name: CI
on:
push:
branches: [main]
pull_request:
branches: [main]
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
env:
CARGO_TERM_COLOR: always
jobs:
peer-ref-ratchet:
name: peer reference ratchet
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
- uses: actions/checkout@v4
- name: peer_ref_ratchet
run: sh scripts/peer_ref_ratchet.sh
build-and-test:
name: build + test (macos-latest)
runs-on: macos-latest
timeout-minutes: 60
steps:
- name: Checkout
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 with:
persist-credentials: false
- name: Install Rust toolchain (1.88.0, as pinned in Cargo.toml)
uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 with:
toolchain: "1.88.0"
components: rustfmt, clippy
- name: Cache cargo registry + target
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 with:
path: |
~/.cargo/registry
~/.cargo/git
target
key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'tests/adr045_tuf_spike/Cargo.lock') }}
restore-keys: cargo-${{ runner.os }}-
- name: cargo fmt --check (informational)
continue-on-error: true
run: cargo fmt --all -- --check
- name: cargo clippy (informational)
continue-on-error: true
run: cargo clippy --locked --all-targets --all-features
- name: Require canonical mlx-native build environment
shell: bash
run: |
if [[ ${MLX_NATIVE_SKIP_METALLIB+x} ]]; then
echo "MLX_NATIVE_SKIP_METALLIB is forbidden for release-capable builds" >&2
exit 1
fi
- name: cargo check
run: cargo check --locked --all-targets --all-features
- name: cargo build --release
run: cargo build --release --locked
- name: cargo audit
run: |
cargo install cargo-audit --locked --version 0.22.2 --no-default-features
cargo audit
- name: ADR-045 signed-update verifier spike (blocking)
env:
CARGO_TARGET_DIR: target/adr045-tuf-spike
run: |
set -euo pipefail
spike=tests/adr045_tuf_spike/Cargo.toml
cargo +1.88.0 fmt --manifest-path "$spike" -- --check
cargo +1.88.0 check --locked --all-targets --manifest-path "$spike"
cargo +1.88.0 clippy --locked --all-targets --manifest-path "$spike" -- -D warnings
cargo +1.88.0 test --locked --lib --manifest-path "$spike" -- --test-threads=1
cargo audit --file tests/adr045_tuf_spike/Cargo.lock
package_list="$(cargo package --locked --list)"
if grep -q '^tests/adr045_tuf_spike/' <<<"$package_list"; then
echo 'ADR-045 spike leaked into the published hf2q crate' >&2
exit 1
fi
- name: ADR-045 production verifier boundary and corpus (blocking)
run: |
set -euo pipefail
direct_metadata="$(cargo +1.88.0 metadata --locked --all-features --format-version 1 --no-deps)"
jq -e '
.packages[]
| select(.name == "hf2q")
| .dependencies[]
| select(.name == "sigstore-tuf")
| .req == "=0.11.0"
and .uses_default_features == false
and .features == []
' <<<"$direct_metadata"
jq -e '
.packages[]
| select(.name == "hf2q")
| .dependencies[]
| select(.name == "toml")
| .req == "=1.1.4"
and .uses_default_features == false
and (.features | sort) == ["display", "parse", "serde"]
' <<<"$direct_metadata"
jq -e '
[.packages[]
| select(.name == "hf2q")
| .dependencies[]
| select(
.name == "percent-encoding"
or .name == "sha1"
or .name == "url"
)
| {name, req, uses_default_features, features}]
| sort_by(.name)
== [
{"name":"percent-encoding","req":"=2.3.2","uses_default_features":true,"features":[]},
{"name":"sha1","req":"=0.10.7","uses_default_features":true,"features":[]},
{"name":"url","req":"=2.5.8","uses_default_features":true,"features":[]}
]
' <<<"$direct_metadata"
jq -e '
.packages[]
| select(.name == "hf2q")
| .dependencies[]
| select(.name == "flate2")
| .req == "=1.1.9"
and .uses_default_features == false
and .features == ["zlib-rs"]
' <<<"$direct_metadata"
jq -e '
.packages[]
| select(.name == "hf2q")
| .dependencies[]
| select(.name == "zip")
| .req == "=7.2.0"
and .uses_default_features == false
and .features == ["deflate-flate2-zlib-rs"]
' <<<"$direct_metadata"
jq -e '
[.packages[]
| select(.name == "hf2q")
| .dependencies[]
| select(
.name == "core-foundation"
or .name == "security-framework"
or .name == "security-framework-sys"
)
| {
name,
req,
uses_default_features,
features,
target
}]
| sort_by(.name)
== [
{
"name":"core-foundation",
"req":"=0.10.1",
"uses_default_features":true,
"features":[],
"target":"cfg(target_os = \"macos\")"
},
{
"name":"security-framework",
"req":"=3.7.0",
"uses_default_features":false,
"features":["macos-12"],
"target":"cfg(target_os = \"macos\")"
},
{
"name":"security-framework-sys",
"req":"=2.17.0",
"uses_default_features":false,
"features":["macos-12"],
"target":"cfg(target_os = \"macos\")"
}
]
' <<<"$direct_metadata"
jq -e '
.packages[]
| select(.name == "hf2q")
| .dependencies[]
| select(.name == "sysctl")
| .req == "=0.6.0"
and .uses_default_features == false
and .features == []
and .target == "cfg(target_os = \"macos\")"
' <<<"$direct_metadata"
resolved_metadata="$(cargo +1.88.0 metadata --locked --all-features --format-version 1)"
jq -e '
(.packages[] | select(.name == "toml") | .id) as $id
| .resolve.nodes[]
| select(.id == $id)
| (.features | sort) == ["display", "parse", "serde"]
' <<<"$resolved_metadata"
jq -e '
(.packages[]
| select(.name == "sigstore-tuf" and .version == "0.11.0")
| .id) as $id
| .resolve.nodes[]
| select(.id == $id)
| .features == []
' <<<"$resolved_metadata"
jq -e '
["percent-encoding@2.3.2", "sha1@0.10.7", "url@2.5.8"] as $expected
| [.packages[]
| select(
(.name == "percent-encoding" and .version == "2.3.2")
or (.name == "sha1" and .version == "0.10.7")
or (.name == "url" and .version == "2.5.8")
)
| .id] as $ids
| [.resolve.nodes[]
| select(.id as $id | $ids | index($id))
| ((.id | split("#")[-1]) + ":" + ((.features | sort) | join(",")))]
