Product installation tests

Real tests

tests/product/cache/install.mjs installs a real catalogued standalone Cargo CLI twice at one canonical revision into an isolated home under this checkout's .build/. It checks the installed receipts and executable, retains both build-step logs, and requires the second install to compile no crate. It then replaces a cached committed lockfile with a symlink and installs again: the file must be restored without changing the link target. A symlinked cache source root and an unknown revision must fail without changing the receipt or installed bytes. The journey refuses products with after-install actions or CLI dependencies, so it cannot restart services or install other products. Set STADO_BIN, STADO_PRODUCT_TEST_PRODUCT, STADO_PRODUCT_TEST_SOURCE, CARGO_HOME and RUSTUP_HOME; STADO_PRODUCT_TEST_COMMIT selects a commit instead of origin/main. On macOS supply a usable signing source as described in Native macOS signatures. Run node tests/product/cache/install.mjs. The report retains the Stado revision, source diff, binary and test digests, commands and exit statuses; isolated product state is removed after the run. Child commands receive only the declared tool PATH, Cargo and Rustup homes, the isolated home and temporary directory, local storage/configuration paths, and the evidence output directory. Caller route, credential and cache overrides are not inherited.

tests/product/lock/main.rs and version.rs exercise the public installation diagnostic against real committed exports and Cargo: an added path dependency and a same-name incompatible version are refused; each corrected lock produces an executable using the dependency; an unrelated compiler error stays distinct. Set CARGO_HOME and RUSTUP_HOME, then run cargo test --manifest-path stado-rs/product/Cargo.toml --test committed-lock-attribution. The isolated source, exports, command evidence and report remain under .build/product-lock. This journey does not install Tama or restart services. The release manifest runs committed-lock-attribution as a required test quality gate on both supported platforms. Registration is not a passing result. The cache-install journey additionally requires the declared real product, checkout and signing inputs above; it must not substitute a Tama installation.

tests/dependencies/independence.mjs runs stado product --workspace <dir> --catalog <file> dependencies <product> --json of the Stado under test against real git checkouts of an isolated workspace and checks each standing (undeclared, bound, unproven, source-missing, independent), its refusal sentence and exit status, an absent checkout, an unknown product, and that a comment line and a tests/ file are not read as dependencies. It needs STADO_BIN and writes report.json under .build/ with the source revision, the binary's digest, the commands and their exit statuses.

tests/product/remote/forwarded_source_install.mjs installs one product from an exact commit on another registry host through that host's own Stado. It first has the host refuse a commit that does not exist and checks that the host's record did not change. It then installs the commit and reads the record back: the installation must be present at that source revision. It needs STADO_PRODUCT_TEST_HOST, STADO_PRODUCT_TEST_PRODUCT and STADO_PRODUCT_TEST_SOURCE, and it writes report.json under .build/ with the source revision, the commands and their exit statuses. It replaces the product's service on that host, so point it only at a host where that is allowed.

tests/product/cargo_revision.mjs builds a real one-binary Cargo product with stado product cargo --manifest-path <checkout>/Cargo.toml --revision <commit> --json build in an isolated workspace under this checkout's .build/, while the checkout's working tree holds an uncommitted edit that does not compile. It checks that the build without --revision fails on that edit; that a commit the checkout does not hold is refused by name and leaves no export; that the build of the commit succeeds, its export sits in stado-build/<commit> of the checkout's build area with a .stado-exported.json naming the commit, nothing was exported into the checkout, and the binary it made prints what the commit holds; and that the edit is still in the working tree. It needs STADO_BIN and writes report.json under .build/ with the source revision, the binary's digest, the commands and their exit statuses.

tests/product/install_catalog_revision.mjs installs the stado CLI surface from one commit with the Stado under test, HOME set to an isolated directory under this checkout's .build/, and a --catalog copy of the committed catalog whose stado CLI recipe gained one after_install step naming a verb no Stado has. It checks that the install succeeds, that its report's catalog provenance names the installed commit chosen as installed-revision, that the steps it ran are the committed recipe's, and that the added verb never ran. It needs STADO_BIN and STADO_PRODUCT_TEST_SOURCE (STADO_PRODUCT_TEST_COMMIT selects the commit, default origin/main), builds Stado from source, and writes report.json under .build/ with the source revision, the binary's digest, the commands and their exit statuses.

tests/product/build_trees.mjs runs stado product --workspace <dir> build-trees list|remove --json against a workspace of two real git checkouts under this checkout's .build/: one whose origin is a catalog desktop repository, laid out like Stado's own, with a Swift package below its root and that package's .build, its own .build scratch area with no Package.swift beside it holding a Stado run area and scratch files, a tagged Cargo target, an old install run and install-failures record, sources, evidence, a false tag and a link to a tagged directory outside the workspace; one whose .build belongs to no desktop product and whose tagged target a real lockf process holds Cargo's .cargo-lock in. It checks the listed trees, their reasons and exact bytes; that remove takes every reclaimable tree, keeps the held one as in_use, the scratch area's own files and everything else in place; that the released target goes on the next remove; that a tree with a directory the account may not write fails the command with the refusal and stays; and the refusals for a missing workspace and a missing or unknown operation. It needs STADO_BIN and writes report.json under .build/ with the source revision, the binary's digest, the commands and their exit statuses.

tests/native/scratch_area.mjs builds and indexes a real Swift package with stado product --workspace <dir> swift --package-path <package> --json build|index, the real Swift toolchain and an isolated home and workspace under this checkout's .build/. It checks that the report's scratch_path is swift/build of the checkout's build area under that home, that the tree there carries CACHEDIR.TAG and SwiftPM's output, that the package holds no .build/wisent-native/build, and that the published editor settings list the package's own source as not generated. It needs STADO_BIN and writes report.json under .build/ with the source revision, the binary's digest, the commands and their exit statuses.

tests/install/resident/prerequisites.mjs runs a real source installation of an older provider on a dedicated host with an isolated home, reads its persisted receipt, inspects --plan, checks the consumer's refusal, then installs with --with-prerequisites and checks both final receipts against the CI last-green revision. Set STADO_BIN, STADO_TEST_SOURCE_COMMIT, STADO_TEST_DEDICATED_HOST and optionally STADO_CI_MAIN_RECORD to the real CI main record; the host must identify itself as the declared dedicated host. Run node tests/install/resident/prerequisites.mjs. Its .build/install-prerequisites/ report retains the source and binary digests, commands, exit statuses and both states. tests/install/resident/locks.mjs uses the same qualified provider path before testing released and held OS locks.

The prerequisite journey repeats the consumer installation without --with-prerequisites once the required provider is installed. It requires the plan to report reuse and checks that the real installation leaves the provider's persisted receipt and installed files unchanged, including file modes and modification times. The report retains the repeat command and provider file fingerprints. This covers release-verb prerequisites, not catalog dependency reuse or the standalone Cargo-cache journey; those remain separate checks.

The prerequisite journey requires PATH, CARGO_HOME and RUSTUP_HOME for its real toolchain. Installation children receive only those tool paths, the isolated home, temporary directory, local store and configuration path, the canonical workspace, selected CI record and retained command output directory. They do not inherit caller routing, credential or cache overrides. The host identity check alone reads the invoking dedicated host's environment.