From 543e6bb65f30f9100c20be1f561d8e57f9a54b93 Mon Sep 17 00:00:00 2001 From: Adrian Webb Date: Sat, 10 Oct 2026 01:13:16 -0400 Subject: [PATCH 1/4] test: reject development marker archive drift and stale prerequisites --- tests/contract/package/installed-assets.test.ts | 14 ++++++++++++++ tests/contract/package/thin-package.test.ts | 2 ++ 2 files changed, 16 insertions(+) diff --git a/tests/contract/package/installed-assets.test.ts b/tests/contract/package/installed-assets.test.ts index 598b9abf..3565bd63 100644 --- a/tests/contract/package/installed-assets.test.ts +++ b/tests/contract/package/installed-assets.test.ts @@ -18,6 +18,11 @@ test('ships the selected CLI native observation assets without checkout source e const [packed] = JSON.parse(await execute('npm', ['pack', '--dry-run', '--ignore-scripts', '--json'])) as Packed[]; assert.ok(packed); const paths = new Set(packed.files.map(file => file.path)); assert.deepEqual(assets.filter(path => !paths.has(path)), []); + const manifest = JSON.parse(readFileSync('package.json', 'utf8')); + for (const path of ['dist/.treeseed-build-complete.json', 'dist/.treeseed-build-complete.json.new']) { + assert.ok(manifest.files.includes(`!${path}`), 'Development readiness bytes must be excluded from package selection'); + assert.equal(paths.has(path), false); + } const source = ts.createSourceFile(assets[2]!, readFileSync(assets[2]!, 'utf8'), ts.ScriptTarget.Latest, true); const privatePaths: string[] = []; const visit = (node: ts.Node) => { @@ -46,6 +51,8 @@ test('native production CLI archive retains exact observation assets and execute await execute('npm', ['ls', '--all', '--omit=dev', '--json'], root); const installed = resolve(root, 'node_modules/@treeseed/cli'); assert.equal(realpathSync(installed), installed); assert.equal(lstatSync(installed).isSymbolicLink(), false); + for (const path of ['dist/.treeseed-build-complete.json', 'dist/.treeseed-build-complete.json.new']) + assert.equal(existsSync(resolve(installed, path)), false, 'Installed archives must omit development readiness state'); for (const path of ['src', 'node_modules/@treeseed/sdk', 'node_modules/@treeseed/identity']) assert.equal(existsSync(resolve(installed, path)), false, path); for (const dependency of ['tsx', 'vitest', '@treeseed/deployment', '@treeseed/ui']) assert.equal(existsSync(resolve(root, 'node_modules', dependency)), false, dependency); for (const path of assets) assert.deepEqual(readFileSync(resolve(installed, path)), readFileSync(path), path); @@ -54,6 +61,13 @@ test('native production CLI archive retains exact observation assets and execute const env: NodeJS.ProcessEnv = { ...process.env, TREESEED_CONFIG_HOME: resolve(root, 'config') }; delete env.NODE_OPTIONS; delete env.NODE_TEST_CONTEXT; const result = await promisify(execFile)(process.execPath, [binary, '--help'], { cwd: root, env, encoding: 'utf8' }); assert.equal(result.stderr, ''); assert.match(result.stdout, /trsd/u); assert.deepEqual(readFileSync(binary), bytes); + const inventory = async () => (JSON.parse(await execute('npm', ['pack', '--dry-run', '--ignore-scripts', '--json'], installed)) as Packed[])[0]!; + const before = await inventory(); + for (const path of ['dist/.treeseed-build-complete.json', 'dist/.treeseed-build-complete.json.new']) + writeFileSync(resolve(installed, path), JSON.stringify({ completedAt: new Date().toISOString(), executable: 'cli/main.js' })); + const after = await inventory(); + assert.equal(after.integrity, before.integrity, 'Development readiness changes must not change executable archive custody'); + assert.deepEqual(after.files, before.files); assert.deepEqual(readFileSync(binary), bytes); for (const archive of packed) assert.equal(`sha512-${createHash('sha512').update(readFileSync(resolve(root, archive.filename))).digest('base64')}`, archive.integrity); console.log(JSON.stringify({ archives: packed.map(archive => ({ filename: archive.filename, sha256: createHash('sha256').update(readFileSync(resolve(root, archive.filename))).digest('hex') })), installedPublicBinary: 'passed' })); diff --git a/tests/contract/package/thin-package.test.ts b/tests/contract/package/thin-package.test.ts index d3d6b699..4d0df95b 100644 --- a/tests/contract/package/thin-package.test.ts +++ b/tests/contract/package/thin-package.test.ts @@ -50,6 +50,8 @@ test('the executable drains complete output before exiting', () => { }); test('candidate promotion uses staging while stable publication uses production', () => { + const verification = readFileSync('.github/workflows/verify.yml', 'utf8'); + assert.match(verification, /uses: treeseed-ai\/reviewer\/\.github\/actions\/run-scenes@9dc625e2186e6d618cea30a17afd79fe64a95998/u); const workflow = readFileSync('.github/workflows/publish.yml', 'utf8'); const install = workflow.indexOf('npm ci --ignore-scripts --no-audit --no-fund'); const verify = workflow.indexOf('npm run release:custody -- verify'); From 82af9026faf709a8d2a48d49165e0d6848503b41 Mon Sep 17 00:00:00 2001 From: Adrian Webb Date: Sat, 10 Oct 2026 01:13:56 -0400 Subject: [PATCH 2/4] fix: omit mutable readiness markers from CLI archives --- .github/workflows/verify.yml | 2 +- package.json | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml index 0eba96b0..7e46ab65 100644 --- a/.github/workflows/verify.yml +++ b/.github/workflows/verify.yml @@ -49,7 +49,7 @@ jobs: - name: Verify package with exact SDK run: npm run verify:direct - name: Execute coded golden component scenes - uses: treeseed-ai/reviewer/.github/actions/run-scenes@013d38165f0430278ac944592d3b20618736c2d5 + uses: treeseed-ai/reviewer/.github/actions/run-scenes@9dc625e2186e6d618cea30a17afd79fe64a95998 env: NODE_OPTIONS: --import=${{ github.workspace }}/tests/support/os-custody.ts with: diff --git a/package.json b/package.json index 74b90c8d..ccc0b19a 100644 --- a/package.json +++ b/package.json @@ -21,6 +21,8 @@ "README.md", "completions", "dist", + "!dist/.treeseed-build-complete.json", + "!dist/.treeseed-build-complete.json.new", "docs/command-reference.md", "schemas", "treeseed.package.yaml", From 50c3b124e0c4dfdc6ac60524a65ccf040988e220 Mon Sep 17 00:00:00 2001 From: Adrian Webb Date: Sat, 10 Oct 2026 02:14:25 -0400 Subject: [PATCH 3/4] test(cli): require checked nested Reviewer prerequisite custody --- tests/contract/package/thin-package.test.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/contract/package/thin-package.test.ts b/tests/contract/package/thin-package.test.ts index 4d0df95b..8ec82755 100644 --- a/tests/contract/package/thin-package.test.ts +++ b/tests/contract/package/thin-package.test.ts @@ -51,7 +51,7 @@ test('the executable drains complete output before exiting', () => { test('candidate promotion uses staging while stable publication uses production', () => { const verification = readFileSync('.github/workflows/verify.yml', 'utf8'); - assert.match(verification, /uses: treeseed-ai\/reviewer\/\.github\/actions\/run-scenes@9dc625e2186e6d618cea30a17afd79fe64a95998/u); + assert.match(verification, /uses: treeseed-ai\/reviewer\/\.github\/actions\/run-scenes@77f8f0003ccdc477cf90801fd7b0a23b1a1bb82f/u); const workflow = readFileSync('.github/workflows/publish.yml', 'utf8'); const install = workflow.indexOf('npm ci --ignore-scripts --no-audit --no-fund'); const verify = workflow.indexOf('npm run release:custody -- verify'); From ee555a7501468c697f49c0b4ed618dbb4f269857 Mon Sep 17 00:00:00 2001 From: Adrian Webb Date: Sat, 10 Oct 2026 02:16:46 -0400 Subject: [PATCH 4/4] fix(cli): use checked nested Reviewer prerequisite custody --- .github/workflows/verify.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml index 7e46ab65..2b85c3bb 100644 --- a/.github/workflows/verify.yml +++ b/.github/workflows/verify.yml @@ -49,7 +49,7 @@ jobs: - name: Verify package with exact SDK run: npm run verify:direct - name: Execute coded golden component scenes - uses: treeseed-ai/reviewer/.github/actions/run-scenes@9dc625e2186e6d618cea30a17afd79fe64a95998 + uses: treeseed-ai/reviewer/.github/actions/run-scenes@77f8f0003ccdc477cf90801fd7b0a23b1a1bb82f env: NODE_OPTIONS: --import=${{ github.workspace }}/tests/support/os-custody.ts with: