subcheck 0.4.1__tar.gz → 0.4.2__tar.gz

{subcheck-0.4.1 → subcheck-0.4.2}/BACKLOG.md

@@ -149,6 +149,19 @@ Open follow-ups from the same pass:
   execute, not the inputs you never thought to send. A gate whose own config can silently weaken it
   is the failure this tool exists to prevent, so policy-shape tests belong next to claim tests.
 
+- `[x]` **Claims-shape validation — DONE 2026-09-01 (v0.4.2), found by asking 0.4.1's question of
+  the other input.** The tool takes two things: a policy and a set of claims. v0.4.1 hardened the
+  policy and never asked the same question of the claims, and that gap *was* the bug — `--claims`
+  went straight to `json.loads` while `decode_claims` had always required a JSON object, so the two
+  claim-input paths disagreed about what claims are. A list-shaped claims file made `validate()`
+  return **all PASS** (`rule.name not in claims` is legal on any container, so every rule read as
+  absent, which is PASS when optional); the only thing preventing a green gate was an unrelated
+  crash a few lines later in `build_report`. `--claims <non-object> --format json` exited **0** and
+  echoed the garbage back. Everything else exited **1** on a traceback — bad input wearing the
+  gate-failure exit code, the same confusion 0.4.1 fixed one input over.
+  **The generalisable move:** when a fix hardens one input, check the others *for the same defect*
+  before closing it out. Symmetry between inputs is cheap to check and, here, was the whole finding.
+
 - `[ ]` `--fail-on <severity>` threshold gating — today any single required-but-missing medium claim
   fails the whole gate (`report.py` `passed = all(PASS)`); no way to gate on high only.
 - `[x]` `exp`/`iat`/`nbf` time checks — **DONE 2026-08-25 (v0.4.0)**, as advisory NOTES, never
@@ -172,10 +185,15 @@ Open follow-ups from the same pass:
   subject parses, not whether it parses *correctly*.
 - `[ ]` Decide `equals`/`in` type handling: coerce, or keep type-strict + documented (currently the
   latter).
-- `[~]` Close test-coverage holes (**95% now, up from 92%**; `validator.py` reached 100%). Closed
-  2026-08-31 (v0.4.1): the `glob` branch, the `equals` FAIL path, and the `rc=2` bad-policy paths
-  — see `tests/test_policy_shape.py`. Still open: `--token-file`, `--token -` stdin,
-  `load_policy_file` suffix logic, `to_json`/summary counts, and `__main__.py`.
+- `[x]` Close test-coverage holes — **DONE 2026-08-31: 92% -> 100%, every module.** The v0.4.1 pass
+  took the `glob` branch, the `equals` FAIL path and the `rc=2` bad-policy paths
+  (`tests/test_policy_shape.py`); the follow-up took the rest (`tests/test_cli_inputs.py`):
+  `--token-file`, `--token -` stdin, both `python -m` entry points, the unknown-policy-suffix
+  branch, the JSON summary counts, malformed-JWT rejection, and the customized-sub and
+  days-duration report branches. **Worth noting which ones mattered**: `--token-file` and
+  `--token -` are how `action.yml` feeds the tool, so the shipped Action's only invocation path had
+  been running on untested code. 100% is not the point and is not a target to defend — it just
+  happens to be where the risk-driven list ran out.
 - `[x]` Cosmetic: rephrase the `# nosec B105` comments — **DONE 2026-08-31**. The prose moved to
   its own line above; `# nosec B105` is now bare, so bandit stops parsing "a status constant, not
   a secret" as a list of test IDs and runs silent.

{subcheck-0.4.1 → subcheck-0.4.2}/CHANGELOG.md

@@ -4,6 +4,48 @@ All notable changes are documented here. Format based on
 [Keep a Changelog](https://keepachangelog.com/); this project follows
 [Semantic Versioning](https://semver.org/).
 
