chore: delete v0867/v0868 debris and stale slop references
Removes the retired v0868-stopship fleet roster, the v0867 setup QA script, and the three v0867 constitution evidence docs, none of which anything on the train references anymore (rg-verified; the only inbound link was docs/CONFIGURATION.md, updated here). Trims the dead v0868-stopship alias from the stopship role-validation guard in crates/cli/src/lib.rs, drops the retired /slop and /canzha aliases from the command-dispatch architecture doc, and removes the deleted crates/tui/src/slop_ledger.rs path from source-structure-budget.json. The v0868_ name-guard regression test stays by design. Verified: cargo fmt clean, cargo test -p codewhale-cli --lib (204 passed), source-structure-budget.json still valid JSON.
This commit is contained in:
Hmbown
@@ -1020,7 +1020,7 @@ fn run_workflow_command(
|
||||
let roots = named_fleet_search_roots(&workspace);
|
||||
let named_fleet = codewhale_workflow::load_named_fleet(&fleet, &roots)
|
||||
.with_context(|| format!("load fleet `{fleet}` from {}", display_roots(&roots)))?;
|
||||
if workflow == "stopship" || fleet == "stopship" || fleet == "v0868-stopship" {
|
||||
if workflow == "stopship" || fleet == "stopship" {
|
||||
named_fleet
|
||||
.validate_stopship_roles()
|
||||
.with_context(|| format!("validate stopship roles in fleet `{fleet}`"))?;
|
||||
|
||||
@@ -38,11 +38,6 @@ controls do not blur together.
|
||||
- **Memory and handoffs** — recalled state. Useful, but lower authority than
|
||||
constitutions and project instructions.
|
||||
|
||||
Release verification for these surfaces lives in
|
||||
[`docs/evidence/v0867-constitution-setup-qa-matrix.md`](evidence/v0867-constitution-setup-qa-matrix.md).
|
||||
Use it when checking `/setup`, `/constitution`, doctor, context reports, and
|
||||
the update checkpoint agree.
|
||||
|
||||
### Managing the user-global constitution (`/setup` and `/constitution`)
|
||||
|
||||
On first launch Codewhale runs a short **constitution-first** setup path:
|
||||
|
||||
@@ -23,7 +23,7 @@ intentional:
|
||||
| 0 | `$skill` compatibility | `$name` is resolved as `/skill name` before slash parsing. |
|
||||
| 1 | User commands | `user_registry::try_dispatch()` checks workspace and global markdown commands first, so user commands can shadow built-ins. |
|
||||
| 2 | Permanent mode compatibility aliases | `/jihua` and `/zidong` route through config mode dispatch so each selects its fixed legacy mode. They remain registered aliases for discovery, but bypass normal `/mode` execution. |
|
||||
| 3 | Built-in registry | `CommandRegistry` resolves group-owned built-in commands by canonical name or alias, including `/slop` and `/canzha` as aliases of `/debt`. |
|
||||
| 3 | Built-in registry | `CommandRegistry` resolves group-owned built-in commands by canonical name or alias. |
|
||||
| 4 | Legacy migration hints | Retired commands such as `/set` and `/deepseek` return targeted replacement guidance. |
|
||||
| 5 | Skills fallback | If no command matches, a skill with the same name may run before unknown-command suggestions are shown. |
|
||||
|
||||
|
||||
@@ -1,255 +0,0 @@
|
||||
# v0.8.67 Constitution Setup Current-Build Evidence
|
||||
|
||||
This note records current-build text/render evidence for the v0.8.67
|
||||
constitution-first setup lane. It complements
|
||||
`docs/evidence/v0867-constitution-setup-qa-matrix.md`; it is not a release
|
||||
tag, artifact, or publish record.
|
||||
|
||||
Representative guided output examples, including a GLM-5.2-oriented profile,
|
||||
are recorded in `docs/evidence/v0867-guided-constitution-examples.md`. As of
|
||||
this snapshot the wizard also offers model-assisted drafting: `A` on the
|
||||
Constitution step asks the first configured model to draft from the guided
|
||||
answers, gated through `UserConstitution::from_untrusted_json`
|
||||
(parse/sanitize/bound) and the same ratification preview + explicit `G` save.
|
||||
|
||||
- Date: 2026-07-02T03:54:02Z
|
||||
- Branch: `claude/v0.8.67-constitution-setup-174rj9`
|
||||
- Head: `fa7c4b055`
|
||||
- Workspace version observed in `Cargo.toml`: `0.8.66`
|
||||
|
||||
## Covered Surfaces
|
||||
|
||||
These checks cover the text-snapshot side of the #3412 release-docs request:
|
||||
|
||||
- `/setup` constitution step at blocker terminal sizes `80x24`, `100x30`,
|
||||
`120x32`, and `160x40`.
|
||||
- `/setup` provider/model readiness, runtime posture, constitution choice,
|
||||
guided preview/save, update checkpoint, skip/retry, verification report, and
|
||||
zh-Hans checkpoint copy.
|
||||
- `/constitution` manager, preview, edit/repair/bundled/repo/explain/posture
|
||||
help paths, including zh-Hans manager/preview copy.
|
||||
- Prompt injection for the user-global
|
||||
`<codewhale_user_constitution>` block and suppression for bundled/deferred or
|
||||
expert-override choices.
|
||||
- `codewhale doctor --json` setup state derivation and persisted-state readback.
|
||||
- Context report constitution/WHALE.md migration diagnostics without loading
|
||||
legacy `WHALE.md` bodies.
|
||||
- Locale JSON validity for the shipped setup locale files.
|
||||
|
||||
## Commands Run
|
||||
|
||||
```sh
|
||||
cargo test -p codewhale-tui --bin codewhale-tui --locked setup_wizard_is_usable_and_opaque_at_blocker_sizes -- --nocapture
|
||||
```
|
||||
|
||||
Result: 1 passed, 0 failed.
|
||||
|
||||
```sh
|
||||
cargo test -p codewhale-tui --bin codewhale-tui --locked constitution -- --nocapture
|
||||
```
|
||||
|
||||
Result: 42 passed, 0 failed.
|
||||
|
||||
```sh
|
||||
cargo test -p codewhale-tui --bin codewhale-tui --locked setup -- --nocapture
|
||||
```
|
||||
|
||||
Result: 127 passed, 0 failed (includes the model-draft request/ingestion,
|
||||
ratification, discard-on-tune, and authoring-provenance tests).
|
||||
|
||||
```sh
|
||||
cargo test -p codewhale-tui --bin codewhale-tui --locked context_report -- --nocapture
|
||||
```
|
||||
|
||||
Result: 10 passed, 0 failed.
|
||||
|
||||
```sh
|
||||
cargo test -p codewhale-tui --bin codewhale-tui --locked doctor_setup -- --nocapture
|
||||
```
|
||||
|
||||
Result: 5 passed, 0 failed.
|
||||
|
||||
```sh
|
||||
cargo test -p codewhale-config --lib
|
||||
```
|
||||
|
||||
Result: 342 passed, 0 failed (includes the `untrusted_draft_*` ingestion-gate
|
||||
tests and the `constitution_authoring` round-trip/legacy-load tests).