| sort
== [
"percent-encoding@2.3.2:alloc,default,std",
"sha1@0.10.7:default,std",
"url@2.5.8:default,std"
]
' <<<"$resolved_metadata"
jq -e '
(.packages[]
| select(.name == "zip" and .version == "7.2.0")
| .id) as $id
| .resolve.nodes[]
| select(.id == $id)
| (.features | sort) == [
"_deflate-any",
"deflate-flate2",
"deflate-flate2-zlib-rs"
]
' <<<"$resolved_metadata"
jq -e '
(.packages[]
| select(.name == "flate2" and .version == "1.1.9")
| .id) as $id
| .resolve.nodes[]
| select(.id == $id)
| (.features | sort) == [
"any_impl",
"any_zlib",
"default",
"miniz_oxide",
"rust_backend",
"zlib-rs"
]
' <<<"$resolved_metadata"
jq -e '[.packages[] | select(.name == "tough")] | length == 0' \
<<<"$resolved_metadata"
unexpected_imports="$(
grep -RIl --include='*.rs' 'sigstore_tuf' src \
| grep -v '^src/distribution/update_auth/' || true
)"
test -z "$unexpected_imports"
unexpected_transport_authority="$(
grep -RInE --include='*.rs' \
'^[[:space:]]*use[[:space:]]+(reqwest|hyper|std::net|tokio::net|url::)|std::process::Command|clap::' \
src/distribution/update_auth || true
)"
test -z "$unexpected_transport_authority"
unexpected_metadata_session_callers="$(
grep -RIlE --include='*.rs' \
'begin_metadata_update|MetadataFetchResponse|MetadataSessionProgress|MetadataUpdateSession' \
src/distribution \
| grep -v '^src/distribution/update_auth/' \
| grep -v '^src/distribution/update_transport/' || true
)"
test -z "$unexpected_metadata_session_callers"
unexpected_preparation_authority="$(
grep -RInE --include='*.rs' --exclude='tests.rs' \
'rustix::fs|std::fs|File::(create|open|options)|OpenOptions::|std::net|std::process|reqwest|hyper|tokio::net|(^|[^:[:alnum:]_])url::|clap::|ZipWriter|\.extract(_unwrapped_root_dir)?\(' \
src/distribution/prepared_release || true
)"
unexpected_preparation_authority="$(
grep -vE '^[^:]+:[0-9]+:use std::fs::File;$' \
<<<"$unexpected_preparation_authority" || true
)"
test -z "$unexpected_preparation_authority"
unexpected_extraction_authority="$(
grep -InE \
'remove_named|remove_dir|remove_file|unlink|rename|fchmod|AuthenticatedPreparedVersion|version-installation|install-receipt|std::process::Command|reqwest|hyper|tokio::net|clap::' \
src/distribution/install_state/extraction.rs \
src/distribution/install_state/extraction/io.rs \
src/distribution/install_state/extraction/modes.rs \
src/distribution/prepared_release/extract.rs || true
)"
test -z "$unexpected_extraction_authority"
unexpected_identity_deletion="$(
grep -RInE --include='*.rs' \
'remove_named|remove_dir|remove_file|unlink|quarantine|trash' \
src/distribution/install_state/identity.rs \
src/distribution/install_state/identity || true
)"
test -z "$unexpected_identity_deletion"
test "$(grep -Fc 'open_private_regular_file_read_only(&update, LOCK_FILE)' src/distribution/install_state/identity.rs)" = 1
test "$(grep -Fc 'pub(super) fn open_private_regular_file_read_only' src/distribution/install_state/unix.rs)" = 1
unexpected_transport_extraction="$(
grep -RInE --include='*.rs' --exclude='tests.rs' \
'ReleaseExtractionStage|PostReplayExtraction|ExtractedRelease|extract_release|with_locked_extraction' \
src/distribution/update_transport || true
)"
test -z "$unexpected_transport_extraction"
unexpected_hf_external_authority="$(
grep -InE \
'std::process|Command::new|(^|[^[:alnum:]_])reqwest(::|[[:space:]])|(^|[^[:alnum:]_])hyper(::|[[:space:]])' \
src/input/hf_reference.rs \
src/input/hf_download.rs \
src/input/hf_download/resolution.rs \
src/input/integrity.rs \
src/convert/receipt.rs \
src/main.rs || true
)"
unexpected_hf_external_authority="$(
grep -vE '^src/main.rs:[0-9]+:use std::process::ExitCode;$' \
<<<"$unexpected_hf_external_authority" || true
)"
test -z "$unexpected_hf_external_authority"
unexpected_pretransfer_authority="$(
grep -nE \
'repo\.(get|download|download_with_progress)\(|download_file|std::fs|File::|OpenOptions|std::process|Command::new|reqwest|hyper|tokio::net|clap::|Serialize|Deserialize' \
src/input/hf_download/resolution.rs || true
)"
test -z "$unexpected_pretransfer_authority"
unexpected_payload_authority="$(
grep -nE \
'std::fs::(remove_dir|remove_file|rename|copy|write|set_permissions)|File::create|OpenOptions|verify_conversion_manifest\(|verify_source\(|convert::|quantize|std::process|Command::new|reqwest|hyper|tokio::net|clap::|Serialize|Deserialize' \
src/input/hf_download/resolution/payload.rs || true
)"
test -z "$unexpected_payload_authority"
unexpected_source_auth_authority="$(
grep -nE \
'build_hub_api|download_file|ApiBuilder|repo\.(get|download|download_with_progress)\(|std::fs::(create_dir|remove_dir|remove_file|rename|copy|write|set_permissions)|File::create|OpenOptions|convert::|quantize|std::process|Command::new|reqwest|hyper|tokio::net|clap::|Serialize|Deserialize' \
src/input/hf_download/resolution/payload/source.rs || true
)"
test -z "$unexpected_source_auth_authority"
unexpected_recipe_conversion_authority="$(
grep -nE \
'build_hub_api|download_file|ApiBuilder|repo\.(get|download|download_with_progress)\(|std::fs::(remove_dir|remove_file|rename|copy|write|set_permissions)|std::process|Command::new|reqwest|hyper|tokio::net|clap::|profile_path\(|preparation_receipt_path\(|SourceRetentionChoice|serve::|calibration::' \
src/input/hf_download/resolution/payload/source/conversion.rs || true
)"
test -z "$unexpected_recipe_conversion_authority"
unexpected_recipe_external_authority="$(
grep -RInE --include='*.rs' \
'hf_hub|resolve_model_reference|resolve_model_preparation_plan|authorize_model_preparation_transfer|std::process|Command::new|reqwest|hyper|tokio::net|clap::' \
src/input/model_recipe.rs src/input/model_recipe || true
