mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-11 17:54:03 +01:00
Krzysztof kuhy Rudnicki
7dc3c94160
The brief's prescribed safety net for this file DOES NOT WORK, and that is
the main finding here. It specifies asdict + json.dumps(default=str) +
sha256 against baseline 1624750c. Four policy fields are frozenset, which
json cannot encode, so default=str stringifies them in SET ITERATION ORDER
-- random per process. Three consecutive runs gave three different digests;
pinning PYTHONHASHSEED=0 gave one. The recipe can never match a recorded
baseline, so it would have flagged every split as a regression regardless
of correctness.
The repo already ships a deterministic serializer. Before trusting it I
checked it was not a weaker proxy: policy_to_json emits all 16 dataclass
fields plus 6 more, so it is strictly stronger than asdict. Baseline
83e05e82, unchanged through all six extractions.
Two audits ran BEFORE any extraction:
- the loader regex-scans config.sh's TEXT ALONE, so the fifteen names it
reads are pinned here. Moving one does not error -- it silently yields
an empty set, and for WHITELIST that reads as "hide everything".
- extractions are variable-scoped, never line-range. A line-range attempt
cut through the WHITELIST string, leaving an unterminated quote; 15
variables vanished from the environment WHILE THE FINGERPRINT STILL
MATCHED, because the loader's regex tolerated the mangled file. That is
why the environment diff exists alongside the hash.
The environment check earned its keep twice: it also caught STATE_DIR being
left behind the source line, which expanded every path against an empty
prefix (/status.json rather than the real path) with the policy hash green
throughout. 79 variables, byte-identical either side, and every parsed list
compared entry-by-entry: 29/16/46/1/1/2/15, all matching.
Rationale prose moves to docs/policy-lists.md with pointers left behind,
including the blocks inside the list strings -- the loader and the shell
both ignore '#' lines there.
All five siblings are in both deploy lists. deploy.sh still sources the
chain from the checkout, run_phone.sh --help exits 0, 379 shell assertions
pass across nine suites, and focus_policy's 137 pytest cases pass.
config.sh is at EXACTLY 250 with no headroom; 184 of those lines are
loader-pinned lists that cannot move. Over-cap count 18 -> 17.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
22 lines
2.5 KiB
JSON
22 lines
2.5 KiB
JSON
{
|
|
"title": "Split config.sh under the cap without changing the policy it defines",
|
|
"objective": "Take phone_focus_mode/config.sh from 571 lines to under the repo's 250-line cap by moving per-enforcer settings into siblings, while proving the parsed policy and the sourced shell environment are both unchanged. Every phone script sources this file and deploy.sh sources it from the checkout, so a mistake here stops the entire stack rather than degrading one enforcer.",
|
|
"acceptance_criteria": [
|
|
"bash meta/scripts/check_file_length.sh --all no longer lists phone_focus_mode/config.sh, and no new file is over the cap.",
|
|
"The policy fingerprint is byte-identical before and after: python3 -m python_pkg.focus_policy --config phone_focus_mode/config.sh | sha256sum.",
|
|
"The SOURCED SHELL ENVIRONMENT is also identical — same variable count, same values. The fingerprint alone is insufficient: the loader reads only the fifteen names it parses, so a broken path expansion in any other variable is invisible to it.",
|
|
"Every one of the fifteen loader-visible variables stays in config.sh. The loader regex-scans that file's text alone, so a name moved to a sibling silently parses as empty rather than erroring.",
|
|
"No extraction may cut through a multi-line quoted value; each moved variable is taken from its assignment through the line closing its quote.",
|
|
"All five siblings are added to BOTH of deploy.sh's hardcoded lists, and the lists remain in exact correspondence.",
|
|
"shellcheck passes on each touched file individually; sh -n passes on every config file; bash -n passes on config.sh.",
|
|
"pytest python_pkg/focus_policy passes, and every phone-side shell suite still passes with an unchanged assertion count."
|
|
],
|
|
"out_of_scope": [
|
|
"Deploying to the phone or verifying on-device.",
|
|
"Changing any package list, prefix, threshold, interval or path value.",
|
|
"Moving any loader-visible variable, however tempting for line count — WHITELIST and SYSTEM_NEVER_DISABLE alone are 122 lines and must stay.",
|
|
"Splitting deploy.sh or focus_ctl.sh, which are separate later items."
|
|
],
|
|
"verifier": "python3 -m python_pkg.focus_policy --config phone_focus_mode/config.sh | sha256sum (expects 83e05e82dd1683e1dff1c79a96fec0a4a56aa73295604c681ae355b40a590ba3), plus a diff of the sourced environment against the pre-split commit showing 79 identical variables, plus check_file_length.sh --all showing 17 files, plus every phone test suite at its previous count, plus pytest python_pkg/focus_policy at 137 passed."
|
|
}
|