Skip to content

[WIP] C10 shared contract foundation + C01/C02 canonical hardening - #1

Draft
loong10k wants to merge 13 commits into
feature/2.0.xfrom
feature/2.0.x-contract-hardening
Draft

loong10k wants to merge 13 commits into
feature/2.0.xfrom
feature/2.0.x-contract-hardening

Conversation

@loong10k

Copy link
Copy Markdown
Collaborator

Scope

First implementation increment of the approved order: C10 foundation → C01/C02/C03/C04/C05/C09 → C06/C07/C08 → final C10 integration. This draft is not completion of all ten OpenSpec Changes.

Canonical base: feature/2.0.x at d0c8056990f7a47fcc202acffa387ba066bcfc67.
Implementation branch: feature/2.0.x-contract-hardening.
The original 1.x / 2.x / 3.x refs and main have not been moved by this increment.

Implemented

  • C10: hash-locked synthetic argv fixtures, real Java child probes, fail-closed layered Surefire evidence reporting, branch-specific wrapper/JDK workflow, pinned official OpenSpec strict validation.
  • C01: lossless raw argv and empty/whitespace values across executor/adapter/typed paths; indexed null validation; ordered schema-checked options, explicit valued false and negation, immutable request input snapshots.
  • C02: stable per-client or explicitly shared capacity; submission-to-exit monotonic deadline; bounded stdout/stderr; cancellation and owned-root cleanup evidence; quarantine after unconfirmed root/reader cleanup.
  • Restored the missing 2.x Maven wrapper launcher using an existing repository blob, without changing Maven 3.9.16 or POM dependency versions/coverage thresholds.

Executed evidence

At code HEAD 3bacc8d09b1eeeaa05d6137e2a7e9c350d6622ce, Actions run 35564455068 completed successfully:

  • clean verify: 2052 Java tests; 0 failures, 0 errors, 0 skipped.
  • Selected contract layers: 43 argv / 14 process tests. These are controlled offline subprocess tests, not live OpenCLI website verification.
  • 13 Python evidence-runner self-tests passed.
  • Official OpenSpec 1.13.1, all ten changes individually and collectively with --strict --no-interactive: passed.
  • Source archive hash, reconstructed Git tree and Surefire XML were checked against the exact commit.

The final documentation checkpoint reruns CI on its own exact HEAD; do not infer that result from the preceding green run.

True RED checkpoints were retained before fixes: C01 21 assertion failures, then 11 dependency-layer failures; ordered options 10 failures; C02 8 failures. Infrastructure/setup failures were not counted as behavior RED.

Keep this PR in draft / do not merge yet

  • C01: add rejection coverage for custom Object.toString() returning null.
  • C02: fault-injection coverage and defensive cleanup around unchecked failures from stop/destroy are still needed; cancellation/exit races and unconfirmed cleanup need further review.
  • Portable cleanup confirms the owned root only; detached descendants are explicitly not claimed terminated. Windows/macOS execution has not been verified.
  • C09 is only a local log reduction so far; HTTP/WS and exception-cause privacy remain open.
  • C03/C04/C05/C06/C07/C08 implementations are not included.
  • No 1.x/3.x implementation backport, three-branch gate closure, CodeGraph run, live OpenCLI verification or independent code review is claimed.

No OpenSpec task has been prematurely checked off or Change archived.

Review entry points

Review focus: argv immutability, legacy API compatibility, limiter ownership, deadline/cleanup accounting, abnormal cleanup, output memory bounds and branch/platform portability.

…s tests

Add shared, hash-locked synthetic argv vectors and a Java 8-compatible child probe.
Add fail-closed layered Surefire reporting with 12 self-tests and pinned OpenSpec strict CI.
This is the intentional C01 RED checkpoint; no product Java sources changed.
Keep C10 integration and the remaining OpenSpec changes open.
…facts

The 2.x script invokes MavenWrapperMain but its launcher JAR was absent.
Reuse the existing repository 3.x launcher blob; retain Maven 3.9.16 distribution.
Use non-hidden scoped evidence directories so upload-artifact can find reports.
No product-source changes; the C01 regression suite remains the RED checkpoint.
…paths

