528 lines
19 KiB
Ruby
528 lines
19 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
require "fileutils"
|
|
require "json"
|
|
require "minitest/autorun"
|
|
require "tmpdir"
|
|
require_relative "../lib/opencode_compat/runtime_tuple_promoter"
|
|
|
|
class RuntimeTuplePromoterTest < Minitest::Test
|
|
CONSUMER = "example"
|
|
CURRENT_COMMIT = "1" * 40
|
|
CANDIDATE_COMMIT = "2" * 40
|
|
RUBY_CURRENT = "3" * 40
|
|
RUBY_CANDIDATE = "4" * 40
|
|
RAILS_CURRENT = "5" * 40
|
|
RAILS_CANDIDATE = "6" * 40
|
|
CURRENT_IMAGE = "ghcr.io/anomalyco/opencode@sha256:#{'a' * 64}"
|
|
CANDIDATE_IMAGE = "ghcr.io/anomalyco/opencode@sha256:#{'b' * 64}"
|
|
CURRENT_TIME = "2026-07-17T12:00:00Z"
|
|
CANDIDATE_TIME = "2026-07-18T12:00:00Z"
|
|
CANDIDATE_TREE = "7" * 40
|
|
|
|
def setup
|
|
@root = Dir.mktmpdir("opencode-compat-promotion")
|
|
FileUtils.mkdir_p(File.join(@root, "manifests"))
|
|
FileUtils.mkdir_p(File.join(@root, "evidence"))
|
|
FileUtils.mkdir_p(File.join(@root, "profiles"))
|
|
File.write(File.join(@root, "profiles", "rails-persisted-turn.json"), "{}\n")
|
|
write_post_merge_canary_evidence("post-merge-canary.json", CANDIDATE_COMMIT)
|
|
write_manifest(valid_manifest)
|
|
@promoter = OpenCodeCompat::RuntimeTuplePromoter.new(root: @root)
|
|
end
|
|
|
|
def teardown
|
|
FileUtils.remove_entry(@root)
|
|
end
|
|
|
|
def test_promotion_atomically_moves_certified_tuples_and_clears_candidate
|
|
candidate, previous = write_matching_evidence
|
|
|
|
promoted = @promoter.promote(
|
|
consumer: CONSUMER,
|
|
consumer_commit: CANDIDATE_COMMIT,
|
|
certification: certification(CANDIDATE_TIME, candidate),
|
|
previous_certification: certification(CURRENT_TIME, previous)
|
|
)
|
|
|
|
consumer = promoted.fetch("consumers").fetch(CONSUMER)
|
|
assert_nil consumer["candidate"]
|
|
assert_equal CANDIDATE_COMMIT, consumer.dig("current", "consumer_commit")
|
|
assert_equal RUBY_CANDIDATE, consumer.dig("current", "opencode_ruby", "git_commit")
|
|
assert_equal "certified", consumer.dig("current", "status")
|
|
assert_equal candidate.fetch("tuple_sha256"), consumer.dig("current", "certification", "tuple_sha256")
|
|
assert_equal CURRENT_COMMIT, consumer.dig("previous", "consumer_commit")
|
|
assert_equal RUBY_CURRENT, consumer.dig("previous", "opencode_ruby", "git_commit")
|
|
assert_equal "certified", consumer.dig("previous", "status")
|
|
assert_equal previous.fetch("tuple_sha256"), consumer.dig("previous", "certification", "tuple_sha256")
|
|
assert_equal "certified", promoted.fetch("migration_state")
|
|
assert_equal promoted, JSON.parse(File.read(manifest_path))
|
|
end
|
|
|
|
def test_dry_run_returns_promotion_without_changing_manifest
|
|
candidate, previous = write_matching_evidence
|
|
before = File.binread(manifest_path)
|
|
|
|
promoted = @promoter.promote(
|
|
consumer: CONSUMER,
|
|
consumer_commit: CANDIDATE_COMMIT,
|
|
certification: certification(CANDIDATE_TIME, candidate),
|
|
previous_certification: certification(CURRENT_TIME, previous),
|
|
dry_run: true
|
|
)
|
|
|
|
assert_equal "certified", promoted.dig("consumers", CONSUMER, "current", "status")
