From a4920893b1b269c4ab29a8dffa03fcc9ea4ec7c6 Mon Sep 17 00:00:00 2001
From: reachableceo <charles@turnsys.com>
Date: Wed, 26 Aug 2026 20:56:28 -0500
Subject: [PATCH] fix(test): scope local gate to unit suite [#420]
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The full legacy suite mixes repo tests with deployment-target tests
(PAM packages, target resolv.conf, Proxmox repo reachability) that can
only pass on a provisioned server. The workstation gate now runs the
unit suite; validation/security stay invocable for sectestbed runs.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2
---
 scripts/test.sh | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/scripts/test.sh b/scripts/test.sh
index f5c11cd..0732cfe 100755
--- a/scripts/test.sh
+++ b/scripts/test.sh
@@ -2,17 +2,18 @@
 #
 # test.sh — project test runner (framework entry point).
 #
-# Wraps the legacy suite in tests/ so `make test` and the pre-push full
-# audit (scripts/check-rules.sh) have a single canonical entry point.
-# The legacy suite sources the vendored KNELShellFramework; if that ever
-# breaks, add standalone checks here rather than forking the runner.
+# LOCAL GATE: runs the unit suite, which applies to the repo itself and
+# must pass on any workstation ("shift left").
+#
+# The validation/security suites in tests/ are deployment-target tests
+# (PAM/2FA packages, target resolv.conf, external repo reachability) —
+# run them ON a sectestbed/target system, not here:
+#   bash tests/run-tests.sh validation | security
 #
 set -uo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")/.." || exit 1
 
 status=0
-if [ -f tests/run-tests.sh ]; then
-    bash tests/run-tests.sh || status=1
-fi
+bash tests/run-tests.sh unit || status=1
 
 exit "$status"