Add complete fake adapter 2×2 contract matrix

README.md

@@ -47,6 +47,20 @@ The stable `scripts/core-contract.sh` wrapper and inactive resolver select this
 generation together. This is a repo-only compatibility switch. It does not install
 the resolver, select a live profile, or qualify a real forge.
 
+## Inactive fake adapter contract matrix
+
+`adapter-tests/v1/` runs a fixed 2×2 producer/forge matrix against one unrelated
+local Git fixture. Its accepted inventory and four distinct fake entrypoints are
+digest-pinned. The runner revalidates each resolved profile with portable core v2,
+validates every producer and forge stage request/result, then checks payload links,
+package, target, candidate, receipt, and Git identities itself.
+
+The result is observation only. It grants no authority, qualification, approval,
+publish, merge, or branch-write capability. The fakes run with a cleared environment,
+fixed limits, and disposable directories, but this test does not provide or claim
+mechanical network or host-filesystem isolation. Real-adapter sandbox qualification
+and an external-target smoke remain required.
+
 ## The current default team
 
 You talk **only** to yshifu, in a Claude Code session. yshifu orchestrates the other roles

RESTORE.md

@@ -308,6 +308,17 @@ materialization in a caller-disposable repository. The package is not qualified
 It grants no credential, network, publish, push, merge, or remote branch-write
 capability. The switch does not install the resolver or select a live profile.
 
+Restore every path in the manifest's inactive fake adapter matrix block, then run:
+
+```sh
+bash scripts/test/portable-adapter-contracts.test.sh
+```
+
+The proof resolves four fake-only profiles, validates both core stage records in
+each cell, and checks the accepted 2×2 matrix plus closed negative protocol cases.
+It uses no real adapter or credential and makes no network/host isolation,
+qualification, activation, or external-target-smoke claim.
+
 ---
 
