From e2ffecde9a85a378ace7baedf30bfcfddb9c4eb4 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 9 Aug 2026 17:20:03 +0000 Subject: [PATCH] ci(wifi-veil): add honesty / anti-slop guard MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add scripts/ci-guard.sh and a `guard` CI job that statically enforce the project's honesty invariants so they cannot silently regress: - no telemetry (.claude-flow/), build artifacts, lockfile, or scratch/probe files committed; - no debug / mock-probe / slop markers in source (panic!("probe...), dbg!, println!("DEBUG, TODO(ai), LOREM IPSUM, ...); - the SYNTHETIC evidence label present on every firmware provider README, and the "never jamming" compliance disclaimer present in the root + firmware READMEs; - no dishonest hardware-validation claims — honest negated / TODO(hw) / build-only mentions are explicitly allowed (negation-aware); - no stale monorepo crate/harness identifiers in the code/manifest surface. Scans only git-tracked files under the tree, so it works both in-monorepo and in the extracted standalone repo, and never trips on untracked local scratch or target/. Documented in CONTRIBUTING.md; passes clean on the current tree. Co-Authored-By: claude-flow Claude-Session: https://claude.ai/code/session_01WEXNqzs7UsfNFBcP5yW21p --- wifi-veil/.github/workflows/ci.yml | 8 ++ wifi-veil/CONTRIBUTING.md | 13 ++++ wifi-veil/scripts/ci-guard.sh | 113 +++++++++++++++++++++++++++++ 3 files changed, 134 insertions(+) create mode 100755 wifi-veil/scripts/ci-guard.sh diff --git a/wifi-veil/.github/workflows/ci.yml b/wifi-veil/.github/workflows/ci.yml index 0a90dfc0..9e6706a0 100644 --- a/wifi-veil/.github/workflows/ci.yml +++ b/wifi-veil/.github/workflows/ci.yml @@ -10,6 +10,14 @@ concurrency: cancel-in-progress: true jobs: + guard: + name: Honesty / anti-slop guard + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Enforce honesty / anti-slop invariants + run: bash scripts/ci-guard.sh + rust: name: Rust (test + lint + wasm) runs-on: ubuntu-latest diff --git a/wifi-veil/CONTRIBUTING.md b/wifi-veil/CONTRIBUTING.md index 463ea89e..f8d1a396 100644 --- a/wifi-veil/CONTRIBUTING.md +++ b/wifi-veil/CONTRIBUTING.md @@ -31,6 +31,19 @@ cd firmware/core && make test # portable C core host test node harness/bin/cli.js guidance --topic overview # harness (dependency-free) ``` +Run the honesty / anti-slop guard before pushing (CI runs it too): + +```bash +bash scripts/ci-guard.sh +``` + +It statically enforces the invariants that keep this project honest: no +telemetry / build artifacts / lockfile / scratch files committed; no debug or +mock-probe markers in source; the `SYNTHETIC` evidence label present on every +firmware provider README; the "never jamming" compliance disclaimer present; no +dishonest hardware-validation claims (honest negated/`TODO(hw)` mentions are +fine); and no stale monorepo identifiers in the code surface. + CI (`.github/workflows/ci.yml`) runs the same gates. Keep changes the smallest coherent unit, read before editing, and never commit telemetry (`.claude-flow/`), build artifacts, credentials, or CSI/person data. diff --git a/wifi-veil/scripts/ci-guard.sh b/wifi-veil/scripts/ci-guard.sh new file mode 100755 index 00000000..e2e846e8 --- /dev/null +++ b/wifi-veil/scripts/ci-guard.sh @@ -0,0 +1,113 @@ +#!/usr/bin/env bash +# WiFi Veil CI guard — enforces the project's honesty / anti-slop invariants so +# they cannot silently regress. This is a STATIC scan; the deterministic proof +# witness, tests, clippy, and the C-core test run in the main CI jobs. +# +# It scans only git-tracked files under the current tree, so untracked local +# scratch never fails CI and build outputs (target/) are ignored. Run locally +# from the repo root: bash scripts/ci-guard.sh +# +# Every check prints PASS/FAIL; the script exits non-zero if any check fails. +set -u + +fail=0 +pass() { printf 'PASS %s\n' "$1"; } +bad() { printf 'FAIL %s\n' "$1"; fail=1; } + +# All tracked files under cwd (works both in-monorepo-subdir and standalone). +mapfile -t TRACKED < <(git ls-files -- .) +# Convenience filtered lists. +code_files() { printf '%s\n' "${TRACKED[@]}" | grep -E '\.