mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-13 00:10:53 +01:00
Krzysztof kuhy Rudnicki
bca70b67b5
The gate was a presence check -- 'a run_all.sh exists beside this lib' -- which an empty suite that asserts nothing satisfies. It now measures. 100% is reachable with no suppressions and no production source changes: run the suite inside a user+mount namespace and the sudo-writes, systemd units and nftables rules execute for real against a throwaway /etc. - meta/scripts/shell_coverage_jail.sh: the runner, promoted out of a session scratchpad. Two fixes it needed on the way: bind targets mirror the real directory tree (an empty bind makes writes fail with ENOENT, which reads as unreachable code), and sudo gets a pass-through stub because real sudo cannot setresuid inside a userns. - It fingerprints git status before and after and fails the run if a write escapes the jail. Verified with a deliberate escapee. - dot_resolver_install.sh: 39/39 = 100.00%, 28 assertions. Picked by scoring every allowlisted lib on root ops, system writes and destructive calls -- it scored highest in the repo. Allowlist 106 -> 105. - jscpd was already over its own threshold at 2.45% and would have rejected every commit staging a .sh file. Excluding vendored .venv/ shell alone gives 1.67%; also excluding lib/tests/ gives 1.47%. The gate is deliberately NOT wired into the hook chain yet. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DbD4nco3EgL1UFoZKmKsLE |
||
|---|---|---|
| .. | ||
| fixtures | ||
| lib | ||
| run_all | ||
| _schema_validation.py | ||
| _session_autopsy_mutations.py | ||
| check_agent_contract.sh | ||
| check_ai_evidence.sh | ||
| check_append_only_sessions.sh | ||
| check_ci_green.sh | ||
| check_file_length.sh | ||
| check_no_binaries.sh | ||
| check_no_dufs_conf.sh | ||
| check_no_inline_python.sh | ||
| check_no_secrets.sh | ||
| check_polling_antipatterns.sh | ||
| check_python_location.sh | ||
| check_requirements_sync.py | ||
| check_shell_coverage.sh | ||
| ci_mirror.sh | ||
| disk_cleanup_check.sh | ||
| extract_shell_functions.py | ||
| init_agent_artifacts.sh | ||
| install_hooks.sh | ||
| makepkg-manual-dlagent.sh | ||
| mutate_session_autopsy_hooks.py | ||
| mutate_shell.py | ||
| pytest_changed_packages.py | ||
| run_prettier_capped.sh | ||
| run_with_heavy_lock.sh | ||
| shell_coverage_jail.sh | ||
| shell_coverage_report.py | ||
| shell_coverage.sh | ||
| trace_shell_split.sh | ||
| validate_contract.py | ||
| validate_evidence.py | ||
| verify_shell_split.sh | ||