pikasTech-unidesk/scripts/code-queue-execution-plane-contract-test.ts

import {
  expectedJudgeProbeBehaviorVersion,
  runCodeQueueExecutionPlaneForTest,
  type CodeQueueExecutionPlaneObservation,
} from "./src/code-queue-execution-plane";
import { readFileSync } from "node:fs";

type JsonRecord = Record<string, unknown>;

function assertCondition(condition: unknown, message: string, detail: JsonRecord = {}): void {
  if (!condition) throw new Error(`${message}: ${JSON.stringify(detail)}`);
}

const commit = "62c613eefc84292fe1874a837685b073ac6c7295";
const otherCommit = "0c3cdb4ee06a23361ed511a2da033d67b53d16f4";
const digest = `sha256:${"1".repeat(64)}`;
const otherDigest = `sha256:${"2".repeat(64)}`;

function deployment(name: string, role: "scheduler" | "read" | "write", schedulerEnabled: "true" | "false", overrides: Partial<CodeQueueExecutionPlaneObservation["deployments"][number]> = {}): CodeQueueExecutionPlaneObservation["deployments"][number] {
  return {
    name,
    namespace: "unidesk",
    observed: true,
    expectedRole: role,
    expectedSchedulerEnabled: schedulerEnabled,
    labels: {
      app: "code-queue",
      component: role === "scheduler" ? null : role,
      deploymentMode: "k3sctl-managed",
      instanceId: role === "scheduler" ? "D601" : `D601-${role}`,
    },
    annotations: {
      deployRef: "origin/master:deploy.json#environments.prod.services.code-queue",
      deployCommit: commit,
      deployRequestedCommit: commit,
      imageSource: "deploy-env-commit",
    },
    replicas: {
      desired: role === "read" ? 2 : 1,
      ready: role === "read" ? 2 : 1,
      available: role === "read" ? 2 : 1,
      updated: role === "read" ? 2 : 1,
    },
    nodeSelector: "D601",
    image: "unidesk-code-queue:d601",
    env: {
      serviceRole: role,
      schedulerEnabled,
      unideskDeployCommit: commit,
      unideskDeployRequestedCommit: commit,
      codeQueueDeployCommit: commit,
      codeQueueDeployRequestedCommit: commit,
    },
    repoHostPath: "/home/ubuntu/cq-deploy",
    error: null,
    ...overrides,
  };
}

function healthyObservation(overrides: Partial<CodeQueueExecutionPlaneObservation> = {}): CodeQueueExecutionPlaneObservation {
  const base: CodeQueueExecutionPlaneObservation = {
    checkedAt: "2026-05-24T00:00:00.000Z",
    namespace: "unidesk",
    kubeconfig: "/etc/rancher/k3s/k3s.yaml",
    worktreePath: "/home/ubuntu/cq-deploy",
    guard: {
      status: "pass",
      refusal: false,
      refusalSignals: [],
      kubeconfig: "/etc/rancher/k3s/k3s.yaml",
      expectedKubeconfig: "/etc/rancher/k3s/k3s.yaml",
      currentContext: "default",
      apiServer: "https://127.0.0.1:6443",
      nodeNames: ["d601"],
      nodeCount: 1,
      requiredNodeName: "d601",
      requiredNodePresent: true,
      commandsOk: true,
      summary: "D601 native k3s guard passed with explicit KUBECONFIG.",
    },
    deployments: [
      deployment("code-queue", "scheduler", "true"),
      deployment("code-queue-read", "read", "false"),
      deployment("code-queue-write", "write", "false"),
    ],
    pods: [
      { name: "code-queue-aaa", instanceId: "D601", component: null, nodeName: "d601", phase: "Running", ready: true, imageID: `registry/unidesk-code-queue@${digest}`, digest },
      { name: "code-queue-read-aaa", instanceId: "D601-read", component: "read", nodeName: "d601", phase: "Running", ready: true, imageID: `registry/unidesk-code-queue@${digest}`, digest },
      { name: "code-queue-write-aaa", instanceId: "D601-write", component: "write", nodeName: "d601", phase: "Running", ready: true, imageID: `registry/unidesk-code-queue@${digest}`, digest },
    ],
    services: [
      { name: "code-queue", observed: true, type: "ClusterIP", clusterIP: "10.43.0.1", ports: ["http:4222->http"], selector: { app: "code-queue", component: null, instanceId: "D601" }, error: null },
      { name: "code-queue-read", observed: true, type: "ClusterIP", clusterIP: "10.43.0.2", ports: ["http:4222->http"], selector: { app: "code-queue", component: "read", instanceId: null }, error: null },
      { name: "code-queue-write", observed: true, type: "ClusterIP", clusterIP: "10.43.0.3", ports: ["http:4222->http"], selector: { app: "code-queue", component: "write", instanceId: null }, error: null },
    ],
    worktree: {
      path: "/home/ubuntu/cq-deploy",
      ok: true,
      head: commit,
      error: null,
    },
    residual: {
      composeBackend: { ok: true, present: false, containers: [], error: null },
      loopbackPort4222: { ok: true, present: false, listeners: [], error: null },
    },
    judgeProbe: {
      ok: true,
      attempted: true,
      behaviorVersion: expectedJudgeProbeBehaviorVersion,
      expectedBehaviorVersion: expectedJudgeProbeBehaviorVersion,
      configured: true,
      model: "minimax-m2.7",
      hits: 8,
      total: 8,
      hitRate: 1,
      serviceProxyPath: "/api/v1/namespaces/unidesk/services/code-queue/proxy/api/judge/probe",
      error: null,
      raw: { ok: true, behaviorVersion: expectedJudgeProbeBehaviorVersion, results: [{ id: "bounded" }] },
    },
    commandDiagnostics: {},
  };
  return { ...base, ...overrides };
}

