Certify alpha7 compatibility candidates

test/exact_live_contract_test.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require "minitest/autorun"
+require_relative "../ruby/exact_live_contract"
+
+class ExactLiveContractTest < Minitest::Test
+  def test_accepts_only_exact_final_text
+    assert_nil OpenCodeCompat::ExactLiveContract.assert_final_text!("compat-ok", "compat-ok")
+
+    error = assert_raises(OpenCodeCompat::ExactLiveContract::ContractError) do
+      OpenCodeCompat::ExactLiveContract.assert_final_text!("compat-ok\n\ncompat-ok", "compat-ok")
+    end
+    assert_match(/equal/, error.message)
+
+    assert_raises(OpenCodeCompat::ExactLiveContract::ContractError) do
+      OpenCodeCompat::ExactLiveContract.assert_final_text!("prefix compat-ok", "compat-ok")
+    end
+  end
+
+  def test_accepts_only_one_model_request
+    assert_nil OpenCodeCompat::ExactLiveContract.assert_model_request_count!("1")
+
+    %w[0 2 not-a-number].each do |count|
+      assert_raises(OpenCodeCompat::ExactLiveContract::ContractError) do
+        OpenCodeCompat::ExactLiveContract.assert_model_request_count!(count)
+      end
+    end
+  end
+end

test/repository_test.rb

@@ -2,6 +2,7 @@
 
 require "json"
 require "minitest/autorun"
+require_relative "../lib/opencode_compat/runtime_tuple_promoter"
 
 class RepositoryTest < Minitest::Test
   ROOT = File.expand_path("..", __dir__)
@@ -42,9 +43,24 @@ class RepositoryTest < Minitest::Test
       assert_match %r{\Aghcr\.io/anomalyco/opencode@sha256:[0-9a-f]{64}\z}, target.fetch("image")
       refute_includes target.fetch("image"), ":latest"
       refute_empty target.fetch("profiles")
+      next unless target.fetch("certification_status") == "certified"
+
+      assert_match(/\A[0-9a-f]{40}\z/, target.fetch("certified_client_commit"))
+      assert_equal target.fetch("expected_text"), target.fetch("full_text")
+      assert_equal 1, target.fetch("llm_request_count")
     end
   end
 
+  def test_candidate_is_bound_to_an_annotated_tag
+    candidate = json("manifests/client-candidate.json")
+    provenance = candidate.fetch("tag_provenance")
+
+    assert_match(/\A[0-9a-f]{40}\z/, candidate.fetch("ref"))
+    assert_match(/\Av\d+\.\d+\.\d+\.alpha\d+\z/, provenance.fetch("tag"))
+    assert_match(/\A[0-9a-f]{40}\z/, provenance.fetch("annotated_tag_object"))
+    assert_equal candidate.fetch("ref"), provenance.fetch("peeled_commit")
+  end
+
   def test_certified_migration_keeps_previous_tuple
     tuples = json("manifests/runtime-tuples.json")
     return unless tuples.fetch("migration_state") == "certified"
@@ -68,6 +84,64 @@ class RepositoryTest < Minitest::Test
     end
   end
 
