testsAndMisc/docs
Krzysztof kuhy Rudnicki 7845ddfe12 Shell ratchet: fix tests/lib misread, enforce shrink-only, correct docs
Three review findings, all before the hook is wired:

is_shell_lib excluded */lib/tests/* but not */tests/lib/*. Both are test
code; the second nesting made the gate demand tests/lib/tests/run_all.sh
for 10 helper files. It would have fired precisely while editing test
helpers to write the suites this ratchet asks for. Reseeded 125 -> 115.

--seed now refuses (exit 1) when a reseed would ADD an entry, instead of
a header comment asking nicely. It reads tracked files only, so an
unstaged probe seeds normally -- staging it produces the refusal with
the allowlist left byte-identical.

The parent commit's docs claimed an exempt file loses its exemption when
next modified. It does not: check_files exempts allowlisted paths
unconditionally, verified by staging an edit and getting exit 0. Fixed
the text, not the code -- making an edit trip the gate would block
routine work across 115 of 198 libraries, which is the repo-wide gate
this ratchet exists to avoid.

Also corrects the "a percentage is unreachable" rationale: commit
53e80462 reached 100% on an entry script with no suppressions. Presence
is still the right bar, because that took per-file mount analysis.
2026-08-21 17:09:20 +02:00
..
explanations session_autopsy: badge counts only significant candidates; zero-token aliases 2026-07-25 18:05:49 +02:00
superpowers Shell ratchet: fix tests/lib misread, enforce shrink-only, correct docs 2026-08-21 17:09:20 +02:00
agent-harness-evaluation-2026-08-18.md docs/agent-harness-evaluation-2026-08-18.md: fix prettier formatting 2026-08-18 21:08:01 +02:00
app-split-recipes.md Add docs/app-split-recipes.md; update the handoff to 78 left 2026-08-16 20:51:38 +02:00
device-owner-wipe-checklist.md inFakt is SMS-only 2FA, so the wipe cannot strand the account 2026-08-10 20:04:06 +02:00
dns-filtering-parked.md Park phone DNS filtering: Private DNS fails closed, so the PC cannot host it 2026-08-05 10:05:16 +02:00
mcp-shortlist.html docs: add MCP server security-triage shortlist 2026-07-17 19:16:31 +02:00
python-split-recipes.md Apply prettier to the handoff and recipe docs 2026-08-16 18:27:18 +02:00
shared-checkout-safety.md Retarget the handoff on verifiability; split out the shared-checkout doc 2026-08-16 23:10:25 +02:00
shell-split-harness.md docs: split shell-split-verification.md 272 -> 78 + harness 2026-08-17 10:54:52 +02:00
shell-split-recipes.md docs: split shell-split-verification.md 272 -> 78 + harness 2026-08-17 10:54:52 +02:00
shell-split-verification.md shell: split clean_audio, enforce_vbox_hosts and migrate_hosts_guard 2026-08-17 14:27:57 +02:00
syncyomi-restore-runbook.md syncyomi_guard: refuse a collapsed payload as the new good copy 2026-08-10 15:33:18 +02:00