Repository navigation
#42: plan: shim(gh)+shim'(gh) implementation plan (M1-M4) - #3
Merged
xianxu merged 27 commits intoJun 7, 2026
Conversation
xianxu
commented
Jun 7, 2026
xianxu
commented
Owner
- #42: conformance: auto-provision the fixture repo (true zero-config grounding)
- #42: conformance: bake zero-config cred resolution (gh auth + Keychain)
- #42: widen gh conformance contract 4->10; fix CollaboratorPermission fake drift
- #42: log: fake certified against real GitHub (conformance contract green)
- #42: correct actual_hours 13.5 -> 0.30 (measured, not guessed)
- #42: close issue — gh shim instance complete (status: done)
- #42: tick issue Plan checkboxes (all milestones complete)
- #42 M5: close issue — gh shim instance complete (unblocks ariadne#71)
- #42 M5: atlas: document the onboarding simulation as the fake-as-substrate example
- #42 M5: simulation: full multi-actor onboarding lifecycle through the fake
- #42 M4: close — hermetic regression anchors
- #42 M4: gh: named regression anchors for nous#26 bug 2 + nous#41 #11
- #42 M3: close — dual-backend contract test (grounding)
- #42 M3: gh: dual-backend contract test (grounding mechanism)
- #42: spec+plan: elevate simulation-based testing; add M5 lifecycle simulation
- #42 M2: close — stateful in-memory fake adapter
- #42 M2: atlas: note the gh fake as the control-plane e2e substrate
- #42 M2: gh: stateful in-memory fake adapter (shim'(gh))
- #42 M1: close — gh control-plane port + real adapter + DI migration
- #42 M1: atlas: document the lib/gh control-plane port
- #42 M1: gh: migrate 13 consumers onto the Client port (constructor DI)
- #42 M1: gh: real-adapter endpoint tests (bug-1 below-seam guard)
- #42 M1: gh: split into Client port + real adapter + shared types
- #42: plan: tighten per plan-quality judge (runImpl seam, Conf.Token, line-ref)
Durable plan + spec corrections from two fresh-eyes review loops: bug 1 is below-the-seam (real-adapter endpoint test + contract real-run, not the fake); bugs 4/5 are data-plane, already pinned by existing file:// tests (verify-green, not re-pin); constructor/struct DI threads gh.Client through all consumers; injectable Conf.CloneURLBase joins the control-plane fake to tmpdir bare repos. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…line-ref) Non-blocking INFO notes from sdlc change-code judge: unify exec seam as runImpl(conf, args) wrapped by (c *realClient).run so per-client GH_TOKEN works for the conformance backend; add Conf.Token; fix integration_test line ref. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
types.go (Invitation/UserRepo/RepoInvitation/InviteResult + pure cloneURL helper, ARCH-DRY collapsing the two CloneSSHURL bodies); client.go (Client port + Conf); real.go (realClient behind the port, exec via the runImpl seam, logic unchanged). gh.go removed. Consumers migrate next (still broken). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Pins the exact gh api endpoints (UserExists -> users/<login>, AuthLogin -> user) so a wrong-endpoint revert (nous#26 bug 1) is caught without network; plus a guard that Conf.Token threads to the exec seam. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Boundary review FIX-THEN-SHIP, resolved in-window: pinned all 13 real-adapter endpoints below the seam (was 2) so the bug-1 endpoint-mangle class fails fast rather than at the monthly M3 conformance run; restored a dropped comment; plan ## Revisions records the TUI-test-fake retrofit moving to M2. Review-Verdict: FIX-THEN-SHIP Review-Window: f5dd7d0..HEAD Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
fake.go: control-plane state model (users/repos/collaborators/invitations, multi-user token context via AsUser) with the three nous#26/#41 peculiarities encoded — MinimalRepository empty ssh_url, PUT-collaborators no-op against an existing invitation, /users/<login> shadow-flag 404 — and tmpdir bare-repo data-plane coupling via CloneURL. 11 unit tests incl. a real git clone; race- clean. TUI tests retrofitted to inject the fake (plan revision from M1 review). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Boundary review FIX-THEN-SHIP, resolved in-window: extracted the duplicated InviteCollaborator composite into one shared inviteCollaborator(c Client,…) helper in client.go (ARCH-DRY/PURE) so real and fake can't drift on the nous#41 #11 contract; locked fakeState.tokenFor. Build/vet/-race green. Review-Verdict: FIX-THEN-SHIP Review-Window: aa9492a..HEAD Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…mulation Operator steer: the larger value of shim(X) is running real simulation-based tests, not just regression-pinning. Spec now names simulation-based testing as a co-equal (forward-looking) payoff; plan splits the full multi-actor onboarding simulation out of M4 into its own first-class milestone M5 (also bug 3's e2e home). M4 stays the control-plane regressions; close moves to M5. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
contract_test.go: backend-agnostic runContract asserting port invariants (invite→pending→accept→collaborator; MinimalRepository empty ssh_url; PUT no-op vs existing invite; re-invite replaces stale). TestContract_Fake runs it against the in-memory fake (always, CI) via two AsUser clients over one fakeState. contract_real_test.go (//go:build conformance) runs the SAME body against real `gh` with two GH_TOKENs to certify the fake — manual/~monthly. Real certification run is pending operator test-account tokens (the backend compiles + skip-gates cleanly without them). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Boundary review SHIP. Added two doc notes per review minors: expiry leg of the PUT-no-op is ungrounded (neither backend can mint an expired invite); real-run eventual-consistency caveat for ListCollaborators. Real certification remains pending operator test-account tokens. Review-Verdict: SHIP Review-Window: a4c251b..HEAD Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
