jason.woltje
e2ec927b1c
Co-authored-by: jason.woltje <jason@diversecanvas.com> Co-committed-by: jason.woltje <jason@diversecanvas.com>
304 lines
13 KiB
Bash
Executable File
304 lines
13 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# test-wake-reconcile.sh — RED-FIRST invariant harness for W5 (EPIC #892):
|
|
# the source-parity reconciler (reconcile.sh, A7).
|
|
#
|
|
# Each test asserts ONE CONVERGED-DESIGN invariant and is designed to go RED if
|
|
# that invariant regresses:
|
|
# R1 complete inventory -> PASS (exit 0) (§4/G3-i)
|
|
# R2 an OMITTED source (declared but unwatched) -> FLAG; the §4 vector
|
|
# cannot pass VACUOUSLY, and it is NOT silently green (§4/G3-i)
|
|
# R3 a required_sources omission -> FLAG (explicit lane-dependency form) (§4/G3-i)
|
|
# R4 a dangling watch reference -> FLAG (§4/G3-i)
|
|
# R5 an UNACCOUNTED source-state -> FLAGGED (found + non-zero exit) (§4/G3-ii)
|
|
# R6 pre-existing state at startup -> ENUMERATED into the durable store;
|
|
# a follow-up reconcile then reports 0 unaccounted (W4-division)
|
|
# R7 a source already reflected in the inbox -> ACCOUNTED (no double-
|
|
# enumeration of detector-delivered state) (§4/G3-ii)
|
|
# R8 a source adapter error -> FAIL LOUD (G2a parity; never 'no state') (§4/G2a)
|
|
# R9 co-feed NO-ALIAS: detector + reconciler share the ONE store-side
|
|
# observed_seq allocator, so co-feeding one store yields DISTINCT,
|
|
# contiguous seqs (no aliasing). Formerly the fail-closed dual-
|
|
# allocator refusal; #908 dissolves the hazard at the root. (§4/G3, #908)
|
|
#
|
|
# Uses FAKE/STUB sources only (no live network). Isolated per test.
|
|
# shellcheck disable=SC2030,SC2031
|
|
set -uo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
RECON="$SCRIPT_DIR/reconcile.sh"
|
|
STORE="$SCRIPT_DIR/store.sh"
|
|
DET="$SCRIPT_DIR/detector.sh"
|
|
|
|
command -v jq >/dev/null 2>&1 || {
|
|
echo "SKIP: jq not available" >&2
|
|
exit 0
|
|
}
|
|
|
|
TMP_ROOT="$(mktemp -d)"
|
|
trap 'rm -rf "$TMP_ROOT"' EXIT
|
|
|
|
FAILFILE="$TMP_ROOT/failures"
|
|
: >"$FAILFILE"
|
|
pass=0
|
|
fail_msg() {
|
|
echo " FAIL: $*" >&2
|
|
echo "x" >>"$FAILFILE"
|
|
}
|
|
ok() { pass=$((pass + 1)); }
|
|
|
|
fresh_state() {
|
|
local d="$TMP_ROOT/$1"
|
|
rm -rf "$d"
|
|
mkdir -p "$d"
|
|
printf '%s' "$d"
|
|
}
|
|
depth() { "$STORE" cursors | sed -n 's/pending_depth=//p'; }
|
|
|
|
# make_stub DIR — a source adapter reading $DIR/<kind>_<id> with optional .rc.
|
|
make_stub() {
|
|
local dir="$1"
|
|
cat >"$dir/adapter.sh" <<EOF
|
|
#!/usr/bin/env bash
|
|
set -u
|
|
kind="\$1"; id="\$2"; base="$dir/\${kind}_\${id}"; rc=0
|
|
[ -f "\$base.rc" ] && rc="\$(cat "\$base.rc")"
|
|
[ -f "\$base" ] && cat "\$base"
|
|
exit "\$rc"
|
|
EOF
|
|
chmod +x "$dir/adapter.sh"
|
|
}
|
|
|
|
echo "== R1: complete inventory -> PASS =="
|
|
(
|
|
WAKE_STATE_HOME="$(fresh_state r1)"
|
|
export WAKE_STATE_HOME
|
|
unset WAKE_AGENT
|
|
wl="$TMP_ROOT/r1.json"
|
|
cat >"$wl" <<'EOF'
|
|
{ "schema_version": 1,
|
|
"repos": [ { "id": "r1" }, { "id": "r2" } ],
|
|
"watches": [ { "lane": "L", "sources": [ { "kind": "repo", "id": "r1" }, { "kind": "repo", "id": "r2" } ] } ] }
|
|
EOF
|
|
export WAKE_WATCH_LIST="$wl"
|
|
out="$("$RECON" inventory 2>&1)"
|
|
rc=$?
