dan-claude-bot ce9ec684d1 test(cli): drive box-firewall under a shim ufw, and the doctor's UFW findings ... The real script, driven end to end (the setup-host seam): a fake ufw serves canned status tables and logs every mutation, fake nft/sysctl/iptables swallow the rest, the shim ip answers the live-bridge read. Proven: a remapped bridge converges (stale tcp+udp allows deleted, live gateway's inserted, live rules never deleted), an agreeing host deletes nothing, a fresh host gets exactly the five historical mutations, the unaddressed-bridge boot window mutates NOTHING and says so (the fallback's absence is pinned to non-comment lines), and a no-UFW host keeps its interface-scoped nft path — boot window included. ufw_dns_findings is extracted and driven against the same tables: agreement silent, stale carve-out flagged and named, deny-with-no-allow flagged, untouched UFW host clean, stale-beside-live named, other interfaces ignored; wiring grep-guarded. 297 checks. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>		2026-07-18 20:45:21 +00:00
..
cli.sh	test(cli): drive box-firewall under a shim ufw, and the doctor's UFW findings	2026-07-18 20:45:21 +00:00
labels-reconcile.sh	fix: base the human auto-request on THIS handoff, not review history	2026-07-18 20:16:55 +00:00