Raise org-wide make test cap to 60s, backstop timeout to 90s (#42)

## The question this answers

Is the 60-second test-time cap the new **org-wide** ceiling, or an approved
**dnswatcher-only** divergence?

- Question: #41
- Origin: sneak/dnswatcher#93

This PR implements **org-wide**.

## The ruling

On sneak/dnswatcher#93 (comment) (2026-08-09),
verbatim:

> make the cap 60s in both and never use mocking, always use live resolvers and
> assume the build and run environments have full unmodified unrestricted
> internet access. it is ok if they fail due to a bad build environment that
> alters dns packets.

And on #41 (comment), disambiguating
the scope:

> org wide. the hard cap is 60 for ci/green, but over 20s should be filed as an
> improvement bug.

That second comment landed after this work was started, and it confirms the
option implemented here. The two-tier shape it describes (60s hard, 20s target,
overage filed as a bug) is encoded in the policy text.

## What changed, and the number chosen

The backstop moves from `30s` to **`90s`**.

The old pairing was incoherent under the new cap: a 60-second ceiling with a
30-second `-timeout` means the timeout kills the suite long before the ceiling
is reached, so the ceiling would never be the thing that fails. The backstop has
to sit above the cap, where it does its actual job of catching a hung test
rather than a merely slow one. `90s` preserves the 1.5x backstop-to-cap ratio
the old `20s`/`30s` pair already had, so the relationship between the two
numbers is unchanged and only the scale moves.

Every place a number changed:

| File | What |
| --- | --- |
| `prompts/REPO_POLICIES.md` | Prose ceiling: `20 seconds` to `60 seconds`, plus the new 20s target / improvement-bug tier |
| `prompts/REPO_POLICIES.md` | Backstop prose: `30-second timeout` to `90-second timeout`, with the rationale for why it exceeds the cap |
| `prompts/REPO_POLICIES.md` | Go example Makefile snippet, first run: `go test -timeout 30s` to `-timeout 90s` |
| `prompts/REPO_POLICIES.md` | Go example Makefile snippet, verbose rerun: `go test -timeout 30s` to `-timeout 90s` |
| `prompts/EXISTING_REPO_CHECKLIST.md` | `make test` has a `30-second` timeout, to `90-second` timeout plus the 60s hard cap and the 20s filing rule |
| `prompts/NEW_REPO_CHECKLIST.md` | `script/test` / `make test` entrypoint line: `30-second timeout` to `90-second timeout, 60-second hard cap on wall time` |

I swept the whole repo for `20 second`, `30-second`, `20s`, `30s`, `timeout 20`,
`timeout 30`, and `under 20`/`under 30`. After this change the only remaining
occurrences of `20` in a test-timing context are the two intentional references
to the new 20-second target. The other `timeout` hits in the repo are unrelated
(`.golangci.yml` lint timeout, HTTP server `ReadTimeout`/`WriteTimeout` examples,
`middleware.Timeout`) and were left alone.

One deliberate non-change: the Python example Makefile snippet in
`prompts/REPO_POLICIES.md` carries no timeout flag today and still carries none.
`pytest` has no built-in timeout, so adding one would mean mandating the
`pytest-timeout` plugin org-wide, which is a new dependency requirement rather
than a renumbering, and outside what was ruled on. It is a pre-existing gap
between the prose and that snippet, not one this PR introduces. Happy to file it
separately or add `--timeout=90` here if you want it in scope.

## The alternative that was not implemented

**Keep canonical at 20s and let `sneak/dnswatcher` carry a documented per-repo
divergence.** That was the recommendation originally written up in
#41, on the reasoning that the 20s
ceiling is doing real work in repos with fast deterministic suites and only
dnswatcher needs the headroom.

Org-wide was chosen instead for two reasons. First, the pressure is not specific
to DNS: any repo whose tests exercise real infrastructure over the network
inherits the same variance, and there is no principled line that admits
dnswatcher and excludes the next such repo. Second, and more decisively,
`REPO_POLICIES.md` is a vendored file. A sanctioned per-repo divergence in a
vendored file is indistinguishable, on inspection, from a stale vendored copy:
the next re-vendoring silently reverts the divergence, and nobody reading a
consuming repo can tell whether the number they are looking at is an intentional
exception or drift. That is the bidirectional-drift problem already tracked in
#31. The two-tier cap gets the same
outcome without the drift, since a fast repo that regresses from 4s to 45s still
generates an improvement bug.