)"
test -z "$unexpected_recipe_external_authority"
unexpected_recipe_plan_authority="$(
grep -nE \
'std::fs::(write|copy|create_dir|remove_dir|remove_file|rename|set_permissions)|File::create|OpenOptions|std::process|Command::new|reqwest|hyper|tokio::net|clap::|Serialize|Deserialize' \
src/input/model_recipe/plan.rs || true
)"
test -z "$unexpected_recipe_plan_authority"
unexpected_prepared_profile_authority="$(
grep -nE \
'std::fs|File::|OpenOptions|hf_hub|std::process|Command::new|reqwest|hyper|tokio::net|clap::|serve::|calibration::' \
src/input/model_recipe/profile.rs || true
)"
test -z "$unexpected_prepared_profile_authority"
unexpected_model_publication_authority="$(
grep -nE \
'std::fs::(create_dir|hard_link|remove_dir|remove_file|rename|copy|write|set_permissions)|File::create|OpenOptions|hf_hub|std::process::Command|Command::new|reqwest|hyper|tokio::net|clap::|serve::|calibration::' \
src/input/hf_download/resolution/payload/source/conversion/publication.rs \
src/input/hf_download/resolution/payload/source/conversion/publication/authentication.rs || true
)"
test -z "$unexpected_model_publication_authority"
unexpected_model_record_file_authority="$(
grep -nE \
'std::fs::(create_dir|remove_dir|remove_file|rename|copy|write|set_permissions|hard_link)|File::create|OpenOptions|hf_hub|std::process::Command|Command::new|reqwest|hyper|tokio::net|clap::|serve::|calibration::' \
src/input/hf_download/resolution/payload/source/conversion/publication/file.rs \
src/input/hf_download/resolution/payload/source/conversion/publication/file/unix.rs || true
)"
test -z "$unexpected_model_record_file_authority"
model_record_files=(
src/input/hf_download/resolution/payload/source/conversion/publication/file.rs
src/input/hf_download/resolution/payload/source/conversion/publication/file/unix.rs
)
test "$(grep -Fhc 'fs::linkat(' "${model_record_files[@]}" | awk '{ total += $1 } END { print total }')" = 1
test "$(grep -Fhc 'fs::unlinkat(' "${model_record_files[@]}" | awk '{ total += $1 } END { print total }')" = 1
test "$(grep -Fhc 'fs::fchmod(' "${model_record_files[@]}" | awk '{ total += $1 } END { print total }')" = 1
test "$(grep -Fhc 'OFlags::CREATE' "${model_record_files[@]}" | awk '{ total += $1 } END { print total }')" = 1
unexpected_setup_authority="$(
grep -nE \
'hf_hub|reqwest|hyper|tokio::net|std::net|std::process|Command::new|crate::(models|convert|quantize|serve)|calibration|bootstrap_installation_identity|update_auth|update_transport|remove_dir|remove_file' \
src/setup/mod.rs src/setup/schema.rs src/setup/host.rs src/setup/policy.rs \
| grep -vE '^src/setup/schema.rs:[0-9]+:[[:space:]]*crate::convert::QuantSelector::from_name\(&self\.quant\)$' || true
)"
test -z "$unexpected_setup_authority"
test "$(grep -Fhc 'QuantSelector::from_name' src/setup/schema.rs)" = 1
unexpected_setup_file_authority="$(
grep -nE \
'std::fs::(write|copy|create_dir|remove_dir|remove_file|rename|hard_link|set_permissions)|File::create|OpenOptions|hf_hub|reqwest|hyper|tokio::net|std::net|std::process|Command::new|crate::(models|convert|quantize|serve)|calibration|bootstrap_installation_identity|update_auth|update_transport' \
src/setup/fs.rs src/setup/fs/unix.rs || true
)"
test -z "$unexpected_setup_file_authority"
setup_file_modules=(src/setup/fs.rs src/setup/fs/unix.rs)
test "$(grep -Fhc 'fs::renameat(' "${setup_file_modules[@]}" | awk '{ total += $1 } END { print total }')" = 1
test "$(grep -Fhc 'fs::unlinkat(' "${setup_file_modules[@]}" | awk '{ total += $1 } END { print total }')" = 2
test "$(grep -Fhc 'fs::mkdirat(' "${setup_file_modules[@]}" | awk '{ total += $1 } END { print total }')" = 1
test "$(grep -Fhc 'OFlags::CREATE' "${setup_file_modules[@]}" | awk '{ total += $1 } END { print total }')" = 1
test "$(grep -Fhc 'fs::fchmod(' "${setup_file_modules[@]}" | awk '{ total += $1 } END { print total }')" = 1
test "$(grep -Fhc 'fs::chmodat(' "${setup_file_modules[@]}" | awk '{ total += $1 } END { print total }')" = 1
test "$(grep -Fhc 'OFlags::EXCL' "${setup_file_modules[@]}" | awk '{ total += $1 } END { print total }')" = 1
test "$(grep -Fhc 'OFlags::NOFOLLOW' "${setup_file_modules[@]}" | awk '{ total += $1 } END { print total }')" = 3
test "$(grep -Fhc 'OFlags::NONBLOCK' "${setup_file_modules[@]}" | awk '{ total += $1 } END { print total }')" = 1
test "$(grep -Fhc 'fs::flock(' "${setup_file_modules[@]}" | awk '{ total += $1 } END { print total }')" = 1
test "$(grep -Fhc 'fs::fsync(' "${setup_file_modules[@]}" | awk '{ total += $1 } END { print total }')" = 2
test "$(grep -Fhc 'fs::fcntl_fullfsync(' "${setup_file_modules[@]}" | awk '{ total += $1 } END { print total }')" = 1
setup_golden=src/setup/testdata/config_v2.toml
test "$(shasum -a 256 "$setup_golden" | awk '{print $1}')" = \
ff9f5d3ba200f2ccc107fc6142d9752c87a8429697a6a19f5c67702b82731c17
recipe=data/model-recipes/qwen38-27b-official-v1.json
test "$(shasum -a 256 "$recipe" | awk '{print $1}')" = \
8d62322eb7860b75fe4d26661354f9890d73e5b3f037a86ebcd60d6ea954fb3c
preparation_v1_golden=data/model-recipes/qwen38-27b-preparation-receipt-v1.json
test "$(shasum -a 256 "$preparation_v1_golden" | awk '{print $1}')" = \
1f6d98b7269c1754d22248136c2793081dd33ed002a13935bde680fa694dffef
preparation_golden=data/model-recipes/qwen38-27b-preparation-receipt-v2.json
test "$(shasum -a 256 "$preparation_golden" | awk '{print $1}')" = \
050900cc0bb998272504a5be94b3105092134a59d47ee1fcca28747464d8240a
prepared_profile_golden=data/model-recipes/qwen38-27b-prepared-profile-v1.json
test "$(shasum -a 256 "$prepared_profile_golden" | awk '{print $1}')" = \
a48bf14c469597f7567e9c11e689aeac9ccb39b1506afa57d79754f8f19c312b
