space-architect 8.0.0 → 9.0.0

data/lib/space_src/config/store.rb

@@ -1,156 +0,0 @@
-# frozen_string_literal: true
-
-require "yaml"
-require "fileutils"
-require "dry/monads"
-require "space_src/config/model"
-require "space_src/config/contract"
-
-module Space::Src
-  module Config
-    # Load/validate/write-back the YAML config file.
-    #
-    # The store is the only place that touches the disk. It does not
-    # preserve unknown keys or YAML comments on write — that's a known
-    # limitation per the PRD §2 (YAML comment loss accepted) and is
-    # documented in the Slice 1 lane report. Managed fields round-trip
-    # byte-identically (gate G1).
-    class Store
-      extend Dry::Monads[:result]
-
-      DEFAULT_BASE_DIR = Space::Src::Paths::DEFAULT_BASE_DIR
-      DEFAULT_REFRESH_INTERVAL = 6 * 3600
-      DEFAULT_CONCURRENCY = 8
-
-      def self.load(path)
-        raw = read_yaml(path)
-        hash = symbolize(raw)
-        # CF1: normalize `refresh_interval` from a human-duration
-        # string ("6h", "90m", "45s", "30d") or bare integer string
-        # ("21600") into integer seconds BEFORE the contract runs.
-        # The contract stays integer-typed (:integer, gt?: 0); this
-        # is a load-layer normalization that lets a hand-edited
-        # config.yaml round-trip without rejecting "6h" as a
-        # non-integer. See lib/space_src/config/duration.rb.
-        if hash.key?(:refresh_interval)
-          result = Duration.parse(hash[:refresh_interval])
-          return result if result.failure?
-          hash[:refresh_interval] = result.success
-        end
-        with_defaults(hash) do |filled|
-          result = Contract.new.call(filled)
-          if result.success?
-            Success(Config.new(result.success))
-          else
-            Failure(result.failure)
-          end
-        end
-      rescue Errno::ENOENT
-        # Missing file is treated as an empty config (load defaults).
-        # The store does not create the file on read — that is the
-        # writer's job (write() is idempotent and always validates first).
-        Success(Config.new(defaults))
-      end
-
-      def self.write(path, config)
-        # Always re-validate the struct's contents before writing. This
-        # guards against a caller constructing a Config with a
-        # constraint-violating value via Struct.new (which does not run
-        # the same checks as the contract).
-        hash = config.to_h
-        result = Contract.new.call(hash)
-        return result if result.failure?
-
-        FileUtils.mkdir_p(File.dirname(path))
-        File.write(path, emit(hash))
-        Success(config)
-      end
-
-      def self.update(path)
-        config = load(path).success
-        new_config = yield(config)
-        write(path, new_config)
-      end
-
-      # dry-struct update idiom: pass a hash of attributes to
-      # `Config#new` to get a new struct with the overrides applied
-      # (existing fields are kept).
-      def self.with(config, **changes)
-        config.new(**changes)
-      end
-
-      # Hash → human-clean YAML string. String keys, defaults omitted.
-      # Stable key order: base_dir, refresh_interval, concurrency, repos, orgs.
-      # repos/orgs omitted when empty.
-      def self.emit(hash)
-        ordered = {}
-        ordered["base_dir"] = hash[:base_dir] if hash.key?(:base_dir)
-        ordered["refresh_interval"] = hash[:refresh_interval] if hash.key?(:refresh_interval)
-        ordered["concurrency"] = hash[:concurrency] if hash.key?(:concurrency)
-
-        repos = hash[:repos]
-        ordered["repos"] = repos.map { |r| compact_repo(r) } if repos && !repos.empty?
-
-        orgs = hash[:orgs]
-        ordered["orgs"] = orgs.map { |o| compact_org(o) } if orgs && !orgs.empty?
-
-        YAML.dump(ordered, line_width: -1)
-      end
-
-      def self.compact_repo(r)
-        h = {}
-        h["host"] = r[:host] if r[:host] && r[:host] != DEFAULT_HOST
-        h["owner"] = r[:owner]
-        h["name"] = r[:name]
-        h
-      end
-
-      def self.compact_org(o)
-        h = {}
-        h["host"] = o[:host] if o[:host] && o[:host] != DEFAULT_HOST
-        h["name"] = o[:name]
-        h["include_archived"] = true if o[:include_archived]
-        h["include_forks"] = true if o[:include_forks]
-        ignored = o[:ignored_repos]
-        h["ignored_repos"] = ignored if ignored && !ignored.empty?
-        h
-      end
-
-      def self.read_yaml(path)
-        return {} unless File.exist?(path)
-        # Symbol permitted because some YAML files use :symbol keys; the
-        # store's symbolize() then re-keys consistently anyway. We still
-        # disallow arbitrary classes.
-        YAML.safe_load_file(path, permitted_classes: [Symbol], aliases: false) || {}
-      end
-
-      def self.symbolize(value)
-        case value
-        when Hash
-          value.each_with_object({}) { |(k, v), acc| acc[k.to_sym] = symbolize(v) }
-        when Array
-          value.map { |v| symbolize(v) }
-        else
-          value
-        end
-      end
-
-      # Fill in missing top-level defaults before validation, so an empty
-      # YAML produces a fully-populated Config.
-      def self.with_defaults(hash)
-        filled = defaults.merge(hash)
-        yield(filled)
-      end
-
-      def self.defaults
-        {
-          base_dir: DEFAULT_BASE_DIR,
-          refresh_interval: DEFAULT_REFRESH_INTERVAL,
-          concurrency: DEFAULT_CONCURRENCY,
-          repos: [],
-          orgs: []
-        }
-      end
-    end
-  end
-end