+## [Unreleased]
+
+## [0.4.2] - 2026-09-01
+
+### Fixed
+- **A claims file that is not a JSON object was half-processed instead of rejected.**
+  `decode_claims` has always required the JWT payload to decode to an object; `--claims` went
+  straight to `json.loads` with no such check, so the tool's two claim-input paths disagreed about
+  what "claims" means. Three consequences, all reproduced through the shipped CLI on 0.4.1:
+  - **`validate()` returned *all PASS* for list-shaped claims.** `rule.name not in claims` is legal
+    on any container, so every rule read as absent - MISSING for a required rule, but **PASS** for
+    an optional one. An all-optional policy therefore reported a clean pass over claims holding
+    nothing at all. Nothing downstream caught that on purpose: the report merely happened to crash
+    a few lines later on `claims.get()`, and that accident was the only thing standing between
+    `--claims '[]'` and a green gate. `validate()` and `build_report()` now reject the shape, so
+    the guard does not depend on a crash that a refactor could remove.
+  - **`--claims <non-object> --format json` exited 0**, echoing the input back as though it were a
+    decoded token. That branch consults no policy and calls no `.items()`, so it had no crash to
+    hide behind - a silent success on input that was never claims.
+  - **Every other combination exited 1** - the "a claim did not match" code - with a raw
+    `AttributeError` traceback. That is the same bad-input-indistinguishable-from-a-finding
+    confusion 0.4.1 fixed on the policy side; it now lands on the documented rc=2 path.
+
+  An empty object `{}` is still accepted, and a required rule still reports MISSING against it: the
+  guard rejects the wrong *shape*, not an empty token.
+
+### Added
+- `tests/test_claims_shape.py` - 28 regression tests, 27 of which fail against 0.4.1. One of them
+  is a parity test asserting that `--token-file` and `--claims` now return the same verdict and the
+  same exit code for the same non-object payload, since that asymmetry is what caused this.
+- Tests for the claim-input paths that had none: `--token-file`, `--token -` (stdin), and both
+  `python -m` entry points - the three the shipped `action.yml` actually uses, so the Action's only
+  invocation path had been running on untested code. Plus malformed-JWT rejection, the
+  unknown-policy-suffix branch, the JSON summary counts, the structurally-invalid-policy rejections
+  through the CLI, and the customized-sub and days-duration report branches.
+  Coverage 95% -> **100%**, every module (still 100% after this release's guards).
+
+### Changed
+- README documents the exit codes explicitly (`0` / `1` / `2`) instead of "non-zero on any
+  finding". Both 0.4.1 and 0.4.2 turn on the 1-vs-2 distinction, and someone wiring this into a CI
+  gate has to know which code means "fix your config" and which means "the gate caught something".
+
 ## [0.4.1] - 2026-08-31
 
 ### Fixed

{subcheck-0.4.1 → subcheck-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: subcheck
-Version: 0.4.1
+Version: 0.4.2
 Summary: Decode GitHub Actions OIDC token claims and validate them against an expected-claims policy - a CI gate against over-broad cloud trust.
 Project-URL: Homepage, https://github.com/Dashtid/subcheck
 Project-URL: Related, https://github.com/Dashtid/subvectors
@@ -62,7 +62,16 @@ Notes:
 ```
 
 Notes are advisory and never change the verdict. Exit code is non-zero on any finding, so the
-command drops straight into a CI step as a gate.
+command drops straight into a CI step as a gate:
+
+| code | meaning |
+|------|---------|
+| `0`  | every rule passed |
+| `1`  | at least one claim FAILed or was required-but-MISSING - the gate caught something |
+| `2`  | bad input: the token, the claims file or the policy could not be read as what it claims to be |
+
+The `1` / `2` split matters in CI. A malformed policy or a claims file that is not a JSON object
+exits `2`, so it reads as "fix your config", never as "the gate caught something".
 
 ## Why
 

{subcheck-0.4.1 → subcheck-0.4.2}/README.md

@@ -30,7 +30,16 @@ Notes:
 ```
 
 Notes are advisory and never change the verdict. Exit code is non-zero on any finding, so the
-command drops straight into a CI step as a gate.
+command drops straight into a CI step as a gate:
+
+| code | meaning |
+|------|---------|
+| `0`  | every rule passed |
+| `1`  | at least one claim FAILed or was required-but-MISSING - the gate caught something |
+| `2`  | bad input: the token, the claims file or the policy could not be read as what it claims to be |
+
+The `1` / `2` split matters in CI. A malformed policy or a claims file that is not a JSON object
+exits `2`, so it reads as "fix your config", never as "the gate caught something".
 
