The full locked CI build stopped in build.rs before reaching CASS tests:
its exact FAD feature contract omitted copilot-vscdb and openclaw-sqlite,
which Cargo.toml intentionally enables for SQLite transcript ingestion.
Admit both existing features without weakening equality, changing sources,
or removing connector functionality.
Add a dependency-free feature preflight and six regression tests so this
class of drift is caught before compiling the dependency graph. Add a
read-only main-push CI job running the actual locked artifact lifecycle,
approval, recovery binary and separate-process CLI suites; require nonzero
executed tests and preserve the full production dependency graph.
Validation: six Python tests passed; YAML parsing and embedded bash syntax
checked; original and uploaded Git blobs verified; diff whitespace clean.
Rust/cargo unavailable locally. Compilation and recovery test execution
remain unverified until the dedicated CI job completes.
A shared UBS module cache can be replaced by another pinned invocation
while this gate is scanning. Always copy or download the pinned runner
into a private temp directory, pass --module-dir there, and fail if
cd into PROJECT_ROOT fails. The dpfvr e2e script now also fails closed
on those cd steps.
Inherited subprocess output from a lib test that self-spawns appears
between the outer `running N tests` line and that binary's final
summary. The previous counter treated every `running` / `test result:
ok` pair as a top-level binary, so a nested child either inflated
PASSED/BINARIES or flagged a complete parent as incomplete.
Track announcement depth: count a binary only when depth returns to
zero, require the ok-summary's passed+failed+ignored+measured to match
the announced count, and treat any other `test result:` line (including
FAILED or a truncated parent) as incomplete.
The dpfvr e2e harness now covers nested children counted once,
deep nesting across two binaries, a completed child with a truncated
parent, a parent closing a missing child, nested empty/failed children,
announced-vs-accounted mismatches, ignored+measured still totaling N,
a false `ok` with nonzero failures, and a malformed terminal summary.
F6 failed before tests because a warm worker Cargo fingerprint still
rejected Devin while the frozen build.rs already listed it. rch transfers
preserve mtimes, so an input whose bytes changed can still look older than
the cached fingerprint.
prepare_compile_inputs now SHA-256s the admitted path set (source-identity),
then touch -c those exact paths and re-digest (source-freshness). touch -c
never recreates a missing input. A concurrent edit or a missing file fails
closed before any compiler stage. EXPECTED_STAGES includes source-freshness.
The dpfvr e2e harness proves: old inputs become newer than a retained
fingerprint, bytes stay identical, a mutated input is refused before
source-freshness, and a renamed input is not recreated. No Cargo
invocation is admitted in that test.
Registry asupersync 0.4.10 does publish Cx::is_cancelled; the 0.4.9 pin
comment that it was unpublished was wrong. frankensearch stays 0.4.2 until
that runtime is validated. FAD 0.2.3 already probes both Antigravity roots.
- Route Prime Agent, Kiro, Devin, OpenHands, Goose, Crush, and Hermes through
watch and quarantine retry (ConnectorKind slug/serde/factory).
- Register watch_startup:fts_shadow_viability so preflight reaches scan.
- scripts/gate.sh run_fmt: cargo-fmt treated a killed rustfmt as success;
wrap rustfmt so a signal becomes a nonzero gate failure.
- Doctor baseline recommendations redact the archive directory.
- Robot search: preserve requested mode, report skipped optional sections on
setup-deadline, bounded read-only session-filter query.
- cass --version stays a plain semver. Duplicate fallback FTS schema rows
no longer block serving a readable lexical generation.
- Pack lessons extract lazily via OnceLock when evidence cites a commit or
closed bead.
Does not bump cass off 0.7.1 or pin frankensearch 0.4.3.
The remote receipt used to scan before lib/integration/goldens, so a
slow UBS could consume the SSH ceiling and leave product tests
unrun-but-green. UBS is still mandatory and blocking, but it now runs
after behavioral stages. fmt/clippy stay first; docs-truth moves with
the golden stages.