 ## 5. Smoke test — prove the rebuilt team is alive

adapter-tests/v1/contract.jq

@@ -0,0 +1,177 @@
+import "portable-core-stage-request-fixtures" as request;
+import "portable-core-result-truth-fixtures" as result;
+
+def exact($keys): type == "object" and (keys | sort) == ($keys | sort);
+def sha256: type == "string" and test("\\A[0-9a-f]{64}\\z");
+def v2: walk(if type == "object" and has("schema_version") then .schema_version = 2 else . end);
+def payload_ok:
+  exact(["data","media_type","payload_id","sha256"]) and
+  (.data | type == "string") and (.media_type | type == "string") and
+  (.payload_id | type == "string") and (.sha256 | sha256);
+def positive_assertions:
+  ["audit-projection","candidate-git","core-validation","environment-clean",
+   "evidence-projection","gate-projection","outcome-projection",
+   "risk-projection","target-git"];
+def expected_cases($fixture):
+  ["aa","ab","ba","bb"] | map(. as $cell | {
+    case_id:("matrix-"+$cell),phase:"pipeline",
+    producer_package_id:("fake.producer."+($cell[0:1])),
+    forge_package_id:("fake.forge."+($cell[1:2])),expected_verdict:"pass",
+    expected_error:"",equivalence_group:"portable-fake-v1",
+    assertions:positive_assertions,fixture_sha256:$fixture
+  }) + [
+    {case_id:"reject-degraded",expected_error:"E_DEGRADED"},
+    {case_id:"reject-empty",expected_error:"E_EMPTY"},
+    {case_id:"reject-malformed",expected_error:"E_MALFORMED"},
+    {case_id:"reject-partial",expected_error:"E_PARTIAL"},
+    {case_id:"reject-relabelled",expected_error:"E_RELABELLED"},
+    {case_id:"reject-timeout",expected_error:"E_TIMEOUT"},
+    {case_id:"reject-transport",expected_error:"E_TRANSPORT"},
+    {case_id:"reject-multiple",expected_error:"E_MULTIPLE"},
+    {case_id:"reject-unlinked",expected_error:"E_UNLINKED_PAYLOAD"},
+    {case_id:"reject-duplicate",expected_error:"E_DUPLICATE_PAYLOAD"},
+    {case_id:"reject-descendant",expected_error:"E_DESCENDANT"}
+  ] | map(if has("phase") then . else . + {
+    phase:"producer",producer_package_id:"fake.protocol-fault",forge_package_id:"none",
+    expected_verdict:"reject",equivalence_group:"protocol-negative",
+    assertions:["expected-error"],fixture_sha256:$fixture
+  } end);
+def inventory_ok:
+  (.inventory | exact(["authorization_ref","cases","protocol","schema_version"])) and
+  .inventory.schema_version == 1 and
+  .inventory.protocol == "ystack.adapter-contract.inventory.v1" and
+  .inventory.authorization_ref ==
+    {comment_id:5476938197,issue_number:153,scope_comment_id:5474023028} and
+  .inventory.cases == expected_cases(.fixture_sha256);
+
+def revision($c):
+  {repository_id:"fixture.target",hash_algorithm:"sha1",commit_id:$c.target_commit};
+def source_ref($c):
+  {revision:revision($c),location:{kind:"path",value:"source.txt"},object_type:"blob",
+   object_id:$c.target_object,mode:"100644"};
+def tree_ref($c):
+  {revision:revision($c),location:{kind:"root"},object_type:"tree",
+   object_id:$c.target_tree,mode:"040000"};
+def target_request($c):
+  .body.target_repository_id="fixture.target" |
+  .body.target_revision={state:"present",value:revision($c)} |
+  .body.base={state:"present",value:revision($c)} |
+  .body.source={state:"present",value:{type:"git-object",value:source_ref($c)}};
+def producer_request($c):
+  request::request_doc("producer";$c.resolved_sha) | v2 |
+  .id=("request."+$c.case_id+".producer") |
+  .body.stage_id=("stage."+$c.case_id+".producer") |
+  .body.resolved_profile_ref.id=$c.resolved_id |
+  .body.selection_ref=$c.resolved_profile.body.selection_ref |
+  .body.repository_context_ref=$c.resolved_profile.body.repository_context_ref |
+  target_request($c) |
+  (.body.inputs[] | select(.input_id=="input.output") | .input_id)="input.allowed-delta" |
+  .body.inputs |= sort_by(.input_id) |
+  .body.operation.arguments={artifact_kind:"git-patch",
+    allowed_delta:request::delivered("allowed-delta";"allowed-delta";request::sha("3"))} |
+  .body.operation.arguments.allowed_delta.ref.subject_ref as $allowed |
+  (.body.inputs[] | select(.input_id=="input.allowed-delta") | .value)=$allowed;
+def forge_request($c):
+  request::request_doc("producer";$c.resolved_sha) | v2 |
+  .id=("request."+$c.case_id+".forge") |
+  .body.stage_id=("stage."+$c.case_id+".forge") |
+  .body.resolved_profile_ref.id=$c.resolved_id |
+  .body.selection_ref=$c.resolved_profile.body.selection_ref |
+  .body.repository_context_ref=$c.resolved_profile.body.repository_context_ref |
+  target_request($c) |
+  .body.inputs=([
+    request::named_content_input("finish";request::sha("1")),
+    request::named_content_input("materialize";request::sha("3")),
+    request::named_content_input("producer-patch";$c.patch_sha),
+    {input_id:"input.source-tree",value:{type:"artifact",value:{type:"git-object",value:tree_ref($c)}}},
+    request::named_content_input("verify";request::sha("2"))
+  ] | sort_by(.input_id)) |
+  .body.operation={role:"forge",binding_id:"binding.forge",
+    capability_id:"core.forge.materialize-candidate.v2",
