mosaicstack/stack
1
0
Fork 0
Code Issues 85 Pull Requests Actions Packages Projects Releases 15 Wiki Activity
Files
9e81ffd7fc0f7ba95b08c9ee4e07d324e5a03aee
stack/packages/mosaic/framework/tools/wake/test-wake-install.sh
jason.woltje 17087efe15
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
Details
ci/woodpecker/push/ci Pipeline was successful
Details
fix(wake): #925 framework-ship canon fallback-wake (systemd timer + schema bound + A10 install/validate) — F7 out of the box (#931) 
Co-authored-by: jason.woltje <jason@diversecanvas.com>
Co-committed-by: jason.woltje <jason@diversecanvas.com>
2026-07-26 13:44:51 +00:00

435 lines
26 KiB
Bash
Executable File
Raw Blame History

#!/usr/bin/env bash
# test-wake-install.sh — RED-FIRST invariant harness for W7 (EPIC #892, A10): the
# idempotent, fail-closed wake COMPONENT INSTALLER (wake-install.sh) + the W6
# monitor-integration hardening in beacon.sh (folded-in observation set).
#
# Each group asserts ONE enforcement-path invariant and is designed to go RED if
# that invariant regresses (a targeted mutation to wake-install.sh / beacon.sh
# makes exactly its group fail):
# I1 idempotency — a second component install produces NO diff / no rewrite (i)
# I2 Gate A — a candidate the framework-manifest SSOT does not own is REFUSED,
# fail-closed, with NO partial write (the wake manifest authorizes nothing) (i)
# I3 blank-reset — the reset-line idiom collapses the cadence to EXACTLY ONE
# OnUnitActiveUSec; without it, two values leak (negative control) (iii)
# I4 snapshot-guard — a reap with NO prior snapshot is REFUSED (fail-closed);
# after a snapshot it is allowed (iv)
# I5 fail-closed install-validate — unconfigured HMAC key OR unconfigured/
# unreachable alarm target FAILS LOUD (non-zero); configured passes; and
# wake-install.sh inlines NO secret/endpoint (v)
# I6 reset->verify->retire lifecycle — overlap leaves the legacy timer running;
# only a §4-vector pass retires it, and only snapshot-guarded (iii)
# I7 ingested_ts staleness — staleness is computed from the monitor's
# receive-time, so a host shipping a FAR-FUTURE emit_ts STILL goes stale (vi-a)
# I8 beacon HMAC-verify at record — a spoofed (bad-sig) beacon is REJECTED (vi-b)
# (I7/I8 exercise the W6 monitor-integration hardening folded into beacon.sh; the
# same invariants are also asserted in depth by test-wake-beacon.sh B11/B12.)
#
# Isolated per-group XDG/systemd/target dirs; no live network, no operator queue,
# no real systemd manager touched (the blank-reset verify uses the deterministic
# merge simulation, which mirrors `systemctl show -p OnUnitActiveUSec`).
#
# SC2030/SC2031 disabled: each group runs in its own ( ) subshell and re-exports
# its env, so environments are isolated by design (same idiom as the W2-W6 harnesses).
# shellcheck disable=SC2030,SC2031
set -uo pipefail
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
WI="$SCRIPT_DIR/wake-install.sh"
BEACON="$SCRIPT_DIR/beacon.sh"
FRAMEWORK_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
command -v jq >/dev/null 2>&1 || { echo "SKIP: jq not available" >&2; exit 0; }
TMP_ROOT="$(mktemp -d)"