--verify-test-log pairs each "running N tests" with its
"test result: ok" line. A missing start, a truncated tail after a
passing binary, or start-count != result-count fails. UBS is invoked
as text --no-auto-update so a red scan still has categories.
coding_agent_session_search-2l1b0.1
gate.sh --verify-receipt now requires every named stage (including
integration targets like e2e_lexical_fail_open) to appear exactly once
with EXIT=0, positive TEST_COUNT lines, and job-complete as the last
record. Transport refusals (103) and timeouts (124) fail. Duplicate
stages, extra stages after job-complete, and a requested docs-binary
that is absent from the log fail.
--verify-test-log requires every cargo binary in a log to report a
positive passed count; zero-selected, truncated, mixed empty+positive,
and FAILED binaries fail. --ubs-files overrides the merge-base scan;
GATE_BUILD_JOBS and GATE_UBS_TIMEOUT_SECS must be positive integers.
UBS pin moves latest -> v5.3.13 so CI cannot float. Batched-only
fixtures in dpfvr_ubs_gate_e2e.sh cover the parsers without live cargo.
coding_agent_session_search-2l1b0.1
The v0.4.3 CLI surface added aliases (cass index, robot docs topics, current
session shorthands, html export, query, search hit source, line_number
drill-down) and the new robot-trace-ingest flag. The supporting shell
scripts get aligned with the canonical names so the e2e and CI scripts
keep matching what the binary actually accepts.
Touches:
- scripts/e2e/connector_stress.sh, query_parser_e2e.sh,
security_paths_e2e.sh, e2e_logging_acceptance_test.sh,
full_coverage_validation.sh: invoke the new alias-free canonical CLI
forms and consume the v0.4.3 robot envelope fields.
- scripts/test-all.sh, scripts/test-pages-e2e.sh, scripts/tests/run_all.sh:
pick up the new test files (tests/cli_index.rs, doctor_e2e_runner.rs,
e2e_search_index.rs, e2e_tui_smoke_flows.rs, metamorphic_introspect_schema.rs)
in their shard plans.
- scripts/validate-e2e-jsonl.sh: handles the new ingest-trace NDJSON shape.
- scripts/validate_ci.sh: minor flag-set update to match the v0.4.3 CLI.
No production behaviour change here — these are CI/test plumbing edits.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds:
- scripts/tests/run_e2e_smoke.sh: rch-wrapped smoke runner that auto-discovers
e2e_scenario_* tests in src/ui/app.rs (no hardcoded list — stays current as
scenarios are added/removed) and runs each in serial under --nocapture.
Captures wall time per scenario; emits TOTAL/PASS/FAIL/WALL_S summary.
On failure, dumps last 50 log lines + a reproduction one-liner.
- tests/e2e_smoke_runner_contract.rs: 5 contract tests covering:
- smoke_runner_script_exists_and_is_executable
- smoke_runner_uses_rch_for_cargo_invocations
- smoke_runner_emits_structured_summary
- smoke_runner_provides_failure_repro_hint
- existing_e2e_scenarios_remain_in_source (≥5 e2e_scenario_* tests)
Note: the bead's AC.1 (e2e-smoke cargo feature gate), AC.3 (TestLogger
wiring into existing 6 scenarios), AC.4 (3 new scenarios — analytics nav,
filter pill cycle, responsive resize), AC.5 (failure replay-hint capture)
require additions to src/ui/app.rs (a 1.4MB file with 1019 existing tests).
Those land in a follow-up bead because each is a substantive feature: the
cargo feature requires Cargo.toml changes + #[cfg(feature)] gates, the
TestLogger wiring requires per-test refactoring of the existing 6 scenarios,
and the 3 new scenarios each require model fixtures + key-event sequences.
The smoke runner ships in this PR so operators can already run
`bash scripts/tests/run_e2e_smoke.sh` against the existing scenarios.
Adds tests/degradation_tier_contract.rs with 5 contract assertions:
- existing_tiers_present (Standard, SimpleBorders, NoStyling, Skeleton)
- tier_resolution_function_present
- tier_preservation_invariant_documented
- no_oscillation_invariant_test_placeholder (deferred)
- force_degradation_tier_env_var_placeholder (deferred)
The bead's Phase 1 (threshold tuning) is in production. Phase 2 (intermediate
Reduced/Minimal tiers, gradual-fade interpolation, anti-oscillation,
CASS_FORCE_DEGRADATION_TIER env var) involves substantive feature work that
benefits from dedicated review and is tracked as a follow-up bead.
