fix(wake): #914 digest renderer — WAKE_AGENT-prefixed ack line + digest-class locator threading (#916)

Co-authored-by: jason.woltje <jason@diversecanvas.com>
Co-committed-by: jason.woltje <jason@diversecanvas.com>

packages/mosaic/framework/tools/wake/test-wake-digest-hmac.sh

@@ -19,6 +19,15 @@
 #   H2 KEY BY-NAME, NEVER INLINE: the key is resolved by NAME from the credential
 #      store; no flag accepts key material; the key never leaks into output; the
 #      same-uid threat boundary is documented.                           (§2.5)
+#   D5 (#914a) EMBEDDED ACK NAMESPACE: the copy-run ack line rendered at
+#      WAKE_AGENT=X render time targets X EXPLICITLY, so an env-less copy-run
+#      still resolves to the correct per-agent namespace (never silently
+#      falls back to `default`).                                         (§2.1/§2.2)
+#   D6 (#914b) DIGEST-CLASS LOCATOR THREADING: an ORIENTATION pointer for a
+#      digest-class entry (the shape detector.sh actually enqueues:
+#      kind/id/observed_hash/remote/path, not repo/issue/sha/file) carries a
+#      non-empty, usable locator — and the ACTIONABLE-tier hard-locator
+#      FAIL-LOUD (exit 4) is UNCHANGED for a malformed actionable claim.  (§2.1)
 #
 # Isolated: every test runs against a fresh temp state / credential file.
 set -uo pipefail
@@ -32,6 +41,7 @@ command -v jq >/dev/null 2>&1 || {
   echo "SKIP: jq not available" >&2
   exit 0
 }
+# NOTE: whole-suite openssl-skip retained; unmasking D1-D6 to run in CI is tracked in #912 (they currently fail under the CI env).
 command -v openssl >/dev/null 2>&1 || {
   echo "SKIP: openssl not available" >&2
   exit 0
@@ -297,6 +307,80 @@ echo "== H2: KEY BY-NAME, never inline; no key leak; same-uid boundary documente
   grep -qi 'off-uid' "$SIGN" || fail_msg "H2: off-uid future signer not named in sign.sh"
 ) && ok
 
