Files
stack-mos-dt-0/packages/mosaic/src/framework/manifest-parity.spec.ts
T
Hermes AgentandClaude Opus 4.8 34e55d4a2e feat(mosaic): manifest-owned upgrade guard so updates never wipe operator config (#791)
Invert the framework updater from a denylist ("framework owns everything unless
preserved") to an explicit allow-list manifest ("operator owns everything unless
framework"). A path the manifest never anticipated resolves to operator-owned by
the fail-safe default, so it is structurally unreachable by any write or prune.

Root cause (#791): `mosaic update` re-seeds via `install.sh` keep-mode, whose
`rsync -a --delete` + hand-maintained PRESERVE_PATHS denylist wiped operator
paths the denylist forgot (agents/*.conf, policy/*.md, *.local.md, harvester
SOP, tools/_lib/credentials.json, unanticipated fleet files).

- framework-manifest.txt: single SSOT ([framework]/[operator], deny-wins,
  UNKNOWN=>operator fail-safe), read by BOTH installers.
- src/framework/manifest.ts: pure resolver (parse/matchGlob/resolveOwnership/
  frameworkSubtreeRoots/planPrune) — the testable seam.
- tools/_lib/manifest.sh: bash resolver (compiled globs, fork-free hot path),
  sourced by install.sh; parity-tested against the TS resolver.
- install.sh keep mode is now manifest-driven (no --delete): overlay-copy
  framework files, scoped-prune only retired framework files inside shipped
  subtrees. Operator + unknown paths are never written or deleted.
- file-ops.syncDirectory gains an isOperatorOwned guard; file-adapter derives it
  from the shared manifest, replacing the drifted hardcoded preservePaths.

Tests (TDD, red->green):
- HARD GATE test-upgrade-manifest-guard.sh: 10 operator sentinels (incl. an
  unanticipated one) survive a keep-mode reseed byte-identical + mtime-unchanged;
  retired framework file pruned; secret value absent from output. RED 31 fail on
  the old installer -> GREEN 48 pass. Wired merge-blocking into CI.
- manifest-parity.spec.ts (§6.1): bash<->TS agree on 34 paths + subtree roots.
- manifest.spec.ts: 18 tests incl. planPrune property test + shipped-tree
  completeness (§6.2).
- test-install-migration.sh F6 flipped: an unanticipated operator fleet file now
  MUST survive keep-mode reseed.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-07-16 15:47:28 -05:00

109 lines
3.4 KiB
TypeScript

import { describe, it, expect } from 'vitest';
import { execFileSync } from 'node:child_process';
import { existsSync } from 'node:fs';
import { join } from 'node:path';
import { fileURLToPath } from 'node:url';
import { loadManifest, resolveOwnership, frameworkSubtreeRoots } from './manifest.js';
/**
* Bash ↔ TS parity (#791, §6.1).
*
* The installer (bash) and the config adapter (TS) each resolve path ownership
* from framework-manifest.txt. If the two resolvers disagreed on a single path,
* an upgrade could protect a file on one code path and wipe it on the other —
* exactly the two-copies drift that #631 patched by hand. This test drives the
* bash resolver (`tools/_lib/manifest.sh`) as a subprocess and asserts it agrees
* with the TS resolver for a broad set of paths spanning every ownership class.
*/
const FRAMEWORK_ROOT = fileURLToPath(new URL('../../framework', import.meta.url));
const MANIFEST_SH = join(FRAMEWORK_ROOT, 'tools', '_lib', 'manifest.sh');
const hasBash = (() => {
try {
execFileSync('bash', ['-c', 'true'], { stdio: 'ignore' });
return true;
} catch {
return false;
}
})();
function bashResolve(relPath: string): string {
return execFileSync('bash', [MANIFEST_SH, 'resolve', relPath], {
encoding: 'utf-8',
}).trim();
}
function bashSubtreeRoots(): string[] {
return execFileSync('bash', [MANIFEST_SH, 'subtree-roots'], { encoding: 'utf-8' })
.split('\n')
.map((s) => s.trim())
.filter((s) => s.length > 0);
}
// Paths spanning every ownership class: framework single-files, framework
// subtrees, operator declared trees, operator carve-out inside a framework
// subtree, local overlays, and deliberately UNANTICIPATED paths (fail-safe).
const PROBE_PATHS = [
'CONSTITUTION.md',
'AGENTS.md',
'STANDARDS.md',
'install.sh',
'framework-manifest.txt',
'guides/E2E-DELIVERY.md',
'tools/git/pr-create.sh',
'tools/_lib/manifest.sh',
'defaults/SOUL.md',
'fleet/README.md',
'fleet/roles/coder.md',
'fleet/roster.schema.json',
'fleet/examples/general.yaml',
// operator
'SOUL.md',
'USER.md',
'TOOLS.md',
'SOUL.local.md',
'USER.local.md',
'STANDARDS.local.md',
'agents/coder0.conf',
'policy/custom.md',
'memory/note.md',
'sources/skills/x.md',
'credentials/c.json',
'tools/_lib/credentials.json',
'fleet/roster.yaml',
'fleet/roster.json',
'fleet/agents/coder0.env',
'fleet/run/coder0.hb',
'fleet/backlog/data.db',
'fleet/roles.local/custom.md',
// unanticipated → operator (fail-safe)
'harvester/sop.md',
'unknown-operator-dir/x',
'fleet/my-fleet.yaml',
'random-root-file.md',
'tools/some-new-framework-tool.sh',
];
describe.skipIf(!hasBash)('bash ↔ TS manifest parity (§6.1)', () => {
it('the bash resolver CLI exists and is executable', () => {
expect(existsSync(MANIFEST_SH)).toBe(true);
});
it('bash and TS resolve identical ownership for every probe path', () => {
const manifest = loadManifest(FRAMEWORK_ROOT);
const disagreements: Array<{ path: string; ts: string; bash: string }> = [];
for (const p of PROBE_PATHS) {
const ts = resolveOwnership(manifest, p);
const bash = bashResolve(p);
if (ts !== bash) disagreements.push({ path: p, ts, bash });
}
expect(disagreements).toEqual([]);
});
it('bash and TS agree on the framework subtree roots', () => {
const manifest = loadManifest(FRAMEWORK_ROOT);
expect(bashSubtreeRoots().sort()).toEqual(frameworkSubtreeRoots(manifest).sort());
});
});