Commit Graph

14 Commits

Author SHA1 Message Date
42fa8228b0 Keep going past a broken target, and run what is already built
Some checks failed
md-naming / markdown naming convention (push) Has been cancelled
pre-commit / pre-commit (push) Has been cancelled
runnability / runnability (push) Has been cancelled
Four follow-ups to the previous commit, three of them cases where the new
runner still did the thing it was written to stop doing.

A build that was already up to date ran nothing. `make` says "up to date" on
the second invocation, no executable changes mtime, the before/after snapshot
diff is empty -- and the runner printed a line and stopped, which is exactly
the complaint that started this. It now falls back to running the executables
that are there. Proved with a scratch course whose makefile has a real file
target, because both make courses in this repo rebuild unconditionally and
neither can reach the branch.

One broken target aborted the rest. `run <dir> all` stopped at the first
failure under set -e, so ELAC's second document was never attempted. Failures
are collected per target and reported together at the end instead.

An index was ignored when a course had one target: `run ECOAR 5` silently ran
target 1. Selections are validated before the single-target shortcut now.

And "ECOAR has 1 targets" read like a bug in the tool.

That last fix then falsified a claim in TODO-refactor-remaining.md. It said
ELAC's projectA and AIS's report/final/ver1 "fail with latexmk exit 12" and
were broken documents. With build/ deleted first, both courses build every
document and exit 0. The exit 12 reproduced once against pre-existing build
state and never from clean; the note now says that, and says which part is
inference rather than re-verified, because the original failing state is gone.

All 44 probes still produce a byte-identical runnability-local.tsv.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0172dj34FDpao6wsix8ZuCzE
2026-08-29 11:04:09 +02:00
d5b94cd8a7 run.sh runs the program now, and says which one it is running
Some checks are pending
md-naming / markdown naming convention (push) Waiting to run
pre-commit / pre-commit (push) Waiting to run
runnability / runnability (push) Waiting to run
Reported by kuhy: "I run run.sh and I have no idea where the actual program is
and how to run it". In EPFU that was one `gcc -Wall -Wextra -pedantic main.c`
line and nothing else -- the makefile has no -o, so the binary is an a.out that
nothing mentions, and it was never executed.

Two separate failures, both fixed.

Building is not running. make, cxx, maven and dotnet built and stopped; make,
maven and dotnet did not even print where the output went, while cxx and tex
did. They all execute what they produced now. `make` is the awkward one,
because a makefile need not say what it writes: the runner snapshots the
executables either side of the build and runs whatever is new.

A course is not always one program. Twelve of them are not -- EPFU a game and
a lab, EOOP six binaries, EARIN eight labs, MOM three reports. With no target
named, an interactive run prints a numbered menu and asks; `run <dir> 2`, a
path substring, or `all` skips the prompt. Enumeration deliberately scans the
course root rather than --entry, because EPFU pinning --entry to penguins/src
is precisely why labs/krudnic3_lab1.c had never been compiled. --entry is the
default now, not the only.

Interactive by default: EPFU's penguins and ECOAR's puzzle both read stdin,
and you typed `run`, so you are at the keyboard. --batch (and any
non-terminal stdin) means no prompt, stdin from /dev/null and a 60s cap per
program, so an unattended run cannot wedge. --probe never reaches any of this
and does not even enumerate targets: all 44 probes produce a byte-identical
gates/runnability-local.tsv, and `status` is still seconds long.

Running things immediately found two bugs that could not have surfaced before,
both recorded in TODO-refactor-remaining.md rather than fixed here, since both
mean touching a submitted .c:

  - EPFU/labs/krudnic3_lab1.c dies with SIGFPE, integer division by zero.
  - ECOAR's puzzle.out writes dest.bmp beside its source, so the tree guard
    fails the run. That guard is doing exactly its job.

