diff --git a/bin/fm-backend.sh b/bin/fm-backend.sh index f4fdde29436..798bb5c599a 100644 --- a/bin/fm-backend.sh +++ b/bin/fm-backend.sh @@ -622,34 +622,35 @@ fm_backend_source_readable() { # } fm_backend_source() { # - local name=$1 adapter rel path siblings + local name=$1 adapter rel sibling fm_backend_validate "$name" || return 1 adapter="$FM_BACKEND_LIB_DIR/backends/$name.sh" + # The sibling list rides in the positional parameters: zsh does not + # word-split an unquoted expansion, so a space-separated string is one path. case "$name" in tmux) - siblings="fm-tmux-lib.sh fm-composer-lib.sh fm-cursor-lib.sh fm-session-lock-lib.sh fm-agent-process-lib.sh fm-gemini-lib.sh" + set -- fm-tmux-lib.sh fm-composer-lib.sh fm-cursor-lib.sh fm-session-lock-lib.sh fm-agent-process-lib.sh fm-gemini-lib.sh ;; herdr) - siblings="fm-composer-lib.sh fm-transition-lib.sh fm-agent-process-lib.sh fm-session-lock-lib.sh fm-gemini-lib.sh" + set -- fm-composer-lib.sh fm-transition-lib.sh fm-agent-process-lib.sh fm-session-lock-lib.sh fm-gemini-lib.sh ;; zellij) - siblings="fm-backend-hometag-lib.sh fm-composer-lib.sh" + set -- fm-backend-hometag-lib.sh fm-composer-lib.sh ;; orca) - siblings="fm-composer-lib.sh" + set -- fm-composer-lib.sh ;; cmux) - siblings="fm-backend-hometag-lib.sh fm-composer-lib.sh" + set -- fm-backend-hometag-lib.sh fm-composer-lib.sh ;; *) return 1 ;; esac fm_backend_source_readable "$adapter" || return 1 - # shellcheck disable=SC2086 # sibling names are a fixed space-separated list - for rel in $siblings; do - path="$FM_BACKEND_LIB_DIR/$rel" - fm_backend_source_readable "$path" || return 1 + for rel in "$@"; do + sibling="$FM_BACKEND_LIB_DIR/$rel" + fm_backend_source_readable "$sibling" || return 1 done case "$name" in tmux) diff --git a/bin/fm-classify-lib.sh b/bin/fm-classify-lib.sh index 11cc7f24cfb..7482e5a9df6 100755 --- a/bin/fm-classify-lib.sh +++ b/bin/fm-classify-lib.sh @@ -1057,6 +1057,28 @@ EOF printf '%s' "$verb" } +# The status file inside that is this home's outbound parent channel +# rather than a self-home task status log, printed; empty when there is none. +# Only a remote mate home resolves one - its state/parent-replies.status is the +# parent channel (bin/fm-parent-channel-lib.sh owns that resolution, sourced +# lazily here because that library sources this one at its top level, so a +# top-level source would be circular). A main home, a local mate - whose +# channel lives in the parent home - or an unusable identity or binding keeps +# every file, so ordinary task logs fold and wake exactly as before. The home +# is the directory containing , the /state layout every caller of +# these fleet-wide scans shares; a state dir outside such a home excludes +# nothing. Callers compare the resolved path, never the file name, so a +# parent-replies.status in any other home shape stays an ordinary task log. +status_scan_parent_channel_exclude() { # + local state=$1 exclude + if ! command -v fm_parent_channel_outbound_status >/dev/null 2>&1; then + # shellcheck source=bin/fm-parent-channel-lib.sh + . "$_FM_CLASSIFY_LIB_DIR/fm-parent-channel-lib.sh" + fi + exclude=$(fm_parent_channel_outbound_status "$(dirname "$state")" "$state") || return 0 + printf '%s\n' "$exclude" +} + # Fleet-wide wrapper around status_open_decisions: scans every task's status # log under and prefixes each still-open decision with its owning task # id, so a per-wake or per-session surface can print the consolidated open set @@ -1065,9 +1087,11 @@ EOF # one "\t\t\t" line per open decision, in glob (task id) # order; prints nothing when none are open. scan_open_decisions() { # - local state=$1 f task open line + local state=$1 f task open line exclude + exclude=$(status_scan_parent_channel_exclude "$state") for f in "$state"/*.status; do [ -e "$f" ] || continue + [ "$f" = "$exclude" ] && continue task=$(basename "$f"); task="${task%.status}" open=$(status_open_decisions "$f") || continue [ -n "$open" ] || continue @@ -1358,9 +1382,11 @@ status_open_decisions_incremental() { # [] # the whole-file status_open_decisions, so a fleet-wide per-drain scan stays # bounded by new appends rather than total lifetime log size across every task. scan_open_decisions_incremental() { # - local state=$1 f task open line + local state=$1 f task open line exclude + exclude=$(status_scan_parent_channel_exclude "$state") for f in "$state"/*.status; do [ -e "$f" ] || continue + [ "$f" = "$exclude" ] && continue task=$(basename "$f"); task="${task%.status}" open=$(status_open_decisions_incremental "$f") || continue [ -n "$open" ] || continue @@ -1375,9 +1401,11 @@ EOF } status_presentation_snapshot() { # - local state=$1 f task size ident + local state=$1 f task size ident exclude + exclude=$(status_scan_parent_channel_exclude "$state") for f in "$state"/*.status; do [ -e "$f" ] || continue + [ "$f" = "$exclude" ] && continue [ -f "$f" ] && [ -r "$f" ] && [ ! -L "$f" ] || continue task=$(basename "$f"); task="${task%.status}" size=$(_fm_status_file_size "$f") || return 1 @@ -1989,9 +2017,11 @@ status_line_is_unread_surface() { # # Prints nothing when none are unread. Directory scan rejects status symlinks # the same way scan_open_decisions does. scan_unread_surface_lines() { # - local state=$1 f task lines line + local state=$1 f task lines line exclude + exclude=$(status_scan_parent_channel_exclude "$state") for f in "$state"/*.status; do [ -e "$f" ] || continue + [ "$f" = "$exclude" ] && continue task=$(basename "$f"); task="${task%.status}" lines=$(status_new_lines_since_cursor "$f") || return 1 [ -n "$lines" ] || continue diff --git a/bin/fm-contributions.sh b/bin/fm-contributions.sh index 4e27e33e8a1..12bfc5fffcf 100755 --- a/bin/fm-contributions.sh +++ b/bin/fm-contributions.sh @@ -5,7 +5,7 @@ # fm-contributions.sh snapshot [--all] # fm-contributions.sh poll # fm-contributions.sh pending -# fm-contributions.sh verdict +# fm-contributions.sh verdict # fm-contributions.sh ack # fm-contributions.sh arm [--if-owned] # @@ -23,9 +23,10 @@ # checks/reviews). Checks are normalized by name, id, started_at, status and # conclusion; projection picks the newest attempt per distinct name. The last # observation's lane names also disclose a lane absent from the next head. -# A verdict records the EXACT judged head, source URL, actor and summary. A -# comment's arrival time never supplies its judged head. Record