|
||||
|
||||
```sh
|
||||
cargo test -p codewhale-tui --bin codewhale-tui --locked verification_report -- --nocapture
|
||||
```
|
||||
|
||||
Result: 2 passed, 0 failed.
|
||||
|
||||
```sh
|
||||
jq empty crates/tui/locales/en.json crates/tui/locales/es-419.json crates/tui/locales/ja.json crates/tui/locales/pt-BR.json crates/tui/locales/vi.json crates/tui/locales/zh-Hans.json crates/tui/locales/zh-Hant.json
|
||||
```
|
||||
|
||||
Result: passed.
|
||||
|
||||
## Localization Coverage and Fallback (zh-Hant)
|
||||
|
||||
The v0.8.67 setup/constitution surfaces are fully localized for `en` and
|
||||
`zh-Hans` (545+ message keys each). `zh-Hant` ships a partial catalog
|
||||
(~162 keys) that does not yet include the setup/constitution strings.
|
||||
|
||||
Documented fallback behavior for the strings zh-Hant does not carry: the
|
||||
runtime message loader is initialized with `i18n!("locales", fallback =
|
||||
["en"])` (`crates/tui/src/main.rs`), so untranslated zh-Hant keys render in
|
||||
**English**. The `LocaleSpec { fallback: "zh-Hans" }` entry in
|
||||
`crates/tui/src/localization.rs` is descriptive metadata only and is not
|
||||
wired into message resolution; a per-locale zh-Hant → zh-Hans chain would be
|
||||
a behavior change and is deliberately left out of v0.8.67. This satisfies
|
||||
the #3412/#3794 acceptance alternative of "documented fallback" for
|
||||
zh-Hant; full zh-Hant coverage (or a zh-Hans fallback chain) remains open
|
||||
as follow-up localization work.
|
||||
|
||||
## Release-Orchestration Snapshot (2026-07-01)
|
||||
|
||||
- Branch: `claude/v0.8.67-constitution-setup-174rj9`
|
||||
- Head: `19971477a`
|
||||
- Workspace version observed in `Cargo.toml`: `0.8.66`
|
||||
|
||||
Landed since the prior snapshot: `008987464` (constitution-first setup copy
|
||||
polish — welcome dual-meaning arc, ritual draft invitation, powers-and-limits
|
||||
plus continuity-not-memory ratification framing, drafting-prompt steering),
|
||||
`b58dcf99c` (#3884: sub-agent failure records carry the full classified error
|
||||
chain), `b4ca8b539` (#3883: durable-review floor keys on action kind; routine
|
||||
YOLO background work no longer prompts; destructive/publish holds preserved),
|
||||
`19971477a` (QA-matrix rows for failed health check and legacy `.deepseek`
|
||||
config migration).
|
||||
|
||||
Gate results at this head (exact observed counts):
|
||||
|
||||
```
|
||||
cargo fmt --all -- --check PASS
|
||||
git diff --check PASS
|
||||
jq empty crates/tui/locales/*.json PASS (7 files incl. zh-Hant)
|
||||
cargo test -p codewhale-config --lib 342 passed; 0 failed
|
||||
cargo test ... --locked setup 127 passed; 0 failed
|
||||
cargo test ... --locked constitution 42 passed; 0 failed
|
||||
cargo test ... --locked context_report 10 passed; 0 failed
|
||||
cargo test ... --locked doctor_setup 5 passed; 0 failed
|
||||
cargo test ... --locked tui::onboarding 9 passed; 0 failed
|
||||
RUSTFLAGS="-D warnings" cargo test ... --no-run clean (1m 07s)
|
||||
cargo build --release -p codewhale-cli -p codewhale-tui clean (1m 02s)
|
||||
```
|
||||
|
||||
Additional suites exercised for the two fix commits: yolo_mode 10, auto_review
|
||||
31, approval 163, engine 272, widgets 186, command_safety 58, client 240,
|
||||
retry 41, subagent 256 — all passing.
|
||||
|
||||
## Localization Coverage and Fallback (other locales)
|
||||
|
||||
Like zh-Hant, the `es-419`, `ja`, `pt-BR`, and `vi` catalogs do not yet carry
|
||||
the v0.8.67 setup/constitution keys (their catalogs predate this lane); those
|
||||
strings render in **English** through the same `fallback = ["en"]` loader.
|
||||
This is the accepted state for v0.8.67; expanding setup/constitution coverage
|
||||
to the remaining full locales is follow-up localization work (tracked under
|
||||
the #3792/#3793 localization residuals).
|
||||
|
||||
## Enhancement-Pass Snapshot (2026-07-01, overnight)
|
||||
|
||||
- Branch: `claude/v0.8.67-constitution-setup-174rj9`
|
||||
- Head: `d73875b7a` (19 commits ahead of origin)
|
||||
|
||||
Landed after the release-orchestration snapshot: `d46047a74` (keep-existing
|
||||
constitution checkpoint completion, #3794), `ed6b21be1` (calm/compact
|
||||
stakes-based approval prompt + `agent` tool classification), `41d26c774` /
|
||||
`c57062077` / `7f82737b7` (#3757 startup and @mention performance +
|
||||
startup milestone tracing), `a429f82c2` (route-identity pinning fixes four
|
||||
machine-dependent test failures, verified pre-existing at the handoff head),
|
||||
`d73875b7a` (model-drafted fleet profiles behind the draft→preview→ratify
|
||||
gate — the constitution pipeline's second consumer), and website phase 1
|
||||
(`28efab313`, `5a38e2059`, `d3d1d5e25`: live star badge/version nav, the
|
||||
constitution-thesis hero in en+zh, and the animated terminal player over the
|
||||
real session traces).
|
||||
|
||||
Final battery at this head (exact observed counts):
|
||||
|
||||
```
|
||||
cargo test -p codewhale-tui --bin codewhale-tui --locked 5676 passed; 0 failed; 2 ignored
|
||||
cargo test -p codewhale-config --lib 342 passed; 0 failed
|
||||
cargo build --release -p codewhale-cli -p codewhale-tui clean (47.94s)
|
||||
cargo fmt --all -- --check PASS
|
||||
cd web && npm run build prerenders all locale routes
|
||||
```
|
||||
|
||||
## Overnight Review + Hardening Snapshot (2026-07-02)
|
||||
|
||||
- Branch: `claude/v0.8.67-constitution-setup-174rj9`
|
||||
- Head: `44eb7e935` (~35 commits ahead of origin; branch diff touches only
|
||||
`crates/`, `web/`, `docs/`, `scripts/`, `Cargo.*`)
|
||||
|
||||
A five-lens adversarial ultracode review of the overnight diff ran (34
|
||||
agents; correctness / constitution-safety-invariants / performance / UX /
|
||||
test-adequacy, each finding refuted-or-confirmed by an independent skeptic).
|
||||
Confirmed findings were fixed:
|
||||
|
||||
- **Safety-floor destroyer gap** (`88c545f2b`): the #3883 floor narrowing had
|
||||
stopped holding `dd`-to-device / `mkfs` / `shred` / `wipefs` / forced
|
||||
recursive deletion of absolute system paths in YOLO background;
|
||||
`segment_is_device_or_filesystem_destroyer` restores those holds.
