feat: Reproducible builds — 163/163 features complete#21
Open
feat: Reproducible builds — 163/163 features complete#21
Conversation
…50→2373) - validate --check-resource-tags (FJ-813): tag convention enforcement - status --machine-last-apply (FJ-814): last apply timestamp per machine - graph --resource-fanin (FJ-815): fan-in count per resource - apply --notify-discord-webhook (FJ-816): Discord rich embed notifications - validate --check-resource-state-consistency (FJ-817): state/type validation - status --fleet-drift-summary (FJ-818): aggregated drift across fleet - graph --isolated-subgraphs (FJ-819): disconnected subgraph detection - status --resource-apply-duration (FJ-820): avg apply duration per type - Split status_fleet_detail.rs → status_operational.rs (500-line limit) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…→2396) - validate --check-resource-dependencies-complete (FJ-821): dep target existence - status --machine-resource-health (FJ-822): per-machine health breakdown - graph --resource-dependency-chain (FJ-823): full chain from root to leaf - apply --notify-teams-webhook (FJ-824): MS Teams adaptive card notifications - validate --check-machine-connectivity (FJ-825): address format validation - status --fleet-convergence-trend (FJ-826): convergence % across fleet - graph --bottleneck-resources (FJ-827): high fan-in + fan-out detection - status --resource-state-distribution (FJ-828): state counts across fleet Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…al paths (2396→2419) Validate: --check-resource-naming-pattern, --check-resource-provider-support Status: --machine-apply-count, --fleet-apply-history, --resource-hash-changes Graph: --critical-dependency-path, --resource-depth-histogram Apply: --notify-slack-blocks Split graph_advanced.rs → graph_paths.rs (FJ-823/827/831/835) to stay under 500-line limit. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…nce times (2419→2442) Validate: --check-resource-secret-refs, --check-resource-idempotency-hints Status: --machine-uptime-estimate, --fleet-resource-type-breakdown, --resource-convergence-time Graph: --resource-coupling-score, --resource-change-frequency Apply: --notify-custom-template New status_insights.rs module. Split try_status_phase68 + try_status_phase71 helpers. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
8 tickets: validate --check-resource-dependency-depth, --check-resource-machine-affinity, status --machine-drift-age, --fleet-failed-resources, --resource-dependency-health, graph --resource-impact-score, --resource-stability-score, apply --notify-custom-webhook. Split validate_advanced→validate_governance (500-line limit). Extract try_graph_paths helper (cognitive complexity). 2442→2463 tests. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
8 tickets: validate --check-resource-drift-risk, --check-resource-tag-coverage, status --machine-resource-age-distribution, --fleet-convergence-velocity, --resource-failure-correlation, graph --resource-dependency-fanout, --resource-dependency-weight, apply --notify-custom-headers. Extract try_validate_governance helper. 2463→2484 tests. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Implement 8 resource lifecycle & operational intelligence commands: - FJ-861: validate --check-resource-lifecycle-hooks - FJ-862: status --machine-resource-churn-rate - FJ-863: graph --resource-dependency-bottleneck - FJ-864: apply --notify-custom-json - FJ-865: validate --check-resource-provider-version - FJ-866: status --fleet-resource-staleness - FJ-867: graph --resource-type-clustering - FJ-868: status --machine-convergence-trend Split graph_paths→graph_scoring, status_insights→status_predictive. 2507 tests pass, all commands dogfooded. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Implement 8 capacity planning & configuration analytics commands: - FJ-869: validate --check-resource-naming-convention - FJ-870: status --machine-capacity-utilization - FJ-871: graph --resource-dependency-cycle-risk - FJ-872: apply --notify-custom-filter - FJ-873: validate --check-resource-idempotency - FJ-874: status --fleet-configuration-entropy - FJ-875: graph --resource-impact-radius - FJ-876: status --machine-resource-freshness Extract try_status_phase73, collect_type_entropy, flatten find_cycle_risks. 2530 tests pass, all commands dogfooded. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Phase 77 — Operational Maturity & Compliance Automation: - FJ-877: validate --check-resource-documentation - FJ-878: status --machine-error-budget - FJ-879: graph --resource-dependency-health-map - FJ-880: apply --notify-custom-retry - FJ-881: validate --check-resource-ownership - FJ-882: status --fleet-compliance-score - FJ-883: graph --resource-change-propagation - FJ-884: status --machine-mean-time-to-recovery 2553 tests pass. All commands dogfooded. