goldenrules

Overview ¶

Package goldenrules holds repository-wide static regression tests for the golden rules in CLAUDE.md. It contains no production code: every file other than this one is a _test.go file that walks the repository from the go.mod root and asserts an invariant that must hold across the whole tree rather than inside a single package.

The tests are pure Go (no Docker, no network, no subprocesses) so they run under `make test` on every push. Each test name is canonical and is referenced from PROGRESS.md and docs/THREAT_MODEL.md:

• TestNoShellExecFromUserInput — golden rule 1: no Go file anywhere in the module imports os/exec (or x/sys/execabs) or spawns a process through syscall / x/sys (Exec, ForkExec, StartProcess, raw Syscall*) or os.StartProcess, resolved through the AST so import aliases cannot hide it (no allow-list).
• TestCIActionsPinnedBySHA — every GitHub Actions `uses:` reference (block or flow style, steps, reusable workflows, composite actions) is pinned to a full commit SHA (or a docker:// image pinned by digest).
• TestSeccompProfileParses — the shipped seccomp profile is default-deny and the operator copy under install/ is byte-identical to the embedded one (D-005).
• TestDocsNeverClaimCertification — no document or template claims SOC 2 (any Type), ISO 27001, HIPAA or PCI DSS certification/compliance unless immediately negated.
• TestComposeBundleSocketAndPorts, TestComposeBundleControlPlaneHardened, TestTraefikStaticConfigHardened — golden rules 2 and 4 plus D-004/D-006/D-009 applied to the install compose bundle: only socket-proxy holds the Docker socket (or any directory containing it) and publishes no port, platformd binds loopback only, Traefik owns 80/443 from unprivileged container ports, every service in the production bundle is non-root/read-only/cap-dropped/confined/limited with no host namespaces or devices, and Traefik has only the file provider, no static-config file, no dashboard, no network in common with socket-proxy, Let's Encrypt production as its resolved ACME CA, and Pebble as the resolved ACME CA in the dev overlay.