, alongside a new deleted_files(). No other module in
the package imports this one.

It is the D STATUS, not the - sign

Classifying on added lines only is the tempting one-liner and it is the wrong
fix. Removing a requesttoken from a file that still ships is a genuine
security change that must still demand a test co-change, and that arm is
pinned by test_tp_removing_the_token_from_a_SURVIVING_file_still_fires.
Because -M is on, a moved file is an R record and never reaches the
deletion set — pinned by test_control_a_rename_is_not_read_as_a_deletion.

Controls — the gate must still be shown able to FAIL

All four run through the real bin/hydra-gates on throwaway fixtures, reading
the printed verdict line and the log artefact (not an exit status).

#	fixture	verdict after	verdict before (origin/main)
1	adds requesttoken: OC.requestToken, no test co-change	FAIL — 1 security-touching change(s)	FAIL
2	removes it from a surviving file, no test co-change	FAIL — 1 security-touching change(s)	FAIL
3	deletes the whole file	PASS	FAIL — 1 security-touching change(s)
4	procest#867 vs 463181f0	0 findings	7 findings

Arm 3 was run against the pre-fix package at origin/main on the byte-identical
fixture and base, and FAILs there — so the difference is this change and not the
fixture. Arms 1 and 2 name the file in
hydra-gate-security-change-has-tests.log (29 bytes, non-empty).

Arm 4's fixture is not degenerate: the delta is 81 files, 77 of them D, and
the four surviving lib/Controller/*.php were opened and classified — so this is
a computed zero, not an unopened scope.

The ten new unit arms were run as a mutant against the pre-fix helper: 4 fail
and 2 error there, while every anti-widening arm (_tp_ / _control_) passes
both ways. A suite that only ever saw the fixed code would prove nothing.

Package suites re-run

suite	result
test_check_security_cochange.py	42 tests, OK
every scripts/lib/test_*.py (50 files)	0 failing
test_gate_discarded_counts_and_empty_deltas.sh	37 assertions, 0 failures — incl. "anti-widening: gate-47 still FAILs a security-annotation change shipped with no test co-change"
test_gate_empty_scope_never_passes.sh	ALL PASS, 0 bad
test_gate_acceptance_matrix.sh	166 passed, 0 failed

Deliberately NOT changed

The shell probe stays as it is. A deletion-only delta now reports PASS
rather than NOT APPLICABLE. The #242/#401(b) doctrine says a gate must not
pass over a scope it never opened — but this gate did open the hunks and
computed that no surviving code changed. That is the same reasoning under which
_ARM6_ALLOWED already blesses a gate-47 PASS ("classified the docs-only hunks
and found no security change. Computed."), and the same verdict the in-module
pure-rename exemption already produces. Measured both ways; say the word if you
want it declining instead and it is a two-line probe change.

How this could weaken real detection — stated, not hidden

1. Deleting a file can itself be a security regression. Dropping
   lib/Middleware/CsrfMiddleware.php removes a guard, and gate-47 no longer
   speaks to that. It never could: its remedy is "co-change a test" and there is
   nothing left to test. Recorded as a KNOWN LIMIT in scan()'s docstring, with
   a test (test_tp_deleting_a_file_under_an_auth_path_is_also_exempt) that
   makes the behaviour explicit rather than incidental. If the fleet wants
   deletion-of-a-guard caught, it needs a different gate with a different remedy.
2. The exemption is per file, not per PR. A PR that deletes a component AND
   drops an auth attribute from a surviving controller is still a finding —
   otherwise "delete something" would be a universal opt-out. Pinned by
   test_tp_deleting_one_file_does_not_excuse_editing_another.
3. Pre-existing, untouched by this PR: has_test counts a deleted test
   file as a test co-change, because changed_files() is status-blind. So a PR
   that deletes a test and adds IUserSession elsewhere passes. That hole
   predates this change and I left it alone rather than widen the diff; worth a
   follow-up.
4. gate-48 measured on the same shape (a whole lib/Controller/*.php
   deletion carrying #[NoCSRFRequired], with an unprotected fetch() DELETE
   caller in the tree) already reports PASS — it does not share this defect, so
   no sibling change is in this PR.

Rules observed

Edit/Write only, no scripted code edits. Named paths staged. No
Co-Authored-By. Fresh worktree off origin/main. Not merged — this repo
is consumed live at @main by all 18 fleet apps.