+    permissions:["core.perm.candidate-repository.write.v2","core.perm.evidence.write.v1",
+      "core.perm.scratch.write.v1","core.perm.target.read.v1"],
+    arguments:{source_tree_input_id:"input.source-tree",candidate_output_id:"candidate.repository",
+      materialization_contract:request::delivered("output-contract";"materialize";request::sha("3")),
+      network_mode:"deny"}} |
+  .body.required_evidence_kinds=["deterministic"];
+def stage_result($c; $output_id; $media_type; $payload_sha):
+  result::completed_result_doc($c.stage_request;$c.request_sha;
+    $c.resolved_profile;$c.resolved_sha) | v2 |
+  .id=("result."+$c.case_id+"."+$c.phase) |
+  .body.outcome={family:"change",value:"changed"} |
+  .body.outputs=[{output_id:$output_id,
+    ref:{content_id:("output."+$c.case_id+"."+$c.phase),media_type:$media_type,sha256:$payload_sha}}] |
+  if $c.phase == "producer" then .body.delta_ref=.body.outputs[0].ref else . end;
+def request_envelope_ok:
+  . as $request |
+  exact(["case_id","payloads","phase","protocol_version","stage_request"]) and
+  .protocol_version == 1 and (.phase == "producer" or .phase == "forge") and
+  .stage_request.schema_version == 2 and .stage_request.kind == "stage_request" and
+  (.payloads | type == "array" and all(.[];payload_ok) and
+    ([.[].payload_id] | length == (unique | length))) and
+  ([.payloads[].payload_id] | sort) ==
+    (if .phase == "producer" then ["resolved-profile","source"]
+     else ["producer.patch","resolved-profile","source"] end) and
+  ([.payloads[] | select(.payload_id=="resolved-profile" and
+      .media_type=="application/json" and
+      .sha256==$request.stage_request.body.resolved_profile_ref.sha256)] | length) == 1 and
+  ([.payloads[] | select(.payload_id=="source" and .media_type=="text/plain")] | length) == 1 and
+  (if .phase == "forge" then
+     ([.stage_request.body.inputs[] |
+       select(.input_id=="input.producer-patch") |
+       .value.value.value.sha256] | length) == 1 and
+     ([.payloads[] as $payload |
+       select($payload.payload_id=="producer.patch" and $payload.media_type=="text/x-diff" and
+         ([$request.stage_request.body.inputs[] |
+           select(.input_id=="input.producer-patch" and
+                  .value.value.value.sha256==$payload.sha256)] | length == 1))] | length) == 1
+   else true end);
+def response_envelope_ok:
+  (.response | exact(["case_id","payloads","phase","protocol_version","stage_result"])) and
+  .response.protocol_version == 1 and .response.case_id == .case_id and
+  .response.phase == .phase and .response.stage_result.schema_version == 2 and
+  .response.stage_result.kind == "stage_result" and
+  (.response.payloads | type == "array" and all(.[];payload_ok)) and
+  ([.response.payloads[].payload_id] | length == (unique | length)) and
+  ([.response.payloads[].payload_id] | sort) ==
+    ([.response.stage_result.body.outputs[].output_id] | sort) and
+  .response as $response |
+  all($response.payloads[];
+    . as $payload |
+    [$response.stage_result.body.outputs[] |
+     select(.output_id==$payload.payload_id and .ref.media_type==$payload.media_type and
+            .ref.sha256==$payload.sha256)] | length == 1);
+def response_error:
+  if (.response | type) != "object" then "E_PARTIAL"
+  elif .response.status? == "degraded" then "E_DEGRADED"
+  elif (.response | exact(["case_id","payloads","phase","protocol_version","stage_result"]) | not)
+  then "E_PARTIAL"
+  elif .response.case_id != .case_id or .response.phase != .phase then "E_RELABELLED"
+  elif (.response.payloads | type) != "array" then "E_PARTIAL"
+  elif ([.response.payloads[].payload_id] as $ids |
+        ($ids | length) != ($ids | unique | length))
+  then "E_DUPLICATE_PAYLOAD"
+  elif ([.response.payloads[].payload_id] | sort) !=
+       ([.response.stage_result.body.outputs[]?.output_id] | sort)
+  then "E_UNLINKED_PAYLOAD"
+  elif (response_envelope_ok | not) then "E_PARTIAL"
+  else "" end;
+def projection:
+  {artifact_sha256:.artifact_sha256,risk:.producer_request.body.risk,
+   gate_refs:.producer_request.body.risk.required_gate_refs,
+   outcome:[.producer_result.body.outcome,.forge_result.body.outcome],
+   evidence:[.producer_result.body.evidence,.forge_result.body.evidence],
+   audit:{producer_status:.producer_result.body.status,forge_status:.forge_result.body.status,
+     producer_attempt:.producer_result.body.attempt_number,
+     forge_attempt:.forge_result.body.attempt_number,
+     target_tree_id:.target_tree,candidate_tree_id:.candidate_tree}};
+
+if $command == "inventory" then inventory_ok
+elif $command == "producer-request" then producer_request(.)
+elif $command == "forge-request" then forge_request(.)
+elif $command == "stage-result" then stage_result(.;.output_id;.media_type;.payload_sha)
+elif $command == "request-envelope" then request_envelope_ok
+elif $command == "response-envelope" then response_envelope_ok
+elif $command == "response-error" then response_error
+elif $command == "projection" then projection
+else error("unknown-command") end

