@chrono-meta/fh-gate 1.4.71 → 1.4.73

package/scripts/test_degrade_scan_shell_probes.sh

@@ -0,0 +1,185 @@
+#!/usr/bin/env bash
+# test_degrade_scan_shell_probes.sh — regression anchor for the shell (S*) probes of
+# scripts/degrade_direction_scan.sh.
+#
+# WHY THIS EXISTS (measured 2026-07-28, known-pair calibration):
+#   The scan COLLECTED `.sh` files but every probe was Python-shaped (`except:` / `.get(k, True)` /
+#   `if not x:` / `.split()`). A known-positive bash file carrying four distinct default-toward-PASS
+#   shapes scored 0/4 and the scan printed "no default-toward-PASS smells in 1 scanned py/sh file".
+#   That is a FALSE CLEAN — strictly worse than honest non-coverage, because a caller keying on the
+#   message or exit code reads it as verified.
+#   A second, larger hole surfaced in the same run: git hooks are named `pre-push` / `pre-commit`
+#   (no extension) and live under a DOTTED directory, so `templates/.git-hooks` — FH's own mechanical
+#   floor — reported "no scannable (py/sh) target files", exit 0.
+#
+# The assertions below pin: (1) the S-probes separate a known pair, (2) extensionless shell files
+# under a dotted directory are collected, (3) the Python probes did not regress, and (4) two
+# deliberate NON-detections stay non-detections — flagging them would push an author to delete a
+# remedy or to silence a legitimate precondition guard.
+#
+# Usage:  bash scripts/test_degrade_scan_shell_probes.sh
+# Exit:   0 = all assertions pass; 1 = a regression.
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SCAN="$REPO_ROOT/scripts/degrade_direction_scan.sh"
+[ -f "$SCAN" ] || { echo "FAIL: $SCAN not found"; exit 1; }
+
+TMP="$(mktemp -d)"
+trap 'rm -rf "$TMP"' EXIT
+
+pass=0; fail=0
+ok()   { printf '  ✅ %s\n' "$1"; pass=$((pass+1)); }
+bad()  { printf '  ❌ %s\n' "$1"; fail=$((fail+1)); }
+
+# Count S-probe hit lines. Deliberately counts the probe TAG, not the summary line: a summary can say
+# "clean" for reasons unrelated to detection, and this anchor must not be satisfiable by prose.
+s_hits() { bash "$SCAN" "$@" 2>&1 | grep -cE '\[S[0-9]:'; }
+p_hits() { bash "$SCAN" "$@" 2>&1 | grep -cE '\[[A-F][0-9]?:'; }
+rc_of()  { bash "$SCAN" "$@" >/dev/null 2>&1; echo $?; }
+
+# ── Fixtures ────────────────────────────────────────────────────────────────────────
+# Known POSITIVE: four distinct shell-shaped default-toward-PASS constructs, one per probe.
+cat > "$TMP/known_positive.sh" <<'EOF'
+#!/usr/bin/env bash
+check_secret() {
+  scan_output=$(run_scanner "$1") || return 0        # S1: the check errored -> report success
+  if [ -z "$scan_output" ]; then
+    return 0                                          # S4: empty == errored == "clean"
+  fi
+  return 1
+}
+verdict=$(get_verdict) || verdict="PASS"              # S3: unresolved -> permissive verdict
+if [ "$verdict" = "BLOCK" ]; then
+  exit 1
+else
+  exit 0                                              # S2: unenumerated case -> allow
+fi
+EOF
+
+# Known NEGATIVE: the same logic written fail-closed. Must stay silent, or the probes are noise.
+cat > "$TMP/known_negative.sh" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+check_secret() {
+  if ! scan_output=$(run_scanner "$1"); then
+    echo "scanner failed - fail closed" >&2; return 1
+  fi
+  [ -n "$scan_output" ] && return 1
+  return 0
+}
+EOF
+
+# Extensionless hook under a DOTTED directory — the collection bug's exact shape.
+mkdir -p "$TMP/.git-hooks"
+cat > "$TMP/.git-hooks/pre-push" <<'EOF'
+#!/usr/bin/env bash
+verdict=$(classify_refs) || verdict="ALLOW"
+EOF
+
+# Deliberate NON-detections.
