Documentation
¶
Overview ¶
Package wirecheck answers one question about one CLI: if rysh points it at the governance proxy, does its provider traffic actually go there?
It is the mechanism behind `##proxy check <binary>` (design 022 §4.4), and it exists because the alternative was a hand-maintained table. docs/proxy-compat-matrix.md can only say what someone verified on a verification host; this lets a user get the same answer for their own CLI, their own version, on their own machine — including CLIs rysh has never tested.
The verdict is made on CAPTURED BYTES, never on an exit code. A CLI that exits non-zero against a stub upstream but put a governed request on the wire is governed; one that exits cleanly having talked to the real provider is not.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Result ¶
type Result struct {
Binary string
Dialect string
Governed bool
// Inconclusive marks a run that proves nothing either way: the CLI failed
// before it could make any request, so its silence is not evidence about
// whether it honours the injected base URL. Reporting that as NOT GOVERNED
// would put a false ❌ in the compatibility matrix — a broken install read
// as a governance failure.
Inconclusive bool
Requests int // requests that reached the stub upstream through the proxy
Planted int // occurrences of the raw secret on the wire (must be 0)
Tokens int // SNAT stand-in tokens on the wire
CLIError string
Reason string
}
Result is the verdict. Governed is true only when the CLI put at least one request on the proxy's wire AND the planted secret was translated rather than forwarded.
func Run ¶
func Run(ctx context.Context, binary string, timeout time.Duration, scratchBase string) (Result, error)
Run probes one CLI. It starts a stub upstream and a REAL proxy with a REAL SecretNAT manager, runs the binary under the injected environment, and greps what arrived.
scratchBase is where the probe's throwaway working directory is created. It should be project-local (RyshDir); see makeScratch for why "" is a worse default than it looks.
Source Files