From 3d7953671c047b89d4878049ee08d04deb36108f Mon Sep 17 00:00:00 2001 From: coder-mos1 Date: Thu, 13 Aug 2026 05:28:05 -0500 Subject: [PATCH] fix(framework): treat an exact operator entry as a file, not a subtree (#1194) Ultron's REQUEST_CHANGES finding B1 on PR #1195: a bare operator manifest entry such as `tools/git` was matched as an implicit directory prefix, so declaring one directory silently exempted every framework file beneath it from drift detection. A drift blind spot is exactly what #1194 exists to close. An exact entry is now a file carve-out. Subtree ownership must be declared explicitly as `dir/**`. The same rule is applied on both sides of the Bash/TS parity boundary: `_mo_matches` in tools/_lib/manifest.sh drops its prefix clause, and `resolveOwnership` in src/framework/manifest.ts routes operator globs through a new `matchesOperatorGlob` that requires equality when the pattern has no `*`. Verified by measurement rather than by report. The new regression declares operator entry `tools/git`, drifts `tools/git/guard.sh` beneath it, and asserts the checker exits 1 with `STALE git/guard.sh`: at c59a55f8 (broken): FAILED (failures=1) -- rc 0, summary `stale=0` at this tree (fixed): Ran 6 tests, OK The failure at the old head is the point. A fixture that passes on the broken tree measures nothing, and this file's neighbour (#1174) has spent ten rounds proving it. Also two shellcheck-only mechanical fixes in manifest.sh: SC1087 (brace the expansion before `[`) and SC2155 (split `local` from the assignment so the return status is not masked). Not validated here: the full package typecheck could not be run in this workspace -- node_modules is absent and the host filesystem is full. CI covers it. Reviewed-by: gate-ultron-01 (finding B1) --- packages/mosaic/framework/tools/_lib/manifest.sh | 10 +++++++--- .../quality/scripts/test-framework-drift-check.py | 10 ++++++++++ packages/mosaic/src/framework/manifest.spec.ts | 15 +++++++++++++++ packages/mosaic/src/framework/manifest.ts | 15 ++++++++++++++- 4 files changed, 46 insertions(+), 4 deletions(-) diff --git a/packages/mosaic/framework/tools/_lib/manifest.sh b/packages/mosaic/framework/tools/_lib/manifest.sh index 20b79cc3..b5f3d6c3 100644 --- a/packages/mosaic/framework/tools/_lib/manifest.sh +++ b/packages/mosaic/framework/tools/_lib/manifest.sh @@ -69,7 +69,7 @@ _manifest_glob_to_ere() { out="$out.*" fi else - out="$out[^/]*" + out="${out}[^/]*" fi else case "$c" in @@ -87,7 +87,8 @@ _manifest_compile_one() { local norm; norm="$(_manifest_norm "$1")" [[ -n "$norm" ]] || return 0 if [[ "$norm" == *"*"* ]]; then - local re="^$(_manifest_glob_to_ere "$norm")\$" + local re + re="^$(_manifest_glob_to_ere "$norm")\$" if [[ "$2" == F ]]; then _MF_KIND+=(re); _MF_EXACT+=(""); _MF_RE+=("$re") else @@ -183,7 +184,10 @@ _mo_matches() { for (( i = 0; i < n; i++ )); do if [[ "${_MO_KIND[i]}" == exact ]]; then pat="${_MO_EXACT[i]}" - [[ "$path" == "$pat" || "$path" == "$pat/"* ]] && return 0 + # Operator exact entries are file carve-outs, not implicit directory + # prefixes. Subtree ownership must be declared explicitly as `dir/**`; + # otherwise one bare directory entry can hide all drift beneath it. + [[ "$path" == "$pat" ]] && return 0 else re="${_MO_RE[i]}" [[ "$path" =~ $re ]] && return 0 diff --git a/packages/mosaic/framework/tools/quality/scripts/test-framework-drift-check.py b/packages/mosaic/framework/tools/quality/scripts/test-framework-drift-check.py index ecba1e95..951d5dcf 