daintree-control: give it an argument surface, so its control can be shown to have run

[jobordu]

daintree-control.py read no argv at all — argparse 0, sys.argv 0 — so a bare run,
--self-test, and --zzz-not-a-flag were the same run, all exiting 0. The gate said exactly why
that is not a control:

⚠ daintree-control.py UNVERIFIABLE — it accepts `--zzz-not-a-flag` and exits 0.
   ⛔ So `--self-test` exiting 0 establishes NOTHING: the flag may never have been recognised.

⇒ A control whose invocation cannot be shown to have happened is not a control.

BEFORE   41 passed · 3 UNESTABLISHED · 6 UNVERIFIABLE
AFTER    41 passed · 3 UNESTABLISHED · 5 UNVERIFIABLE
         daintree-control.py has NO self-test, declared in-file: controlled by
         tools/test_daintree_control.py

⛔ The two refusals must DIFFER — that is the whole design

Refusing every argument with one message would make --self-test and garbage byte-identical,
which the gate reads as "the flag was never DISPATCHED" — trading UNVERIFIABLE for UNESTABLISHED
and establishing nothing either way. I read that branch before writing the fix, not after:

--self-test        ->  2, and NAMES where the control lives
--zzz-not-a-flag   ->  2, and says there is no flag to pass
bare               ->  0, unchanged

⚠ Why there is no in-process --self-test

Stated in the file rather than left implicit: main() opens a live MCP session on its first
statement. A hermetic control has to stand a server up around the whole process — which is
exactly what tools/test_daintree_control.py already does (make_handler / run_against, 9
controls, gated by the CI glob, passing).

⇒ So the declaration is true: the control exists, it is gated, and it is not reachable from
inside this process.

⚠ Not touched — and one deliberately

• pretooluse-guard.py is a live PreToolUse hook. Its own header says an addition "changes
  a running mechanism rather than" adding a check. Harness configuration is the operator's, not
  TEAMLEAD's to alter. It stays UNVERIFIABLE by choice, and that should be recorded rather than
  fixed by me.
• fleet-identity, discriminates, pane-census, pipe-exit-scan remain. Same two shapes; this
  commit is the template — an argv surface where the recognised flag answers truthfully and the
  unrecognised one is refused differently.

Verification

gate-selftests.sh --self-test	exit 0
scripts/exit-code-gate.sh tools 'test_*.py'	exit 0
scripts/check-tools-index.py	exit 0
test_daintree_control.py	exit 0 — run because main()'s entry moved

🤖 Generated with Claude Code

https://claude.ai/code/session_01DTMf4EvaTEnDKXY47efRZZ

[coderabbitai]

Warning

Review limit reached

Next included review available in 3 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 16ffed84-234e-4bd5-b9c1-0be64cf9b701

📥 Commits

Reviewing files that changed from the base of the PR and between e616eae and 412841b.

📒 Files selected for processing (1)

• tools/daintree-control.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}