rung-cli 0.1.2__py3-none-any.whl

rung/checks/prove.py

@@ -0,0 +1,125 @@
+"""`rung prove`: show that a new test actually catches the bug it claims to.
+
+A regression test that passes before the fix proves nothing; agents write such
+tests all the time. The proof is mechanical: take the test files changed on this
+branch, put them on top of the merge base (the code *without* the fix), and run
+the test command there. It must fail. Then run it on the branch. It must pass.
+Both runs are recorded in the ledger.
+
+When the base fails for the wrong reason, typically an import error because the
+fix added a new function, `--expect` names text the base failure must contain,
+such as the assertion or the test name.
+"""
+
+from __future__ import annotations
+
+import re
+import shlex
+import shutil
+from dataclasses import dataclass, field
+from pathlib import Path
+
+from rung.core import git, ledger
+from rung.core.errors import RungError
+from rung.core.proc import run as run_process
+from rung.core.redact import redact_lines
+
+TEST_PATTERNS = [
+    "**/test_*.py", "**/*_test.py", "**/tests/**", "**/__tests__/**", "**/*.test.*",
+    "**/*.spec.*", "**/*_test.go", "**/spec/**", "**/*Test.java", "**/*Tests.cs",
+]  # fmt: skip
+
+
+@dataclass
+class Run:
+    returncode: int
+    tail: list[str]
+
+
+@dataclass
+class Proof:
+    verdict: str  # pass | fail | error
+    summary: str
+    tests: list[str] = field(default_factory=list)
+    base: Run | None = None
+    head: Run | None = None
+
+
+def is_test_file(path: str) -> bool:
+    return any(git.glob_match(p, path) for p in TEST_PATTERNS)
+
+
+def _run(command: str, cwd: Path, timeout: int) -> Run:
+    result = run_process(shlex.split(command), cwd=cwd, timeout=timeout)
+    return Run(result.returncode, (result.stdout + result.stderr).strip().splitlines()[-25:])
+
+
+# Output that means the tests never reached an assertion on the base: they could not even load.
+SETUP_FAILURE = re.compile(
+    r"ModuleNotFoundError|ImportError|SyntaxError|NameError: name .* is not defined|error collecting|"
+    r"ERROR collecting|errors? during collection|no tests ran|collected 0 items|Cannot find module|"
+    r"is not exported|has no exported member|TS2307|TS2305|undefined: |cannot find package",
+)
+
+
+def prove(
+    root: Path, command: str, base_ref: str, *, tests: list[str] | None = None,
+    expect: str | None = None, timeout: int = 1800, cwd: str = ".",
+) -> Proof:  # fmt: skip
+    mb = git.merge_base(root, base_ref)
+    changed = git.changed_files(root, base_ref)
+    chosen = sorted(tests) if tests else sorted(f for f in changed if is_test_file(f))
+    if not chosen:
+        return Proof("error", "no changed test files on this branch; name them with --tests")
+    missing = [t for t in chosen if not (root / t).is_file()]
+    if missing:
+        raise RungError(f"test file(s) not found: {', '.join(missing)}")
+    sources = sorted(f for f in changed if not is_test_file(f) and (root / f).is_file())
+    before = ledger.snapshot(root, sources + chosen)
+
+    with git.worktree(root, mb) as tree:
+        for rel in chosen:
+            dest = tree / rel
+            dest.parent.mkdir(parents=True, exist_ok=True)
+            shutil.copy2(root / rel, dest)
+        base_run = _run(command, tree / cwd, timeout)
+    head_run = _run(command, root / cwd, timeout)
+
+    proof = Proof("pass", "", chosen, base_run, head_run)
+    base_text = "\n".join(base_run.tail)
+    if base_run.returncode == 0:
+        proof.verdict, proof.summary = "fail", "the tests pass without the fix, so they do not catch the bug"
+    elif expect and expect not in base_text:
+        proof.verdict = "fail"
+        proof.summary = f"the base run failed, but not with {expect!r}; it may be failing for another reason"
+    elif not expect and SETUP_FAILURE.search(base_text):
+        proof.verdict = "fail"
+        proof.summary = (
+            "on the merge base the tests failed while loading (an import or collection error), not on an "
+            "assertion. If that failure is the bug, re-run with --expect '<text of the failing assertion>'"
+        )
+    elif head_run.returncode != 0:
+        proof.verdict, proof.summary = "fail", "the tests fail on this branch too"
+    else:
+        proof.summary = f"fails on merge base {mb[:10]}, passes on this branch"
+    if ledger.snapshot(root, sources + chosen) != before:
+        proof.verdict, proof.summary = "error", "files changed while the proof ran; re-run it"
+
+    slug = re.sub(r"[^a-z0-9]+", "-", command.lower()).strip("-")[:40] or "tests"
+    ledger.record(
+        root,
+        check_id=f"proof:{slug}",
+        kind="proof",
+        verdict=proof.verdict,
+        covers=before,
+        specs={},
+        summary=proof.summary,
+        context=mb,
+        details={
+            "command": command, "cwd": cwd, "base": mb, "tests": chosen, "expect": expect or "",
+            "files": sorted(before),
+            "base_returncode": base_run.returncode, "head_returncode": head_run.returncode,
+            "base_tail": redact_lines(base_run.tail), "head_tail": redact_lines(head_run.tail),
+        },
+    )  # fmt: skip
+    return proof

rung/checks/registry.py

@@ -0,0 +1,35 @@
+"""Check kinds. Each is a `Checker`; `get(kind)` returns the one for a declared check."""