|
|
assert_equal before, File.binread(manifest_path)
|
|
end
|
|
|
|
def test_rejects_missing_candidate_without_touching_manifest
|
|
manifest = valid_manifest
|
|
manifest.fetch("consumers").fetch(CONSUMER)["candidate"] = nil
|
|
write_manifest(manifest)
|
|
before = File.binread(manifest_path)
|
|
|
|
error = assert_raises(OpenCodeCompat::PromotionError) do
|
|
@promoter.promote(
|
|
consumer: CONSUMER,
|
|
consumer_commit: CANDIDATE_COMMIT,
|
|
certification: certification(CANDIDATE_TIME, {"path" => "evidence/missing.json"})
|
|
)
|
|
end
|
|
|
|
assert_match(/no candidate/, error.message)
|
|
assert_equal before, File.binread(manifest_path)
|
|
end
|
|
|
|
def test_rejects_mutable_candidate_image_even_with_an_exact_image_id
|
|
manifest = valid_manifest
|
|
runtime = manifest.dig("consumers", CONSUMER, "candidate", "runtime")
|
|
runtime["registry_ref"] = "ghcr.io/anomalyco/opencode:latest"
|
|
runtime["docker_image_id"] = "sha256:#{'c' * 64}"
|
|
write_manifest(manifest)
|
|
before = File.binread(manifest_path)
|
|
|
|
error = assert_raises(OpenCodeCompat::PromotionError) do
|
|
@promoter.fingerprints(consumer: CONSUMER, consumer_commit: CANDIDATE_COMMIT)
|
|
end
|
|
|
|
assert_match(/immutable image@sha256 digest/, error.message)
|
|
assert_equal before, File.binread(manifest_path)
|
|
end
|
|
|
|
def test_rejects_short_consumer_and_client_commits
|
|
assert_raises(OpenCodeCompat::PromotionError) do
|
|
@promoter.fingerprints(consumer: CONSUMER, consumer_commit: "abc123")
|
|
end
|
|
|
|
manifest = valid_manifest
|
|
manifest.dig("consumers", CONSUMER, "candidate", "opencode_ruby")["git_commit"] = "abc123"
|
|
write_manifest(manifest)
|
|
error = assert_raises(OpenCodeCompat::PromotionError) do
|
|
@promoter.fingerprints(consumer: CONSUMER, consumer_commit: CANDIDATE_COMMIT)
|
|
end
|
|
assert_match(/full 40-character/, error.message)
|
|
end
|
|
|
|
def test_rejects_missing_server_version_or_unknown_profile
|
|
manifest = valid_manifest
|
|
manifest.dig("consumers", CONSUMER, "candidate", "runtime").delete("reported_version")
|
|
write_manifest(manifest)
|
|
error = assert_raises(OpenCodeCompat::PromotionError) do
|
|
@promoter.fingerprints(consumer: CONSUMER, consumer_commit: CANDIDATE_COMMIT)
|
|
end
|
|
assert_match(/reported OpenCode server version/, error.message)
|
|
|
|
manifest = valid_manifest
|
|
manifest.dig("consumers", CONSUMER)["profile"] = "untracked-profile"
|
|
write_manifest(manifest)
|
|
error = assert_raises(OpenCodeCompat::PromotionError) do
|
|
@promoter.fingerprints(consumer: CONSUMER, consumer_commit: CANDIDATE_COMMIT)
|
|
end
|
|
assert_match(/profile does not exist/, error.message)
|
|
end
|
|
|
|
def test_rejects_missing_previous_certification_for_an_uncertified_baseline
|
|
candidate, = write_matching_evidence
|
|
before = File.binread(manifest_path)
|
|
|
|
error = assert_raises(OpenCodeCompat::PromotionError) do
|
|
@promoter.promote(
|
|
consumer: CONSUMER,
|
|
consumer_commit: CANDIDATE_COMMIT,
|
|
certification: certification(CANDIDATE_TIME, candidate)
|
|
)
|
|
end
|
|
|
|
assert_match(/current tuple is not certified/, error.message)