fixture=src/distribution/update_auth/testdata/python-tuf-v1
(cd "$fixture" && shasum -a 256 -c SHA256SUMS)
expected_generator="$(jq -er .generator_sha256 "$fixture/PROVENANCE.json")"
actual_generator="$(shasum -a 256 "$fixture/generate.py" | awk '{print $1}')"
test "$actual_generator" = "$expected_generator"
package_list="$(cargo +1.88.0 package --locked --list)"
for required in \
src/distribution/schema/channel_pointer.rs \
src/distribution/schema/testdata/channel_pointer_v1.json \
src/distribution/schema/first_standalone_record.rs \
src/distribution/schema/install_receipt.rs \
src/distribution/schema/install_receipt_validation.rs \
src/distribution/schema/install_receipt_tests.rs \
src/distribution/schema/installation_identity.rs \
src/distribution/schema/installation_identity_tests.rs \
src/distribution/schema/testdata/installation_identity_v1.json \
src/distribution/schema/installed_version_marker.rs \
src/distribution/schema/release_manifest.rs \
src/distribution/schema/release_manifest_tests.rs \
src/distribution/schema/testdata/install_receipt_v1_initial_marker_v2.json \
src/distribution/schema/testdata/installed_version_marker_v1.json \
src/distribution/schema/testdata/installed_version_marker_v2.json \
src/distribution/schema/target_name.rs \
src/distribution/install_state/artifact.rs \
src/distribution/install_state/artifact/tests.rs \
src/distribution/install_state/extraction.rs \
src/distribution/install_state/extraction/io.rs \
src/distribution/install_state/extraction/modes.rs \
src/distribution/install_state/extraction/prepared.rs \
src/distribution/install_state/extraction/prepared/fault.rs \
src/distribution/install_state/extraction/prepared/support.rs \
src/distribution/install_state/extraction/prepared/types.rs \
src/distribution/install_state/extraction_tests.rs \
src/distribution/install_state/identity.rs \
src/distribution/install_state/identity/fault.rs \
src/distribution/install_state/identity/inventory.rs \
src/distribution/install_state/identity_tests.rs \
src/distribution/install_state/identity_tests/process_cases.rs \
src/distribution/install_state/release_floor.rs \
src/distribution/install_state/release_floor_tests.rs \
src/distribution/install_state/unix.rs \
src/distribution/prepared_release/mod.rs \
src/distribution/prepared_release/archive.rs \
src/distribution/prepared_release/codesign.rs \
src/distribution/prepared_release/codesign_tests.rs \
src/distribution/prepared_release/deflate.rs \
src/distribution/prepared_release/extract.rs \
src/distribution/prepared_release/publish.rs \
src/distribution/prepared_release/macho.rs \
src/distribution/prepared_release/macho/linkedit.rs \
src/distribution/prepared_release/macho/segment.rs \
src/distribution/prepared_release/macho_tests.rs \
src/distribution/prepared_release/macho_tests/fixture.rs \
src/distribution/prepared_release/macho_tests/hostile_cases.rs \
src/distribution/prepared_release/tests.rs \
src/distribution/update_auth/artifact_authorization.rs \
src/distribution/update_auth/artifact_authorization/extraction.rs \
src/distribution/update_auth/commit.rs \
src/distribution/update_auth/profile.rs \
src/distribution/update_auth/session.rs \
src/distribution/update_auth/target_set.rs \
src/distribution/update_auth/target_set_tests.rs \
src/distribution/update_auth/target_set_tests/extraction_cases.rs \
src/distribution/update_auth/target_set_tests/extraction_cases/prepared_publication_cases.rs \
src/distribution/update_auth/target_set_tests/extraction_cases/prepared_publication_cases/fault_cases.rs \
src/distribution/update_auth/target_set_tests/extraction_cases/prepared_publication_cases/hostile_cases.rs \
src/distribution/update_auth/test_repository.rs \
src/distribution/update_auth/test_repository/hostile_keys.rs \
src/distribution/update_auth/tests/hostile_profile.rs \
src/distribution/update_auth/tests/rotation.rs \
src/distribution/update_transport/mod.rs \
src/distribution/update_transport/fetch.rs \
src/distribution/update_transport/http.rs \
src/distribution/update_transport/metadata.rs \
src/distribution/update_transport/origin.rs \
src/distribution/update_transport/tests.rs \
src/distribution/update_transport/tests/metadata.rs \
src/distribution/update_auth/testdata/python-tuf-v1/1.root.json \
src/distribution/update_auth/testdata/python-tuf-v1/2.root.json \
src/distribution/update_auth/testdata/python-tuf-v1/timestamp.json \
src/distribution/update_auth/testdata/python-tuf-v1/2.snapshot.json \
src/distribution/update_auth/testdata/python-tuf-v1/2.targets.json \
src/distribution/update_auth/testdata/python-tuf-v1/PROVENANCE.json \
src/distribution/update_auth/testdata/python-tuf-v1/SHA256SUMS \
src/distribution/update_auth/testdata/python-tuf-v1/generate.py \
src/distribution/update_auth/testdata/python-tuf-v1/requirements.lock \
src/input/hf_reference.rs \
src/input/hf_reference_tests.rs \
src/input/hf_download.rs \
src/input/hf_download/resolution.rs \
src/input/hf_download/resolution/payload.rs \
src/input/hf_download/resolution/payload/tests.rs \
src/input/hf_download/resolution/payload/source.rs \
src/input/hf_download/resolution/payload/source/tests.rs \
src/input/hf_download/resolution/payload/source/conversion.rs \
src/input/hf_download/resolution/payload/source/conversion/tests.rs \
src/input/hf_download/resolution/payload/source/conversion/publication.rs \
src/input/hf_download/resolution/payload/source/conversion/publication/authentication.rs \
src/input/hf_download/resolution/payload/source/conversion/publication/file.rs \
src/input/hf_download/resolution/payload/source/conversion/publication/file/unix.rs \
