test: qualify exact docs desk heads and retained negative controls

.github/workflows/tests.yml

@@ -1,31 +1,15 @@
 name: Tests
-
-# Builds, type-checks and runs every test suite on a clean GitHub runner, and records the file
-# list each published package would contain. Each suite is its own job so one failure does not
-# hide the others. No provider credentials or operator configuration are supplied.
-# Package suites deny external networking; scenario runtime has no external route.
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-  workflow_dispatch:
-
+on: workflow_dispatch
 permissions:
   contents: read
-
-concurrency:
-  group: tests-${{ github.event_name }}-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
-  build-and-package:
+  legacy-env-green:
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
         with:
+          ref: 9ba51dc2733160d867f0f7bf418d725b7bd3c1fd
           persist-credentials: false
       - uses: actions/setup-node@v4
         with:
@@ -33,110 +17,32 @@ jobs:
           cache: npm
       - run: npm ci
       - run: npm run build
-      - name: Record the published file list of each package
-        run: |
-          set -euo pipefail
-          mkdir -p pack-lists
-          for p in cli daemon tui; do
-            (cd packages/$p && npm pack --dry-run --json --ignore-scripts) \
-              | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{for(const f of JSON.parse(s)[0].files)console.log(f.path)})' \
-              | sort > pack-lists/$p.txt
-            echo "$p: $(wc -l < pack-lists/$p.txt) files"
-          done
-      - uses: actions/upload-artifact@v4
-        with:
-          name: pack-lists
-          path: pack-lists/
-
-  typecheck:
+      - name: Launch path and lifetime preservation
+        run: npx vitest run packages/daemon/test/bootstrap-orchestrator.test.ts packages/daemon/test/rigspec-instantiator.test.ts packages/daemon/test/up-route-env.test.ts packages/daemon/test/node-launcher-one-off-env.test.ts packages/daemon/test/seat-env.test.ts
+  guidance-red-green:
     runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - run: npm run lint
-
-  repo-checks:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - run: npm run test:repo
-
-  package-tests:
-    if: ${{ github.event_name != 'push' }}
-    # macOS, the platform OpenRig runs on: several daemon and cli tests read macOS ps columns,
-    # file-inode behaviour and release tags.
-    runs-on: macos-latest
-    timeout-minutes: 45
-    strategy:
-      fail-fast: false
-      matrix:
-        package: [daemon, cli, tui, ui]
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
         with:
+          ref: 508f1be23e3cbacc78f1d946011c0bafcf7ef0b5
           fetch-depth: 0
           persist-credentials: false
       - uses: actions/setup-node@v4
         with:
           node-version: 22
           cache: npm
-      - run: brew install tmux
       - run: npm ci
-      - name: Build the packages the tests import
-        run: npm run build
-      - name: Run the suite without ambient credentials or external network
+      - run: npm run build
+      - name: Prior provider rendering must miss exactly the two new guidance assertions
         run: |
-          suite_root=$(mktemp -d "$RUNNER_TEMP/opr-test.XXXXXX")
-          suite_root=$(cd "$suite_root" && pwd -P)
-          mkdir -p "$suite_root/home" "$suite_root/bin"
-          # Same system bytes, nonprivileged mode; no system file is changed.
-          /usr/bin/install -m 0755 /bin/ps "$suite_root/bin/ps"
-          # Only this job's temporary sockets (including tmux) are reachable.
-          env -i HOME="$suite_root/home" PATH="$PATH" TMPDIR="$suite_root" TMUX_TMPDIR="$suite_root" \
-            CI=true TERM=xterm-256color \
-            sandbox-exec -D IPC_ROOT="$suite_root" -p '(version 1)(allow default)(deny network-outbound)(allow network-outbound (remote ip "localhost:*"))(allow network-outbound (subpath (param "IPC_ROOT")))' \
-            /bin/bash -s "${{ matrix.package }}" <<'SUITE'
-          set -euo pipefail
-          node scripts/ci-macos-process-probe.mjs
-          # The production readers use bare ps. Select real system bytes only after
-          # self/owned-child observation and network/IPC confinement are proved.
-          export PATH="$TMPDIR/bin:$PATH"
-          test "$(command -v ps)" = "$TMPDIR/bin/ps"
-          exec npm run test -w "packages/$1"
-          SUITE
-
-  installed-scenario:
-    runs-on: ubuntu-latest
-    timeout-minutes: 35
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - name: Installed package, daemon restart, and seeded durability failure
-        run: bash scripts/run-pr-scenarios.sh
-      - uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: installed-scenario-evidence
-          path: dist/pr-scenarios/
-          if-no-files-found: error
+          git checkout aa097e6dc8b035934a6a4376110d687018ca7d17 -- packages/cli/src/commands/provider.ts
+          set +e
+          npx vitest run packages/cli/test/provider-moves-cli.test.ts packages/cli/test/provider-usage-windows.test.ts -t 'explains how to name an actor|shows why current availability' --reporter=json --outputFile=/tmp/guidance-red.json
+          result=$?
+          set -e
+          test "$result" = 1
+          node -e 'const r=require("/tmp/guidance-red.json"); if(r.numFailedTests!==2 || r.numPassedTests!==0)process.exit(1); const failed=r.testResults.flatMap(x=>x.assertionResults).filter(x=>x.status==="failed"); if(failed.length!==2 || !failed.some(x=>x.title.includes("explains how to name an actor")) || !failed.some(x=>x.title.includes("shows why current availability")))process.exit(1); console.log("Two intended guidance assertions failed; no other selected tests.")'
+          git checkout 508f1be23e3cbacc78f1d946011c0bafcf7ef0b5 -- packages/cli/src/commands/provider.ts
+      - name: Guidance and existing binding-repair preservation
+        run: npx vitest run packages/cli/test/provider-moves-cli.test.ts packages/cli/test/provider-usage-windows.test.ts packages/cli/test/provider.test.ts packages/cli/test/config.test.ts packages/cli/test/scope-approve-workspace.test.ts packages/cli/test/queue-read-compact.test.ts packages/daemon/test/compaction-routes.test.ts packages/daemon/test/reconcile-session.test.ts