Verified: EPFU both targets, EOOP under a pty answering the prompt, EADS,
ECOAR, MOM. Full gate green, shellcheck clean on all 44 runners.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0172dj34FDpao6wsix8ZuCzE
2026-08-29 11:00:46 +02:00
37cc00fa21 Say which jupyter problem it is, and regenerate the status table
Some checks are pending
md-naming / markdown naming convention (push) Waiting to run
pre-commit / pre-commit (push) Waiting to run
runnability / runnability (push) Waiting to run
`_works jupyter || _blocked "needs jupyter"` collapsed two different problems
into one message. "needs jupyter" and "jupyter is on PATH but does not run"
send you to different fixes -- install it, versus work out why the shim's
interpreter is gone -- and a status table is only worth keeping if it says
which. `_require_working` checks presence and then execution, and reports
them separately.

The wording is now what DOCS-runnability.md already said for twm_4 and PBAD,
except the probe produces it rather than someone having typed it. Regenerating
the table changed those two rows and nothing else, which is the useful part:
the run guard, the two new .venv directories under PSD and ERSMS-project, and
the tex entry-point change left all 44 courses' status exactly as it was.

One thing worth knowing for the next regeneration: the answer depends on PATH.
jupyter lives in ~/.local/bin, so a shell without it reports "needs jupyter"
and one with it reports the dead shim. Regenerate from a login shell.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-29 08:44:02 +02:00
7b019d103f Gate the zero, and fix the LaTeX course the run guard exposed
The archive reached zero ruff findings this morning, so the standing rule in
.pre-commit-config.yaml -- a hook lands only once the thing it gates is clean
-- is finally satisfied for ruff. `ruff check` and `ruff format --check` are
hooks now, pinned at v0.16.5 per rules/dependency-freshness, plus
`no-suppressions`, which rejects `# noqa` and `# type: ignore`. CLAUDE.md has
always claimed a hook did that; until now the only thing stopping them was
whoever was reading ruff's output, and I typed `# noqa-free` three times in
this session by accident. mypy stays out: six of its errors are third-party
typing limits rather than our code.

The first attempt used `language: system`, which passed `pre-commit run
--all-files` and then failed the actual commit with "Executable `ruff` not
found" -- git hooks do not get ~/.local/bin on PATH. Taking the hooks from
astral-sh/ruff-pre-commit means pre-commit installs ruff itself, which is also
what makes the pin mean anything.

`ruff format --check` failed the moment it was wired up, on four TRAK files I
wrote today and never formatted. Formatted, and the ray_tracing0 render is
still 02484bdb6b6c1ddeff317d7e5566580f.

Then the run guard from f780d023 needed proving on more than TRAK, since it
now applies to every course kind. make, cpp and python courses pass it; node
and target and obj are all properly gitignored, so npm, maven and dotnet
builds cannot trip it either. But NotProgramming/MOM failed, and not because
of the guard:

`_first_file '*.tex'` used `find -print -quit`, which returns whatever readdir
hands back. After the 19 reports were split into sections, that was
`report_three/sections/02-model-dwukryterialny.tex`, and latexmk faithfully
tried to typeset a bare `\section` as a document. DOCS-runnability.md has
recorded MOM as runnable throughout. The tex branch now picks a file that
actually contains `\documentclass`.

Deliberately not sorted, and that is the interesting part. Sorting is the
obvious fix and it made things worse: it swapped ELAC's pick to projectA and
AIS's to report/final/ver1, both of which fail with latexmk exit 12. Those two
documents are broken independently, and sorting merely surfaced them; turning
two green courses red to fix a third is a bad trade. Recorded in
TODO-refactor-remaining.md instead. MOM, ELAC, AIS, SPD, ZPOB, SDM, DPZ and
ESOEN all exit 0 now.

`_works` also grew a `timeout 5`, because `unityhub --version` never returns
on this machine and a probe without one would hang the status sweep.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-29 08:41:34 +02:00
f780d023be A run may no longer change the tree it ran in
Executing coursework has silently overwritten a submitted deliverable twice in
this campaign -- TRAK's outputs/output.png and SPD's results_*.png -- and both
times it was found by a later `git status`, not by the run. `course_main` now
snapshots what git sees under the course root before and after `_run`, and
fails with a diff naming the files if anything moved. Gitignored build output
does not show up there, which is why every runner already writes into build/.

