unit

package
v1.0.21 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 26, 2026 License: MIT Imports: 49 Imported by: 0

Documentation

Overview

Package unit holds AUR-424's Unit-layer proof: the standard-library Go documentation extractor (internal/documentation/extractors/go) parses real Go source, renders real symbols and their real doc comments, and never invokes an external tool to do it.

This file is not named "_test.go" on purpose, mirroring every sibling card in this office (AUR-402..AUR-411, AUR-422): tests/acceptance/AUR-424.sh stages a private writable copy of the module and writes a tiny bridge "_test.go" file that calls TestAUR424, so the assertions below run inside the sandboxed acceptance instead of being swept into an unrelated top-level `go test ./...`.

AUR-425 unit selector: a run of cmd/regenerate-docs that produces zero documentation pages must state the reason and exit non-zero, instead of the historical silent exit 0.

WHY THIS DRIVES THE REAL BINARY INSTEAD OF IMPORTING THE PACKAGE: the verdict under test lives in report() inside package main of cmd/regenerate-docs; a main package cannot be imported, and the promised behaviour is a raw process exit status, which only the operating system can prove. The card's mutation (MUT-001: going back to exit 0 with zero pages) is only observable at that boundary, so any in-process re-model of the switch would pass under the mutation and be a false green.

This file is a plain (non-_test) source in package unit, per the board's selector convention; the acceptance stages it next to a generated bridge _test file that calls TestAUR425.

Package unit holds AUR-426's Unit-layer proof: `aurumcode docs` is a real, flag-driven subcommand of cmd/aurumcode that reuses internal/pipeline and internal/documentation/extractors to generate documentation -- not a stub that only parses flags -- and that its --help output, docs/specs/AUR-426.md and the flag set actually registered in the code all agree (MUT-001: the three must never silently drift apart).

This file is not named "_test.go" on purpose, mirroring every sibling card in this office: tests/acceptance/AUR-426.sh stages a private writable copy of the module and writes a tiny bridge "_test.go" file that calls TestAUR426, so the assertions below run inside the sandboxed acceptance instead of being swept into an unrelated top-level `go test ./...`.

Package unit holds AUR-427's Unit-layer proof: the native, tool-free documentation extractors for Rust (internal/documentation/extractors/rust) and C# (internal/documentation/extractors/csharp) parse real `///`/`//!` doc comments out of real source text, render real Markdown pages from them, and start no subprocess to do it.

This file is not named "_test.go" on purpose, mirroring every sibling card in this office (AUR-402..AUR-411, AUR-422, AUR-424, AUR-426): tests/acceptance/AUR-427.sh stages a private writable copy of the module and writes a tiny bridge "_test.go" file that calls TestAUR427, so the assertions below run inside the sandboxed acceptance instead of being swept into an unrelated top-level `go test ./...`.

Package unit holds AUR-428's Unit-layer proof: the example workflow the user copies verbatim (.github/workflows/examples/documentation.yml) is a real, parseable GitHub Actions manifest whose own declarations deliver the card's outcome -- it can be triggered by `gh workflow run`, it references the AurumCode action by a publishable semver tag (never a local commit SHA and never a mutable branch), and it grants exactly the permissions GitHub Pages deployment requires (`pages: write`, `id-token: write`).

The card's "Restricao medida" fixes the scope: the acceptance sandbox has no network, so this layer is STATIC verification of the manifest -- a real YAML parse into a node tree, walked structurally. It is not a grep over bytes: a workflow that does not parse, or whose structure moved, fails here even if the right substrings still appear somewhere in the file.

This file is not named "_test.go" on purpose, mirroring every sibling card in this office (AUR-402..AUR-411, AUR-422, AUR-424): tests/acceptance/AUR-428.sh stages a private writable copy of the module and writes a tiny bridge "_test.go" file that calls TestAUR428, so these assertions run inside the sandboxed acceptance instead of being swept into an unrelated top-level `go test ./...`.

AUR-429 unit selector: the smallest observable seam of "a pagina publicada abre e navega" — browserproof.VerifyDocs driven over hand-built published trees through the offline scripted driver.

What this lane proves, per AC-001:

  • a site whose home page opens, whose index links to a page, and whose linked page shows the expected content is PROVED, and the verdict carries the followed link, the followed route and a full corroborated browser proof;
  • a linked page WITHOUT the expected content is REFUSED with BROWSERPROOF_TEXT_MISMATCH — the exact behavior MUT-001 deletes; if it ever comes back proved this lane prints AUR-429/AC-001/MUT-001 and fails;
  • an index that links to nothing is REFUSED as unreachable, a missing home page is REFUSED as absent, and a driver that forges observations can never produce proof;
  • the verdict survives its own contract: Validate accepts the real run and rejects a doctored "proved" verdict, and the JSON round-trips through ParseDocsVerifyResultV1.

This is a plain (non-_test) source in package unit; the acceptance stages it into a private module next to a generated bridge _test file, mirroring AUR-424/AUR-425/AUR-428.

Package unit holds AUR-440's Unit-layer proof: the example workflow the user copies verbatim (.github/workflows/examples/code-review.yml) is a real, parseable GitHub Actions manifest whose own declarations deliver the card's outcome -- every pull request opened in the user's repository is reviewed automatically and receives the AurumCode comment, with nobody running a command.

The architecture this card fixed in its Escopo: GitHub Actions triggers natively on the `pull_request` event and authenticates with the Action's own token. There is NO self-hosted webhook server and NO HMAC validation here -- that second trigger model (internal/git/webhook, cmd/server) stays out of scope, recoverable from commit c12d7ab if a future card wants it.

Scope per the card's Preconditions: the acceptance sandbox has no network, so this layer is STATIC verification of the manifest -- a real YAML parse into a node tree (gopkg.in/yaml.v3), walked structurally. It is not a grep over bytes: a workflow that does not parse, or whose structure moved, fails here even if the right substrings still appear somewhere in the file.

This file is not named "_test.go" on purpose, mirroring every sibling card in this office (AUR-402..AUR-411, AUR-422, AUR-424, AUR-428): tests/acceptance/AUR-440.sh stages a private writable copy of the module and writes a tiny bridge "_test.go" file that calls TestAUR440, so these assertions run inside the sandboxed acceptance instead of being swept into an unrelated top-level `go test ./...`.

Package unit holds AUR-443's Unit-layer proof: a user who has never read the source discovers what `aurumcode` does and can run a first review, through the real binary's --help/--version surfaces, its unified --help convention, its provider-missing message, and its cleaned-up git-repository/ref-resolution errors -- while every pre-existing published surface this card must not disturb (review --base's findings output, docs's output, the AUR-433 --limite exit code) stays exactly as it was.

This file is not named "_test.go" on purpose, mirroring every sibling card in this office (see tests/unit/AUR-426.go's own note): tests/acceptance/AUR-443.sh stages a private writable copy of the module and writes a tiny bridge "_test.go" file that calls TestAUR443, so the assertions below run inside the sandboxed acceptance instead of being swept into an unrelated top-level `go test ./...`.

Package unit holds AUR-444's Unit-layer proof.

THE DEFECT THIS PROVES FIXED 

scripts/action-entrypoint.sh invoked "$AURUMCODE_CLI" review with flags
(--provider, --model, --api-key, --github-token, --post-comments) that
cmd/aurumcode's review command never registered. The binary would refuse
the parse: the Action publicised a code review it could never run.

HOW THIS IS PROVED, AND WHY NOT BY grep-ING A HAND LIST 

The card explicitly forbids a hand-written list of "the real flags":
that is exactly the kind of claim this card exists to correct. Measured
independently against this repository's actual tip (`go build` +
`review --help`): --check DOES exist (AUR-439's code is integrated as of
this tip -- an earlier measurement against a stale board state found it
absent; see docs/specs/AUR-444.md for why --check is still not wired
into this entrypoint mode, and why that is a deliberate scope decision,
not another missed flag). The real, registered flag set is derived here
by parsing cmd/aurumcode's OWN source with go/parser: it walks the
function that calls flag.NewFlagSet("review", ...) and collects every
flag name registered on that flag.FlagSet (.String/.Bool/.Int/...) --
dynamically, so this proof cannot go stale the way a hand list already
has once.

go/parser only needs syntax, not type-checked imports, so this Unit
layer needs none of cmd/aurumcode's internal/... dependencies to be
materialized on disk -- unlike tests/integration/AUR-444.go, which now
also builds and runs the REAL binary (AUR-444's read_paths carries the
full compile closure as of this tip) for an independent, build-based
confirmation of the same property. The two do not depend on each other;
either alone would already catch the defect this card fixes.

