testsAndMisc/docs/superpowers/contracts/check-and-enable-services-coverage-2026-08-21.json
Krzysztof kuhy Rudnicki 0a69d18390 check_and_enable_services: 100% coverage via a redirectable path prefix
Follow-up to 9085a4e5, which recorded services_units.sh at 84.51% because
its remaining branches sit behind [[ -f /etc/systemd/system/*.service ]] --
absolute root-owned paths that exist on this machine, so the else-branch
never runs and no PATH shim can redirect it.

All 87 such paths across the seven check libs now go through $SYSROOT, read
from SERVICES_ROOT. The prefix is deliberately NOT defaulted. Three commands
in hosts_fix_resolved run outside `run` and so are not stopped by --dry-run
(chattr -i on resolved.conf.d, find -delete over its *.conf, and an append to
resolved.conf); with an empty default, a test that forgot to set SERVICES_ROOT
would really delete this machine's resolved.conf drop-ins. Unset is therefore
a hard error and only an explicitly empty value means the real filesystem.

The harness now owns PATH outright: $FAKE_BIN for shims and staged fake apps,
$REAL_BIN for a curated set of symlinks to genuine coreutils. The machine's
/usr/bin is deliberately absent -- a really-installed discord and chromium
otherwise make the "no target apps present" branches untestable, which is
exactly what happened until these tests caught it.

Coverage, measured against run_all.sh because two test files jointly cover
services_common.sh after the 250-cap split: common 55/55, report 27/27,
units 72/72 (was 84.51%), wrappers 100/100, apps 66/66, browser 79/79 --
seven libs at 100%. services_hosts.sh reads 86.05% and services_hosts_fix.sh
97.30%, and those 14 lines are a kcov attribution artifact rather than a gap.
Falsified rather than assumed: the suite prints "51 passed, 0 failed" when run
under kcov, so no group is skipped, and every supposedly-uncovered line is an
issues+=("...") whose string can only reach stdout through the print loop
below it -- with a passing assertion matching that exact string.

Two falsification checks, both re-run after the rewrite: `--status --dry-run`
as root stays byte-identical to rev 6691cb26 modulo the Date: line, and the
sha256sums of /etc/hosts, /etc/nsswitch.conf and /etc/systemd/resolved.conf
plus the contents of resolved.conf.d are unchanged across a full suite run.
The second one is what makes a missed prefix site detectable instead of a
matter of inspection: the repair paths really do write.

220 assertions across 8 test files. Also fixes a bug in the harness's own
lsattr shim, where printf with a leading-dash format string parsed the dashes
as options and silently produced nothing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F3PzGc75gBcdxP3PkHXGcV
2026-08-21 14:08:11 +02:00

20 lines
2.3 KiB
JSON

{
"title": "Reach 100% coverage on the check_and_enable_services libs via a redirectable path prefix",
"objective": "Make the absolute root-owned paths the check libs probe redirectable through a $SYSROOT prefix, so the file-existence branches become reachable in tests and the eight libs from 9085a4e5 reach 100% line coverage. This is the follow-up the user chose (option b): split first with measured coverage recorded, then close the gap in its own commit.",
"acceptance_criteria": [
"Every absolute /usr, /etc and /var path in the seven check libs is prefixed with $SYSROOT; the only literals left are inside services_report.sh's usage help text.",
"SERVICES_ROOT has no default in the libs: unset is a hard error, empty means the real filesystem, and check_and_enable_services.sh sets it explicitly.",
"sudo bash check_and_enable_services.sh --status --dry-run stays byte-identical to the same command at rev 6691cb26, modulo the Date: line.",
"sha256sum of /etc/hosts, /etc/nsswitch.conf and /etc/systemd/resolved.conf plus the contents of /etc/systemd/resolved.conf.d are unchanged across a full suite run.",
"shell_coverage.sh against lib/tests/run_all.sh reports 100% for every lib, or records a measured figure with a falsified diagnosis for any shortfall.",
"Every file including the test files is at or under 250 lines.",
"shellcheck reports zero findings standalone and with -x, with no suppression added."
],
"out_of_scope": [
"The latent status-downgrade bug in the three unit checks, where an unconditional status=\"warning\" on the is-active branch overwrites the status=\"error\" from is-enabled, so a timer that is both disabled and inactive is never repaired. Still pinned and named by the tests; it changes live enforcement and earns its own commit.",
"Any behaviour change: the prefix is empty in production and the live output diff is the proof.",
"The other six files still over the 250-line cap."
],
"verifier": "lib/tests/run_all.sh (220 assertions, 0 failures), bash meta/scripts/shell_coverage.sh lib/tests/run_all.sh <lib> 100 for all eight libs, a diff of sudo bash check_and_enable_services.sh --status --dry-run against rev 6691cb26, a before/after sha256sum of the three /etc files, grep for unprefixed absolute paths, shellcheck, and check_file_length.sh --all."
}