Files:
- tests/degradation_tier_contract.rs: 5 tests (3 active assertions + 2
documented placeholders for follow-up tracking).
- scripts/tests/50m1v_degradation_tier_contract_e2e.sh: orchestrator.
The placeholders explicitly enumerate the deferred work so the follow-up
bead author has a clear punch list.
Takes the bead's Path B (document the post-closure removal of the
`cass analytics cost` subcommand and ship the alternate-path SQL query).
The bead's AC.1 explicitly allowed two paths: (a) restore the subcommand
or (b) document the removal + alternate path. Path B is taken here because
restoring the subcommand requires Commands::Analytics::Cost dispatch, time-
filter parsing, robot-docs golden updates — work that fits a dedicated
follow-up bead rather than a remediation PR.
Files:
- tests/analytics_cost_pricing_table_contract.rs: 5 contract tests
asserting PricingTable struct, compute_cost fn, franken_load fn, the
ingest-path call site, and this test file's documented SQL alternate
path remain in place. If a future PR accidentally deletes these, the
test fails loudly BEFORE the underlying engine is lost.
- scripts/tests/vz9t8_5_analytics_cost_contract_e2e.sh: orchestrator.
The alternate-path SQL is documented in the test file's doc comment:
SELECT model, SUM(cost_usd_in + cost_usd_out) AS total_usd
FROM usage_daily
WHERE day >= ?
GROUP BY model
ORDER BY total_usd DESC
LIMIT 10;
Operators can compute cost directly via this SQL until the public
`cass analytics cost` subcommand returns in a follow-up bead.
Adds tests/plans_view_contract.rs with 5 contract-level tests pinning the
Plans-subview public surface in src/ui/analytics_charts.rs:
- render_plans function presence
- empty-state code path documented
- navigation constants documented
- fixture directory + README present
- regenerate script present and well-formed
Also ships:
- scripts/tests/regenerate_plans_snapshots.sh: regen script that fails
loudly when fixture DBs are missing (rather than producing stale
snapshots). Set ALLOW_REGEN_WITHOUT_FIXTURES=1 to opt into regen with
in-memory synthesized data.
- tests/fixtures/analytics/README.md: documents the 3 required fixture
DBs (plans_normal/sparse/empty) and the generation steps.
Note: the bead's 6 .snap files (cassapp_plans_compact_normal.snap etc)
require committed fixture DBs which require frankensqlite-driven seeding.
The fixture-generation pipeline is a follow-up bead; this PR ships the
regen tooling + contract guards so the snapshots can land safely once the
fixtures are seeded.
Adds tests/markdown_theme_distinct_colors.rs with 7 tests:
- markdown_theme_dark_produces_distinct_fg_colors (≥3 distinct fg).
- markdown_theme_light_produces_distinct_fg_colors (≥3 distinct fg).
- markdown_theme_code_block_has_distinct_background.
- markdown_theme_h1_through_h6_distinct_or_styled (all bold).
- markdown_theme_link_is_underlined_and_colored.
- markdown_theme_handles_empty_render_input_safely.
- markdown_theme_admonition_colors_match_severity (caution≠tip).
Each logs structured tracing events.
Note: the bead's snapshot files (cassapp_detail_markdown_dark.snap,
cassapp_detail_markdown_light.snap) require running the existing FTUI
snapshot harness with a populated detail pane. That generation step is
deferred to a follow-up that pairs `UPDATE_GOLDENS=1 cargo test
ftui_harness_snapshots cassapp_detail_markdown` with a fixture session
loader. This PR ships the contract assertions that protect the renderer's
distinct-color invariant against regressions.
scripts/tests/3n06q_markdown_theme_e2e.sh orchestrates.
Adds tests/e2e_analytics_models.rs with 5 assert_cmd tests covering:
- analytics_models_empty_data_dir_returns_actionable_response (happy + error
shape: stdout must be JSON whether the dir is empty-but-valid or returns
an error envelope per AGENTS.md robot-mode contract).
- analytics_models_missing_db_emits_actionable_error (stderr/stdout must
contain a recovery hint mentioning index/init/missing).