 ## Why
 

{subcheck-0.4.1 → subcheck-0.4.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "subcheck"
-version = "0.4.1"
+version = "0.4.2"
 description = "Decode GitHub Actions OIDC token claims and validate them against an expected-claims policy - a CI gate against over-broad cloud trust."
 readme = "README.md"
 requires-python = ">=3.10"

{subcheck-0.4.1 → subcheck-0.4.2}/src/subcheck/__init__.py

@@ -5,7 +5,7 @@ from .policy import ClaimRule, Policy, load_policy, load_policy_file
 from .report import build_report, to_json, to_text
 from .validator import Result, validate
 
-__version__ = "0.4.1"
+__version__ = "0.4.2"
 
 __all__ = [
     "decode_claims",

{subcheck-0.4.1 → subcheck-0.4.2}/src/subcheck/cli.py

@@ -22,7 +22,17 @@ def _load_claims(args: argparse.Namespace) -> dict:
     if args.token_file:
         return decode_claims(Path(args.token_file).read_text(encoding="utf-8"))
     if args.claims:
-        return json.loads(Path(args.claims).read_text(encoding="utf-8"))
+        claims = json.loads(Path(args.claims).read_text(encoding="utf-8"))
+        # decode_claims already rejects a payload that is not a JSON object, but
+        # --claims went straight to json.loads, so a file holding a list or a bare
+        # scalar reached the report unchecked. See validate() for why that shape
+        # is not merely untidy.
+        if not isinstance(claims, dict):
+            raise ValueError(
+                f"--claims file {args.claims} did not decode to a JSON object "
+                f"(got {type(claims).__name__})"
+            )
+        return claims
     raise ValueError("provide one of --token, --token-file, or --claims")
 
 

{subcheck-0.4.1 → subcheck-0.4.2}/src/subcheck/report.py

@@ -13,6 +13,9 @@ from .validator import FAIL, MISSING, PASS, Result
 
 def build_report(claims: dict, results: list[Result], now: float | None = None) -> dict:
     """Assemble the report. ``now`` (unix seconds) is injectable for tests."""
+    # Same guard as validate(): both are public API and both read claims as a mapping.
+    if not isinstance(claims, dict):
+        raise ValueError(f"claims must be a mapping/object, got {type(claims).__name__}")
     passed = all(r.status == PASS for r in results)
     return {
         "passed": passed,

{subcheck-0.4.1 → subcheck-0.4.2}/src/subcheck/validator.py

@@ -39,6 +39,13 @@ def _matches(rule: ClaimRule, value) -> bool:
 
 def validate(claims: dict, policy: Policy) -> list[Result]:
     """Check each policy rule against the claims and return one Result per rule."""
+    # `rule.name not in claims` is legal on any container, so a list or tuple read
+    # as "every claim absent" - MISSING for a required rule, but PASS for an
+    # optional one, so an all-optional policy passed claims that held nothing at
+    # all. The only thing that stopped a green report was an unrelated crash further
+    # down, on claims.get(). Reject the shape here rather than lean on that accident.
+    if not isinstance(claims, dict):
+        raise ValueError(f"claims must be a mapping/object, got {type(claims).__name__}")
     results: list[Result] = []
     for rule in policy.rules:
         expected = rule.describe()

