feat(ql3): rehearse cross-domain reconciliation completion

2026-09-22 19:29:13 +08:00 · 2026-09-02 02:37:39 +08:00
parent 37801d2f30
commit a95ed67fe8
20 changed files with 1030 additions and 60 deletions
@@ -8,8 +8,10 @@ const test = require('node:test');

 const {
  automationFixture,
+  completionReviewFixture,
  parseArguments,
  reviewFixture,
+  secretConfigFixture,
 } = require('../../scripts/ql3-local-alpha-reconciliation-decision-fixture.cjs');

 const DOMAINS = [
@@ -29,6 +31,10 @@ const INVENTORY_DIGEST = '4'.repeat(64);
 const REVIEW_ID = '019f8680-143d-4000-8000-000000000301';
 const AUTOMATION_ID = '019f8680-143d-4000-8000-000000000461';
 const DECISION_ID = '019f8680-143d-7000-8000-000000000471';
+const SECRET_CONFIG_ID = '019f8680-143d-4000-8000-000000000491';
+const SECRET_CONFIG_DECISION_ID = '019f8680-143d-7000-8000-0000000004a1';
+const SECRET_CONFIG_PLAN_DIGEST = '6'.repeat(64);
+const SECRET_CONFIG_PREPARATION_DIGEST = '7'.repeat(64);

 function fixture(t) {
  const root = fs.realpathSync(
@@ -248,6 +254,119 @@ test('review fixture fails closed without the exact Legacy Crontabs fact', (t) =
  assert.equal(fs.existsSync(output), false);
 });

+function completionReviewState(t) {
+  const state = fixture(t);
+  const unknownPath = path.join(
+    state.root,
+    'diagnostics/legacy-unknown-table-0.json',
+  );
+  const unknown = JSON.parse(fs.readFileSync(unknownPath, 'utf8'));
+  unknown.records = [];
+  unknown.recordCount = 0;
+  fs.writeFileSync(unknownPath, `${JSON.stringify(unknown)}\n`);
+  const additions = [
+    ['legacy', 'secret_and_config', '6'],
+    ['target', 'secret_and_config', '7'],
+    ['target', 'run_history', '8'],
+  ];
+  for (const [database, domain, digest] of additions) {
+    const pagePath = path.join(
+      state.root,
+      'diagnostics',
+      `${database}-${domain}-table-0.json`,
+    );
+    const page = JSON.parse(fs.readFileSync(pagePath, 'utf8'));
+    page.records = [
+      {
+        schema: 'qinglong3-local-reconciliation-diagnostic-fact',
+        schemaVersion: 1,
+        ordinal: 1,
+        database,
+        domain,
+        factKind: 'table',
+        objectType: 'table',
+        name:
+          domain === 'secret_and_config'
+            ? database === 'legacy'
+              ? 'Envs'
+              : 'QingLong3Secrets'
+            : 'QingLong3Runs',
+        tableName:
+          domain === 'secret_and_config'
+            ? database === 'legacy'
+              ? 'Envs'
+              : 'QingLong3Secrets'
+            : 'QingLong3Runs',
+        rowCount: '1',
+        decisionRequirement: 'required',
+        reason:
+          domain === 'run_history'
+            ? 'historical_preservation_required'
+            : 'secret_custody_required',
+        factDigest: digest.repeat(64),
+      },
+    ];
+    page.recordCount = 1;
+    fs.writeFileSync(pagePath, `${JSON.stringify(page)}\n`);
+  }
+  const summaryPath = path.join(state.root, 'summary.json');
+  const summary = JSON.parse(fs.readFileSync(summaryPath, 'utf8'));
+  summary.review.diagnosticRecords = state.recordCount - 1 + additions.length;
+  fs.writeFileSync(summaryPath, `${JSON.stringify(summary)}\n`);
+  return state;
+}
+
+test('builds completion review authority for all adapted domains', (t) => {
+  const state = completionReviewState(t);
+  const output = path.join(
+    path.dirname(state.root),
+    `${path.basename(state.root)}.completion-review.ndjson`,
+  );
+  t.after(() => fs.rmSync(output, { force: true }));
+  const report = completionReviewFixture(state.root, output);
+  assert.equal(report.adoptedAutomationTables, 1);
+  assert.equal(report.legacyRunHistoryFacts, 1);
+  assert.equal(report.targetRunHistoryFacts, 1);
+  assert.equal(report.secretConfigFacts, 2);
+  const decisions = fs
+    .readFileSync(output, 'utf8')
+    .trimEnd()
+    .split('\n')
+    .map((line) => JSON.parse(line))
+    .slice(1);
+  assert.ok(
+    decisions.some(
+      (decision) =>
+        decision.database === 'legacy' &&
+        decision.domain === 'run_history' &&
+        decision.disposition === 'retain_both' &&
+        decision.reason === 'preserve_both',
+    ),
+  );
+  assert.ok(
+    decisions
+      .filter((decision) => decision.domain === 'secret_and_config')
+      .every(
+        (decision) =>
+          decision.disposition === 'manual_external' &&
+          decision.reason === 'external_recovery_required',
+      ),
+  );
+});
+
+test('completion review fixture refuses any blocked domain', (t) => {
+  const state = fixture(t);
+  const output = path.join(
+    path.dirname(state.root),
+    `${path.basename(state.root)}.blocked-completion.ndjson`,
+  );
+  assert.throws(
+    () => completionReviewFixture(state.root, output),
+    /refuses blocked diagnostic facts/,
+  );
+  assert.equal(fs.existsSync(output), false);
+});
+
 function automationState(t) {
  const state = fixture(t);
  fs.writeFileSync(
@@ -340,6 +459,99 @@ test('Automation fixture rejects a conflict before writing decisions', (t) => {
  assert.equal(fs.existsSync(output), false);
 });

