From f7c139dd23fde7fcf886bcd8c28729c76978b983 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Tue, 4 Aug 2026 06:55:17 -0500 Subject: [PATCH 01/19] test(DEN-1462): add black-box mise export boundary harness --- scripts/mise_export_boundaries.py | 335 ++++++++++++++++++++++++++++++ 1 file changed, 335 insertions(+) create mode 100644 scripts/mise_export_boundaries.py diff --git a/scripts/mise_export_boundaries.py b/scripts/mise_export_boundaries.py new file mode 100644 index 00000000..d172cae6 --- /dev/null +++ b/scripts/mise_export_boundaries.py @@ -0,0 +1,335 @@ +#!/usr/bin/env python3 +"""Black-box certification for deterministic, conflict-safe mise export.""" + +from __future__ import annotations + +import argparse +import hashlib +import json +import os +import shutil +import subprocess +import sys +from pathlib import Path +from typing import Iterable + + +class HarnessFailure(RuntimeError): + pass + + +def ensure(condition: bool, message: str) -> None: + if not condition: + raise HarnessFailure(message) + + +def write_json(path: Path, value: object) -> None: + path.parent.mkdir(parents=True, exist_ok=True) + path.write_text( + json.dumps(value, indent=2, sort_keys=True) + "\n", + encoding="utf-8", + newline="\n", + ) + + +def sha256(path: Path) -> str: + return hashlib.sha256(path.read_bytes()).hexdigest() + + +def snapshot(root: Path) -> dict[str, str]: + return { + path.relative_to(root).as_posix(): sha256(path) + for path in sorted(root.rglob("*")) + if path.is_file() + } + + +def base_plan() -> dict[str, object]: + return { + "schema": 2, + "tools": { + "node": [ + {"requirement": "22.4.0"}, + {"requirement": "20.15.1"}, + ] + }, + "env": {"APP_ENV": "test", "RETRIES": 3}, + "vars": {"release": {"channel": "stable"}}, + "tasks": { + "prepare": {"run": ["echo prepare"]}, + "setup": { + "description": "Restore dependencies", + "aliases": ["bootstrap"], + "depends": ["prepare"], + "run": ["zed install --frozen", "cargo check"], + }, + }, + "platforms": ["linux-x64", "macos-arm64"], + "activation": "none", + } + + +def run( + zed: Path, + project: Path, + home: Path, + args: Iterable[str], + *, + success: bool, + contains: str | None = None, +) -> subprocess.CompletedProcess[str]: + empty_path = home / "empty-path" + empty_path.mkdir(parents=True, exist_ok=True) + env = os.environ.copy() + env.update( + { + "HOME": str(home), + "USERPROFILE": str(home), + "XDG_CONFIG_HOME": str(home / ".config"), + "ZED_PKG_HOME": str(home / ".zed-pkg"), + "PATH": str(empty_path), + } + ) + for key in ( + "ZED_PKG_ENV_PLAN", + "ZED_PKG_ENV_OUTPUT", + "ZED_PKG_ENV_JSON", + "ZED_PKG_ENV_CHECK", + "ZED_PKG_ENV_WRITE", + "MISE_CONFIG_FILE", + "MISE_TOML", + ): + env.pop(key, None) + + completed = subprocess.run( + [str(zed), *args], + cwd=project, + env=env, + text=True, + capture_output=True, + check=False, + ) + if (completed.returncode == 0) != success: + raise HarnessFailure( + f"unexpected status {completed.returncode} for {list(args)!r}\n" + f"stdout:\n{completed.stdout}\nstderr:\n{completed.stderr}" + ) + if contains is not None: + combined = completed.stdout + "\n" + completed.stderr + ensure(contains in combined, f"missing {contains!r} in:\n{combined}") + return completed + + +def export_args(*extra: str, output: str = ".mise.toml") -> tuple[str, ...]: + return ( + "env", + "export", + "mise", + "--plan", + "zed-env.json", + "--output", + output, + *extra, + ) + + +def certify(zed: Path, root: Path) -> None: + ensure(zed.is_file(), f"missing zed executable: {zed}") + ensure(not root.exists(), f"work root must be fresh: {root}") + root.mkdir(parents=True) + home = root / "home" + home.mkdir() + assertions: list[str] = [] + + project = root / "owned" + project.mkdir() + write_json(project / "zed-env.json", base_plan()) + initial = snapshot(project) + + printed = run(zed, project, home, export_args(), success=True) + ensure("[tools]" in printed.stdout, "print mode did not emit mise TOML") + ensure(snapshot(project) == initial, "print mode mutated project") + assertions.append("print-read-only") + + written = run( + zed, + project, + home, + export_args("--write", "--json"), + success=True, + ) + written_json = json.loads(written.stdout) + ensure(written_json.get("action") == "written", f"unexpected write: {written_json}") + ensure((project / ".mise.toml").is_file(), "write mode omitted output") + ensure( + (project / ".zed/mise-export-state.json").is_file(), + "write mode omitted ownership state", + ) + assertions.append("write-owned") + + checked = run( + zed, + project, + home, + export_args("--check", "--json"), + success=True, + ) + ensure(json.loads(checked.stdout).get("action") == "verified", "check not verified") + assertions.append("check-verified") + + unchanged = run( + zed, + project, + home, + export_args("--write", "--json"), + success=True, + ) + ensure( + json.loads(unchanged.stdout).get("action") == "unchanged", + "idempotent write was not unchanged", + ) + assertions.append("write-idempotent") + + original_output = (project / ".mise.toml").read_bytes() + (project / ".mise.toml").write_text("# hand edit\n", encoding="utf-8") + run(zed, project, home, export_args("--write"), success=False, contains="edited") + ensure((project / ".mise.toml").read_text(encoding="utf-8") == "# hand edit\n", "edited output overwritten") + (project / ".mise.toml").write_bytes(original_output) + assertions.append("edited-output-protected") + + unowned = root / "unowned" + unowned.mkdir() + write_json(unowned / "zed-env.json", base_plan()) + (unowned / ".mise.toml").write_text('[tools]\nnode = "18"\n', encoding="utf-8") + before = snapshot(unowned) + run(zed, unowned, home, export_args("--write"), success=False, contains="hand-authored") + ensure(snapshot(unowned) == before, "unowned output failure mutated project") + assertions.append("unowned-output-protected") + + nested = root / "nested-output" + nested.mkdir() + write_json(nested / "zed-env.json", base_plan()) + run( + zed, + nested, + home, + export_args("--write", output="generated/config/.mise.toml"), + success=True, + ) + ensure((nested / "generated/config/.mise.toml").is_file(), "safe missing parents not created") + assertions.append("safe-parent-creation") + + boundaries = root / "boundaries" + boundaries.mkdir() + write_json(boundaries / "zed-env.json", base_plan()) + original_plan = (boundaries / "zed-env.json").read_bytes() + for output, diagnostic in ( + ("zed-env.json", "cannot overwrite"), + ("ZED-ENV.JSON", "cannot overwrite"), + (".zed/mise-export-state.json", "reserved export state"), + (".ZED/MISE-EXPORT-STATE.JSON", "reserved export state"), + (".zpkg-staging/mise.toml", "reserved transaction