ajaynomics/opencode-compat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: ajaynomics:fix/gitea-candidate-prepare-ruby-20260720
Branches Tags
ajaynomics:main ajaynomics:fix/gitea-candidate-prepare-ruby-20260720 ajaynomics:chore/final-recertification-20260718 ajaynomics:certify/alpha7-runtime-tuples ajaynomics:feature/runtime-tuple-promotion
..
compare: ajaynomics:chore/final-recertification-20260718
Branches Tags
ajaynomics:main ajaynomics:fix/gitea-candidate-prepare-ruby-20260720 ajaynomics:chore/final-recertification-20260718 ajaynomics:certify/alpha7-runtime-tuples ajaynomics:feature/runtime-tuple-promotion

1 Commits
fix/gitea- ... chore/fina

Author SHA1 Message Date
Ajay Krishnan
0d0ab1f23f Harden runtime tuple recertification policy 2026-07-18 16:46:56 -07:00
42 changed files with 1930 additions and 3051 deletions
Expand all files Collapse all files

309
.github/workflows/candidate.yml vendored
View File

@@ -6,205 +6,67 @@ on:
pull_request:
branches: [main]
workflow_dispatch:
permissions:
contents: read
inputs:
opencode_ruby_ref:
description: Candidate opencode-ruby ref; blank uses the manifest
required: false
type: string
jobs:
repository:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1
- uses: actions/checkout@v4
- uses: ruby/setup-ruby@v1
with:
ruby-version: "3.4"
- run: |
ruby test/repository_test.rb
ruby test/runtime_tuple_promoter_test.rb
ruby test/exact_live_contract_test.rb
ruby test/watcher_test.rb
ruby test/client_candidate_test.rb
ruby test/lockstep_client_contract_test.rb
ruby test/matrix_json_test.rb
ruby test/image_contract_evidence_test.rb
- run: ruby test/repository_test.rb && ruby test/runtime_tuple_promoter_test.rb && ruby test/exact_live_contract_test.rb
prepare:
runs-on: ubuntu-latest
outputs:
matrix: ${{ steps.matrix.outputs.value }}
publication_state: ${{ steps.clients.outputs.publication_state }}
ruby_provenance_kind: ${{ steps.clients.outputs.ruby_provenance_kind }}
ruby_ref: ${{ steps.clients.outputs.ruby_ref }}
ruby_version: ${{ steps.clients.outputs.ruby_version }}
ruby_tag: ${{ steps.clients.outputs.ruby_tag }}
ruby_tag_object: ${{ steps.clients.outputs.ruby_tag_object }}
rails_provenance_kind: ${{ steps.clients.outputs.rails_provenance_kind }}
rails_ref: ${{ steps.clients.outputs.rails_ref }}
rails_version: ${{ steps.clients.outputs.rails_version }}
rails_tag: ${{ steps.clients.outputs.rails_tag }}
rails_tag_object: ${{ steps.clients.outputs.rails_tag_object }}
client_ref: ${{ steps.client.outputs.value }}
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1
with:
ruby-version: "3.4"
- uses: actions/checkout@v4
- id: matrix
run: echo "value=$(ruby scripts/matrix_json.rb)" >> "$GITHUB_OUTPUT"
- id: clients
run: ruby scripts/client_candidate_outputs.rb >> "$GITHUB_OUTPUT"
- id: client
env:
INPUT_REF: ${{ inputs.opencode_ruby_ref }}
run: |
if [ -n "$INPUT_REF" ]; then
echo "value=$INPUT_REF" >> "$GITHUB_OUTPUT"
else
echo "value=$(jq -r .ref manifests/client-candidate.json)" >> "$GITHUB_OUTPUT"
fi
fixture-contract:
needs: prepare
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: actions/checkout@v4
- uses: actions/checkout@v4
with:
repository: ajaynomics/opencode-ruby
ref: ${{ needs.prepare.outputs.ruby_ref }}
path: ruby-client
- uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1
ref: ${{ needs.prepare.outputs.client_ref }}
path: client
- uses: ruby/setup-ruby@v1
with:
ruby-version: "3.4"
bundler-cache: ${{ github.server_url == 'https://github.com' }}
working-directory: ruby-client
- name: Install candidate dependencies without the unavailable Gitea cache service
if: github.server_url != 'https://github.com'
working-directory: ruby-client
env:
BUNDLE_APP_CONFIG: ${{ runner.temp }}/opencode-ruby-fixture-bundle-config
BUNDLE_PATH: ${{ runner.temp }}/opencode-ruby-fixture-bundle
run: |
echo "BUNDLE_APP_CONFIG=$BUNDLE_APP_CONFIG" >> "$GITHUB_ENV"
echo "BUNDLE_PATH=$BUNDLE_PATH" >> "$GITHUB_ENV"
bundle install --jobs 4 --retry 3
- id: client-sha
name: Verify immutable Ruby candidate checkout
env:
EXPECTED_CLIENT_SHA: ${{ needs.prepare.outputs.ruby_ref }}
run: |
actual_client_sha="$(git -C ruby-client rev-parse HEAD)"
test "$actual_client_sha" = "$EXPECTED_CLIENT_SHA"
echo "value=$actual_client_sha" >> "$GITHUB_OUTPUT"
bundler-cache: true
working-directory: client
- name: Candidate unit tests
working-directory: ruby-client
working-directory: client
run: bundle exec rake test
- name: Shared fixture contract
working-directory: ruby-client
working-directory: client
env:
OPENCODE_RUBY_PATH: ${{ github.workspace }}/ruby-client
OPENCODE_RUBY_COMMIT: ${{ steps.client-sha.outputs.value }}
OPENCODE_COMPAT_EVIDENCE_PATH: ${{ github.workspace }}/.compat-evidence/ruby-fixtures.json
OPENCODE_COMPAT_RUN_ID: ${{ github.run_id }}
OPENCODE_COMPAT_RUN_ATTEMPT: ${{ github.run_attempt }}
OPENCODE_COMPAT_HEAD_SHA: ${{ github.sha }}
OPENCODE_COMPAT_REPOSITORY: ${{ github.repository }}
OPENCODE_COMPAT_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
run: |
mkdir -p ../.compat-evidence
bundle exec ruby ../ruby/opencode_ruby_fixture_contract.rb
- name: Upload fixture evidence
if: always() && github.server_url == 'https://github.com'
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: ruby-fixtures-${{ github.run_id }}-${{ github.run_attempt }}
path: .compat-evidence/ruby-fixtures.json
include-hidden-files: true
if-no-files-found: warn
retention-days: 30
- name: State the Gitea evidence boundary
if: always() && github.server_url != 'https://github.com'
run: echo "Gitea executed the fixture contract, but this forge has no supported immutable artifact upload; generated JSON is transient and is not review evidence."
lockstep-client-contract:
needs: prepare
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
ruby: ["3.2", "3.3", "3.4", "4.0"]
name: lockstep clients Ruby ${{ matrix.ruby }}
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
repository: ajaynomics/opencode-ruby
ref: ${{ needs.prepare.outputs.ruby_ref }}
path: ruby-client
fetch-depth: 0
fetch-tags: true
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
repository: ajaynomics/opencode-rails
ref: ${{ needs.prepare.outputs.rails_ref }}
path: opencode-rails
fetch-depth: 0
fetch-tags: true
- uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1
with:
ruby-version: ${{ matrix.ruby }}
bundler-cache: ${{ github.server_url == 'https://github.com' }}
working-directory: opencode-rails
- name: Install candidate dependencies without the unavailable Gitea cache service
if: github.server_url != 'https://github.com'
working-directory: opencode-rails
env:
BUNDLE_APP_CONFIG: ${{ runner.temp }}/opencode-rails-${{ matrix.ruby }}-bundle-config
BUNDLE_PATH: ${{ runner.temp }}/opencode-rails-${{ matrix.ruby }}-bundle
run: |
echo "BUNDLE_APP_CONFIG=$BUNDLE_APP_CONFIG" >> "$GITHUB_ENV"
echo "BUNDLE_PATH=$BUNDLE_PATH" >> "$GITHUB_ENV"
bundle install --jobs 4 --retry 3
- name: Verify immutable candidate checkouts
env:
EXPECTED_RUBY_SHA: ${{ needs.prepare.outputs.ruby_ref }}
EXPECTED_RAILS_SHA: ${{ needs.prepare.outputs.rails_ref }}
run: |
test "$(git -C ruby-client rev-parse HEAD)" = "$EXPECTED_RUBY_SHA"
test "$(git -C opencode-rails rev-parse HEAD)" = "$EXPECTED_RAILS_SHA"
- name: Rails candidate unit tests
working-directory: opencode-rails
run: bundle exec rake test
- name: Lockstep client provenance contract
working-directory: opencode-rails
env:
OPENCODE_RUBY_PATH: ${{ github.workspace }}/ruby-client
OPENCODE_RAILS_PATH: ${{ github.workspace }}/opencode-rails
OPENCODE_CLIENT_PUBLICATION_STATE: ${{ needs.prepare.outputs.publication_state }}
OPENCODE_RUBY_COMMIT: ${{ needs.prepare.outputs.ruby_ref }}
OPENCODE_RUBY_PROVENANCE_KIND: ${{ needs.prepare.outputs.ruby_provenance_kind }}
OPENCODE_RUBY_TAG: ${{ needs.prepare.outputs.ruby_tag }}
OPENCODE_RUBY_TAG_OBJECT: ${{ needs.prepare.outputs.ruby_tag_object }}
OPENCODE_RAILS_COMMIT: ${{ needs.prepare.outputs.rails_ref }}
OPENCODE_RAILS_PROVENANCE_KIND: ${{ needs.prepare.outputs.rails_provenance_kind }}
OPENCODE_RAILS_TAG: ${{ needs.prepare.outputs.rails_tag }}
OPENCODE_RAILS_TAG_OBJECT: ${{ needs.prepare.outputs.rails_tag_object }}
OPENCODE_RUBY_VERSION: ${{ needs.prepare.outputs.ruby_version }}
OPENCODE_RAILS_VERSION: ${{ needs.prepare.outputs.rails_version }}
OPENCODE_COMPAT_EVIDENCE_PATH: ${{ github.workspace }}/.compat-evidence/lockstep-ruby-${{ matrix.ruby }}.json
OPENCODE_COMPAT_RUN_ID: ${{ github.run_id }}
OPENCODE_COMPAT_RUN_ATTEMPT: ${{ github.run_attempt }}
OPENCODE_COMPAT_HEAD_SHA: ${{ github.sha }}
OPENCODE_COMPAT_REPOSITORY: ${{ github.repository }}
OPENCODE_COMPAT_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
run: |
mkdir -p ../.compat-evidence
bundle exec ruby ../ruby/lockstep_client_contract.rb
- name: Upload lockstep evidence
if: always() && github.server_url == 'https://github.com'
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: lockstep-ruby-${{ matrix.ruby }}-${{ github.run_id }}-${{ github.run_attempt }}
path: .compat-evidence/lockstep-ruby-${{ matrix.ruby }}.json
include-hidden-files: true
if-no-files-found: warn
retention-days: 30
- name: State the Gitea evidence boundary
if: always() && github.server_url != 'https://github.com'
run: echo "Gitea executed the lockstep client contract, but this forge has no supported immutable artifact upload; generated JSON is transient and is not review evidence."
OPENCODE_RUBY_PATH: ${{ github.workspace }}/client
OPENCODE_RUBY_COMMIT: ${{ needs.prepare.outputs.client_ref }}
run: bundle exec ruby ../ruby/opencode_ruby_fixture_contract.rb
exact-image-contract:
if: github.server_url == 'https://github.com'
needs: prepare
runs-on: ubuntu-latest
strategy:
@@ -212,109 +74,20 @@ jobs:
matrix: ${{ fromJSON(needs.prepare.outputs.matrix) }}
name: image ${{ matrix.id }}
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: actions/checkout@v4
- uses: actions/checkout@v4
with:
repository: ajaynomics/opencode-ruby
ref: ${{ needs.prepare.outputs.ruby_ref }}
path: ruby-client
- uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1
ref: ${{ needs.prepare.outputs.client_ref }}
path: client
- uses: ruby/setup-ruby@v1
with:
ruby-version: "3.4"
- name: Install candidate dependencies outside the checkout
working-directory: ruby-client
env:
BUNDLE_APP_CONFIG: ${{ runner.temp }}/opencode-ruby-bundle-config
BUNDLE_PATH: ${{ runner.temp }}/opencode-ruby-bundle
run: bundle install --jobs 4 --retry 3
- id: client-sha
name: Verify immutable Ruby candidate checkout
env:
EXPECTED_CLIENT_SHA: ${{ needs.prepare.outputs.ruby_ref }}
run: |
actual_client_sha="$(git -C ruby-client rev-parse HEAD)"
test "$actual_client_sha" = "$EXPECTED_CLIENT_SHA"
echo "value=$actual_client_sha" >> "$GITHUB_OUTPUT"
bundler-cache: true
working-directory: client
- name: Exercise complete REST and SSE turn
env:
BUNDLE_GEMFILE: ${{ github.workspace }}/ruby-client/Gemfile
BUNDLE_APP_CONFIG: ${{ runner.temp }}/opencode-ruby-bundle-config
BUNDLE_PATH: ${{ runner.temp }}/opencode-ruby-bundle
BUNDLE_GEMFILE: ${{ github.workspace }}/client/Gemfile
OPENCODE_IMAGE: ${{ matrix.image }}
OPENCODE_EXPECTED_VERSION: ${{ matrix.version }}
OPENCODE_MATRIX_ID: ${{ matrix.id }}
OPENCODE_REQUIRED_CONSUMER_PROFILES: ${{ toJSON(matrix.required_consumer_profiles) }}
OPENCODE_RUBY_PATH: ${{ github.workspace }}/ruby-client
OPENCODE_RUBY_COMMIT: ${{ steps.client-sha.outputs.value }}
OPENCODE_RAILS_COMMIT: ${{ needs.prepare.outputs.rails_ref }}
OPENCODE_COMPAT_EVIDENCE_PATH: ${{ github.workspace }}/.compat-evidence/${{ matrix.id }}.json
OPENCODE_COMPAT_RUN_ID: ${{ github.run_id }}
OPENCODE_COMPAT_RUN_ATTEMPT: ${{ github.run_attempt }}
OPENCODE_COMPAT_HEAD_SHA: ${{ github.sha }}
OPENCODE_COMPAT_REPOSITORY: ${{ github.repository }}
OPENCODE_COMPAT_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
run: |
mkdir -p .compat-evidence
bundle exec scripts/run_image_contract.sh
- name: Upload exact-image evidence
if: always() && github.server_url == 'https://github.com'
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: image-${{ matrix.id }}-${{ github.run_id }}-${{ github.run_attempt }}
path: .compat-evidence/${{ matrix.id }}.json
include-hidden-files: true
if-no-files-found: warn
retention-days: 30
exact-image-contract-gitea:
if: github.server_url != 'https://github.com'
needs: prepare
runs-on: ubuntu-latest
name: Gitea full exact image matrix
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
repository: ajaynomics/opencode-ruby
ref: ${{ needs.prepare.outputs.ruby_ref }}
path: ruby-client
- uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1
with:
ruby-version: "3.4"
- name: Install candidate dependencies outside the checkout
working-directory: ruby-client
env:
BUNDLE_APP_CONFIG: ${{ runner.temp }}/opencode-ruby-bundle-config
BUNDLE_PATH: ${{ runner.temp }}/opencode-ruby-bundle
run: |
echo "BUNDLE_APP_CONFIG=$BUNDLE_APP_CONFIG" >> "$GITHUB_ENV"
echo "BUNDLE_PATH=$BUNDLE_PATH" >> "$GITHUB_ENV"
bundle install --jobs 4 --retry 3
- id: client-sha
name: Verify immutable Ruby candidate checkout
env:
EXPECTED_CLIENT_SHA: ${{ needs.prepare.outputs.ruby_ref }}
run: |
actual_client_sha="$(git -C ruby-client rev-parse HEAD)"
test "$actual_client_sha" = "$EXPECTED_CLIENT_SHA"
echo "value=$actual_client_sha" >> "$GITHUB_OUTPUT"
- name: Resolve the private Docker host transport
run: |
probe_host="$(ruby scripts/private_default_gateway.rb)"
echo "OPENCODE_PROBE_HOST=$probe_host" >> "$GITHUB_ENV"
- name: Exercise the complete manifest matrix without artifact claims
env:
BUNDLE_GEMFILE: ${{ github.workspace }}/ruby-client/Gemfile
OPENCODE_RUBY_PATH: ${{ github.workspace }}/ruby-client
OPENCODE_RUBY_COMMIT: ${{ steps.client-sha.outputs.value }}
OPENCODE_RAILS_COMMIT: ${{ needs.prepare.outputs.rails_ref }}
OPENCODE_COMPAT_EVIDENCE_DIR: ${{ github.workspace }}/.compat-evidence
OPENCODE_COMPAT_RUN_ID: ${{ github.run_id }}
OPENCODE_COMPAT_RUN_ATTEMPT: ${{ github.run_attempt }}
OPENCODE_COMPAT_HEAD_SHA: ${{ github.sha }}
OPENCODE_COMPAT_REPOSITORY: ${{ github.repository }}
OPENCODE_COMPAT_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
run: scripts/run_image_matrix_contract.sh
- name: State the Gitea evidence boundary
if: always()
run: echo "Gitea's exact-image path uploads nothing; generated JSON is transient and is not review evidence. This job passes only after every manifest image passes."
OPENCODE_RUBY_PATH: ${{ github.workspace }}/client
run: bundle exec scripts/run_image_contract.sh

138
.github/workflows/watch-upstream.yml vendored
View File

@@ -17,7 +17,7 @@ jobs:
open-compatibility-pr:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Resolve latest release
@@ -27,153 +27,55 @@ jobs:
run: |
release="$(gh api repos/anomalyco/opencode/releases/latest)"
tag="$(jq -r .tag_name <<<"$release")"
digest="$(docker buildx imagetools inspect "ghcr.io/anomalyco/opencode:${tag#v}" --format '{{json .Manifest}}' | jq -r .digest)"
image="ghcr.io/anomalyco/opencode@$digest"
published_at="$(jq -r .published_at <<<"$release")"
release_url="$(jq -r .html_url <<<"$release")"
current="$(jq -r .release_tag manifests/upstream.json)"
current_image="$(jq -r .image manifests/upstream.json)"
current_image_count="$(
jq \
--arg image "$image" \
'[.public_ci[]? | select(.image == $image)] | length' \
manifests/image-matrix.json
)"
ruby scripts/upstream_branch_name.rb "$tag" "$digest" >/dev/null
ruby -rtime -e 'Time.iso8601(ARGV.fetch(0))' "$published_at"
test "$release_url" = "https://github.com/anomalyco/opencode/releases/tag/$tag"
echo "tag=$tag" >> "$GITHUB_OUTPUT"
echo "digest=$digest" >> "$GITHUB_OUTPUT"
echo "published_at=$published_at" >> "$GITHUB_OUTPUT"
echo "release_url=$release_url" >> "$GITHUB_OUTPUT"
if [ "$tag" = "$current" ] && [ "$image" != "$current_image" ]; then
echo "same_tag_digest_changed=true" >> "$GITHUB_OUTPUT"
else
echo "same_tag_digest_changed=false" >> "$GITHUB_OUTPUT"
fi
if [ "$tag" = "$current" ] && [ "$image" = "$current_image" ] && [ "$current_image_count" -eq 1 ]; then
echo "published_at=$(jq -r .published_at <<<"$release")" >> "$GITHUB_OUTPUT"
echo "release_url=$(jq -r .html_url <<<"$release")" >> "$GITHUB_OUTPUT"
if [ "$tag" = "$current" ]; then
echo "changed=false" >> "$GITHUB_OUTPUT"
else
echo "changed=true" >> "$GITHUB_OUTPUT"
fi
- name: Resolve collision-safe compatibility branch
- name: Stop when a PR already exists
if: steps.release.outputs.changed == 'true'
id: branch
id: existing
env:
GH_TOKEN: ${{ github.token }}
TAG: ${{ steps.release.outputs.tag }}
DIGEST: ${{ steps.release.outputs.digest }}
run: |
base_branch="$(ruby scripts/upstream_branch_name.rb "$TAG" "$DIGEST")"
expected_image="ghcr.io/anomalyco/opencode@$DIGEST"
open_branch=""
open_prs="$(
gh pr list --state open --base main --limit 1000 \
--json baseRefName,headRefName,headRefOid,headRepository,headRepositoryOwner,isCrossRepository
)"
while IFS=$'\t' read -r candidate_branch head_oid; do
[ -n "$candidate_branch" ] || continue
if ! candidate_upstream="$(
gh api \
-H "Accept: application/vnd.github.raw+json" \
"repos/$GITHUB_REPOSITORY/contents/manifests/upstream.json?ref=$head_oid" 2>/dev/null
)"; then
continue
fi
if ! candidate_matrix="$(
gh api \
-H "Accept: application/vnd.github.raw+json" \
"repos/$GITHUB_REPOSITORY/contents/manifests/image-matrix.json?ref=$head_oid" 2>/dev/null
)"; then
continue
fi
if jq -e \
--arg tag "$TAG" \
--arg image "$expected_image" \
'.release_tag == $tag and .image == $image' \
>/dev/null <<<"$candidate_upstream" &&
jq -e \
--arg image "$expected_image" \
'([.public_ci[]? | select(.image == $image)] | length) == 1' \
>/dev/null <<<"$candidate_matrix"; then
open_branch="$candidate_branch"
break
fi
done < <(
jq -r \
--arg base "$base_branch" \
--arg owner "${GITHUB_REPOSITORY%%/*}" \
--arg repository "${GITHUB_REPOSITORY#*/}" \
'.[] | select(
.baseRefName == "main" and
.isCrossRepository == false and
.headRepositoryOwner.login == $owner and
.headRepository.name == $repository and
(.headRefName == $base or (.headRefName | startswith($base + "-r")))
) | [.headRefName, .headRefOid] | @tsv' \
<<<"$open_prs"
)
if [ -n "$open_branch" ]; then
echo "branch=$open_branch" >> "$GITHUB_OUTPUT"
echo "skip=true" >> "$GITHUB_OUTPUT"
exit 0
fi
branch="$base_branch"
existing_count="$(
gh pr list --state all --base main --head "$base_branch" --limit 1000 \
--json baseRefName,headRepository,headRepositoryOwner,isCrossRepository |
jq \
--arg owner "${GITHUB_REPOSITORY%%/*}" \
--arg repository "${GITHUB_REPOSITORY#*/}" \
'[.[] | select(
.baseRefName == "main" and
.isCrossRepository == false and
.headRepositoryOwner.login == $owner and
.headRepository.name == $repository
)] | length'
)"
if [ "$existing_count" -gt 0 ] || git ls-remote --exit-code --heads origin "$base_branch" >/dev/null 2>&1; then
branch="$(ruby scripts/upstream_branch_name.rb "$TAG" "$DIGEST" "${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}")"
fi
branch="compat/upstream-${TAG#v}"
count="$(gh pr list --state open --head "$branch" --json number --jq length)"
echo "branch=$branch" >> "$GITHUB_OUTPUT"
if [ "$count" -gt 0 ]; then
echo "skip=true" >> "$GITHUB_OUTPUT"
else
echo "skip=false" >> "$GITHUB_OUTPUT"
fi
- name: Resolve immutable image and update manifests
if: steps.release.outputs.changed == 'true' && steps.branch.outputs.skip == 'false'
if: steps.release.outputs.changed == 'true' && steps.existing.outputs.skip == 'false'
env:
TAG: ${{ steps.release.outputs.tag }}
PUBLISHED_AT: ${{ steps.release.outputs.published_at }}
RELEASE_URL: ${{ steps.release.outputs.release_url }}
DIGEST: ${{ steps.release.outputs.digest }}
run: |
ruby scripts/record_upstream_candidate.rb "$TAG" "$PUBLISHED_AT" "$RELEASE_URL" "$DIGEST"
digest="$(docker buildx imagetools inspect "ghcr.io/anomalyco/opencode:${TAG#v}" --format '{{json .Manifest}}' | jq -r .digest)"
ruby scripts/record_upstream_candidate.rb "$TAG" "$PUBLISHED_AT" "$RELEASE_URL" "$digest"
ruby test/repository_test.rb
ruby test/watcher_test.rb
- name: Open compatibility PR
if: steps.release.outputs.changed == 'true' && steps.branch.outputs.skip == 'false'
if: steps.release.outputs.changed == 'true' && steps.existing.outputs.skip == 'false'
env:
GH_TOKEN: ${{ github.token }}
TAG: ${{ steps.release.outputs.tag }}
DIGEST: ${{ steps.release.outputs.digest }}
BRANCH: ${{ steps.branch.outputs.branch }}
SAME_TAG_DIGEST_CHANGED: ${{ steps.release.outputs.same_tag_digest_changed }}
BRANCH: ${{ steps.existing.outputs.branch }}
run: |
git config user.name "opencode-compat-bot"
git config user.email "opencode-compat-bot@users.noreply.github.com"
short_digest="${DIGEST#sha256:}"
short_digest="${short_digest:0:12}"
git switch -c "$BRANCH"
git add manifests/image-matrix.json manifests/upstream.json
git commit -m "Test OpenCode ${TAG} compatibility (${short_digest})"
git commit -m "Test OpenCode ${TAG} compatibility"
git push --set-upstream origin "$BRANCH"
title="Test OpenCode ${TAG} compatibility (${short_digest})"
notice="Upstream watcher resolved ${TAG} to immutable OCI digest ${DIGEST}."
if [ "$SAME_TAG_DIGEST_CHANGED" = "true" ]; then
title="Review changed OCI digest for existing OpenCode ${TAG} (${short_digest})"
notice="Security-sensitive change: existing release ${TAG} now resolves to a different OCI digest, ${DIGEST}."
fi
gh pr create \
--base main \
--head "$BRANCH" \
--title "$title" \
--body "${notice} The watcher added it as a pending compatibility target. This PR only runs certification checks; promotion and consumer rollout remain manual."
--title "Test OpenCode ${TAG} compatibility" \
--body "Upstream watcher detected ${TAG}, resolved its immutable OCI digest, and added it as a pending compatibility target. This PR only runs certification checks; promotion and consumer rollout remain manual."

101
README.md
View File

@@ -8,25 +8,37 @@ prompts, credentials, sessions, or user data belong here.
## Policy
- An unpublished gem build is a candidate until the fixture suite and every
required image profile pass. It is identified only by an exact commit.
- `opencode-ruby` and `opencode-rails` are one candidate release train. The
manifest records both exact commits, and CI rejects a Rails candidate whose
exact runtime dependency resolves to a different Ruby version or commit.
- Once a train is published, commit-only provenance is no longer accepted. The
manifest and lockstep contract require each annotated tag object, local tag
ref, and peeled commit to bind to the tested checkout.
- A gem release is a candidate until the fixture suite and every required image
profile pass.
- Image references are immutable OCI index digests. A tag may be recorded as
human-readable provenance, but it is never an execution coordinate.
- Custom consumer images are certified with an isolated canary on the host that
can pull them. Public CI certifies their upstream base plus the same profile.
- Promotion is explicit. CI may certify a tuple and the watcher may open a PR;
neither workflow deploys or changes a consumer.
- Each consumer retains both `current` and `previous` certified tuples so a
rollback restores the gem and server together.
- A passing pull-request head is candidate evidence only. Promotion and
deployed certification use the actual main/merge commit, or an explicit
equal-tree attestation paired with a passing post-merge canary.
- Git-sourced gems use the full peeled commit as the Bundler `ref` and lockfile
revision. A consumer test must also prove the running process loaded that
exact `Bundler::Source::Git`; a release tag or lockfile alone is provenance,
not loaded-source proof.
- Ajent records AIGL, Blackline, and Raven selections together. Every selected
product needs a content digest or local image ID before promotion; a full
commit tag selects a candidate build but does not prove its content.
- In steady state, each consumer retains both `current` and `previous`
certified tuples so a rollback restores the gem and server together. The
explicitly labeled bootstrap state is the temporary degraded exception.
- A failing bootstrap baseline is never relabeled as a certified `previous`
tuple. Promotion stays blocked until a distinct rollback consumer commit is
pinned to a passing client/runtime tuple and canaried.
tuple. After a real main/deploy canary, an explicitly acknowledged degraded
bootstrap may certify only `current`; it leaves `previous` null and keeps the
failed baseline as emergency provenance. The next meaningful passing release
becomes the first genuine certified rollback tuple.
The runtime ledger is schema version 2; its machine-readable shape lives at
[`schemas/runtime-tuples.schema.json`](schemas/runtime-tuples.schema.json).
The current candidates remain deliberately unpromotable PR-head records, and
all `previous` slots remain `null` because no passing rollback tuple exists.