+
+from __future__ import annotations
+
+from rung.checks.base import Checker, Context, Outcome
+from rung.checks.command import CommandChecker, EvidenceChecker
+from rung.checks.deps import DepsChecker
+from rung.checks.formal import DRTChecker, LeanChecker, TLAChecker
+from rung.checks.scan import ScanChecker
+from rung.checks.shortcuts import ShortcutsChecker
+from rung.core.config import ConfigError
+
+REGISTRY: dict[str, Checker] = {
+    c.kind: c
+    for c in (
+        CommandChecker(),
+        EvidenceChecker(),
+        ScanChecker(),
+        ShortcutsChecker(),
+        DepsChecker(),
+        TLAChecker(),
+        LeanChecker(),
+        DRTChecker(),
+    )
+}
+
+
+def get(kind: str) -> Checker:
+    try:
+        return REGISTRY[kind]
+    except KeyError:
+        raise ConfigError(f"unknown check kind {kind!r}; choose from {', '.join(REGISTRY)}") from None
+
+
+__all__ = ["REGISTRY", "Checker", "Context", "Outcome", "get"]

rung/checks/runner.py

@@ -0,0 +1,161 @@
+"""Select checks, run them through their checkers, and record verdicts in the ledger."""
+
+from __future__ import annotations
+
+import shutil
+import subprocess
+from dataclasses import dataclass
+from pathlib import Path
+
+from rung.checks import registry
+from rung.checks.base import Context, Outcome
+from rung.checks.command import evidence_dir, is_attested, missing_required
+from rung.core import git, ledger
+from rung.core.config import Check, Config, ConfigError
+from rung.core.errors import RungError
+from rung.core.redact import redact, redact_lines
+
+MAX_RECORDED_FINDINGS = 200
+
+
+@dataclass
+class Result:
+    check: Check
+    outcome: Outcome
+
+    @property
+    def verdict(self) -> str:
+        return self.outcome.verdict
+
+
+def covers(check: Check) -> list[str]:
+    return registry.get(check.kind).covers(check)
+
+
+def specs(check: Check) -> list[str]:
+    return registry.get(check.kind).specs(check)
+
+
+def definition(check: Check) -> str:
+    return ledger.definition_hash(check.kind, check.covers, check.options)
+
+
+def touched_by(check: Check, changed: set[str]) -> bool:
+    """Does a change to `changed` files affect this check? Checks covering nothing always run."""
+    patterns = covers(check) + specs(check)
+    if not patterns:
+        return True
+    return any(git.glob_match(p, f) for p in patterns for f in changed)
+
+
+def select(config: Config, ids: list[str], changed: set[str] | None) -> list[Check]:
+    """Checks to run: all (or the named ones), narrowed to those a change touches.
+
+    A check that is not currently fresh is always selected, so editing a check's own declaration,
+    a baseline or a waiver, or breaking the ledger, can never be skipped by `--changed`.