src/input/hf_download/resolution/payload/source/conversion/publication/tests.rs \
src/input/hf_download/resolution/payload/source/conversion/publication/file/tests.rs \
src/input/hf_download_plan_tests.rs \
src/input/integrity.rs \
src/input/model_recipe.rs \
src/input/model_recipe/validation.rs \
src/input/model_recipe/verification.rs \
src/input/model_recipe/preparation.rs \
src/input/model_recipe/preparation/host.rs \
src/input/model_recipe/preparation/validation.rs \
src/input/model_recipe/plan.rs \
src/input/model_recipe/profile.rs \
src/input/model_recipe_tests.rs \
src/input/model_recipe_preparation_tests.rs \
src/input/model_recipe_plan_tests.rs \
src/input/model_recipe_profile_tests.rs \
data/model-recipes/qwen38-27b-official-v1.json \
data/model-recipes/qwen38-27b-preparation-receipt-v1.json \
data/model-recipes/qwen38-27b-preparation-receipt-v2.json \
data/model-recipes/qwen38-27b-prepared-profile-v1.json \
src/setup/mod.rs \
src/setup/schema.rs \
src/setup/host.rs \
src/setup/policy.rs \
src/setup/fs.rs \
src/setup/fs/unix.rs \
src/setup/tests.rs \
src/setup/defaults_contract_tests.rs \
src/setup/testdata/config_v2.toml \
src/distribution/mod.rs \
src/distribution/standalone.rs \
src/distribution/standalone/update.rs \
src/distribution/standalone_tests.rs \
src/distribution/install_state/identity.rs \
scripts/install.sh.in \
scripts/render_standalone_installer.sh \
scripts/render_standalone_release_record.sh \
scripts/sign_notarize_standalone_release.sh \
scripts/verify_standalone_candidate.sh \
scripts/test_standalone_installer.sh \
scripts/test_standalone_release_signing_contract.sh \
tests/completions.rs \
Cargo.toml \
Cargo.lock \
src/main.rs \
src/cli.rs \
src/serve/mod.rs \
src/core/integrity.rs \
src/core/provenance/source_shard.rs \
src/convert/cli_driver.rs \
src/convert/receipt.rs \
README.md \
CHANGELOG.md \
docs/adr/ADR-045-frictionless-distribution-updates-and-onboarding.md \
docs/adr/ADR-033-unified-quant-convert-pipeline.md \
docs/ARCHITECTURE.md \
docs/setup.md \
docs/converting-a-model.md \
docs/getting-started.md
do
grep -Fqx -- "$required" <<<"$package_list"
done
- name: cargo test (hosted-safe contracts)
run: |
set -euo pipefail
cargo test --locked --lib --all-features
cargo test --locked --test build_script_contract --all-features
cargo test --locked --test completions --all-features
cargo test --locked --test convert_integration --all-features
cargo test --locked --test lcp_registry_unit --all-features
cargo test --locked --bin hf2q --all-features convert::orchestrator::tests::
cargo test --locked --bin hf2q --all-features distribution::schema::
cargo test --locked --bin hf2q --all-features distribution::install_state:: -- --test-threads=1
cargo test --locked --bin hf2q --all-features distribution::update_auth:: -- --test-threads=1
cargo test --locked --bin hf2q --all-features distribution::update_transport:: -- --test-threads=1
cargo test --locked --bin hf2q --all-features distribution::prepared_release:: -- --test-threads=1
cargo test --locked --bin hf2q --all-features distribution::standalone:: -- --test-threads=1
scripts/test_standalone_installer.sh
scripts/test_standalone_release_signing_contract.sh
cargo test --locked --bin hf2q --all-features setup:: -- --test-threads=1
cargo test --locked --bin hf2q --all-features tests::convert_config_quant_is_used_and_explicit_quant_wins -- --exact
cargo test --locked --bin hf2q --all-features tests::invalid_operator_config_fails_before_convert_source_or_serve_bind -- --exact
cargo test --locked --bin hf2q --all-features serve::tests::serve_config_defaults_are_used_and_cli_env_override_them -- --exact
cargo test --locked --bin hf2q --all-features serve::tests::configured_lan_requires_runtime_auth -- --exact
cargo test --locked --bin hf2q --all-features serve::tests::c4_scheduler_cli_wins_over_env -- --exact
cargo test --locked --bin hf2q --all-features serve::tests::c4_max_slots_cli_wins_over_env -- --exact
hf_source_tests="$(cargo test --locked --bin hf2q --all-features -- --list)"
for required_test in \
cli::tests::getting_started_qwen38_commands_parse_exactly \
distribution::standalone::tests::standalone_lifecycle_installs_updates_rolls_back_and_preserves_operator_state \
distribution::standalone::tests::standalone_installer_bootstrap_surface_is_hidden_bounded_and_parseable \
distribution::standalone::update::tests::stable_release_record_is_small_canonical_and_exact \
distribution::standalone::update::tests::standalone_candidate_architecture_is_exactly_thin_arm64 \
setup::defaults_contract_tests::operator_config_v2_is_canonical_strict_and_uses_the_guide_defaults \
setup::defaults_contract_tests::operator_config_v2_rejects_incoherent_fifo_slots_and_invalid_quant \
setup::defaults_contract_tests::absent_operator_config_preserves_existing_command_behavior_without_claiming_root_authority \
setup::defaults_contract_tests::selected_state_root_loads_the_exact_operator_config \
setup::tests::cli_parses_the_closed_noninteractive_surface \
setup::tests::fresh_and_repeated_noninteractive_setup_are_idempotent \
setup::tests::interactive_setup_uses_current_values_and_records_explicit_operator_choices \
setup::tests::cancelled_or_interrupted_interactive_setup_creates_nothing \
setup::tests::noninteractive_setup_requires_complete_choices_or_accept_defaults \
setup::tests::named_performance_levels_accept_one_or_more_levels_and_reject_incoherent_facts \
tests::convert_config_quant_is_used_and_explicit_quant_wins \
tests::invalid_operator_config_fails_before_convert_source_or_serve_bind \
serve::tests::serve_config_defaults_are_used_and_cli_env_override_them \
serve::tests::configured_lan_requires_runtime_auth \