(rs|c|h|js|ts)$' || true; } +doc_files() { printf '%s\n' "${TRACKED[@]}" | grep -E '\.md$' || true; } + +# --------------------------------------------------------------------------- +# 1. No forbidden artifacts / telemetry / scratch committed. +# --------------------------------------------------------------------------- +artifacts=$(printf '%s\n' "${TRACKED[@]}" | grep -E \ + '(^|/)(\.claude-flow/|node_modules/|target/)|\.o$|(^|/)test_veil_shield$|(^|/)Cargo\.lock$|(^|/)tests/probe.*\.rs$|(^|/)(tmp_|scratch_).*' \ + || true) +if [ -n "$artifacts" ]; then + bad "forbidden artifacts/telemetry/scratch are tracked:" + printf ' %s\n' $artifacts +else + pass "no telemetry / build artifacts / lockfile / scratch files tracked" +fi + +# --------------------------------------------------------------------------- +# 2. No debug/scratch leftovers in source (mock-probe / slop markers). +# --------------------------------------------------------------------------- +markers='panic!\("probe|dbg!\(|println!\("DEBUG|console\.log\("DEBUG|TODO\(ai\)|FIXME\(slop\)|XXX SLOP|LOREM IPSUM' +hits=$(code_files | xargs -r grep -nEI "$markers" 2>/dev/null || true) +if [ -n "$hits" ]; then + bad "debug/scratch/slop markers in source:" + printf ' %s\n' "$hits" +else + pass "no debug/scratch/slop markers in source" +fi + +# --------------------------------------------------------------------------- +# 3. Honesty labels present where evidence discipline requires them. +# Every firmware provider README must carry the SYNTHETIC label; the top +# firmware README and the root README must carry the compliance disclaimer. +# --------------------------------------------------------------------------- +for p in firmware/openwifi firmware/openwrt firmware/nexmon firmware/esp32; do + if [ -f "$p/README.md" ]; then + if grep -qi 'SYNTHETIC' "$p/README.md"; then + pass "$p/README.md carries SYNTHETIC evidence label" + else + bad "$p/README.md is missing the SYNTHETIC evidence label" + fi + fi +done +for f in firmware/README.md README.md; do + if [ -f "$f" ]; then + if grep -qiE 'never jamming|not jamming|not a jammer' "$f"; then + pass "$f carries the 'never jamming' compliance disclaimer" + else + bad "$f is missing the 'never jamming' compliance disclaimer" + fi + fi +done + +# --------------------------------------------------------------------------- +# 4. No dishonest hardware-success claims. Honest 'not yet MEASURED / TODO(hw) / +# build-only' language is REQUIRED elsewhere; here we forbid only phrases that +# assert silicon validation that does not exist. (Conservative denylist to +# avoid false positives on the many honest negated mentions.) +# --------------------------------------------------------------------------- +dishonest='hardware[- ]validated|validated on (real )?silicon|flashed and verified|[^n]verified on silicon|confirmed on hardware|MEASURED on (real )?hardware' +# Exclude honest negated/hedged mentions (the discipline itself): "not/never +# validated on silicon", "NOT hardware-validated", "unverified", "nothing is +# validated", "SYNTHETIC ... not hardware-validated", roadmap/TODO framing, etc. +negation='\bnot\b|\bnever\b|\bno\b|\bnothing\b|\bwithout\b|unverified|unvalidated|\bwould\b|\bplanned\b|\bbefore\b|not yet|TODO|SYNTHETIC' +hwhits=$( { doc_files; code_files; } | xargs -r grep -nEiI "$dishonest" 2>/dev/null \ + | grep -viE "$negation" || true) +if [ -n "$hwhits" ]; then + bad "dishonest hardware-success claim(s) (no captured log exists):" + printf ' %s\n' "$hwhits" +else + pass "no dishonest hardware-validation claims" +fi + +# --------------------------------------------------------------------------- +# 5. No stale monorepo identifiers in the standalone code surface. The crate is +# `wifi-veil` (lib `wifi_veil`); the old `wifi-densepose-privshield` name must +# not survive in code / manifests (docs may cite the historical ADR filename). +# --------------------------------------------------------------------------- +codeset=$(printf '%s\n' "${TRACKED[@]}" | grep -E '\.(rs|toml)$|harness/(bin|src)/.*\.(js|ts)$|harness/package\.json$|harness/\.harness/manifest\.json$' || true) +if [ -n "$codeset" ]; then + stale=$(printf '%s\n' "$codeset" | xargs -r grep -nEI 'wifi[_-]densepose[_-]privshield' 2>/dev/null || true) + if [ -n "$stale" ]; then + bad "stale monorepo crate/harness identifier in code/manifests:" + printf ' %s\n' "$stale" + else + pass "no stale monorepo identifiers in code/manifests" + fi +fi + +echo +if [ "$fail" -ne 0 ]; then + echo "ci-guard: FAILED" + exit 1 +fi +echo "ci-guard: all invariants hold"