|
|
[ "$rc" -eq 0 ] || fail_msg "R1: a complete inventory must PASS (exit 0) [$out]"
|
|
echo "$out" | grep -qi 'COMPLETE' || fail_msg "R1: a complete inventory must report COMPLETE [$out]"
|
|
) && ok
|
|
|
|
echo "== R2: OMITTED source -> FLAG (vacuous-pass prevented, not silently green) =="
|
|
(
|
|
WAKE_STATE_HOME="$(fresh_state r2)"
|
|
export WAKE_STATE_HOME
|
|
unset WAKE_AGENT
|
|
# r2 is DECLARED (operationally depended-on) but no watch covers it.
|
|
wl="$TMP_ROOT/r2.json"
|
|
cat >"$wl" <<'EOF'
|
|
{ "schema_version": 1,
|
|
"repos": [ { "id": "r1" }, { "id": "r2" } ],
|
|
"watches": [ { "lane": "L", "sources": [ { "kind": "repo", "id": "r1" } ] } ] }
|
|
EOF
|
|
export WAKE_WATCH_LIST="$wl"
|
|
out="$("$RECON" inventory 2>&1)"
|
|
rc=$?
|
|
[ "$rc" -ne 0 ] || fail_msg "R2: an omitted (declared-but-unwatched) source must FLAG (non-zero), not silently pass"
|
|
echo "$out" | grep -qi 'r2' || fail_msg "R2: the flag must name the omitted source r2 [$out]"
|
|
echo "$out" | grep -qi 'vacuous' || fail_msg "R2: the flag must state the vacuous-pass is prevented [$out]"
|
|
) && ok
|
|
|
|
echo "== R3: required_sources omission -> FLAG =="
|
|
(
|
|
WAKE_STATE_HOME="$(fresh_state r3)"
|
|
export WAKE_STATE_HOME
|
|
unset WAKE_AGENT
|
|
# The lane explicitly declares it depends on r1 AND r2, but only watches r1.
|
|
wl="$TMP_ROOT/r3.json"
|
|
cat >"$wl" <<'EOF'
|
|
{ "schema_version": 1,
|
|
"repos": [ { "id": "r1" }, { "id": "r2" } ],
|
|
"watches": [ { "lane": "L", "required_sources": [ "r1", "r2" ], "sources": [ { "kind": "repo", "id": "r1" } ] } ] }
|
|
EOF
|
|
export WAKE_WATCH_LIST="$wl"
|
|
out="$("$RECON" inventory 2>&1)"
|
|
rc=$?
|
|
[ "$rc" -ne 0 ] || fail_msg "R3: a required_sources omission must FLAG (non-zero)"
|
|
echo "$out" | grep -qi "requires source 'r2'" || fail_msg "R3: the flag must name the required-but-omitted source r2 [$out]"
|
|
) && ok
|
|
|
|
echo "== R4: dangling watch reference -> FLAG =="
|
|
(
|
|
WAKE_STATE_HOME="$(fresh_state r4)"
|
|
export WAKE_STATE_HOME
|
|
unset WAKE_AGENT
|
|
wl="$TMP_ROOT/r4.json"
|
|
cat >"$wl" <<'EOF'
|
|
{ "schema_version": 1,
|
|
"repos": [ { "id": "r1" } ],
|
|
"watches": [ { "lane": "L", "sources": [ { "kind": "repo", "id": "r1" }, { "kind": "repo", "id": "r9" } ] } ] }
|
|
EOF
|
|
export WAKE_WATCH_LIST="$wl"
|
|
out="$("$RECON" inventory 2>&1)"
|
|
rc=$?