|
|
assert_equal before, File.binread(manifest_path)
|
|
end
|
|
|
|
def test_rejects_known_failed_baseline_even_with_passing_evidence
|
|
manifest = valid_manifest
|
|
manifest.dig("consumers", CONSUMER, "current")["status"] = "observed-production-contract-failed"
|
|
write_manifest(manifest)
|
|
candidate, previous = write_matching_evidence
|
|
before = File.binread(manifest_path)
|
|
|
|
error = assert_raises(OpenCodeCompat::PromotionError) do
|
|
@promoter.promote(
|
|
consumer: CONSUMER,
|
|
consumer_commit: CANDIDATE_COMMIT,
|
|
certification: certification(CANDIDATE_TIME, candidate),
|
|
previous_certification: certification(CURRENT_TIME, previous)
|
|
)
|
|
end
|
|
|
|
assert_match(/known to fail/, error.message)
|
|
assert_equal before, File.binread(manifest_path)
|
|
end
|
|
|
|
def test_rejects_pre_merge_pull_request_evidence_as_candidate_only
|
|
manifest = valid_manifest
|
|
candidate = manifest.dig("consumers", CONSUMER, "candidate")
|
|
candidate["certification_scope"] = "pre-merge-pr-head-candidate-only"
|
|
candidate["promotion_eligible"] = false
|
|
candidate["consumer_ref"] = {
|
|
"kind" => "pull-request-head",
|
|
"repository" => "example/consumer",
|
|
"commit" => CANDIDATE_COMMIT,
|
|
"tree" => CANDIDATE_TREE,
|
|
"base_commit" => CURRENT_COMMIT,
|
|
"review_url" => "https://example.test/pulls/1"
|
|
}
|
|
candidate.delete("promotion_provenance")
|
|
write_manifest(manifest)
|
|
candidate_evidence, previous_evidence = write_matching_evidence
|
|
|
|
error = assert_raises(OpenCodeCompat::PromotionError) do
|
|
@promoter.promote(
|
|
consumer: CONSUMER,
|
|
consumer_commit: CANDIDATE_COMMIT,
|
|
certification: certification(CANDIDATE_TIME, candidate_evidence),
|
|
previous_certification: certification(CURRENT_TIME, previous_evidence),
|
|
dry_run: true
|
|
)
|
|
end
|
|
|
|
assert_match(/pre-merge pull-request evidence is candidate-only/, error.message)
|
|
end
|
|
|
|
def test_accepts_explicit_identical_tree_attestation_with_post_merge_canary
|
|
manifest = valid_manifest
|
|
candidate = manifest.dig("consumers", CONSUMER, "candidate")
|
|
candidate["consumer_ref"] = {
|
|
"kind" => "pull-request-head",
|
|
"repository" => "example/consumer",
|
|
"commit" => CANDIDATE_COMMIT,
|
|
"tree" => CANDIDATE_TREE,
|
|
"base_commit" => CURRENT_COMMIT,
|
|
"review_url" => "https://example.test/pulls/1"
|
|
}
|
|
main_commit = "8" * 40
|
|
write_post_merge_canary_evidence("post-merge-attested-canary.json", main_commit)
|
|
candidate["promotion_provenance"] = {
|
|
"kind" => "identical-tree-attestation",
|
|
"pull_request_commit" => CANDIDATE_COMMIT,
|
|
"pull_request_tree" => CANDIDATE_TREE,
|
|
"main_commit" => main_commit,
|
|
"main_tree" => CANDIDATE_TREE,
|
|
"attested_at" => CANDIDATE_TIME,
|
|
"post_merge_canary" => {
|
|
"status" => "pass",
|
|
"checked_at" => CANDIDATE_TIME,
|
|
"evidence" => ["evidence/post-merge-attested-canary.json"]
|
|
}
|
|
}
|
|
write_manifest(manifest)
|
|
candidate_evidence, previous_evidence = write_matching_evidence
|
|
|
|
promoted = @promoter.promote(
|
|
consumer: CONSUMER,
|
