test: verify projection warning with prior-source negative control

.github/workflows/tests.yml

@@ -1,31 +1,16 @@
 name: Tests
-
-# Builds, type-checks and runs every test suite on a clean GitHub runner, and records the file
-# list each published package would contain. Each suite is its own job so one failure does not
-# hide the others. No provider credentials or operator configuration are supplied.
-# Package suites deny external networking; scenario runtime has no external route.
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-  workflow_dispatch:
-
+on: workflow_dispatch
 permissions:
   contents: read
-
-concurrency:
-  group: tests-${{ github.event_name }}-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
-  build-and-package:
+  projection-warning-red-green:
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 12
     steps:
       - uses: actions/checkout@v4
         with:
+          ref: b380cd46faf8bbd4ea1a4194a6cf8ce220fde68f
+          fetch-depth: 0
           persist-credentials: false
       - uses: actions/setup-node@v4
         with:
@@ -33,110 +18,15 @@ jobs:
           cache: npm
       - run: npm ci
       - run: npm run build
-      - name: Record the published file list of each package
+      - name: Prior wording must fail the supported-remedies assertion
         run: |
-          set -euo pipefail
-          mkdir -p pack-lists
-          for p in cli daemon tui; do
-            (cd packages/$p && npm pack --dry-run --json --ignore-scripts) \
-              | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{for(const f of JSON.parse(s)[0].files)console.log(f.path)})' \
-              | sort > pack-lists/$p.txt
-            echo "$p: $(wc -l < pack-lists/$p.txt) files"
-          done
-      - uses: actions/upload-artifact@v4
-        with:
-          name: pack-lists
-          path: pack-lists/
-
-  typecheck:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - run: npm run lint
-
-  repo-checks:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - run: npm run test:repo
-
-  package-tests:
-    if: ${{ github.event_name != 'push' }}
-    # macOS, the platform OpenRig runs on: several daemon and cli tests read macOS ps columns,
-    # file-inode behaviour and release tags.
-    runs-on: macos-latest
-    timeout-minutes: 45
-    strategy:
-      fail-fast: false
-      matrix:
-        package: [daemon, cli, tui, ui]
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: brew install tmux
-      - run: npm ci
-      - name: Build the packages the tests import
-        run: npm run build
-      - name: Run the suite without ambient credentials or external network
-        run: |
-          suite_root=$(mktemp -d "$RUNNER_TEMP/opr-test.XXXXXX")
-          suite_root=$(cd "$suite_root" && pwd -P)
-          mkdir -p "$suite_root/home" "$suite_root/bin"
-          # Same system bytes, nonprivileged mode; no system file is changed.
-          /usr/bin/install -m 0755 /bin/ps "$suite_root/bin/ps"
-          # Only this job's temporary sockets (including tmux) are reachable.
-          env -i HOME="$suite_root/home" PATH="$PATH" TMPDIR="$suite_root" TMUX_TMPDIR="$suite_root" \
-            CI=true TERM=xterm-256color \
-            sandbox-exec -D IPC_ROOT="$suite_root" -p '(version 1)(allow default)(deny network-outbound)(allow network-outbound (remote ip "localhost:*"))(allow network-outbound (subpath (param "IPC_ROOT")))' \
-            /bin/bash -s "${{ matrix.package }}" <<'SUITE'
-          set -euo pipefail
-          node scripts/ci-macos-process-probe.mjs
-          # The production readers use bare ps. Select real system bytes only after
-          # self/owned-child observation and network/IPC confinement are proved.
-          export PATH="$TMPDIR/bin:$PATH"
-          test "$(command -v ps)" = "$TMPDIR/bin/ps"
-          exec npm run test -w "packages/$1"
-          SUITE
-
-  installed-scenario:
-    runs-on: ubuntu-latest
-    timeout-minutes: 35
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - name: Installed package, daemon restart, and seeded durability failure
-        run: bash scripts/run-pr-scenarios.sh
-      - uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: installed-scenario-evidence
-          path: dist/pr-scenarios/
-          if-no-files-found: error
+          git checkout bcb0438b6785f7d97a171947fa1ab9d05db90e00 -- packages/daemon/src/domain/projection-planner.ts
+          set +e
+          npx vitest run packages/daemon/test/projection-protect.test.ts -t 'operator_conflict warning names supported remedies' --reporter=json --outputFile=/tmp/projection-warning-red.json
+          result=$?
+          set -e
+          test "$result" = 1
+          node -e 'const r=require("/tmp/projection-warning-red.json"); const f=r.testResults.flatMap(x=>x.assertionResults).filter(x=>x.status==="failed"); if(r.numFailedTests!==1 || r.numPassedTests!==0 || f.length!==1 || !f[0].title.includes("operator_conflict warning names supported remedies"))process.exit(1); console.log("Exactly the unsupported-remedy warning assertion fails on prior source.")'
+          git checkout b380cd46faf8bbd4ea1a4194a6cf8ce220fde68f -- packages/daemon/src/domain/projection-planner.ts
+      - name: Supported wording and unchanged projection protection
+        run: npx vitest run packages/daemon/test/projection-protect.test.ts packages/daemon/test/projection-planner.test.ts packages/daemon/test/projection-manifest-wiring.test.ts packages/daemon/test/conflict-detector.test.ts packages/daemon/test/conflict-detector-discrimination.test.ts