|
|
[ "$rc" -ne 0 ] || fail_msg "R4: a dangling reference must FLAG (non-zero)"
|
|
echo "$out" | grep -qi 'dangling' || fail_msg "R4: the flag must state it is dangling [$out]"
|
|
) && ok
|
|
|
|
echo "== R5/R6: pre-existing state -> UNACCOUNTED flag + enumerated into store; re-run 0 =="
|
|
(
|
|
WAKE_STATE_HOME="$(fresh_state r56)"
|
|
export WAKE_STATE_HOME
|
|
unset WAKE_AGENT
|
|
stub="$TMP_ROOT/r56stub"
|
|
mkdir -p "$stub"
|
|
make_stub "$stub"
|
|
export WAKE_DETECTOR_SOURCE_CMD="$stub/adapter.sh"
|
|
# TWO pre-existing sources with content already present at startup.
|
|
printf 'PRE-EXISTING-1\n' >"$stub/repo_r1"
|
|
printf 'PRE-EXISTING-2\n' >"$stub/repo_r2"
|
|
wl="$TMP_ROOT/r56.json"
|
|
cat >"$wl" <<'EOF'
|
|
{ "schema_version": 1,
|
|
"repos": [ { "id": "r1" }, { "id": "r2" } ],
|
|
"watches": [ { "lane": "L", "sources": [ { "kind": "repo", "id": "r1" }, { "kind": "repo", "id": "r2" } ] } ] }
|
|
EOF
|
|
export WAKE_WATCH_LIST="$wl"
|
|
# Sole-feeder mode: no detector co-feeds this store (detector.sh is never run
|
|
# here), so enumeration is collision-safe once the operator asserts it.
|
|
export WAKE_RECONCILE_ALLOW_ENUMERATE=1
|
|
[ "$(depth)" = "0" ] || fail_msg "R5: store must start empty"
|
|
out="$("$RECON" reconcile 2>&1)"
|
|
rc=$?
|
|
[ "$rc" -ne 0 ] || fail_msg "R5: pre-existing unaccounted state must FLAG (non-zero) on first reconcile"
|
|
echo "$out" | grep -qi 'UNACCOUNTED=2' || fail_msg "R5: both pre-existing sources must be UNACCOUNTED [$out]"
|
|
# R6: enumerated into the durable store — one entry per pre-existing source.
|
|
[ "$(depth)" = "2" ] || fail_msg "R6: pre-existing state must be ENUMERATED into the store (depth 2), got $(depth)"
|
|
# A follow-up reconcile now finds everything accounted -> 0 unaccounted.
|
|
out2="$("$RECON" reconcile 2>&1)"
|
|
rc2=$?
|
|
[ "$rc2" -eq 0 ] || fail_msg "R6: a second reconcile must report 0 unaccounted (exit 0) [$out2]"
|
|
echo "$out2" | grep -qi 'UNACCOUNTED=0' || fail_msg "R6: second reconcile must be 0 unaccounted [$out2]"
|
|
[ "$(depth)" = "2" ] || fail_msg "R6: a clean reconcile must NOT re-enumerate (depth still 2), got $(depth)"
|
|
) && ok
|
|
|
|
echo "== R7: source already in the inbox -> ACCOUNTED (no double-enumeration) =="
|
|
(
|
|
WAKE_STATE_HOME="$(fresh_state r7)"
|
|
export WAKE_STATE_HOME
|
|
unset WAKE_AGENT
|
|
stub="$TMP_ROOT/r7stub"
|
|
mkdir -p "$stub"
|
|
make_stub "$stub"
|
|
export WAKE_DETECTOR_SOURCE_CMD="$stub/adapter.sh"
|
|
printf 'V0\n' >"$stub/repo_r1"
|
|
wl="$TMP_ROOT/r7.json"
|
|
cat >"$wl" <<'EOF'
|
|
{ "schema_version": 1,
|
|
"repos": [ { "id": "r1" } ],
|
|
"watches": [ { "lane": "L", "sources": [ { "kind": "repo", "id": "r1" } ] } ] }
|
|
EOF
|
|
export WAKE_WATCH_LIST="$wl"
