test: bind refocus failure contract corrections on macOS

.github/workflows/tests.yml

@@ -1,94 +1,15 @@
 name: Tests
-
-# Builds, type-checks and runs every test suite on a clean GitHub runner, and records the file
-# list each published package would contain. Each suite is its own job so one failure does not
-# hide the others. No provider credentials or operator configuration are supplied.
-# Package suites deny external networking; scenario runtime has no external route.
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-  workflow_dispatch:
-
+on: workflow_dispatch
 permissions:
   contents: read
-
-concurrency:
-  group: tests-${{ github.event_name }}-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
-  build-and-package:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - run: npm run build
-      - name: Record the published file list of each package
-        run: |
-          set -euo pipefail
-          mkdir -p pack-lists
-          for p in cli daemon tui; do
-            (cd packages/$p && npm pack --dry-run --json --ignore-scripts) \
-              | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{for(const f of JSON.parse(s)[0].files)console.log(f.path)})' \
-              | sort > pack-lists/$p.txt
-            echo "$p: $(wc -l < pack-lists/$p.txt) files"
-          done
-      - uses: actions/upload-artifact@v4
-        with:
-          name: pack-lists
-          path: pack-lists/
-
-  typecheck:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - run: npm run lint
-
-  repo-checks:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - run: npm run test:repo
-
-  package-tests:
-    if: ${{ github.event_name != 'push' }}
-    # macOS, the platform OpenRig runs on: several daemon and cli tests read macOS ps columns,
-    # file-inode behaviour and release tags.
+  refocus-test-corrections:
     runs-on: macos-latest
-    timeout-minutes: 45
-    strategy:
-      fail-fast: false
-      matrix:
-        package: [daemon, cli, tui, ui]
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
         with:
+          ref: 01f97300a2e210920efb1aa59fca75cf929d6573
           fetch-depth: 0
           persist-credentials: false
       - uses: actions/setup-node@v4
@@ -97,46 +18,52 @@ jobs:
           cache: npm
       - run: brew install tmux
       - run: npm ci
-      - name: Build the packages the tests import
-        run: npm run build
-      - name: Run the suite without ambient credentials or external network
+      - run: npm run build
+      - name: Reproduce stale tests then verify preserved contracts
         run: |
+          set -euo pipefail
+          mkdir -p "$RUNNER_TEMP/proof"
+          git rev-parse HEAD HEAD^ HEAD^{tree} > "$RUNNER_TEMP/proof/checkout.txt"
+          id > "$RUNNER_TEMP/proof/uid.txt"
+          shasum -a 256 packages/daemon/assets/plugins/openrig-core/skills/refocusing/scripts/trace-to-root.py packages/daemon/test/refocus-managed-result.test.ts packages/daemon/test/scope-audit-parity.test.ts packages/daemon/test/tmux-control.test.ts > "$RUNNER_TEMP/proof/before.sha256"
+          git show fcd003491f0ee6fe847ee1c8496375990292a95a:packages/daemon/test/refocus-managed-result.test.ts > packages/daemon/test/refocus-managed-result.test.ts
+          git show fcd003491f0ee6fe847ee1c8496375990292a95a:packages/daemon/test/scope-audit-parity.test.ts > packages/daemon/test/scope-audit-parity.test.ts
+          shasum -a 256 packages/daemon/assets/plugins/openrig-core/skills/refocusing/scripts/trace-to-root.py packages/daemon/test/refocus-managed-result.test.ts packages/daemon/test/scope-audit-parity.test.ts packages/daemon/test/tmux-control.test.ts > "$RUNNER_TEMP/proof/red.sha256"
+          set +e
+          npm exec -w packages/daemon -- vitest run test/refocus-managed-result.test.ts test/scope-audit-parity.test.ts -t 'retains real resolver failures|check mode reports actual resolution failure|confirms a slow stream receipt|uses the real CLI resolver for every locked outcome' --reporter=default --reporter=json --outputFile="$RUNNER_TEMP/proof/red-daemon.json"
+          red_exit=$?