This file is not named "_test.go" on purpose, mirroring every sibling card in this office: tests/acceptance/AUR-444.sh stages a private writable copy and writes a tiny bridge "_test.go" file that calls TestAUR444, so this assertion runs inside the sandboxed acceptance instead of being swept into an unrelated top-level `go test ./...`.

Package unit holds AUR-445's Unit-layer proof: none of the five families of false statement the 2026-08-13 audit found (.board/cards/ready/AUR-445.md, "Achados medidos") still appear in the six root documentation files this card owns, and the true replacement text is present where the audit demanded it.

The five families, each already false before this card's fix:

  • "No LICENSE file is present" (README.md, ACTION_USAGE.md, CHANGELOG.md)
  • "No code-review or test-generation output" (CHANGELOG.md)
  • "Every knob is an environment variable" as an unqualified, whole-repository claim (CHANGELOG.md, docs/getting-started.md)
  • `gomarkdoc` declared required for Go (README.md, SETUP_GUIDE.md, ACTION_USAGE.md, docs/getting-started.md, RUN_DOCS_PIPELINE.md)
  • "the only command in this repository" (RUN_DOCS_PIPELINE.md)

This layer is pure text: it normalizes each file (strip backticks, lowercase, collapse all whitespace including newlines to single spaces) and substring-matches the same-normalized banned phrase and the same-normalized required anchor. It does not read any other package's source; that cross-check is the Integration layer (tests/integration/AUR-445.go).

Not named "_test.go" on purpose, mirroring every sibling card in this office (AUR-402..AUR-411, AUR-422, AUR-424, AUR-428, AUR-440): tests/acceptance/AUR-445.sh stages a private writable copy of the module and writes a tiny bridge "_test.go" file that calls TestAUR445, so these assertions run inside the sandboxed acceptance instead of being swept into an unrelated top-level `go test ./...`.

Selector naming note: the card's own "TDD proof" section names the selectors TestAUR428 / IntegrationAUR428 / E2EAUR428 -- residue from the AUR-428 template this card was cloned from. Those symbols already exist in tests/unit/AUR-428.go and tests/integration/AUR-428.go, in these same packages; redeclaring them here would collide and break `go build ./...`. This file uses TestAUR445 instead, matching this card's own ID and the naming pattern every other card in the office follows. Recorded in docs/specs/AUR-445.md.

AUR-446 unit selector: proves the anchor checker this card's acceptance relies on is correct, using in-memory fixtures -- not the real files on disk (IntegrationAUR446 in tests/integration/AUR-446.go exercises those).

AC-001's "grep de verificacao estatica sobre os specs entregues" is, at its core, a substring check: a corrected spec must contain the anchor that states the delivered behaviour and must not contain the anchor that states the stale, pre-correction claim. specAnchors() below is the exact table tests/acceptance/AUR-446.sh and tests/integration/AUR-446.go also use (duplicated per file on purpose: each selector is staged alone into its own sealed container, per tests/acceptance/EXIT_CODE_CONVENTION.md's documented idiom, so a shared sourced library would not resolve there).

Anchors are compared after whitespace normalization (every run of whitespace, including newlines, collapsed to one space) so a check is immune to where a paragraph happens to wrap -- verified empirically against the real pre-fix files in docs/specs/AUR-446.md's "O comando" table before this file was written.

This file is a plain (non-_test) source in package unit, per the board's selector convention; the acceptance stages it next to a generated bridge _test file that calls TestAUR446.

Package unit holds AUR-447's Unit-layer proof: `aurumcode docs --source <projeto Rust ou C#>` generates real documentation pages through cmd/aurumcode/docs.go's registerDocsExtractors -- not the "no extractor registered", zero-page failure a reviewer reproduced before this card -- while Go (already supported since AUR-426) keeps working.

This file is not named "_test.go" on purpose, mirroring every sibling card in this office: tests/acceptance/AUR-447.sh stages a private writable copy of the module and writes a tiny bridge "_test.go" file that calls TestAUR447, so the assertions below run inside the sandboxed acceptance instead of being swept into an unrelated top-level `go test ./...`.

Package unit holds AUR-448's Unit-layer proof, at the internal/review package API level: GenerateReview names how many findings the rule gate (AUR-434) discarded and why -- a missing rule_id, an unknown one, or both -- in result.Metadata["discard_warning"], and that string is empty exactly when nothing was discarded (the byte-identical happy path cmd/aurumcode's stderr guard depends on).

This card's TDD proof section names the unit selector TestAUR435; that collides with the function tests/unit/AUR-435.go already declares in this same package (a different card). See docs/specs/AUR-448.md's "A note on this card's own TDD-proof identifiers" for why this file declares TestAUR448 instead, following every sibling card's own numeral-matches-file convention (TestAUR434, TestAUR443, ...).

This file is not named "_test.go" on purpose, mirroring every sibling card in this office (see tests/unit/AUR-434.go's own note): tests/acceptance/AUR-448.sh stages a private writable copy of the module and writes a tiny bridge "_test.go" file that calls TestAUR448, so the assertions below run inside the sandboxed acceptance instead of being swept into an unrelated top-level `go test ./...`.

Selector naming note, the same technique tests/unit/AUR-442.go and tests/unit/AUR-445.go document: a function named TestAUR435 already exists in this package (tests/unit/AUR-435.go) and would collide, so this proof is TestAUR449 even though the card text's TDD proof section names TestAUR435 (a copy-paste artifact from the AUR-435 card this one was drafted against).

Selector naming note, the same technique tests/unit/AUR-442.go and tests/unit/AUR-449.go document: a function named TestAUR435 already exists in this package (tests/unit/AUR-435.go) and would collide, so this proof is TestAUR450 even though the card text's TDD proof section names TestAUR435 (a copy-paste artifact from the AUR-435 card this one was drafted against).

Package unit holds AUR-455's Unit-layer proof: the 2026-08-14 onboarding audit (.board/cards/ready/AUR-455.md, "Achados medidos") found the product's main feature invisible in the README, a documented build command that fails, a broken relative path in the only executable review example, and a naming collision in docs/getting-started.md. This layer checks, by static text, that the fix this card ships actually removed each false or missing statement and left true, honest replacement text in its place.

What this layer does NOT do: it never runs `go build`, `go run` or demo.sh itself -- that is tests/e2e/AUR-455.go's job (and tests/acceptance/AUR-455.sh's AC-001, which wraps it). This layer only reads README.md, docs/getting-started.md and demo.sh as text, exactly like tests/unit/AUR-445.go reads its six root documentation files.

Selector naming note: the card's own "TDD proof" section names the selectors TestAUR445 / IntegrationAUR445 / E2EAUR445 -- residue from the AUR-445 card this one was cloned from as a template. Those symbols already exist in tests/unit/AUR-445.go and tests/integration/AUR-445.go, in these same packages (`unit`, `integration`); redeclaring them here would collide and break `go build ./cmd/... ./internal/... ./pkg/...` and every `go test` invocation that touches these packages. This file uses TestAUR455 instead, matching this card's own ID and the naming pattern every other card in the office follows (see tests/unit/AUR-445.go's own identical note about AUR-428). Recorded in docs/specs/AUR-455.md.

