testsAndMisc/docs/superpowers/contracts/shell-coverage-gate-2026-08-17.json
Krzysztof kuhy Rudnicki a174b2a3c4 meta: measurable shell coverage, and dns_iptables.sh at 100%
kcov works here once invoked correctly, so shell coverage is measurable
after all. shell_coverage.sh wraps it as a gate; the XML parsing lives in
shell_coverage_report.py per the rule against inlining another language's
logic in a shell script.

Two kcov traps are documented in the wrapper because both fail silently.
It must be handed the test script DIRECTLY: given `bash script.sh` it
instruments the bash binary, finds no shell source, and reports 0/0 at
0.00% -- indistinguishable from "nothing is covered". And per-line detail
exists only in cov.xml; coverage.json carries the percentage alone, so it
cannot say which lines are missing.

First measurement put dns_iptables.sh at 68/74 = 91.89%, with all six
uncovered lines in error and edge branches: chain creation failing, jump
insertion failing, the stale-jump de-dupe log, and the v6 trusted-resolver
ACCEPT. The stub grew failure injection and jump seeding to reach them,
and four new cases take it to 74/74 = 100.00%.

The gate fails closed: deleting the three ensure_chain failure cases drops
it to 93.24%, names lines 23, 24, 37, 40, 41, and exits 1.

Not wired into pre-commit -- kcov is absent on CI, and most shell files
here have no test at all.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
2026-08-17 15:29:08 +02:00

18 lines
1.0 KiB
JSON

{
"title": "measurable shell coverage, and dns_iptables.sh at 100%",
"objective": "Provide a working kcov-based line-coverage gate for shell libraries, then use it to close every uncovered line in dns_iptables.sh.",
"acceptance_criteria": [
"shell_coverage.sh reports dns_iptables.sh at 100.00% and exits 0",
"Removing coverage-critical tests drops it below 100%, names the uncovered lines, and exits 1",
"test_dns_iptables.sh reports 24 passed, 0 failed",
"The subject under test is unchanged: verify_shell_split.sh against 728301c still reports all 14 functions verbatim",
"pre-commit passes on every changed file with zero lint suppressions"
],
"out_of_scope": [
"Wiring coverage into pre-commit or CI — kcov is not installed on CI and most shell files have no test",
"Branch coverage, which kcov does not provide for shell",
"Any behavioural change to dns_iptables.sh"
],
"verifier": "bash meta/scripts/shell_coverage.sh phone_focus_mode/lib/tests/test_dns_iptables.sh dns_iptables.sh"
}