data/lib/space_src/forge/client.rb

@@ -1,31 +0,0 @@
-# frozen_string_literal: true
-
-require "dry/monads"
-require "space_src/config/model"
-
-module Space::Src
-  module Forge
-    # Abstract forge interface. The GitHub implementation lists the
-    # repos belonging to an OrgRef. The interface is intentionally
-    # narrow: a forge is a source of (host, owner, name) triples. The
-    # sync engine expands an OrgRef into RepoRefs at sync time; it
-    # never asks the forge about a specific repo.
-    class Client
-      extend Dry::Monads[:result]
-
-      # Returns Success(:authenticated) or Failure({reason:}).
-      # Called ONCE by the engine before fanning out org listings.
-      def check_authenticated
-        raise NotImplementedError
-      end
-
-      # Returns Success([RepoRef, ...]) or Failure. Honors the
-      # include_archived / include_forks flags on the OrgRef.
-      # Does NOT perform authentication — the engine calls
-      # check_authenticated first.
-      def list_org(org_ref)
-        raise NotImplementedError
-      end
-    end
-  end
-end

data/lib/space_src/forge/github.rb

@@ -1,98 +0,0 @@
-# frozen_string_literal: true
-
-require "json"
-require "space_src/forge/client"
-require "space_src/shell"
-require "space_src/config/model"
-
-module Space::Src
-  module Forge
-    # `gh repo list <org> --json …` implementation of Forge::Client.
-    #
-    # Per AGENTS.md gotcha, `gh` can silently fall back to
-    # unauthenticated (60 req/hr). We probe `gh auth status` once
-    # (via the engine calling check_authenticated before listing)
-    # and surface a clear Failure rather than risking the rate-limit wall.
-    class GitHub < Client
-      # Default page size for `gh repo list`. Matches gh's own --limit
-      # cap; orgs with >1000 repos are out of scope for Slice 1.
-      LIST_LIMIT = 1000
-
-      def initialize(shell: Shell)
-        @shell = shell
-      end
-
-      # Probe `gh auth status`. On stderr the unauthenticated case is
-      # obvious: "You are not logged into any GitHub hosts." We treat
-      # that exact phrase as Failure; otherwise Success.
-      #
-      # Public so the engine can call it once before fanning out org
-      # listings. `list_org` no longer authenticates per-call.
-      def check_authenticated
-        # `gh auth status` writes a human-friendly summary to stdout
-        # and exits 0 when authenticated, 1 when not. We also fail
-        # when the binary is missing (status 127 from the shell).
-        result = @shell.run("gh", "auth", "status")
-        return result if result.failure?
-
-        if result.success.include?("not logged into any GitHub hosts")
-          Dry::Monads::Failure({reason: "gh not authenticated; run `gh auth login` first"})
-        else
-          Dry::Monads::Success(:authenticated)
-        end
-      end
-
-      def list_org(org_ref)
-        return Dry::Monads::Failure({org: org_ref.name, reason: "missing org name"}) if org_ref.name.nil? || org_ref.name.empty?
-
-        argv = build_argv(org_ref)
-        result = @shell.run(*argv)
-        return result if result.failure?
-
-        parsed = parse_repos(result.success, org_ref)
-        Dry::Monads::Success(parsed)
-      rescue JSON::ParserError => e
-        Dry::Monads::Failure({org: org_ref.name, reason: "invalid JSON from gh", error: e.message})
-      end
-
-      def build_argv(org_ref)
-        # G11 fix (Slice 2): `--no-source` is NOT a valid `gh repo list`
-        # flag (`gh repo list --help` lists `--archived`, `--no-archived`,
-        # `--fork`, `--source`, `--json`, `--limit`, `--topic`,
-        # `--language`, `--visibility`, `--jq`, `--template` — no
-        # `--no-source`). Fork exclusion is handled authoritatively in
-        # `parse_repos` below (the `include_forks` filter), so we no
-        # longer emit an advisory CLI flag for it. The existing G6
-        # behavioral tests for `include_forks=false` still pass.
-        argv = ["gh", "repo", "list", org_ref.name, "--json", "nameWithOwner,defaultBranchRef,isArchived,isFork", "--limit", LIST_LIMIT.to_s]
-        argv << "--no-archived" unless org_ref.include_archived
-        argv
-      end
-
-      private
-
-      # Parses gh's JSON output into RepoRef structs, honoring
-      # include_archived / include_forks (the CLI flags are advisory;
-      # the filter is authoritative so a future gh flag rename
-      # doesn't break us silently).
-      def parse_repos(json_text, org_ref)
-        rows = JSON.parse(json_text)
-        ignored = org_ref.ignored_repos
-        rows.map do |row|
-          next if !org_ref.include_archived && row["isArchived"]
-          next if !org_ref.include_forks && row["isFork"]
-
-          owner, name = row.fetch("nameWithOwner").split("/", 2)
-          next if ignored.include?(name) || ignored.include?(row.fetch("nameWithOwner"))
-          # default_branch is state, not config — the SCM layer resolves
-          # it on the local clone (see SCM::Git#default_branch).
-          Config::RepoRef.new(
-            host: org_ref.host,
-            owner: owner,
-            name: name
-          )
-        end.compact
-      end
-    end
-  end
-end

