local-first ios domain inspection toolkit. dns, tls, rdap, audit. http://git.krz.sh/krz/domain-dig.git/atom?h=main 2026-07-25T04:04:14+00:00 2026-07-25T04:04:14+00:00 Christian Cleberg hello@cleberg.net 2026-07-25T03:58:44+00:00 urn:sha1:7001577e6798530c943ac4cf03258bc172927a67 - Scripts/audit-a11y.sh: replace `[ ... ]` with `[[ ... ]]` in the seven shell conditionals SonarCloud flagged (shelldre:S7688). The script is bash (`#!/usr/bin/env bash`), so `[[` is safe and avoids word-splitting/globbing footguns. The jq `[ .devices | ... ]` filter is untouched — it is not a shell test. - AccessibilityAuditHarness.swift: fold the nested `if` in the noise classifier into a single conditional (swift:S1066); behavior unchanged. The remaining open SonarCloud issues (S1075 https literals, S115 external-JSON CodingKeys, S107 parameter counts, S3087 callback nesting) are false positives or intentional and are being resolved as Won't Fix / Safe in SonarCloud, consistent with the v4.8.3 static-analysis policy in RELEASE_ROADMAP.md. 2026-07-20T22:55:24+00:00 Christian Cleberg hello@cleberg.net 2026-07-20T22:50:56+00:00 urn:sha1:1e25fb947d3c01fc983b481fff5b064ed82349ab The two-job CI matrix was buying two near-identical iOS 26.x runs at double the macOS minutes. GitHub's macos-26 image ships only 26.x simulator runtimes, so it cannot test the 17.6 floor at all, and floor coverage was the entire justification for the second job. Split the work by what each side can uniquely do instead: CI keeps one job on the newest runtime. Its real value is not the runtime — it is building a clean checkout of the merge result, which catches a file that was never committed. A local run cannot, and that failure mode is live here: DomainDig.xcodeproj is hand-edited and uses file-system-synchronized groups, where an entire missing folder still builds locally. sr.ht cannot run macOS, so this is the only place that check exists. Collapsing the matrix also removed the deployment-target math, since "newest" is always above the floor. Scripts/audit-a11y.sh runs the audit against real runtimes, defaulting to floor + current. It reads the deployment target from the project rather than hard-coding it, selects the oldest runtime at or above it (one below is useless — the app cannot install), and says so plainly when the nearest installed runtime is a major version above the target rather than implying floor coverage it does not have. .githooks/pre-push runs the floor tier, and only when Swift, asset, or project files changed. Pre-push rather than pre-commit because the suite takes ~85s: at pre-commit that blocks every commit, and a hook routinely bypassed with --no-verify is worse than none. Opt in per clone with 'git config core.hooksPath .githooks'. Docs/ACCESSIBILITY.md records the split, the measured non-nested coverage that motivates it, and the enforcement ratchet.