+function secretConfigState(t) {
+  const state = fixture(t);
+  fs.writeFileSync(
+    path.join(state.root, 'summary.json'),
+    `${JSON.stringify({
+      schemaVersion: 1,
+      schema: 'qinglong/local-alpha-reconciliation-rehearsal-summary@v1',
+      status: 'secret_config_decision_required',
+      profile: 'edge',
+      secretConfig: {
+        secretConfigId: SECRET_CONFIG_ID,
+        secretConfigPlanDigest: SECRET_CONFIG_PLAN_DIGEST,
+        eligibleBindingCount: 1,
+        eligiblePreservationCount: 1,
+        targetConflictCount: 0,
+        unadaptedLegacyConfigCount: 0,
+      },
+      secretConfigDecision: {
+        decisionId: SECRET_CONFIG_DECISION_ID,
+        preparationDigest: SECRET_CONFIG_PREPARATION_DIGEST,
+      },
+    })}\n`,
+  );
+  const directory = path.join(state.root, 'secret-config', SECRET_CONFIG_ID);
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+  fs.writeFileSync(
+    path.join(directory, 'receipt.json'),
+    `${JSON.stringify({
+      schema: 'qinglong3-local-reconciliation-secret-config-plan-receipt',
+      schemaVersion: 1,
+      state: 'reconciliation_secret_config_planned',
+      secretConfigId: SECRET_CONFIG_ID,
+      secretConfigPlanDigest: SECRET_CONFIG_PLAN_DIGEST,
+      outcome: 'ready',
+      eligibleBindingCount: 1,
+      eligiblePreservationCount: 1,
+      targetConflictCount: 0,
+      unadaptedLegacyConfigCount: 0,
+    })}\n`,
+    { mode: 0o600 },
+  );
+  const candidates = [
+    ['review_apply_binding', '9'],
+    ['review_preserve_disabled', 'a'],
+  ].map(([requirement, digest], index) => ({
+    schemaVersion: 1,
+    kind: 'qinglong3-local-reconciliation-secret-config-plan-candidate',
+    candidateOrdinal: index + 1,
+    candidateDigest: digest.repeat(64),
+    requirement,
+    target: { state: 'absent' },
+  }));
+  fs.writeFileSync(
+    path.join(directory, 'plan.ndjson'),
+    `${candidates.map((candidate) => JSON.stringify(candidate)).join('\n')}\n`,
+    { mode: 0o600 },
+  );
+  return state;
+}
+
+test('builds reviewed Secret/Config candidate decisions', (t) => {
+  const state = secretConfigState(t);
+  const output = path.join(
+    path.dirname(state.root),
+    `${path.basename(state.root)}.secret-config.ndjson`,
+  );
+  t.after(() => fs.rmSync(output, { force: true }));
+  const report = secretConfigFixture(state.root, output);
+  assert.equal(report.decisionCount, 2);
+  const records = fs
+    .readFileSync(output, 'utf8')
+    .trimEnd()
+    .split('\n')
+    .map((line) => JSON.parse(line));
+  assert.equal(records[0].decisionId, SECRET_CONFIG_DECISION_ID);
+  assert.deepEqual(
+    records.slice(1).map(({ disposition, reason }) => ({
+      disposition,
+      reason,
+    })),
+    [
+      {
+        disposition: 'apply_active_binding',
+        reason: 'reviewed_active_binding',
+      },
+      {
+        disposition: 'preserve_disabled',
+        reason: 'reviewed_disabled_preservation',
+      },
+    ],
+  );
+});
+
 test('CLI grammar is exact', () => {
  assert.throws(
    () => parseArguments(['--mode=review', '--output=/tmp/review.ndjson']),