data/lib/space_src/launchd/agent.rb

@@ -1,195 +0,0 @@
-# frozen_string_literal: true
-
-require "dry/monads"
-require "async"
-require "space_src/shell"
-require "space_src/launchd/plist"
-
-module Space::Src
-  module Launchd
-    # launchctl wrapper. Holds an injected command runner (the
-    # real default goes through `Space::Src::Shell` inside a
-    # `Sync{}` block; tests inject a `RecordingRunner` that
-    # captures argv and returns canned output — gate G2).
-    #
-    # All public methods return `Dry::Monads::Result`. A non-zero
-    # `launchctl` exit surfaces as `Failure({argv:, stderr:,
-    # status:})` — the same shape `Shell.run` uses — NOT a
-    # raise. A non-zero `runner` exit propagates as `Failure` to
-    # the caller.
-    #
-    # Domain: every operation targets `gui/<UID>` (the user's
-    # per-GUI-session launchd domain — the conventional domain
-    # for user-installed LaunchAgents on macOS). The UID is
-    # resolved via `Process.uid` by default; tests may inject
-    # a different UID to assert the exact argv (G2).
-    class Agent
-      extend Dry::Monads[:result]
-
-      DEFAULT_LABEL = "io.github.jetpks.space-src.sync"
-
-      # The default real-runner. Wraps `Shell.run` in a `Sync{}`
-      # block so the Fiber-scheduler requirement is satisfied.
-      # Outside an ambient Async::Task, `Shell.run` would raise;
-      # the wrapper creates one. This is the only place the
-      # production code path touches `Shell` for launchctl.
-      class ShellRunner
-        def run(*argv, **opts)
-          Sync do |_task|
-            if opts.empty?
-              Shell.run(*argv)
-            else
-              Shell.run(*argv, **opts)
-            end
-          end
-        end
-      end
-
-      def initialize(runner: ShellRunner.new, uid: Process.uid, label: DEFAULT_LABEL)
-        @runner = runner
-        @uid = uid
-        @label = label
-      end
-
-      attr_reader :label
-
-      # `launchctl bootstrap gui/<UID> <abs-plist-path>`
-      def install(plist_path)
-        run("bootstrap", "gui/#{@uid}", plist_path)
-      end
-
-      # `launchctl bootout gui/<UID>/<label>`
-      #
-      # Idempotency (Slice 5 / CF5): a benign bootout Failure
-      # (status 3 / "No such process" / "Could not find
-      # specified service") is mapped to **Success** —
-      # uninstalling a not-loaded agent is a no-op for the
-      # bootout step. The plist removal in the CLI command
-      # layer is independent of this result.
-      def uninstall
-        r = run("bootout", "gui/#{@uid}/#{@label}")
-        return Dry::Monads::Success("") if benign_bootout_failure?(r)
-        r
-      end
-
-      # bootstrap the plist, then `enable` the service.
-      # Both must succeed (both 0 exit) for the operation to
-      # be a `Success`; the first failure short-circuits.
-      def start(plist_path)
-        r1 = run("bootstrap", "gui/#{@uid}", plist_path)
-        return r1 if r1.failure?
-        run("enable", "gui/#{@uid}/#{@label}")
-      end
-
-      # bootout the service, then `disable` it.
-      #
-      # Idempotency (Slice 5 / CF5): a `bootout` Failure with
-      # `status == 3` ("No such process") or matching the
-      # not-loaded stderr is treated as **already not loaded**
-      # and is not propagated — the disable step still runs so
-      # the persistent `disable` override stays in place
-      # (matching the gate's recorded-argv assertion
-      # `[[bootout,…], [disable,…]]` and the
-      # "stopped" semantic). A non-benign bootout Failure
-      # (e.g. status 1 "Operation not permitted") short-
-      # circuits as before.
-      def stop
-        r1 = run("bootout", "gui/#{@uid}/#{@label}")
-        return r1 if r1.failure? && !benign_bootout_failure?(r1)
-        run("disable", "gui/#{@uid}/#{@label}")
-      end
-
-      # `launchctl kickstart -k gui/<UID>/<label>` — `-k` kills
