Date: 2026-10-03. One reviewer (an AI agent), on 196b4ea..00414be: the
sudoers, sshd, unit, grub and plain-rule checkers, which four parallel
agents built in separate worktrees and Claude reviewed and integrated.
The reviewer read the code and did not run it. Claude reproduced the two
main findings before fixing them.
| Area | Finding | Severity | Fixed in |
|---|---|---|---|
| unit | A remark about a line of a unit that loads (User=nobody, StandardOutput=syslog, MemoryLimit=) became a unit-syntax error, “the unit does not load”, because only messages with “ignoring” were taken as harmless. Reproduced with systemd 255: exit 0, the unit loads. |
high | 41c87bf (new rule unit-notice, a warning) |
| nsswitch | One bad action on any line ([NOTFOUND=retrun], an unclosed [) makes glibc reject the whole file, so every lookup fails, and sc said nothing. Reproduced on glibc 2.39: getent passwd root exits 2 with the file bind-mounted in a private mount namespace. 13 cases checked that way are now the test’s cases. |
high | 41c87bf (new rule nsswitch-invalid, a blocker) |
| sudoers | Drop-ins whose names sudo skips (a dot, a trailing ~) got syntax and mode findings, though sudo never reads them. |
medium | 41c87bf (sudoers-ignored warning; sc check with no argument looks only at files the scope records) |
| sudoers | sc check <id> reported today’s mode of the file as a problem of a saved version. |
low | 41c87bf (CheckSaved) |
| graph | Brace patterns turned off Files’ depth limit: sc check walked all of /boot/grub and every .wants directory. |
low | 41c87bf (scope.Glob.MaxDepth) |
| code | Three copies of the line hash; unitKey run twice; lines split per finding. |
cleanup | 41c87bf (one lineKey) |
| code | Test-only fields (sshdHostKey, lstat) on the production Checks. |
cleanup | not changed: unexported, settable only by the package’s tests, as exists has been since step 3 |
sc check with no argument had been checking 18 of snapd’s generated
mount and service units in /etc/systemd/system, which the M2 scope
leaves out on purpose (M2 plan question 7). With the scope filter it
checks the files scd records: 10 on this VM, 6 of them readable by a user.
TestUnitVerify (remarks, a remark next to a refusal, a remark then a
load failure), TestNsswitch (the 13 glibc-checked cases),
TestSudoersIgnoredNames, TestSudoersSavedVersion,
TestCheckCLISkipsUnrecorded, TestGraphFilesAlternatives and the
MaxDepth cases of TestExportedGlob.