admin c52d591851 The decoy suite is a gate of the full run (R-1116); scripts only, no release ...

scripts/test_gate_decoys.py is now agent_gates.py's `gate-decoys` row: the full run (which CI runs on every
push), not --fast (~20 s in the workspace, 30 cases). Declared in its own COVERS; test_agent_gates.py pins it.
Red-proved: a reuse-refs FACT case flipped to expect rc 0 -> CONVICTED: gate-decoys; restored, green.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

2026-10-17 11:01:25 +02:00

..

agent_gates.py

The decoy suite is a gate of the full run (R-1116); scripts only, no release

2026-10-17 11:01:25 +02:00

build-config-bundle.py

R-840: the config bundle — a signed agent_config_update brings a box's root-owned files (sudoers, wrappers, units)

2026-10-04 19:36:58 +02:00

build-step-bundle.py

R-880: build-step-bundle.py — the transition bundle for a release whose bundle adds paths (an installed felhom-os-apply refuses unknown paths, R16)

2026-10-05 12:23:55 +02:00

check-published-versions.py

Two guards, one number: bound the published check to the retention it must live with

2026-08-09 19:05:05 +02:00

check-release-complete.py

Two guards, one number: bound the published check to the retention it must live with

2026-08-09 19:05:05 +02:00

mkfs-guarded-harness.sh

v0.61.0: audit fixes B1 (random temp staging) + D1 (mkfs wrapper member/RO re-checks) + D2 (empty-lsblk fail-safe) + D3 (blank-format anti-retarget)

2026-07-03 07:25:50 +02:00

publish-agent.sh

v0.122.0: three ways the signals lied about themselves (R-189, R-188, R-186)

2026-08-03 16:40:18 +02:00

release-agent.sh

release-agent.sh: only a clean 404 proves a version is new (R-1098)

2026-10-16 17:23:46 +02:00

retention-policy.json

R-291 retention record source, R-348 restart comment (no binary change; burn-down)

2026-10-05 16:56:18 +02:00

test_agent_gates.py

The decoy suite is a gate of the full run (R-1116); scripts only, no release

2026-10-17 11:01:25 +02:00

test_gate_decoys.py

The decoy suite is a gate of the full run (R-1116); scripts only, no release

2026-10-17 11:01:25 +02:00

test_release_push_once.sh

release-agent.sh: only a clean 404 proves a version is new (R-1098)

2026-10-16 17:23:46 +02:00