## What is covered
@@ -52,26 +64,11 @@ Prerequisites are Ruby 3.2+, Python 3, `jq`, and Docker.
ruby test/repository_test.rb
ruby test/runtime_tuple_promoter_test.rb
ruby test/exact_live_contract_test.rb
ruby test/watcher_test.rb
ruby test/client_candidate_test.rb
OPENCODE_RUBY_PATH=/path/to/opencode-ruby-at-9277646a4bb2cf25a8384ffc140b154f49ea5766 \
OPENCODE_RUBY_PATH=/path/to/opencode-ruby-at-78b6f9c9e9c7d58b699af1c3c17764acd33de798 \
ruby ruby/opencode_ruby_fixture_contract.rb
BUNDLE_GEMFILE=/path/to/opencode-rails/Gemfile \
OPENCODE_RUBY_PATH=/path/to/opencode-ruby \
OPENCODE_RAILS_PATH=/path/to/opencode-rails \
OPENCODE_CLIENT_PUBLICATION_STATE=unpublished \
OPENCODE_RUBY_COMMIT=9277646a4bb2cf25a8384ffc140b154f49ea5766 \
OPENCODE_RUBY_PROVENANCE_KIND=commit \
OPENCODE_RAILS_COMMIT=a9add2a7c1dd3eb978aa8b4ebf9ef7e111d1057f \
OPENCODE_RAILS_PROVENANCE_KIND=commit \
OPENCODE_RUBY_VERSION=0.0.1.alpha8 \
OPENCODE_RAILS_VERSION=0.0.1.alpha8 \
bundle exec ruby ruby/lockstep_client_contract.rb
BUNDLE_GEMFILE=/path/to/opencode-ruby-at-9277646a4bb2cf25a8384ffc140b154f49ea5766/Gemfile \
OPENCODE_RUBY_PATH=/path/to/opencode-ruby-at-9277646a4bb2cf25a8384ffc140b154f49ea5766 \
OPENCODE_RUBY_COMMIT=9277646a4bb2cf25a8384ffc140b154f49ea5766 \
OPENCODE_RUBY_PATH=/path/to/opencode-ruby-at-78b6f9c9e9c7d58b699af1c3c17764acd33de798 \
OPENCODE_IMAGE='ghcr.io/anomalyco/opencode@sha256:e975a0647576016dfdf77d54b979ca30d32b4750472c10263e9894aad6628c2a' \
bundle exec scripts/run_image_contract.sh
scripts/run_image_contract.sh
```
The live contract starts a deterministic local OpenAI-compatible model stub and
@@ -79,47 +76,15 @@ an isolated OpenCode container. It creates a session, subscribes, submits an
async prompt, observes terminal SSE, fetches the authoritative exchange, and
deletes the session. Passing requires the authoritative final text to equal the
expected text byte-for-byte and the deterministic model stub to observe exactly
one request and exactly one authoritative assistant message. It never calls an
external model provider.
On GitHub, candidate CI uploads machine-readable fixture, lockstep-client, and
exact-image evidence for 30 days. These artifacts are review inputs, not
certification by themselves. Gitea runs the same repository, fixture, and
lockstep contracts and executes every exact-image manifest entry sequentially,
because its runner cannot expand a matrix from a dependency job's JSON output.
The installed Gitea artifact service does not support the pinned GitHub upload
action, so Gitea deliberately uploads nothing: its generated JSON is transient
and must not be described as review evidence. A person must review a passing
GitHub artifact and commit the durable certification document under `evidence/`;
no workflow commits or promotes its own result.
`manifests/image-matrix.json` binds the active pending matrix to both candidate
commits. Its `previous_certification` entries preserve the last alpha7 result;
they do not certify alpha8. Ajent and Mushu custom-image rows remain pending
until their host canaries run against this exact pair.
The checked-in alpha8 local exact-image result is explicitly marked
`not-certified` and `shared-client-contract-only`. It proves the Ruby/SSE probe
on the recorded image IDs but does not claim Rails, plugin, application, or
deployment canary coverage; exact-head CI still supplies reviewable workflow
provenance.
one request. It never calls an external model provider.
## Adding an upstream release
The scheduled watcher compares both the latest upstream GitHub release tag and
its resolved OCI digest with the manifest. A new release or a changed digest
behind an existing tag gets a digest-specific branch and compatibility PR. The
PR adds a pending image-matrix entry, which runs the candidate suite after the
normal GitHub workflow approval boundary. A person still decides whether to
promote it and update consumers. The watcher never merges, dispatches consumer
workflows, deploys, or force-pushes.
`public_ci` is the active compatibility set, not an append-only release log.
Keep images still referenced by a consumer's current, candidate, or previous
runtime tuple plus the newest pending upstream candidate. When a watcher PR
supersedes an unreferenced pending target, remove that older row during review;
durable certification documents and Git history are the archive. This keeps a
fast-moving upstream from making every future run retest every old release.
The scheduled watcher compares the latest upstream GitHub release with the
manifest. When a new release appears, it resolves the tag to an OCI digest and
opens a compatibility PR. The PR adds a pending image-matrix entry, which runs
the candidate suite. A person still decides whether to promote it and update
consumers.
See [docs/certification.md](docs/certification.md) for promotion, canary, and
rollback evidence requirements.

156
docs/certification.md
View File

@@ -6,44 +6,41 @@ A candidate tuple is the complete set of client version or commit, Rails gem
version or commit where applicable, exact OpenCode image, profile, and consumer
commit. Changing any member invalidates the certification.
There are two distinct scopes:
- `pre-merge-pr-head-candidate-only` proves that one reviewed PR head is
compatible. It is never a deployment or promotion authorization.
- `promotion-deployed` is recorded only after a passing post-merge canary and
the consumer coordinate is the actual main/merge commit. If policy
deliberately retains the PR-head commit, the evidence must additionally
record both Git trees as identical and name the actual main/merge commit.
Comparing diffs is not an identical-tree attestation.
The gate requires:
1. repository validation and the shared fixture corpus;
2. exact `opencode-ruby` and `opencode-rails` candidate checkouts, all Rails
candidate tests on Ruby 3.2 through 4.0, an exact Rails-to-Ruby runtime
dependency, and loaded Bundler provenance for the Ruby commit;
3. the public exact-image matrix against the deterministic model stub;
4. an isolated custom-image canary for Ajent Rails and Mushu;
5. the consumer's own focused and full required tests in its devcontainer;
6. a user-visible canary turn for stream consumers;
7. captured evidence including image ID/digest, server version, source commit,
2. the public exact-image matrix against the deterministic model stub;
3. an isolated custom-image canary for Ajent Rails and Mushu;
4. the consumer's own focused and full required tests in its devcontainer;
5. a user-visible canary turn for stream consumers;
6. captured evidence including image ID/digest, server version, source commit,
gem commits, timestamps, and probe outcome.
For a Git-sourced gem, “gem commit” means the peeled 40-character commit in
both the Gemfile `ref` and lockfile `revision`, plus runtime loaded-source proof:
the loaded version, `Bundler::Source::Git`, observed revision (and observed ref
when the consumer test exposes it), and the consumer test that made those
assertions. Annotated tag objects remain useful release provenance, but they
are not an execution coordinate.
Ajent's runtime is a three-product selection. The ledger records AIGL,
Blackline, and Raven under one source commit. Candidate evidence may say that a
product artifact has not been built; promotion may not. At promotion time the
set of content-addressed product artifacts must exactly equal the selected
product set.
Health-only probes do not certify a tuple.
### Client source provenance
Before publication, `manifests/client-candidate.json` must use
`publication_state: unpublished` and `kind: commit` for both clients. Each
provenance commit must equal its full 40-character checkout ref, and the Rails
Gemfile/runtime dependency must resolve the same exact Ruby commit and version.
Commit-only evidence is candidate evidence; it is not proof of a gem release.
The lockstep checkout fetches tags and fails unpublished mode if the matching
`vVERSION` tag appears, forcing the manifest through the published gate.
After publication, change the state to `published` and replace both commit
provenance objects with `kind: annotated-tag`, the exact tag, annotated tag
object ID, and peeled commit. The repository validator rejects a published
commit-only candidate. The lockstep job additionally verifies that each local
tag ref resolves to the declared annotated tag object and that both the object
and ref peel to the tested checkout. This transition is a reviewed manifest
change; CI does not create or publish tags.
The image matrix's active candidate coordinates must equal the client manifest.
Changing either commit resets the active matrix to `pending`. A
`previous_certification` preserves historical evidence but does not certify the
new candidate.
The shared live probe is intentionally strict: `full_text` must equal the
expected text byte-for-byte and the deterministic model must receive exactly
one request. A response that merely contains the expected text, including a
@@ -52,9 +49,18 @@ duplicated `compat-ok\n\ncompat-ok`, fails.
## Promotion
Promotion is a reviewed manifest change that moves the old `current` tuple to
`previous` and the passing candidate to `current`. The consumer change is then
merged and deployed separately. Workflows in this repository have no deploy
credentials or deploy steps.
`previous` and the passing candidate to `current`. The consumer change must
already have a main/merge identity (or the equal-tree exception below) before
that manifest change. Production rollout remains a separate consumer-owned
operation; workflows in this repository have no deploy credentials or deploy
steps.
Before invoking the promoter, replace PR-head-only metadata with either the
actual main/merge consumer ref and `main-commit` promotion provenance, or an
explicit identical-tree attestation containing the main commit/tree. Both
forms require a post-merge canary evidence path. Set `promotion_eligible` only
after that evidence exists. The promoter rejects the current PR-head candidates
even when their compatibility probes pass.
Use the repository promotion command; do not hand-edit the three tuple slots.
It binds evidence to a canonical SHA-256 of the complete tuple, requires full
@@ -115,27 +121,13 @@ being able to observe the underlying model request. Record that distinction
explicitly; do not infer a model request count from an application prompt
count. The exact-image shared contract supplies the model-request proof.
Likewise, the public image job executes `ruby-rest-sse`; it does not silently
certify Rails persistence, plugin hooks, voice streaming, strict route gates,
or provider hooks. Those appear as `required_consumer_profiles` in the image
matrix and need their own consumer evidence before a full tuple can pass.
The companion lockstep job proves that the exact Rails candidate loads and
tests against the exact Ruby candidate on every supported Ruby version. That
still does not certify a consumer's ActiveRecord schema, persistence callbacks,
container adapter, or application canary; those remain consumer-owned profile
evidence.
GitHub CI writes canonical JSON artifacts for the shared fixture, lockstep
client, and each exact-image target. Artifact retention is 30 days and supplies
reviewable workflow provenance; it is not the long-term ledger. Gitea executes
the same contracts, with its exact-image targets run sequentially from the full
generated manifest, but its installed artifact service cannot accept the
reviewed GitHub upload action. Gitea therefore keeps generated JSON transient
and makes no artifact-evidence claim. After reviewing a GitHub artifact, copy
the relevant facts into a repository evidence document bound to the complete
tuple fingerprint. Automated workflows never update certified evidence or
promote a tuple.
Likewise, the public image job executes only `ruby-rest-sse`; it does not
silently certify Rails persistence, plugin hooks, voice streaming, strict route
gates, or provider hooks. Every other profile is labeled
`executable-consumer-attestation` with `shared_ruby_probe_sufficient: false`.
Those profiles appear as `required_consumer_profiles` in the image matrix and
need executable evidence from their owning consumer before a full tuple can
pass. A prose review or a successful shared Ruby probe is not that evidence.
The command clears `candidate` after promotion. It sets the repository-wide
`migration_state` to `certified` only after every consumer has certified
@@ -148,21 +140,39 @@ coordinates for emergency recovery but mark it failed. Do not create passing
evidence for it and do not promote it into `previous`. The promoter rejects
known-failed baselines even if a document claims `pass`.
The safe bootstrap is two-stage: certify and roll out the new candidate, then
create and canary a distinct consumer rollback commit that preserves the same
known-good client and exact runtime. Only after both immutable consumer commits
have real passing evidence can the manifest honestly contain certified
`current` and `previous` tuples. Until then, `promotion_readiness` remains
blocked and the candidate PR must not be treated as a deploy authorization.
Do not manufacture a no-op second commit merely to fill `previous`. Once the
candidate has been merged, deployed, and canaried under promotion-grade
provenance, a reviewer may use `bootstrap-current` with this exact
acknowledgement:
The schema-v1 promotion command deliberately cannot perform the first degraded
bootstrap transition when `current` is a known-failing baseline. Do not bypass
that guard by hand-editing the manifest or relabeling alpha2 evidence. A
separate reviewed state-machine change must first add an explicit
`bootstrap-current-only` state that preserves the failed baseline as
uncertified emergency provenance and leaves `previous` null. Itemized rollback
certification is complete only after a later, materially distinct passing tuple
can move the first certified current into `previous`.
```text
accept-degraded-rollback-with-failed-emergency-provenance
```
That operation certifies only `current`, moves the failed baseline to
`emergency_provenance` without relabeling it, leaves `previous` null, and sets
`migration_state` to `bootstrap-current-only`. This is an intentionally
degraded rollback state, not full certification. The next meaningful passing
release uses normal promotion; the already-certified current tuple then becomes
the first honest certified `previous` tuple.
Until main/deploy evidence exists, `promotion_readiness` remains blocked and a
candidate PR must not be treated as deploy authorization.
After reviewing the degraded rollback consequence, preview the explicit
bootstrap before writing it:
```sh
ruby scripts/promote_runtime_tuple.rb bootstrap-current \
--consumer travelwolf \
--consumer-commit FULL_MAIN_OR_ATTESTED_PR_COMMIT \
--status pass \
--certified-at 2026-07-18T12:00:00Z \
--evidence evidence/travelwolf-post-merge.json \
--acknowledge-degraded-rollback \
accept-degraded-rollback-with-failed-emergency-provenance \
--dry-run
```
## Rollback
@@ -177,17 +187,11 @@ the source commit used to build it. A source tag alone is insufficient.
Run the shared live contract on a host that can pull the exact image:
```sh
BUNDLE_GEMFILE=/path/to/opencode-ruby/Gemfile \
OPENCODE_RUBY_PATH=/path/to/opencode-ruby \
OPENCODE_RUBY_COMMIT=FULL_40_HEX_COMMIT \
OPENCODE_IMAGE='registry.example/image@sha256:...' \
bundle exec scripts/run_image_contract.sh
scripts/run_image_contract.sh
```
The Ruby checkout must be clean and its `HEAD` must equal
`OPENCODE_RUBY_COMMIT`. Install Bundler dependencies outside that checkout when
the normal cache path would create untracked files.
If an older private registry cannot expose an OCI repository digest, set
`ALLOW_EXACT_IMAGE_ID=1` and pass the locally present `sha256:...` image ID.
Record the registry tag, image ID, source commit, and reason a repository

86
evidence/2026-07-18-ajent-rails-alpha7-candidate.json
View File

@@ -2,15 +2,87 @@
"schema_version": 1,
"consumer": "ajent-rails",
"profile": "rails-persisted-turn",
"consumer_commit": "96552893baccd5ccba1592b2585edfef1299b4f9",
"consumer_commit": "01cdf9da8e1b3f9a205d681e448aefefd9704db2",
"consumer_tree": "9e93834ad16b60fa5edfe1cb3baaba193402be74",
"consumer_ref_kind": "pull-request-head",
"review_url": "https://gitea.ajay.to/ajaynomics/ajent-rails/pulls/946",
"certification_scope": "pre-merge-pr-head-candidate-only",
"promotion_eligible": false,
"status": "pass",
"certified_at": "2026-07-18T22:03:14Z",
"tuple_sha256": "sha256:2fc1026cf247b5ad5677bfa4673c1073f7c2478769dca0cc8443a0924cebfca3",
"certified_at": "2026-07-18T23:28:16.435369Z",
"tuple_sha256": "sha256:e7026c294d0b2981f6ec785a45afb69969f4dc2b4d0ed6533f9bda5153304663",
"shared_evidence": "evidence/2026-07-18-opencode-ruby-alpha7.json",
"canary": {
"checked_at": "2026-07-18T21:58:00Z",
"docker_image_id": "sha256:239e3dc6cd2958251cda636fb20bd7cd7c46f596bd4c61cb81863ebc49d824e8",
"loaded_sources": {
"opencode-ruby": {
"version": "0.0.1.alpha7",
"requested_ref": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"locked_revision": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"observed_revision": "78b6f9c9e9c7d58b699af1c3c17764acd33de798"
},
"opencode-rails": {
"version": "0.0.1.alpha7",
"requested_ref": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb",
"locked_revision": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb",
"observed_revision": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb"
},
"source_class": "Bundler::Source::Git",
"proof_test": "test/lib/opencode/runtime_image_provenance_test.rb",
"status": "pass"
},
"deterministic_contract": {
"checked_at": "2026-07-18T23:16:13Z",
"docker_image_id": "sha256:075cb49ac7fcb1f8972e051dff96d655fa0d0d911d83a523a6abf03a5e2e2935",
"expected_text": "compat-ok",
"full_text": "compat-ok",
"authoritative_assistant_count": 1,
"model_request_count": 1,
"status": "pass"
},
"application_canary": {
"checked_at": "2026-07-18T23:28:16.435369Z",
"docker_image_id": "sha256:075cb49ac7fcb1f8972e051dff96d655fa0d0d911d83a523a6abf03a5e2e2935",
"persisted_final_text": "compat-ok",
"model_request_count": 1
"authoritative_final_text": "compat-ok",
"authoritative_assistant_count": 1,
"model_request_count": 1,
"cleanup_status": "pass",
"status": "pass"
},
"consumer_verification": {
"tests": {
"runs": 4077,
"assertions": 14495,
"failures": 0,
"errors": 0,
"existing_skips": 4
},
"rubocop": {
"files": 1365,
"offenses": 0
},
"gitea_actions": {
"run_id": 2545,
"status": "success",
"commit": "01cdf9da8e1b3f9a205d681e448aefefd9704db2"
},
"remotes_exact": [
"origin",
"github",
"backup"
]
},
"product_artifact_coverage": {
"selected_products": [
"aigl",
"blackline",
"raven"
],
"content_addressed_artifacts": [
"blackline"
],
"missing_before_promotion": [
"aigl",
"raven"
]
}
}

90
evidence/2026-07-18-mushu-alpha7-candidate.json
View File

@@ -2,16 +2,88 @@
"schema_version": 1,
"consumer": "mushu",
"profile": "ruby-rest-sse",
"consumer_commit": "f26d958b64f214a422aeb629860c8c9a46a4c084",
"consumer_commit": "7cff22788b36ae703f6b1b8fa39b52d6dbafe7e0",
"consumer_tree": "762eb8dcc7042a52cd240ca69acdb9cb45150a84",
"consumer_ref_kind": "pull-request-head",
"review_url": "https://gitea.ajay.to/ajaynomics/mushu/pulls/1",
"certification_scope": "pre-merge-pr-head-candidate-only",
"promotion_eligible": false,
"status": "pass",
"certified_at": "2026-07-18T22:03:14Z",
"tuple_sha256": "sha256:6171647c7db6d88d52882695c6106a4391e87d0bb1f9e0c48151b2bc1e95b318",
"certified_at": "2026-07-18T23:26:06.865190Z",
"tuple_sha256": "sha256:648d53b1d800c065e8ecdb95974049ee179617569170cfc169c31c3bfc1e8865",
"shared_evidence": "evidence/2026-07-18-opencode-ruby-alpha7.json",
"canary": {
"run_id": "mushu-alpha7-20260718T215300Z-f26d958",
"checked_at": "2026-07-18T21:53:00Z",
"docker_image_id": "sha256:ed6293ca87e6db1dc07870d3ed6da21960743e6e2e904533b3c566d334b58d6a",
"persisted_final_text": "compat-ok",
"model_request_count": 1
"loaded_source": {
"gem": "opencode-ruby",
"version": "0.0.1.alpha7",
"source_class": "Bundler::Source::Git",
"requested_ref": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"locked_revision": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"observed_ref": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"observed_revision": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"loaded_file_within_spec": true,
"proof_test": "test/services/mushu/runtime/opencode_dependency_provenance_test.rb",
"status": "pass"
},
"deterministic_contract": {
"checked_at": "2026-07-18T23:23:41Z",
"image": "docker-registry:5000/mushu-opencode@sha256:ed6293ca87e6db1dc07870d3ed6da21960743e6e2e904533b3c566d334b58d6a",
"expected_text": "compat-ok",
"full_text": "compat-ok",
"authoritative_assistant_count": 1,
"model_request_count": 1,
"status": "pass"
},
"application_canary": {
"checked_at": "2026-07-18T23:26:06.865190Z",
"response_text": "compat-ok",
"authoritative_final_text": "compat-ok",
"message_roles": [
"user",
"assistant"
],
"authoritative_assistant_count": 1,
"provider_request_count": 1,
"mapping_and_last_turn_persisted": true,
"active_claim_cleared": true,
"opencode_session_deleted": true,
"synthetic_database_rows_after_cleanup": 0,
"status": "pass"
},
"consumer_verification": {
"focused_tests": {
"runs": 126,
"assertions": 1413,
"failures": 0,
"errors": 0
},
"full_tests": {
"runs": 632,
"assertions": 9013,
"failures": 0,
"errors": 0
},
"rubocop": {
"files": 216,
"offenses": 0
},
"gitea_actions": {
"run_id": 2544,
"url": "https://gitea.ajay.to/ajaynomics/mushu/actions/runs/2544",
"overall_status": "failure",
"commit": "7cff22788b36ae703f6b1b8fa39b52d6dbafe7e0",
"classification": "inherited-unrelated-baseline-failures",
"jobs": {
"lint": "success",
"scan_js": "success",
"scan_ruby": "inherited-vendor-bundle-source-scan-failure",
"test": "inherited-evidence-report-single-failure",
"system-test": "inherited-missing-test-system-directory"
},
"baseline_run_id": 2508
},
"remotes_exact": [
"origin",
"backup"
]
}
}

39
evidence/2026-07-18-opencode-ruby-alpha2-regression.json
View File

@@ -36,7 +36,9 @@
},
{
"target": "ajent-production-artifact",
"docker_image_id": "sha256:6fb2b3bf8e4cdf48e16bf6c3475e953df2f8304e77f5efe816ceb46f905eead8",
"consumer_commit": "8d8550265dca0ac06a41d5427c585ede56bbb808",
"product": "blackline",
"docker_image_id": "sha256:af479243e6ccf1206f57dffd13b8e9d2c028de401cccc954bcc2f00940274c60",
"server_version": "1.18.3",
"status": "fail"
},
@@ -47,5 +49,38 @@
"status": "fail"
}
],
"promotion_effect": "The observed alpha2 consumer baselines are not eligible for certified previous tuples. A distinct, tested rollback consumer commit pinned to alpha7 is required before the two-certified-tuples policy can be satisfied."
"observed_ajent_production_runtime": {
"consumer_commit": "8d8550265dca0ac06a41d5427c585ede56bbb808",
"upstream_base_layer_match": "ghcr.io/anomalyco/opencode@sha256:c2d5d6398df72aac85cb1bdc8f900c71a9b75a33fb7c0a76dc1484e4b126e41e",
"shared_accessory": {
"product": "blackline",
"tag_provenance": "docker-registry:5000/opencode-blackline:8d8550265dca0ac06a41d5427c585ede56bbb808",
"docker_image_id": "sha256:af479243e6ccf1206f57dffd13b8e9d2c028de401cccc954bcc2f00940274c60"
},
"deployed_per_user_product_configuration": {
"strategy": "mutable-latest",
"status": "observed-configuration-drift-failure",
"references": {
"aigl": "docker-registry:5000/opencode-aigl:latest",
"blackline": "docker-registry:5000/opencode-blackline:latest",
"raven": "docker-registry:5000/opencode-raven:latest"
}
},
"ci_built_sha_artifacts": {
"aigl": {
"tag_provenance": "docker-registry:5000/opencode-aigl:8d8550265dca0ac06a41d5427c585ede56bbb808",
"docker_image_id": "sha256:72c454f39d423618b75439122c9073dbba7c9071421e5f3abd12cf288dc1f898"
},
"blackline": {
"tag_provenance": "docker-registry:5000/opencode-blackline:8d8550265dca0ac06a41d5427c585ede56bbb808",
"docker_image_id": "sha256:af479243e6ccf1206f57dffd13b8e9d2c028de401cccc954bcc2f00940274c60"
},
"raven": {
"tag_provenance": "docker-registry:5000/opencode-raven:8d8550265dca0ac06a41d5427c585ede56bbb808",
"docker_image_id": "sha256:6c4da94a8dec6160f0b1b4d0e2cd9ff38a3faa18dbd2a8d6023a71f6416a544c"
}
},
"scope_note": "The hardened alpha2 contract was rerun against the exact shared Blackline accessory. The three SHA-tagged image IDs are CI artifact provenance, not evidence that the deployed per-user ProductConfig selected them; it selected mutable latest references."
},
"promotion_effect": "The observed alpha2 consumer baselines are not eligible for certified previous tuples. After a real main/deploy/post-merge canary, an explicitly acknowledged bootstrap may certify current while leaving previous null and retaining alpha2 only as failed emergency provenance; the next meaningful passing release creates the first certified previous tuple."
