Verification: delivery
Categories:
Use the verification protocol and the pinned source snapshot. The rebase and selected-base rows cite the R1/R2 fixture passes in the protocol; other results remain unrun for this documentation pass. Fixture observations are automated evidence, not a manual production or interactive-terminal pass.
For a named test, run from the projects/al workspace with
bazel test //internal/delivery:go_test --test_arg=-test.run=^TEST_NAME$ --test_output=all, replacing TEST_NAME with the
exact name in the row. Keep the test log and any undeclared output artifact under
the pass evidence directory. Read the named fixture before running it so its
assertions, controlled environment, and coverage limits are clear. Do not infer
that a passing fixture exercised live GitHub timing.
Rows labeled instrumented fixture require a disposable Git/forge setup with the stated pause or failure hook. Existing tests provide its reference behavior, but these rows are blocked until that setup exists; do not substitute the real repository or forge. TTY rows require a controlling terminal. No row authorizes a live push, review comment, or credential change.
Delivery workflow
DEL-10, DEL-13–22, and DEL-26 describe retired target suggestions, structured check plans, result ledgers, and combined validation/publication helpers. Their IDs remain reserved; historical evidence does not verify the current workflow. The ordinary-check workflow is covered by DEL-58–63 below.
| ID | P | Device | Claim | Setup | Steps | Expected | Result |
|---|---|---|---|---|---|---|---|
| DEL-01 | P1 | Local CLI | Provider output separates adapter and transport support (invoke). | Disposable repository with SSH origin identifying GitHub; no remote contact needed. | 1. Run al delivery --repository FIXTURE provider.2. Parse stdout as JSON. | Adapter availability and SSH transport availability are separate fields. | — |
| DEL-02 | P1 | Local CLI | Provider output does not print endpoint URLs (invoke). | DEL-01 fixture with a known synthetic remote string. | 1. Capture provider stdout and stderr. 2. Search for the complete configured remote string. | The endpoint string is absent from the sanitized report. | — |
| DEL-03 | P1 | Local CLI | HTTPS does not silently become SSH (invoke). | Disposable repository with an HTTPS GitHub origin. | 1. Run provider. 2. Read its transport fields. 3. Read the configured remote afterward. | Delivery transport is unavailable and the remote remains HTTPS. | — |
| DEL-04 | P2 | Local CLI | Help does not prepare or publish a candidate (exits immediately). | Clean disposable repository; record HEAD and refs. | 1. Run al delivery prepare --help.2. Compare HEAD and refs. | Help is printed; recorded Git state is unchanged. | — |
| DEL-05 | P1 | Existing fixture | Scope includes the complete existing feature diff (begins running). | TestPreparePathConstrainsExistingAggregateDiff. | 1. Run the named test. 2. Inspect its omitted-path refusal. | Preparation refuses a requested scope that excludes existing aggregate changes. | — |
| DEL-06 | P1 | Existing fixture | Explicit tracked deletions can be staged (begins running). | TestPrepareStagesExplicitTrackedDeletion. | 1. Run the named test. 2. Inspect the candidate tree assertion. | The explicitly owned deletion is included in the candidate. | — |
| DEL-07 | P1 | Existing fixture | Consolidation requires explicit exact-head selection (begins running). | TestPrepareRefusesMultiCommitRangeWithoutExactConsolidation. | 1. Run the named test. 2. Inspect the refusal cases. | An unselected or stale multi-commit replacement is refused. | — |
| DEL-08 | P1 | Existing fixture | An eligible explicitly selected range becomes one candidate (begins running). | TestPrepareConsolidatesExactOwnedLinearRange. | 1. Run the named test. 2. Inspect the resulting range assertions. | The prepared range is one aggregate commit preserving the owned content. | — |
| DEL-09 | P1 | Existing fixture | Index preparation freezes exact aggregate paths (begins running). | TestPreparedIndexReceiptFreezesExactAggregatePaths. | 1. Run the named test. 2. Inspect receipt scope assertions. | The receipt carries immutable exact aggregate paths. | — |
