feat: harden OpenSpec SDD workflow

2026-08-26 00:42:35 +03:00
parent 039b72eed3
commit a8b2c4eed9
42 changed files with 4024 additions and 181 deletions
@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)
+verifier="$script_dir/verify-agent-projection.sh"
+syncer="$script_dir/sync-agent-projection.sh"
+contract_version=$(tr -d '[:space:]' < "$script_dir/../openspec/.cli-version")
+
+if [[ ! -x "$verifier" ]]; then
+  printf 'expected executable projection verifier at %s\n' "$verifier" >&2
+  exit 1
+fi
+if [[ ! -x "$syncer" ]]; then
+  printf 'expected executable projection sync at %s\n' "$syncer" >&2
+  exit 1
+fi
+
+fixture=$(mktemp -d)
+trap 'rm -rf "$fixture"' EXIT
+
+mkdir -p "$fixture/specs/openspec" \
+  "$fixture/specs/agent-projection/opencode/commands" \
+  "$fixture/specs/agent-projection/opencode/skills/example" \
+  "$fixture/.opencode"
+printf '%s\n' "$contract_version" > "$fixture/specs/openspec/.cli-version"
+printf 'command authority\n' > "$fixture/specs/agent-projection/opencode/commands/example.md"
+printf '%s\n' '---' 'name: example' 'metadata:' "  generatedBy: \"$contract_version\"" '---' > "$fixture/specs/agent-projection/opencode/skills/example/SKILL.md"
+printf '{"private":true}\n' > "$fixture/.opencode/package.json"
+
+WEALTH_LEDGER_WORKSPACE="$fixture" bash "$syncer"
+WEALTH_LEDGER_WORKSPACE="$fixture" bash "$verifier"
+[[ -f "$fixture/.opencode/package.json" ]]
+
+printf 'manual drift\n' >> "$fixture/.opencode/commands/example.md"
+if output=$(WEALTH_LEDGER_WORKSPACE="$fixture" bash "$verifier" 2>&1); then
+  printf 'expected content drift to fail projection verification\n' >&2
+  exit 1
+fi
+[[ "$output" == *'projection content drift: commands/example.md'* ]]
+WEALTH_LEDGER_WORKSPACE="$fixture" bash "$syncer"
+
+rm "$fixture/.opencode/skills/example/SKILL.md"
+if output=$(WEALTH_LEDGER_WORKSPACE="$fixture" bash "$verifier" 2>&1); then
+  printf 'expected missing projection file to fail verification\n' >&2
+  exit 1
+fi
+[[ "$output" == *'missing projection file: skills/example/SKILL.md'* ]]
+WEALTH_LEDGER_WORKSPACE="$fixture" bash "$syncer"
+
+printf 'unexpected\n' > "$fixture/.opencode/commands/unexpected.md"
+if output=$(WEALTH_LEDGER_WORKSPACE="$fixture" bash "$verifier" 2>&1); then
+  printf 'expected extra projection file to fail verification\n' >&2
+  exit 1
+fi
+[[ "$output" == *'unexpected projection file: commands/unexpected.md'* ]]
+WEALTH_LEDGER_WORKSPACE="$fixture" bash "$syncer"
+
+perl -0pi -e 's/generatedBy: "1\.10\.0"/generatedBy: "9.9.9"/' "$fixture/specs/agent-projection/opencode/skills/example/SKILL.md"
+if output=$(WEALTH_LEDGER_WORKSPACE="$fixture" bash "$verifier" 2>&1); then
+  printf 'expected incompatible canonical marker to fail verification\n' >&2
+  exit 1
+fi
+[[ "$output" == *"generated version marker mismatch in skills/example/SKILL.md: expected $contract_version"* ]]
+perl -0pi -e "s/generatedBy: \"9\\.9\\.9\"/generatedBy: \"$contract_version\"/" "$fixture/specs/agent-projection/opencode/skills/example/SKILL.md"
+
+printf 'old command\n' > "$fixture/.opencode/commands/example.md"
+printf '%s\n' '---' 'name: old' 'metadata:' "  generatedBy: \"$contract_version\"" '---' > "$fixture/.opencode/skills/example/SKILL.md"
+cp -R "$fixture/.opencode/commands" "$fixture/expected-commands"
+cp -R "$fixture/.opencode/skills" "$fixture/expected-skills"
+if WEALTH_LEDGER_WORKSPACE="$fixture" WEALTH_LEDGER_SYNC_FAIL_DURING_BACKUP=1 bash "$syncer"; then
+  printf 'expected injected backup failure\n' >&2
+  exit 1
+fi
+diff -r "$fixture/expected-commands" "$fixture/.opencode/commands"
+diff -r "$fixture/expected-skills" "$fixture/.opencode/skills"
+
+if WEALTH_LEDGER_WORKSPACE="$fixture" WEALTH_LEDGER_SYNC_FAIL_AFTER_COMMANDS=1 bash "$syncer"; then
+  printf 'expected injected sync failure\n' >&2
+  exit 1
+fi
+diff -r "$fixture/expected-commands" "$fixture/.opencode/commands"
+diff -r "$fixture/expected-skills" "$fixture/.opencode/skills"
+
+rm -rf "$fixture/.opencode/commands" "$fixture/.opencode/skills"
+WEALTH_LEDGER_WORKSPACE="$fixture" bash "$syncer"
+WEALTH_LEDGER_WORKSPACE="$fixture" bash "$verifier"
+
+printf 'verify-agent-projection tests passed\n'