test(e2e): cover time-and-locale actions with stories 141-143

[bferanmi806-sketch]

Summary

One story per action in the #233 time-and-locale cluster: GetDateTime (141, read-only), SetNtp (142, medium-risk), SetLocale (143, medium-risk). Each story requires exactly one matching plan step with exact action, risk, and params assertions, so none can pass on an arbitrary non-empty planner response. Story 142 guards the GetDateTime near-miss (answering "is NTP enabled?" vs the imperative "enable NTP"); story 143 rejects sibling identity actions (SetTimezone/SetHostname/SetNtp). Cassettes untouched.

Related Issue

#233 (time-and-locale cluster). Does not close #233. Separate from #219 work; does not touch stories 139/140.

Validation

• Tests added or updated (stories 141-143)
• Documentation updated if behavior changed (CONTRIBUTING.md + docs/introduction.md counts derived from repo: 143 stories, 54 atomic + 89 Ubuntu, 56 uncovered cross-family actions)
• Security impact considered (no production code changed; SetNtp/SetLocale stories assert medium-risk approval-gated plans only)
• Trust boundary preserved (daemon remains the only privileged executor)
• CI passes (pending; shellcheck/shfmt and Linux cargo gate could not run on this Windows box - see Notes)

Host-side checks run here, all green:

• story-metadata.test.sh: 143 stories (89 ubuntu, 54 atomic)
• run-stories.sh --metadata derives 141-143 in ubuntu family
• bash -n syntax OK on all three stories
• scripts/check_evidence_claims.py: published figures match
• scripts/check_public_claims.sh: internally consistent; check_no_secrets.sh clean
• tests/e2e/story-runner-verdicts.test.sh: passed
• Story coverage map: 59 Ubuntu and cross-family actions have no story, clustered into takeable pieces #233 derivation rerun: uncovered 59 -> 56, time-locale fully covered

Notes for Reviewers

Static checks only from this environment: shellcheck/shfmt are not installed here and the full cargo nextest run --workspace --locked gate cannot run on this Windows host (default rustc 1.88 too old for sqlx; 1.96 build fails in the Linux-only vsock dependency - pre-existing, unrelated to this change which touches no Rust code). Live Ubuntu recording/replay blocked: no QEMU host, no sysknife binary, no LLM API key in this environment (same blocker as #506). Requesting CI verification for shellcheck, shfmt, and the Linux test gate before merge.

[vladimirrott]

Reviewed at 30fd9ac8. Nothing here blocks.

Each story asserts exactly one step and then its action, risk and params, so none of them can pass on whatever the planner returns. Story 142 is the one I would point to: "enable NTP" against the GetDateTime near miss is the exact confusion Example F in the prompt exists to prevent, and the story now pins the other direction.

What I checked

• The risk labels match the prompt. SetLocale and SetNtp sit in the "Medium risk" list at crates/sysknife-brain/src/prompt.rs:439, and GetDateTime is read-only.
• The stories follow the house shape. The other Ubuntu medium-risk stories (100, 103, 111, 124, 135) also run --dry-run without the SYSKNIFE_ALLOW_DESTRUCTIVE guard.
• shellcheck --severity=warning is clean on all three.
• All five workflows at your head passed, including docs-and-hygiene, which rederives the 143, 89 and 56 figures in the CONTRIBUTING.md table, and the branch merges clean.

maintainer screen marks story scripts as executable, and my container sandbox was unavailable today, so I did not run them. They also need a live VM to mean anything, which is my side of this. I will record them on Ubuntu before they count toward the committed evidence.

Optional

Story 143's sibling-action check cannot fire once STEP_COUNT is 1 and that step is SetLocale, so it duplicates the earlier assertions. It does no harm, and it documents the near miss, so keep it if you like it.

You hold #233 and #219 already, so I will not hand you anything new. The next uncovered cluster in #233 is yours whenever you want it.

[vladimirrott]

Approved at 30fd9ac8.

Three stories, and the part I want to point at is the arithmetic around them. You moved 86 to 89, 140 to 143, seven to ten, and 59 untouched action names to 56, in both the contributing table and the introduction, and you left the live-VM figure at 79/79 where it belongs. The count of things that had to move together here is exactly the trap this repo keeps stepping in, and none of them are wrong.

Story 141 asserts one step, the action name, risk low and empty params. That last assertion is the one that catches a plan which answers the right question with a parameter nobody asked for.

What I ran:

$ maintainer-merge verify 516 30fd9ac8 tests/release/public-claims.test.sh \
    's%^# Story 143 (ubuntu, medium-risk)%# Story 143 (atomic, medium-risk)%' shell
  running 'tests/release/public-claims.test.sh' unmutated
  shell suite: evidence of 1 executed unit(s), passing unmutated
  applying the mutation and re-running
  receipt recorded for #516 at 30fd9ac8 (observed: clean pass, mutated fail)

That retags story 143 into the atomic family inside a container. The derived Ubuntu count drops to 88, stops matching the 89 you published, and the claim screen refuses. So the new stories are inside the derivation, not beside it.

prompt.rs:439 lists SetLocale and SetNtp as Medium, and stories 100, 103, 111, 124 and 135 carry the same guard=0 for ALLOW_DESTRUCTIVE, so 142 and 143 match their siblings. Board: 12 pass, container-smoke skipping, merge clean. Test-only, so no CHANGELOG entry.

You already hold #233 and #219, so I am not offering a third. The next cluster in #233 after these is the storage family, if you want to keep going in the same direction once #219 lands.

Stories like these are written by somebody who administers Ubuntu boxes rather than reads about them. sysknife --dry-run "what is the current date and time on this machine" is the same path story 141 drives, on your own machine, with nothing executed.