Making of - caveman-savings¶
Living journal. Newest chapter at the bottom.
Chapter 1: birth via the house tool-repo pipeline (2026-07-08)¶
Apply-CavemanSavings.ps1 and Migrate-CavemanBackups.ps1 started life as two loose scripts
in ~/OneDrive, applied by hand on each house PC. As part of an org-wide migration to give
every house tool its own proper repo (pipeline: secret gate -> Codex review -> 4-layer
testing -> docs set -> CI template -> local commit, no push until the org migration lands),
they were copied - not moved - into this standalone repo, built out with a hermetic Pester
test suite, and given the full house doc set.
What made this repo different from the pilot (house-council-client)¶
The pilot's scripts talk to a network service (MCP council servers over HTTP), so its E2E
layer is a loopback HttpListener mock. These two scripts touch only the local filesystem -
no network, no server, no credential of any kind - so the "automation/E2E" pillar of the
4-layer testing matrix is documented as not applicable rather than faked; the hermetic unit
tests already run the real scripts against a real (throwaway) filesystem end-to-end.
The $home variable gotcha¶
The first draft of the test helper stored the fake ~/.claude + %LOCALAPPDATA% paths in a
variable named $home. PowerShell reserves $HOME as a read-only automatic variable, so
every test that tried to assign it threw Cannot overwrite variable HOME because it is
read-only or constant. Renamed to $fakeHome throughout and the tests ran clean.
The pwsh vs Windows PowerShell 5.1 gotcha¶
Early local test runs (via powershell -ExecutionPolicy Bypass -File tests\Invoke-CI.ps1,
i.e. Windows PowerShell 5.1) showed six Migrate-CavemanBackups.ps1 tests failing - the
captured console output was empty even though the script's own Write-Host / Write-Warning
lines were clearly printing to the terminal. Re-running the exact same command through pwsh
(PowerShell 7, matching the shell: pwsh steps in ci.yml) passed all 23 tests immediately.
The scripts themselves are correct under both hosts; only the test harness's stream-capture
(*>&1 | Out-String) behaves differently between the two PowerShell major versions. Lesson
for the next fan-out repo: always validate locally with the same shell CI will use.
Codex security review verdict¶
codex exec (gpt-5.5) found no hardcoded secrets and no injection/RCE risk in the scripts
themselves. It flagged four CI-template patterns (self-hosted pull_request runner, floating
Docker tag, -SkipPublisherCheck PSGallery install, and local-plugin-cache script discovery)
- all four are shared, house-standard patterns already present in the pilot repo (or,
in the fourth case, an accepted local-machine-only tradeoff), documented in
docs/technical/SECURITY.md rather than reworked here. None met the "real secret/RCE"
bar that would have stopped this ship.
Ticket¶
This shipping work is tracked as its first board entry - see docs/BOARD.md, CAVE-1.