+    """
+    chosen = [config.check(i) for i in ids] if ids else list(config.checks)
+    if changed is None:
+        return chosen
+    view = ledger.View(config.root)
+    return [c for c in chosen if touched_by(c, changed) or not status(config, c, view=view).trusted]
+
+
+def run_check(config: Config, check: Check, *, base: str | None = None) -> Result:
+    root = config.root
+    if is_attested(check) and (held := status(config, check)).trusted and held.entry:
+        # Attested evidence cannot be re-run; while its files are unchanged, the attestation stands.
+        return Result(check, Outcome("pass", held.entry.get("summary", "attested"), held.entry.get("evidence", [])))
+    checker = registry.get(check.kind)
+    cover_patterns, spec_patterns = checker.covers(check), checker.specs(check)
+    before = (ledger.snapshot(root, cover_patterns), ledger.snapshot(root, spec_patterns))
+    try:
+        outcome = checker.run(Context(root=root, base=base), check)
+    except (RungError, FileNotFoundError, subprocess.TimeoutExpired) as exc:
+        outcome = Outcome("error", str(exc))
+    # Hash before and after: a file edited mid-run must not be recorded as verified.
+    after = (ledger.snapshot(root, cover_patterns), ledger.snapshot(root, spec_patterns))
+    if after != before:
+        moved = sorted(p for b, a in zip(before, after, strict=True) for p in set(b) | set(a) if b.get(p) != a.get(p))
+        hint = (
+            "files it covers changed while it ran: " + ", ".join(moved[:5]) + (" ..." if len(moved) > 5 else "")
+            + ". If the check writes them itself (coverage, reports), add them to .gitignore or narrow `covers`."
+        )  # fmt: skip
+        outcome = Outcome("error", hint, outcome.lines)
+    ledger.record(
+        root,
+        check_id=check.id,
+        kind=check.kind,
+        verdict=outcome.verdict,
+        covers=before[0],
+        specs=before[1],
+        summary=redact(outcome.summary),
+        evidence=[f"{path} sha256:{digest}" for path, digest in outcome.evidence.items()],
+        definition=definition(check),
+        context=base or "",
+        valid_until=outcome.valid_until,
+        details={
+            "lines": redact_lines(outcome.lines[:60]),
+            "base": base or "",
+            "findings": outcome.findings[:MAX_RECORDED_FINDINGS],
+        },
+    )
+    return Result(check, outcome)
+
+
+def status(config: Config, check: Check, *, base: str | None = None, view: ledger.View | None = None) -> ledger.Status:
+    """Whether `check`'s latest verdict still holds. With `base`, it must have been made against that base."""
+    view = view or ledger.View(config.root)
+    max_age = registry.get(check.kind).max_age_days(check)
+    return view.status(check.id, covers(check), specs(check), definition(check), base, max_age)
+
+
+def statuses(config: Config, *, base: str | None = None) -> list[ledger.Status]:
+    view = ledger.View(config.root)
+    return [status(config, c, base=base, view=view) for c in config.checks]
+
+
+def attest(config: Config, check: Check, files: list[Path], *, by: str, note: str = "") -> Result:
+    """Record evidence an agent or a person captured (a browser recording, screenshots) for an attested check.
+
+    The files are copied into `.rung/evidence/` and hashed into the verdict, which binds them to the
+    code as it is now. Nothing is re-run: the verdict says who recorded what, not that Rung saw it work.
