Let the audit emit its state, for a watcher that keeps the baseline elsewhere #21

2026-08-27T23:55:54-07:00

dejima-agent commented

2026-08-27 23:55:54 -07:00

Summary generated by LLM agent

The devbox half of the watcher, which is being built as its own repository.

Why the audit needs to emit state

drift compares against a baseline kept on the devbox — and root there can rewrite that as easily as read it, which is exactly the case being looked for. The program already says so, and says the half that fixes it runs elsewhere: a watcher on another machine, keeping the baseline where the devbox cannot reach it.

This is the interface that half needs. drift --state prints the collected state and compares nothing, so the diff can happen somewhere root on the devbox has no reach.

To stdout unconditionally, terminal or not, because this is data rather than a verdict — the one-word verdicts are suppressed on a terminal, and this must not be.

The refusal survives it

A watcher diffing a partial state against a full baseline sees a list of removals and calls it an intruder deleting things. So --state keeps the same guard as drift: if any watched path could not be read, it reports INDETERMINATE and emits nothing rather than emitting half a machine.

That is one of the three tests, and it is the one worth having.

Tested

bats test/ — 161 passing, 3 new: that --state prints the state and no verdict, that it still refuses a partial state with exit 2, and that it writes no baseline.

What it is for

dejima-guard — a third repository, because the watcher runs on neither of this project's two machines and putting a program that must not run on the devbox in the repository about the devbox would have been the wrong home for it.

Nothing in this PR depends on that existing. drift --state is useful on its own to anyone who wants to keep a state file somewhere else by hand.

**Summary generated by LLM agent** The devbox half of the watcher, which is being built as its own repository. ## Why the audit needs to emit state `drift` compares against a baseline kept on the devbox — and root there can rewrite that as easily as read it, which is exactly the case being looked for. The program already says so, and says the half that fixes it runs elsewhere: a watcher on another machine, keeping the baseline where the devbox cannot reach it. This is the interface that half needs. `drift --state` prints the collected state and compares nothing, so the diff can happen somewhere root on the devbox has no reach. To stdout unconditionally, terminal or not, because this is data rather than a verdict — the one-word verdicts are suppressed on a terminal, and this must not be. ## The refusal survives it A watcher diffing a *partial* state against a full baseline sees a list of removals and calls it an intruder deleting things. So `--state` keeps the same guard as `drift`: if any watched path could not be read, it reports `INDETERMINATE` and emits nothing rather than emitting half a machine. That is one of the three tests, and it is the one worth having. ## Tested `bats test/` — 161 passing, 3 new: that `--state` prints the state and no verdict, that it still refuses a partial state with exit 2, and that it writes no baseline. ## What it is for [dejima-guard](https://gitbox.branderson.io/dejima/dejima-guard) — a third repository, because the watcher runs on neither of this project's two machines and putting a program that *must not run on the devbox* in the repository about the devbox would have been the wrong home for it. Nothing in this PR depends on that existing. `drift --state` is useful on its own to anyone who wants to keep a state file somewhere else by hand.

dejima-agent added 1 commit 2026-08-27 23:55:55 -07:00

Let the audit emit its state, for a watcher that keeps the baseline elsewhere

tests / runner-env (pull_request_target) Successful in 41s

Details

tests / tests (pull_request_target) Successful in 1m18s

Details

23e1c247f7

`drift` compares against a baseline kept on this machine, and root here can
rewrite that as easily as read it - which is the case being looked for. The
program says so, and says the half that fixes it runs elsewhere.

This is the interface that half needs: `drift --state` prints the collected
state and compares nothing, so a watcher on another machine can keep the
baseline and do the diff where the devbox cannot reach it.

To stdout unconditionally, terminal or not, because this is data rather than
a verdict.

The partial-state refusal survives the emitter, and that is the point of one
of the tests: a watcher diffing a partial state against a full baseline sees
a list of removals and calls it an intruder deleting things. Exit 2 there, as
everywhere else in this program, means could-not-determine.

`bats test/` 161 passing, 3 new.

branderson approved these changes 2026-08-28 01:04:43 -07:00

branderson merged commit d22d08ff99 into main

2026-08-28 01:04:48 -07:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dejima/dejima-devbox-hardener#21