amalgm 0.1.245 → 0.1.246

package/runtime/scripts/amalgm-mcp/tests/entity-oracle/ledger.js

@@ -0,0 +1,234 @@
+'use strict';
+
+/**
+ * The event ledger — replays the detector's published events into a
+ * believed entity state and refuses every stream a correct detector could
+ * not have produced:
+ *
+ *   - a created fileId or dirId that was ever used before (fresh identity
+ *     is fresh),
+ *   - a change whose previousHash breaks the hash chain,
+ *   - a change to an equal hash (equal versions are silence),
+ *   - any event on a deleted or unknown channel,
+ *   - a rename whose `from` is not where the channel lives,
+ *   - a territory discovered twice, or removed while unknown.
+ *
+ * Directory channels follow the same grammar minus content: created,
+ * renamed, deleted — there is no dir.changed, because a directory has no
+ * bytes of its own. Link channels follow the FILE grammar with the written
+ * target as the whole payload: the previousTarget chain must hold, and an
+ * equal target is silence. `repo.changed` is a raw doorbell, not a state
+ * claim, and is ignored — quieting it is the follower's job.
+ */
+
+const assert = require('node:assert/strict');
+
+function createLedger() {
+  const files = new Map(); // fileId -> { rootId, path, hash, deleted }
+  const links = new Map(); // linkId -> { rootId, path, target, deleted }
+  const dirs = new Map(); // dirId -> { rootId, path, deleted }
+  const usedFileIds = new Set();
+  const usedLinkIds = new Set();
+  const usedDirIds = new Set();
+  const territories = new Map(); // absolute path -> rootId
+
+  function alive(event) {
+    const believed = files.get(event.fileId);
+    assert.ok(believed, `ledger: ${event.type} for unknown fileId ${event.fileId}`);
+    assert.ok(!believed.deleted, `ledger: ${event.type} after deletion of ${event.fileId}`);
+    return believed;
+  }
+
+  function aliveLink(event) {
+    const believed = links.get(event.linkId);
+    assert.ok(believed, `ledger: ${event.type} for unknown linkId ${event.linkId}`);
+    assert.ok(!believed.deleted, `ledger: ${event.type} after deletion of ${event.linkId}`);
+    return believed;
+  }
+
+  function aliveDir(event) {
+    const believed = dirs.get(event.dirId);
+    assert.ok(believed, `ledger: ${event.type} for unknown dirId ${event.dirId}`);
+    assert.ok(!believed.deleted, `ledger: ${event.type} after deletion of ${event.dirId}`);
+    return believed;
+  }
+
+  return {
+    ingest(events) {
+      for (const event of events) {
+        switch (event.type) {
+          case 'file.created': {
+            assert.ok(!usedFileIds.has(event.fileId),
+              `ledger: created fileId ${event.fileId} was used before — a fresh identity must be fresh`);
+            for (const believed of files.values()) {
+              if (believed.deleted) continue;
+              assert.ok(!(believed.rootId === event.rootId && believed.path === event.path),
+                `ledger: two live channels claim ${event.path}`);
+            }
+            usedFileIds.add(event.fileId);
+            files.set(event.fileId, {
+              rootId: event.rootId, path: event.path, hash: event.hash, deleted: false,
+            });
+            break;
+          }
+          case 'file.changed': {
+            const believed = alive(event);
+            assert.equal(event.path, believed.path,
+              `ledger: change names ${event.path} but the channel lives at ${believed.path}`);
+            assert.equal(event.previousHash, believed.hash,
+              `ledger: hash chain broken at ${event.path}`);
+            assert.notEqual(event.hash, event.previousHash,
+              `ledger: equal versions must be silence (${event.path})`);
+            believed.hash = event.hash;
+            break;
+          }
+          case 'file.renamed': {
+            const believed = alive(event);
+            assert.equal(event.from, believed.path,
+              `ledger: rename from ${event.from} but the channel lives at ${believed.path}`);
+            believed.path = event.to;
+            break;
+          }
+          case 'file.deleted': {
+            const believed = alive(event);
+            assert.equal(event.path, believed.path,
+              `ledger: delete names ${event.path} but the channel lives at ${believed.path}`);
+            believed.deleted = true;
+            break;
+          }
+          case 'link.created': {
+            assert.ok(!usedLinkIds.has(event.linkId),
+              `ledger: created linkId ${event.linkId} was used before — a fresh identity must be fresh`);
+            for (const believed of links.values()) {
+              if (believed.deleted) continue;
+              assert.ok(!(believed.rootId === event.rootId && believed.path === event.path),
+                `ledger: two live link channels claim ${event.path}`);
+            }
+            usedLinkIds.add(event.linkId);
+            links.set(event.linkId, {
+              rootId: event.rootId, path: event.path, target: event.target, deleted: false,
