Take nvidia_config.sh off the allowlist for real (85 -> 84)
Some checks are pending
Pre-commit checks / pre-commit (push) Waiting to run
Shell tests / shell-tests (push) Waiting to run
Shell tests / arch-tests (push) Waiting to run

The deletion did not survive the seam-restore commit, so the exemption
was still in place and the gate was passing on it rather than on
coverage. Measured 76/76 = 100.00% with the gate's own jail flags, in a
detached worktree -- the main tree aborts the jail right now because
another agent is editing python_pkg/endurain_import concurrently and the
tree fingerprint reads that as a write escaping the jail.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Krzysztof Rudnicki 2026-08-23 14:13:01 +02:00
parent b399fab56d
commit de4b266135
2 changed files with 33 additions and 1 deletions

View File

@ -0,0 +1,33 @@
{
"intent": "Remove nvidia_config.sh's coverage exemption, which was reinstated when an earlier commit's allowlist deletion did not survive alongside the seam restore.",
"scope": [
"meta/shell-coverage-allowlist.txt (one line removed)",
"Non-goal: any code change; the lib and its tests are already correct"
],
"changes": [
"Deleted the fixes/lib/nvidia_config.sh line from the allowlist, taking it from 85 to 84 entries"
],
"verification": [
{
"command": "shell_coverage_jail.sh with the gate's own flags (--bind /etc --bind /usr/local/bin --bind /var/lib), in a detached worktree",
"result": "pass",
"evidence": "nvidia_config.sh: 76/76 lines = 100.00%."
},
{
"command": "The same measurement in the main working tree",
"result": "fail",
"evidence": "'the subject modified the working tree; a write escaped the jail', listing python_pkg/endurain_import files another agent was editing concurrently. This is a false positive from the jail's tree fingerprint, which is why the real measurement was taken in an isolated worktree."
},
{
"command": "grep for the four seams in nvidia_config.sh",
"result": "pass",
"evidence": "All four present at lines 26, 27, 60 and 85. An earlier `grep -c 'XORG_CONF:-'` returning 1 counted matching LINES, not seams, and briefly looked like a regression."
}
],
"risks": [
"The coverage gate cannot be trusted while another agent is writing to the same working tree; any measurement must be taken in a detached worktree or it may abort on their churn."
],
"rollback": [
"Re-add the nvidia_config.sh line to meta/shell-coverage-allowlist.txt"
]
}

View File

@ -75,7 +75,6 @@ linux_configuration/scripts/single_use/features/lib/wg_keys.sh
linux_configuration/scripts/single_use/features/lib/wg_sshd.sh
linux_configuration/scripts/single_use/fixes/lib/arch_sysctl.sh
linux_configuration/scripts/single_use/fixes/lib/bt_adapter.sh
linux_configuration/scripts/single_use/fixes/lib/nvidia_config.sh
linux_configuration/scripts/single_use/fixes/lib/pacman_hook_stall_setup.sh
linux_configuration/scripts/single_use/fresh-install/lib/packages.sh
linux_configuration/scripts/single_use/lib/joplin_server.sh