Correct the unindexed sensitivity fixture

docs/roadmap/remediation.md

@@ -49,7 +49,10 @@ the completion evidence with the actual implementation.
 
 ## 2. Correct the unindexed-sensitivity regression fixture (P2)
 
-Status: Open.
+Status: Complete. The fixture now uses canonical `/untracked` while leaving it
+unindexed, and explicitly checks that `/copy` is sensitive and `/ordinary` is
+not. The new assertion failed with the original malformed seed and passed after
+correction. The closure equivalence test and `./scripts/check.sh` passed.
 
 Affected: [secret_propagation_test.go](../../internal/engine/secret_propagation_test.go),
 `TestSecretDependencyClosureMatchesFixedPointScan`, the

internal/engine/secret_propagation_test.go

@@ -7,11 +7,12 @@ import (
 
 func TestSecretDependencyClosureMatchesFixedPointScan(t *testing.T) {
 	tests := []struct {
-		name         string
-		paths        map[string]Path
-		seed         map[string]bool
-		dependencies []secretDependency
-		inherited    []secretDependency
+		name            string
+		paths           map[string]Path
+		seed            map[string]bool
+		dependencies    []secretDependency
+		inherited       []secretDependency
+		wantSensitivity map[string]bool
 	}{
 		{
 			name:  "forward reverse chains and cycles",
@@ -38,13 +39,14 @@ func TestSecretDependencyClosureMatchesFixedPointScan(t *testing.T) {
 		{
 			name:  "unindexed seed only activates inherited relations",
 			paths: secretPaths(Keys("ordinary"), Keys("copy")),
-			seed:  map[string]bool{"untracked": true},
+			seed:  secretSet(Keys("untracked")),
 			dependencies: []secretDependency{
 				{dependency: Keys("untracked"), target: Keys("ordinary")},
 			},
 			inherited: []secretDependency{
 				{dependency: Keys("untracked"), target: Keys("copy")},
 			},
+			wantSensitivity: map[string]bool{"/copy": true, "/ordinary": false},
 		},
 		{
 			name:  "inheritance direction root escapes and numeric spellings",
@@ -75,6 +77,11 @@ func TestSecretDependencyClosureMatchesFixedPointScan(t *testing.T) {
 			if !reflect.DeepEqual(got, want) {
 				t.Fatalf("closure = %#v, want %#v", got, want)
 			}
+			for pointer, sensitive := range test.wantSensitivity {
+				if got[pointer] != sensitive {
+					t.Errorf("sensitivity at %q = %v, want %v", pointer, got[pointer], sensitive)
+				}
+			}
 		})
 	}
 }