|
||||
- **Repo law as mechanism** (`88c545f2b`): `.codewhale/constitution.json`
|
||||
`protected_invariants` may now carry path globs + `action` (ask|block),
|
||||
compiled into write holds in the tool gate (`crates/tui/src/repo_law.rs`),
|
||||
tighten-only, non-bypassable by mode, with a receipt naming the invariant.
|
||||
- **Boot-janitor races** (`007ce2680`): backgrounded session cleanup no longer
|
||||
races session restore (skips/excludes the resumed id).
|
||||
- **Event-loop-freeze class closed**: both the fleet-profile (`138dbad1b`) and
|
||||
constitution (`58aefa392`) model drafters moved off the inline await onto the
|
||||
background-cell + poll pattern; the UI stays interactive during drafting.
|
||||
- **Fleet-draft finish + UX parity** (`007ce2680`): provider-readiness gating,
|
||||
en+zh localization, Enter-ratifies, duplicate-id guard.
|
||||
- **UX copy** (`126633e78`, `e09fd46c2`): status classifier no longer paints
|
||||
negated-success failures green; shell exit codes are human-readable; lock
|
||||
jargon replaced with actionable copy; GitHub issue numbers removed from
|
||||
`--help` and config UI; session/model pickers have actionable empty states.
|
||||
- **Test-adequacy gaps** (`432fa0fbe`) and a headless QA probe
|
||||
(`scripts/v0867-setup-qa.sh`, `93b5c1e59`) added.
|
||||
- **#3830 missing-auth handoff** (`e2b32ec4c`): a route switch that fails for
|
||||
want of a key opens `/provider` at that provider's key entry.
|
||||
|
||||
Final gate battery at this head:
|
||||
|
||||
```
|
||||
cargo fmt --all -- --check PASS
|
||||
git diff --check PASS
|
||||
jq empty crates/tui/locales/*.json PASS (7 files)
|
||||
cargo test -p codewhale-tui --bin codewhale-tui --locked 5686 passed; 0 failed; 2 ignored
|
||||
cargo test -p codewhale-config --lib 342 passed; 0 failed
|
||||
RUSTFLAGS="-D warnings" cargo test ... --locked --no-run clean
|
||||
cargo build --release -p codewhale-cli -p codewhale-tui clean (47s)
|
||||
scripts/v0867-setup-qa.sh 9 passed; 0 failed
|
||||
```
|
||||
|
||||
## PR Push + Community Harvest Snapshot (2026-07-02)
|
||||
|
||||
- Branch pushed to origin as PR #3861 (ready for review), 118 commits ahead of
|
||||
`main`; `Cargo.toml` still `0.8.66`.
|
||||
- A five-lens adversarial review of the branch found and closed real repo-law
|
||||
enforcement bypasses (interior `./`/`..` path evasion, apply_patch header
|
||||
forms, `fim_edit` ungated) and safety-floor destroyer evasions
|
||||
(env/wrapper prefixes, quotes, pipes) — all fixed with tests before push.
|
||||
- Drafter event-loop-freeze class fully closed (fleet + constitution).
|
||||
- Two safe runtime perf wins (idle offline-queue clone skipped; tool output
|
||||
hashed once). Structural render-loop items documented in the local roadmap
|
||||
for human-supervised TUI QA rather than changed blind.
|
||||
- **Community harvest (v0.8.67):** four vetted PRs harvested with credit
|
||||
(contributor as canonical author + `Co-authored-by`): #3763 (@idling11,
|
||||
website i18n matrix), #3760 (@idling11, Homebrew rollout docs), #3872 and
|
||||
#3871 (@cyq1017, dead-code removals). Duplicates #3873/#3879 noted on-PR.
|
||||
MCP-spawn/provider/persistence/constitution-context PRs left NEEDS-REVIEW.
|
||||
- CI at push: fmt / clippy (workspace, CI flags) / provider-registry /
|
||||
co-author (`--check-authors` canonical) / version-drift / GitGuardian /
|
||||
CodeQL / ubuntu+macOS tests all green; only slowest jobs finishing at
|
||||
snapshot time; zero failures.
|
||||
|
||||
## Remaining Manual Evidence
|
||||
|
||||
Before the release is called ready, keep the final manual pass from the QA
|
||||
matrix: open a current TUI build and visually confirm the same flow through
|
||||
`/setup`, `/constitution`, `/setup report`, `doctor --json`, and
|
||||
`doctor --context-json`. This file records automated current-build coverage,
|
||||
not a human visual acceptance pass.
|
||||
@@ -1,118 +0,0 @@
|
||||
# v0.8.67 Constitution Setup QA Matrix
|
||||
|
||||
This matrix is the release evidence checklist for the v0.8.67
|
||||
constitution-first setup lane. It ties `/setup`, `/constitution`, doctor,
|
||||
context reports, and docs to one shared setup-state vocabulary instead of
|
||||
checking each surface in isolation.
|
||||
|
||||
Current-build automated text/render evidence is recorded in
|
||||
`docs/evidence/v0867-constitution-setup-current-build-evidence.md`.
|
||||
Guided constitution output examples are recorded in
|
||||
`docs/evidence/v0867-guided-constitution-examples.md`.
|
||||
|
||||
## Gate Commands
|
||||
|
||||
Run these before claiming the setup lane is ready:
|
||||
|
||||
```sh
|
||||
cargo fmt --all -- --check
|
||||
git diff --check
|
||||
jq empty crates/tui/locales/en.json crates/tui/locales/es-419.json crates/tui/locales/ja.json crates/tui/locales/pt-BR.json crates/tui/locales/vi.json crates/tui/locales/zh-Hans.json
|
||||
cargo test -p codewhale-tui --bin codewhale-tui --locked setup -- --nocapture
|
||||
cargo test -p codewhale-tui --bin codewhale-tui --locked constitution -- --nocapture
|
||||
cargo test -p codewhale-tui --bin codewhale-tui --locked context_report -- --nocapture
|
||||
cargo test -p codewhale-tui --bin codewhale-tui --locked doctor_setup -- --nocapture
|
||||
cargo test -p codewhale-tui --bin codewhale-tui --locked tui::onboarding -- --nocapture
|
||||
RUSTFLAGS="-D warnings" cargo test -p codewhale-tui --bin codewhale-tui --locked --no-run
|
||||
cargo test -p codewhale-config --lib
|
||||
```
|
||||
|
||||
## Automated Headless Probe
|
||||
|
||||
`scripts/v0867-setup-qa.sh` runs the noninteractive contracts below against
|
||||
isolated temp homes and exits non-zero on any regression (requires `jq`):
|
||||
|
||||
```sh
|
||||
scripts/v0867-setup-qa.sh # builds release if needed
|
||||
CODEWHALE_BIN=target/release/codewhale-tui scripts/v0867-setup-qa.sh
|
||||
```
|
||||
|
||||
It verifies: the `doctor --json .setup` block shape and
|
||||
`next_actions.constitution`, that a configured key never appears in
|
||||
`doctor --json`, that a repo `.codewhale/constitution.json` surfaces in
|
||||
`--context-json`, and that a legacy `WHALE.md` body is never loaded. It
|
||||
prints the remaining human-visual checks it cannot cover. This shrinks the
|
||||
manual pass to the visual items enumerated in the Text Snapshot Checklist.
