@rubytech/create-maxy-code 0.1.157 → 0.1.158

package/payload/platform/scripts/smoke-boot-services.sh

@@ -1,16 +1,40 @@
 #!/usr/bin/env bash
 #
 # smoke-boot-services.sh — boot every compiled service against a synthetic
-# install fixture, assert the canonical `boot port=` log line appears and no
-# `^\[.*\] fatal ` line is emitted before SIGTERM.
+# install fixture, run the cypher schema against a live Neo4j, and assert
+# every startup-self-test the production boot would log fires here.
 #
-# Motivation: Task 099 — `claude-session-manager` shipped a `require()` call
-# in an ESM module. tsc + vitest (Vite shims `require`) were green; native
-# Node ESM at boot threw `ReferenceError: require is not defined` and crash-
-# looped the service. This gate boots the compiled service from a temp
-# install dir — the same shape the installer writes — so the runtime
-# evaluator runs every module-load and arm()/init path the production
-# service runs.
+# Failure modes caught (Task 438):
+#   - specialist-tool-drift: a specialist template (or per-account override)
+#     names a tool the plugin does not export.
+#   - system-prompt-sentinels: the composer drops a `<name>` the
+#     IDENTITY.md prose references.
+#   - identity-drift: IDENTITY.md mentions a `<name>` the composer does not
+#     emit.
+#   - cypher-schema: schema.cypher contains syntax the live Neo4j rejects
+#     (e.g. Neo4j 4 `DROP FULLTEXT INDEX` against a Neo4j 5 parser).
+#   - module-load: the original Task 099 motivation — `require()` in ESM,
+#     missing externals, stray top-level throws.
+#
+# Fixture shape: the temp install dir mirrors what the installer writes on
+# first boot. Real templates are copied (not stubs) so the drift gates run
+# against the same content production would see:
+#   $INSTALL_DIR/platform/config/brand.json
+#   $INSTALL_DIR/platform/plugins/<name>/PLUGIN.md          (real manifests)
+#   $INSTALL_DIR/platform/templates/agents/admin/*.md       (real templates)
+#   $INSTALL_DIR/platform/templates/specialists/agents/*.md (real templates)
+#   $INSTALL_DIR/data/accounts/<uuid>/account.json
+#   $INSTALL_DIR/data/accounts/<uuid>/agents/admin/{IDENTITY,SOUL,AGENTS}.md
+#   $INSTALL_DIR/data/accounts/<uuid>/specialists/agents/*.md (per-account)
+#   $INSTALL_DIR/.claude/                                    (CLAUDE_CONFIG_DIR)
+#
+# Cypher gate: apply schema.cypher to the dev's local Neo4j via cypher-shell.
+# NEO4J_URI / NEO4J_USER / NEO4J_PASSWORD must be set (same shape as
+# seed-neo4j.sh — the maintainer's existing local install). The gate is a
+# real apply, not parse-only: schema commands use `IF NOT EXISTS` / `IF
+# EXISTS` and the dev's Neo4j is the test surface — pollution is the point.
+# If cypher-shell is absent or NEO4J_URI is unset, the gate exits non-zero
+# so the publish blocker maps to the same code path a real install hits.
 #
 # Service list: extend SERVICES below as additional services adopt the
 # smoke gate. Each entry needs a fixture function that creates the temp
@@ -42,28 +66,28 @@ cleanup() {
 }
 trap cleanup EXIT
 