+            });
+            break;
+          }
+          case 'link.changed': {
+            const believed = aliveLink(event);
+            assert.equal(event.path, believed.path,
+              `ledger: link change names ${event.path} but the channel lives at ${believed.path}`);
+            assert.equal(event.previousTarget, believed.target,
+              `ledger: target chain broken at ${event.path}`);
+            assert.notEqual(event.target, event.previousTarget,
+              `ledger: equal targets must be silence (${event.path})`);
+            believed.target = event.target;
+            break;
+          }
+          case 'link.renamed': {
+            const believed = aliveLink(event);
+            assert.equal(event.from, believed.path,
+              `ledger: link rename from ${event.from} but the channel lives at ${believed.path}`);
+            believed.path = event.to;
+            break;
+          }
+          case 'link.deleted': {
+            const believed = aliveLink(event);
+            assert.equal(event.path, believed.path,
+              `ledger: link delete names ${event.path} but the channel lives at ${believed.path}`);
+            believed.deleted = true;
+            break;
+          }
+          case 'dir.created': {
+            assert.ok(!usedDirIds.has(event.dirId),
+              `ledger: created dirId ${event.dirId} was used before — a fresh identity must be fresh`);
+            for (const believed of dirs.values()) {
+              if (believed.deleted) continue;
+              assert.ok(!(believed.rootId === event.rootId && believed.path === event.path),
+                `ledger: two live dir channels claim ${event.path}`);
+            }
+            usedDirIds.add(event.dirId);
+            dirs.set(event.dirId, { rootId: event.rootId, path: event.path, deleted: false });
+            break;
+          }
+          case 'dir.renamed': {
+            const believed = aliveDir(event);
+            assert.equal(event.from, believed.path,
+              `ledger: dir rename from ${event.from} but the channel lives at ${believed.path}`);
+            believed.path = event.to;
+            break;
+          }
+          case 'dir.deleted': {
+            const believed = aliveDir(event);
+            assert.equal(event.path, believed.path,
+              `ledger: dir delete names ${event.path} but the channel lives at ${believed.path}`);
+            believed.deleted = true;
+            break;
+          }
+          case 'repo.discovered': {
+            assert.ok(!territories.has(event.path),
+              `ledger: territory ${event.path} discovered twice without removal`);
+            territories.set(event.path, event.rootId);
+            break;
+          }
+          case 'repo.removed': {
+            assert.ok(territories.has(event.path),
+              `ledger: territory ${event.path} removed while unknown`);
+            territories.delete(event.path);
+            break;
+          }
+          case 'repo.changed':
+            break; // raw doorbell, never a state claim
+          default:
+            assert.fail(`ledger: unknown event type ${event.type}`);
+        }
+      }
+    },
+
+    /** Live believed files, optionally for one root: path -> { fileId, hash }. */
+    liveFiles(rootId) {
+      const live = new Map();
+      for (const [fileId, believed] of files) {
+        if (believed.deleted) continue;
+        if (rootId && believed.rootId !== rootId) continue;
+        live.set(believed.path, { fileId, hash: believed.hash });
+      }
+      return live;
+    },
+
+    /** Live believed links, optionally for one root: path -> { linkId, target }. */
+    liveLinks(rootId) {
+      const live = new Map();
+      for (const [linkId, believed] of links) {
+        if (believed.deleted) continue;
+        if (rootId && believed.rootId !== rootId) continue;
+        live.set(believed.path, { linkId, target: believed.target });
+      }
+      return live;
+    },
+
+    /** Live believed directories, optionally for one root: path -> { dirId }. */
+    liveDirs(rootId) {
+      const live = new Map();
+      for (const [dirId, believed] of dirs) {
+        if (believed.deleted) continue;
+        if (rootId && believed.rootId !== rootId) continue;
+        live.set(believed.path, { dirId });
+      }
+      return live;
+    },
+
+    liveTerritories() {
+      return new Map(territories);
+    },
+
+    /** Channel-kind blind: a closed channel is closed, file, link, or dir. */
+    isDeleted(channelId) {
+      return files.get(channelId)?.deleted === true
+        || links.get(channelId)?.deleted === true
+        || dirs.get(channelId)?.deleted === true;
+    },
+
+    knows(fileId) {
+      return files.has(fileId);
+    },
+  };
+}
+
+module.exports = { createLedger };

package/runtime/scripts/amalgm-mcp/tests/entity-oracle/referee.js

@@ -0,0 +1,118 @@
+'use strict';
+
+/**
+ * The independent disk referee — the oracle's second truth.