-      # the running instance first so the new one always starts.
-      def restart
-        run("kickstart", "-k", "gui/#{@uid}/#{@label}")
-      end
-
-      # Returns a defensive parse of `launchctl list` (the
-      # machine-readable form — `launchctl print` is documented
-      # as "not API"). We run `launchctl list` (no service
-      # target) and search the output for our label.
-      #
-      # The parser tolerates: empty output, a "Could not find"
-      # line, malformed rows, and PID values that are not
-      # integers. On any of those, we return Success(loaded:
-      # false) — the gate G4 "no raise on malformed" guarantee.
-      def status
-        result = run("list")
-        return result if result.failure?
-        parse_list(result.success)
-      end
-
-      # ----- internal: argv dispatch + list parser -----
-
-      private
-
-      # CF5: a `bootout` Failure whose `status == 3` ("No such
-      # process") OR whose stderr matches the
-      # not-loaded markers is **not a real failure** — the
-      # service is simply not currently loaded, which is the
-      # common case at a 6h refresh interval. We key on
-      # `argv[1] == "bootout"` so the benign mapping is
-      # strictly scoped to bootout (bootstrap status-3
-      # remains a real Failure — gate G3 regression guard).
-      #
-      # Status 3 is the POSIX `ESRCH` errno (`launchctl error 3`
-      # → "No such process") and is the documented signal.
-      # The stderr regex is the defensive OR — `launchctl`
-      # stderr text is NOT API and may drift; we accept both
-      # observed phrasings ("No such process" from recent
-      # macOS, "Could not find specified service" from older
-      # releases / the legacy `unload` path).
-      def benign_bootout_failure?(result)
-        return false unless result.failure?
-
-        f = result.failure
-        return false unless f.is_a?(Hash)
-
-        argv = f[:argv]
-        return false unless argv.is_a?(Array) && argv[1] == "bootout"
-
-        return true if f[:status] == 3
-        stderr = f[:stderr].to_s
-        stderr.match?(/No such process|Could not find specified service/i)
-      end
-
-      # Every operation is a `launchctl` subcommand — the program
-      # name must be argv[0] so the runner (real `Shell.run` →
-      # Open3) actually execs `launchctl`, not the bare subcommand.
-      def run(*argv)
-        @runner.run("launchctl", *argv)
-      end
-
-      # Parses the tabular output of `launchctl list`. Each line
-      # is three tab-separated fields: PID, Status (last exit
-      # code), Label. PID is "-" if the job is not currently
-      # running. A line whose label matches ours is the row we
-      # want; everything else is ignored.
-      def parse_list(output)
-        return Dry::Monads::Success({loaded: false, running: false, last_exit: nil, pid: nil}) if output.nil? || output.empty?
-
-        output.each_line do |line|
-          fields = line.chomp.split("\t", 3)
-          next if fields.length < 3
-          pid_s, status_s, lbl = fields
-          next unless lbl == @label
-          pid = (pid_s == "-" || pid_s.nil? || pid_s.empty?) ? nil : Integer(pid_s, exception: false)
-          status = (status_s == "-" || status_s.nil? || status_s.empty?) ? nil : Integer(status_s, exception: false)
-          return Dry::Monads::Success({
-            loaded: true,
-            running: !pid.nil?,
-            pid: pid,
-            last_exit: status
-          })
-        end
-
-        Dry::Monads::Success({loaded: false, running: false, last_exit: nil, pid: nil})
-      rescue => e
-        # Defensive: any unexpected parse failure is reported as
-        # "unknown" — NOT a raise (gate G4).
-        Dry::Monads::Success({loaded: false, running: false, last_exit: nil, pid: nil, error: e.message})
-      end
-    end
-  end
-end

