From 5574ace81e88ef57f6ac549cb531f5d7208800b4 Mon Sep 17 00:00:00 2001 From: Adrian Webb Date: Sun, 11 Oct 2026 17:32:48 -0400 Subject: [PATCH 1/4] Reproduce missing provider offer revision readback before proposal creation --- tests/modern/guarantees/preflight/campaign-freeze.test.ts | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/tests/modern/guarantees/preflight/campaign-freeze.test.ts b/tests/modern/guarantees/preflight/campaign-freeze.test.ts index 116a0735..be378336 100644 --- a/tests/modern/guarantees/preflight/campaign-freeze.test.ts +++ b/tests/modern/guarantees/preflight/campaign-freeze.test.ts @@ -278,7 +278,7 @@ it('uses the original operator proposal and start and denies changed CLI intent state.files.set('/supplied-platform/seeds/treeseed.yaml', seed); state.files.set('/draft.json', JSON.stringify(template)); state.writes.mockImplementation((path: string, bytes: string) => state.files.set(path, bytes)); for (const scenario of ['intent-drift', 'policy-drift', 'policy-team', 'policy-owner-missing', 'policy-malformed', 'policy-unknown', - 'project-drift', 'lookup-team-drift', 'lookup-slug-drift', 'lookup-repository-missing', 'lookup-denied', 'unchanged']) { + 'offer-revision', 'offer-provider', 'offer-denied', 'project-drift', 'lookup-team-drift', 'lookup-slug-drift', 'lookup-repository-missing', 'lookup-denied', 'unchanged']) { state.bytes = JSON.stringify(supplied); state.writes.mockClear(); state.commands.mockClear(); state.execute.mockClear(); state.publicRead.mockClear(); state.execute.mockImplementation((command: string, args: string[]) => command.endsWith('/codex') ? 'codex-cli 0.158.0' : args.includes('--refs') ? `${head}\trefs/heads/staging\n` @@ -305,6 +305,11 @@ it('uses the original operator proposal and start and denies changed CLI intent if (args[0] === 'library') return { result: { repoId: 'repo_supplied', resolvedRef: head, files: [{ path: canonical.architectureBook.path, content, frontmatter: bookFrontmatter }] } }; if (args[0] === 'agents') return campaignProfiles(args[3]!, head, `repository-${args[3]}`).inventory; + if (args[0] === 'providers' && args[1] === 'offers') { + if (scenario === 'offer-denied') throw new Error('ACCEPTANCE_CLI_COMMAND: providers.offers.show denied'); + return { schemaVersion: 'treeseed.provider-offer-inventory/v1', providerId: scenario === 'offer-provider' ? 'foreign' : args[3], + revision: scenario === 'offer-revision' ? supplied.providerOfferRevision + 1 : supplied.providerOfferRevision, offers: [] }; + } if (args[0] === 'providers' && args[1] === 'list') return { items: [{ status: 'approved', providerId: 'supplied' }] }; if (args[0] === 'providers') { const now = new Date().toISOString(), measured = { day: now.slice(0, 10), observedAt: now, healthy: true, activeSeconds: 0, reservedSeconds: 0 }; From 18b98cf8fad6ef726f890c9add1258d97672a28e Mon Sep 17 00:00:00 2001 From: Adrian Webb Date: Sun, 11 Oct 2026 17:37:07 -0400 Subject: [PATCH 2/4] Cover frozen native provider offers and public SDK readback --- .../preflight/campaign-offers-fixture.ts | 15 +++++ .../preflight/campaign-offers-native.test.ts | 54 +++++++++++++++++ .../preflight/campaign-offers.test.ts | 58 +++++++++++++++++++ 3 files changed, 127 insertions(+) create mode 100644 tests/modern/guarantees/preflight/campaign-offers-fixture.ts create mode 100644 tests/modern/guarantees/preflight/campaign-offers-native.test.ts create mode 100644 tests/modern/guarantees/preflight/campaign-offers.test.ts diff --git a/tests/modern/guarantees/preflight/campaign-offers-fixture.ts b/tests/modern/guarantees/preflight/campaign-offers-fixture.ts new file mode 100644 index 00000000..6618fd2f --- /dev/null +++ b/tests/modern/guarantees/preflight/campaign-offers-fixture.ts @@ -0,0 +1,15 @@ +import { createManagedProviderManifestV5 } from '../../../../src/provider/configuration/managed-manifest.ts'; +import { campaignInputs } from './campaign-freeze-fixture.ts'; + +export function campaignOffers() { + const manifest = campaignInputs(['sdk']), providerId = manifest.allocationInputsByRun.sdk!.providerSupply[0]!.providerId; + const digest = `sha256:${'a'.repeat(64)}`; + const produced = createManagedProviderManifestV5({ release: 'native-frozen-offer', guestImage: 'isolated/guest', + guestImageDigest: digest, baseImageDigest: digest, provenanceDigest: digest }); + const offers = produced.adapters[0]!.offers.map(({ offer }, index) => ({ executionProviderId: 'renamed-execution-provider', + offerId: offer.offerId, offerDigest: offer.offerDigest, offer, status: index ? 'context_overflow' : 'active', + observedAt: '2026-10-11T00:00:00.000Z' })).sort((left, right) => left.offerId < right.offerId ? -1 : left.offerId > right.offerId ? 