- analytics_models_with_archive_log_env_writes_jsonl (CASS_ANALYTICS_E2E_LOG
env var; soft-skip when not yet wired — bead's AC.9/AC.10 acknowledge the
env var is opt-in additive).
- analytics_models_with_limit_flag_parses_cleanly (flag-parsing happy path).
- analytics_models_with_invalid_since_returns_actionable_error (edge: bad
date string).
scripts/tests/vz9t8_6_analytics_models_e2e.sh runs the cargo test under rch.
Note: AC.2-AC.8 in the bead require fixture-DB seeding to assert top-N
ordering and per-row schema. The current implementation focuses on the
robot-contract guarantees (JSON shape, error envelope shape, flag parsing,
recovery hints). Fixture-DB seeding for ordering tests is deferred to a
follow-up that ships a tests/fixtures/analytics/models_seeded.db artifact.
Adds tests/e2e/rendering/virtual-list-perf.spec.ts with 6 Playwright tests:
1. 10K items render p95 ≤ 16ms (CI_PERF_STRICT=1) or ≤ 50ms (default soft
gate; relaxed for shared CI runners). Samples 100 scroll-driven render
frames and computes p50/p95/p99.
2. scroll position preserved across data-set churn (filter → unfilter).
3. empty list renders without errors and handles scroll events.
4. single-item list renders exactly one item.
5. 100K items: initial paint < 500ms AND DOM child count < 200 (proves
virtualization is actually virtualizing — without it, child count
would equal totalCount).
6. missing height-cache entry recovers gracefully (VariableHeightVirtualList
path; soft-skip if not exposed).
The spec loads src/pages_assets/virtual-list.js by reading the file and
injecting a stripped-export form into about:blank, so we exercise the
real module without requiring a built export.
scripts/tests/vz9t8_8_virtual_list_perf_e2e.sh orchestrates and writes a
markdown summary aggregating the perf_test_result console.info events.
Adds tests/e2e/encryption/integrity-tofu.spec.ts (Playwright). The spec
exercises src/pages_assets/auth.js::verifyTofu directly via a page.evaluate
bridge that injects the function source into about:blank. This avoids
requiring a fully-built export to test the TOFU logic in isolation.
Six tests:
- integrity_first_visit_records_fingerprint: empty localStorage → record + isFirstVisit=true.
- integrity_subsequent_same_fingerprint_passes: matching fingerprint → valid + !isFirstVisit.
- integrity_tofu_violation_detected: differing fingerprint → valid=false + TOFU_VIOLATION
+ previous/current populated; localStorage NOT silently overwritten.
- integrity_operator_can_clear_recorded_fingerprint: clear → next call is first-visit.
- integrity_works_when_localstorage_disabled: localStorage stub that throws
SecurityError → function returns permissive result without throwing.
- integrity_distinct_keys_isolate_archives: different storage keys don't collide.
Each test logs structured console.info(JSON.stringify({event,...})) for
forensics in playwright reports.
scripts/tests/vz9t8_7_integrity_tofu_e2e.sh orchestrates the playwright run
and emits a markdown summary.
Note: VERIFY_TOFU_SOURCE in the spec must stay in sync with auth.js's
verifyTofu function. A future bead can refactor auth.js to expose verifyTofu
as a CommonJS/ESM export so the test imports the canonical source instead
of mirroring it.
Adds tests/ui_high_contrast_wcag_aa.rs with 5 tests:
1. high_contrast_preset_meets_wcag_aa — sweeps every body+role+accent token
pair on the HighContrast preset, asserts WCAG AA (4.5:1 body / 3:1 large).
2. other_presets_meet_minimum_legibility — sweeps non-HighContrast presets,
logs ratios, fails ONLY if more than 30% of body tokens fall below 3:1
(systemic regression vs aesthetic choice).
3. high_contrast_focused_unfocused_borders_meet_threshold — focus state
highlights (border, accent, accent_alt) ≥ 3:1.
4. high_contrast_passes_on_inverted_terminal_background — symmetry sanity.
5. contrast_utility_handles_extreme_inputs — black/white = ~21, identity = 1.