|
||||
|
||||
## Hermetic Local Setup
|
||||
|
||||
Use temp homes so the matrix does not read or mutate a real install:
|
||||
|
||||
```sh
|
||||
tmp="$(mktemp -d)"
|
||||
export CODEWHALE_HOME="$tmp/codewhale-home"
|
||||
export HOME="$tmp/home"
|
||||
export USERPROFILE="$tmp/home"
|
||||
export DEEPSEEK_CONFIG_PATH="$CODEWHALE_HOME/config.toml"
|
||||
mkdir -p "$CODEWHALE_HOME" "$HOME"
|
||||
```
|
||||
|
||||
Useful noninteractive probes:
|
||||
|
||||
```sh
|
||||
cargo run -p codewhale-tui --locked -- doctor --json | jq '.setup'
|
||||
cargo run -p codewhale-tui --locked -- doctor --context-json | jq '.entries[] | select(.source_kind | test("constitution|project_context_warning"))'
|
||||
```
|
||||
|
||||
## Matrix
|
||||
|
||||
| Scenario | Expected behavior | Evidence |
|
||||
| --- | --- | --- |
|
||||
| Clean home, bundled/default constitution | First-run can complete by choosing language, recording provider readiness as ready or needs-action, reviewing runtime posture, choosing bundled/default, and opening the setup report. | `/setup` `U` on Constitution step; `crates/tui/src/tui/setup/mod.rs::bundled_constitution_commit_marks_checkpoint_complete`; `doctor --json .setup.constitution.choice == "bundled"` |
|
||||
| Clean home, guided user-global constitution | Guided custom save writes `$CODEWHALE_HOME/constitution.json`, records source/validity/hash/version/authoring in `setup_state.json`, and previews the rendered block before the ratifying second `G`. | `crates/tui/src/tui/setup/mod.rs::guided_constitution_requires_preview_before_save`; `guided_constitution_answers_shape_preview_and_saved_payload`; `deterministic_ratification_records_guided_authoring`; `persist_user_constitution_choice_writes_constitution_and_state`; `/constitution preview` |
|
||||
| Model-assisted draft offer gating | The `A` "ask your model to draft" action appears and responds only when the first provider/model route is ready (key/local runtime present); without a ready route the key is inert and the deterministic guided flow is unchanged. | `crates/tui/src/tui/setup/mod.rs::model_draft_key_is_inert_without_a_ready_provider`; `model_draft_key_requests_drafting_with_current_answers`; `constitution_card_gates_the_model_draft_invitation` |
|
||||
| Model-assisted draft request payload | The one-shot drafting request carries only the six guided answer labels and the UI language tag — no secrets, env, config, repo contents, or memory — plus injection-resistance and advisory-only guardrails in the system prompt. | `crates/tui/src/tui/setup/model_draft.rs::drafting_request_sends_only_answers_and_language`; `drafting_prompts_carry_the_safety_guardrails` |
|
||||
| Model-assisted draft ingestion | Model output is untrusted: fenced/prose-wrapped JSON parses, invalid or empty output is rejected with a reason, oversized fields are bounded before preview/save, unknown (runtime-policy) keys cannot persist, thinking blocks never reach the parser, and constitution-tag forgery is neutralized. | `crates/tui/src/tui/setup/model_draft.rs` ingestion tests; `crates/config/src/user_constitution.rs::untrusted_draft_*` tests |
|
||||
| Model-assisted draft failure fallback | Provider construction failure, timeout, request error, or bad JSON degrade to a status line; the deterministic guided draft still previews and ratifies. Decline is the default: not pressing `A` (or tuning `1-6`, which discards a stale draft) keeps the guided path. | `crates/tui/src/tui/ui.rs::handle_setup_constitution_model_draft` error arm; `crates/tui/src/tui/setup/mod.rs::cycling_answers_discards_the_model_draft` |
|
||||
| Model-assisted ratification | An installed model draft opens the ratification preview immediately; saving still requires the explicit `G`, records `constitution_authoring = model_drafted` plus the bounded draft's preview hash, and persists through the same single `SetupTransaction`. | `crates/tui/src/tui/setup/mod.rs::installed_model_draft_previews_then_ratifies_with_provenance`; `model_drafted_commit_round_trips_through_the_setup_transaction` |
|
||||
| Existing user update checkpoint | If the v0.8.67 checkpoint is incomplete, interactive launch opens `/setup`; choosing bundled/default is a valid completion. | `crates/tui/src/tui/setup/mod.rs::wizard_resumes_at_constitution_checkpoint_when_update_incomplete`; `crates/tui/src/tui/ui/tests.rs::setup_checkpoint_opens_after_onboarding_when_due` |
|
||||
| First-run onboarding handoff | Finishing the legacy Welcome/Language/API/trust gates opens setup when the checkpoint is due, instead of landing straight in chat. | `crates/tui/src/tui/ui/tests.rs::setup_checkpoint_opens_after_onboarding_when_due`; onboarding copy tests |
|
||||
| Existing valid user-global constitution | `/constitution` reports it as active when setup state does not select bundled/deferred/expert override; prompt assembly injects it as a separate block. | `crates/tui/src/prompts.rs::user_global_constitution_block_is_injected_separately`; `/constitution status` |
|
||||
| Invalid, empty, or unreadable user-global constitution | Invalid data is not injected, `/constitution preview` points to repair, and setup can reopen the Constitution step. | `crates/tui/src/prompts.rs::invalid_user_global_constitution_is_skipped`; `crates/tui/src/commands/groups/core/constitution.rs::constitution_preview_renders_structured_block` |
|
||||
| Advanced full base-prompt override | Expert override is labeled separately from guided user-global constitution and can suppress stale user-global injection when selected. | `docs/CONFIGURATION.md` expert override section; prompt/setup-state tests for bundled/deferred/expert choices |
|
||||
| Headless or skip-onboarding launch | Noninteractive/skip-onboarding paths do not hang on the setup checkpoint; doctor/setup JSON reports incomplete state. | `crates/tui/src/tui/ui/tests.rs::setup_checkpoint_waits_for_onboarding_and_skip_flag`; `doctor_setup_report_json_derives_state_without_sidecar` |
|
||||
| Non-English setup checkpoint | zh-Hans setup/checkpoint copy is usable enough to complete the checkpoint; other full locale files keep setup tips aligned with `/setup` and `/constitution`. | `crates/tui/src/tui/setup/mod.rs::zh_hans_checkpoint_copy_is_localized`; locale JSON `jq empty` gate |
|
||||
| Runtime posture boundary | Constitution autonomy guidance never mutates `default_mode`, approval policy, sandbox, network, shell, trust, or MCP permissions. | `crates/config/src/user_constitution.rs::autonomy_renders_as_guidance_not_runtime_control`; `crates/tui/src/tui/setup/mod.rs::runtime_posture_review_confirms_without_config_mutation` |
|
||||
| Provider/model readiness ready | Setup records provider/model as `verified` when auth or local runtime is ready, and the result is a secret-free summary. | `crates/tui/src/tui/setup/mod.rs::provider_model_review_records_ready_route_and_continues` |
|
||||
| Provider/model missing key | Setup records provider/model as `needs_action` and continues; final report points to `/provider` or `/model`. | `crates/tui/src/tui/setup/mod.rs::provider_model_review_records_missing_auth_as_needs_action`; `doctor --json .setup.next_actions.provider_model` |
