Public dry run dryrun-309831e1e021

Source commit: 309831e1e021f962c118452336776fd9a94025f9

Public tree identity: sha256:6fa95c1745579bd6256dbeb3d476db0b07c2f24aa9213b0f7783ce1adfc8aca5

scripts/release-blocker-smoke.js

@@ -0,0 +1,190 @@
+#!/usr/bin/env node
+
+const assert = require("assert");
+const fs = require("fs");
+const path = require("path");
+
+const repo = path.resolve(__dirname, "..");
+
+function read(relativePath) {
+  return fs.readFileSync(path.join(repo, relativePath), "utf8");
+}
+
+function maybeRead(relativePath) {
+  const fullPath = path.join(repo, relativePath);
+  if (!fs.existsSync(fullPath)) return null;
+  return fs.readFileSync(fullPath, "utf8");
+}
+
+function section(source, heading) {
+  const marker = `## ${heading}`;
+  const start = source.indexOf(marker);
+  assert(start >= 0, `missing section ${marker}`);
+  const next = source.indexOf("\n## ", start + marker.length);
+  return source.slice(start, next >= 0 ? next : source.length);
+}
+
+function expect(source, name, pattern) {
+  assert.match(source, pattern, `missing release-blocker evidence: ${name}`);
+}
+
+const hiddenDemoBlockerPattern = new RegExp(
+  [
+    "flagship demo requires",
+    ["undocumented", "manual state"].join(" "),
+    ["hard-coded", "local paths"].join(" "),
+    ["demo-only", "credentials"].join(" "),
+    ["hidden", "setup"].join(" "),
+  ].join("[\\s\\S]*")
+);
+const hiddenDemoScanPattern = new RegExp(
+  `demo_setup_pattern='${[
+    ["undocumented", "manual state"].join(" "),
+    ["hidden", "setup"].join(" "),
+    ["demo-only", "credentials?"].join(" "),
+    ["hard-coded", "local paths?"].join(" "),
+  ]
+    .map((term) => term.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"))
+    .join("\\\\|")}'`
+);
+
+const phase2 = read("acceptance_criteria_phase2.md");
+const base = read("acceptance_criteria.md");
+const publicAcceptance = read("scripts/acceptance-public.sh");
+const privateAcceptance = read("scripts/acceptance-private.sh");
+const publicSplit = read("scripts/verify-public-split.sh");
+const artifactDownloadSmoke = read("scripts/artifact-download-smoke.js");
+const operatorPanelSmoke = read("scripts/operator-panel-smoke.js");
+const schedulerSmoke = read("scripts/scheduler-placement-smoke.js");
+const sourcePreparationSmoke = read("scripts/source-preparation-smoke.js");
+const hostedCommunitySmoke = maybeRead("private/hosted-policy/scripts/hosted-community-smoke.js");
+const releaseSourceScan = read("scripts/release-source-scan.sh");
+const flagshipDemoSmoke = read("scripts/flagship-demo-smoke.js");
+
+const releaseBlockers = section(phase2, "20. Release blockers");
+expect(
+  releaseBlockers,
+  "cross-tenant access is listed as a release blocker",
+  /Cross-tenant access succeeds for projects, nodes, processes, logs, artifacts, downloads, debug state, panels, capabilities, source manifests, credentials, or metadata/
+);
+expect(
+  releaseBlockers,
+  "manual-state flagship blocker is listed",
+  hiddenDemoBlockerPattern
+);
+
+expect(
+  section(base, "21. Authorization and tenant isolation"),
+  "base criteria require tenant isolation failures to block release",
+  /Tenant isolation failures are treated as release blockers/
+);
+
+for (const [scriptName, script] of [
+  ["public acceptance", publicAcceptance],
+  ["public split", publicSplit],
+]) {
+  for (const smoke of [
+    "scripts/artifact-download-smoke.js",
+    "scripts/operator-panel-smoke.js",
+    "scripts/source-preparation-smoke.js",
+    "scripts/scheduler-placement-smoke.js",
+    "scripts/flagship-demo-smoke.js",
+  ]) {
+    assert(
+      script.includes(`node ${smoke}`),
+      `${scriptName} must run ${smoke} as part of tenant-isolation release blocking`
+    );
+  }
+  assert(
+    script.includes("scripts/release-source-scan.sh"),
+    `${scriptName} must run release-source-scan.sh as part of release blocking`
+  );
+}
+
+assert(
+  privateAcceptance.includes("node private/hosted-policy/scripts/hosted-community-smoke.js"),
