frame-cli 0.4.0

//! R6's structural tripwire on the production dev-watch paths: the
//! R-B-1 enumerated forbidden set, re-aimed at `src/dev/**`.
//!
//! The one resettable edit-quiet deadline is admitted ONLY by the named
//! debounce choke in `src/dev/session.rs` — pinned here as: exactly one
//! `recv_timeout` call site in that file, reachable only under an armed
//! deadline (`armed_until` present), and zero anywhere else in the dev
//! tree. The one event-driven existence check (R2's atomic-replace
//! versus true-disappearance answer) is pinned the same way: at most one
//! `.exists()` in session.rs, zero in the loop's other modules.
//! `build.rs` is excluded from the filesystem-token wall by design: its
//! directory walk is COMMANDED by a `StartBuild` directive, never by a
//! timer — the wall here is about time-driven discovery, and build.rs
//! contains no wait of any kind (asserted below).

#![allow(clippy::unwrap_used)]

use std::fs;
use std::path::PathBuf;

/// Non-vacuity floor: every production dev-watch source, by name.
const REQUIRED_PRODUCTION: &[&str] = &[
    "src/dev/mod.rs",
    "src/dev/watch.rs",
    "src/dev/debounce.rs",
    "src/dev/session.rs",
    "src/dev/build.rs",
];

const ATTACKS: &[(&str, &str)] = &[
    (
        "thread sleep",
        include_str!("fixtures/tripwire/thread_sleep.fixture"),
    ),
    (
        "condition timeout",
        include_str!("fixtures/tripwire/condition_timeout.fixture"),
    ),
    (
        "rearmed recv with fs reread",
        include_str!("fixtures/tripwire/rearmed_recv_fs_reread.fixture"),
    ),
    (
        "timer admission checking the filesystem",
        include_str!("fixtures/tripwire/timer_admission_fs_check.fixture"),
    ),
    (
        "Instant busy wait",
        include_str!("fixtures/tripwire/instant_busy_wait.fixture"),
    ),
];

fn dev_sources() -> Result<Vec<(String, String)>, Box<dyn std::error::Error>> {
    // Runtime var, not compile-time env!: shared-target-dir worktree
    // practice makes embedded paths stale.
    let root = PathBuf::from(std::env::var("CARGO_MANIFEST_DIR")?);
    let dev = root.join("src/dev");
    let mut sources = Vec::new();
    let mut entries = fs::read_dir(&dev)?.collect::<Result<Vec<_>, _>>()?;
    entries.sort_by_key(fs::DirEntry::path);
    for entry in entries {
        let path = entry.path();
        if path.extension().is_some_and(|extension| extension == "rs") {
            let relative = format!("src/dev/{}", path.file_name().unwrap().to_string_lossy());
            sources.push((relative, fs::read_to_string(&path)?));
        }
    }
    Ok(sources)
}

/// Strips the trailing `mod tests { … }` block: the wall guards
/// PRODUCTION paths; tests may orchestrate with bounded waits. Cutting
/// at `mod tests` (not at the first `#[cfg(test)]`, which also marks
/// the choke's counter field) keeps the whole production body walked.
fn production_half(source: &str) -> String {
    match source.find("mod tests") {
        Some(index) => source[..index].to_owned(),
        None => source.to_owned(),
    }
}

fn polling_violation(path: &str, source: &str) -> Option<String> {
    if source.contains("thread::sleep") {
        return Some("thread sleep".to_owned());
    }
    if source.contains("wait_timeout") || source.contains("park_timeout") {
        return Some("bounded condition/park timeout".to_owned());
    }
    let recv_timeouts = source.matches("recv_timeout").count();
    if path == "src/dev/session.rs" {
        if recv_timeouts != 1 {
            return Some(format!(
                "the choke admits exactly ONE recv_timeout call site, found {recv_timeouts}"
            ));
        }
        if !source.contains("armed_until") {
            return Some("the choke's armed-deadline guard is gone".to_owned());
        }
    } else if recv_timeouts != 0 {
        return Some("bounded recv outside the named choke".to_owned());
    }
    // Time-driven filesystem discovery: no directory walks, metadata, or
    // mtime reads anywhere in the loop's modules (build.rs is excluded —
    // see the module doc — but must contain no wait at all).
    if path != "src/dev/build.rs"
        && ["read_dir", "metadata(", ".modified("]
            .iter()
            .any(|token| source.contains(token))
    {
        return Some("filesystem inspection inside the watch loop".to_owned());
    }
    if path == "src/dev/build.rs"
        && ["recv(", "recv_timeout", "sleep", "wait("]
            .iter()
            .any(|token| source.contains(token))
    {
        return Some("a wait inside the commanded build pipeline".to_owned());
    }
    let exists_calls = source.matches(".exists()").count();
    if path == "src/dev/session.rs" {
        if exists_calls > 1 {
            return Some(format!(
                "one event-driven existence check is sanctioned, found {exists_calls}"
            ));
        }
    } else if path != "src/dev/build.rs" && exists_calls != 0 {
        return Some("existence probing outside the sanctioned check".to_owned());
    }
    if source.contains(".schedule(") {
        return Some("timer admission".to_owned());
    }
    if source.contains("Instant::now() >=") || source.contains("Instant::now() <") {
        return Some("Instant busy-wait comparison".to_owned());
    }
    None
}

#[test]
fn production_dev_paths_have_no_polling_shape() -> Result<(), Box<dyn std::error::Error>> {
    let sources = dev_sources()?;
    assert!(
        sources.len() >= REQUIRED_PRODUCTION.len(),
        "tripwire found fewer sources than the known floor"
    );
    for required in REQUIRED_PRODUCTION {
        assert!(
            sources.iter().any(|(path, _)| path == required),
            "tripwire did not read required production source {required}"
        );
    }
    for (path, source) in sources {
        let production = production_half(&source);
        assert_eq!(
            polling_violation(&path, &production),
            None,
            "polling shape in {path}"
        );
    }
    Ok(())
}

#[test]
fn every_enumerated_attack_fixture_trips_the_guard() {
    for (name, source) in ATTACKS {
        assert!(
            polling_violation("fixture", source).is_some(),
            "attack escaped: {name}"
        );
    }
}