trap 'rm -rf "$TMP_ROOT"' EXIT
# Isolation default: no group may ever touch the operator's REAL user systemd dir
# (~/.config/systemd/user). The (b/#913) search-path link step defaults there, so
# pin an isolated per-run dir here; groups that need their own re-export it.
export WAKE_SYSTEMD_USER_DIR="$TMP_ROOT/systemd-user-default"
mkdir -p "$WAKE_SYSTEMD_USER_DIR"
FAILFILE="$TMP_ROOT/failures"
: >"$FAILFILE"
pass=0
fail_msg() { echo " FAIL: $*" >&2; echo "x" >>"$FAILFILE"; }
ok() { pass=$((pass + 1)); }
fresh() { local d="$TMP_ROOT/$1"; rm -rf "$d"; mkdir -p "$d"; printf '%s' "$d"; }
echo "== I1: idempotency — a second component install produces NO diff =="
(
TGT="$(fresh i1-target)"
export WAKE_INSTALL_SOURCE="$FRAMEWORK_ROOT"
export WAKE_INSTALL_TARGET="$TGT"
out1="$(bash "$WI" install 2>/dev/null)"
w1="$(echo "$out1" | sed -n 's/.*written=\([0-9]*\).*/\1/p')"
[ "${w1:-0}" -gt 0 ] || fail_msg "I1: first install must write the wake component (written=$w1)"
# Snapshot the installed tree, run again, and require byte-identical output.
cp1="$(fresh i1-copy)"; cp -a "$TGT/." "$cp1/"
out2="$(bash "$WI" install 2>/dev/null)"
w2="$(echo "$out2" | sed -n 's/.*written=\([0-9]*\).*/\1/p')"
[ "${w2:-1}" -eq 0 ] || fail_msg "I1: a re-run must write ZERO files (idempotent); got written=$w2"
if ! diff -r "$cp1" "$TGT" >/dev/null 2>&1; then
fail_msg "I1: second install changed the target tree (not idempotent)"
fi
) && ok
echo "== I2: Gate A — a non-framework-owned candidate is REFUSED (fail-closed, no partial write) =="
(
TGT="$(fresh i2-target)"
# A manifest that DE-AUTHORIZES the wake tools: tools/wake/** is operator-owned.
# The install MUST refuse the whole thing and write nothing (deny-wins).
BAD_MANIFEST="$TMP_ROOT/i2-manifest.txt"
cat >"$BAD_MANIFEST" <<'EOF'
[framework]
tools/**
systemd/**
defaults/**
[operator]
tools/wake/**
EOF
export WAKE_INSTALL_SOURCE="$FRAMEWORK_ROOT"
export WAKE_INSTALL_TARGET="$TGT"
export WAKE_INSTALL_MANIFEST="$BAD_MANIFEST"
out="$(bash "$WI" install 2>&1)"; rc=$?
[ "$rc" -ne 0 ] || fail_msg "I2: install must FAIL when a wake candidate is not framework-owned (got rc=$rc)"
echo "$out" | grep -qi 'Gate A VIOLATION' || fail_msg "I2: refusal must name the Gate A violation [$out]"
# No partial write: the target must have received NO wake tool file.
[ ! -e "$TGT/tools/wake/beacon.sh" ] || fail_msg "I2: a refused install must not have written any wake file (partial write leaked)"
# And the positive control: with the REAL manifest, the same candidates install.
unset WAKE_INSTALL_MANIFEST
bash "$WI" install >/dev/null 2>&1 || fail_msg "I2: install must SUCCEED under the real framework-manifest"
[ -f "$TGT/tools/wake/beacon.sh" ] || fail_msg "I2: real-manifest install must write the wake tools"
) && ok
echo "== I3: blank-reset — reset idiom yields EXACTLY ONE OnUnitActiveUSec (negative control leaks two) =="
(
UD="$(fresh i3-units)"
export WAKE_SYSTEMD_USER_DIR="$UD"
UNIT="mosaic-heartbeat@a.timer"
# Base unit already carries a cadence (the legacy value being superseded).
mkdir -p "$UD"
cat >"$UD/$UNIT" <<'EOF'
[Timer]
OnUnitActiveSec=15min
[Install]
WantedBy=timers.target
EOF
# Blank-reset drop-in: empty reset then the new value.
bash "$WI" blank-reset "$UD/$UNIT.d/interval.conf" "30min" >/dev/null 2>&1 \
|| fail_msg "I3: blank-reset drop-in write failed"
out="$(bash "$WI" verify-single "$UNIT" 2>&1)"; rc=$?
[ "$rc" -eq 0 ] || fail_msg "I3: blank-reset must resolve exactly one OnUnitActiveUSec (rc=$rc) [$out]"
echo "$out" | grep -qi 'EXACTLY ONE' || fail_msg "I3: verify must confirm exactly-one [$out]"
# NEGATIVE CONTROL: a drop-in WITHOUT the reset line appends -> TWO values -> fail.
cat >"$UD/$UNIT.d/interval.conf" <<'EOF'
[Timer]
OnUnitActiveSec=30min
EOF
out2="$(bash "$WI" verify-single "$UNIT" 2>&1)"; rc2=$?
