Fail loudly when a probe is not staged

[kwsantiago]

Summary

Backports the probe-staged assertion from privkeyio/keep-android#473 and privkeyio/keep#936, so the four copies of this harness do not diverge.

The gap

run_probe discards the errors from git read-tree and git add. The existing staged -lt 10 check does not cover a failed git add: HEAD's whole tree is still in the index, so the count sails past 10 while the probe itself is missing, and the guard is then judged on a file it never received.

A reject case surfaces that as a spurious BYPASS, which sends someone hunting a guard defect that does not exist. An accept case surfaces it as a silent pass.

Now asserted directly:

if ! GIT_INDEX_FILE="$TMPD/index" git ls-files --error-unmatch "$name" >/dev/null 2>&1; then
    echo "  HARNESS BROKEN: $name was not staged; the guard would never see it"

Test plan

• Self-test passes unchanged on the current guard
• Sabotage control: replacing the git add with a no-op makes every case report HARNESS BROKEN, with zero BYPASS lines. Before this change the same sabotage produced BYPASS, the misleading result
• Restored afterwards and passing
• CI

Worth recording how this landed: the first attempt at this backport spliced the block into the middle of an echo string, because the insertion anchored on fi and matched the fi inside the word file(s). The corrupted file still parsed under bash -n and the self-test still reported OK, so "it passes" was true and meaningless. The sabotage control is what caught it. Re-anchored on local rc=0 out, which appears once.

Summary by CodeRabbit

• Tests
  • Improved test harness validation to ensure temporary checks are correctly staged before evaluation.
  • Added clearer error handling and cleanup when staging fails or required test data is missing.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7fc121c2-5d45-4b53-8b0f-536a985c717c

📥 Commits

Reviewing files that changed from the base of the PR and between 3548ee6 and d847406.

📒 Files selected for processing (1)

• scripts/test-rng-hygiene.sh

---

Walkthrough

The RNG hygiene test harness now confirms that each probe is staged in the temporary Git index. It reports staging failures, removes the probe, increments the failure count, and skips guard evaluation when the probe is absent.

Changes

RNG hygiene harness

Layer / File(s)	Summary
Validate staged probes scripts/test-rng-hygiene.sh	The harness checks that each probe exists in the temporary Git index. Missing probes produce harness failures, trigger cleanup, and skip guard evaluation.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Possibly related PRs

• privkeyio/keep-esp32#154: Both changes update scripts/test-rng-hygiene.sh; this PR strengthens its temporary-index staging checks.

Poem

A bunny checks each probe in place,
Then tidies up with steady grace.
If staging fails, the guard steps by,
The failure count is raised up high.
Clean tests now hop reliably.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: reporting an error when a probe is not staged.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch backport-probe-assertion

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}