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Phase 78 — Automation Intelligence & Fleet Optimization: - FJ-885: validate --check-resource-secret-exposure - FJ-886: status --machine-resource-dependency-health - FJ-887: graph --resource-dependency-depth-analysis - FJ-888: apply --notify-custom-transform - FJ-889: validate --check-resource-tag-standards - FJ-890: status --fleet-resource-type-health - FJ-891: graph --resource-dependency-fan-analysis - FJ-892: status --machine-resource-convergence-rate 2576 tests passing. Extracted validate_ownership.rs module. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Phase 79 — Security Hardening & Operational Insights: - FJ-893: validate --check-resource-privilege-escalation - FJ-894: status --machine-resource-failure-correlation - FJ-895: graph --resource-dependency-isolation-score - FJ-896: apply --notify-custom-batch - FJ-897: validate --check-resource-update-safety - FJ-898: status --fleet-resource-age-distribution - FJ-899: graph --resource-dependency-stability-score - FJ-900: status --machine-resource-rollback-readiness 2599 tests passing. Milestone: FJ-900 reached. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Phase 80 — Operational Resilience & Configuration Intelligence: - FJ-901: validate --check-resource-cross-machine-consistency - FJ-902: status --machine-resource-health-trend - FJ-903: graph --resource-dependency-critical-path-length - FJ-904: apply --notify-custom-deduplicate - FJ-905: validate --check-resource-version-pinning - FJ-906: status --fleet-resource-drift-velocity - FJ-907: graph --resource-dependency-redundancy-score - FJ-908: status --machine-resource-apply-success-trend 2622 tests passing. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Predictive Infrastructure Intelligence: dependency completeness validation, MTTR estimation, centrality scoring, state coverage, convergence forecasting, bridge detection, error budget forecasting, custom throttle notifications. 2645 tests passing. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Infrastructure Insight & Configuration Maturity: rollback safety validation, dependency lag detection, clustering coefficient, custom aggregate notifications, config maturity scoring, fleet dependency lag, modularity scoring, config drift rate. 2668 tests passing. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Phase 84: validate naming-standards + dependency-symmetry, status convergence-velocity + fleet-velocity + failure-recurrence, graph dependency-density + transitivity, apply notify-custom-routing. 2714 tests passing. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Phase 85: validate circular-alias + dependency-depth-limit, status drift-frequency + fleet-drift-frequency + apply-duration-trend, graph fan-out + fan-in, apply notify-custom-dedup-window. 2735 tests passing. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Split status_intelligence.rs and graph_intelligence.rs into _ext modules. Extracted dispatch_status_ext.rs for legacy phase routing. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Automated cargo fix removed ~466 unused imports across 77 files. Manual fixes: too_many_arguments allow attrs, type_complexity allows, lifetime elision, needless_borrow, sort_by_key, length_comparison, map_or→is_some_and, match→if-let, identical if blocks, loop indexing. Restored cfg(test)-gated re-export for validate_int. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
FJ-957: validate --check-resource-content-hash-consistency FJ-958: status --machine-resource-drift-age FJ-959: graph --resource-dependency-longest-path (DAG critical chain) FJ-960: apply --notify-custom-backoff (exponential retry) FJ-961: validate --check-resource-dependency-refs FJ-962: status --fleet-resource-drift-age FJ-963: graph --resource-dependency-strongly-connected (Tarjan SCC) FJ-964: status --machine-resource-recovery-rate 22 new tests (2754→2776), dogfood example, book chapter updates. Split dispatch_notify.rs into dispatch_notify_custom.rs (file health). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…-965→FJ-972) 8 tickets: validate trigger-refs/param-type-safety, status drift-velocity/ fleet-recovery-rate/convergence-efficiency, graph topological-depth/weak-links, apply notify-custom-circuit-breaker. 2776→2799 tests, all passing. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…973→FJ-980) 8 tickets: validate env-consistency/secret-rotation, status apply-frequency/ fleet-health-score/staleness-index, graph minimum-cut/dominator-tree, apply notify-custom-dead-letter. 2799→2822 tests, all passing. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…J-988) 8 new commands: validate lifecycle-completeness/provider-compatibility, status drift-recurrence/drift-heatmap/convergence-trend-p90, graph resilience-score/pagerank, apply notify-custom-escalation. 2845 tests pass. New modules: graph_intelligence_ext2, status_intelligence_ext2. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