[ "$rc2" -ne 0 ] || fail_msg "I3: without the reset line two cadences must leak (verify should FAIL) [$out2]"
) && ok
echo "== I4: snapshot-guard — reap without a snapshot is REFUSED; allowed after snapshot =="
(
UD="$(fresh i4-units)"; SNAP="$(fresh i4-snap)"
export WAKE_SYSTEMD_USER_DIR="$UD"
export WAKE_SNAPSHOT_DIR="$SNAP"
UNIT="mosaic-heartbeat@b.timer"
printf '[Timer]\nOnUnitActiveSec=10min\n' >"$UD/$UNIT"
# (a) reap WITHOUT snapshot -> refuse, unit still present.
out="$(bash "$WI" reap-unit "$UNIT" 2>&1)"; rc=$?
[ "$rc" -ne 0 ] || fail_msg "I4: reap without a snapshot must be REFUSED (rc=$rc)"
echo "$out" | grep -qi 'snapshot-guard' || fail_msg "I4: refusal must name the snapshot-guard [$out]"
[ -f "$UD/$UNIT" ] || fail_msg "I4: a refused reap must NOT delete the unit"
# (b) snapshot, then reap -> allowed, unit gone, snapshot retained.
bash "$WI" snapshot-unit "$UNIT" >/dev/null 2>&1 || fail_msg "I4: snapshot-unit failed"
bash "$WI" reap-unit "$UNIT" >/dev/null 2>&1 || fail_msg "I4: reap after snapshot must succeed"
[ ! -f "$UD/$UNIT" ] || fail_msg "I4: reap after snapshot must remove the unit"
[ -f "$SNAP/$UNIT" ] || fail_msg "I4: the snapshot must be retained after reap"
) && ok
echo "== I5: fail-closed install-validate — unconfigured HMAC/alarm FAIL LOUD; no secret inlined =="
(
H="$(fresh i5)"
CRED="$H/credentials.json"
export MOSAIC_CREDENTIALS_FILE="$CRED"
SECRET_KEY="s3cr3t-HMAC-DO-NOT-ECHO-xyz"
SECRET_ENDPOINT="https://monitor.invalid/alarm/DO-NOT-INLINE-abc123"
# --- HMAC key: absent store -> fail loud.
export WAKE_HMAC_KEY_NAME="primary"
out="$(bash "$WI" validate-hmac-key 2>&1)"; rc=$?
[ "$rc" -ne 0 ] || fail_msg "I5: missing credential store must FAIL LOUD for the HMAC key (rc=$rc)"
echo "$out" | grep -qi 'UNSIGNED' || fail_msg "I5: HMAC failure must warn about unsigned wakes [$out]"
# Now provide the key by-name -> pass, and the value must NEVER be echoed.
jq -cn --arg k "$SECRET_KEY" '{wake:{hmac_keys:{"primary":$k}}}' >"$CRED"
out2="$(bash "$WI" validate-hmac-key 2>&1)"; rc2=$?
[ "$rc2" -eq 0 ] || fail_msg "I5: a by-name-resolvable HMAC key must pass (rc=$rc2) [$out2]"
echo "$out2" | grep -qF "$SECRET_KEY" && fail_msg "I5: validate must NEVER echo the HMAC key material"
# --- alarm target: unconfigured -> fail loud (silent no-alarm host).
unset WAKE_ALARM_SINK_CMD
out3="$(bash "$WI" validate-alarm-target 2>&1)"; rc3=$?
[ "$rc3" -ne 0 ] || fail_msg "I5: unconfigured alarm target must FAIL LOUD (rc=$rc3)"
echo "$out3" | grep -qi 'silent no-alarm host' || fail_msg "I5: alarm failure must name the silent-no-alarm hazard [$out3]"
# unreachable -> fail loud.
export WAKE_ALARM_SINK_CMD="false"
out4="$(bash "$WI" validate-alarm-target 2>&1)"; rc4=$?
[ "$rc4" -ne 0 ] || fail_msg "I5: unreachable alarm sink must FAIL LOUD (rc=$rc4)"
echo "$out4" | grep -qi 'UNREACHABLE' || fail_msg "I5: alarm failure must name the unreachable target [$out4]"
# reachable -> pass.
export WAKE_ALARM_SINK_CMD="cat >/dev/null"
bash "$WI" validate-alarm-target >/dev/null 2>&1 || fail_msg "I5: a configured+reachable alarm sink must pass"
# The installer file must inline NO secret/endpoint.
grep -qF "$SECRET_ENDPOINT" "$WI" && fail_msg "I5: wake-install.sh must NOT inline any alarm endpoint"
grep -qE 'hmac_keys[^A-Za-z_].*=[^=].*[A-Za-z0-9]{8,}' "$WI" && fail_msg "I5: wake-install.sh must NOT inline key material"
true
) && ok
echo "== I6: reset->verify->retire — overlap keeps legacy running; only §4-vector pass retires =="
(
UD="$(fresh i6-units)"; SNAP="$(fresh i6-snap)"
export WAKE_SYSTEMD_USER_DIR="$UD"
export WAKE_SNAPSHOT_DIR="$SNAP"
TIMER="mosaic-heartbeat@c.timer"
printf '[Timer]\nOnUnitActiveSec=15min\n' >"$UD/$TIMER"
# F7 (#925): the vector-passed reap now REFUSES unless the canon FALLBACK WAKE is
# proven live (replacement-before-retirement). Provision it at the schedulable
# floor so the lifecycle path under test still reaches the reap. (I11 is the
# dedicated F7 refuse/allow control.)
cp "$FRAMEWORK_ROOT/systemd/user/mosaic-wake-fallback.timer" "$UD/mosaic-wake-fallback.timer"
cp "$FRAMEWORK_ROOT/systemd/user/mosaic-wake-fallback.service" "$UD/mosaic-wake-fallback.service"
# (a) overlap phase (NO --vector-passed): reset+verify, legacy LEFT RUNNING.
out="$(bash "$WI" reset-verify-retire c --interval 30min 2>&1)"; rc=$?
[ "$rc" -eq 0 ] || fail_msg "I6: overlap reset-verify must succeed (rc=$rc) [$out]"
[ -f "$UD/$TIMER" ] || fail_msg "I6: overlap phase must LEAVE the legacy timer running (retire withheld)"
[ -f "$SNAP/$TIMER" ] || fail_msg "I6: the legacy timer must be snapshotted before any retire"
echo "$out" | grep -qi 'LEFT RUNNING' || fail_msg "I6: overlap must announce retire is withheld [$out]"
# (b) §4-vector pass: retire LAST, snapshot-guarded (fallback proven live above).
out2="$(bash "$WI" reset-verify-retire c --interval 30min --vector-passed 2>&1)"; rc2=$?
[ "$rc2" -eq 0 ] || fail_msg "I6: vector-passed retire must succeed (rc=$rc2) [$out2]"
[ ! -f "$UD/$TIMER" ] || fail_msg "I6: on §4-vector pass the legacy timer must be RETIRED"
[ -f "$SNAP/$TIMER" ] || fail_msg "I6: the snapshot must survive the retire"
) && ok
# ── W6 monitor-integration hardening folded into beacon.sh (vi) ────────────────
echo "== I7: ingested_ts staleness — a far-future emit_ts still goes stale (receive-time governs) =="
(
H="$(fresh i7)"
export WAKE_BEACON_RECEIVED="$H/received.json"
export WAKE_ALARM_SINK_CMD="cat >$H/alarm.json"
now="$(date +%s)"
# Host lies with a far-future emit_ts; record stamps the monitor's ingested_ts.
jq -cn --argjson ts "$((now + 100000))" \
'{kind:"wake-beacon", beacon_seq:3, emit_ts:$ts, host_id:"h", independence:"off-host", degraded:false}' \
| bash "$BEACON" record
# Simulate the beacon having been received 100s ago (backdate ingested_ts only).
jq -c --argjson ing "$((now - 100))" '.ingested_ts = $ing' "$WAKE_BEACON_RECEIVED" >"$H/t" && mv "$H/t" "$WAKE_BEACON_RECEIVED"
out="$(bash "$BEACON" check --slo-seconds 5 2>&1)"; rc=$?