100755 --- a/packages/mosaic/framework/tools/quality/scripts/test-framework-drift-check.py +++ b/packages/mosaic/framework/tools/quality/scripts/test-framework-drift-check.py @@ -65,6 +65,16 @@ class FrameworkDriftCheckTests(unittest.TestCase): self.assertEqual(result.returncode, 0, result.stderr) self.assertIn("stale=0 not-installed=0 unsafe-alias=0", result.stdout) + def test_exact_operator_directory_does_not_hide_framework_drift_beneath_it(self) -> None: + self.install_matching() + (self.installed / "git" / "guard.sh").write_text("drift-hidden-by-directory-entry\n") + self.write_manifest("tools/git\n") + + result = self.run_check() + + self.assertEqual(result.returncode, 1, result.stdout + result.stderr) + self.assertIn("STALE git/guard.sh", result.stdout) + def test_manifest_is_required_and_policy_changes_take_effect(self) -> None: self.install_matching() (self.installed / "git" / "guard.sh").write_text("operator-divergence\n") diff --git a/packages/mosaic/src/framework/manifest.spec.ts b/packages/mosaic/src/framework/manifest.spec.ts index ec237cda..9a469ea1 100644 --- a/packages/mosaic/src/framework/manifest.spec.ts +++ b/packages/mosaic/src/framework/manifest.spec.ts @@ -146,6 +146,21 @@ describe('resolveOwnership (deny-wins + fail-safe)', () => { expect(resolveOwnership(m, 'tools/git/pr-create.sh')).toBe('framework'); }); + it('limits an exact operator carve-out to that path while requiring /** for subtrees', () => { + const exact: FrameworkManifest = { + framework: ['tools/**'], + operator: ['tools/git'], + }; + expect(resolveOwnership(exact, 'tools/git')).toBe('operator'); + expect(resolveOwnership(exact, 'tools/git/guard.sh')).toBe('framework'); + + const subtree: FrameworkManifest = { + framework: ['tools/**'], + operator: ['tools/git/**'], + }; + expect(resolveOwnership(subtree, 'tools/git/guard.sh')).toBe('operator'); + }); + it('framework-declared paths resolve to framework', () => { expect(resolveOwnership(m, 'guides/E2E-DELIVERY.md')).toBe('framework'); expect(resolveOwnership(m, 'CONSTITUTION.md')).toBe('framework'); diff --git a/packages/mosaic/src/framework/manifest.ts b/packages/mosaic/src/framework/manifest.ts index 056a03bd..33c1bea0 100644 --- a/packages/mosaic/src/framework/manifest.ts +++ b/packages/mosaic/src/framework/manifest.ts @@ -154,12 +154,25 @@ export function matchesAny(globs: readonly string[], relPath: string): boolean { return globs.some((g) => matchGlob(g, relPath)); } +/** + * Operator entries without wildcards are exact file carve-outs. Treating them + * as directory prefixes would let one bare entry hide an entire framework + * subtree from reconciliation and drift detection. Operator subtree ownership + * remains explicit through `dir/**`. + */ +function matchesOperatorGlob(glob: string, relPath: string): boolean { + const pattern = normalizeRel(glob); + if (pattern === '') return false; + if (!pattern.includes('*')) return normalizeRel(relPath) === pattern; + return matchGlob(pattern, relPath); +} + /** * Resolve ownership of a mosaic-home-relative path (deny-wins / fail-safe): * operator globs win, then framework globs, else operator by default. */ export function resolveOwnership(manifest: FrameworkManifest, relPath: string): Ownership { - if (matchesAny(manifest.operator, relPath)) return 'operator'; + if (manifest.operator.some((glob) => matchesOperatorGlob(glob, relPath))) return 'operator'; if (matchesAny(manifest.framework, relPath)) return 'framework'; return 'operator'; }