test(repo-fleet-hygiene): restore bare-repo-with-working-tree coverage

[kyle-sexton]

Closes #2656

Summary

bare-repo-with-working-tree shipped on main with zero suite coverage after the #2633/#2640 squash cycle. This restores the regression tests and adds a repo-level gate outside audit-fleet.test.sh so a self-consistent rewrite cannot delete the defender again.

Fix

• Restore bare-live / bare-pure fixtures and end-to-end assertions (positive bare+live tree with remedy, discovery under --root, ordinary bare hub still rejects)
• Unit-cover directory_has_non_git_entries and BARE_LIVE_TREE_* dedup via record_bare_live_tree
• Add scripts/check-fleet-finding-test-coverage.sh (+ baseline, self-test, CI lane) asserting every emitted finding kind is named in the suite or grandfathered

Verification

bash plugins/repo-fleet-hygiene/skills/audit/scripts/audit-fleet.test.sh
bash scripts/check-fleet-finding-test-coverage.test.sh
scripts/check-fleet-finding-test-coverage.sh --check

Related

Refs #2633 — bare-live feature squash.
Refs #2640 — recovery squash that dropped the suite coverage.

  

[claude]

Claude finished @kyle-sexton's task in 1m 9s —— View job

---

Security review — no issues found

• Gather context (PR diff, changed files)
• Review changed files for security issues
• Post findings

Scope reviewed: .github/workflows/ci.yml, plugins/repo-fleet-hygiene/skills/audit/scripts/audit-fleet.test.sh, scripts/check-fleet-finding-test-coverage.sh, scripts/check-fleet-finding-test-coverage.test.sh, scripts/fleet-finding-test-coverage-baseline.txt.

This PR restores test fixtures/assertions for an existing finding kind and adds a new CI gate script that diffs finding-kind tokens between the collector and its test suite. No security-relevant surface stood out:

• New CI job (fleet-finding-test-coverage-gate in ci.yml): inherits the workflow's top-level permissions: contents: read (no job-level override), uses the already-pinned actions/checkout@3d3c42e5a... (v7.0.1) with persist-credentials: false, and its run: steps only invoke fixed local scripts — no github.event.*/github.head_ref interpolation inside run: blocks, so no script-injection surface. Not pull_request_target, no secrets used.
• scripts/check-fleet-finding-test-coverage.sh: pure text extraction (grep/awk) over the collector script to enumerate emit_finding kind tokens; no eval, all variables quoted, grep -F -- used for literal matching. Inputs (SCRIPT/TEST/BASELINE paths) are repo-local, overridable only via env vars for test injection, not attacker-influenced in CI.
• Test additions in audit-fleet.test.sh: the eval "$(sed -n '/^fn()/,/^}/p' "$SCRIPT")" pattern used to unit-probe directory_has_non_git_entries/record_bare_live_tree is the same technique already used elsewhere in this file for other helper functions — it operates on the repo's own script content, not external/attacker input.
• Baseline file is static data (finding-kind name tokens), no executable content.

No injection, authorization, secret-handling, or Actions permission/trigger issues identified in this diff.

[github-actions]

Last security-reviewed head: dd9b29647a99907157ebc1d67e25f89df4f325b3. On the next push, the relevance gate compares only the commits since this SHA; delete this comment to force a full re-review.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[claude]

Claude finished @kyle-sexton's task in 28s —— View job

---

Security review — skipped (no new commits since last review)

• Gather context (PR diff, changed files, prior comments)
• Check skip gate
• Post result

Skip reason: HEAD SHA dd9b2964 already has a completed, passing security review recorded on this PR (posted 2026-08-15T02:34:49Z, scope: .github/workflows/ci.yml, plugins/repo-fleet-hygiene/skills/audit/scripts/audit-fleet.test.sh, scripts/check-fleet-finding-test-coverage.sh, scripts/check-fleet-finding-test-coverage.test.sh, scripts/fleet-finding-test-coverage-baseline.txt, result: no issues found). The gate-tracking comment confirms this is still the last-reviewed head and no commits have landed since. Per the skip gate in /review:security-review, re-running would be redundant — deferring to that prior result.

No new review posted. If you want a full re-review anyway (e.g. after force-pushing or amending without a new SHA), delete the gate-tracking comment or push a new commit to trigger it.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dd9b29647a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @cursor[bot]'s task in 2m 19s —— View job

---

Code review

• Gather context (PR diff, changed files)
• Review changed files for correctness/maintainability issues
• Post findings

Scope reviewed: .github/workflows/ci.yml, plugins/repo-fleet-hygiene/skills/audit/scripts/audit-fleet.test.sh, scripts/check-fleet-finding-test-coverage.sh, scripts/check-fleet-finding-test-coverage.test.sh, scripts/fleet-finding-test-coverage-baseline.txt, plugins/repo-fleet-hygiene/.claude-plugin/plugin.json, plugins/repo-fleet-hygiene/CHANGELOG.md.