Seen failing before being trusted: a stub whose `_run` appends a newline to
TRAK's config.ini exits 1 and names the file; the same stub without the append
exits 0; and a real `./run.sh run Programming/TRAK` still exits 0 after
rendering, because it writes into build/.

The notebook branch was the specific landmine. `nbconvert --execute --inplace`
rewrites the notebook it just ran, and all four notebooks here are tracked with
their outputs. It now executes to a temp --output-dir. That alone is not
enough, though: nbconvert runs the kernel with its cwd set to the notebook's
own directory, so a cell calling plt.savefig('x.png') still writes beside the
notebook. The tree check above is what actually catches that, which is why it
lives in course_main and applies to every course kind rather than to notebooks.

`_have jupyter` was also the wrong probe. jupyter on this machine is a pipx
shim whose interpreter is gone: `command -v` finds it, and running it exits
127. Both the probe and the runner now use `_works`, which runs `--version`.
`./Programming/twm_4/run.sh --probe` reports "needs jupyter" and exit 78
instead of failing confusingly mid-run.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-29 07:59:15 +02:00
42007d56e4 PORR runs in 28s, and three checks so the next pass cannot repeat my mistakes
PORR was the last course whose `run` did not work. Four measurements, not
guesses, explain why -- and none of them is the matrix size everyone assumes:

  ProcessingType.PROCESSES   20.9s at n=2, 32.8s at n=5, 78.2s at n=10. That
                             is process-pool setup PER TEST, and it grows.
  matrix_type poli3          densifies a sparse .mat into a 2.3 GB npz cache
                             (nemeth12: 723 MB) -- over the 2G ceiling before
                             any solving happens.
  n=10000                    800 MB matrix, and np.linalg.solve wants a copy.
  n=5000                     spd_5000.npz was a Git LFS pointer whose object
                             404s on GitHub, so it regenerates from scratch.

Remove those and what is left still exercises the whole Richardson
implementation at every size that fits: 18 tests, 28 seconds through the
harness, exit 0. The submitted parameter set is one documented environment
variable away. `main.py` now propagates pytest's status (verified: exit 5 when
nothing is collected) -- it discarded it before, so `run` could not tell a
passing suite from a failing one.

The rest of this commit is scripts/check_refactor_safety.py, which exists
because three regressions got past both ruff and a smoke run during this
campaign, and I would rather they could not get past the next one:

  --signatures      diffs two trees function by function, parameter by
                    parameter, default by default. This is what found the 22
                    EARIN functions whose defaults an annotation pass silently
                    dropped.
  --logging         a module with a __main__ guard that logs at INFO must call
                    basicConfig, or it prints nothing at all. Found two more
                    in PORR just now.
  --print-keywords  refuses to let an automated rewrite near print(x, end="")
                    or print(x, file=sys.stderr); losing those turns a
                    rendered board into one glyph per line, or silently moves
                    error output onto stdout.

All three pass on the whole archive. Also in here: 12 latent TypeErrors mypy
found in EARIN that ruff could not -- call sites still passing positionally to
parameters this campaign had made keyword-only, plus one caller of a function
whose argument I had removed. Every one would have raised at runtime.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0172dj34FDpao6wsix8ZuCzE
2026-08-28 20:50:46 +02:00
bd24dd57ea Hold the coursework to the same lint bar as the tooling
kuhy overruled the "do not fix coursework to be better than it was submitted"
rule: git history is the archive, so the working tree can be clean. This lands
the config and the mechanical half of the cleanup -- 9,281 ruff findings under
the fleet config down to 3,686, with no per-file-ignores anywhere.