1 : 0); + Reflect.set(manifest.allocationInputsByRun.sdk!.providerSupply[0]!, 'offers', structuredClone(offers)); + const inventory = { schemaVersion: 'treeseed.provider-offer-inventory/v1', providerId, revision: manifest.providerOfferRevision, offers }; + return { manifest, inventory, providerId }; +} diff --git a/tests/modern/guarantees/preflight/campaign-offers-native.test.ts b/tests/modern/guarantees/preflight/campaign-offers-native.test.ts new file mode 100644 index 00000000..cda8fd65 --- /dev/null +++ b/tests/modern/guarantees/preflight/campaign-offers-native.test.ts @@ -0,0 +1,54 @@ +import { createServer } from 'node:http'; +import { expect, it } from 'vitest'; +import { ControlPlaneClient, defaultLocalControlPlaneServer } from '@treeseed/sdk/control-plane-client'; +import { controlPlaneOperation } from '@treeseed/sdk/operator-contracts'; +import { verifyCampaignProviderOffer } from '../../../acceptance/workday/support/preflight/campaign-provider-offers.ts'; +import { campaignOffers } from './campaign-offers-fixture.ts'; + +it('native owning provider offers and public SDK reads retain exact frozen revision configuration denial and interruption observations before unchanged concurrent retry', async () => { + const f = campaignOffers(), held = structuredClone(f), requests: string[] = [], failed: Array<{ mode: string; error: unknown; observed: unknown }> = []; + let mode = 'exact'; + const server = createServer((request, response) => { + requests.push(`${request.method} ${request.url}`); response.setHeader('content-type', 'application/json'); + if (mode === 'interrupted') { request.socket.destroy(); return; } + if (mode === 'denied' || mode === 'unavailable') { + const status = mode === 'denied' ? 403 : 503; + response.writeHead(status).end(JSON.stringify({ status, code: 'controlled_offer_denied', title: 'Retained native denial' })); return; + } + if (mode === 'json') { response.end('{'); return; } + const value = structuredClone(f.inventory); + if (mode === 'revision') value.revision++; + if (mode === 'provider') value.providerId = 'foreign'; + if (mode === 'omitted') value.offers.pop(); + if (mode === 'duplicate') value.offers.push(structuredClone(value.offers[0]!)); + if (mode === 'configuration') value.offers[0]!.offer.features.push('changed-native-configuration'); + if (mode === 'clock') value.offers[0]!.observedAt = 'invalid'; + response.end(JSON.stringify({ data: value })); + }); + try { + await new Promise((accept, reject) => { server.once('error', reject); server.listen(0, '127.0.0.1', accept); }); + const address = server.address(); if (!address || typeof address === 'string') throw new Error('Native offer listener required'); + const client = new ControlPlaneClient({ profile: defaultLocalControlPlaneServer({ TREESEED_API_BASE_URL: `http://127.0.0.1:${address.port}` }), accessToken: 'controlled-native-offer-input' }); + const input = { path: { teamId: 'renamed-team', providerId: f.providerId }, query: {}, body: undefined }, originalInput = structuredClone(input); + const observe = async () => { + let observed: unknown; + try { + observed = (await client.invoke(controlPlaneOperation('providers.offers.show'), input)).data; + return verifyCampaignProviderOffer(f.manifest, f.providerId, observed); + } catch (error) { failed.push({ mode, error, observed: structuredClone(observed) }); throw error; } + }; + expect(await Promise.all([observe(), observe()])).toEqual([f.inventory, f.inventory]); + for (const fault of ['revision', 'provider', 'omitted', 'duplicate', 'configuration', 'clock', 'denied', 'unavailable', 'json', 'interrupted']) { + mode = fault; await expect(observe(), fault).rejects.toThrow(); expect(f).toEqual(held); expect(input).toEqual(originalInput); + } + const originalFailures = [...failed]; mode = 'exact'; expect(await Promise.all([observe(), observe()])).toEqual([f.inventory, f.inventory]); + expect(failed).toEqual(originalFailures); expect(failed).toHaveLength(10); expect(f).toEqual(held); + expect(requests).toHaveLength(14); expect(requests.every(value => value === `GET /v1/teams/renamed-team/capacity-providers/${f.providerId}/offers`)).toBe(true); + // The original owning manifest producer and SDK/native HTTP are real. + // API inventory, credentials and revision are controlled; current runtime + // supply, conformance signatures and a managed campaign are not proven here. + } finally { + server.closeAllConnections(); if (server.listening) await new Promise((accept, reject) => server.close(error => error ? reject(error) : accept())); + } + expect(server.listening).toBe(false); +}, 30_000); diff --git a/tests/modern/guarantees/preflight/campaign-offers.test.ts b/tests/modern/guarantees/preflight/campaign-offers.test.ts new file mode 100644 index 00000000..9a9074c4 --- /dev/null +++ b/tests/modern/guarantees/preflight/campaign-offers.test.ts @@ -0,0 +1,58 @@ +import { expect, it, vi } from 'vitest'; +import { capabilityOfferDigest } from '@treeseed/sdk/capacity-provider'; +import { readFileSync } from 'node:fs'; +import { parse } from 'yaml'; +import { readCampaignProviderOffers, verifyCampaignProviderOffer } from '../../../acceptance/workday/support/preflight/campaign-provider-offers.ts'; +import { campaignOffers } from './campaign-offers-fixture.ts'; + +it('reads every exact frozen provider offer revision and original configuration through the public boundary without changing supplied observations', () => { + const f = campaignOffers(), held = structuredClone(f), reader = vi.fn(() => f.inventory); + expect(verifyCampaignProviderOffer(f.manifest, f.providerId, f.inventory)).toBe(f.inventory); + expect(readCampaignProviderOffers(f.manifest, 'renamed-team', reader)).toEqual(new Map([[f.providerId, f.inventory]])); + expect(reader.mock.calls).toEqual([[['providers', 'offers', 'show', f.providerId], 'renamed-team']]); + const refreshed = structuredClone(f.inventory); for (const offer of refreshed.offers) offer.observedAt = '2026-10-11T00:01:00.000Z'; + expect(verifyCampaignProviderOffer(f.manifest, f.providerId, refreshed)).toBe(refreshed); + expect(f).toEqual(held); +}); + +it('denies missing malformed foreign moved duplicated and incomplete provider offer authority while retaining every original failed input before exact retry', () => { + for (const mode of ['revision', 'revision-string', 'provider', 'schema', 'unknown', 'missing', 'empty', 'duplicate', 'owner', + 'clock', 'digest', 'offer-id', 'configuration', 'status', 'omitted', 'reordered', 'uncanonical']) { + const f = campaignOffers(), observed: Record = structuredClone(f.inventory), offers = observed.offers as typeof f.inventory.offers; + if (mode === 'revision') observed.revision = f.inventory.revision + 1; + if (mode === 'revision-string') observed.revision = String(f.inventory.revision); + if (mode === 'provider') observed.providerId = 'foreign'; if (mode === 'schema') observed.schemaVersion = 'unknown'; + if (mode === 'unknown') observed.compatibilityOffers = []; if (mode === 'missing') delete observed.offers; + if (mode === 'empty') observed.offers = []; if (mode === 'duplicate') offers.push(structuredClone(offers[0]!)); + if (mode === 'owner') offers[0]!.executionProviderId = 'foreign'; if (mode === 'clock') offers[0]!.observedAt = 'invalid'; + if (mode === 'digest') offers[0]!.offerDigest = `sha256:${'f'.repeat(64)}`; + if (mode === 'offer-id') offers[0]!.offerId = 'foreign'; if (mode === 'status') offers[0]!.status = 'disabled'; + if (mode === 'omitted') offers.pop(); if (mode === 'reordered') offers.reverse(); + if (mode === 'uncanonical') Reflect.set(offers[0]!.offer, 'retiredOffer', true); + if (mode === 'configuration') { + offers[0]!.offer.features.push('changed-native-configuration'); + const { offerDigest: _old, ...material } = offers[0]!.offer; + offers[0]!.offer.offerDigest = capabilityOfferDigest(material); offers[0]!.offerDigest = offers[0]!.offer.offerDigest; + } + const held = structuredClone({ f, observed }); + expect(() => verifyCampaignProviderOffer(f.manifest, f.providerId, observed), mode).toThrow(); + expect({ f, observed }).toEqual(held); expect(verifyCampaignProviderOffer(f.manifest, f.providerId, f.inventory)).toBe(f.inventory); + } + for (const mode of ['missing-supply', 'empty-supply', 'foreign-supply', 'duplicate-supply', 'missing-offers', 'empty-offers']) { + const f = campaignOffers(), supply = f.manifest.allocationInputsByRun.sdk!.providerSupply; + if (mode === 'missing-supply') Reflect.deleteProperty(f.manifest.allocationInputsByRun.sdk!, 'providerSupply'); + if (mode === 'empty-supply') supply.length = 0; if (mode === 'foreign-supply') supply[0]!.providerId = ' '; + if (mode === 'duplicate-supply') supply.push(structuredClone(supply[0]!)); + if (mode === 'missing-offers') Reflect.deleteProperty(supply[0]!, 'offers'); if (mode === 'empty-offers') Reflect.set(supply[0]!, 'offers', []); + const reader = vi.fn(() => f.inventory), held = structuredClone(f); + expect(() => readCampaignProviderOffers(f.manifest, 'team', reader), mode).toThrow(); expect(reader).not.toHaveBeenCalled(); expect(f).toEqual(held); + } +}); + +it('selects original provider offer readback in the normal SDK freeze and retains preparation evidence before proposal creation', () => { + const guarantee = parse(readFileSync('guarantees/agent/golden/sdk-complete.guarantee.yaml', 'utf8')) as { acceptanceCriteria: Array<{ criterion: string; verifierRefs: string[] }> }; + expect(guarantee.acceptanceCriteria.filter(value => value.criterion === '2feaea9a8a706e1279affead3af5bacc467f12b285ba2570f183361c5d8203c7')) + .toEqual([{ criterion: '2feaea9a8a706e1279affead3af5bacc467f12b285ba2570f183361c5d8203c7', verifierRefs: ['agent.golden.live.campaign-freeze', 'agent.golden.live.campaign'] }]); + for (const asset of ['tests/acceptance/freeze-integrity.test.ts', 'tests/acceptance/prepare-campaign.ts']) + expect(readFileSync(asset, 'utf8')).toContain('readCampaignProviderOffers('); +}); From c76fcfa9711ef63218bcd6ada0de1fd37d2450f0 Mon Sep 17 00:00:00 2001 From: Adrian Webb