-# Build the synthetic install dir for claude-session-manager. The layout
-# mirrors what the installer writes (and what loadConfig walks):
-#   $INSTALL_DIR/platform/config/brand.json
-#   $INSTALL_DIR/platform/plugins/<name>/PLUGIN.md  (real manifests — tool surface)
-#   $INSTALL_DIR/platform/templates/specialists/agents/*.md  (real shipped set)
-#   $INSTALL_DIR/data/accounts/<uuid>/account.json
-#   $INSTALL_DIR/data/accounts/<uuid>/agents/admin/{IDENTITY,SOUL}.md
+# Build the synthetic install dir for claude-session-manager. Layout mirrors
+# what the installer writes on first boot, with REAL template content (not
+# stubs) so the drift gates fire against the same files production sees.
 #
-# Specialist templates and plugin PLUGIN.md files are copied from the real
-# source so assertSpecialistDrift runs against the actual shipped content.
-# An empty specialists dir or empty plugins dir both yield a trivial pass
-# (0 specialists inspected = no defects found), hiding tool-name mismatches
-# that only surface at production boot.  Only PLUGIN.md manifests are copied;
-# MCP binaries are not needed — the drift check parses frontmatter only.
+# Why real-templates: a 0-specialist or empty-IDENTITY fixture lets every
+# drift gate fall through trivially (Task 438). The 0.1.155 install regressed
+# because the librarian per-account override referenced an MCP tool the
+# memory plugin no longer exports — a defect the smoke fixture missed because
+# the fixture's per-account specialists dir was empty.
 fixture_claude_session_manager() {
   local install_dir="$1"
   local platform_root="$install_dir/platform"
+  local templates_src="$REPO_ROOT/platform/templates"
   local account_id="00000000-0000-4000-8000-000000000000"
   local account_dir="$install_dir/data/accounts/$account_id"
 
   mkdir -p "$platform_root/config"
   mkdir -p "$account_dir/agents/admin"
+  mkdir -p "$account_dir/agents/public"
+  mkdir -p "$account_dir/specialists/agents"
+  mkdir -p "$account_dir/.claude"
+  mkdir -p "$install_dir/.claude"
 
   cat > "$platform_root/config/brand.json" <<'BRAND'
 {
@@ -72,20 +96,39 @@ fixture_claude_session_manager() {
 }
 BRAND
 
-  echo '{}' > "$account_dir/account.json"
-  # IDENTITY.md references no `<sentinels>`, so runIdentityDriftAssertion has
-  # nothing to verify and trivially passes. SOUL.md is read per-spawn (not at
-  # boot) but the file presence is convention.
-  echo "smoke identity" > "$account_dir/agents/admin/IDENTITY.md"
-  echo "smoke soul" > "$account_dir/agents/admin/SOUL.md"
-
-  # Real specialist templates — the drift check looks at
-  # $PLATFORM_ROOT/templates/specialists/agents/; an absent or empty dir
-  # means 0 specialists inspected and the drift gate is a no-op.
-  local specialists_src="$REPO_ROOT/packages/create-maxy-code/payload/platform/templates/specialists/agents"
-  local specialists_dst="$platform_root/templates/specialists/agents"
-  mkdir -p "$specialists_dst"
-  cp "$specialists_src"/*.md "$specialists_dst/"
+  # account.json field set mirrors the live template's required fields
+  # (resolveAccount throws on missing adminModel/publicModel). Values just
+  # need to satisfy the field check — boot never hits Anthropic.
+  cat > "$account_dir/account.json" <<JSON
+{
+  "accountId": "$account_id",
+  "tier": "smoke-test",
+  "adminModel": "claude-sonnet-4-6",
+  "publicModel": "claude-haiku-4-5"
+}
+JSON
+
+  # Real admin templates — the drift gate reads the per-account IDENTITY.md;
+  # SOUL/AGENTS are not boot-gated but presence is convention.
+  cp "$templates_src/agents/admin/IDENTITY.md" "$account_dir/agents/admin/IDENTITY.md"
+  cp "$templates_src/agents/admin/SOUL.md" "$account_dir/agents/admin/SOUL.md"
+  [ -f "$templates_src/agents/admin/AGENTS.md" ] && cp "$templates_src/agents/admin/AGENTS.md" "$account_dir/agents/admin/AGENTS.md"
+  [ -f "$templates_src/agents/public/IDENTITY.md" ] && cp "$templates_src/agents/public/IDENTITY.md" "$account_dir/agents/public/IDENTITY.md"
+
+  # Real per-account specialist overrides — the drift gate walks
+  # $accountDir/specialists/agents/ alongside the template path. 0.1.155
+  # regressed because this dir was empty in the smoke fixture; a per-account
+  # override referencing a withdrawn tool slipped through to a real install.
+  for specialist in "$templates_src/specialists/agents/"*.md; do
+    [ -f "$specialist" ] && cp "$specialist" "$account_dir/specialists/agents/$(basename "$specialist")"
+  done
+
+  # Real templates copied into $PLATFORM_ROOT/templates so the drift gate's
+  # template-path walk sees the same content as production.
+  mkdir -p "$platform_root/templates/agents/admin"
+  mkdir -p "$platform_root/templates/specialists/agents"
+  cp "$templates_src/agents/admin/"*.md "$platform_root/templates/agents/admin/" 2>/dev/null || true
+  cp "$templates_src/specialists/agents/"*.md "$platform_root/templates/specialists/agents/"
 