a prose verdict -# only after its source identifies that head; otherwise leave it unbound and +# A verdict records the EXACT judged head, source URL, actor and summary. The +# actor is exactly one of captain, fleet, maintainer or nobody; any other value +# is refused. A comment's arrival time never supplies its judged head. Record a +# prose verdict only after its source identifies that head; otherwise leave it unbound and # triage its signal. Formal reviews carry GitHub's own commit_id. Neither kind # can grant merge authority. Captain-actor prose requires an existing live hold; # an eligible merge remains a captain call, never an automatic forge action. @@ -473,7 +474,7 @@ case "${1:-}" in else [ "$#" -eq 4 ] || fail 'verdict needs judged-head, source-url, actor and summary' fm_pr_head_valid "$1" || fail 'an exact judged commit is required' - case "$3" in captain|fleet|maintainer|nobody) ;; *) fail 'invalid required actor' ;; esac + case "$3" in captain|fleet|maintainer|nobody) ;; *) fail "invalid required actor '$3'; expected one of: captain, fleet, maintainer, nobody" ;; esac case "$2" in "$url"\#*) ;; *) fail 'verdict source must be a comment or review on this contribution' ;; esac jq --arg head "$1" --arg source "$2" --arg actor "$3" --arg summary "$4" \ '.verdict={head:$head,source:$source,actor:$actor,summary:$summary}' "$TMP/row.json" > "$TMP/update.json" diff --git a/bin/fm-fleet-sync.sh b/bin/fm-fleet-sync.sh index f8cc3054591..91b76f78555 100755 --- a/bin/fm-fleet-sync.sh +++ b/bin/fm-fleet-sync.sh @@ -319,10 +319,12 @@ sync_project() { echo "$label: skipped: not a git repo" return 0 fi - # Both sides are physical paths (git resolves --show-toplevel through symlinks), - # so a symlinked clone dir still compares equal to its own root. + # Compare filesystem identity, not spelling: the question is whether git's root + # and $PROJ are the same directory, and a string compare of the two paths also + # fails when they merely differ in case (case-insensitive volume) or in how a + # symlink is spelled. proj_abs=$(cd "$PROJ" && pwd -P) || proj_abs="" - if [ "$proj_top" != "$proj_abs" ]; then + if [ -z "$proj_abs" ] || ! [ "$proj_top" -ef "$proj_abs" ]; then echo "$label: skipped: not a clone root (git would act on $proj_top)" return 0 fi diff --git a/bin/fm-parent-channel-lib.sh b/bin/fm-parent-channel-lib.sh index 24718258317..160d580ac02 100644 --- a/bin/fm-parent-channel-lib.sh +++ b/bin/fm-parent-channel-lib.sh @@ -123,6 +123,28 @@ fm_parent_channel_destination() { # esac } +# The outbound parent-channel status path that lives INSIDE , printed, +# when is a remote mate; non-zero for a main home, a local mate, or an +# unusable identity or binding. Only the remote route resolves the channel into +# the mate's own state dir, so parent-replies.status there is the mate's parent +# channel rather than a self-home task status file: a home's own status scans +# and decision folds exclude exactly this resolved path (the same special case +# fm-pending-reply-lib.sh's wrong-home detection applies). A local mate's +# channel lives in the parent home's state/.status, which the parent's +# scans must keep classifying, so only the remote route resolves here. +fm_parent_channel_outbound_status() { # + local home=$1 state=$2 destination rc=0 + destination=$(fm_parent_channel_destination "$home" "$state") || rc=$? + [ "$rc" -eq 0 ] || return 1 + # The substitution above ran the resolver in a subshell, so its route global + # died with it; resolve once more in this shell (stdout discarded, the same + # shape fm-pending-reply-lib.sh's wrong-home detection uses) so the route + # check reads the resolver's own verdict rather than re-deriving it. + fm_parent_channel_destination "$home" "$state" >/dev/null || return 1 + [ "$FM_PARENT_CHANNEL_ROUTE" = remote ] || return 1 + printf '%s\n' "$destination" +} + # Fold onto one bounded line, so a note copied from a child ledger or a # hold reason cannot break the channel's line framing. fm_parent_channel_clean_note() { # diff --git a/bin/fm-supervise-daemon.sh b/bin/fm-supervise-daemon.sh index 7a7191807df..a2a7664f4fb 100755 --- a/bin/fm-supervise-daemon.sh +++ b/bin/fm-supervise-daemon.sh @@ -65,9 +65,10 @@ # undelivered past FM_MAX_DEFER_SECS, the daemon retries a normal flush and # writes state/.subsuper-inject-wedged and attempts a configurable active # alert if submit still cannot be confirmed. -# - Cheap heartbeat catch-all: every HEARTBEAT_SCAN_SECS the daemon greps all -# state/*.status for a captain-relevant line the per-wake classifier might -# have missed (e.g. a status verb outside CAPTAIN_RE) and escalates it. +# - Cheap heartbeat catch-all: every HEARTBEAT_SCAN_SECS the daemon greps the +# state dir's task status logs for a captain-relevant line the per-wake +# classifier might have missed (e.g. a status verb outside CAPTAIN_RE) and +# escalates it. # # The robustness shell from the prior always-inject version is preserved: # single-instance lock (portable helper, no flock dependency), crash-loop @@ -1184,8 +1185,8 @@ _oldest_line_age() { # -> seconds since the oldest buffered item first ar # re-peek; gone -> clear; still declaring the wait, on an idle OR a busy pane # -> escalate a recheck digest naming which human the wait is on, and reset # the window (repeating bounded re-surface, never a wedge). -# 3) heartbeat scan: every HEARTBEAT_SCAN_SECS, grep state/*.status for a -# captain-relevant line the per-wake classifier missed and escalate it. +# 3) heartbeat scan: every HEARTBEAT_SCAN_SECS, run the catch-all status scan in +# the block below and escalate what it finds; that block owns its file set. housekeeping() { # local state=$1 now due f key task win marker age last max_defer oldest pause_secs marker_epoch until bounded_until pause_reason now=$(_now) @@ -1339,11 +1340,17 @@ housekeeping() { # # because the event this backstop most needs to catch is precisely one a # later routine append has already moved past; fm-classify-lib.sh's span # read decides relevance, and the classified-through offset is the dedup. + # A remote mate's own parent channel is not a self-home task status log, + # so it is excluded here exactly as in the watcher's twin backstop + # (fm-watch.sh heartbeat_scan_finds_actionable); the home-shape-aware + # resolution lives in status_scan_parent_channel_exclude. if [ "$(_file_age "$state/.subsuper-last-scan")" -ge "${FM_HEARTBEAT_SCAN_SECS:-$HEARTBEAT_SCAN_SECS_DEFAULT}" ]; then _now > "$state/.subsuper-last-scan" - local event record rest endpoint ident rc + local event record rest endpoint ident rc exclude + exclude=$(status_scan_parent_channel_exclude "$state") for f in "$state"/*.status; do [ -e "$f" ] || [ -L "$f" ] || continue + [ "$f" = "$exclude" ] && continue task=$(basename "$f"); task="${task%.status}" record=$(status_span_first_actionable_record "$f" \ "$(status_seen_offset "$state" "$task")") diff --git a/bin/fm-test-run.sh b/bin/fm-test-run.sh index dfff544fbdf..4702f403f7f 100755 --- a/bin/fm-test-run.sh +++ b/bin/fm-test-run.sh @@ -309,6 +309,7 @@ family_for_basename() { ;; fm-daemon.test.sh|fm-guard-stale-banner.test.sh|fm-pi-watch-extension.test.sh|\ fm-session-lock-ancestry.test.sh|fm-cursor-primary.test.sh|\ + fm-parent-channel-scan-exclusion.test.sh|\ fm-supervision-events.test.sh|fm-turnend-guard.test.sh|fm-wake-daemon-lifecycle-e2e.test.sh|\ fm-wake-drain-unread-status.test.sh|\ fm-tool-update-check.test.sh|\ diff --git a/bin/fm-watch.sh b/bin/fm-watch.sh index 35c5a9f1b75..6e51f76770a 100755 --- a/bin/fm-watch.sh +++ b/bin/fm-watch.sh @@ -1990,8 +1990,13 @@ age_of() { # seconds since file mtime; "due immediately" if missing # The caller records reported state only after surfacing or intentional absorption, # and commits a status classification position only after a successful span read. scan_signals() { - local f sig sf + local f sig sf exclude + # A remote mate's own parent channel is not a self-home task status log; the + # home-shape-aware exclusion and its precedent live in + # status_scan_parent_channel_exclude (fm-classify-lib.sh). + exclude=$(status_scan_parent_channel_exclude "$STATE") for f in "$STATE"/*.status "$STATE"/*.turn-ended; do + [ "$f" = "$exclude" ] && continue if [ ! -e "$f" ]; then case "$f" in *.status) [ -L "$f" ] || continue ;; *) continue ;; esac fi @@ -2255,10 +2260,14 @@ EOF # is absorbed; it surfaces only an event the per-wake path absorbed by mistake - # the fail-safe backstop. heartbeat_scan_finds_actionable() { - local f task record rest endpoint ident rc found=1 sig marker + local f task record rest endpoint ident rc found=1 sig marker exclude + # Same self-home exclusion as scan_signals: a remote mate's parent channel + # must not come back through the heartbeat fail-safe backstop. + exclude=$(status_scan_parent_channel_exclude "$STATE") FM_HEARTBEAT_SURFACE_ENDPOINTS='' for f in "$STATE"/*.status; do [ -e "$f" ] || [ -L "$f" ] || continue + [ "$f" = "$exclude" ] && continue task=$(basename "$f"); task="${task%.status}" record=$(status_span_first_actionable_record "$f" "$(hb_surfaced_offset "$task")") rc=$? diff --git a/docs/secondmate-parent-channel.md b/docs/secondmate-parent-channel.md index a15a163107c..614a26fca83 100644 --- a/docs/secondmate-parent-channel.md +++ b/docs/secondmate-parent-channel.md @@ -38,6 +38,8 @@ A duplicate line is harmless and a missed one is not, so the mate may still appe For marked replies, the report helper accepts no caller-selected destination and uses the channel resolver for both local and remote homes; its script header owns the exact invocation contract. The pending-reply guard may restate only the correlated line from a local mate's `state/.status` onto the parent channel, which repairs the common parent-home versus mate-home mixup without accepting arbitrary mate-home sightings as acknowledgement. Other correlated mate-home status lines remain wrong-home evidence, while a remote home's routed `state/parent-replies.status` is already the parent channel and is not classified as wrong-home. +The mate home's own status scans treat that remote channel the same way: `status_scan_parent_channel_exclude` in `bin/fm-classify-lib.sh` resolves the outbound path through the same `bin/fm-parent-channel-lib.sh` binding, and the watcher's signal scan and heartbeat backstop, the away-mode daemon's catch-all scan, and the fleet-wide folds skip exactly that resolved path, never a file name. +The remote reply adapter already mirrors every channel line into the parent home, so folding the channel again here would only spin spurious wakes and a phantom `parent-replies` task, while a `parent-replies.status` in a main home or in a local mate is an ordinary task log that keeps folding and waking. A missed-reply escalation includes the complete first sighting path and line number in readable shell-escaped form. ## What is deliberately not built @@ -55,6 +57,7 @@ A missed-reply escalation includes the complete first sighting path and line num `tests/fm-teardown.test.sh` covers teardown delivering a child's final line and refusing when the channel cannot be written. `tests/fm-brief.test.sh` pins the charter's channel rule. `tests/fm-pending-reply.test.sh` covers helper-selected local routing, remote-channel classification, same-basename restatement before false escalation, readable wrong-home diagnostics, and the rule that arbitrary mate-home sightings never acknowledge a reply. +`tests/fm-parent-channel-scan-exclusion.test.sh` covers the home-shape-aware scan exclusion against real remote, main-home, and local-mate fixtures: the watcher signal scan, both heartbeat backstops, the fleet-wide folds, and the real `fm-wake-drain.sh` end to end. ## Live verification diff --git a/tests/fm-backend.test.sh b/tests/fm-backend.test.sh index 96d00b10303..a9030018d8c 100755 --- a/tests/fm-backend.test.sh +++ b/tests/fm-backend.test.sh @@ -502,17 +502,32 @@ test_backend_validate_refuses_unknown() { } test_backend_source_shell_portable() { - local out status + local out status stub probe # zsh does not word-split unquoted expansions; sourcing fm-backend.sh from # an interactive zsh session must still recognize known backend names. + # The claim is name matching and the sibling precheck only: the adapters + # find their own siblings through BASH_SOURCE, so zsh is not a full load. if command -v zsh >/dev/null 2>&1; then - zsh -c "cd '$ROOT' && source bin/fm-backend.sh && fm_backend_source herdr && whence -w fm_backend_herdr_capture >/dev/null" 2>/dev/null \ - || fail "zsh: fm_backend_source herdr should load the adapter when sourced" + zsh -c "cd '$ROOT' && source bin/fm-backend.sh && fm_backend_source herdr" >/dev/null 2>&1 \ + || fail "zsh: fm_backend_source herdr should accept the known backend