adapter-tests/v1/fakes/forge-a.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# shellcheck disable=SC2016
+set -euo pipefail
+[ "$#" -eq 4 ] || exit 64
+[ -z "${GH_TOKEN-}${GITHUB_TOKEN-}${AWS_SECRET_ACCESS_KEY-}${SSH_AUTH_SOCK-}" ] || exit 70
+request=$1 jq_bin=$2 contract=$3 modules=$4
+"$jq_bin" -L "${contract%/*}" -L "$modules" -e --arg command request-envelope \
+  -f "$contract" "$request" >/dev/null
+"$jq_bin" -S -c '.stage_request' "$request" > "$HOME/stage-request.json"
+"$jq_bin" -j '.payloads[] | select(.payload_id=="resolved-profile") | .data' \
+  "$request" > "$HOME/resolved.json"
+"$jq_bin" -j '.payloads[] | select(.payload_id=="source") | .data' "$request" > "$HOME/source.txt"
+"$jq_bin" -j '.payloads[] | select(.payload_id=="producer.patch") | .data' "$request" > "$HOME/producer.patch"
+patch_sha=$(/usr/bin/shasum -a 256 "$HOME/producer.patch" | /usr/bin/awk '{print $1}')
+candidate="$HOME/candidate"
+/bin/mkdir -m 700 "$candidate"
+/usr/bin/git init -q "$candidate"
+/bin/cp "$HOME/source.txt" "$candidate/source.txt"
+/usr/bin/git -C "$candidate" add source.txt
+/usr/bin/git -C "$candidate" commit -q -m source
+/usr/bin/git -C "$candidate" apply "$HOME/producer.patch"
+/usr/bin/git -C "$candidate" add source.txt
+/usr/bin/git -C "$candidate" commit -q -m candidate
+commit_id=$(/usr/bin/git -C "$candidate" rev-parse HEAD)
+tree_id=$(/usr/bin/git -C "$candidate" rev-parse 'HEAD^{tree}')
+object_id=$(/usr/bin/git -C "$candidate" rev-parse HEAD:source.txt)
+source_tree=$("$jq_bin" -r '.stage_request.body.inputs[] | select(.input_id=="input.source-tree") | .value.value.value.object_id' "$request")
+"$jq_bin" -S -c -n --arg source_tree "$source_tree" --arg patch "$patch_sha" \
+  --arg commit "$commit_id" --arg tree "$tree_id" --arg object "$object_id" '
+  {candidate_commit_id:$commit,candidate_object_id:$object,candidate_tree_id:$tree,
+   patch_sha256:$patch,source_tree_id:$source_tree}' > "$HOME/receipt.json"
+receipt_sha=$(/usr/bin/shasum -a 256 "$HOME/receipt.json" | /usr/bin/awk '{print $1}')
+request_sha=$(/usr/bin/shasum -a 256 "$HOME/stage-request.json" | /usr/bin/awk '{print $1}')
+resolved_sha=$(/usr/bin/shasum -a 256 "$HOME/resolved.json" | /usr/bin/awk '{print $1}')
+"$jq_bin" -S -c -n --slurpfile stage_request "$HOME/stage-request.json" \
+  --slurpfile resolved "$HOME/resolved.json" --arg case_id "$("$jq_bin" -r '.case_id' "$request")" \
+  --arg request_sha "$request_sha" --arg resolved_sha "$resolved_sha" --arg payload_sha "$receipt_sha" \
+  '{case_id:$case_id,phase:"forge",stage_request:$stage_request[0],request_sha:$request_sha,
+    resolved_profile:$resolved[0],resolved_sha:$resolved_sha,output_id:"candidate.repository",
+    media_type:"application/json",payload_sha:$payload_sha}' > "$HOME/result-context.json"
+"$jq_bin" -L "${contract%/*}" -L "$modules" -S -c --arg command stage-result \
+  -f "$contract" "$HOME/result-context.json" > "$HOME/stage-result.json"
+"$jq_bin" -S -c -n --slurpfile result "$HOME/stage-result.json" --rawfile receipt "$HOME/receipt.json" \
+  --arg case_id "$("$jq_bin" -r '.case_id' "$request")" --arg receipt_sha "$receipt_sha" '
+  {case_id:$case_id,payloads:[{data:$receipt,media_type:"application/json",
+    payload_id:"candidate.repository",sha256:$receipt_sha}],phase:"forge",protocol_version:1,
+    stage_result:$result[0]}'