[ "$rc" -eq 1 ] || fail_msg "I7: far-future emit_ts must NOT defer staleness — receive-time governs (expected exit 1); got $rc [$out]"
) && ok
echo "== I8: beacon HMAC-verify at record — a spoofed (bad-sig) beacon is REJECTED =="
# #912: hard-require openssl in CI (Woodpecker sets CI=woodpecker) so the install
# beacon-sign leg is actually exercised; keep the skip for openssl-less local dev.
if ! command -v openssl >/dev/null 2>&1; then
if [ -n "${CI:-}" ]; then
echo " FAIL: I8 requires openssl in CI (#912) but it is not on PATH — the CI image must provide it" >&2
echo "x" >>"$FAILFILE"
else
echo "SKIP: openssl not available (local dev; CI hard-requires it)" >&2
fi
else
(
H="$(fresh i8)"
export WAKE_STATE_HOME="$H"
export MOSAIC_CREDENTIALS_FILE="$H/credentials.json"
export WAKE_BEACON_HMAC_KEY_NAME="beacon"
jq -cn --arg k "i8-hmac-key" '{wake:{hmac_keys:{"beacon":$k}}}' >"$MOSAIC_CREDENTIALS_FILE"
export WAKE_BEACON_INDEPENDENCE="off-host"
export WAKE_BEACON_SINK_CMD="cat >$H/shipped.json"
export WAKE_BEACON_RECEIVED="$H/received.json"
bash "$BEACON" emit >/dev/null 2>&1 || fail_msg "I8: signed emit must succeed"
bash "$BEACON" record <"$H/shipped.json" >/dev/null 2>&1 || fail_msg "I8: an authentic signed beacon must be accepted"
rm -f "$WAKE_BEACON_RECEIVED"
jq -c '.beacon_seq = 88888 | .host_id = "attacker"' "$H/shipped.json" >"$H/spoof.json"
out="$(bash "$BEACON" record <"$H/spoof.json" 2>&1)"; rc=$?
[ "$rc" -ne 0 ] || fail_msg "I8: a spoofed beacon must be REJECTED at record (rc=$rc) [$out]"
[ ! -s "$WAKE_BEACON_RECEIVED" ] || fail_msg "I8: a rejected spoof must NOT advance the dead-man clock"
) && ok
fi
# ── (a #913) missing _lib/manifest.sh dependency — FAIL LOUD, not a bare source error ──
echo "== I9: dep-check — a host seed missing _lib/manifest.sh FAILS LOUD (names dep + remedy), not a bare source error =="
(
# Simulate an OLDER host seed that predates the shared manifest reader: copy the
# framework tree the installer needs, but OMIT tools/_lib/manifest.sh. Running the
# copied wake-install.sh reproduces the adoption gap on a not-yet-updated host.
FAKE="$(fresh i9-fw)"
mkdir -p "$FAKE/tools/wake" "$FAKE/tools/_lib" "$FAKE/systemd/user"
cp "$FRAMEWORK_ROOT/tools/wake/"* "$FAKE/tools/wake/" 2>/dev/null || true
# Copy _lib EXCEPT manifest.sh — the exact file older seeds lack.
for f in "$FRAMEWORK_ROOT/tools/_lib/"*; do
[ -e "$f" ] || continue
case "$(basename "$f")" in manifest.sh) continue ;; esac
cp "$f" "$FAKE/tools/_lib/" 2>/dev/null || true
done
cp "$FRAMEWORK_ROOT/systemd/user/mosaic-wake.service" "$FAKE/systemd/user/" 2>/dev/null || true
cp "$FRAMEWORK_ROOT/framework-manifest.txt" "$FAKE/" 2>/dev/null || true
[ ! -e "$FAKE/tools/_lib/manifest.sh" ] || fail_msg "I9: fixture setup — manifest.sh must be absent to simulate an older seed"
WI_FAKE="$FAKE/tools/wake/wake-install.sh"
TGT="$(fresh i9-target)"
out="$(WAKE_INSTALL_SOURCE="$FAKE" WAKE_INSTALL_TARGET="$TGT" bash "$WI_FAKE" install 2>&1)"; rc=$?