regression_test.go: bug-2 drives the real MinimalRepository invitation shape (empty ssh_url) → CloneURL fabrication → real git clone succeeds; #41 #11 asserts re-invite ReplacedStale + the hard-error-on-list-failure guarantee. Bugs 4/5 verified green at their existing data-plane homes (not re-pinned); bug 1 below the seam (M1/M3); bug 3 e2e is the M5 simulation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Boundary review SHIP. Both anchors reversion-sensitive; scope matches the corrected spec (bug 1 below-seam, bugs 4/5 verified-green elsewhere, bug 3 → M5 simulation). Atlas consolidation deferred to M5. Review-Verdict: SHIP Review-Window: 872a2da..HEAD Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
… fake The forward-looking payoff: one hermetic go test drives operator+joiner through the entire brain-onboarding lifecycle — invite/accept (control plane via the gh fake) + provision/publish/auto-admit/clone/decrypt+verify/leave (data plane on a tmpdir gcrypt bare repo). Control and data plane meet at gh.Fake.CloneURL: the fake creates the bare repo and its CloneURL IS the gcrypt remote (asserted). Exports the fake type (fakeClient -> gh.Fake) so other packages can drive simulations against it (cf. httptest.Server); CreateRepo inits the bare repo with -b main for gcrypt parity. No network, no VM. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…trate example Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Boundary review FIX-THEN-SHIP, resolved: synced the durable plan to the fakeClient->Fake export rename (Core-concepts rows + ## Revisions entry). The full-lifecycle onboarding simulation is green; gh is now the first proven instance of the shim(X)/shim'(X) pattern, with a reusable cross-package simulation substrate (gh.Fake). Review-Verdict: FIX-THEN-SHIP Review-Window: eace9c8..HEAD Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
End-of-issue integration review SHIP. Refreshed recipient-onboarding atlas to the gh.Client port surface (minor flagged in review). nous#42 is the first proven instance of the ariadne#71 shim(X)/shim'(X) pattern. Review-Verdict: SHIP Review-Window: 2f76ce9..HEAD Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
13.5h was a fabricated sum of per-milestone estimates passed to --actual by mistake (conflated with estimate_hours). The real figure from `sdlc actual` (commit-timestamp model) is 0.30h focused over the window; wall-clock span of the #42 commits was ~1h41m. Corrected so velocity calibration isn't polluted. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…een) Contract_Real passed all 4 invariants against real GitHub (xianxu/yingtest42/ shim-conformance), incl. the MinimalRepository empty-ssh_url and PUT-no-op peculiarities. The grounding loop is closed: same contract body green on both the fake (CI) and real gh. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…fake drift Operator: 4 invariants too thin. Added AuthLogin/UserExists/CollaboratorPermission/ UserRepos/DeclineInvitation/RemoveCollaborator invariants — full used surface now grounded. Re-certifying against real GitHub caught two mismatches (grounding working as designed): - CollaboratorPermission non-collaborator → real returns "none" (200), not 404; fake returned "" and drifted → fixed fake to return "none" (consumers already treat it as no-access). - UserExists visible-check used the invitee, but yingtest42 404s on /users/<login> (the live nous#25 visibility lag the fake models) → assert on the owner instead. All 10 invariants pass on fake + real gh; gh/brain/brainsync suites green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The grounding run needs two tokens; now they resolve by default so re-cert is `go test -tags conformance ./lib/gh/ -run Contract_Real` with no env: - operator token <- `gh auth token` - invitee token <- macOS Keychain (security -s nous-conformance-invitee) - owner/invitee logins derived from the tokens (AuthLogin; no usernames baked) - repo defaults to "shim-conformance" All overridable by env (the CI path: encrypted Actions secrets). Tokens never live in the repo — only gh auth / Keychain / CI secrets. Unresolved creds SKIP, never fail. One-time setup documented in the file header. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…rounding) The test was non-destructive and required the repo to pre-exist; deleting it broke zero-config. Now ensure-create the private fixture via `gh repo create` (idempotent; off the Client port since repo-create isn't nous's surface). We create but never delete (token has repo, not delete_repo), so it persists empty. Verified end to end: `go test -tags conformance ./lib/gh/ -run Contract_Real` with NO env passes all 10 invariants — operator token from gh auth, invitee from Keychain, logins derived, repo auto-created. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
… deleted gh.go
Pre-merge specs judge caught two atlas files still referencing lib/gh/gh.go
(deleted in the port split). Repointed to lib/gh/{client,real,fake,types}.go +
the inviteCollaborator composite's new home in client.go. Log note added for the
zero-config grounding refinements.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…off pre-port gh Pre-merge specs judge round 2: relationship-to-ariadne.md still called lib/gh "thin wrappers over gh api" (the exact characterization this PR overturns) → now "provider-neutral control-plane port"; collaborator-lifecycle free-function refs (gh.InviteCollaborator/AcceptInvitation/ListCollaborators) → gh.Client.X. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
xianxu
deleted the
000042-shim-gh-shim-gh-hermetic-github-control-plane-fake-behind-a-provider-neutral-port
branch
June 7, 2026 06:20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.