test_bootstrap_audit: the SUITE-DEPENDS marker was stale — #20s gated caller now runs

[jobordu]

Addresses #20's "caller that still runs it" leg. TEAMLEAD (session 15b69750), 2026-09-08.

The claim #20 made, still true 19 days later

"⚠ Note test_bootstrap_audit currently declares # SUITE-DEPENDS: and is therefore gated nowhere (#286) — so the caller exists and does not run."

Measured on origin/main: 4 of 61 suites declare the marker, and this is one.

⇒ The marker was stale, and "it passes" was not enough to show that

The declaration's own reason warns of the trap: "a fake would make its control pass without the thing it controls for." A suite can pass by skipping the legs that need the thing. So both directions, and a control:

with a live registry          rc 0 · 12 check lines
env -i, HOME=/nonexistent     rc 0 · 12 check lines · output BYTE-IDENTICAL
⛔ CONTROL, same bare env     test_stranded_branches.py → rc 1,
                              FileNotFoundError: 'gh'      (a real dependency)

No leg reads the registry. The declaration excluded the suite from the gate for a dependency it does not have.

At the gate — and the number moves

before   ran 57 hermetic suite(s) · 57 passed · skipped 4
after    ran 58 hermetic suite(s) · 58 passed · skipped 3 · 0 FINDINGS

⇒ That movement is what makes it a measurement. Earlier today I ran a marker test where skipped 4 came back identical with and without the change — a number that does not move is not evidence, and I nearly recorded it as one.

★ I swept the other three, and only this one was stale

suite	bare env	verdict
test_runmarker	rc 1, output differs	✅ genuine — injects into pane-binding, which exits 2 on an empty registry before reaching the injection
test_stranded_branches	rc 1, output differs	✅ genuine — gh, network + auth
test_grant_check	rc 0, identical	⚠ not stale. Its marker states a deliberate judgement: "MEASURED PASSING on a runner (run 32345860216); listed here only because a network-dependent gate is a flake source." That is an author's call about flakiness, not a claim I can refute by running it once. Left alone.

⚠ The last row is the one worth pausing on: the same measurement (bare rc 0, identical output) means "stale" in one file and "deliberate" in another, and only the stated reason distinguishes them. A sweep that acted on the measurement alone would have removed both.

What this does not claim

⚠ It adds a suite to the gating population. It passes hermetically today; if it ever fails there, that is a finding — the whole point of gating it — rather than a regression in this change.

⚠ And it does not close #20, whose predicate is about a pane reporting bootstrap failure in its ROLE-READY line. This lands one named leg of its condition.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Documentation
  • Updated test-suite comments to explain that the suite no longer depends on a live pane registry.
  • Removed the outdated suite dependency declaration.

[sentinel-by-digital-frontier]

🛡️ Sentinel PR review

1 file(s) changed · 0 introduced by this diff (secrets+SAST) · dependencies unchanged — SCA/CVE not re-scanned. Advisory — the fail-closed gate is the post-merge pentest.

Findings — ranked by criticality

No issues found on the changed surface.

🤖 Code review (Flynn)

No issues found.

Scan summary

Category	Scope	Findings
Secrets	this diff	0
Static analysis	changed files	0
Dependencies + IaC	skipped (no manifest changed)	0
Known CVEs	skipped (no manifest changed)	0

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 08da6e59-0bdb-43f9-9823-18573cb4f7e9

📥 Commits

Reviewing files that changed from the base of the PR and between 933a5a4 and ade7d77.

📒 Files selected for processing (1)

• tools/test_bootstrap_audit.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The change removes an obsolete SUITE-DEPENDS: comment from the bootstrap audit suite and replaces it with an explanation. No executable behavior changes.

Changes

Bootstrap audit metadata

Layer / File(s)	Summary
Update suite dependency documentation tools/test_bootstrap_audit.py	The obsolete dependency marker is replaced with a comment explaining that the suite no longer requires a live Daintree pane registry.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to ade7d

This removes a stale suite dependency declaration so the bootstrap audit suite is included in hermetic gating. No remaining merge-blocking risk is identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the stale SUITE-DEPENDS marker and the resulting gated execution of test_bootstrap_audit.
Linked Issues check	✅ Passed	The change satisfies the caller-gating requirement in [#20] by removing the stale marker and adding test_bootstrap_audit to the hermetic suite population. The broader ROLE-READY contract remains outsi…
Out of Scope Changes check	✅ Passed	The changes are limited to removing the stale suite dependency marker and documenting the rationale. They directly support the linked issue's gating requirement and introduce no unrelated code changes…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch tl/20-gate-bootstrap-audit

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}