async function checkHealthyNoDrift(): Promise<void> {
  const result = await runCodeQueueExecutionPlaneForTest([], healthyObservation());
  assertCondition(result.ok === true, "healthy fixture should pass", result);
  assertCondition((result.summary as JsonRecord).deploymentDrift === false, "healthy fixture should not report deployment drift", result);
  assertCondition((result.summary as JsonRecord).deprecatedComposeResidual === false, "healthy fixture should not report residual compose", result);
}

async function checkDeploymentDrift(): Promise<void> {
  const obs = healthyObservation({
    deployments: [
      deployment("code-queue", "scheduler", "true", { env: { ...deployment("code-queue", "scheduler", "true").env, codeQueueDeployCommit: otherCommit } }),
      deployment("code-queue-read", "read", "false"),
      deployment("code-queue-write", "write", "false"),
    ],
    pods: [
      { name: "code-queue-aaa", instanceId: "D601", component: null, nodeName: "d601", phase: "Running", ready: true, imageID: `registry/unidesk-code-queue@${digest}`, digest },
      { name: "code-queue-read-aaa", instanceId: "D601-read", component: "read", nodeName: "d601", phase: "Running", ready: true, imageID: `registry/unidesk-code-queue@${otherDigest}`, digest: otherDigest },
    ],
    judgeProbe: {
      ...healthyObservation().judgeProbe,
      behaviorVersion: "legacy",
    },
  });
  const result = await runCodeQueueExecutionPlaneForTest([], obs);
  const drift = result.drift as JsonRecord;
  assertCondition(result.ok === false, "drift fixture should fail", result);
  assertCondition(drift.status === "deployment-drift", "drift status should be deployment-drift", result);
  assertCondition(JSON.stringify(drift).includes("deployment-drift"), "drift signal code should be visible", result);
}

async function checkDeprecatedComposeResidual(): Promise<void> {
  const result = await runCodeQueueExecutionPlaneForTest([], healthyObservation({
    residual: {
      composeBackend: { ok: true, present: true, containers: [{ name: "code-queue-backend", status: "Up 3 days", image: "unidesk-code-queue:old" }], error: null },
      loopbackPort4222: { ok: true, present: true, listeners: [{ localAddress: "127.0.0.1:4222", process: "users:((\"bun\",pid=1,fd=12))", line: "LISTEN 0 128 127.0.0.1:4222 0.0.0.0:* users:((\"bun\",pid=1,fd=12))" }], error: null },
    },
  }));
  const residual = result.residual as JsonRecord;
  assertCondition(result.ok === false, "residual fixture should fail", result);
  assertCondition(residual.status === "deprecated-compose-residual", "residual status should be explicit", result);
  assertCondition(JSON.stringify(result.blockers).includes("deprecated-compose-residual"), "residual blocker code should be visible", result);
}

async function checkProgressiveDisclosure(): Promise<void> {
  const compact = await runCodeQueueExecutionPlaneForTest([], healthyObservation());
  assertCondition(!("details" in compact), "default output should omit details", compact);
  assertCondition(!("rawObservation" in compact), "default output should omit raw observation", compact);
  const full = await runCodeQueueExecutionPlaneForTest(["--full"], healthyObservation());
  assertCondition("details" in full, "--full should include details", full);
  assertCondition(!("rawObservation" in full), "--full should still omit raw observation", full);
  const raw = await runCodeQueueExecutionPlaneForTest(["--raw"], healthyObservation());
  assertCondition("details" in raw && "rawObservation" in raw, "--raw should include details and raw observation", raw);
}

async function checkLiveCollectorUsesD601TranTransport(): Promise<void> {
  const source = readFileSync(new URL("./src/code-queue-execution-plane.ts", import.meta.url), "utf8");
  assertCondition(source.includes('["D601:k3s", "kubectl", ...args]'), "live collector should observe k3s through D601 tran route, not local kubectl");
  assertCondition(source.includes('`D601:${options.worktreePath}`'), "worktree observation should run on D601 workspace route");
  assertCondition(!source.includes('runCommand(["kubectl", ...args]'), "live collector must not call local kubectl directly");
  assertCondition(!source.includes('runCommand(["git", "-C", options.worktreePath'), "worktree observation must not read local filesystem");
}

async function main(): Promise<void> {
  const checks = [
    ["code-queue:execution-plane-healthy-no-drift", checkHealthyNoDrift],
    ["code-queue:execution-plane-deployment-drift", checkDeploymentDrift],
    ["code-queue:execution-plane-deprecated-compose-residual", checkDeprecatedComposeResidual],
    ["code-queue:execution-plane-progressive-disclosure", checkProgressiveDisclosure],
    ["code-queue:execution-plane-d601-tran-transport", checkLiveCollectorUsesD601TranTransport],
  ] as const;
  const results = [];
  for (const [name, check] of checks) {
    await check();
    results.push({ name, ok: true });
  }
  process.stdout.write(`${JSON.stringify({ ok: true, results }, null, 2)}\n`);
}

if (import.meta.main) {
  await main();
}