reeve 0.3.0 → 0.5.0

data/lib/reeve/inventory/report.rb

@@ -0,0 +1,146 @@
+# frozen_string_literal: true
+
+module Reeve
+  class Inventory
+    # Every registered name, in one of four states, plus whatever the inventory declares
+    # that the server does not register.
+    #
+    # The output names tools, tool classes and exemption reasons, and nothing else. It is
+    # built before any invocation and knows no arguments, principals or records, so it is
+    # safe to print in a CI log or a boot failure — there is nothing in it to redact.
+    #
+    #   reeve inventory: 6 registered
+    #     4 protected and guarded
+    #     1 routed through reeve but unguarded
+    #     1 bypasses reeve
+    #     0 exempted
+    #   coverage: incomplete
+    class Report
+      attr_reader :entries
+
+      def initialize(registered, routes, reasons)
+        @entries = (classify(registered, routes, reasons) +
+                    unregistered(registered, routes, reasons)).freeze
+        freeze
+      end
+
+      # Every registered name is either guarded or deliberately exempt, and the inventory
+      # names nothing the server does not register.
+      #
+      # That last part is not tidiness. A route for a name the server does not register is
+      # almost always a rename or a typo — and the real name, the one being dispatched, is
+      # then the one with no route.
+      def complete?
+        unguarded.empty? && bypassing.empty? && unregistered_entries.empty?
+      end
+
+      def registered
+        entries.reject { |entry| entry.status == :unregistered }
+      end
+
+      def guarded
+        select(:guarded)
+      end
+
+      def unguarded
+        select(:unguarded)
+      end
+
+      def bypassing
+        select(:bypass)
+      end
+
+      def exempted
+        select(:exempt)
+      end
+
+      def unregistered_entries
+        select(:unregistered)
+      end
+
+      # The classes routed to a registered name.
+      def routed_tools
+        entries.filter_map(&:tool).uniq
+      end
+
+      def to_s
+        [summary, *entries.filter_map { |entry| detail(entry) }].join("\n")
+      end
+
+      def inspect
+        "#<Reeve::Inventory::Report #{registered.size} registered, " \
+          "coverage: #{complete? ? 'complete' : 'incomplete'}>"
+      end
+
+      private
+
+      def select(status)
+        entries.select { |entry| entry.status == status }
+      end
+
+      def classify(registered, routes, reasons)
+        registered.map do |name|
+          tool = routes[name]
+          if tool
+            status = Reeve.registry.for_class(tool) ? :guarded : :unguarded
+            Entry.new(name: name, status: status, tool: tool)
+          elsif reasons.key?(name)
+            Entry.new(name: name, status: :exempt, reason: reasons[name])
+          else
+            Entry.new(name: name, status: :bypass)
+          end
+        end
+      end
+
+      def unregistered(registered, routes, reasons)
+        (routes.keys | reasons.keys).reject { |name| registered.include?(name) }.map do |name|
+          Entry.new(name: name, status: :unregistered, tool: routes[name],
+                    reason: reasons[name])
+        end
+      end
+
+      def summary
+        ["reeve inventory: #{registered.size} registered", *counts.map { |line| "  #{line}" },
+         "coverage: #{complete? ? 'complete' : 'incomplete'}"].join("\n")
+      end
+
+      def counts
+        lines = [
+          "#{guarded.size} protected and guarded",
+          "#{unguarded.size} routed through reeve but unguarded",
+          "#{bypassing.size} #{bypassing.size == 1 ? 'bypasses' : 'bypass'} reeve",
+          "#{exempted.size} exempted"
+        ]
+        return lines if unregistered_entries.empty?
+
+        lines << "#{unregistered_entries.size} declared but not registered"
+      end
+
+      # One line saying what is wrong and one saying what to do, for everything but a
+      # guarded tool — which needs neither. Exemptions are listed even when coverage is
+      # complete: a deliberate hole is still a hole, and it should be read every time.
+      def detail(entry)
+        case entry.status
+        when :unguarded
+          "\nUNGUARDED #{entry.name}\n  routed to #{label(entry.tool)}, which has no " \
+          "guard_with declaration — reeve denies it, or runs it unscoped under " \
+          ":allow_with_warning"
+        when :bypass
+          "\nBYPASS #{entry.name}\n  registered with the server but neither routed " \
+          "through reeve nor exempted — route it to a guarded tool, or exempt it with a " \
+          "reason"
+        when :exempt
+          "\nEXEMPT #{entry.name}\n  #{entry.reason}"
+        when :unregistered
+          what = entry.tool ? "routed to #{label(entry.tool)}" : "exempted"
+          "\nNOT REGISTERED #{entry.name}\n  #{what}, but the server registers no tool " \
+            "by that name — if it was renamed, the new name is unbound"
+        end
+      end
+
+      def label(tool)
+        tool.name || tool.inspect
+      end
+    end
+  end
+end

