From 917afbd201304956e36274460b609e7d284a9f61 Mon Sep 17 00:00:00 2001
From: Nathan Gillett <nathan@intentproof.io>
Date: Sat, 30 May 2026 10:32:57 -0500
Subject: [PATCH 1/2] Guard unset CRITICAL_PREFIXES in coverage config

Signed-off-by: Nathan Gillett <nathan@intentproof.io>
---
 scripts/check-coverage.sh             |  2 +-
 scripts/check-coverage_config_test.sh | 37 +++++++++++++++++++++++++++
 2 files changed, 38 insertions(+), 1 deletion(-)
 create mode 100755 scripts/check-coverage_config_test.sh

diff --git a/scripts/check-coverage.sh b/scripts/check-coverage.sh
index d3b7792..072eede 100755
--- a/scripts/check-coverage.sh
+++ b/scripts/check-coverage.sh
@@ -47,7 +47,7 @@ fi
 
 if [[ -n "${CRITICAL_RULES:-}" ]]; then
   printf '%s\n' "${CRITICAL_RULES[@]}" >"$rules_file"
-elif [[ -n "${CRITICAL_MIN:-}" && ${#CRITICAL_PREFIXES[@]} -gt 0 ]]; then
+elif [[ -n "${CRITICAL_MIN:-}" && ${#CRITICAL_PREFIXES[@]:-0} -gt 0 ]]; then
   while IFS= read -r prefix; do
     [[ -n "$prefix" ]] || continue
     printf '%s:%s\n' "$CRITICAL_MIN" "$prefix"
diff --git a/scripts/check-coverage_config_test.sh b/scripts/check-coverage_config_test.sh
new file mode 100755
index 0000000..af4fb5f
--- /dev/null
+++ b/scripts/check-coverage_config_test.sh
@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# Regression test: missing critical tier config yields a clear error.
+set -euo pipefail
+
+root="$(mktemp -d)"
+trap 'rm -rf "$root"' EXIT
+
+mkdir -p "$root/scripts"
+cp "$(dirname "$0")/check-coverage.sh" "$(dirname "$0")/check-coverage-aggregate.awk" \
+  "$root/scripts/"
+
+cat >"$root/scripts/coverage-tiers.conf" <<'EOF'
+TOTAL_MIN=90
+EOF
+
+cat >"$root/coverage.out" <<'EOF'
+mode: atomic
+example.com/pkg/main.go:1.1,2.1 2 2
+EOF
+
+output=""
+code=0
+output="$(bash "$root/scripts/check-coverage.sh" "$root/coverage.out" 2>&1)" || code=$?
+
+if [[ "$code" -ne 2 ]]; then
+  echo "FAIL: expected exit 2 for incomplete config, got ${code}" >&2
+  echo "$output" >&2
+  exit 1
+fi
+
+if ! grep -q "must set CRITICAL_RULES or CRITICAL_MIN + CRITICAL_PREFIXES" <<<"$output"; then
+  echo "FAIL: expected descriptive config error, got:" >&2
+  echo "$output" >&2
+  exit 1
+fi
+
+echo "PASS: incomplete critical tier config reports clear error"

From d9f5de7ad7754dfebe10d920e5d6a814909a3ad7 Mon Sep 17 00:00:00 2001
From: Nathan Gillett <nathan@intentproof.io>
Date: Sat, 30 May 2026 10:39:51 -0500
Subject: [PATCH 2/2] Fix CRITICAL_PREFIXES guard syntax in coverage script

Signed-off-by: Nathan Gillett <nathan@intentproof.io>
---
 scripts/check-coverage.sh             | 15 ++++---
 scripts/check-coverage_config_test.sh | 60 +++++++++++++++++----------
 2 files changed, 47 insertions(+), 28 deletions(-)

diff --git a/scripts/check-coverage.sh b/scripts/check-coverage.sh
index 072eede..be625d7 100755
--- a/scripts/check-coverage.sh
+++ b/scripts/check-coverage.sh
@@ -47,11 +47,16 @@ fi
 