   # Real plugin manifests — loadToolSurface walks platform/plugins/*/PLUGIN.md
   # to build the tool surface. An empty plugins dir gives an empty `all` set,
@@ -129,21 +172,34 @@ run_one() {
 
   # Spawn the service. PLATFORM_ROOT is the synthetic platform dir; loadConfig
   # walks $(dirname PLATFORM_ROOT)/data/accounts for the account dir.
+  # CLAUDE_CONFIG_DIR + NEO4J_URI + NEO4J_PASSWORD are stamped to satisfy the
+  # manager's env-presence checks at boot. NEO4J values are dummies — the
+  # manager only asserts non-empty here, it does not connect. The cypher-
+  # schema gate runs separately against the dev's real Neo4j.
   PLATFORM_ROOT="$install_dir/platform" \
   CLAUDE_SESSION_MANAGER_PORT="$port" \
   CLAUDE_SESSION_MANAGER_PERSIST_DIR="$install_dir/persist" \
+  CLAUDE_CONFIG_DIR="$install_dir/.claude" \
+  NEO4J_URI="bolt://127.0.0.1:65535" \
+  NEO4J_PASSWORD="smoke" \
   node "$dist_path" >"$log_file" 2>&1 &
   local pid=$!
 
-  # Poll up to 5s for either the success line or a fatal line.
+  # Poll up to 10s for the final readiness signal (identity-drift line — last
+  # startup-self-test logged) or any fast-fail line. The boot port= line fires
+  # before self-tests; using it as the kill trigger lost the drift gates'
+  # output (Task 438). identity-drift=ok|fail is the last log line on the
+  # self-test path; boot-failed reason= is the fast-fail surface.
   local boot_line=""
   local fatal_line=""
+  local readiness_line=""
   local waited_ms=0
-  while [ "$waited_ms" -lt 5000 ]; do
+  while [ "$waited_ms" -lt 10000 ]; do
     if [ -s "$log_file" ]; then
+      readiness_line="$(grep -m1 -E 'startup-self-test identity-drift=' "$log_file" || true)"
       boot_line="$(grep -m1 -E '^\[claude-session-manager\] boot port=' "$log_file" || true)"
-      fatal_line="$(grep -m1 -E '^\[.*\] fatal ' "$log_file" || true)"
-      if [ -n "$boot_line" ] || [ -n "$fatal_line" ]; then break; fi
+      fatal_line="$(grep -m1 -E '^\[.*\] fatal |boot-failed reason=' "$log_file" || true)"
+      if [ -n "$readiness_line" ] || [ -n "$fatal_line" ]; then break; fi
     fi
     if ! kill -0 "$pid" 2>/dev/null; then break; fi
     sleep 0.1
@@ -182,6 +238,17 @@ run_one() {
     cat "$log_file" >&2
     return 1
   fi
+  # boot-failed lines mean the manager rejected a startup-self-test before
+  # printing the boot line. Surface the gate-specific reason verbatim — same
+  # signal a real device would print to journald.
+  local boot_failed_line
+  boot_failed_line="$(grep -m1 -E 'boot-failed reason=' "$log_file" || true)"
+  if [ -n "$boot_failed_line" ]; then
+    echo "[smoke] service=$name reason=boot-failed matched=$boot_failed_line" >&2
+    echo "--- log ($log_file) ---" >&2
+    cat "$log_file" >&2
+    return 1
+  fi
   if [ -z "$boot_line" ]; then
     echo "[smoke] service=$name reason=no-boot-line matched=" >&2
     echo "--- log ($log_file) ---" >&2
@@ -197,7 +264,86 @@ run_one() {
     return 1
   fi
 