Package unit holds AUR-456's Unit-layer proof: the 2026-08-14 audit (.board/cards/ready/AUR-456.md, "Achados medidos") found a closed set of files that either had no importer anywhere in the repository or had diverged from the version the binary actually embeds. This layer is a pure filesystem check -- existence, not content -- over the exact paths this card owns:

  • .aurumcode/rules/ (whole directory): dead since the first commit; the live catalog is internal/review/rules/*.yml, embedded via go:embed (internal/review/rules.go) and diverged from the dead copy on 2026-08-13.
  • .aurumcode/prompts/*.md (six files, everything except documentation/welcome-page.md): dead, because internal/prompt embeds its own templates/*.md at build time (internal/prompt/builder.go).
  • configs/ (whole directory): zero importer in Go or docs.
  • index.md and _config.yml at the REPOSITORY ROOT (not .aurumcode/): never read by any generator -- cmd/aurumcode/docs.go and cmd/regenerate-docs/main.go both default their output directory to ".aurumcode", never ".".
  • _api/ (whole directory): documents pipelines (review_pipeline.go/docs_pipeline.go/qa_pipeline.go) that do not exist under internal/pipeline/.
  • .github/actions/aurumcode-docs/ (whole directory, including README.md): action.yml is a second, incompatible Action definition no workflow references; its sibling README.md exists only to document that action.yml, so keeping the README after removing action.yml would create a NEW false claim (a reusable Action at a path with no action.yml) rather than remove one -- see docs/specs/AUR-456.md.
  • pages-fix.md, test-jekyll.sh: stray files with no importer.

The one exception this card must prove stays alive: .aurumcode/prompts/documentation/welcome-page.md, read as an optional override by internal/documentation/welcome/generator.go's defaultPromptPath (cross-checked against the source directly in tests/integration/AUR-456.go, not re-derived here).

Not named "_test.go" on purpose, mirroring every sibling card in this office (AUR-402..AUR-411, AUR-422, AUR-424, AUR-428, AUR-440, AUR-445): tests/acceptance/AUR-456.sh stages a private writable copy of the module and writes a tiny bridge "_test.go" file that calls TestAUR456, so these assertions run inside the sandboxed acceptance instead of being swept into an unrelated top-level `go test ./...`.

Selector naming note: the card's own "TDD proof" section names the selectors TestAUR445 / IntegrationAUR445 / E2EAUR445 -- residue from the AUR-445 template this card was cloned from. Those symbols already exist in tests/unit/AUR-445.go and tests/integration/AUR-445.go, in these same packages (unit, integration); redeclaring them here would collide and break `go build ./...` / `go vet ./...` over this package, exactly the problem AUR-445 itself hit and documented against its own AUR-428 template residue. This file uses TestAUR456 instead, matching this card's own ID and the naming pattern every other card in the office follows. Recorded in docs/specs/AUR-456.md.

Package unit holds AUR-457's Unit-layer proof.

AUR-457 was opened on the hypothesis that `oci-run --card AUR-002` exits 1 because AUR-424's gomarkdoc -> go/doc switch drifted the legacy characterization. Measurement falsified that. The characterization is intact; what fails is compiling the subject inside the sealed profile, because AUR-002's `read_paths` enumerates the extractor packages file by file and never gained the two `native.go` files AUR-427 (9ef5273) added and cmd/regenerate-docs/main.go:665,670 register.

This layer is the pure source-level half of that finding, asserted against the tree rather than against the spec: the registration sites still exist, and the constructors they name are really DEFINED in the two files the stale read_paths omits. It deliberately does not read docs/specs/AUR-457.md -- the acceptance script covers the spec, and a layer that only checked prose could stay green while the code moved underneath it.

Declared-selector note: the card declares `TestAUR446`, which is a template typo -- that symbol already exists at tests/unit/AUR-446.go:138 in this same package, so redeclaring it would not compile. Delivered as TestAUR457 and recorded as a declared gap in docs/specs/AUR-457.md.

AUR-458 unit selector. DISTINCT ASSERTION: the exit CODE alone, for every situation this card classifies as "did not review", plus the two situations it deliberately classifies as "reviewed" (exit 0). It makes no claim about stdout composition (that is tests/integration/AUR-458.go) and none about the CI gate's precedence (tests/e2e/AUR-458.sh).

AUR-460 unit selector. DISTINCT ASSERTION: the RAW bytes the litellm provider puts on the wire, in isolation from the rest of the review pipeline, never contain a "temperature" key -- no matter what value llm.Options.Temperature carries when Complete is called. This is the card's one required proof (the JSON body sent to the provider must not contain the key at all): tests/integration/AUR-460.go instead proves the composition through internal/review.Reviewer end-to-end against a gateway fixture that 400s on ANY explicit temperature, and tests/e2e/AUR-460.sh exercises the real compiled binary the same way.

Measured achado (2026-08-14, real gateway): `--modelo gpt-5.6-luna` returned "Unsupported value: 'temperature' does not support 0.3 with this model. Only the default (1) value is supported." Sending 0 instead of 0.3 is ALSO rejected by that model family, so the only value proven to work across the whole gateway fleet is the key's absence -- which is why this test checks for the substring "temperature" in the raw serialized body, not for a particular numeric value.

TestAUR462 proves the AUR-462 outcome at the package boundary: the 2026-08-14 measurement found the security pass caught a Node repository's planted secret and SQL injection but missed its two most common defects -- `exec("ping -c 1 " + host)` (child_process.exec with concatenation) and `innerHTML = userInput` (a direct, unescaped write) -- because security/command-injection's pattern required an `l`/`v` right after `exec` (matching only C/Python's execl/execv/execve) and security/xss carried no pattern at all. This file proves both are now matched, that the three named false-positive shapes (AC-002: an argv-form exec call, an innerHTML literal, and a comment mentioning "exec") are never matched, and that the Python and command-injection shapes the catalog already matched before this card still match identically (AC-003).

Selector naming note, the same technique tests/unit/AUR-442.go and tests/unit/AUR-445.go document: this proof is TestAUR462, matching the card id, and does not collide with any existing Test* function in this package.

Package unit holds AUR-463's Unit-layer proof: the native, tool-free documentation extractor for JavaScript (internal/documentation/extractors/javascript's NewNativeExtractor) reads real JSDoc comments out of real ESM source text, renders real Markdown pages from them, starts no subprocess to do it, and never synthesizes prose for a symbol that carries no JSDoc.

This file is not named "_test.go" on purpose, mirroring AUR-427's tests/unit/AUR-427.go: tests/acceptance/AUR-463.sh stages a private writable copy of the module and writes a tiny bridge "_test.go" file that calls TestAUR463, so the assertions below run inside the sandboxed acceptance instead of being swept into an unrelated top-level `go test ./...`.

Package unit holds AUR-464's Unit-layer proof: the Bash and PowerShell documentation extractors (internal/documentation/extractors/bash, internal/documentation/extractors/powershell) attach each documented comment block to the real function it precedes -- never to a fixed "## Documentation" placeholder repeated once per block -- and a symbol with no comment still appears, with its real signature and no invented prose.

This file is not named "_test.go" on purpose, mirroring every sibling card in this office (AUR-402..AUR-411, AUR-422, AUR-424, AUR-426, AUR-427): tests/acceptance/AUR-464.sh stages a private writable copy of the module and writes a tiny bridge "_test.go" file that calls TestAUR464, so the assertions below run inside the sandboxed acceptance instead of being swept into an unrelated top-level `go test ./...`.

Package unit holds AUR-465's Unit-layer proof: the three deterministic guardrails internal/documentation/welcome/sanitize.go adds around the generated welcome page each do exactly what AC-001/AC-002/AC-003 require, checked function-by-function with no LLM, no filesystem walk of the real site, and no other package involved.

AC-001 (SanitizeActionRef): every "Mpaape/AurumCode@<ref>" the generated index carries must be the published major tag or a full immutable commit SHA. A branch -- @main, @master, or any other name an LLM might echo back from a consumer's own README -- is a mutable ref: a later upstream push would silently change what a copied workflow executes.

AC-002 (DeclaredAssetPath + AssetExists): a _config.yml "logo:" entry is compliant only if it is either absent or resolves to a real file under the published site root.

AC-003 (SanitizeInternalLinks): the only internal, relative link the welcome content may carry is the getting-started guide; any other relative path is an invented link nothing in this package can confirm the site scaffold will ever produce, so it is neutralized to plain text.