staging"), + (".ZPKG-STAGING/mise.toml", "reserved transaction staging"), + ): + run( + zed, + boundaries, + home, + export_args("--write", output=output), + success=False, + contains=diagnostic, + ) + ensure((boundaries / "zed-env.json").read_bytes() == original_plan, f"boundary {output} mutated plan") + assertions.append("portable-reserved-paths") + + nested_secret = root / "nested-secret" + nested_secret.mkdir() + plan = base_plan() + plan["vars"] = {"release": {"api_token": "plaintext"}} + write_json(nested_secret / "zed-env.json", plan) + run( + zed, + nested_secret, + home, + export_args(), + success=False, + contains="vars.release.api_token", + ) + ensure(not (nested_secret / ".mise.toml").exists(), "secret rejection wrote output") + assertions.append("nested-secret-rejected") + + tool_secret = root / "tool-secret" + tool_secret.mkdir() + plan = base_plan() + plan["tools"] = { + "node": [ + { + "requirement": "22.4.0", + "options": {"config": {"password": "plaintext"}}, + } + ] + } + write_json(tool_secret / "zed-env.json", plan) + run( + zed, + tool_secret, + home, + export_args(), + success=False, + contains="tools.node.versions[0].options.config.password", + ) + assertions.append("nested-tool-secret-rejected") + + symlink_case = root / "symlink-state" + symlink_case.mkdir() + write_json(symlink_case / "zed-env.json", base_plan()) + outside = root / "outside-state" + outside.mkdir() + try: + os.symlink(outside, symlink_case / ".zed", target_is_directory=True) + except (OSError, NotImplementedError): + assertions.append("symlink-state-skipped") + else: + run( + zed, + symlink_case, + home, + export_args("--write"), + success=False, + contains="mise export state crosses a symlink", + ) + ensure(not (symlink_case / ".mise.toml").exists(), "symlink failure wrote output") + ensure(not (outside / "mise-export-state.json").exists(), "state escaped project") + assertions.append("symlink-state-rejected") + + print( + json.dumps( + { + "schema": "zed-pkg.mise-export-boundaries.v1", + "certified": True, + "assertions": assertions, + "ambient_mise_required": False, + }, + sort_keys=True, + ) + ) + + +def main() -> int: + parser = argparse.ArgumentParser() + parser.add_argument("--zed", type=Path, required=True) + parser.add_argument("--work-root", type=Path, required=True) + args = parser.parse_args() + try: + certify(args.zed.resolve(), args.work_root.resolve()) + except (HarnessFailure, json.JSONDecodeError) as error: + print(f"mise export boundary certification failed: {error}", file=sys.stderr) + return 1 + finally: + if args.work_root.exists() and os.environ.get("KEEP_MISE_EXPORT_ROOT") != "1": + shutil.rmtree(args.work_root, ignore_errors=True) + return 0 + + +if __name__ == "__main__": + raise SystemExit(main()) From 3d8a3e2a5396e294ea1e24770001a73e88229d5e Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Tue, 4 Aug 2026 06:55:40 -0500 Subject: [PATCH 02/19] docs(DEN-1462): define mise export boundary certification --- docs/mise-export-boundaries.md | 56 ++++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100644 docs/mise-export-boundaries.md diff --git a/docs/mise-export-boundaries.md b/docs/mise-export-boundaries.md new file mode 100644 index 00000000..adbf6ba3 --- /dev/null +++ b/docs/mise-export-boundaries.md @@ -0,0 +1,56 @@ +# mise export boundary certification + +This suite independently certifies deterministic, conflict-safe projection from a Zed `EnvironmentPlanV2` into project-local mise TOML. + +`zed-pkg` is an independent multi-language package manager and is unrelated to the Zed editor. Here, `zed` refers only to the `zed-pkg` CLI. + +## Implementation graph + +- Base exporter: `zed-pkg/zed-cli#113` +- Stacked ownership/security hardening: `zed-pkg/zed-cli#115` +- Independent black-box harness: `scripts/mise_export_boundaries.py` + +The certification workflow will pin the final immutable implementation commit after #115 is merged into the #113 feature branch. It will never follow a mutable branch. + +## Certified behavior + +The harness runs the real CLI with an empty `PATH` and proves: + +- print mode is deterministic and read-only; +- `--write` creates generated TOML plus typed ownership state; +- `--check` verifies exact generated bytes; +- repeated writes are idempotent; +- hand-edited owned files are not overwritten; +- differing unowned files are not adopted or overwritten; +- safe missing output parent directories can be created transactionally; +- output cannot alias its input plan, including case-only aliases relevant to Windows; +- output and input cannot target the reserved export-state path; +- output and input cannot target transaction staging; +- nested secret-like keys in vars and tool options fail with exact field paths; +- symlinked export-state parents cannot redirect state outside the project; and +- no ambient mise executable, global mise configuration, or credentials are required. + +Both successful and failed commands are checked for unintended project mutation. + +## Deliberate boundary + +This certifies deterministic manager configuration export and ownership safety. It does not claim: + +- complete current `mise.lock` export; +- native `EnvironmentLock` translation; +- a general semantic three-way merge for arbitrary hand-authored mise files; +- execution of mise tasks, hooks, templates, plugins, or environment expressions; or +- installation of runtimes. + +The current-lock contract remains DEN-1461. More sophisticated merge planning remains separate follow-up work under DEN-1462. + +## Promotion gate + +Promotion requires: + +1. a full 40-character final CLI pin; +2. Ubuntu 24.04, macOS 15, and Windows Server 2025 success; +3. formatting, focused unit tests, real CLI tests, a locked release build, and all-target Clippy with warnings denied; +4. this black-box harness passing on all platforms, with symlink assertions skipped only where the host cannot create symlinks; +5. ordinary lifecycle, recursive-install, browser, install-boundary, and runtime-mise workflows remaining green; and +6. exact implementation, certification, and merge commits recorded in DEN-1462 and the canonical mise interoperability policy. From 15bda0bc410d452de373894eeb3fc04ac519c912 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 8 Aug 2026 11:59:32 -0500 Subject: [PATCH 03/19] test(DEN-1462): pin reconstructed current-main exporter --- .github/workflows/mise-export-boundaries.