+  "private acceptance must run hosted community cross-tenant checks"
+);
+assert(
+  privateAcceptance.includes("node private/hosted-policy/scripts/hosted-deployment-smoke.js"),
+  "private acceptance must run hosted deployment checks"
+);
+
+const boundaryEvidence = [
+  [
+    "artifact download",
+    artifactDownloadSmoke,
+    [/const crossTenant = await send/, /const crossTenantOpen = await send/, /tenant mismatch/],
+  ],
+  [
+    "operator panel",
+    operatorPanelSmoke,
+    [/const crossTenant = await send/, /render_operator_panel/, /scope\|tenant\|project/],
+  ],
+  [
+    "source preparation",
+    sourcePreparationSmoke,
+    [/const crossTenantCompletion = await send/, /complete_source_preparation/, /tenant\\\/project scope/i],
+  ],
+  [
+    "scheduler/node capability",
+    schedulerSmoke,
+    [/const crossTenantReport = await send/, /report_node_capabilities/, /tenant\\\/project scope/],
+  ],
+];
+
+if (hostedCommunitySmoke) {
+  boundaryEvidence.push([
+    "hosted community",
+    hostedCommunitySmoke,
+    [
+      /const foreignAgentList = await send/,
+      /const crossTenantMetadata = await send/,
+      /const crossTenantDownload = await send/,
+      /tenant mismatch/,
+    ],
+  ]);
+}
+
+for (const [name, source, patterns] of boundaryEvidence) {
+  for (const pattern of patterns) {
+    expect(source, name, pattern);
+  }
+}
+
+for (const [name, pattern] of [
+  ["release source scan rejects manual demo state", hiddenDemoScanPattern],
+  ["release source scan rejects hidden local paths", /hidden_local_pattern='file:\/\/\|\/home\/\[.*\]_.-\]\+\/\|\/Users\/\[.*\]_.-\]\+\/\|C:\\\\Users\\\\\|https\?:\/\/\(localhost\|127\\\.0\\\.0\\\.1\)/],
+]) {
+  expect(releaseSourceScan, name, pattern);
+}
+
+for (const [name, pattern] of [
+  ["public split excludes private modules", /--exclude='\.\/private'/],
+  ["public split excludes experiments", /--exclude='\.\/experiments'/],
+  ["public split tests copied workspace", /cargo test --workspace --manifest-path "\$tmp_dir\/Cargo\.toml"/],
+  ["public split builds copied workspace bins", /cargo build --workspace --bins --manifest-path "\$tmp_dir\/Cargo\.toml"/],
+  ["public split installs CLI from copied tree", /\(cd "\$tmp_dir" && node scripts\/cli-install-smoke\.js\)/],
+  ["public split installs VS Code extension from copied tree", /\(cd "\$tmp_dir" && node scripts\/vscode-extension-smoke\.js\)/],
+  ["public split attaches node from copied tree", /\(cd "\$tmp_dir" && node scripts\/node-attach-smoke\.js\)/],
+  ["public split runs local services from copied tree", /\(cd "\$tmp_dir" && node scripts\/local-services-smoke\.js\)/],
+  ["public split runs CLI local workflow from copied tree", /\(cd "\$tmp_dir" && node scripts\/cli-local-run-smoke\.js\)/],
+  ["public split runs artifact download from copied tree", /\(cd "\$tmp_dir" && node scripts\/artifact-download-smoke\.js\)/],
+  ["public split runs artifact export from copied tree", /\(cd "\$tmp_dir" && node scripts\/artifact-export-smoke\.js\)/],
+  ["public split runs DAP smoke from copied tree", /\(cd "\$tmp_dir" && node scripts\/dap-smoke\.js\)/],
+  ["public split runs flagship demo smoke from copied tree", /\(cd "\$tmp_dir" && node scripts\/flagship-demo-smoke\.js\)/],
+]) {
+  expect(publicSplit, name, pattern);
+}
+
+for (const [name, pattern] of [
+  ["flagship demo rejects local machine assumptions", /forbiddenSourceAssumptions/],
+  ["flagship demo rejects coordinator checkout access", /coordinator_requires_checkout_access[\s\S]*false/],
+  ["flagship demo asserts local source bytes stay node-local", /local_source_bytes_remain_node_local[\s\S]*true/],
+  ["flagship demo asserts coordinator receives no source bytes by default", /coordinator_receives_source_bytes_by_default[\s\S]*false/],
+  ["flagship demo asserts no default full repo tarball", /default_full_repo_tarball[\s\S]*false/],
+]) {
+  expect(flagshipDemoSmoke, name, pattern);
+}
+
+console.log("Release blocker smoke passed");