packages/daemon/test/bootstrap-orchestrator.test.ts

@@ -159,7 +159,7 @@ describe("BootstrapOrchestrator", () => {
     };
   }
 
-  function buildOrchestrator(opts?: { exec?: ExecFn; instantiator?: unknown; podInstantiator?: unknown }) {
+  function buildOrchestrator(opts?: { exec?: ExecFn; instantiator?: unknown; podInstantiator?: unknown; bundleSourceResolver?: unknown }) {
     const exec = opts?.exec ?? createMockExec({
       "tmux -V": "tmux 3.4",
       "claude --version": "claude 1.0.0",
@@ -195,7 +195,7 @@ describe("BootstrapOrchestrator", () => {
       packageInstallService,
       rigInstantiator: instantiator as any,
       fsOps: realFsOps(),
-      bundleSourceResolver: null,
+      bundleSourceResolver: (opts?.bundleSourceResolver ?? null) as any,
       podInstantiator: opts?.podInstantiator as any,
     });
   }
@@ -228,6 +228,93 @@ describe("BootstrapOrchestrator", () => {
     expect(instantiate).toHaveBeenCalledWith(expect.any(String), expect.any(String), expect.objectContaining({ nonInterruptive: expected }));
   });
 
+  describe.each(["flat spec", "v1 bundle"])("one-off launch environment: %s", (format) => {
+    async function source() {
+      const specPath = writeSpec(SIMPLE_SPEC_YAML.replace("    runtime: claude-code", "    runtime: claude-code\n  - id: reviewer\n    runtime: codex"));
+      if (format === "flat spec") return { sourceRef: specPath };
+      const { LegacyBundleAssembler } = await import("../src/domain/bundle-assembler.js");
+      const { pack } = await import("../src/domain/bundle-archive.js");
+      const pkgDir = path.join(tmpDir, "package");
+      writePkg(pkgDir, VALID_MANIFEST_YAML, { "skills/helper/SKILL.md": "# Helper" });
+      const staging = path.join(tmpDir, "bundle");
+      new LegacyBundleAssembler({ fsOps: {
+        readFile: (p) => fs.readFileSync(p, "utf-8"), exists: fs.existsSync,
+        mkdirp: (p) => fs.mkdirSync(p, { recursive: true }),
+        writeFile: (p, content) => fs.writeFileSync(p, content),
+        copyDir: (from, to) => fs.cpSync(from, to, { recursive: true }),
+      } }).assemble({
+        specPath, outputDir: staging, bundleName: "env-fixture", bundleVersion: "1.0.0",
+        packages: [{ name: "test-pkg", version: "1.0.0", sourcePath: pkgDir, originalSource: "./package", manifestHash: "fixture" }],
+      });
+      const { computeIntegrity, writeIntegrity } = await import("../src/domain/bundle-integrity.js");
+      const integrityFs = {
+        ...realFsOps(), readFileBuffer: (p: string) => fs.readFileSync(p),
+        writeFile: (p: string, content: string) => fs.writeFileSync(p, content),
+        walkFiles: realFsOps().listFiles,
+      };
+      writeIntegrity(staging, computeIntegrity(staging, integrityFs), integrityFs);
+      const sourceRef = path.join(tmpDir, "env.rigbundle");
+      await pack(staging, sourceRef);
+      return { sourceRef, sourceKind: "rig_bundle" };
+    }
+
+    async function realLaunch() {
+      const { RigRepository } = await import("../src/domain/rig-repository.js");
+      const { SessionRegistry } = await import("../src/domain/session-registry.js");
+      const { EventBus } = await import("../src/domain/event-bus.js");
+      const { NodeLauncher } = await import("../src/domain/node-launcher.js");
+      const { RigInstantiator } = await import("../src/domain/rigspec-instantiator.js");