What is in here:

- pyproject.toml, the first one in this repo. select = ["ALL"], mypy strict,
  and the vendored list mirrored into ruff exclude and coverage omit. Five
  rules are off and each says why; CPY001 is the only judgement call, because
  stamping a copyright header onto 137 university assignments would assert a
  licence that was never claimed. No hook is wired up yet -- a gate lands only
  once its subject is clean.

- ruff format + the safe fixes, then a second pass over the docstring rules
  ruff marks unsafe (they only edit docstring text). 108 files.

- TRAK/sightpy is vendored, not coursework: it is rafael-fuente/Python-Raytracer
  (BSD 3-Clause). Verified against a fresh upstream clone with line endings
  normalised -- 30 of 32 files byte-identical, ray.py and scene.py carrying a
  12- and 13-line local patch that counts rays for the report. 35 files that
  should never have been linted, now excluded and restored.

- WDWR, SPD, MOM and ECRYPT are fully clean, by hand and verified by running
  them: WDWR's three plot scripts print the same statistics as before, MOM's
  PuLP model solves to the same cost. WDWR's graph.py had a 342-character CSV
  header embedded as a string literal, which cannot be wrapped -- the data
  moved to data/pareto_front.csv. Two 0-byte .py stubs are deleted; an empty
  file is not a deliverable and git still has it.

Three harness bugs found by actually running things:

- `run` now forces MPLBACKEND=Agg. TRAK finished its ray trace in 37 seconds
  and then sat for 45 minutes: plt.show() had opened an image viewer and was
  waiting for someone to close the window.
- TRAK's main.py only pops that viewer with --show now, and its runner writes
  to a gitignored build/ via the new --entry-args. The default output path is
  outputs/output.png, which is TRACKED -- a plain run overwrote a submitted
  deliverable.
- course_lib.sh was 357 lines, over this repo's own cap. Split into
  course_probe.sh and course_run.sh.

Verified: ECOTE 26 tests pass, ECRYPT_PROJECT 99 pass, TRAK renders
cornell_box in 37s and exits 0, every module compiles, and every import ruff
removed was checked to be genuinely unused.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0172dj34FDpao6wsix8ZuCzE
2026-08-28 19:53:04 +02:00
ffa5dad02a Split 19 over-cap LaTeX reports, proving each PDF is unchanged
The 250-line cap applies to prose too, and the reports were the worst
offenders -- ENUME's projectA.tex alone was 1,876 lines. Each is now a
preamble plus one \input{} per section, which is how a long LaTeX document is
normally organised; not one byte of prose was rewritten.

"The PDF is unchanged" is checked by a script rather than by eye, because
hashing the PDF cannot work: pdflatex stamps a /CreationDate and an /ID into
every build, so two runs of the SAME source already differ. tex_fingerprint.sh
compares what a reader sees instead -- page count plus a hash of the extracted
text -- and it is stable across rebuilds of untouched sources, which is the
property that makes it usable as a gate.

It earned its keep immediately. Both ECOTE reports quote an example LaTeX
document inside an lstlisting block, so \end{document} appears in the middle
of the file; splitting on the FIRST one stranded everything after it. Same
page count, different text, caught automatically. EOPSY lab3 exposed a second
bug: a \section{} title that runs onto the next line.

Result: 19 .tex over the cap -> 1. The survivor,
ELAC/.../03-building-nfa-...tex, is 418 lines of consecutive tikz figures
with no subsection to split on and needs a hand-placed boundary.

Verified: 29 splits across two passes (section, then subsection for the
pieces still over), every one reporting `unchanged` from
scripts/tex_fingerprint.sh --check.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0172dj34FDpao6wsix8ZuCzE
2026-08-28 19:47:12 +02:00
6479773e41 Make ZPOB build: its essay was handed in without a bibliography
`./run.sh run Programming/ZPOB` exited 12. A clean-room rebuild (the previous
failure was reading a cached .aux) shows the real error is bibtex, not LaTeX:

    I found no \citation commands---while reading file esej.aux
    I found no \bibstyle command---while reading file esej.aux

esej.tex ends with \bibliography{references} but never cites anything and
never sets a \bibliographystyle. latexmk therefore runs bibtex, bibtex exits
2, and latexmk reports 12 -- after pdflatex has already written a correct
esej.pdf.