name and find its sibling libraries" out=$(zsh -c "cd '$ROOT' && source bin/fm-backend.sh && fm_backend_source bogus" 2>&1) \ && fail "zsh: fm_backend_source bogus should fail" assert_contains "$out" "unknown backend 'bogus'" \ "zsh: fm_backend_source did not reject bogus with the expected error" pass "zsh: fm_backend_source recognizes known backends and rejects unknown ones" + + # zsh ties the lowercase `path` array to PATH; a backend loaded while + # fm_backend_source clobbers PATH cannot resolve external commands. + stub="$TMP_ROOT/zsh-source-path" + probe="$stub/probe" + mkdir -p "$stub/backends" + printf 'command -v dirname > "%s"\n' "$probe" > "$stub/backends/orca.sh" + : > "$stub/fm-composer-lib.sh" + zsh -c "cd '$ROOT' && source bin/fm-backend.sh && FM_BACKEND_LIB_DIR='$stub' && fm_backend_source orca" >/dev/null 2>&1 \ + || fail "zsh: fm_backend_source orca should load a stub adapter" + [ -s "$probe" ] \ + || fail "zsh: fm_backend_source clobbered PATH while loading a backend adapter" + pass "zsh: fm_backend_source keeps PATH intact while loading a backend adapter" else pass "zsh: shell-portable backend matching skipped (zsh not found)" fi diff --git a/tests/fm-calm-claude-mod.test.sh b/tests/fm-calm-claude-mod.test.sh index 69ab66558e0..ce5dcf8a869 100644 --- a/tests/fm-calm-claude-mod.test.sh +++ b/tests/fm-calm-claude-mod.test.sh @@ -33,6 +33,13 @@ run_node() { # node --input-type=module <"$1" } +# js_string : a JavaScript string literal for a shell value, for the +# generated scripts below. ${value@Q} would need Bash 4.4 and yields shell +# quoting; stock macOS Bash 3.2 reports a bad substitution. +js_string() { # + node -e 'process.stdout.write(JSON.stringify(process.argv[1]))' -- "$1" +} + test_plugin_shape() { local link resolved autoload link="$ROOT/.agents/skills/firstmate-calm" @@ -49,7 +56,7 @@ test_plugin_shape() { [ ! -e "$MOD/SKILL.md" ] || fail "the mod carries a SKILL.md and would load as a skill on every harness" cat >"$TMP_ROOT/shape.mjs" <"$TMP_ROOT/sprite.mjs" <"$TMP_ROOT/raster.mjs" < { if (!condition) throw new Error(message); }; for (let length = 0; length <= 80; length += 1) { const bytes = new Uint8Array(randomBytes(length)); @@ -235,8 +242,8 @@ test_presentation_policy() { local out cat >"$TMP_ROOT/policy.mjs" < { if (!condition) throw new Error(message); }; const plugin = "/repo/.claude/mods/firstmate-calm"; check(policy.calmPreferencePath({}, plugin) === "/repo/config/calm", "plugin-root fallback"); @@ -473,8 +480,8 @@ test_classifier_parity_with_shell_owner() { cat >"$TMP_ROOT/classify.mjs" <"$TMP_ROOT/doorbells.mjs" </dev/null \ + || fail 'could not register delivery before judging its head' + help=$("$ROOT/bin/fm-contributions.sh" --help) || fail 'verdict help did not print' + out=$(with_home "$home" "$ROOT/bin/fm-contributions.sh" verdict delivery https://github.com/o/r/pull/8 "$HEAD_A" \ + https://github.com/o/r/pull/8#issuecomment-99 bogus 'no such actor' 2>&1) \ + && fail 'an unknown actor was accepted' + [ "$(printf '%s\n' "$help" | sed -n '/^ fm-contributions.sh verdict /p')" = \ + ' fm-contributions.sh verdict ' ] \ + || fail "help usage does not name exactly the accepted actors: $help" + [ "$(printf '%s\n' "$help" | sed -n '/^actor is exactly one of /p')" = \ + 'actor is exactly one of captain, fleet, maintainer or nobody; any other value' ] \ + || fail "help explanation does not name exactly the accepted actors: $help" + [ "$out" = "fm-contributions: invalid required actor 'bogus'; expected one of: captain, fleet, maintainer, nobody" ] \ + || fail "refusal does not name exactly the accepted actors: $out" + for actor in captain fleet maintainer nobody; do + with_home "$home" "$ROOT/bin/fm-contributions.sh" verdict delivery https://github.com/o/r/pull/8 "$HEAD_A" \ + https://github.com/o/r/pull/8#issuecomment-99 "$actor" 'documented actor' >/dev/null \ + || fail "documented actor $actor was refused" + done + pass 'verdict help and refusal name exactly the actors the command accepts' +} + test_observed_replacement_refreshes_verdict() { local home home=$(new_home observed-replacement) @@ -606,17 +632,24 @@ set -eu printf '%s\n' "$*" >> "$FORGE/calls" fault=$(cat "$FORGE/fault" 2>/dev/null || true) case "$fault" in latency) sleep "${FORGE_LATENCY:-2}" ;; esac +# Concurrent forge callers each advance one shared clock. Truncating it in +# place races with the other callers and the fake date: an interleaved write +# can publish a half-written value (or the 6 an emptied read computes), and a +# caller then evaluates DEADLINE against torn arithmetic. Publish every new +# value by rename so each reader always sees one complete old-or-new clock. +clock_bump() { + local tmp + tmp=$(mktemp "$FORGE/clock.XXXXXX") + printf '%s\n' "$(( $(cat "$FORGE/clock") + $1 ))" > "$tmp" + mv -f "$tmp" "$FORGE/clock" +} case "$fault:$*" in # Advance once before the parallel read wave; its readers share this clock. - reserve:'api repos/o/r/issues/9') - printf '%s\n' "$(( $(cat "$FORGE/clock") + 6 ))" > "$FORGE/clock" ;; + reserve:'api repos/o/r/issues/9') clock_bump 6 ;; slow-wave:'api repos/o/r/pulls/8') sleep 3 ;; slow-wave:'api repos/o/r/pulls/8/reviews?'*) sleep 6 ;; - exhaust:'api repos/o/r/issues/8/comments?'*) - printf '%s\n' "$(( $(cat "$FORGE/clock") + 100 ))" > "$FORGE/clock" ;; - fail-late:'api repos/o/r/pulls/8/reviews?'*) - printf '%s\n' "$(( $(cat "$FORGE/clock") + 100 ))" > "$FORGE/clock" - printf 'HTTP 502\n' >&2; exit 1 ;; + exhaust:'api repos/o/r/issues/8/comments?'*) clock_bump 100 ;; + fail-late:'api repos/o/r/pulls/8/reviews?'*) clock_bump 100; printf 'HTTP 502\n' >&2; exit 1 ;; fail:'api repos/o/r/pulls/8/reviews?'