+cat > "$TMP/non_detections.sh" <<'EOF'
+#!/usr/bin/env bash
+# (a) integer sanitization — the PRESCRIBED remedy for the pipefail-fallback class, not the defect.
+count=$(grep -c pattern file)
+if [ "${count:-0}" -gt 0 ]; then echo "found"; fi
+# (b) SCOPE guards — "this run does not apply here" is not a claim that a check passed.
+[ -d "$HOME/projects" ] || exit 0
+[[ "$1" =~ ^[0-9]{4}$ ]] || return 0
+EOF
+
+# DEPENDENCY guards must NOT be swept up by the scope-guard exclusion above. `[ -f lib ] || exit 0`
+# says "my guard library is missing, therefore allow" — the fail-open shape measured on qasp
+# 2026-07-28. An earlier draft of the scoping hid it; this fixture pins the distinction.
+cat > "$TMP/dependency_guards.sh" <<'EOF'
+#!/usr/bin/env bash
+[ -f "$GUARD_LIB" ] || exit 0
+[ -x "$SCANNER" ] || exit 0
+EOF
+
+# Python known-pair — the pre-existing probes must not have regressed.
+printf 'def f(x):\n    try:\n        return g(x)\n    except Exception:\n        return True\n' > "$TMP/kp.py"
+printf 'def f(x):\n    try:\n        return g(x)\n    except Exception:\n        raise\n' > "$TMP/kn.py"
+
+# ── Assertions ──────────────────────────────────────────────────────────────────────
+echo "degrade-scan shell-probe regression anchor"
+
+n=$(s_hits "$TMP/known_positive.sh")
+[ "$n" -eq 4 ] && ok "known-positive .sh: 4/4 shell smells detected" \
+                || bad "known-positive .sh: expected 4 S-hits, got $n (probes blind to bash again)"
+
+rc=$(rc_of "$TMP/known_positive.sh")
+[ "$rc" -eq 2 ] && ok "known-positive .sh: advisory exit 2" \
+                || bad "known-positive .sh: expected exit 2, got $rc"
+
+n=$(s_hits "$TMP/known_negative.sh")
+[ "$n" -eq 0 ] && ok "known-negative .sh: silent (probes discriminate, not just fire)" \
+                || bad "known-negative .sh: expected 0 S-hits, got $n"
+
+rc=$(rc_of "$TMP/known_negative.sh")
+[ "$rc" -eq 0 ] && ok "known-negative .sh: exit 0" \
+                || bad "known-negative .sh: expected exit 0, got $rc"
+
+# Directory walk must reach an extensionless shell file inside a dotted directory.
+n=$(s_hits "$TMP/.git-hooks")
+[ "$n" -ge 1 ] && ok "extensionless hook under a dotted dir: collected and scanned" \
+                || bad "extensionless hook under a dotted dir: not scanned ($n hits) — the git-hook floor is invisible again"
+
+# ...and so must an explicit file argument naming it.
+n=$(s_hits "$TMP/.git-hooks/pre-push")
+[ "$n" -ge 1 ] && ok "extensionless hook as a direct file argument: scanned" \
+                || bad "extensionless hook as a direct file argument: not scanned ($n hits)"
+
+n=$(s_hits "$TMP/non_detections.sh")
+[ "$n" -eq 0 ] && ok "non-detections stay silent (\${v:-0} sanitization + precondition guards)" \
+                || bad "non-detections fired $n time(s) — flagging the remedy trains authors to delete it"
+
+# A DOTTED shell filename (`helper.bash`) must not be silently dropped from a directory walk.
+# Cross-family finding (gpt-5.5, 2026-07-28), reproduced before acceptance: the directory path
+# dropped it in silence while the explicit-file path reported the same file as UNSCANNABLE.
+# Silent on one path, honest on the other, is the fail-open half.