data/lib/space_src/launchd/plist.rb

@@ -1,129 +0,0 @@
-# frozen_string_literal: true
-
-module Space::Src
-  module Launchd
-    # Hand-rolled launchd plist emitter. The slice forbids a plist
-    # gem (PRD §2, AGENTS.md) — this class emits an XML property
-    # list as a string and is validated offline with `plutil -lint`.
-    #
-    # The plist produced here is a fixed-shape StartInterval-driven
-    # agent that:
-    #   * runs `src sync` non-interactively under the
-    #     repo's mise-managed Ruby (so the right toolchain is in
-    #     effect without `mise activate`, which is broken
-    #     non-interactively);
-    #   * is classified as a Background process (lower scheduling
-    #     + I/O priority — sync is a periodic background job);
-    #   * writes its stdout/stderr to absolute log files under
-    #     the log dir (launchd owns the redirect, the sync process
-    #     rotates its own log on each run — see LogRotator);
-    #   * has NO `KeepAlive` key — it is a periodic, not a daemon.
-    #
-    # The caller is responsible for passing absolute paths. We do
-    # NOT `File.expand_path` here — that would mask the caller's
-    # responsibility to pass absolute paths (the G1 / G3 gates
-    # assert that no `~` or `$HOME` appears in any value).
-    class Plist
-      # The plist's outer XML decl + DOCTYPE — required by
-      # plutil's lint and by launchd's parser.
-      HEADER = <<~XML
-        <?xml version="1.0" encoding="UTF-8"?>
-        <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-        <plist version="1.0">
-        <dict>
-      XML
-      FOOTER = "</dict>\n</plist>\n"
-
-      class << self
-        # Emit a launchd plist for a sync job.
-        #
-        # @param label [String]              The job label (must be a valid reverse-DNS string; appears as the basename of the on-disk plist).
-        # @param refresh_interval [Integer] StartInterval in seconds (must be > 0).
-        # @param log_dir [String]            Absolute directory for the standard-out / standard-err logs.
-        # @param repo_root [String]          Absolute path to set as WorkingDirectory (so mise finds the repo's mise.toml).
-        # @param mise_toml [String]          Absolute path to mise.toml (pinned via EnvironmentVariables.MISE_CONFIG_FILE).
-        # @param mise_bin [String]           Absolute path to the mise binary (ProgramArguments[0]).
-        # @param ruby_bin [String]           Absolute path to the ruby to run the script under.
-        # @param bin_path [String]           Absolute path to the src bin script.
-        # @return [String]                   The full plist XML, ready to be written to disk and `plutil -lint`-validated.
-        def call(label:, refresh_interval:, log_dir:, repo_root:, mise_toml:, mise_bin:, ruby_bin:, bin_path:)
-          raise ArgumentError, "label is required" if label.to_s.empty?
-          raise ArgumentError, "refresh_interval must be > 0" unless refresh_interval.is_a?(Integer) && refresh_interval > 0
-          %w[log_dir repo_root mise_toml mise_bin ruby_bin bin_path].each do |k|
-            v = binding.local_variable_get(k)
-            raise ArgumentError, "#{k} must be absolute (got #{v.inspect})" unless v.is_a?(String) && File.absolute_path?(v)
-          end
-
-          out_log = File.join(log_dir, "#{label}.out.log")
-          err_log = File.join(log_dir, "#{label}.err.log")
-
-          body = +""
-          body << key("Label") << string(label) << "\n"
-          body << key("ProgramArguments") << "\n" << array([
-            mise_bin,
-            "exec",
-            "--",
-            ruby_bin,
-            bin_path,
-            "sync"
-          ])
-          body << key("WorkingDirectory") << string(repo_root) << "\n"
-          body << key("EnvironmentVariables") << "\n" << dict({
-            "MISE_CONFIG_FILE" => mise_toml
-          })
-          body << key("StartInterval") << integer(refresh_interval) << "\n"
-          body << key("RunAtLoad") << boolean(true) << "\n"
-          body << key("ProcessType") << string("Background") << "\n"
-          body << key("StandardOutPath") << string(out_log) << "\n"
-          body << key("StandardErrorPath") << string(err_log) << "\n"
-
-          HEADER + body + FOOTER
-        end
-
-        private
-
-        def key(name)
-          "  <key>#{escape(name)}</key>\n"
-        end
-
-        # XML-escape: & must be first, then <, >, " and ' in attribute values
-        # (we only emit element text, but be safe for both).
-        def escape(s)
-          s.to_s
-            .gsub("&", "&amp;")
-            .gsub("<", "&lt;")
-            .gsub(">", "&gt;")
-            .gsub("\"", "&quot;")
-            .gsub("'", "&apos;")
-        end
-
-        def string(s)
-          "  <string>#{escape(s)}</string>"
-        end
-
-        def integer(i)
-          "  <integer>#{Integer(i)}</integer>"
-        end
-
-        def boolean(b)
-          "  <#{b ? "true" : "false"}/>"
-        end
-
-        def array(items)
-          out = +"  <array>\n"
-          items.each { |arg| out << "    <string>#{escape(arg)}</string>\n" }
-          out << "  </array>"
-        end
-
-        def dict(hash)
-          out = +"  <dict>\n"
-          hash.each do |k, v|
-            out << "    <key>#{escape(k)}</key>\n"
-            out << "    <string>#{escape(v)}</string>\n"
-          end
-          out << "  </dict>"
-        end
-      end
-    end
-  end
-end