*) printf 'HTTP 502\n' >&2; exit 1 ;; down:*) printf 'HTTP 502\n' >&2; exit 1 ;; hang:'api repos/o/r/pulls/8') sleep 4 ;; @@ -1066,7 +1099,7 @@ test_late_owner_keeps_failure_episode_suppressed() { } failures=0 -for test_name in test_actor_coverage test_stale_verdict test_unchecked_is_not_silence test_newest_check_has_no_verdict test_comment_wake test_review_wake test_inline_wake test_ready_issue_wake test_fresh_issue_requires_maintainer test_missing_lane_remains_missing test_partial_freshness_keeps_measured_rows test_malformed_record_cannot_prove_silence test_issue_timeline_and_exact_ack test_verdict_retains_judged_head test_observed_replacement_refreshes_verdict test_unobserved_head_leaves_verdict_unknown test_away_yolo_is_fleet_work test_away_yolo_cross_home_is_fleet_work test_retired_and_unsupported_coverage test_unsupported_forge_is_not_fleet_work test_held_unsupported_forge_is_not_captain_work test_shared_contribution_signal_wakes_once test_watcher_keeps_diagnostics_separate_from_contribution_wakes test_expired_child_unsupported_forge_stays_unmeasured test_watcher_surfaces_new_contribution_once test_home_summary_coverage test_unreadable_pending_is_not_empty test_record_task_identity_matches_dirname_basename test_read_only_views_create_no_state test_budget_refusal_between_calls test_budget_bounded_call_timeout test_genuine_failure_near_deadline_is_unavailable test_shared_url_observed_once test_terminal_contribution_settles test_late_owner_inherits_terminal_observation test_interrupted_multi_owner_poll_settles_every_owner test_done_task_open_pr_still_observed test_reservation_defers_later_url_when_fifteen_seconds_do_not_remain test_three_second_pr_reads_complete_fresh_in_one_cycle test_slow_read_deadline_kill_is_budget_refusal test_unmeasured_url_does_not_starve_the_tail test_budget_is_cut_down_to_the_watcher_check_bound test_arm_plumbs_a_configured_budget_into_the_check_shim test_unavailable_forge_records_error_and_wakes_once_per_episode test_late_owner_keeps_failure_episode_suppressed; do +for test_name in test_actor_coverage test_stale_verdict test_unchecked_is_not_silence test_newest_check_has_no_verdict test_comment_wake test_review_wake test_inline_wake test_ready_issue_wake test_fresh_issue_requires_maintainer test_missing_lane_remains_missing test_partial_freshness_keeps_measured_rows test_malformed_record_cannot_prove_silence test_issue_timeline_and_exact_ack test_verdict_retains_judged_head test_verdict_actor_values_are_discoverable test_observed_replacement_refreshes_verdict test_unobserved_head_leaves_verdict_unknown test_away_yolo_is_fleet_work test_away_yolo_cross_home_is_fleet_work test_retired_and_unsupported_coverage test_unsupported_forge_is_not_fleet_work test_held_unsupported_forge_is_not_captain_work test_shared_contribution_signal_wakes_once test_watcher_keeps_diagnostics_separate_from_contribution_wakes test_expired_child_unsupported_forge_stays_unmeasured test_watcher_surfaces_new_contribution_once test_home_summary_coverage test_unreadable_pending_is_not_empty test_record_task_identity_matches_dirname_basename test_read_only_views_create_no_state test_budget_refusal_between_calls test_budget_bounded_call_timeout test_genuine_failure_near_deadline_is_unavailable test_shared_url_observed_once test_terminal_contribution_settles test_late_owner_inherits_terminal_observation test_interrupted_multi_owner_poll_settles_every_owner test_done_task_open_pr_still_observed test_reservation_defers_later_url_when_fifteen_seconds_do_not_remain test_three_second_pr_reads_complete_fresh_in_one_cycle test_slow_read_deadline_kill_is_budget_refusal test_unmeasured_url_does_not_starve_the_tail test_budget_is_cut_down_to_the_watcher_check_bound test_arm_plumbs_a_configured_budget_into_the_check_shim test_unavailable_forge_records_error_and_wakes_once_per_episode test_late_owner_keeps_failure_episode_suppressed; do ( "$test_name" ) || failures=$((failures + 1)) done [ "$failures" -eq 0 ] || fail "$failures contribution regressions" diff --git a/tests/fm-fleet-sync.test.sh b/tests/fm-fleet-sync.test.sh index 68c32f50d30..0bee1668c3d 100755 --- a/tests/fm-fleet-sync.test.sh +++ b/tests/fm-fleet-sync.test.sh @@ -683,8 +683,8 @@ test_symlinked_clone_still_syncs() { home=$(new_home) clone=$(build_pair "$home" sigma) advance_origin "$home" sigma C1 - # A symlinked clone dir is a real clone root; the guard compares resolved paths, - # so it must not be mistaken for a directory nested in someone else's repo. + # A symlinked clone dir is a real clone root and must not be mistaken for a + # directory nested in someone else's repo. mv "$clone" "$home/real-sigma" ln -s "$home/real-sigma" "$clone" @@ -694,6 +694,38 @@ test_symlinked_clone_still_syncs() { pass "the clone-root guard accepts a symlinked clone directory" } +test_clone_root_named_by_another_spelling_still_syncs() { + local home clone fakebin alias out + home=$(new_home) + clone=$(build_pair "$home" tau) + advance_origin "$home" tau C1 + fakebin="$home/fb-rootalias"; rm -rf "$fakebin"; mkdir -p "$fakebin" + # git reports the clone's own root through an alias that is the same directory + # but a different string, as it does on a case-insensitive volume when the home + # was recorded with other casing. A symlink stands in for the case difference so + # the test also holds on a case-sensitive filesystem. + alias="$home/root-alias" + ln -s "$clone" "$alias" + cat > "$fakebin/git" <<'SH' +#!/usr/bin/env bash +real=${REAL_GIT_FOR_TEST:?} +case " $* " in + *" rev-parse --show-toplevel "*) printf '%s\n' "${ROOT_ALIAS_FOR_TEST:?}"; exit 0 ;; +esac +exec "$real" "$@" +SH + chmod +x "$fakebin/git" + out="$home/out"; err="$home/err" + + ROOT_ALIAS_FOR_TEST="$alias" run_sync_guarded "$home" "$fakebin" "$out" "$err" tau || true + + assert_contains "$(cat "$out")" "tau: synced" \ + "a clone root that git names with another spelling must still fast-forward" + assert_not_contains "$(cat "$out")" "not a clone root" \ + "the guard must compare the directory itself, not the spelling of its path" + pass "the clone-root guard accepts a root named by a different spelling of the same directory" +} + test_non_signature_fetch_failure_is_not_retried() { local home fakebin clone out err home=$(new_home) @@ -741,3 +773,4 @@ test_non_signature_fetch_failure_is_not_retried test_non_clone_dir_never_syncs_the_enclosing_repo test_non_clone_dir_named_directly_never_syncs_the_enclosing_repo test_symlinked_clone_still_syncs +test_clone_root_named_by_another_spelling_still_syncs diff --git a/tests/fm-parent-channel-scan-exclusion.test.sh b/tests/fm-parent-channel-scan-exclusion.test.sh new file mode 100755 index 00000000000..7d8a580a4c6 --- /dev/null +++ b/tests/fm-parent-channel-scan-exclusion.test.sh @@ -0,0 +1,414 @@ +#!