+mkdir -p "$TMP/dotted"
+cat > "$TMP/dotted/helper.bash" <<'EOF'
+#!/usr/bin/env bash
+scan=$(run_scanner "$1") || return 0
+EOF
+cat > "$TMP/dotted/gate.sh" <<'EOF'
+#!/usr/bin/env bash
+scan=$(run_scanner "$1") || return 0
+EOF
+n=$(s_hits "$TMP/dotted")
+[ "$n" -eq 2 ] && ok "dotted shell filename (helper.bash) scanned alongside gate.sh in a directory walk" \
+                || bad "dotted shell filename: expected 2 S-hits, got $n — a .bash/.zsh gate is silently dropped again"
+
+n=$(s_hits "$TMP/dependency_guards.sh")
+[ "$n" -eq 2 ] && ok "dependency guards (\`[ -f lib ] || exit 0\`) still detected — scope exclusion did not swallow them" \
+                || bad "dependency guards: expected 2 S-hits, got $n — 'guard library missing → allow' is hidden again"
+
+n=$(p_hits "$TMP/kp.py")
+[ "$n" -ge 1 ] && ok "python known-positive: pre-existing probes still fire" \
+                || bad "python known-positive: no hits — the Python probes regressed"
+
+n=$(p_hits "$TMP/kn.py")
+[ "$n" -eq 0 ] && ok "python known-negative: still silent" \
+                || bad "python known-negative: $n hit(s) — Python probes became noisy"
+
+# The field-propagated copy must not drift from the canonical one. Two copies of the same
+# normalizer diverge, and the lenient half silently drops what the strict half catches — measured
+# 2026-07-28: `templates/` was 2 lines behind BEFORE this session's fix and then a full 8 KB behind
+# after it, so field harnesses (the ones the cross-family gate doc actually points at) were running
+# the version that scored 0/4 on the known-positive while `scripts/` scored 4/4.
+TPL="$REPO_ROOT/templates/degrade_direction_scan.sh"
+if [ ! -d "$REPO_ROOT/templates" ]; then
+  # Package mode: the npm tarball may ship a narrower surface. Absent templates/ is not drift.
+  printf '  \u2013 field-copy drift check SKIPPED (no templates/ — package mode)\n'
+elif [ ! -f "$TPL" ]; then
+  bad "templates/ exists but degrade_direction_scan.sh is MISSING there — field harnesses get no scan"
+elif cmp -s "$TPL" "$SCAN"; then
+  ok "field-propagated copy is byte-identical to scripts/ (no divergent-normalizer drift)"
+else
+  bad "templates/degrade_direction_scan.sh has DRIFTED from scripts/ — the field copy is what qasp/pmh run; sync it (cp scripts/degrade_direction_scan.sh templates/)"
+fi
+
+echo "----"
+echo "degrade-scan shell probes: $pass passed, $fail failed"
+[ "$fail" -eq 0 ] || exit 1

package/scripts/test_fh_gate_regressions.sh

@@ -34,7 +34,7 @@ while [ $# -gt 0 ]; do
   esac
 done
 cat >/dev/null   # consume the prompt on stdin
-[ -n "$out" ] && printf '%s' "$FAKE_PAYLOAD" > "$out"
+[ -n "$out" ] && printf '%s' "${FAKE_PAYLOAD_CODEX:-$FAKE_PAYLOAD}" > "$out"
 exit 0
 FAKE
 chmod +x "$FAKEBIN/codex"
@@ -47,7 +47,7 @@ cat > "$FAKEBIN/claude" <<'FAKE'
 #!/usr/bin/env bash
 cat >/dev/null   # consume the prompt on stdin
 if [ -n "${FAKE_ENVELOPE:-}" ]; then printf '%s\n' "$FAKE_ENVELOPE"; exit 0; fi
-printf '{"is_error":false,"subtype":"success","structured_output":%s}\n' "$FAKE_PAYLOAD"
+printf '{"is_error":false,"subtype":"success","structured_output":%s}\n' "${FAKE_PAYLOAD_CLAUDE:-$FAKE_PAYLOAD}"
 exit 0
 FAKE
 chmod +x "$FAKEBIN/claude"
@@ -201,6 +201,50 @@ printf '#!/usr/bin/env bash\nexit 1\n' > "$NOENT/od";      chmod +x "$NOENT/od"
 check "no CSPRNG (openssl+od stubbed to fail) → fails closed" 10 \
   env PATH="$NOENT:$PATH" FH_DRY_RUN=1 bash "$GATE" "package.json" quick test
 
+echo
+echo "── FH_BACKEND=cross (decorrelated review) ──"
+# cross runs BOTH families and UNIONs. `auto` is fallback SELECTION and runs one leg; conflating the
+# two would let a single-family verdict read as decorrelated, which is the defect class this mode
+# exists to remove. These pairs pin: the union verdict, the leg accounting, and — most importantly —
+# that a degraded (single-leg) run says so in machine-readable form.
