ci: measure wrapper model identity regression

.github/workflows/tests.yml

@@ -1,31 +1,15 @@
 name: Tests
-
-# Builds, type-checks and runs every test suite on a clean GitHub runner, and records the file
-# list each published package would contain. Each suite is its own job so one failure does not
-# hide the others. No provider credentials or operator configuration are supplied.
-# Package suites deny external networking; scenario runtime has no external route.
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-  workflow_dispatch:
-
+on: workflow_dispatch
 permissions:
   contents: read
-
-concurrency:
-  group: tests-${{ github.event_name }}-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
-  build-and-package:
+  model-wrapper:
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
         with:
+          ref: de4a71c7fe956cffb00bdf4b4a216010edb3d095
           persist-credentials: false
       - uses: actions/setup-node@v4
         with:
@@ -33,110 +17,21 @@ jobs:
           cache: npm
       - run: npm ci
       - run: npm run build
-      - name: Record the published file list of each package
+      - name: Composed wrapper identity regression
+        shell: bash
         run: |
-          set -euo pipefail
-          mkdir -p pack-lists
-          for p in cli daemon tui; do
-            (cd packages/$p && npm pack --dry-run --json --ignore-scripts) \
-              | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{for(const f of JSON.parse(s)[0].files)console.log(f.path)})' \
-              | sort > pack-lists/$p.txt
-            echo "$p: $(wc -l < pack-lists/$p.txt) files"
-          done
-      - uses: actions/upload-artifact@v4
-        with:
-          name: pack-lists
-          path: pack-lists/
-
-  typecheck:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - run: npm run lint
-
-  repo-checks:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - run: npm run test:repo
-
-  package-tests:
-    if: ${{ github.event_name != 'push' }}
-    # macOS, the platform OpenRig runs on: several daemon and cli tests read macOS ps columns,
-    # file-inode behaviour and release tags.
-    runs-on: macos-latest
-    timeout-minutes: 45
-    strategy:
-      fail-fast: false
-      matrix:
-        package: [daemon, cli, tui, ui]
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: brew install tmux
-      - run: npm ci
-      - name: Build the packages the tests import
-        run: npm run build
-      - name: Run the suite without ambient credentials or external network
-        run: |
-          suite_root=$(mktemp -d "$RUNNER_TEMP/opr-test.XXXXXX")
-          suite_root=$(cd "$suite_root" && pwd -P)
-          mkdir -p "$suite_root/home" "$suite_root/bin"
-          # Same system bytes, nonprivileged mode; no system file is changed.
-          /usr/bin/install -m 0755 /bin/ps "$suite_root/bin/ps"
-          # Only this job's temporary sockets (including tmux) are reachable.
-          env -i HOME="$suite_root/home" PATH="$PATH" TMPDIR="$suite_root" TMUX_TMPDIR="$suite_root" \
-            CI=true TERM=xterm-256color \
-            sandbox-exec -D IPC_ROOT="$suite_root" -p '(version 1)(allow default)(deny network-outbound)(allow network-outbound (remote ip "localhost:*"))(allow network-outbound (subpath (param "IPC_ROOT")))' \
-            /bin/bash -s "${{ matrix.package }}" <<'SUITE'
-          set -euo pipefail
-          node scripts/ci-macos-process-probe.mjs
-          # The production readers use bare ps. Select real system bytes only after
-          # self/owned-child observation and network/IPC confinement are proved.
-          export PATH="$TMPDIR/bin:$PATH"
-          test "$(command -v ps)" = "$TMPDIR/bin/ps"
-          exec npm run test -w "packages/$1"
-          SUITE
-
-  installed-scenario:
-    runs-on: ubuntu-latest
-    timeout-minutes: 35
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - name: Installed package, daemon restart, and seeded durability failure
-        run: bash scripts/run-pr-scenarios.sh
+          set +e
+          set -uo pipefail
+          mkdir -p proof
+          git rev-parse HEAD HEAD^{tree} > proof/source.txt
+          npm --workspace @openrig/daemon test -- test/current-model-reader.test.ts --reporter=verbose 2>&1 | tee proof/daemon.log
+          result=${PIPESTATUS[0]}
+          git diff --exit-code > proof/source-unchanged.txt
+          printf 'daemon=%s\n' "$result" > proof/exits.txt
+          test "$result" -eq 0
       - uses: actions/upload-artifact@v4
         if: always()
         with:
-          name: installed-scenario-evidence
-          path: dist/pr-scenarios/
+          name: model-wrapper-red
+          path: proof/
           if-no-files-found: error

packages/daemon/test/current-model-reader.test.ts

@@ -5,6 +5,7 @@ import { join } from "node:path";
 import { createFullTestDb, createTestApp } from "./helpers/test-app.js";
 import { RigRepository } from "../src/domain/rig-repository.js";
 import { SessionRegistry } from "../src/domain/session-registry.js";
+import { SeatIdentityReconciler } from "../src/domain/seat-identity-reconciler.js";
 import { SeatIdentityStore } from "../src/domain/seat-identity-store.js";
 import { ProcessCensus } from "../src/domain/process-census.js";
 import { CurrentModelReader } from "../src/domain/model-divergence/current-model-reader.js";
@@ -46,7 +47,7 @@ function fixture(runtime = "claude-code") {
     readAllPaneProcesses, census, now: () => boot + 60_000, native: { getPanePid, listProcesses: () => census.list(), readThreadIdByPid: thread },
   });
   const input = { nodeId: node.id, canonicalSessionName: "editor@studio", runtime, sessionStatus: "running" };
-  return { db, dir, rigs, rig, node, sessions, identities, session, tenure, boot, stamp, path, claudeRecord, reader, input, list, getPanePid, thread, processRows, readAllPaneProcesses };
+  return { db, dir, rigs, rig, node, sessions, identities, session, tenure, boot, stamp, path, id, claudeRecord, reader, input, list, getPanePid, thread, processRows, readAllPaneProcesses };
 }
 