[ "$rc" -ne 0 ] || fail_msg "I9: install MUST fail when _lib/manifest.sh is missing (rc=$rc)"
echo "$out" | grep -qi 'manifest.sh' || fail_msg "I9: the failure must NAME the missing library (manifest.sh) [$out]"
echo "$out" | grep -qiE 'REMEDY|mosaic update|re-seed|framework install' \
|| fail_msg "I9: the failure must give an actionable REMEDY, not just an error [$out]"
# It must be a CLEAR fail-loud, NOT the obscure bare `source: No such file or directory`.
echo "$out" | grep -qi 'No such file or directory' \
&& fail_msg "I9: must not fail with a bare source error (obscure) [$out]"
# Positive control: with the helper present (real framework root) install succeeds.
TGT_OK="$(fresh i9-target-ok)"
WAKE_INSTALL_SOURCE="$FRAMEWORK_ROOT" WAKE_INSTALL_TARGET="$TGT_OK" \
bash "$WI" install >/dev/null 2>&1 || fail_msg "I9: with _lib/manifest.sh present the install must succeed"
) && ok
# ── (b #913) mosaic-wake.service lands IN the user systemd search path + validates ──
echo "== I10: systemd search-path — install links mosaic-wake.service into the search path; validate catches a miss; idempotent =="
(
TGT="$(fresh i10-target)"
UD="$(fresh i10-systemd)" # isolated stand-in for ~/.config/systemd/user
export WAKE_INSTALL_SOURCE="$FRAMEWORK_ROOT"
export WAKE_INSTALL_TARGET="$TGT"
export WAKE_SYSTEMD_USER_DIR="$UD"
bash "$WI" install >/dev/null 2>&1 || fail_msg "I10: install must succeed"
# (a) the unit is resolvable in the user systemd search path.
[ -e "$UD/mosaic-wake.service" ] || fail_msg "I10: mosaic-wake.service must be linked into the user systemd search path ($UD)"
out="$(bash "$WI" validate-systemd-path 2>&1)"; rc=$?
[ "$rc" -eq 0 ] || fail_msg "I10: post-install validate must confirm the unit resolves (rc=$rc) [$out]"
# (b) NEGATIVE CONTROL: not-in-search-path is CAUGHT (fail loud, names the miss).
rm -f "$UD/mosaic-wake.service"
out2="$(bash "$WI" validate-systemd-path 2>&1)"; rc2=$?
[ "$rc2" -ne 0 ] || fail_msg "I10: validate must FAIL when the unit is not in the search path (rc=$rc2) [$out2]"
echo "$out2" | grep -qi 'search path' || fail_msg "I10: validate failure must name the search-path miss [$out2]"
# (c) idempotent re-install: exactly one search-path entry, still resolvable.
bash "$WI" install >/dev/null 2>&1 || fail_msg "I10: re-run install must succeed"
n="$(find "$UD" -maxdepth 1 -name 'mosaic-wake.service' | grep -c .)"
[ "$n" -eq 1 ] || fail_msg "I10: re-install must not duplicate the search-path entry (found $n)"
bash "$WI" validate-systemd-path >/dev/null 2>&1 || fail_msg "I10: re-install must keep the unit resolvable"
) && ok
# ── (#925) canon FALLBACK WAKE (F7 replacement-before-retirement) ──────────────
echo "== I11: F7 — the legacy reap REFUSES unless the canon fallback wake is proven live =="
(
UD="$(fresh i11-units)"; SNAP="$(fresh i11-snap)"
export WAKE_SYSTEMD_USER_DIR="$UD"
export WAKE_SNAPSHOT_DIR="$SNAP"
TIMER="mosaic-heartbeat@f.timer"
printf '[Timer]\nOnUnitActiveSec=15min\n' >"$UD/$TIMER"
# (a) fallback-proven-live is the F7 gate primitive: with NO fallback installed,
# it must REFUSE (schedulable floor not met).
out0="$(bash "$WI" fallback-proven-live 2>&1)"; rc0=$?
[ "$rc0" -ne 0 ] || fail_msg "I11: fallback-proven-live must FAIL when the fallback wake is not installed (rc=$rc0)"
echo "$out0" | grep -qi 'F7' || fail_msg "I11: the refusal must name the F7 precondition [$out0]"
# (b) NEGATIVE — vector-passed reap with NO live fallback must be REFUSED and the
# legacy timer LEFT RUNNING (never a coverage gap).
out="$(bash "$WI" reset-verify-retire f --interval 30min --vector-passed 2>&1)"; rc=$?
