crates/nornir-purgatory/tests/against_the_real_committed_fragments.rs
//! **The 711 committed lines of kernel opinion, read as data.**
//!
//! The unit tests in this crate run on fragments a test invented. That is the
//! shape of defect `gunnar 30da3d04` cost four days over: a predicate asserted
//! only against values a test made up, so nothing ever asked the question about a
//! SHIPPED input. `nornir-build-thing/src/kconfig/*.config` is the real stage-1
//! policy — 711 lines across six files — and these tests read it off disk.
//!
//! They assert PROPERTIES, never a count of directives: the fragments are edited
//! by other lanes (F45 and F46 both moved them on 2026-09-07) and a test pinning
//! a total would go red on a correct edit, which teaches people to delete tests.
use std::path::{Path, PathBuf};
use nornir_purgatory::kconfig::{Effective, EffectiveReport, Requested};
use nornir_purgatory::{immune_from_fragments, propose, Demand, Freshness, Policy, Scope, Value};
fn kconfig_dir() -> PathBuf {
Path::new(env!("CARGO_MANIFEST_DIR"))
.parent()
.expect("crates/")
.join("nornir-build-thing/src/kconfig")
}
fn read(name: &str) -> String {
let p = kconfig_dir().join(name);
std::fs::read_to_string(&p).unwrap_or_else(|e| panic!("read {}: {e}", p.display()))
}
/// The stage-1 stack a hardened tunnr kernel is built from, in apply order.
fn policy_fragments() -> Vec<(String, String)> {
[
"base.config",
"deps-tinyconfig.config",
"hardened.config",
"nuked.config",
]
.iter()
.map(|n| ((*n).to_string(), read(n)))
.collect()
}
fn requested() -> Requested {
let owned = policy_fragments();
Requested::from_fragments(owned.iter().map(|(n, t)| (n.as_str(), t.as_str())))
}
/// The parser must actually understand the real files — not merely not crash.
#[test]
fn the_real_fragments_parse_into_a_substantial_policy_set() {
let r = requested();
assert!(
r.len() > 100,
"711 committed lines produced only {} directives — the parser is skipping real ones",
r.len()
);
let vals: Vec<Value> = r
.symbols()
.iter()
.filter_map(|s| r.get(s).cloned())
.collect();
assert!(vals.iter().any(|v| *v == Value::Yes), "no `=y` parsed");
assert!(
vals.iter().any(|v| *v == Value::No),
"no `is not set` parsed"
);
}
/// **The symbols invariant 2 protects, taken from the real policy.** Named
/// individually because losing them would be catastrophic and silent, and
/// because `SECCOMP` is the plan's own example of one a clean boot never reaches.
#[test]
fn the_real_hardening_symbols_are_immune_and_seccomp_is_among_them() {
let owned = policy_fragments();
let im = immune_from_fragments(owned.iter().map(|(n, t)| (n.as_str(), t.as_str())));
let missing: Vec<&str> = ["SECCOMP", "STACKPROTECTOR_STRONG", "RANDOMIZE_BASE"]
.into_iter()
.filter(|s| !im.contains(*s))
.collect();
assert!(
missing.is_empty(),
"named by the committed fragments and MUST be immune; missing {missing:?}"
);
}
/// **The fail-closed bench the plan asks for** (`mimir-v2.md` §6,
/// `purgatory_fail_closed`): real policy, real shipped set, evidence withheld ⇒
/// subtractions MUST be zero.
#[test]
fn purgatory_fail_closed_on_the_real_policy() {
let owned = policy_fragments();
let immune = immune_from_fragments(owned.iter().map(|(n, t)| (n.as_str(), t.as_str())));
// A symbol the committed policy provably does NOT name, asserted rather than
// assumed. My first draft used BLK_DEV_IO_TRACE here and the real fragments
// refused it: `hardened.config:192-193` already vetoes both it and DEBUG_FS,
// so they are policy and therefore immune. The fixture was wrong and the real
// data said so, which is the entire reason this file reads the files.
let unrequested = "PURGATORY_TEST_UNNAMED_WIDGET";
assert!(
requested().get(unrequested).is_none() && !immune.contains(unrequested),
"{unrequested} must be absent from the real policy for this test to mean anything"
);
let mut shipped = String::new();
for d in requested().directives() {
shipped.push_str(&d.render());
shipped.push('\n');
}
shipped.push_str(&format!("CONFIG_{unrequested}=y\n"));
let eff = Effective::from_produced_config(&shipped);
for ev in [
Freshness::Absent,
Freshness::Stale {
why: "older than HEAD".into(),
},
Freshness::Unsound {
why: "ra_ingest moniker collision — def-site keys are file#Lline:Ccol and collide \
across workspace members (mimir-v2 §7, step 0)"
.into(),
},
] {
let d = propose(
&eff,
&Demand::default(),
&Policy {
immune: immune.clone(),
report_only: false,
},
&ev,
);
assert!(
d.subtractions.is_empty(),
"{ev:?} must subtract NOTHING from the real policy; got {:?}",
d.subtractions
);
assert!(d.refused.is_some(), "and it must say why");
}
// NON-VACUOUS: fresh evidence on the same real input DOES propose removals,
// so the three refusals are not a function that never fires — and SECCOMP
// still survives, which is invariant 2 on real data under maximum pressure.
let d = propose(
&eff,
// A complete graph, said out loud: the default scope judges nothing.