This file is not named "_test.go" on purpose, mirroring every sibling card in this office (AUR-402..AUR-461): tests/acceptance/AUR-465.sh stages a private copy of the module and bridges TestAUR465 into a real `go test` so these assertions run inside the sandboxed acceptance instead of being swept into an unrelated top-level `go test ./...`.

TestAUR466 proves the AUR-466 outcome at the package boundary: the 2026-08-14 measurement on a real, 55-commit Node repository found 15 security/`error` findings and every sampled one was false -- security/hardcoded-secret matched a documentation placeholder (`export GEMINI_API_KEY=sua-chave`), a help-text string that teaches the same export, and two test-fixture assignments whose values are synthetic labels (`ttm-smoke-key`, `sk-body-ULTRA-SECRET`); and security/sql-injection matched a query built entirely from string CONSTANTS, whose real values are bound later through `?` placeholders. The shared cause: both rules matched the FORM of the text, never the VALUE or the CONTEXT.

This file proves the fix (internal/review/rules/security.yml): none of the five measured false-positive shapes are matched (AC-001); a real digit-bearing secret, a SQL query concatenating a VARIABLE, and a shell command concatenating a VARIABLE are all three still matched (AC-002); and the pre-existing Python SQL-injection line and hardcoded-secret values this catalog already matched keep matching, unchanged (AC-003).

Selector naming note, the same technique tests/unit/AUR-442.go and tests/unit/AUR-462.go document: this proof is TestAUR466, matching the card id, and does not collide with any existing Test* function in this package.

Package unit holds AUR-472's Unit-layer proof: an action ref is validated against the tags that actually exist, never merely against the SHAPE of a semver tag.

THE DEFECT (2026-08-14 adversarial review of AUR-465) 

internal/documentation/welcome/sanitize.go used to define
pinnedTagPattern = ^v[0-9]+(\.[0-9]+){0,2}$ and treated ANY ref matching
that shape as already-compliant: v2, v10, v1.99 all passed untouched
even though only v1, v1.0.0 and v1.0.1 have ever been published. The
same validate-the-shape/conclude-the-value mistake showed up twice the
same day as strings.Contains gate checks (AUR-457, AUR-465's own
SanitizeInternalLinks review).

This file is not named "_test.go" on purpose, mirroring every sibling card in this office: tests/acceptance/AUR-472.sh stages a private copy of the module and bridges TestAUR472 into a real `go test`.

Package unit holds AUR-474's Unit-layer proof: a Bash function whose body opens and closes on the SAME physical line (`greet() { echo "hi"; }`, `function greet { ... }`, `function greet() { ... }`) is recognized as a real symbol by internal/documentation/extractors/bash, carries its own preceding comment as its own Doc (never swept into "## Script Notes"), and the four AC-002 non-symbol shapes (my-array=(), x=$(cmd), a one-line if/fi, and a quoted string containing "foo() { }") still produce no symbol at all.

This file is not named "_test.go" on purpose, mirroring every sibling card in this office: tests/acceptance/AUR-474.sh stages a private writable copy of the module and writes a tiny bridge "_test.go" file that calls TestAUR474, so the assertions below run inside the sandboxed acceptance instead of an unrelated top-level `go test ./...`.

Index

Constants

View Source 
const (
	ProfileKeyAUR422       = "bootstrap-readonly-v1"
	ProfilePathAUR422      = ".board/oci/profiles/bootstrap-readonly-v1.json"
	LockPathAUR422         = ".board/locks/oci/bootstrap-readonly-v1.lock.json"
	SchemaPathAUR422       = ".board/schemas/container-profile.schema.json"
	RegistryPathAUR422     = ".board/oci/profiles/registry.v1.json"
	RequiredTmpfsAUR422    = "rw,nosuid,nodev"
	TmpfsDestinationAUR422 = "/tmp"
)
View Source 
const (
	CeilingTimeoutAUR422    = 900
	CeilingMemoryMBAUR422   = 4096
	CeilingCPUMillisAUR422  = 4000
	CeilingPidsAUR422       = 4096
	CeilingTmpfsMBAUR422    = 1024
	CeilingOutputAUR422     = 1048576
	CeilingInputFilesAUR422 = 100000
	CeilingInputBytesAUR422 = 268435456
	FloorTimeoutAUR422      = 1
	FloorMemoryMBAUR422     = 64
	FloorCPUMillisAUR422    = 100
	FloorPidsAUR422         = 16
	FloorTmpfsMBAUR422      = 8
	FloorOutputAUR422       = 4096
)

Ceilings and floors characterized from .board/bin/oci-run; the integration lane re-extracts these from the runner source and refuses any drift.

View Source 
const (
	ImagePatternAUR422 = `^[a-z0-9][a-z0-9._/-]*@sha256:[0-9a-f]{64}$`
	UserPatternAUR422  = `^[1-9][0-9]{2,6}:[1-9][0-9]{2,6}$`
)

Pattern literals identical to the runner's readonly variables.

Variables

This section is empty.

Functions

func EngineSupportedAUR410 

func EngineSupportedAUR410(p profile410, name string) bool

EngineSupportedAUR410 answers whether the plan admits one named engine. The published list is consulted only after the name has passed the closed expression above, so a widened list can never make `nerdctl`, `ctr` or `crictl` admissible, and neither an upper-cased spelling, a leading space, an embedded newline nor the empty string can impersonate an admitted name.

func ResolveConformanceAUR410 

func ResolveConformanceAUR410(root string, probeOutput []byte) (string, string, string)

ResolveConformanceAUR410 is the orchestrator entry point. It accepts the untrusted probe observation as an argument and returns the verdict together with a digest of the bounded observation. The observation is recorded, never consulted: it is truncated to the declared probe bound, hashed, and returned beside a verdict computed from the registered documents alone. No branch below the truncation reads it, so a probe that prints `{"result":"valid"}`, `proved: true`, an approval sentence or a rejection code changes the recorded observation digest and nothing else.

func ResolveLanguageAUR411 

func ResolveLanguageAUR411(p profile411, language string, availability map[string]bool) (languagePlan411, string)

ResolveLanguageAUR411 resolves one declared language to its isolated offline plan.

`availability` is the *measured* set of runtime commands: a key is present only when the caller actually observed that runtime, and its value says whether the observation found it. A runtime that was never observed is not "absent" and is certainly not "available" -- it is unmeasured, and it denies with its own code. Absence of evidence is never read as evidence, in either direction.

The function invokes nothing: it never executes a runtime, never spawns a subprocess, never installs a package and never touches the network. It answers from the registered document and the measurement it is handed.

func ResolvePolyglotAUR411 

func ResolvePolyglotAUR411(root, language string, availability map[string]bool) (languagePlan411, string)

ResolvePolyglotAUR411 is the entry point a consumer would call. It validates the whole registry and then the profile, and resolves a language only from a plan both admitted.

This is where the measurement is put in its place: the availability argument can decide that an admitted partition is unavailable, and it can never decide that a rejected plan is usable. A measurement reporting all eight runtimes present cannot rescue a plan the loader refused, because the refusal is returned before the measurement is ever read.

func TestAUR005 

func TestAUR005(t *testing.T)

TestAUR005 is the card's declared unit selector. It executes schema validation, sealing, canonical replay and byte-level output verification.

func TestAUR006 

func TestAUR006(t *testing.T)

TestAUR006 is the unit-level contract probe named by AUR-006.

func TestAUR308 

func TestAUR308(t *testing.T)

func TestAUR402 

func TestAUR402(t *testing.T)

func TestAUR403 

func TestAUR403(t *testing.T)

func TestAUR404 

func TestAUR404(t *testing.T)

func TestAUR405 

func TestAUR405(t *testing.T)

func TestAUR406 

func TestAUR406(t *testing.T)

func TestAUR407 

func TestAUR407(t *testing.T)

func TestAUR408 

func TestAUR408(t *testing.T)

func TestAUR409 

func TestAUR409(t *testing.T)

func TestAUR410 

func TestAUR410(t *testing.T)

func TestAUR411 

func TestAUR411(t *testing.T)

func TestAUR422 

func TestAUR422(t *testing.T)

func TestAUR424 

func TestAUR424(t *testing.T)

TestAUR424 is AUR-424's Unit-layer selector. It proves the two halves of the card's outcome at the extractor package's own public API:

  1. Feeding the extractor a real Go source file produces a real Markdown page containing the real exported symbols and their real doc comments (not an empty file, not a placeholder).
  2. No call ever reaches the caller-supplied runner: the standard-library rewrite has nothing to shell out to.