 if [[ -n "${CRITICAL_RULES:-}" ]]; then
   printf '%s\n' "${CRITICAL_RULES[@]}" >"$rules_file"
-elif [[ -n "${CRITICAL_MIN:-}" && ${#CRITICAL_PREFIXES[@]:-0} -gt 0 ]]; then
-  while IFS= read -r prefix; do
-    [[ -n "$prefix" ]] || continue
-    printf '%s:%s\n' "$CRITICAL_MIN" "$prefix"
-  done < <(printf '%s\n' "${CRITICAL_PREFIXES[@]}") >"$rules_file"
+elif [[ -n "${CRITICAL_MIN:-}" ]]; then
+  if declare -p CRITICAL_PREFIXES &>/dev/null && [[ ${#CRITICAL_PREFIXES[@]} -gt 0 ]]; then
+    while IFS= read -r prefix; do
+      [[ -n "$prefix" ]] || continue
+      printf '%s:%s\n' "$CRITICAL_MIN" "$prefix"
+    done < <(printf '%s\n' "${CRITICAL_PREFIXES[@]}") >"$rules_file"
+  else
+    echo "coverage-tiers.conf must set CRITICAL_RULES or CRITICAL_MIN + CRITICAL_PREFIXES" >&2
+    exit 2
+  fi
 else
   echo "coverage-tiers.conf must set CRITICAL_RULES or CRITICAL_MIN + CRITICAL_PREFIXES" >&2
   exit 2
diff --git a/scripts/check-coverage_config_test.sh b/scripts/check-coverage_config_test.sh
index af4fb5f..52e84bd 100755
--- a/scripts/check-coverage_config_test.sh
+++ b/scripts/check-coverage_config_test.sh
@@ -2,36 +2,50 @@
 # Regression test: missing critical tier config yields a clear error.
 set -euo pipefail
 
-root="$(mktemp -d)"
-trap 'rm -rf "$root"' EXIT
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
-mkdir -p "$root/scripts"
-cp "$(dirname "$0")/check-coverage.sh" "$(dirname "$0")/check-coverage-aggregate.awk" \
-  "$root/scripts/"
+run_config_case() {
+  local conf_body="$1"
+  local label="$2"
 
-cat >"$root/scripts/coverage-tiers.conf" <<'EOF'
-TOTAL_MIN=90
+  local root
+  root="$(mktemp -d)"
+  # shellcheck disable=SC2064
+  trap "rm -rf '$root'" RETURN
+
+  mkdir -p "$root/scripts"
+  cp "$script_dir/check-coverage.sh" "$script_dir/check-coverage-aggregate.awk" \
+    "$root/scripts/"
+
+  cat >"$root/scripts/coverage-tiers.conf" <<EOF
+${conf_body}
 EOF
 
-cat >"$root/coverage.out" <<'EOF'
+  cat >"$root/coverage.out" <<'EOF'
 mode: atomic
 example.com/pkg/main.go:1.1,2.1 2 2
 EOF
 
-output=""
-code=0
-output="$(bash "$root/scripts/check-coverage.sh" "$root/coverage.out" 2>&1)" || code=$?
-
-if [[ "$code" -ne 2 ]]; then
-  echo "FAIL: expected exit 2 for incomplete config, got ${code}" >&2
-  echo "$output" >&2
-  exit 1
-fi
-
-if ! grep -q "must set CRITICAL_RULES or CRITICAL_MIN + CRITICAL_PREFIXES" <<<"$output"; then
-  echo "FAIL: expected descriptive config error, got:" >&2
-  echo "$output" >&2
-  exit 1
-fi
+  local output=""
+  local code=0
+  output="$(bash "$root/scripts/check-coverage.sh" "$root/coverage.out" 2>&1)" || code=$?
+
+  if [[ "$code" -ne 2 ]]; then
+    echo "FAIL (${label}): expected exit 2, got ${code}" >&2
+    echo "$output" >&2
+    return 1
+  fi
+
+  if ! grep -q "must set CRITICAL_RULES or CRITICAL_MIN + CRITICAL_PREFIXES" <<<"$output"; then
+    echo "FAIL (${label}): expected descriptive config error, got:" >&2
+    echo "$output" >&2
+    return 1
+  fi
+
+  return 0
+}
+
+run_config_case "TOTAL_MIN=90" "no critical tier keys" || exit 1
+run_config_case $'TOTAL_MIN=90\nCRITICAL_MIN=95' "CRITICAL_MIN without CRITICAL_PREFIXES" || exit 1
 
 echo "PASS: incomplete critical tier config reports clear error"