+  def test_runtime_tuples_use_full_commits_and_no_mutable_registry_coordinate
+    tuples = json("manifests/runtime-tuples.json")
+    tuples.fetch("consumers").each_value do |consumer|
+      %w[current candidate previous].each do |slot|
+        tuple = consumer[slot]
+        next unless tuple
+
+        assert_match(/\A[0-9a-f]{40}\z/, tuple.fetch("consumer_commit"))
+        %w[opencode_ruby opencode_rails].each do |client_name|
+          client = tuple[client_name]
+          assert_match(/\A[0-9a-f]{40}\z/, client.fetch("git_commit")) if client
+        end
+
+        runtime = tuple.fetch("runtime")
+        if runtime.key?("registry_ref")
+          assert_match(/\A[^@\s]+@sha256:[0-9a-f]{64}\z/, runtime.fetch("registry_ref"))
+        end
+        if runtime.key?("tag_provenance")
+          refute_empty runtime.fetch("tag_provenance")
+        end
+      end
+    end
+  end
+
+  def test_failed_alpha2_baselines_block_promotion_instead_of_becoming_previous
+    tuples = json("manifests/runtime-tuples.json")
+    readiness = tuples.fetch("promotion_readiness")
+
+    assert_equal "blocked", readiness.fetch("status")
+    assert_path_exists File.join(ROOT, readiness.fetch("evidence"))
+    tuples.fetch("consumers").each_value do |consumer|
+      assert_equal "observed-production-contract-failed", consumer.dig("current", "status")
+      assert_nil consumer.fetch("previous")
+    end
+  end
+
+  def test_candidate_evidence_is_bound_to_complete_tuple_fingerprints
+    promoter = OpenCodeCompat::RuntimeTuplePromoter.new(root: ROOT)
+    evidence_paths = {
+      "ajent-rails" => "evidence/2026-07-18-ajent-rails-alpha7-candidate.json",
+      "travelwolf" => "evidence/2026-07-18-travelwolf-alpha7-candidate.json",
+      "mushu" => "evidence/2026-07-18-mushu-alpha7-candidate.json"
+    }
+
+    evidence_paths.each do |consumer, path|
+      evidence = json(path)
+      fingerprints = promoter.fingerprints(
+        consumer: consumer,
+        consumer_commit: evidence.fetch("consumer_commit")
+      )
+
+      assert_equal consumer, evidence.fetch("consumer")
+      assert_equal fingerprints.fetch("profile"), evidence.fetch("profile")
+      assert_equal fingerprints.fetch("candidate_tuple_sha256"), evidence.fetch("tuple_sha256")
+      assert_equal "pass", evidence.fetch("status")
+    end
+  end
+
   def test_watcher_has_no_deployment_commands
     workflow = File.read(File.join(ROOT, ".github/workflows/watch-upstream.yml"))
     refute_match(/\b(kamal|kubectl|helm|nomad|docker\s+service)\b/i, workflow)
@@ -84,4 +158,14 @@ class RepositoryTest < Minitest::Test
     refute_match(/`[^`]+`/, implementation)
     refute_match(/\b(kamal|kubectl|helm|nomad|docker\s+service)\b/i, implementation)
   end
+
+  def test_live_contract_requires_exact_text_and_one_model_request
+    probe = File.read(File.join(ROOT, "ruby/live_probe.rb"))
+    runner = File.read(File.join(ROOT, "scripts/run_image_contract.sh"))
+
+    assert_includes probe, "ExactLiveContract.assert_final_text!"
+    refute_includes probe, "full_text.include?"
+    assert_includes runner, "exact_live_contract.rb"
+    refute_match(/request_count.*-lt\s+1/, runner)
+  end
 end

test/runtime_tuple_promoter_test.rb

@@ -155,6 +155,26 @@ class RuntimeTuplePromoterTest < Minitest::Test
     assert_equal before, File.binread(manifest_path)
   end
 
+  def test_rejects_known_failed_baseline_even_with_passing_evidence
+    manifest = valid_manifest
+    manifest.dig("consumers", CONSUMER, "current")["status"] = "observed-production-contract-failed"
+    write_manifest(manifest)
+    candidate, previous = write_matching_evidence
+    before = File.binread(manifest_path)
+
+    error = assert_raises(OpenCodeCompat::PromotionError) do
+      @promoter.promote(
+        consumer: CONSUMER,
+        consumer_commit: CANDIDATE_COMMIT,
+        certification: certification(CANDIDATE_TIME, candidate),
+        previous_certification: certification(CURRENT_TIME, previous)
+      )
+    end
+
+    assert_match(/known to fail/, error.message)
+    assert_equal before, File.binread(manifest_path)
+  end
+
   def test_rejects_evidence_that_does_not_match_the_complete_tuple
     candidate, previous = write_matching_evidence
     manifest = JSON.parse(File.read(manifest_path))
@@ -249,8 +269,8 @@ class RuntimeTuplePromoterTest < Minitest::Test
           "candidate" => {
             "status" => "compatibility-certified",
             "certified_at" => "2026-07-18T10:00:00Z",
-            "opencode_ruby" => {"version" => "0.0.1.alpha6", "git_commit" => RUBY_CANDIDATE},
-            "opencode_rails" => {"version" => "0.0.1.alpha6", "git_commit" => RAILS_CANDIDATE},
+            "opencode_ruby" => {"version" => "0.0.1.alpha7", "git_commit" => RUBY_CANDIDATE},
+            "opencode_rails" => {"version" => "0.0.1.alpha7", "git_commit" => RAILS_CANDIDATE},
             "runtime" => {"image" => CANDIDATE_IMAGE, "reported_version" => "1.18.3"}
           },
           "previous" => nil