golem15/msd-core
4
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(1259-01): close re-review NEW-BL-01 (ignored-target vacuous green) + no-throw hardening

Browse Source 
Round-2 adversarial review found the lint-rule runner falsely greened an
eslint-IGNORED target: eslint returns a length-1 "File ignored" result (ruleId
null) that passed the >=1-file vacuity guard while nothing was linted — reopening
the vacuous-green class. Fix: buildLintArgs now passes --no-warn-ignored so an
ignored path returns [] -> fails closed (verified + E2E test on an ignored
bin/lib artifact).

Also: wrap runCheck() so even a (test-injected) throwing runner fails closed
(NEW-WR-01, full no-throw contract); document the benign basename-naming
constraint on wired node-test names (NEW-WR-02, fail-closed).
This commit is contained in:
Dave
2026-06-15 13:45:03 -04:00
parent 31b822b312
commit 97931249bc
2 changed files with 44 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
tests/prohibition-enforcement.test.cjs
View File

@@ -103,6 +103,8 @@ describe('prohibition-enforcement: deterministic test-tier producer (#1259 / ADR
const fmtIdx = argv.indexOf('--format');
assert.ok(fmtIdx !== -1 && argv[fmtIdx + 1] === 'json',
'emits --format json so the report can be filtered by ruleId');
assert.ok(argv.includes('--no-warn-ignored'),
'must pass --no-warn-ignored so an eslint-ignored target returns [] (fails closed), not a length-1 warning result');
assert.ok(!argv.includes('--rule'),
'must NOT use --rule — it cannot load a plugin rule like local/no-source-grep (the SF-01 bug)');
assert.equal(argv[argv.length - 1], 'tests/', 'the LAST arg is the lint target path');
@@ -146,6 +148,18 @@ describe('prohibition-enforcement: deterministic test-tier producer (#1259 / ADR
assert.equal(result.flagged, true);
});
test('a runCheck that THROWS fails closed, never propagates (no-throw contract, NEW-WR-01)', () => {
const enforce = require(ENFORCEMENT_LIB);
const result = enforce.runProhibitionEnforcement(
TEST_TIER,
{ kind: 'node-test', target: 'tests/neg.test.cjs', failFirst: true },
{ runCheck: () => { throw new Error('runner blew up'); } },
);
assert.notEqual(result.status, 'green', 'a throwing runner must never green');
assert.equal(result.flagged, true);
assert.equal(result.located, true);
});
test('hard-gates in BOTH modes on a failing check (ADR-550 D4)', () => {
const enforce = require(ENFORCEMENT_LIB);
for (const mode of ['interactive', 'autonomous']) {
@@ -303,4 +317,17 @@ describe('prohibition-enforcement REAL runner end-to-end (#1259)', () => {
assert.equal(result.kind, 'lint-rule');
assert.equal(result.evidence[0].rule, 'local/no-source-grep');
});
test('an eslint-IGNORED target does NOT green the lint-rule kind (vacuous-green guard, NEW-BL-01)', () => {
const enforce = require(ENFORCEMENT_LIB);
// The generated bin/lib artifact is eslint-ignored. Without --no-warn-ignored, eslint returns a
// length-1 "File ignored" result that would falsely pass the vacuity guard. It must fail closed.
const result = enforce.runProhibitionEnforcement(
TEST_TIER,
{ kind: 'lint-rule', rule: 'local/no-source-grep', target: 'gsd-core/bin/lib/prohibition-enforcement.cjs', failFirst: true },
{ cwd: process.cwd() },
);
assert.notEqual(result.status, 'green', 'an ignored path lints nothing — must NEVER green');
assert.equal(result.located, true, 'the descriptor was well-formed; it just did not genuinely pass');
});
});