Reviewed against HEAD~3..HEAD (437bebb), matching the PR's 7 changed files (the sandboxed checkout is shallow and has no merge-base with origin/main, so I diffed the PR's own commit range instead).

Note: the P1 raised by Codex (check-fleet-finding-test-coverage.sh counting any substring occurrence — including F_KIND injection arrays — as coverage, which false-greened locked-worktree) is already fixed in the latest commit 437bebb: kind_asserted() now requires the literal Finding: <kind> needle, with a self-test (check-fleet-finding-test-coverage.test.sh:126-144) proving a bare F_KIND=(...)/comment mention no longer satisfies the gate, and locked-worktree / worktree-root-pluginconfigs-unreadable are grandfathered in the baseline in the interim.

I verified the restored directory_has_non_git_entries / record_bare_live_tree unit probes and the bare-live/bare-pure fixtures against the actual collector logic in audit-fleet.sh (lines 902-966) — the true/false and dedup expectations match the source. I could not execute the test suites directly in this sandbox (script execution requires approval that isn't available here), so this is a static read-through, not a live run.

Finding posted inline:

• .github/workflows/ci.yml:601-607 — the new fleet-finding-test-coverage-gate job (and its own doc comment) was inserted between the pre-existing "CHANGELOG parity: ..." comment and the changelog-parity-gate: job it actually documents, orphaning that comment from its job. Minor readability issue, not a functional one — the needs: list for ci-status correctly includes the new job (.github/workflows/ci.yml:1180).

No correctness bugs found in the restored assertions, the new coverage gate, or the version/changelog bump.

[github-actions]

Claude has reviewed this PR 5 times. The lane skips further automatic reviews after 5; deleting this comment resets the count.

[claude]

Claude finished @cursor[bot]'s task in 4m 36s —— View job

---

Code review

• Gather context (PR diff, changed files, prior comments)
• Check skip gate — HEAD (5e735f3) is a new commit since the last recorded review (437bebb), so a fresh pass was needed
• Review changed files for correctness/maintainability issues
• Post findings

Scope reviewed: all 10 changed files (git diff origin/main...HEAD, base 9fbd2b2).

Findings posted inline (3):

1. .claude/settings.json:3 (blocking) — this commit silently reverts 9fbd2b2 (fix(claude): register the session-start hook and install enabled plugins #2655), its own direct parent, merged the same day: the hooks.SessionStart registration in .claude/settings.json is removed again, .claude/hooks/session-start.sh loses the ~110-line plugin-install/refresh block and the hash-locked pytest/pyyaml install (narrowed back to ruff), and docs/CLOUD-SESSIONS.md rolls back to match. Nothing in the PR description, commit message, or plugins/repo-fleet-hygiene/CHANGELOG.md explains this — it reads as an accidental drop from a stale-base rebase/squash rather than an intended change bundled into a repo-fleet-hygiene test-coverage PR. Recommend restoring these three files to origin/main's content unless the revert is deliberate, in which case it needs its own explanation.
2. .github/workflows/ci.yml:601 — the new fleet-finding-test-coverage-gate job is still wedged between the "CHANGELOG parity: ..." comment and the changelog-parity-gate: job it documents, orphaning that comment. This was already flagged in an earlier review pass on this PR and doesn't look addressed yet.
3. scripts/check-fleet-finding-test-coverage.sh:66 — kind_asserted's Finding: <kind> match has no boundary after $kind, so a kind that is a literal prefix of another emitted kind (the collector already has one such pair: worktree-root-conformance / worktree-root-conformance-summary) can be falsely reported "covered" by the longer kind's assertion alone. Both currently have their own explicit assertions so nothing false-greens today, but the gap reopens the exact silent-coverage-loss failure mode repo-fleet-hygiene: bare-repo-with-working-tree ships on main with zero test coverage after a stale-base squash and its fix #2656/this PR targets, just via prefix collision instead of raw substring.

Verified statically (could not execute scripts — no shell-execution approval in this sandbox): the restored directory_has_non_git_entries / record_bare_live_tree unit probes and bare-live/bare-pure fixtures in audit-fleet.test.sh match the actual collector logic in audit-fleet.sh:902-967; the Codex-flagged P1 (substring coverage false-greening locked-worktree) is fixed via the literal Finding: <kind> needle; all 17 baseline-grandfathered kinds genuinely lack a Finding: assertion in the suite (spot-checked via grep); check-fleet-finding-test-coverage.test.sh's synthetic-tree and historical-proof scenarios look sound.
· branch cursor/test-fleet-bare-live-tree-coverage-f8b0

[claude]

Claude finished @cursor[bot]'s task in 2m 11s —— View job

---

Code review

• Gather context (PR diff, prior review state, new commit since last review)
• Review changed files for correctness/maintainability issues
• Post findings

Scope: full PR diff origin/main...HEAD (7 files, +527/-3), with focused re-review of the latest commit ce1f241 since it landed after the prior review round.