}

53
evidence/2026-07-18-opencode-ruby-alpha7.json
View File

@@ -41,7 +41,7 @@
"target": "travelwolf-1.16.1",
"image": "ghcr.io/anomalyco/opencode@sha256:e975a0647576016dfdf77d54b979ca30d32b4750472c10263e9894aad6628c2a",
"server_version": "1.16.1",
"checked_at": "2026-07-18T22:03:12Z",
"checked_at": "2026-07-18T23:35:57Z",
"expected_text": "compat-ok",
"full_text": "compat-ok",
"llm_request_count": 1,
@@ -51,7 +51,7 @@
"target": "opencode-ajent-1.17.18",
"image": "ghcr.io/anomalyco/opencode@sha256:bf9d0e84b7cedef436a8f57db4d48767cd5d8fc6604f666335c1cc916b199a97",
"server_version": "1.17.18",
"checked_at": "2026-07-18T22:03:13Z",
"checked_at": "2026-07-18T23:35:58Z",
"expected_text": "compat-ok",
"full_text": "compat-ok",
"llm_request_count": 1,
@@ -61,7 +61,7 @@
"target": "ajent-base-1.18.3",
"image": "ghcr.io/anomalyco/opencode@sha256:c2d5d6398df72aac85cb1bdc8f900c71a9b75a33fb7c0a76dc1484e4b126e41e",
"server_version": "1.18.3",
"checked_at": "2026-07-18T22:03:14Z",
"checked_at": "2026-07-18T23:35:58Z",
"expected_text": "compat-ok",
"full_text": "compat-ok",
"llm_request_count": 1,
@@ -71,42 +71,55 @@
"consumer_canaries": [
{
"consumer": "ajent-rails",
"consumer_commit": "96552893baccd5ccba1592b2585edfef1299b4f9",
"tag_provenance": "ajent-opencode-blackline-canary:96552893",
"docker_image_id": "sha256:239e3dc6cd2958251cda636fb20bd7cd7c46f596bd4c61cb81863ebc49d824e8",
"source_commit": "96552893baccd5ccba1592b2585edfef1299b4f9",
"consumer_commit": "01cdf9da8e1b3f9a205d681e448aefefd9704db2",
"consumer_ref_kind": "pull-request-head",
"certification_scope": "pre-merge-pr-head-candidate-only",
"tag_provenance": "ajent-opencode-blackline-canary:01cdf9da8e1b3f9a205d681e448aefefd9704db2",
"docker_image_id": "sha256:075cb49ac7fcb1f8972e051dff96d655fa0d0d911d83a523a6abf03a5e2e2935",
"source_commit": "01cdf9da8e1b3f9a205d681e448aefefd9704db2",
"upstream_base": "ghcr.io/anomalyco/opencode@sha256:c2d5d6398df72aac85cb1bdc8f900c71a9b75a33fb7c0a76dc1484e4b126e41e",
"server_version": "1.18.3",
"checked_at": "2026-07-18T21:58:00Z",
"checked_at": "2026-07-18T23:28:16.435369Z",
"application_path": "Blackline::GenerateResponseJob",
"persisted_final_text": "compat-ok",
"authoritative_final_text": "compat-ok",
"authoritative_assistant_count": 1,
"model_request_count": 1,
"cleanup_status": "pass",
"status": "pass"
},
{
"consumer": "mushu",
"consumer_commit": "f26d958b64f214a422aeb629860c8c9a46a4c084",
"run_id": "mushu-alpha7-20260718T215300Z-f26d958",
"consumer_commit": "7cff22788b36ae703f6b1b8fa39b52d6dbafe7e0",
"consumer_ref_kind": "pull-request-head",
"certification_scope": "pre-merge-pr-head-candidate-only",
"tag_provenance": "docker-registry:5000/mushu-opencode:sha-99d6328b1",
"image": "docker-registry:5000/mushu-opencode@sha256:ed6293ca87e6db1dc07870d3ed6da21960743e6e2e904533b3c566d334b58d6a",
"docker_image_id": "sha256:ed6293ca87e6db1dc07870d3ed6da21960743e6e2e904533b3c566d334b58d6a",
"source_commit": "99d6328b18ff8a340a928449a2aa8bc184a063f9",
"server_version": "0.0.0-permission-shortcuts-202606300721",
"checked_at": "2026-07-18T21:53:00Z",
"persisted_final_text": "compat-ok",
"model_request_count": 1,
"checked_at": "2026-07-18T23:26:06.865190Z",
"response_text": "compat-ok",
"authoritative_final_text": "compat-ok",
"authoritative_assistant_count": 1,
"provider_request_count": 1,
"cleanup_status": "pass",
"status": "pass"
},
{
"consumer": "travelwolf",
"consumer_commit": "19747b59fa21e12560afd9edd73ed674ab3a644c",
"run_id": "20260718215135-8d8102c0",
"consumer_commit": "b9a2c2dd361a6b2ea547cc67ee817b8eb4ce31e8",
"consumer_ref_kind": "pull-request-head",
"certification_scope": "pre-merge-pr-head-candidate-only",
"run_id": "travelwolf-alpha7-ref-20260718T232211Z-48eadf",
"image": "ghcr.io/anomalyco/opencode@sha256:e975a0647576016dfdf77d54b979ca30d32b4750472c10263e9894aad6628c2a",
"server_version": "1.16.1",
"started_at": "2026-07-18T21:51:35Z",
"checked_at": "2026-07-18T21:51:56.552Z",
"final_text": "TRAVELWOLF_ALPHA7_SUBSCRIBE_READY",
"application_prompt_count": 1,
"model_request_count_observed": false,
"checked_at": "2026-07-18T23:22:26.216140Z",
"final_text": "TRAVELWOLF_ALPHA7_REF_PIN_READY",
"subscription_ready_before_prompt": true,
"opencode_api_prompt_count": 1,
"provider_request_count_observed": false,
"message_roles": ["user", "assistant"],
"cleanup_status": "pass",
"status": "pass"
}

89
evidence/2026-07-18-travelwolf-alpha7-candidate.json
View File

@@ -2,17 +2,86 @@
"schema_version": 1,
"consumer": "travelwolf",
"profile": "rails-persisted-turn",
"consumer_commit": "19747b59fa21e12560afd9edd73ed674ab3a644c",
"consumer_commit": "b9a2c2dd361a6b2ea547cc67ee817b8eb4ce31e8",
"consumer_tree": "8b3f8a97dc1f1d8b558a49523bf312d2810422df",
"consumer_ref_kind": "pull-request-head",
"review_url": "https://gitea.ajay.to/ajaynomics/travelwolf/pulls/29",
"certification_scope": "pre-merge-pr-head-candidate-only",
"promotion_eligible": false,
"status": "pass",
"certified_at": "2026-07-18T22:03:14Z",
"tuple_sha256": "sha256:a7519e661f74d86788928540429c953edcbf20d26321c0dd2b72cd0a1b995b61",
"certified_at": "2026-07-18T23:35:57Z",
"tuple_sha256": "sha256:bed7d6f6a5e6dd9138c3b960b8bf13ac6f5bf402d0aa7e5c01a52a8e8ea1083d",
"shared_evidence": "evidence/2026-07-18-opencode-ruby-alpha7.json",
"canary": {
"run_id": "20260718215135-8d8102c0",
"checked_at": "2026-07-18T21:51:56.552Z",
"final_text": "TRAVELWOLF_ALPHA7_SUBSCRIBE_READY",
"application_prompt_count": 1,
"model_request_count_observed": false,
"cleanup_status": "pass"
"loaded_sources": {
"opencode-ruby": {
"version": "0.0.1.alpha7",
"requested_ref": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"locked_revision": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"observed_ref": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"observed_revision": "78b6f9c9e9c7d58b699af1c3c17764acd33de798"
},
"opencode-rails": {
"version": "0.0.1.alpha7",
"requested_ref": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb",
"locked_revision": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb",
"observed_ref": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb",
"observed_revision": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb"
},
"source_class": "Bundler::Source::Git",
"proof_test": "test/services/travelwolf/opencode_env_wiring_test.rb",
"status": "pass"
},
"deterministic_contract": {
"checked_at": "2026-07-18T23:23:03Z",
"image": "ghcr.io/anomalyco/opencode@sha256:e975a0647576016dfdf77d54b979ca30d32b4750472c10263e9894aad6628c2a",
"opencode_ruby_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"expected_text": "compat-ok",
"full_text": "compat-ok",
"authoritative_assistant_count": 1,
"model_request_count": 1,
"status": "pass"
},
"application_canary": {
"run_id": "travelwolf-alpha7-ref-20260718T232211Z-48eadf",
"checked_at": "2026-07-18T23:22:26.216140Z",
"final_text": "TRAVELWOLF_ALPHA7_REF_PIN_READY",
"subscription_ready_before_prompt": true,
"opencode_api_prompt_count": 1,
"provider_request_count_observed": false,
"message_roles": [
"user",
"assistant"
],
"cleanup_status": "pass",
"status": "pass"
},
"consumer_verification": {
"source_guard": {
"runs": 4,
"assertions": 110,
"failures": 0,
"errors": 0
},
"focused_tests": {
"runs": 31,
"assertions": 248,
"failures": 0,
"errors": 0
},
"bounded_full_tests": {
"runs": 2300,
"assertions": 21679,
"failures": 0,
"errors": 0
},
"rubocop": {
"changed_ruby_files": 6,
"offenses": 0
},
"remotes_exact": [
"origin",
"github",
"backup"
]
}
}

103
evidence/2026-07-20-opencode-alpha8-pre-release-shared-client.json
View File

@@ -1,103 +0,0 @@
{
"schema_version": 1,
"kind": "pre-release-client-image-review-input",
"status": "pass",
"certification_status": "not-certified",
"publication_state": "unpublished",
"coverage_scope": "shared-client-contract-only",
"clients": {
"opencode_ruby": {
"version": "0.0.1.alpha8",
"commit": "9277646a4bb2cf25a8384ffc140b154f49ea5766",
"executed": true
},
"opencode_rails": {
"version": "0.0.1.alpha8",
"commit": "a9add2a7c1dd3eb978aa8b4ebf9ef7e111d1057f",
"executed_by_image_contract": false
}
},
"checks": [
{
"id": "upstream-1.16.1",
"checked_at": "2026-07-20T05:38:34Z",
"image": "ghcr.io/anomalyco/opencode@sha256:e975a0647576016dfdf77d54b979ca30d32b4750472c10263e9894aad6628c2a",
"docker_image_id": "sha256:e975a0647576016dfdf77d54b979ca30d32b4750472c10263e9894aad6628c2a",
"platform": "linux/amd64",
"reported_version": "1.16.1",
"status": "pass",
"expected_text": "compat-ok",
"full_text": "compat-ok",
"authoritative_assistant_message_count": 1,
"llm_request_count": 1,
"executed_profiles": ["ruby-rest-sse"],
"required_consumer_profiles": ["rails-persisted-turn"]
},
{
"id": "upstream-1.17.18",
"checked_at": "2026-07-20T05:39:06Z",
"image": "ghcr.io/anomalyco/opencode@sha256:bf9d0e84b7cedef436a8f57db4d48767cd5d8fc6604f666335c1cc916b199a97",
"docker_image_id": "sha256:bf9d0e84b7cedef436a8f57db4d48767cd5d8fc6604f666335c1cc916b199a97",
"platform": "linux/amd64",
"reported_version": "1.17.18",
"status": "pass",
"expected_text": "compat-ok",
"full_text": "compat-ok",
"authoritative_assistant_message_count": 1,
"llm_request_count": 1,
"executed_profiles": ["ruby-rest-sse"],
"required_consumer_profiles": ["plugin-ledger"]
},
{
"id": "upstream-1.18.3",
"checked_at": "2026-07-20T05:39:18Z",
"image": "ghcr.io/anomalyco/opencode@sha256:c2d5d6398df72aac85cb1bdc8f900c71a9b75a33fb7c0a76dc1484e4b126e41e",
"docker_image_id": "sha256:c2d5d6398df72aac85cb1bdc8f900c71a9b75a33fb7c0a76dc1484e4b126e41e",
"platform": "linux/amd64",
"reported_version": "1.18.3",
"status": "pass",
"expected_text": "compat-ok",
"full_text": "compat-ok",
"authoritative_assistant_message_count": 1,
"llm_request_count": 1,
"executed_profiles": ["ruby-rest-sse"],
"required_consumer_profiles": ["rails-persisted-turn", "plugin-ledger"]
},
{
"id": "ajent-blackline-alpha8-shared-contract",
"checked_at": "2026-07-20T05:39:57Z",
"image": "sha256:239e3dc6cd2958251cda636fb20bd7cd7c46f596bd4c61cb81863ebc49d824e8",
"docker_image_id": "sha256:239e3dc6cd2958251cda636fb20bd7cd7c46f596bd4c61cb81863ebc49d824e8",
"platform": "linux/amd64",
"reported_version": "1.18.3",
"status": "pass",
"expected_text": "compat-ok",
"full_text": "compat-ok",
"authoritative_assistant_message_count": 1,
"llm_request_count": 1,
"executed_profiles": ["ruby-rest-sse"],
"required_consumer_profiles": ["rails-persisted-turn", "plugin-ledger"]
},
{
"id": "mushu-permission-shortcuts-alpha8-shared-contract",
"checked_at": "2026-07-20T05:40:08Z",
"image": "sha256:ed6293ca87e6db1dc07870d3ed6da21960743e6e2e904533b3c566d334b58d6a",
"docker_image_id": "sha256:ed6293ca87e6db1dc07870d3ed6da21960743e6e2e904533b3c566d334b58d6a",
"platform": "linux/amd64",
"reported_version": "0.0.0-permission-shortcuts-202606300721",
"status": "pass",
"expected_text": "compat-ok",
"full_text": "compat-ok",
"authoritative_assistant_message_count": 1,
"llm_request_count": 1,
"executed_profiles": ["ruby-rest-sse"],
"required_consumer_profiles": []
}
],
"limitations": [
"This local evidence has no GitHub workflow run provenance and is review input only.",
"The exact-image contract executed opencode-ruby but did not execute opencode-rails.",
"Rails persistence, plugin-ledger, consumer application, deployment, and user-visible canary profiles remain unverified.",
"No runtime tuple was promoted and no consumer was deployed."
]
}

154
lib/opencode_compat/client_candidate.rb
View File

@@ -1,154 +0,0 @@
# frozen_string_literal: true
require "json"
require "rubygems"
module OpenCodeCompat
class ClientCandidate
class ValidationError < StandardError; end
SCHEMA_VERSION = 3
CLIENT_NAMES = %w[opencode-rails opencode-ruby].freeze
PUBLICATION_PROVENANCE = {
"published" => "annotated-tag",
"unpublished" => "commit"
}.freeze
SHA_PATTERN = /\A[0-9a-f]{40}\z/
def self.load(path)
new(JSON.parse(File.binread(path)))
rescue JSON::ParserError => error
raise ValidationError, "client candidate is not valid JSON: #{error.message}"
end
attr_reader :document
def initialize(document)
@document = document
end
def verify!
assert_exact_keys!(document,
%w[clients publication_state release_train schema_version status], "client candidate")
assert_equal!(SCHEMA_VERSION, document.fetch("schema_version"), "schema_version")
assert_equal!("candidate", document.fetch("status"), "status")
release_train = exact_version!(document.fetch("release_train"), "release_train")
publication_state = document.fetch("publication_state")
expected_kind = PUBLICATION_PROVENANCE.fetch(publication_state) do
raise ValidationError,
"publication_state must be one of #{PUBLICATION_PROVENANCE.keys.join(', ')}, got #{publication_state.inspect}"
end
clients = document.fetch("clients")
assert_equal!(CLIENT_NAMES, clients.keys.sort, "client names")
clients.each do |name, client|
validate_client!(name, client, release_train, expected_kind)
end
validate_runtime_dependency!(clients, release_train)
self
rescue KeyError => error
raise ValidationError, "client candidate is missing required field #{error.key.inspect}"
end
def github_outputs
verify!
clients = document.fetch("clients")
{
"publication_state" => document.fetch("publication_state"),
"ruby_provenance_kind" => provenance(clients, "opencode-ruby").fetch("kind"),
"ruby_ref" => clients.dig("opencode-ruby", "ref"),
"ruby_tag" => provenance(clients, "opencode-ruby")["tag"].to_s,
"ruby_tag_object" => provenance(clients, "opencode-ruby")["annotated_tag_object"].to_s,
"ruby_version" => clients.dig("opencode-ruby", "version"),
"rails_provenance_kind" => provenance(clients, "opencode-rails").fetch("kind"),
"rails_ref" => clients.dig("opencode-rails", "ref"),
"rails_tag" => provenance(clients, "opencode-rails")["tag"].to_s,
"rails_tag_object" => provenance(clients, "opencode-rails")["annotated_tag_object"].to_s,
"rails_version" => clients.dig("opencode-rails", "version")
}
end
private
def validate_client!(name, client, release_train, expected_kind)
expected_keys = %w[provenance ref repository version]
expected_keys << "runtime_dependencies" if name == "opencode-rails"
assert_exact_keys!(client, expected_keys.sort, "#{name} candidate")
assert_equal!("ajaynomics/#{name}", client.fetch("repository"), "#{name} repository")
assert_equal!(release_train, exact_version!(client.fetch("version"), "#{name} version"), "#{name} version")
ref = exact_commit!(client.fetch("ref"), "#{name} ref")
source = client.fetch("provenance")
assert_equal!(expected_kind, source.fetch("kind"), "#{name} provenance kind")
case expected_kind
when "commit"
assert_exact_keys!(source, %w[commit kind], "#{name} commit provenance")
assert_equal!(ref, exact_commit!(source.fetch("commit"), "#{name} provenance commit"),
"#{name} provenance commit")
when "annotated-tag"
assert_exact_keys!(source, %w[annotated_tag_object kind peeled_commit tag],
"#{name} annotated-tag provenance")
assert_equal!("v#{release_train}", exact_tag!(source.fetch("tag"), "#{name} tag"), "#{name} tag")
exact_commit!(source.fetch("annotated_tag_object"), "#{name} annotated tag object")
assert_equal!(ref, exact_commit!(source.fetch("peeled_commit"), "#{name} peeled commit"),
"#{name} peeled commit")
end
end
def validate_runtime_dependency!(clients, release_train)
dependency = clients.fetch("opencode-rails")
.fetch("runtime_dependencies")
.fetch("opencode-ruby")
assert_exact_keys!(dependency, %w[ref requirement], "opencode-rails runtime dependency")
assert_equal!("= #{release_train}", dependency.fetch("requirement"),
"opencode-rails runtime dependency requirement")
assert_equal!(clients.dig("opencode-ruby", "ref"),
exact_commit!(dependency.fetch("ref"), "opencode-rails runtime dependency ref"),
"opencode-rails runtime dependency ref")
end
def provenance(clients, name)
clients.fetch(name).fetch("provenance")
end
def exact_commit!(value, label)
return value if value.is_a?(String) && value.match?(SHA_PATTERN)
raise ValidationError, "#{label} must be a full lowercase 40-character Git commit, got #{value.inspect}"
end
def exact_tag!(value, label)
if value.is_a?(String) && value.match?(/\A[A-Za-z0-9][A-Za-z0-9._-]*\z/) &&
!value.include?("..") && !value.end_with?(".")
return value
end
raise ValidationError, "#{label} must be a safe exact Git tag, got #{value.inspect}"
end
def exact_version!(value, label)
if value.is_a?(String) && value.match?(/\A[0-9A-Za-z][0-9A-Za-z.-]*\z/) && Gem::Version.correct?(value)
return value
end
raise ValidationError, "#{label} must be an exact RubyGems version, got #{value.inspect}"
end
def assert_exact_keys!(value, expected, label)
actual = value.keys.sort
return if actual == expected
raise ValidationError, "#{label} keys must equal #{expected.inspect}, got #{actual.inspect}"
end
def assert_equal!(expected, actual, label)
return if expected == actual
raise ValidationError, "#{label} must equal #{expected.inspect}, got #{actual.inspect}"
end
end
end

325
lib/opencode_compat/runtime_tuple_promoter.rb
View File

@@ -10,11 +10,14 @@ module OpenCodeCompat
class PromotionError < StandardError; end
class RuntimeTuplePromoter
SCHEMA_VERSION = 2
FULL_COMMIT = /\A[0-9a-f]{40}\z/
DIGEST = /\Asha256:[0-9a-f]{64}\z/
IMMUTABLE_IMAGE = /\A[^@\s]+@sha256:[0-9a-f]{64}\z/
UTC_TIMESTAMP = /\A\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z\z/
CERTIFICATION_STATUS = "pass"
DEGRADED_BOOTSTRAP_ACKNOWLEDGEMENT =
"accept-degraded-rollback-with-failed-emergency-provenance"
NON_CERTIFIABLE_TUPLE_STATUSES = %w[observed-production-contract-failed].freeze
TUPLE_METADATA_KEYS = %w[
certification
@@ -41,7 +44,7 @@ module OpenCodeCompat
manifest = read_manifest
consumer_entry = fetch_consumer!(manifest, consumer)
profile = fetch_profile!(consumer_entry, consumer)
candidate = prepare_candidate!(consumer_entry, consumer_commit)
candidate = prepare_candidate!(consumer_entry, consumer_commit, for_promotion: false)
current = consumer_entry.fetch("current") do
raise PromotionError, "#{consumer} has no current tuple to preserve as previous"
end
@@ -82,6 +85,37 @@ module OpenCodeCompat
end
end
def bootstrap_current(consumer:, consumer_commit:, certification:, acknowledgement:, dry_run: false)
validate_full_commit!(consumer_commit, "consumer commit")
unless acknowledgement == DEGRADED_BOOTSTRAP_ACKNOWLEDGEMENT
raise PromotionError,
"bootstrap requires explicit acknowledgement #{DEGRADED_BOOTSTRAP_ACKNOWLEDGEMENT.inspect}"
end
if dry_run
manifest = read_manifest
return bootstrap_current_manifest(
manifest,
consumer: consumer,
consumer_commit: consumer_commit,
certification: certification,
acknowledgement: acknowledgement
)
end
with_current_manifest_lock do |manifest|
bootstrapped = bootstrap_current_manifest(
manifest,
consumer: consumer,
consumer_commit: consumer_commit,
certification: certification,
acknowledgement: acknowledgement
)
atomic_write(bootstrapped)
bootstrapped
end
end
private
def read_manifest
@@ -93,7 +127,7 @@ module OpenCodeCompat
def promote_manifest(manifest, consumer:, consumer_commit:, certification:, previous_certification:)
consumer_entry = fetch_consumer!(manifest, consumer)
profile = fetch_profile!(consumer_entry, consumer)
candidate = prepare_candidate!(consumer_entry, consumer_commit)
candidate = prepare_candidate!(consumer_entry, consumer_commit, for_promotion: true)
current = consumer_entry.fetch("current") do
raise PromotionError, "#{consumer} has no current tuple to preserve as previous"
end
@@ -124,13 +158,60 @@ module OpenCodeCompat
consumer_entry["previous"] = certified_previous
consumer_entry["current"] = certified_candidate
consumer_entry["candidate"] = nil
manifest["migration_state"] = all_consumers_certified?(manifest) ? "certified" : "candidate"
consumer_entry.delete("rollback_state")
manifest["migration_state"] = migration_state_for(manifest)
manifest
end
def bootstrap_current_manifest(manifest, consumer:, consumer_commit:, certification:, acknowledgement:)
consumer_entry = fetch_consumer!(manifest, consumer)
profile = fetch_profile!(consumer_entry, consumer)
candidate = prepare_candidate!(consumer_entry, consumer_commit, for_promotion: true)
current = consumer_entry.fetch("current") do
raise PromotionError, "#{consumer} has no current tuple to retain as emergency provenance"
end
validate_tuple!(current, "#{consumer} current")
unless NON_CERTIFIABLE_TUPLE_STATUSES.include?(current["status"])
raise PromotionError, "degraded bootstrap is only for a current tuple known to fail the contract"
end
candidate_fingerprint = tuple_fingerprint(candidate, consumer: consumer, profile: profile)
current_fingerprint = tuple_fingerprint(current, consumer: consumer, profile: profile)
if candidate_fingerprint == current_fingerprint
raise PromotionError, "#{consumer} candidate is identical to its failed current tuple"
end
certified_candidate = certify_tuple!(
candidate,
consumer: consumer,
profile: profile,
supplied: certification,
expected_fingerprint: candidate_fingerprint,
label: "bootstrap candidate"
)
consumer_entry["emergency_provenance"] = deep_copy(current)
consumer_entry["current"] = certified_candidate
consumer_entry["candidate"] = nil
consumer_entry["previous"] = nil
consumer_entry["rollback_state"] = {
"status" => "degraded-no-certified-previous",
"acknowledgement" => acknowledgement,
"recorded_at" => certification.fetch("certified_at"),
"emergency_provenance_status" => current.fetch("status")
}
manifest["migration_state"] = migration_state_for(manifest)
manifest["promotion_readiness"] = {
"status" => "bootstrap-current-only",
"reason" => "The current tuple is certified, but no independently passing previous tuple exists.",
"required_action" => "Certify the next meaningful release; normal promotion will then retain this current tuple as the first certified previous rollback."
}
manifest
end
def fetch_consumer!(manifest, consumer)
unless manifest.is_a?(Hash) && manifest["schema_version"] == 1 && manifest["consumers"].is_a?(Hash)
raise PromotionError, "runtime tuple manifest must use schema_version 1 and contain consumers"
unless manifest.is_a?(Hash) && manifest["schema_version"] == SCHEMA_VERSION && manifest["consumers"].is_a?(Hash)
raise PromotionError, "runtime tuple manifest must use schema_version #{SCHEMA_VERSION} and contain consumers"
end
manifest.fetch("consumers").fetch(consumer) do
@@ -138,7 +219,7 @@ module OpenCodeCompat
end
end
def prepare_candidate!(consumer_entry, consumer_commit)
def prepare_candidate!(consumer_entry, consumer_commit, for_promotion:)
candidate = consumer_entry["candidate"]
unless candidate.is_a?(Hash)
raise PromotionError, "consumer has no candidate tuple to promote"
@@ -155,9 +236,151 @@ module OpenCodeCompat
prepared = deep_copy(candidate)
prepared["consumer_commit"] = consumer_commit
validate_tuple!(prepared, "candidate")
validate_candidate_consumer_ref!(prepared, consumer_commit)
validate_candidate_client_sources!(prepared)
if for_promotion
validate_promotion_provenance!(prepared, consumer_commit)
validate_promotion_product_artifacts!(prepared.fetch("runtime"))
end
prepared
end
def validate_candidate_consumer_ref!(candidate, consumer_commit)
reference = candidate["consumer_ref"]
unless reference.is_a?(Hash)
raise PromotionError, "candidate must record its exact consumer ref"
end
kind = reference["kind"]
unless %w[pull-request-head main-commit].include?(kind)
raise PromotionError, "candidate consumer ref must be a pull-request-head or main-commit"
end
validate_full_commit!(reference["commit"], "candidate consumer ref commit")
validate_full_commit!(reference["tree"], "candidate consumer ref tree")
unless reference["commit"] == consumer_commit
raise PromotionError, "candidate consumer ref does not match the tuple consumer commit"
end
unless reference["repository"].is_a?(String) && !reference["repository"].empty?
raise PromotionError, "candidate consumer ref must name its repository"
end
return unless kind == "pull-request-head"
validate_full_commit!(reference["base_commit"], "candidate pull request base commit")
unless reference["review_url"].is_a?(String) && reference["review_url"].start_with?("https://")
raise PromotionError, "candidate pull request ref must include its HTTPS review URL"
end
end
def validate_candidate_client_sources!(candidate)
%w[opencode_ruby opencode_rails].each do |client_name|
client = candidate[client_name]
next unless client
validate_client_source!(client, "candidate #{client_name}", required: true)
end
end
def validate_promotion_provenance!(candidate, consumer_commit)
unless candidate["certification_scope"] == "promotion-deployed" && candidate["promotion_eligible"] == true
raise PromotionError,
"pre-merge pull-request evidence is candidate-only; promotion requires deployed certification scope"
end
provenance = candidate["promotion_provenance"]
unless provenance.is_a?(Hash)
raise PromotionError, "promotion requires main-commit provenance or an identical-tree attestation"
end
case provenance["kind"]
when "main-commit"
unless candidate.dig("consumer_ref", "kind") == "main-commit" &&
provenance["main_commit"] == consumer_commit
raise PromotionError, "main-commit promotion provenance must match the tuple consumer commit"
end
validate_post_merge_canary!(
provenance["post_merge_canary"],
consumer_commit: provenance["main_commit"]
)
when "identical-tree-attestation"
validate_identical_tree_attestation!(candidate, provenance, consumer_commit)
else
raise PromotionError, "unknown promotion provenance kind #{provenance['kind'].inspect}"
end
end
def validate_identical_tree_attestation!(candidate, provenance, consumer_commit)
validate_full_commit!(provenance["pull_request_commit"], "attested pull request commit")
validate_full_commit!(provenance["pull_request_tree"], "attested pull request tree")
validate_full_commit!(provenance["main_commit"], "attested main commit")
validate_full_commit!(provenance["main_tree"], "attested main tree")
validate_timestamp!(provenance["attested_at"], "identical-tree attestation timestamp")
unless provenance["pull_request_commit"] == consumer_commit &&
provenance["pull_request_tree"] == candidate.dig("consumer_ref", "tree") &&
provenance["main_tree"] == provenance["pull_request_tree"]
raise PromotionError, "identical-tree attestation does not match the candidate and main trees"
end
validate_post_merge_canary!(
provenance["post_merge_canary"],
consumer_commit: provenance["main_commit"]
)
end
def validate_post_merge_canary!(canary, consumer_commit:)
unless canary.is_a?(Hash) && canary["status"] == "pass"
raise PromotionError, "promotion requires a passing post-merge canary"
end
validate_timestamp!(canary["checked_at"], "post-merge canary timestamp")
evidence = Array(canary["evidence"])
if evidence.empty? || evidence.any? { |path| !path.is_a?(String) || !path.start_with?("evidence/") }
raise PromotionError, "post-merge canary must reference evidence under evidence/"
end
evidence.each do |reference|
validate_post_merge_canary_evidence!(
reference,
checked_at: canary.fetch("checked_at"),
consumer_commit: consumer_commit
)
end
end
def validate_post_merge_canary_evidence!(reference, checked_at:, consumer_commit:)
relative = Pathname.new(reference).cleanpath
if relative.absolute? || relative.each_filename.first != "evidence"
raise PromotionError, "post-merge canary evidence must stay under evidence/"
end
evidence_root = File.realpath(File.join(@root, "evidence"))
real_path = File.realpath(File.join(@root, relative.to_s))
unless real_path.start_with?("#{evidence_root}#{File::SEPARATOR}")
raise PromotionError, "post-merge canary evidence resolves outside evidence/"
end
document = parse_json(File.read(real_path), relative.to_s)
unless document.is_a?(Hash) && document["schema_version"] == 1 &&
document["status"] == "pass" && document["checked_at"] == checked_at &&
document["consumer_commit"] == consumer_commit
raise PromotionError,
"post-merge canary evidence must match its passing timestamp and main consumer commit"
end
rescue Errno::ENOENT
raise PromotionError, "post-merge canary evidence does not exist: #{reference}"
end
def validate_promotion_product_artifacts!(runtime)
selection = runtime["product_selection"]
return unless selection
selected_products = selection.fetch("references").keys.sort
artifact_products = runtime.fetch("product_images", {}).keys.sort
return if selected_products == artifact_products
raise PromotionError,
"promotion requires exact content IDs or digests for every selected product image"
end
def fetch_profile!(consumer_entry, consumer)
profile = consumer_entry["profile"]
unless profile.is_a?(String) && profile.match?(/\A[a-z0-9][a-z0-9-]*\z/)
@@ -346,6 +569,46 @@ module OpenCodeCompat
end
validate_full_commit!(client["git_commit"], "#{label} git commit")
validate_client_source!(client, label, required: false)
end
def validate_client_source!(client, label, required:)
source = client["source"]
if source.nil?
raise PromotionError, "#{label} must include loaded exact-ref source proof" if required
return
end
unless source.is_a?(Hash) && source["type"] == "git" && source["uri"].is_a?(String) && !source["uri"].empty?
raise PromotionError, "#{label} source must identify its Git URI"
end
commit = client.fetch("git_commit")
%w[requested_ref locked_revision].each do |key|
unless source[key] == commit
raise PromotionError, "#{label} source #{key} must equal the peeled client commit"
end
end
proof = source["loaded_source_proof"]
unless proof.is_a?(Hash) && proof["status"] == "pass" && proof["source_class"] == "Bundler::Source::Git"
raise PromotionError, "#{label} must include passing Bundler Git loaded-source proof"
end
expected = {
"loaded_version" => client.fetch("version"),
"observed_revision" => commit
}
expected.each do |key, value|
unless proof[key] == value
raise PromotionError, "#{label} loaded-source proof #{key} must equal #{value.inspect}"
end
end
if proof.key?("observed_ref") && proof["observed_ref"] != commit
raise PromotionError, "#{label} loaded-source proof observed_ref must equal #{commit.inspect}"
end
unless proof["test"].is_a?(String) && !proof["test"].empty?
raise PromotionError, "#{label} loaded-source proof must name the consumer test"
end
end
def validate_runtime!(runtime, label)
@@ -355,6 +618,47 @@ module OpenCodeCompat
end
exact_execution_coordinate = false
product_selection = runtime["product_selection"]
if product_selection
unless product_selection.is_a?(Hash) && product_selection["strategy"] == "full-consumer-commit-tag"
raise PromotionError, "#{label} product_selection must use the full-consumer-commit-tag strategy"
end
validate_full_commit!(product_selection["source_commit"], "#{label} product selection source commit")
references = product_selection["references"]
unless references.is_a?(Hash) && !references.empty?
raise PromotionError, "#{label} product selection references must be a non-empty object"
end
references.each do |product, reference|
unless product.match?(/\A[a-z0-9][a-z0-9-]*\z/) &&
reference.is_a?(String) && reference.end_with?(":#{product_selection['source_commit']}")
raise PromotionError,
"#{label} #{product} selection must end in the full consumer commit tag"
end
end
exact_execution_coordinate = true
end
product_images = runtime["product_images"]
if product_images
unless product_images.is_a?(Hash) && !product_images.empty?