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/mise-export-boundaries.yml b/.github/workflows/mise-export-boundaries.yml index 22260a54..d31e2188 100644 --- a/.github/workflows/mise-export-boundaries.yml +++ b/.github/workflows/mise-export-boundaries.yml @@ -9,7 +9,7 @@ on: zed_cli_ref: description: Immutable zed-cli commit to certify required: false - default: c345f58d625eb8b5dbdf312f173d39eb281add25 + default: 9fcd902c1e4c34c95f00dd97950d648cc6aba790 schedule: - cron: "17 5 * * 3" @@ -27,7 +27,7 @@ defaults: env: CARGO_TERM_COLOR: always RUST_BACKTRACE: "1" - ZED_CLI_REF: ${{ github.event.inputs.zed_cli_ref || 'c345f58d625eb8b5dbdf312f173d39eb281add25' }} + ZED_CLI_REF: ${{ github.event.inputs.zed_cli_ref || '9fcd902c1e4c34c95f00dd97950d648cc6aba790' }} jobs: certify: From efc87337e4e343e6748e0ca7d243474c65316936 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 8 Aug 2026 11:59:50 -0500 Subject: [PATCH 04/19] docs(DEN-1462): record reconstructed exporter candidate --- docs/mise-export-boundaries.md | 32 ++++++++++++++++++++++++-------- 1 file changed, 24 insertions(+), 8 deletions(-) diff --git a/docs/mise-export-boundaries.md b/docs/mise-export-boundaries.md index adbf6ba3..9c8d6dff 100644 --- a/docs/mise-export-boundaries.md +++ b/docs/mise-export-boundaries.md @@ -4,13 +4,19 @@ This suite independently certifies deterministic, conflict-safe projection from `zed-pkg` is an independent multi-language package manager and is unrelated to the Zed editor. Here, `zed` refers only to the `zed-pkg` CLI. -## Implementation graph +## Immutable implementation candidate -- Base exporter: `zed-pkg/zed-cli#113` -- Stacked ownership/security hardening: `zed-pkg/zed-cli#115` -- Independent black-box harness: `scripts/mise_export_boundaries.py` +Canonical product PR: `zed-pkg/zed-cli#131`. -The certification workflow will pin the final immutable implementation commit after #115 is merged into the #113 feature branch. It will never follow a mutable branch. +Pinned current-main candidate: + +```text +9fcd902c1e4c34c95f00dd97950d648cc6aba790 +``` + +The product branch was semantically reconstructed on current `main`. Newer task-runtime, tool-profile, GitOps, locking, Nix, and role-auditor behavior remains authoritative. The durable exporter delta is limited to nine source, test, contract, and documentation files; no materializer workflow remains. + +The certification workflow pins the full immutable commit and never follows a mutable branch during a run. ## Certified behavior @@ -32,9 +38,19 @@ The harness runs the real CLI with an empty `PATH` and proves: Both successful and failed commands are checked for unintended project mutation. +## Three-platform gate + +The permanent workflow runs on: + +- Ubuntu 24.04; +- macOS 15; and +- Windows Server 2025. + +Each platform requires formatting, focused exporter unit tests, both real CLI test targets, all-target Clippy with warnings denied, a locked release build, and the black-box harness. An aggregate gate requires every platform to succeed. All ordinary repository-wide E2E workflows remain merge gates on the same certification head. + ## Deliberate boundary -This certifies deterministic manager configuration export and ownership safety. It does not claim: +This certifies deterministic manager-configuration export and ownership safety. It does not claim: - complete current `mise.lock` export; - native `EnvironmentLock` translation; @@ -42,13 +58,13 @@ This certifies deterministic manager configuration export and ownership safety. - execution of mise tasks, hooks, templates, plugins, or environment expressions; or - installation of runtimes. -The current-lock contract remains DEN-1461. More sophisticated merge planning remains separate follow-up work under DEN-1462. +The complete current manager-lock identity contract is separately merged and certified through DEN-1461. More sophisticated manager merge planning and lock-aware round trips remain separate follow-up work under DEN-1462. ## Promotion gate Promotion requires: -1. a full 40-character final CLI pin; +1. the exact product head above remaining the final immutable head of `zed-pkg/zed-cli#131`; 2. Ubuntu 24.04, macOS 15, and Windows Server 2025 success; 3. formatting, focused unit tests, real CLI tests, a locked release build, and all-target Clippy with warnings denied; 4. this black-box harness passing on all platforms, with symlink assertions skipped only where the host cannot create symlinks; From f308a310c141871eec8fa27f00d85fd2756bce0b Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 8 Aug 2026 12:03:13 -0500 Subject: [PATCH 05/19] test(DEN-1462): add exporter ownership-state regressions --- scripts/mise_export_ownership_state.py | 183 +++++++++++++++++++++++++ 1 file changed, 183 insertions(+) create mode 100644 scripts/mise_export_ownership_state.py diff --git a/scripts/mise_export_ownership_state.py b/scripts/mise_export_ownership_state.py new file mode 100644 index 00000000..3f5582e3 --- /dev/null +++ b/scripts/mise_export_ownership_state.py @@ -0,0 +1,183 @@ +#!/usr/bin/env python3 +"""Black-box regressions for Zed-owned mise export state integrity.""" + +from __future__ import annotations + +import argparse +import json +import os +import shutil +import subprocess +import sys +from pathlib import Path +from typing import Iterable + + +class HarnessFailure(RuntimeError): + pass + + +def ensure(condition: bool, message: str) -> None: + if not condition: + raise HarnessFailure(message) + + +def write_plan(path: Path) -> None: + path.write_text( + json.dumps( + { + "schema": 2, + "tools": {"node": [{"requirement": "22.4.0"}]}, + "env": {"APP_ENV": "test"}, + "vars": {}, + "tasks": {}, + "platforms": ["linux-x64", "macos-arm64", "windows-x64"], + "activation": "none", + }, + indent=2, + sort_keys=True, + ) + + "\n", + encoding="utf-8", + newline="\n", + ) + + +def run( + zed: Path, + project: Path, + home: Path, + args: Iterable[str], + *, + success: bool, + contains: str | None = None, +) -> subprocess.CompletedProcess[str]: + empty_path = home / "empty-path" + empty_path.mkdir(parents=True, exist_ok=True) + env = os.environ.copy() + env.update( + { + "HOME": str(home), + "USERPROFILE": str(home), + "XDG_CONFIG_HOME": str(home / ".config"), + "ZED_PKG_HOME": str(home / ".zed-pkg"), + "PATH": str(empty_path), + } + ) + for key in tuple(env): + if key.startswith("ZED_PKG_ENV_") or key in {"MISE_CONFIG_FILE", "MISE_TOML"}: + env.pop(key, None) + + completed = subprocess.run( + [str(zed), *args], + cwd=project, + env=env, + text=True, + capture_output=True, + check=False, + ) + if (completed.returncode == 0) != success: + raise HarnessFailure( + f"unexpected status {completed.returncode} for {list(args)!r}\n" + f"stdout:\n{completed.stdout}\nstderr:\n{completed.stderr}" + ) + if contains is not None: + combined = completed.stdout + "\n" + completed.stderr + ensure(contains in combined, f"missing {contains!r} in:\n{combined}") + return