serve::tests::c4_scheduler_cli_wins_over_env \
serve::tests::c4_max_slots_cli_wins_over_env \
setup::tests::matching_existing_installation_identity_is_read_only_and_accepted \
setup::tests::lock_contention_is_busy_and_mints_no_config \
setup::tests::exact_read_rejects_leaf_replacement_after_reading_the_open_inode \
setup::tests::partial_leaf_replacement_before_rename_is_rejected_without_publication \
setup::tests::config_lock_and_partial_leaf_replacements_never_return_success \
setup::tests::stale_prompt_snapshot_and_partial_prefix_replacement_fail_closed \
setup::tests::installation_identity_appearance_or_replacement_during_setup_is_rejected \
setup::tests::sigabrt_at_every_publication_barrier_recovers_in_a_fresh_process \
input::hf_reference_tests::equivalent_model_references_share_one_canonical_identity \
input::hf_download_plan_tests::file_specific_resolution_fails_before_any_hub_lookup \
input::hf_download_plan_tests::repository_info_seals_a_mutable_request_to_the_returned_exact_commit \
input::hf_download_plan_tests::immutable_file_metadata_is_checked_before_transfer \
input::hf_download_plan_tests::metadata_transfer_caps_are_explicit_and_exact \
input::model_recipe_tests::embedded_recipe_is_exact_canonical_and_binds_accepted_outputs \
input::model_recipe_tests::semantic_cross_bindings_fail_closed \
input::model_recipe_preparation_tests::exact_pair_receipt_is_canonical_and_structurally_reparseable \
input::model_recipe_preparation_tests::volatile_available_space_does_not_change_the_durable_v2_receipt \
input::model_recipe_preparation_tests::prepublication_v1_receipt_is_retained_as_exact_unsupported_evidence \
input::model_recipe_preparation_tests::every_conversion_cross_binding_fails_closed \
input::model_recipe_preparation_tests::os_bound_disk_probe_uses_the_target_filesystem_and_rejects_file_ancestors \
input::model_recipe_preparation_tests::os_bound_host_preflight_rejects_a_file_as_the_preparation_root \
input::model_recipe_preparation_tests::current_recipe_host_preflight_passes_on_the_explicit_proof_machine \
input::model_recipe_plan_tests::canonical_no_options_layout_is_exact_and_inert \
input::model_recipe_plan_tests::exact_hub_resolution_consumes_the_plan_and_preserves_its_layout \
input::model_recipe_plan_tests::exact_recipe_metadata_mints_only_an_inert_transfer_authorization \
input::model_recipe_plan_tests::resolution_must_match_the_original_plan_revision_and_complete_recipe_inventory \
input::model_recipe_plan_tests::transfer_authorization_rejects_every_metadata_cross_binding \
input::model_recipe_plan_tests::current_plan_resolves_through_the_exact_production_hub_boundary \
input::model_recipe_plan_tests::current_plan_authorizes_all_recipe_metadata_before_payload_transfer \
input::model_recipe_plan_tests::current_no_options_plan_passes_on_the_explicit_proof_machine \
input::model_recipe_plan_tests::preparation_root_is_absolute_canonical_bounded_and_directory_backed \
input::model_recipe_profile_tests::prepared_profile_golden_is_exact_and_cross_binds_the_pair_receipt \
input::model_recipe_profile_tests::parser_rejects_size_duplicate_unknown_trailing_and_noncanonical_bytes \
input::hf_download::resolution::payload::tests::payload_transfer_consumes_the_exact_recipe_order_and_stays_inert \
input::hf_download::resolution::payload::tests::failed_or_cross_cache_transfer_mints_no_payload \
input::hf_download::resolution::payload::tests::namespace_change_is_rejected_before_hub_or_payload_authority \
input::hf_download::resolution::payload::tests::current_recipe_payload_transfers_and_verifies_when_explicitly_requested \
input::hf_download::resolution::payload::source::tests::reopened_source_consumes_the_exact_recipe_inventory_and_stays_inert \
input::hf_download::resolution::payload::source::tests::failed_or_cross_bound_reauthentication_mints_no_source_capability \
input::hf_download::resolution::payload::source::tests::changed_snapshot_namespace_fails_before_any_source_authentication \
input::hf_download::resolution::payload::source::tests::snapshot_replacement_during_authentication_mints_no_source_capability \
input::hf_download::resolution::payload::source::tests::current_recipe_cache_reauthenticates_when_explicitly_requested \
input::hf_download::resolution::payload::source::conversion::tests::coordinator_reauthenticates_around_both_roles_and_returns_only_inert_pair \
input::hf_download::resolution::payload::source::conversion::tests::source_drift_after_text_conversion_prevents_projector_and_pair_authority \
input::hf_download::resolution::payload::source::conversion::tests::projector_failure_prevents_final_reauthentication_and_pair_authority \
input::hf_download::resolution::payload::source::conversion::tests::final_artifact_drift_prevents_pair_authority_after_both_conversions \
input::hf_download::resolution::payload::source::conversion::tests::restart_shape_adopts_only_complete_pairs_and_rejects_orphan_receipts \
input::hf_download::resolution::payload::source::conversion::tests::dangling_symlink_is_retained_as_hostile_evidence_instead_of_absence \
input::hf_download::resolution::payload::source::conversion::tests::current_recipe_converts_and_reopens_the_exact_pair_when_explicitly_requested \
input::hf_download::resolution::payload::source::conversion::publication::tests::publication_reauthenticates_before_and_after_each_durable_record \
input::hf_download::resolution::payload::source::conversion::publication::tests::restart_order_accepts_only_write_order_prefixes_and_exact_hardlink_residue \
input::hf_download::resolution::payload::source::conversion::publication::file::tests::exact_prefix_and_published_hardlink_crash_states_are_resumed \