Before the fix, step 1 failed: the old gomarkdoc-backed extractor called countingRunnerAUR424.Run("gomarkdoc", ...), which errors here exactly the way a genuinely missing gomarkdoc binary errors in the sandbox, and the package was skipped with zero generated docs -- the AUR-424/AC-001/ behavior-missing label below is what a RED run before the fix (or a MUT-001 run that reintroduces the gomarkdoc call) prints.

func TestAUR425 

func TestAUR425(t *testing.T)

TestAUR425 is AC-001 at its smallest observable seam: one project with no supported source file, one run, one exit status, one stated reason.

func TestAUR426 

func TestAUR426(t *testing.T)

TestAUR426 proves `aurumcode docs` behaviorally, through the real binary: --help is self-documenting and its flags match docs/specs/AUR-426.md and the code's own registered set (MUT-001's target); the command actually drives internal/pipeline to generate real documentation, not a stub; invalid input and a run that documents nothing both fail loudly instead of exiting 0; a secret canary never reaches stdout or stderr; the run is deterministic; and `aurumcode review`'s published contract is untouched. See docs/specs/AUR-426.md.

func TestAUR427 

func TestAUR427(t *testing.T)

TestAUR427 is AUR-427's Unit-layer selector. It proves, for both extractors, that:

  1. Feeding the extractor real Rust/C# source produces a real Markdown page containing the real public symbols and their real doc comments (not an empty file, not a placeholder).
  2. Validate never depends on anything external: it always returns nil, so the pipeline can never classify either language as "tool unavailable" and skip it (the exact defect AUR-427 closes; see cmd/regenerate-docs/repo_code_execution.go for why the OLD cargo/dotnet-backed extractors, untouched by this card, remain gated behind an explicit opt-in instead).
  3. Coverage is honestly partial: a private member and a macro-generated symbol -- both real, both present in the source -- never appear on the generated page, because this parser genuinely cannot recognize them.

func TestAUR428 

func TestAUR428(t *testing.T)

TestAUR428 is AUR-428's Unit-layer selector: the example workflow document, parsed for real, declares everything the card's outcome depends on.

Before the fix this failed with AUR-428/AC-001/behavior-missing: the example pinned `Mpaape/AurumCode@<40-hex local SHA>`, a reference the user cannot rely on as the published contract -- the card requires a publishable semver tag (`v1`) that a human publishes once and every copied workflow resolves. A MUT-001 run that points the workflow at a nonexistent or unpublishable reference fails here with the AUR-428/AC-001/MUT-001 label.

func TestAUR429 

func TestAUR429(t *testing.T)

TestAUR429 is AC-001 at the exported-API seam.

func TestAUR430 

func TestAUR430(t *testing.T)

TestAUR430 exercises the restored given -> analyze -> prompt -> llm -> parse -> findings pipeline end to end against the deterministic tests/fixtures/repos/git-demo fixture and a fake, offline LLM provider, then separately proves the parser's degraded-mode fallback recovers findings from a response that is not valid JSON at all.

func TestAUR431 

func TestAUR431(t *testing.T)

TestAUR431 proves the --fail-on severity gate of `aurumcode review` behaviorally, through the real binary: the command exits 3 exactly when a finding sits at the chosen severity or above, exits 0 when none does, rejects unknown levels with a usage error, and leaves the pre-existing no-flag contract (exit 0, identical stdout) untouched. Levels are the engine's own severity names (error, warning, info) plus the CI-conventional aliases high, medium, low. See docs/specs/AUR-431.md.

func TestAUR432 

func TestAUR432(t *testing.T)

TestAUR432 proves AUR-432's outcome at the model boundary, in process: a secret present in the reviewed diff never reaches the provider (the prompt is redacted before it leaves internal/review), a secret echoed back by the model never reaches the report (the parsed result is redacted at the same boundary), and the redaction replaces values, not context, so the review stays useful. Secret values that must not exist in a tracked file (credential shapes, private-key banners) are assembled at runtime from split literals.

func TestAUR433 

func TestAUR433(t *testing.T)

TestAUR433 proves the --limite cost cap of `aurumcode review` behaviorally, through the real binary: the estimated cost prints before the model can have been called, an over-limit run refuses -- calling the model zero times, spending nothing -- a within-limit run reports both the estimate and the real cost, --limite composes with --fail-on, --modelo and --seguranca, and without the flag every prior contract holds byte for byte. See docs/specs/AUR-433.md.

func TestAUR434 

func TestAUR434(t *testing.T)

TestAUR434 proves, at the package API level, the two halves of AUR-434's outcome: every issue the reviewer reports cites a rule from the embedded project review standard, and an issue that cannot cite such a rule never reaches the caller.

func TestAUR435 

func TestAUR435(t *testing.T)

TestAUR435 proves the security pass at the package boundary: the embedded catalog's security rules now carry the matcher the c12d7ab restoration measured as missing ("as regras sao metadados sem padrao"), the scan finds a planted synthetic vulnerability on the exact added line, it never matches removed or context lines, and its findings cite only rules of category security -- the separation from the quality rubric that MUT-001 attacks.

func TestAUR436 

func TestAUR436(t *testing.T)

TestAUR436 proves the --modelo model selection of `aurumcode review` behaviorally, through the real binary: the flag chooses which model reviews (including a local one, exercised offline through the deterministic provider), an unavailable model produces a clear, actionable error on stderr with exit 1 -- never an empty review with exit 0 -- and without the flag every contract published by AUR-430 and AUR-431 holds byte for byte. See docs/specs/AUR-436.md.

func TestAUR437 

func TestAUR437(t *testing.T)

TestAUR437 is the unit selector declared by the card (TDD proof: Unit).

func TestAUR438 

func TestAUR438(t *testing.T)

TestAUR438 proves `aurumcode review --pr` behaviorally: --repo, --publicar and --na-linha are all required with --pr (usage exit 2, the same treatment --base already gets); --repo must be "owner/repo"; a finding reaches the pull request as a comment through a real, offline httptest fake GitHub; and every flag/behavior published before this card (--base, --fail-on, --modelo, --seguranca) is unaffected by --pr's mere existence. See docs/specs/AUR-438.md.

func TestAUR439 

func TestAUR439(t *testing.T)

TestAUR439 proves `aurumcode review --pr --check` behaviorally: --check satisfies the --na-linha requirement on its own (AC-001's declared command carries no --na-linha at all); --repo and --publicar remain required exactly as before; a grave (error-severity) finding publishes a commit status through a real, offline httptest fake GitHub with state=="failure" and an exit code that is never 0 (never "reports success"); and every flag/behavior published before this card (--base, --fail-on, --modelo, --seguranca, and the pre-existing --na-linha path without --check) is unaffected by --check's mere existence. See docs/specs/AUR-439.md.

func TestAUR440 

func TestAUR440(t *testing.T)

TestAUR440 is AUR-440's Unit-layer selector: the example workflow document, parsed for real, declares everything the card's outcome depends on.