|
||||
| Failed provider health check | A route whose health probe fails records provider/model as `needs_action` with a secret-free `health=needs action` summary; constitution checkpoint completion is not blocked and the report points at the fix. | `crates/tui/src/tui/setup/mod.rs` health derivation (`SetupRuntimeFacts`, `provider_result`); `provider_model_review_records_missing_auth_as_needs_action`; `first_run_ready()` accepts needs-action |
|
||||
| Migrated legacy `.deepseek` config | A legacy `~/.deepseek` config keeps comments and disabled keys through setup writes; inherited setup state derives from the existing install without regressing configured surfaces; setup stages only user-global paths. | `crates/config/src/tests.rs::config_store_rendered_body_preserves_comments_at_legacy_deepseek_path`; `crates/config/src/setup_state.rs::derive_inherited` tests; hermetic env sets `DEEPSEEK_CONFIG_PATH` above |
|
||||
| Custom provider/model route | `/model` can record provider-qualified custom routes without confusing them with the active provider only. | `cargo test -p codewhale-tui --bin codewhale-tui --locked model_picker -- --nocapture` |
|
||||
| MCP/tools configured or skipped | Optional tools/MCP readiness never blocks constitution checkpoint completion and remains represented with shared setup-step status. | `/setup` Tools/MCP row; setup filter gate |
|
||||
| Hotbar defaulted or customized | Hotbar setup remains independent of constitution setup; setup/hotbar tests cover defaulted and saved bindings. | `docs/evidence/hotbar-qa-matrix.md`; `cargo test -p codewhale-tui --bin codewhale-tui --locked hotbar -- --nocapture` |
|
||||
| Remote/runtime skipped | Remote runtime remains optional; skipped/deferred state is recorded through `SetupState` rather than blocking first-run. | `/setup` Remote Runtime row; `skip_and_retry_emit_setup_state_commits` |
|
||||
| WHALE.md migration | Legacy `WHALE.md` is ignored, reported as migration-needed, and its body is not loaded into prompt or context report. | `context_report_marks_whale_md_ignored_without_loading_body`; `constitution_manager_marks_whale_md_ignored` |
|
||||
| Final setup report is secret-free | Report names constitution choice, provider readiness, runtime posture, skipped/deferred/needs-action steps, and no raw secrets. | `doctor --json .setup`; `verification_report_records_ready_after_bundled_checkpoint`; `step_result_carries_no_secret_by_construction` |
|
||||
|
||||
## Text Snapshot Checklist
|
||||
|
||||
Capture these snippets in release notes or PR evidence when cutting the release
|
||||
candidate:
|
||||
|
||||
1. Welcome screen opens with the dual meaning of "code" ("Code means two
|
||||
things here"), walks the setup arc (choose the model, let it draft the
|
||||
constitution it will live under, read and ratify), and states "Nothing
|
||||
becomes law until you confirm."
|
||||
2. `/setup` Provider and Model card shows provider, model, auth state, and
|
||||
health without secrets.
|
||||
3. `/setup` Runtime Posture card says constitution guidance does not change
|
||||
runtime policy silently.
|
||||
4. `/setup` Constitution step shows bundled/default and guided custom actions,
|
||||
and — once the provider route is ready — the `A` model-draft invitation
|
||||
naming the first configured model.
|
||||
5. `/constitution` overview shows bundled, user-global, repo-local, AGENTS,
|
||||
memory/handoff, preview, and maintenance actions.
|
||||
6. `/setup report` or `codewhale doctor --json | jq '.setup'` shows
|
||||
`constitution`, `runtime_posture_source`, `steps`, and `next_actions`.
|
||||
7. `doctor --context-json` shows repo constitution or WHALE.md migration
|
||||
diagnostics without legacy file bodies.
|
||||
@@ -1,176 +0,0 @@
|
||||
# v0.8.67 Guided Constitution Examples
|
||||
|
||||
These examples show the structured output of the v0.8.67 constitution creator.
|
||||
The wizard has two authoring paths that share one schema, one validator, and
|
||||
one renderer:
|
||||
|
||||
1. **Guided deterministic** — the six guided answers map deterministically
|
||||
into `$CODEWHALE_HOME/constitution.json`. Always available; the standing
|
||||
fallback.
|
||||
2. **Model-assisted** — once the user's first provider/model route is ready,
|
||||
`A` on the Constitution step asks that first configured model (GLM-5.2 on
|
||||
Z.ai, DeepSeek, or any other route) to draft the constitution from the
|
||||
guided answers. The request carries only the six answer labels and the UI
|
||||
language tag. The reply is treated as untrusted data: the first JSON object
|
||||
is extracted, schema-parsed (unknown keys — including any runtime-policy
|
||||
keys — are dropped), sanitized (control characters and
|
||||
`<codewhale_user_constitution>` tag forgery neutralized), and bounded
|
||||
before anyone sees it. Invalid, empty, or failed drafts degrade to the
|
||||
deterministic path with a visible reason.
|
||||
|
||||
Either way, the saved artifact is the same bounded `UserConstitution` JSON,
|
||||
rendered by the same deterministic renderer into the same
|
||||
`<codewhale_user_constitution>` block — the model that drafts the law gains no
|
||||
authority from having written it. Ratification is explicit: the wizard shows
|
||||
the rendered preview and nothing persists until the user confirms with `G`.
|
||||
`setup_state.json` records the provenance (`constitution_authoring`:
|
||||
`guided` or `model_drafted`).
|
||||
|
||||
This matters for provider testing: a GLM-5.2 route receives the same
|
||||
constitution layer as any other route, and may also be the route that drafts
|
||||
it. Provider/model choice affects model behavior, context limits, pricing,
|
||||
and reasoning controls, but it does not change the constitution schema or
|
||||
silently expand runtime authority.
|
||||
|
||||
## Schema Shape
|
||||
|
||||
```json
|
||||
{
|
||||
"schema_version": 1,
|
||||
"language": "en",
|
||||
"about": "short user/work context",
|
||||
"working_style": [
|
||||
"bounded working-style preference"
|
||||
],
|
||||
"priorities": [
|
||||
"bounded standing priority"
|
||||
],
|
||||
"autonomy_preference": "balanced",
|
||||
"notes": "bounded advisory free prose"
|
||||
}
|
||||
```
|
||||
|
||||
All text fields are bounded before save. Empty structured constitutions render
|
||||
no block. Autonomy remains guidance only; it never changes approval policy,
|
||||
sandbox mode, shell access, network defaults, trust, MCP permission, or default
|
||||
mode.
|
||||
|
||||
## Example: GLM-5.2 Coding Workbench
|
||||
|
||||
This is the kind of user-global constitution a Z.ai/GLM-5.2 user might ratify
|
||||
after choosing a coding purpose, ambitious initiative, release evidence,
|
||||
concise communication, strict boundaries, and scoped changes — whether GLM-5.2
|
||||
drafted it via `A` or the wizard rendered it deterministically. A model-drafted
|
||||
version may word the prose differently, but it must land in this same schema,
|
||||
inside these same bounds, and renders through this same block.
