test(fleet): cover reconciler lifecycle gates #786

2026-07-15T15:45:02Z

jason.woltje commented

2026-07-15 15:45:02 +00:00

Adds FCM-M3-002 isolated acceptance evidence for the local fleet reconciler.

Covers canonical roster-v2 named-socket lifecycle behavior through serialization, parsing, Commander, and a stateful fake runner.
Proves missing or empty roster-v2 tmux.socket_name fails closed.
Proves literal default-server behavior only through the legacy-v1 loader and runtime transport, with no -L argument.
Covers drift classification, unmanaged near-collision safety, and zero fuzzy destructive targeting.
Proves stopped-state preservation through apply/reconcile and bounded restart-failure recovery.
Covers truthful redacted partial-failure JSON and nonzero exit behavior.
Updates canonical task tracking and the card acceptance-evidence scratchpad.

No production source changed. All systemd/tmux lifecycle behavior is fake/injected; the legacy transport boundary uses an injected runner. No live fleet actions were performed.

Independent synthetic-tree review: VERIFIED APPROVE for exact tree 46cdfbcdc1d1ff9c7b8b2b9cf3841086590bf774.
Committed head: 58af3deb475b54cc4d606bd6b49a8e300b7b3206 with the identical reviewed tree.
Verification: focused 8 files / 304 tests; full package 57 files / 827 tests; package/root typecheck and lint; Prettier; diff check. Pre-push root typecheck, lint, and formatting also passed.

Relates to #758. Parent #758 remains open through M5.

🤖 Generated with Claude Code

Adds FCM-M3-002 isolated acceptance evidence for the local fleet reconciler. - Covers canonical roster-v2 named-socket lifecycle behavior through serialization, parsing, Commander, and a stateful fake runner. - Proves missing or empty roster-v2 `tmux.socket_name` fails closed. - Proves literal default-server behavior only through the legacy-v1 loader and runtime transport, with no `-L` argument. - Covers drift classification, unmanaged near-collision safety, and zero fuzzy destructive targeting. - Proves stopped-state preservation through apply/reconcile and bounded restart-failure recovery. - Covers truthful redacted partial-failure JSON and nonzero exit behavior. - Updates canonical task tracking and the card acceptance-evidence scratchpad. No production source changed. All systemd/tmux lifecycle behavior is fake/injected; the legacy transport boundary uses an injected runner. No live fleet actions were performed. Independent synthetic-tree review: `VERIFIED APPROVE` for exact tree `46cdfbcdc1d1ff9c7b8b2b9cf3841086590bf774`. Committed head: `58af3deb475b54cc4d606bd6b49a8e300b7b3206` with the identical reviewed tree. Verification: focused 8 files / 304 tests; full package 57 files / 827 tests; package/root typecheck and lint; Prettier; diff check. Pre-push root typecheck, lint, and formatting also passed. Relates to #758. Parent #758 remains open through M5. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jason.woltje added 1 commit 2026-07-15 15:45:03 +00:00

test(fleet): cover reconciler lifecycle gates

ci/woodpecker/pr/ci Pipeline was successful

Details

307b07d027

Co-Authored-By: Claude Opus 4.8 <[email protected]>

jason.woltje commented

2026-07-15 16:01:24 +00:00

REQUEST CHANGES — reviewer-of-record for PR #786 head 307b07d027

[BLOCKER] packages/mosaic/src/fleet/fleet-reconciler.acceptance.spec.ts:207-214 constructs a direct internal FleetRosterV2 fixture with socketName: "" and calls executeFleetReconcile, bypassing the canonical v2 roster and CLI boundary. Canonical parsing rejects that state: packages/mosaic/src/fleet/roster-v2.ts:461-480 requires non-empty tmux.socket_name, while packages/mosaic/src/commands/fleet-reconciler-command.ts:71-90 always parses canonical roster.yaml before reconciliation. Fresh isolated proof with renderRosterV2Yaml rejected the fixture: Roster v2 tmux socket_name is required and must be a non-empty string. Therefore the green matrix does not prove canonical v2 default-socket behavior and does not complete AC-FCM-05 / FCM-M3-002 acceptance evidence.

Bounded remediation: exercise the default-socket case through canonical roster serialization/parsing and the CLI boundary, making default-socket state representable in the v2 contract if it is required; otherwise reconcile the normative acceptance criterion/card and remove the unreachable claim.

Verified at the immutable target: remote PR head 307b07d0270743f1564742715166ffecc98f31dd, commit tree 3301cbb7620afe448820c097c7e993134271b314, direct base origin/main 499090508ef1d768660e4d54e7934cbcf13cb1cd; parent #758 remains open. Isolated gates passed: 3 files / 53 tests, @mosaicstack/mosaic typecheck, package lint, scoped Prettier, and git diff --check. Security/scope review found no live runner effects or secret leakage.

Residual risk: fake-runner coverage intentionally does not validate real systemd/tmux integration; that is acceptable under this card's no-live-effects constraint once all tested states are reachable from canonical input.

