admin
f62a115891
New internal/offsiteheal, the sibling of pbsdrheal: it acts ONLY on the state the box declares, sustained across two distinct reports, re-staging the stored credential before ever minting a new one. A healthy box is a pure no-op; it never blind-timer-reissues and never re-runs a provisioning step. RESTAGE IS POSSIBLE because the stored value survives a consume — established from the schema and ConsumeOneTimeSecret (which stamps consumed_at and nothing else), not inherited from the PBS analogy, and pinned by a test that asserts the SAME value comes back. reportHasOffsite is TIGHTENED to require enabled:true. Its comment asserted that presence == applied-on-the-box, and the declaration deliberately breaks that premise; left alone it would have read a request for help as proof the tier was applied. Provably a no-op for every report shape that existed before, because an attached object has always carried enabled:true. R-192's guard half is CLOSED BY REPLACEMENT: the delivery checker's counting inference read the OLDEST 500 reports after a consume — all predating a rebuild, which is why demo-hp sat stranded for 108 reports under a confident regressed-shape verdict. A declaration outranks both inferred shapes, and the checker stands down with a record so the two mechanisms cannot double-issue. No escrow ceremony is ever run or requested: credential automatic, key customer-present.
59 lines
2.0 KiB
Go
59 lines
2.0 KiB
Go
package offsiteheal
|
|
|
|
import (
|
|
"go/ast"
|
|
"go/parser"
|
|
"go/token"
|
|
"testing"
|
|
)
|
|
|
|
// SCENARIO H — the reconciler is WIRED, asserted from main.go's source.
|
|
//
|
|
// Every test in this package passes on a reconciler that main.go never starts. That is this
|
|
// project's most-repeated failure shape: six features built and never wired, one of them an off-site
|
|
// restage event that existed and never fired once. The whole of R-204 item 4 is worth nothing if
|
|
// `Run` is not called.
|
|
//
|
|
// It walks the AST rather than grepping, because a commented-out call still contains the string, and
|
|
// it parses with comments DROPPED so a commented `go rec.Run(ctx)` cannot satisfy it.
|
|
//
|
|
// RED-PROOF: comment out the `go offsiteReconciler.Run(ctx)` line in cmd/hub/main.go → this fails.
|
|
func TestMainWiresTheOffsiteHealReconciler(t *testing.T) {
|
|
const mainPath = "../../cmd/hub/main.go"
|
|
fset := token.NewFileSet()
|
|
f, err := parser.ParseFile(fset, mainPath, nil, 0) // comments dropped on purpose
|
|
if err != nil {
|
|
t.Fatalf("parse %s: %v — the reconciler's wiring is now unasserted", mainPath, err)
|
|
}
|
|
|
|
var sawConstruct, sawRun bool
|
|
ast.Inspect(f, func(n ast.Node) bool {
|
|
call, ok := n.(*ast.CallExpr)
|
|
if !ok {
|
|
return true
|
|
}
|
|
sel, ok := call.Fun.(*ast.SelectorExpr)
|
|
if !ok {
|
|
return true
|
|
}
|
|
pkg, isIdent := sel.X.(*ast.Ident)
|
|
// offsiteheal.NewReconciler(...)
|
|
if isIdent && pkg.Name == "offsiteheal" && sel.Sel.Name == "NewReconciler" {
|
|
sawConstruct = true
|
|
}
|
|
// <something>.Run(ctx) — the receiver is a local variable, so match on the method name and
|
|
// confirm the construction separately. Narrow enough: this file has one Run per reconciler.
|
|
if sel.Sel.Name == "Run" && isIdent && pkg.Name == "offsiteReconciler" {
|
|
sawRun = true
|
|
}
|
|
return true
|
|
})
|
|
|
|
if !sawConstruct {
|
|
t.Fatal("cmd/hub/main.go never calls offsiteheal.NewReconciler — R-204 item 4 ships inert")
|
|
}
|
|
if !sawRun {
|
|
t.Fatal("the offsite self-heal reconciler is CONSTRUCTED but never Run — a stranded box would declare forever and nothing would answer")
|
|
}
|
|
}
|