packages/daemon/src/domain/projection-planner.ts

@@ -327,7 +327,7 @@ export function projectionConflictWarnings(plan: Pick<ProjectionPlan, "conflicts
       // P20 PROTECT: the manifest tells us the target diverged from BOTH our last
       // write and the source — an operator edited it. filterProtectedProjections
       // holds the file back, so "not overwritten" is now TRUE (not just a warning).
-      return `projection conflict: ${reason} — PROTECTED: the target is NOT overwritten; re-run projection with --force to overwrite it, or fold the operator edit into the spec source`;
+      return `projection conflict: ${reason} — PROTECTED: the target is NOT overwritten; fold the operator edit into the spec source, or move the edited target aside before the next projection`;
     }
     // hash_conflict — the P17 fallback: no projection manifest for this target yet,
     // so an operator edit can't be told apart from a stale projection. We overwrite

packages/daemon/src/domain/rigspec-instantiator.ts

@@ -2150,8 +2150,8 @@ export class PodRigInstantiator {
     );
     const managedDedupedFiles = this.dedupeProjectedManagedStartupFiles(planResult.plan, resolvedFiles);
     // P20 atom-4 PROTECT: hold back operator-edited skill targets (operator_conflict)
-    // so the adapter never overwrites an operator's edit — unless the operator forces
-    // it (input.force). The per-conflict warning already tells the operator this.
+    // so the adapter never overwrites an operator's edit unless an internal caller sets
+    // input.force. The warning names the source-edit/move-aside remedies available to users.
     const dedupedResolvedFiles = filterProtectedProjections(
       managedDedupedFiles,
       planResult.plan,

packages/daemon/test/projection-protect.test.ts

@@ -10,7 +10,7 @@ import type { ResolvedStartupFile } from "../src/domain/runtime-adapter.js";
 // (target diverged from BOTH our last write and the source), atom-3 records the
 // last write. This atom makes the "not overwriting" the warning already claims
 // actually TRUE: operator_conflict skill files are held back from delivery, so
-// the adapter never overwrites an operator's edit — unless --force. hash_conflict
+// the adapter never overwrites an operator's edit unless an internal caller sets force. hash_conflict
 // (no manifest yet) stays the P17 overwrite-with-warning fallback (can't tell
 // operator-vs-stale apart without a recorded last hash).
 
@@ -76,10 +76,12 @@ describe("P20 atom-4 protect — operator_conflict skills held back from deliver
 });
 
 describe("P20 atom-4 warning branch — protect vs softened-overwrite tail by classification", () => {
-  it("operator_conflict warning states PROTECTED + --force, not 'will be overwritten'", () => {
+  it("operator_conflict warning names supported remedies and preserves protection", () => {
     const [w] = projectionConflictWarnings({ conflicts: [skillEntry({ classification: "operator_conflict" })] });
     expect(w).toMatch(/not overwrit|protected/i);
-    expect(w).toMatch(/--force/);
+    expect(w).toContain("fold the operator edit into the spec source");
+    expect(w).toContain("move the edited target aside");
+    expect(w).not.toContain("--force");
     expect(w).not.toMatch(/will be overwritten by re-projection/);
   });