+    """
+    if not is_attested(check):
+        raise ConfigError(
+            f'check {check.id!r} is not an attested evidence check (kind = "evidence" without `run`); '
+            "scripted checks record their own evidence with `rung check`"
+        )
+    if not by.strip():
+        raise ConfigError("say which tool or person recorded the evidence with --by")
+    empty = [str(f) for f in files if not f.is_file() or f.stat().st_size == 0]
+    if empty:
+        raise ConfigError(f"not a non-empty file: {', '.join(empty)}")
+    if missing := missing_required(check, (f.name for f in files)):
+        raise ConfigError(f"check {check.id!r} requires evidence ending in {', '.join(missing)}")
+    root = config.root
+    cover_patterns, spec_patterns = covers(check), specs(check)
+    before = (ledger.snapshot(root, cover_patterns), ledger.snapshot(root, spec_patterns))
+    out_dir = evidence_dir(root, check.id)
+    artifacts: dict[str, str] = {}
+    for i, f in enumerate(files):
+        target = out_dir / f"{i + 1:02d}-{f.name}"
+        shutil.copyfile(f, target)
+        artifacts[target.relative_to(root).as_posix()] = ledger.file_digest(target)
+    if (ledger.snapshot(root, cover_patterns), ledger.snapshot(root, spec_patterns)) != before:
+        raise RungError("files the check covers changed while the evidence was being recorded; attest again")
+    summary = redact(f"attested by {by.strip()}: {len(artifacts)} artifact(s), not re-run by Rung")
+    lines = [f"evidence: {path}" for path in artifacts] + ([redact(f"note: {note}")] if note else [])
+    ledger.record(
+        root,
+        check_id=check.id,
+        kind=check.kind,
+        verdict="pass",
+        covers=before[0],
+        specs=before[1],
+        summary=summary,
+        evidence=[f"{path} sha256:{digest}" for path, digest in artifacts.items()],
+        definition=definition(check),
+        details={"lines": lines, "attested_by": by.strip(), "note": redact(note)},
+    )
+    return Result(check, Outcome("pass", summary, lines, artifacts))

rung/checks/scan.py

@@ -0,0 +1,152 @@
+"""Scan checker: run any SARIF-emitting analyzer and gate on what a change introduces."""
+
+from __future__ import annotations
+
+import json
+import shlex
+import shutil
+import tempfile
+from datetime import date
+from pathlib import Path
+
+from rung.checks import findings
+from rung.checks.base import Checker, Context, Outcome
+from rung.checks.presets import PRESETS, Preset
+from rung.core import git
+from rung.core.config import Check, ConfigError
+from rung.core.errors import RungError, ToolMissing
+from rung.core.proc import run as run_process
+from rung.engines import sarif
+
+MAX_LISTED = 10
+
+
+def project_findings(root: Path, found: list[sarif.Finding]) -> list[sarif.Finding]:
+    """Drop findings in Rung's own state and in files git ignores (caches, build output)."""
+    found = [f for f in found if not f.path.startswith(".rung/")]
+    if not found or not git.is_repo(root):
+        return found
+    files = set(git.list_files(root))
+    return [
+        f for f in found
+        if not f.path.startswith(".rung/") and (not f.path or f.path in files or not (root / f.path).is_file())
+    ]  # fmt: skip
+
+
+class ScanChecker(Checker):
+    kind = "scan"
+    summary = "Run a SARIF analyzer (secrets, dependencies, code patterns) and gate on new findings"
+
+    def _preset(self, check: Check) -> Preset | None:
+        name = check.get("tool")
+        if name is None:
+            return None
+        if name not in PRESETS:
+            raise ConfigError(f"check {check.id!r}: unknown scanner {name!r}; choose from {', '.join(PRESETS)}")
+        return PRESETS[name]
+
+    def _command(self, check: Check) -> str:
+        if run := check.get("run"):
+            return str(run)
+        preset = self._preset(check)
+        if preset is None:
+            raise ConfigError(f"check {check.id!r} (scan) needs `tool` (a preset) or `run`")
+        return preset.run
+
+    def fail_on(self, check: Check) -> str:
+        preset = self._preset(check)
+        level = str(check.get("fail_on", preset.fail_on if preset else "warning"))
+        if level not in sarif.LEVELS:
+            raise ConfigError(f"check {check.id!r}: fail_on must be one of {', '.join(sarif.LEVELS)}")
+        return level
+
+    def specs(self, check: Check) -> list[str]:
+        """The policy a verdict depends on: this check's baseline and the waivers file."""
+        return [*check.get_list("specs"), findings.baseline_path_rel(check.id), findings.WAIVERS_FILE.as_posix()]
+
+    def max_age_days(self, check: Check) -> int | None:
+        if "max_age_days" in check.options:
+            return check.get_int("max_age_days", 0) or None
+        preset = self._preset(check)
+        return preset.max_age_days if preset else None
+
+    def default_covers(self, check: Check) -> list[str]:
+        preset = self._preset(check)
+        return list(preset.covers) if preset else ["**/*"]
+
+    def collect(self, cwd: Path, check: Check, timeout: int) -> list[sarif.Finding]:
+        """Run the analyzer in `cwd` and parse its SARIF."""