Each test logs structured tracing::info!(target: "wcag_aa_test", preset, token,
ratio, aa_pass) so failures land in the test harness output.
scripts/tests/vz9t8_1_wcag_aa_e2e.sh orchestrates the cargo test run and
generates a markdown report at $RCH_TARGET_DIR/wcag-report.md tabulating
preset × token × ratio × aa_pass.
Adds #[tracing::instrument(skip_all, ...)] to:
- src/encryption.rs::hkdf_extract_expand
- src/encryption.rs::hkdf_extract
- src/pages/encrypt.rs::derive_kek_argon2id
- src/pages/encrypt.rs::derive_kek_hkdf
- src/pages/encrypt.rs::derive_chunk_nonce
Logged fields are limited to safe context:
- operation name
- input/output LENGTHS (salt_len, ikm_len, output_len, kek_len)
- algorithm parameters (Argon2 memory_kb, iterations, parallelism)
- info_label (hkdf_extract_expand only): emitted ONLY when info is short
ASCII text with graphic chars. Binary or oversized info is replaced with
`<binary or oversized; redacted>`. This protects domain-separation
metadata while never logging high-entropy key material.
The skip_all macro ensures input bytes (passwords, IKM, salts, secrets)
NEVER reach the trace fields. Output keys are also never logged.
Tests:
- tests/crypto_tracing_safety.rs (4 tests):
- derive_kek_emits_tracing_on_success — happy path
- derive_kek_emits_tracing_on_error — error path with oversized output_len
- derive_kek_handles_empty_info_and_salt — edge: empty inputs
- derive_functions_do_not_log_key_material — negative-coverage leak guard.
Calls hkdf_extract_expand and hkdf_extract with known patterns
(0xCA*32 ikm, 0xDE*16 salt) and asserts ABSENCE of those byte patterns
in any captured tracing field name OR value, in any of: lowercase hex,
uppercase hex, or Debug-formatted representations. Also bans field
names that imply secrets (ikm, salt, key, kek, password, secret,
nonce_value).
- scripts/tests/vz9t8_4_crypto_tracing_e2e.sh: orchestrator that runs the
cargo test under RUST_LOG=debug and additionally greps the captured
stderr for the same key-leak patterns.
Adds:
- scripts/tests/connector_edge_cases_regenerate_log.sh: rch-wrapped script
that runs `cargo test --lib connectors` plus the integration connector
tests, captures stdout+stderr to test-results/connector_edge_cases.log
with an embedded header (commit SHA, rustc version, date, host) and a
summary footer (elapsed seconds, total tests, panic count, overall exit).
- tests/connector_edge_cases_log_freshness.rs: 3 tests verifying:
(a) either the log file or the regenerate script is present,
(b) when the log exists, it contains the expected header lines,
(c) when the log exists, the embedded commit SHA is reachable from HEAD.
Tests soft-skip when the log is absent (gives operators a regenerate path
without forcing a stale-log error).
Per the bead, AC.4 explicitly allowed two paths: (a) commit the log, or
(b) commit only the regenerate script. We're shipping (b) — operators run
the script when fresh data is needed, and the freshness test enforces the
commit-reachability invariant once the log lands.
Adds an automated regression test that scans shell scripts under scripts/
for two bug classes:
1. Bare `cargo build|test|bench|clippy|run|check|fmt|update|install` outside
the rch-wrapped form. Originating beads (vq9l5/yzh2t/zlzpk) correctly
wrapped their target scripts; the test prevents future regressions.
2. `set -e` + `((VAR++))` / `((VAR--))` arithmetic-abort idiom — bash
evaluates the post-increment expression to 0 when VAR was 0, which
set -e treats as failure. Subsumes coding_agent_session_search-iaor8
(the zlzpk polish bead, closed as superseded by this scanner).
Also introduces `scripts/lib/run_cargo.sh` — a single-source-of-truth
helper that scripts can `source` to get a consistent rch-wrapped cargo
invocation (logs cmd/cwd/target/rch_bin to stderr; defaults RCH_BIN
and RCH_TARGET_DIR; defends against missing rch with a clear error).
Files:
- scripts/lib/run_cargo.sh: shared helper.