+ *
+ * A deliberately simple test-only reader: plain recursive readdir, plain
+ * whole-buffer sha256, its own .git-boundary and policy handling. It shares
+ * no traversal or comparison code with the detector (walkRoot,
+ * censusBoundaries, diffRootState are all forbidden imports — enforced by a
+ * meta-test), so the detector and its referee cannot host the same bug.
+ *
+ * Read-only by contract: nothing here writes, touches, or scans.
+ */
+
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+
+function hashBytes(absPath) {
+  return crypto.createHash('sha256').update(fs.readFileSync(absPath)).digest('hex');
+}
+
+/**
+ * Ground truth for one enrolled root: every enrollable regular file outside
+ * repo territory, hashed, every enrollable directory outside repo territory
+ * (a directory is ground with no bytes — existence is its whole claim),
+ * every enrollable symlink as pointer ground — its target exactly as
+ * written, never followed — plus the minimal repo boundaries the walk
+ * stops at ('' when the root itself is one). Policy prunes at
+ * directories, exactly as the enrollment contract states.
+ */
+function readGround(rootPath, shouldEnroll) {
+  const files = new Map(); // relPath -> hash
+  const links = new Map(); // relPath -> target, exactly as written
+  const dirs = new Set(); // relDir, outside repo territory ('' never listed)
+  const repoDirs = [];
+
+  (function walk(relDir) {
+    const absDir = relDir ? path.join(rootPath, relDir) : rootPath;
+    let entries;
+    try {
+      entries = fs.readdirSync(absDir, { withFileTypes: true });
+    } catch {
+      return; // vanished mid-read; the settled truth is the next read's
+    }
+    if (entries.some((entry) => entry.name === '.git')) {
+      repoDirs.push(relDir);
+      return;
+    }
+    if (relDir) dirs.add(relDir);
+    for (const entry of entries) {
+      const relPath = relDir ? `${relDir}/${entry.name}` : entry.name;
+      if (!shouldEnroll(relPath)) continue;
+      if (entry.isSymbolicLink()) {
+        try {
+          links.set(relPath, fs.readlinkSync(path.join(rootPath, relPath)));
+        } catch {
+          /* vanished mid-read */
+        }
+      } else if (entry.isDirectory()) walk(relPath);
+      else if (entry.isFile()) {
+        try {
+          files.set(relPath, hashBytes(path.join(rootPath, relPath)));
+        } catch {
+          /* vanished mid-read */
+        }
+      }
+    }
+  })('');
+
+  return { files, links, dirs, repoDirs };
+}
+
+/**
+ * Every repo boundary under rootPath at any depth, as absolute paths —
+ * recursing INTO each boundary the way each root runs its own census, with
+ * the enrollment policy re-applied relative to that boundary.
+ */
+function allBoundaries(rootPath, shouldEnroll) {
+  const found = [];
+
+  function census(baseAbs) {
+    const pending = [''];
+    while (pending.length > 0) {
+      const relDir = pending.pop();
+      const absDir = relDir ? path.join(baseAbs, relDir) : baseAbs;
+      let entries;
+      try {
+        entries = fs.readdirSync(absDir, { withFileTypes: true });
+      } catch {
+        continue;
+      }
+      if (relDir && entries.some((entry) => entry.name === '.git')) {
+        found.push(absDir);
+        census(absDir); // a child's children are the child's own census
+        continue;
+      }
+      for (const entry of entries) {
+        if (!entry.isDirectory() || entry.name === '.git') continue;
+        const rel = relDir ? `${relDir}/${entry.name}` : entry.name;
+        if (!shouldEnroll(rel)) continue;
+        pending.push(rel);
+      }
+    }
+  }
+
+  census(rootPath);
+  let hasRootGit = false;
+  try {
+    hasRootGit = fs.existsSync(path.join(rootPath, '.git'));
+  } catch {
+    /* unreadable root: no boundary claim */
+  }
+  if (hasRootGit) found.push(rootPath);
+  return found.sort();
+}
+
+module.exports = { allBoundaries, hashBytes, readGround };