+        command = self._command(check)
+        executable = shlex.split(command)[0]
+        if not shutil.which(executable):
+            preset = self._preset(check)
+            hint = f" Install: {preset.install}" if preset else ""
+            raise ToolMissing(f"`{executable}` is not installed.{hint}")
+        with tempfile.TemporaryDirectory(prefix="rung-scan-") as tmp:
+            out = Path(tmp) / "result.sarif"
+            argv = [part.replace("{out}", str(out)) for part in shlex.split(command)]
+            result = run_process(argv, cwd=cwd / str(check.get("cwd", ".")), timeout=timeout)
+            raw = out.read_text() if "{out}" in command and out.exists() else result.stdout
+        detail = (result.stderr or result.stdout).strip()[-800:]
+        preset = self._preset(check)
+        default = str(check.get("default_level", preset.default_level if preset else "warning"))
+        try:
+            found = sarif.parse(raw, cwd, default_level=default)
+        except (json.JSONDecodeError, sarif.SarifError, AttributeError, TypeError, KeyError) as exc:
+            raise RungError(
+                f"`{command}` exited {result.returncode} without a valid SARIF result ({exc}): {detail}"
+            ) from exc
+        # Scanners exit non-zero when they find something. Non-zero with nothing found means it failed.
+        if result.returncode != 0 and not found:
+            raise RungError(
+                f"`{command}` exited {result.returncode} and reported no findings; it likely failed: {detail}"
+            )
+        return project_findings(cwd, found)
+
+    def run(self, ctx: Context, check: Check) -> Outcome:
+        timeout = check.get_int("timeout", 900)
+        head = self.collect(ctx.root, check, timeout)
+
+        if ctx.base:
+            with git.worktree(ctx.root, ctx.base) as tree:
+                base = self.collect(tree, check, timeout)
+            compared = f"merge base {ctx.base[:10]}"
+        else:
+            base = findings.load_baseline(ctx.root, check.id)
+            compared = "the recorded baseline" if base is not None else ""
+
+        t = findings.triage(
+            check.id,
+            head,
+            base,
+            findings.load_waivers(ctx.root),
+            fail_on=self.fail_on(check),
+            today=date.today(),
+            compared_with=compared,
+        )
+        lines = [
+            f"{len(head)} finding(s); compared with {t.compared_with}: "
+            f"{len(t.blocking)} new blocking, {len(t.nonblocking)} new below `{self.fail_on(check)}`, "
+            f"{len(t.waived)} waived, {len(t.resolved)} resolved"
+        ]
+        for f in t.blocking[:MAX_LISTED]:
+            lines.append(f"NEW {f.level:7} {f.rule}  {f.where}  [{f.fingerprint}]")
+            if f.message:
+                lines.append(f"    {f.message[:160]}")
+        if len(t.blocking) > MAX_LISTED:
+            lines.append(f"... and {len(t.blocking) - MAX_LISTED} more (`rung report` or `--json` lists all)")
+        if not compared and t.blocking:
+            lines.append(
+                f"Existing code? `rung baseline {check.id}` accepts today's findings, or "
+                "`rung check --changed` compares with the merge base. Either way only new findings block."
+            )
+        for w in t.expired:
+            lines.append(f"EXPIRED waiver {w.fingerprint} ({w.reason}), expired {w.expires}")
+
+        records = [f.to_dict() | {"status": "new"} for f in t.blocking]
+        records += [f.to_dict() | {"status": "new-below-threshold"} for f in t.nonblocking]
+        records += [f.to_dict() | {"status": "waived"} for f in t.waived]
+        if t.blocking:
+            return Outcome("fail", f"{len(t.blocking)} new finding(s) at or above `{self.fail_on(check)}`",
+                           lines, findings=records)  # fmt: skip
+        return Outcome("pass", "no new blocking findings", lines, findings=records, valid_until=t.valid_until)

rung/checks/shortcuts.py

@@ -0,0 +1,109 @@
+"""Shortcuts checker: block the type-checker silencers, skipped tests and relaxed configs a change adds.
+
+It reuses the scan machinery (fingerprints, baselines, waivers), so it gates the same way: only what
+a change introduces blocks. Without `--base` it compares with the recorded baseline if there is one,
+otherwise with the merge base of the default branch, so existing shortcuts never block day one.
