From 946fa10764cd1e7ddd7565dcd21608d19e7aa781 Mon Sep 17 00:00:00 2001
From: Eric Rakestraw <eric@rakestraw.us>
Date: Fri, 11 Sep 2026 15:06:29 +0000
Subject: [PATCH] Verify deployment-managed cache permissions

---
 docs/roadmap/implementation.md              |  2 ++
 internal/cli/state_permissions_unix_test.go | 12 ++----------
 2 files changed, 4 insertions(+), 10 deletions(-)

diff --git a/docs/roadmap/implementation.md b/docs/roadmap/implementation.md
index cad483cf..6309d848 100644
--- a/docs/roadmap/implementation.md
+++ b/docs/roadmap/implementation.md
@@ -303,6 +303,8 @@ prompt.
 
 ## Stage 5: Repository-Wide Verification And Contract Audit
 
+**Completed:** 2026-09-11
+
 ### Goal
 
 Prove the complete target state and catch accidental permission, safety, or
diff --git a/internal/cli/state_permissions_unix_test.go b/internal/cli/state_permissions_unix_test.go
index cef86186..58129bb7 100644
--- a/internal/cli/state_permissions_unix_test.go
+++ b/internal/cli/state_permissions_unix_test.go
@@ -3,6 +3,7 @@
 package cli
 
 import (
+	"fmt"
 	"os"
 	"path/filepath"
 	"syscall"
@@ -43,19 +44,10 @@ func assertGroupAccessibleCacheTree(t *testing.T, root string) {
 			want = 0o770
 		}
 		if got := info.Mode().Perm(); got != want {
-			return &cachePermissionError{path: path, got: got, want: want}
+			return fmt.Errorf("%s mode = %#o, want %#o", path, got, want)
 		}
 		return nil
 	}); err != nil {
 		t.Fatal(err)
 	}
 }
-
-type cachePermissionError struct {
-	path      string
-	got, want os.FileMode
-}
-
-func (err *cachePermissionError) Error() string {
-	return err.path + " mode mismatch"
-}