raise PromotionError, "#{label} product_images must be a non-empty object"
end
product_images.each do |product, coordinate|
unless product.match?(/\A[a-z0-9][a-z0-9-]*\z/) && coordinate.is_a?(Hash)
raise PromotionError, "#{label} product image entries must use named coordinate objects"
end
image_id = coordinate["docker_image_id"]
image = coordinate["image"]
unless (image_id.is_a?(String) && image_id.match?(DIGEST)) ||
(image.is_a?(String) && image.match?(IMMUTABLE_IMAGE))
raise PromotionError,
"#{label} #{product} product image must include an exact sha256 image ID or OCI digest"
end
validate_full_commit!(coordinate["source_commit"], "#{label} #{product} source commit")
exact_execution_coordinate = true
end
end
runtime.each do |key, value|
if key == "docker_image_id" || key.end_with?("_image_id")
unless value.is_a?(String) && value.match?(DIGEST)
@@ -455,6 +759,15 @@ module OpenCodeCompat
end
end
def migration_state_for(manifest)
return "certified" if all_consumers_certified?(manifest)
degraded = manifest.fetch("consumers").any? do |_consumer, entry|
entry.dig("rollback_state", "status") == "degraded-no-certified-previous"
end
degraded ? "bootstrap-current-only" : "candidate"
end
def with_current_manifest_lock
loop do
retry_with_new_inode = false

33
manifests/client-candidate.json
View File

@@ -1,32 +1,11 @@
{
"schema_version": 3,
"release_train": "0.0.1.alpha8",
"publication_state": "unpublished",
"clients": {
"opencode-ruby": {
"repository": "ajaynomics/opencode-ruby",
"ref": "9277646a4bb2cf25a8384ffc140b154f49ea5766",
"version": "0.0.1.alpha8",
"provenance": {
"kind": "commit",
"commit": "9277646a4bb2cf25a8384ffc140b154f49ea5766"
}
},
"opencode-rails": {
"repository": "ajaynomics/opencode-rails",
"ref": "a9add2a7c1dd3eb978aa8b4ebf9ef7e111d1057f",
"version": "0.0.1.alpha8",
"provenance": {
"kind": "commit",
"commit": "a9add2a7c1dd3eb978aa8b4ebf9ef7e111d1057f"
},
"runtime_dependencies": {
"opencode-ruby": {
"requirement": "= 0.0.1.alpha8",
"ref": "9277646a4bb2cf25a8384ffc140b154f49ea5766"
}
}
}
"ref": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"version": "0.0.1.alpha7",
"tag_provenance": {
"tag": "v0.0.1.alpha7",
"annotated_tag_object": "abfce3ec8cb1ee468107d0845521769502251645",
"peeled_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798"
},
"status": "candidate"
}

82
manifests/image-matrix.json
View File

@@ -1,12 +1,5 @@
{
"schema_version": 2,
"client_candidate": {
"release_train": "0.0.1.alpha8",
"publication_state": "unpublished",
"opencode_ruby_commit": "9277646a4bb2cf25a8384ffc140b154f49ea5766",
"opencode_rails_commit": "a9add2a7c1dd3eb978aa8b4ebf9ef7e111d1057f",
"certification_status": "pending"
},
"schema_version": 1,
"public_ci": [
{
"id": "upstream-1.16.1",
@@ -16,15 +9,12 @@
"consumers": ["travelwolf"],
"profiles": ["ruby-rest-sse"],
"required_consumer_profiles": ["rails-persisted-turn"],
"certification_status": "pending",
"previous_certification": {
"status": "certified",
"client_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"certified_at": "2026-07-18T22:03:12Z",
"certification_status": "certified",
"certified_client_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"certified_at": "2026-07-18T23:35:57Z",
"expected_text": "compat-ok",
"full_text": "compat-ok",
"llm_request_count": 1
}
},
{
"id": "upstream-1.17.18",
@@ -34,15 +24,12 @@
"consumers": ["opencode-ajent"],
"profiles": ["ruby-rest-sse"],
"required_consumer_profiles": ["plugin-ledger"],
"certification_status": "pending",
"previous_certification": {
"status": "certified",
"client_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"certified_at": "2026-07-18T22:03:13Z",
"certification_status": "certified",
"certified_client_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"certified_at": "2026-07-18T23:35:58Z",
"expected_text": "compat-ok",
"full_text": "compat-ok",
"llm_request_count": 1
}
},
{
"id": "upstream-1.18.3",
@@ -52,56 +39,55 @@
"consumers": ["ajent-rails"],
"profiles": ["ruby-rest-sse"],
"required_consumer_profiles": ["rails-persisted-turn", "plugin-ledger"],
"certification_status": "pending",
"previous_certification": {
"status": "certified",
"client_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"certified_at": "2026-07-18T22:03:14Z",
"certification_status": "certified",
"certified_client_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"certified_at": "2026-07-18T23:35:58Z",
"expected_text": "compat-ok",
"full_text": "compat-ok",
"llm_request_count": 1
}
}
],
"host_canary": [
{
"id": "ajent-blackline-alpha7-canary",
"consumer": "ajent-rails",
"consumer_commit": "96552893baccd5ccba1592b2585edfef1299b4f9",
"tag_provenance": "ajent-opencode-blackline-canary:96552893",
"docker_image_id": "sha256:239e3dc6cd2958251cda636fb20bd7cd7c46f596bd4c61cb81863ebc49d824e8",
"source_commit": "96552893baccd5ccba1592b2585edfef1299b4f9",
"consumer_commit": "01cdf9da8e1b3f9a205d681e448aefefd9704db2",
"consumer_ref_kind": "pull-request-head",
"certification_scope": "pre-merge-pr-head-candidate-only",
"promotion_eligible": false,
"tag_provenance": "ajent-opencode-blackline-canary:01cdf9da8e1b3f9a205d681e448aefefd9704db2",
"docker_image_id": "sha256:075cb49ac7fcb1f8972e051dff96d655fa0d0d911d83a523a6abf03a5e2e2935",
"source_commit": "01cdf9da8e1b3f9a205d681e448aefefd9704db2",
"reported_version": "1.18.3",
"upstream_base": "ghcr.io/anomalyco/opencode@sha256:c2d5d6398df72aac85cb1bdc8f900c71a9b75a33fb7c0a76dc1484e4b126e41e",
"profiles": ["rails-persisted-turn"],
"certification_status": "pending",
"previous_certification": {
"status": "candidate-certified",
"client_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"rails_commit": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb",
"certified_at": "2026-07-18T21:58:00Z",
"certification_status": "candidate-certified",
"certified_client_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"certified_rails_commit": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb",
"certified_at": "2026-07-18T23:28:16.435369Z",
"persisted_final_text": "compat-ok",
"model_request_count": 1
}
"authoritative_final_text": "compat-ok",
"model_request_count": 1,
"product_artifacts_missing_before_promotion": ["aigl", "raven"]
},
{
"id": "mushu-permission-shortcuts-alpha7-canary",
"consumer": "mushu",
"consumer_commit": "f26d958b64f214a422aeb629860c8c9a46a4c084",
"run_id": "mushu-alpha7-20260718T215300Z-f26d958",
"consumer_commit": "7cff22788b36ae703f6b1b8fa39b52d6dbafe7e0",
"consumer_ref_kind": "pull-request-head",
"certification_scope": "pre-merge-pr-head-candidate-only",
"promotion_eligible": false,
"tag_provenance": "docker-registry:5000/mushu-opencode:sha-99d6328b1",
"image": "docker-registry:5000/mushu-opencode@sha256:ed6293ca87e6db1dc07870d3ed6da21960743e6e2e904533b3c566d334b58d6a",
"docker_image_id": "sha256:ed6293ca87e6db1dc07870d3ed6da21960743e6e2e904533b3c566d334b58d6a",
"source_commit": "99d6328b18ff8a340a928449a2aa8bc184a063f9",
"reported_version": "0.0.0-permission-shortcuts-202606300721",
"profiles": ["ruby-rest-sse"],
"certification_status": "pending",
"previous_certification": {
"status": "candidate-certified",
"client_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"certified_at": "2026-07-18T21:53:00Z",
"persisted_final_text": "compat-ok",
"model_request_count": 1
}
"certification_status": "candidate-certified",
"certified_client_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"certified_at": "2026-07-18T23:26:06.865190Z",
"authoritative_final_text": "compat-ok",
"provider_request_count": 1
}
]
}

270
manifests/runtime-tuples.json
View File

@@ -1,18 +1,19 @@
{
"schema_version": 1,
"$schema": "../schemas/runtime-tuples.schema.json",
"schema_version": 2,
"migration_state": "candidate",
"promotion_readiness": {
"status": "blocked",
"reason": "Every observed alpha2 baseline fails the hardened exact-final-text contract, so none can be certified as the previous rollback tuple.",
"reason": "Every observed alpha2 baseline fails the hardened exact-final-text contract, so none can be certified as the previous rollback tuple; the passing evidence is also bound to unmerged pull-request heads.",
"evidence": "evidence/2026-07-18-opencode-ruby-alpha2-regression.json",
"required_action": "Create and canary a distinct rollback consumer commit that pins alpha7 and the exact runtime before promoting any candidate."
"required_action": "Merge, deploy, and canary the exact main/merge tuple (or record an identical-tree attestation plus post-merge canary), then explicitly acknowledge bootstrap-current-only; previous remains null until the next meaningful independently passing release."
},
"consumers": {
"ajent-rails": {
"profile": "rails-persisted-turn",
"current": {
"status": "observed-production-contract-failed",
"consumer_commit": "83eed3c247a352842b08fc5cf339c4d0acdaacba",
"consumer_commit": "8d8550265dca0ac06a41d5427c585ede56bbb808",
"opencode_ruby": {
"version": "0.0.1.alpha2",
"git_commit": "889d38332f98f5f7b76d16952b7204d8a5b9a662"
@@ -22,21 +23,83 @@
"git_commit": "9b0c4cd3cd31bdfebbb89567daca012d68a356ea"
},
"runtime": {
"tag_provenance": "docker-registry:5000/opencode-blackline:83eed3c247a352842b08fc5cf339c4d0acdaacba",
"docker_image_id": "sha256:6fb2b3bf8e4cdf48e16bf6c3475e953df2f8304e77f5efe816ceb46f905eead8",
"tag_provenance": "docker-registry:5000/opencode-blackline:8d8550265dca0ac06a41d5427c585ede56bbb808",
"docker_image_id": "sha256:af479243e6ccf1206f57dffd13b8e9d2c028de401cccc954bcc2f00940274c60",
"source_commit": "8d8550265dca0ac06a41d5427c585ede56bbb808",
"reported_version": "1.18.3",
"upstream_base": "ghcr.io/anomalyco/opencode@sha256:c2d5d6398df72aac85cb1bdc8f900c71a9b75a33fb7c0a76dc1484e4b126e41e"
"upstream_base": "ghcr.io/anomalyco/opencode@sha256:c2d5d6398df72aac85cb1bdc8f900c71a9b75a33fb7c0a76dc1484e4b126e41e",
"upstream_base_proof": {
"method": "rootfs-prefix-layer-match",
"matched_layer_count": 4,
"status": "pass",
"note": "The deployed images match the exact 1.18.3 base layers even though this main commit selected the mutable upstream tag at build time."
},
"deployed_product_selection": {
"strategy": "mutable-latest",
"status": "observed-configuration-drift-failure",
"references": {
"aigl": "docker-registry:5000/opencode-aigl:latest",
"blackline": "docker-registry:5000/opencode-blackline:latest",
"raven": "docker-registry:5000/opencode-raven:latest"
},
"note": "The shared Blackline accessory used the SHA tag above, but Rails ProductConfig resolved per-user AIGL, Blackline, and Raven containers through mutable latest references."
},
"ci_built_product_images": {
"aigl": {
"tag_provenance": "docker-registry:5000/opencode-aigl:8d8550265dca0ac06a41d5427c585ede56bbb808",
"docker_image_id": "sha256:72c454f39d423618b75439122c9073dbba7c9071421e5f3abd12cf288dc1f898",
"source_commit": "8d8550265dca0ac06a41d5427c585ede56bbb808"
},
"blackline": {
"tag_provenance": "docker-registry:5000/opencode-blackline:8d8550265dca0ac06a41d5427c585ede56bbb808",
"docker_image_id": "sha256:af479243e6ccf1206f57dffd13b8e9d2c028de401cccc954bcc2f00940274c60",
"source_commit": "8d8550265dca0ac06a41d5427c585ede56bbb808"
},
"raven": {
"tag_provenance": "docker-registry:5000/opencode-raven:8d8550265dca0ac06a41d5427c585ede56bbb808",
"docker_image_id": "sha256:6c4da94a8dec6160f0b1b4d0e2cd9ff38a3faa18dbd2a8d6023a71f6416a544c",
"source_commit": "8d8550265dca0ac06a41d5427c585ede56bbb808"
}
}
}
},
"candidate": {
"status": "compatibility-certified",
"consumer_commit": "96552893baccd5ccba1592b2585edfef1299b4f9",
"certification_scope": "pre-merge-pr-head-candidate-only",
"promotion_eligible": false,
"promotion_blockers": [
"consumer-ref-is-an-unmerged-pull-request-head",
"aigl-and-raven-candidate-content-artifacts-have-not-been-built-and-canaried",
"no-certified-previous-tuple"
],
"consumer_commit": "01cdf9da8e1b3f9a205d681e448aefefd9704db2",
"consumer_ref": {
"kind": "pull-request-head",
"repository": "ajaynomics/ajent-rails",
"commit": "01cdf9da8e1b3f9a205d681e448aefefd9704db2",
"tree": "9e93834ad16b60fa5edfe1cb3baaba193402be74",
"base_commit": "8d8550265dca0ac06a41d5427c585ede56bbb808",
"review_url": "https://gitea.ajay.to/ajaynomics/ajent-rails/pulls/946"
},
"opencode_ruby": {
"version": "0.0.1.alpha7",
"git_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"tag_provenance": {
"tag": "v0.0.1.alpha7",
"annotated_tag_object": "abfce3ec8cb1ee468107d0845521769502251645"
},
"source": {
"type": "git",
"uri": "https://gitea.krishnan.ca/ajaynomics/opencode-ruby.git",
"requested_ref": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"locked_revision": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"loaded_source_proof": {
"status": "pass",
"source_class": "Bundler::Source::Git",
"loaded_version": "0.0.1.alpha7",
"observed_revision": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"test": "test/lib/opencode/runtime_image_provenance_test.rb"
}
}
},
"opencode_rails": {
@@ -45,23 +108,61 @@
"tag_provenance": {
"tag": "v0.0.1.alpha7",
"annotated_tag_object": "61e128084b2b665c0ba20b332987e41794948d7c"
},
"source": {
"type": "git",
"uri": "https://gitea.krishnan.ca/ajaynomics/opencode-rails.git",
"requested_ref": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb",
"locked_revision": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb",
"loaded_source_proof": {
"status": "pass",
"source_class": "Bundler::Source::Git",
"loaded_version": "0.0.1.alpha7",
"observed_revision": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb",
"test": "test/lib/opencode/runtime_image_provenance_test.rb"
}
}
},
"runtime": {
"tag_provenance": "ajent-opencode-blackline-canary:96552893",
"docker_image_id": "sha256:239e3dc6cd2958251cda636fb20bd7cd7c46f596bd4c61cb81863ebc49d824e8",
"source_commit": "96552893baccd5ccba1592b2585edfef1299b4f9",
"reported_version": "1.18.3",
"upstream_base": "ghcr.io/anomalyco/opencode@sha256:c2d5d6398df72aac85cb1bdc8f900c71a9b75a33fb7c0a76dc1484e4b126e41e"
"upstream_base": "ghcr.io/anomalyco/opencode@sha256:c2d5d6398df72aac85cb1bdc8f900c71a9b75a33fb7c0a76dc1484e4b126e41e",
"product_selection": {
"strategy": "full-consumer-commit-tag",
"source_commit": "01cdf9da8e1b3f9a205d681e448aefefd9704db2",
"references": {
"aigl": "docker-registry:5000/opencode-aigl:01cdf9da8e1b3f9a205d681e448aefefd9704db2",
"blackline": "docker-registry:5000/opencode-blackline:01cdf9da8e1b3f9a205d681e448aefefd9704db2",
"raven": "docker-registry:5000/opencode-raven:01cdf9da8e1b3f9a205d681e448aefefd9704db2"
}
},
"application_canary": {
"checked_at": "2026-07-18T21:58:00Z",
"path": "Blackline::GenerateResponseJob",
"persisted_final_text": "compat-ok",
"product_images": {
"blackline": {
"tag_provenance": "ajent-opencode-blackline-canary:01cdf9da8e1b3f9a205d681e448aefefd9704db2",
"docker_image_id": "sha256:075cb49ac7fcb1f8972e051dff96d655fa0d0d911d83a523a6abf03a5e2e2935",
"source_commit": "01cdf9da8e1b3f9a205d681e448aefefd9704db2"
}
}
},
"deterministic_contract": {
"checked_at": "2026-07-18T23:16:13Z",
"docker_image_id": "sha256:075cb49ac7fcb1f8972e051dff96d655fa0d0d911d83a523a6abf03a5e2e2935",
"expected_text": "compat-ok",
"full_text": "compat-ok",
"authoritative_assistant_count": 1,
"model_request_count": 1,
"status": "pass"
},
"certified_at": "2026-07-18T22:03:14Z"
"application_canary": {
"checked_at": "2026-07-18T23:28:16.435369Z",
"path": "Blackline::GenerateResponseJob",
"persisted_final_text": "compat-ok",
"authoritative_final_text": "compat-ok",
"authoritative_assistant_count": 1,
"model_request_count": 1,
"cleanup_status": "pass",
"status": "pass"
},
"certified_at": "2026-07-18T23:28:16.435369Z"
},
"previous": null
},
@@ -85,13 +186,41 @@
},
"candidate": {
"status": "compatibility-certified",
"consumer_commit": "19747b59fa21e12560afd9edd73ed674ab3a644c",
"certification_scope": "pre-merge-pr-head-candidate-only",
"promotion_eligible": false,
"promotion_blockers": [
"consumer-ref-is-an-unmerged-pull-request-head",
"no-certified-previous-tuple"
],
"consumer_commit": "b9a2c2dd361a6b2ea547cc67ee817b8eb4ce31e8",
"consumer_ref": {
"kind": "pull-request-head",
"repository": "ajaynomics/travelwolf",
"commit": "b9a2c2dd361a6b2ea547cc67ee817b8eb4ce31e8",
"tree": "8b3f8a97dc1f1d8b558a49523bf312d2810422df",
"base_commit": "75c92ed5248996e5278ac9a3351cc4eaf03df820",
"review_url": "https://gitea.ajay.to/ajaynomics/travelwolf/pulls/29"
},
"opencode_ruby": {
"version": "0.0.1.alpha7",
"git_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"tag_provenance": {
"tag": "v0.0.1.alpha7",
"annotated_tag_object": "abfce3ec8cb1ee468107d0845521769502251645"
},
"source": {
"type": "git",
"uri": "https://gitea.krishnan.ca/ajaynomics/opencode-ruby.git",
"requested_ref": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"locked_revision": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"loaded_source_proof": {
"status": "pass",
"source_class": "Bundler::Source::Git",
"loaded_version": "0.0.1.alpha7",
"observed_ref": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"observed_revision": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"test": "test/services/travelwolf/opencode_env_wiring_test.rb"
}
}
},
"opencode_rails": {
@@ -100,22 +229,52 @@
"tag_provenance": {
"tag": "v0.0.1.alpha7",
"annotated_tag_object": "61e128084b2b665c0ba20b332987e41794948d7c"
},
"source": {
"type": "git",
"uri": "https://gitea.krishnan.ca/ajaynomics/opencode-rails.git",
"requested_ref": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb",
"locked_revision": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb",
"loaded_source_proof": {
"status": "pass",
"source_class": "Bundler::Source::Git",
"loaded_version": "0.0.1.alpha7",
"observed_ref": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb",
"observed_revision": "2a391ccad1d098e4bb51eb19b6ca52adaa79e5cb",
"test": "test/services/travelwolf/opencode_env_wiring_test.rb"
}
}
},
"runtime": {
"image": "ghcr.io/anomalyco/opencode@sha256:e975a0647576016dfdf77d54b979ca30d32b4750472c10263e9894aad6628c2a",
"reported_version": "1.16.1"
},
"deterministic_contract": {
"evidence": "evidence/2026-07-18-opencode-ruby-alpha7.json",
"checked_at": "2026-07-18T23:23:03Z",
"image": "ghcr.io/anomalyco/opencode@sha256:e975a0647576016dfdf77d54b979ca30d32b4750472c10263e9894aad6628c2a",
"opencode_ruby_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"expected_text": "compat-ok",
"full_text": "compat-ok",
"authoritative_assistant_count": 1,
"model_request_count": 1,
"status": "pass"
},
"application_canary": {
"run_id": "20260718215135-8d8102c0",
"checked_at": "2026-07-18T21:51:56.552Z",
"final_text": "TRAVELWOLF_ALPHA7_SUBSCRIBE_READY",
"application_prompt_count": 1,
"model_request_count_observed": false,
"run_id": "travelwolf-alpha7-ref-20260718T232211Z-48eadf",
"checked_at": "2026-07-18T23:22:26.216140Z",
"final_text": "TRAVELWOLF_ALPHA7_REF_PIN_READY",
"subscription_ready_before_prompt": true,
"opencode_api_prompt_count": 1,
"provider_request_count_observed": false,
"message_roles": [
"user",
"assistant"
],
"cleanup_status": "pass",
"status": "pass"
},
"certified_at": "2026-07-18T22:03:14Z"
"certified_at": "2026-07-18T23:35:57Z"
},
"previous": null
},
@@ -130,36 +289,87 @@
},
"runtime": {
"tag_provenance": "docker-registry:5000/mushu-opencode:sha-99d6328b1",
"image": "docker-registry:5000/mushu-opencode@sha256:ed6293ca87e6db1dc07870d3ed6da21960743e6e2e904533b3c566d334b58d6a",
"docker_image_id": "sha256:ed6293ca87e6db1dc07870d3ed6da21960743e6e2e904533b3c566d334b58d6a",
"source_commit": "99d6328b18ff8a340a928449a2aa8bc184a063f9",
"base_image": "docker-registry:5000/mushu-opencode-base@sha256:de8a6adeefb30ce1c474cde23fe173dfe059434a13df0a54d14c7473edb33e16",
"reported_version": "0.0.0-permission-shortcuts-202606300721"
}
},
"candidate": {
"status": "compatibility-certified",
"consumer_commit": "f26d958b64f214a422aeb629860c8c9a46a4c084",
"certification_scope": "pre-merge-pr-head-candidate-only",
"promotion_eligible": false,
"promotion_blockers": [
"consumer-ref-is-an-unmerged-pull-request-head",
"no-certified-previous-tuple"
],
"consumer_commit": "7cff22788b36ae703f6b1b8fa39b52d6dbafe7e0",
"consumer_ref": {
"kind": "pull-request-head",
"repository": "ajaynomics/mushu",
"commit": "7cff22788b36ae703f6b1b8fa39b52d6dbafe7e0",
"tree": "762eb8dcc7042a52cd240ca69acdb9cb45150a84",
"base_commit": "fe16e5bab028e3c92cd5508ef2cebd9bfa23386f",
"review_url": "https://gitea.ajay.to/ajaynomics/mushu/pulls/1"
},
"opencode_ruby": {
"version": "0.0.1.alpha7",
"git_commit": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"tag_provenance": {
"tag": "v0.0.1.alpha7",
"annotated_tag_object": "abfce3ec8cb1ee468107d0845521769502251645"
},
"source": {
"type": "git",
"uri": "https://gitea.krishnan.ca/ajaynomics/opencode-ruby.git",
"requested_ref": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"locked_revision": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"loaded_source_proof": {
"status": "pass",
"source_class": "Bundler::Source::Git",
"loaded_version": "0.0.1.alpha7",
"observed_ref": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"observed_revision": "78b6f9c9e9c7d58b699af1c3c17764acd33de798",
"loaded_file_within_spec": true,
"test": "test/services/mushu/runtime/opencode_dependency_provenance_test.rb"
}
}
},
"runtime": {
"tag_provenance": "docker-registry:5000/mushu-opencode:sha-99d6328b1",
"image": "docker-registry:5000/mushu-opencode@sha256:ed6293ca87e6db1dc07870d3ed6da21960743e6e2e904533b3c566d334b58d6a",
"docker_image_id": "sha256:ed6293ca87e6db1dc07870d3ed6da21960743e6e2e904533b3c566d334b58d6a",
"source_commit": "99d6328b18ff8a340a928449a2aa8bc184a063f9",
"base_image": "docker-registry:5000/mushu-opencode-base@sha256:de8a6adeefb30ce1c474cde23fe173dfe059434a13df0a54d14c7473edb33e16",
"reported_version": "0.0.0-permission-shortcuts-202606300721"
},
"application_canary": {
"run_id": "mushu-alpha7-20260718T215300Z-f26d958",
"checked_at": "2026-07-18T21:53:00Z",
"persisted_final_text": "compat-ok",
"deterministic_contract": {
"checked_at": "2026-07-18T23:23:41Z",
"image": "docker-registry:5000/mushu-opencode@sha256:ed6293ca87e6db1dc07870d3ed6da21960743e6e2e904533b3c566d334b58d6a",
"expected_text": "compat-ok",
"full_text": "compat-ok",
"authoritative_assistant_count": 1,
"model_request_count": 1,
"status": "pass"
},
"certified_at": "2026-07-18T22:03:14Z"
"application_canary": {
"checked_at": "2026-07-18T23:26:06.865190Z",
"response_text": "compat-ok",
"authoritative_final_text": "compat-ok",
"message_roles": [
"user",
"assistant"
],
"authoritative_assistant_count": 1,
"provider_request_count": 1,
"mapping_and_last_turn_persisted": true,
"active_claim_cleared": true,
"opencode_session_deleted": true,
"synthetic_database_rows_after_cleanup": 0,
"status": "pass"
},
"certified_at": "2026-07-18T23:26:06.865190Z"
},
"previous": null
}

2
profiles/plugin-ledger.json
View File

@@ -1,6 +1,8 @@
{
"id": "plugin-ledger",
"owner": "opencode-ajent",
"certification_mode": "executable-consumer-attestation",
"shared_ruby_probe_sufficient": false,
"required_behaviors": [
"exact-upstream-image",
"exact-plugin-version",

2
profiles/provider-hooks.json
View File

@@ -1,6 +1,8 @@
{
"id": "provider-hooks",
"owner": "inference",
"certification_mode": "executable-consumer-attestation",
"shared_ruby_probe_sufficient": false,
"required_behaviors": [
"provider-schema",
"model-routing",

2
profiles/rails-persisted-turn.json
View File

@@ -1,6 +1,8 @@
{
"id": "rails-persisted-turn",
"owner": "opencode-rails",
"certification_mode": "executable-consumer-attestation",
"shared_ruby_probe_sufficient": false,
"extends": ["ruby-rest-sse"],
"required_behaviors": [
"session-recovery",

2
profiles/ruby-rest-sse.json
View File

@@ -1,6 +1,8 @@
{
"id": "ruby-rest-sse",
"owner": "opencode-ruby",
"certification_mode": "shared-ruby-fixture-and-live-probe",
"shared_ruby_probe_sufficient": true,
"required_fixtures": [
"legacy-idle",
"current-status-idle",

2
profiles/strict-v2.json
View File

@@ -1,6 +1,8 @@
{
"id": "strict-v2",
"owner": "leela",
"certification_mode": "executable-consumer-attestation",
"shared_ruby_probe_sufficient": false,
"required_behaviors": [
"exact-upstream-version-and-commit",
"bun-toolchain-provenance",

2
profiles/voice-stream.json
View File

@@ -1,6 +1,8 @@
{
"id": "voice-stream",
"owner": "greenroom",
"certification_mode": "executable-consumer-attestation",
"shared_ruby_probe_sufficient": false,
"extends": ["ruby-rest-sse"],
"required_behaviors": [
"legacy-and-current-terminal-events",

11
ruby/exact_live_contract.rb
View File

@@ -13,22 +13,13 @@ module OpenCodeCompat
end
def assert_model_request_count!(value)
count = Integer(value.to_s, 10)
count = Integer(value, 10)
return if count == 1
raise ContractError, "Expected exactly one deterministic model request, got #{count}"
rescue ArgumentError, TypeError
raise ContractError, "Deterministic model request count is not an integer: #{value.inspect}"
end
def assert_authoritative_assistant_count!(value)
count = Integer(value.to_s, 10)
return if count == 1
raise ContractError, "Expected exactly one authoritative assistant message, got #{count}"
rescue ArgumentError, TypeError
raise ContractError, "Authoritative assistant message count is not an integer: #{value.inspect}"
end
end
end

2
ruby/live_probe.rb
View File

@@ -37,7 +37,7 @@ begin
messages = client.get_messages(session_id)
assistant_messages = Array(messages).select { |message| message.dig(:info, :role) == "assistant" }
OpenCodeCompat::ExactLiveContract.assert_authoritative_assistant_count!(assistant_messages.length)
raise "No authoritative assistant exchange returned" if assistant_messages.empty?
