Follow-ups to test job count computation

[mernst]

Follow-up to #892.

• Computing DAIKON_TEST_JOBS clones plume-scripts if it is absent (unless NONETWORK is set), as the top-level Makefile does, rather than failing. The clone goes to a temporary directory that is then renamed into place, so concurrent sub-makes do not collide and an interrupted clone does not leave a partial directory.
• clean-all in kvasir-tests and dyncomp-tests (and thus very-clean) no longer requires plume-scripts.
• dyncomp-tests regression-tests honors DAIKON_TEST_JOBS and MPARG, as kvasir-tests does.
• Document DAIKON_TEST_JOBS=1 as the way to run serially.
• The test scripts use DAIKON_TEST_JOBS=1 rather than MPARG=-j1.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: codespecs/daikon/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: c152c616-ce65-4d36-8531-9d77b6dffae7

---

📥 Commits

Reviewing files that changed from the base of the PR and between 6e127bc and 9dec7f2.

---

📒 Files selected for processing (6)

• scripts/test-kvasir.sh
• scripts/test-nonquick-txt-diff.sh
• scripts/test-quick-txt-diff.sh
• tests/Makefile.jobs
• tests/dyncomp-tests/Makefile
• tests/kvasir-tests/Makefile

---

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 0 remain after this review.

---

---

📝 Walkthrough

Walkthrough

The test job configuration now attempts to obtain plume-scripts when the directory is absent and NONETWORK is unset. When no job count is set, it selects one job for CI and four otherwise. Test scripts and the dyncomp regression target now pass job settings through their respective commands. The dyncomp and Kvasir cleanup targets use a fixed four jobs.

---

Priority: ➖ Normal

Change: Bug fix

Merge Risk | ⚪ Minimal · up to 9dec7

Merge Risk: ⚪ Minimal · up to 9dec7

Regression runs retain their intended job limits, and cleanup works without a network clone. No actionable merge risk was established.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 9dec7

The change extends automatic helper download and execution to independent test runs. It uses the same source already trusted by normal builds and supports offline or explicit job-count overrides. Exposure is limited to the invoking build/test process, but the downloaded revision is not pinned.

Retained concerns

• Low · security · inferred: Independent test invocations now execute a newly downloaded, unpinned helper where the base would stop for a missing helper. Compromise of the trusted upstream repository could therefore reach those additional invocations with the test process's permissions. This is a limited expansion of an existing build dependency trust boundary, not evidence of an upstream compromise or a new privilege grant.

Security review details

Security Blast Radius

• inferred — The additional exposure is independent test execution with no configured job count and an absent helper. Downloaded code executes as the invoking process, so its effective reach includes that process's accessible workspace and environment. Actual runner credentials and downstream service authority were not established. The changed scripted flows already invoke the root build, which had the same acquisition dependency.

Security Findings and Attack Paths

• inferred — An attacker controlling the trusted upstream repository could alter is-ci.sh, which the new direct-test acquisition path downloads and executes. The URL is fixed rather than caller-selected, so this path requires upstream compromise or equivalent control over acquired content; ordinary test input alone is not shown to reach it.

Trust Boundaries and Controls

• observed — The helper crosses from external repository content into local shell execution. HTTPS and a fixed repository constrain acquisition, but the invocation does not select an immutable revision or sandbox execution. Existing PLUME_SCRIPTS configuration remains caller-selectable, as it was in the base.

Resilience and Maintainability Implications

• observed — Temporary cleanup runs after the clone-and-rename sequence but has no interruption trap. An existing destination suppresses acquisition even if is-ci.sh is missing, leading to an error rather than automatic repair. These are recovery limitations, not demonstrated privilege-escalation paths.

Hardening Proposals

• proposed — Use an immutable, approved helper revision consistently across root-build and direct-test acquisition to reduce mutable-upstream execution and dependency drift.

---

Pre-merge checks | 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 3…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[mernst]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[mernst]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.