Date: Sun, 11 Oct 2026 17:41:59 -0400 Subject: [PATCH 3/4] Bind actual provider offer revisions and frozen original configuration --- .../scenes/component-boundaries.scene.yaml | 8 +++ .../agent/golden/sdk-complete.guarantee.yaml | 2 + guarantees/verifiers/golden.verifiers.yaml | 20 ++++++ tests/acceptance/freeze-integrity.test.ts | 5 ++ tests/acceptance/prepare-campaign.ts | 5 ++ .../preflight/campaign-provider-offers.ts | 63 +++++++++++++++++++ .../preflight/campaign-freeze.test.ts | 9 ++- .../preflight/campaign-offers.test.ts | 20 ++++++ 8 files changed, 129 insertions(+), 3 deletions(-) create mode 100644 tests/acceptance/workday/support/preflight/campaign-provider-offers.ts diff --git a/guarantees/agent/golden/scenes/component-boundaries.scene.yaml b/guarantees/agent/golden/scenes/component-boundaries.scene.yaml index eecfd7c0..e137a939 100644 --- a/guarantees/agent/golden/scenes/component-boundaries.scene.yaml +++ b/guarantees/agent/golden/scenes/component-boundaries.scene.yaml @@ -60,6 +60,14 @@ workflow: - id: campaign-fresh-estimates-native action: { verifier: agent.golden.campaign-fresh-estimates-native } expect: { status: passed } + - id: campaign-offers-read-unit + action: { verifier: agent.golden.campaign-offers-read-unit } + - id: campaign-offers-denials-unit + action: { verifier: agent.golden.campaign-offers-denials-unit } + - id: campaign-offers-binding-unit + action: { verifier: agent.golden.campaign-offers-binding-unit } + - id: campaign-offers-native + action: { verifier: agent.golden.campaign-offers-native } - id: campaign-policy-native action: { verifier: agent.golden.campaign-policy-native } expect: { status: passed } diff --git a/guarantees/agent/golden/sdk-complete.guarantee.yaml b/guarantees/agent/golden/sdk-complete.guarantee.yaml index 8398491d..c2bd787a 100644 --- a/guarantees/agent/golden/sdk-complete.guarantee.yaml +++ b/guarantees/agent/golden/sdk-complete.guarantee.yaml @@ -11,6 +11,8 @@ scene: required: true manifest: guarantees/agent/golden/scenes/sdk-complete.scene.yaml acceptanceCriteria: + - criterion: 2feaea9a8a706e1279affead3af5bacc467f12b285ba2570f183361c5d8203c7 + verifierRefs: [agent.golden.live.campaign-freeze, agent.golden.live.campaign] - criterion: 64ffc06b0d268ad11fbf692ca201cd75423c0afae2a6be3e2ae7cd2eea7fb17f verifierRefs: [agent.golden.live.campaign, api.golden.execution-normal-sdk-clean-schema-live-1, agent.golden.architecture-record-custody-live-1, agent.golden.architecture-living-graph-live-1] - criterion: 6c6e922d724fe9bf966e3f11456af2f176224cdff4792c9b7a73ce8047659e55 diff --git a/guarantees/verifiers/golden.verifiers.yaml b/guarantees/verifiers/golden.verifiers.yaml index 6a4693ac..7861ed80 100644 --- a/guarantees/verifiers/golden.verifiers.yaml +++ b/guarantees/verifiers/golden.verifiers.yaml @@ -421,6 +421,26 @@ verifiers: ownerPackage: "@treeseed/agent" testFile: tests/modern/guarantees/preflight/campaign-freeze.test.ts testName: "uses the original operator proposal and start and denies changed CLI intent or policy before any proposal creation" + agent.golden.campaign-offers-read-unit: + kind: vitestCase + ownerPackage: "@treeseed/agent" + testFile: tests/modern/guarantees/preflight/campaign-offers.test.ts + testName: "reads every exact frozen provider offer revision and original configuration through the public boundary without changing supplied observations" + agent.golden.campaign-offers-denials-unit: + kind: vitestCase + ownerPackage: "@treeseed/agent" + testFile: tests/modern/guarantees/preflight/campaign-offers.test.ts + testName: "denies missing malformed foreign moved duplicated and incomplete provider offer authority while retaining every original failed input before exact retry" + agent.golden.campaign-offers-binding-unit: + kind: vitestCase + ownerPackage: "@treeseed/agent" + testFile: tests/modern/guarantees/preflight/campaign-offers.test.ts + testName: "selects original provider offer readback in the normal SDK freeze and retains preparation evidence before proposal creation" + agent.golden.campaign-offers-native: + kind: vitestCase + ownerPackage: "@treeseed/agent" + testFile: tests/modern/guarantees/preflight/campaign-offers-native.test.ts + testName: "native owning provider offers and public SDK reads retain exact frozen revision configuration denial and interruption observations before unchanged concurrent retry" agent.golden.campaign-policy-native: kind: vitestCase ownerPackage: "@treeseed/agent" diff --git a/tests/acceptance/freeze-integrity.test.ts b/tests/acceptance/freeze-integrity.test.ts index 8078a201..3c0add7a 100644 --- a/tests/acceptance/freeze-integrity.test.ts +++ b/tests/acceptance/freeze-integrity.test.ts @@ -4,6 +4,7 @@ import test from 'node:test'; import { readCampaignProjectLibraries, readCampaignRepositoryBases, readPreRunCampaignFreeze, verifyCampaignWorkdayPolicy, verifyFreezeIntegrity } from './freeze-integrity.ts'; import { read } from './acceptance-cli.ts'; import { readCampaignProfiles } from './workday/support/preflight/campaign-profiles.ts'; +import { readCampaignProviderOffers } from './workday/support/preflight/campaign-provider-offers.ts'; test('Golden pre-run campaign freeze retains every schema-valid expanded input and original manifest bytes before SDK execution', () => { const original = readPreRunCampaignFreeze(); @@ -14,10 +15,14 @@ test('Golden pre-run campaign freeze retains every schema-valid expanded input a const protectedHeads = readCampaignRepositoryBases(original); const profiles = readCampaignProfiles(original, bindings, team); const policy = verifyCampaignWorkdayPolicy(original.manifest, read(['workdays', 'profiles', 'show', 'default'], team), bindings.get('sdk')?.teamId); + const providerOffers = readCampaignProviderOffers(original.manifest, team); assert.deepEqual(readCampaignProjectLibraries(original.manifest, team), bindings); assert.deepEqual(readCampaignRepositoryBases(original), protectedHeads); assert.deepEqual(readCampaignProfiles(original, bindings, team), profiles); assert.deepEqual(verifyCampaignWorkdayPolicy(original.manifest, read(['workdays', 'profiles', 'show', 'default'], team), bindings.get('sdk')?.teamId), policy); + const finalProviderOffers = readCampaignProviderOffers(original.manifest, team); + assert.deepEqual([...finalProviderOffers.keys()], [...providerOffers.keys()]); + console.log(JSON.stringify({ providerOfferReadback: { before: [...providerOffers], after: [...finalProviderOffers] } })); const independentlyRead = readPreRunCampaignFreeze(); assert.deepEqual(independentlyRead, original); assert.deepEqual(readFileSync(original.path), held); diff --git a/tests/acceptance/prepare-campaign.ts b/tests/acceptance/prepare-campaign.ts index 3dd8317d..2ab020f0 100644 --- a/tests/acceptance/prepare-campaign.ts +++ b/tests/acceptance/prepare-campaign.ts @@ -8,6 +8,7 @@ import { read } from './acceptance-cli.ts'; import { readCampaignProfiles } from './workday/support/preflight/campaign-profiles.ts'; import { freshSdkDraft, requirePlanningWindow, sdkProposalText, sdkCampaignWindow } from './campaign.ts'; import { readCampaignProjectLibraries, readCampaignRepositoryBases, readPreRunCampaignFreeze, verifyCampaignWorkdayPolicy, verifyRuntimeClosure } from './freeze-integrity.ts'; +import { readCampaignProviderOffers } from './workday/support/preflight/campaign-provider-offers.ts'; type Row = Record; export function requirePinnedCodex(pinned: string, installed: string): void { @@ -122,6 +123,7 @@ export function prepareSdkCampaign(draftPath: string, freezePath: string, team: read(['workdays', 'profiles', 'show', 'default'], team), libraries.get('sdk')?.teamId); const protectedHeads = readCampaignRepositoryBases(operatorFreeze); const profiles = readCampaignProfiles(operatorFreeze, libraries, team); + const providerOffers = readCampaignProviderOffers(operatorFreeze.manifest, team); const agentPath = resolve(platform, 'packages/agent'); const pinnedCodex = (JSON.parse(readFileSync(join(agentPath, 'package.json'), 'utf8')) as Row).dependencies['@openai/codex'] as string; const installedCodex = execFileSync(join(agentPath, 'node_modules/.bin/codex'), ['--version'], { encoding: 'utf8', timeout: 30_000 }).trim(); @@ -156,6 +158,7 @@ export function prepareSdkCampaign(draftPath: string, freezePath: string, team: verifySdkPublishedProfiles(sdkProfiles.inventory.agents as Row[], sdkProfiles.ref); const providers = (read(['providers', 'list'], team).items as Row[]).filter(item => item.status === 'approved'); assert.equal(providers.length, 1, 'ACCEPTANCE_CAMPAIGN_SUPPLY: Individual host campaign requires unambiguous provider'); + assert.ok(providerOffers.has(providers[0]!.providerId), 'ACCEPTANCE_CAMPAIGN_OFFERS: Selected provider differs from frozen offer authority'); const supply = read(['providers', 'status', providers[0]!.providerId], team); requireSdkCampaignSupply(supply, durationSeconds, planningPercent, new Date().toISOString()); const project = draft.projectId as string; @@ -190,6 +193,7 @@ export function prepareSdkCampaign(draftPath: string, freezePath: string, team: capture('protected-staging-heads.json', JSON.stringify(protectedHeads)); capture('architecture-book.json', JSON.stringify(bookReadback)); capture('governed-agent-profiles.json', JSON.stringify([...profiles])); + capture('provider-offers.json', JSON.stringify([...providerOffers])); capture('codex-version.json', JSON.stringify({ pinned: pinnedCodex, installed: installedCodex })); const runtime = read(['dev', 'status'], team, true); capture('runtime.json', JSON.stringify(runtime)); capture('supply.json', JSON.stringify(supply)); @@ -203,6 +207,7 @@ export function prepareSdkCampaign(draftPath: string, freezePath: string, team: 'ACCEPTANCE_CAMPAIGN_FREEZE: Protected repositories changed during preparation'); assert.deepEqual(readCampaignProfiles(operatorFreeze, libraries, team), profiles, 