|
consumer_commit: CANDIDATE_COMMIT,
|
|
certification: certification(CANDIDATE_TIME, candidate_evidence),
|
|
previous_certification: certification(CURRENT_TIME, previous_evidence),
|
|
dry_run: true
|
|
)
|
|
|
|
assert_equal "certified", promoted.dig("consumers", CONSUMER, "current", "status")
|
|
end
|
|
|
|
def test_main_commit_promotion_still_requires_a_post_merge_canary
|
|
manifest = valid_manifest
|
|
manifest.dig("consumers", CONSUMER, "candidate", "promotion_provenance").delete("post_merge_canary")
|
|
write_manifest(manifest)
|
|
|
|
error = assert_raises(OpenCodeCompat::PromotionError) do
|
|
@promoter.promote(
|
|
consumer: CONSUMER,
|
|
consumer_commit: CANDIDATE_COMMIT,
|
|
certification: {},
|
|
dry_run: true
|
|
)
|
|
end
|
|
|
|
assert_match(/passing post-merge canary/, error.message)
|
|
end
|
|
|
|
def test_rejects_candidate_without_loaded_exact_ref_source_proof
|
|
manifest = valid_manifest
|
|
manifest.dig("consumers", CONSUMER, "candidate", "opencode_ruby").delete("source")
|
|
write_manifest(manifest)
|
|
|
|
error = assert_raises(OpenCodeCompat::PromotionError) do
|
|
@promoter.fingerprints(consumer: CONSUMER, consumer_commit: CANDIDATE_COMMIT)
|
|
end
|
|
|
|
assert_match(/loaded exact-ref source proof/, error.message)
|
|
end
|
|
|
|
def test_explicit_degraded_bootstrap_certifies_current_without_faking_previous
|
|
manifest = valid_manifest
|
|
failed = manifest.dig("consumers", CONSUMER, "current")
|
|
failed["status"] = "observed-production-contract-failed"
|
|
write_manifest(manifest)
|
|
fingerprint = @promoter.fingerprints(
|
|
consumer: CONSUMER,
|
|
consumer_commit: CANDIDATE_COMMIT
|
|
).fetch("candidate_tuple_sha256")
|
|
evidence = write_evidence(
|
|
"bootstrap-candidate.json",
|
|
commit: CANDIDATE_COMMIT,
|
|
timestamp: CANDIDATE_TIME,
|
|
fingerprint: fingerprint
|
|
)
|
|
|
|
bootstrapped = @promoter.bootstrap_current(
|
|
consumer: CONSUMER,
|
|
consumer_commit: CANDIDATE_COMMIT,
|
|
certification: certification(CANDIDATE_TIME, evidence),
|
|
acknowledgement: OpenCodeCompat::RuntimeTuplePromoter::DEGRADED_BOOTSTRAP_ACKNOWLEDGEMENT,
|
|
dry_run: true
|
|
)
|
|
|
|
consumer = bootstrapped.dig("consumers", CONSUMER)
|
|
assert_equal "certified", consumer.dig("current", "status")
|
|
assert_equal CANDIDATE_COMMIT, consumer.dig("current", "consumer_commit")
|
|
assert_nil consumer["candidate"]
|
|
assert_nil consumer["previous"]
|
|
assert_equal "observed-production-contract-failed", consumer.dig("emergency_provenance", "status")
|
|
assert_nil consumer.dig("emergency_provenance", "certification")
|
|
assert_equal "degraded-no-certified-previous", consumer.dig("rollback_state", "status")
|
|
assert_equal "bootstrap-current-only", bootstrapped.fetch("migration_state")
|
|
end
|
|
|
|
def test_degraded_bootstrap_requires_exact_explicit_acknowledgement
|
|
error = assert_raises(OpenCodeCompat::PromotionError) do
|
|
@promoter.bootstrap_current(
|
|
consumer: CONSUMER,
|
|
consumer_commit: CANDIDATE_COMMIT,
|
|
certification: {},
|
|
acknowledgement: "yes",
|
|
dry_run: true
|
|
)
|
|
end
|
|
|
|