puts JSON.generate(
status: "pass",

422
ruby/lockstep_client_contract.rb
View File

@@ -1,422 +0,0 @@
# frozen_string_literal: true
require "fileutils"
require "json"
require "open3"
require "rubygems"
module OpenCodeCompat
class LockstepClientContract
class ContractError < StandardError; end
class GitCommandError < ContractError
attr_reader :exitstatus
def initialize(message, exitstatus:)
@exitstatus = exitstatus
super(message)
end
end
CONTRACT_NAME = "opencode-client-lockstep"
OPENCODE_RUBY_GIT_URI = "https://github.com/ajaynomics/opencode-ruby.git"
PUBLICATION_PROVENANCE = {
"published" => "annotated-tag",
"unpublished" => "commit"
}.freeze
REQUIRED_ENV = %w[
OPENCODE_CLIENT_PUBLICATION_STATE
OPENCODE_RUBY_PATH
OPENCODE_RUBY_COMMIT
OPENCODE_RUBY_PROVENANCE_KIND
OPENCODE_RUBY_VERSION
OPENCODE_RAILS_PATH
OPENCODE_RAILS_COMMIT
OPENCODE_RAILS_PROVENANCE_KIND
OPENCODE_RAILS_VERSION
].freeze
def self.from_environment(env: ENV, git_resolver: nil, git_head_resolver: nil)
require "bundler"
require "opencode-rails"
new(
env: env,
git_resolver: git_resolver,
git_head_resolver: git_head_resolver,
loaded_specs: Gem.loaded_specs,
bundle_specs: Bundler.load.specs,
runtime_ruby_version: RUBY_VERSION,
ruby_version: Opencode::VERSION,
rails_version: Opencode::RAILS_VERSION
)
end
def self.canonical_json(value)
JSON.generate(canonicalize(value))
end
def self.canonicalize(value)
case value
when Hash
value.keys.map(&:to_s).sort.to_h do |key|
source_key = value.key?(key) ? key : value.keys.find { |candidate| candidate.to_s == key }
[key, canonicalize(value.fetch(source_key))]
end
when Array
value.map { |entry| canonicalize(entry) }
else
value
end
end
private_class_method :canonicalize
def initialize(
env:,
loaded_specs:,
bundle_specs:,
ruby_version:,
rails_version:,
runtime_ruby_version: RUBY_VERSION,
git_resolver: nil,
git_head_resolver: nil
)
@env = env
@loaded_specs = loaded_specs
@bundle_specs = bundle_specs
@ruby_version = ruby_version.to_s
@rails_version = rails_version.to_s
@runtime_ruby_version = runtime_ruby_version.to_s
@git_resolver = git_resolver || method(:resolve_git)
@git_head_resolver = git_head_resolver
end
def verify
ensure_required_environment!
ruby_path = realpath("OPENCODE_RUBY_PATH")
rails_path = realpath("OPENCODE_RAILS_PATH")
ruby_commit = exact_commit("OPENCODE_RUBY_COMMIT")
rails_commit = exact_commit("OPENCODE_RAILS_COMMIT")
expected_ruby_version = exact_version("OPENCODE_RUBY_VERSION")
expected_rails_version = exact_version("OPENCODE_RAILS_VERSION")
publication_state = exact_publication_state
assert_equal!(ruby_commit, checkout_head(ruby_path, "opencode-ruby"), "opencode-ruby checkout commit")
assert_equal!(rails_commit, checkout_head(rails_path, "opencode-rails"), "opencode-rails checkout commit")
ruby_source_provenance = source_provenance(
path: ruby_path,
label: "opencode-ruby",
prefix: "OPENCODE_RUBY",
publication_state: publication_state,
expected_commit: ruby_commit,
expected_version: expected_ruby_version
)
rails_source_provenance = source_provenance(
path: rails_path,
label: "opencode-rails",
prefix: "OPENCODE_RAILS",
publication_state: publication_state,
expected_commit: rails_commit,
expected_version: expected_rails_version
)
assert_equal!(expected_ruby_version, @ruby_version, "loaded Opencode::VERSION")
assert_equal!(expected_rails_version, @rails_version, "loaded Opencode::RAILS_VERSION")
assert_equal!(expected_ruby_version, expected_rails_version, "lockstep client version")
ruby_spec = loaded_spec!("opencode-ruby")
rails_spec = loaded_spec!("opencode-rails")
assert_equal!(expected_ruby_version, ruby_spec.version.to_s, "loaded opencode-ruby gem version")
assert_equal!(expected_rails_version, rails_spec.version.to_s, "loaded opencode-rails gem version")
assert_equal!(rails_path, File.realpath(rails_spec.full_gem_path), "loaded opencode-rails checkout")
dependency = exact_runtime_dependency!(rails_spec, expected_ruby_version)
bundle_spec = bundled_ruby_spec!
source = bundle_spec.source
unless source && source.respond_to?(:revision) && source.respond_to?(:ref) && source.respond_to?(:uri) &&
source.class.name.match?(/(?:\A|::)Git\z/)
raise ContractError, "Bundler opencode-ruby source must be a Git source"
end
bundler_revision = source.revision.to_s
bundler_ref = source.ref.to_s
bundler_uri = source.uri.to_s
assert_exact_commit!(bundler_revision, "Bundler opencode-ruby revision")
assert_exact_commit!(bundler_ref, "Bundler opencode-ruby ref")
assert_equal!(ruby_commit, bundler_revision, "Bundler opencode-ruby revision")
assert_equal!(ruby_commit, bundler_ref, "Bundler opencode-ruby ref")
assert_equal!(OPENCODE_RUBY_GIT_URI, bundler_uri, "Bundler opencode-ruby URI")
{
"contract" => CONTRACT_NAME,
"publication_state" => publication_state,
"opencode_rails" => {
"checkout_commit" => rails_commit,
"gem_version" => rails_spec.version.to_s,
"loaded_version" => @rails_version,
"source_provenance" => rails_source_provenance,
"runtime_dependency" => {
"name" => dependency.name,
"requirement" => dependency.requirement.to_s
}
},
"opencode_ruby" => {
"bundler_git_ref" => bundler_ref,
"bundler_git_revision" => bundler_revision,
"bundler_git_uri" => bundler_uri,
"bundler_source" => source.class.name,
"checkout_commit" => ruby_commit,
"gem_version" => ruby_spec.version.to_s,
"loaded_version" => @ruby_version,
"source_provenance" => ruby_source_provenance
},
"ruby_runtime_version" => @runtime_ruby_version,
"schema_version" => 2,
"status" => "pass",
"workflow" => {
"head_sha" => @env["OPENCODE_COMPAT_HEAD_SHA"],
"repository" => @env["OPENCODE_COMPAT_REPOSITORY"],
"run_attempt" => @env["OPENCODE_COMPAT_RUN_ATTEMPT"],
"run_id" => @env["OPENCODE_COMPAT_RUN_ID"],
"run_url" => @env["OPENCODE_COMPAT_RUN_URL"]
}
}
rescue Errno::ENOENT, Errno::EACCES => error
raise ContractError, error.message
end
def emit(io: $stdout)
document = verify
json = self.class.canonical_json(document)
evidence_path = @env["OPENCODE_COMPAT_EVIDENCE_PATH"].to_s
unless evidence_path.empty?
expanded_path = File.expand_path(evidence_path)
FileUtils.mkdir_p(File.dirname(expanded_path))
File.binwrite(expanded_path, "#{json}\n")
end
io.puts(json)
document
end
private
def ensure_required_environment!
missing = REQUIRED_ENV.select { |name| @env[name].to_s.empty? }
return if missing.empty?
raise ContractError, "missing required environment: #{missing.join(', ')}"
end
def realpath(name)
File.realpath(@env.fetch(name))
end
def exact_commit(name)
value = @env.fetch(name)
assert_exact_commit!(value, name)
value
end
def exact_publication_state
value = @env.fetch("OPENCODE_CLIENT_PUBLICATION_STATE")
return value if PUBLICATION_PROVENANCE.key?(value)
raise ContractError,
"OPENCODE_CLIENT_PUBLICATION_STATE must be one of #{PUBLICATION_PROVENANCE.keys.join(', ')}, got #{value.inspect}"
end
def exact_tag(name)
exact_tag_value(@env.fetch(name), name)
end
def exact_tag_value(value, label)
if value.match?(/\A[A-Za-z0-9][A-Za-z0-9._-]*\z/) && !value.include?("..") && !value.end_with?(".")
return value
end
raise ContractError, "#{label} must be a safe exact Git tag name, got #{value.inspect}"
end
def exact_tag_object(name)
value = @env.fetch(name)
return value if value.match?(/\A[0-9a-f]{40}\z/)
raise ContractError,
"#{name} must be a full lowercase 40-character Git object ID, got #{value.inspect}"
end
def assert_exact_commit!(value, label)
return if value.match?(/\A[0-9a-f]{40}\z/)
raise ContractError, "#{label} must be a full lowercase 40-character Git commit, got #{value.inspect}"
end
def exact_version(name)
value = @env.fetch(name)
return value if Gem::Version.correct?(value)
raise ContractError, "#{name} must be an exact RubyGems version, got #{value.inspect}"
end
def checkout_head(path, label)
head = if @git_head_resolver
@git_head_resolver.call(path).to_s.strip
else
git_value(path, "#{label} checkout HEAD", "rev-parse", "--verify", "HEAD^{commit}")
end
assert_exact_commit!(head, "#{label} checkout HEAD")
head
rescue ContractError
raise
rescue StandardError => error
raise ContractError, "could not resolve #{label} checkout HEAD: #{error.message}"
end
def source_provenance(path:, label:, prefix:, publication_state:, expected_commit:, expected_version:)
kind_name = "#{prefix}_PROVENANCE_KIND"
kind = @env.fetch(kind_name)
expected_kind = PUBLICATION_PROVENANCE.fetch(publication_state)
assert_equal!(expected_kind, kind, "#{label} provenance kind for #{publication_state} candidate")
case kind
when "commit"
ensure_unpublished_tag_absent!(path, label, expected_version)
supplied_tag_fields = %W[#{prefix}_TAG #{prefix}_TAG_OBJECT].select do |name|
!@env[name].to_s.empty?
end
unless supplied_tag_fields.empty?
raise ContractError,
"#{label} unpublished commit provenance must not supply #{supplied_tag_fields.join(', ')}"
end
{"commit" => expected_commit, "kind" => "commit"}
when "annotated-tag"
annotated_tag_provenance(
path: path,
label: label,
tag_name: "#{prefix}_TAG",
tag_object: "#{prefix}_TAG_OBJECT",
expected_commit: expected_commit
).merge("kind" => "annotated-tag")
else
raise ContractError, "#{kind_name} has unsupported value #{kind.inspect}"
end
end
def ensure_unpublished_tag_absent!(path, label, expected_version)
tag = exact_tag_value("v#{expected_version}", "#{label} expected release tag")
tag_ref = "refs/tags/#{tag}"
resolved = begin
@git_resolver.call(path, "rev-parse", "--verify", "--quiet", tag_ref).to_s.strip
rescue GitCommandError => error
raise ContractError, "could not check #{label} release tag: #{error.message}" unless error.exitstatus == 1
nil
rescue KeyError
nil
end
return if resolved.nil? || resolved.empty?
raise ContractError,
"#{label} release tag #{tag} already exists; publication_state must be published with annotated-tag provenance"
end
def annotated_tag_provenance(path:, label:, tag_name:, tag_object:, expected_commit:)
tag = exact_tag(tag_name)
object = exact_tag_object(tag_object)
tag_ref = "refs/tags/#{tag}"
object_type = git_value(path, "#{label} annotated tag object type", "cat-file", "-t", object)
assert_equal!("tag", object_type, "#{label} annotated tag object type")
resolved_object = git_value(path, "#{label} local tag ref", "rev-parse", "--verify", tag_ref)
assert_exact_commit!(resolved_object, "#{label} local tag ref object")
assert_equal!(object, resolved_object, "#{label} local tag ref object")
object_commit = git_value(path, "#{label} annotated tag peel", "rev-parse", "--verify", "#{object}^{commit}")
assert_exact_commit!(object_commit, "#{label} annotated tag peeled commit")
assert_equal!(expected_commit, object_commit, "#{label} annotated tag peeled commit")
ref_commit = git_value(path, "#{label} local tag ref peel", "rev-parse", "--verify", "#{tag_ref}^{commit}")
assert_exact_commit!(ref_commit, "#{label} local tag ref peeled commit")
assert_equal!(expected_commit, ref_commit, "#{label} local tag ref peeled commit")
{
"annotated_tag_object" => object,
"peeled_commit" => object_commit,
"tag" => tag
}
end
def git_value(path, label, *arguments)
@git_resolver.call(path, *arguments).to_s.strip
rescue StandardError => error
raise ContractError, "could not resolve #{label}: #{error.message}"
end
def resolve_git(path, *arguments)
stdout, stderr, status = Open3.capture3("git", "-C", path, *arguments)
return stdout.strip if status.success?
detail = stderr.strip
detail = "git exited #{status.exitstatus}" if detail.empty?
raise GitCommandError.new(detail, exitstatus: status.exitstatus)
end
def loaded_spec!(name)
@loaded_specs.fetch(name)
rescue KeyError
raise ContractError, "#{name} is not present in Gem.loaded_specs"
end
def exact_runtime_dependency!(rails_spec, ruby_version)
dependencies = rails_spec.runtime_dependencies.select { |dependency| dependency.name == "opencode-ruby" }
unless dependencies.length == 1
raise ContractError, "opencode-rails must declare exactly one runtime dependency on opencode-ruby"
end
dependency = dependencies.first
expected = [["=", Gem::Version.new(ruby_version)]]
unless dependency.requirement.requirements == expected
raise ContractError,
"opencode-rails must require opencode-ruby = #{ruby_version}, got #{dependency.requirement}"
end
dependency
end
def bundled_ruby_spec!
specs = @bundle_specs.select { |spec| spec.name == "opencode-ruby" }
return specs.first if specs.length == 1
raise ContractError, "Bundler must resolve exactly one opencode-ruby spec, found #{specs.length}"
end
def assert_equal!(expected, actual, label)
return if expected == actual
raise ContractError, "#{label} must equal #{expected.inspect}, got #{actual.inspect}"
end
end
end
if $PROGRAM_NAME == __FILE__
begin
OpenCodeCompat::LockstepClientContract.from_environment.emit
rescue StandardError => error
failure = OpenCodeCompat::LockstepClientContract.canonical_json(
"contract" => OpenCodeCompat::LockstepClientContract::CONTRACT_NAME,
"error" => "#{error.class}: #{error.message}",
"schema_version" => 2,
"status" => "fail"
)
if (evidence_path = ENV["OPENCODE_COMPAT_EVIDENCE_PATH"]) && !evidence_path.empty?
expanded_path = File.expand_path(evidence_path)
FileUtils.mkdir_p(File.dirname(expanded_path))
File.binwrite(expanded_path, "#{failure}\n")
end
warn failure
exit 1
end
end

45
ruby/opencode_ruby_fixture_contract.rb
View File

@@ -1,8 +1,6 @@
# frozen_string_literal: true
require "json"
require "fileutils"
require "time"
root = File.expand_path("..", __dir__)
gem_path = File.expand_path(ENV.fetch("OPENCODE_RUBY_PATH"))
@@ -11,12 +9,6 @@ require "opencode-ruby"
manifest = JSON.parse(File.read(File.join(root, "fixtures/manifest.json")))
failures = []
write_evidence = lambda do |document|
next unless (evidence_path = ENV["OPENCODE_COMPAT_EVIDENCE_PATH"])
FileUtils.mkdir_p(File.dirname(evidence_path))
File.write(evidence_path, JSON.pretty_generate(document) + "\n")
end
manifest.fetch("fixtures").each do |entry|
reply = Opencode::Reply.new
@@ -64,45 +56,14 @@ manifest.fetch("fixtures").each do |entry|
end
unless failures.empty?
evidence = {
schema_version: 1,
kind: "shared-ruby-fixture-contract",
status: "fail",
checked_at: Time.now.utc.iso8601,
adapter: "opencode-ruby",
adapter_version: Opencode::VERSION,
adapter_commit: ENV["OPENCODE_RUBY_COMMIT"],
fixture_count: manifest.fetch("fixtures").length,
failures: failures,
workflow: {
run_id: ENV["OPENCODE_COMPAT_RUN_ID"],
run_attempt: ENV["OPENCODE_COMPAT_RUN_ATTEMPT"],
head_sha: ENV["OPENCODE_COMPAT_HEAD_SHA"],
repository: ENV["OPENCODE_COMPAT_REPOSITORY"],
run_url: ENV["OPENCODE_COMPAT_RUN_URL"]
}
}
write_evidence.call(evidence)
warn failures.join("\n")
exit 1
end
evidence = {
schema_version: 1,
kind: "shared-ruby-fixture-contract",
puts JSON.generate(
status: "pass",
checked_at: Time.now.utc.iso8601,
adapter: "opencode-ruby",
adapter_version: Opencode::VERSION,
adapter_commit: ENV["OPENCODE_RUBY_COMMIT"],
fixture_count: manifest.fetch("fixtures").length,
workflow: {
run_id: ENV["OPENCODE_COMPAT_RUN_ID"],
run_attempt: ENV["OPENCODE_COMPAT_RUN_ATTEMPT"],
head_sha: ENV["OPENCODE_COMPAT_HEAD_SHA"],
repository: ENV["OPENCODE_COMPAT_REPOSITORY"],
run_url: ENV["OPENCODE_COMPAT_RUN_URL"]
}
}
puts JSON.generate(evidence)
write_evidence.call(evidence)
fixture_count: manifest.fetch("fixtures").length
)

401
schemas/runtime-tuples.schema.json Normal file
View File

@@ -0,0 +1,401 @@
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://github.com/ajaynomics/opencode-compat/schemas/runtime-tuples.schema.json",
"title": "OpenCode runtime tuple ledger",
"type": "object",
"required": [
"schema_version",
"migration_state",
"promotion_readiness",
"consumers"
],
"properties": {
"schema_version": {
"const": 2
},
"migration_state": {
"enum": [
"candidate",
"bootstrap-current-only",
"certified"
]
},
"consumers": {
"type": "object",
"additionalProperties": {
"type": "object",
"required": [
"profile",
"current",
"candidate",
"previous"
],
"properties": {
"rollback_state": {
"type": "object",
"required": [
"status",
"acknowledgement",
"recorded_at",
"emergency_provenance_status"
],
"properties": {
"status": {
"const": "degraded-no-certified-previous"
},
"acknowledgement": {
"const": "accept-degraded-rollback-with-failed-emergency-provenance"
},
"emergency_provenance_status": {
"const": "observed-production-contract-failed"
}
}
},
"candidate": {
"oneOf": [
{
"type": "null"
},
{
"$ref": "#/$defs/candidate"
}
]
}
}
}
}
},
"$defs": {
"fullCommit": {
"type": "string",
"pattern": "^[0-9a-f]{40}$"
},
"loadedGitSource": {
"type": "object",
"required": [
"type",
"uri",
"requested_ref",
"locked_revision",
"loaded_source_proof"
],
"properties": {
"type": {
"const": "git"
},
"requested_ref": {
"$ref": "#/$defs/fullCommit"
},
"locked_revision": {
"$ref": "#/$defs/fullCommit"
},
"loaded_source_proof": {
"type": "object",
"required": [
"status",
"source_class",
"loaded_version",
"observed_revision",
"test"
],
"properties": {
"status": {
"const": "pass"
},
"source_class": {
"const": "Bundler::Source::Git"
},
"observed_ref": {
"$ref": "#/$defs/fullCommit"
},
"observed_revision": {
"$ref": "#/$defs/fullCommit"
}
}
}
}
},
"client": {
"type": "object",
"required": [
"version",
"git_commit",
"source"
],
"properties": {
"git_commit": {
"$ref": "#/$defs/fullCommit"
},
"source": {
"$ref": "#/$defs/loadedGitSource"
}
}
},
"consumerRef": {
"type": "object",
"required": [
"kind",
"repository",
"commit",
"tree"
],
"properties": {
"kind": {
"enum": [
"pull-request-head",
"main-commit"
]
},
"commit": {
"$ref": "#/$defs/fullCommit"
},
"tree": {
"$ref": "#/$defs/fullCommit"
},
"base_commit": {
"$ref": "#/$defs/fullCommit"
}
},
"allOf": [
{
"if": {
"properties": {
"kind": {
"const": "pull-request-head"
}
}
},
"then": {
"required": [
"base_commit",
"review_url"
]
}
}
]
},
"promotionProvenance": {
"oneOf": [
{
"type": "object",
"required": [
"kind",
"main_commit",
"post_merge_canary"
],
"properties": {
"kind": {
"const": "main-commit"
},
"main_commit": {
"$ref": "#/$defs/fullCommit"
},
"post_merge_canary": {
"type": "object",
"required": [
"status",
"checked_at",
"evidence"
],
"properties": {
"status": {
"const": "pass"
},
"evidence": {
"type": "array",
"minItems": 1,
"items": {
"type": "string",
"pattern": "^evidence/"
}
}
}
}
}
},
{
"type": "object",
"required": [
"kind",
"pull_request_commit",
"pull_request_tree",
"main_commit",
"main_tree",
"attested_at",
"post_merge_canary"
],
"properties": {
"kind": {
"const": "identical-tree-attestation"
},
"pull_request_commit": {
"$ref": "#/$defs/fullCommit"
},
"pull_request_tree": {
"$ref": "#/$defs/fullCommit"
},
"main_commit": {
"$ref": "#/$defs/fullCommit"
},
"main_tree": {
"$ref": "#/$defs/fullCommit"
},
"post_merge_canary": {
"type": "object",
"required": [
"status",
"checked_at",
"evidence"
],
"properties": {
"status": {
"const": "pass"
},
"evidence": {
"type": "array",
"minItems": 1,
"items": {
"type": "string",
"pattern": "^evidence/"
}
}
}
}
}
}
]
},
"runtime": {
"type": "object",
"required": [
"reported_version"
],
"properties": {
"product_selection": {
"type": "object",
"required": [
"strategy",
"source_commit",
"references"
],
"properties": {
"strategy": {
"const": "full-consumer-commit-tag"
},
"source_commit": {
"$ref": "#/$defs/fullCommit"
},
"references": {
"type": "object",
"minProperties": 1,
"additionalProperties": {
"type": "string",
"pattern": ":[0-9a-f]{40}$"
}
}
}
},
"product_images": {
"type": "object",
"minProperties": 1,
"additionalProperties": {
"type": "object",
"required": [
"source_commit"
],
"properties": {
"source_commit": {
"$ref": "#/$defs/fullCommit"
},
"docker_image_id": {
"type": "string",
"pattern": "^sha256:[0-9a-f]{64}$"
},
"image": {
"type": "string",
"pattern": "@sha256:[0-9a-f]{64}$"
}
},
"anyOf": [
{
"required": [
"docker_image_id"
]
},
{
"required": [
"image"
]
}
]
}
}
}
},
"candidate": {
"type": "object",
"required": [
"status",
"certification_scope",
"promotion_eligible",
"consumer_commit",
"consumer_ref",
"opencode_ruby",
"runtime"
],
"properties": {
"status": {
"const": "compatibility-certified"
},
"certification_scope": {
"enum": [
"pre-merge-pr-head-candidate-only",
"promotion-deployed"
]
},
"promotion_eligible": {
"type": "boolean"
},
"consumer_commit": {
"$ref": "#/$defs/fullCommit"
},
"consumer_ref": {
"$ref": "#/$defs/consumerRef"
},
"promotion_provenance": {
"$ref": "#/$defs/promotionProvenance"
},
"opencode_ruby": {
"$ref": "#/$defs/client"
},
"opencode_rails": {
"$ref": "#/$defs/client"
},
"runtime": {
"$ref": "#/$defs/runtime"
}
},
"allOf": [
{
"if": {
"properties": {
"promotion_eligible": {
"const": true
}
}
},
"then": {
"required": [
"promotion_provenance"
],
"properties": {
"certification_scope": {
"const": "promotion-deployed"
}
}
}
}
]
}
}
}

9
scripts/client_candidate_outputs.rb
View File

@@ -1,9 +0,0 @@
#!/usr/bin/env ruby
# frozen_string_literal: true
require_relative "../lib/opencode_compat/client_candidate"
root = File.expand_path("..", __dir__)
path = ARGV.fetch(0, File.join(root, "manifests/client-candidate.json"))
candidate = OpenCodeCompat::ClientCandidate.load(path)
candidate.github_outputs.each { |key, value| puts "#{key}=#{value}" }

37
scripts/matrix_json.rb
View File

@@ -1,47 +1,14 @@
# frozen_string_literal: true
require "json"
require_relative "../lib/opencode_compat/client_candidate"
root = File.expand_path("..", __dir__)
manifest = JSON.parse(File.read(File.join(root, "manifests/image-matrix.json")))
candidate = OpenCodeCompat::ClientCandidate.load(File.join(root, "manifests/client-candidate.json"))
candidate.verify!
clients = candidate.document.fetch("clients")
expected_candidate = {
"release_train" => candidate.document.fetch("release_train"),
"publication_state" => candidate.document.fetch("publication_state"),
"opencode_ruby_commit" => clients.dig("opencode-ruby", "ref"),
"opencode_rails_commit" => clients.dig("opencode-rails", "ref")
}
matrix_candidate = manifest.fetch("client_candidate")
unless expected_candidate.all? { |key, value| matrix_candidate[key] == value }
abort "image matrix client_candidate must equal the exact client candidate"
end
unless %w[pending certified].include?(matrix_candidate.fetch("certification_status"))
abort "image matrix client_candidate certification_status must be pending or certified"
end
matrix = manifest.fetch("public_ci").map do |target|
id = target.fetch("id")
profiles = target.fetch("profiles")
certification_scope = target.fetch("certification_scope", "shared-client-contract-only")
unless profiles == ["ruby-rest-sse"]
abort "#{id}: public CI executes exactly ruby-rest-sse; got profiles=#{profiles.inspect}"
end
unless certification_scope == "shared-client-contract-only"
abort "#{id}: certification_scope must be shared-client-contract-only; got #{certification_scope.inspect}"
end
{
"id" => id,
"id" => target.fetch("id"),
"version" => target.fetch("version"),
"image" => target.fetch("image"),
"consumers" => target.fetch("consumers"),
"profiles" => profiles,
"required_consumer_profiles" => target.fetch("required_consumer_profiles"),
"certification_scope" => certification_scope,
"certification_status" => target.fetch("certification_status")
"image" => target.fetch("image")
}
end

28
scripts/private_default_gateway.rb
View File

@@ -1,28 +0,0 @@
#!/usr/bin/env ruby
# frozen_string_literal: true
require "ipaddr"
route_path = ARGV.fetch(0, "/proc/net/route")
routes = File.foreach(route_path).drop(1).filter_map do |line|
fields = line.split
next unless fields.length >= 8
next unless fields.fetch(1) == "00000000"
next unless (fields.fetch(3).to_i(16) & 0x2) == 0x2
fields
end
routes.sort_by { |fields| fields.fetch(6).to_i }.each do |fields|
gateway_hex = fields.fetch(2)
next unless gateway_hex.match?(/\A[0-9A-Fa-f]{8}\z/)
gateway = gateway_hex.scan(/../).reverse.map { |octet| octet.to_i(16) }.join(".")
address = IPAddr.new(gateway)
next unless address.ipv4? && address.private?
puts address
exit 0
end
abort "no private IPv4 default-route gateway found in #{route_path}"

43
scripts/promote_runtime_tuple.rb
View File

@@ -20,6 +20,10 @@ parser = OptionParser.new do |opts|
--status pass --certified-at TIMESTAMP --evidence evidence/FILE.json \\
[--previous-status pass --previous-certified-at TIMESTAMP \\
--previous-evidence evidence/FILE.json] [--dry-run]
ruby scripts/promote_runtime_tuple.rb bootstrap-current --consumer NAME --consumer-commit SHA \\
--status pass --certified-at TIMESTAMP --evidence evidence/FILE.json \\
--acknowledge-degraded-rollback \\
accept-degraded-rollback-with-failed-emergency-provenance [--dry-run]
USAGE
opts.on("--consumer NAME") { |value| options["consumer"] = value }
@@ -30,6 +34,9 @@ parser = OptionParser.new do |opts|
opts.on("--previous-status STATUS") { |value| options["previous_status"] = value }
opts.on("--previous-certified-at TIMESTAMP") { |value| options["previous_certified_at"] = value }
opts.on("--previous-evidence PATH") { |value| options["previous_evidence"] << value }
opts.on("--acknowledge-degraded-rollback VALUE") do |value|
options["degraded_rollback_acknowledgement"] = value
end
opts.on("--dry-run") { options["dry_run"] = true }
end
@@ -94,8 +101,42 @@ begin
"migration_state" => promoted.fetch("migration_state")
)
end
when "bootstrap-current"
required!(
options,
"consumer",
"consumer_commit",
"status",
"certified_at",
"evidence",
"degraded_rollback_acknowledgement"
)
bootstrapped = promoter.bootstrap_current(
consumer: options.fetch("consumer"),
consumer_commit: options.fetch("consumer_commit"),
certification: {
"status" => options.fetch("status"),
"certified_at" => options.fetch("certified_at"),
"evidence" => options.fetch("evidence")
},
acknowledgement: options.fetch("degraded_rollback_acknowledgement"),
dry_run: options.fetch("dry_run", false)
)
if options.fetch("dry_run", false)
puts JSON.pretty_generate(bootstrapped)
else
raise OptionParser::InvalidArgument, "command must be fingerprint or promote"
consumer = bootstrapped.fetch("consumers").fetch(options.fetch("consumer"))
puts JSON.pretty_generate(
"consumer" => options.fetch("consumer"),
"current_consumer_commit" => consumer.dig("current", "consumer_commit"),
"current_tuple_sha256" => consumer.dig("current", "certification", "tuple_sha256"),
"previous" => consumer.fetch("previous"),
"rollback_state" => consumer.fetch("rollback_state"),
"migration_state" => bootstrapped.fetch("migration_state")
)
end
else
raise OptionParser::InvalidArgument, "command must be fingerprint, promote, or bootstrap-current"
end
rescue OpenCodeCompat::PromotionError, OptionParser::ParseError => e
warn "error: #{e.message}"

57
scripts/record_upstream_candidate.rb
View File

@@ -8,13 +8,6 @@ tag, published_at, release_url, digest = ARGV
abort "usage: record_upstream_candidate.rb TAG PUBLISHED_AT RELEASE_URL DIGEST" unless digest
abort "invalid upstream release tag: #{tag.inspect}" unless tag.match?(/\Av\d+\.\d+\.\d+\z/)
abort "invalid OCI digest: #{digest.inspect}" unless digest.match?(/\Asha256:[0-9a-f]{64}\z/)
begin
Time.iso8601(published_at)
rescue ArgumentError, TypeError
abort "invalid upstream publication timestamp: #{published_at.inspect}"
end
expected_release_url = "https://github.com/anomalyco/opencode/releases/tag/#{tag}"
abort "invalid upstream release URL: #{release_url.inspect}" unless release_url == expected_release_url
version = tag.delete_prefix("v")
image = "ghcr.io/anomalyco/opencode@#{digest}"
@@ -22,46 +15,30 @@ upstream_path = File.join(root, "manifests/upstream.json")
matrix_path = File.join(root, "manifests/image-matrix.json")
upstream = JSON.parse(File.read(upstream_path))
matrix = JSON.parse(File.read(matrix_path))
public_ci = matrix.fetch("public_ci")
abort "public_ci must be an array" unless public_ci.is_a?(Array)
matching_targets = public_ci.select { |target| target.fetch("image") == image }
if matching_targets.length > 1
abort "image #{image} must appear exactly once in public_ci; found #{matching_targets.length}"
end
exit 0 if upstream.fetch("release_tag") == tag
matrix_changed = false
if matching_targets.empty?
