82 lines
5.2 KiB
Plaintext
82 lines
5.2 KiB
Plaintext
#1050 C1 ROUND 5 — ARM COVERAGE + CHECKOUT PURITY
|
|
|
|
IDENTITY / SCOPE
|
|
- predecessor head: f33bd0da96bee3ce518744d6888d018bebb1c841
|
|
- branch: feat/1050-install-state-machine-red-fixture
|
|
- review inputs: be-coder-06 review 110; rev-security-02 review 111
|
|
- in scope: exact required pipeline-arm set including greenfield-remote-installer-contract; success-only arm marks; skipped-remote RED control; coverage-state exclusion from checkout source archives
|
|
- unchanged/fenced: tools/fixtures/greenfield-expected-red.tsv, tools/verify-greenfield-expected-red.sh, tools/e2e-install-test.sh, #869, and all per-case dispositions
|
|
- status: believed-fixed, pending jarvis validation
|
|
|
|
RED-FIRST — FOUR ARMS WERE REPRESENTED BY THREE CASES
|
|
The f33bd0d gate represented only the three expected-RED case identities. With all three case names marked and no remote-arm identity available, the production checker returned:
|
|
SKIPPED_REMOTE_ARM_CURRENT_GATE_RC=0
|
|
[fixture-suite] cases_defined=3 cases_executed=3
|
|
The fourth required arm, greenfield-remote-installer-contract, reused next-git-present and therefore could skip without changing case-set equality.
|
|
|
|
RED-FIRST — COVERAGE STATE CONTAMINATED CHECKOUT ARCHIVES
|
|
The f33bd0d workflow created .greenfield-case-state in the shared repository before the checkout-mode fixture arms. An independent reproduction using the exact e2e-install-test.sh tar exclusions created .greenfield-case-state/remote-arm.ran and measured:
|
|
OLD_STATE_ARCHIVE_MATCHES=1
|
|
The state instrument was therefore part of the checkout source payload it was intended only to observe.
|
|
|
|
IMPLEMENTATION
|
|
- Renamed the checker to tools/verify-greenfield-execution-coverage.sh and generalized it over two validated dimensions: cases and arms.
|
|
- Added tools/fixtures/greenfield-expected-arms.txt as the explicit required arm set:
|
|
greenfield-git-present
|
|
greenfield-main-git-present
|
|
greenfield-remote-installer-contract
|
|
greenfield-git-absent
|
|
- Expected cases remain derived from the unchanged expected-RED TSV. Expected arms are derived from the new one-name-per-line arm declaration. Both inputs allow comments/blanks and validate every resulting name.
|
|
- Each of the four fixture arms writes its unique arm marker only after its exact per-case verifier succeeds. The three distinct expected-RED cases continue to write case markers after successful verification.
|
|
- The final step checks both dimensions even when the first check fails, emits both denominators, and fails unless both exact name sets match.
|
|
- Coverage state moved to .mosaic-test-work/greenfield-execution-coverage/${CI_PIPELINE_NUMBER}-${CI_WORKFLOW_NUMBER}/{cases,arms}. The checkout archive already excludes every */.mosaic-test-work subtree.
|
|
- The expected-RED manifest, per-case verifier, and detector are untouched.
|
|
|
|
MEASURED SKIPPED-REMOTE CONTROL
|
|
With all three cases marked and only the three non-remote arms marked:
|
|
case gate rc=0
|
|
[fixture-suite] cases_defined=3 cases_executed=3
|
|
arm gate rc=1
|
|
[fixture-suite] arms_defined=4 arms_executed=3
|
|
[fixture-suite] missing_arm=greenfield-remote-installer-contract
|
|
This is the discriminating control: the case denominator remains green while the arm denominator catches the exact previously invisible skip.
|
|
|
|
OTHER DYNAMIC CONTROLS
|
|
- missing case: cases 3/2 => rc1
|
|
- case count inflation (one missing + one unexpected): cases 3/3 => rc1
|
|
- stale case markers after re-init: cases 3/0 => rc1
|
|
- exact case set: cases 3/3 => rc0
|
|
- future manifest case: cases 4/3 => rc1
|
|
- arm count inflation (remote missing + unexpected): arms 4/4 => rc1
|
|
- exact arm set: arms 4/4 => rc0
|
|
- production expected-RED manifest comments/blanks: accepted; exact set 3/3 => rc0
|
|
- archive selector firing control: a non-excluded root marker is present in the archive
|
|
- archive purity control: no .mosaic-test-work path is present in the archive
|
|
|
|
STATIC / STRUCTURAL CONTROLS
|
|
- every case mark follows that arm's successful per-case verifier
|
|
- every arm mark, including the remote contract, follows that arm's successful per-case verifier
|
|
- all four arms depend on coverage initialization
|
|
- final denominator depends on all four arms and is eligible after success or failure
|
|
- final denominator runs both checks and aggregates their statuses
|
|
- workflow contains the already-excluded .mosaic-test-work state root and no .greenfield-case-state reference
|
|
|
|
LOCAL BASELINES
|
|
- bash -n + ShellCheck on generalized checker/test: PASS
|
|
- pnpm test:installer: PASS, including execution-coverage controls
|
|
- pnpm typecheck: PASS, 45/45
|
|
- pnpm lint: PASS, 25/25
|
|
- pnpm format:check: PASS
|
|
- woodpecker-cli lint --strict: PASS
|
|
- git diff --check: PASS
|
|
- /home free before/after: 11G
|
|
|
|
INDEPENDENT REVIEW
|
|
- Codex code review: APPROVE, confidence 0.93, zero findings. It confirmed exact arm coverage, success-only marking, dual-status aggregation, excluded state, checkout-purity controls, and PRD alignment.
|
|
- Codex security review: risk NONE, confidence 0.96, zero findings. CI/path identifiers are constrained, expansions quoted, expected sets treated as data, and checks fail closed.
|
|
- Review sandboxes could not execute their own dynamic suite/ShellCheck because their filesystem is read-only; the local measured baselines above provide that evidence.
|
|
|
|
PENDING
|
|
- commit, queue guard, one push, attribution read-back
|
|
- announce the new full SHA; no merge or closure
|