From d46697034df5f77db9baa2ae424353c08fe3ea09 Mon Sep 17 00:00:00 2001 From: cluade-reviewer-andresmgsl Date: Fri, 31 Jul 2026 20:15:35 +0000 Subject: [PATCH] test: pin the hermeticity, not just achieve it MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit codex and kimi both drove the same experiment: delete the two wiring lines this branch adds and the suite stays 786/786 on any host without a real Forgejo runner. Hermetic today, unpinned tomorrow — and #136's task list names the guard verbatim: "a check that fails if either group can see host state". Three checks assert the suite's own helpers keep their seals: undo() passes RIG_FORGEJO_RUNNER_DIR, cibox_run() passes CIBOX_BIN, and the hand-rolled undo invocation behind "failed logout is loud" passes it too — that third one being the site I missed first time round, which is exactly why it earns a check rather than a comment. They assert on the test side deliberately: the production knobs are already covered, and the regression worth catching is a deletion in the suite. Verified by re-running codex's experiment: with both wiring lines gone, the two seal checks fail where previously nothing did. Refs #136 Co-Authored-By: Claude Opus 5 (1M context) --- test/cli.sh | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/test/cli.sh b/test/cli.sh index 3cbf64f..6c2883b 100644 --- a/test/cli.sh +++ b/test/cli.sh @@ -3289,6 +3289,29 @@ cibox_src_matches_install() { } check "ci-box: CLI_SRC is the path its install.sh installs" 0 "" cibox_src_matches_install +# codex/kimi on !137: the two wiring lines this change exists to add could be +# deleted tomorrow and the suite stayed 786/786 on any host without a real +# Forgejo runner — hermetic today, unpinned. #136's task list names the guard +# verbatim: "a check that fails if either group can see host state". +# +# These assert on the SUITE's own helpers, not the production knobs — the knobs +# are already covered above. What must go red is a deletion on the test side, +# because that is the regression that silently reintroduces host dependence. +undo_is_sealed() { + sed -n '/^undo() {/,/^}/p' "$0" | grep -q 'RIG_FORGEJO_RUNNER_DIR=' +} +cibox_run_is_sealed() { + sed -n '/^cibox_run() {/,/^}/p' "$0" | grep -q 'CIBOX_BIN=' +} +check "hermetic: undo() seals the Forgejo-runner host scan" 0 "" undo_is_sealed +check "hermetic: cibox_run() seals the real /usr/local/bin lookup" 0 "" cibox_run_is_sealed +# The failed-logout check builds its own env rather than calling undo(), so it +# needs the same seal — and it is the one that was missed first time round. +inline_undo_is_sealed() { + grep -A 4 'failed logout is loud' "$0" | grep -q 'RIG_FORGEJO_RUNNER_DIR=' +} +check "hermetic: the hand-rolled undo invocation is sealed too" 0 "" inline_undo_is_sealed + # Registration holds a credential, so it must NOT be in the definition: a # tenant install is creds-free by contract — box auto-runs it at mint, holding # nothing. Registration is the operator's separate, out-loud act.