data/lib/space_src/log_rotator.rb

@@ -1,46 +0,0 @@
-# frozen_string_literal: true
-
-require "fileutils"
-require "time"
-require "dry/monads"
-
-module Space::Src
-  # Rotates a log file when it exceeds a byte threshold. The
-  # archive's filename embeds an ISO-8601-compact timestamp
-  # (`YYYYMMDDTHHMMSSZ`) of the rotation event (the injected
-  # `now` — deterministic in tests, real `Time.now` in
-  # production). The rename is byte-for-byte — no copy, no
-  # data loss.
-  #
-  # The sync process calls this at the top of `Run#call` to
-  # rotate the two plist log paths (`<label>.out.log` and
-  # `<label>.err.log`). launchd opens those files fresh on the
-  # next spawn; the current process's inherited fd still points
-  # to the renamed file (writes succeed; the file is the
-  # archive). After the process exits, launchd re-opens a new
-  # file at the original path. This is the mechanism the spec
-  # asked for (gate G5).
-  class LogRotator
-    extend Dry::Monads[:result]
-
-    # @param log_path [String]           absolute path to the log file to potentially rotate
-    # @param threshold_bytes [Integer]   rotation threshold; > this many bytes ⇒ rotate
-    # @param now [Time]                  the timestamp to embed in the archive filename
-    # @return [Dry::Monads::Result<Hash>] Success({rotated: bool, archive_path: String|nil})
-    def self.call(log_path, threshold_bytes:, now: Time.now)
-      return Success({rotated: false, archive_path: nil, reason: "missing"}) unless File.exist?(log_path)
-      return Success({rotated: false, archive_path: nil, reason: "under_threshold"}) if File.size(log_path) <= threshold_bytes
-
-      archive = build_archive_path(log_path, now)
-      FileUtils.mv(log_path, archive)
-      Success({rotated: true, archive_path: archive, reason: "oversized"})
-    rescue => e
-      Failure({log_path: log_path, error: e.class.name, message: e.message})
-    end
-
-    def self.build_archive_path(log_path, now)
-      ts = now.utc.strftime("%Y%m%dT%H%M%SZ")
-      "#{log_path}.#{ts}"
-    end
-  end
-end