script-suites.sh

#!/usr/bin/env bash
# Run broca's operator script suites: the Python tests that guard release, placement,
# WAL-reading and dependency tooling. CI and the local gate both call this one list, so a
# suite added here runs in both places. Before this file existed the list lived only in
# CI, and a conflict between two dependency checks reached CI after passing the local gate.
#
# Usage: scripts/script-suites.sh
set -euo pipefail
cd "$(dirname "$0")/.."
source scripts/lib/exit-guard.sh

# Suites can spawn Python themselves, so the variable (inherited) rather than `python3 -B`.
# Bytecode left in scripts/__pycache__ would trip CI's clean-worktree guard.
export PYTHONDONTWRITEBYTECODE=1

# Suites need Python 3.11+ (tomllib) and PyYAML (workflow parsing). macOS's system python3
# is older, and Homebrew's has no PyYAML, so an operator venv is tried first. Take the first
# interpreter that has both, and refuse with the remedy if none does.
PY=""
suites_venv="${XDG_DATA_HOME:-$HOME/.local/share}/cortexkit/broca/py-suites"
for candidate in "${BROCA_SUITES_PYTHON:-}" "$suites_venv/bin/python3" \
    python3 python3.14 python3.13 python3.12 python3.11 /opt/homebrew/bin/python3; do
    [[ -n $candidate ]] || continue
    if command -v "$candidate" >/dev/null 2>&1 && "$candidate" -c 'import tomllib, yaml' 2>/dev/null; then
        PY=$(command -v "$candidate")
        break
    fi
done
if [[ -z $PY ]]; then
    echo "script-suites: no Python 3.11+ with PyYAML found. Create one with:" >&2
    echo "  python3.11+ -m venv $suites_venv && $suites_venv/bin/pip install PyYAML" >&2
    echo "or set BROCA_SUITES_PYTHON to an interpreter that has tomllib and yaml." >&2
    exit 2
fi
# A temporary python3 link to the interpreter chosen above goes first on PATH, so a suite
# that starts "python3" itself runs under that same interpreter.
PY_DIR=$(mktemp -d "${TMPDIR:-/tmp}/broca-suites-python.XXXXXX")
trap 'broca_exit_guard rm -rf "$PY_DIR"' EXIT
# A wrapper that execs the interpreter, not a symlink: a venv's Python finds its
# site-packages relative to the path it was started from, so a symlink elsewhere drops them.
printf '#!/bin/sh\nexec "%s" "$@"\n' "$PY" > "$PY_DIR/python3"
chmod +x "$PY_DIR/python3"
export PATH="$PY_DIR:$PATH"
echo "script-suites: $(python3 --version) at $PY"

suites=(
    scripts/test-exit-guard.py
    scripts/test-check-path-deps.py
    scripts/test-stage-release.py
    scripts/tests/test-release-clients.py
    scripts/test-release.py
    scripts/test-prune-staging.py
    # Stubs codesign, file, stat, ps and lsof, so the placement gate's macOS-only signing
    # checks also run on a Linux runner.
    scripts/test-place-release-gate.py
    scripts/test-place-release-seal.py
    scripts/test-train-push.py
    scripts/test-train-preflight.py
    scripts/test-watch-ci-resolve.py
    scripts/test-archive-read.py
    scripts/test-wal-archive-instruments.py
    scripts/test-wal-retention-readers.py
    scripts/test-step-timing.py
    scripts/tests/test-attempt-telemetry.py
    scripts/test-rekey-harness.py
    # The WAL readers' handling of gated (version-3) frames: decoded when their features
    # are known, reported as newer-writer when not.
    scripts/test-live-runs.py
    scripts/test-find-finalize-leaks.py
    # Every script locates broca's state root by the daemon's rule.
    scripts/test-state-root.py
    # Verifies quickcheck's unconditional guards and feature propagation behavior.
    scripts/test-quickcheck-guards.py
    # The gate's phase order (fmt, clippy, prewarm, tests) and its log, with cargo stubbed.
    scripts/test-gate-phases.py
    scripts/test-ci-pipeline.py
    scripts/test-prepush-npm.py
    scripts/test-prepush-coverage.py
    scripts/test-gated-commit.py
    scripts/tests/test_linux_quickcheck.py
    scripts/test-deploy.py
    scripts/test-check-credential-metadata.py
    scripts/test-acceptance-worker-turn.py
    scripts/tests/test-acceptance-turns.py
    scripts/test-turn-harnesses.py
    scripts/test-repro-vanished-bind-root.py
    scripts/test-script-options.py
    # Keep Tokio test clocks dev-only and the live transport stack out of non-live graphs.
    scripts/test-dependency-features.py
    scripts/test-cargo-watchdog.py
    scripts/tests/test_clock_safety.py
    scripts/tests/test_release_fences.py
    # Maintenance scripts refuse to write while a writer's liveness is unknown.
    scripts/lib/test_liveness.py
    # Every suite file in scripts/ is listed in one of the arrays in this file.
    scripts/test-script-suites.py
    # nextest's resource groups select modules that exist and every module they must cap.
    scripts/test-nextest-groups.py
    # Vendored Cingulate consent contract: checksums, pins and broca's mapping.
    crates/broca-subc/tests/fixtures/consent/verify.py
)

# Suites that drive real macOS tools (cc, dsymutil, codesign) on real Mach-O files. On a Mac
# they run with BROCA_REQUIRE_NATIVE_MACOS=1, so a missing tool fails instead of skipping. On
# any other host they are reported as not run: a skip there is no evidence for the contract.
native_macos_suites=(
    # place-release.sh --restart restarts only after a successful placement and a clear
    # second live-run check.
    scripts/test-place-release-restart.py
)

# Suite files deliberately not run here, each with the place that does run it.
run_elsewhere=(
    # Its own CI step (in the archive job) and gate.sh's portable preflight phase run it, after
    # Cargo has built the test binaries it inspects.
    scripts/test-portable-test-selection.py
    # Needs the network and an authenticated gh; armed by hand with WATCH_CI_LIVE_TESTS=1.
    scripts/test-watch-ci.py
)

# A rename must not quietly shrink this to a no-op that keeps passing.
for suite in "${suites[@]}" "${native_macos_suites[@]}" "${run_elsewhere[@]}"; do
    [[ -f $suite ]] || { echo "missing suite: $suite" >&2; exit 2; }
done
echo "running ${#suites[@]} operator script suites"
for suite in "${suites[@]}"; do
    echo "--- $suite"
    python3 "$suite"
done
for suite in "${native_macos_suites[@]}"; do
    if [[ $(uname -s) == Darwin ]]; then
        echo "--- $suite (native macOS)"
        BROCA_REQUIRE_NATIVE_MACOS=1 python3 "$suite"
    else
        echo "--- NOT RUN: $suite needs native macOS; this host proves nothing for it"
    fi
done
python3 scripts/check-path-deps.py
python3 scripts/live-runs.py --self-test
python3 scripts/audit-export-lane.py --self-test
# Nothing under .cortexkit/ may be tracked except release-notes/, skills/, rules/ and WORKER.md.
scripts/check-cortexkit-layout.sh
BROCA_EXIT_GUARD_FINISHED=1