Adding \bibliographystyle would make a References section appear that is not
in the deliverable: the submitted esej.pdf (LuaTeX, 2023-12-12, 2 pages) has
no bibliography either, so bibtex never succeeded for the author. The fix
belongs in the harness, so course_lib grows --no-bibtex and ZPOB's stub says
in full why it passes it.

Verified: `rm -rf esej/build && ./run.sh run Programming/ZPOB` exits 0 and
writes esej/build/esej.pdf.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0172dj34FDpao6wsix8ZuCzE
2026-08-28 19:18:11 +02:00
a8d873b4fd Run all 33 safe courses; fix what that broke
Some checks are pending
md-naming / markdown naming convention (push) Waiting to run
pre-commit / pre-commit (push) Waiting to run
runnability / runnability (push) Waiting to run
Running one directory (EADS) had already produced four bugs, so all of them
were run. 11 failed. Every one was real -- either in the coursework or in the
harness I had just written -- and the split was roughly even.

Coursework bugs:
  - 15 .tex files use Polish ogonek characters with no fontenc, so pdflatex
    dies with "Command \k unavailable in encoding OT1". Fixed where it was
    actually needed, not blanket-applied.
  - BSS had \documentclass{article}[12pt] -- options after the class name,
    where they are not options at all.
  - SDM's beamer deck had a stray } on an \item, which took out the frame.
  - EOOP/Various/currency included "currency2.hpp"; the file is currency.hpp.
  - ECRYPT_PROJECT had the SAME stdlib-shadowing bug as ECOTE: a package named
    code/. Renamed to sieve/, and its 99 tests now run. With ECOTE's 26 that
    is 125 tests that could not execute at all before today.

Harness bugs, which the run is what exposed:
  - COURSE_ENTRY pointed at directories for PORR and ECRYPT_PROJECT, so python
    looked for __main__.py and reported the wrong problem.
  - main.py was auto-picked via find's first result. EARIN has six labs and
    six main.py files, so that ran an arbitrary lab and called it the course.
    Now only auto-picked when exactly one exists.
  - Only the first requirements.txt was installed, which is why EARIN still
    died on gymnasium after a venv was created for it. All of them now.
  - The notebook probe accepted jupyter being on PATH. This machine's jupyter
    is a pipx shim whose interpreter is gone, so "runnable" was a lie; it now
    invokes jupyter --version and PBAD/twm_4 report blocked, honestly.
  - Nothing ran a course's tests. Where a suite exists it is now the check,
    which matters most for ECRYPT_PROJECT, whose program prompts on stdin and
    cannot be run headlessly at all.
  - Which directory pytest runs from is course-specific and unguessable, so
    stubs pass --test-dir: ECOTE needs program/ for imports, ECRYPT_PROJECT
    needs sieve/ because its fixtures open a CSV by relative path.

gates/known-incomplete.txt records the one file that genuinely cannot build:
EOOP/Various/set/set.cpp includes set.hpp, which `git log --all` shows has
never existed here. The course supplied it and only the .cpp was submitted.
That is a factual record with a stated check, not a lint allowlist -- and
fabricating the header would be inventing coursework.

Status is now 36 runnable / 5 no-code / 3 blocked.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0172dj34FDpao6wsix8ZuCzE
2026-08-28 18:52:31 +02:00
e512bde26f Gate the invariants, fix ECOTE's unrunnable tests, contain build output
Two invariants had been established by hand and left ungated, which is the
"a remedy that only works if someone remembers" pattern:

  - scripts/check_ignore_consistency.sh fails the commit if any TRACKED file
    is also gitignored. .binary-allowlist used to *instruct* the reader to
    re-run that check; now it is enforced. Verified both ways -- passes on the
    tree, and fails when an ignored file is force-added.