Before the fix this failed with AUR-440/AC-001/behavior-missing: the example was still the pre-restoration documentation gate -- it delegated to the root composite action (which cannot review a pull request), pinned a local 40-hex commit SHA instead of the publishable v1 tag, and never declared the pull-requests: write permission a review comment needs. A MUT-001 run that removes the publishing job's pull-requests: write fails here with the AUR-440/AC-001/MUT-001 label.

func TestAUR441 

func TestAUR441(t *testing.T)

TestAUR441 proves internal/review/cache at the package boundary: the content-addressed key changes exactly when the file's own diff, the model, or the prompt version changes and stays stable otherwise, a Put/Get roundtrip returns exactly what was stored, a miss reports (nil, false, nil) rather than an error, ResolveDir honors AURUMCODE_CACHE_DIR when set and otherwise defaults to a location unique to this process (never shared with a separate invocation unless asked), and nothing recoverable -- in particular a planted secret canary -- ever reaches a byte written to disk.

func TestAUR442 

func TestAUR442(t *testing.T)

TestAUR442 proves the AUR-442 outcome at the package boundary: the dogfooding measurement found `--seguranca` matched only 2 of the 8 catalog rules (security/sql-injection, security/command-injection), both requiring the narrow `"..." + var` concatenation shape, so the project's own demo fixture -- tests/fixtures/repos/git-demo, whose sole purpose is to plant a plaintext secret -- reported "No security findings." AUR-442 restores the matcher for security/hardcoded-secret (the card's named priority, and the rule git-demo's fixture depends on) and leaves the remaining five patternless rules (xss, path-traversal, weak-crypto, insecure-random, missing-auth) honestly declared as metadata-only rather than shipping unvalidated matchers for them. See internal/review/rules/security.yml and docs/specs/AUR-442.md.

Selector naming note, same technique tests/unit/AUR-445.go documents: a function named TestAUR435 already exists in this package (tests/unit/AUR-435.go) and would collide, so this proof is TestAUR442 even though the card text's TDD proof section names TestAUR435 (a copy-paste artifact from the AUR-435 card this one was drafted against).

func TestAUR443 

func TestAUR443(t *testing.T)

TestAUR443 proves, through the real binary, that a first-time user discovers what aurumcode does and can run a first review without reading source. See docs/specs/AUR-443.md for the full rationale behind each assertion.

func TestAUR444 

func TestAUR444(t *testing.T)

TestAUR444 proves criterion (a) of AUR-444's acceptance: every flag token the entrypoint sends to `"$AURUMCODE_CLI" review` is a flag cmd/aurumcode actually registers, dynamically derived from cmd/aurumcode's own source -- never a hand-written list -- and at least --base (the one required real flag) is among them.

func TestAUR445 

func TestAUR445(t *testing.T)

TestAUR445 is AUR-445's Unit-layer selector.

Before the fix this failed with AUR-445/AC-001/behavior-missing for every banned family still present in its named files: the audit's whole point was that these files lied. A MUT-001 run that reintroduces "No LICENSE file is present" into README.md, ACTION_USAGE.md or CHANGELOG.md fails here with the AUR-445/AC-001/MUT-001 label.

func TestAUR446 

func TestAUR446(t *testing.T)

TestAUR446 proves the checker itself, both directions:

  • fed the exact corrected excerpt, it reports zero violations (GREEN);
  • fed the exact pre-correction excerpt (the card's RED, and the shape MUT-001 reintroduces), it reports exactly the expected violation.

func TestAUR447 

func TestAUR447(t *testing.T)

TestAUR447 proves, through the real binary, that `aurumcode docs --source <projeto Rust ou C#>` documents Rust and C# projects the same way `cmd/regenerate-docs` already does, while Go stays regression-free, a secret canary never leaks, and `aurumcode review`'s published contract is untouched. See docs/specs/AUR-447.md.

func TestAUR448 

func TestAUR448(t *testing.T)

TestAUR448 proves, at the internal/review package API level, both halves of this card's outcome: the discard-warning metadata is empty exactly when nothing was discarded, and non-empty with the right count and reason(s) when something was.

func TestAUR449 

func TestAUR449(t *testing.T)

TestAUR449 proves the AUR-449 outcome at the CLI boundary through the real binary: `aurumcode review --base HEAD~1 --seguranca` run with no LLM provider configured at all now runs the deterministic security pass (restored by AUR-442) and reports its findings with exit 0, instead of refusing outright with `no LLM provider configured` -- because that pass is a regex matcher over the diff's added lines and never calls a model. The skip is reported plainly on stderr, never silently. Every path this card does not own stays exactly as published: --seguranca combined with a configured provider is byte-identical (manually verified against a parent build during development, sha256 63c649af1c90e38b473e1bd45b4152b1f96ecad17d5d9c05c17bb94df7b8240f for git-demo's --seguranca stdout with the fixture provider, on both sides of this card's change); an explicit --modelo that cannot be served still fails loudly (reportModelUnavailable); a provider that WAS attempted but is broken (an AURUMCODE_LLM_FIXTURE path that does not exist) still fails, because only "nothing configured at all" is eligible for the skip; and without --seguranca the pre-existing no-provider refusal is untouched. See docs/specs/AUR-449.md.

func TestAUR450 

func TestAUR450(t *testing.T)

TestAUR450 proves the AUR-450 outcome at the CLI boundary through the real binary: when `--seguranca` runs the security pass, stderr now names how many and which security-category rules of the embedded catalog the pass actually applied (carry a matcher) against how many the category declares in total -- identically whether the pass found a match or found nothing at all, so "No security findings." is never misread as "the code was scanned by the full catalog." Findings themselves (their content, their order, the AUR-442/AUR-449 byte contract with a provider configured) are completely untouched. See docs/specs/AUR-450.md.

func TestAUR451 

func TestAUR451(t *testing.T)

TestAUR451 proves AC-001: `--seguranca`, `--fail-on`, `--limite` and `--modelo` reach the `--pr` path and reuse the exact functions the `--base` path already calls, plus the pre-existing usage-error and compatibility surface is untouched.

func TestAUR452 added in v1.0.2 

func TestAUR452(t *testing.T)

func TestAUR455 

func TestAUR455(t *testing.T)

TestAUR455 is AUR-455's Unit-layer selector.

func TestAUR456 

func TestAUR456(t *testing.T)

TestAUR456 is AUR-456's Unit-layer selector.

Before the fix (or on the untouched pre-fix tree) this fails with AUR-456/AC-001/behavior-missing for the first dead path still present. A MUT-001 run that reintroduces .aurumcode/rules/security.yml into a mutated scratch copy fails here with the AUR-456/AC-001/MUT-001 label instead.

func TestAUR457 added in v1.0.2 

func TestAUR457(t *testing.T)

func TestAUR458 added in v1.0.2 

func TestAUR458(t *testing.T)

TestAUR458 is the exit-code table. Every row is a situation a user can reach, and the only thing asserted is the number the shell sees -- because that number is the entire defect: a CI job reads the exit code, not stderr.

func TestAUR459 added in v1.0.2 

func TestAUR459(t *testing.T)

TestAUR459 proves, at the public boundary of internal/prompt, the two halves of AUR-459's fix that used to disagree in silence: the review prompt template teaches exactly ONE findings schema, and the parser reads the shape a real model actually answers with.

The defect: the template showed "line_comments" first and "issues" second while the parser read only "issues", so a model that answered with line_comments -- what the real gateway does -- produced "No issues found." with exit 0 over a diff carrying planted secrets.

The card's declared selector for this file is "TestAUR435", a typo carried from the card template: tests/unit/AUR-435.go already defines TestAUR435 in this same package, so redefining it would not compile. See docs/specs/AUR-459.md.

func TestAUR460 added in v1.0.2 

func TestAUR460(t *testing.T)

TestAUR460 is the proof: for a spread of Options.Temperature values -- the pre-AUR-460 fixed default (0.3), the zero value, and a caller who explicitly asks for something else -- the JSON body the litellm provider sends never carries a "temperature" key.

func TestAUR461 added in v1.0.2 

func TestAUR461(t *testing.T)

TestAUR461 is this card's unit selector. It proves, at the public boundary of internal/prompt, that the review prompt now carries the closed list of rule ids the AUR-434 gate accepts -- and that the list cannot drift from the catalog without failing right here.

The defect (measured 2026-08-14 against the real gateway): six findings came back, five were discarded citing ids the model invented (security/shell-injection for what the catalog calls security/command-injection, quality/naming for quality/poor-naming, quality/documentation and quality/readability for nothing at all), because templates/review.md showed one example rule_id and never said which ids exist.

