Scope private helper checks and retain audit retry diagnostics

Bind the new 0600 assertion only to the reviewed temperature cleanup helper rather than impose it on the unchanged public Unified Agent installer recipe. Include the captured canned audit output when its existing one-call assertion fails, preserving verdicts, call counts and timing controls. The complete second proof retains its fail-closed two-call observation without a cause or successful-retry claim.

Contract-Neutral: Test adapter scope and failure diagnostics only; existing guide, audit verdict and timing contracts are unchanged.
Change-source: pulse-maintainer
This commit is contained in:
pulse-triage[bot]
2026-10-05 05:33:35 +01:00
parent eb9cf740bf
commit 4bcca1a100
2 changed files with 3 additions and 2 deletions
+2 -1
View File
@@ -173,7 +173,8 @@ class AgentDocsTest(unittest.TestCase):
self.assertEqual(result.returncode, expected, result.stderr.decode())
if expected == 0:
self.assertEqual((home / ".config/pulse" / output).read_bytes(), b"# harmless installer fixture\n")
self.assertEqual(stat.S_IMODE((home / ".config/pulse" / output).stat().st_mode), 0o600)
if name == NAMES[1]:
self.assertEqual(stat.S_IMODE((home / ".config/pulse" / output).stat().st_mode), 0o600)
elif name == NAMES[1]:
self.assertFalse((home / ".config/pulse" / output).exists(),
"a failed temporary download must not become the cleanup helper")
+1 -1
View File
@@ -206,7 +206,7 @@ class NpmAuditRetryTest(unittest.TestCase):
with self.subTest(require=require):
result, calls = self.run_check("vulnerability", "all", require=require)
self.assertEqual(result.returncode, 1, result.stdout)
self.assertEqual(calls, ["audit --json"])
self.assertEqual(calls, ["audit --json"], result.stdout + result.stderr)
self.assertIn("::error::", result.stdout)
self.assertNotIn("::warning::", result.stdout)