DOCS-runnability.md now really has two columns. Each environment writes only
its own gates/runnability-<env>.tsv and the doc renders from both, so a CI run
cannot clobber the local results. The ci tsv is gitignored: committing a copy
generated here would label this machine's capabilities as the runner's.
Rendering it surfaced a classic bug -- awk's NR==FNR idiom silently swallows
the SECOND file when the first is empty, so the table came out with a header
and no rows. It compares FILENAME instead.

runnability.yml deliberately does NOT diff against a committed baseline. A
status is a property of the machine, so `runnable` locally and `blocked` on a
runner is correct rather than drift, and diffing would make the workflow red
by construction. It fails on `error` instead -- a runner that crashes or
reports an unknown kind.

Then five more courses were actually run, because EADS alone had produced four
real bugs and one sample proves nothing:

  - ECOAR and EPFU build (nasm + 32-bit gcc, and gcc respectively).
  - ECOTE's 17 test modules could not run AT ALL. Its package is named `code/`,
    which shadows the standard library: pytest's debugging plugin imports pdb,
    pdb imports code, and it got this directory instead, so the suite died
    with an INTERNALERROR before collecting a single test. Renamed to
    translator/ with all 17 imports updated -- 26 tests now pass.
  - A LaTeX report builds. That one exposed a hazard rather than a bug:
    latexmk wrote its PDF beside the source, and in a course where the built
    name matches the submitted one it would have silently overwritten a
    tracked deliverable. Both the LaTeX and C++ runners now build into a
    gitignored build/, and rebuilding ECOGR leaves `git status` empty.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0172dj34FDpao6wsix8ZuCzE
2026-08-28 18:43:13 +02:00
f7763bb1cd Add a run.sh to every course, and fix the code that would not build
All 44 directories now probe: 38 runnable, 5 no-code, 1 blocked (ENUME needs
MATLAB or Octave, neither of which is on this machine).

The runners are stubs over one shared scripts/course_lib.sh rather than 44
copies of the logic, for the same reason the gates live in ~/utils. A stub
passes its kind as ARGUMENTS -- course_main --kind python --entry ... -- "$@"
-- rather than setting globals, because globals a linter cannot see being read
mean SC2034 on every one of them, and the only cure would be 44 disables.

Fixed along the way:
  - Generating the stubs overwrote Programming/PSD/run.sh, the original
    coursework runner. Restored, and given a --probe early exit instead so it
    is otherwise untouched: it installs packages with sudo and starts Kafka,
    which is exactly what a probe must not trigger.
  - The probe guard only recognised runners containing the literal --probe, so
    the new stubs (which delegate to the library) all read unprobed. It now
    also accepts delegation to course_lib.sh.
  - Blocked probes reported "unknown" because _require_any prints the tool it
    found, so probes redirected its stdout -- swallowing the failure reason
    too. Split into _probe_any, and ENUME now says exactly what it needs.
  - shellcheck runs with -x so it follows the sourced library; without it every
    stub reports SC1091 and the only alternative is a per-file disable. The
    library itself carries `# shellcheck shell=bash` because it has no shebang
    on purpose -- it is sourced, never executed.

Then EADS was actually run, and three of its six C++ files did not compile:
  - lab3.cpp: copyDictionary was declared taking Dictionary* but its body used
    Node members, and the copy constructor called copyTree(), which does not
    exist. The copy also dropped key and balanceFactor. Now compiles AND runs,
    printing its AVL tests.
  - MidTerm/task2.cpp: a const mismatch between declaration and definition, a
    stray semicolon before a function body, findNode calling a Tree method on
    a treeNode*, and a while loop that never advanced. sumNodeSub also had no
    base case -- unreachable before, because the const mismatch meant its body
    was never compiled.
These compiled years ago because older GCC did not diagnose uninstantiated
template bodies. Fragments with no main() are now type-checked with -c rather
than linked, since two of these files are exam answers, not programs.