completed + + +def export_args(plan: str) -> tuple[str, ...]: + return ( + "env", + "export", + "mise", + "--plan", + plan, + "--output", + ".mise.toml", + "--write", + "--json", + ) + + +def certify(zed: Path, root: Path) -> None: + ensure(zed.is_file(), f"missing zed executable: {zed}") + ensure(not root.exists(), f"work root must be fresh: {root}") + root.mkdir(parents=True) + home = root / "home" + home.mkdir() + project = root / "project" + project.mkdir() + + write_plan(project / "plan-one.json") + write_plan(project / "plan-two.json") + + first = run(zed, project, home, export_args("plan-one.json"), success=True) + ensure(json.loads(first.stdout).get("action") == "written", "initial export was not written") + + output_path = project / ".mise.toml" + state_path = project / ".zed/mise-export-state.json" + output_before = output_path.read_bytes() + state_before = state_path.read_bytes() + + run( + zed, + project, + home, + export_args("plan-two.json"), + success=False, + contains="change ownership", + ) + ensure(output_path.read_bytes() == output_before, "ownership-transfer failure changed output") + ensure(state_path.read_bytes() == state_before, "ownership-transfer failure changed state") + + state = json.loads(state_before) + record = state["outputs"][".mise.toml"] + record["output_sha256"] = "0" * 64 + corrupted = (json.dumps(state, indent=2, sort_keys=True) + "\n").encode() + state_path.write_bytes(corrupted) + + run( + zed, + project, + home, + export_args("plan-one.json"), + success=False, + contains="export state records sha256", + ) + ensure(output_path.read_bytes() == output_before, "state-corruption failure changed output") + ensure(state_path.read_bytes() == corrupted, "state-corruption failure repaired state silently") + + print( + json.dumps( + { + "schema": "zed-pkg.mise-export-ownership-state.v1", + "certified": True, + "ownership_transfer_rejected": True, + "stale_digest_rejected": True, + "ambient_mise_required": False, + }, + sort_keys=True, + ) + ) + + +def main() -> int: + parser = argparse.ArgumentParser() + parser.add_argument("--zed", type=Path, required=True) + parser.add_argument("--work-root", type=Path, required=True) + args = parser.parse_args() + try: + certify(args.zed.resolve(), args.work_root.resolve()) + except (HarnessFailure, json.JSONDecodeError, KeyError) as error: + print(f"mise export ownership-state certification failed: {error}", file=sys.stderr) + return 1 + finally: + if args.work_root.exists() and os.environ.get("KEEP_MISE_EXPORT_ROOT") != "1": + shutil.rmtree(args.work_root, ignore_errors=True) + return 0 + + +if __name__ == "__main__": + raise SystemExit(main()) From 3bf83b76864954fd95c22049fe7bac92cfad8f34 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 8 Aug 2026 12:06:15 -0500 Subject: [PATCH 06/19] test(DEN-1462): certify exporter ownership-state integrity --- .github/workflows/mise-export-boundaries.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/mise-export-boundaries.yml b/.github/workflows/mise-export-boundaries.yml index d31e2188..f98a1c96 100644 --- a/.github/workflows/mise-export-boundaries.yml +++ b/.github/workflows/mise-export-boundaries.yml @@ -77,7 +77,9 @@ jobs: - name: Run focused exporter tests and strict lint run: | set -euo pipefail - python -m py_compile harness/scripts/mise_export_boundaries.py + python -m py_compile \ + harness/scripts/mise_export_boundaries.py \ + harness/scripts/mise_export_ownership_state.py cargo fmt --all --check --manifest-path zed-cli/Cargo.toml cargo test --locked --manifest-path zed-cli/Cargo.toml mise_export cargo test --locked --manifest-path zed-cli/Cargo.toml --test mise_export_cli @@ -104,6 +106,9 @@ jobs: python harness/scripts/mise_export_boundaries.py \ --zed "$ZED_BIN" \ --work-root "$RUNNER_TEMP/zed-mise-export" + python harness/scripts/mise_export_ownership_state.py \ + --zed "$ZED_BIN" \ + --work-root "$RUNNER_TEMP/zed-mise-export-ownership" - name: Collect failure diagnostics if: failure() @@ -111,7 +116,8 @@ jobs: set +e diagnostics="$RUNNER_TEMP/zed-mise-export-diagnostics" mkdir -p "$diagnostics" - cp -R "$RUNNER_TEMP/zed-mise-export" "$diagnostics/work-root" 2>/dev/null || true + cp -R "$RUNNER_TEMP/zed-mise-export" "$diagnostics/boundaries-work-root" 2>/dev/null || true + cp -R "$RUNNER_TEMP/zed-mise-export-ownership" "$diagnostics/ownership-work-root" 2>/dev/null || true git -C zed-cli status --porcelain=v1 --untracked-files=all \ > "$diagnostics/zed-cli-status.txt" 2>&1 git -C harness status --porcelain=v1 --untracked-files=all \ From a7ab33ac1e391cda49b988152d293e6712ac9ef4 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 8 Aug 2026 12:07:37 -0500 Subject: [PATCH 07/19] docs(DEN-1462): add ownership-state integrity certification --- docs/mise-export-boundaries.md | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-) diff --git a/docs/mise-export-boundaries.md b/docs/mise-export-boundaries.md index 9c8d6dff..3470777f 100644 --- a/docs/mise-export-boundaries.md +++ b/docs/mise-export-boundaries.md @@ -8,19 +8,13 @@ This suite independently certifies deterministic, conflict-safe projection from Canonical product PR: `zed-pkg/zed-cli#131`. -Pinned current-main candidate: +The product branch was semantically reconstructed on current `main`. Newer task-runtime, tool-profile, GitOps, locking, Nix, and role-auditor behavior remains authoritative. The durable exporter delta is limited to nine source, test, contract, and documentation files; no materializer workflow may remain in the final product diff. -```text -9fcd902c1e4c34c95f00dd97950d648cc6aba790 -``` - -The product branch was semantically reconstructed on current `main`. Newer task-runtime, tool-profile, GitOps, locking, Nix, and role-auditor behavior remains authoritative. The durable exporter delta is limited to nine source, test, contract, and documentation files; no materializer workflow remains. - -The certification workflow pins the full immutable commit and never follows a mutable branch during a run. +The certification workflow pins a full immutable product commit and never follows a mutable branch during a run. The pin is advanced whenever the product head changes, including ownership-integrity fixes. ## Certified behavior -The harness runs the real CLI with an empty `PATH` and proves: +The harnesses run the real CLI with an empty `PATH` and prove: - print mode is deterministic and read-only; - `--write` creates generated TOML plus typed ownership state; @@ -28,6 +22,9 @@ The harness runs the real CLI with an empty `PATH` and proves: - repeated writes are idempotent; - hand-edited owned files are not overwritten; - differing unowned files are not adopted or overwritten; +- an