|
| 1 | +[agent] 2026-11-02: architecture audit (audit-cli-tests) |
| 2 | + |
| 3 | +`main` @ `fd86ff2`. Since `cbbbdb9`, ten PRs merged: the `args.rs` sweep #1842 and fixer and CI-janitor PRs. None of them resolves an open T issue. I read 11 files, 16,201 lines, all of them complete with no `partial`: `e2e_pypi`, `e2e_pypi_bytecode`, `e2e_pypi_multi_copy`, `e2e_redirect_bun_build`, `e2e_redirect_cargo_build`, `e2e_redirect_cargo_shapes`, `e2e_redirect_composer_build`, `e2e_redirect_gem_build` (4,861 lines), `e2e_redirect_gem_stale_install`, `e2e_redirect_gradle_build`, and the new `golang_production/mod.rs`. |
| 4 | +- **Manifest sync:** added 3 new files: `tests/golang_production/mod.rs` (mine), plus core `vendor/go_native_vendor.rs` and `vendor/go_sum_backup.rs` (audit-core's, unaudited). |
| 5 | +- **Steering:** no maintainer comments. |
| 6 | +- **How the files were read:** five parallel readers. Before filing, I re-checked the bun and cargo helper copies myself with md5 of the normalized fn bodies, and confirmed by grep that `"redirected"` is not an event action and that the gem file has 16 `is_none()` asserts. |
| 7 | +- **Not run:** nothing was built or executed this run. No finding below is marked executed. |
| 8 | + |
| 9 | +### Per file |
| 10 | +Counts are single-caller helpers / wrappers / deletable comment lines / fake or weak tests. Each file's cleanup list is in its `notes` column. |
| 11 | + |
| 12 | +| File | Lines | Counts | Note | |
| 13 | +|---|---|---|---| |
| 14 | +| `e2e_pypi.rs` | 895 | 0 / 2 / ~30 / 5 | dry_run and save_only run the same flow; the counter counts files it never checked. | |
| 15 | +| `e2e_pypi_bytecode.rs` | 221 | 2 / 0 / ~4 / 1 | Silent skip with no REQUIRED gate (T50). | |
| 16 | +| `e2e_pypi_multi_copy.rs` | 290 | 0 / 1 / ~6 / 2 | Its `--json` rollback output is never parsed. | |
| 17 | +| `e2e_redirect_bun_build.rs` | 1917 | 6 / 3 / ~70 / 6 | Bun toolchain ×3 (T70); the v1 leg's last assert can't fail. | |
| 18 | +| `e2e_redirect_cargo_build.rs` | 1066 | 5 / 3 / ~40 / 3 | Fixture helpers ×4 (T71); 4b's check is optional. | |
| 19 | +| `e2e_redirect_cargo_shapes.rs` | 1559 | 8 / 2 / ~40 / 2 | `run_shape` is 365 lines; the unwind tolerance is too wide. | |
| 20 | +| `e2e_redirect_composer_build.rs` | 1009 | 4 / 1 / ~15 / 5 | Tamper `assert_ne!` can't fail. | |
| 21 | +| `e2e_redirect_gem_build.rs` | 4861 | 8 / 3 / ~120 / 9 | 16 `is_none()` asserts can't fire; a 787-line fixture. | |
| 22 | +| `e2e_redirect_gem_stale_install.rs` | 1881 | 1 / 1 / ~35 / 12 | 9 VEX checks pass when no file is written; argv ×11. | |
| 23 | +| `e2e_redirect_gradle_build.rs` | 2288 | 7 / 4 / ~15 / 7 | `codes()` reads `warnings` twice (confirmed); `Cell::vex` ignores the exit code. | |
| 24 | +| `golang_production/mod.rs` | 224 | 1 / 0 / ~1 / 1 | `#[path]` re-mounts of `common`; checks an impossible `"redirected"` action. | |
| 25 | + |
| 26 | +### Structural findings |
| 27 | +- **T70 → [#1992](https://github.com/SocketDev/socket-patch/issues/1992) (new).** The bun toolchain block is copied across `e2e_redirect_bun_build`, `e2e_vendor_bun_build` and `mode_migration_bun`. |
| 28 | + - Six helpers are md5-identical in all three suites (`parse_bun_version` 59beb239, `bun_required` 87d11bab, `pinned_bun_version` f0a8041d, `expected_lock_version` 302e2a61, `fixture_install_args` f599907c, `packages_line` 9864c4c9). |
| 29 | + - The three `bun_toolchain` copies differ only in the suite name. |
| 30 | +- **T71 → [#1993](https://github.com/SocketDev/socket-patch/issues/1993) (new).** The cargo suites re-write their fixture helpers beside `cargo_e2e_matrix`, which they already include. |
| 31 | + - `cargo` ×4 (f9f7f391), `sparse_index_rel` ×3 (c5573a49) and `find_registry_crate` ×4 (07d0421e; the shapes copy has drifted to fbb0ccc2). |
| 32 | + - `locked_version` ×3 (b933fd5b) and `package_block` ×3 (312981d4) hand-parse `Cargo.lock`, although `parse_lock` already reads it. |
