testsAndMisc/docs/superpowers/evidence/gate-reads-jail-args-2026-08-22.json

{
  "intent": "Close two defects found in review that would each have made the campaign's guarantees hollow: is_covered() ignored the jail_args marker (so 44 features/lib libs could never reach 100% through the gate), and two suites unstubbed a tool with a bare `rm`, which bash's command hash cache makes a no-op.",
  "scope": [
    "meta/scripts/lib/shell_coverage_bar.sh: is_covered() reads jail_args and passes --fail-on-case-error",
    "linux_configuration/scripts/single_use/features/lib/tests/features_harness.sh: new _t_unstub helper",
    ".../tests/test_dwm_config.sh and test_rpi_nc_ca.sh: switched to _t_unstub",
    "Non-goal: test_cco_state.sh's `rm` of beeper.orig -- get_real_binary probes with `[[ -f ]]`, which the hash cache does not affect, so that test is sound"
  ],
  "changes": [
    "GATE DEFECT: is_covered() hardcoded `--bind /etc --bind /usr/local/bin --bind /var/lib` and never read the jail_args file that ci_mirror.sh and shell-tests.yml both consume. The features/lib suite needs /usr/local/share and /etc/pki and ABORTS under set -e without them -- yet the coverage number still printed, because kcov had already recorded whatever the dead run reached. The gate would have graded a lib on a suite that never finished.",
    "is_covered() now reads the marker, falls back to the historical defaults when a suite has none, fails closed on a present-but-empty marker, and passes --fail-on-case-error so a suite that dies partway fails the gate instead of being scored on its stump.",
    "HASH-CACHE DEFECT: the _t_unstub helper written for the transcribe harness was needed in features_harness.sh too. Two assertions were vacuous -- test_dwm_config.sh's 'verify still reports when dwm is absent' and test_rpi_nc_ca.sh's uname removal after the macOS branch, where a cached uname would have left every later branch running under a faked Darwin.",
    "This was found by review rather than by a failing test, which is the point: both defects made checks PASS more easily, so nothing went red."
  ],
  "verification": [
    {
      "command": "bash meta/scripts/check_shell_coverage.sh .../dot_resolver_install.sh",
      "result": "pass",
      "evidence": "exit 0 -- the lib that is already OFF the allowlist still clears the real gate now that the gate reads the marker and enforces case failure."
    },
    {
      "command": "NEGATIVE CONTROL: replace jail_args with `--bind /etc` alone, re-run the gate, restore",
      "result": "pass",
      "evidence": "gate exit=1 with the binds stripped, exit=0 after restoring. Before this commit BOTH cases exited 0 -- the gate could not fail on an aborting suite. git diff --stat on jail_args is empty afterwards."
    },
    {
      "command": "re-measure all four features libs after the _t_unstub fix",
      "result": "pass",
      "evidence": "dot_resolver_install.sh 39/39 = 100.00% (unchanged -- its off-allowlist clearance is sound with real absence enforced), dwm_config.sh 47.95%, rpi_nc_ca.sh 98.63%, aw_autostart.sh 82.93%. No figure moved."
    },
    {
      "command": "the features/lib runner under --fail-on-case-error after the change",
      "result": "pass",
      "evidence": "0 case failures -- every assertion still passes with the tools genuinely absent rather than cached."
    },
    {
      "command": "grep -rn 'rm -f \"$TEST_TMPDIR/bin/' --include='test_*.sh' linux_configuration/",
      "result": "pass",
      "evidence": "Four hits audited. Two fixed; test_aw_autostart.sh's runs in a subshell via $status_script so the parent's cache is irrelevant; test_cco_state.sh probes with [[ -f ]], not command -v."
    }
  ],
  "risks": [
    "is_covered() now runs the full jailed suite per lib with --fail-on-case-error, so a directory whose suite is slow makes the gate slower per file. Hook mode was measured at 0.42s/file before; a jailed suite is seconds, which is why an --all sweep belongs in CI rather than a commit hook.",
    "A suite that legitimately has no jail_args gets the historical default binds. If such a suite later needs a mount it will abort and now correctly fail the gate -- loudly, which is the intended direction, but it is a new way for the gate to go red."
  ],
  "rollback": [
    "git revert the commit; is_covered() returns to hardcoded binds with no case-failure check, and the two suites return to vacuous absence assertions.",
    "After rollback, re-run the negative control: it should exit 0 with the binds stripped, confirming the fail-open behaviour is back."
  ]
}