existing generated output cannot silently transfer ownership to a different plan, even when both plans currently render byte-identical TOML; +- a stale or corrupted recorded output digest is rejected rather than silently repaired; +- ownership-state failures leave both the generated output and state file unchanged; - safe missing output parent directories can be created transactionally; - output cannot alias its input plan, including case-only aliases relevant to Windows; - output and input cannot target the reserved export-state path; @@ -46,7 +43,7 @@ The permanent workflow runs on: - macOS 15; and - Windows Server 2025. -Each platform requires formatting, focused exporter unit tests, both real CLI test targets, all-target Clippy with warnings denied, a locked release build, and the black-box harness. An aggregate gate requires every platform to succeed. All ordinary repository-wide E2E workflows remain merge gates on the same certification head. +Each platform requires formatting, focused exporter unit tests, both real CLI test targets, all-target Clippy with warnings denied, a locked release build, and both black-box harnesses. An aggregate gate requires every platform to succeed. All ordinary repository-wide E2E workflows remain merge gates on the same certification head. ## Deliberate boundary @@ -64,9 +61,9 @@ The complete current manager-lock identity contract is separately merged and cer Promotion requires: -1. the exact product head above remaining the final immutable head of `zed-pkg/zed-cli#131`; +1. the workflow pin matching the final immutable head of `zed-pkg/zed-cli#131`; 2. Ubuntu 24.04, macOS 15, and Windows Server 2025 success; 3. formatting, focused unit tests, real CLI tests, a locked release build, and all-target Clippy with warnings denied; -4. this black-box harness passing on all platforms, with symlink assertions skipped only where the host cannot create symlinks; +4. both black-box harnesses passing on all platforms, with symlink assertions skipped only where the host cannot create symlinks; 5. ordinary lifecycle, recursive-install, browser, install-boundary, and runtime-mise workflows remaining green; and 6. exact implementation, certification, and merge commits recorded in DEN-1462 and the canonical mise interoperability policy. From 3c2426b5ca5de16ba199f20b0621fb2c292bf9ad Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 8 Aug 2026 12:11:49 -0500 Subject: [PATCH 08/19] test(DEN-1462): reject reserved export-state plan input --- scripts/mise_export_ownership_state.py | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/scripts/mise_export_ownership_state.py b/scripts/mise_export_ownership_state.py index 3f5582e3..94c147aa 100644 --- a/scripts/mise_export_ownership_state.py +++ b/scripts/mise_export_ownership_state.py @@ -23,6 +23,7 @@ def ensure(condition: bool, message: str) -> None: def write_plan(path: Path) -> None: + path.parent.mkdir(parents=True, exist_ok=True) path.write_text( json.dumps( { @@ -107,9 +108,25 @@ def certify(zed: Path, root: Path) -> None: root.mkdir(parents=True) home = root / "home" home.mkdir() + + reserved_project = root / "reserved-source" + reserved_project.mkdir() + reserved_state = reserved_project / ".zed/mise-export-state.json" + write_plan(reserved_state) + reserved_before = reserved_state.read_bytes() + run( + zed, + reserved_project, + home, + export_args(".zed/mise-export-state.json"), + success=False, + contains="environment plan cannot target reserved export state", + ) + ensure(reserved_state.read_bytes() == reserved_before, "reserved source plan was mutated") + ensure(not (reserved_project / ".mise.toml").exists(), "reserved source created output") + project = root / "project" project.mkdir() - write_plan(project / "plan-one.json") write_plan(project / "plan-two.json") @@ -154,6 +171,7 @@ def certify(zed: Path, root: Path) -> None: { "schema": "zed-pkg.mise-export-ownership-state.v1", "certified": True, + "reserved_state_source_rejected": True, "ownership_transfer_rejected": True, "stale_digest_rejected": True, "ambient_mise_required": False, From 8fe53d8875a3db42c27b830bd74334fc2401c422 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 8 Aug 2026 12:40:28 -0500 Subject: [PATCH 09/19] test(DEN-1462): pin public-API-hardened exporter candidate --- .github/workflows/mise-export-boundaries.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/mise-export-boundaries.yml b/.github/workflows/mise-export-boundaries.yml index f98a1c96..9a7d7c6c 100644 --- a/.github/workflows/mise-export-boundaries.yml +++ b/.github/workflows/mise-export-boundaries.yml @@ -9,7 +9,7 @@ on: zed_cli_ref: description: Immutable zed-cli commit to certify required: false - default: 9fcd902c1e4c34c95f00dd97950d648cc6aba790 + default: c21f26c2370a426f36445d13186f540980dd1362 schedule: - cron: "17 5 * * 3" @@ -27,7 +27,7 @@ defaults: env: CARGO_TERM_COLOR: always RUST_BACKTRACE: "1" - ZED_CLI_REF: ${{ github.event.inputs.zed_cli_ref || '9fcd902c1e4c34c95f00dd97950d648cc6aba790' }} + ZED_CLI_REF: ${{ github.event.inputs.zed_cli_ref || 'c21f26c2370a426f36445d13186f540980dd1362' }} jobs: certify: @@ -82,6 +82,7 @@ jobs: harness/scripts/mise_export_ownership_state.py cargo fmt --all --check --manifest-path zed-cli/Cargo.toml cargo test --locked --manifest-path zed-cli/Cargo.toml mise_export + cargo test --locked --manifest-path zed-cli/Cargo.toml --test mise_export_api_boundaries cargo test --locked --manifest-path zed-cli/Cargo.toml --test mise_export_cli cargo test --locked --manifest-path zed-cli/Cargo.toml --test mise_export_reserved_paths_cli cargo clippy --locked --manifest-path zed-cli/Cargo.toml --all-targets -- -D warnings From 62d6c932466b165a2a161682e355a98f77faf63e Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 8 Aug 2026 12:41:35 -0500 Subject: [PATCH 10/19] docs(DEN-1462): pin public-API-hardened exporter --- docs/mise-export-boundaries.md | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/docs/mise-export-boundaries.md b/docs/mise-export-boundaries.md index 3470777f..58d8a890 100644 --- a/docs/mise-export-boundaries.md +++ b/docs/mise-export-boundaries.md @@ -8,9 +8,17 @@ This suite independently certifies deterministic, conflict-safe projection from Canonical product PR: `zed-pkg/zed-cli#131`. -The product branch was semantically reconstructed on current `main`. Newer task-runtime, tool-profile, GitOps, locking, Nix, and role-auditor behavior remains authoritative. The durable exporter delta is limited to nine source, test, contract, and documentation files; no materializer workflow may remain in the final product diff. +Pinned product head: -The certification workflow pins a full immutable