|
|
# Detector baselines (silent) then observes a real delta -> pending inbox entry.
|
|
"$DET" poll-once >/dev/null 2>&1 || fail_msg "R7: detector baseline failed"
|
|
printf 'V1\n' >"$stub/repo_r1"
|
|
"$DET" poll-once >/dev/null 2>&1 || fail_msg "R7: detector delta failed"
|
|
[ "$(depth)" = "1" ] || fail_msg "R7: detector delta should leave one pending entry, got $(depth)"
|
|
# The source's CURRENT state IS the pending inbox entry -> ACCOUNTED, and the
|
|
# reconciler must NOT enumerate a duplicate.
|
|
out="$("$RECON" reconcile 2>&1)"
|
|
rc=$?
|
|
[ "$rc" -eq 0 ] || fail_msg "R7: state reflected in the inbox must be ACCOUNTED (exit 0) [$out]"
|
|
echo "$out" | grep -qi 'UNACCOUNTED=0' || fail_msg "R7: inbox-reflected state must be 0 unaccounted [$out]"
|
|
[ "$(depth)" = "1" ] || fail_msg "R7: reconciler must NOT double-enumerate inbox-reflected state (depth still 1), got $(depth)"
|
|
) && ok
|
|
|
|
echo "== R8: source adapter error -> FAIL LOUD (G2a; never 'no state') =="
|
|
(
|
|
WAKE_STATE_HOME="$(fresh_state r8)"
|
|
export WAKE_STATE_HOME
|
|
unset WAKE_AGENT
|
|
stub="$TMP_ROOT/r8stub"
|
|
mkdir -p "$stub"
|
|
make_stub "$stub"
|
|
export WAKE_DETECTOR_SOURCE_CMD="$stub/adapter.sh"
|
|
printf 'FORBIDDEN\n' >"$stub/repo_r1"
|
|
printf '3\n' >"$stub/repo_r1.rc" # adapter exits non-zero (403/partial class)
|
|
wl="$TMP_ROOT/r8.json"
|
|
cat >"$wl" <<'EOF'
|
|
{ "schema_version": 1,
|
|
"repos": [ { "id": "r1" } ],
|
|
"watches": [ { "lane": "L", "sources": [ { "kind": "repo", "id": "r1" } ] } ] }
|
|
EOF
|
|
export WAKE_WATCH_LIST="$wl"
|
|
out="$("$RECON" reconcile 2>&1)"
|
|
rc=$?
|
|
[ "$rc" -ne 0 ] || fail_msg "R8: a source error must FAIL LOUD (non-zero exit)"
|
|
echo "$out" | grep -qi 'FAIL LOUD' || fail_msg "R8: the source error must be loud [$out]"
|
|
[ "$(depth)" = "0" ] || fail_msg "R8: a failed observation must NOT enumerate anything, got depth $(depth)"
|
|
) && ok
|
|
|
|
echo "== R9: co-feed NO-ALIAS — detector + reconciler share ONE store allocator; every observed_seq distinct + gapless (#908 resolved) =="
|
|
(
|
|
WAKE_STATE_HOME="$(fresh_state r9)"
|
|
export WAKE_STATE_HOME
|
|
unset WAKE_AGENT WAKE_RECONCILE_ALLOW_ENUMERATE
|
|
stub="$TMP_ROOT/r9stub"
|
|
mkdir -p "$stub"
|
|
make_stub "$stub"
|
|
export WAKE_DETECTOR_SOURCE_CMD="$stub/adapter.sh"