adapter-tests/v1/fakes/forge-b.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# shellcheck disable=SC2016
+set -euo pipefail
+[ "$#" -eq 4 ] || exit 64
+[ -z "${GH_TOKEN-}${GITHUB_TOKEN-}${AWS_SECRET_ACCESS_KEY-}${SSH_AUTH_SOCK-}" ] || exit 70
+request=$1 jq_bin=$2 contract=$3 modules=$4
+"$jq_bin" -L "${contract%/*}" -L "$modules" -e --arg command request-envelope \
+  -f "$contract" "$request" >/dev/null
+"$jq_bin" -S -c '.stage_request' "$request" > "$HOME/stage-request.json"
+"$jq_bin" -j '.payloads[] | select(.payload_id=="resolved-profile") | .data' \
+  "$request" > "$HOME/resolved.json"
+"$jq_bin" -j '.payloads[] | select(.payload_id=="source") | .data' "$request" > "$HOME/source.txt"
+"$jq_bin" -j '.payloads[] | select(.payload_id=="producer.patch") | .data' "$request" > "$HOME/producer.patch"
+patch_sha=$(/usr/bin/shasum -a 256 "$HOME/producer.patch" | /usr/bin/awk '{print $1}')
+candidate="$HOME/candidate"
+/bin/mkdir -m 700 "$candidate"
+/usr/bin/git init -q "$candidate"
+/bin/cp "$HOME/source.txt" "$candidate/source.txt"
+/usr/bin/git -C "$candidate" add source.txt
+/usr/bin/git -C "$candidate" commit -q -m source
+/usr/bin/git -C "$candidate" apply --index "$HOME/producer.patch"
+/usr/bin/git -C "$candidate" commit -q -m candidate
+commit_id=$(/usr/bin/git -C "$candidate" rev-parse HEAD)
+tree_id=$(/usr/bin/git -C "$candidate" rev-parse 'HEAD^{tree}')
+object_id=$(/usr/bin/git -C "$candidate" rev-parse HEAD:source.txt)
+source_tree=$("$jq_bin" -r '.stage_request.body.inputs[] | select(.input_id=="input.source-tree") | .value.value.value.object_id' "$request")
+"$jq_bin" -S -c -n --arg source_tree "$source_tree" --arg patch "$patch_sha" \
+  --arg commit "$commit_id" --arg tree "$tree_id" --arg object "$object_id" '
+  {candidate_commit_id:$commit,candidate_object_id:$object,candidate_tree_id:$tree,
+   patch_sha256:$patch,source_tree_id:$source_tree}' > "$HOME/receipt.json"
+receipt_sha=$(/usr/bin/shasum -a 256 "$HOME/receipt.json" | /usr/bin/awk '{print $1}')
+request_sha=$(/usr/bin/shasum -a 256 "$HOME/stage-request.json" | /usr/bin/awk '{print $1}')
+resolved_sha=$(/usr/bin/shasum -a 256 "$HOME/resolved.json" | /usr/bin/awk '{print $1}')
+"$jq_bin" -S -c -n --slurpfile stage_request "$HOME/stage-request.json" \
+  --slurpfile resolved "$HOME/resolved.json" --arg case_id "$("$jq_bin" -r '.case_id' "$request")" \
+  --arg request_sha "$request_sha" --arg resolved_sha "$resolved_sha" --arg payload_sha "$receipt_sha" \
+  '{case_id:$case_id,phase:"forge",stage_request:$stage_request[0],request_sha:$request_sha,
+    resolved_profile:$resolved[0],resolved_sha:$resolved_sha,output_id:"candidate.repository",
+    media_type:"application/json",payload_sha:$payload_sha}' > "$HOME/result-context.json"
+"$jq_bin" -L "${contract%/*}" -L "$modules" -S -c --arg command stage-result \
+  -f "$contract" "$HOME/result-context.json" > "$HOME/stage-result.json"
+"$jq_bin" -S -c -n --slurpfile result "$HOME/stage-result.json" --rawfile receipt "$HOME/receipt.json" \
+  --arg case_id "$("$jq_bin" -r '.case_id' "$request")" --arg receipt_sha "$receipt_sha" '
+  {case_id:$case_id,payloads:[{data:$receipt,media_type:"application/json",
+    payload_id:"candidate.repository",sha256:$receipt_sha}],phase:"forge",protocol_version:1,
+    stage_result:$result[0]}'