## Status

This PR was opened speculatively, ahead of a decision, on the standing "open it
rather than wait" instruction. The scope question has since been answered
org-wide in the issue, but the specific backstop value of `90s` and the two-tier
wording are still my proposals rather than anything ruled on, so closing this or
sending it back for a different number is a perfectly fine outcome.

`make check` passes; `make fmt` was run and the result is included (it was a
no-op, the edits were already prettier-conformant).

`sneak/dnswatcher` is landing the matching 60s edit to its vendored copy in
parallel, and will match whichever way this is decided.

Co-authored-by: clawbot <clawbot@eeqj.de>
Reviewed-on: #42
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

Dockerfile

@@ -12,17 +12,4 @@ COPY package.json yarn.lock ./
 RUN script/bootstrap
 
 COPY . .
-
+RUN make check
-# CHECK_EPOCH is a per-invocation nonce supplied by script/cibuild and
-# script/docker. Without it an unchanged tree serves this layer from
-# cache and the build reports a green it never ran. ARG is stage-scoped,
-# so it must be redeclared in every stage that runs checks. The guard
-# makes a bare `docker build .` fail loudly instead of silently reusing
-# the empty (and therefore stable) cache key. Expand the value into the
-# command so the cache miss does not depend on BuildKit's handling of an
-# unreferenced ARG. Both the guard and the check RUN reference the value,
-# so both are value-keyed: there are two independent invalidation points
-# here, not one. Keep both.
-ARG CHECK_EPOCH
-RUN [ -n "$CHECK_EPOCH" ] || exit 1
-RUN echo "check epoch: ${CHECK_EPOCH}" && make check

README.md

@@ -123,13 +123,9 @@ alpine. We provide:
 - `script/check` — run all checks: `test`, `lint`, `fmt-check` (our own
   extension)
 - `script/docker` — build the Docker image, tagged via `script/projectname`
-  (byte-identical across repos); passes the same `CHECK_EPOCH` nonce as
+  (byte-identical across repos)
-  `script/cibuild`
+- `script/cibuild` — cd to the repo root and `docker build .` (what CI runs; the
-- `script/cibuild` — cd to the repo root, assign `epoch="$(date +%s%N)$$"`, then
+  image build runs `script/check`)
-  `docker build --build-arg CHECK_EPOCH="$epoch" .` (what CI runs; the image
-  build runs `script/check`, and the per-invocation `CHECK_EPOCH` nonce is what
-  stops Docker serving that check from cache on an unchanged tree — a bare
-  `docker build .` fails closed on purpose)
 - `script/precommit` — run by the git pre-commit hook (our own extension); calls
   `script/check`
 - `script/install-precommit` — installs the git pre-commit hook (our own

TODO.md

@@ -21,15 +21,6 @@ fmt-check, and commit.
 
 # Completed Steps
 
-- 2026-08-09: Fixed the false green in the canonical CI gate: `script/cibuild`
-  and `script/docker` now pass a per-invocation `CHECK_EPOCH` nonce, and the
-  `Dockerfile` (plus the Go multistage template in REPO_POLICIES.md, in both its
-  lint and builder stages) declares `ARG CHECK_EPOCH` with a guard that makes a
-  bare `docker build .` fail closed. Corrected the org-canonical text that
-  asserted a successful build implies all checks pass, across every document
-  carrying it: `REPO_POLICIES.md`, both repo checklists (which still told agents
-  to write the pre-fix `script/cibuild` and ended on an acceptance item the
-  guard makes unsatisfiable), and the Go styleguide.
 - 2026-08-07: Set the canonical `.golangci.yml` to the org-standard v2-schema
   config already deployed byte-identical across the org's Go repos (settings
   under `linters.settings` so thresholds like lll/funlen/cyclop/dupl actually

prompts/CODE_STYLEGUIDE_GO.md

@@ -1,6 +1,6 @@
 ---
 title: Code Styleguide — Go
-last_modified: 2026-08-09
+last_modified: 2026-03-18
 ---
 
 1.  Try to hard wrap long lines at 77 characters or less.
@@ -101,16 +101,9 @@ last_modified: 2026-08-09
     `golangci-lint`.
 