data/lib/reeve/inventory.rb

@@ -0,0 +1,212 @@
+# frozen_string_literal: true
+
+module Reeve
+  # The host's whole tool inventory, stated against what reeve was told about.
+  #
+  # Reeve only sees an invocation that reaches `Reeve.invoke`. A server that registers its
+  # tools as names and handler blocks can route some of them through the envelope and
+  # dispatch the rest directly, and the direct ones are invisible: neither guarded nor
+  # reported as unguarded. Every guarantee reeve makes — deny by default, scoping, the
+  # ledger — is skipped together for them, and nothing anywhere says so. The registry
+  # cannot answer "is every tool this endpoint dispatches protected?" because the tools
+  # that are not are, by construction, the ones it never heard of.
+  #
+  # The inventory makes the host's list of registered names the thing being checked:
+  #
+  #   McpInventory = Reeve::Inventory.new(
+  #     registered: -> { McpServer.tool_names },
+  #     routed: -> { { "search_invoices" => InvoiceSearchTool } },
+  #     exemptions: { "healthcheck" => { reason: "returns no application data" } }
+  #   )
+  #
+  #   McpInventory.verify!   # at boot, or in CI
+  #
+  # and, optionally, the place the host dispatches through, so that a name it has no
+  # entry for is refused rather than run:
+  #
+  #   McpInventory.dispatch(name, arguments: args) { handlers.fetch(name).call(args) }
+  #
+  # Every part takes a value or a callable returning one. A Rails initializer cannot
+  # reference application constants, and a server registers its tools after the
+  # initializer runs, so the lists are read when asked for rather than when declared.
+  #
+  # Nothing here depends on an MCP library. A list of names is the whole protocol.
+  class Inventory
+    # One registered name, classified. +tool+ is the class it is routed to, if any;
+    # +reason+ is the stated reason for an exemption.
+    Entry = Struct.new(:name, :status, :tool, :reason, keyword_init: true)
+
+    def initialize(registered:, routed: {}, exemptions: {})
+      @registered = registered
+      @routed     = routed
+      @exemptions = exemptions
+
+      # Literal values are checked now, so a blank exemption reason fails on the line that
+      # declared it. Callables cannot be until they are asked; #report checks those.
+      resolve unless [registered, routed, exemptions].any? { |part| part.respond_to?(:call) }
+    end
+
+    # The classification, read fresh. Raises ArgumentError if the inventory is malformed:
+    # a report built from a list it could not read would be a report about nothing.
+    def report
+      Report.new(*resolve)
+    end
+
+    # The strict gate: the report when coverage is complete, IncompleteInventoryError
+    # otherwise. Call it where failing is what you want — boot, a deploy step, CI.
+    def verify!
+      report.tap do |result|
+        raise IncompleteInventoryError, result unless result.complete?
+      end
+    end
+
+    # The tool classes the inventory routes through reeve. The testing kit certifies these.
+    def routed_tools
+      routes.values.uniq
+    end
+
+    # The dispatch boundary. A host that sends every tool call through here cannot have a
+    # tool that bypasses reeve, because the three answers are exhaustive:
+    #
+    # * **routed** — runs through `Reeve.invoke` with the class it is routed to. A handler
+    #   block, if given, is the body, so a registry of blocks needs one guarded class per
+    #   tool to say which policy governs it and nothing else.
+    # * **exempt** — the handler runs as it would have without reeve. That is what the
+    #   exemption says, and why it needs a reason.
+    # * **neither** — governed by `config.unguarded_tools`, exactly like a tool with no
+    #   guard. Under `:deny`, the default, the call is refused with `unbound_tool`; under
+    #   `:allow_with_warning` it runs unscoped. Either way it is recorded, so a name the
+    #   inventory missed shows up in the ledger rather than nowhere.
+    #
+    # +registered+ is not consulted. The host's own dispatcher already decided the name
+    # exists; what this decides is whether reeve stands in front of it.
+    def dispatch(name, arguments: {}, principal: :unset, agent: nil, metadata: {}, &handler)
+      name = name.to_s
+      tool = routes[name]
+      if tool
+        return Reeve.invoke(tool: tool, arguments: arguments, principal: principal,
+                            agent: agent, metadata: metadata, &handler)
+      end
+
+      if handler.nil?
+        raise ArgumentError, "#{name} is not routed to a tool, so dispatch needs the " \
+                             "handler block that runs it"
