archsetup/docs/design/2026-07-19-sentry-code-findings.org, branch mainBuilds a full dev workstation from a bare Arch Linux install.
https://git.cjennings.net/archsetup/atom?h=main2026-07-20T21:10:37+00:00docs: complete the code audit (S5-S7) and triage findings into tasks2026-07-20T21:10:37+00:00Craig Jenningsc@cjennings.net2026-07-20T21:10:37+00:00urn:sha1:085c5d81407e26db34443daa36dd145a977d9365
Ran read-only audits over the last three coverage slices: the VM test framework (S5), the Python (S6), and the elisp prototype (S7). That closes the sentry code-inspection sweep -- all seven slices covered.
S5 turned up five bugs (one Major: run-net-scenarios prints a diagnose failure but exits green) and three refactors. S6 found one bug plus a High test-quality defect -- the pacman-hook-order test compares two string literals, so the boot-critical hook ordering it claims to guard is never actually measured. S7 found three Minor bugs in the gallery-widget prototype (the needle clamps while the readout doesn't, a missing cl-lib require, a nil-path load) plus refactor and coverage gaps.
Appended every finding to the sentry findings doc, marked the coverage tracker, and filed six graded tasks: the two Major/High defects as [#C], and four [#D] clusters (VM-framework robustness, prototype elisp bugs, test-quality, and a test-framework/prototype refactor group). Detection only -- nothing fixed here.
docs: log overnight code audit and file triaged installer bugs2026-07-20T12:27:16+00:00Craig Jenningsc@cjennings.net2026-07-20T12:27:16+00:00urn:sha1:2e062cc27285f79d75ce49f15a26ea8ebba9764f
Overnight sentry ran its hygiene passes plus a code-inspection pass over the installer and the scripts/ directory. It archived 6 completed tasks to Resolved and logged 19 bugs and 12 refactors in docs/design/2026-07-19-sentry-code-findings.org. I filed the bugs as tasks graded by severity times frequency. Nothing in the codebase changed, this was detection only.
Two things stand out. The installer does no partitioning (it's a post-install config layer), so the real data-loss surface is boot config, and it overwrites GRUB_CMDLINE wholesale, which can drop a cryptdevice or resume param and leave a machine unbootable. Three WireGuard configs with live private keys are tracked in git, flagged for a rotate-or-keep decision.