 1.  Write a `Dockerfile` for every repo, even if it only runs the tests and
-    linting. `script/cibuild` and `script/docker` should always make sure that
+    linting. `docker build .` should always make sure that the code is in an
-    the code is in an able-to-be-compiled state, linted, and any tests run, and
+    able-to-be-compiled state, linted, and any tests run. The Docker build
-    the build should fail if linting doesn't pass. That guarantee holds only
+    should fail if linting doesn't pass.
-    because those scripts pass a per-invocation `CHECK_EPOCH` build arg that
-    busts the check layers out of the Docker cache; without it an unchanged tree
-    serves those layers from cache and the build reports a green it never ran. A
-    bare `docker build .` fails closed by design, on the `[ -n "$CHECK_EPOCH" ]`
-    guard — always go through `script/cibuild` or `script/docker`. See
-    [Repository Policies](https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/REPO_POLICIES.md)
-    for the canonical form.
 
 1.  Every repo must have a `Makefile`. See
     [Repository Policies](https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/REPO_POLICIES.md)

prompts/EXISTING_REPO_CHECKLIST.md

@@ -1,6 +1,6 @@
 ---
 title: Existing Repo Checklist
-last_modified: 2026-08-09
+last_modified: 2026-07-06
 ---
 
 Use this checklist when beginning work in a repo that may not yet conform to our
@@ -29,15 +29,10 @@ with your task.
       if missing
 - [ ] `.editorconfig` exists — fetch from
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/.editorconfig`
-- [ ] `Dockerfile` and `.dockerignore` exist (fetch `.dockerignore` from
+- [ ] `Dockerfile` and `.dockerignore` exist; Dockerfile runs `make check` as a
-      `https://git.eeqj.de/sneak/prompts/raw/branch/main/.dockerignore`);
+      build step — fetch `.dockerignore` from
-      Dockerfile runs `make check` as a build step, and every stage containing a
+      `https://git.eeqj.de/sneak/prompts/raw/branch/main/.dockerignore`
-      check-running `RUN` declares `ARG CHECK_EPOCH` with the
+- [ ] Gitea Actions workflow in `.gitea/workflows/` runs `docker build .` on
-      `RUN [ -n "$CHECK_EPOCH" ] || exit 1` guard immediately below it — see the
-      `CHECK_EPOCH` rule in `REPO_POLICIES.md`. Without them the check layer is
-      served from cache on an unchanged tree and the build reports a green it
-      never ran.
-- [ ] Gitea Actions workflow in `.gitea/workflows/` runs `script/cibuild` on
       push — reference
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitea/workflows/check.yml`
 - [ ] Language-specific config:
@@ -64,7 +59,9 @@ with your task.
 - [ ] README has an **Entrypoints** section documenting the `script/`
       entrypoints and linking the standard
 - [ ] `make check` does not modify any files in the repo
-- [ ] `make test` has a 30-second timeout
+- [ ] `make test` has a 90-second timeout and completes within the 60-second
+      hard cap (over 20 seconds is green but must be filed as an improvement
+      bug)
 - [ ] `make test` runs real tests, not a no-op (at minimum, import/compile
       check)
 - [ ] `make check` passes on current branch
@@ -109,6 +106,5 @@ with your task.
 # Final
 
 - [ ] `make check` passes
-- [ ] `script/cibuild` succeeds (a bare `docker build .` fails closed by design,
+- [ ] `docker build` succeeds
-      on the `CHECK_EPOCH` guard)
 - [ ] Commit and merge fixes before starting your actual task

prompts/NEW_REPO_CHECKLIST.md

@@ -1,6 +1,6 @@
 ---
 title: New Repo Checklist
-last_modified: 2026-08-09
+last_modified: 2026-07-06
 ---
 