assert_match(/explicit acknowledgement/, error.message)
|
|
end
|
|
|
|
def test_rejects_evidence_that_does_not_match_the_complete_tuple
|
|
candidate, previous = write_matching_evidence
|
|
manifest = JSON.parse(File.read(manifest_path))
|
|
manifest.dig("consumers", CONSUMER, "candidate", "runtime")["image"] =
|
|
"ghcr.io/anomalyco/opencode@sha256:#{'f' * 64}"
|
|
write_manifest(manifest)
|
|
before = File.binread(manifest_path)
|
|
|
|
error = assert_raises(OpenCodeCompat::PromotionError) do
|
|
@promoter.promote(
|
|
consumer: CONSUMER,
|
|
consumer_commit: CANDIDATE_COMMIT,
|
|
certification: certification(CANDIDATE_TIME, candidate),
|
|
previous_certification: certification(CURRENT_TIME, previous)
|
|
)
|
|
end
|
|
|
|
assert_match(/tuple_sha256/, error.message)
|
|
assert_equal before, File.binread(manifest_path)
|
|
end
|
|
|
|
def test_rejects_non_passing_or_implicit_certification_metadata
|
|
candidate, previous = write_matching_evidence
|
|
|
|
assert_raises(OpenCodeCompat::PromotionError) do
|
|
@promoter.promote(
|
|
consumer: CONSUMER,
|
|
consumer_commit: CANDIDATE_COMMIT,
|
|
certification: certification(CANDIDATE_TIME, candidate).merge("status" => "pending"),
|
|
previous_certification: certification(CURRENT_TIME, previous),
|
|
dry_run: true
|
|
)
|
|
end
|
|
|
|
assert_raises(OpenCodeCompat::PromotionError) do
|
|
@promoter.promote(
|
|
consumer: CONSUMER,
|
|
consumer_commit: CANDIDATE_COMMIT,
|
|
certification: certification("today", candidate),
|
|
previous_certification: certification(CURRENT_TIME, previous),
|
|
dry_run: true
|
|
)
|
|
end
|
|
end
|
|
|
|
def test_rejects_duplicate_or_unversioned_evidence
|
|
candidate, previous = write_matching_evidence
|
|
|
|
assert_raises(OpenCodeCompat::PromotionError) do
|
|
@promoter.promote(
|
|
consumer: CONSUMER,
|
|
consumer_commit: CANDIDATE_COMMIT,
|
|
certification: certification(CANDIDATE_TIME, candidate).merge(
|
|
"evidence" => [candidate.fetch("path"), candidate.fetch("path")]
|
|
),
|
|
previous_certification: certification(CURRENT_TIME, previous),
|
|
dry_run: true
|
|
)
|
|
end
|
|
|
|
path = File.join(@root, candidate.fetch("path"))
|
|
document = JSON.parse(File.read(path))
|
|
document.delete("schema_version")
|
|
File.write(path, JSON.pretty_generate(document) + "\n")
|
|
assert_raises(OpenCodeCompat::PromotionError) do
|
|
@promoter.promote(
|
|
consumer: CONSUMER,
|
|
consumer_commit: CANDIDATE_COMMIT,
|
|
certification: certification(CANDIDATE_TIME, candidate),
|
|
previous_certification: certification(CURRENT_TIME, previous),
|
|
dry_run: true
|
|
)
|
|
end
|
|
end
|
|
|
|
private
|
|
|
|
def valid_manifest
|
|
{
|
|
"schema_version" => 2,
|
|
"migration_state" => "candidate",
|
|
"consumers" => {
|
|
CONSUMER => {
|
|
"profile" => "rails-persisted-turn",
|
|
"current" => {
|
|
"status" => "observed-production",
|
|
"consumer_commit" => CURRENT_COMMIT,
|
|
"opencode_ruby" => {"version" => "0.0.1.alpha2", "git_commit" => RUBY_CURRENT},
|
|
"opencode_rails" => {"version" => "0.0.1.alpha2", "git_commit" => RAILS_CURRENT},
|
|
"runtime" => {"image" => CURRENT_IMAGE, "reported_version" => "1.16.1"}
