From 8e817ff671a1184c3f4c61d2bb15611ff72979f6 Mon Sep 17 00:00:00 2001 From: Douglas Mun Date: Sun, 23 Aug 2026 22:46:07 +0800 Subject: [PATCH] doc: record the "a harness must not delete its own evidence" rule Three harnesses put SERIAL inside a mktemp -d dir and rm -rf'd it from an EXIT trap, which fires on failure too -- destroying exactly the panic dump PR #128 added for issue #126. Fixed in PR #131 with the shared verify/preserve-serial.sh; this records the rule and the two traps that make it non-obvious (key on exit status rather than a parsed verdict, and capture rc=$? as the trap's first action before cleanup_qemu resets it). Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01CEkhAhgTxbE5TgifyYf8v4 --- CLAUDE.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/CLAUDE.md b/CLAUDE.md index 45c4d91..db0ba5d 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -54,6 +54,16 @@ look arbitrary until you know which failure produced them. - Harnesses live in `verify/`; `verify/run-all.sh` is the batch runner (~2.7 h serially, so it is nightly/manual, not a PR gate). A harness that has never been run end to end reports PASS and proves nothing — run new ones against the **unfixed** tree. +- **A harness must not delete its own evidence.** Three put `SERIAL` inside a + `mktemp -d` dir and `rm -rf`'d it from an EXIT trap, which fires on *failure* too — + destroying exactly the panic dump PR #128 added for issue #126. Use the shared + **`verify/preserve-serial.sh`** (tests: `verify/preserve-serial-test.sh`), and key it + on the **exit status, not a parsed verdict**: a run killed by `set -e`, a QEMU + timeout or a typist TIMEOUT never prints a verdict, and those are the runs worth + keeping. Capture `rc=$?` as the trap's **first** action — any earlier command + (`cleanup_qemu`) succeeds and resets `$?`, so a helper reading `$?` itself silently + preserves nothing. Unit tests that call the helper first in the trap pass against + that bug; only the real trap shape catches it. Build flags are all **explicitly named opt-outs, never defaults**: `-DELF_PERMISSIVE_SIGNATURES` (warn-and-load unsigned binaries),