 Use this checklist when creating a new repository from scratch. Follow the steps
@@ -52,12 +52,7 @@ Template files can be fetched from:
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/REPO_POLICIES.md`
 - [ ] `Dockerfile` and `.dockerignore` — fetch `.dockerignore` from
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/.dockerignore`
-    - All Dockerfiles must run `make check` as a build step, and every stage
+    - All Dockerfiles must run `make check` as a build step
-      containing a check-running `RUN` must declare `ARG CHECK_EPOCH` with the
-      `RUN [ -n "$CHECK_EPOCH" ] || exit 1` guard immediately below it — see the
-      `CHECK_EPOCH` rule in `REPO_POLICIES.md`. Without them the check layer is
-      served from cache on an unchanged tree and the build reports a green it
-      never ran.
     - Server: also builds and runs the application
     - Non-server: brings up dev environment and runs `make check`
     - Image pinned by sha256 hash with version/date comment
@@ -85,8 +80,8 @@ are thin shims calling them. Model scripts:
       installs
 - [ ] `script/setup` / `make setup` — readies a fresh clone: runs `bootstrap`,
       then `install-precommit`, plus repo-specific init
-- [ ] `script/test` / `make test` — runs real tests, not a no-op (30-second
+- [ ] `script/test` / `make test` — runs real tests, not a no-op (90-second
-      timeout)
+      timeout, 60-second hard cap on wall time)
 - [ ] `script/lint` / `make lint` — runs linter
 - [ ] `script/fmt` / `make fmt` — formats code (writes)
 - [ ] `script/fmt-check` / `make fmt-check` — checks formatting (read-only)
@@ -95,14 +90,8 @@ are thin shims calling them. Model scripts:
 - [ ] `script/projectname` — outputs the project name (used by `script/docker`
       for the image tag)
 - [ ] `script/docker` / `make docker` — builds Docker image, tagged via
-      `script/projectname` (byte-identical across repos); assigns
+      `script/projectname` (byte-identical across repos)
-      `epoch="$(date +%s%N)$$"` on its own line and passes
+- [ ] `script/cibuild` — cd to repo root, `docker build .` (what CI runs)
-      `--build-arg CHECK_EPOCH="$epoch"`
-- [ ] `script/cibuild` — cd to repo root, assign `epoch="$(date +%s%N)$$"` on
-      its own line, then run `docker build --build-arg CHECK_EPOCH="$epoch" .`
-      (what CI runs). The build arg is mandatory: see the `CHECK_EPOCH` rule in
-      `REPO_POLICIES.md` for why each element is load-bearing. A bare
-      `docker build .` fails closed by design.
 - [ ] `script/precommit` — called by the pre-commit hook; runs `script/check`
 - [ ] `script/install-precommit` — installs the pre-commit hook that runs
       `script/precommit`

prompts/REPO_POLICIES.md

@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-08-09
+last_modified: 2026-08-07
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -60,19 +60,17 @@ style conventions are in separate documents:
   prerequisite since nvm requires bash. yarn is then pinned via
   `corepack prepare yarn@<version> --activate`. Never install "latest" or "lts";
   always exact versions. `script/cibuild` runs the CI build: it changes to the
-  repo root and runs `docker build --build-arg CHECK_EPOCH="$epoch" .`, where
+  repo root and runs `docker build .`; the Gitea workflow calls it. Four further
-  `epoch` is a per-invocation nonce (see the `CHECK_EPOCH` rule below); the
+  scripts are our own extensions to the standard: `script/check` runs
-  Gitea workflow calls it. Four further scripts are our own extensions to the
+  `script/test`, `script/lint`, and `script/fmt-check`; `script/precommit` is
-  standard: `script/check` runs `script/test`, `script/lint`, and
+  what the git pre-commit hook runs, and it calls `script/check`;
-  `script/fmt-check`; `script/precommit` is what the git pre-commit hook runs,
+  `script/install-precommit` installs the git pre-commit hook (the `make hooks`
-  and it calls `script/check`; `script/install-precommit` installs the git
+  target shims to it); and `script/projectname` (literally that filename) simply
-  pre-commit hook (the `make hooks` target shims to it); and
+  outputs the project's name. Scripts that need the name call
-  `script/projectname` (literally that filename) simply outputs the project's
+  `script/projectname` — e.g. `script/docker` assembles its image tag from it —
-  name. Scripts that need the name call `script/projectname` — e.g.
+  so those scripts stay byte-identical across all repos. Repo-type-specific
-  `script/docker` assembles its image tag from it — so those scripts stay
+  pre-commit extras (e.g. `go mod tidy` verification in Go repos) belong in
-  byte-identical across all repos. Repo-type-specific pre-commit extras (e.g.
+  `script/precommit`, not in the hook itself. Model scripts are at
-  `go mod tidy` verification in Go repos) belong in `script/precommit`, not in
-  the hook itself. Model scripts are at
   `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`. The README
   must document the provided scripts in an **Entrypoints** section (see the
   README requirements below).
@@ -101,58 +99,6 @@ style conventions are in separate documents:
   `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it so the bootstrap
   layer stays cached until dependencies change.
 
