2d88776463
Harness Replays / detect-changes (pull_request) Successful in 4s
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 8s
E2E API Smoke Test / detect-changes (pull_request) Successful in 9s
E2E Chat / detect-changes (pull_request) Successful in 9s
qa-review / approved (pull_request_target) Successful in 3s
Runtime PR-Built Compatibility / detect-changes (pull_request) Successful in 7s
Harness Replays / Harness Replays (pull_request) Successful in 1s
sop-checklist / all-items-acked (pull_request) acked: 1/7 — missing: local-postgres-e2e, staging-smoke, root-cause, +3 — body-unfilled: comprehensive-testing, local-postgres-e2e, staging-
sop-checklist / na-declarations (pull_request) N/A: (none)
sop-checklist / all-items-acked (pull_request_target) Successful in 3s
CI / Detect changes (pull_request) Successful in 14s
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 11s
Handlers Postgres Integration / detect-changes (pull_request) Successful in 12s
sop-tier-check / tier-check (pull_request_target) Successful in 3s
gate-check-v3 / gate-check (pull_request_target) Successful in 12s
security-review / approved (pull_request_target) Successful in 11s
E2E Chat / E2E Chat (pull_request) Failing after 12s
CI / Shellcheck (E2E scripts) (pull_request) Successful in 26s
Runtime PR-Built Compatibility / PR-built wheel + import smoke (pull_request) Failing after 37s
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 55s
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 58s
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 1m38s
CI / Platform (Go) (pull_request) Failing after 3m36s
CI / Canvas (Next.js) (pull_request) Successful in 5m32s
CI / Canvas Deploy Reminder (pull_request) Has been skipped
CI / Python Lint & Test (pull_request) Successful in 6m43s
CI / all-required (pull_request) Successful in 2s
sop-tier-check / tier-check (pull_request_review) Successful in 6s
audit-force-merge / audit (pull_request_target) Has been skipped
Per CTO FREEZE-LIFT granted by PM (Option-A reasoning same as 760d5e2a), address the 2 unaddressed blockers from hongming's REQUEST_CHANGES #38669 that survived thed1d9da57fix: **Blocker #2 — LOST IDOR-pin happy-path** (TestAdminTestToken_HappyPath_TokenValidates). Refactor replaced the round-trip through wsauth.ValidateToken with a string-match on the response body. Round-trip coverage gap. Restore: get token via GetTestToken, extract from response, call wsauth.ValidateToken(ctx, db.DB, wsToken, issuedToken), assert nil. sha256-hash lookup is mocked with sqlmock.AnyArg since the hash is opaque to the test; what matters is the row that comes back points at wsToken. If GetTestToken and ValidateToken ever drift on token format, the round-trip will error. **Blocker #3 — os.Setenv → t.Setenv** (consistency + auto-restore + panic-safety). 3 tests in this file still used os.Setenv + defer os.Unsetenv. Every other test in the file uses t.Setenv; this is the last patchy island. Convert the 3 stragglers: - TestGetTestToken_AdminTokenRequired_WrongToken - TestGetTestToken_AdminTokenRequired_MissingBearer - TestGetTestToken_AdminTokenRequired_CorrectToken Removes the "os" import (no longer used) and adds the "context" and wsauth imports for the new test. **Nits from #38669 not addressed** (explicit non-scope): - _AdminTokenEmpty_NoAuthRequired test — out of scope; would need a separate PR for the gate-bypass invariant doc + test. - per-test ExpectationsWereMet on _CorrectToken + _ResponseContainsToken — superseded by thed1d9da57cleanup-hook pattern (DRY, covers all tests using makeTokenHandler). - generic SELECT-error path coverage — separate test surface, file follow-up if hongming re-flags. - sqlmock regex casing — stylistic; current raw-string works. Test-only change. 1 file, +62/-7. No production code touched. Refs: hongming #38669 (blockers #2 + #3), CTO freeze-lift via PM A2A this tick. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>