Observed RED at 94de053: 33 real-child contract tests, 21 failures,
0 errors and 0 skips; full suite 2027 tests.
Snapshot submitted tokens, reject null elements without disclosing values,
preserve empty/padded/newline arguments and validate blank command identifiers.
Align two legacy filtering assertions with OC-ARGV-001 without removing tests.
Ordered schema-aware options and remaining C01 closure are still pending.
The first repair left 11 real-child assertions failing because CommandLine.Argument
trims its stored value even with handleQuoting=false. Preserve a separate literal
vector at the native launch boundary; do not relax whitespace/newline assertions.
No implicit shell parsing, quoting, or substitution is added.
Cover repeatable option occurrences, explicit valued false, positive/negative flags,
nonrepeatable and legacy collisions, malformed schemas, and captured mutable inputs.
Use public API reflection so absent API is an assertion failure, not compile failure.
The existing 33 real-child contracts remain enabled.
…inputs

Observed second RED at d02b16d: 2038 tests, 10 assertion failures, 0 errors/skips.
Add explicit flag/value/negatable schemas and immutable option occurrences.
Preserve occurrence order and valued false; reject duplicate/mixed-schema ambiguity.
Snapshot legacy maps and mutable values while retaining Boolean flag compatibility.
Do not claim capability discovery or final three-branch integration is complete.
Use self-bounded offline child processes to expose limiter replacement,
queue deadline bypass, unbounded stdout/stderr and interrupted-child leaks.
Also require explicit shared runtime and pre-cancel semantics.
No production lifecycle implementation changes in this RED checkpoint.
…pture

C02 RED at 31bde9c: 2046 tests, 8 failures, 0 errors/skips.
Use fixed per-client or explicit shared runtimes, monotonic queue/execution budgets,
8MiB stdout and 2MiB stderr caps, per-call cancellation and owned-root cleanup.
Preserve lifecycle reasons, byte counts and unknown descendant status in results.
Quarantine runtimes with unconfirmed owned root/reader cleanup; keep legacy API bridge.
Remote cancellation and unverified descendant ownership are not claimed.
…idence

Add UTF-8 byte-boundary, budget validation, running/queued cancellation,
configuration copy and repeated timeout regression tests.
Report both argv suites and process suites separately from live OpenCLI evidence.
Runner extension observed local RED then GREEN: 13 self-tests pass.
Archive only committed source alongside exact-head CI evidence for reproducible review.
…eview gates

Record exact RED/GREEN commits, 2052-test evidence, 43 argv/14 process contracts,
13 evidence-runner self-tests and ten official OpenSpec strict validations.
Keep remaining edge cases, independent review, platform/backport work and the
three-branch integration gate explicitly open; no OpenSpec tasks are pre-closed.
Preserve the intentional trailing TSV separator with a path-scoped attribute.
No product Java or dependency changes in this documentation checkpoint.

Copy link
Copy Markdown
Collaborator Author

最新文档检查点已完成精确 HEAD 验证:d2690ce76692d593044614e20f4dd2ae1e080176

OpenCLI Contracts run 35565296171 为 completed / success。已下载该 run 的产物并校验摘要、真实 Surefire XML 和报告:完整 2052 Java tests,0 failures / errors / skipped;argv 43 项、process 14 项;官方 OpenSpec 1.13.1 的十个 Change strict 全通过。证据检查器 13 项自检通过。

JDK artifact SHA-256:1a3787dfaa9c8c647dd8b9efcadc384ee3320ec3410e455d5ce846a13a02d205;strict artifact:8fa9fcc7a2aad6a180b8503fb78d5339ae6f986d978c1ef94f15ca98d6785caa

这只验证本次 canonical JDK17 增量,不验证真实 OpenCLI 网站、JDK8/21 版本线或全部 OpenSpec 关闭条件。PR 继续保持 draft;C01 null-toString 边界、C02 unchecked cleanup 故障注入/保护,以及说明中的其它门禁仍开放。原始 1.x/2.x/3.x 和 main 已回读确认未移动。

Resolve baseline build and the proposed safe YAML parser for C03.
Export only public Maven artifacts and distribution, never credentials or settings.
Bundle runs only when its workflow changes or is explicitly dispatched.
Run only bounded version/help probes from npm OpenCLI 1.8.8 with lifecycle scripts disabled.
Retain package provenance, hashes and descriptive artifacts; do not invoke website operations.
The registry returned E404 for @jackwener/opencli@1.8.8. Keep that evidence.
Build the previously audited 8271afc commit and label descriptive captures as source-built.
Do not silently substitute another upstream version.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant