rig/test
cluade-reviewer-andresmgsl d46697034d
Some checks failed
ci / check (pull_request) Failing after 7s
ci / install (pull_request) Successful in 4s
ci / db-integration (pull_request) Successful in 3s
labels / labels (pull_request) Failing after 8s
test: pin the hermeticity, not just achieve it
codex and kimi both drove the same experiment: delete the two wiring lines this
branch adds and the suite stays 786/786 on any host without a real Forgejo
runner. Hermetic today, unpinned tomorrow — and #136's task list names the
guard verbatim: "a check that fails if either group can see host state".

Three checks assert the suite's own helpers keep their seals: undo() passes
RIG_FORGEJO_RUNNER_DIR, cibox_run() passes CIBOX_BIN, and the hand-rolled undo
invocation behind "failed logout is loud" passes it too — that third one being
the site I missed first time round, which is exactly why it earns a check
rather than a comment.

They assert on the test side deliberately: the production knobs are already
covered, and the regression worth catching is a deletion in the suite.

Verified by re-running codex's experiment: with both wiring lines gone, the two
seal checks fail where previously nothing did.

Refs #136

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-31 20:15:35 +00:00
..
cli.sh test: pin the hermeticity, not just achieve it 2026-07-31 20:15:35 +00:00
db-integration.sh test(db): add real dump/restore round-trip probe + CI job + manual proof docs 2026-07-17 15:48:51 +00:00
drill.sh test: prove drill records registry source 2026-07-25 13:41:01 +00:00
install-lifecycle.sh feat: install and record registry snapshot 2026-07-25 13:38:54 +00:00
release.sh fix: shellcheck SC2129, BOX_MANUAL lists candidates, drive box_install_urls 2026-07-29 14:53:07 +00:00