@agentsfleet/orly 0.6.6 → 0.6.7

package/audits/ufs.sh

@@ -343,48 +343,57 @@ done < <(awk -v re="$NUMERIC_RE" '
 ' "${FILES[@]}")
 
 # ── 3. cross-runtime-orphan ─────────────────────────────────────────────────
-# Full-codebase ERR_* parity check. Scoped to ERR_* prefix because that's
-# the cross-runtime contract surface (server error codes consumed by
-# clients). Server (Zig) is the source of truth — every JS/TS ERR_* must
-# have a matching Zig pub const ERR_*. Zig-only ERR_* consts are fine
-# (server-internal codes don't need a client mirror).
+# Full-tree ERR_* parity. Scoped to the ERR_* prefix because that is the
+# cross-runtime contract surface — server error codes a client consumes. Zig is
+# the source of truth: every client-side ERR_* must have a matching Zig
+# `pub const ERR_*`. Zig-only codes are fine; a server-internal code needs no
+# client mirror.
 #
-# Scans the *working tree* via `git ls-files` — sees staged content even
-# before it lands in HEAD, closing the previous diff-mode blindspot where
-# a fix staged in pre-commit couldn't satisfy a check that only read
-# committed history.
+# Scoped BY RUNTIME, not by one repository's directory names. The previous form
+# globbed `src/*.zig`, `agentsfleet/src/*.{js,jsx,ts,tsx}` and
+# `ui/packages/*/src/*.ts{,x}` — one repository's layout inside a gate every
+# repository receives, and it aged exactly as badly as that implies.
+# `agentsfleet/src/` stopped existing, so the JavaScript half globbed ZERO
+# files and "every JS ERR_* has a Zig twin" passed by scanning nothing, while
+# three real codes one directory over went uncompared. A check aimed at a path
+# that resolves to nothing is the same silent green this audit exists to catch.
 #
-# Perf (M70): batched `xargs grep` (single process across all files)
-# instead of `xargs -I{} grep` (one process per file). On agentsfleet the
-# server-side scan dropped from ~30s to <2s.
+# Zig is the source of truth WHERE ZIG EXISTS. A repository with no Zig has
+# nothing to compare against, so the check reports that it skipped rather than
+# passing vacuously — and, more to the point, does not turn every error code in
+# a pure-TypeScript repository into an orphan the moment the globs get fixed.
+#
+# Perf (M70): batched `xargs grep` (single process across all files) instead of
+# `xargs -I{} grep` (one process per file). The server-side scan dropped from
+# ~30s to <2s on a 1000-file Zig tree; scoping by runtime keeps that shape.
 
-zig_err=$(git ls-files -z -- 'src/*.zig' 2>/dev/null \
-  | { grep -zvE '_test\.zig$|^src/zbench_fixtures\.zig$' || true; } \
-  | xargs -0 grep -hE '^pub const ERR_[A-Z][A-Z0-9_]+[[:space:]]*=' 2>/dev/null \
-  | grep -oE 'ERR_[A-Z][A-Z0-9_]+' | sort -u || true)
+# Test and fixture trees are excluded DIRECTORY-shaped, not by `.test.` infix
+# alone. `cli/test/acceptance/fixtures/install-negatives-ops.ts` declares codes
+# that are INPUTS to a negative test — an infix-only filter walked straight
+# past it and would have reported two fixtures as production orphans.
+PARITY_EXCLUDE='(^|/)(test|tests|__tests__|fixtures)/|_test\.zig$|\.test\.|\.spec\.|(^|/)node_modules/|^vendor/|^third_party/|^src/zbench_fixtures\.zig$'
 
-js_err=$(git ls-files -z -- 'agentsfleet/src/*.js' 'agentsfleet/src/*.jsx' 'agentsfleet/src/*.ts' 'agentsfleet/src/*.tsx' 2>/dev/null \
-  | { grep -zvE '\.test\.|\.spec\.' || true; } \
-  | xargs -0 grep -hE '^export const ERR_[A-Z][A-Z0-9_]+[[:space:]]*=' 2>/dev/null \
-  | grep -oE 'ERR_[A-Z][A-Z0-9_]+' | sort -u || true)
+parity_codes() {
+  local declaration="$1"; shift
+  git ls-files -z -- "$@" 2>/dev/null \
+    | { grep -zvE "$PARITY_EXCLUDE" || true; } \
+    | { xargs -0 grep -hE "$declaration" 2>/dev/null || true; } \
+    | grep -oE 'ERR_[A-Z][A-Z0-9_]+' | sort -u || true
+}
 
-ui_err=$(git ls-files -z -- 'ui/packages/*/src/*.ts' 'ui/packages/*/src/*.tsx' 2>/dev/null \
-  | { grep -zvE '\.test\.|\.spec\.' || true; } \
-  | xargs -0 grep -hE '^export const ERR_[A-Z][A-Z0-9_]+[[:space:]]*=' 2>/dev/null \
-  | grep -oE 'ERR_[A-Z][A-Z0-9_]+' | sort -u || true)
+zig_err=$(parity_codes '^pub const ERR_[A-Z][A-Z0-9_]+[[:space:]]*=' '*.zig')
+client_err=$(parity_codes '^export const ERR_[A-Z][A-Z0-9_]+[[:space:]]*=' '*.js' '*.jsx' '*.ts' '*.tsx')
 