[ "$rc" -ne 0 ] || fail_msg "I11: reap must be REFUSED without a proven-live fallback (rc=$rc)"
echo "$out" | grep -qi 'FALLBACK WAKE is not proven live' || fail_msg "I11: refusal must name the un-proven fallback [$out]"
[ -f "$UD/$TIMER" ] || fail_msg "I11: a refused reap must LEAVE the legacy timer running (F7 — no coverage gap)"
# (c) POSITIVE — provision the fallback at the schedulable floor, then the reap
# proceeds (F7 satisfied) and the legacy timer is retired.
cp "$FRAMEWORK_ROOT/systemd/user/mosaic-wake-fallback.timer" "$UD/mosaic-wake-fallback.timer"
cp "$FRAMEWORK_ROOT/systemd/user/mosaic-wake-fallback.service" "$UD/mosaic-wake-fallback.service"
bash "$WI" fallback-proven-live >/dev/null 2>&1 || fail_msg "I11: fallback-proven-live must PASS once the fallback units are schedulable"
out2="$(bash "$WI" reset-verify-retire f --interval 30min --vector-passed 2>&1)"; rc2=$?
[ "$rc2" -eq 0 ] || fail_msg "I11: with a proven-live fallback the reap must succeed (rc=$rc2) [$out2]"
[ ! -f "$UD/$TIMER" ] || fail_msg "I11: with F7 satisfied the legacy timer must be RETIRED"
) && ok
echo "== I12: fallback drain — a STALLED detector still gets delivery via the canon fallback drain =="
(
H="$(fresh i12-state)"
export WAKE_STATE_HOME="$H"
unset WAKE_AGENT
STORE="$SCRIPT_DIR/store.sh"; DIGEST="$SCRIPT_DIR/digest.sh"
# A pending obligation lands in the durable inbox — but the detector daemon is
# STALLED/absent (we never run detector.sh). Enqueue directly to the store.
seq="$(bash "$STORE" enqueue --class digest \
--locators '{"kind":"repo","id":"STALLED-DRAIN-MARK","path":"BOARD.md","observed_hash":"deadbeef"}' 2>/dev/null)"
[ -n "$seq" ] || fail_msg "I12: store enqueue must allocate a seq"
# The canon fallback drain is EXACTLY the shipped unit's ExecStart: digest render
# --from-store. Firing it (as the timer would) must surface the pending obligation
# even with no detector running — no starvation of the drain.
out="$(bash "$DIGEST" render --from-store 2>/dev/null)"; rc=$?
[ "$rc" -eq 0 ] || fail_msg "I12: the canon fallback drain must exit 0 (rc=$rc)"
echo "$out" | grep -q 'STALLED-DRAIN-MARK' \
|| fail_msg "I12: the fallback drain must DELIVER the pending obligation a stalled detector left (no delivery starvation) [$out]"
# Bind the invariant to the SHIPPED unit: its ExecStart must be this canon drain.
UNIT="$FRAMEWORK_ROOT/systemd/user/mosaic-wake-fallback.service"
grep -qE '^ExecStart=.*digest\.sh render --from-store' "$UNIT" \
|| fail_msg "I12: mosaic-wake-fallback.service ExecStart must fire the canon drain (digest.sh render --from-store)"
) && ok
echo "== I13: install links + validates the canon fallback timer+service into the search path (idempotent) =="
(
TGT="$(fresh i13-target)"
UD="$(fresh i13-systemd)"
export WAKE_INSTALL_SOURCE="$FRAMEWORK_ROOT"
export WAKE_INSTALL_TARGET="$TGT"
export WAKE_SYSTEMD_USER_DIR="$UD"
bash "$WI" install >/dev/null 2>&1 || fail_msg "I13: install must succeed"
# (a) both fallback units resolve in the user systemd search path.
[ -e "$UD/mosaic-wake-fallback.timer" ] || fail_msg "I13: fallback timer must be linked into the search path"
[ -e "$UD/mosaic-wake-fallback.service" ] || fail_msg "I13: fallback service must be linked into the search path"
bash "$WI" validate-fallback-units >/dev/null 2>&1 || fail_msg "I13: validate-fallback-units must pass after install"
# (b) NEGATIVE CONTROL: a missing fallback unit is CAUGHT (fail loud, names the miss).
rm -f "$UD/mosaic-wake-fallback.timer"
out="$(bash "$WI" validate-fallback-units 2>&1)"; rc=$?