|
|
# The reviewer's alpha/beta repro (formerly the dual-allocator ALIASING case).
|
|
printf 'ALPHA\n' >"$stub/repo_alpha"
|
|
printf 'BETA\n' >"$stub/repo_beta"
|
|
wl="$TMP_ROOT/r9.json"
|
|
cat >"$wl" <<'EOF'
|
|
{ "schema_version": 1,
|
|
"repos": [ { "id": "alpha" }, { "id": "beta" } ],
|
|
"watches": [ { "lane": "L", "sources": [ { "kind": "repo", "id": "alpha" }, { "kind": "repo", "id": "beta" } ] } ] }
|
|
EOF
|
|
export WAKE_WATCH_LIST="$wl"
|
|
|
|
# A DETECTOR is co-feeding this store. Under #908 both the detector and the
|
|
# reconciler allocate observed_seq from the ONE store cursor (store.sh enqueue,
|
|
# no --seq), so co-feeding is now SAFE — the reconciler ENUMERATES (no refusal),
|
|
# and no seq can be aliased. (The old guard failed closed here; that refusal is
|
|
# retired exactly to the extent the single allocator makes safe.)
|
|
"$DET" poll-once >/dev/null 2>&1 || fail_msg "R9: detector baseline failed"
|
|
# A real detector delta on alpha -> the store allocates observed_seq 1.
|
|
printf 'ALPHA2\n' >"$stub/repo_alpha"
|
|
"$DET" poll-once >/dev/null 2>&1 || fail_msg "R9: detector delta (alpha) failed"
|
|
[ "$(depth)" = "1" ] || fail_msg "R9: detector delta should enqueue exactly one entry, got depth $(depth)"
|
|
|
|
# The reconciler co-feeds the SAME store: beta is still unaccounted (its
|
|
# baseline was silent), so it enumerates beta -> the store allocates the NEXT
|
|
# seq (2), NOT a reissue of 1. alpha's current state is already in the inbox
|
|
# (accounted), so it is not double-enumerated.
|
|
out="$("$RECON" reconcile 2>&1)"
|
|
rc=$?
|
|
[ "$rc" -ne 0 ] || fail_msg "R9: pre-existing beta is unaccounted on this pass -> must FLAG (non-zero) [$out]"
|
|
echo "$out" | grep -qi 'UNACCOUNTED=1' || fail_msg "R9: only beta should be unaccounted (alpha is inbox-accounted) [$out]"
|
|
[ "$(depth)" = "2" ] || fail_msg "R9: reconciler must ENUMERATE beta into the co-fed store (depth 2), got $(depth)"
|
|
|
|
# A further detector delta on beta must allocate 3 — the unified allocator
|
|
# advances past the reconciler's seq, it can NEVER reissue/alias 1 or 2.
|
|
printf 'BETA2\n' >"$stub/repo_beta"
|
|
"$DET" poll-once >/dev/null 2>&1 || fail_msg "R9: detector delta (beta) failed"
|
|
|
|
# THE NO-ALIAS ASSERTION: every observed_seq across BOTH feeders is DISTINCT and
|
|
# the observed prefix is CONTIGUOUS/GAPLESS (1,2,3). Under the OLD two-allocator
|
|
# design the detector's private counter would have reissued a seq the reconciler
|
|
# already used, so this set would contain a duplicate (alias).
|
|
seqs="$("$STORE" drain | jq -r '.observed_seq' | sort -n | tr '\n' ' ')"
|
|
[ "$seqs" = "1 2 3 " ] || fail_msg "R9: co-fed observed_seqs must be distinct+gapless '1 2 3', got '$seqs' (a duplicate = the aliasing #908 dissolved)"
|
|
ndistinct="$("$STORE" drain | jq -r '.observed_seq' | sort -nu | grep -c .)"
|
|
ntotal="$("$STORE" drain | jq -r '.observed_seq' | grep -c .)"
|
|
[ "$ndistinct" = "$ntotal" ] || fail_msg "R9: aliasing detected — $ntotal entries but only $ndistinct distinct observed_seq"
|
|
# The contiguous-prefix CONSUMED contract holds over the co-fed seqs.
|
|
"$STORE" consume --upto 3 >/dev/null 2>&1 || fail_msg "R9: CONSUMED 3 must succeed over the gapless co-fed prefix"
|
|
) && ok
|
|
|
|
echo
|
|
if [ -s "$FAILFILE" ]; then
|
|
echo "wake reconcile harness: FAILED ($(grep -c . "$FAILFILE") assertion(s))" >&2
|
|
exit 1
|
|
fi
|
|
echo "wake reconcile harness: all invariants passed ($pass groups)"
|