{ "checker": { "claims": [ { "claim": "Quickstart runs offline with Python 3.10+ and no packages", "command": "python3 agent_access.py summary", "evidence": "agent-a (tag:agent-agent-a)\n Everything preset: grants all IP traffic to all destinations.\n\nagent-b (tag:agent-agent-b)\n Everything preset: grants all IP traffic to all destinations.\n\nagent-c (tag:agent-agent-c)\n Everything preset: grants all IP traffic to all destinations.\n", "expected": "Summary lists agent-a with its tag", "input": "python3 agent_access.py summary", "kind": "claim", "outcome": "Real input produced the expected result: agent-a (tag:agent-agent-a)", "returncode": 0, "source": "Requires Python 3.10 or newer; no packages or network access are needed.", "source_checked": true, "source_file": "README.md", "verdict": "yes" }, { "claim": "everything preset grants all IP traffic to all destinations", "command": "python3 agent_access.py summary", "evidence": "Everything preset: grants all IP traffic to all destinations.\n\nagent-b (tag:agent-agent-b)\n Everything preset: grants all IP traffic to all destinations.\n\nagent-c (tag:agent-agent-c)\n Everything preset: grants all IP traffic to all destinations.\n", "expected": "Each agent shows the everything preset grant", "input": "python3 agent_access.py summary (checked-in policy)", "kind": "claim", "outcome": "Real input produced the expected result: Everything preset: grants all IP traffic to all destinations.", "returncode": 0, "source": "Choose `everything` to grant an agent all IP traffic to all destinations,", "source_checked": true, "source_file": "README.md", "verdict": "yes" }, { "claim": "validate command checks the policy", "command": "python3 agent_access.py validate", "evidence": "Policy is valid.\n", "expected": "Policy is valid.", "input": "python3 agent_access.py validate", "kind": "claim", "outcome": "Real input produced the expected result: Policy is valid.", "returncode": 0, "source": "Run `python3 agent_access.py validate`", "source_checked": true, "source_file": "README.md", "verdict": "yes" }, { "claim": "scoped preset grants only listed LAN hosts and ports", "command": "python3 agent_access.py --policy .coldpass/scoped-policy.json summary", "evidence": "Grants access to printer () on tcp:631, udp:8000-8010.\n This fragment grants LAN access only to listed addresses or ranges on listed TCP/UDP ports.\n This fragment grants no access to other agents' Tailscale node addresses.\n This fragment adds no Internet or exit-node access grant.\n These network grants do not confer tailnet or user administration authority.\n These network grants do not confer policy-edit, device-tagging, or network-configuration authority.\n This fragment adds no unlisted TCP/UDP ports or protocols.\n", "expected": "Summary states the printer grant on those ports only", "input": "scoped policy with printer on tcp:631 and udp:8000-8010", "kind": "claim", "outcome": "Real input produced the expected result: Grants access to printer () on tcp:631, udp:8000-8010.", "returncode": 0, "source": "or `scoped` to grant only its listed LAN hosts and ports.", "source_checked": true, "source_file": "README.md", "verdict": "yes" }, { "claim": "diff never writes files and prints additions", "command": "python3 agent_access.py diff --against policy.json", "evidence": "Added grants:\n+ {\"dst\":[\"*\"],\"ip\":[\"*\"],\"src\":[\"tag:agent-agent-a\"]}\n+ {\"dst\":[\"*\"],\"ip\":[\"*\"],\"src\":[\"tag:agent-agent-b\"]}\n+ {\"dst\":[\"*\"],\"ip\":[\"*\"],\"src\":[\"tag:agent-agent-c\"]}\nRemoved grants:\n (none)\n", "expected": "Lists the three everything grants as additions", "input": "diff --against policy.json (no grants array)", "kind": "claim", "outcome": "Real