'ACCEPTANCE_CAMPAIGN_PROFILES: Governed profiles changed during preparation'); + capture('provider-offers-final.json', JSON.stringify([...readCampaignProviderOffers(operatorFreeze.manifest, team)])); const current = read(['proposals', 'show', id, '--server', 'local', '--project', project], team, true); writeFileSync(freezePath, JSON.stringify({ createdAt: new Date().toISOString(), proposal: { id, revision: current.activeVersion, digest: current.activeContentHash, estimates: 0 }, request, preflight, sourceHeads, diff --git a/tests/acceptance/workday/support/preflight/campaign-provider-offers.ts b/tests/acceptance/workday/support/preflight/campaign-provider-offers.ts new file mode 100644 index 00000000..c698445b --- /dev/null +++ b/tests/acceptance/workday/support/preflight/campaign-provider-offers.ts @@ -0,0 +1,63 @@ +import assert from 'node:assert/strict'; +import { capabilityOfferDigest, capabilityOfferSchema } from '@treeseed/sdk/capacity-provider'; +import { read, row, type Row } from '../../../acceptance-cli.ts'; + +function frozenSupply(manifest: Row): Row[] { + assert.ok(Number.isSafeInteger(manifest.providerOfferRevision) && Number(manifest.providerOfferRevision) > 0, 'ACCEPTANCE_CAMPAIGN_OFFERS: Exact frozen offer revision required'); + const supply = row(row(manifest.allocationInputsByRun).sdk).providerSupply; + assert.ok(Array.isArray(supply) && supply.length > 0, 'ACCEPTANCE_CAMPAIGN_OFFERS: Complete frozen provider supply required'); + const values = supply.map(row), ids = values.map(value => value.providerId); + assert.ok(ids.every(id => typeof id === 'string' && id && id.trim() === id) && new Set(ids).size === ids.length, + 'ACCEPTANCE_CAMPAIGN_OFFERS: Exact unique frozen providers required'); + return values; +} + +function authority(offers: unknown): Row[] { + const code = 'ACCEPTANCE_CAMPAIGN_OFFERS'; + assert.ok(Array.isArray(offers) && offers.length > 0, `${code}: Original complete offer inventory required`); + const ids = new Set(); + return offers.map(value => { + const original = row(value); + assert.deepEqual(Object.keys(original).sort(), ['executionProviderId', 'offerId', 'offerDigest', 'offer', 'status', 'observedAt'].sort(), + `${code}: Original native offer fields required`); + assert.ok(typeof original.executionProviderId === 'string' && original.executionProviderId && original.executionProviderId.trim() === original.executionProviderId + && typeof original.status === 'string' && original.status && original.status.trim() === original.status, `${code}: Exact native owner and status required`); + assert.ok(typeof original.observedAt === 'string' && Number.isFinite(Date.parse(original.observedAt)), `${code}: Original observation clock required`); + const offer = capabilityOfferSchema.parse(original.offer); + assert.deepEqual(offer, original.offer, `${code}: Native offer must already be canonical`); + const { offerDigest, ...material } = offer; + assert.equal(offerDigest, capabilityOfferDigest(material), `${code}: Original offer digest differs from its configuration`); + assert.equal(original.offerId, offer.offerId); assert.equal(original.offerDigest, offerDigest); + assert.ok(!ids.has(offer.offerId), `${code}: Duplicate native offer identity`); ids.add(offer.offerId); + // Heartbeat time is observation metadata. All original offer authority, + // including inactive unrelated offers, remains visible and compared. + const { observedAt: _clock, ...configuration } = original; + return configuration; + }); +} + +/** The existing public inventory and frozen original offer rows are authority; + * the inventory's revision alone cannot establish unchanged configuration. */ +export function verifyCampaignProviderOffer(manifest: Row, providerId: string, observed: unknown): Row { + const code = 'ACCEPTANCE_CAMPAIGN_OFFERS', supplied = frozenSupply(manifest).filter(value => value.providerId === providerId); + assert.equal(supplied.length, 1, `${code}: Exact frozen provider required`); + const inventory = row(observed); + assert.deepEqual(Object.keys(inventory).sort(), ['schemaVersion', 'providerId', 'revision', 'offers'].sort(), `${code}: Original public inventory required`); + assert.equal(inventory.schemaVersion, 'treeseed.provider-offer-inventory/v1', code); + assert.equal(inventory.providerId, providerId, `${code}: Foreign provider inventory`); + assert.equal(inventory.revision, manifest.providerOfferRevision, `${code}: Public offer revision differs from frozen authority`); + assert.deepEqual(authority(inventory.offers), authority(supplied[0]!.offers), `${code}: Public offer configuration differs from frozen authority`); + return inventory; +} + +export function readCampaignProviderOffers(manifest: Row, team: string, reader: typeof read = read): Map { + assert.ok(typeof team === 'string' && team && team.trim() === team, 'ACCEPTANCE_CAMPAIGN_OFFERS: Explicit owning team