product commit and never follows a mutable branch during a run. The pin is advanced whenever the product head changes, including ownership-integrity fixes. +```text +c21f26c2370a426f36445d13186f540980dd1362 +``` + +The product branch was semantically reconstructed on current `main`. Newer task-runtime, tool-profile, GitOps, locking, Nix, and role-auditor behavior remains authoritative. The durable exporter delta contains ten source, test, contract, and documentation files; no materializer workflow remains in the product diff. + +The public Rust API now enforces the reserved exporter-state source boundary before delegating to the implementation. This protects the CLI, external Rust callers, portable case aliases, and in-project symlink aliases through one shared guard. + +The certification workflow pins the full immutable product commit above and never follows a mutable branch during a run. ## Certified behavior @@ -25,6 +33,8 @@ The harnesses run the real CLI with an empty `PATH` and prove: - an existing generated output cannot silently transfer ownership to a different plan, even when both plans currently render byte-identical TOML; - a stale or corrupted recorded output digest is rejected rather than silently repaired; - ownership-state failures leave both the generated output and state file unchanged; +- the public Rust API and real CLI reject the reserved exporter-state file as the plan source; +- the public API rejects a symlink to the reserved exporter-state file on Unix; - safe missing output parent directories can be created transactionally; - output cannot alias its input plan, including case-only aliases relevant to Windows; - output and input cannot target the reserved export-state path; @@ -43,7 +53,7 @@ The permanent workflow runs on: - macOS 15; and - Windows Server 2025. -Each platform requires formatting, focused exporter unit tests, both real CLI test targets, all-target Clippy with warnings denied, a locked release build, and both black-box harnesses. An aggregate gate requires every platform to succeed. All ordinary repository-wide E2E workflows remain merge gates on the same certification head. +Each platform requires formatting, focused exporter unit tests, the public-API boundary target, both real CLI test targets, all-target Clippy with warnings denied, a locked release build, and both black-box harnesses. An aggregate gate requires every platform to succeed. All ordinary repository-wide E2E workflows remain merge gates on the same certification head. ## Deliberate boundary @@ -61,9 +71,9 @@ The complete current manager-lock identity contract is separately merged and cer Promotion requires: -1. the workflow pin matching the final immutable head of `zed-pkg/zed-cli#131`; +1. the workflow pin matching final immutable head `c21f26c2370a426f36445d13186f540980dd1362` of `zed-pkg/zed-cli#131`; 2. Ubuntu 24.04, macOS 15, and Windows Server 2025 success; -3. formatting, focused unit tests, real CLI tests, a locked release build, and all-target Clippy with warnings denied; +3. formatting, focused unit tests, the public API target, real CLI tests, a locked release build, and all-target Clippy with warnings denied; 4. both black-box harnesses passing on all platforms, with symlink assertions skipped only where the host cannot create symlinks; 5. ordinary lifecycle, recursive-install, browser, install-boundary, and runtime-mise workflows remaining green; and 6. exact implementation, certification, and merge commits recorded in DEN-1462 and the canonical mise interoperability policy. From 0e04c590871b924793895b991b7179cd5e67099c Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 8 Aug 2026 12:51:20 -0500 Subject: [PATCH 11/19] test(DEN-1462): pin current-main merge candidate --- .github/workflows/mise-export-boundaries.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/mise-export-boundaries.yml b/.github/workflows/mise-export-boundaries.yml index 9a7d7c6c..31fd5910 100644 --- a/.github/workflows/mise-export-boundaries.yml +++ b/.github/workflows/mise-export-boundaries.yml @@ -9,7 +9,7 @@ on: zed_cli_ref: description: Immutable zed-cli commit to certify required: false - default: c21f26c2370a426f36445d13186f540980dd1362 + default: 50edd5cf5c7ff0960e312d50c172a75529e390ea schedule: - cron: "17 5 * * 3" @@ -27,7 +27,7 @@ defaults: env: CARGO_TERM_COLOR: always RUST_BACKTRACE: "1" - ZED_CLI_REF: ${{ github.event.inputs.zed_cli_ref || 'c21f26c2370a426f36445d13186f540980dd1362' }} + ZED_CLI_REF: ${{ github.event.inputs.zed_cli_ref || '50edd5cf5c7ff0960e312d50c172a75529e390ea' }} jobs: certify: From 6e13ff4916868394d93a06a4a28b410c3f814d05 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 8 Aug 2026 12:51:53 -0500 Subject: [PATCH 12/19] docs(DEN-1462): pin current-main exporter merge --- docs/mise-export-boundaries.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/mise-export-boundaries.md b/docs/mise-export-boundaries.md index 58d8a890..186dff8c 100644 --- a/docs/mise-export-boundaries.md +++ b/docs/mise-export-boundaries.md @@ -11,14 +11,14 @@ Canonical product PR: `zed-pkg/zed-cli#131`. Pinned product head: ```text -c21f26c2370a426f36445d13186f540980dd1362 +50edd5cf5c7ff0960e312d50c172a75529e390ea ``` -The product branch was semantically reconstructed on current `main`. Newer task-runtime, tool-profile, GitOps, locking, Nix, and role-auditor behavior remains authoritative. The durable exporter delta contains ten source, test, contract, and documentation files; no materializer workflow remains in the product diff. +The product branch was semantically reconstructed on current `main` and then merged with main head `0ecd5b00cdd4c5df66824bd9ffdeb079b592a651`. The intervening main-only changes were confined to `docs/publish-ignore.md` and `src/ops_entry.rs`; their exact reviewed blobs are preserved unchanged. The exporter remains a ten-file source, test, contract, and documentation delta with no materializer workflow. -The public Rust API now enforces the reserved exporter-state source boundary before delegating to the implementation. This protects the CLI, external Rust callers, portable case aliases, and in-project symlink aliases through one shared guard. +The public Rust API enforces the reserved exporter-state source boundary before delegating to the implementation. This protects the CLI, external Rust callers, portable case aliases, and in-project symlink aliases through one shared guard. -The certification workflow pins the full immutable product commit above and never follows a mutable branch during a run. +The certification workflow pins the full immutable product merge above and never follows a mutable branch during a run. ## Certified behavior @@ -71,7 +71,7 @@ The complete current manager-lock identity contract is separately merged and cer Promotion requires: -1. the workflow pin matching final immutable head `c21f26c2370a426f36445d13186f540980dd1362` of `zed-pkg/zed-cli#131`; +1. the workflow pin matching final immutable head `50edd5cf5c7ff0960e312d50c172a75529e390ea` of `zed-pkg/zed-cli#131`; 2. Ubuntu 24.04, macOS 15, and Windows Server 2025 success; 3. formatting, focused unit tests, the public API target, real CLI tests, a locked release build, and all-target Clippy with warnings denied; 4. both black-box harnesses passing on all platforms, with symlink assertions skipped only where the host cannot create symlinks; From 1b079e97e87f5eb66e2b542ebe9758b7abb25e68 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 8 Aug 2026 12:59:32 -0500 Subject: [PATCH 13/19] test(DEN-1462): pin rustfmt-correct exporter head --- .github/workflows/mise-export-boundaries.