REQUEST CHANGES — reviewer-of-record for PR #786 head 307b07d0270743f1564742715166ffecc98f31dd [BLOCKER] `packages/mosaic/src/fleet/fleet-reconciler.acceptance.spec.ts:207-214` constructs a direct internal `FleetRosterV2` fixture with `socketName: ""` and calls `executeFleetReconcile`, bypassing the canonical v2 roster and CLI boundary. Canonical parsing rejects that state: `packages/mosaic/src/fleet/roster-v2.ts:461-480` requires non-empty `tmux.socket_name`, while `packages/mosaic/src/commands/fleet-reconciler-command.ts:71-90` always parses canonical `roster.yaml` before reconciliation. Fresh isolated proof with `renderRosterV2Yaml` rejected the fixture: `Roster v2 tmux socket_name is required and must be a non-empty string.` Therefore the green matrix does not prove canonical v2 default-socket behavior and does not complete AC-FCM-05 / FCM-M3-002 acceptance evidence. Bounded remediation: exercise the default-socket case through canonical roster serialization/parsing and the CLI boundary, making default-socket state representable in the v2 contract if it is required; otherwise reconcile the normative acceptance criterion/card and remove the unreachable claim. Verified at the immutable target: remote PR head `307b07d0270743f1564742715166ffecc98f31dd`, commit tree `3301cbb7620afe448820c097c7e993134271b314`, direct base `origin/main` `499090508ef1d768660e4d54e7934cbcf13cb1cd`; parent #758 remains open. Isolated gates passed: 3 files / 53 tests, `@mosaicstack/mosaic` typecheck, package lint, scoped Prettier, and `git diff --check`. Security/scope review found no live runner effects or secret leakage. Residual risk: fake-runner coverage intentionally does not validate real systemd/tmux integration; that is acceptable under this card's no-live-effects constraint once all tested states are reachable from canonical input.

jason.woltje added 1 commit 2026-07-15 16:36:05 +00:00

test(fleet): correct socket boundary coverage

ci/woodpecker/pr/ci Pipeline was successful

Details

58af3deb47

Co-Authored-By: Claude Opus 4.8 <[email protected]>

jason.woltje commented

2026-07-15 16:45:21 +00:00

VERIFIED APPROVE — reviewer-of-record for PR #786 head 58af3deb47

Independent read-only review found no surviving blocker against base 499090508e.

Evidence:

Immutable object gate: commit tree is exactly the approved synthetic tree 46cdfbcdc1d1ff9c7b8b2b9cf3841086590bf774; merge-base is exactly 499090508e.
Scope gate: exactly three files changed — docs/TASKS.md, docs/scratchpads/758-fcm-m3-002-reconciler-lifecycle-gates.md, and packages/mosaic/src/fleet/fleet-reconciler.acceptance.spec.ts. No production source/configuration changed.
Prior blocker 17596 is correctly remediated. Canonical v2 YAML is rendered, loaded through Commander fleet status, parsed by the production v2 parser, and observed tmux calls are exactly -L mosaic-fleet; missing and empty canonical v2 tmux.socket_name both fail closed with the production parser error.
Literal default-server proof is now reachable only through an actual on-disk legacy-v1 roster with omitted socket_name, production loadFleetRoster, FleetTmuxRuntimeTransport.verifySession, and an injected fake runner; the exact runner call contains no -L.
Production-boundary trace confirms v2 socketName flows serialization → parseRosterV2 → Commander/reconciler → tmux argument construction, while legacy-v1 omission normalizes to '' and socketArgs('') emits no selector.
Read-only/adversarial gates passed: focused fleet suite 7 files / 297 tests; full @mosaicstack/mosaic suite 57 files / 827 tests; package typecheck; package lint; scoped Prettier; git diff --check.
Live-effects gate: acceptance paths use injected fake runners and temporary files only. No real systemctl/tmux/runtime/deployment action was invoked.
Parent #758 was rechecked open and must remain open through M5.

Residual boundary: fake-runner coverage intentionally does not prove host integration; that is acceptable for this no-live-effects acceptance card. This reviewer approval is review evidence only and does not authorize merge by itself.

VERIFIED APPROVE — reviewer-of-record for PR #786 head 58af3deb475b54cc4d606bd6b49a8e300b7b3206 Independent read-only review found no surviving blocker against base 499090508ef1d768660e4d54e7934cbcf13cb1cd. Evidence: - Immutable object gate: commit tree is exactly the approved synthetic tree 46cdfbcdc1d1ff9c7b8b2b9cf3841086590bf774; merge-base is exactly 499090508ef1d768660e4d54e7934cbcf13cb1cd. - Scope gate: exactly three files changed — docs/TASKS.md, docs/scratchpads/758-fcm-m3-002-reconciler-lifecycle-gates.md, and packages/mosaic/src/fleet/fleet-reconciler.acceptance.spec.ts. No production source/configuration changed. - Prior blocker 17596 is correctly remediated. Canonical v2 YAML is rendered, loaded through Commander `fleet status`, parsed by the production v2 parser, and observed tmux calls are exactly `-L mosaic-fleet`; missing and empty canonical v2 `tmux.socket_name` both fail closed with the production parser error. - Literal default-server proof is now reachable only through an actual on-disk legacy-v1 roster with omitted socket_name, production `loadFleetRoster`, `FleetTmuxRuntimeTransport.verifySession`, and an injected fake runner; the exact runner call contains no `-L`. - Production-boundary trace confirms v2 socketName flows serialization → parseRosterV2 → Commander/reconciler → tmux argument construction, while legacy-v1 omission normalizes to `''` and `socketArgs('')` emits no selector. - Read-only/adversarial gates passed: focused fleet suite 7 files / 297 tests; full @mosaicstack/mosaic suite 57 files / 827 tests; package typecheck; package lint; scoped Prettier; `git diff --check`. - Live-effects gate: acceptance paths use injected fake runners and temporary files only. No real systemctl/tmux/runtime/deployment action was invoked. - Parent #758 was rechecked open and must remain open through M5. Residual boundary: fake-runner coverage intentionally does not prove host integration; that is acceptable for this no-live-effects acceptance card. This reviewer approval is review evidence only and does not authorize merge by itself.

jason.woltje merged commit c1aecfabe9 into main

2026-07-15 16:46:14 +00:00

jason.woltje referenced this issue from a commit

2026-07-15 16:46:16 +00:00

test(fleet): cover reconciler lifecycle gates (#786)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#786