required'); + const supply = frozenSupply(manifest); + // Validate every frozen row before the first public read; never substitute + // a registry version, another provider, or a partially checked inventory. + for (const value of supply) authority(value.offers); + return new Map(supply.map(value => { + const providerId = String(value.providerId); + return [providerId, verifyCampaignProviderOffer(manifest, providerId, reader(['providers', 'offers', 'show', providerId], team))]; + })); +} diff --git a/tests/modern/guarantees/preflight/campaign-freeze.test.ts b/tests/modern/guarantees/preflight/campaign-freeze.test.ts index be378336..34e44532 100644 --- a/tests/modern/guarantees/preflight/campaign-freeze.test.ts +++ b/tests/modern/guarantees/preflight/campaign-freeze.test.ts @@ -2,6 +2,7 @@ import { beforeEach, afterEach, expect, it, vi } from 'vitest'; import { createHash } from 'node:crypto'; import { resolve } from 'node:path'; import { stringify } from 'yaml'; +import { campaignOffers } from './campaign-offers-fixture.ts'; const state = vi.hoisted(() => ({ bytes: '{}', reads: [] as string[], files: new Map(), commands: vi.fn(), writes: vi.fn(), execute: vi.fn(), publicRead: vi.fn() })); @@ -265,6 +266,8 @@ it('uses the original operator proposal and start and denies changed CLI intent const canonical = sdkProposalText(document), head = 'a'.repeat(40); const supplied = campaignInputs(portfolioRelations(document, seed).projects.map(project => project.slug), seed); const sdk = supplied.allocationInputsByRun.sdk!; + const frozenOffers = campaignOffers().inventory.offers; + for (const provider of sdk.providerSupply) Reflect.set(provider, 'offers', structuredClone(frozenOffers)); const bookFrontmatter = { id: canonical.architectureBook.id, title: canonical.architectureBook.title, schemaVersion: 'treeseed.book/v3', projectId: sdk.input.projects[0], revision: 1, status: 'published' }; const content = `---\n${stringify(bookFrontmatter)}---\n\nControlled published Book\n`; @@ -308,9 +311,9 @@ it('uses the original operator proposal and start and denies changed CLI intent if (args[0] === 'providers' && args[1] === 'offers') { if (scenario === 'offer-denied') throw new Error('ACCEPTANCE_CLI_COMMAND: providers.offers.show denied'); return { schemaVersion: 'treeseed.provider-offer-inventory/v1', providerId: scenario === 'offer-provider' ? 'foreign' : args[3], - revision: scenario === 'offer-revision' ? supplied.providerOfferRevision + 1 : supplied.providerOfferRevision, offers: [] }; + revision: scenario === 'offer-revision' ? supplied.providerOfferRevision + 1 : supplied.providerOfferRevision, offers: structuredClone(frozenOffers) }; } - if (args[0] === 'providers' && args[1] === 'list') return { items: [{ status: 'approved', providerId: 'supplied' }] }; + if (args[0] === 'providers' && args[1] === 'list') return { items: [{ status: 'approved', providerId: 'supplied-provider' }] }; if (args[0] === 'providers') { const now = new Date().toISOString(), measured = { day: now.slice(0, 10), observedAt: now, healthy: true, activeSeconds: 0, reservedSeconds: 0 }; return { healthy: true, availability: [{ refreshed_at: now, executionProviders: [{ id: 'supplied', status: 'active', @@ -333,7 +336,7 @@ it('uses the original operator proposal and start and denies changed CLI intent if (scenario === 'intent-drift' || scenario.startsWith('policy-')) expect(() => prepareSdkCampaign('/draft.json', '/sdk.freeze.json', 'supplied-team')).toThrow('ACCEPTANCE_CAMPAIGN_FREEZE'); else expect.soft(() => prepareSdkCampaign('/draft.json', '/sdk.freeze.json', 'supplied-team')) - .toThrow(/ACCEPTANCE_(CAMPAIGN_FREEZE|PROJECT_LIBRARY|CLI_COMMAND)/u); + .toThrow(/ACCEPTANCE_(CAMPAIGN_FREEZE|CAMPAIGN_OFFERS|PROJECT_LIBRARY|CLI_COMMAND)/u); expect(state.writes).not.toHaveBeenCalled(); expect(state.publicRead.mock.calls.filter(call => call[0][0] === 'proposals')).toHaveLength(0); if (scenario === 'project-drift' || scenario.startsWith('lookup-')) expect.soft(state.execute).not.toHaveBeenCalled(); diff --git a/tests/modern/guarantees/preflight/campaign-offers.test.ts b/tests/modern/guarantees/preflight/campaign-offers.test.ts index 9a9074c4..5e25a452 100644 --- a/tests/modern/guarantees/preflight/campaign-offers.test.ts +++ b/tests/modern/guarantees/preflight/campaign-offers.test.ts @@ -12,6 +12,17 @@ it('reads every exact frozen provider offer revision and original configuration expect(reader.mock.calls).toEqual([[['providers', 'offers', 'show', f.providerId], 'renamed-team']]); const refreshed = structuredClone(f.inventory); for (const offer of refreshed.offers) offer.observedAt = '2026-10-11T00:01:00.000Z'; expect(verifyCampaignProviderOffer(f.manifest, f.providerId, refreshed)).toBe(refreshed); + const second = structuredClone(f.manifest.allocationInputsByRun.sdk!.providerSupply[0]!); second.providerId = 'second-provider'; + f.manifest.allocationInputsByRun.sdk!.providerSupply.push(second); + const beforeMultiple = structuredClone(f), observations = new Map([f.providerId, second.providerId].map(providerId => [providerId, { ...f.inventory, providerId }])); + const all = vi.fn((args: string[]) => observations.get(args[3]!)