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/mise-export-boundaries.yml b/.github/workflows/mise-export-boundaries.yml index 31fd5910..87d8ac74 100644 --- a/.github/workflows/mise-export-boundaries.yml +++ b/.github/workflows/mise-export-boundaries.yml @@ -9,7 +9,7 @@ on: zed_cli_ref: description: Immutable zed-cli commit to certify required: false - default: 50edd5cf5c7ff0960e312d50c172a75529e390ea + default: e08910e86880fdc7f729daebec28b8f79c477508 schedule: - cron: "17 5 * * 3" @@ -27,7 +27,7 @@ defaults: env: CARGO_TERM_COLOR: always RUST_BACKTRACE: "1" - ZED_CLI_REF: ${{ github.event.inputs.zed_cli_ref || '50edd5cf5c7ff0960e312d50c172a75529e390ea' }} + ZED_CLI_REF: ${{ github.event.inputs.zed_cli_ref || 'e08910e86880fdc7f729daebec28b8f79c477508' }} jobs: certify: From 29242d15f1b1344e6022228aa641a2dceea95b62 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 8 Aug 2026 13:00:08 -0500 Subject: [PATCH 14/19] docs(DEN-1462): pin rustfmt-correct exporter candidate --- docs/mise-export-boundaries.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/mise-export-boundaries.md b/docs/mise-export-boundaries.md index 186dff8c..215a1aa1 100644 --- a/docs/mise-export-boundaries.md +++ b/docs/mise-export-boundaries.md @@ -11,14 +11,14 @@ Canonical product PR: `zed-pkg/zed-cli#131`. Pinned product head: ```text -50edd5cf5c7ff0960e312d50c172a75529e390ea +e08910e86880fdc7f729daebec28b8f79c477508 ``` The product branch was semantically reconstructed on current `main` and then merged with main head `0ecd5b00cdd4c5df66824bd9ffdeb079b592a651`. The intervening main-only changes were confined to `docs/publish-ignore.md` and `src/ops_entry.rs`; their exact reviewed blobs are preserved unchanged. The exporter remains a ten-file source, test, contract, and documentation delta with no materializer workflow. The public Rust API enforces the reserved exporter-state source boundary before delegating to the implementation. This protects the CLI, external Rust callers, portable case aliases, and in-project symlink aliases through one shared guard. -The certification workflow pins the full immutable product merge above and never follows a mutable branch during a run. +The certification workflow pins the full immutable product head above and never follows a mutable branch during a run. The previous candidate failed only the formatting gate in the new real-CLI regression; this head contains the exact rustfmt output and no semantic change. ## Certified behavior @@ -71,7 +71,7 @@ The complete current manager-lock identity contract is separately merged and cer Promotion requires: -1. the workflow pin matching final immutable head `50edd5cf5c7ff0960e312d50c172a75529e390ea` of `zed-pkg/zed-cli#131`; +1. the workflow pin matching final immutable head `e08910e86880fdc7f729daebec28b8f79c477508` of `zed-pkg/zed-cli#131`; 2. Ubuntu 24.04, macOS 15, and Windows Server 2025 success; 3. formatting, focused unit tests, the public API target, real CLI tests, a locked release build, and all-target Clippy with warnings denied; 4. both black-box harnesses passing on all platforms, with symlink assertions skipped only where the host cannot create symlinks; From 15b4abacc2e552e664b7213d7e149e320097df6b Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 8 Aug 2026 13:37:12 -0500 Subject: [PATCH 15/19] test(DEN-1462): pin final current-main exporter head --- .github/workflows/mise-export-boundaries.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/mise-export-boundaries.yml b/.github/workflows/mise-export-boundaries.yml index 87d8ac74..381a85f9 100644 --- a/.github/workflows/mise-export-boundaries.yml +++ b/.github/workflows/mise-export-boundaries.yml @@ -9,7 +9,7 @@ on: zed_cli_ref: description: Immutable zed-cli commit to certify required: false - default: e08910e86880fdc7f729daebec28b8f79c477508 + default: 7c5445b2cd15a503c8004da98cac31451ea2f1d4 schedule: - cron: "17 5 * * 3" @@ -27,7 +27,7 @@ defaults: env: CARGO_TERM_COLOR: always RUST_BACKTRACE: "1" - ZED_CLI_REF: ${{ github.event.inputs.zed_cli_ref || 'e08910e86880fdc7f729daebec28b8f79c477508' }} + ZED_CLI_REF: ${{ github.event.inputs.zed_cli_ref || '7c5445b2cd15a503c8004da98cac31451ea2f1d4' }} jobs: certify: From d24eb439a2e3e93afffb830bcf54628b198a7733 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 8 Aug 2026 13:37:35 -0500 Subject: [PATCH 16/19] docs(DEN-1462): record final current-main exporter head --- docs/mise-export-boundaries.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/mise-export-boundaries.md b/docs/mise-export-boundaries.md index 215a1aa1..67ac5bda 100644 --- a/docs/mise-export-boundaries.md +++ b/docs/mise-export-boundaries.md @@ -11,14 +11,14 @@ Canonical product PR: `zed-pkg/zed-cli#131`. Pinned product head: ```text -e08910e86880fdc7f729daebec28b8f79c477508 +7c5445b2cd15a503c8004da98cac31451ea2f1d4 ``` -The product branch was semantically reconstructed on current `main` and then merged with main head `0ecd5b00cdd4c5df66824bd9ffdeb079b592a651`. The intervening main-only changes were confined to `docs/publish-ignore.md` and `src/ops_entry.rs`; their exact reviewed blobs are preserved unchanged. The exporter remains a ten-file source, test, contract, and documentation delta with no materializer workflow. +The product branch was semantically merged with current `main` head `5d1d13119be5784f545a7d812cdfaae3ca120693`. Current submodule CLI and project-lock behavior were adopted verbatim; `src/main.rs` was composed by extracting the already-tested exporter import and dispatch arms into the current main-line recovery and locking flow. The exporter remains a ten-file source, test, contract, and documentation delta with no materializer or synchronization workflow. The public Rust API enforces the