+echo "== D5 (#914a): EMBEDDED ACK NAMESPACE — env-less copy-run targets the RENDER-TIME agent, not 'default' =="
+(
+  WAKE_STATE_HOME="$(fresh_state d5)"
+  export WAKE_STATE_HOME
+  # A pending obligation observed under the 'someagent' namespace (render-time
+  # WAKE_AGENT is known; the bug is that the EMBEDDED line forgets it).
+  WAKE_AGENT=someagent "$STORE" enqueue --seq 1 --class actionable --locators '{"repo":"r","issue":41}' >/dev/null
+  out="$(WAKE_AGENT=someagent "$DIGEST" render)" || fail_msg "D5: render (WAKE_AGENT=someagent) failed"
+  ack_line="$(printf '%s\n' "$out" | awk '/^-- ACK/{f=1;next} f && NF {print; exit}')"
+  [ -n "$ack_line" ] || fail_msg "D5: no embedded ack line extracted from the digest"
+  printf '%s' "$ack_line" | grep -q 'WAKE_AGENT=someagent' ||
+    fail_msg "D5: embedded ack line has no explicit WAKE_AGENT=someagent prefix — an env-less copy-run silently resolves to 'default' [$ack_line]"
+  # Actually RUN it with NO WAKE_AGENT in the environment (the real failure
+  # mode: a consumer copy-pastes the line into a fresh shell).
+  ( unset WAKE_AGENT; env -u WAKE_AGENT sh -c "$ack_line" >/dev/null 2>&1 )
+  rc=$?
+  [ "$rc" -eq 0 ] || fail_msg "D5: env-less copy-run of the embedded ack line exited non-zero (rc=$rc) [$ack_line]"
+  someagent_consumed="$(cat "$WAKE_STATE_HOME/someagent/consumed_seq" 2>/dev/null || echo '?')"
+  [ "$someagent_consumed" = "1" ] ||
+    fail_msg "D5: env-less copy-run did NOT advance the someagent namespace's consumed_seq (got '$someagent_consumed') — resolved to the wrong namespace"
+  # The 'default' namespace must stay untouched — no silent fallback.
+  if [ -f "$WAKE_STATE_HOME/default/consumed_seq" ]; then
+    default_consumed="$(cat "$WAKE_STATE_HOME/default/consumed_seq" 2>/dev/null || echo 0)"
+    [ "$default_consumed" = "0" ] || fail_msg "D5: env-less copy-run advanced the WRONG ('default') namespace instead of someagent"
+  fi
+
+  # --- injection-safety: a hostile agent value must not become a shell
+  # injection vector when the embedded line is later copy-run, and must be
+  # scrubbed (control/ANSI bytes stripped) like any other inlined value.
+  wd="$TMP_ROOT/d5-wd"
+  rm -rf "$wd"
+  mkdir -p "$wd"
+  WAKE_STATE_HOME2="$(fresh_state d5b)"
+  # shellcheck disable=SC2016 # deliberately literal: this is the injection
+  # payload under test, not an expression we want the test script to expand.
+  nasty='$(touch INJECTED)nasty'
+  WAKE_AGENT="$nasty" WAKE_STATE_HOME="$WAKE_STATE_HOME2" "$STORE" enqueue --seq 1 --class actionable --locators '{"repo":"r","issue":1}' >/dev/null
+  out2="$(WAKE_AGENT="$nasty" WAKE_STATE_HOME="$WAKE_STATE_HOME2" "$DIGEST" render)" || fail_msg "D5: render with a hostile agent value failed"
+  ack_line2="$(printf '%s\n' "$out2" | awk '/^-- ACK/{f=1;next} f && NF {print; exit}')"
+  ( cd "$wd" && unset WAKE_AGENT && env -u WAKE_AGENT WAKE_STATE_HOME="$WAKE_STATE_HOME2" sh -c "$ack_line2" >/dev/null 2>&1 )
+  [ -e "$wd/INJECTED" ] && fail_msg "D5: a hostile WAKE_AGENT value achieved shell injection via the embedded ack line [$ack_line2]"
+  true
+) && ok
+
+echo "== D6 (#914b): DIGEST-CLASS LOCATOR THREADING — ORIENTATION pointer carries its (soft) locator; ACTIONABLE hard-locator FAIL-LOUD unchanged =="
+(
+  WAKE_STATE_HOME="$(fresh_state d6)"
+  export WAKE_STATE_HOME
+  unset WAKE_AGENT WAKE_LANE
+  # The REAL shape store.sh receives for a digest-class entry, per detector.sh's
+  # own enqueue-building jq filter (kind/id/observed_hash + whichever of
+  # repo/path/anchor/remote/branches the source def declares) — NOT
+  # repo/issue/sha/file, which is what _locator_line originally recognized.
+  loc="$(jq -cn '{kind:"repo", id:"r1", observed_hash:"deadbeefcafe0123456789abcdef0123456789abcdef0123456789abcdef01", remote:"example/repo"}')"
+  "$STORE" enqueue --seq 1 --class digest --locators "$loc" >/dev/null
+  out="$("$DIGEST" render)" || fail_msg "D6: render failed"
+  orientline="$(printf '%s\n' "$out" | grep -E '^\s*\* seq 1 \[digest\]')"
+  [ -n "$orientline" ] || fail_msg "D6: no ORIENTATION line found for seq 1"
+  printf '%s' "$orientline" | grep -qE 'locator: *$' &&
+    fail_msg "D6: digest-class ORIENTATION pointer rendered an EMPTY locator despite a populated .locators field [$orientline]"
+  # Must surface something a consumer can act on to re-verify.
+  printf '%s' "$orientline" | grep -qE 'remote=example/repo|id=r1|kind=repo' ||
+    fail_msg "D6: digest-class ORIENTATION pointer does not carry a usable locator [$orientline]"
+
+  # --- ACTIONABLE-tier hard-locator FAIL-LOUD (exit 4) must be UNCHANGED ------
+  WAKE_STATE_HOME="$(fresh_state d6b)"
+  export WAKE_STATE_HOME
+  "$STORE" enqueue --seq 1 --class actionable --locators '{"claim":"mergeable=true"}' >/dev/null
+  rc=0
+  "$DIGEST" render >/dev/null 2>&1 || rc=$?
+  [ "$rc" -eq 4 ] ||
+    fail_msg "D6: actionable claim with no hard locator must still FAIL-LOUD exit 4 (got $rc) — regression in the unrelated hard-locator gate"
+) && ok
+
 echo
 if [ -s "$FAILFILE" ]; then
   echo "wake digest/hmac harness: FAILED ($(grep -c . "$FAILFILE") assertion(s))" >&2