|
|
},
|
|
"candidate" => {
|
|
"status" => "compatibility-certified",
|
|
"certified_at" => "2026-07-18T10:00:00Z",
|
|
"certification_scope" => "promotion-deployed",
|
|
"promotion_eligible" => true,
|
|
"consumer_ref" => {
|
|
"kind" => "main-commit",
|
|
"repository" => "example/consumer",
|
|
"commit" => CANDIDATE_COMMIT,
|
|
"tree" => CANDIDATE_TREE
|
|
},
|
|
"promotion_provenance" => {
|
|
"kind" => "main-commit",
|
|
"main_commit" => CANDIDATE_COMMIT,
|
|
"post_merge_canary" => {
|
|
"status" => "pass",
|
|
"checked_at" => CANDIDATE_TIME,
|
|
"evidence" => ["evidence/post-merge-canary.json"]
|
|
}
|
|
},
|
|
"opencode_ruby" => client("0.0.1.alpha7", RUBY_CANDIDATE),
|
|
"opencode_rails" => client("0.0.1.alpha7", RAILS_CANDIDATE),
|
|
"runtime" => {"image" => CANDIDATE_IMAGE, "reported_version" => "1.18.3"}
|
|
},
|
|
"previous" => nil
|
|
}
|
|
}
|
|
}
|
|
end
|
|
|
|
def client(version, commit)
|
|
{
|
|
"version" => version,
|
|
"git_commit" => commit,
|
|
"source" => {
|
|
"type" => "git",
|
|
"uri" => "https://example.test/client.git",
|
|
"requested_ref" => commit,
|
|
"locked_revision" => commit,
|
|
"loaded_source_proof" => {
|
|
"status" => "pass",
|
|
"source_class" => "Bundler::Source::Git",
|
|
"loaded_version" => version,
|
|
"observed_ref" => commit,
|
|
"observed_revision" => commit,
|
|
"test" => "test/dependency_provenance_test.rb"
|
|
}
|
|
}
|
|
}
|
|
end
|
|
|
|
def write_matching_evidence
|
|
fingerprints = @promoter.fingerprints(consumer: CONSUMER, consumer_commit: CANDIDATE_COMMIT)
|
|
candidate = write_evidence(
|
|
"candidate.json",
|
|
commit: CANDIDATE_COMMIT,
|
|
timestamp: CANDIDATE_TIME,
|
|
fingerprint: fingerprints.fetch("candidate_tuple_sha256")
|
|
)
|
|
previous = write_evidence(
|
|
"previous.json",
|
|
commit: CURRENT_COMMIT,
|
|
timestamp: CURRENT_TIME,
|
|
fingerprint: fingerprints.fetch("current_tuple_sha256")
|
|
)
|
|
[candidate, previous]
|
|
end
|
|
|
|
def write_evidence(name, commit:, timestamp:, fingerprint:)
|
|
path = File.join("evidence", name)
|
|
document = {
|
|
"schema_version" => 1,
|
|
"consumer" => CONSUMER,
|
|
"profile" => "rails-persisted-turn",
|
|
"consumer_commit" => commit,
|
|
"status" => "pass",
|
|
"certified_at" => timestamp,
|
|
"tuple_sha256" => fingerprint
|
|
}
|
|
File.write(File.join(@root, path), JSON.pretty_generate(document) + "\n")
|
|
{"path" => path, "tuple_sha256" => fingerprint}
|
|
end
|
|
|
|
def write_post_merge_canary_evidence(name, commit)
|
|
document = {
|
|
"schema_version" => 1,
|
|
"status" => "pass",
|
|
"checked_at" => CANDIDATE_TIME,
|
|
"consumer_commit" => commit
|
|
}
|
|
File.write(File.join(@root, "evidence", name), JSON.pretty_generate(document) + "\n")
|
|
end
|
|
|
|
def certification(timestamp, evidence)
|
|
{
|
|
"status" => "pass",
|
|
"certified_at" => timestamp,
|
|
"evidence" => [evidence.fetch("path")]
|
|
}
|
|
end
|
|
|
|
def manifest_path
|
|
File.join(@root, "manifests", "runtime-tuples.json")
|
|
end
|
|
|
|
def write_manifest(manifest)
|
|
File.write(manifest_path, JSON.pretty_generate(manifest) + "\n")
|
|
end
|
|
end
|