Binaries go to a gitignored build/ -- an extensionless executable dropped next
to its source is not something .gitignore catches by name.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0172dj34FDpao6wsix8ZuCzE
2026-08-28 18:37:55 +02:00
50263f075a Add pre-commit and fix everything it found
`pre-commit run --all-files` is green. The config only carries hooks whose
subject is already clean, so it stays green at every commit -- file-length,
ruff/mypy and dependency-freshness are listed as blocked, each on its own
cleanup, and the file-REWRITING hooks (trailing-whitespace, end-of-file-fixer)
are held back for their own reviewed commit.

Turning it on found four real things:

1. A committed private key: ERSMS-project/nginx/ssl/nginx.key. It is a
   self-signed CN=localhost cert that had already expired (notAfter
   2025-06-16), so the risk is nil -- but it is regenerable in one openssl
   call, so it is replaced by generate-cert.sh rather than excluded from the
   hook. The script says plainly that removing it from HEAD does NOT
   unpublish it: history is deliberately not rewritten, which is acceptable
   only because nothing ever trusted this key.

2. Four files with unresolved merge conflict markers committed, left over
   from the subtree merges. EARIN/.gitignore and .vscode/extensions.json are
   resolved as the union of both sides. The two Unity folder .meta files each
   had two candidate GUIDs; grepping showed neither is referenced anywhere
   (folder GUIDs rarely are), so either is safe and the HEAD side is kept --
   an arbitrary choice, but a checked one rather than a guess.

3. 62 shellcheck findings across 11 scripts, all fixed, no disables added.
   The interesting pattern was `cd X; cmd &; PID=$!; cd ..`, which trips both
   SC2164 and SC2103 and cannot use a plain subshell without losing the PID.
   `( cd X && exec cmd ) &` keeps the directory, the PID and the semantics.
   EOPSY lab1's submitted solution was verified by RUNNING it afterwards:
   a->A, B->b, foldera->FOLDERA, FOLDERB->folderb, exactly as before.

4. check-json failing on 11 files, which was the wrong parser rather than a
   defect -- tsconfig*.json and .vscode/*.json are JSONC, where TypeScript
   and VS Code both allow comments. Those two path classes are excluded and
   every other .json is still checked. Excluding them is what surfaced the
   merge conflict in (2) as the one genuine failure.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0172dj34FDpao6wsix8ZuCzE
2026-08-28 18:21:22 +02:00
94f965fe3a Add the no-binaries gate with a path-scoped allowlist
621 binaries are tracked here and they are supposed to be: 155 PDFs, 275
PNGs, 68 JPGs, the submitted reports and figures. Decision 3 keeps them and
skips the history rewrite, so a blanket block would be wrong. What the gate
is for is stopping NEW junk.

So the allowlist is scoped by path rather than by extension alone. Documents,
figures and datasets are allowed under Programming/ and NotProgramming/;
compiled output (.o .so .a .exe .dll .dylib .class .pyc) is allowed nowhere
and has no entry at all; and the repo root, gates/, scripts/ and .github/
have no entry either, so a binary dropped in the tooling directories is
blocked. The .tgz entries are load-bearing -- EOPSY ships its simulators as
ftp/{sched,memory}.tgz and `make setup` extracts them.

Verified three ways, because a gate that passes everything is vacuous:
  - all 2749 tracked files          -> exit 0
  - probe.exe at root, probe.png in gates/ -> BLOCKED, exit 1
  - a real submitted PDF            -> exit 0
plus shellcheck clean.

The script is a copy of testsAndMisc's, which is where this gate lives today
-- it is not in the shared ~/utils set. The header says so and says to move
it to ~/utils rather than let the two drift, since a hand-copied gate is what
produced four forks of the 250-line cap.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0172dj34FDpao6wsix8ZuCzE
2026-08-28 17:37:53 +02:00