b6b229bc

test: three borderline constants get a literal, three are left as they are

a73x 2026-08-23 11:12

Commit message

test: three borderline constants get a literal, three are left as they are

The exec output cap, the chrony drop-in path and the smoke's delegation
TTL were each asserted back from the constant that produced them, and
each is a number with a consequence outside the package: memory per
concurrent exec, where chronyd looks for its config, how long a minted
credential lives. netTapPrefix is left alone — the IFNAMSIZ budget it
feeds is already pinned by a literal 15 in the sibling test — as are
OnlineWindow, remoteToolCount and tenantExt, which assert relationships
rather than values.

internal/agent/seed/seed_test.go

Old		New
@@ -379,7 +379,9 @@ func TestVendorDataClockAlwaysPresent(t *testing.T) {
379	// The clock drop-in is fleet infrastructure like the disk-grow, not SSH	379	// The clock drop-in is fleet infrastructure like the disk-grow, not SSH
380	// material: it lands with no CA key, no host key, and no user-data.	380	// material: it lands with no CA key, no host key, and no user-data.
381	vd := vendorDataDoc(Params{})	381	vd := vendorDataDoc(Params{})
382	assert.Contains(t, vd, " - path: "+chronyDropInPath+"\n")	382	assert.Contains(t, vd, " - path: /etc/chrony/conf.d/eitri-clock.conf\n",
		383	"the drop-in path is the guest's, not eitri's: chronyd reads /etc/chrony/conf.d, and a path asserted against the "+
		384	"constant that wrote it lands anywhere at all while the guest's clock quietly keeps drifting")
383	assert.Contains(t, vd, " makestep 1 -1\n",	385	assert.Contains(t, vd, " makestep 1 -1\n",
384	"a negative limit disables the step limit, so a host suspend is stepped away rather than slewed")	386	"a negative limit disables the step limit, so a host suspend is stepped away rather than slewed")
385	assert.Contains(t, vd, chronyRuncmd, "the drop-in reaches the running chronyd, not just the next boot")	387	assert.Contains(t, vd, chronyRuncmd, "the drop-in reaches the running chronyd, not just the next boot")

internal/mcpserver/sshrun_test.go

Old		New
@@ -223,7 +223,12 @@ func TestExecReportsTruncationPastTheCap(t *testing.T) {
223	res, err := newTestRunner(t, string(bytes.Repeat([]byte("x"), outputCap+512)), 0).	223	res, err := newTestRunner(t, string(bytes.Repeat([]byte("x"), outputCap+512)), 0).
224	Exec(t.Context(), "testvm", "cat big", 30*time.Second)	224	Exec(t.Context(), "testvm", "cat big", 30*time.Second)
225	require.NoError(t, err)	225	require.NoError(t, err)
226	assert.Len(t, res.Stdout, outputCap, "captured output is capped")	226	// 1 MiB as a literal: a cap compared to itself is satisfied at any size,
		227	// including one that fits the whole of a guest's syslog into one reply.
		228	assert.Len(t, res.Stdout, 1<<20,
		229	"captured output is capped at 1 MiB — the buffer is held in the plane's memory per concurrent exec, and the bytes "+
		230	"go on to the model, so an unbounded `cat` on a guest is both a memory cost the plane never agreed to and a "+
		231	"context window spent on one file")
227	assert.True(t, res.Truncated, "the model must be told the output was cut")	232	assert.True(t, res.Truncated, "the model must be told the output was cut")
228	}	233	}
229		234

internal/smoke/mcp_test.go

Old		New
@@ -431,6 +431,9 @@ func TestSignDelegationProducesAUsableCertificate(t *testing.T) {
431	assert.Equal(t, []string{"ubuntu"}, cert.ValidPrincipals)	431	assert.Equal(t, []string{"ubuntu"}, cert.ValidPrincipals)
432	assert.Equal(t, f.pubLine, authorizedLine(cert.Key))	432	assert.Equal(t, f.pubLine, authorizedLine(cert.Key))
433	assert.Equal(t, uint64(now.Add(delegationTTL).Unix()), cert.ValidBefore)	433	assert.Equal(t, uint64(now.Add(delegationTTL).Unix()), cert.ValidBefore)
		434	assert.LessOrEqual(t, cert.ValidBefore, uint64(now.Add(time.Hour).Unix()),
		435	"a delegated user cert is a credential the smoke mints and leaves behind: bounded against delegationTTL it is valid "+
		436	"for however long that constant says, so the lifetime is held to an hour here as well")
434		437
435	checker := &ssh.CertChecker{	438	checker := &ssh.CertChecker{
436	IsUserAuthority: func(auth ssh.PublicKey) bool {	439	IsUserAuthority: func(auth ssh.PublicKey) bool {