Derive the Payload List From the Block List, So a New Snippet Cannot Escape the Digest

`test_every_deployed_file_is_in_the_digest` matched only literal
`HERE / "..."` reads, which is the hook and nothing else. The snippet names
came from a list inside `main`, so the test never saw them and a new
snippet would have passed while being absent from the digest. It asserted
coverage and measured one file.
The structural fix rather than a wider regex: `CLAUDE_MD_BLOCKS` is a
module constant and `PAYLOAD_FILES` derives from it, so adding a block
enters the digest with no second edit. Two lists maintained by hand are two
lists that drift.
Three readers each carried their own copy of the marker pair, which is the
same hazard one level down, and all three now read `BLOCK_MARKERS`.
Three cases: the scan covers both sources and asserts it matched more than
the hook, the derivation holds, and no reader carries its own pair.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: ptr727

host-setup/agent-safety/install.py

@@ -34,10 +34,21 @@
 # A reader that predates a field needs to know the shape changed rather than infer it from a missing key.
 STAMP_VERSION=1
 
-# The files whose bytes this kit actually places on a machine.
+# The marker-delimited blocks this kit maintains in CLAUDE.md, in the order they are written and hashed.
+# One list rather than the marker pair repeated at each reader.
+# A block added to one reader and not the others is installed and then never checked by what reports on it.
+CLAUDE_MD_BLOCKS= (
+ ("agent-safety", "claude-md-safety.md"),
+ ("fleet-bootstrap", "claude-md-fleet.md"),
+)
+BLOCK_MARKERS=tuple(markerformarker, _inCLAUDE_MD_BLOCKS)
+
+# The files whose bytes this kit actually places on a machine, the hook first and then each block.
+# Derived rather than listed, so a block added above enters the digest without a second edit.
+# Written out, this list and the block list drifted apart silently and the digest stopped covering a file.
 # The digest is taken over these rather than over the commit, since it is the content that runs.
 # A clean commit and a dirty checkout install different bytes while reporting the same SHA.
-PAYLOAD_FILES= ("gh-write-guard.py","claude-md-safety.md", "claude-md-fleet.md")
+PAYLOAD_FILES= ("gh-write-guard.py",) +tuple(filenamefor_, filenameinCLAUDE_MD_BLOCKS)
 
 # Distinguishes an absent key from one holding an explicit null, which `dict.get` reports alike.
 # The two need different answers, since a gap is filled and a null is a settings error.
@@ -182,7 +193,7 @@ def blocks_present(claude_md):
 return {}
 text=claude_md.read_text(encoding="utf-8", errors="replace")
 found= {}
-formarkerin("agent-safety", "fleet-bootstrap"):
+formarkerinBLOCK_MARKERS:
 # A start marker alone is a half-written block, which a presence check reads as installed.
 # Exactly one pair, since the installer writes one and a duplicate is a corrupted file.
 # Two blocks mean the second silently governs, and reporting the first as current hides that.
@@ -205,7 +216,7 @@ def marker_corruption(claude_md):
 text=claude_md.read_text(encoding="utf-8", errors="replace")
 valid=blocks_present(claude_md)
 out= []
-formarkerin("agent-safety", "fleet-bootstrap"):
+formarkerinBLOCK_MARKERS:
 ifre.search(rf"<!-- {marker} v\d+ (?:start|end) -->", text) andmarkernotinvalid:
 out.append(f"the {marker} markers in CLAUDE.md are duplicated or incomplete")
 returnout
@@ -228,7 +239,7 @@ def installed_digest(claude_home):
 h=hashlib.sha256()
 h.update(normalized(hook.read_bytes()))
 text=normalized(claude_md.read_text(encoding="utf-8", errors="replace"))
-formarkerin("agent-safety", "fleet-bootstrap"):
+formarkerinBLOCK_MARKERS:
 found=re.search(rf"<!-- {marker} v\d+ start -->.*?<!-- {marker} v\d+ end -->", text, re.DOTALL)
 ifnotfound:
 returnNone
@@ -548,15 +559,14 @@ def reject(where, held, want):
 # The two blocks install and update independently, so one can change without rewriting the other.
 # The safety block states restrictions only.
 # The fleet block enables, so it stays separate from a block whose own text says nothing in it widens a permission.
-blocks= [("agent-safety", "claude-md-safety.md"), ("fleet-bootstrap", "claude-md-fleet.md")]
 # Preserve CLAUDE.md's existing line endings: work in \n internally, write back with its own ending.
 ifclaude_md.exists():
 raw=claude_md.read_bytes()
 newline="\r\n"ifb"\r\n"inrawelse"\n"
 existing=normalized(raw.decode("utf-8"))
 else:
 newline, existing="\n", ""
-formarker, filenameinblocks:
+formarker, filenameinCLAUDE_MD_BLOCKS:
 snippet= (HERE/filename).read_text(encoding="utf-8").strip()
 block_re=re.compile(rf"<!-- {marker} v\d+ start -->.*?<!-- {marker} v\d+ end -->", re.DOTALL)
 ifblock_re.search(existing):

host-setup/agent-safety/test_install.py

@@ -465,14 +465,35 @@ def test_a_real_edit_to_a_snippet_is_still_reported(self):
 target.write_bytes(original)
 
 deftest_every_deployed_file_is_in_the_digest(self):
-"""The inverse: the kit copies gh-write-guard.py and both snippets, and each must be covered."""
+"""The inverse: the kit copies gh-write-guard.py and every snippet, and each must be covered.
+
+ The source scan alone was a false positive. It matched only literal `HERE / "..."` reads,
+ which is the hook and nothing else, while the snippet names came from a list inside `main`.
+ A new snippet passed it while being absent from the digest, so the two sources of truth are
+ both checked now, and the derivation below is what actually makes the gap impossible.
+ """
 source=INSTALL.read_text(encoding="utf-8")
-fornameinre.findall(r'HERE / "([^"]+\.(?:py|md))"', source):
-ifname=="install.py":
-continue
+named= {namefornameinre.findall(r'HERE / "([^"]+\.(?:py|md))"', source)}
+named|= {filenamefor_, filenameininstall.CLAUDE_MD_BLOCKS}
+named.discard("install.py")
+# The hook is the only literal read; every other entry arrives from the block list.
+self.assertGreater(len(named), 1, "the scan matched only one file, so it is not covering the blocks")
+fornameinsorted(named):
 self.assertIn(name, install.PAYLOAD_FILES,
 f"install.py reads {name} but PAYLOAD_FILES omits it, so the digest misses it")
 
+deftest_the_payload_list_is_derived_from_the_block_list(self):
+"""Written out by hand, the two drifted and the digest stopped covering a deployed file."""
+self.assertEqual(install.PAYLOAD_FILES,
+ ("gh-write-guard.py",) +tuple(ffor_, fininstall.CLAUDE_MD_BLOCKS))
+
+deftest_every_reader_uses_the_same_marker_list(self):
+"""Three readers each carried their own marker pair, so a new block could reach one only."""
+source=INSTALL.read_text(encoding="utf-8")
+self.assertNotIn('("agent-safety", "fleet-bootstrap")', source,
+"a reader is carrying its own marker pair instead of BLOCK_MARKERS")
+self.assertEqual(install.BLOCK_MARKERS, tuple(mform, _ininstall.CLAUDE_MD_BLOCKS))
+
 deftest_the_one_line_summary_names_the_host_and_the_commit(self):
 self.install()
 stamp=json.loads(self.stamp.read_text(encoding="utf-8"))