 it("reports assistant-response evidence separately from the pin, with native time and no record contents", async () => {
@@ -274,3 +275,59 @@ it.each([false, true])("r3: retains observed PID-turnover reporting with a warme
   expect(await f.reader.observe(f.input)).toMatchObject({ status: "unknown", model: null, reason: "occupant-changed-during-read" });
   expect(f.getPanePid).toHaveBeenCalledTimes(3);
 });
+
+
+// Compose the real reconciler/store/record reader: a hand-seeded pane-PID verdict hides this bug.
+async function wrapperFixture() {
+  const f = fixture();
+  f.db.prepare("UPDATE sessions SET resume_token = ? WHERE id = ?").run(f.id, f.session.id);
+  const rows = [
+    { pid: 10, ppid: 1, pgid: 10, tpgid: 20, executableName: "sh", command: "sh", startedAt: f.stamp },
+    { pid: 20, ppid: 10, pgid: 20, tpgid: 20, executableName: "claude", command: `claude --resume ${f.id}`, startedAt: f.stamp },
+  ];
+  f.list.mockImplementation(async () => rows);
+  const reconciler = new SeatIdentityReconciler({ db: f.db, now: () => new Date(f.stamp), listProcesses: f.list,
+    tmux: { listSessions: async () => [{ name: "editor@studio" }], getPanePid: f.getPanePid,
+      getPaneCommand: async () => "sh" } as never });
+  await reconciler.reconcileAll();
+  expect(f.identities.getForNode(f.node.id)).toMatchObject({ verdict: "verified", evidence: { observedPid: 20 } });
+  const seat = { nodeId: f.node.id, sessionName: "editor@studio", runtime: "claude-code", generation: f.tenure.generationUuid,
+    rigId: f.rig.id, rigName: "studio", pinnedModel: "configured-model" };
+  return { ...f, rows, reconciler, seat };
+}
+
+it("reads the response model through a persisted wrapper-root/Claude-child verdict", async () => {
+  const f = await wrapperFixture();
+  expect(await f.reader.readEffectiveModel(f.seat)).toEqual({ ok: true, model: "response-model" });
+  expect(await f.reader.observe(f.input)).toMatchObject({ status: "observed", model: "response-model" });
+});
+
+it("the wrapper join ignores a newer retained predecessor record and process outside its pane", async () => {
+  const f = await wrapperFixture();
+  const priorId = "22222222-2222-4222-8222-222222222222", priorPath = join(f.dir, `${priorId}.jsonl`);
+  writeFileSync(priorPath, f.claudeRecord(new Date(f.boot + 3_000).toISOString(), "predecessor-model"));
+  f.rows.push({ pid: 30, ppid: 1, pgid: 30, tpgid: 40, executableName: "sh", command: "sh", startedAt: f.stamp },
+    { pid: 40, ppid: 30, pgid: 40, tpgid: 40, executableName: "claude", command: `claude --resume ${priorId}`, startedAt: f.stamp });
+  const { resolveIdentityVerifiedClaudeRecord } = await import("../src/domain/model-divergence/current-generation-record.js");
+  expect(await resolveIdentityVerifiedClaudeRecord({ sessionName: f.seat.sessionName, generation: f.seat.generation,
+    occupantBootAt: f.tenure.bootAt, binding: { tmuxSession: f.seat.sessionName, tmuxPane: "%1" },
+    identity: f.identities.getForNode(f.node.id), sidecar: { session_name: f.seat.sessionName, session_id: priorId,
+      transcript_path: priorPath, sampled_at: f.stamp, occupant_generation: "retained-generation" } },
+  { getPanePid: f.getPanePid, listProcesses: f.list }, () => true)).toMatchObject({ ok: true, id: f.id, path: f.path,
+    source: "verified-pane-argument" });
+});
+
+it.each(["child-replaced", "child-moved", "pane-replaced", "binding-changed", "old-verdict"])(
+  "does not read a wrapper record after %s", async kind => {
+    const f = await wrapperFixture();
+    if (kind === "child-replaced") f.rows[1]!.pid = 21;
+    if (kind === "child-moved") f.rows[1]!.ppid = 99;
+    if (kind === "pane-replaced") {
+      f.getPanePid.mockResolvedValue(99);
+      f.rows[0]!.pid = 99; f.rows[1]!.ppid = 99;
+    }
+    if (kind === "binding-changed") f.sessions.updateBinding(f.node.id, { tmuxSession: "editor@studio", tmuxPane: "%2" });
+    if (kind === "old-verdict") f.identities.upsert({ ...f.identities.getForNode(f.node.id)!, observedAt: new Date(f.boot - 1_000).toISOString() });
+    expect((await f.reader.readEffectiveModel(f.seat)).ok).toBe(false);
+  },
+);