{
"_comment": [
"Rescue arms for the gated-tests guard (nornir_testmatrix::gatedtests) — declared",
"in the repo that SHIPS the guard, which had two silenced targets of its own.",
"",
"Verified 2026-07-21, both green with no fixes needed:",
" nornir-flight tls_roundtrip --features tls 4/4",
" nornir-testmatrix functional_subprocess --features testmatrix 1/1",
"",
"The nornir-flight one is the entry worth naming: FOUR TLS roundtrip tests — token",
"rejection, bearer auth, and two byte-identity checks — had never executed. That is",
"the transport's security surface reporting `0 tests ... ok`, which is exactly the",
"shape the guard exists to catch, sitting in the guard's own workspace.",
"",
"--- 2026-08-01, stinky-hunter pass 19 -------------------------------------",
"",
"A THIRD dark target had appeared since, and this file did not notice because",
"NOTHING READ IT. The guard shipped on 2026-07-21 and was consumed by zero of",
"the fleet's twenty repos; edda declared these arms and then never ran the",
"audit on itself. crates/nornir-testmatrix/tests/this_repo_has_no_silenced_",
"tests.rs now does, on every plain `cargo test`, so the next one cannot arrive",
"in silence.",
"",
" korp-installer secure_boot --features secure-boot",
"",
"WHAT THE ARM PROVES (measured on oden, 2026-08-01): the file COMPILES under",
"`--features secure-boot`, its binary lists 3 tests, and ALL THREE PASS — zero",
"fixes needed. The gap was reporting, not correctness.",
" a_real_factory_varstore_takes_the_customer_key .............. pass (39.8s run)",
" the_real_first_stage_signs_and_keeps_its_authenticode_digest pass",
" secure_boot_runs_the_signed_chain_and_refuses_the_unsigned_one pass (8.8s,",
" `-- --ignored`: pure-Rust key ceremony -> PK/KEK/db enrollment -> pure-Rust",
" Authenticode signing -> Secure-Boot-enforcing OVMF RAN the signed chain and",
" REFUSED both the unsigned one and a signed-then-tampered one)",
"The third is `#[ignore]`d by its author as heavy, so it stays opt-in. An",
"#[ignore] is a visible choice that shows up in every test run; the unsatisfied",
"cfg was not, and that is the whole distinction this file exists to draw.",
"",
"WHY THE GATE IS RIGHT AND MUST STAY A GATE: `secure-boot` pulls rsa + sha2 +",
"cms + x509-cert + der + spki + rand. That stack is needed only on the BUILD box",
"that signs a release, never on the appliance, which only runs what the firmware",
"already verified. Making it default would drag a signing stack into every",
"dep-light installer build. Note korp-installer's own Cargo.toml already argues",
"the other way for `splash` — 'a feature-gated test is a test nobody runs' — and",
"made that one default. It was right about the risk and wrong that defaulting is",
"the only cure: declaring the arm and running the guard is the other one.",
"",
"WHAT THE ARM DOES NOT PROVE: that the Secure-Boot enforcement path itself works",
"on real firmware. It is an OVMF/QEMU proof, and the negative half (an unsigned",
"chain is refused) only executes under `--ignored`.",
"",
"--- 2026-08-27, the `forge` row + the four this file could see and did not ----",
"",
"The guard WAS RUNNING and WAS RED on main, and had been ignored: 110 test",
"targets scanned, 7 SILENCED, 21 hidden test fns. A red guard nobody clears is",
"a guard everybody learns to skip, so the four arms below take it to green and",
"each one was compiled before it was declared.",
"",
" korp-installer --features forge 17 lib + 9 integration rescued",
" gunnar-pack --features delta tests/deltified.rs, 7 fns",
" nornir-build-thing --features cargo-container toolchain_images_live, cargo half",
" nornir-build-thing --features kernel-build kernel_{build,probe,run}_live +",
" toolchain_images_live, kernel half",
"",
"THE `forge` ROW IS THE ONE WORTH READING, because it was not a dark test at",
"all — it was a HARD BREAK wearing a dark test's clothes. tests/root_key_",
"enrollment.rs was born 2026-08-04 importing `korp_installer::forge` with no",
"`#![cfg]` of its own, and `forge` has never been in `default`. So for 23 days",
"a plain `cargo test -p korp-installer` exited 101 on E0432 and ran 0 of 320",
"tests — the 257 that pass perfectly well included. `cargo test` does not list",