reserved exporter-state source boundary before delegating to the implementation. This protects the CLI, external Rust callers, portable case aliases, and in-project symlink aliases through one shared guard. -The certification workflow pins the full immutable product head above and never follows a mutable branch during a run. The previous candidate failed only the formatting gate in the new real-CLI regression; this head contains the exact rustfmt output and no semantic change. +The certification workflow pins the full immutable product head above and never follows a mutable branch during a run. ## Certified behavior @@ -71,7 +71,7 @@ The complete current manager-lock identity contract is separately merged and cer Promotion requires: -1. the workflow pin matching final immutable head `e08910e86880fdc7f729daebec28b8f79c477508` of `zed-pkg/zed-cli#131`; +1. the workflow pin matching final immutable head `7c5445b2cd15a503c8004da98cac31451ea2f1d4` of `zed-pkg/zed-cli#131`; 2. Ubuntu 24.04, macOS 15, and Windows Server 2025 success; 3. formatting, focused unit tests, the public API target, real CLI tests, a locked release build, and all-target Clippy with warnings denied; 4. both black-box harnesses passing on all platforms, with symlink assertions skipped only where the host cannot create symlinks; From 3b4c3f23f895771931e01478594d41eecbb6875a Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 8 Aug 2026 16:19:29 -0500 Subject: [PATCH 17/19] test(DEN-1462): repin mise export certification to clean current head --- .github/workflows/mise-export-boundaries.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/mise-export-boundaries.yml b/.github/workflows/mise-export-boundaries.yml index 381a85f9..22a99bf9 100644 --- a/.github/workflows/mise-export-boundaries.yml +++ b/.github/workflows/mise-export-boundaries.yml @@ -9,7 +9,7 @@ on: zed_cli_ref: description: Immutable zed-cli commit to certify required: false - default: 7c5445b2cd15a503c8004da98cac31451ea2f1d4 + default: c0040b4848cc8b95a168c2acf47eac82d1929d31 schedule: - cron: "17 5 * * 3" @@ -27,7 +27,7 @@ defaults: env: CARGO_TERM_COLOR: always RUST_BACKTRACE: "1" - ZED_CLI_REF: ${{ github.event.inputs.zed_cli_ref || '7c5445b2cd15a503c8004da98cac31451ea2f1d4' }} + ZED_CLI_REF: ${{ github.event.inputs.zed_cli_ref || 'c0040b4848cc8b95a168c2acf47eac82d1929d31' }} jobs: certify: From e570cbaadd5724ba981447d7408521f7ada3fa1c Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 8 Aug 2026 16:57:08 -0500 Subject: [PATCH 18/19] test(DEN-1462): certify checkout-owned recovery head --- .github/workflows/mise-export-boundaries.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/mise-export-boundaries.yml b/.github/workflows/mise-export-boundaries.yml index 22a99bf9..80cd90ac 100644 --- a/.github/workflows/mise-export-boundaries.yml +++ b/.github/workflows/mise-export-boundaries.yml @@ -9,7 +9,7 @@ on: zed_cli_ref: description: Immutable zed-cli commit to certify required: false - default: c0040b4848cc8b95a168c2acf47eac82d1929d31 + default: 5ad549c544276a713dd5de353f6fbe8ddd4b53d7 schedule: - cron: "17 5 * * 3" @@ -27,7 +27,7 @@ defaults: env: CARGO_TERM_COLOR: always RUST_BACKTRACE: "1" - ZED_CLI_REF: ${{ github.event.inputs.zed_cli_ref || 'c0040b4848cc8b95a168c2acf47eac82d1929d31' }} + ZED_CLI_REF: ${{ github.event.inputs.zed_cli_ref || '5ad549c544276a713dd5de353f6fbe8ddd4b53d7' }} jobs: certify: From f6f14dbefe4262f59ba0aaa33275baca22484dc2 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 8 Aug 2026 17:07:23 -0500 Subject: [PATCH 19/19] test(DEN-1462): ignore only the deliberate operation rendezvous --- scripts/mise_export_boundaries.py | 44 ++++++++++++++++++++++++++++--- 1 file changed, 40 insertions(+), 4 deletions(-) diff --git a/scripts/mise_export_boundaries.py b/scripts/mise_export_boundaries.py index d172cae6..5245062a 100644 --- a/scripts/mise_export_boundaries.py +++ b/scripts/mise_export_boundaries.py @@ -44,6 +44,31 @@ def snapshot(root: Path) -> dict[str, str]: } +def snapshot_without_operation_rendezvous(root: Path) -> dict[str, str]: + """Snapshot semantic project state while validating the lock separately.""" + relative_lock = Path(".zed/operation.lock") + return { + relative: digest + for relative, digest in snapshot(root).items() + if Path(relative) != relative_lock + } + + +def assert_regular_operation_rendezvous(root: Path) -> None: + operation_lock = root / ".zed/operation.lock" + ensure(operation_lock.is_file(), "mutation did not retain the operation rendezvous") + ensure(not operation_lock.is_symlink(), "operation rendezvous is a symlink") + unexpected = [ + path.relative_to(root).as_posix() + for path in sorted((root / ".zed").rglob("*")) + if path != operation_lock + ] + ensure( + not unexpected, + f"failed mutation left native adapter state: {unexpected!r}", + ) + + def base_plan() -> dict[str, object]: return { "schema": 2, @@ -193,7 +218,10 @@ def certify(zed: Path, root: Path) -> None: original_output = (project / ".mise.toml").read_bytes() (project / ".mise.toml").write_text("# hand edit\n", encoding="utf-8") run(zed, project, home, export_args("--write"), success=False, contains="edited") - ensure((project / ".mise.toml").read_text(encoding="utf-8") == "# hand edit\n", "edited output overwritten") + ensure( + (project / ".mise.toml").read_text(encoding="utf-8") == "# hand edit\n", + "edited output overwritten", + ) (project / ".mise.toml").write_bytes(original_output) assertions.append("edited-output-protected") @@ -201,10 +229,15 @@ def certify(zed: Path, root: Path) -> None: unowned.mkdir() write_json(unowned / "zed-env.json", base_plan()) (unowned / ".mise.toml").write_text('[tools]\nnode = "18"\n', encoding="utf-8") - before = snapshot(unowned) + before = snapshot_without_operation_rendezvous(unowned) run(zed, unowned, home, export_args("--write"), success=False, contains="hand-authored") - ensure(snapshot(unowned) == before, "unowned output failure mutated project") + assert_regular_operation_rendezvous(unowned) + ensure( + snapshot_without_operation_rendezvous(unowned) == before, + "unowned output failure mutated semantic project state", + ) assertions.append("unowned-output-protected") + assertions.append("operation-rendezvous-nonsemantic") nested = root / "nested-output" nested.mkdir() @@ -239,7 +272,10 @@ def certify(zed: Path, root: Path) -> None: success=False, contains=diagnostic, ) - ensure((boundaries / "zed-env.json").read_bytes() == original_plan, f"boundary {output} mutated plan") + ensure( + (boundaries / "zed-env.json").read_bytes() == original_plan, + f"boundary {output} mutated plan", + ) assertions.append("portable-reserved-paths") nested_secret = root / "nested-secret"