+CROSS_PASS='{"status":"SUCCESS","verdict":"PASS","findings_count":0,"findings_a":0,"findings_b":0,"findings":[]}'
+CROSS_BLOCK='{"status":"SUCCESS","verdict":"BLOCKED","findings_count":1,"findings_a":1,"findings_b":0,"findings":[{"grade":"A","location":"x:1","title":"t","evidence":"e","fix":"f"}]}'
+
+check_out() {  # <name> <expected-exit> <grep-ere that MUST appear> -- <cmd...>
+  local name="$1" expect="$2" want="$3"; shift 3
+  local got
+  "$@" >"$TMPROOT/out" 2>"$TMPROOT/err"; got=$?
+  if [ "$got" -eq "$expect" ] && grep -qE "$want" "$TMPROOT/out"; then
+    printf 'PASS  %-58s (exit %s)\n' "$name" "$got"; pass=$((pass + 1))
+  else
+    printf 'FAIL  %-58s expected %s + /%s/, got %s\n' "$name" "$expect" "$want" "$got"
+    sed 's/^/        /' "$TMPROOT/out" | head -4; sed 's/^/        /' "$TMPROOT/err" | head -2
+    fail=$((fail + 1))
+  fi
+}
+run_cross() {  # <claude-payload> <codex-payload>
+  env PATH="$FAKEBIN:$PATH" FH_BACKEND=cross FH_MODEL=fake \
+      FAKE_PAYLOAD_CLAUDE="$1" FAKE_PAYLOAD_CODEX="$2" FAKE_PAYLOAD="$1" \
+      bash "$GATE" "package.json" quick test
+}
+
+check_out "cross: both PASS → PASS, decorrelated" 0 'FH_GATE_DECORRELATED: yes' \
+  run_cross "$CROSS_PASS" "$CROSS_PASS"
+# UNION, not vote: one leg blocking is enough. A majority rule would discard precisely the finding
+# only the other family saw, which is the entire point of running two.
+check_out "cross: one leg BLOCKED → union BLOCKED" 2 'FH_GATE_VERDICT: BLOCKED' \
+  run_cross "$CROSS_PASS" "$CROSS_BLOCK"
+check_out "cross: both legs' findings survive the union" 2 'FH_GATE_LEGS: claude,codex' \
+  run_cross "$CROSS_BLOCK" "$CROSS_BLOCK"
+# A machine with only one family is the COMMON case, not an edge case. It must not be silent.
+ONELEG="$TMPROOT/oneleg"; mkdir -p "$ONELEG"; cp "$FAKEBIN/claude" "$ONELEG/claude"
+check_out "cross: codex absent → single leg, DECORRELATED: no" 0 'FH_GATE_DECORRELATED: no' \
+  env PATH="$ONELEG:/usr/bin:/bin" FH_BACKEND=cross FH_MODEL=fake \
+      FAKE_PAYLOAD_CLAUDE="$CROSS_PASS" FAKE_PAYLOAD="$CROSS_PASS" \
+      bash "$GATE" "package.json" quick test
+check "cross: no family available → fails closed" 10 \
+  env PATH="/usr/bin:/bin" FH_BACKEND=cross bash "$GATE" "package.json" quick test
+
 echo
 echo "────────────────────────────────────────────────────────────────────"
 printf 'fh-gate regressions: %d passed, %d failed\n' "$pass" "$fail"

package/scripts/test_prepush_stdin_integrity.sh

@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+# test_prepush_stdin_integrity.sh — regression anchor for the 2026-07-20 fail-open hole.
+#
+# HOLE: the session-close block inserted at the TOP of templates/.git-hooks/pre-push starts a
+# subprocess. git delivers the pushed ref list on the hook's STDIN, and the ref-reading loop runs
+# AFTER that block. A stdin-inheriting subprocess drains the ref list → the loop sees zero refs →
+# every DEL_/FORCED_ variable stays empty → the hook takes "nothing destructive → exit 0",
+# silently disarming the Destructive-Op gate on a branch-delete / force push.
