@linzumi/cli 1.0.112 → 1.0.113

package/scripts/f5_live_cross_harness_failover_e2e.mjs

@@ -0,0 +1,239 @@
+#!/usr/bin/env node
+// F5 LIVE real-harness e2e (compute-nodes program, Workstream F): the
+// cross-harness failover RUNG PATH against the REAL claude-code harness -
+// no scripted double anywhere on the target side.
+//
+//   1. The failover ORACLE (the same bundle the conformance suite runs:
+//      scripts/build-cross-harness-failover-oracle.mjs) drives the REAL
+//      channelSession: a codex thread runs, its backend DIES mid-thread
+//      (the worker/IPC client closes - the precise F5 trigger), the fate
+//      ladder decides the cross_harness_failover rung, and the REAL
+//      transpilation bridge (T.2 exportPage -> T.4 rehydrateSession)
+//      seeds the REAL claude session store (~/.claude/projects/...).
+//   2. The REAL @anthropic-ai/claude-agent-sdk validates the seeded
+//      session (getSessionInfo), reads the transpiled history back
+//      (getSessionMessages), and RESUMES it (query with options.resume),
+//      completing a REAL follow-up turn whose answer must reference
+//      content that exists ONLY in the failed codex thread's transpiled
+//      activity (the coherence probe).
+//
+// This is a LOCAL, manual, credentialed run (it spends one real model
+// turn); it is NOT in any CI test list. Evidence lands in
+// /tmp/linzumi-evidence-f5/ and is mirrored into the committed evidence
+// doc (kandan/server_v2/web/docs/qa-evidence/2026-07-14-f5-failover/).
+//
+// Scope honesty (the T.4 precedent, extended): there is deliberately NO
+// deployed-preview leg - the failover's kandan/codex sides ride the
+// oracle's scripted doubles (killing a real production backend mid-thread
+// on the preview is not an exercisable CI act), while the LADDER, the
+// TRANSPILERS, the SESSION STORE, and the CLAUDE HARNESS are all real.
+
+import { execFileSync } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import { mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const evidenceDir = '/tmp/linzumi-evidence-f5';
+mkdirSync(evidenceDir, { recursive: true });
+
+function fail(message) {
+  console.error(`F5-LIVE-E2E FAIL: ${message}`);
+  process.exit(1);
+}
+
+// --- 1. The REAL rung path: oracle -> ladder -> bridge -> REAL store ---------
+
+execFileSync(
+  process.execPath,
+  [join(packageRoot, 'scripts', 'build-cross-harness-failover-oracle.mjs')],
+  { stdio: 'inherit' }
+);
+
+const cwdRaw = join('/tmp', `linzumi-f5-live-${Date.now()}`);
+mkdirSync(cwdRaw, { recursive: true });
+const cwd = realpathSync(cwdRaw);
+
+const reportRaw = execFileSync(
+  process.execPath,
+  [join(packageRoot, '.differential', 'cross-harness-failover-oracle.mjs')],
+  {
+    env: {
+      ...process.env,
+      // The REAL store: the bridge seeds ~/.claude/projects/<munged-cwd>/.
+      F5_ORACLE_HOME: homedir(),
+      F5_ORACLE_CWD: cwd,
+      F5_ORACLE_EXECUTOR: 'bridge',
+    },
+    encoding: 'utf8',
+  }
+);
+const report = JSON.parse(reportRaw.trim());
+
+const failoverStep = (report.ladderSteps ?? []).find(
+  (step) => step.rung === 'cross_harness_failover'
+);
+if (!failoverStep) fail('the ladder never decided the failover rung');
+if (failoverStep.fate !== 'transient_local') {
+  fail(`unexpected fate: ${failoverStep.fate}`);
+}
+const dispatchedLog = (report.failoverLogs ?? []).find(
+  (log) => log.event === 'codex.fate_ladder_cross_harness_failover_dispatched'
+);
+if (!dispatchedLog) fail('no failover_dispatched receipt log');
+if (dispatchedLog.payload.model !== 'oracle-model-slug') {
+  fail('the receipts did not carry the explicitly-passed model (D39)');
+}
+if (!report.seeded) fail('the bridge seeded no session store');
+const { targetSessionId, sessionFile, transpiledItemCount } = report.seeded;
+console.log('[f5-live] rung decided + REAL store seeded:', sessionFile);
+console.log(
+  '[f5-live] transpiled items:',
+  transpiledItemCount,
+  '(redacted reasoning:',
+  report.seeded.redactedReasoningCount + ')'
+);
+
+writeFileSync(
+  join(evidenceDir, 'f5-live-oracle-report.json'),
+  JSON.stringify(report, null, 2) + '\n'
+);
+
+// The seeded store must contain the recap marker + the journal content.