| 33 | +- **T72 (to verify, new).** The hosted patch-API mocks are hand-mounted in 122 test files (counted by grepping for `patches/by-package`). The by-package block is identical in bun and composer, and npm differs only in a constant's name. Gradle `mount_grants` is a fork of `hosted_maven_common::mount_api`: it adds multiple grants, `server.reset()` and global constants. This needs a design (one `mount_hosted_api`) before it can be filed. |
| 34 | +- **T73 (to verify, new).** Fixtures copied between pairs of suites: |
| 35 | + - pypi `dupkit` (bytecode and multi_copy; `stage_patch` differs only in its vuln and description); |
| 36 | + - JVM `central_file`/`pristine_jar`/`patch_jar` (gradle redirect and agent, md5-identical); |
| 37 | + - the `ruby -e 'puts Gem.ruby_api_version'` probe ×7, where gem_build L1629 drops the status check; |
| 38 | + - `percent_decode` ×3. |
| 39 | +- **More evidence for existing rows:** |
| 40 | + - **T55:** `sha256_hex` (7de5c5fd) is identical in 6 files that include `common`. `e2e_pypi` keeps `git_sha256_file` and `assert_run_ok` byte-for-byte. |
| 41 | + - **T64:** `hosted_pinned` is md5-identical in gem_stale and hosted_production, and appears in 10 files by name. `copy_dir_recursive` adds a drifted gem copy (2fe2a6f1), and `golang_production` adds a 21st copy-tree body. |
| 42 | + - **T68:** `golang_production` (#1698) merged the two Go legs into one `delivery(mode)`. `has_command`/`pm_command`/`tool` are still md5-identical in both suites, and the parents' comments still call golang "unsupported". |
| 43 | + - **T69:** gradle `codes()` iterates `[&json["warnings"], &json["warnings"]]`, and its doc names a `redirect` block that carries no warnings. gem_build `contains("mirror_overrides_source")` follows a check on a longer string that contains it. |
| 44 | + - **T50:** pypi_bytecode `let Some(py) else return` and the two bundler < 2.2 `println!` + `return` in gem_build skip with no REQUIRED gate. |
| 45 | + - **C32:** about 15 more sentence or raw-JSON `.contains` asserts. |
| 46 | + |
| 47 | +### Carried rows reconciled (5) |
| 48 | +- **C32:** `filed #1089` (still open). |
| 49 | +- **C33:** `filed #948`. CLI_CONTRACT.md is now 611 KB. |
| 50 | +- **C48:** `filed #1067`. [pdm_site.rs L314](https://github.com/SocketDev/socket-patch/blob/fd86ff211cae896fef2b0e20375f71e6cb52a38b/crates/socket-patch-core/src/crawlers/python_crawler/pdm_site.rs#L314) still keeps its own `tokio::time::timeout`. |
| 51 | +- **C68:** `filed #426`, the only one of the 9 bugs still open. |
| 52 | +- **C69:** `filed #761, #836`. Both are still open. |
| 53 | + |
| 54 | +### Register refresh |
| 55 | +- No T issue closed. #1849 closed #1832, which is the sibling's row. |
| 56 | +- To stay under 15K characters, I shortened the problem cells of 14 rows: T06, T08, T10, T12, T16, T19, T21, T24, T30-T32, T34, T42, T46, T47, T51, T57 and T65. |
| 57 | + |
| 58 | +### Ruled out |
| 59 | +- **Cargo, bun, composer and gradle skips:** they go through gated helpers (`cargo_available`, `bun_toolchain`, `composer_e2e_common::skip`, `gradle_skip`), so they are not silent. |
| 60 | +- **`#[ignore]` on pypi, composer, gem and gradle:** each is backed by a CI job or a documented on-demand run. |
| 61 | +- **Composer rollback reaching packagist and `golang_production` using the live proxy:** both are intended, so neither is T53. |
| 62 | +- **T61 and T67:** neither applies to the files read this run. |
| 63 | +- **`md5_hex` in gem vs maven:** not a copy; ruby shell-out vs pure Rust. |
| 64 | +- **`mount_api`'s `view_budget`:** it has a real `Some(1)` caller. |
| 65 | + |
| 66 | +### Next files |
| 67 | +`e2e_redirect_maven_build` (521), `e2e_redirect_npm_build` (1418), `e2e_redirect_pnpm_build` (2224), `e2e_redirect_rush_sim` (734), `e2e_redirect_uv_build` (111), `e2e_redirect_vlt_build` (1706), `e2e_redirect_yarn_berry_build` (1056), `e2e_redirect_yarn_classic_build` (1929), `e2e_safety_*` (7 files, 5,133 lines). About 14.8K lines. |
| 68 | + |
| 69 | +--- |
| 70 | +_Generated by [Claude Code](https://claude.ai/code)_ |
0 commit comments