Repository navigation
test(panels): make the panel life-cycle suites offline and sqlite-isolated - #12
Merged
iitzSeriZdev merged 2 commits intoSep 27, 2026
Conversation
added 2 commits
September 27, 2026 22:39
…lated
Both installer panel suites fail on ubuntu-latest and pass on the authoring
host, for two reasons that have nothing to do with the adapters they cover.
Both are harness defects, and neither is fixed by changing production code.
1. sqlite3 leaked in from the runner.
`sqlite: false` meant only "write no sqlite3 shim". The adapters decide
with `command -v sqlite3` (rt_panel_rebecca_db_ready), and ubuntu-latest
ships a real sqlite3, so the gate opened anyway, activation took the
automatic path, and the manual-activation test read
inactive
outcome=auto
...
(Automatic activation needs the sqlite3 command and Rebecca's SQLite database.)
where it expected `manual`. Shadowing sqlite3 with a shim that fails
cannot fix this: the gate asks whether the command exists, not whether it
works.
`sqlite: false` now removes every directory that holds a sqlite3 from the
child's PATH, replacing each with a mirror of itself (the same entries,
symlinked, minus sqlite3) so nothing else on the host stops resolving.
A new test plants a real-looking sqlite3 -- plus a second tool, to prove
the substituted directory still carries what it held -- and asserts that
`command -v sqlite3` fails in the child while the other tool resolves.
2. The network leaked in from the payload.
The payload was two designs. RT_TEMPLATES_AVAILABLE names seventeen, so
rt_complete_install always judged the install short of what its version
ships and downloaded the release pinned to that version. On a runner with
network the download succeeded, the template store was rebuilt from the
PUBLISHED v1.3.0 release, and verify then compared that release's artifact
against this working tree's:
Completing the Row-Template 1.3.0 installation (designs and installer files)...
ok Installation completed: 17 design(s) available.
FAIL canonical artifact does not match the selected template (row).
The suites were therefore validating a published release against the
branch, and doing it over the network -- which is the opposite of what
they are for, and it made them depend on whatever v1.3.0 happened to
contain.
The payload is now the complete release (availableTemplateIds(), the same
seventeen ids as RT_TEMPLATES_AVAILABLE), so rt_complete_install has
nothing to complete and is never reached. curl and wget are denied in
every fake host -- they record the attempt and fail -- so a regression
fails the suite loudly instead of silently reaching the internet. The two
life-cycle tests assert the recorded attempts are empty, so "this suite
needs no network" is measured rather than assumed.
Production behaviour is untouched: the installer, the adapters and the
release tooling are byte-identical. The payload is a real release, and the
only thing that changed is that the tests now hand the installer all of it.
Two defects in the previous commit, both in test code. Found by the Linux
run: three failures down to one, and the one was this commit's own new
test.
bashRun spreads its first argument, so a string became one line per
character:
"set -Eeuo pipefail\ns\n=\n0\n;\n \ne\nc\nh\no\n \nA"
The new sqlite3 test passed a joined string, so its script died under
`set -e` -- the first one-character line is a command that does not exist
-- before printing anything, and the assertion read an empty stdout
(`actual: ''`). Every other caller passes an array. bashRun now accepts
either shape, as the suites' own `run` helpers already do, so the
footgun cannot recur; the test passes an array, and reports the exit code
and stderr when it fails.
A mirror is now stamped once it is complete. A run killed by a signal (a
timeout, a cancelled job) never reaches the exit hook, and a half-built
mirror would otherwise be reused on the next run -- failing, if `bash`
were the entry that never got linked, in a way that has nothing to do
with sqlite3.
iitzSeriZdev
merged commit Sep 27, 2026
ea66445
into
fix/v1.3.0-pasarguard-identity-and-flags
1 check passed
![graphify-labs[bot]](https://avatars.githubusercontent.com/in/4356270?s=60&v=4){kind=small}
There was a problem hiding this comment.
Graphify reviewed this change.
Worth a look — the grounded gate found no coupling regressions or blocking issues, but 2 advisory finding(s) below merit a look before merge.
Graphify review — findings
Denies network access in the panel-host test doubles by putting failing curl/wget shims on PATH that record each attempt to net.log, exposed via netAttempts so tests assert they ran fully offline. Makes sqlite: false genuinely remove sqlite3 rather than shadow it, via pathWithoutSqlite/mirrorWithoutSqlite which rebuild PATH from mirrored bin dirs stripped of sqlite3, so the command -v sqlite3 gate sees no sqlite3 even on runners that ship one. Switches the PasarGuard and Rebecca suites to build complete payloads from availableTemplateIds() so rt_complete_install never fetches the published release, with the life-cycle tests asserting zero network attempts.