input::hf_download::resolution::payload::source::conversion::publication::file::tests::hostile_partial_final_and_symlink_evidence_is_retained \
input::hf_download::resolution::payload::source::conversion::publication::file::tests::every_publication_barrier_is_exactly_retryable \
input::hf_download::resolution::payload::source::conversion::publication::file::tests::concurrent_publishers_cannot_append_after_a_measured_partial_prefix \
input::hf_download::resolution::payload::source::conversion::publication::file::tests::exact_read_rejects_leaf_replacement_after_the_open_fd_was_read \
input::hf_download::resolution::payload::source::conversion::publication::file::tests::retained_parent_descriptor_prevents_namespace_redirection \
input::hf_download::resolution::payload::source::conversion::publication::file::tests::restrictive_umask_cannot_strand_an_unusable_partial \
input::model_recipe_plan_tests::completed_conversion_files_must_be_canonical_single_link_regular_files \
convert::cli_driver::tests::deepseek_tiny_official_layout_converts_to_q2_k_s_end_to_end \
convert::cli_driver::tests::explicit_receipt_path_cannot_alias_the_conversion_output \
models::vit::gguf_emit::tests::projector_can_reproduce_a_recipe_frozen_producer_banner \
input::integrity::tests::safetensors_index_entry_cap_is_exact \
convert::receipt::tests::prepared_success_receipt_binds_output_and_replaces_stale_atomically \
convert::receipt::tests::explicit_receipt_destination_cannot_replace_the_artifact \
tests::convert_source_classifier_reconciles_revision_and_rejects_ambiguity
do
grep -Fq -- "$required_test: test" <<<"$hf_source_tests"
done
cargo test --locked --bin hf2q --all-features input::hf_reference_tests::
cargo test --locked --bin hf2q --all-features input::hf_download_plan_tests::
cargo test --locked --bin hf2q --all-features input::model_recipe_tests::
cargo test --locked --bin hf2q --all-features input::model_recipe_preparation_tests::
cargo test --locked --bin hf2q --all-features input::model_recipe_plan_tests::
cargo test --locked --bin hf2q --all-features input::model_recipe_profile_tests::
cargo test --locked --bin hf2q --all-features input::hf_download::resolution::payload::tests:: -- --test-threads=1
cargo test --locked --bin hf2q --all-features input::hf_download::resolution::payload::source::tests:: -- --test-threads=1
cargo test --locked --bin hf2q --all-features input::hf_download::resolution::payload::source::conversion::tests:: -- --test-threads=1
cargo test --locked --bin hf2q --all-features input::hf_download::resolution::payload::source::conversion::publication:: -- --test-threads=1
cargo test --locked --bin hf2q --all-features input::integrity::tests:: -- --test-threads=1
cargo test --locked --bin hf2q --all-features convert::cli_driver::tests::deepseek_tiny_official_layout_converts_to_q2_k_s_end_to_end -- --exact
cargo test --locked --bin hf2q --all-features convert::cli_driver::tests::explicit_receipt_path_cannot_alias_the_conversion_output -- --exact
cargo test --locked --bin hf2q --all-features convert::receipt::tests::
cargo test --locked --bin hf2q --all-features models::vit::gguf_emit::tests::projector_can_reproduce_a_recipe_frozen_producer_banner -- --exact
cargo test --locked --bin hf2q --all-features tests::convert_source_classifier
distribution_tests="$(cargo test --locked --bin hf2q --all-features -- --list)"
for required_test in \
distribution::install_state::identity::tests::process_cases::process_abort_at_every_identity_barrier_is_exactly_recoverable \
distribution::install_state::identity::tests::process_cases::shared_identity_lock_excludes_a_fresh_process_bootstrap \
distribution::install_state::extraction::tests::process_abort_mid_file_leaves_only_resumable_inert_state \
distribution::install_state::extraction::tests::every_normalization_barrier_is_exactly_restartable_after_sigabrt \
distribution::install_state::extraction::tests::every_normalization_barrier_is_exactly_retryable_after_returned_error \
distribution::update_auth::target_set::tests::extraction_cases::stored_and_deflated_bundles_cross_the_complete_extraction_boundary \
distribution::update_auth::target_set::tests::extraction_cases::signed_mode_normalization_is_sealed_and_keeps_the_tree_inert \
distribution::update_auth::target_set::tests::extraction_cases::failed_native_brackets_return_no_capability_and_exact_retry_recovers \
distribution::update_auth::target_set::tests::extraction_cases::post_extraction_archive_revalidation_failure_returns_no_capability_and_is_retryable
do
grep -Fq -- "$required_test: test" <<<"$distribution_tests"
done
cargo test --locked --bin hf2q --all-features qwen38 -- --test-threads=1
cargo test --locked --bin hf2q --all-features qwen_thinking_budget -- --test-threads=1
cargo test --locked --bin hf2q --all-features gqa_q2_policy::tests -- --test-threads=1
cargo test --locked --bin hf2q --all-features iter230_a2_lock_discipline -- --test-threads=1
cargo test --locked --bin hf2q --all-features loaded_registration_overrides -- --test-threads=1
cargo test --locked --bin hf2q --all-features serve::operator_ui::tests:: -- --test-threads=1
cargo test --locked --bin hf2q --all-features qwen35_serving_tokenizer_is_sidecar_free_and_detects_vision_markers -- --test-threads=1
cargo test --locked --bin hf2q --all-features vision_projector_binding -- --test-threads=1
cargo test --locked --bin hf2q --all-features model_advertisement_contract_ -- --test-threads=1
cargo test --locked --bin hf2q --all-features qwen35_startup_warmup_primes_gpu_for_serial_and_slot_aware -- --test-threads=1