subcheck-0.4.2/tests/test_claims_shape.py

@@ -0,0 +1,100 @@
+"""A claims file that is not a JSON object must be rejected, not half-processed.
+
+`decode_claims` has always rejected a JWT payload that is not an object. `--claims`
+went straight to `json.loads` with no such check, so the two claim-input paths
+disagreed about what "claims" means. Three things followed from that asymmetry,
+all reproduced on 0.4.1 and all pinned below:
+
+* `validate()` returned **all PASS** for list-shaped claims - `rule.name not in
+  claims` is legal on any container, so every rule read as absent, which is PASS
+  for an optional rule. Only an unrelated crash further down stopped a green report.
+* `--claims <non-object> --format json` with no policy printed the garbage and
+  **exited 0**.
+* Every other combination raised an AttributeError traceback and exited **1** - the
+  "a claim did not match" code, so bad input was indistinguishable from a real
+  gate failure.
+"""
+
+import json
+
+import pytest
+
+from subcheck import build_report, load_policy, validate
+from subcheck.cli import main
+from subcheck.validator import MISSING, PASS
+
+NOT_OBJECTS = [[], [1, 2, 3], "hello", 42, None, True]
+
+OPTIONAL_POLICY = {
+    "claims": {
+        "repository": {"equals": "acme/api", "required": False},
+        "sub": {"matches": "^repo:acme/api:", "required": False},
+    }
+}
+
+
+# --- the library API ---------------------------------------------------------
+
+@pytest.mark.parametrize("claims", NOT_OBJECTS + [()])
+def test_validate_rejects_claims_that_are_not_a_mapping(claims):
+    # Was: [] and (1,2,3) returned one PASS per rule, so an all-optional policy
+    # reported a clean pass over claims holding nothing at all.
+    with pytest.raises(ValueError, match="mapping/object"):
+        validate(claims, load_policy(OPTIONAL_POLICY))
+
+
+@pytest.mark.parametrize("claims", NOT_OBJECTS)
+def test_build_report_rejects_claims_that_are_not_a_mapping(claims):
+    with pytest.raises(ValueError, match="mapping/object"):
+        build_report(claims, [])
+
+
+def test_an_empty_claims_object_is_still_accepted():
+    # The guard must reject the wrong SHAPE, not an empty token: {} is a legitimate
+    # (if useless) claim set, and a required rule should report MISSING as before.
+    policy = load_policy({"claims": {"repository": {"equals": "acme/api"}}})
+    assert [r.status for r in validate({}, policy)] == [MISSING]
+    assert [r.status for r in validate({}, load_policy(OPTIONAL_POLICY))] == [PASS, PASS]
+
+
+# --- through the CLI ---------------------------------------------------------
+
+def _claims_file(tmp_path, value):
+    f = tmp_path / "claims.json"
+    f.write_text(json.dumps(value), encoding="utf-8")
+    return str(f)
+
+
+@pytest.mark.parametrize("claims", NOT_OBJECTS)
+def test_cli_rejects_a_non_object_claims_file_on_rc2(tmp_path, capsys, claims):
+    # Was: rc=1 with an AttributeError traceback - the gate-failure exit code.
+    assert main(["--claims", _claims_file(tmp_path, claims)]) == 2
+    assert "did not decode to a JSON object" in capsys.readouterr().err
+
+
+@pytest.mark.parametrize("claims", NOT_OBJECTS)
+def test_cli_json_format_no_longer_exits_zero_on_a_non_object(tmp_path, capsys, claims):
+    # Was: rc=0, echoing the garbage back as if it were a decoded token. This is
+    # the worst of the three - a silent success on input that is not claims.
+    assert main(["--claims", _claims_file(tmp_path, claims), "--format", "json"]) == 2
+    assert "did not decode to a JSON object" in capsys.readouterr().err
+
+
+def test_cli_rejects_a_non_object_claims_file_with_a_policy(tmp_path, capsys):
+    policy = tmp_path / "policy.json"
+    policy.write_text(json.dumps(OPTIONAL_POLICY), encoding="utf-8")
+    rc = main(["--claims", _claims_file(tmp_path, []), "--policy", str(policy)])
+    assert rc == 2
+    assert "did not decode to a JSON object" in capsys.readouterr().err
+
+
+def test_both_claim_input_paths_agree_on_what_claims_are(tmp_path, capsys, make_jwt):
+    # Parity: the token path has always rejected a non-object payload. The point of
+    # the fix is that --claims now gives the same verdict and the same exit code.
+    token = tmp_path / "token.jwt"
+    token.write_text(make_jwt(["not", "an", "object"]), encoding="utf-8")
+    assert main(["--token-file", str(token)]) == 2
+    assert "did not decode to a JSON object" in capsys.readouterr().err
+
+    assert main(["--claims", _claims_file(tmp_path, ["not", "an", "object"])]) == 2
+    assert "did not decode to a JSON object" in capsys.readouterr().err

subcheck-0.4.2/tests/test_cli_inputs.py

@@ -0,0 +1,113 @@
+"""The claim-input paths and the failure exits, which had no coverage.
+
+`--token-file` and `--token -` are how the shipped GitHub Action feeds subcheck
+(action.yml pipes the token into `--token -`), so the tool's own advertised entry
+point ran on code no test executed.
+"""
+
+import json
+import subprocess
+import sys
+
+import pytest
+
+from subcheck.cli import main
+
+
+def test_token_file(make_jwt, tmp_path, capsys):
+    jwt = make_jwt({"iss": "https://token.actions.githubusercontent.com", "repository": "acme/api"})
+    f = tmp_path / "token.jwt"
+    f.write_text(jwt, encoding="utf-8")
+    assert main(["--token-file", str(f)]) == 0
+    assert "repository: acme/api" in capsys.readouterr().out
+
+
+def test_token_stdin(make_jwt, monkeypatch, capsys):
+    # The action.yml path: `... | python3 -m subcheck --token - ...`
+    jwt = make_jwt({"iss": "https://token.actions.githubusercontent.com", "repository": "acme/api"})
+    monkeypatch.setattr("sys.stdin", __import__("io").StringIO(jwt + "\n"))
+    assert main(["--token", "-"]) == 0
+    assert "repository: acme/api" in capsys.readouterr().out
+
+
+def test_token_stdin_then_policy(make_jwt, monkeypatch, tmp_path, capsys):
+    jwt = make_jwt({"iss": "https://x", "repository": "acme/api"})
+    policy = tmp_path / "p.json"
+    policy.write_text(
+        json.dumps({"claims": {"repository": {"equals": "acme/api"}}}), encoding="utf-8"
+    )
+    monkeypatch.setattr("sys.stdin", __import__("io").StringIO(jwt))
+    assert main(["--token", "-", "--policy", str(policy)]) == 0
+
+
+@pytest.mark.parametrize("token", ["not-a-jwt", "a.b", "a.!!!!.c"])
+def test_malformed_token_exits_2(token, capsys):
+    assert main(["--token", token]) == 2
+    assert "error:" in capsys.readouterr().err
+
+
+def test_token_payload_that_is_not_an_object_exits_2(capsys):
+    import base64
+
+    def seg(obj):
+        return base64.urlsafe_b64encode(json.dumps(obj).encode()).rstrip(b"=").decode()
+
+    jwt = f"{seg({'alg': 'none'})}.{seg(['not', 'an', 'object'])}.xxxxxxxx"
+    assert main(["--token", jwt]) == 2
+
+
+def test_missing_claims_file_exits_2(capsys):
+    assert main(["--claims", "no-such-file.json"]) == 2
+    assert "error:" in capsys.readouterr().err
+
+
+def test_policy_file_with_unknown_suffix_is_read_as_json(tmp_path, make_jwt, monkeypatch):
+    # load_policy_file only special-cases .yaml/.yml; everything else is JSON.
+    policy = tmp_path / "policy.txt"
+    policy.write_text(
+        json.dumps({"claims": {"repository": {"equals": "acme/api"}}}), encoding="utf-8"
+    )
+    claims = tmp_path / "c.json"
+    claims.write_text(json.dumps({"repository": "acme/api"}), encoding="utf-8")
+    assert main(["--claims", str(claims), "--policy", str(policy)]) == 0
+
+
+def test_json_format_report_shape(examples_dir, capsys):
+    rc = main(["--claims", str(examples_dir / "claims-pull-request.json"),
+               "--policy", str(examples_dir / "policy.json"), "--format", "json"])
+    assert rc == 1
+    report = json.loads(capsys.readouterr().out)
+    assert report["passed"] is False
+    assert report["summary"]["fail"] >= 1
+    counted = sum(report["summary"][k] for k in ("pass", "fail", "missing"))
+    assert counted == len(report["results"])
+    assert isinstance(report["notes"], list)
+
+
+def test_python_dash_m_entry_point():
+    # `python -m subcheck` is what action.yml invokes; __main__.py had 0% coverage.
+    # Run out-of-process against this checkout, so it works whether or not the
+    # package happens to be installed in the environment running the tests.
+    import os
+    from pathlib import Path
+
+    src = Path(__file__).resolve().parent.parent / "src"
+    env = {**os.environ, "PYTHONPATH": str(src)}
+    r = subprocess.run([sys.executable, "-m", "subcheck", "--version"],
+                       capture_output=True, text=True, env=env)
+    assert r.returncode == 0, r.stderr
+    assert "subcheck" in r.stdout
+
+
+def test_python_dash_m_subcheck_cli_entry_point():
+    # cli.py carries its own `if __name__ == "__main__"` guard, reachable as
+    # `python -m subcheck.cli`. Both entry points are real; exercise both.
+    import os
+    from pathlib import Path
+
+    src = Path(__file__).resolve().parent.parent / "src"
+    env = {**os.environ, "PYTHONPATH": str(src)}
+    r = subprocess.run([sys.executable, "-m", "subcheck.cli", "--version"],
+                       capture_output=True, text=True, env=env)
+    assert r.returncode == 0, r.stderr
+    assert "subcheck" in r.stdout