!); + expect(readCampaignProviderOffers(f.manifest, 'renamed-team', all)).toEqual(observations); + expect(all.mock.calls.map(call => call[0][3])).toEqual([f.providerId, second.providerId]); + const denied = new Error('Original second provider denial'); + const partial = vi.fn((args: string[]) => { if (args[3] === second.providerId) throw denied; return f.inventory; }); + expect(() => readCampaignProviderOffers(f.manifest, 'renamed-team', partial)).toThrow(denied); + expect(partial).toHaveBeenCalledTimes(2); expect(f).toEqual(beforeMultiple); + f.manifest.allocationInputsByRun.sdk!.providerSupply.pop(); expect(f).toEqual(held); }); @@ -38,6 +49,15 @@ it('denies missing malformed foreign moved duplicated and incomplete provider of expect(() => verifyCampaignProviderOffer(f.manifest, f.providerId, observed), mode).toThrow(); expect({ f, observed }).toEqual(held); expect(verifyCampaignProviderOffer(f.manifest, f.providerId, f.inventory)).toBe(f.inventory); } + for (const revision of [0, -1, Number.NaN, undefined, '1', 1.5, Number.POSITIVE_INFINITY]) { + const f = campaignOffers(), reader = vi.fn(() => f.inventory); Reflect.set(f.manifest, 'providerOfferRevision', revision); + const held = structuredClone(f); expect(() => readCampaignProviderOffers(f.manifest, 'team', reader)).toThrow(); + expect(reader).not.toHaveBeenCalled(); expect(f).toEqual(held); + } + for (const team of ['', ' ', ' team', 'team ']) { + const f = campaignOffers(), reader = vi.fn(() => f.inventory); + expect(() => readCampaignProviderOffers(f.manifest, team, reader)).toThrow(); expect(reader).not.toHaveBeenCalled(); + } for (const mode of ['missing-supply', 'empty-supply', 'foreign-supply', 'duplicate-supply', 'missing-offers', 'empty-offers']) { const f = campaignOffers(), supply = f.manifest.allocationInputsByRun.sdk!.providerSupply; if (mode === 'missing-supply') Reflect.deleteProperty(f.manifest.allocationInputsByRun.sdk!, 'providerSupply'); From a4a673229a38f6ec87cf9317459323015bec2c92 Mon Sep 17 00:00:00 2001 From: Adrian Webb Date: Sun, 11 Oct 2026 17:49:14 -0400 Subject: [PATCH 4/4] Retain exact offer binding and explicit component passing expectations --- .../agent/golden/scenes/component-boundaries.scene.yaml | 4 ++++ tests/modern/guarantees/bindings.test.ts | 1 + 2 files changed, 5 insertions(+) diff --git a/guarantees/agent/golden/scenes/component-boundaries.scene.yaml b/guarantees/agent/golden/scenes/component-boundaries.scene.yaml index e137a939..e73bc696 100644 --- a/guarantees/agent/golden/scenes/component-boundaries.scene.yaml +++ b/guarantees/agent/golden/scenes/component-boundaries.scene.yaml @@ -62,12 +62,16 @@ workflow: expect: { status: passed } - id: campaign-offers-read-unit action: { verifier: agent.golden.campaign-offers-read-unit } + expect: { status: passed } - id: campaign-offers-denials-unit action: { verifier: agent.golden.campaign-offers-denials-unit } + expect: { status: passed } - id: campaign-offers-binding-unit action: { verifier: agent.golden.campaign-offers-binding-unit } + expect: { status: passed } - id: campaign-offers-native action: { verifier: agent.golden.campaign-offers-native } + expect: { status: passed } - id: campaign-policy-native action: { verifier: agent.golden.campaign-policy-native } expect: { status: passed } diff --git a/tests/modern/guarantees/bindings.test.ts b/tests/modern/guarantees/bindings.test.ts index cc841b5f..01211f11 100644 --- a/tests/modern/guarantees/bindings.test.ts +++ b/tests/modern/guarantees/bindings.test.ts @@ -179,6 +179,7 @@ describe('capacity-provider guarantee execution bindings', () => { 'b918b519ac545fdd61faab208687ccc64e1f3d03c9a84dfc57a5cfee6190f3f3', ].map(criterion => ({ criterion, verifierRefs: ['agent.golden.live.campaign-freeze'] })); expect(manifest.acceptanceCriteria).toEqual([ + { criterion: '2feaea9a8a706e1279affead3af5bacc467f12b285ba2570f183361c5d8203c7', verifierRefs: ['agent.golden.live.campaign-freeze', 'agent.golden.live.campaign'] }, { criterion: '64ffc06b0d268ad11fbf692ca201cd75423c0afae2a6be3e2ae7cd2eea7fb17f', verifierRefs: ['agent.golden.live.campaign', 'api.golden.execution-normal-sdk-clean-schema-live-1', 'agent.golden.architecture-record-custody-live-1', 'agent.golden.architecture-living-graph-live-1'] }, { criterion: '6c6e922d724fe9bf966e3f11456af2f176224cdff4792c9b7a73ce8047659e55', verifierRefs: ['api.golden.execution-normal-sdk-clean-schema-live-1', 'agent.golden.architecture-record-custody-live-1'] }, { criterion: '2e5d3dfc2cd33fd0656866a59ce59153137c199b766309decab4f71ecbf4e8d7', verifierRefs: ['api.golden.execution-normal-sdk-clean-schema-live-1', 'agent.golden.architecture-record-custody-live-1'] },