+const storeLines = readFileSync(sessionFile, 'utf8')
+  .trim()
+  .split('\n')
+  .map((line) => JSON.parse(line));
+const storeText = JSON.stringify(storeLines);
+if (!storeText.includes('[linzumi cross-harness resume]')) {
+  fail('the seeded store carries no cross-harness resume marker');
+}
+if (!storeText.includes('renamed the column and updated 3 call sites')) {
+  fail('the seeded store lost the transpiled codex activity');
+}
+
+// --- 2. The REAL SDK: validate, read back, RESUME, follow-up turn ------------
+
+const sdk = await import('@anthropic-ai/claude-agent-sdk');
+
+// Never run the harness as a nested claude-code session.
+const env = { ...process.env };
+delete env.CLAUDECODE;
+delete env.CLAUDE_CODE_ENTRYPOINT;
+delete env.CLAUDE_CODE_SSE_PORT;
+
+const info = await sdk.getSessionInfo(targetSessionId, { dir: cwd });
+if (!info) fail('the real SDK store did not find the seeded session');
+console.log('[f5-live] getSessionInfo found the failover-seeded session');
+
+const storedMessages = await sdk.getSessionMessages(targetSessionId, {
+  dir: cwd,
+});
+if (storedMessages.length !== storeLines.length) {
+  fail(
+    `store read-back count ${storedMessages.length} != seeded ${storeLines.length}`
+  );
+}
+console.log(
+  '[f5-live] getSessionMessages returned the seeded history:',
+  storedMessages.length,
+  'messages'
+);
+
+// The coherence probe: answerable ONLY from the transpiled codex activity
+// that crossed with the failover.
+const probe =
+  'Answer from this conversation only, in one short sentence: before the ' +
+  'harness failover, how many call sites did the agent say it had already ' +
+  'updated after renaming the column?';
+
+const transcript = [];
+const query = sdk.query({
+  prompt: probe,
+  options: {
+    cwd,
+    resume: targetSessionId,
+    model: 'haiku',
+    permissionMode: 'default',
+    allowedTools: [],
+    maxTurns: 1,
+    persistSession: true,
+    env,
+  },
+});
+
+let announcedSessionId = null;
+let resultMessage = null;
+let assistantText = '';
+for await (const message of query) {
+  transcript.push(message);
+  if (message.type === 'system' && message.subtype === 'init') {
+    announcedSessionId = message.session_id;
+    console.log('[f5-live] system:init announced session:', announcedSessionId);
+  }
+  if (message.type === 'assistant') {
+    const blocks = message.message?.content ?? [];
+    for (const block of blocks) {
+      if (block.type === 'text') assistantText += block.text + '\n';
+    }
+  }
+  if (message.type === 'result') {
+    resultMessage = message;
+    break;
+  }
+}
+
+writeFileSync(
+  join(evidenceDir, 'f5-live-resume-transcript.ndjson'),
+  transcript.map((message) => JSON.stringify(message)).join('\n') + '\n'
+);
+
+if (!resultMessage) fail('the follow-up turn produced no result terminal');
+if (resultMessage.is_error) {
+  fail(`the follow-up turn errored: ${JSON.stringify(resultMessage)}`);
+}
+console.log('[f5-live] follow-up turn completed:', resultMessage.subtype);
+console.log('[f5-live] follow-up answer:', assistantText.trim());
+
+const coherent = /\b(3|three)\b/i.test(assistantText);
+if (!coherent) {
+  fail(
+    'the follow-up answer does not reference the transpiled codex activity ' +
+      '(expected the 3 updated call sites) - the resume did not carry the ' +
+      'failed thread across the harness boundary'
+  );
+}
+console.log(
+  '[f5-live] COHERENCE PROVED: the answer references the 3 updated call ' +
+    'sites, which exist only in the transpiled codex activity'
+);
+
+const summary = {
+  ran_at: new Date().toISOString(),
+  trigger:
+    'transient_local infra kill on a DEAD codex worker (the oracle-scripted backend), redispatch/worker_rebuild unavailable',
+  flag: 'LINZUMI_CROSS_HARNESS_FAILOVER=1 (default OFF)',
+  ladder_decision: failoverStep,
+  failover_receipt: dispatchedLog.payload,
+  source_harness: 'codex',
+  target_harness: 'claude_code',
+  target_session_id: targetSessionId,
+  announced_session_id: announcedSessionId,
+  session_file: sessionFile,
+  transpiled_item_count: transpiledItemCount,
+  redacted_reasoning_count: report.seeded.redactedReasoningCount,
+  follow_up_result_subtype: resultMessage.subtype,
+  follow_up_answer: assistantText.trim(),
+  coherence_probe: probe,
+  coherence_proved: true,
+  scope_honesty:
+    'kandan/codex sides scripted by the oracle doubles; the ladder, the T transpilers, the session store, and the claude harness (SDK resume + real model turn) are all real. No deployed-preview leg (killing a real backend mid-thread on the preview is not an exercisable CI act).',
+};
+writeFileSync(
+  join(evidenceDir, 'f5-live-failover-summary.json'),
+  JSON.stringify(summary, null, 2) + '\n'
+);
+console.log('[f5-live] PASS - evidence in', evidenceDir);
+process.exit(0);