+#
+# This test reproduces the mechanism (not just greps for the fix), then asserts the fix is present.
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+HOOK="$ROOT/templates/.git-hooks/pre-push"
+FAILED=0
+_ok(){ echo "PASS  $1"; }
+_no(){ echo "FAIL  $1"; FAILED=1; }
+
+# T1 — the mechanism is real: a stdin-inheriting subprocess eats the ref list.
+GOT=$(printf 'r1 a1 r2 b2\n' | { _=$(bash -c 'cat >/dev/null' 2>&1); while read -r a _b _c _d; do echo "$a"; done; })
+[ -z "$GOT" ] && _ok "T1 mechanism reproduces (inheriting subprocess drains stdin)" \
+              || _no "T1 mechanism did NOT reproduce — test is no longer meaningful, re-derive it"
+
+# T2 — the fix works: redirecting the subprocess from /dev/null preserves the ref list.
+GOT=$(printf 'r1 a1 r2 b2\n' | { _=$(bash -c 'cat >/dev/null' 2>&1 </dev/null); while read -r a _b _c _d; do echo "$a"; done; })
+[ "$GOT" = "r1" ] && _ok "T2 '< /dev/null' preserves the ref list" \
+                  || _no "T2 redirect did not preserve stdin (got: '$GOT')"
+
+# T3 — the shipped hook actually carries the guard on the close-check invocation.
+LINE=$(grep -n 'session_close_check\.sh' "$HOOK" | grep -v '^\s*#' | grep '_SC_OUT=' || true)
+case "$LINE" in
+  *"< /dev/null"*|*"</dev/null"*) _ok "T3 pre-push close-check invocation is stdin-guarded" ;;
+  "") _no "T3 could not find the _SC_OUT invocation in $HOOK — hole may have been reintroduced under a new name" ;;
+  *)  _no "T3 pre-push close-check invocation LACKS '< /dev/null' → Destructive-Op gate is fail-open: $LINE" ;;
+esac
+
+# T4 — STRUCTURAL FIX: ref classification must run BEFORE any helper subprocess.
+# (Inverted 2026-07-20: the first draft asserted the opposite, because the block originally sat
+#  above the loop. A cross-family audit called that a priority inversion — advisory check above a
+#  blocking safety gate — so the block moved below classification and this assertion flipped with it.
+#  Match CODE lines only; an earlier draft matched the hook's own explanatory COMMENT and
+#  self-inverted. Instrument defect caught by the instrument.)
+SC_LN=$(grep -n '_SC_OUT=' "$HOOK" | grep -v ':[[:space:]]*#' | head -1 | cut -d: -f1)
+LOOP_LN=$(grep -n 'while read -r local_ref' "$HOOK" | grep -v ':[[:space:]]*#' | head -1 | cut -d: -f1)
+if [ -n "$SC_LN" ] && [ -n "$LOOP_LN" ] && [ "$LOOP_LN" -lt "$SC_LN" ]; then
+  _ok "T4 ref classification (:$LOOP_LN) precedes the close-check helper (:$SC_LN)"
+else
+  _no "T4 PRIORITY INVERSION — helper(:${SC_LN:-?}) runs at/before ref classification(:${LOOP_LN:-?}); a stdin-reading helper can disarm the Destructive-Op gate"
+fi
+
+# T5 — END-TO-END (the anchor a cross-family audit required): a helper that ACTUALLY reads stdin,
+# plus a synthetic DESTRUCTIVE ref, must still BLOCK. This is what T1-T4 cannot prove on their own —
+# they test the mechanism and the source layout; this tests the shipped hook's real behavior.