+      end
+
+      return handler.call if exemption_reasons.key?(name)
+
+      dispatch_unbound(name, arguments: arguments, principal: principal, agent: agent,
+                             metadata: metadata, &handler)
+    end
+
+    def inspect
+      "#<Reeve::Inventory>"
+    end
+
+    private
+
+    def resolve
+      names = registered_names
+      routes = self.routes
+      reasons = exemption_reasons
+
+      both = routes.keys & reasons.keys
+      unless both.empty?
+        raise ArgumentError, "a tool is either routed through reeve or exempt from it, " \
+                             "not both: #{both.join(', ')}"
+      end
+
+      [names, routes, reasons]
+    end
+
+    def registered_names
+      names = read(:registered, @registered)
+      unless names.respond_to?(:to_a) && !names.is_a?(Hash)
+        raise ArgumentError, "registered must list tool names, got #{names.inspect}"
+      end
+
+      names.to_a.map { |name| name_from(:registered, name) }.uniq
+    end
+
+    def routes
+      read_hash(:routed, @routed).to_h do |name, tool|
+        unless tool.is_a?(Class)
+          raise ArgumentError, "routed must map each name to a tool class; " \
+                               "#{name} maps to #{tool.inspect}"
+        end
+
+        [name_from(:routed, name), tool]
+      end
+    end
+
+    # An exemption with no reason is a hole someone forgot about. With one, it is a
+    # decision someone can be asked about.
+    def exemption_reasons
+      read_hash(:exemptions, @exemptions).to_h do |name, options|
+        name = name_from(:exemptions, name)
+        reason = options.is_a?(Hash) ? (options[:reason] || options["reason"]) : nil
+        if reason.nil? || reason.to_s.strip.empty?
+          raise ArgumentError, "the exemption for #{name} needs a reason, e.g. " \
+                               "{ \"#{name}\" => { reason: \"returns no application data\" } }"
+        end
+
+        [name, reason.to_s.strip]
+      end
+    end
+
+    def read_hash(part, source)
+      value = read(part, source)
+      return value if value.is_a?(Hash)
+
+      raise ArgumentError, "#{part} must be a Hash keyed by tool name, got #{value.inspect}"
+    end
+
+    def read(part, source)
+      value = source.respond_to?(:call) ? source.call : source
+      raise ArgumentError, "#{part} is nil" if value.nil?
+
+      value
+    end
+
+    def name_from(part, name)
+      string = name.respond_to?(:to_str) || name.is_a?(Symbol) ? name.to_s.strip : nil
+      return string unless string.nil? || string.empty?
+
+      raise ArgumentError, "#{part} contains a blank or non-string tool name: #{name.inspect}"
+    end
+
+    # A name the inventory has no entry for still goes through the envelope, under its
+    # own name and with nothing to look up. The registry answer below is what makes the
+    # refusal name the real cause — the inventory, not a missing `guard_with` on a class
+    # that may not exist.
+    def dispatch_unbound(name, arguments:, principal:, agent:, metadata:, &handler)
+      config = Reeve.config.with_principal(principal)
+      context = Context.new(tool_name: name, agent: agent, arguments: arguments,
+                            metadata: metadata)
+
+      Invocation.call(context, registry: Unbound.new(name, config), config: config, &handler)
+    end
+
+    # The registry the envelope consults for an unbound name. Under `:deny` it answers
+    # with the refusal itself; under `:allow_with_warning` it has no guard to offer, and
+    # the envelope runs the tool unscoped and records `guard: "none"` — the same worklist
+    # an unguarded class lands on.
+    class Unbound
+      def initialize(name, config)
+        @name = name
+        @config = config
+      end
+
+      def guard_for(_tool_name)
+        return nil if @config.unguarded_tools == :allow_with_warning
+
+        Decision.deny(
+          rule: Decision::UNBOUND_TOOL,
+          detail: "#{@name} is neither routed through reeve nor exempted in the inventory"
+        )
+      end
+    end
+  end
+end
+
+require_relative "inventory/report"

data/lib/reeve/invocation.rb

@@ -90,7 +90,9 @@ module Reeve
       context.principal = principal
 
       guard = look_up_guard
-      return guard if guard.is_a?(Decision) # registry blew up
+      # A registry may answer with a refusal instead of a guard: the lookup raised, or an
+      # Inventory is refusing a name it has no entry for.
+      return guard if guard.is_a?(Decision)
 
       if guard.nil?
         if deny_unguarded?
@@ -152,13 +154,51 @@ module Reeve
       Decision.deny(rule: Decision::POLICY_ERROR, detail: "policy raised #{e.class}: #{e.message}")
     end
 
