// tests/fixtures/red-first/02243c6-always-allow-shim.mjs
// The shim that makes the red-first claim of 02243c6 reproducible.
//
// 02243c6 ("the criteria runner screens with an ALLOWLIST") says six of its new
// tests were red before the fix. On the parent tree the test file does not even
// LOAD - it imports `allowedCommand`, which the parent does not export - so the
// red is a load error on the whole file, not six named failures. The six only
// appear once the missing export exists and allows everything. This file is
// that export, kept here so a re-measure does not have to guess it.
//
// Reproduce "6 of 55" (POSIX shell, from the repo root, needs git history):
//
//   T="$(mktemp -d)"
//   git archive 02243c6 | tar -x -C "$T"
//   git show 02243c6^:lib/verification/criteria-runner.mjs > "$T/lib/verification/criteria-runner.mjs"
//   cat tests/fixtures/red-first/02243c6-always-allow-shim.mjs >> "$T/lib/verification/criteria-runner.mjs"
//   (cd "$T" && node --test --test-reporter=tap tests/lib/criteria-runner.test.mjs) | grep -E '^# (tests|fail)'
//
// Expected: `# tests 55` and `# fail 6` - four `allowedCommand` tests (all but
// "every known test runner is allowed", which an always-allow shim passes),
// `runCriteria: a command outside the allowlist is NOT RUN`, and the end-to-end
// canary test (28 evasions, 0 run). Measured 2026-09-22.
// It is a fixture, not a test: nothing in the suite runs it, because the suite
// must also pass on a `git archive` tree, where there is no history to rewind.

export function allowedCommand() { return { allowed: true, reason: '' }; }