&Demand {
scope: Scope::Whole,
..Demand::default()
},
&Policy {
immune,
report_only: false,
},
&Freshness::Fresh {
revision: "test".into(),
},
);
assert!(
!d.subtractions.is_empty(),
"fresh evidence must actually propose something, or this bench proves nothing"
);
assert!(
!d.subtractions.iter().any(|s| s.symbol == "SECCOMP"),
"SECCOMP is policy and must survive maximum subtraction pressure"
);
assert!(
d.subtractions.iter().any(|s| s.symbol == unrequested),
"the unrequested arrival is what should be cut: {:?}",
d.subtractions.iter().map(|s| &s.symbol).collect::<Vec<_>>()
);
}
/// **The real 2026-09-07 defect, replayed as arithmetic.**
///
/// `hardened.config:187-193` records it in prose: `BLK_DEV_IO_TRACE` carries
/// `select DEBUG_FS` (`kernel/trace/Kconfig:648`), so `olddefconfig` put debugfs
/// straight back and a veto lost to an undeclared dependency. Both symbols are
/// vetoed by the committed policy, so a kernel that shipped them `=y` is TWO
/// DROPPED vetoes — and DROPPED is the mode that was invisible until the canary
/// ran. This is the finding the four view modes exist to make routine.
#[test]
fn the_defeated_debugfs_veto_is_two_dropped_vetoes_on_the_real_policy() {
let r = requested();
for sym in ["BLK_DEV_IO_TRACE", "DEBUG_FS"] {
assert_eq!(
r.get(sym),
Some(&Value::No),
"{sym} is vetoed by the committed policy (hardened.config:192-193)"
);
}
let mut shipped = String::new();
for d in r.directives() {
// Ship the kernel that DEFEATED the veto: both symbols come back on.
if d.symbol == "BLK_DEV_IO_TRACE" || d.symbol == "DEBUG_FS" {
shipped.push_str(&format!("CONFIG_{}=y\n", d.symbol));
} else {
shipped.push_str(&d.render());
shipped.push('\n');
}
}
let report = EffectiveReport::compute(requested(), Effective::from_produced_config(&shipped));
let dropped: Vec<&str> = report.dropped.iter().map(|d| d.symbol.as_str()).collect();
assert!(
dropped.contains(&"DEBUG_FS") && dropped.contains(&"BLK_DEV_IO_TRACE"),
"both defeated vetoes must show as DROPPED: {dropped:?}"
);
// They were REQUESTED, so they are drops and NOT additions — the two modes
// must not double-count the same symbol.
let added: Vec<&str> = report.added.iter().map(|a| a.symbol.as_str()).collect();
assert!(
!added.contains(&"DEBUG_FS") && !added.contains(&"BLK_DEV_IO_TRACE"),
"a requested symbol is never an ADDITION: {added:?}"
);
assert!(report
.rows()
.iter()
.any(|l| l.contains("DROPPED") && l.contains("DEBUG_FS")));
}
/// **ADDED, on the real policy** — the mode nobody looks at, with the defect
/// found by hand on 2026-09-07.
#[test]
fn a_select_chain_arrival_shows_up_as_added_against_the_real_policy() {
let unrequested = "PURGATORY_TEST_UNNAMED_WIDGET";
assert!(
requested().get(unrequested).is_none(),
"{unrequested} must be absent from the real policy for this test to mean anything"
);
let mut shipped = String::new();
for d in requested().directives() {
shipped.push_str(&d.render());
shipped.push('\n');
}
shipped.push_str(&format!("CONFIG_{unrequested}=y\n"));
let report = EffectiveReport::compute(requested(), Effective::from_produced_config(&shipped));
assert!(
report.added.iter().any(|a| a.symbol == unrequested),
"an enabled symbol no fragment named must appear in ADDED: {:?}",
report.added
);
assert!(report.rows().iter().any(|l| l.contains("ADDED")));
assert!(
report.dropped.is_empty(),
"nothing was dropped here: {:?}",
report.dropped
);
}
/// **The honesty rule on the real path**: with no build, EFFECTIVE is a typed
/// refusal — never an empty set that reads like a clean diff.
#[test]
fn with_no_kernel_build_effective_refuses_rather_than_guessing() {
let err = Effective::from_path(&kconfig_dir().join("there-is-no-produced-config"))
.expect_err("a missing .config must not yield an Effective");
assert!(
err.to_string().starts_with("EFFECTIVE unavailable"),
"{err}"
);
}