-  echo "[smoke] service=$name ok boot-line=\"$boot_line\" elapsed-ms=$elapsed_ms"
+  # Assert every startup-self-test the manager would log on a real boot fired
+  # here. The fixture-from-real-templates change above is what makes these
+  # gates non-trivial — without the per-account specialists/IDENTITY copies,
+  # the drift gates would log =ok against an empty surface.
+  local required_tests=(
+    "startup-self-test specialist-tool-drift=ok"
+    "startup-self-test system-prompt-sentinels=ok"
+    "startup-self-test identity-drift=ok"
+  )
+  for test_line in "${required_tests[@]}"; do
+    if ! grep -qF "$test_line" "$log_file"; then
+      echo "[smoke] service=$name reason=startup-self-test-missing expected=\"$test_line\"" >&2
+      echo "--- log ($log_file) ---" >&2
+      cat "$log_file" >&2
+      return 1
+    fi
+  done
+
+  echo "[smoke-boot] service=$name specialist-tool-drift=ok system-prompt-sentinels=ok identity-drift=ok boot=ok elapsed-ms=$elapsed_ms"
+  return 0
+}
+
+# Apply schema.cypher to the dev's local Neo4j via cypher-shell. Catches
+# Neo4j 4/5 syntax drift (e.g. 0.1.151's `DROP FULLTEXT INDEX`) the same way
+# a real `seed-neo4j.sh` apply would. The dev's database is the test surface;
+# schema commands use IF NOT EXISTS / IF EXISTS so re-runs are idempotent.
+#
+# Hard prerequisite: NEO4J_URI (and a password source) must be set, and
+# cypher-shell must be on PATH. Absence = publish refusal — the maintainer
+# already runs Neo4j locally for their own brand install.
+run_cypher_schema() {
+  local schema_path="$REPO_ROOT/platform/neo4j/schema.cypher"
+  if [ ! -f "$schema_path" ]; then
+    echo "[smoke-boot] cypher-schema=fail err=schema-missing path=$schema_path" >&2
+    return 1
+  fi
+
+  if ! command -v cypher-shell >/dev/null 2>&1; then
+    echo "[smoke-boot] cypher-schema=fail err=cypher-shell-not-on-path" >&2
+    echo "[smoke-boot] cypher-schema requires a local Neo4j (cypher-shell on PATH) — same toolchain seed-neo4j.sh uses." >&2
+    return 1
+  fi
+
+  if [ -z "${NEO4J_URI:-}" ]; then
+    echo "[smoke-boot] cypher-schema=fail err=neo4j-uri-unset env=NEO4J_URI" >&2
+    return 1
+  fi
+
+  local neo4j_user="${NEO4J_USER:-neo4j}"
+  local neo4j_password="${NEO4J_PASSWORD:-}"
+  if [ -z "$neo4j_password" ]; then
+    # Fall back to the same password-file convention seed-neo4j.sh uses.
+    local pw_file="$REPO_ROOT/platform/config/.neo4j-password"
+    if [ -f "$pw_file" ]; then
+      neo4j_password="$(cat "$pw_file")"
+    fi
+  fi
+  if [ -z "$neo4j_password" ]; then
+    echo "[smoke-boot] cypher-schema=fail err=neo4j-password-unset env=NEO4J_PASSWORD" >&2
+    return 1
+  fi
+
+  local log_file="$TMP_ROOT/cypher-schema.log"
+  local statement_count
+  # Count CREATE/DROP/CALL statement-starts. Approximate but stable signal
+  # for the log line; the real authority is cypher-shell's exit code.
+  statement_count="$(grep -cE '^(CREATE|DROP|CALL)\b' "$schema_path" || true)"
+
+  if ! cypher-shell -u "$neo4j_user" -p "$neo4j_password" -a "$NEO4J_URI" \
+      --non-interactive --fail-fast --format plain < "$schema_path" \
+      > "$log_file" 2>&1; then
+    local first_err
+    first_err="$(grep -m1 -E '^(Invalid|Error|Neo\.)' "$log_file" || head -1 "$log_file" || true)"
+    echo "[smoke-boot] cypher-schema=fail err=${first_err:-unknown}" >&2
+    echo "--- log ($log_file) ---" >&2
+    cat "$log_file" >&2
+    return 1
+  fi
+
+  echo "[smoke-boot] cypher-schema=ok statements=$statement_count uri=$NEO4J_URI"
   return 0
 }
 
@@ -259,4 +405,8 @@ for entry in "${MCP_PLUGINS[@]}"; do
   fi
 done
 
+if ! run_cypher_schema; then
+  rc=1
+fi
+
 exit "$rc"