[ "$rc" -ne 0 ] || fail_msg "I13: validate must FAIL when a fallback unit is not in the search path (rc=$rc) [$out]"
echo "$out" | grep -qi 'search path' || fail_msg "I13: validate failure must name the search-path miss [$out]"
# (c) idempotent re-install: exactly one entry per unit, still resolvable.
bash "$WI" install >/dev/null 2>&1 || fail_msg "I13: re-run install must succeed"
nt="$(find "$UD" -maxdepth 1 -name 'mosaic-wake-fallback.timer' | grep -c .)"
ns="$(find "$UD" -maxdepth 1 -name 'mosaic-wake-fallback.service' | grep -c .)"
[ "$nt" -eq 1 ] && [ "$ns" -eq 1 ] || fail_msg "I13: re-install must not duplicate the fallback entries (timer=$nt service=$ns)"
bash "$WI" validate-fallback-units >/dev/null 2>&1 || fail_msg "I13: re-install must keep the fallback units resolvable"
) && ok
echo "== I14: per-class fallback cadence — blank-reset yields EXACTLY ONE OnUnitActiveUSec (negative control leaks two) =="
(
UD="$(fresh i14-units)"
export WAKE_SYSTEMD_USER_DIR="$UD"
TIMER="mosaic-wake-fallback.timer"
# The shipped timer carries the base OnUnitActiveSec placeholder (=1h).
cp "$FRAMEWORK_ROOT/systemd/user/$TIMER" "$UD/$TIMER"
grep -q '^OnUnitActiveSec=1h' "$UD/$TIMER" || fail_msg "I14: shipped fallback timer must carry a base OnUnitActiveSec placeholder"
# write-fallback-cadence writes the per-class cadence in BLANK-RESET form.
out="$(bash "$WI" write-fallback-cadence 30min 2>&1)"; rc=$?
[ "$rc" -eq 0 ] || fail_msg "I14: write-fallback-cadence must succeed + verify single (rc=$rc) [$out]"
echo "$out" | grep -qi 'exactly one' || fail_msg "I14: the cadence write must confirm exactly-one OnUnitActiveUSec [$out]"
[ -f "$UD/$TIMER.d/cadence.conf" ] || fail_msg "I14: the per-class cadence drop-in must be written under <timer>.d/"
# Assert the blank-reset FORM: an empty `OnUnitActiveSec=` reset line IMMEDIATELY
# FOLLOWED by the new value. Portable across GNU and BusyBox grep (Alpine CI) —
# `grep -z` (NUL-data) is a GNU-only extension BusyBox grep does NOT support, so
# match the reset line and require the value on the very next line (-A1) instead.
grep -A1 '^OnUnitActiveSec=$' "$UD/$TIMER.d/cadence.conf" | grep -qx 'OnUnitActiveSec=30min' \
|| fail_msg "I14: the drop-in must use the blank-reset form (empty reset line, then the value)"
bash "$WI" verify-single "$TIMER" >/dev/null 2>&1 || fail_msg "I14: base(1h)+blank-reset(30min) must resolve exactly one OnUnitActiveUSec"
# NEGATIVE CONTROL: a drop-in WITHOUT the reset line appends -> base 1h + 30min -> two -> fail.
printf '[Timer]\nOnUnitActiveSec=30min\n' >"$UD/$TIMER.d/cadence.conf"
out2="$(bash "$WI" verify-single "$TIMER" 2>&1)"; rc2=$?
[ "$rc2" -ne 0 ] || fail_msg "I14: without the reset line two cadences must leak (verify should FAIL) [$out2]"
) && ok
echo
if [ -s "$FAILFILE" ]; then
echo "wake install harness: FAILED ($(grep -c . "$FAILFILE") assertion(s))" >&2
exit 1
fi
echo "wake install harness: all invariants passed ($pass groups)"
Reference in New Issue View Git Blame Copy Permalink