/usr/bin/env bash +# tests/fm-parent-channel-scan-exclusion.test.sh - a remote mate home's own +# outbound parent channel (state/parent-replies.status, resolved through +# bin/fm-parent-channel-lib.sh) must not be enumerated by the home's own status +# scans: every parent-channel append is mirrored into the parent home by the +# remote reply adapter, so folding or waking on it here spins spurious signal +# wakes and phantom "parent-replies" open decisions. The exclusion must be +# home-shape-aware: a parent-replies.status in a main home, in a local mate, or +# in any other home shape is an ordinary task log and keeps waking and folding. +# +# Covers the watcher scan (scan_signals, the heartbeat fail-safe backstop), the +# away-mode daemon's twin catch-all scan (fm-supervise-daemon.sh housekeeping), +# and fm-classify-lib.sh's fleet-wide folds (whole-file, incremental, +# presentation snapshot, unread surface), each against a real remote mate +# fixture plus the main-home and local-mate negative cases, and the real +# fm-wake-drain.sh end to end. +set -u + +# shellcheck source=tests/lib.sh +. "$(dirname "${BASH_SOURCE[0]}")/lib.sh" + +TMP_ROOT=$(fm_test_tmproot fm-parent-channel-scan-exclusion) +mkdir -p "$TMP_ROOT" +TMP_ROOT=$(cd "$TMP_ROOT" && pwd -P) + +# The real drain asserts watcher liveness through fm-guard.sh, whose tangle +# check warns when FM_ROOT sits on a feature branch; point it at a fresh +# non-git dir so the banner stays inert in this disposable worktree (the same +# trick tests/wake-helpers.sh installs for the drain suites). +FM_ROOT_OVERRIDE="$(fm_test_tmproot fm-parent-channel-scan-exclusion-root)" +export FM_ROOT_OVERRIDE +mkdir -p "$FM_ROOT_OVERRIDE" + +cleanup() { rm -rf -- "$TMP_ROOT"; } +trap cleanup EXIT + +# seed_remote_mate : build a remote mate home whose state dir carries one +# genuine task log and the outbound parent channel, with one captain-facing +# decision, one reserved-key resolution, and one informational note on the +# channel - exactly the line shapes a mate home publishes mechanically. +seed_remote_mate() { # + local dir=$1 + mkdir -p "$dir/state" + printf '%s\n' mate > "$dir/.fm-secondmate-home" + printf 'schema=fm-secondmate-parent.v1\nroute=remote\nparent_host=remote.example\n' \ + > "$dir/.fm-secondmate-parent" + printf 'needs-decision [key=captain-hold-pr-7-1]: captain hold pr-7: merge the green PR?\n' \ + > "$dir/state/parent-replies.status" + printf 'resolved [key=captain-hold-pr-5-2]: captain chose the staged rollout\n' \ + >> "$dir/state/parent-replies.status" + printf 'note: the release branch is cut\n' >> "$dir/state/parent-replies.status" + printf 'needs-decision [key=api-shape]: pick REST or RPC\n' > "$dir/state/real-task.status" + printf 'note: benchmark results are in\n' >> "$dir/state/real-task.status" +} + +# seed_plain_home : a main home (no secondmate identity marker) whose +# state dir carries a parent-replies.status that merely shares the name. +seed_plain_home() { # + local dir=$1 + mkdir -p "$dir/state" + printf 'needs-decision [key=name-only]: an ordinary task file that shares the name\n' \ + > "$dir/state/parent-replies.status" + printf 'needs-decision [key=other-task]: a genuine sibling task decision\n' \ + > "$dir/state/other-task.status" +} + +# seed_local_mate : a LOCAL mate home - its parent channel +# lives in the parent home's state/.status, so a parent-replies.status in +# its own state dir is an ordinary self-home file. +seed_local_mate() { # + local dir=$1 parent_home=$2 + mkdir -p "$dir/state" + printf '%s\n' mate > "$dir/.fm-secondmate-home" + printf 'schema=fm-secondmate-parent.v1\nroute=local\nparent_home=%s\n' "$parent_home" \ + > "$dir/.fm-secondmate-parent" + printf 'needs-decision [key=local-shape]: still an ordinary self-home file\n' \ + > "$dir/state/parent-replies.status" +} + +REMOTE="$TMP_ROOT/remote-mate" +PLAIN="$TMP_ROOT/main-home" +LOCAL_MATE="$TMP_ROOT/local-mate" +seed_remote_mate "$REMOTE" +seed_plain_home "$PLAIN" +seed_local_mate "$LOCAL_MATE" "$PLAIN" +REMOTE_STATE="$REMOTE/state" +PLAIN_STATE="$PLAIN/state" +LOCAL_STATE="$LOCAL_MATE/state" + +# --- unit: the exclusion predicates ----------------------------------------- + +test_predicate_resolves_only_the_remote_channel() { + local out rc + out=$(FM_TEST_LIB_SOURCED=1 bash -c ' + # shellcheck source=bin/fm-classify-lib.sh + . "$1/bin/fm-classify-lib.sh" + status_scan_parent_channel_exclude "$2" + ' _ "$ROOT" "$REMOTE_STATE") \ + || fail "the remote mate's channel must resolve for exclusion, got rc=$?" + [ "$out" = "$REMOTE_STATE/parent-replies.status" ] \ + || fail "the exclusion must be the resolved channel path, got: $out" + out=$(FM_TEST_LIB_SOURCED=1 bash -c ' + # shellcheck source=bin/fm-classify-lib.sh + . "$1/bin/fm-classify-lib.sh" + status_scan_parent_channel_exclude "$2" + ' _ "$ROOT" "$PLAIN_STATE") + [ -z "$out" ] || fail "a main home must exclude nothing, got: $out" + out=$(FM_TEST_LIB_SOURCED=1 bash -c ' + # shellcheck source=bin/fm-classify-lib.sh + . "$1/bin/fm-classify-lib.sh" + status_scan_parent_channel_exclude "$2" + ' _ "$ROOT" "$LOCAL_STATE") + [ -z "$out" ] || fail "a local mate must exclude nothing, got: $out" + pass "only a remote mate home resolves its own parent channel for exclusion" +} + +test_resolver_predicates_on_home_shape_not_name() { + local out + out=$(FM_TEST_LIB_SOURCED=1 bash -c ' + # shellcheck source=bin/fm-parent-channel-lib.sh + . "$1/bin/fm-parent-channel-lib.sh" + fm_parent_channel_outbound_status "$2" "$3" + ' _ "$ROOT" "$REMOTE" "$REMOTE_STATE") \ + || fail "the remote mate's outbound status must resolve" + [ "$out" = "$REMOTE_STATE/parent-replies.status" ] \ + || fail "the remote route must resolve into the mate's own state dir, got: $out" + FM_TEST_LIB_SOURCED=1 bash -c ' + # shellcheck source=bin/fm-parent-channel-lib.sh + . "$1/bin/fm-parent-channel-lib.sh" + fm_parent_channel_outbound_status "$2" "$3" + ' _ "$ROOT" "$PLAIN" "$PLAIN_STATE" \ + && fail "a main home has no outbound parent-channel status" + FM_TEST_LIB_SOURCED=1 bash -c ' + # shellcheck source=bin/fm-parent-channel-lib.sh + . "$1/bin/fm-parent-channel-lib.sh" + fm_parent_channel_outbound_status "$2" "$3" + ' _ "$ROOT" "$LOCAL_MATE" "$LOCAL_STATE" \ + && fail "a local mate's channel lives in the parent home, not its own state dir" + pass "fm_parent_channel_outbound_status resolves only the remote route" +} + +# --- unit: the fleet-wide folds omit the channel and keep genuine tasks ----- + +test_remote_folds_omit_channel_and_keep_genuine_task() { + local dir out + dir="$TMP_ROOT/folds" + seed_remote_mate "$dir/home" + out=$(FM_TEST_LIB_SOURCED=1 bash -c ' + # shellcheck source=bin/fm-classify-lib.sh + . "$1/bin/fm-classify-lib.sh" + echo "WHOLE:"; scan_open_decisions "$2" + echo "SNAPSHOT:"; status_presentation_snapshot "$2" + echo "UNREAD:"; scan_unread_surface_lines "$2" + ' _ "$ROOT" "$dir/home/state") || fail "the remote-mate fold pass failed" + case "$out" in *parent-replies*) + fail "the channel leaked into the remote mate's folds: $out" ;; + esac + printf '%s\n' "$out" | sed -n '/^WHOLE:/,/^SNAPSHOT:/p' | grep -F 'api-shape' >/dev/null \ + || fail "the genuine task's open decision must still fold: $out" + printf '%s\n' "$out" | sed -n '/^SNAPSHOT:/,/^UNREAD:/p' | grep -F 'real-task' >/dev/null \ + || fail "the genuine task must stay in the presentation snapshot: $out" + printf '%s\n' "$out" | sed -n '/^UNREAD:/,$p' | grep -F 'benchmark results' >/dev/null \ + || fail "the genuine task's note must stay on the unread surface: $out" + pass "a remote mate's folds omit its channel and keep a genuine task" +} + +test_incremental_fold_omits_channel_and_keeps_genuine_task() { + local dir out + dir="$TMP_ROOT/folds-incremental" + seed_remote_mate "$dir/home" + out=$(FM_TEST_LIB_SOURCED=1 bash -c ' + # shellcheck source=bin/fm-classify-lib.sh + . "$1/bin/fm-classify-lib.sh" + scan_open_decisions_incremental "$2" + ' _ "$ROOT" "$dir/home/state") || fail "the incremental fold failed" + case "$out" in *parent-replies*) + fail "the channel leaked into the incremental fold: $out" ;; + esac + printf '%s\n' "$out" | grep -F 'api-shape' >/dev/null \ + || fail "the genuine task's decision must still fold incrementally: $out" + pass "the cursor-backed incremental fold omits a remote mate's channel" +} + +test_channel_lines_never_reach_the_remote_unread_surface() { + local dir out + dir="$TMP_ROOT/unread" + seed_remote_mate "$dir/home" + out=$(FM_TEST_LIB_SOURCED=1 bash -c ' + # shellcheck source=bin/fm-classify-lib.sh + . "$1/bin/fm-classify-lib.sh" + scan_unread_surface_lines "$2" + ' _ "$ROOT" "$dir/home/state") || fail "the unread-surface scan failed" + case "$out" in *parent-replies*|*captain-hold*|*release\ branch*) + fail "channel decision, resolution, or note surfaced as self-home unread status: $out" ;; + esac + pass "the channel's resolution and note lines stay off the remote unread surface" +} + +test_name_shared_file_folds_in_a_main_home() { + local out + out=$(FM_TEST_LIB_SOURCED=1 bash -c ' + # shellcheck source=bin/fm-classify-lib.sh + . "$1/bin/fm-classify-lib.sh" + scan_open_decisions "$2" + ' _ "$ROOT" "$PLAIN_STATE") || fail "the main-home fold failed" + printf '%s\n' "$out" | grep -F 'name-only' >/dev/null \ + || fail "a main home's parent-replies.status must keep folding as an ordinary task: $out" + printf '%s\n' "$out" | grep -F 'other-task' >/dev/null \ + || fail "the sibling task decision must keep folding: $out" + pass "a parent-replies.status in a main home still folds" +} + +test_name_shared_file_folds_in_a_local_mate() { + local out + out=$(FM_TEST_LIB_SOURCED=1 bash -c ' + # shellcheck source=bin/fm-classify-lib.sh + . "$1/bin/fm-classify-lib.sh" + scan_open_decisions "$2" + ' _ "$ROOT" "$LOCAL_STATE") || fail "the local-mate fold failed" + printf '%s\n' "$out" | grep -F 'local-shape' >/dev/null \ + || fail "a local mate's parent-replies.status must keep folding: $out" + pass "a parent-replies.status in a local mate still folds" +} + +# --- unit: the watcher's signal scan and heartbeat backstop ----------------- + +# Source the watcher once with an isolated state/home; its source guard returns +# before the lock/loop, so only the functions load. scan_signals and +# heartbeat_scan_finds_actionable read STATE at call time. FM_ROOT_OVERRIDE +# stays at the inert dir set above; the unit-called functions read STATE, not +# the repo root. +WATCH_STATE="$REMOTE_STATE" +export FM_STATE_OVERRIDE="$WATCH_STATE" +export FM_HOME="$REMOTE" +# Production modules are independently linted canonical roots. Keep this test's +# ShellCheck context local while preserving its unchanged runtime source path. +# shellcheck source=/dev/null +. "$ROOT/bin/fm-watch.sh" + +test_watcher_scan_skips_channel_and_keeps_task_in_remote_mate() { + local out rc + STATE="$REMOTE_STATE" + out=$(scan_signals) || fail "scan_signals failed over the remote mate state" + printf '%s\n' "$out" | cut -f3 | grep -F 'parent-replies.status' >/dev/null \ + && fail "the channel must not produce a signal wake: $out" + printf '%s\n' "$out" | cut -f3 | grep -F 'real-task.status' >/dev/null \ + || fail "the genuine task's status must still wake: $out" + pass "scan_signals skips a remote mate's channel and still reports its tasks" +} + +test_heartbeat_backstop_skips_channel_in_remote_mate() { + local dir rc + dir="$TMP_ROOT/heartbeat" + seed_remote_mate "$dir/home" + # A quiet task log keeps the first pass channel-only: the note: line is + # informational, so only the excluded channel could make the scan actionable. + printf 'note: benchmark results are in\n' > "$dir/home/state/real-task.status" + STATE="$dir/home/state" + heartbeat_scan_finds_actionable; rc=$? + [ "$rc" -eq 1 ] || fail "the channel must not surface through the heartbeat backstop (rc=$rc): $FM_HEARTBEAT_SURFACE_ENDPOINTS" + case "$FM_HEARTBEAT_SURFACE_ENDPOINTS" in + *parent-replies*) fail "the channel leaked into the heartbeat backstop: $FM_HEARTBEAT_SURFACE_ENDPOINTS" ;; + esac + # A genuine task's captain-relevant line must keep reaching the backstop. + printf 'blocked [key=wedge]: the crew is stuck\n' >> "$dir/home/state/real-task.status" + heartbeat_scan_finds_actionable; rc=$? + [ "$rc" -eq 0 ] || fail "a genuine task's decision must surface through the heartbeat backstop" + case "$FM_HEARTBEAT_SURFACE_ENDPOINTS" in + *real-task.status*) ;; + *) fail "the heartbeat backstop must name the genuine task: $FM_HEARTBEAT_SURFACE_ENDPOINTS" ;; + esac + case "$FM_HEARTBEAT_SURFACE_ENDPOINTS" in + *parent-replies*) fail "the channel leaked into the heartbeat backstop: $FM_HEARTBEAT_SURFACE_ENDPOINTS" ;; + esac + pass "the heartbeat backstop skips a remote mate's channel and keeps its tasks" +} + +test_watcher_scan_keeps_name_shared_files_outside_remote_mates() { + local out + STATE="$PLAIN_STATE" + out=$(scan_signals) || fail "scan_signals failed over the main-home state" + printf '%s\n' "$out" | cut -f3 | grep -F 'parent-replies.status' >/dev/null \ + || fail "a main home's parent-replies.status must keep waking: $out" + # shellcheck disable=SC2034 # read by the sourced