target_id = "upstream-#{version}-#{digest.delete_prefix('sha256:')}"
if public_ci.any? { |target| target.fetch("id") == target_id }
abort "cannot add #{image}: public_ci id #{target_id.inspect} is already used by another image"
end
public_ci << {
"id" => target_id,
"version" => version,
"image" => image,
"tag_provenance" => "ghcr.io/anomalyco/opencode:#{version}",
"consumers" => [],
"profiles" => ["ruby-rest-sse"],
"required_consumer_profiles" => [],
"certification_scope" => "shared-client-contract-only",
"certification_status" => "pending"
}
matrix_changed = true
end
upstream_changed = upstream.fetch("release_tag") != tag || upstream.fetch("image") != image
if upstream_changed
upstream.merge!(
upstream.merge!(
"release_tag" => tag,
"version" => version,
"published_at" => published_at,
"release_url" => release_url,
"image" => image,
"observed_at" => Time.now.utc.iso8601
)
)
unless matrix.fetch("public_ci").any? { |target| target.fetch("image") == image }
matrix.fetch("public_ci") << {
"id" => "upstream-#{version}",
"version" => version,
"image" => image,
"tag_provenance" => "ghcr.io/anomalyco/opencode:#{version}",
"consumers" => ["upstream-candidate"],
"profiles" => ["ruby-rest-sse"],
"required_consumer_profiles" => ["rails-persisted-turn", "voice-stream", "strict-v2", "plugin-ledger", "provider-hooks"],
"certification_status" => "pending"
}
end
File.write(upstream_path, JSON.pretty_generate(upstream) + "\n") if upstream_changed
File.write(matrix_path, JSON.pretty_generate(matrix) + "\n") if matrix_changed
File.write(upstream_path, JSON.pretty_generate(upstream) + "\n")
File.write(matrix_path, JSON.pretty_generate(matrix) + "\n")

222
scripts/run_image_contract.sh
View File

@@ -2,146 +2,46 @@
set -euo pipefail
repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
image="${OPENCODE_IMAGE:-}"
gem_path="${OPENCODE_RUBY_PATH:-}"
expected_gem_commit="${OPENCODE_RUBY_COMMIT:-}"
evidence_path="${OPENCODE_COMPAT_EVIDENCE_PATH:-}"
probe_host="${OPENCODE_PROBE_HOST:-127.0.0.1}"
container_name="opencode-compat-${RANDOM}-$$"
llm_container_name="opencode-compat-llm-${RANDOM}-$$"
network_name="opencode-compat-net-${RANDOM}-$$"
python_image="python@sha256:399babc8b49529dabfd9c922f2b5eea81d611e4512e3ed250d75bd2e7683f4b0"
network_created=0
llm_container_started=0
opencode_container_started=0
gem_commit=""
image="${OPENCODE_IMAGE:?set OPENCODE_IMAGE to an immutable image digest}"
gem_path="${OPENCODE_RUBY_PATH:?set OPENCODE_RUBY_PATH to the candidate checkout}"
write_failure_evidence() {
local exit_status="$1"
[[ -n "$evidence_path" ]] || return 0
mkdir -p "$(dirname "$evidence_path")"
jq -n \
--argjson schema_version 1 \
--arg kind shared-client-image-contract \
--arg status fail \
--arg checked_at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
--arg matrix_target "${OPENCODE_MATRIX_ID:-local}" \
--arg image "$image" \
--arg ruby_commit "${gem_commit:-}" \
--arg rails_commit "${OPENCODE_RAILS_COMMIT:-}" \
--arg run_id "${OPENCODE_COMPAT_RUN_ID:-}" \
--arg run_attempt "${OPENCODE_COMPAT_RUN_ATTEMPT:-}" \
--arg head_sha "${OPENCODE_COMPAT_HEAD_SHA:-}" \
--arg repository "${OPENCODE_COMPAT_REPOSITORY:-}" \
--arg run_url "${OPENCODE_COMPAT_RUN_URL:-}" \
--argjson exit_status "$exit_status" \
'{
schema_version:$schema_version,
kind:$kind,
status:$status,
checked_at:$checked_at,
matrix_target:$matrix_target,
certification_scope:"shared-client-contract-only",
executed_profiles:[],
image:{requested:$image},
clients:{opencode_ruby:{commit:$ruby_commit},opencode_rails:{commit:$rails_commit,executed:false}},
failure:{exit_status:$exit_status},
workflow:{run_id:$run_id,run_attempt:$run_attempt,head_sha:$head_sha,repository:$repository,run_url:$run_url}
}' >"$evidence_path"
}
cleanup() {
local status=$?
trap - EXIT
if [[ "$status" != "0" ]]; then
echo "OpenCode compatibility probe failed; container log follows" >&2
if [[ "$opencode_container_started" == "1" ]]; then
docker logs "$container_name" >&2 2>/dev/null || true
fi
echo "Deterministic model request summary follows" >&2
if [[ "$llm_container_started" == "1" ]]; then
docker exec "$llm_container_name" wget -qO- http://127.0.0.1:8080/stats >&2 2>/dev/null || true
fi
echo >&2
write_failure_evidence "$status" || true
fi
if [[ "$opencode_container_started" == "1" ]]; then
docker rm -f "$container_name" >/dev/null 2>&1 || true
fi
if [[ "$llm_container_started" == "1" ]]; then
docker rm -f "$llm_container_name" >/dev/null 2>&1 || true
fi
if [[ "$network_created" == "1" ]]; then
docker network rm "$network_name" >/dev/null 2>&1 || true
fi
exit "$status"
}
trap cleanup EXIT
if [[ -n "$evidence_path" ]]; then
mkdir -p "$(dirname "$evidence_path")"
: >"$evidence_path"
fi
if [[ -z "$image" ]]; then
echo "set OPENCODE_IMAGE to an immutable image digest" >&2
exit 2
fi
if [[ -z "$gem_path" ]]; then
echo "set OPENCODE_RUBY_PATH to the candidate checkout" >&2
exit 2
fi
if [[ ! "$image" =~ ^[^[:space:]@]+@sha256:[0-9a-f]{64}$ ]]; then
if [[ "${ALLOW_EXACT_IMAGE_ID:-0}" != "1" || ! "$image" =~ ^sha256:[0-9a-f]{64}$ ]]; then
if [[ "$image" != *@sha256:* ]]; then
if [[ "${ALLOW_EXACT_IMAGE_ID:-0}" != "1" || "$image" != sha256:* ]]; then
echo "OPENCODE_IMAGE must be an OCI digest (or an exact local image ID with ALLOW_EXACT_IMAGE_ID=1)" >&2
exit 2
fi
fi
if ! ruby -ripaddr -e '
begin
address = IPAddr.new(ARGV.fetch(0))
valid = address.ipv4? && (address.loopback? || address.private?)
rescue IPAddr::InvalidAddressError
valid = false
end
exit(valid ? 0 : 1)
' "$probe_host"; then
echo "OPENCODE_PROBE_HOST must be a loopback or private IPv4 address" >&2
exit 2
fi
if [[ ! "$expected_gem_commit" =~ ^[0-9a-f]{40}$ ]]; then
echo "OPENCODE_RUBY_COMMIT must be a full lowercase 40-character Git commit" >&2
exit 2
fi
if ! gem_commit="$(git -C "$gem_path" rev-parse --verify 'HEAD^{commit}' 2>/dev/null)"; then
echo "OPENCODE_RUBY_PATH must be a readable Git checkout" >&2
exit 2
fi
if [[ "$gem_commit" != "$expected_gem_commit" ]]; then
echo "opencode-ruby checkout HEAD $gem_commit does not match expected commit $expected_gem_commit" >&2
exit 2
fi
if [[ -n "$(git -C "$gem_path" status --porcelain --untracked-files=all)" ]]; then
echo "opencode-ruby checkout must be clean before certification" >&2
exit 2
fi
container_name="opencode-compat-${RANDOM}-$$"
llm_container_name="opencode-compat-llm-${RANDOM}-$$"
network_name="opencode-compat-net-${RANDOM}-$$"
python_image="python@sha256:399babc8b49529dabfd9c922f2b5eea81d611e4512e3ed250d75bd2e7683f4b0"
cleanup() {
status=$?
if [[ "$status" != "0" ]]; then
echo "OpenCode compatibility probe failed; container log follows" >&2
docker logs "$container_name" >&2 2>/dev/null || true
echo "Deterministic model request summary follows" >&2
docker exec "$llm_container_name" wget -qO- http://127.0.0.1:8080/stats >&2 2>/dev/null || true
echo >&2
fi
docker rm -f "$container_name" >/dev/null 2>&1 || true
docker rm -f "$llm_container_name" >/dev/null 2>&1 || true
docker network rm "$network_name" >/dev/null 2>&1 || true
return "$status"
}
trap cleanup EXIT
docker network create "$network_name" >/dev/null
network_created=1
docker run --detach \
--name "$llm_container_name" \
--network "$network_name" \
--network-alias compat-llm \
--volume "$repo_root/scripts:/compat:ro" \
"$python_image" \
python -c 'import time; time.sleep(3600)' \
python /compat/fake_llm.py --port 8080 --port-file /tmp/compat-port \
>/dev/null
llm_container_started=1
docker cp "$repo_root/scripts/fake_llm.py" "$llm_container_name:/tmp/fake_llm.py"
docker exec --detach \
"$llm_container_name" \
python /tmp/fake_llm.py --port 8080 --port-file /tmp/compat-port
for _ in $(seq 1 100); do
if docker exec "$llm_container_name" wget -qO- http://127.0.0.1:8080/health >/dev/null 2>&1; then
@@ -184,7 +84,7 @@ config_json="$(jq -cn --arg url "http://compat-llm:8080/v1" '{
docker run --detach \
--name "$container_name" \
--network "$network_name" \
--publish "${probe_host}::4096" \
--publish 127.0.0.1::4096 \
--env "OPENCODE_CONFIG_CONTENT=$config_json" \
--env OPENCODE_DISABLE_AUTOUPDATE=1 \
--env OPENCODE_DISABLE_AUTOCOMPACT=1 \
@@ -193,10 +93,9 @@ docker run --detach \
--env OPENCODE_PURE=1 \
"$image" serve --hostname 0.0.0.0 --port 4096 \
>/dev/null
opencode_container_started=1
host_port="$(docker port "$container_name" 4096/tcp | sed -E 's/.*:([0-9]+)$/\1/' | head -1)"
base_url="http://${probe_host}:${host_port}"
base_url="http://127.0.0.1:${host_port}"
ready=0
for _ in $(seq 1 120); do
@@ -219,75 +118,22 @@ fi
server_version="$(docker exec "$container_name" opencode --version)"
image_id="$(docker inspect "$container_name" --format '{{.Image}}')"
image_os="$(docker image inspect "$image_id" --format '{{.Os}}')"
image_architecture="$(docker image inspect "$image_id" --format '{{.Architecture}}')"
image_platform="${image_os}/${image_architecture}"
expected_version="${OPENCODE_EXPECTED_VERSION:-}"
gem_commit="$(git -C "$gem_path" rev-parse HEAD 2>/dev/null || true)"
if [[ -n "$expected_version" && "$server_version" != "$expected_version" ]]; then
echo "OpenCode reported version $server_version; expected $expected_version" >&2
exit 1
fi
live_contract="$(
OPENCODE_BASE_URL="$base_url" \
OPENCODE_RUBY_PATH="$gem_path" \
OPENCODE_RUBY_COMMIT="$gem_commit" \
OPENCODE_BASE_URL="$base_url" \
OPENCODE_RUBY_PATH="$gem_path" \
OPENCODE_RUBY_COMMIT="$gem_commit" \
ruby "$repo_root/ruby/live_probe.rb"
)"
printf '%s\n' "$live_contract"
llm_stats="$(docker exec "$llm_container_name" wget -qO- http://127.0.0.1:8080/stats)"
request_count="$(jq -r '.request_count' <<<"$llm_stats")"
ruby "$repo_root/ruby/exact_live_contract.rb" "$request_count"
evidence="$(jq -cn \
--argjson schema_version 1 \
jq -cn \
--arg status pass \
--arg kind shared-client-image-contract \
--arg matrix_target "${OPENCODE_MATRIX_ID:-local}" \
--arg certification_scope "shared-client-contract-only" \
--argjson executed_profiles '["ruby-rest-sse"]' \
--argjson required_consumer_profiles "${OPENCODE_REQUIRED_CONSUMER_PROFILES:-[]}" \
--arg image "$image" \
--arg image_id "$image_id" \
--arg image_platform "$image_platform" \
--arg server_version "$server_version" \
--arg gem_commit "$gem_commit" \
--arg companion_rails_commit "${OPENCODE_RAILS_COMMIT:-}" \
--arg run_id "${OPENCODE_COMPAT_RUN_ID:-}" \
--arg run_attempt "${OPENCODE_COMPAT_RUN_ATTEMPT:-}" \
--arg head_sha "${OPENCODE_COMPAT_HEAD_SHA:-}" \
--arg repository "${OPENCODE_COMPAT_REPOSITORY:-}" \
--arg run_url "${OPENCODE_COMPAT_RUN_URL:-}" \
--argjson live_contract "$live_contract" \
--argjson llm_request_count "$request_count" \
'{
schema_version:$schema_version,
kind:$kind,
status:$status,
checked_at:$live_contract.checked_at,
matrix_target:$matrix_target,
certification_scope:$certification_scope,
executed_profiles:$executed_profiles,
required_consumer_profiles:$required_consumer_profiles,
image:{requested:$image,docker_image_id:$image_id,platform:$image_platform,reported_version:$server_version},
clients:{
opencode_ruby:{version:$live_contract.opencode_ruby_version,commit:$gem_commit,executed:true},
opencode_rails:{commit:$companion_rails_commit,executed:false}
},
contract:{
expected_text:$live_contract.expected_text,
full_text:$live_contract.full_text,
observed_part_count:$live_contract.observed_part_count,
authoritative_assistant_message_count:$live_contract.authoritative_assistant_message_count,
llm_request_count:$llm_request_count
},
workflow:{run_id:$run_id,run_attempt:$run_attempt,head_sha:$head_sha,repository:$repository,run_url:$run_url}
}'
)"
printf '%s\n' "$evidence"
if [[ -n "$evidence_path" ]]; then
printf '%s\n' "$evidence" >"$evidence_path"
fi
'{status:$status,image:$image,image_id:$image_id,server_version:$server_version,opencode_ruby_commit:$gem_commit,llm_request_count:$llm_request_count}'

44
scripts/run_image_matrix_contract.sh
View File

@@ -1,44 +0,0 @@
#!/usr/bin/env bash
set -euo pipefail
repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
evidence_dir="${OPENCODE_COMPAT_EVIDENCE_DIR:-$repo_root/.compat-evidence}"
matrix_json="$(ruby "$repo_root/scripts/matrix_json.rb")"
entry_count="$(jq -er '.include | length' <<<"$matrix_json")"
if [[ ! "$entry_count" =~ ^[1-9][0-9]*$ ]]; then
echo "exact image matrix must contain at least one entry" >&2
exit 2
fi
mkdir -p "$evidence_dir"
for ((index = 0; index < entry_count; index++)); do
entry="$(jq -ec --argjson index "$index" '.include[$index]' <<<"$matrix_json")"
matrix_id="$(jq -er '.id' <<<"$entry")"
image="$(jq -er '.image' <<<"$entry")"
expected_version="$(jq -er '.version' <<<"$entry")"
required_profiles="$(jq -ec '.required_consumer_profiles' <<<"$entry")"
evidence_path="$evidence_dir/$matrix_id.json"
printf 'Running exact image matrix entry %s (%s)\n' "$matrix_id" "$image"
OPENCODE_IMAGE="$image" \
OPENCODE_EXPECTED_VERSION="$expected_version" \
OPENCODE_MATRIX_ID="$matrix_id" \
OPENCODE_REQUIRED_CONSUMER_PROFILES="$required_profiles" \
OPENCODE_COMPAT_EVIDENCE_PATH="$evidence_path" \
bundle exec "$repo_root/scripts/run_image_contract.sh"
jq -e \
--arg matrix_id "$matrix_id" \
--arg image "$image" \
--arg version "$expected_version" \
'.status == "pass" and
.matrix_target == $matrix_id and
.image.requested == $image and
.image.reported_version == $version' \
"$evidence_path" >/dev/null
printf 'Exact image matrix entry %s passed; JSON remains transient on this forge.\n' "$matrix_id"
done
printf 'Full exact image matrix passed (%s entries).\n' "$entry_count"

21
scripts/upstream_branch_name.rb
View File

@@ -1,21 +0,0 @@
# frozen_string_literal: true
tag = ARGV.fetch(0)
digest = ARGV.fetch(1)
disambiguator = ARGV[2]
abort "release tag must be vMAJOR.MINOR.PATCH" unless tag.match?(/\Av\d+\.\d+\.\d+\z/)
abort "digest must be an exact sha256" unless digest.match?(/\Asha256:[0-9a-f]{64}\z/)
branch = "compat/upstream-#{tag.delete_prefix('v')}-#{digest.delete_prefix('sha256:')}"
if disambiguator
unless disambiguator.match?(/\A[A-Za-z0-9][A-Za-z0-9-]*\z/)
abort "disambiguator must contain only letters, digits, and hyphens"
end
branch = "#{branch}-r#{disambiguator}"
end
abort "generated branch is longer than 128 characters" if branch.length > 128
puts branch

114
test/client_candidate_test.rb
View File

@@ -1,114 +0,0 @@
# frozen_string_literal: true
require "fileutils"
require "json"
require "minitest/autorun"
require "open3"
require "rbconfig"
require "tmpdir"
require_relative "../lib/opencode_compat/client_candidate"
class ClientCandidateTest < Minitest::Test
ROOT = File.expand_path("..", __dir__)
RUBY_COMMIT = "9277646a4bb2cf25a8384ffc140b154f49ea5766"
RAILS_COMMIT = "a9add2a7c1dd3eb978aa8b4ebf9ef7e111d1057f"
def setup
@document = JSON.parse(File.binread(File.join(ROOT, "manifests/client-candidate.json")))
end
def test_accepts_exact_unpublished_commit_candidate_and_emits_safe_outputs
outputs = OpenCodeCompat::ClientCandidate.new(@document).github_outputs
assert_equal "unpublished", outputs.fetch("publication_state")
assert_equal "commit", outputs.fetch("ruby_provenance_kind")
assert_equal RUBY_COMMIT, outputs.fetch("ruby_ref")
assert_equal "", outputs.fetch("ruby_tag")
assert_equal "commit", outputs.fetch("rails_provenance_kind")
assert_equal RAILS_COMMIT, outputs.fetch("rails_ref")
assert_equal "", outputs.fetch("rails_tag_object")
end
def test_unpublished_candidate_rejects_mixed_or_mismatched_provenance
@document.dig("clients", "opencode-ruby", "provenance")["tag"] = "v0.0.1.alpha8"
error = assert_raises(OpenCodeCompat::ClientCandidate::ValidationError) { candidate.verify! }
assert_match(/commit provenance keys/, error.message)
@document.dig("clients", "opencode-ruby", "provenance").delete("tag")
@document.dig("clients", "opencode-ruby", "provenance")["commit"] = "f" * 40
error = assert_raises(OpenCodeCompat::ClientCandidate::ValidationError) { candidate.verify! }
assert_match(/provenance commit/, error.message)
end
def test_published_candidate_requires_annotated_tag_provenance_for_both_clients
publish_document!
candidate.verify!
@document.dig("clients", "opencode-ruby")["provenance"] = {
"kind" => "commit",
"commit" => RUBY_COMMIT
}
error = assert_raises(OpenCodeCompat::ClientCandidate::ValidationError) { candidate.verify! }
assert_match(/provenance kind must equal "annotated-tag"/, error.message)
end
def test_published_candidate_rejects_wrong_tag_object_shape_or_peel
publish_document!
ruby_provenance = @document.dig("clients", "opencode-ruby", "provenance")
ruby_provenance["annotated_tag_object"] = "short"
error = assert_raises(OpenCodeCompat::ClientCandidate::ValidationError) { candidate.verify! }
assert_match(/annotated tag object must be a full lowercase 40-character/, error.message)
ruby_provenance["annotated_tag_object"] = "3" * 40
ruby_provenance["peeled_commit"] = "f" * 40
error = assert_raises(OpenCodeCompat::ClientCandidate::ValidationError) { candidate.verify! }
assert_match(/peeled commit/, error.message)
end
def test_rejects_non_lockstep_runtime_dependency
dependency = @document.dig("clients", "opencode-rails", "runtime_dependencies", "opencode-ruby")
dependency["requirement"] = "~> 0.0.1.alpha8"
error = assert_raises(OpenCodeCompat::ClientCandidate::ValidationError) { candidate.verify! }
assert_match(/runtime dependency requirement/, error.message)
dependency["requirement"] = "= 0.0.1.alpha8"
dependency["ref"] = "f" * 40
error = assert_raises(OpenCodeCompat::ClientCandidate::ValidationError) { candidate.verify! }
assert_match(/runtime dependency ref/, error.message)
end
def test_output_script_validates_the_repository_manifest
output, error, status = Open3.capture3(
RbConfig.ruby,
File.join(ROOT, "scripts/client_candidate_outputs.rb")
)
assert status.success?, error
assert_includes output.lines, "ruby_ref=#{RUBY_COMMIT}\n"
assert_includes output.lines, "rails_ref=#{RAILS_COMMIT}\n"
assert_includes output.lines, "publication_state=unpublished\n"
end
private
def candidate
OpenCodeCompat::ClientCandidate.new(@document)
end
def publish_document!
@document["publication_state"] = "published"
{
"opencode-ruby" => "3" * 40,
"opencode-rails" => "4" * 40
}.each do |name, tag_object|
client = @document.fetch("clients").fetch(name)
client["provenance"] = {
"kind" => "annotated-tag",
"tag" => "v#{client.fetch('version')}",
"annotated_tag_object" => tag_object,
"peeled_commit" => client.fetch("ref")
}
end
end
end

10
test/exact_live_contract_test.rb
View File

@@ -26,14 +26,4 @@ class ExactLiveContractTest < Minitest::Test
end
end
end
def test_accepts_only_one_authoritative_assistant_message
assert_nil OpenCodeCompat::ExactLiveContract.assert_authoritative_assistant_count!(1)
[0, 2, "not-a-number"].each do |count|
assert_raises(OpenCodeCompat::ExactLiveContract::ContractError) do
OpenCodeCompat::ExactLiveContract.assert_authoritative_assistant_count!(count)
end
end
end
end

198
test/image_contract_evidence_test.rb
View File

@@ -1,198 +0,0 @@
# frozen_string_literal: true
require "fileutils"
require "json"
require "minitest/autorun"
require "open3"
require "rbconfig"
require "tmpdir"
class ImageContractEvidenceTest < Minitest::Test
ROOT = File.expand_path("..", __dir__)
RUNNER = File.join(ROOT, "scripts/run_image_contract.sh")
GATEWAY_RESOLVER = File.join(ROOT, "scripts/private_default_gateway.rb")
VALID_IMAGE = "ghcr.io/anomalyco/opencode@sha256:#{'a' * 64}"
def setup
@tmp = Dir.mktmpdir("opencode-image-evidence")
@bin = File.join(@tmp, "bin")
@docker_marker = File.join(@tmp, "docker-called")
FileUtils.mkdir_p(@bin)
docker = File.join(@bin, "docker")
File.write(docker, <<~SH)
#!/usr/bin/env bash
: >"$DOCKER_CALLED_MARKER"
exit 99
SH
FileUtils.chmod(0o755, docker)
end
def teardown
FileUtils.remove_entry(@tmp)
end
def test_invalid_input_overwrites_stale_pass_without_touching_docker
evidence_path = File.join(@tmp, "evidence.json")
File.write(evidence_path, JSON.generate("status" => "pass"))
_output, _error, status = run_contract(
"OPENCODE_IMAGE" => "latest",
"OPENCODE_RUBY_PATH" => ROOT,
"OPENCODE_COMPAT_EVIDENCE_PATH" => evidence_path
)
assert_equal 2, status.exitstatus
refute_path_exists @docker_marker
evidence = JSON.parse(File.read(evidence_path))
assert_equal "fail", evidence.fetch("status")
assert_equal 2, evidence.dig("failure", "exit_status")
assert_equal "latest", evidence.dig("image", "requested")
assert_equal [], evidence.fetch("executed_profiles")
end
def test_rejects_truncated_registry_and_local_image_ids_before_docker
{
"ghcr.io/anomalyco/opencode@sha256:#{'a' * 12}" => {},
"sha256:#{'b' * 12}" => {"ALLOW_EXACT_IMAGE_ID" => "1"}
}.each_with_index do |(image, extra_environment), index|
evidence_path = File.join(@tmp, "truncated-#{index}.json")
_output, error, status = run_contract(
{
"OPENCODE_IMAGE" => image,
"OPENCODE_RUBY_PATH" => ROOT,
"OPENCODE_COMPAT_EVIDENCE_PATH" => evidence_path
}.merge(extra_environment)
)
assert_equal 2, status.exitstatus
assert_match(/must be an OCI digest/, error)
assert_equal image, JSON.parse(File.read(evidence_path)).dig("image", "requested")
end
refute_path_exists @docker_marker
end
def test_rejects_a_checkout_at_a_different_commit_before_docker
checkout, _commit = git_checkout
evidence_path = File.join(@tmp, "mismatch.json")
_output, error, status = run_contract(
base_environment(checkout, "f" * 40, evidence_path)
)
assert_equal 2, status.exitstatus
assert_match(/does not match expected commit/, error)
assert_failed_without_docker(evidence_path)
end
def test_rejects_a_dirty_checkout_before_docker
checkout, commit = git_checkout
File.write(File.join(checkout, "dirty.txt"), "not certified\n")
evidence_path = File.join(@tmp, "dirty.json")
_output, error, status = run_contract(base_environment(checkout, commit, evidence_path))
assert_equal 2, status.exitstatus
assert_match(/checkout must be clean/, error)
assert_failed_without_docker(evidence_path)
end
def test_rejects_a_non_git_path_before_docker
checkout = File.join(@tmp, "not-a-checkout")
FileUtils.mkdir_p(checkout)
evidence_path = File.join(@tmp, "not-git.json")
_output, error, status = run_contract(
base_environment(checkout, "f" * 40, evidence_path)
)
assert_equal 2, status.exitstatus
assert_match(/readable Git checkout/, error)
assert_failed_without_docker(evidence_path)
end
def test_rejects_malformed_ipv6_and_public_probe_hosts_before_docker
checkout, commit = git_checkout
["not-an-address", "::1", "8.8.8.8"].each_with_index do |probe_host, index|
evidence_path = File.join(@tmp, "probe-host-#{index}.json")
environment = base_environment(checkout, commit, evidence_path).merge(
"OPENCODE_PROBE_HOST" => probe_host
)
_output, error, status = run_contract(environment)
assert_equal 2, status.exitstatus
assert_match(/loopback or private IPv4 address/, error)
assert_failed_without_docker(evidence_path)
end
end
def test_resolves_a_private_default_gateway_from_linux_route_hex
route_path = File.join(@tmp, "route")
File.write(route_path, <<~ROUTES)
Iface Destination Gateway Flags RefCnt Use Metric Mask MTU Window IRTT
eth0 00000000 010011AC 0003 0 0 10 00000000 0 0 0
ROUTES
output, error, status = Open3.capture3(RbConfig.ruby, GATEWAY_RESOLVER, route_path)
assert status.success?, error
assert_equal "172.17.0.1\n", output
end
def test_gateway_resolver_rejects_a_public_default_gateway
route_path = File.join(@tmp, "public-route")
File.write(route_path, <<~ROUTES)
Iface Destination Gateway Flags RefCnt Use Metric Mask MTU Window IRTT
eth0 00000000 08080808 0003 0 0 10 00000000 0 0 0
ROUTES
_output, error, status = Open3.capture3(RbConfig.ruby, GATEWAY_RESOLVER, route_path)
refute status.success?