Worth a look
- process.on('exit') rmSync removes mirror dir still in use by a concurrent process —
tests/helpers/panel-hosts.mjs· Escalate · medium- agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
- Non-atomic check-then-act on shared mirror directory across concurrent tests —
tests/helpers/panel-hosts.mjs· Escalate · medium- agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
Analysis details — impact, health, verification
Impact & health
Graphify review
Impact — 35 functions depend on the 35 functions this change touches.
Health — grade A; no new coupling hotspots.
Verification — 35 functions in the blast radius were not formally verified this run (proofs are advisory here).
Health delta baseline: last indexed commit 13fb6c8, 7 commit(s) behind this PR's base.
Gate & verification
graphify gate
PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.
Advisory (not blocking):
- verification_scope: 35 function(s) in the blast radius were not formally verified this run
Docs that may be stale (advisory)
.github/pull_request_template.md§ How it was checked (lines 5-14): references changed symbolsrunCHANGELOG.md§ Development (lines 73-85): references changed symbolsrunCHANGELOG.md§ Development (lines 386-396): references changed symbolsrunCONTRIBUTING.md§ Development (lines 31-53): references changed symbolsrunCONTRIBUTING.md§ Linting shell scripts (lines 54-69): references changed symbolsrunCONTRIBUTING.md§ Translations (lines 70-82): references changed symbolsrunCONTRIBUTING.md§ Documentation site (lines 90-102): references changed symbolsrunREADME.ar.md§ التطوير (lines 268-282): references changed symbolsrunREADME.ar.md§ الاختبار (lines 283-289): references changed symbolsrunREADME.fa.md§ توسعه (lines 269-283): references changed symbolsrun
…and 10 more.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
A test-harness fix. Three files, all of them test code, and no production
file is touched —
installer/,src/,template/andtools/arebyte-identical to the base branch.
Both installer panel suites (
tests/installer-panel-pasarguard.test.mjs,tests/installer-panel-rebecca.test.mjs) fail onubuntu-latestand pass onthe authoring host. Neither failure is about the adapters they cover.
1. The runner's own
sqlite3leaked insqlite: falseonly meant "write nosqlite3shim". The adapters decide withcommand -v sqlite3(rt_panel_rebecca_db_ready), andubuntu-latestships areal
sqlite3, so the gate opened anyway, activation took the automatic path,and the manual-activation test read:
where it expected
manual. A shim that exists and fails cannot fix this: thegate asks whether the command exists, not whether it works.
2. The network leaked in through the payload
The payload held two designs;
RT_TEMPLATES_AVAILABLEnames seventeen. Sort_complete_installalways judged the install short of what its own versionships and downloaded the release pinned to the installed version. On a runner
with network that succeeded, the template store was rebuilt from the
published v1.3.0 release, and verify then compared that release's artifact
against this branch's working tree:
The suite was validating a published release against the branch, over the
network — the opposite of what it is for, and a dependency on whatever v1.3.0
happens to contain.
The fix
sqlite: falsenow means unavailable.pathWithoutSqlite()removesevery directory holding a
sqlite3from the child'sPATH, replacing eachwith a mirror of itself (the same entries, symlinked, minus
sqlite3) sonothing else on the host stops resolving.
availableTemplateIds()— the sameseventeen ids as
RT_TEMPLATES_AVAILABLE— sort_complete_installhasnothing to complete and is never reached.
curlandwgetare denied in every fake host. They record the attemptand fail, so a regression fails the suite loudly instead of silently reaching
the internet.
sqlite3(plus a secondtool, to prove the substituted directory still carries what it held) and
proves it cannot reach the child; and both life-cycle tests assert the
recorded network attempts are empty, so "this suite needs no network" is
measured rather than assumed.
Merge order
This branch is based on
fix/v1.3.0-pasarguard-identity-and-flags(#9) andtargets it, on purpose:
release-validation.yml— the only workflow that runsnpm test— exists only in #9, so a pull request againstmainwould carryno check result at all. Merge order:
fix/v1.3.0-pasarguard-identity-and-flagsmainNothing here is merged, tagged or released.