+    # A denial has to mean nothing happened.
+    #
+    # Authorization runs before the tool, but with the *class* as its subject — for an
+    # index-style check there is no record yet. The per-record answer only exists once the
+    # tool has returned something to scope. So a write tool used to mutate the record and
+    # then be refused its response: the caller saw `out_of_scope_record`, the ledger
+    # recorded a denial, and the row in the host's database had already changed. A denial
+    # in a compliance artifact that follows a committed write is not a partial guarantee,
+    # it is a false statement.
+    #
+    # Running the tool inside a transaction closes that. `requires_new` matters: under a
+    # transaction the host opened around the invocation this is a savepoint, so rolling
+    # back takes the tool's work and leaves the host's alone.
+    #
+    # What it cannot undo is anything that was never in the transaction — a sent email, a
+    # webhook, a file. A tool that reaches outside the database before it knows whether it
+    # is allowed to must ask first; `authorize!` in the tool body is for exactly that.
     def run_guarded(guard, decision, &tool)
+      return run_and_narrow(guard, decision, &tool) unless rollback_available?
+
+      ::ActiveRecord::Base.transaction(requires_new: true) do
+        outcome = run_and_narrow(guard, decision, &tool)
+        raise ::ActiveRecord::Rollback if @scope_result.denied?
+
+        outcome
+      end || @scope_result.decision
+    end
+
+    def run_and_narrow(guard, decision, &tool)
       result = execute(&tool)
 
       @scope_result = narrow(guard, result)
       @scope_result.denied? ? @scope_result.decision : decision
     end
 
+    # The core runs with no ActiveRecord at all (SC-008), and a host may have the library
+    # loaded without a connection. Neither can roll anything back, and neither should be
+    # made to fail here — they get the behaviour they had before, which the ledger still
+    # records truthfully because it records what the scoper decided either way.
+    def rollback_available?
+      defined?(::ActiveRecord::Base) && ::ActiveRecord::Base.connected?
+    rescue StandardError
+      false
+    end
+
     # The degraded mode a host opts into while retrofitting guards onto existing tools
     # (FR-023). The call is unscoped — that is the whole point of the warning.
     def run_unguarded(&tool)
@@ -171,6 +211,14 @@ module Reeve
 
     def execute(&tool)
       tool.call
+    rescue DeniedError => e
+      # A denial the tool raised on itself through `authorize!`. It is an authorization
+      # outcome, not a crash, and recording it as `tool_error` would file a policy saying
+      # no under the same rule as a NoMethodError. The rule the policy gave is carried
+      # through to the ledger unchanged.
+      @decision = Decision.deny(rule: e.rule, detail: e.detail)
+      @scope_result = ScopeResult.deny(rule: e.rule, detail: e.detail)
+      raise
     rescue StandardError => e
       # The tool's own failure propagates untouched, but not before the ensure block
       # records it: the invocations most worth having a trace of are the ones that broke.

data/lib/reeve/testing/assertions.rb

@@ -56,14 +56,14 @@ module Reeve
         )
       end
 
-      # SC-009's escape hatch: any of the seven, straight from Minitest.
+      # SC-009's escape hatch: any check, straight from Minitest.
       def assert_reeve_check(check)
         result = check.call
         assert result.passed?, result.message
         result
       end
 
-      # A whole Report at once, for a host that would rather have one test than seven.
+      # A whole Report at once, for a host that would rather have one test than one per check.
       def assert_reeve_compliance(principals: nil, **options)
         report = Checks.run_all(
           principals: principals || Testing.compliance_principals, **options

