92 lines
4.7 KiB
Bash
Executable File
92 lines
4.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
TMP="$(mktemp -d "${TMPDIR:-/tmp}/mosaic-expected-red-test.XXXXXX")"
|
|
trap 'rm -rf "$TMP"' EXIT
|
|
|
|
cat > "$TMP/match.log" <<'LOG'
|
|
[fixture] resolved lane=next package=@mosaicstack/mosaic@next version=0.0.50-next.999
|
|
[fixture] installer_exit=1 done_claims=0
|
|
[SECRET-CONTROL] PASS: seeded canary absent from complete scan population
|
|
[P0] PASS: target=mosaic uid=1001 HOME=/home/mosaic passwd_HOME=/home/mosaic shell=/bin/bash privilege=user arch=x86_64 libc=glibc node=v24.0.0 npm=10.6.2
|
|
[P1] PASS: preflight complete
|
|
[P2] PASS: pinned artifact
|
|
[P3] PASS: absolute_path=/home/test/.npm-global/bin/mosaic version=0.0.50-next.999 equals resolved lane version
|
|
[P4] FAIL: NOT-MEASURED / UNDECLARED: declaration absent
|
|
[P5] FAIL: identity absent
|
|
[P6] FAIL: runtime linking/activation action reported a required failure
|
|
[P7] PASS: no services requested
|
|
[P8] FAIL: shell path absent
|
|
[P9] FAIL: aggregate refusal
|
|
LOG
|
|
|
|
bash "$ROOT/tools/verify-greenfield-expected-red.sh" next-git-present "$TMP/match.log" 1 >/dev/null
|
|
printf '[test] PASS: matching detector findings make the CI verifier green\n'
|
|
|
|
sed 's/^\[P0\] PASS:.*/[P0] PASS: arbitrary unconditional success/' "$TMP/match.log" > "$TMP/vacuous-p0.log"
|
|
if bash "$ROOT/tools/verify-greenfield-expected-red.sh" next-git-present "$TMP/vacuous-p0.log" 1 >/dev/null 2>&1; then
|
|
echo '[test] FAIL: vacuous P0 PASS satisfied the expected-RED contract without identity/context evidence' >&2
|
|
exit 1
|
|
fi
|
|
printf '[test] PASS: P0 PASS must bind target identity, HOME, shell, privilege, architecture, and runtime reason\n'
|
|
|
|
sed 's/^\[P4\] FAIL:/[P4] PASS:/' "$TMP/match.log" > "$TMP/drift.log"
|
|
if bash "$ROOT/tools/verify-greenfield-expected-red.sh" next-git-present "$TMP/drift.log" 1 >/dev/null 2>&1; then
|
|
echo '[test] FAIL: changed P4 verdict did not invalidate the pinned manifest' >&2
|
|
exit 1
|
|
fi
|
|
printf '[test] PASS: changed phase verdict requires a deliberate manifest update\n'
|
|
|
|
if bash "$ROOT/tools/verify-greenfield-expected-red.sh" next-git-present "$TMP/match.log" 0 >/dev/null 2>&1; then
|
|
echo '[test] FAIL: unexpected fixture exit did not invalidate the pinned manifest' >&2
|
|
exit 1
|
|
fi
|
|
printf '[test] PASS: unexpected fixture exit remains blocking\n'
|
|
|
|
printf 'next-git-present\texit\t1\n' > "$TMP/shrunk.tsv"
|
|
if MOSAIC_EXPECTED_RED_MANIFEST="$TMP/shrunk.tsv" \
|
|
bash "$ROOT/tools/verify-greenfield-expected-red.sh" next-git-present "$TMP/match.log" 1 >/dev/null 2>&1; then
|
|
echo '[test] FAIL: one-row manifest shrink still certified the detector' >&2
|
|
exit 1
|
|
fi
|
|
printf '[test] PASS: manifest shrink cannot delete the structural contract\n'
|
|
|
|
manifest="$ROOT/tools/fixtures/greenfield-expected-red.tsv"
|
|
grep -v $'^next-git-present\tphase\tP8=' "$manifest" > "$TMP/missing-phase.tsv"
|
|
if MOSAIC_EXPECTED_RED_MANIFEST="$TMP/missing-phase.tsv" \
|
|
bash "$ROOT/tools/verify-greenfield-expected-red.sh" next-git-present "$TMP/match.log" 1 >/dev/null 2>&1; then
|
|
echo '[test] FAIL: missing P8 disposition was accepted' >&2; exit 1
|
|
fi
|
|
printf '[test] PASS: every case requires one P0-P9 disposition\n'
|
|
|
|
grep -v $'^next-git-present\tphase-reason\tP0=' "$manifest" > "$TMP/missing-p0-reason.tsv"
|
|
if MOSAIC_EXPECTED_RED_MANIFEST="$TMP/missing-p0-reason.tsv" \
|
|
bash "$ROOT/tools/verify-greenfield-expected-red.sh" next-git-present "$TMP/match.log" 1 >/dev/null 2>&1; then
|
|
echo '[test] FAIL: missing P0 reason binding was accepted' >&2; exit 1
|
|
fi
|
|
printf '[test] PASS: every case requires one discriminating P0 reason binding\n'
|
|
|
|
cp "$manifest" "$TMP/duplicate.tsv"
|
|
printf 'next-git-present\tphase\tP3=PASS\n' >> "$TMP/duplicate.tsv"
|
|
if MOSAIC_EXPECTED_RED_MANIFEST="$TMP/duplicate.tsv" \
|
|
bash "$ROOT/tools/verify-greenfield-expected-red.sh" next-git-present "$TMP/match.log" 1 >/dev/null 2>&1; then
|
|
echo '[test] FAIL: duplicate phase key was accepted' >&2; exit 1
|
|
fi
|
|
printf '[test] PASS: duplicate structural keys are rejected\n'
|
|
|
|
cp "$manifest" "$TMP/unknown-case.tsv"
|
|
printf 'invented-case\texit\t1\n' >> "$TMP/unknown-case.tsv"
|
|
if MOSAIC_EXPECTED_RED_MANIFEST="$TMP/unknown-case.tsv" \
|
|
bash "$ROOT/tools/verify-greenfield-expected-red.sh" next-git-present "$TMP/match.log" 1 >/dev/null 2>&1; then
|
|
echo '[test] FAIL: unknown case was accepted' >&2; exit 1
|
|
fi
|
|
printf '[test] PASS: unknown case rows are rejected\n'
|
|
|
|
cp "$manifest" "$TMP/unknown-kind.tsv"
|
|
printf 'next-git-present\toptional\tanything\n' >> "$TMP/unknown-kind.tsv"
|
|
if MOSAIC_EXPECTED_RED_MANIFEST="$TMP/unknown-kind.tsv" \
|
|
bash "$ROOT/tools/verify-greenfield-expected-red.sh" next-git-present "$TMP/match.log" 1 >/dev/null 2>&1; then
|
|
echo '[test] FAIL: unknown row kind was accepted' >&2; exit 1
|
|
fi
|
|
printf '[test] PASS: unknown manifest kinds are rejected\n'
|