TODO.md

@@ -25,6 +25,15 @@ Bring the repo into policy compliance in one commit:
 
 # Completed Steps
 
+- 2026-08-09: `script/test` now runs
+  `go test -timeout 30s -race -cover ./...` and, on failure, reruns
+  verbosely and then exits non-zero, so a test that fails once and
+  passes on the retry can no longer produce a green build (closes #32).
+  Enabling `-race` showed the suite cannot meet the 20-second policy
+  budget: `internal/cli` exceeds the 30-second timeout because the
+  99MB/100MB boundary cases in `secrets_size_test.go` run roughly 10x
+  slower under race instrumentation. No flags were weakened and no
+  tests skipped; the conflict is tracked in #52 for a decision.
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
   Makefile shims, README Entrypoints section
 - 2026-03-11: Secure Enclave unlocker for hardware-backed secret

script/test

@@ -9,7 +9,11 @@ main() {
     # CGO is required (Makefile exports this too)
     export CGO_ENABLED=1
     go vet ./...
-    go test ./... || go test -v ./...
+    # The rerun is diagnostic only: `exit 1` keeps the script failing
+    # even if a flaky test passes on the second attempt.
+    go test -timeout 30s -race -cover ./... || \
+        { echo "--- Rerunning with -v for details ---"; \
+          go test -timeout 30s -race -v ./...; exit 1; }
 }
 
 main "$@"