data/lib/reeve/testing/checks/endpoint_coverage.rb

@@ -0,0 +1,133 @@
+# frozen_string_literal: true
+
+module Reeve
+  module Testing
+    module Checks
+      # Whether the run covered the endpoint, or only the tools reeve was told about.
+      #
+      # Every other check walks a population reeve assembled itself: the classes that
+      # included `Reeve::Guard`. A server that dispatches some tools without ever handing
+      # them to reeve leaves them out of that population, and the run goes green on the
+      # subset it could see. This check compares the run against the host's own list of
+      # registered names (`config.inventory`), so a green run can only mean the endpoint.
+      #
+      # Four answers, and only one of them is a pass:
+      #
+      # * **no inventory declared** — skipped. Reeve cannot know what the server registers
+      #   unless told, and a pass here would be the green that means "did not look".
+      # * **a subset** — skipped, when the host narrowed the run with `compliance_tools` or
+      #   `tools:`. That is the incremental-adoption path; the run says what it certified
+      #   and that it is not the endpoint, without turning the build red mid-retrofit.
+      # * **incomplete** — failed: a registered tool bypasses reeve or reaches it unguarded,
+      #   and the run claimed to cover everything.
+      # * **complete** — passed.
+      #
+      #   Reeve::Checks::EndpointCoverage.new.call
+      #   Reeve::Checks::EndpointCoverage.new(inventory: McpInventory).call
+      class EndpointCoverage < Base
+        def initialize(inventory: :configured, tools: nil, ledger: nil)
+          super(ledger: ledger)
+          @inventory = inventory == :configured ? Reeve.config.inventory : inventory
+          @tools = tools
+        end
+
+        def call
+          return unverified if inventory.nil?
+
+          report = inventory.report
+          if narrowed?
+            subset(report)
+          elsif report.complete?
+            complete(report)
+          else
+            incomplete(report)
+          end
+        rescue StandardError => e
+          failed("the endpoint inventory could not be read, so its coverage is unknown: " \
+                 "#{e.class}: #{e.message}", coverage: :unknown)
+        end
+
+        private
+
+        attr_reader :inventory
+
+        def narrowed?
+          !@tools.nil? || Testing.compliance_tools_narrowed?
+        end
+
+        def certified
+          @certified ||= @tools || Testing.compliance_tools
+        end
+
+        def unverified
+          skipped(
+            "no endpoint inventory is declared, so this run certifies the " \
+            "#{pluralize(certified.size, 'tool')} reeve knows about and cannot say whether " \
+            "the server dispatches others outside it — set config.inventory to a " \
+            "Reeve::Inventory to verify the endpoint",
+            coverage: :unverified
+          )
+        end
+
+        def complete(report)
+          passed(
+            "every one of the #{pluralize(report.registered.size, 'tool')} the server " \
+            "registers is protected and guarded (#{report.guarded.size}) or exempted " \
+            "(#{report.exempted.size})",
+            coverage: :complete
+          )
+        end
+
+        def incomplete(report)
+          failed(
+            "expected every tool the server registers to be protected by reeve or " \
+            "exempted, but #{gaps(report)}\n\n#{report}",
+            coverage: :incomplete
+          )
+        end
+
+        # Complete coverage with a narrowed run is still a subset: the inventory is sound,
+        # but this run did not certify all of it.
+        def subset(report)
+          routed = report.routed_tools
+          missing = routed - certified
+          lines = [
+            "this run certifies a subset, not the endpoint: " \
+            "#{(routed - missing).size} of the #{pluralize(routed.size, 'tool')} routed " \
+            "through reeve (compliance_tools or tools: narrowed it)"
+          ]
+          lines << "not certified: #{missing.map { |tool| tool.name || tool.inspect }.join(', ')}" \
+            unless missing.empty?
+          lines << "" << report.to_s unless report.complete?
+
+          skipped(lines.join("\n"), coverage: :subset)
+        end
+
+        def gaps(report)
+          [
+            gap(report.bypassing, "bypasses it", "bypass it"),
+            gap(report.unguarded, "is routed through it unguarded",
+                "are routed through it unguarded"),
+            gap(report.unregistered_entries, "declared in the inventory is not registered",
+                "declared in the inventory are not registered")
+          ].compact.join(", ")
+        end
+
+        def gap(entries, one, many)
+          return nil if entries.empty?
+
+          "#{entries.size} #{entries.size == 1 ? one : many}"
+        end
+
+        # Only this check can come back with nothing established either way.
+        def skipped(message, details = {})
+          Result.skipped(check: check_name, message: message, details: details)
+        end
+
+        def base_details
+          {}
+        end
+      end
+    end
+  end
+end

data/lib/reeve/testing/checks.rb

@@ -8,10 +8,11 @@ require_relative "checks/rule_present"
 require_relative "checks/redaction_holds"
 require_relative "checks/principal_required"
 require_relative "checks/contract_version"
+require_relative "checks/endpoint_coverage"
 
 module Reeve
   module Testing
-    # The seven guarantees, as objects.
+    # The guarantees, as objects.
     #
     # This is the whole of the testing kit's logic. The RSpec matchers and the Minitest
     # assertions are adapters over it and contain no assertions of their own, which is why
@@ -29,11 +30,13 @@ module Reeve
         RulePresent,
         RedactionHolds,
         PrincipalRequired,
-        ContractVersion
+        ContractVersion,
+        EndpointCoverage
       ].freeze
 
