testsAndMisc/docs
Krzysztof kuhy Rudnicki 4eedc17b17 Split install_pacman_wrapper.sh into an entry plus four libs
The 316-line installer was 66 over the 250-line cap. The managed-copy helpers,
the /usr/local/bin install step, the integrity + drift manifest, and the
immutability/LeechBlock/VirtualBox payloads move into a sibling lib/, leaving a
128-line entry.

What stays in the entry is chosen by what the harness can execute, not by
taste. `--bind-abs /usr/bin` removes the directory bwrap needs to exec
anything, so the trace stops at `ln -sf ... /usr/bin/pacman` with exit 1 on
EPERM. That line onwards, plus the `if [ ! -L /usr/bin/pacman ]` backup branch
whose guard is false on this machine, therefore never run under trace — moving
them would have shipped code no diff could check. They stay put.

Everything else is proven: the before/after traces are identical, including all
16 generated-file hashes. pacman_wrapper at 548fc2b53ee4cea6 is the one that
matters most — it is post-`sed -i`, so it catches a reorder of the rewrite
relative to the copy.

The path definitions stay in the entry too, for a linter reason rather than a
runtime one: a definitions-only lib assigns without referencing, which is
SC2034 on 36 variables, and suppressions are not allowed. Libs that only
reference globals are fine. `export` would have silenced it while leaking 40
variables into every child process, which the trace cannot see.

Eight assertions across two test libs grep the installer's source text; five
needed widening to search entry+lib/. TEST 9's `chattr +i` grep caught the move
as a genuine failure first, which is what prompted enumerating the rest. No
assertion was weakened.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
2026-08-17 07:42:31 +02:00
..
explanations session_autopsy: badge counts only significant candidates; zero-token aliases 2026-07-25 18:05:49 +02:00
superpowers Split install_pacman_wrapper.sh into an entry plus four libs 2026-08-17 07:42:31 +02:00
app-split-recipes.md Add docs/app-split-recipes.md; update the handoff to 78 left 2026-08-16 20:51:38 +02:00
device-owner-wipe-checklist.md inFakt is SMS-only 2FA, so the wipe cannot strand the account 2026-08-10 20:04:06 +02:00
dns-filtering-parked.md Park phone DNS filtering: Private DNS fails closed, so the PC cannot host it 2026-08-05 10:05:16 +02:00
mcp-shortlist.html docs: add MCP server security-triage shortlist 2026-07-17 19:16:31 +02:00
python-split-recipes.md Apply prettier to the handoff and recipe docs 2026-08-16 18:27:18 +02:00
shared-checkout-safety.md Retarget the handoff on verifiability; split out the shared-checkout doc 2026-08-16 23:10:25 +02:00
shell-split-recipes.md Record the verification lessons; split the recipe doc at the cap 2026-08-16 22:06:08 +02:00
shell-split-verification.md Record the /usr/bin bind limit; retarget the brief at the pacman wrapper 2026-08-17 07:32:37 +02:00
syncyomi-restore-runbook.md syncyomi_guard: refuse a collapsed payload as the new good copy 2026-08-10 15:33:18 +02:00