From 06b80816647c7c8b9ac0e8bb56ef40eb509758bb Mon Sep 17 00:00:00 2001 From: Timothy Date: Sun, 30 Aug 2026 14:23:27 +0200 Subject: [PATCH] docs(887): two probed non-routes, recorded so they are not re-derived MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Hunting a fifth instance of "the pin assumes it is pinning the thing that still decides" turned up two candidates that look like routes and are not, both measured rather than argued: * `setupFiles` is pinned by NAME while its CONTENT is not, which reads like the package.json hole one level down. It is fail-NOISY: `process.exit(0)` at the top of `src/setupTests.ts` makes vitest report `121 failed (121)`, not a green. * `tsconfig*.json` shapes what `tsc -b` compiles, not what vitest collects. Recorded because a reader who spots either will otherwise spend the same probe to reach the same answer — and because the honest residual beside them is the one that IS open: a dependency's own install script, reached through `npm ci` and `web/package-lock.json`. That is a supply-chain concern wider than this guard, and it is named rather than claimed covered. Refs: #887 Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_019T79beF1Ufid3dXju4yqkF --- scripts/tests/test_image_build_delegates_the_spa_suite.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/scripts/tests/test_image_build_delegates_the_spa_suite.py b/scripts/tests/test_image_build_delegates_the_spa_suite.py index bcf667292..7bbbf988a 100644 --- a/scripts/tests/test_image_build_delegates_the_spa_suite.py +++ b/scripts/tests/test_image_build_delegates_the_spa_suite.py @@ -74,6 +74,14 @@ another WORKFLOW (a `needs:` edge naming a job called `test` that is not this on pinned command invokes (a vite plugin, an npm lifecycle script). Ask of any new pin: what else could decide this, and would the pin still match? +Two candidates for that class were probed and are NOT routes, recorded so the next reader does not +re-derive them. The `setupFiles` entry is pinned by NAME and its CONTENT is not, but a setup file +that terminates the run is FAIL-NOISY: `process.exit(0)` at the top of `src/setupTests.ts` reports +`121 failed (121)`, not a green. And `tsconfig*.json` shapes what `tsc -b` compiles, not what vitest +collects. What remains genuinely unpinned in that direction is a dependency's own install script, +reached through `npm ci` and `web/package-lock.json` — a supply-chain concern wider than this guard, +named rather than claimed to be covered. + The cost is stated rather than hidden: a legitimate edit to those command lines reddens this guard and its author must update the pin. That is the same deliberate review trigger `KNOWN_GATE_*` uses, applied to the two places where a silent change publishes an untested image.