From db4d9473519946123cb9ed0e40e056359b52b172 Mon Sep 17 00:00:00 2001 From: Krzysztof kuhy Rudnicki Date: Sun, 23 Aug 2026 21:10:14 +0200 Subject: [PATCH] Record the vendor-closure and broad-scan findings in the evidence Two post-push audits, both worth keeping. vendor/common.sh sources three sibling libs unconditionally and only common.sh had been vendored, so every entry point printed three "No such file or directory" errors. Every suite passed anyway -- the functions in use are defined above that block and a failed sibling source is non-fatal -- which is exactly why it needed its own test. Fixed in digital-wellbeing c5eb028. A grep across /etc, /usr/local and /usr/bin, broader than report_live_state.sh (which reads only /usr/local/{bin,lib}, units and symlinks), found three references. None from this work: pw_guard.sh's target still exists, and dwm-session carries two pre-existing single_use/ paths. dwm is dormant and was deliberately abandoned, so that one is reported rather than changed. Also records that digital_wellbeing/data/ was safe to delete: never tracked on any historical path, and no script in the unit references data/ at all. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01PJrqKERAo5QUeEHWS5Asgp --- .../extract-digital-wellbeing-2026-08-23.json | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/docs/superpowers/evidence/extract-digital-wellbeing-2026-08-23.json b/docs/superpowers/evidence/extract-digital-wellbeing-2026-08-23.json index e48de6d6..63483736 100644 --- a/docs/superpowers/evidence/extract-digital-wellbeing-2026-08-23.json +++ b/docs/superpowers/evidence/extract-digital-wellbeing-2026-08-23.json @@ -76,13 +76,24 @@ "command": "shellcheck on all nine changed shell files", "result": "pass", "evidence": "ALL CLEAN, no severity filter." + }, + { + "command": "source vendor/common.sh in a subshell and inspect stderr (post-push audit)", + "result": "fail", + "evidence": "Three 'No such file or directory' errors: common.sh sources common_packages.sh, common_services.sh and common_datetime.sh unconditionally, and only common.sh had been vendored. Every suite still passed -- the four functions used are defined above that block, and a failed source of a sibling is non-fatal -- so nothing caught it. Fixed in digital-wellbeing c5eb028 by vendoring all four and adding tests/test_vendor_closure.sh, verified to fail when any sibling is removed." + }, + { + "command": "sudo grep -rl 'testsAndMisc/linux_configuration/(scripts|periodic_background)' /etc /usr/local /usr/bin", + "result": "pass", + "evidence": "Broader than report_live_state.sh, which greps only /usr/local/{bin,lib} plus units and symlinks. Three hits, none from this work: pw_guard.sh names a path that still exists, and /usr/local/bin/dwm-session carries two pre-existing single_use/ paths from the flatten. dwm is dormant (lightdm user-session=i3, no dwm process) and one of its targets no longer exists anywhere -- reported, not changed, since dwm was deliberately abandoned." } ], "risks": [ "vendor/common.sh duplicates 163 lines of the monorepo lib. The two copies may drift; that is accepted, and the README says so, so a future session does not 're-fix' it by re-coupling the repos.", "The pacman wrapper's drift manifest is regenerated by the checker's own fix path. A machine that clones digital-wellbeing to a non-default location must re-run install_pacman_wrapper.sh or the manifest will name the wrong paths.", "install_core_system.sh on a fresh machine now hard-stops at three modules until both extracted repos are cloned. Deliberate and loud; INSTALLER_FIX_TASK.md tracks fresh-machine installer defects.", - "The depth cap is now enforcing, so any future path more than two directories deep is a hard commit failure rather than a warning." + "The depth cap is now enforcing, so any future path more than two directories deep is a hard commit failure rather than a warning.", + "digital_wellbeing/data/ (2 untracked files) went with the rm -rf. Verified safe to lose: it was never tracked on any historical path, and no script in the unit -- blocker, seeders or libs -- references data/ at all." ], "rollback": [ "git revert this commit to restore the unit, the six suites, the two test libs and every rewired caller, and to put --warn back on the depth hook.",