-- **Every check-running `RUN` must be cache-busted with `CHECK_EPOCH`.** Docker
-  invalidates a `COPY` layer only when the copied content changes, so on an
-  unchanged tree the `RUN make check` layer is served from cache, the suite
-  never runs, and the build still exits 0. A sub-second `docker build` reporting
-  success is a cache hit, not a result. The canonical form, in **every** stage
-  containing a check-running `RUN`:
-
-    ```dockerfile
-    ARG CHECK_EPOCH
-    RUN [ -n "$CHECK_EPOCH" ] || exit 1
-    RUN echo "check epoch: ${CHECK_EPOCH}" && make check
-    ```
-
-    and in both `script/cibuild` and `script/docker`:
-
-    ```sh
-    epoch="$(date +%s%N)$$"
-    docker build --build-arg CHECK_EPOCH="$epoch" .
-    ```
-
-    All four elements are load-bearing; none is optional, and each guards a
-    failure mode that otherwise fails green:
-    - `ARG` is stage-scoped, so a single declaration leaves the other check
-      stages frozen while the fix reviews as complete. Declare it in every stage
-      that runs checks, immediately above the first such `RUN`.
-    - Expand the value into the command. This makes the cache miss contractual
-      rather than dependent on BuildKit's handling of an unreferenced `ARG`, and
-      it puts the epoch in the build log. The guard is itself value-keyed, for
-      the same reason: it references `$CHECK_EPOCH`, so BuildKit renders the
-      epoch into that layer's description (observed as
-      `RUN [ -n "1786287053..." ] || exit 1`) and re-runs it whenever the value
-      changes. Each stage therefore has two independent invalidation points, and
-      the guard always precedes the check `RUN`. Keep both: the expansion is
-      defence in depth, and it is what makes the epoch visible in the build
-      output.
-    - The `[ -n ... ]` guard is required: an unset `ARG` is empty, and empty is
-      a stable cache key, so without it a bare `docker build .` still produces
-      the false green. Failed steps are never cached, so the guard fails on
-      every such invocation, loudly. A bare `docker build .` failing is by
-      design.
-    - Assign `epoch=` on its own line, never inline in the `--build-arg`
-      argument: a failing command substitution inside an argument does not trip
-      `set -e`, so the inline form silently degrades to an empty constant. The
-      `$$` suffix is required because busybox `date` drops `%N` and exits 0, so
-      on an alpine host the epoch would degrade to second granularity and
-      concurrent invocations would collide.
-
-    This invalidates the check layers and everything after them while leaving
-    `go mod download`, `script/bootstrap`, and the pinned toolchain install
-    cached, so it does not push against the five-minute Docker build ceiling.
-    Blanket `--no-cache` also works but is wasteful and can blow that ceiling.
-
 - **Dockerfiles must use a separate lint stage for fail-fast feedback.** Go
   repos use a multistage build where linting runs in an independent stage based
   on the `golangci/golangci-lint` image (pinned by hash). This stage runs
@@ -173,9 +119,7 @@ style conventions are in separate documents:
     COPY go.mod go.sum ./
     RUN go mod download
     COPY . .
-    ARG CHECK_EPOCH
+    RUN make fmt-check
-    RUN [ -n "$CHECK_EPOCH" ] || exit 1
-    RUN echo "check epoch: ${CHECK_EPOCH}" && make fmt-check
     RUN make lint
 
     # Build stage
@@ -189,9 +133,7 @@ style conventions are in separate documents:
     COPY go.mod go.sum ./
     RUN go mod download
     COPY . .
-    ARG CHECK_EPOCH
+    RUN make test
-    RUN [ -n "$CHECK_EPOCH" ] || exit 1
-    RUN echo "check epoch: ${CHECK_EPOCH}" && make test
 
     ARG VERSION=dev
     RUN CGO_ENABLED=0 go build -trimpath \
@@ -223,28 +165,11 @@ style conventions are in separate documents:
     - The build stage runs `make test` after compilation setup. Tests run in the
       build stage, not the lint stage, because they may require compiled
       artifacts or heavier dependencies.
-    - `ARG CHECK_EPOCH` appears in **both** stages, because `ARG` is
-      stage-scoped: declaring it only in the lint stage leaves `make test`
-      frozen at the last cached result. In each stage the guard sits immediately
-      below the `ARG` so a bare `docker build .` fails instead of reusing the
-      empty cache key, and the value is expanded into the first check `RUN` so
-      the cache miss does not rely on BuildKit's unreferenced-`ARG` handling.
-      Both of those lines reference `$CHECK_EPOCH`, so both are value-keyed:
-      each stage is invalidated at two independent points. The later `RUN`s in
-      the same stage need no expansion of their own: they are already
-      invalidated by their busted parent layer.
 
 - Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
-  runs `script/cibuild` (which runs
+  runs `script/cibuild` (which runs `docker build .`) on push. Since the
-  `docker build --build-arg CHECK_EPOCH="$epoch" .`) on push. The Dockerfile
+  Dockerfile already runs `make check`, a successful build implies all checks
-  runs `make check`, so a successful build implies all checks pass — but that
+  pass.
-  implication holds **only** because of the `CHECK_EPOCH` cache-bust described
-  above. Without it, an unchanged tree serves the check layer from cache and the
-  build reports a green it never earned. A bare `docker build .` fails closed by
-  design, on the `[ -n "$CHECK_EPOCH" ]` guard; always go through
-  `script/cibuild` or `script/docker`. Never accept a `script/cibuild` pass as
-  evidence without confirming it ran: a sub-second wall time, or `CACHED` on the
-  check layer, means nothing was executed.
 
 - Use platform-standard formatters: `black` for Python, `prettier` for
   JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with
@@ -264,8 +189,13 @@ style conventions are in separate documents:
   module under test to verify it compiles/parses. There is no excuse for
   `make test` to be a no-op.
 
-- `make test` must complete in under 20 seconds. Add a 30-second timeout in the
+- `make test` must complete in under 60 seconds. That is the hard cap, and a
-  Makefile.
+  suite that exceeds it fails. Under 20 seconds is the target. A suite between
+  20 and 60 seconds is still green, but the overage must be filed as an
+  improvement bug against that repo. Add a 90-second timeout to the test
+  invocation in the Makefile (`go test -timeout 90s`). The backstop deliberately
+  sits above the hard cap so that it catches a genuinely hung test rather than a
+  merely slow one.
 
 - **`make test` should use the conditional verbose rerun pattern.** Run tests
   without `-v` (verbose) first. If tests fail, automatically rerun with `-v` to
@@ -284,9 +214,9 @@ style conventions are in separate documents:
 
     ```makefile
     test:
-    	@go test -timeout 30s -race -cover ./... || \
+    	@go test -timeout 90s -race -cover ./... || \
     		{ echo "--- Rerunning with -v for details ---"; \
-    		  go test -timeout 30s -race -v ./...; exit 1; }
+    		  go test -timeout 90s -race -v ./...; exit 1; }
     ```
 
     Python example:

script/cibuild

@@ -1,20 +1,13 @@
 #!/bin/sh
-# script/cibuild: run the CI build. The Dockerfile runs script/check, but
+# script/cibuild: run the CI build. The Dockerfile runs script/check, so
-# that only proves anything because CHECK_EPOCH is a fresh nonce on every
+# a successful build implies all checks pass.
-# invocation: without it Docker serves the check layer from cache on an
-# unchanged tree and the build exits 0 without running the suite.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    # Assign on its own line: a failing command substitution inside an
+    docker build .
-    # argument does not trip `set -e`, which would silently degrade the
-    # nonce to an empty constant. `$$` is required because busybox `date`
-    # drops %N without erroring.
-    epoch="$(date +%s%N)$$"
-    docker build --build-arg CHECK_EPOCH="$epoch" .
 }
 
 main "$@"

script/docker

@@ -1,9 +1,6 @@
 #!/bin/sh
 # script/docker: build the Docker image tagged with the project name.
-# Identical in all repos; the tag comes from script/projectname. The
+# Identical in all repos; the tag comes from script/projectname.
-# Dockerfile's checks only actually run because CHECK_EPOCH is a fresh
-# nonce on every invocation; without it a warm cache turns this into a
-# green that proves nothing.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -11,13 +8,7 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    # Assign on its own line: a failing command substitution inside an
+    docker build -t "$("$SCRIPT_DIR/projectname")" .
-    # argument does not trip `set -e`, which would silently degrade the
-    # nonce to an empty constant. `$$` is required because busybox `date`
-    # drops %N without erroring.
-    epoch="$(date +%s%N)$$"
-    docker build --build-arg CHECK_EPOCH="$epoch" \
-        -t "$("$SCRIPT_DIR/projectname")" .
 }
 
 main "$@"