Why this library cites documents that are not in it

Copy Markdown View Source

ex_sandbox was an application inside the Axonn umbrella until 1.0.0, and it was moved out with git subtree split so that its 143 commits came with it. The code came. The specification tree it was written against did not, because that tree describes a platform this library is only one part of.

The comments and docstrings here cite that tree constantly, and deliberately. This project's convention is that a claim about behaviour names the thing that measured it, so a comment saying a pasta ordering hazard is real names the probe script that demonstrated it. Stripping those citations during the extraction would have converted measured statements into assertions, which is the change this codebase is least willing to make. They were kept instead, and this page is what makes them resolvable.

test/documentation_pointers_test.exs enforces the split below. A backticked filename anywhere in lib/, test/, or mix.exs must either resolve in this repository or be listed there as one of the three kinds of absence described here. A name that is neither is a broken pointer, and that test is the thing that fails.

1. Artefacts that stayed in the umbrella

Reachable only in the originating repository. Cited for provenance, never as something a reader of this package is expected to open.

NameWhat it is
contracts/egress.md, contracts/hardening.mdThe interface contracts the egress and hardening subsystems were built to satisfy. The requirement IDs they define (005-FR-011a and the rest) are explained in requirement-ids.md, which did come across.
012/contracts/execution-seam.md, 008/data-model.mdContracts belonging to numbered features that own other parts of the platform.
egress-path-measurements.mdThe measurement log for the egress path. Every numbered defect cited from a comment here is one of its entries.
spec.md, quickstart.mdPer-feature specification and operator walkthrough.
docs/legacy/specify/014-desktop-deployment/spikes/darwin-hardening/baseline.md, spin.cThe darwin hardening spike and the fixture it measured against. test/support/darwin_fixtures/spin_nolimit.c is this repository's deliberately-different sibling of that fixture, and says so.
docker/launch-ordering-probe.sh, docker/wired-egress-e2e.sh, docker/netns-first-e2e.sh, docker/acceptor-e2e.sh, docker/unprivileged-census-probe.sh, docker/acceptor-mark-probe.py, docker/loopback-redirect-probe.py, docker/compose.memtiming.ymlOne-off probes, each written to settle one question and kept where it was written. The docker/ directory here holds the isolation harness, which is a different thing: it runs on every change, and it is the reason docker/census-baseline.txt exists.
library_boundary_test.exs, delegated_launch_test.exs, provision.ex, apps/axonn/test/axonn/model_access/credential_leak_test.exsUmbrella modules and tests. Where this repository has its own equivalent, the comment names both.

⚠️ A citation here is not a dependency. Nothing in this library reads any of these files at build time or at run time, and no consumer needs them. The isolation harness under docker/ is self-contained, and mix test needs nothing outside this tree.

2. This repository's own deleted history

Reachable with git log. These are named in comments that explain why the current code has the shape it has, and naming the thing that was removed is the point.

priv/egress/nsacceptor.py was the Python listener the egress acceptor used to be, deleted in 1.1.0 when setns(2) made a namespace-local socket possible from the BEAM. pool_relay_wiring_test.exs and pool_transport_test.exs were the two test files that justified ExSandbox.Egress.Pool's host listener; they were moved onto ExSandbox.Egress.Acceptor and renamed when that listener was removed, and ExSandbox.Egress.Decision records why. pool_decide_test.exs was renamed to decision_test.exs in the same commit, and the pointer to it that stayed behind in test/egress/supervision_test.exs is the one this page's test was written for.

3. Produced rather than committed

Absent from a clean checkout by design.

priv/netns_nif.so is built from c_src/netns_nif.c by Mix.Tasks.Compile.NetnsNif, in the consumer's own tree, and is excluded from the package so a maintainer's architecture never ships. docker/results/census.txt and docker/results/suite.log are one isolation run's output. secret.txt is a fixture a hardening test writes and then proves is unreadable.

4. In the repository, not in the isolation image

docker/Dockerfile.isolation copies the working tree, and .dockerignore holds back .git/ and .github/ because a runtime image has no use for either. .github/workflows/ci.yml is therefore cited by test/test_helper.exs and present on every developer machine and every CI checkout, and absent from the one place the suite also runs.

The check resolves a name against the filesystem before it consults its allowlist, so on a full checkout ci.yml resolves normally and this category is never reached. It exists so the suite passes inside the container without the check having to be weakened everywhere else.