testsAndMisc/docs
Krzysztof kuhy Rudnicki 61ff5eacac Cover nc_php.sh (98.82%) and teach the jail to measure foreign platforms
nc_php.sh was the next-hardest library on the allowlist. It targets a
Debian Raspberry Pi -- it edits /etc/php/<ver>/apache2/php.ini, drives
occ as www-data and installs a crontab -- so none of its write targets
exist on this Arch host and the jail had nothing to mirror.

- --seed-dir / --seed-file create the paths a foreign-platform subject
  expects. Verified with a probe: /etc/php/8.2/apache2 exists inside
  the jail while /etc/php does not exist outside it.
- A failed bind is now FATAL, and missing mountpoints are created
  first. A bind that fails silently is indistinguishable from
  unreachable code in the report, which is the misdiagnosis this
  runner exists to prevent.
- Mirroring skips unreadable targets (/root as a normal user) rather
  than aborting under set -e.

nc_php.sh: 84/85 = 98.82%, 24 assertions. It STAYS on the allowlist,
because 98.82% is below the bar. Line 111 -- the crontab first-run
fallback -- hung the suite on both attempts to cover it, so it is left
uncovered and documented rather than tried a third time.

Two harness hazards found the hard way and written down: a top-level
stub function shadows the subject's own function for every later
assertion (this silently dropped coverage 83.53% -> 57.65% while the
tests still passed), and a stub for a piped-into command must drain
stdin or the writer takes SIGPIPE.

dot_resolver_install.sh still measures 39/39 = 100.00%.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DbD4nco3EgL1UFoZKmKsLE
2026-08-22 11:30:32 +02:00
..
explanations session_autopsy: badge counts only significant candidates; zero-token aliases 2026-07-25 18:05:49 +02:00
superpowers Cover nc_php.sh (98.82%) and teach the jail to measure foreign platforms 2026-08-22 11:30:32 +02:00
agent-harness-evaluation-2026-08-18.md docs/agent-harness-evaluation-2026-08-18.md: fix prettier formatting 2026-08-18 21:08:01 +02:00
app-split-recipes.md Add docs/app-split-recipes.md; update the handoff to 78 left 2026-08-16 20:51:38 +02:00
device-owner-wipe-checklist.md inFakt is SMS-only 2FA, so the wipe cannot strand the account 2026-08-10 20:04:06 +02:00
dns-filtering-parked.md Park phone DNS filtering: Private DNS fails closed, so the PC cannot host it 2026-08-05 10:05:16 +02:00
mcp-shortlist.html docs: add MCP server security-triage shortlist 2026-07-17 19:16:31 +02:00
python-split-recipes.md Apply prettier to the handoff and recipe docs 2026-08-16 18:27:18 +02:00
shared-checkout-safety.md Retarget the handoff on verifiability; split out the shared-checkout doc 2026-08-16 23:10:25 +02:00
shell-split-harness.md docs: split shell-split-verification.md 272 -> 78 + harness 2026-08-17 10:54:52 +02:00
shell-split-recipes.md docs: split shell-split-verification.md 272 -> 78 + harness 2026-08-17 10:54:52 +02:00
shell-split-verification.md shell: split clean_audio, enforce_vbox_hosts and migrate_hosts_guard 2026-08-17 14:27:57 +02:00
syncyomi-restore-runbook.md syncyomi_guard: refuse a collapsed payload as the new good copy 2026-08-10 15:33:18 +02:00