From de4b26613585f9a25df40c9faf7cb06270431d02 Mon Sep 17 00:00:00 2001 From: Krzysztof kuhy Rudnicki Date: Sun, 23 Aug 2026 14:13:01 +0200 Subject: [PATCH] Take nvidia_config.sh off the allowlist for real (85 -> 84) The deletion did not survive the seam-restore commit, so the exemption was still in place and the gate was passing on it rather than on coverage. Measured 76/76 = 100.00% with the gate's own jail flags, in a detached worktree -- the main tree aborts the jail right now because another agent is editing python_pkg/endurain_import concurrently and the tree fingerprint reads that as a write escaping the jail. Co-Authored-By: Claude Opus 5 (1M context) --- .../nvidia-config-allowlist-2026-08-23.json | 33 +++++++++++++++++++ meta/shell-coverage-allowlist.txt | 1 - 2 files changed, 33 insertions(+), 1 deletion(-) create mode 100644 docs/superpowers/evidence/nvidia-config-allowlist-2026-08-23.json diff --git a/docs/superpowers/evidence/nvidia-config-allowlist-2026-08-23.json b/docs/superpowers/evidence/nvidia-config-allowlist-2026-08-23.json new file mode 100644 index 00000000..ce1f8121 --- /dev/null +++ b/docs/superpowers/evidence/nvidia-config-allowlist-2026-08-23.json @@ -0,0 +1,33 @@ +{ + "intent": "Remove nvidia_config.sh's coverage exemption, which was reinstated when an earlier commit's allowlist deletion did not survive alongside the seam restore.", + "scope": [ + "meta/shell-coverage-allowlist.txt (one line removed)", + "Non-goal: any code change; the lib and its tests are already correct" + ], + "changes": [ + "Deleted the fixes/lib/nvidia_config.sh line from the allowlist, taking it from 85 to 84 entries" + ], + "verification": [ + { + "command": "shell_coverage_jail.sh with the gate's own flags (--bind /etc --bind /usr/local/bin --bind /var/lib), in a detached worktree", + "result": "pass", + "evidence": "nvidia_config.sh: 76/76 lines = 100.00%." + }, + { + "command": "The same measurement in the main working tree", + "result": "fail", + "evidence": "'the subject modified the working tree; a write escaped the jail', listing python_pkg/endurain_import files another agent was editing concurrently. This is a false positive from the jail's tree fingerprint, which is why the real measurement was taken in an isolated worktree." + }, + { + "command": "grep for the four seams in nvidia_config.sh", + "result": "pass", + "evidence": "All four present at lines 26, 27, 60 and 85. An earlier `grep -c 'XORG_CONF:-'` returning 1 counted matching LINES, not seams, and briefly looked like a regression." + } + ], + "risks": [ + "The coverage gate cannot be trusted while another agent is writing to the same working tree; any measurement must be taken in a detached worktree or it may abort on their churn." + ], + "rollback": [ + "Re-add the nvidia_config.sh line to meta/shell-coverage-allowlist.txt" + ] +} diff --git a/meta/shell-coverage-allowlist.txt b/meta/shell-coverage-allowlist.txt index 01cdcb65..d34afa9c 100644 --- a/meta/shell-coverage-allowlist.txt +++ b/meta/shell-coverage-allowlist.txt @@ -75,7 +75,6 @@ linux_configuration/scripts/single_use/features/lib/wg_keys.sh linux_configuration/scripts/single_use/features/lib/wg_sshd.sh linux_configuration/scripts/single_use/fixes/lib/arch_sysctl.sh linux_configuration/scripts/single_use/fixes/lib/bt_adapter.sh -linux_configuration/scripts/single_use/fixes/lib/nvidia_config.sh linux_configuration/scripts/single_use/fixes/lib/pacman_hook_stall_setup.sh linux_configuration/scripts/single_use/fresh-install/lib/packages.sh linux_configuration/scripts/single_use/lib/joplin_server.sh