input produced the expected result: Added grants:", "returncode": 0, "source": "prints additions and removals.", "source_checked": true, "source_file": "README.md", "verdict": "yes" } ], "cycle_checks": [ { "claim": "Scheduled or looping main behavior", "command": "", "evidence": "Entry points inspected: agent_access.py has only argparse subcommands (summary, validate, generate, diff) and no scheduler, cron, loop, webhook, --once or --now option; the only 'exit 2' path is a parser error. The tool runs once per invocation, so no product cycle exists.", "expected": "identify the product trigger", "input": "source inspection", "kind": "cycle", "outcome": "Entry points inspected: agent_access.py has only argparse subcommands (summary, validate, generate, diff) and no scheduler, cron, loop, webhook, --once or --now option; the only 'exit 2' path is a parser error. The tool runs once per invocation, so no product cycle exists.", "source": "repository entry points", "verdict": "yes" } ], "details": { "argv": [ "python3", "agent_access.py", "--policy", ".coldpass/scoped-policy.json", "generate", "--output", ".coldpass/probe-scoped.hujson-checker-e5494a2a69364b7a9f246bcb2b9243c4" ], "expected_file": ".coldpass/probe-scoped.hujson-checker-e5494a2a69364b7a9f246bcb2b9243c4", "file_checked": true, "file_excerpt": "\"\n ],\n \"ip\": [\n \"tcp:631\",\n \"udp:8000-8010\"\n ]\n }\n ],\n \"tests\": [\n {\n \"src\": \"tag:agent-agent-a\",\n \"proto\": \"tcp\",\n \"accept\": [\n \":631\"\n ],\n \"deny\": [\n \"198.51.100.10:631\"\n ]\n },\n {\n \"src\": \"tag:agent-agent-a\",\n \"proto\": \"udp\",\n \"accept\": [\n \":8000-8010\"\n ],\n \"deny\": [\n \"198.51.100.10:8000-8010\"\n ]\n }\n ]\n}\n", "kind": "cli", "needs_browser": false, "needs_credentials": false, "returncode": 0, "scope": "product operation", "stderr": "", "stdout": "", "working": true }, "evidence_strength": "readme_checked", "example_checks": [ { "claim": "Quickstart summary", "command": "python3 agent_access.py summary", "deferred": false, "evidence": "e not excluded.\nA range grants the listed TCP/UDP flows to every address it covers; service labels do not restrict destinations.\nScoped mode does not model or test ICMP; the everything preset grants all IP traffic, including ICMP.\nThis fragment does not revoke credentials, host permissions, or access provided elsewhere.\n\nagent-a (tag:agent-agent-a)\n Everything preset: grants all IP traffic to all destinations.\n\nagent-b (tag:agent-agent-b)\n Everything preset: grants all IP traffic to all destinations.\n\nagent-c (tag:agent-agent-c)\n Everything preset: grants all IP traffic to all destinations.", "expected": "Agent Tailscale grants header printed", "input": "summary of checked-in policy", "kind": "example", "outcome": "command completed successfully", "returncode": 0, "source": "README.md Quickstart", "verdict": "yes" }, { "claim": "Validate the checked-in policy", "command": "python3 agent_access.py validate", "deferred": false, "evidence": "Policy is valid.", "expected": "Policy is valid.", "input": "validate checked-in policy", "kind": "example", "outcome": "command completed successfully", "returncode": 0, "source": "README.md Quickstart", "verdict": "yes" }, { "claim": "Generate the Tailscale policy fragment to a file", "command": "python3 agent_access.py generate --output .coldpass/example-fragment.hujson-checker-da440cbb22494fe7ae49578061a25167", "deferred": false, "evidence": "ent-a\": [\n \"autogroup:admin\"\n ],\n \"tag:agent-agent-b\": [\n \"autogroup:admin\"\n ],\n \"tag:agent-agent-c\": [\n \"autogroup:admin\"\n ]\n },\n \"grants\": [\n {\n \"src\": [\n \"tag:agent-agent-a\"\n ],\n \"dst\": [\n \"*\"\n ],\n \"ip\": [\n \"*\"\n ]\n },\n {\n \"src\": [\n \"tag:agent-agent-b\"\n ],\n \"dst\": [\n \"*\"\n ],\n \"ip\": [\n \"*\"\n ]\n },\n {\n \"src\": [\n \"tag:agent-agent-c\"\n ],\n \"dst\": [\n \"*\"\n ],\n \"ip\": [\n \"*\"\n ]\n }\n ],\n \"tests\": []\n}\n", "expected": "Fragment file written with the agent tag", "input": "generate --output .coldpass/example-fragment.hujson", "kind": "example", "outcome": "command completed successfully", "returncode": 0, "source": "README.md Manual application / Quickstart generate", "verdict": "yes" }, { "claim": "Diff against an existing policy without writing", "command": "python3 agent_access.py diff --against policy.json", "deferred": false, "evidence": "Added grants:\n+ {\"dst\":[\"*\"],\"ip\":[\"*\"],\"src\":[\"tag:agent-agent-a\"]}\n+ {\"dst\":[\"*\"],\"ip\":[\"*\"],\"src\":[\"tag:agent-agent-b\"]}\n+ {\"dst\":[\"*\"],\"ip\":[\"*\"],\"src\":[\"tag:agent-agent-c\"]}\nRemoved grants:\n (none)", "expected": "Added grants section listed", "input": "diff --against policy.json", "kind": "example", "outcome": "command completed successfully", "returncode": 0, "source": "README.md Quickstart diff command", "verdict": "yes" }, { "claim": "Offline unit test suite from release-check", "command": "python3 -m unittest discover -s tests", "deferred": false, "evidence": "...................................\n----------------------------------------------------------------------\nRan 35 tests in 58.433s\n\nOK", "expected": "All 35 offline tests pass", "input": "python3 -m unittest discover -s tests", "kind": "example", "outcome": "command completed successfully", "returncode": 0, "source": "CONTRIBUTING.md", "verdict": "yes" } ], "status": "PASS" }, "deviations": [ "/inputs/coldpass-preflight.py does not exist in this guest; ran the checker at instead (same arguments).", "First validate pass rejected claim 2 because the quote had a trailing period not present in README line 3 (comma follows 'destinations'); corrected the quote to the exact substring and re-ran; passed.", "Workspace is not a git repository and no command needed Git metadata, so the git init/fetch/reset pin procedure was not run. Source snapshot was used as supplied.", "No install was needed: no packages or Node/uv, product is stdlib-only and Python 3.12.3 is present.", "Scoped-mode test used a policy in .coldpass (not policy.local.json) and the RFC1918 placeholder , since the README's 192.0.2.25 is rejected by validation." ], "fault_owner": null, "main_blocker": null, "operation": "Generate and review Tailscale grant fragments for agent-a/b/c with the offline agent_access.py CLI (summary, validate, generate, diff, and a scoped policy via --policy)", "operation_scope": "Offline only, Python 3.12.3 (README requires 3.10+), standard library only, no network or Tailscale connection. Scoped test used a placeholder RFC1918 printer address in .coldpass/scoped-policy.json, not a real LAN value. Product runs once per invocation; no product cycle.", "outcome": "working", "plain_failure": null, "steps": [ "python3 --version (3.12.3, meets README Requires Python 3.10 or newer)", "python3 agent_access.py summary", "python3 agent_access.py validate", "python3 agent_access.py generate --output ", "python3 agent_access.py diff --against policy.json", "python3 -m unittest discover -s tests (release-check.json / CONTRIBUTING.md offline test command): 35 tests OK", "python3 agent_access.py --policy .coldpass/scoped-policy.json validate / summary / generate --output .coldpass/probe-scoped.hujson", "COLDPASS_WORKSPACE= python3 -I --validate --replay: valid true, replay PASS" ], "stuck_step": null, "suggested_fix": "None needed for this run. Optionally, the repo could document that the offline test command prints its OK line to stderr." }