"a target it could not build, and this guard asks a different question (a file",
"that compiles to an EMPTY binary), so nothing said a word. Gating the file",
"made the package compile again (measured: 0 -> 257 passing, exit 101 -> 0) and",
"turned the break into the visible silence this file answers.",
"",
"WHY `forge` STAYS OFF BY DEFAULT, with the number. It is tempting here,",
"because in a TEST build it is nearly free: `nornir-build-thing` is already an",
"unconditional dev-dependency, so `cargo tree -e normal,dev` measures 439 unique",
"packages by default and 442 with `--features forge` — the whole cost of the arm",
"is zstd + zstd-safe + zstd-sys. But `cargo tree -e normal` measures 181 -> 442,",
"+261 packages: the entire gix 0.87 tree, reqwest, rustls + aws-lc-sys, russh,",
"tokio, and a second parallel RustCrypto generation. The two shipped PID-1",
"binaries are built with the DEFAULT features, and a PID-1 that links a build-",
"declaration crate it never calls is the opposite of an appliance. Same verdict",
"as `secure-boot` above, arrived at from the other direction.",
"",
"WHAT THESE FOUR ARMS PROVE AND DO NOT PROVE: `verify_arms` compiles each with",
"`--no-run` and REFUSES an arm that rescues zero tests, so a feature renamed out",
"from under an arm is RED rather than silent — that is the drift check. It does",
"not RUN them, and the two nornir-build-thing arms name gates whose tests are",
"`#[ignore]`d heavy live probes (podman, a kernel compile) that only an operator's",
"`-- --ignored` pass executes. Compiling them is still the thing that was",
"missing: toolchain_images_live.rs exists BECAUSE two toolchain images had a",
"complete engine and no way to build them, and until this arm nothing compiled",
"the file that says so.",
"",
"--- 2026-09-26: the two korp-installer arms LEFT with the crate ------------",
"",
"korp-installer moved to tunnr (owner ruling: the install medium's PID-1 sits",
"next to the kernel it boots). Its two arms (secure-boot / secure_boot, and",
"forge) moved unchanged into tunnr/.nornir/testmatrix-arms.json; the history",
"above is kept because it is why they exist.",
"",
"--- 2026-09-29 (release-3): four targets had gone dark again --------------",
"",
"this_repo_has_no_silenced_tests was RED: 4 SILENCED, 22 hidden test fns. Each",
"arm below was RUN before it was declared (dwarf, edda-green):",
" edda-admit --features serde settings_toml 4/4",
" guest-host --features wasmtime bounds_and_trust 7/7",
" nornir-auth-policy --features auth-passkey,auth-bearer passkey_dispatch 9/9",
" nornir-build-thing --features image-build pinned_recipe_reproduces 1 (#[ignore]d:",
" pulls debian and mints ~1.2 GB; the arm proves it compiles)",
"",
"WHY ARMS AND NOT `default`: edda-admit and guest-host are PATH deps of gunnar",
"(gunnar-ssh -> admit, gunnar-front -> guest-host). A default feature there",
"changes their dependency lists in gunnar's committed Cargo.lock, and gunnar's",
"offline Build Thing build runs `--locked`. wasmtime is also far too heavy to",
"force on every consumer; the passkey/bearer pair and image-build are opt-in",
"stacks by design (image-build is dwarves' default, not the library's).",
"",
"--- 2026-10-11, r5-4 tests-green ------------------------------------------",
"",
"Three dark targets had arrived (51 hidden test fns); each arm was run on the",
"build box before it was declared here:",
" appliance-pid1 sigpwr_stops --features runtime",
" nornir-auth-saml sp_interop + sp_rules --features sp,test-support"
],
"arms": [
{ "package": "nornir-flight", "features": ["tls"] },
{ "package": "nornir-testmatrix", "features": ["testmatrix"] },
{ "package": "gunnar-pack", "features": ["delta"] },
{ "package": "nornir-build-thing", "features": ["cargo-container"] },
{ "package": "nornir-build-thing", "features": ["kernel-build"] },
{ "package": "edda-admit", "features": ["serde"] },
{ "package": "guest-host", "features": ["wasmtime"] },
{ "package": "nornir-auth-policy", "features": ["auth-passkey", "auth-bearer"] },
{ "package": "nornir-build-thing", "features": ["image-build"] },
{ "package": "appliance-pid1", "features": ["runtime"] },
{ "package": "nornir-auth-saml", "features": ["sp", "test-support"] }
]
}