test(DEN-1462): certify mise export ownership and secret boundaries

.github/workflows/mise-export-boundaries.yml

@@ -0,0 +1,153 @@
+name: mise export boundaries
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      zed_cli_ref:
+        description: Immutable zed-cli commit to certify
+        required: false
+        default: 5ad549c544276a713dd5de353f6fbe8ddd4b53d7
+  schedule:
+    - cron: "17 5 * * 3"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: mise-export-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+env:
+  CARGO_TERM_COLOR: always
+  RUST_BACKTRACE: "1"
+  ZED_CLI_REF: ${{ github.event.inputs.zed_cli_ref || '5ad549c544276a713dd5de353f6fbe8ddd4b53d7' }}
+
+jobs:
+  certify:
+    name: export / ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-24.04
+          - macos-15
+          - windows-2025
+    steps:
+      - name: Require an immutable CLI pin
+        run: |
+          set -euo pipefail
+          [[ "$ZED_CLI_REF" =~ ^[0-9a-f]{40}$ ]]
+
+      - name: Check out certification harness
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          path: harness
+          fetch-depth: 1
+          persist-credentials: false
+          show-progress: false
+
+      - name: Check out immutable zed CLI
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: zed-pkg/zed-cli
+          ref: ${{ env.ZED_CLI_REF }}
+          path: zed-cli
+          fetch-depth: 1
+          persist-credentials: false
+          show-progress: false
+
+      - name: Install validation toolchain
+        run: |
+          set -euo pipefail
+          rustup toolchain install stable --profile minimal --component rustfmt,clippy
+          rustup default stable
+          rustc --version --verbose
+          cargo --version --verbose
+          python --version
+
+      - name: Run focused exporter tests and strict lint
+        run: |
+          set -euo pipefail
+          python -m py_compile \
+            harness/scripts/mise_export_boundaries.py \
+            harness/scripts/mise_export_ownership_state.py
+          cargo fmt --all --check --manifest-path zed-cli/Cargo.toml
+          cargo test --locked --manifest-path zed-cli/Cargo.toml mise_export
+          cargo test --locked --manifest-path zed-cli/Cargo.toml --test mise_export_api_boundaries
+          cargo test --locked --manifest-path zed-cli/Cargo.toml --test mise_export_cli
+          cargo test --locked --manifest-path zed-cli/Cargo.toml --test mise_export_reserved_paths_cli
+          cargo clippy --locked --manifest-path zed-cli/Cargo.toml --all-targets -- -D warnings
+
+      - name: Build immutable release CLI
+        run: |
+          set -euo pipefail
+          cargo build --locked --release --manifest-path zed-cli/Cargo.toml --bin zed
+          if [[ "$RUNNER_OS" == "Windows" ]]; then
+            test -f zed-cli/target/release/zed.exe
+          else
+            test -x zed-cli/target/release/zed
+          fi
+
+      - name: Certify ownership, conflict, secret, and path boundaries
+        run: |
+          set -euo pipefail
+          ZED_BIN="$PWD/zed-cli/target/release/zed"
+          if [[ "$RUNNER_OS" == "Windows" ]]; then
+            ZED_BIN="${ZED_BIN}.exe"
+          fi
+          python harness/scripts/mise_export_boundaries.py \
+            --zed "$ZED_BIN" \
+            --work-root "$RUNNER_TEMP/zed-mise-export"
+          python harness/scripts/mise_export_ownership_state.py \
+            --zed "$ZED_BIN" \
+            --work-root "$RUNNER_TEMP/zed-mise-export-ownership"
+
+      - name: Collect failure diagnostics
+        if: failure()
+        run: |
+          set +e
+          diagnostics="$RUNNER_TEMP/zed-mise-export-diagnostics"
+          mkdir -p "$diagnostics"
+          cp -R "$RUNNER_TEMP/zed-mise-export" "$diagnostics/boundaries-work-root" 2>/dev/null || true
+          cp -R "$RUNNER_TEMP/zed-mise-export-ownership" "$diagnostics/ownership-work-root" 2>/dev/null || true
+          git -C zed-cli status --porcelain=v1 --untracked-files=all \
+            > "$diagnostics/zed-cli-status.txt" 2>&1
+          git -C harness status --porcelain=v1 --untracked-files=all \
+            > "$diagnostics/harness-status.txt" 2>&1
+          rustc --version --verbose > "$diagnostics/rust-version.txt" 2>&1
+          cargo --version --verbose > "$diagnostics/cargo-version.txt" 2>&1
+          python --version > "$diagnostics/python-version.txt" 2>&1
+
+      - name: Upload failure diagnostics
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: mise-export-${{ matrix.os }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/zed-mise-export-diagnostics
+          if-no-files-found: warn
+          retention-days: 14
+          include-hidden-files: true
+
+  gate:
+    name: All mise export platforms passed
+    if: always()
+    needs: certify
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - name: Enforce aggregate result
+        env:
+          MATRIX_RESULT: ${{ needs.certify.result }}
+        run: |
+          set -euo pipefail
+          printf 'mise-export=%s\n' "$MATRIX_RESULT"
+          test "$MATRIX_RESULT" = success