cargo test --locked --bin hf2q --all-features qwen35_bounded_prefill_watchdog_tests -- --test-threads=1
cargo test --locked --bin hf2q --all-features prompt_cache_ -- --test-threads=1
cargo test --locked --bin hf2q --all-features agentic_grammar_contract_ -- --test-threads=1
cargo test --locked --bin hf2q --all-features gemma4_bounded_prefill_tests -- --test-threads=1
cargo test --locked --bin hf2q --all-features slotaware_fail_stop_tests -- --test-threads=1
cargo test --locked --bin hf2q --all-features engine_supervisor::tests -- --test-threads=1
cargo test --locked --bin hf2q --all-features public_watchdog_fixture_bytes_are_stable_without_a_model -- --test-threads=1
cargo test --locked --bin hf2q --all-features public_watchdog_fixture_consumers_share_the_canonical_digests -- --test-threads=1
cargo test --locked --bin hf2q --all-features readiness_guard_tests -- --test-threads=1
bash -n scripts/qwen36_watchdog_validate.sh \
scripts/serve_qwen38_opencode.sh \
scripts/test_qwen36_prefill_watchdog.sh \
scripts/test_qwen36_prefill_cancellation.sh \
scripts/test_qwen36_cumulative_release.sh \
scripts/test_deepseek4_agentic.sh \
scripts/test_deepseek4_structured_tools.sh \
scripts/test_deepseek4_agentic_fixture_contract.sh \
scripts/test_deepseek4_cooperative_prefill_receipt_contract.sh \
scripts/test_deepseek4_decode_cohort_receipt_contract.sh \
scripts/test_deepseek4_peer_cold_wave.sh \
scripts/test_deepseek4_peer_cold_wave_contract.sh \
scripts/run_deepseek4_matched_peer.sh \
scripts/macos_thermal_guard.sh \
scripts/verify_macos_thermal_receipt.sh \
scripts/verify_deepseek4_cooperative_prefill_receipt.sh \
scripts/verify_deepseek4_decode_cohort_receipt.sh \
scripts/run_deepseek4_decode_cohort_gate.sh \
scripts/verify_gemma4_wave_thermal_receipt.sh \
scripts/verify_gemma4_parity_receipt.sh \
scripts/qwen38_long_decode_ab.sh \
scripts/verify_qwen38_long_decode_receipt.sh \
scripts/test_qwen38_long_decode_receipt_contract.sh \
scripts/test_macos_thermal_guard_contract.sh \
scripts/test_gemma4_wave_thermal_contract.sh \
scripts/test_gemma4_eight_slot_receipt_contract.sh \
scripts/seal_release_binary.sh \
scripts/test_release_binary_seal_contract.sh \
scripts/sign_notarize_standalone_release.sh \
scripts/verify_standalone_candidate.sh \
scripts/test_standalone_release_signing_contract.sh \
scripts/verify_release_dependency_provenance.sh \
scripts/test_release_dependency_provenance_contract.sh \
scripts/run_release_gate_process_group.sh \
scripts/test_release_gate_process_group_contract.sh \
scripts/ensure_github_release_tag.sh \
scripts/test_release_tag_recovery_contract.sh \
scripts/test_deepseek4_cached_suffix.sh \
scripts/test_deepseek4_cached_suffix_contract.sh \
scripts/test_deepseek4_interactive_overlap.sh \
scripts/test_agentic_cache_lifecycle.sh \
scripts/test_gemma4_long_short_overlap.sh \
scripts/test_gemma4_long_short_overlap_contract.sh \
scripts/run_agentic_cache_release_gate.sh
bash scripts/test_qwen36_watchdog_harness_contract.sh
bash scripts/test_deepseek4_cached_suffix_contract.sh
bash scripts/test_deepseek4_agentic_fixture_contract.sh
bash scripts/test_deepseek4_cooperative_prefill_receipt_contract.sh
bash scripts/test_deepseek4_decode_cohort_receipt_contract.sh
bash scripts/test_deepseek4_peer_cold_wave_contract.sh
bash scripts/test_macos_thermal_guard_contract.sh
bash scripts/test_gemma4_wave_thermal_contract.sh
bash scripts/test_gemma4_eight_slot_receipt_contract.sh
bash scripts/test_qwen38_long_decode_receipt_contract.sh
bash scripts/test_release_binary_seal_contract.sh
bash scripts/test_standalone_release_signing_contract.sh
bash scripts/test_release_dependency_provenance_contract.sh
bash scripts/test_release_gate_process_group_contract.sh
bash scripts/test_release_tag_recovery_contract.sh
bash scripts/test_gemma4_long_short_overlap_contract.sh
cargo test --locked --bin hf2q --all-features deepseek4 -- \
--skip attention_forward_tests \
--skip allocator_materializes_the_plan_as_zeroed_bf16_buffers \
--skip cache_steps_publish_only_complete_groups_and_commit_transactionally \
--skip partial_token_poison_requires_reset_before_replay \
--skip start_zero_prefill_span_counts_complete_groups_and_publishes_once \
--skip ffn_forward_tests \
--skip raw_matmul_accepts_quality_sensitive_f32_weights \
--skip embedding_forward_rejects_empty_input \
--skip q2_k_embeddings_expand_to_four_identical_hc_streams \
--skip native_model_load_keeps_weights_and_cache_on_one_device \
--skip native_output_head_produces_finite_vocab_logits_and_rejects_shape_drift \
--skip loader_preserves_raw_blocks_and_expands_only_elementwise_state \
--skip loader_rejects_catalog_and_i32_storage_before_residency
- name: activate() matrix smoke (clean / REFUSED / UNSAFE)
shell: bash
run: |
set -euo pipefail
echo "--- clean env should produce no investigation output ---"
./target/release/hf2q --help > /dev/null 2>/tmp/stderr_clean.log
if [[ -s /tmp/stderr_clean.log ]]; then
echo "FAIL: clean-env run produced stderr:" >&2
cat /tmp/stderr_clean.log >&2
exit 1
fi
echo " OK"
echo "--- HF2Q_F16_KV=1 without ack must REFUSE ---"
HF2Q_F16_KV=1 ./target/release/hf2q --help \
> /dev/null 2>/tmp/stderr_refused.log
grep -q "REFUSED" /tmp/stderr_refused.log
grep -q "HF2Q_F16_KV=1" /tmp/stderr_refused.log
echo " OK"
echo "--- HF2Q_F16_KV=1 + HF2Q_UNSAFE_EXPERIMENTS=1 must ACTIVATE ---"
HF2Q_F16_KV=1 HF2Q_UNSAFE_EXPERIMENTS=1 \
./target/release/hf2q --help \
> /dev/null 2>/tmp/stderr_unsafe.log
grep -q "UNSAFE (ack-required, activated)" /tmp/stderr_unsafe.log
if grep -q "REFUSED" /tmp/stderr_unsafe.log; then
echo "FAIL: explicitly acknowledged unsafe activation was refused" >&2
exit 1
fi
echo " OK"