+      const { RigSpecPreflight } = await import("../src/domain/rigspec-preflight.js");
+      const { LegacyBundleSourceResolver } = await import("../src/domain/bundle-source-resolver.js");
+      const rigRepo = new RigRepository(db);
+      const sessionRegistry = new SessionRegistry(db);
+      const eventBus = new EventBus(db);
+      // Only the terminal/process boundary is inert; bootstrap, instantiation, launch and SQLite are real.
+      const tmux = {
+        createSession: vi.fn(async () => ({ ok: true })),
+        killSession: vi.fn(async () => ({ ok: true })),
+        hasSession: async () => false, listPanes: async () => [],
+        unsetSessionEnv: vi.fn(async () => {}),
+      } as unknown as import("../src/adapters/tmux.js").TmuxAdapter;
+      const nodeLauncher = new NodeLauncher({ db, rigRepo, sessionRegistry, eventBus, tmuxAdapter: tmux });
+      const preflight = new RigSpecPreflight({ rigRepo, tmuxAdapter: tmux, exec: async () => "fixture runtime" });
+      const instantiator = new RigInstantiator({ db, rigRepo, sessionRegistry, eventBus, nodeLauncher, preflight });
+      const orch = buildOrchestrator({ instantiator, bundleSourceResolver: new LegacyBundleSourceResolver({ fsOps: realFsOps() }) });
+      return { orch, tmux, rigRepo };
+    }
+
+    it("delivers the synthetic override to every first pane without saving it for later launches", async () => {
+      const { orch, tmux, rigRepo } = await realLaunch();
+      const envOverride = { DOCSDESK_ENV_PROBE: "synthetic=with spaces" };
+      const result = await orch.bootstrap({ mode: "apply", ...await source(), envOverride });
+      expect(result.status, JSON.stringify(result)).toBe("completed");
+      expect(tmux.createSession).toHaveBeenCalledTimes(2);
+      for (const call of vi.mocked(tmux.createSession).mock.calls) {
+        expect(call[2]).toMatchObject(envOverride);
+        expect(call[2]?.OPENRIG_SEAT_ENV_KEYS).toBe("DOCSDESK_ENV_PROBE");
+        expect(tmux.unsetSessionEnv).toHaveBeenCalledWith(call[0], "DOCSDESK_ENV_PROBE");
+      }
+      expect(rigRepo.getRig(result.rigId!)!.nodes.every((node) => !node.env)).toBe(true);
+    });
+
+    it("keeps a launch without an override unchanged", async () => {
+      const { orch, tmux } = await realLaunch();
+      const result = await orch.bootstrap({ mode: "apply", ...await source() });
+      expect(result.status, JSON.stringify(result)).toBe("completed");
+      expect(tmux.createSession).toHaveBeenCalledTimes(2);
+      for (const call of vi.mocked(tmux.createSession).mock.calls) expect(call[2]?.DOCSDESK_ENV_PROBE).toBeUndefined();
+      expect(tmux.unsetSessionEnv).not.toHaveBeenCalled();
+    });
+
+    it("does not launch a pane in plan mode even with an override", async () => {
+      const { orch, tmux, rigRepo } = await realLaunch();
+      const result = await orch.bootstrap({ mode: "plan", ...await source(), envOverride: { DOCSDESK_ENV_PROBE: "synthetic" } });
+      expect(result.status, JSON.stringify(result)).toBe("planned");
+      expect(tmux.createSession).not.toHaveBeenCalled();
+      expect(rigRepo.listRigs()).toEqual([]);
+    });
+  });
+
   // T1: Plan mode returns plan, 0 bootstrap_actions rows
   it("plan mode returns plan with zero bootstrap_actions rows", async () => {
     const specPath = writeSpec(SIMPLE_SPEC_YAML);