docs/mise-export-boundaries.md

@@ -0,0 +1,79 @@
+# mise export boundary certification
+
+This suite independently certifies deterministic, conflict-safe projection from a Zed `EnvironmentPlanV2` into project-local mise TOML.
+
+`zed-pkg` is an independent multi-language package manager and is unrelated to the Zed editor. Here, `zed` refers only to the `zed-pkg` CLI.
+
+## Immutable implementation candidate
+
+Canonical product PR: `zed-pkg/zed-cli#131`.
+
+Pinned product head:
+
+```text
+7c5445b2cd15a503c8004da98cac31451ea2f1d4
+```
+
+The product branch was semantically merged with current `main` head `5d1d13119be5784f545a7d812cdfaae3ca120693`. Current submodule CLI and project-lock behavior were adopted verbatim; `src/main.rs` was composed by extracting the already-tested exporter import and dispatch arms into the current main-line recovery and locking flow. The exporter remains a ten-file source, test, contract, and documentation delta with no materializer or synchronization workflow.
+
+The public Rust API enforces the reserved exporter-state source boundary before delegating to the implementation. This protects the CLI, external Rust callers, portable case aliases, and in-project symlink aliases through one shared guard.
+
+The certification workflow pins the full immutable product head above and never follows a mutable branch during a run.
+
+## Certified behavior
+
+The harnesses run the real CLI with an empty `PATH` and prove:
+
+- print mode is deterministic and read-only;
+- `--write` creates generated TOML plus typed ownership state;
+- `--check` verifies exact generated bytes;
+- repeated writes are idempotent;
+- hand-edited owned files are not overwritten;
+- differing unowned files are not adopted or overwritten;
+- an existing generated output cannot silently transfer ownership to a different plan, even when both plans currently render byte-identical TOML;
+- a stale or corrupted recorded output digest is rejected rather than silently repaired;
+- ownership-state failures leave both the generated output and state file unchanged;
+- the public Rust API and real CLI reject the reserved exporter-state file as the plan source;
+- the public API rejects a symlink to the reserved exporter-state file on Unix;
+- safe missing output parent directories can be created transactionally;
+- output cannot alias its input plan, including case-only aliases relevant to Windows;
+- output and input cannot target the reserved export-state path;
+- output and input cannot target transaction staging;
+- nested secret-like keys in vars and tool options fail with exact field paths;
+- symlinked export-state parents cannot redirect state outside the project; and
+- no ambient mise executable, global mise configuration, or credentials are required.
+
+Both successful and failed commands are checked for unintended project mutation.
+
+## Three-platform gate
+
+The permanent workflow runs on:
+
+- Ubuntu 24.04;
+- macOS 15; and
+- Windows Server 2025.
+
+Each platform requires formatting, focused exporter unit tests, the public-API boundary target, both real CLI test targets, all-target Clippy with warnings denied, a locked release build, and both black-box harnesses. An aggregate gate requires every platform to succeed. All ordinary repository-wide E2E workflows remain merge gates on the same certification head.
+
+## Deliberate boundary
+
+This certifies deterministic manager-configuration export and ownership safety. It does not claim:
+
+- complete current `mise.lock` export;
+- native `EnvironmentLock` translation;
+- a general semantic three-way merge for arbitrary hand-authored mise files;
+- execution of mise tasks, hooks, templates, plugins, or environment expressions; or
+- installation of runtimes.
+
+The complete current manager-lock identity contract is separately merged and certified through DEN-1461. More sophisticated manager merge planning and lock-aware round trips remain separate follow-up work under DEN-1462.
+
+## Promotion gate
+
+Promotion requires:
+
+1. the workflow pin matching final immutable head `7c5445b2cd15a503c8004da98cac31451ea2f1d4` of `zed-pkg/zed-cli#131`;
+2. Ubuntu 24.04, macOS 15, and Windows Server 2025 success;
+3. formatting, focused unit tests, the public API target, real CLI tests, a locked release build, and all-target Clippy with warnings denied;
+4. both black-box harnesses passing on all platforms, with symlink assertions skipped only where the host cannot create symlinks;
+5. ordinary lifecycle, recursive-install, browser, install-boundary, and runtime-mise workflows remaining green; and
+6. exact implementation, certification, and merge commits recorded in DEN-1462 and the canonical mise interoperability policy.