+          set -e
+          printf '%s\n' "$red_exit" > "$RUNNER_TEMP/proof/red.exit"
+          test "$red_exit" -ne 0
+          python3 - "$RUNNER_TEMP/proof" <<'PYTHON'
+          import json,pathlib,sys
+          r=json.loads((pathlib.Path(sys.argv[1])/'red-daemon.json').read_text())
+          assert r['numFailedTests']==4 and r['numPassedTests']==0,r
+          failures=[a for f in r['testResults'] for a in f['assertionResults'] if a['status']=='failed']
+          assert len(failures)==4 and all(a['failureMessages'] for a in failures)
+          for expected in ['retains real resolver failures','check mode reports actual resolution failure','confirms a slow stream receipt','uses the real CLI resolver for every locked outcome']:
+           assert sum(expected in a['fullName'] for a in failures)==1,expected
+          PYTHON
+          git show HEAD:packages/daemon/test/refocus-managed-result.test.ts > packages/daemon/test/refocus-managed-result.test.ts
+          git show HEAD:packages/daemon/test/scope-audit-parity.test.ts > packages/daemon/test/scope-audit-parity.test.ts
           suite_root=$(mktemp -d "$RUNNER_TEMP/opr-test.XXXXXX")
           suite_root=$(cd "$suite_root" && pwd -P)
           mkdir -p "$suite_root/home" "$suite_root/bin"
-          # Same system bytes, nonprivileged mode; no system file is changed.
           /usr/bin/install -m 0755 /bin/ps "$suite_root/bin/ps"
-          # Only this job's temporary sockets (including tmux) are reachable.
-          env -i HOME="$suite_root/home" PATH="$PATH" TMPDIR="$suite_root" TMUX_TMPDIR="$suite_root" \
-            CI=true TERM=xterm-256color \
+          env -i HOME="$suite_root/home" PATH="$PATH" TMPDIR="$suite_root" TMUX_TMPDIR="$suite_root" PROOF_OUT="$RUNNER_TEMP/proof" CI=true TERM=xterm-256color \
             sandbox-exec -D IPC_ROOT="$suite_root" -p '(version 1)(allow default)(deny network-outbound)(allow network-outbound (remote ip "localhost:*"))(allow network-outbound (subpath (param "IPC_ROOT")))' \
-            /bin/bash -s "${{ matrix.package }}" <<'SUITE'
+            /bin/bash -s <<'SUITE'
           set -euo pipefail
           node scripts/ci-macos-process-probe.mjs
-          # The production readers use bare ps. Select real system bytes only after
-          # self/owned-child observation and network/IPC confinement are proved.
           export PATH="$TMPDIR/bin:$PATH"
-          test "$(command -v ps)" = "$TMPDIR/bin/ps"
-          exec npm run test -w "packages/$1"
+          npm exec -w packages/daemon -- vitest run test/refocus-context-ref.test.ts test/refocus-notes-local.test.ts test/refocus-work-packet.test.ts test/refocus-budget-concurrency.test.ts test/refocus-managed-result.test.ts test/scope-audit-parity.test.ts test/tmux-control.test.ts --reporter=default --reporter=json --outputFile="$PROOF_OUT/green-daemon.json"
           SUITE
-
-  installed-scenario:
-    runs-on: ubuntu-latest
-    timeout-minutes: 35
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - name: Installed package, daemon restart, and seeded durability failure
-        run: bash scripts/run-pr-scenarios.sh
+          shasum -a 256 packages/daemon/assets/plugins/openrig-core/skills/refocusing/scripts/trace-to-root.py packages/daemon/test/refocus-managed-result.test.ts packages/daemon/test/scope-audit-parity.test.ts packages/daemon/test/tmux-control.test.ts > "$RUNNER_TEMP/proof/after.sha256"
+          diff -u "$RUNNER_TEMP/proof/before.sha256" "$RUNNER_TEMP/proof/after.sha256"
+          git diff --exit-code
       - uses: actions/upload-artifact@v4
         if: always()
         with:
-          name: installed-scenario-evidence
-          path: dist/pr-scenarios/
+          name: refocus-test-corrections
+          path: ${{ runner.temp }}/proof/
           if-no-files-found: error