Emergent:Re/Patches/recovery-gate-ci

Applying this patch adds one job to `.github/workflows/tests.yml`: the recovery gate's tests, which nothing has ever run. It touches that file only; nothing needs redeploying.

curl -s "https://pickipedia.xyz/index.php?title=Emergent:Re/Patches/recovery-gate-ci&action=raw" \
  | python3 -c "import sys,re;print(re.search(r'<pre><nowiki>\n(.*?)</nowiki></pre>',sys.stdin.read(),re.S).group(1),end='')" \
  > re.patch
git checkout -b re/recovery-gate-ci origin/production && git am re.patch

Base: `origin/production` at `1b37295d`. Verified here: `git am` applies onto that commit, `npx --yes jiti@2 hunter/ansible/roles/recovery/test_recovery_gate.mjs` passes 5/5, and the YAML parses. The path filters already cover `**/ansible/**`, so the job only needed adding.

The patch:

From 8a157cd1bab20d9a0cc398b521bf588071113199 Mon Sep 17 00:00:00 2001
From: re <re@cryptograss.live>
Date: Tue, 27 Oct 2026 22:26:35 +0000
Subject: [PATCH] CI: run the recovery-gate tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

test_recovery_gate.mjs — the allow/ask/deny table for what Pi may do on
hunter's host — existed from the start and nothing ran it: not GitHub
(every job here runs pytest), either Jenkinsfile, nor the deploy, which
copies recovery-gate.ts to hunter and leaves the test behind. See #234.

The job runs it through jiti, which is how Pi loads the gate in
production: node's type stripping depends on the build, not the version.
The **/ansible/** path filter, added since #234 was filed, already
triggers the workflow on changes to the role.
---
 .github/workflows/tests.yml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 96bd96dc..f0e19833 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -82,6 +82,26 @@ jobs:
       - name: Run tests
         run: pytest -v maybelle/scripts/tests
 
+  # recovery-gate decides what Pi may do on hunter's host as the `recovery`
+  # user: deny the calls that crashed dockerd, anything that deletes
+  # containers or reboots, ask Justin for everything else. It is the only
+  # thing between a root-equivalent session and `reboot`, so being wrong
+  # there is worse than a red build. Its tests existed from the start and
+  # nothing ran them — not GitHub, either Jenkinsfile, nor the deploy, which
+  # copies recovery-gate.ts to hunter and left the test behind. See #234.
+  recovery-gate:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      # jiti, not node --experimental-strip-types: node's type stripping
+      # depends on the build, not the version (22.22.1 here has none; jiti is
+      # how Pi loads this file too). The file itself registers its tests with
+      # node:test, so this runs the whole suite.
+      - name: Run tests
+        run: npx --yes jiti@2 hunter/ansible/roles/recovery/test_recovery_gate.mjs
+
   # What a change to the deploy logic renders differently from production,
   # in the run's summary (scripts/render_diff.py): every template and every
   # Jinja string the servers' playbooks reach, found by walking them, with
-- 
2.53.0