Replace the custom encrypted container with AgeSwift 0.1.0 so standard
age tools can inspect sensitive configuration independently of the app.
Use independent Keychain X25519 identities for catalog.age and
proxy-listening.age. Preserve atomic commits and confirmed recovery;
reject historical NG2 formats without migration or cleanup.
Six sites re-asserted the predicate waitUntilRuntimeSettles already checks,
with no suspension point in between, so they could never fail; their intent
messages are folded into comments where one was not already stated.
Two commit-failure cases asserted the fake's bookkeeping (updateCalls stays
empty) which the fake guarantees by throwing before recording; the outcome
and committed-snapshot assertions already prove the real behavior.
Also drop a no-op loop that mutated a discarded struct copy, a duplicated
isWellFormed line, two WorkspaceRoute cases subsumed by the constructor and
the publish-count case, a duplicated presentation-message assertion, and the
round-trip halves of two payload-shape cases already covered case-by-case.
Co-Authored-By: DeepSeek Harness <noreply@deepseek.com>
Each removed assertion holds by construction and can never fail:
- jsonData() compared with itself cannot detect cross-run byte stability;
bindAddress and mode are literal-returning computed properties
- RuleAction/RuleSourceKind allCases assertions pin synthesized enum order
(neither allCases list is used in production); the persisted action tokens
stay pinned by the kept rawValue assertions and source-kind tokens by
fixture decoding through RuleSnapshotStore
- memberwise-constructor echo in RuleSourceIdentity, fixture-guaranteed
name == id rows, a share draft field pair built from one string, and a
local struct compared to its own assignment
- the synthesized-Codable round trip through literal JSONEncoder/JSONDecoder
The duplicate-import assertion becomes a real check: Set of node ids instead
of a count that restated roots.count, which is what its comment claims.
Co-Authored-By: DeepSeek Harness <noreply@deepseek.com>
Every case here restates a rule another test already pins with the same or a
wider input class:
- the activation group case is byte-identical to its neighbour, minus an extra
assertion; the rule snapshot version guard is re-driven with a second value
of the same schemaVersion check; the global-mode deployment-failure case is
a mode-literal copy of the strictly stronger direct-mode one; the clear-
failure case duplicates the deferred-retry sibling
- two RuntimeDocument projection cases only re-map locals, already asserted as
full array equality; the IPv6-LAN endpoint case repeats the direct-mode case
(the derivation reads only ports)
- the three HTTP export cases varied only listenerMode while the derivation
ignores it and one name contradicted its own expectation; one loop over all
listener modes now states the real rule
- the 0700/0600 permission baseline is one AtomicFileWriter behavior and stays
pinned through RuntimeFileStoreTests, which also covers self-heal and atomic
replace
The command-boundary case keeps its mixed-scenario isolation check (four
commands, four independent adapter counters) and drops only its unfalsifiable
queriedTargetIDs claim.
Co-Authored-By: DeepSeek Harness <noreply@deepseek.com>
Three tests claimed coverage they could not deliver:
- subscription URL credential cleanup asserted a lookup derived from the
already-empty subscription list, so it held even on a leak; production has
no separate URL credential store (SubscriptionRecord.url is a plain field)
- the runtime log event sweep planted no secret values, so its secret half
could never fail; keep the live JSON-dump check and rename the test to match
- clipboard and QR saver tests exercised only in-memory doubles that live in
production source and have no other caller; delete the six tests and the
three doubles (AppKit adapters stay untested, as before)
Co-Authored-By: DeepSeek Harness <noreply@deepseek.com>
The root system-proxy helper logged nothing and launchd discards its
stdout/stderr, leaving helper launches, connection refusals, GUI-side
timeouts and root-side failures invisible. Share the minimal unified-log
emission unit (SystemLog) across GUI, wrapper and helper, and add a
dedicated closed helper event enum (lifecycle minimum: listener ready,
connection accepted/rejected with peer pid, typed apply/clear results)
with ADR-0045 privacy splitting. The emission seam is injected at the
helper engine and listener for test doubles. Helper events are
Console-only: no stderr, no agent.log, no diagnostic view or report
surface (ADR-0047).
Collapse the four definitions of "one log line" into LogLine (timestamp,
level, source, text) with a single renderer and parser. agent.log lines
now carry the uniform prefix, absorbing the ssxng: event marker into the
source column; legacy lines degrade to raw display without rewriting.
Level detection moves into the row model with a classic three-level
taxonomy whose unified-log projection stays unchanged.
The diagnostics log view merges GUI events and the agent.log tail through
DiagnosticLogIntake into one time-ordered list with level and source
filters; the tail window logic moves into the intake and blank lines are
kept for raw fidelity. The report whitelist projection and unified-log
routing are unchanged.
Add the SSXNG_SYSTEM_LOG=0 test seam: RuntimeLog.emit and the sslocal
unified-log destination skip their os.Logger writes when it is set,
while stderr lines and the event sink are unaffected. Test execution
no longer floods the unified log store (a full validate run previously
recorded 795 entries under the shared subsystem, 743 from xctest and
52 from test-spawned agents).
The switch is injected by the schemes' test actions only (Run/Profile
keep system logging so debugging from Xcode still shows it), and set
explicitly in the fixtures that spawn the agent/sslocal processes,
including the fixture that strips inherited SSXNG_* path seams. The
main scheme is now declared explicitly to keep the variable out of the
Launch/Profile actions. Document the seam in ADR-0045.
Collect line framing, password redaction and oversized-line discard in
one SslocalOutputIntake and dispatch redacted lines through a
destination seam: stderr (freopen'd into agent.log, raw capture kept
for ADR-0006 local viewing) and the unified log under category "sslocal",
reusing the shared subsystem.
Upstream free text is never routed through RuntimeLogEvent and is
marked private in the unified log as a whole (ADR-0014 warns default
upstream logs may contain server addresses). Levels derive from
whitespace-separated upstream level tokens: ERROR maps to .error,
WARN/WARNING maps to .default (unified logging has no warning level),
and anything else maps to .info so the unified-log surface persists
only detected problems while agent.log stays the persistent surface.
The intake lives in Domain/Runtime so the hostless test mirror compiles
it; unit tests drive raw chunks against fake destinations instead of
parsing agent.log text. The 1 MiB agent.log retention policy deliberately
stays on the file side shared with wrapper event lines.
Emit every RuntimeLogEvent to os.Logger under a shared subsystem with
per-event category and level, so GUI and wrapper output can be filtered
in Console.app. Public text is split from private detail (free-form error
text and connectivity measurement content) on the closed enum, keeping
server addresses out of the public log surface. The stderr line and the
event sink stay unchanged. Add the system log glossary term.
Separate Agent supervision from sslocal input and preserve the latest intent after deployment failure. Persist failure barriers, serialize publication and retirement, and verify reload and single-instance behavior with real processes.
Refs #83
Drop workflow port and credential prechecks that duplicated the store
gate. Credential shape is a save constraint only while LAN
authentication is enabled; terminal commands treat password() as a
usable secret without reshaping it.
Qiu Yuzhou