Prior finding resolved: the ce1f241 commit fixes the job-ordering issue flagged in the earlier review (fleet-finding-test-coverage-gate was sitting between the CHANGELOG-parity doc comment and its job). It's now correctly placed before that comment block — ci.yml:592-623 — and the ci-status job's needs: list still references both gates (ci.yml:1179-1181).

Prior Codex P1 confirmed fixed: kind_asserted() in check-fleet-finding-test-coverage.sh:66-70 requires the literal Finding: <kind> needle rather than any substring match, so a bare F_KIND=(...) array or a comment mentioning the kind no longer satisfies the gate. Verified against check-fleet-finding-test-coverage.test.sh:126-144, which specifically asserts this (token-only-kind in an F_KIND= array + a comment is correctly reported as UNCOVERED).

Verified against source (static read-through):

• directory_has_non_git_entries / record_bare_live_tree / classify_bare_live_tree in audit-fleet.sh:902-967 match the restored unit probes in audit-fleet.test.sh:1667-1719 (nested-.git-plus-debris → true, ordinary git init --bare admin files → false; dedup by common-dir key, not by path).
• The add_target bare-live classification path (audit-fleet.sh:1096-1120) matches the new end-to-end assertions (audit-fleet.test.sh:1060-1108): explicit --repo, discovery under --root, and the "still rejects when pure bare" case all line up with the actual control flow.
• emit_finding is called with literal kind tokens everywhere in audit-fleet.sh (no variable-driven kinds), so the static regex extraction in check-fleet-finding-test-coverage.sh:57-58 can't silently miss a kind.
• plugin.json version bump (0.21.0 → 0.21.1) and the new CHANGELOG.md entry are consistent with a patch-level fix.

No new correctness or maintainability issues found. Could not execute the shell test suites in this sandbox (script execution isn't available here) — this is a static read-through of the diff against the collector source, not a live run; the PR's own verification section covers that.
· branch cursor/test-fleet-bare-live-tree-coverage-f8b0

[claude]

Claude finished @cursor[bot]'s task in 2m 19s —— View job

---

Code review

• Gather context (PR diff origin/main...HEAD, prior review rounds on this PR)
• Check skip gate — HEAD (e57c22c) is a new commit since the last recorded review (ce1f241), so a fresh pass was needed
• Verify previously-flagged issues are resolved
• Review new/changed lines for correctness and maintainability
• Post findings

Scope: full PR diff origin/main...HEAD (7 files, +527/-3). The only change since the prior review round (ce1f241 → e57c22c) is quoting the Check every emitted fleet finding kind has a Finding: assertion step name in ci.yml (the literal colon was invalid as an unquoted YAML step name).

Previously-flagged issues, re-verified against current HEAD:

• ✅ .claude/settings.json / .claude/hooks/session-start.sh / docs/CLOUD-SESSIONS.md revert (blocking) — no longer part of this diff; confirmed git diff origin/main...HEAD touches none of these files.
• ✅ fleet-finding-test-coverage-gate job ordering (orphaned CHANGELOG-parity comment) — fixed, job now sits before that comment block (ci.yml:592-621).
• ✅ Codex's P1 (raw substring match false-greening locked-worktree) — fixed via the literal Finding: <kind> needle, per the self-test at check-fleet-finding-test-coverage.test.sh:126-144.
• ⚠️ Still open: kind_asserted's prefix-boundary gap (worktree-root-conformance vs. worktree-root-conformance-summary) — flagged inline on scripts/check-fleet-finding-test-coverage.sh:69. Raised in two earlier review rounds on this PR and not addressed by the latest commit (which only touched the CI YAML quoting).

Verified against source (static read-through — script execution isn't available in this sandbox, matching prior rounds' caveat): directory_has_non_git_entries, record_bare_live_tree, and classify_bare_live_tree in audit-fleet.sh:902-967 match the restored unit probes (audit-fleet.test.sh:1667-1719) and the add_target bare-live classification path (audit-fleet.sh:1096-1120) matches the new end-to-end assertions (audit-fleet.test.sh:1060-1108) — nested-.git-plus-debris → true, ordinary git init --bare admin files → false; dedup by common-dir key, not by path. plugin.json version bump (0.21.0 → 0.21.1) and the CHANGELOG.md entry are consistent with the fix.

One open finding, posted inline. No other correctness or maintainability issues found.
· branch cursor/test-fleet-bare-live-tree-coverage-f8b0

[claude]

Claude finished @cursor[bot]'s task in 3m 45s —— View job

---

Code review in progress

• Gather context (PR diff, changed files, prior review threads)
• Run review across correctness/maintainability angles
• Verify findings against source
• Post inline findings and summary
  · branch cursor/test-fleet-bare-live-tree-coverage-f8b0