+T5_TMP=$(mktemp -d 2>/dev/null || echo "/tmp/fh_t5_$$") ; mkdir -p "$T5_TMP"
+(
+  cd "$T5_TMP" || exit 1
+  git init -q . 2>/dev/null
+  mkdir -p scripts
+  # a DELIBERATELY hostile helper: it drains stdin, exactly the failure mode under test
+  printf '#!/usr/bin/env bash
+cat >/dev/null 2>&1 || true
+exit 0
+' > scripts/session_close_check.sh
+  chmod +x scripts/session_close_check.sh
+  cp "$HOOK" ./pre-push-under-test
+  # synthetic destructive ref: local sha all-zero => DELETE of refs/heads/victim
+  printf 'refs/heads/victim 0000000000000000000000000000000000000000 refs/heads/victim deadbeefdeadbeefdeadbeefdeadbeefdeadbeef
+'     | bash ./pre-push-under-test origin https://example.invalid/x.git >/dev/null 2>&1
+  echo "$?" > rc.txt
+)
+T5_RC=$(cat "$T5_TMP/rc.txt" 2>/dev/null || echo "")
+rm -rf "$T5_TMP" 2>/dev/null
+if [ "$T5_RC" = "0" ]; then
+  _no "T5 FAIL-OPEN REPRODUCED — a stdin-draining helper let a synthetic branch DELETE through (hook exited 0)"
+elif [ -n "$T5_RC" ]; then
+  _ok "T5 stdin-draining helper did NOT disarm the gate (synthetic delete still blocked, exit $T5_RC)"
+else
+  _no "T5 could not run end-to-end (no exit code captured) — treat as unverified, not as pass"
+fi
+
+# ── PR-only policy guard (2026-07-20 operator decision) ──────────────────────────
+# KNOWN-PAIR calibration per CLAUDE.md §Instrument Calibration: a known-POSITIVE that must block
+# and a known-NEGATIVE that must NOT. A guard that fires on everything is as broken as one that
+# never fires — over-blocking trains MAIN_PUSH_OK=1 into muscle memory, which disarms it.
+_pp_run() { # _pp_run <refline> [env...]  -> echoes exit code
+  local refline="$1"; shift
+  local d; d=$(mktemp -d 2>/dev/null || echo "/tmp/fh_pp_$$"); mkdir -p "$d/scripts"
+  ( cd "$d" && git init -q . 2>/dev/null
+    printf '#!/usr/bin/env bash\nexit 0\n' > scripts/session_close_check.sh
+    chmod +x scripts/session_close_check.sh
+    cp "$HOOK" ./h
+    printf '%s\n' "$refline" | env "$@" bash ./h origin https://example.invalid/x.git >/dev/null 2>&1
+    echo "$?" > rc )
+  cat "$d/rc" 2>/dev/null; rm -rf "$d"
+}
+_SHA_A=1111111111111111111111111111111111111111
+_ZERO=0000000000000000000000000000000000000000
+# remote_sha = ZERO (new ref) ISOLATES the PR-only guard from the destructive classifier.
+# First draft used two synthetic non-zero SHAs; the hook could not resolve remote_sha, marked the
+# ref UNCLASSIFIED and fail-closed — so T7/T8 "failed" on the classifier, not on the guard under
+# test. The instrument was measuring itself. (Calibration caught it: the known-NEGATIVE is what
+# exposed it — CLAUDE.md §Instrument Calibration.)
+
+# T6 known-POSITIVE: a non-delete push aimed at main MUST block
+rc=$(_pp_run "refs/heads/main $_SHA_A refs/heads/main $_ZERO")
+[ "$rc" = "1" ] && _ok "T6 direct push to main BLOCKED (known-positive)" \
+                || _no "T6 direct push to main was NOT blocked (rc=$rc) — PR-only policy is fail-open"
+
+# T7 known-NEGATIVE: a feature branch must pass untouched (no over-blocking)
+rc=$(_pp_run "refs/heads/feat/x $_SHA_A refs/heads/feat/x $_ZERO")
+[ "$rc" = "0" ] && _ok "T7 feature-branch push allowed (known-negative, no over-block)" \
+                || _no "T7 feature-branch push was blocked (rc=$rc) — guard over-fires; that trains the override"
+
+# T8 the override is honored and stays explicit
+rc=$(_pp_run "refs/heads/main $_SHA_A refs/heads/main $_ZERO" MAIN_PUSH_OK=1)
+[ "$rc" = "0" ] && _ok "T8 MAIN_PUSH_OK=1 override honored" \
+                || _no "T8 override did not work (rc=$rc) — an unusable escape hatch gets --no-verify instead"
+
+echo "── prepush stdin integrity: $([ "$FAILED" -eq 0 ] && echo PASS || echo FAIL) ──"
+exit "$FAILED"