This file is a plain .go program, not a _test.go file: the acceptance script bridges it (see tests/acceptance/AUR-461.sh).

func TestAUR462 added in v1.0.2 

func TestAUR462(t *testing.T)

func TestAUR463 added in v1.0.2 

func TestAUR463(t *testing.T)

TestAUR463 is the Unit-layer proof. It is called by a bridge _test.go file tests/acceptance/AUR-463.sh writes into a staged, writable copy of the module (see that script for why: a bare top-level `go test ./...` must not pick this file up, since it is not named "_test.go").

func TestAUR464 added in v1.0.2 

func TestAUR464(t *testing.T)

TestAUR464 is AUR-464's Unit-layer selector. It proves, for both the Bash and the PowerShell extractor:

  1. AC-001: every documented block's heading carries the real symbol name, never the fixed "## Documentation" placeholder, and no heading text repeats within the page.
  2. AC-002: two distinct symbols on the same page produce two distinct anchors (via the same slug rule the real site renderer applies).
  3. AC-003: a symbol with no comment still appears, with its real signature and zero invented prose between its heading and its code fence.
  4. A comment that precedes something other than a recognized symbol (a file overview, a stray mid-script note) is never turned into a fake per-block symbol heading: it is collected once, under one real, non-repeating heading.

func TestAUR464AnchorTrioUnique added in v1.0.2 

func TestAUR464AnchorTrioUnique(t *testing.T)

TestAUR464AnchorTrioUnique is the reviewer's second-round Blocker 2 fixture, proved for both languages: after the SAME slug normalization a real Markdown renderer applies, all three of "foo"/"Foo"/"foo-2" must end up on distinct anchors.

func TestAUR464AnchorUniqueAfterNormalization added in v1.0.2 

func TestAUR464AnchorUniqueAfterNormalization(t *testing.T)

TestAUR464AnchorUniqueAfterNormalization is the reviewer's Blocker 2 fixture: it slugs every generated heading with the SAME normalization a real Markdown renderer applies (lowercase, non-word stripped) and requires the RESULT to still be unique, not just the raw heading text.

func TestAUR464CodeBeforeDocPreserved added in v1.0.2 

func TestAUR464CodeBeforeDocPreserved(t *testing.T)

TestAUR464CodeBeforeDocPreserved is the reviewer's second-round Blocker 1 fixture: a real statement precedes the first documented function, so that function's own doc comment must survive as ITS doc, not be misfiled as an ambiguous file header the way a header glued straight to the first function (with no code at all before it) still correctly is.

func TestAUR464FileHeaderNotMisattributed added in v1.0.2 

func TestAUR464FileHeaderNotMisattributed(t *testing.T)

TestAUR464FileHeaderNotMisattributed is the reviewer's Blocker 1 fixture, proved for both languages: a leading file-level comment with no blank line before the first function must never become that function's Doc.

func TestAUR464LeadingCommentFourCases added in v1.0.2 

func TestAUR464LeadingCommentFourCases(t *testing.T)

TestAUR464LeadingCommentFourCases is the table this card's own review history asked for: the four leading-comment shapes that decide whether a comment attaches to the first function or is swept into Notes, so the NEXT change to this signal breaks the build here instead of silently swapping one cost for another. 

shebang + license, nothing else            -> Notes   (ambiguous: no symbol, no note, no code yet)
set -euo pipefail, then the doc            -> attaches (code already ran)
overview, blank line, then the doc         -> attaches (an earlier note already resolved the ambiguity)
first executable line IS the documented fn -> Notes   (declared residual cost)

func TestAUR464OverviewThenDocPreserved added in v1.0.2 

func TestAUR464OverviewThenDocPreserved(t *testing.T)

TestAUR464OverviewThenDocPreserved is the reviewer's third-round fixture, proved for both languages: greet's/Get-Greeting's own doc must survive even though no code ever ran, because an earlier stray note already resolved the file's own ambiguity.

func TestAUR464RegressionGuard added in v1.0.2 

func TestAUR464RegressionGuard(t *testing.T)

func TestAUR465 added in v1.0.2 

func TestAUR465(t *testing.T)

TestAUR465 is AUR-465's Unit-layer selector.

func TestAUR466 added in v1.0.2 

func TestAUR466(t *testing.T)

func TestAUR467 added in v1.0.2 

func TestAUR467(t *testing.T)

TestAUR467 is this card's unit selector. It proves, at the public boundary of internal/prompt, that a review prompt built from a diff mixing code and prose files:

  1. never carries a documentation file's hunk content into the section the model is told to apply the code rule catalog to (AC-001);
  2. still carries every code file's hunk content when the budget has room, exactly as before this card (AC-002);
  3. declares, in both the assembled prompt and PromptParts.Meta, how many code files a tight budget left out, by name (AC-003).

A fourth subtest is this card's required measurement: it reconstructs, against the exported budgeting primitives (NewTokenBudget, BuildContextSegments, TrimToFit), why the 2026-08-14 gateway measurement found all seven findings on AGENTS.md and none of the fifteen `.mjs` files got a single comment. The original user diff was never captured -- this is a reconstruction shaped like the measured commit (one uppercase-named prose file plus many lowercase code files), not a replay of it.

This file is a plain .go program, not a _test.go file: the acceptance script bridges it (see tests/acceptance/AUR-467.sh), matching the convention tests/unit/AUR-461.go set.

func TestAUR472 added in v1.0.2 

func TestAUR472(t *testing.T)

TestAUR472 is AUR-472's Unit-layer selector.

func TestAUR474 added in v1.0.2 

func TestAUR474(t *testing.T)

TestAUR474 is AUR-474's Unit-layer selector.

func TestAUR474NoBodyStillRecognized added in v1.0.2 

func TestAUR474NoBodyStillRecognized(t *testing.T)

TestAUR474NoBodyStillRecognized proves an undocumented one-liner (no preceding comment) still becomes a real symbol with its real signature and zero synthesized prose -- the same AC-003 guarantee AUR-464 established for the multi-line form, now also true for the one-line form.

func TestAUR474PowerShellAlreadyHandlesOneLiners added in v1.0.2 

func TestAUR474PowerShellAlreadyHandlesOneLiners(t *testing.T)

TestAUR474PowerShellAlreadyHandlesOneLiners is the card's explicit instruction ("confirmar o mesmo em PowerShell antes de decidir o escopo"): powerShellFunctionPattern has no end-of-line anchor, so a PowerShell one-line function declaration already produces a real symbol today, with no code change required in that extractor. This locks that finding in as a regression guard.

func TestAUR475 added in v1.0.2 

func TestAUR475(t *testing.T)

TestAUR475 is this card's unit selector. It proves, at the public boundary of internal/prompt (PromptBuilder.BuildPrompt, the exact function internal/review/reviewer.go calls), that a single oversized file at the front of the priority order no longer starves every file behind it:

  1. the files that DO fit are still reviewed, and the file that doesn't fit is named in the coverage declaration (AC-001);
  2. no file that appears in the reviewed content is ever partial -- it is either whole or entirely absent, never truncated (AC-002);
  3. a file whose hunks are PARTLY covered classifies "partial" (not "omitted"), and a file whose hunks are entirely skipped classifies "omitted" (not "partial") -- the exact interaction the card calls out: flipping break to continue lets more files become partial, and that must not blur into omitted or vice versa (AC-003).

