bastion 0.55.3

CONTRIBUTING.md

@@ -9,10 +9,9 @@ their approval on that machine.
 
 Issues and pull requests are welcome on GitHub, at
 [github.com/Privatae/bastion](https://github.com/Privatae/bastion).
-Development happens in a private repository, and the public repository
-receives the source of each published release as one snapshot commit, so an
-accepted change is carried into the development repository and arrives with
-the next release. Sign-in on the git.privatae.ai forge is not reachable from
+Development happens in a private repository, so an accepted change is carried
+into the development repository and arrives here with the next release, as
+its own commit. Sign-in on the git.privatae.ai forge is not reachable from
 the internet, so issues and pull requests cannot be opened there. You can
 also read, clone, build and verify a release, and fork under the GPL. Report
 a security problem by email, not in a public issue (see
@@ -26,8 +25,15 @@ gofmt -l .            # must print nothing
 go vet ./...
 CGO_ENABLED=0 go build .
 go test ./...
+cd .. && deploy/staticcheck.sh   # must find nothing, on linux, darwin and windows
 ```
 
+Some claim tests need a real machine and root: the op sandboxes, the
+namespace tests and the root command watch skip in a container and as a
+user. GitHub's CI runs every test `docs/claims.md` cites as root on its own
+virtual machine and fails if one skips; to run them yourself, use a machine
+you can throw away.
+
 The backup tests also check this code against the age command itself when
 one is on PATH or named by `AGE_BIN`; CI installs a pinned age release and
 sets `PRIVATAE_REQUIRE_AGE`, so there they fail rather than skip.