assert_match(/no private IPv4 default-route gateway found/, error)
end
private
def base_environment(checkout, commit, evidence_path)
{
"OPENCODE_IMAGE" => VALID_IMAGE,
"OPENCODE_RUBY_PATH" => checkout,
"OPENCODE_RUBY_COMMIT" => commit,
"OPENCODE_COMPAT_EVIDENCE_PATH" => evidence_path
}
end
def run_contract(environment)
env = {
"PATH" => "#{@bin}:#{ENV.fetch('PATH')}",
"DOCKER_CALLED_MARKER" => @docker_marker
}.merge(environment)
Open3.capture3(env, "bash", RUNNER)
end
def git_checkout
path = File.join(@tmp, "checkout-#{rand(1_000_000)}")
FileUtils.mkdir_p(path)
run_git!(path, "init", "--quiet")
run_git!(path, "config", "user.name", "Compatibility Test")
run_git!(path, "config", "user.email", "compat@example.test")
File.write(File.join(path, "tracked.txt"), "clean\n")
run_git!(path, "add", "tracked.txt")
run_git!(path, "commit", "--quiet", "-m", "fixture")
commit = run_git!(path, "rev-parse", "HEAD").strip
[path, commit]
end
def run_git!(path, *arguments)
output, error, status = Open3.capture3("git", "-C", path, *arguments)
assert status.success?, error
output
end
def assert_failed_without_docker(evidence_path)
refute_path_exists @docker_marker
assert_equal "fail", JSON.parse(File.read(evidence_path)).fetch("status")
end
end

415
test/lockstep_client_contract_test.rb
View File

@@ -1,415 +0,0 @@
# frozen_string_literal: true
require "minitest/autorun"
require "rbconfig"
require "stringio"
require "tmpdir"
require_relative "../ruby/lockstep_client_contract"
module LockstepClientContractTestSources
class Git
attr_reader :ref, :revision, :uri
def initialize(revision, ref: revision, uri: OpenCodeCompat::LockstepClientContract::OPENCODE_RUBY_GIT_URI)
@revision = revision
@ref = ref
@uri = uri
end
end
class Path; end
end
class LockstepClientContractTest < Minitest::Test
RUBY_COMMIT = "1" * 40
RAILS_COMMIT = "2" * 40
RUBY_TAG_OBJECT = "3" * 40
RAILS_TAG_OBJECT = "4" * 40
RUBY_TAG = "v0.0.1.alpha7"
RAILS_TAG = "v0.0.1.alpha7"
VERSION = "0.0.1.alpha7"
FakeSpec = Struct.new(:name, :version, :runtime_dependencies, :source, :full_gem_path, keyword_init: true)
def setup
@root = Dir.mktmpdir("opencode-lockstep-contract")
@ruby_path = File.join(@root, "opencode-ruby")
@rails_path = File.join(@root, "opencode-rails")
Dir.mkdir(@ruby_path)
Dir.mkdir(@rails_path)
@env = {
"OPENCODE_CLIENT_PUBLICATION_STATE" => "published",
"OPENCODE_RUBY_PATH" => @ruby_path,
"OPENCODE_RUBY_COMMIT" => RUBY_COMMIT,
"OPENCODE_RUBY_PROVENANCE_KIND" => "annotated-tag",
"OPENCODE_RUBY_TAG" => RUBY_TAG,
"OPENCODE_RUBY_TAG_OBJECT" => RUBY_TAG_OBJECT,
"OPENCODE_RUBY_VERSION" => VERSION,
"OPENCODE_RAILS_PATH" => @rails_path,
"OPENCODE_RAILS_COMMIT" => RAILS_COMMIT,
"OPENCODE_RAILS_PROVENANCE_KIND" => "annotated-tag",
"OPENCODE_RAILS_TAG" => RAILS_TAG,
"OPENCODE_RAILS_TAG_OBJECT" => RAILS_TAG_OBJECT,
"OPENCODE_RAILS_VERSION" => VERSION
}
@heads = {@ruby_path => RUBY_COMMIT, @rails_path => RAILS_COMMIT}
@git_results = {}
seed_annotated_tag(@ruby_path, RUBY_TAG, RUBY_TAG_OBJECT, RUBY_COMMIT)
seed_annotated_tag(@rails_path, RAILS_TAG, RAILS_TAG_OBJECT, RAILS_COMMIT)
@ruby_spec = FakeSpec.new(name: "opencode-ruby", version: Gem::Version.new(VERSION))
@rails_spec = FakeSpec.new(
name: "opencode-rails",
version: Gem::Version.new(VERSION),
runtime_dependencies: [Gem::Dependency.new("opencode-ruby", "= #{VERSION}")],
full_gem_path: @rails_path
)
@bundle_ruby_spec = FakeSpec.new(
name: "opencode-ruby",
source: LockstepClientContractTestSources::Git.new(RUBY_COMMIT)
)
end
def teardown
FileUtils.remove_entry(@root)
end
def test_verifies_and_emits_canonical_lockstep_evidence
evidence_path = File.join(@root, "evidence", "lockstep.json")
@env["OPENCODE_COMPAT_EVIDENCE_PATH"] = evidence_path
output = StringIO.new
document = contract.emit(io: output)
expected_json = OpenCodeCompat::LockstepClientContract.canonical_json(document)
assert_equal "#{expected_json}\n", output.string
assert_equal "#{expected_json}\n", File.binread(evidence_path)
assert_equal "pass", document.fetch("status")
assert_equal 2, document.fetch("schema_version")
assert_equal "published", document.fetch("publication_state")
assert_equal RUBY_COMMIT, document.dig("opencode_ruby", "checkout_commit")
assert_equal RUBY_COMMIT, document.dig("opencode_ruby", "bundler_git_ref")
assert_equal RUBY_COMMIT, document.dig("opencode_ruby", "bundler_git_revision")
assert_equal OpenCodeCompat::LockstepClientContract::OPENCODE_RUBY_GIT_URI,
document.dig("opencode_ruby", "bundler_git_uri")
assert_equal "annotated-tag", document.dig("opencode_ruby", "source_provenance", "kind")
assert_equal RUBY_TAG_OBJECT, document.dig("opencode_ruby", "source_provenance", "annotated_tag_object")
assert_equal RUBY_COMMIT, document.dig("opencode_ruby", "source_provenance", "peeled_commit")
assert_equal RUBY_TAG, document.dig("opencode_ruby", "source_provenance", "tag")
assert_equal RAILS_COMMIT, document.dig("opencode_rails", "checkout_commit")
assert_equal RAILS_TAG_OBJECT, document.dig("opencode_rails", "source_provenance", "annotated_tag_object")
assert_equal RAILS_COMMIT, document.dig("opencode_rails", "source_provenance", "peeled_commit")
assert_equal "= #{VERSION}", document.dig("opencode_rails", "runtime_dependency", "requirement")
assert_equal RUBY_VERSION, document.fetch("ruby_runtime_version")
assert_nil document.dig("workflow", "run_id")
assert_equal expected_json, JSON.generate(JSON.parse(expected_json).sort.to_h)
end
def test_accepts_unpublished_commit_only_provenance_without_tag_lookup
use_commit_only_provenance!
document = contract.verify
assert_equal "unpublished", document.fetch("publication_state")
assert_equal({"commit" => RUBY_COMMIT, "kind" => "commit"},
document.dig("opencode_ruby", "source_provenance"))
assert_equal({"commit" => RAILS_COMMIT, "kind" => "commit"},
document.dig("opencode_rails", "source_provenance"))
end
def test_publication_state_cannot_weaken_published_tag_binding
@env["OPENCODE_RUBY_PROVENANCE_KIND"] = "commit"
error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
assert_match(/published candidate/, error.message)
use_commit_only_provenance!
@env["OPENCODE_RAILS_PROVENANCE_KIND"] = "annotated-tag"
error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
assert_match(/unpublished candidate/, error.message)
end
def test_commit_only_provenance_rejects_residual_tag_coordinates
use_commit_only_provenance!
@env["OPENCODE_RUBY_TAG"] = RUBY_TAG
error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
assert_match(/must not supply OPENCODE_RUBY_TAG/, error.message)
end
def test_commit_only_provenance_stops_when_the_release_tag_appears
use_commit_only_provenance!
set_git_result(
@ruby_path,
["rev-parse", "--verify", "--quiet", "refs/tags/#{RUBY_TAG}"],
RUBY_TAG_OBJECT
)
error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
assert_match(/release tag #{Regexp.escape(RUBY_TAG)} already exists/, error.message)
assert_match(/publication_state must be published/, error.message)
end
def test_commit_only_provenance_does_not_treat_git_errors_as_an_absent_tag
use_commit_only_provenance!
@git_results[[@ruby_path, ["rev-parse", "--verify", "--quiet", "refs/tags/#{RUBY_TAG}"]]] =
OpenCodeCompat::LockstepClientContract::GitCommandError.new("corrupt ref", exitstatus: 128)
resolver = lambda do |path, *arguments|
result = resolve_git(path, *arguments)
raise result if result.is_a?(Exception)
result
end
error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) do
contract(git_resolver: resolver).verify
end
assert_match(/could not check opencode-ruby release tag: corrupt ref/, error.message)
end
def test_rejects_checkout_commit_mismatch_for_either_client
{
@ruby_path => "opencode-ruby checkout commit",
@rails_path => "opencode-rails checkout commit"
}.each do |path, message|
original = @heads.fetch(path)
@heads[path] = "f" * 40
error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
assert_match message, error.message
ensure
@heads[path] = original
end
end
def test_rejects_non_annotated_tag_object_for_either_client
{
@ruby_path => RUBY_TAG_OBJECT,
@rails_path => RAILS_TAG_OBJECT
}.each do |path, object|
set_git_result(path, ["cat-file", "-t", object], "commit")
error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
assert_match(/annotated tag object type must equal "tag"/, error.message)
ensure
set_git_result(path, ["cat-file", "-t", object], "tag")
end
end
def test_rejects_tampered_annotated_tag_object_coordinate
tampered_object = "f" * 40
@env["OPENCODE_RUBY_TAG_OBJECT"] = tampered_object
set_git_result(@ruby_path, ["cat-file", "-t", tampered_object], "tag")
set_git_result(@ruby_path, ["rev-parse", "--verify", "#{tampered_object}^{commit}"], RUBY_COMMIT)
error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
assert_match(/opencode-ruby local tag ref object/, error.message)
assert_match(/#{RUBY_TAG_OBJECT}/, error.message)
end
def test_rejects_local_tag_ref_resolving_to_another_object
set_git_result(
@rails_path,
["rev-parse", "--verify", "refs/tags/#{RAILS_TAG}"],
"e" * 40
)
error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
assert_match(/opencode-rails local tag ref object/, error.message)
end
def test_rejects_wrong_object_or_ref_peel
object_peel_key = ["rev-parse", "--verify", "#{RUBY_TAG_OBJECT}^{commit}"]
set_git_result(@ruby_path, object_peel_key, "e" * 40)
error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
assert_match(/opencode-ruby annotated tag peeled commit/, error.message)
set_git_result(@ruby_path, object_peel_key, RUBY_COMMIT)
set_git_result(
@ruby_path,
["rev-parse", "--verify", "refs/tags/#{RUBY_TAG}^{commit}"],
"e" * 40
)
error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
assert_match(/opencode-ruby local tag ref peeled commit/, error.message)
end
def test_rejects_missing_local_tag
@git_results.delete([@ruby_path, ["rev-parse", "--verify", "refs/tags/#{RUBY_TAG}"]])
error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
assert_match(/could not resolve opencode-ruby local tag ref/, error.message)
end
def test_rejects_loaded_or_gem_version_drift
error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) do
contract(ruby_version: "0.0.1.alpha8").verify
end
assert_match(/loaded Opencode::VERSION/, error.message)
@rails_spec.version = Gem::Version.new("0.0.1.alpha8")
error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
assert_match(/loaded opencode-rails gem version/, error.message)
end
def test_rejects_non_lockstep_expected_versions
@env["OPENCODE_RAILS_VERSION"] = "0.0.1.alpha8"
error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) do
contract(rails_version: "0.0.1.alpha8").verify
end
assert_match(/lockstep client version/, error.message)
end
def test_rejects_non_exact_or_wrong_rails_runtime_dependency
["~> #{VERSION}", "= 0.0.1.alpha6"].each do |requirement|
@rails_spec.runtime_dependencies = [Gem::Dependency.new("opencode-ruby", requirement)]
error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
assert_match(/must require opencode-ruby = #{Regexp.escape(VERSION)}/, error.message)
end
end
def test_rejects_missing_or_duplicate_rails_runtime_dependency
@rails_spec.runtime_dependencies = []
error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
assert_match(/exactly one runtime dependency/, error.message)
@rails_spec.runtime_dependencies = [
Gem::Dependency.new("opencode-ruby", "= #{VERSION}"),
Gem::Dependency.new("opencode-ruby", "= #{VERSION}")
]
error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
assert_match(/exactly one runtime dependency/, error.message)
end
def test_rejects_non_git_or_mismatched_bundler_source
@bundle_ruby_spec.source = LockstepClientContractTestSources::Path.new
error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
assert_match(/must be a Git source/, error.message)
@bundle_ruby_spec.source = LockstepClientContractTestSources::Git.new("f" * 40)
error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
assert_match(/Bundler opencode-ruby revision/, error.message)
@bundle_ruby_spec.source = LockstepClientContractTestSources::Git.new(RUBY_COMMIT, ref: "main")
error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
assert_match(/Bundler opencode-ruby ref/, error.message)
@bundle_ruby_spec.source = LockstepClientContractTestSources::Git.new(
RUBY_COMMIT,
uri: "https://example.test/opencode-ruby.git"
)
error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
assert_match(/Bundler opencode-ruby URI/, error.message)
end
def test_rejects_loaded_rails_gem_from_another_checkout
other_path = File.join(@root, "other-opencode-rails")
Dir.mkdir(other_path)
@rails_spec.full_gem_path = other_path
error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
assert_match(/loaded opencode-rails checkout/, error.message)
end
def test_requires_full_exact_candidate_coordinates
@env.delete("OPENCODE_RUBY_COMMIT")
error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
assert_match(/missing required environment: OPENCODE_RUBY_COMMIT/, error.message)
@env["OPENCODE_RUBY_COMMIT"] = "main"
error = assert_raises(OpenCodeCompat::LockstepClientContract::ContractError) { contract.verify }
assert_match(/full lowercase 40-character Git commit/, error.message)
end
def test_cli_failure_writes_failure_evidence
stub_path = File.join(@root, "cli-stubs")
evidence_path = File.join(@root, "cli-evidence", "lockstep.json")
FileUtils.mkdir_p(stub_path)
File.binwrite(File.join(stub_path, "bundler.rb"), <<~RUBY)
module Bundler
LoadedDefinition = Struct.new(:specs)
def self.load
LoadedDefinition.new([])
end
end
RUBY
File.binwrite(File.join(stub_path, "opencode-rails.rb"), <<~RUBY)
module Opencode
VERSION = #{VERSION.inspect}
RAILS_VERSION = #{VERSION.inspect}
end
RUBY
_stdout, stderr, status = Open3.capture3(
{"OPENCODE_COMPAT_EVIDENCE_PATH" => evidence_path},
RbConfig.ruby,
"-I",
stub_path,
File.expand_path("../ruby/lockstep_client_contract.rb", __dir__),
unsetenv_others: true
)
refute status.success?
assert_equal 1, status.exitstatus
failure = JSON.parse(File.binread(evidence_path))
assert_equal "opencode-client-lockstep", failure.fetch("contract")
assert_equal 2, failure.fetch("schema_version")
assert_equal "fail", failure.fetch("status")
assert_match(/missing required environment/, failure.fetch("error"))
assert_equal failure, JSON.parse(stderr)
end
private
def contract(ruby_version: VERSION, rails_version: VERSION, git_resolver: method(:resolve_git))
OpenCodeCompat::LockstepClientContract.new(
env: @env,
git_resolver: git_resolver,
loaded_specs: {
"opencode-ruby" => @ruby_spec,
"opencode-rails" => @rails_spec
},
bundle_specs: [@bundle_ruby_spec],
ruby_version: ruby_version,
rails_version: rails_version
)
end
def resolve_git(path, *arguments)
return @heads.fetch(path) if arguments == ["rev-parse", "--verify", "HEAD^{commit}"]
@git_results.fetch([path, arguments])
end
def seed_annotated_tag(path, tag, object, commit)
set_git_result(path, ["cat-file", "-t", object], "tag")
set_git_result(path, ["rev-parse", "--verify", "refs/tags/#{tag}"], object)
set_git_result(path, ["rev-parse", "--verify", "#{object}^{commit}"], commit)
set_git_result(path, ["rev-parse", "--verify", "refs/tags/#{tag}^{commit}"], commit)
end
def set_git_result(path, arguments, result)
@git_results[[path, arguments]] = result
end
def use_commit_only_provenance!
@env["OPENCODE_CLIENT_PUBLICATION_STATE"] = "unpublished"
@env["OPENCODE_RUBY_PROVENANCE_KIND"] = "commit"
@env["OPENCODE_RAILS_PROVENANCE_KIND"] = "commit"
@env.delete("OPENCODE_RUBY_TAG")
@env.delete("OPENCODE_RUBY_TAG_OBJECT")
@env.delete("OPENCODE_RAILS_TAG")
@env.delete("OPENCODE_RAILS_TAG_OBJECT")
end
end

97
test/matrix_json_test.rb
View File

@@ -1,97 +0,0 @@
# frozen_string_literal: true
require "fileutils"
require "json"
require "minitest/autorun"
require "open3"
require "rbconfig"
require "tmpdir"
class MatrixJsonTest < Minitest::Test
ROOT = File.expand_path("..", __dir__)
def setup
@tmp = Dir.mktmpdir("opencode-matrix-json")
FileUtils.mkdir_p(File.join(@tmp, "lib/opencode_compat"))
FileUtils.mkdir_p(File.join(@tmp, "scripts"))
FileUtils.mkdir_p(File.join(@tmp, "manifests"))
FileUtils.cp(File.join(ROOT, "scripts/matrix_json.rb"), File.join(@tmp, "scripts"))
FileUtils.cp(
File.join(ROOT, "lib/opencode_compat/client_candidate.rb"),
File.join(@tmp, "lib/opencode_compat")
)
FileUtils.cp(
File.join(ROOT, "manifests/client-candidate.json"),
File.join(@tmp, "manifests")
)
@manifest = JSON.parse(File.read(File.join(ROOT, "manifests/image-matrix.json")))
end
def teardown
FileUtils.remove_entry(@tmp)
end
def test_emits_only_the_actual_shared_client_contract_profile
output, error, status = run_matrix(@manifest)
assert status.success?, error
JSON.parse(output).fetch("include").each do |target|
assert_equal ["ruby-rest-sse"], target.fetch("profiles")
assert_equal "shared-client-contract-only", target.fetch("certification_scope")
end
end
def test_rejects_a_manifest_that_overstates_the_executed_profile
@manifest.fetch("public_ci").first["profiles"] = ["rails-persisted-turn"]
_output, error, status = run_matrix(@manifest)
refute status.success?
assert_match(/executes exactly ruby-rest-sse/, error)
end
def test_rejects_a_manifest_that_overstates_the_certification_scope
@manifest.fetch("public_ci").first["certification_scope"] = "consumer-runtime"
_output, error, status = run_matrix(@manifest)
refute status.success?
assert_match(/certification_scope must be shared-client-contract-only/, error)
end
def test_rejects_a_matrix_bound_to_another_client_candidate
@manifest.fetch("client_candidate")["opencode_ruby_commit"] = "f" * 40
_output, error, status = run_matrix(@manifest)
refute status.success?
assert_match(/must equal the exact client candidate/, error)
end
def test_allows_reviewed_candidate_certification_without_changing_coordinates
@manifest.fetch("client_candidate")["certification_status"] = "certified"
_output, error, status = run_matrix(@manifest)
assert status.success?, error
end
def test_rejects_unknown_candidate_certification_status
@manifest.fetch("client_candidate")["certification_status"] = "deployed"
_output, error, status = run_matrix(@manifest)
refute status.success?
assert_match(/certification_status must be pending or certified/, error)
end
private
def run_matrix(manifest)
File.write(
File.join(@tmp, "manifests/image-matrix.json"),
JSON.pretty_generate(manifest) + "\n"
)
Open3.capture3(RbConfig.ruby, File.join(@tmp, "scripts/matrix_json.rb"))
end
end

303
test/repository_test.rb
View File

@@ -2,7 +2,6 @@
require "json"
require "minitest/autorun"
require_relative "../lib/opencode_compat/client_candidate"
require_relative "../lib/opencode_compat/runtime_tuple_promoter"
class RepositoryTest < Minitest::Test
@@ -13,7 +12,7 @@ class RepositoryTest < Minitest::Test
end
def test_every_json_document_parses
paths = Dir.glob(File.join(ROOT, "{evidence,fixtures,manifests,profiles}/**/*.json"))
paths = Dir.glob(File.join(ROOT, "{evidence,fixtures,manifests,profiles,schemas}/**/*.json"))
refute_empty paths
paths.each { |path| JSON.parse(File.read(path)) }
end
@@ -37,96 +36,42 @@ class RepositoryTest < Minitest::Test
end
end
def test_only_ruby_rest_sse_can_be_certified_by_the_shared_ruby_probe
Dir.glob(File.join(ROOT, "profiles/*.json")).each do |path|
profile = JSON.parse(File.read(path))
if profile.fetch("id") == "ruby-rest-sse"
assert_equal "shared-ruby-fixture-and-live-probe", profile.fetch("certification_mode")
assert_equal true, profile.fetch("shared_ruby_probe_sufficient")
else
assert_equal "executable-consumer-attestation", profile.fetch("certification_mode")
assert_equal false, profile.fetch("shared_ruby_probe_sufficient")
end
end
end
def test_public_matrix_uses_only_immutable_oci_digests
manifest = json("manifests/image-matrix.json")
assert_equal 2, manifest.fetch("schema_version")
targets = manifest.fetch("public_ci")
targets = json("manifests/image-matrix.json").fetch("public_ci")
refute_empty targets
targets.each do |target|
assert_match %r{\Aghcr\.io/anomalyco/opencode@sha256:[0-9a-f]{64}\z}, target.fetch("image")
refute_includes target.fetch("image"), ":latest"
assert_equal ["ruby-rest-sse"], target.fetch("profiles")
assert_equal "shared-client-contract-only",
target.fetch("certification_scope", "shared-client-contract-only")
assert_equal "pending", target.fetch("certification_status")
previous = target["previous_certification"]
next unless previous
refute_empty target.fetch("profiles")
next unless target.fetch("certification_status") == "certified"
assert_equal "certified", previous.fetch("status")
assert_match(/\A[0-9a-f]{40}\z/, previous.fetch("client_commit"))
assert_equal previous.fetch("expected_text"), previous.fetch("full_text")
assert_equal 1, previous.fetch("llm_request_count")
assert_match(/\A[0-9a-f]{40}\z/, target.fetch("certified_client_commit"))
assert_equal target.fetch("expected_text"), target.fetch("full_text")
assert_equal 1, target.fetch("llm_request_count")
end
end
def test_candidate_client_train_is_lockstep_and_bound_to_unpublished_commits
def test_candidate_is_bound_to_an_annotated_tag
candidate = json("manifests/client-candidate.json")
OpenCodeCompat::ClientCandidate.new(candidate).verify!
