2 Commits

Author	SHA1	Message	Date
Krzysztof kuhy Rudnicki	7dc3c94160	config.sh: split 571 -> 250, with a fingerprint that actually works ... The brief's prescribed safety net for this file DOES NOT WORK, and that is the main finding here. It specifies asdict + json.dumps(default=str) + sha256 against baseline 1624750c. Four policy fields are frozenset, which json cannot encode, so default=str stringifies them in SET ITERATION ORDER -- random per process. Three consecutive runs gave three different digests; pinning PYTHONHASHSEED=0 gave one. The recipe can never match a recorded baseline, so it would have flagged every split as a regression regardless of correctness. The repo already ships a deterministic serializer. Before trusting it I checked it was not a weaker proxy: policy_to_json emits all 16 dataclass fields plus 6 more, so it is strictly stronger than asdict. Baseline 83e05e82, unchanged through all six extractions. Two audits ran BEFORE any extraction: - the loader regex-scans config.sh's TEXT ALONE, so the fifteen names it reads are pinned here. Moving one does not error -- it silently yields an empty set, and for WHITELIST that reads as "hide everything". - extractions are variable-scoped, never line-range. A line-range attempt cut through the WHITELIST string, leaving an unterminated quote; 15 variables vanished from the environment WHILE THE FINGERPRINT STILL MATCHED, because the loader's regex tolerated the mangled file. That is why the environment diff exists alongside the hash. The environment check earned its keep twice: it also caught STATE_DIR being left behind the source line, which expanded every path against an empty prefix (/status.json rather than the real path) with the policy hash green throughout. 79 variables, byte-identical either side, and every parsed list compared entry-by-entry: 29/16/46/1/1/2/15, all matching. Rationale prose moves to docs/policy-lists.md with pointers left behind, including the blocks inside the list strings -- the loader and the shell both ignore '#' lines there. All five siblings are in both deploy lists. deploy.sh still sources the chain from the checkout, run_phone.sh --help exits 0, 379 shell assertions pass across nine suites, and focus_policy's 137 pytest cases pass. config.sh is at EXACTLY 250 with no headroom; 184 of those lines are loader-pinned lists that cannot move. Over-cap count 18 -> 17. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY	2026-08-17 17:17:02 +02:00
Krzysztof kuhy Rudnicki	094c4765f3	focus_daemon: split 543 -> 206 + 165 + 140 + 94, with 110 tests ... Location/curfew goes to daemon_location.sh, the derived state files to daemon_state.sh, the app layer to daemon_apps.sh. All 23 functions moved verbatim -- nothing restructured, which matters more here than anywhere else in this session. focus_daemon.sh has five `while IFS= read -r pkg; do ... done <file` loops and EVERY body calls pm. Piping any of them in lets pm inherit and drain the loop's stdin, so it would process one package instead of all of them -- measured elsewhere in this repo as 1 of 54. That audit ran BEFORE the extraction, not after coverage came back short, and all five moved untouched with a note above them saying why. CURRENT_MODE and _CURFEW_TICK_CACHED are each written in both the entry script and a library, so both stay declared with main, same call as NET_BUILT in the curfew split. 110 assertions and 33 mutations, all killed. Two survived the first run and both were defects in my own tests: the whitelist and sysprotect exactness checks used a SUPERSTRING of a listed entry, which fails under grep -qF and grep -qxF alike and so proved nothing about which was in use. Two subjects are NOT at 100%, and the numbers are reported as measured: daemon_state.sh 67/67 = 100.00% daemon_location.sh 26/40 = 65.00% daemon_apps.sh 71/76 = 93.42% Both shortfalls are kcov attribution failures, shown to be artifacts rather than gaps. daemon_location.sh's missing lines are all inside the embedded awk Haversine; mutating the Earth radius and dropping the longitude term both fail the suite, and an isolated probe shows a one-line awk measuring 100% where the identical multi-line one measures 0%. Collapsing the formula to satisfy the tool would cost the readability of the only real mathematics in the repo, so it stays. daemon_apps.sh's five are the trailing `done <file` of the very loops described above. That is the same artifact piping fixed in curfew_net.sh, and it is exactly what must NOT be done here. Redirecting two of them from /dev/null fails the suite, so the lines run; all three are pinned in the mutation spec instead. Over-cap count 19 -> 18. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY	2026-08-17 16:54:04 +02:00