Wire limits primitive tests into main suite
ober
37b991976570e99c57c630f7913a795b39d80aa8
--- a/Makefile +++ b/Makefile @@ -31,7 +31,7 @@ TYPED_RUST_SOURCES ?= $(TYPED_SOURCES) TYPED_RUST_DIR ?= build/typed/rust TYPED_WRAPPER_DIR ?= build/typed/jerboa -.PHONY: help chez chez-cross build binary binary-typed binary-typed-smoke binary-cross native-cross pure-audit typecheck typed-rust typed-wrappers typed-build typed-wrapper-smoke typed-split-tree-smoke typed-test typed-clean test test-reader test-core test-runtime test-stdlib test-ffi test-modules test-expanded test-contract test-ergo test-typed-core test-typed-parser test-typed-checker test-typed-rust test-typed-wrappers test-pure-audit test-features test-wrappers test-phase4a test-phase4b test-phase4c test-phase4d test-phase4e test-phase4f test-phase5 test-phase5e test-phase6 test-phase7 test-phase8 test-functional test-repl test-security test-security-profile test-native test-gaps native clean-native audit-native clean security security-production security-profile fuzz fuzz-smoke fuzz-deep fuzz-reader-fuzz fuzz-json-fuzz fuzz-http2-fuzz fuzz-dns-fuzz fuzz-pregexp-fuzz fuzz-csv-fuzz fuzz-base64-fuzz fuzz-hex-fuzz fuzz-uri-fuzz fuzz-format-fuzz fuzz-router-fuzz fuzz-sandbox-fuzz test-rawstring test-regex test-rx test-peg test-regex-all check-docs check-docs-strict docker-build docker-push +.PHONY: help chez chez-cross build binary binary-typed binary-typed-smoke binary-cross native-cross pure-audit typecheck typed-rust typed-wrappers typed-build typed-wrapper-smoke typed-split-tree-smoke typed-test typed-clean test test-reader test-core test-runtime test-stdlib test-ffi test-modules test-expanded test-contract test-ergo test-limits-primitives test-typed-core test-typed-parser test-typed-checker test-typed-rust test-typed-wrappers test-pure-audit test-features test-wrappers test-phase4a test-phase4b test-phase4c test-phase4d test-phase4e test-phase4f test-phase5 test-phase5e test-phase6 test-phase7 test-phase8 test-functional test-repl test-security test-security-profile test-native test-gaps native clean-native audit-native clean security security-production security-profile fuzz fuzz-smoke fuzz-deep fuzz-reader-fuzz fuzz-json-fuzz fuzz-http2-fuzz fuzz-dns-fuzz fuzz-pregexp-fuzz fuzz-csv-fuzz fuzz-base64-fuzz fuzz-hex-fuzz fuzz-uri-fuzz fuzz-format-fuzz fuzz-router-fuzz fuzz-sandbox-fuzz test-rawstring test-regex test-rx test-peg test-regex-all check-docs check-docs-strict docker-build docker-push help: @echo "Usage: make <target>" @@ -78,6 +78,7 @@ help: @echo " test-gaps Gap coverage tests" @echo " test-contract Runtime contract tests" @echo " test-ergo Ergonomic contract marker tests" + @echo " test-limits-primitives Limits/sandbox/supervisor/audit primitive tests" @echo " test-typed-parser Typed Jerboa parser tests" @echo " test-typed-checker Typed Jerboa checker tests" @echo " test-typed-rust Typed Jerboa Rust emitter tests" @@ -308,7 +309,7 @@ binary-cross: chez build chez-cross CC="$(CROSS_CC)" \ support/build-binary.sh $(BINARY_ENTRY) $(BINARY_OUTPUT)-$(CHEZ_TARGET_MACHINE) -test: test-reader test-core test-runtime test-stdlib test-ffi test-modules test-expanded test-regex-all test-contract test-ergo test-typed-parser test-typed-checker test-pure-audit +test: test-reader test-core test-runtime test-stdlib test-ffi test-modules test-expanded test-regex-all test-contract test-ergo test-limits-primitives test-typed-parser test-typed-checker test-pure-audit typecheck: @$(SCHEME) --libdirs $(LIBDIRS) --script support/typecheck.ss $(TYPED_SOURCES) @@ -424,6 +425,9 @@ test-ergo: @$(SCHEME) --libdirs $(LIBDIRS) --script tests/test-ergo.ss @$(SCHEME) --libdirs $(LIBDIRS) --script tests/test-jerboa-prelude-ergo.ss +test-limits-primitives: + @$(SCHEME) --libdirs $(LIBDIRS) --script tests/test-limits-primitives.ss + test-typed-core: @$(SCHEME) --libdirs $(LIBDIRS) --script tests/test-typed-core.ss --- a/docs/limits-followup.md +++ b/docs/limits-followup.md @@ -1,14 +1,36 @@ # Limits Follow-Up: Missing Enforcement and Test Work Reviewed: 2026-05-21 +Status updated: 2026-05-21 (post-`1e4aba7` follow-up) This document is a follow-up to `docs/limits.md` after reviewing the new limits/sandbox/audit module set added around commit `97eea41`. -The short version: the new modules are a useful start, and the modules load -under the normal repo Scheme runtime, but the `docs/limits.md` requirements -are not fully implemented yet. Several pieces are prototypes, static reports, -or partial helpers without fail-closed enforcement. +The short version after the follow-up commit: the new modules are wired far +enough for callers to choose safe fail-closed behavior, and the focused +primitive tests are now part of `make test`. Some backend work remains: +per-child sandbox install status still needs a parent-visible status pipe, +Linux cgroup enforcement is not implemented, and tracefs is still a strace +wrapper/parser rather than a full normalized filesystem-event backend. + +## Status After Follow-Up Fixes + +| § | Topic | Status | +|----|------------------------|--------| +| 1 | Unified sandbox API | SAFE PARTIAL — `sandbox-launch` has `require:` + `fail-closed?:`; macOS path policies wrap with `sandbox-exec`; **GAP**: child-to-parent install-status pipe | +| 2 | Process supervision | DONE — timeout/capture handling and `128 + signal` statuses are covered by focused tests | +| 3 | Resource limits | SAFE PARTIAL — requested-limit plans and installs are per-kind; parent-side time/output markers exist; **GAP**: cgroup v2 and parent-visible child install reports | +| 4 | Executable identity | DONE — path search, realpath/stat identity, comparison helper, and TOCTOU caveat are present | +| 5 | Filesystem tracing | SAFE PARTIAL — `tracefs-capabilities` + fail-closed wrapper exist; **GAP**: fd/cwd tracking and normalized fs-event output | +| 6 | Network allowlist | DONE for decision layer — IP literals and localnet ranges are denied before wildcard matching; **GAP**: DNS recheck + child network sandbox/proxy handoff | +| 7 | Environment/secrets | DONE — default deny policy, argv validation, env construction, and redaction helpers exist | +| 8 | Temp HOME/cache | DONE for helper layer — fake HOME, scratch/cache grants, env overrides, cleanup, and sandbox grant helper exist | +| 9 | Structured audit model | PARTIAL — event constructors and redaction exist; **GAP**: full integration from all primitives | +| 10 | Tests | DONE — `tests/test-limits-primitives.ss` covers the new primitive set and is wired into `make test` | + +Detailed sections below preserve the original review findings so later backend +passes can see the exact requested behavior. Treat "Missing" and "Observed" +subsections below as historical unless the status table above still lists a GAP. ## Current Implemented Pieces @@ -30,9 +52,16 @@ Basic import smoke tests passed for all of those modules under: /Users/user/mine/jerboa/.chez/bin/scheme --libdirs lib --script <script> ``` -`make build` also completed successfully, but it only reported a small number -of compiled modules and does not prove these new modules have behavioral test -coverage. +`make build` completed successfully during the original review. The current +behavioral baseline is: + +```sh +make test +# includes tests/test-limits-primitives.ss + +/Users/user/mine/jerboa/.chez/bin/scheme --libdirs lib --script tests/test-limits-primitives.ss +# 43 passed, 0 failed, 0 skipped +``` ## Required Standard Before Calling This Done