-      # The checks that are asked once about the ledger rather than once per tool.
-      GLOBAL = [ContractVersion].freeze
+      # The checks that are asked once — about the ledger, or about the endpoint as a
+      # whole — rather than once per tool.
+      GLOBAL = [ContractVersion, EndpointCoverage].freeze
 
       # The compliance suite's engine (FR-018): every check, against every registered
       # guarded tool, in one Report.
@@ -53,9 +56,12 @@ module Reeve
       # test method out of, so that a failing suite names the guarantee that broke rather
       # than reporting "compliance" as one undifferentiated red.
       def self.run(check, principals:, tools: nil, arguments: {}, invoke: nil, ledger: nil)
-        return Report.new([check.new(ledger: ledger).call]) if GLOBAL.include?(check)
+        if GLOBAL.include?(check)
+          return Report.new([build(check, tool: nil, principals: principals, tools: tools,
+                                          ledger: ledger).call])
+        end
 
-        subjects = tools || Reeve.registry.map(&:tool_class)
+        subjects = tools || Testing.compliance_tools
         Report.new(
           subjects.map do |tool|
             build(check, tool: tool, principals: principals, arguments: arguments,
@@ -74,12 +80,17 @@ module Reeve
 
       # The one place that knows what each check's constructor wants. Front-ends and hosts
       # ask for a check by class and get a configured one back.
-      def self.build(check, tool:, principals:, arguments: {}, invoke: nil, ledger: nil)
+      #
+      # +tools+ is the population the run was given, which only EndpointCoverage reads: an
+      # explicit list is a narrowed run, and it must say so.
+      def self.build(check, tool:, principals:, arguments: {}, invoke: nil, ledger: nil,
+                     tools: nil)
         common = { tool: tool, arguments: arguments, invoke: invoke, ledger: ledger }
 
         case check.check_name
         when "GuardDeclared"      then GuardDeclared.new(tool: tool, ledger: ledger)
         when "ContractVersion"    then ContractVersion.new(ledger: ledger)
+        when "EndpointCoverage"   then EndpointCoverage.new(tools: tools, ledger: ledger)
         when "PrincipalRequired"  then PrincipalRequired.new(**common)
         when "CrossPrincipalLeak" then CrossPrincipalLeak.new(principals: Array(principals),
                                                               **common)

data/lib/reeve/testing/compliance_assertions.rb

@@ -15,7 +15,8 @@ module Reeve
     #
     # One method per check, matching the RSpec shared example group one for one, so a red
     # build names the guarantee that broke rather than reporting "compliance" as one
-    # undifferentiated failure.
+    # undifferentiated failure. A check that could establish nothing either way is
+    # skipped with its reason, never passed.
     module ComplianceAssertions
       include Assertions
 
@@ -25,6 +26,7 @@ module Reeve
 
         define_method(method_name) do
           report = Checks.run(check, principals: Testing.compliance_principals)
+          skip(report.to_s) if report.skipped?
           assert report.passed?, report.to_s
           report
         end

data/lib/reeve/testing/compliance_suite.rb

@@ -11,11 +11,14 @@
 #   Reeve::Testing.compliance_principals = -> { [users(:alice), users(:bob)] }
 #
 # One example per check rather than one for the lot, so a red build names the guarantee
-# that broke — "CrossPrincipalLeak" is an incident, "compliance" is a shrug.
+# that broke — "CrossPrincipalLeak" is an incident, "compliance" is a shrug. A check that
+# could establish nothing either way (EndpointCoverage with no inventory) is skipped, with
+# its reason, rather than passed.
 RSpec.shared_examples "a reeve-compliant server" do
   Reeve::Checks::ALL.each do |check|
     it "satisfies #{check.check_name} for every registered guarded tool" do
       report = Reeve::Checks.run(check, principals: Reeve::Testing.compliance_principals)
+      skip(report.to_s) if report.skipped?
 
       expect(report).to be_passed, report.to_s
     end