Skip to content

fix(nix): the three flake check reds on main - #300

Merged
randomizedcoder merged 3 commits into
mainfrom
fix/capcheck-listener-token
Nov 14, 2026
Merged

randomizedcoder merged 3 commits into
mainfrom
fix/capcheck-listener-token

Conversation

@randomizedcoder

@randomizedcoder randomizedcoder commented Nov 13, 2026 •

Copy link
Copy Markdown
Owner

Three checks fail on main today. Each commit fixes one; what each check asserts is unchanged.

  • capability-check-no-caps / -names-sys-admin:
    • Since feat(xtcp2): listener model, authenticated socket by default (FP-3) #295, listeners start before the capability check. The default listener needs LISTENER_RAW_TOKEN_FILE and a writable /run/xtcp2, so the daemon exited 64 on the missing token and never printed the capability diagnostic.
    • Fix: both checks now create a 0400 token file and a metrics socket in $TMPDIR.
  • nlcap-ws (and nlcap-batch under it):
    • writePython3Bin runs flake8, which rejects two lines over 79 characters (E501) in nlcap_batch.py.
    • Fix: both lines are wrapped.
  • vm-check-runner:
    • 379a940 moved the guest scratch dir to a short vm.XXXXXX path outside the evidence directory, but the env row still expected a dir named work beside the evidence.
    • Fix: the guest records its work dir, and the row checks that it is vm.*, lies outside the evidence directory and has been removed.
  • Passed: every check above, plus nix-fmt, deadnix and statix.
  • Found while running nix flake check for FP-8 (test(nix): no-write-encoders check, goip_write docs (FP-8c) #299).

🤖 Generated with Claude Code

randomizedcoder and others added 3 commits November 12, 2026 18:15
…ocket path

Since the listener model (#295) the daemon starts its listeners before the
capability check: the default one needs LISTENER_RAW_TOKEN_FILE and
/run/xtcp2, so both checks exited 64 on the token and never reached the
capability diagnostic. Give them a 0400 token file and a metrics socket in
$TMPDIR.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
writePython3Bin runs flake8, so xtcp2-nlcap-batch, and with it the nlcap-ws
check, failed to build.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
379a940 moved the guest's scratch to a short vm.XXXXXX dir under
XDG_RUNTIME_DIR or TMPDIR, outside the evidence, but the env row still
wanted it named work and beside the evidence, so it failed. The guest now
records its work dir; the row checks it is vm.*, outside the evidence and
removed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
@randomizedcoder randomizedcoder changed the title fix(nix): capability checks pass a listener token and socket path fix(nix): the three flake check reds on main Nov 13, 2026
randomizedcoder added a commit that referenced this pull request Nov 13, 2026
@randomizedcoder
randomizedcoder merged commit 65c2e34 into main Nov 14, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant