From a076ccfe513c2b261efa3e821f05a2706106f050 Mon Sep 17 00:00:00 2001 From: jochen Date: Fri, 9 Oct 2026 12:02:28 +0200 Subject: [PATCH] Run the proof of the operator's answers in the Go toolchain on every pull request, and say NOT RUN loudly where it cannot The review of 2026-10-09: the build seat runs the lab's merge-check.sh in the TypeScript toolchain, which holds no Go, so the proof never ran there. It is now a declared part of its own (mesh-check-also), run against the controller, runtime and catalogue cloned beside the lab; a missing clone or a controller without the proof's fixture is said NOT RUN in capitals instead of failing every lab change. --- asks/harness_test.go | 14 ++++++++++++++ asks/merge-check.sh | 22 ++++++++++++++++++---- merge-check.sh | 9 ++++++--- 3 files changed, 38 insertions(+), 7 deletions(-) diff --git a/asks/harness_test.go b/asks/harness_test.go index 89f7025..8101b6a 100644 --- a/asks/harness_test.go +++ b/asks/harness_test.go @@ -84,6 +84,20 @@ func clonesFor(t *testing.T) clones { "MESH_LAB_CATALOGUE)", want) } } + // The controller beside is, on the build seat, the one the mesh runs: until it carries the proof's fixture + // (mesh-controller's TestTheAsksLabBus), the proof cannot compose its bus, and says so rather than fail + // every pull request of the lab for a merge not yet made. + fixtures, _ := filepath.Glob(filepath.Join(c.controller, "internal", "inventory", "*_test.go")) + has := false + for _, f := range fixtures { + if body, err := os.ReadFile(f); err == nil && strings.Contains(string(body), "func TestTheAsksLabBus(") { + has = true + } + } + if !has { + t.Skipf("NOT RUN: the controller at %s has no TestTheAsksLabBus, the fixture that composes the proof's bus "+ + "(mesh-controller #157): the proof runs once the controller it is given carries it", c.controller) + } return c } diff --git a/asks/merge-check.sh b/asks/merge-check.sh index 696c3e4..11070dd 100644 --- a/asks/merge-check.sh +++ b/asks/merge-check.sh @@ -1,7 +1,17 @@ #!/bin/sh -# The proof of the operator's answers (novox/hq ADR 0259): formatted, vetted, and run where the clones it -# builds are beside it (MESH_LAB_REPOS, or MESH_LAB_CONTROLLER, MESH_LAB_TOOLS and MESH_LAB_CATALOGUE); -# elsewhere it says NOT RUN and why. It takes about four minutes when it runs. +# mesh-check-toolchain: go +# +# The proof of the operator's answers (novox/hq ADR 0259), the Go part of the lab's own check: run by the +# build seat in the mesh's Go toolchain, its own container, because the lab's merge-check.sh declares it +# (`# mesh-check-also: go asks/merge-check.sh`) — and by hand: `sh asks/merge-check.sh`. +# +# Formatted, vetted, and run against the clones beside the lab: on the build seat those are the controller, +# the runtime and the catalogue **the mesh runs**, so every pull request of the lab proves the answers the +# operator would get today. By hand, MESH_LAB_REPOS, or MESH_LAB_CONTROLLER, MESH_LAB_TOOLS and +# MESH_LAB_CATALOGUE, point it at branches under review. It takes about four minutes when it runs. +# +# **Said, never passed silently**: where a clone is missing, or the controller predates the proof's fixture, +# it says NOT RUN and why, in capitals, and passes; a proof that runs and fails, fails the check. set -eu cd "$(dirname "$0")" export GOPRIVATE=git.novox.be @@ -17,7 +27,11 @@ go vet ./... out=$(mktemp) status=0 go test -count=1 -timeout 25m -v -run '^TestTheOperatorsAnswerEndToEnd$' . >"$out" 2>&1 || status=$? -grep -E '^(--- | --- |ok|FAIL|PASS)|NOT RUN' "$out" || true +grep -E '^(--- | --- |ok|FAIL|PASS)' "$out" || true +if grep -q 'NOT RUN' "$out"; then + echo "NOT RUN: THE PROOF OF THE OPERATOR'S ANSWERS DID NOT RUN HERE:" + grep -o 'NOT RUN: .*' "$out" | head -3 +fi [ "$status" -eq 0 ] || tail -60 "$out" rm -f "$out" exit "$status" diff --git a/merge-check.sh b/merge-check.sh index 39c836b..4769564 100644 --- a/merge-check.sh +++ b/merge-check.sh @@ -1,6 +1,7 @@ #!/bin/sh # mesh-check-toolchain: typescript # mesh-check-also: go replays/merge-check.sh +# mesh-check-also: go asks/merge-check.sh # # The lab's own check (novox/hq ADR 0237 as amended): the second layer of a pull request's merge check, # `mesh/repo-check`, run by the build seat — and by hand. @@ -11,8 +12,10 @@ # # - this script, in the TypeScript toolchain: installed from the lock file, type-checked, sources and # tests, and the unit suite; -# - replays/merge-check.sh, in the Go toolchain, declared on the line above: the replays register and its -# prover formatted, vetted and compiled, and the register's own tests. +# - replays/merge-check.sh, in the Go toolchain, declared above: the replays register and its prover +# formatted, vetted and compiled, and the register's own tests; +# - asks/merge-check.sh, in the Go toolchain, declared above: the proof of the operator's answers, run +# against the controller, runtime and catalogue cloned beside the lab (novox/hq ADR 0259). # # **Said, never passed silently**: the integration suite raises a lab on a workstation, and the replays # raise containers through the container runtime — neither is given to code nobody has approved. The @@ -29,6 +32,6 @@ if command -v go >/dev/null 2>&1; then sh replays/merge-check.sh sh asks/merge-check.sh else - echo "replays/ (Go) is checked by replays/merge-check.sh, which the build seat runs in the Go toolchain" + echo "replays/ and asks/ (Go) are checked by their merge-check.sh, which the build seat runs in the Go toolchain" fi echo "NOT RUN HERE: the integration suite and the replays — they need a lab and the container runtime"