[phase2][test-gap] validate-diff: no spec verifies selective attribution (non-scoped change → 0 findings)

[Anand-rahul]

Problem

The core value proposition of graph-harness is selective attribution — only flagging changes to functions scoped in overlay flows. There is currently no e2e spec that falsifies this property.

Every existing validate-diff spec uses a diff authored to touch a scoped function. A broken implementation that fires flow_unreviewed on every parsed function change — with zero selectivity — would pass the entire test suite.

Missing Specs

T1.1 — Non-scoped change → 0 findings

tests/e2e/specs/validate-diff/non-scoped-change-emits-zero-findings.yaml

A diff modifying TaskProcessor.Process (parsed and indexed, NOT in any flow selector) must produce exactly 0 findings. Without this, the selectivity guarantee is unverifiable from e2e tests.

T2.2 — Whitespace-only diff → 0 findings

tests/e2e/specs/validate-diff/whitespace-only-diff-emits-zero-findings.yaml

The diff parser extracts entity names from added lines only (extractFunctionNames). A whitespace-only patch contains no function declarations → 0 findings. Documents the implementation contract and prevents regressions if the diff parser is extended to also scan context lines.

Status

Both specs implemented and passing on impl/phase2. New go-module-multi-method fixture added (generic task-service module, no PocketBase references).

References

• internal/change_process/pipeline.go — extractFunctionNames, hunk → entity mapping (stage 2)
• tests/e2e/helpers/repos.go — GoModuleMultiMethod helper
• tests/e2e/specs/validate-diff/non-scoped-change-emits-zero-findings.yaml
• tests/e2e/specs/validate-diff/whitespace-only-diff-emits-zero-findings.yaml