Module allowlist 

The command allow-gates behind the dispatching tools.

ct-test and ct-each can run another program, so each runs only commands on a fixed, compiled-in list. The lists are intentionally static and immutable: nothing a caller does at run time can extend them, so an agent driving these tools cannot grant itself new commands. A command that is not on the relevant list is refused, and nothing runs. There is no shell mode anywhere in the suite — every dispatch is a direct argv launch.

• ct-test gates on BUILTIN: read-only commands only.
• ct-each gates through is_allowed_for_each: BUILTIN plus ct-test (itself gated, so still read-only), and — only behind an explicit --mutating flag — the suite’s own MUTATING_SUITE tools, which carry their own --expect/--dry-run safety gates.

Gating is by program name (the file-name component of the command). It is a guard against unintended side effects, not a sandbox: it does not inspect arguments or resolve which binary a name ultimately runs.

Constants

BUILTIN

Commands trusted as read-only — ct-test’s entire, fixed allowlist.

MUTATING_SUITE

The suite’s mutating tools, runnable by ct-each only behind its explicit --mutating flag. Each carries its own --expect/--dry-run gates, so a dispatched edit still has to assert its own effect before writing.

Functions

gated_name

The program name the gates check for a command: its file-name component, so ls, /bin/ls, and ./ls all gate on ls.

is_allowed

Whether name is on ct-test’s fixed read-only allowlist.

is_allowed_for_each

Whether name is a permitted ct-each dispatch target.