testsAndMisc/docs/superpowers/evidence/curfew-net-split-2026-08-17.json

{
  "intent": "Bring curfew_enforcer.sh under the 250-line cap by extracting its network-curfew layer into curfew_net.sh, and cover that layer at 100% — it had no test, and it is the code that decides which apps can reach the network overnight.",
  "scope": [
    "phone_focus_mode/curfew_enforcer.sh - 367 lines down to 244",
    "phone_focus_mode/curfew_net.sh - new: night_uids, ensure_net_chain, fill_net_chain, iptw, refresh_uid_cache, rebuild_net_from_cache, net_hold, apply_net, teardown_net",
    "phone_focus_mode/deploy.sh - the new sibling added to both hardcoded lists",
    "phone_focus_mode/lib/tests/curfew_net_harness.sh - new: iptables/ip6tables/pm stubs",
    "phone_focus_mode/lib/tests/curfew_net_cases_chain.sh - new: chain-construction assertions",
    "phone_focus_mode/lib/tests/curfew_net_cases_lifecycle.sh - new: lifecycle assertions",
    "phone_focus_mode/lib/tests/test_curfew_net.sh - new: the entry point",
    "Non-goal: any device deploy. The split is proven with stubs, hashes and output comparison instead."
  ],
  "changes": [
    "Moved the nine network functions with meta/scripts/extract_shell_functions.py. As expected for a #!/system/bin/sh script with no set -e anchor, the tool moved the functions and warned that the source line had to be placed by hand; it was placed after the existing config.sh source, which defines the globals these functions read.",
    "Placed the library as a FLAT SIBLING (phone_focus_mode/curfew_net.sh), not under lib/. deploy.sh pushes phone scripts into one flat directory, so a lib/ path would not exist on the device; dns_iptables.sh and tether_iptables.sh sit beside their enforcers for the same reason. This was caught by reading the deploy lists before committing, not after.",
    "Added curfew_net.sh to both of deploy.sh's hardcoded lists: the adb_cmd push list and the adb_root cp list. It is deliberately NOT added to the chmod 755 list, matching dns_iptables.sh and tether_iptables.sh — sourced files do not need the executable bit on the device.",
    "Left NET_BUILT in the entry script: both files write it, so it is a genuine shared global and neither file assigns something it never reads.",
    "Rewrote two `while ... done < file` loops as pipes. A trailing `done < file` is a line kcov instruments but bash never reports, and those two lines alone held the file at 96.77%. Neither loop reads stdin internally, so the pipe's subshell is immaterial — unlike the pull_apks case in backup_capture.sh, where that same change would reintroduce a known bug.",
    "Added stubs on PATH rather than function mocks: unlike the monitor probes, these functions invoke iptables, ip6tables and pm as real binaries, so the process boundary is where the fake has to sit. The stub logs every call in order, which is what makes rule ordering assertable."
  ],
  "verification": [
    {
      "command": "bash phone_focus_mode/lib/tests/test_curfew_net.sh",
      "result": "pass",
      "evidence": "Results: 41 passed, 0 failed. There was no test for this code before."
    },
    {
      "command": "bash meta/scripts/shell_coverage.sh phone_focus_mode/lib/tests/test_curfew_net.sh curfew_net.sh",
      "result": "pass",
      "evidence": "curfew_net.sh: 60/60 lines = 100.00%, exit 0 at the default 100% minimum. First measured run was 96.77%."
    },
    {
      "command": "mutation run: 17 mutations of the network behaviour, each required to fail the suite",
      "result": "pass",
      "evidence": "17 killed, 0 survived. Includes flipping the 10000-19999 REJECT to ACCEPT (which would disable the whole cut-off), cutting off root, moving the OUTPUT jump off position 1, and passing non-numeric uids to iptables."
    },
    {
      "command": "rule-order assertion inside the suite",
      "result": "pass",
      "evidence": "The REJECT line index is asserted greater than the last ACCEPT line index. Presence assertions alone would pass with the order reversed, which would block every whitelisted app."
    },
    {
      "command": "bash meta/scripts/verify_shell_split.sh 61be666 phone_focus_mode/curfew_enforcer.sh phone_focus_mode/curfew_enforcer.sh phone_focus_mode/curfew_net.sh",
      "result": "pass",
      "evidence": "Reports night_uids and fill_net_chain as differing, which is correct: those are the two functions whose loops were rewritten. Every other function hashes identical."
    },
    {
      "command": "behavioural comparison of the two rewritten functions against their pre-split bodies on identical inputs",
      "result": "pass",
      "evidence": "night_uids emits '10123 10456' from both. fill_net_chain emits an identical 11-rule sequence from both, diffed byte-for-byte including ordering — so the hash differences above carry no behaviour change."
    },
    {
      "command": "shellcheck on each touched file individually (no -x)",
      "result": "pass",
      "evidence": "All seven clean standalone. Two SC2034 findings in the lifecycle cases were fixed by reading the values back rather than by a disable."
    },
    {
      "command": "sh -n phone_focus_mode/curfew_enforcer.sh; sh -n phone_focus_mode/curfew_net.sh",
      "result": "pass",
      "evidence": "Both parse under ash, which is what actually runs them on the device. The enforcer is a daemon loop and is not safe to execute here, so this plus the sourced-library tests is the substitute for running it."
    },
    {
      "command": "grep curfew_net phone_focus_mode/deploy.sh",
      "result": "pass",
      "evidence": "Two hits: the push list at line 382 and the cp list at line 501. Both lists updated, which is the step the brief flags as easy to miss."
    },
    {
      "command": "bash meta/scripts/check_file_length.sh --all",
      "result": "pass",
      "evidence": "20 over-cap files, down from 21. curfew_enforcer.sh 244, curfew_net.sh 156, and the three test files 170/174/121 — all under the cap."
    }
  ],
  "risks": [
    "UNVERIFIED ON DEVICE. This joins tether_enforcer.sh and dns_enforcer.sh as an enforcer split with passing tests and no deploy behind it. If the night curfew's network layer misbehaves after the next deploy, this is one of three places to look.",
    "The library is a new file that must reach the device. If the deploy runs from a stale checkout, or a partial push drops curfew_net.sh, curfew_enforcer.sh will fail to source it and exit immediately rather than running with the net layer disabled. The net layer defaults to off, so the blast radius of it being missing is the whole enforcer, not just the net layer.",
    "The two rewritten loops now run their bodies in a pipe subshell. Neither assigns a variable the caller reads, so nothing is lost today, but a future edit that adds such an assignment inside either loop would silently not take effect."
  ],
  "rollback": [
    "git revert the commit. curfew_enforcer.sh returns to a single 367-line file, over the cap and untested, and deploy.sh stops pushing curfew_net.sh.",
    "After rollback, run sh -n phone_focus_mode/curfew_enforcer.sh expecting exit 0, and confirm grep curfew_net phone_focus_mode/deploy.sh returns nothing.",
    "A rollback AFTER a deploy would leave a stale curfew_net.sh on the device; it is inert once nothing sources it, but remove it from $REMOTE_DIR to avoid confusing a later audit."
  ]
}