- tests/scripts_rch_compliance.rs: 8 tests — 2 live-fire (no bare cargo,
no set-e arithmetic against HEAD), 1 helper-presence check, 5 synthetic
fixtures (violating, clean, set-e + ++, no-set-e + ++, safe-form +=,
comment-immune).
- scripts/tests/tafss_compliance_scanner_e2e.sh: orchestrator script.
Adds the ubs-changed-files job to .github/workflows/ci.yml that runs
`ubs --ci --fail-on-warning` against the diff for every PR and push to main.
Files:
- .github/workflows/ci.yml: new ubs-changed-files job with full diff/filter/
install/run/upload pipeline. Skips when no UBS-relevant files changed.
- .github/workflows/ubs-version.txt: pinned UBS version for reproducible CI.
- AGENTS.md: new "UBS Pre-Merge Gate" subsection under Compiler Checks
documenting the local pre-flight command + suppression policy.
- tests/ci_workflow_validates_ubs_gate.rs: 8 regression tests covering
job_exists, canonical_invocation, triggers, artifact_upload,
version_pin_file, supported_extensions, skip_path, agents_md_documents.
- scripts/tests/dpfvr_ubs_gate_e2e.sh: 4 scenarios that reproduce the gate's
diff/filter logic against representative inputs.
Also includes the linter's normalization of tests/simd_tests.rs from yvv7r/8tgic
work (rng.r#gen() -> rng.random() per rand 0.10 API).
Shell script that runs all TUI test categories (stress, e2e_scenario,
cross_theme_degradation, density, rendering_invariants + P1 categories),
produces evidence-bundle.json manifest and evidence-summary.md. P0
categories gate the release — script exits non-zero if any P0 fails.
Supports --quick mode for fast local validation.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Strengthen path integrity verification against Unicode-based path traversal attacks:
Unicode Attack Detection Enhancements (verify.rs):
- Add combining solidus overlays (U+0337, U+0338) that could visually disguise chars
- Block zero-width characters (U+200B, U+200C, U+200D, U+FEFF) that invisibly split tokens
- Block bidirectional override/embedding/isolate characters (U+202A-U+202E, U+2066-U+2069)
that can visually reverse or scramble path display
- Add confusable slash characters (U+2044, U+2215, U+29F8, U+1735) that look like /
- Add confusable dot characters (U+2E2E, U+0701, U+0702, U+A60E, U+10A50) that look like .
Comprehensive Test Coverage:
- Add tests for each new blocked Unicode character category
- Test combining overlay characters
- Test zero-width joiner/non-joiner/space/BOM
- Test RTL override, LTR override, RTL embedding, RTL isolate
- Test fraction slash, division slash, big solidus
- Test Vai full stop, Syriac full stops
- Add NFD/NFC normalization test with legitimate accented filenames
- Add unit tests for detect_encoded_path_violation with new attack vectors
E2E Test Infrastructure Improvements:
- Update run_all.sh to include per-test cass.log files in combined aggregation
- Exclude trace.jsonl and combined.jsonl from aggregation to avoid duplication
- Update output documentation in script headers
- Fix JSONL aggregation to recursively find test logs using find command
- Update validate-e2e-jsonl.sh default file discovery to include cass.log files
- Support recursive search in test-results/e2e for complete validation
Co-Authored-By: Claude <noreply@anthropic.com>
Improve Rust E2E test discovery robustness:
1. Check if git command is available before using git ls-files
2. Fallback to find command if git unavailable or returns empty
3. Properly strip path prefixes (./, tests/) and .rs extension
4. Use while-read loop for safer handling of filenames
This fixes test discovery in environments where:
- Git is not installed
- Running from a non-git directory
- Sparse checkout excludes tests
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Enhance run_all.sh to dynamically discover and run Rust E2E tests:
1. Use git ls-files to find tests/e2e_*.rs test files
2. Skip suite gracefully if no E2E tests found (yellow warning)
3. Build cargo test command with explicit --test flags per file
4. Enable E2E_LOG=1 for structured test output
5. Add --all-features and --verbose for comprehensive testing
6. Keep --nocapture for visible test output
Previous behavior used a glob pattern that might miss tests or include
non-E2E tests. New approach is explicit and handles empty test sets.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Jeff Emanuel