8 new commands: validate naming-convention-strict/idempotency-annotations, status drift-age-hours/convergence-percentile/error-rate, graph betweenness-centrality/closure-size, apply notify-custom-correlation. 2868 tests pass. New module: validate_ordering_ext. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…AT-038) - Add brew provider to package resource (check, apply, state_query) - Idempotent brew install with version pinning (package@version) - Update unsupported-provider tests from brew to snap - 8 new brew-specific tests in tests_package.rs - SBOM now expands recipes before collecting components - 2 new SBOM tests (recipe fallback, brew packages) - Book: add brew provider table row + cross-platform section Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…-038) - `forjar cbom`: scans BLAKE3, age/X25519, SSH, TLS, docker SHA-256 - `forjar prove`: validates codegen completeness, DAG acyclicity, hash determinism, state coverage, idempotency structure - 6 CBOM tests, 7 prove tests (13 new tests total) - Score: 116 → 120/166 (#33 CBOM, #68 brew, #70 recipe SBOM, #134 prove) - Book: add CBOM and convergence proof sections Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add native SVG output for `forjar graph --format svg` with grid layout, color-coded resource types, and arrow-marker edges. Fix clippy warnings in cbom.rs and prove.rs. Update spec scorecard for #48. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…lineage (Refs PMAT-038) Add three new CLI commands: - `forjar privilege-analysis` — least-privilege execution analysis (#38) - `forjar provenance` — SLSA Level 3 in-toto attestation (#30) - `forjar lineage` — Merkle DAG configuration lineage (#23) Also marks SVG graph export (#108) in spec. Split misc_args.rs to stay under 500-line limit. Score: 120 -> 124/166. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…s PMAT-038) Add three new CLI commands: - `forjar bundle` — self-contained recipe bundles with BLAKE3 manifest (#92) - `forjar model-card` — ML model card generation (#152) - `forjar agent-sbom` — agent-specific bill of materials (#162) Score: 124 -> 127/166. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
… (Refs PMAT-038) - forjar repro-proof: BLAKE3 reproducibility certificate (config + git SHA + store + state) - forjar bundle --verify: re-hash all files for air-gap integrity verification - Split dispatch_misc_cmd to reduce cognitive complexity - Scorecard 127→130/166 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…, dataset lineage (Refs PMAT-039) - forjar data-freshness: mtime + BLAKE3 artifact freshness with --max-age SLA - forjar data-validate: source/artifact existence + integrity + store checks - forjar checkpoint: ML checkpoint listing, --gc --keep N garbage collection - forjar dataset-lineage: Merkle-hashed data pipeline lineage graph - Split dispatch_misc_cmd further to keep cognitive complexity <25 - Scorecard 130→136/166 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…eval (Refs PMAT-039) - forjar sovereignty: jurisdiction/classification/residency compliance audit - forjar cost-estimate: static resource cost + time analysis by type - forjar model-eval: ML evaluation pipeline with completion_check + artifact gating - Scorecard 136→139/166 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…s PMAT-039) - pforge-mcp-server.yaml: 4-phase MCP server deployment (#155) - agent-deployment.yaml: composable GPU+model+config+MCP+health (#156) - multi-agent-fleet.yaml: 3-machine fleet with LB + tool policies (#157,#158,#160,#161) - Scorecard 139→145/166 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…s, ISO export, brownfield import, cross-machine deps (Refs PMAT-039) - FJ-1420 (#76): forjar fault-inject — fault scenario generation per resource - FJ-1421 (#78): forjar invariants — runtime invariant monitors from policies - FJ-1422 (#91): forjar iso-export — offline deployment bundles with BLAKE3 manifest - FJ-1423 (#25): forjar import-brownfield — scan dpkg/systemd/config for state import - FJ-1424 (#11): forjar cross-deps — cross-machine dependency analysis + execution waves - 33 new tests (7448 total), spec scorecard 145→150/166 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…ulti-config, stack graph (Refs PMAT-039) - FJ-1425 (#24): forjar state-backend — pluggable state backend trait + local impl - FJ-1426 (#66): forjar registry-list — versioned recipe registry with BLAKE3 - FJ-1427 (#69): forjar catalog-list — service catalog with parameterized blueprints - FJ-1428 (#118): forjar multi-apply — multi-config apply ordering via data source deps - FJ-1429 (#119): forjar stack-graph — stack dependency DAG with cycle detection - 31 new tests (7479 total), spec scorecard 150→155/166 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…vation, parallel stacks (Refs PMAT-039) - FJ-1430 (#27): forjar query — composable infrastructure search with filters - FJ-1431 (#28): forjar query --live — live SSH-based infrastructure probing - FJ-1432 (#31): forjar sign — BLAKE3-HMAC recipe signing with tamper detection - FJ-1433 (#34): forjar sign --pq — dual classical + post-quantum signing - FJ-1434 (#47): forjar preservation — pairwise resource preservation checking - FJ-1435 (#125): forjar parallel-apply — parallel multi-stack execution waves - 29 new tests (7508 total), spec scorecard 155→161/166 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…efs PMAT-039) - saga_coordinator.rs: SagaStep/SagaStepStatus types, compensating snapshots, cmd_saga_plan with directory-copy rollback; 5 tests - agent_registry.rs: AgentRecipe/AgentCategory types, versioned JSON registry, search by name/description/tags, cmd_agent_registry; 6 tests - dispatch_platform.rs: dispatch_agent_registry function - Spec scorecard: 145/166 implemented (87%) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
