Krzysztof kuhy Rudnicki 53e80462c5 Phase 3: prove 100% shell coverage is reachable via a namespace jail ... Measurement-only. No production file changed. The gating question was whether the campaign's constraints are jointly satisfiable: 100% line coverage over ALL .sh files with no suppressions. Phase 1 measured effecting code at 0% under PATH shims, which implied either forbidden suppressions or source seams in 17+46 files. They are satisfiable. A user+mount namespace reaches 100% with zero source changes: --map-root-user makes require_root fall through, and bind-mounting each write target makes installer writes land in the jail. setup_night_lockdown.sh went 81.58% (PATH shims) -> 86.84% (userns) -> 100.00% (38/38, all mounts). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F3PzGc75gBcdxP3PkHXGcV		2026-08-21 17:08:05 +02:00
..
contracts	Phase 2: enforce the 250-line cap and stop pushing red	2026-08-21 16:41:31 +02:00
evidence	Phase 3: prove 100% shell coverage is reachable via a namespace jail	2026-08-21 17:08:05 +02:00
memory	style(prettier): apply markdown/json formatting updates	2026-05-07 22:08:00 +02:00
plans	feat(phone-focus): add recovery workflow, automation scripts, and docs	2026-05-01 19:07:27 +02:00
sessions	chore(agent): add governance checks and artifact workflow scaffolding	2026-05-07 22:03:43 +02:00
specs	Bring every markdown file under the cap	2026-08-16 19:25:59 +02:00
workflows	chore(agent): add governance checks and artifact workflow scaffolding	2026-05-07 22:03:43 +02:00