-# Every JS ERR_* must exist in Zig.
-for c in $js_err; do
-  if ! echo "$zig_err" | grep -qx "$c"; then
-    record "cross-runtime-orphan $c absent-in-zig"
-  fi
-done
-# Every TS (UI) ERR_* must exist in Zig.
-for c in $ui_err; do
-  if ! echo "$zig_err" | grep -qx "$c"; then
-    record "cross-runtime-orphan $c absent-in-zig"
-  fi
-done
+if [ -z "$zig_err" ]; then
+  ok "audit-ufs: cross-runtime parity skipped — no Zig ERR_* declared, so this repository has no source of truth to compare against"
+else
+  # Every client-side ERR_* must exist in Zig.
+  for c in $client_err; do
+    if ! echo "$zig_err" | grep -qx "$c"; then
+      record "cross-runtime-orphan $c absent-in-zig"
+    fi
+  done
+fi
 
 # ── Report ──────────────────────────────────────────────────────────────────
 

package/dispatch/write_any.md

@@ -348,7 +348,7 @@ ERROR REGISTRY GATE: <file>
 <!-- oracle-packs:start product.agentsfleet -->
 In this repository those surfaces are `src/` (Zig), `rustd/crates/*/src/` (Rust), `cli/src/` and `ui/packages/*/{src,app,lib,components,pages,tests}/` (TypeScript).
 
-`agentsfleet/src/` and `agentsfleet/test/` were listed here until they stopped existing. A trigger path that resolves to nothing is the same silent green this card's gate exists to prevent — and the identical stale prefix in `ufs.sh`'s cross-runtime parity scan means its JavaScript half reads zero files today.
+`agentsfleet/src/` and `agentsfleet/test/` were listed here until they stopped existing. A trigger path that resolves to nothing is the same silent green this card's gate exists to prevent. The identical stale prefix sat in `ufs.sh`'s cross-runtime parity scan, where it made the JavaScript half read zero files; that scan now derives its runtimes instead of naming directories, so no path in it can go stale again.
 <!-- oracle-packs:end -->
 
 **Override:** `UFS GATE: SKIPPED per user override (reason: ...)` immediately preceding the edit. **User-only**; auto-mode does not cover.
@@ -370,7 +370,7 @@ Three discipline points, all part of RULE UFS:
 
 2. **Semantic numeric literals → named constant.** Numeric literals carrying meaning beyond their digits become named consts even at first use. Includes: conversion factors (powers-of-ten ≥ 1e3 used as multipliers/divisors), thresholds, sub-cent rates, time-unit factors, byte-unit factors, retry caps, sentinel offsets. Bare `1_000_000_000` in `nanos / 1_000_000_000` is a smell — `nanos / NANOS_PER_USD` is the rule.
 
-3. **Cross-runtime parity.** Any constant that exists in more than one runtime (Zig, TS, JS) **must share its identifier verbatim**, modulo case where a language idiom forces it (Zig snake_case → TS/JS SCREAMING_SNAKE is a single-runtime style choice; the *semantic* name is identical). When a literal in runtime A would benefit from a name and a sibling runtime already has that name, reuse it. When introducing a new constant, define it in every runtime that uses the same value, same commit. There is no per-constant carve-out: this applies to every cross-runtime constant, not a curated subset.
+3. **Cross-runtime parity.** Any constant that exists in more than one of the runtimes this repository ships **must share its identifier verbatim**, modulo case where a language idiom forces it (Zig snake_case → TS/JS SCREAMING_SNAKE is a single-runtime style choice; the *semantic* name is identical). When a literal in runtime A would benefit from a name and a sibling runtime already has that name, reuse it. When introducing a new constant, define it in every runtime that uses the same value, same commit. There is no per-constant carve-out: this applies to every cross-runtime constant, not a curated subset.
 
 The gate exists because RULE UFS is otherwise pure self-policing. Without an audit script, an inline literal in a 800-LOC editing session reliably slips past attention.
 
@@ -421,6 +421,8 @@ The previous `--diff` (`BASE...HEAD`) default was retired with M70. The forcing
 
 `--all` is accepted as a back-compat alias for the default. `--diff` is rejected with exit 2 + a pointer to this section.
 
+**Parity scope is derived, not named.** The ERR_* parity scan reads `*.zig` as the source of truth and every other in-scope runtime file as the client side, anywhere in the tree. It used to glob three fixed directories; when one of them stopped existing the glob matched zero files and "every client `ERR_*` has a Zig twin" passed by scanning nothing. Where a repository ships no Zig there is no source of truth, so the check prints that it skipped — a repository with one runtime is not a repository with an orphan in every file. Test and fixture trees are excluded directory-shaped (`test/`, `tests/`, `fixtures/`), because a code declared as the INPUT to a negative test is not a client mirror.
+
 **Languages the leaf reads.** Zig, TypeScript, JavaScript, Rust and Go. The rule is one rule, but each language hides its literals differently, so each gets a lane in `is_source` + the string-dup pass:
 
 | Language | Held out of the count, and why |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentsfleet/orly",
-  "version": "0.6.6",
+  "version": "0.6.7",
   "description": "Repository-scoped engineering harness: renders agent rules, materialises the gates that enforce them, and proves the PR boundary \u2014 for any coding agent.",
   "license": "MIT",
   "type": "module",