{subcheck-0.4.1 → subcheck-0.4.2}/tests/test_policy_shape.py

@@ -158,3 +158,39 @@ def test_equals_shorthand_string_form_fails_too():
     # The bare-string shorthand builds the same rule as {"equals": ...}.
     policy = load_policy({"claims": {"repository": "acme/api"}})
     assert validate({"repository": "attacker/evil"}, policy)[0].status == FAIL
+
+
+# --- the remaining rejection paths -------------------------------------------
+
+@pytest.mark.parametrize(
+    ("data", "expected"),
+    [
+        (["not", "a", "mapping"], "policy must be a mapping"),
+        ({"claims": ["not", "a", "mapping"]}, "'claims' must be a mapping"),
+        ({}, "policy is empty"),
+        ({"claims": {"ref": 42}}, "rule must be a string, list, or mapping"),
+    ],
+)
+def test_structurally_invalid_policies_are_rejected(data, expected):
+    with pytest.raises(ValueError, match=expected):
+        load_policy(data)
+
+
+def test_bad_policy_file_exits_2_through_the_cli(tmp_path, capsys):
+    from subcheck.cli import main
+
+    claims = tmp_path / "c.json"
+    claims.write_text('{"repository": "acme/api"}', encoding="utf-8")
+    policy = tmp_path / "p.json"
+    policy.write_text('{"claims": {"environment": {"in": "production"}}}', encoding="utf-8")
+    assert main(["--claims", str(claims), "--policy", str(policy)]) == 2
+    assert "must be a list" in capsys.readouterr().err
+
+
+def test_missing_policy_file_exits_2_through_the_cli(tmp_path, capsys):
+    from subcheck.cli import main
+
+    claims = tmp_path / "c.json"
+    claims.write_text('{"repository": "acme/api"}', encoding="utf-8")
+    assert main(["--claims", str(claims), "--policy", str(tmp_path / "nope.json")]) == 2
+    assert "error:" in capsys.readouterr().err

{subcheck-0.4.1 → subcheck-0.4.2}/tests/test_report.py

@@ -64,3 +64,25 @@ def test_malformed_half_immutable_sub_is_flagged():
     policy = {"claims": {"sub": {"matches": r"^repo:.*$"}}}
     note = " ".join(_report(claims, policy)["notes"])
     assert "only one segment" in note
+
+
+def test_customized_sub_warns_that_default_format_conditions_stop_matching():
+    # A customized sub REPLACES the default format rather than varying it, so a
+    # trust condition written for 'repo:ORG/REPO:...' stops matching entirely -
+    # wildcards included. That advisory had no test.
+    claims = {
+        "sub": "repo:acme/payments-api:environment:production"
+        ":job_workflow_ref:acme/shared/.github/workflows/deploy.yml@refs/tags/v1.2.3"
+    }
+    note = " ".join(_report(claims, {"claims": {"sub": {"matches": "^repo:acme/"}}})["notes"])
+    assert "CUSTOMIZED" in note
+    assert "wildcards included" in note
+
+
+def test_unparseable_sub_yields_no_format_notes():
+    # A sub that is not a GitHub subject at all (another issuer's format) must
+    # not produce migration advice about a format it does not have.
+    claims = {"sub": "project_path:acme/api:ref_type:branch:ref:main"}
+    report = _report(claims, {"claims": {"sub": {"matches": "^project_path:"}}})
+    assert report["passed"]
+    assert not any("immutable" in n for n in report["notes"])

{subcheck-0.4.1 → subcheck-0.4.2}/tests/test_time_notes.py

@@ -53,3 +53,13 @@ def test_non_numeric_time_claims_are_ignored():
 
 def test_absent_time_claims_produce_no_notes():
     assert _notes({}) == ""
+
+
+def test_long_expiry_is_reported_in_days():
+    # _duration's coarsest branch: anything past 48h reads in days, not hours.
+    from subcheck.report import _duration
+
+    assert _duration(30) == "30s"
+    assert _duration(600) == "10m"
+    assert _duration(7200) == "2h"
+    assert _duration(3 * 86400) == "3d"