clients = candidate.fetch("clients")
release_train = candidate.fetch("release_train")
provenance = candidate.fetch("tag_provenance")
assert_equal 3, candidate.fetch("schema_version")
assert_equal "candidate", candidate.fetch("status")
assert_equal "unpublished", candidate.fetch("publication_state")
assert_equal "0.0.1.alpha8", release_train
assert_equal %w[opencode-rails opencode-ruby], clients.keys.sort
clients.each do |name, client|
provenance = client.fetch("provenance")
assert_equal "ajaynomics/#{name}", client.fetch("repository")
assert_equal release_train, client.fetch("version")
assert_match(/\A[0-9a-f]{40}\z/, client.fetch("ref"))
assert_equal "commit", provenance.fetch("kind")
assert_equal client.fetch("ref"), provenance.fetch("commit")
refute provenance.key?("tag")
end
assert_equal "9277646a4bb2cf25a8384ffc140b154f49ea5766", clients.dig("opencode-ruby", "ref")
assert_equal "a9add2a7c1dd3eb978aa8b4ebf9ef7e111d1057f", clients.dig("opencode-rails", "ref")
dependency = clients.fetch("opencode-rails").fetch("runtime_dependencies").fetch("opencode-ruby")
assert_equal "= #{release_train}", dependency.fetch("requirement")
assert_equal clients.fetch("opencode-ruby").fetch("ref"), dependency.fetch("ref")
end
def test_image_matrix_is_pending_and_bound_to_the_exact_client_candidate
candidate = json("manifests/client-candidate.json")
clients = candidate.fetch("clients")
matrix_candidate = json("manifests/image-matrix.json").fetch("client_candidate")
assert_equal "pending", matrix_candidate.fetch("certification_status")
assert_equal candidate.fetch("release_train"), matrix_candidate.fetch("release_train")
assert_equal candidate.fetch("publication_state"), matrix_candidate.fetch("publication_state")
assert_equal clients.dig("opencode-ruby", "ref"), matrix_candidate.fetch("opencode_ruby_commit")
assert_equal clients.dig("opencode-rails", "ref"), matrix_candidate.fetch("opencode_rails_commit")
json("manifests/image-matrix.json").fetch("host_canary").each do |target|
assert_equal "pending", target.fetch("certification_status")
previous = target.fetch("previous_certification")
assert_includes %w[candidate-certified certified], previous.fetch("status")
assert_match(/\A[0-9a-f]{40}\z/, previous.fetch("client_commit"))
end
end
def test_alpha8_local_image_evidence_is_review_input_not_app_certification
evidence = json("evidence/2026-07-20-opencode-alpha8-pre-release-shared-client.json")
candidate = json("manifests/client-candidate.json").fetch("clients")
assert_equal "not-certified", evidence.fetch("certification_status")
assert_equal "shared-client-contract-only", evidence.fetch("coverage_scope")
assert_equal "unpublished", evidence.fetch("publication_state")
assert_equal candidate.dig("opencode-ruby", "ref"), evidence.dig("clients", "opencode_ruby", "commit")
assert_equal candidate.dig("opencode-rails", "ref"), evidence.dig("clients", "opencode_rails", "commit")
assert_equal true, evidence.dig("clients", "opencode_ruby", "executed")
assert_equal false, evidence.dig("clients", "opencode_rails", "executed_by_image_contract")
assert_equal 5, evidence.fetch("checks").length
evidence.fetch("checks").each do |check|
assert_equal "pass", check.fetch("status")
assert_equal ["ruby-rest-sse"], check.fetch("executed_profiles")
assert_equal check.fetch("expected_text"), check.fetch("full_text")
assert_equal 1, check.fetch("authoritative_assistant_message_count")
assert_equal 1, check.fetch("llm_request_count")
end
assert evidence.fetch("limitations").any? { |entry| entry.include?("remain unverified") }
assert_match(/\A[0-9a-f]{40}\z/, candidate.fetch("ref"))
assert_match(/\Av\d+\.\d+\.\d+\.alpha\d+\z/, provenance.fetch("tag"))
assert_match(/\A[0-9a-f]{40}\z/, provenance.fetch("annotated_tag_object"))
assert_equal candidate.fetch("ref"), provenance.fetch("peeled_commit")
end
def test_certified_migration_keeps_previous_tuple
@@ -146,6 +91,10 @@ class RepositoryTest < Minitest::Test
def test_runtime_tuple_profiles_exist
tuples = json("manifests/runtime-tuples.json")
schema = json("schemas/runtime-tuples.schema.json")
assert_equal 2, tuples.fetch("schema_version")
assert_equal 2, schema.dig("properties", "schema_version", "const")
tuples.fetch("consumers").each_value do |consumer|
profile = consumer.fetch("profile")
assert_path_exists File.join(ROOT, "profiles", "#{profile}.json")
@@ -188,6 +137,96 @@ class RepositoryTest < Minitest::Test
end
end
def test_pull_request_heads_are_explicitly_candidate_only
tuples = json("manifests/runtime-tuples.json")
tuples.fetch("consumers").each do |name, consumer|
candidate = consumer.fetch("candidate")
reference = candidate.fetch("consumer_ref")
assert_equal "pre-merge-pr-head-candidate-only", candidate.fetch("certification_scope"), name
assert_equal false, candidate.fetch("promotion_eligible"), name
assert_equal "pull-request-head", reference.fetch("kind"), name
assert_equal candidate.fetch("consumer_commit"), reference.fetch("commit"), name
assert_match(/\A[0-9a-f]{40}\z/, reference.fetch("tree"), name)
assert_match(%r{\Ahttps://.+/pulls/\d+\z}, reference.fetch("review_url"), name)
end
end
def test_candidate_gems_use_peeled_refs_and_loaded_source_proof
tuples = json("manifests/runtime-tuples.json")
tuples.fetch("consumers").each do |consumer_name, consumer|
candidate = consumer.fetch("candidate")
%w[opencode_ruby opencode_rails].each do |client_name|
client = candidate[client_name]
next unless client
commit = client.fetch("git_commit")
source = client.fetch("source")
proof = source.fetch("loaded_source_proof")
assert_equal "git", source.fetch("type"), "#{consumer_name} #{client_name}"
assert_equal commit, source.fetch("requested_ref"), "#{consumer_name} #{client_name}"
assert_equal commit, source.fetch("locked_revision"), "#{consumer_name} #{client_name}"
assert_equal "pass", proof.fetch("status"), "#{consumer_name} #{client_name}"
assert_equal "Bundler::Source::Git", proof.fetch("source_class"), "#{consumer_name} #{client_name}"
assert_equal client.fetch("version"), proof.fetch("loaded_version"), "#{consumer_name} #{client_name}"
assert_equal commit, proof.fetch("observed_ref"), "#{consumer_name} #{client_name}" if proof.key?("observed_ref")
assert_equal commit, proof.fetch("observed_revision"), "#{consumer_name} #{client_name}"
refute_empty proof.fetch("test"), "#{consumer_name} #{client_name}"
end
end
end
def test_ajent_records_current_selection_drift_and_exact_candidate_selection
ajent = json("manifests/runtime-tuples.json").fetch("consumers").fetch("ajent-rails")
expected_products = %w[aigl blackline raven]
current_runtime = ajent.fetch("current").fetch("runtime")
assert_match(/\Asha256:[0-9a-f]{64}\z/, current_runtime.fetch("docker_image_id"))
deployed = current_runtime.fetch("deployed_product_selection")
assert_equal "mutable-latest", deployed.fetch("strategy")
assert_equal "observed-configuration-drift-failure", deployed.fetch("status")
assert_equal expected_products, deployed.fetch("references").keys.sort
deployed.fetch("references").each_value { |reference| assert reference.end_with?(":latest") }
built = current_runtime.fetch("ci_built_product_images")
assert_equal expected_products, built.keys.sort
built.each_value do |coordinate|
assert_match(/\Asha256:[0-9a-f]{64}\z/, coordinate.fetch("docker_image_id"))
assert_equal ajent.dig("current", "consumer_commit"), coordinate.fetch("source_commit")
end
candidate_runtime = ajent.fetch("candidate").fetch("runtime")
selected = candidate_runtime.fetch("product_selection")
assert_equal expected_products, selected.fetch("references").keys.sort
selected.fetch("references").each_value do |reference|
assert reference.end_with?(":#{ajent.dig('candidate', 'consumer_commit')}")
refute reference.end_with?(":latest")
end
assert_equal ["blackline"], candidate_runtime.fetch("product_images").keys
assert_includes ajent.dig("candidate", "promotion_blockers"),
"aigl-and-raven-candidate-content-artifacts-have-not-been-built-and-canaried"
end
def test_manifest_candidates_cannot_be_promoted_from_pre_merge_evidence
promoter = OpenCodeCompat::RuntimeTuplePromoter.new(root: ROOT)
tuples = json("manifests/runtime-tuples.json")
tuples.fetch("consumers").each do |name, consumer|
error = assert_raises(OpenCodeCompat::PromotionError) do
promoter.promote(
consumer: name,
consumer_commit: consumer.dig("candidate", "consumer_commit"),
certification: {},
dry_run: true
)
end
assert_match(/pre-merge pull-request evidence is candidate-only/, error.message)
end
end
def test_candidate_evidence_is_bound_to_complete_tuple_fingerprints
promoter = OpenCodeCompat::RuntimeTuplePromoter.new(root: ROOT)
evidence_paths = {
@@ -206,6 +245,8 @@ class RepositoryTest < Minitest::Test
assert_equal consumer, evidence.fetch("consumer")
assert_equal fingerprints.fetch("profile"), evidence.fetch("profile")
assert_equal fingerprints.fetch("candidate_tuple_sha256"), evidence.fetch("tuple_sha256")
assert_equal "pre-merge-pr-head-candidate-only", evidence.fetch("certification_scope")
assert_equal false, evidence.fetch("promotion_eligible")
assert_equal "pass", evidence.fetch("status")
end
end
@@ -215,98 +256,6 @@ class RepositoryTest < Minitest::Test
refute_match(/\b(kamal|kubectl|helm|nomad|docker\s+service)\b/i, workflow)
end
def test_workflow_actions_are_pinned_to_exact_commits
workflows = Dir.glob(File.join(ROOT, ".github/workflows/*.{yml,yaml}"))
refute_empty workflows
workflows.each do |path|
File.foreach(path).with_index(1) do |line, number|
next unless (match = line.match(/\buses:\s+[^\s@]+@([^\s#]+)/))
assert_match(/\A[0-9a-f]{40}\z/, match[1], "#{path}:#{number} must pin an exact action commit")
end
end
end
def test_workflow_actions_use_reviewed_node24_compatible_pins
expected = {
"actions/checkout" => "9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0",
"actions/upload-artifact" => "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a",
"ruby/setup-ruby" => "003a5c4d8d6321bd302e38f6f0ec593f77f06600"
}
observed = Hash.new { |hash, key| hash[key] = [] }
Dir.glob(File.join(ROOT, ".github/workflows/*.{yml,yaml}")).each do |path|
File.read(path).scan(/\buses:\s+([^\s@]+)@([0-9a-f]{40})/) do |action, commit|
observed[action] << commit if expected.key?(action)
end
end
expected.each do |action, commit|
refute_empty observed.fetch(action), "expected at least one #{action} use"
assert_equal [commit], observed.fetch(action).uniq, "#{action} must stay on the reviewed Node 24 pin"
end
end
def test_candidate_workflow_verifies_and_preserves_the_lockstep_client_tuple
workflow = File.read(File.join(ROOT, ".github/workflows/candidate.yml"))
refute_includes workflow, "inputs.opencode_ruby_ref"
refute_includes workflow, "inputs.opencode_rails_ref"
assert_includes workflow, "repository: ajaynomics/opencode-ruby"
assert_includes workflow, "repository: ajaynomics/opencode-rails"
assert_includes workflow, "path: opencode-rails"
assert_includes workflow, "ruby: [\"3.2\", \"3.3\", \"3.4\", \"4.0\"]"
assert_includes workflow, "scripts/client_candidate_outputs.rb"
assert_includes workflow, "OPENCODE_CLIENT_PUBLICATION_STATE"
assert_includes workflow, "OPENCODE_RUBY_PROVENANCE_KIND"
assert_includes workflow, "OPENCODE_RAILS_PROVENANCE_KIND"
assert_includes workflow, "ruby/lockstep_client_contract.rb"
assert_includes workflow, "OPENCODE_RUBY_TAG_OBJECT"
assert_includes workflow, "OPENCODE_RAILS_TAG_OBJECT"
assert_operator workflow.scan("fetch-tags: true").length, :>=, 2
assert_operator workflow.scan("actions/upload-artifact@").length, :>=, 3
assert_includes workflow, "OPENCODE_COMPAT_EVIDENCE_PATH"
assert_includes workflow, "OPENCODE_REQUIRED_CONSUMER_PROFILES"
assert_includes workflow, 'BUNDLE_PATH: ${{ runner.temp }}/opencode-ruby-bundle'
assert_includes workflow, "Install candidate dependencies outside the checkout"
refute_includes workflow, "OPENCODE_MATRIX_PROFILES"
refute_includes workflow, "OPENCODE_CERTIFICATION_SCOPE"
refute_match(/\b(kamal|kubectl|helm|nomad|docker\s+service|gh\s+pr\s+merge)\b/i, workflow)
end
def test_candidate_workflow_has_an_explicit_dual_forge_evidence_boundary
workflow = File.read(File.join(ROOT, ".github/workflows/candidate.yml"))
upload_conditions = workflow.scan(
/- name: Upload (?:fixture|lockstep|exact-image) evidence\n\s+if: ([^\n]+)\n\s+uses: actions\/upload-artifact@/
).flatten
assert_equal 3, upload_conditions.length
assert_equal ["always() && github.server_url == 'https://github.com'"], upload_conditions.uniq
assert_includes workflow, "bundler-cache: ${{ github.server_url == 'https://github.com' }}"
assert_includes workflow, "exact-image-contract-gitea:"
assert_includes workflow, "if: github.server_url != 'https://github.com'"
assert_includes workflow, "run: scripts/run_image_matrix_contract.sh"
assert_includes workflow, 'probe_host="$(ruby scripts/private_default_gateway.rb)"'
assert_includes workflow, 'echo "OPENCODE_PROBE_HOST=$probe_host" >> "$GITHUB_ENV"'
assert_operator workflow.scan('BUNDLE_GEMFILE: ${{ github.workspace }}/ruby-client/Gemfile').length, :>=, 2
assert_operator workflow.scan("generated JSON is transient and is not review evidence").length, :>=, 3
gitea_job = workflow.split(/^ exact-image-contract-gitea:\n/, 2).fetch(1)
refute_includes gitea_job, "actions/upload-artifact@"
end
def test_gitea_matrix_runner_uses_every_generated_entry_without_hardcoded_coordinates
runner = File.read(File.join(ROOT, "scripts/run_image_matrix_contract.sh"))
assert_includes runner, 'matrix_json="$(ruby "$repo_root/scripts/matrix_json.rb")"'
assert_includes runner, 'for ((index = 0; index < entry_count; index++))'
assert_includes runner, 'bundle exec "$repo_root/scripts/run_image_contract.sh"'
assert_includes runner, '.image.reported_version == $version'
refute_match(/upstream-[0-9]/, runner)
refute_match(/ghcr\.io\/anomalyco/, runner)
end
def test_tuple_promotion_has_no_command_execution_or_deployment_client
paths = %w[
lib/opencode_compat/runtime_tuple_promoter.rb
@@ -324,16 +273,8 @@ class RepositoryTest < Minitest::Test
runner = File.read(File.join(ROOT, "scripts/run_image_contract.sh"))
assert_includes probe, "ExactLiveContract.assert_final_text!"
assert_includes probe, "ExactLiveContract.assert_authoritative_assistant_count!"
refute_includes probe, "full_text.include?"
assert_includes runner, "exact_live_contract.rb"
assert_includes runner, 'docker cp "$repo_root/scripts/fake_llm.py"'
refute_includes runner, '--volume "$repo_root/scripts:/compat:ro"'
assert_includes runner, '--publish "${probe_host}::4096"'
assert_includes runner, 'base_url="http://${probe_host}:${host_port}"'
refute_includes runner, "--publish 0.0.0.0"
assert_includes runner, "OPENCODE_COMPAT_EVIDENCE_PATH"
assert_includes runner, "OPENCODE_EXPECTED_VERSION"
refute_match(/request_count.*-lt\s+1/, runner)
end
end

204
test/runtime_tuple_promoter_test.rb
View File

@@ -18,6 +18,7 @@ class RuntimeTuplePromoterTest < Minitest::Test
CANDIDATE_IMAGE = "ghcr.io/anomalyco/opencode@sha256:#{'b' * 64}"
CURRENT_TIME = "2026-07-17T12:00:00Z"
CANDIDATE_TIME = "2026-07-18T12:00:00Z"
CANDIDATE_TREE = "7" * 40
def setup
@root = Dir.mktmpdir("opencode-compat-promotion")
@@ -25,6 +26,7 @@ class RuntimeTuplePromoterTest < Minitest::Test
FileUtils.mkdir_p(File.join(@root, "evidence"))
FileUtils.mkdir_p(File.join(@root, "profiles"))
File.write(File.join(@root, "profiles", "rails-persisted-turn.json"), "{}\n")
write_post_merge_canary_evidence("post-merge-canary.json", CANDIDATE_COMMIT)
write_manifest(valid_manifest)
@promoter = OpenCodeCompat::RuntimeTuplePromoter.new(root: @root)
end
@@ -175,6 +177,154 @@ class RuntimeTuplePromoterTest < Minitest::Test
assert_equal before, File.binread(manifest_path)
end
def test_rejects_pre_merge_pull_request_evidence_as_candidate_only
manifest = valid_manifest
candidate = manifest.dig("consumers", CONSUMER, "candidate")
candidate["certification_scope"] = "pre-merge-pr-head-candidate-only"
candidate["promotion_eligible"] = false
candidate["consumer_ref"] = {
"kind" => "pull-request-head",
"repository" => "example/consumer",
"commit" => CANDIDATE_COMMIT,
"tree" => CANDIDATE_TREE,
"base_commit" => CURRENT_COMMIT,
"review_url" => "https://example.test/pulls/1"
}
candidate.delete("promotion_provenance")
write_manifest(manifest)
candidate_evidence, previous_evidence = write_matching_evidence
error = assert_raises(OpenCodeCompat::PromotionError) do
@promoter.promote(
consumer: CONSUMER,
consumer_commit: CANDIDATE_COMMIT,
certification: certification(CANDIDATE_TIME, candidate_evidence),
previous_certification: certification(CURRENT_TIME, previous_evidence),
dry_run: true
)
end
assert_match(/pre-merge pull-request evidence is candidate-only/, error.message)
end
def test_accepts_explicit_identical_tree_attestation_with_post_merge_canary
manifest = valid_manifest
candidate = manifest.dig("consumers", CONSUMER, "candidate")
candidate["consumer_ref"] = {
"kind" => "pull-request-head",
"repository" => "example/consumer",
"commit" => CANDIDATE_COMMIT,
"tree" => CANDIDATE_TREE,
"base_commit" => CURRENT_COMMIT,
"review_url" => "https://example.test/pulls/1"
}
main_commit = "8" * 40
write_post_merge_canary_evidence("post-merge-attested-canary.json", main_commit)
candidate["promotion_provenance"] = {
"kind" => "identical-tree-attestation",
"pull_request_commit" => CANDIDATE_COMMIT,
"pull_request_tree" => CANDIDATE_TREE,
"main_commit" => main_commit,
"main_tree" => CANDIDATE_TREE,
"attested_at" => CANDIDATE_TIME,
"post_merge_canary" => {
"status" => "pass",
"checked_at" => CANDIDATE_TIME,
"evidence" => ["evidence/post-merge-attested-canary.json"]
}
}
write_manifest(manifest)
candidate_evidence, previous_evidence = write_matching_evidence
promoted = @promoter.promote(
consumer: CONSUMER,
consumer_commit: CANDIDATE_COMMIT,
certification: certification(CANDIDATE_TIME, candidate_evidence),
previous_certification: certification(CURRENT_TIME, previous_evidence),
dry_run: true
)
assert_equal "certified", promoted.dig("consumers", CONSUMER, "current", "status")
end
def test_main_commit_promotion_still_requires_a_post_merge_canary
manifest = valid_manifest
manifest.dig("consumers", CONSUMER, "candidate", "promotion_provenance").delete("post_merge_canary")
write_manifest(manifest)
error = assert_raises(OpenCodeCompat::PromotionError) do
@promoter.promote(
consumer: CONSUMER,
consumer_commit: CANDIDATE_COMMIT,
certification: {},
dry_run: true
)
end
assert_match(/passing post-merge canary/, error.message)
end
def test_rejects_candidate_without_loaded_exact_ref_source_proof
manifest = valid_manifest
manifest.dig("consumers", CONSUMER, "candidate", "opencode_ruby").delete("source")
write_manifest(manifest)
error = assert_raises(OpenCodeCompat::PromotionError) do
@promoter.fingerprints(consumer: CONSUMER, consumer_commit: CANDIDATE_COMMIT)
end
assert_match(/loaded exact-ref source proof/, error.message)
end
def test_explicit_degraded_bootstrap_certifies_current_without_faking_previous
manifest = valid_manifest
failed = manifest.dig("consumers", CONSUMER, "current")
failed["status"] = "observed-production-contract-failed"
write_manifest(manifest)
fingerprint = @promoter.fingerprints(
consumer: CONSUMER,
consumer_commit: CANDIDATE_COMMIT
).fetch("candidate_tuple_sha256")
evidence = write_evidence(
"bootstrap-candidate.json",
commit: CANDIDATE_COMMIT,
timestamp: CANDIDATE_TIME,
fingerprint: fingerprint
)
bootstrapped = @promoter.bootstrap_current(
consumer: CONSUMER,
consumer_commit: CANDIDATE_COMMIT,
certification: certification(CANDIDATE_TIME, evidence),
acknowledgement: OpenCodeCompat::RuntimeTuplePromoter::DEGRADED_BOOTSTRAP_ACKNOWLEDGEMENT,
dry_run: true
)
consumer = bootstrapped.dig("consumers", CONSUMER)
assert_equal "certified", consumer.dig("current", "status")
assert_equal CANDIDATE_COMMIT, consumer.dig("current", "consumer_commit")
assert_nil consumer["candidate"]
assert_nil consumer["previous"]
assert_equal "observed-production-contract-failed", consumer.dig("emergency_provenance", "status")
assert_nil consumer.dig("emergency_provenance", "certification")
assert_equal "degraded-no-certified-previous", consumer.dig("rollback_state", "status")
assert_equal "bootstrap-current-only", bootstrapped.fetch("migration_state")
end
def test_degraded_bootstrap_requires_exact_explicit_acknowledgement
error = assert_raises(OpenCodeCompat::PromotionError) do
@promoter.bootstrap_current(
consumer: CONSUMER,
consumer_commit: CANDIDATE_COMMIT,
certification: {},
acknowledgement: "yes",
dry_run: true
)
end
assert_match(/explicit acknowledgement/, error.message)
end
def test_rejects_evidence_that_does_not_match_the_complete_tuple
candidate, previous = write_matching_evidence
manifest = JSON.parse(File.read(manifest_path))
@@ -254,7 +404,7 @@ class RuntimeTuplePromoterTest < Minitest::Test
def valid_manifest
{
"schema_version" => 1,
"schema_version" => 2,
"migration_state" => "candidate",
"consumers" => {
CONSUMER => {
@@ -269,8 +419,25 @@ class RuntimeTuplePromoterTest < Minitest::Test
"candidate" => {
"status" => "compatibility-certified",
"certified_at" => "2026-07-18T10:00:00Z",
"opencode_ruby" => {"version" => "0.0.1.alpha7", "git_commit" => RUBY_CANDIDATE},
"opencode_rails" => {"version" => "0.0.1.alpha7", "git_commit" => RAILS_CANDIDATE},
"certification_scope" => "promotion-deployed",
"promotion_eligible" => true,
"consumer_ref" => {
"kind" => "main-commit",
"repository" => "example/consumer",
"commit" => CANDIDATE_COMMIT,
"tree" => CANDIDATE_TREE
},
"promotion_provenance" => {
"kind" => "main-commit",
"main_commit" => CANDIDATE_COMMIT,
"post_merge_canary" => {
"status" => "pass",
"checked_at" => CANDIDATE_TIME,
"evidence" => ["evidence/post-merge-canary.json"]
}
},
"opencode_ruby" => client("0.0.1.alpha7", RUBY_CANDIDATE),
"opencode_rails" => client("0.0.1.alpha7", RAILS_CANDIDATE),
"runtime" => {"image" => CANDIDATE_IMAGE, "reported_version" => "1.18.3"}
},
"previous" => nil
@@ -279,6 +446,27 @@ class RuntimeTuplePromoterTest < Minitest::Test
}
end
def client(version, commit)
{
"version" => version,
"git_commit" => commit,
"source" => {
"type" => "git",
"uri" => "https://example.test/client.git",
"requested_ref" => commit,
"locked_revision" => commit,
"loaded_source_proof" => {
"status" => "pass",
"source_class" => "Bundler::Source::Git",
"loaded_version" => version,
"observed_ref" => commit,
"observed_revision" => commit,
"test" => "test/dependency_provenance_test.rb"
}
}
}
end
def write_matching_evidence
fingerprints = @promoter.fingerprints(consumer: CONSUMER, consumer_commit: CANDIDATE_COMMIT)
candidate = write_evidence(
@@ -311,6 +499,16 @@ class RuntimeTuplePromoterTest < Minitest::Test
{"path" => path, "tuple_sha256" => fingerprint}
end
def write_post_merge_canary_evidence(name, commit)
document = {
"schema_version" => 1,
"status" => "pass",
"checked_at" => CANDIDATE_TIME,
"consumer_commit" => commit
}
File.write(File.join(@root, "evidence", name), JSON.pretty_generate(document) + "\n")
end
def certification(timestamp, evidence)
{
"status" => "pass",

234
test/watcher_test.rb
View File

@@ -1,234 +0,0 @@
# frozen_string_literal: true
require "fileutils"
require "json"
require "minitest/autorun"
require "open3"
require "rbconfig"
require "tmpdir"
class WatcherTest < Minitest::Test
ROOT = File.expand_path("..", __dir__)
RUBY = RbConfig.ruby
def setup
@tmp = Dir.mktmpdir("opencode-watcher")
FileUtils.mkdir_p(File.join(@tmp, "scripts"))
FileUtils.mkdir_p(File.join(@tmp, "manifests"))
FileUtils.cp(File.join(ROOT, "scripts/record_upstream_candidate.rb"), File.join(@tmp, "scripts"))
%w[upstream.json image-matrix.json].each do |name|
FileUtils.cp(File.join(ROOT, "manifests", name), File.join(@tmp, "manifests"))
end
end
def teardown
FileUtils.remove_entry(@tmp)
end
def test_same_tag_and_digest_is_an_exact_noop
upstream = read_json("manifests/upstream.json")
before = watched_bytes
run_recorder!(
upstream.fetch("release_tag"),
upstream.fetch("published_at"),
upstream.fetch("release_url"),
upstream.fetch("image").split("@").last
)
assert_equal before, watched_bytes
end
def test_same_tag_and_digest_repairs_a_missing_public_target_then_noops
upstream = read_json("manifests/upstream.json")
matrix = read_json("manifests/image-matrix.json")
image = upstream.fetch("image")
matrix.fetch("public_ci").reject! { |target| target.fetch("image") == image }
write_json("manifests/image-matrix.json", matrix)
upstream_before = File.binread(File.join(@tmp, "manifests/upstream.json"))
arguments = [
upstream.fetch("release_tag"),
upstream.fetch("published_at"),
upstream.fetch("release_url"),
image.split("@").last
]
run_recorder!(*arguments)
repaired = read_json("manifests/image-matrix.json")
targets = repaired.fetch("public_ci").select { |target| target.fetch("image") == image }
assert_equal 1, targets.length
assert_equal "pending", targets.first.fetch("certification_status")
assert_equal ["ruby-rest-sse"], targets.first.fetch("profiles")
assert_equal upstream_before, File.binread(File.join(@tmp, "manifests/upstream.json"))
after = watched_bytes
run_recorder!(*arguments)
assert_equal after, watched_bytes
end
def test_duplicate_public_targets_are_rejected_without_writing_either_manifest
upstream = read_json("manifests/upstream.json")
matrix = read_json("manifests/image-matrix.json")
target = matrix.fetch("public_ci").find { |entry| entry.fetch("image") == upstream.fetch("image") }
duplicate = target.merge("id" => "#{target.fetch('id')}-duplicate")
matrix.fetch("public_ci") << duplicate
write_json("manifests/image-matrix.json", matrix)
before = watched_bytes
_output, error, status = capture_recorder(
upstream.fetch("release_tag"),
upstream.fetch("published_at"),
upstream.fetch("release_url"),
upstream.fetch("image").split("@").last
)
refute status.success?
assert_match(/must appear exactly once in public_ci; found 2/, error)
assert_equal before, watched_bytes
end
def test_missing_public_target_with_conflicting_generated_id_is_rejected_without_writing
upstream = read_json("manifests/upstream.json")
matrix = read_json("manifests/image-matrix.json")
image = upstream.fetch("image")
removed = matrix.fetch("public_ci").find { |target| target.fetch("image") == image }
matrix.fetch("public_ci").reject! { |target| target.fetch("image") == image }
matrix.fetch("public_ci") << removed.merge(
"id" => "upstream-#{upstream.fetch('version')}-#{image.split('sha256:').last}",
"image" => "ghcr.io/anomalyco/opencode@sha256:#{'e' * 64}"
)
write_json("manifests/image-matrix.json", matrix)
before = watched_bytes
_output, error, status = capture_recorder(
upstream.fetch("release_tag"),
upstream.fetch("published_at"),
upstream.fetch("release_url"),
image.split("@").last
)
refute status.success?
assert_match(/public_ci id .* is already used by another image/, error)
assert_equal before, watched_bytes
end
def test_same_tag_with_new_digest_records_a_distinct_pending_target_once
upstream = read_json("manifests/upstream.json")
replacement = "sha256:#{'f' * 64}"
arguments = [
upstream.fetch("release_tag"),
upstream.fetch("published_at"),
upstream.fetch("release_url"),
replacement
]
run_recorder!(*arguments)
changed_upstream = read_json("manifests/upstream.json")
matrix = read_json("manifests/image-matrix.json")
target = matrix.fetch("public_ci").last
assert_equal "ghcr.io/anomalyco/opencode@#{replacement}", changed_upstream.fetch("image")
expected_version = upstream.fetch("release_tag").delete_prefix("v")
assert_equal "upstream-#{expected_version}-#{'f' * 64}", target.fetch("id")
assert_equal "ghcr.io/anomalyco/opencode@#{replacement}", target.fetch("image")
assert_equal "pending", target.fetch("certification_status")
assert_equal "shared-client-contract-only", target.fetch("certification_scope")
assert_empty target.fetch("consumers")
assert_empty target.fetch("required_consumer_profiles")
after = watched_bytes
run_recorder!(*arguments)
assert_equal after, watched_bytes
end
def test_recorder_rejects_untrusted_release_metadata
upstream = read_json("manifests/upstream.json")
digest = upstream.fetch("image").split("@").last
refute recorder_status("branch-name", upstream.fetch("published_at"), upstream.fetch("release_url"), digest).success?
refute recorder_status(upstream.fetch("release_tag"), "yesterday", upstream.fetch("release_url"), digest).success?
refute recorder_status(upstream.fetch("release_tag"), upstream.fetch("published_at"), "https://example.test/release", digest).success?
refute recorder_status(upstream.fetch("release_tag"), upstream.fetch("published_at"), upstream.fetch("release_url"), "sha256:nope").success?
end
def test_branch_names_bind_the_full_tag_and_digest_and_support_retries
script = File.join(ROOT, "scripts/upstream_branch_name.rb")
digest = "sha256:#{'a' * 64}"
replacement = "sha256:#{'b' * 64}"
base = run_script!(script, "v1.18.3", digest).strip
changed = run_script!(script, "v1.18.3", replacement).strip
retry_branch = run_script!(script, "v1.18.3", digest, "123-2").strip
assert_equal "compat/upstream-1.18.3-#{'a' * 64}", base
refute_equal base, changed
assert_equal "#{base}-r123-2", retry_branch
refute run_status(script, "v1.18.3", digest, "bad/value").success?
end
def test_workflow_can_only_update_manifests_and_open_a_pr
workflow = File.read(File.join(ROOT, ".github/workflows/watch-upstream.yml"))
assert_includes workflow, "contents: write"
assert_includes workflow, "pull-requests: write"
assert_includes workflow, "git add manifests/image-matrix.json manifests/upstream.json"
assert_includes workflow, "gh pr create"
assert_includes workflow, "scripts/upstream_branch_name.rb"
assert_includes workflow, "git ls-remote --exit-code --heads"
assert_includes workflow, "--base main"
assert_includes workflow, ".baseRefName == \"main\""
assert_includes workflow, "isCrossRepository == false"
assert_includes workflow, "headRefOid"
assert_includes workflow, "application/vnd.github.raw+json"
assert_includes workflow, "current_image_count"
assert_includes workflow, '[.public_ci[]? | select(.image == $image)] | length'
assert_includes workflow, '[ "$current_image_count" -eq 1 ]'
assert_includes workflow, ".release_tag == $tag and .image == $image"
assert_includes workflow, "([.public_ci[]? | select(.image == $image)] | length) == 1"
content_check = workflow.index(".release_tag == $tag and .image == $image")
skip = workflow.index('echo "skip=true"')
assert_operator content_check, :<, skip
refute_match(/gh\s+pr\s+merge|repository_dispatch|workflow_dispatches|git\s+push\s+--force/i, workflow)
refute_match(/\b(kamal|kubectl|helm|nomad|docker\s+service)\b/i, workflow)
end
private
def run_recorder!(*arguments)
run_script!(File.join(@tmp, "scripts/record_upstream_candidate.rb"), *arguments)
end
def recorder_status(*arguments)
run_status(File.join(@tmp, "scripts/record_upstream_candidate.rb"), *arguments)
end
def capture_recorder(*arguments)
Open3.capture3(RUBY, File.join(@tmp, "scripts/record_upstream_candidate.rb"), *arguments)
end
def run_script!(script, *arguments)
output, error, status = Open3.capture3(RUBY, script, *arguments)
assert status.success?, error
output
end
def run_status(script, *arguments)
_output, _error, status = Open3.capture3(RUBY, script, *arguments)
status
end
def read_json(relative_path)
JSON.parse(File.read(File.join(@tmp, relative_path)))
end
def write_json(relative_path, value)
File.write(File.join(@tmp, relative_path), JSON.pretty_generate(value) + "\n")
end
def watched_bytes
%w[manifests/upstream.json manifests/image-matrix.json].map do |relative_path|
File.binread(File.join(@tmp, relative_path))
end
end
end