|
||||
|
||||
```json
|
||||
{
|
||||
"schema_version": 1,
|
||||
"language": "en",
|
||||
"about": "A CodeWhale user who routes through Z.ai GLM-5.2 for coding work and wants a calm, evidence-first coding workbench.",
|
||||
"working_style": [
|
||||
"Keep code changes scoped to requested behavior and existing repo patterns.",
|
||||
"Keep updates concise and explain important tradeoffs briefly.",
|
||||
"Cite file paths, commands, screenshots, CI, or sources for material claims and release evidence.",
|
||||
"Treat secrets, personal data, credentials, production state, money, and publish actions as stop-and-confirm boundaries."
|
||||
],
|
||||
"priorities": [
|
||||
"Current user requests and live tool evidence outrank memory, stale handoffs, and guesses.",
|
||||
"Batch routine safe work, then stop for destructive, credential, publishing, high-cost, legal, or security-risk actions.",
|
||||
"Stop and ask before reading or spreading sensitive data, touching production systems, spending money, or publishing."
|
||||
],
|
||||
"autonomy_preference": "autonomous",
|
||||
"notes": "Guided answers: purpose=coding workbench; initiative=ambitious; evidence=release receipts; communication=concise; privacy=strict boundaries; principles=scoped changes. Freeform principle: prefer small, reviewable changes and avoid unrelated refactors unless explicitly requested. Freeform principles are advisory and do not change approval, sandbox, shell, network, trust, or MCP permissions."
|
||||
}
|
||||
```
|
||||
|
||||
Rendered block:
|
||||
|
||||
```text
|
||||
<codewhale_user_constitution source="user-global">
|
||||
User-global standing preferences (personal law: subordinate to the current user request and the global Constitution, but applies across all your projects). Treat as durable guidance, not as enforceable runtime policy.
|
||||
|
||||
About the user:
|
||||
A CodeWhale user who routes through Z.ai GLM-5.2 for coding work and wants a calm, evidence-first coding workbench.
|
||||
|
||||
Working style:
|
||||
- Keep code changes scoped to requested behavior and existing repo patterns.
|
||||
- Keep updates concise and explain important tradeoffs briefly.
|
||||
- Cite file paths, commands, screenshots, CI, or sources for material claims and release evidence.
|
||||
- Treat secrets, personal data, credentials, production state, money, and publish actions as stop-and-confirm boundaries.
|
||||
|
||||
Standing priorities:
|
||||
- Current user requests and live tool evidence outrank memory, stale handoffs, and guesses.
|
||||
- Batch routine safe work, then stop for destructive, credential, publishing, high-cost, legal, or security-risk actions.
|
||||
- Stop and ask before reading or spreading sensitive data, touching production systems, spending money, or publishing.
|
||||
|
||||
Autonomy preference (guidance only — does not change approval policy, sandbox, shell, network, trust, MCP permissions, or default mode):
|
||||
The user prefers ambitious initiative wherever it is safe: batch routine work and surface decisions rather than pausing for routine confirmations.
|
||||
|
||||
Additional notes (advisory, not enforceable policy):
|
||||
Guided answers: purpose=coding workbench; initiative=ambitious; evidence=release receipts; communication=concise; privacy=strict boundaries; principles=scoped changes. Freeform principle: prefer small, reviewable changes and avoid unrelated refactors unless explicitly requested. Freeform principles are advisory and do not change approval, sandbox, shell, network, trust, or MCP permissions.
|
||||
</codewhale_user_constitution>
|
||||
```
|
||||
|
||||
## Example: Research Synthesis
|
||||
|
||||
```json
|
||||
{
|
||||
"schema_version": 1,
|
||||
"language": "en",
|
||||
"about": "A CodeWhale user who wants current, cited research and careful synthesis.",
|
||||
"working_style": [
|
||||
"Separate live evidence from inference and cite sources for unstable facts.",
|
||||
"Explain key reasoning and tradeoffs enough that the user can learn the system.",
|
||||
"Use commands, tests, screenshots, or citations when they materially reduce uncertainty.",
|
||||
"Protect secrets, user files, git history, production systems, cost, privacy, and time."
|
||||
],
|
||||
"priorities": [
|
||||
"Current user requests and live tool evidence outrank memory, stale handoffs, and guesses.",
|
||||
"Stop and ask before editing files, running commands, or choosing between ambiguous product paths.",
|
||||
"Ask before destructive, high-cost, credential, publishing, legal, or security-risk actions."
|
||||
],
|
||||
"autonomy_preference": "cautious",
|
||||
"notes": "Guided answers: purpose=research synthesis; initiative=cautious; evidence=tests/receipts; communication=teaching; privacy=standard care; principles=user voice. Freeform principle: preserve the user's voice, brand, and constraints without treating preferences as permission expansion. Freeform principles are advisory and do not change approval, sandbox, shell, network, trust, or MCP permissions."
|
||||
}
|
||||
```
|
||||
|
||||
## Example: Operations Helper
|
||||
|
||||
```json
|
||||
{
|
||||
"schema_version": 1,
|
||||
"language": "en",
|
||||
"about": "A CodeWhale user who wants reliable operational help with clear rollback points.",
|
||||
"working_style": [
|
||||
"Prefer reversible operational steps with dry-runs, status checks, and rollback notes.",
|
||||
"Be direct about blockers, risk, and uncertainty; avoid ornamental copy.",
|
||||
"Summarize assumptions, unknowns, and remaining risk before claiming completion.",
|
||||
"Keep project-specific context local; avoid carrying sensitive details into memory unless explicitly asked."
|
||||
],
|
||||
"priorities": [
|
||||
"Current user requests and live tool evidence outrank memory, stale handoffs, and guesses.",
|
||||
"Act directly on clear low-risk tasks; confirm before risky, destructive, or ambiguous actions.",
|
||||
"Confirm before carrying project details across memory, workspaces, or stale handoffs."
|
||||
],
|
||||
"autonomy_preference": "balanced",
|
||||
"notes": "Guided answers: purpose=operations helper; initiative=balanced; evidence=assumptions; communication=direct; privacy=project-local memory; principles=reversible steps. Freeform principle: favor reversible steps, checkpoints, and rollback notes before high-impact operations. Freeform principles are advisory and do not change approval, sandbox, shell, network, trust, or MCP permissions."
|
||||
}
|
||||
```
|
||||
|
||||
## Acceptance Notes
|
||||
|
||||
- `/setup` first opens the ratification preview; saving the guided
|
||||
constitution requires a second `G` after preview. A model draft (`A`) opens
|
||||
its ratification preview immediately and still requires the explicit `G`.
|
||||
- Tuning any guided answer (`1-6`) discards an installed model draft and
|
||||
forces a fresh preview before save.
|
||||
- The model-draft offer exists only when the first provider/model route is
|
||||
ready; any drafting failure reports why and leaves the guided path standing.
|
||||
- Saving writes `constitution.json` and `setup_state.json` (including
|
||||
`constitution_authoring` provenance) through one setup transaction.
