fix(test): name the allowlist test for what it checks #18

Merged

jlxq0 merged 1 commit from fix/allowlist-test-name into main

2026-08-27 04:39:48 +00:00

jlxq0 commented

2026-08-27 04:38:05 +00:00

Owner

Closes #11.

deployed_allowlist_parses promised in its name to observe a deployment and
observed nothing. It hardcodes a nine-entry literal, parses it, asserts the
count is nine, and stops. No test in this suite reads an environment variable
(grep -n 'env::var' src/oauth_redirect.rs is empty), so it could not notice
the deployed value dropping an entry — silently breaking a client — or gaining
one, silently enabling a redirect nobody reviewed.

A green test named for a security allowlist it does not check is worse than
no test, because it is evidence to the next reader that the allowlist is
checked. Measured under the old name: adding
https://attacker.example/callback to the literal and bumping the count to ten
left all ten tests in the module green.

The rename

mixed_scheme_allowlist_parses_every_entry, which is what it does: the
parser's scheme coverage across https, three private-use schemes and a
cleartext loopback entry.

Verified the new name is not itself a vacuous claim. Making
validate_redirect_uri reject private-use schemes turns it red, along with
allowlist_accepts_private_use_schemes,
loopback_relaxation_checks_the_entry_scheme and
non_loopback_entries_keep_exact_port_matching — 6 passed, 4 failed. A rename
that swapped one unfalsifiable name for another would have been the same defect
with better wording.

The capability left unbuilt

The comment says what would observe the deployed value rather than leaving it
implied: reading clusters/fondue/carddav-mcp/deployment.yaml from
oddie-apps/platform and comparing. Another repository, another pipeline, and
a network read from a unit test. Not built, and probably not worth building —
the defect was the name, and a known limit stated is not the same object as a
false claim.

For the record, and stated as what it is: the literal and the live value are
byte-identical right now, 9 entries each. That is agreement, not a measurement,
and the mutation above is what shows the difference.

AGENTS.md no longer names the old test. It now says no test observes the
deployed allowlist and none can from this repository, which survives the next
rename.

Verification

Gates green at f1ae981b: fmt, clippy -D warnings, 95 tests, and the two
mutations above. No behaviour change — a test name and comments — so v0.1.4
stays the release and the pod stays on sha256:dd915b10….

Closes #11. `deployed_allowlist_parses` promised in its name to observe a deployment and observed nothing. It hardcodes a nine-entry literal, parses it, asserts the count is nine, and stops. No test in this suite reads an environment variable (`grep -n 'env::var' src/oauth_redirect.rs` is empty), so it could not notice the deployed value dropping an entry — silently breaking a client — or gaining one, silently enabling a redirect nobody reviewed. **A green test named for a security allowlist it does not check is worse than no test**, because it is evidence to the next reader that the allowlist is checked. Measured under the old name: adding `https://attacker.example/callback` to the literal and bumping the count to ten left **all ten tests in the module green**. ## The rename `mixed_scheme_allowlist_parses_every_entry`, which is what it does: the parser's scheme coverage across `https`, three private-use schemes and a cleartext loopback entry. **Verified the new name is not itself a vacuous claim.** Making `validate_redirect_uri` reject private-use schemes turns it red, along with `allowlist_accepts_private_use_schemes`, `loopback_relaxation_checks_the_entry_scheme` and `non_loopback_entries_keep_exact_port_matching` — 6 passed, 4 failed. A rename that swapped one unfalsifiable name for another would have been the same defect with better wording. ## The capability left unbuilt The comment says what would observe the deployed value rather than leaving it implied: reading `clusters/fondue/carddav-mcp/deployment.yaml` from `oddie-apps/platform` and comparing. Another repository, another pipeline, and a network read from a unit test. Not built, and probably not worth building — the defect was the name, and a known limit stated is not the same object as a false claim. For the record, and stated as what it is: the literal and the live value are byte-identical right now, 9 entries each. That is agreement, not a measurement, and the mutation above is what shows the difference. `AGENTS.md` no longer names the old test. It now says no test observes the deployed allowlist and none can from this repository, which survives the next rename. ## Verification Gates green at `f1ae981b`: fmt, clippy `-D warnings`, 95 tests, and the two mutations above. No behaviour change — a test name and comments — so `v0.1.4` stays the release and the pod stays on `sha256:dd915b10…`.

jlxq0 added 1 commit

2026-08-27 04:38:05 +00:00

fix(test): name the allowlist test for what it checks

CI / cargo (pull_request) Successful in 1m11s

Details

CI / docker (pull_request) Successful in 48s

Details

f1ae981b97

deployed_allowlist_parses promised in its name to observe a deployment and
observed nothing. It hardcodes a nine-entry literal, parses it, and asserts the
count. Nothing in the suite reads an environment variable, so it could not
notice the deployed value dropping an entry (silently breaking a client) or
gaining one (silently enabling a redirect nobody reviewed).

A green test named for a security allowlist it does not check is worse than no
test, because it is evidence to the next reader that the allowlist is checked.
Measured under the old name: adding https://attacker.example/callback to the
literal and bumping the count to ten left all ten tests in the module green.

Renamed to mixed_scheme_allowlist_parses_every_entry, which is what it does --
the parser's scheme coverage across https, three private-use schemes and a
cleartext loopback entry. Verified the new name is not a vacuous claim:
rejecting private-use schemes in validate_redirect_uri turns it red along with
three others.

The comment records what would observe the deployed value, since the capability
is a known limit rather than something to leave implied: reading
clusters/fondue/carddav-mcp/deployment.yaml from oddie-apps/platform and
comparing, which is another repository, another pipeline, and a network read
from a unit test. Left unbuilt. The defect was the name.

AGENTS.md no longer names the old test; it now says no test observes the
deployed allowlist and none can from this repository.

Closes #11

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

jlxq0 merged commit 35d804e287 into main

2026-08-27 04:39:48 +00:00

jlxq0 deleted branch fix/allowlist-test-name

2026-08-27 04:39:48 +00:00

jlxq0 referenced this pull request from a commit

2026-08-27 04:39:49 +00:00

Merge pull request 'fix(test): name the allowlist test for what it checks' (#18) from fix/allowlist-test-name into main

jlxq0 referenced this pull request

2026-08-27 04:41:37 +00:00

docs(agents): an extraction fault is symmetric, its two outcomes are not #19