test: measure that an accepted mount compiles to a flag podman runs - #124
Merged
Merged
Conversation
Base automatically changed from
fix/nocopy-and-reservation-evidence
to
main
September 20, 2026 12:28
`refusals.py` only ever measured that podman refuses what we refuse. The direction #104 and #114 actually failed in -- the gate accepts, emit renders, `podman run` dies -- had no oracle at all. Of the nested options that reach a `--mount`, exactly one (bind propagation, one value of six) was ever executed. Each row pins its flag to what `emit` produces before running it, so a row cannot drift into measuring a flag the tool does not ship. Closes #118
lesnik512
force-pushed
the
test/acceptance-oracle
branch
from
September 20, 2026 12:28
218f0ff to
e8e571a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #118. Stacked on #123 — GitHub will retarget this to
mainonce that merges. Review #123 first.The gap
refusals.pymeasures one direction: podman will not make a mount we refuse. The direction that actually shipped bugs twice — the gate accepts,emitrenders,podman rundies — had no oracle at all.Of the nested option keys that reach a
--mount, exactly one was ever executed against real podman, and only one of its six legal values:bind.propagationbind-propagation=rprivateonlybind.selinuxrelabel=tmpfs.sizetmpfs-size=tmpfs.modetmpfs-mode=subpathsat in that same column for two releases: accepted, emitted, 100% covered by unit tests, and unrunnable on the podman in this repo's own CI.Result: nothing is broken
All 14 rows exit 0 on podman 4.9.3, including
shared/rshared, which I half-expected to fail on a bind whose source is not itself a shared mount. That is the honest outcome and it is still worth having: the point is somewhere for it to go red.The one design decision
Each row pins
expected_argvto whatemitactually produces, checked before the flag is run.That is deliberately the opposite of
refusals.py's rule, where the argv is hand-written precisely so an emit bug cannot hide behind a parity claim. Here the emitted flag is the thing under test, so a hand-written argv would measure a flag nobody ships — which is the failure mode this whole issue is about.refusals.pygained a sentence pointing at the new module so the two rules are not read as an inconsistency.I checked every expected string by eye against
emit's output rather than pasting what emit gave me, since a row generated from emit would assert only that emit equals itself.Verification
just lint,just test-ci: green, 100% line coverage held.integrationjob onubuntu-24.04/ podman 4.9.3.