This file is a plain .go program, not a _test.go file: the acceptance script bridges it (see tests/acceptance/AUR-475.sh), matching the convention tests/unit/AUR-467.go set.

func ValidateProfileAUR404 

func ValidateProfileAUR404(root string) (profile404, lock404, string)

ValidateProfileAUR404 is the side-effect-free plan loader for go-git-offline-v1. It never invokes a container engine and never reads anything outside the documents this card owns.

func ValidateProfileAUR405 

func ValidateProfileAUR405(root string) (profile405, lock405, string)

ValidateProfileAUR405 is the side-effect-free plan loader for fake-provider-v1. It never invokes a container engine, never opens a socket, and never reads anything outside the documents this card owns.

func ValidateProfileAUR406 

func ValidateProfileAUR406(root string) (profile406, lock406, string)

ValidateProfileAUR406 is the side-effect-free plan loader for parser-worker-v1. It never invokes a container engine, never opens a socket, never spawns a subprocess, and never reads anything outside the documents this card owns.

func ValidateProfileAUR407 

func ValidateProfileAUR407(root string) (profile407, lock407, string)

ValidateProfileAUR407 is the side-effect-free plan loader for sqlite-offline-v1. It never invokes a container engine, never opens a socket, never spawns a subprocess, never opens a database, and never reads anything outside the documents this card owns.

func ValidateProfileAUR408 

func ValidateProfileAUR408(root string) (profile408, lock408, string)

ValidateProfileAUR408 is the side-effect-free plan loader for docs-tool-offline-v1. It never invokes a container engine, never opens a socket, never spawns a subprocess, never renders a document, and never reads anything outside the documents this card owns.

func ValidateProfileAUR409 

func ValidateProfileAUR409(root string) (profile409, lock409, string)

ValidateProfileAUR409 is the side-effect-free plan loader for fake-scm-offline-v1. It never invokes a container engine, never opens a socket, never spawns a subprocess, never runs a version-control command, and never reads anything outside the documents this card owns.

func ValidateProfileAUR410 

func ValidateProfileAUR410(root string) (profile410, lock410, string)

ValidateProfileAUR410 is the side-effect-free plan loader for oci-conformance-v1. It never invokes a container engine, never opens an engine socket, never opens a network socket, never spawns a subprocess, and never reads anything outside the documents this card owns.

func ValidateProfileAUR411 

func ValidateProfileAUR411(root string) (profile411, lock411, string)

ValidateProfileAUR411 is the side-effect-free plan loader for polyglot-toolchain-v1. It never installs a toolchain, never installs a package, never invokes a runtime, never spawns a subprocess, never opens a network socket, and never reads anything outside the documents this card owns.

func ValidateRegistryAUR402 

func ValidateRegistryAUR402(root string, document []byte) (string, string)

ValidateRegistryAUR402 is the canonical, side-effect-free registry loader used by every layer.

func ValidateRegistryAUR404 

func ValidateRegistryAUR404(root string) (string, string)

ValidateRegistryAUR404 resolves the canonical registry and admits exactly the eleven registered keys. It is fail-closed: an unknown key, a duplicate, an out-of-order entry, or a digest that does not match the bytes on disk denies without any engine.

func ValidateRegistryAUR405 

func ValidateRegistryAUR405(root string) (string, string)

ValidateRegistryAUR405 resolves the canonical registry and admits exactly the eleven registered keys. It is fail-closed: an unknown key, a duplicate, an out-of-order entry, or a digest that does not match the bytes on disk denies without any engine.

func ValidateRegistryAUR406 

func ValidateRegistryAUR406(root string) (string, string)

ValidateRegistryAUR406 resolves the canonical registry and admits exactly the eleven registered keys. It is fail-closed: an unknown key, a duplicate, an out-of-order entry, or a digest that does not match the bytes on disk denies without any engine.

func ValidateRegistryAUR407 

func ValidateRegistryAUR407(root string) (string, string)

ValidateRegistryAUR407 resolves the canonical registry and admits exactly the eleven registered keys. It is fail-closed: an unknown key, a duplicate, an out-of-order entry, or a digest that does not match the bytes on disk denies without any engine.

func ValidateRegistryAUR408 

func ValidateRegistryAUR408(root string) (string, string)

ValidateRegistryAUR408 resolves the canonical registry and admits exactly the eleven registered keys. It is fail-closed: an unknown key, a duplicate, an out-of-order entry, or a digest that does not match the bytes on disk denies without any engine.

func ValidateRegistryAUR409 

func ValidateRegistryAUR409(root string) (string, string)

ValidateRegistryAUR409 resolves the canonical registry and admits exactly the eleven registered keys. It is fail-closed: an unknown key, a duplicate, an out-of-order entry, or a digest that does not match the bytes on disk denies without any engine.

func ValidateRegistryAUR410 

func ValidateRegistryAUR410(root string) (string, string)

ValidateRegistryAUR410 resolves the canonical registry and admits exactly the eleven registered keys. It is fail-closed: an unknown key, a duplicate, an out-of-order entry, or a digest that does not match the bytes on disk denies without any engine.

func ValidateRegistryAUR411 

func ValidateRegistryAUR411(root string) (string, string)

ValidateRegistryAUR411 resolves the canonical registry and admits exactly the eleven registered keys. It is fail-closed: an unknown key, a duplicate, an out-of-order entry, or a digest that does not match the bytes on disk denies without any engine.

Types

type LockDocAUR422 

type LockDocAUR422 struct {
	Schema  string `json:"schema"`
	Version *int   `json:"version"`
	Profile string `json:"profile"`
	Image   string `json:"image"`
}

type PlanAUR422 

type PlanAUR422 struct {
	Image             string
	User              string
	Network           string
	CapDrop           string
	CapAdd            string
	ReadOnlyRootfs    bool
	NoNewPrivileges   bool
	Tmpfs             string
	Memory            string
	CPUs              string
	MemoryMB          int
	CPUMillis         int
	PidsLimit         int
	TimeoutSeconds    int
	TmpfsMB           int
	StdoutLimitBytes  int
	StderrLimitBytes  int
	MaxInputFiles     int
	MaxInputBytes     int
	ProfileDigest     string
	LockDigest        string
	EngineInvocations int
}

PlanAUR422 is the derived execution plan: exactly the flags oci-run passes to the engine, plus the digests binding the plan to its source documents. EngineInvocations is part of the contract: deriving a plan is always zero.

func ResolveBootstrapPlanAUR422 

func ResolveBootstrapPlanAUR422(registry, schema, profileDoc, lockDoc []byte) (PlanAUR422, string)

ResolveBootstrapPlanAUR422 resolves the bootstrap-readonly-v1 key against the registry document and derives the plan oci-run would execute. Validation order deliberately mirrors resolve_profile in .board/bin/oci-run: the lock is validated before the profile-to-lock digest binding, so a lock whose image reference became a mutable tag reports mutable-image, not lock-mismatch. Every failure returns a stable code with an empty plan; nothing here can reach the runner's die 78 and nothing here invokes an engine.

type ProfileDocAUR422 

type ProfileDocAUR422 struct {
	Schema           string `json:"schema"`
	Version          *int   `json:"version"`
	Profile          string `json:"profile"`
	Lock             string `json:"lock"`
	LockDigest       string `json:"lock_digest"`
	Network          string `json:"network"`
	User             string `json:"user"`
	CapDrop          string `json:"cap_drop"`
	CapAdd           string `json:"cap_add"`
	Mounts           string `json:"mounts"`
	Devices          string `json:"devices"`
	Pull             string `json:"pull"`
	Tmpfs            string `json:"tmpfs"`
	ReadOnlyRootfs   *bool  `json:"read_only_rootfs"`
	NoNewPrivileges  *bool  `json:"no_new_privileges"`
	Privileged       *bool  `json:"privileged"`
	TimeoutSeconds   *int   `json:"timeout_seconds"`
	MemoryMB         *int   `json:"memory_mb"`
	CPUMillis        *int   `json:"cpu_millis"`
	PidsLimit        *int   `json:"pids_limit"`
	TmpfsMB          *int   `json:"tmpfs_mb"`
	StdoutLimitBytes *int   `json:"stdout_limit_bytes"`
	StderrLimitBytes *int   `json:"stderr_limit_bytes"`
	MaxInputFiles    *int   `json:"max_input_files"`
	MaxInputBytes    *int   `json:"max_input_bytes"`
}

type RegistryDocAUR422 

type RegistryDocAUR422 struct {
	Schema   string                `json:"schema"`
	Version  *int                  `json:"version"`
	Profiles []RegistryEntryAUR422 `json:"profiles"`
}

type RegistryEntryAUR422 

type RegistryEntryAUR422 struct {
	Key            string `json:"key"`
	Schema         string `json:"schema"`
	SchemaDigest   string `json:"schema_digest"`
	Lock           string `json:"lock"`
	LockDigest     string `json:"lock_digest"`
	ImageSetDigest string `json:"image_set_digest"`
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.