|
||||
- `/constitution preview` and prompt assembly use the same deterministic
|
||||
renderer for guided and model-drafted constitutions alike.
|
||||
- Bundled/default, deferred, invalid, empty, unreadable, or expert-override
|
||||
states suppress stale user-global injection.
|
||||
@@ -1,42 +0,0 @@
|
||||
# Fleet roster: v0868-stopship (#4178)
|
||||
#
|
||||
# Named stopship fleet binding roles → AgentProfile ids. Fleet resolves roles
|
||||
# only — it does NOT spawn tmux or manage worktrees (Runtime owns those).
|
||||
#
|
||||
# Load path (when wired by workflow run --fleet):
|
||||
# 1. $CODEWHALE_HOME/fleets/v0868-stopship.toml
|
||||
# 2. <workspace>/fleets/v0868-stopship.toml (this file)
|
||||
#
|
||||
# Built-in roster members used as profile ids: scout, builder, reviewer,
|
||||
# verifier, manager. Role aliases match Phase 2 / Phase 3 vocabulary.
|
||||
|
||||
name = "v0868-stopship"
|
||||
description = "Read-only v0.8.68 orchestration acceptance fleet"
|
||||
|
||||
[roles]
|
||||
# role name = AgentProfile id (built-in or workspace profile)
|
||||
scout = "scout"
|
||||
implementer = "builder"
|
||||
reviewer = "reviewer"
|
||||
verifier = "verifier"
|
||||
release_lead = "manager"
|
||||
|
||||
[role_intents.scout]
|
||||
mode = "read_only"
|
||||
summary = "Source-level runtime and receipt reconnaissance"
|
||||
|
||||
[role_intents.implementer]
|
||||
mode = "read_only"
|
||||
summary = "No-edit acceptance evidence plan"
|
||||
|
||||
[role_intents.reviewer]
|
||||
mode = "read_only"
|
||||
summary = "False-green and receipt-contract review"
|
||||
|
||||
[role_intents.verifier]
|
||||
mode = "read_only"
|
||||
summary = "Static test and receipt serialization verification"
|
||||
|
||||
[role_intents.release_lead]
|
||||
mode = "read_only"
|
||||
summary = "Final evidence-only acceptance receipt"
|
||||
@@ -91,7 +91,6 @@
|
||||
"crates/tui/src/skills/install.rs",
|
||||
"crates/tui/src/skills/mod.rs",
|
||||
"crates/tui/src/skills/mutation.rs",
|
||||
"crates/tui/src/slop_ledger.rs",
|
||||
"crates/tui/src/snapshot/repo.rs",
|
||||
"crates/tui/src/task_manager.rs",
|
||||
"crates/tui/src/tool_inspection.rs",
|
||||
|
||||
@@ -1,203 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# v0.8.67 constitution-first setup lane — headless QA probe.
|
||||
#
|
||||
# Exercises the noninteractive surfaces of the setup lane against isolated
|
||||
# temp homes so the human manual pass shrinks to visual confirmation only.
|
||||
# It does NOT drive the interactive TUI; it verifies the machine-readable
|
||||
# contracts (doctor --json .setup, constitution state derivation, secret
|
||||
# safety, WHALE.md migration diagnostics) that the QA matrix ties each
|
||||
# scenario to.
|
||||
#
|
||||
# Usage:
|
||||
# scripts/v0867-setup-qa.sh # build (release) if needed, then probe
|
||||
# CODEWHALE_BIN=/path/to/codewhale-tui scripts/v0867-setup-qa.sh # use a prebuilt binary
|
||||
#
|
||||
# Exit 0 = every probe passed. Non-zero = a contract regressed; the failing
|
||||
# probe prints what it expected vs. observed. Requires `jq`.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
cd "$REPO_ROOT"
|
||||
|
||||
if ! command -v jq >/dev/null 2>&1; then
|
||||
echo "FATAL: jq is required (brew install jq)." >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
BIN="${CODEWHALE_BIN:-}"
|
||||
if [[ -z "$BIN" ]]; then
|
||||
if [[ -x "target/release/codewhale-tui" ]]; then
|
||||
BIN="target/release/codewhale-tui"
|
||||
else
|
||||
echo "Building release codewhale-tui (set CODEWHALE_BIN to skip)…" >&2
|
||||
cargo build --release -p codewhale-tui >&2
|
||||
BIN="target/release/codewhale-tui"
|
||||
fi
|
||||
fi
|
||||
if [[ "$BIN" != /* ]]; then
|
||||
BIN="$REPO_ROOT/$BIN"
|
||||
fi
|
||||
echo "Using binary: $BIN" >&2
|
||||
|
||||
PASS=0
|
||||
FAIL=0
|
||||
pass() { echo " PASS: $1"; PASS=$((PASS + 1)); }
|
||||
fail() { echo " FAIL: $1" >&2; FAIL=$((FAIL + 1)); }
|
||||
expect_jq_value() {
|
||||
local label="$1"
|
||||
local json="$2"
|
||||
local filter="$3"
|
||||
local expected="$4"
|
||||
local observed
|
||||
observed="$(echo "$json" | jq -r "$filter")"
|
||||
if [[ "$observed" == "$expected" ]]; then
|
||||
pass "$label"
|
||||
else
|
||||
fail "$label wrong: $observed"
|
||||
fi
|
||||
}
|
||||
expect_jq_select() {
|
||||
local label="$1"
|
||||
local json="$2"
|
||||
local filter="$3"
|
||||
if echo "$json" | jq -e "$filter" >/dev/null; then
|
||||
pass "$label"
|
||||
else
|
||||
fail "$label missing"