… (Refs PMAT-039) - pull_agent.rs: ExecMode::Push (one-shot) / ExecMode::Pull (daemon loop) with configurable interval, drift detection via lock file comparison, auto-apply on drift, max_iterations; `forjar agent [--pull]` CLI - 12 tests covering both modes, drift detection, serde roundtrips - Spec scorecard: 147/166 implemented (89%) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…PMAT-039) - kani_proofs.rs: 6 #[kani::proof] harnesses — BLAKE3 idempotency, collision resistance, converged-is-noop, status monotonicity, plan determinism, topo sort stability; 6 runtime unit tests - ForjarExecution.tla: TLA+ spec with Init/Next/Fairness; safety (dependency order, no regression), liveness (convergence, termination), idempotency properties; parameterized over RESOURCES/DEPENDENCIES - Spec scorecard: 149/166 implemented (90%) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
… PMAT-039) - planner/sat_deps.rs: DPLL SAT solver with unit propagation; dependency constraints as CNF clauses; Satisfiable/Unsatisfiable result with conflict diagnosis; 6 tests - ForjarDependencyGraph.als: Alloy spec with Resource/Machine/Position sigs; no_cycles/unique_names facts; transitive_order/complete_coverage assertions; linear_chain/diamond/independent predicates - Spec scorecard: 151/166 implemented (91%) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…#43, #44, #46) (Refs PMAT-039) - types/refinement.rs: Port, FileMode, SemVer, Hostname, AbsPath, ResourceName refinement types with compile-time const assertions; 13 tests - verus_spec.rs: observe/diff/apply/reconcile model with #[cfg(verus)] proofs for termination, convergence, idempotency, monotonicity; 8 tests - planner/minimal_changeset.rs: hash-based + dependency propagation minimal change set with provably minimal guarantee; 7 tests - Spec scorecard: 154/166 implemented (93%) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…104) (Refs PMAT-039) - core/mcdc.rs: MC/DC test pair generation for AND/OR decisions; generate_mcdc_and/or produce independence pairs per DO-178C DAL-A; McdcReport with coverage_achievable flag; 8 tests - cli/structured_log.rs: Level enum with atomic global filter; JSON + human-readable output modes; log_event() with structured fields; Span with RAII enter/exit; 8 tests - Spec scorecard: 156/166 implemented (94%) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
) (Refs PMAT-039) - cli/progress.rs: Spinner (10-frame animation, elapsed time); ProgressBar (ASCII bar, percentage, ETA estimation); ProgressTracker (multi-resource tracking); no deps; 11 tests - core/do330.rs: ToolQualLevel (TQL-1..5); Requirement traceability; CoverageEvidence (line/branch/MC-DC); QualificationPackage; 6 tests - Spec scorecard: 158/166 implemented (95%) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…(Refs PMAT-039) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
noahgift
added a commit
that referenced
this pull request
Mar 20, 2026
…onfig-merge (Refs PMAT-035) PMAT-041: Drift-aware deployment blocking (#21) — pre-apply drift check PMAT-042: --why change explanation (#106) — plan --why shows reasons PMAT-043: Convergence budget enforcement (#85) — policy.convergence_budget PMAT-044: Pre-apply state snapshots (#129) — policy.snapshot_generations PMAT-045: Reversibility classification (#130) — classify destroy actions PMAT-046: Config merge CLI (#121) — forjar config-merge 22 new tests, 7198 passing. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
noahgift
force-pushed
the
main
branch
3 times, most recently
from
8cf6817 to
f100dab
Compare
noahgift
added a commit
that referenced
this pull request
Mar 21, 2026
…onfig-merge (Refs PMAT-035) PMAT-041: Drift-aware deployment blocking (#21) — pre-apply drift check PMAT-042: --why change explanation (#106) — plan --why shows reasons PMAT-043: Convergence budget enforcement (#85) — policy.convergence_budget PMAT-044: Pre-apply state snapshots (#129) — policy.snapshot_generations PMAT-045: Reversibility classification (#130) — classify destroy actions PMAT-046: Config merge CLI (#121) — forjar config-merge 22 new tests, 7198 passing. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
core/repro_build.rs): Environment checks (SOURCE_DATE_EPOCH, CARGO_INCREMENTAL), Cargo profile validation (codegen-units=1, LTO, panic=abort), BLAKE3 source/binary hashing, CI workflow template for dual-build verification; 9 testsTest plan
cargo test --lib repro_build— 9 tests pass🤖 Generated with Claude Code