R-204 item 4 (hub half): the hub answers a rebuilt box's request (hub v0.96.0)

New internal/offsiteheal, the sibling of pbsdrheal: it acts ONLY on the state the box declares, sustained across two distinct reports, re-staging the stored credential before ever minting a new one. A healthy box is a pure no-op; it never blind-timer-reissues and never re-runs a provisioning step. RESTAGE IS POSSIBLE because the stored value survives a consume — established from the schema and ConsumeOneTimeSecret (which stamps consumed_at and nothing else), not inherited from the PBS analogy, and pinned by a test that asserts the SAME value comes back. reportHasOffsite is TIGHTENED to require enabled:true. Its comment asserted that presence == applied-on-the-box, and the declaration deliberately breaks that premise; left alone it would have read a request for help as proof the tier was applied. Provably a no-op for every report shape that existed before, because an attached object has always carried enabled:true. R-192's guard half is CLOSED BY REPLACEMENT: the delivery checker's counting inference read the OLDEST 500 reports after a consume — all predating a rebuild, which is why demo-hp sat stranded for 108 reports under a confident regressed-shape verdict. A declaration outranks both inferred shapes, and the checker stands down with a record so the two mechanisms cannot double-issue. No escrow ceremony is ever run or requested: credential automatic, key customer-present.
2026-08-05 10:48:18 +02:00
parent c917251eeb
commit f62a115891
8 changed files with 1026 additions and 16 deletions
@@ -0,0 +1,58 @@
+package offsiteheal
+
+import (
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"testing"
+)
+
+// SCENARIO H — the reconciler is WIRED, asserted from main.go's source.
+//
+// Every test in this package passes on a reconciler that main.go never starts. That is this
+// project's most-repeated failure shape: six features built and never wired, one of them an off-site
+// restage event that existed and never fired once. The whole of R-204 item 4 is worth nothing if
+// `Run` is not called.
+//
+// It walks the AST rather than grepping, because a commented-out call still contains the string, and
+// it parses with comments DROPPED so a commented `go rec.Run(ctx)` cannot satisfy it.
+//
+// RED-PROOF: comment out the `go offsiteReconciler.Run(ctx)` line in cmd/hub/main.go → this fails.
+func TestMainWiresTheOffsiteHealReconciler(t *testing.T) {
+	const mainPath = "../../cmd/hub/main.go"
+	fset := token.NewFileSet()
+	f, err := parser.ParseFile(fset, mainPath, nil, 0) // comments dropped on purpose
+	if err != nil {
+		t.Fatalf("parse %s: %v — the reconciler's wiring is now unasserted", mainPath, err)
+	}
+
+	var sawConstruct, sawRun bool
+	ast.Inspect(f, func(n ast.Node) bool {
+		call, ok := n.(*ast.CallExpr)
+		if !ok {
+			return true
+		}
+		sel, ok := call.Fun.(*ast.SelectorExpr)
+		if !ok {
+			return true
+		}
+		pkg, isIdent := sel.X.(*ast.Ident)
+		// offsiteheal.NewReconciler(...)
+		if isIdent && pkg.Name == "offsiteheal" && sel.Sel.Name == "NewReconciler" {
+			sawConstruct = true
+		}
+		// <something>.Run(ctx) — the receiver is a local variable, so match on the method name and
+		// confirm the construction separately. Narrow enough: this file has one Run per reconciler.
+		if sel.Sel.Name == "Run" && isIdent && pkg.Name == "offsiteReconciler" {
+			sawRun = true
+		}
+		return true
+	})
+
+	if !sawConstruct {
+		t.Fatal("cmd/hub/main.go never calls offsiteheal.NewReconciler — R-204 item 4 ships inert")
+	}
+	if !sawRun {
+		t.Fatal("the offsite self-heal reconciler is CONSTRUCTED but never Run — a stranded box would declare forever and nothing would answer")
+	}
+}