+"""
+
+from __future__ import annotations
+
+from datetime import date
+from pathlib import Path
+
+from rung.checks import findings
+from rung.checks.base import Context, Outcome
+from rung.checks.scan import MAX_LISTED, ScanChecker
+from rung.core import git
+from rung.core.config import Check
+from rung.engines import sarif
+from rung.engines import shortcuts as engine
+
+
+def _working_files(root: Path) -> list[tuple[str, str]]:
+    def read(rel: str) -> str | None:
+        try:
+            return (root / rel).read_text(errors="replace")
+        except OSError:
+            return None
+
+    return engine.read_all((f for f in git.list_files(root) if not git.is_rung_output(f)), read)
+
+
+def _files_at(root: Path, commit: str) -> list[tuple[str, str]]:
+    paths = [p for p in git.files_at(root, commit) if engine.scannable(p)]
+    blobs = git.show_many(root, commit, paths)
+
+    def read(rel: str) -> str | None:
+        try:
+            return blobs[rel].decode() if rel in blobs else None
+        except UnicodeDecodeError:  # not text
+            return None
+
+    return engine.read_all(paths, read)
+
+
+class ShortcutsChecker(ScanChecker):
+    kind = "shortcuts"
+    summary = "Block new type-checker silencers, skipped or deleted tests, and relaxed checker configs"
+
+    def _preset(self, check: Check) -> None:
+        return None
+
+    def max_age_days(self, check: Check) -> int | None:
+        return check.get_int("max_age_days", 0) or None
+
+    def default_covers(self, check: Check) -> list[str]:
+        return ["**/*"]
+
+    def collect(self, cwd: Path, check: Check, timeout: int) -> list[sarif.Finding]:
+        return engine.find(_working_files(cwd), check.get_list("allow"))
+
+    def _commit(self, ctx: Context) -> str:
+        """The commit deleted tests and weakened settings are compared with: the base, else the default branch's."""
+        if ctx.base:
+            return ctx.base
+        try:
+            return git.merge_base(ctx.root, git.default_base(ctx.root))
+        except git.GitError:
+            return ""
+
+    def run(self, ctx: Context, check: Check) -> Outcome:
+        allow = check.get_list("allow")
+        head_files = _working_files(ctx.root)
+        head = engine.find(head_files, allow)
+        commit = self._commit(ctx)
+        base_files = _files_at(ctx.root, commit) if commit else []
+        # Findings are compared with the base, or with an accepted baseline when one is recorded; the
+        # structural comparisons (deleted tests, coverage, strictness) always use the base commit.
+        recorded = None if ctx.base else findings.load_baseline(ctx.root, check.id)
+        if recorded is not None:
+            base, compared = recorded, "the recorded baseline"
+        elif commit:
+            base, compared = engine.find(base_files, allow), f"merge base {commit[:10]}"
+        else:
+            base, compared = None, ""
+        if commit:
+            head += engine.compare(head_files, base_files, allow)
+        t = findings.triage(check.id, head, base, findings.load_waivers(ctx.root),
+                            fail_on=self.fail_on(check), today=date.today(), compared_with=compared)  # fmt: skip
+        lines = [
+            f"{len(head)} shortcut(s) in the code; compared with {t.compared_with}: {len(t.blocking)} new blocking, "
+            f"{len(t.waived)} waived, {len(t.resolved)} removed"
+        ]
+        for f in t.blocking[:MAX_LISTED]:
+            lines.append(f"NEW {f.rule:17} {f.where or '(project)'}  [{f.fingerprint}]")
+            lines.append(f"    {f.message[:160]}")
+        if len(t.blocking) > MAX_LISTED:
+            lines.append(f"... and {len(t.blocking) - MAX_LISTED} more (`rung report` or `--json` lists all)")
+        if t.blocking:
+            lines.append(
+                "Fix the code instead. If one is genuinely needed, a person can accept it: "
+                f"`rung waive {check.id} <fingerprint> --reason ...`."
+            )
+        for w in t.expired:
+            lines.append(f"EXPIRED waiver {w.fingerprint} ({w.reason}), expired {w.expires}")
+        records = [f.to_dict() | {"status": "new"} for f in t.blocking]
+        records += [f.to_dict() | {"status": "waived"} for f in t.waived]
+        if t.blocking:
+            return Outcome("fail", f"{len(t.blocking)} new shortcut(s)", lines, findings=records)
+        return Outcome("pass", "no new shortcuts", lines, findings=records, valid_until=t.valid_until)