|
||||
fi
|
||||
}
|
||||
|
||||
# Run the binary in a fully isolated home so no real install is read or
|
||||
# mutated. Echoes the doctor --json blob on stdout.
|
||||
doctor_json_in() {
|
||||
local home="$1"
|
||||
shift
|
||||
CODEWHALE_HOME="$home/codewhale-home" \
|
||||
HOME="$home/home" \
|
||||
USERPROFILE="$home/home" \
|
||||
DEEPSEEK_CONFIG_PATH="$home/codewhale-home/config.toml" \
|
||||
"$BIN" doctor --json "$@" 2>/dev/null
|
||||
}
|
||||
|
||||
new_home() {
|
||||
local d
|
||||
d="$(mktemp -d)"
|
||||
mkdir -p "$d/codewhale-home" "$d/home"
|
||||
echo "$d"
|
||||
}
|
||||
|
||||
echo "== v0.8.67 setup-lane headless QA =="
|
||||
|
||||
# --- Scenario: clean home, no constitution chosen yet ---
|
||||
echo "[clean home] doctor --json .setup contract"
|
||||
H="$(new_home)"
|
||||
SETUP="$(doctor_json_in "$H" | jq '.setup')"
|
||||
if [[ -n "$SETUP" && "$SETUP" != "null" ]]; then
|
||||
pass "doctor --json emits a .setup block on a clean home"
|
||||
else
|
||||
fail "doctor --json .setup missing on a clean home"
|
||||
fi
|
||||
for field in constitution provider_model runtime_posture_source steps next_actions; do
|
||||
if echo "$SETUP" | jq -e "has(\"$field\")" >/dev/null; then
|
||||
pass ".setup.$field present"
|
||||
else
|
||||
fail ".setup.$field missing"
|
||||
fi
|
||||
done
|
||||
expect_jq_value ".setup.first_run_ready == false" "$SETUP" '.first_run_ready' "false"
|
||||
expect_jq_value ".setup.update_ready == false" "$SETUP" '.update_ready' "false"
|
||||
expect_jq_value ".setup.operate_ready == false" "$SETUP" '.operate_ready' "false"
|
||||
expect_jq_value ".setup.next_actions.constitution == /constitution" "$SETUP" '.next_actions.constitution' "/constitution"
|
||||
expect_jq_value ".setup.next_actions.provider_model advertises guided provider setup" "$SETUP" '.next_actions.provider_model' "/setup provider, /provider setup <name>, or /model"
|
||||
expect_jq_value ".setup.next_actions.hotbar == /setup hotbar" "$SETUP" '.next_actions.hotbar' "/setup hotbar"
|
||||
expect_jq_value ".setup.next_actions.tools_mcp == /setup tools" "$SETUP" '.next_actions.tools_mcp' "/setup tools"
|
||||
expect_jq_value ".setup.next_actions.remote_runtime == /setup remote" "$SETUP" '.next_actions.remote_runtime' "/setup remote"
|
||||
expect_jq_value ".setup.next_actions.persistence == /setup persistence" "$SETUP" '.next_actions.persistence' "/setup persistence"
|
||||
expect_jq_value ".setup.provider_model.provider.id == deepseek" "$SETUP" '.provider_model.provider.id' "deepseek"
|
||||
expect_jq_value ".setup.provider_model.model.resolved == deepseek-v4-pro" "$SETUP" '.provider_model.model.resolved' "deepseek-v4-pro"
|
||||
expect_jq_value ".setup.provider_model.auth.credential_url is DeepSeek" "$SETUP" '.provider_model.auth.credential_url' "https://platform.deepseek.com/api_keys"
|
||||
expect_jq_value ".setup.provider_model.auth.env_vars[0] == DEEPSEEK_API_KEY" "$SETUP" '.provider_model.auth.env_vars[0]' "DEEPSEEK_API_KEY"
|
||||
expect_jq_value ".setup.provider_model.health.live_validation == false" "$SETUP" '.provider_model.health.live_validation' "false"
|
||||
expect_jq_value ".setup.operate_fleet.concurrency.plan_limit_probed == false" "$SETUP" '.operate_fleet.concurrency.plan_limit_probed' "false"
|
||||
expect_jq_value ".setup.operate_fleet.roster.readiness_rule is documented" "$SETUP" '.operate_fleet.roster.readiness_rule' "built-in starter roster or custom roster"
|
||||
for step in provider_model trust_sandbox operate_fleet hotbar tools_mcp remote_runtime persistence verification; do
|
||||
expect_jq_select ".setup.steps includes $step" "$SETUP" ".steps[] | select(.step == \"$step\")"
|
||||
done
|
||||
rm -rf "$H"
|
||||
|
||||
# --- Scenario: secret safety — a configured key must never appear in doctor --json ---
|
||||
echo "[secret safety] configured key absent from doctor --json"
|
||||
H="$(new_home)"
|
||||
SECRET="CANARY_apikey_do_not_leak_0000"
|
||||
cat > "$H/codewhale-home/config.toml" <<EOF
|
||||
model = "deepseek-v4-pro"
|
||||
[providers.deepseek]
|
||||
api_key = "$SECRET"
|
||||
EOF
|
||||
FULL="$(doctor_json_in "$H")"
|
||||
if echo "$FULL" | grep -q "$SECRET"; then
|
||||
fail "raw API key leaked into doctor --json output"
|
||||
else
|
||||
pass "raw API key never appears in doctor --json"
|
||||
fi
|
||||
rm -rf "$H"
|
||||
|
||||
# --- Scenario: existing valid repo constitution surfaces without leaking body ---
|
||||
echo "[repo law] enforced invariant surfaces in context diagnostics, body not loaded verbatim"
|
||||
H="$(new_home)"
|
||||
WS="$(mktemp -d)"
|
||||
mkdir -p "$WS/.codewhale"
|
||||
cat > "$WS/.codewhale/constitution.json" <<'EOF'
|
||||
{
|
||||
"authority": ["AGENTS.md"],
|
||||
"protected_invariants": [
|
||||
{ "text": "The wire format is frozen", "paths": ["crates/protocol/**"], "action": "block" }
|
||||
]
|
||||
}
|
||||
EOF
|
||||
CTX="$(cd "$WS" && CODEWHALE_HOME="$H/codewhale-home" HOME="$H/home" USERPROFILE="$H/home" \
|
||||
"$BIN" doctor --context-json 2>/dev/null || true)"
|
||||
if echo "$CTX" | jq -e '.entries[] | select(.source_kind == "repo_constitution")' >/dev/null 2>&1; then
|
||||
pass "repo constitution surfaces in --context-json"
|
||||
else
|
||||
fail "repo constitution not found in --context-json"
|
||||
fi
|
||||
rm -rf "$H" "$WS"
|
||||
|
||||
# --- Scenario: legacy WHALE.md is ignored, body not loaded ---
|
||||
echo "[WHALE.md migration] legacy file reported, body never surfaced"
|
||||
H="$(new_home)"
|
||||
WS="$(mktemp -d)"
|
||||
printf 'SECRET_WHALE_BODY_SHOULD_NOT_APPEAR\n' > "$WS/WHALE.md"
|
||||
CTX="$(cd "$WS" && CODEWHALE_HOME="$H/codewhale-home" HOME="$H/home" USERPROFILE="$H/home" \
|
||||
"$BIN" doctor --context-json 2>/dev/null || true)"
|
||||
if echo "$CTX" | grep -q "SECRET_WHALE_BODY_SHOULD_NOT_APPEAR"; then
|
||||
fail "legacy WHALE.md body leaked into context report"
|
||||
else
|
||||
pass "legacy WHALE.md body not loaded into context report"
|
||||
fi
|
||||
rm -rf "$H" "$WS"
|
||||
|
||||
echo
|
||||
echo "== summary: $PASS passed, $FAIL failed =="
|
||||
if [[ "$FAIL" -gt 0 ]]; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
cat <<'EOF'
|
||||
|
||||
Remaining MANUAL (visual) checks — these need a human eye on a live TUI and
|
||||
are the only setup-lane items this script cannot cover:
|
||||
1. /setup welcome opens with the dual meaning of "code" and the
|
||||
choose -> draft -> ratify arc.
|
||||
2. /setup Constitution step: G guided preview + ratify, K keep-existing
|
||||
(when a valid constitution.json is present), A model-draft (provider
|
||||
ready), U bundled.
|
||||
3. /constitution manager renders bundled / user-global / repo-local /
|
||||
AGENTS / memory layers.
|
||||
4. Approval prompt reads calm for routine/elevated actions and reserves
|
||||
the red DESTRUCTIVE styling for genuinely critical ones.
|
||||
5. /fleet setup: m drafts a profile (provider ready), preview shows the
|
||||
exact TOML, g ratifies.
|
||||
EOF
|
||||
Reference in New Issue
Block a user