CNA-VGAP-014: The physical source-partition validator checks only *.cpp/*.mm path prefixes, so headers, C sources and a TU in a renderer's src/ subdirectory (never compiled) all pass it

CNA snapshot 009d40f5  ·  Known Issues › Verification gaps  ·  source links pinned to 009d40f5

modules/CMakeLists.txt's no-loss ownership gate globs only .cpp and .mm and compares path prefixes, while cna_add_renderer globs src/*.cpp non-recursively, so a new TU under src/<subdir>/ passes configure and is silently not built.

Identifier

CNA-VGAP-014

Category

Verification gap

Subsystem

Build & CI

Status

Open

Verified against

CNA 009d40f5 (009d40f5dd085c4e674d3479675fac84b12b3e0a)

Evidence basis

Source-verified: read at TARGET, not executed

Tests touching this area

None

Affected contract

modules/CMakeLists.txt physical source-partition validator; modules/renderers/CMakeLists.txt cna_add_renderer

Expected behaviour

The validator's comment calls it a no-loss ownership gate: "file physical module location == declared CMake ownership" and "module CMakeLists glob exactly their own src/, so location IS ownership".

Actual behaviour at TARGET

It runs file(GLOB_RECURSE ... "*.cpp" "*.mm") and only requires each path to start with a declared module's src|tests|examples|benchmarks prefix. Headers and .c files are never considered. cna_add_renderer() collects ${CMAKE_CURRENT_SOURCE_DIR}/src/*.cpp without recursion, so a TU placed in, say, src/detail/ satisfies the prefix check and is not compiled. Existing examples are intentional (standalone shader tools under directx9/src/shaders/ and common/d3d/src/shaders/), which is exactly why the gate cannot distinguish a deliberate exclusion from a lost file.

Source locations

• modules/CMakeLists.txt — physical source-partition validator (GLOB_RECURSE of *.cpp and *.mm, prefix match)
• modules/renderers/CMakeLists.txt — cna_add_renderer non-recursive src/*.cpp glob

Evidence

Checked by reading the named sources at 009d40f5; nothing was built or executed for this entry. No lost file exists at 009d40f5; this is a hole in the gate, not a missing source.

Focused reproduction

No focused reproduction is known. Nothing has been invented here; the evidence above is what exists.

Current tests

The validator is a configure-time FATAL_ERROR; nothing tests the validator itself.

Regression test

Compare the validator's file set with each target's SOURCES property (with an explicit allowlist for standalone tools), so an uncompiled TU inside a module fails configure.

Blast radius

Future renderer or module additions placed in a subdirectory. Current builds are unaffected.

Workaround

After adding a file, check the target's source list in the configure output or IDE rather than relying on a clean configure.