watcher's scans at call time + STATE="$LOCAL_STATE" + out=$(scan_signals) || fail "scan_signals failed over the local-mate state" + printf '%s\n' "$out" | cut -f3 | grep -F 'parent-replies.status' >/dev/null \ + || fail "a local mate's parent-replies.status must keep waking: $out" + pass "scan_signals keeps parent-replies.status outside remote mate homes" +} + +# --- unit: the away-mode daemon's heartbeat catch-all backstop -------------- + +# The daemon runs the watcher's twin catch-all scan while a home is away, so it +# needs the same exclusion. Source it in a subshell - its BASH_SOURCE guard +# skips the main loop, and the isolation keeps its function table from +# colliding with the watcher already sourced above. +daemon_heartbeat_scan() { # + local home=$1 + rm -f "$home/state/.subsuper-last-scan" + FM_TEST_LIB_SOURCED=1 FM_HOME="$home" FM_STATE_OVERRIDE="$home/state" \ + bash -c ' + # shellcheck source=/dev/null + . "$1/bin/fm-supervise-daemon.sh" + housekeeping "$2" + ' _ "$ROOT" "$home/state" >/dev/null 2>&1 +} + +test_daemon_heartbeat_backstop_skips_channel_in_remote_mate() { + local dir buffer + dir="$TMP_ROOT/daemon-heartbeat" + seed_remote_mate "$dir/home" + # A quiet task log keeps the first pass channel-only, so only the excluded + # channel could put anything in the escalation buffer. + printf 'note: benchmark results are in\n' > "$dir/home/state/real-task.status" + daemon_heartbeat_scan "$dir/home" + buffer=$(cat "$dir/home/state/.subsuper-escalations" 2>/dev/null || true) + case "$buffer" in *parent-replies*|*captain-hold*|*release\ branch*) + fail "the channel leaked into the daemon's catch-all scan: $buffer" ;; + esac + [ -z "$(cat "$dir/home/state/.subsuper-seen-status-parent-replies" 2>/dev/null || true)" ] \ + || fail "the daemon tracked the channel as a phantom parent-replies task" + + # A genuine task's captain-relevant line must keep reaching the backstop. + printf 'blocked [key=wedge]: the crew is stuck\n' >> "$dir/home/state/real-task.status" + daemon_heartbeat_scan "$dir/home" + buffer=$(cat "$dir/home/state/.subsuper-escalations" 2>/dev/null || true) + printf '%s\n' "$buffer" | grep -F 'real-task.status' >/dev/null \ + || fail "a genuine task's decision must still surface through the daemon backstop: $buffer" + case "$buffer" in *parent-replies*) + fail "the channel leaked into the daemon's catch-all scan: $buffer" ;; + esac + pass "the daemon's catch-all scan skips a remote mate's channel and keeps its tasks" +} + +test_daemon_heartbeat_backstop_keeps_name_shared_file_in_a_main_home() { + local dir buffer + dir="$TMP_ROOT/daemon-heartbeat-main" + seed_plain_home "$dir/home" + printf 'blocked [key=name-only]: an ordinary task file that shares the name\n' \ + > "$dir/home/state/parent-replies.status" + daemon_heartbeat_scan "$dir/home" + buffer=$(cat "$dir/home/state/.subsuper-escalations" 2>/dev/null || true) + printf '%s\n' "$buffer" | grep -F 'parent-replies.status' >/dev/null \ + || fail "a main home's parent-replies.status must keep reaching the daemon backstop: $buffer" + pass "the daemon's catch-all scan keeps parent-replies.status outside remote mate homes" +} + +# --- end to end: the real drain over a remote mate home --------------------- + +test_drain_presents_no_channel_content_in_remote_mate() { + local dir out manifest + dir="$TMP_ROOT/drain" + seed_remote_mate "$dir/home" + mkdir -p "$dir/home/data" + FM_STATE_OVERRIDE="$dir/home/state" FM_HOME="$dir/home" \ + "$ROOT/bin/fm-wake-drain.sh" > "$dir/drain.out" \ + || fail "the drain failed over a remote mate home" + out=$(cat "$dir/drain.out") + case "$out" in *parent-replies*) + fail "the drain presented the remote mate's channel: $out" ;; + esac + printf '%s\n' "$out" | grep -F 'api-shape' >/dev/null \ + || fail "the genuine task's open decision must still surface in OPEN DECISIONS: $out" + printf '%s\n' "$out" | grep -F 'benchmark results' >/dev/null \ + || fail "the genuine task's note must still surface under UNREAD STATUS: $out" + # The presentation manifest is rebuilt from the excluded snapshot, so a + # channel row an older watcher recorded must not survive the drain. + manifest=$(cat "$dir/home/state/.status-presentation-cursor" 2>/dev/null || true) + case "$manifest" in *parent-replies*) + fail "the presentation manifest still tracks the channel: $manifest" ;; + esac + pass "the real drain presents no channel content from a remote mate home" +} + +test_drain_ignores_stale_channel_records_from_an_older_watcher() { + local dir out manifest + dir="$TMP_ROOT/drain-stale" + seed_remote_mate "$dir/home" + mkdir -p "$dir/home/data" + # An older watcher folded the channel and tracked it as a task; the fixed + # drain must drop both rather than present or choke on them. + printf 'needs-decision [key=old-phantom]: folded by the unfixed watcher\n' \ + > "$dir/home/state/.parent-replies.open-decisions-cursor" + printf 'parent-replies\tstrong:1:2:3\t99\t0\n' \ + > "$dir/home/state/.status-presentation-cursor" + FM_STATE_OVERRIDE="$dir/home/state" FM_HOME="$dir/home" \ + "$ROOT/bin/fm-wake-drain.sh" > "$dir/drain.out" \ + || fail "the drain failed over stale channel records" + out=$(cat "$dir/drain.out") + case "$out" in *parent-replies*|*old-phantom*) + fail "a stale channel fold resurfaced through the drain: $out" ;; + esac + manifest=$(cat "$dir/home/state/.status-presentation-cursor" 2>/dev/null || true) + case "$manifest" in *parent-replies*) + fail "the stale manifest row survived the drain: $manifest" ;; + esac + pass "stale channel records from an older watcher are dropped, not presented" +} + +test_predicate_resolves_only_the_remote_channel +test_resolver_predicates_on_home_shape_not_name +test_remote_folds_omit_channel_and_keep_genuine_task +test_incremental_fold_omits_channel_and_keeps_genuine_task +test_channel_lines_never_reach_the_remote_unread_surface +test_name_shared_file_folds_in_a_main_home +test_name_shared_file_folds_in_a_local_mate +test_watcher_scan_skips_channel_and_keeps_task_in_remote_mate +test_heartbeat_backstop_skips_channel_in_remote_mate +test_watcher_scan_keeps_name_shared_files_outside_remote_mates +test_daemon_heartbeat_backstop_skips_channel_in_remote_mate +test_daemon_heartbeat_backstop_keeps_name_shared_file_in_a_main_home +test_drain_presents_no_channel_content_in_remote_mate +test_drain_ignores_stale_channel_records_from_an_older_watcher