86 lines
4.6 KiB
Markdown
86 lines
4.6 KiB
Markdown
# REPORT — gate enforcement: the `-v` allowlist, one entry point, a pre-push hook (2026-08-02)
|
|
|
|
**Overwritten** per the standing rule. The prior contents (D5, controller v0.188.0, 2026-07-30) have
|
|
their durable record in `CHANGELOG.md`; nothing was lost by this overwrite.
|
|
|
|
**No version bump, no image build, no deploy.** Nothing compiled changed — this touches
|
|
`controller/scripts/` and `.githooks/` only, so no behaviour on any box moved. Stated explicitly so
|
|
the omission reads as a decision rather than a miss. Controller stays **v0.188.0**; guest 9201 was
|
|
not touched.
|
|
|
|
## What changed
|
|
|
|
| Commit | What |
|
|
|---|---|
|
|
| `c432f70` | **the ALLOWLIST entry, alone in its own reviewed diff** |
|
|
| `8cb3d7a` | `controller/scripts/controller_gates.py` + `controller/scripts/test_controller_gates.py` + `.githooks/pre-push` + `CLAUDE.md` |
|
|
| `7c32c74` | `CHANGELOG.md` + `controller/README.md` |
|
|
|
|
Baseline on arrival: `4115e88f688b`, clean, `HEAD == origin/main` — matched the spec's anchor.
|
|
|
|
### 1. `docker_run_volume_path_gate.py` — one allowlist entry (R-29 leg (a), now CLOSED)
|
|
|
|
The gate was **RED**, flagging `internal/appexport/estimate.go:179`. The finding is benign and was
|
|
reviewed rather than suppressed: `realVolumeSize` mounts a **named Docker volume** read-only into a
|
|
throwaway `alpine` to `du` it from a container view. No host path is involved — the daemon resolves
|
|
the volume name daemon-side — which makes it structurally identical to the already-allowlisted
|
|
`internal/backup/backup.go` entry `'"-v", volName+":/vol:ro"'`. The entry carries its WHY in the
|
|
voice of its neighbours.
|
|
|
|
`realVolumeSize` was **not** rewritten: the code is correct, the allowlist was incomplete. The diff
|
|
is alone in its commit because burying an allowlist widening inside a feature commit is how an
|
|
allowlist stops meaning anything.
|
|
|
|
**Red-proof:** renaming the new entry's suffix to a non-existent file returns the gate to **exit 1**,
|
|
naming `estimate.go:179`; restored → **exit 0**.
|
|
|
|
### 2. `controller_gates.py` — THE entry point
|
|
|
|
Runs all seven local gates plus `reuse_refs_check` on the repo root, streams each gate's own output,
|
|
exits worst-wins non-zero, and reports exit 2 distinctly as INCONCLUSIVE. `--fast` selects the gates
|
|
that touch no network and no container runtime — today all eight. **A missing gate script is a
|
|
FAILURE with the path printed, never a skip.**
|
|
|
|
Why a runner at all: the 2026-08-02 census across the four repos found that **every gate a
|
|
`CLAUDE.md` names was green, and the ones nobody names were where the red was.** This repo had seven
|
|
gates and `CLAUDE.md` named two; four more lived behind a line in `REUSE.md`, and the docker-`-v`
|
|
gate behind one line in `REUSE.md` — while red. The canonical shape is
|
|
`app-catalog-felhom.eu/scripts/catalog_gates.py` (R-161).
|
|
|
|
**The shared checker is never copied here.** `reuse_refs_check.py` stays in `felhom.eu/scripts/` and
|
|
is invoked at `<repo-root>/../felhom.eu/scripts/`; a copy would recreate exactly the drift it detects.
|
|
It now resolves this repo's REUSE map cleanly: **133 cited paths — 126 exact, 6 by suffix, 1
|
|
cross-repo** (`wgsync/reconciler.go`, which lives in the hub), 0 failures.
|
|
|
|
### 3. `.githooks/pre-push`
|
|
|
|
Runs `controller_gates.py --fast` and refuses the push. It prints a line before and after, because an
|
|
absent log line is not evidence a hook ran. Its limits are written into the hook itself: **per-clone**
|
|
(`core.hooksPath` is local config; this clone is armed — `git config --get core.hooksPath` →
|
|
`.githooks`) and **`git push --no-verify` bypasses it on purpose**, which must be stated in a session
|
|
report when used. It was **not** used against this repo; both real pushes ran the hook and passed.
|
|
|
|
### 4. `test_controller_gates.py` — a seam test, not a smoke test
|
|
|
|
Asserts each member gate's **own distinctive stdout**, never the runner's summary line, which an
|
|
inert runner prints while calling nothing. **Red-proof:** replacing `run_gate`'s body with `return 0`
|
|
still prints `all controller gates OK` and exits 0 — and turns the seam test red. It also pins that
|
|
`reuse_refs_check.py` has not been copied into this repo.
|
|
|
|
## Verification
|
|
|
|
```
|
|
template-id OK (exit 0) app-row-dedup OK (exit 0)
|
|
emoji OK (exit 0) mojibake OK (exit 0)
|
|
native-confirm OK (exit 0) docker-v OK (exit 0)
|
|
offbox-rename OK (exit 0) reuse-refs OK (exit 0)
|
|
|
|
all controller gates OK
|
|
```
|
|
|
|
`python3 scripts/test_controller_gates.py` → **4 tests, OK** (0 before). No Go test count changed; no
|
|
Go file was touched.
|
|
|
|
Full cross-repo detail, every red-proof, the `core.hooksPath` probe measurements and the hub
|
|
deployment: `felhom.eu/REPORT.md`.
|