| DEL-11 | P1 | Existing fixture | Direct rebase preserves remote publication while updating the local candidate (begins running). | TestRebasePreservesRemoteUntilPublication, with an advanced base and both existing and absent remote feature refs. | 1. Run both subcases. 2. Compare local heads, remote refs, leases, and PR state. | Status is rebased, pushed is false, the new head includes base changes, and remote/PR state is unchanged. | Fixture pass, R1 TestRebasePreservesRemoteUntilPublication. |
| DEL-12 | P1 | Existing fixture | Direct rebase refuses a dirty worktree (begins running). | TestRebaseRequiresCleanWorktree. | 1. Run the named test. 2. Inspect its refusal and retained files. | Rebase preserves HEAD and the tracked and untracked edits. | Fixture pass, R1 TestRebaseRequiresCleanWorktree. |
| DEL-23 | P1 | Existing fixture | Exact remote feature progress is protected (while running). | TestPublishReceiptRejectsChangedRemoteHeadLease. | 1. Run the named test. 2. Inspect the changed remote head refusal. | A stale lease cannot replace the newly observed remote head. | — |
| DEL-24 | P1 | Existing fixture | A PR identity replacement is refused (while running). | TestPublishReceiptRejectsReplacementPullRequest. | 1. Run the named test. 2. Inspect identity checks. | A replacement PR is not silently adopted. | — |
| DEL-25 | P1 | Existing fixture | Verification preserves changed PR metadata (while running). | TestVerifyRefusesPullRequestMetadataEditAfterInitialInspection. | 1. Run the named test. 2. Inspect the mutation/refusal boundary. | Changed metadata causes a refusal instead of being overwritten. | — |
| DEL-27 | P1 | Existing fixture | A final read failure retains known publication evidence (finishes). | TestPublicationRetainsEvidenceAfterReviewFailure; push and PR synchronization succeed before the final review read fails. | 1. Run the named fixture. 2. Inspect publication-review-recovery.json and the remote-state assertions. | The pending report retains candidate and PR identity with verified false; later verification observes the completed publication without repeating it. | Fixture pass, D1 publication-review-recovery.json; working-tree candidate. |
| DEL-28 | P1 | Existing fixture | Review inspection covers all bounded review categories (review). | TestGitHubInspectReviewsReadsEveryReviewCategory. | 1. Run the named test. 2. Inspect returned reviews, threads, comments, and requests. | Each category appears without implying a review job completed. | — |
| DEL-29 | P1 | Existing fixture | Address recovery does not duplicate a confirmed reply (review). | TestReviewAddressPublishedCandidateAndRecovery. | 1. Run the named test. 2. Inspect the retained review-address.json artifact when available. | The restored unexpired attempt resolves the thread with only one reply. | — |
| DEL-30 | P1 | Existing fixture | Unknown reply outcome blocks automatic reposting (review). | TestReviewAddressRefusesDuplicateAfterUnknownReplyOutcome. | 1. Run the named test. 2. Inspect the reply-call count. | The next attempt does not post a second reply. | — |
| DEL-31 | P1 | Existing fixture | Address refuses changed candidate or reply inputs (review). | TestReviewAddressRefusesChangedInputs. | 1. Run the named test. 2. Inspect dirty, stale, expired, and altered-evidence cases. | Changed authority or evidence does not resolve the thread. | — |
| DEL-32 | P2 | Local CLI | Repository selection changes the inspected local target (modifiers). | Two disposable repositories with different synthetic forge identities. | 1. Run provider with each --repository path.2. Compare sanitized identity fields. | Each report identifies its selected repository. | — |
| DEL-33 | P2 | Local CLI | Structured command reports are separate from errors (modifiers). | Missing disposable repository path; stdout/stderr captured separately. | 1. Run provider with the missing path. 2. Inspect both streams and exit status. | Nonzero status and stderr diagnostic; stdout is not a successful JSON report. | — |
| DEL-34 | P1 | Instrumented fixture | Missing forge execution prerequisites fail rather than starting plugins (modifiers). | Instrumented local CLI with no valid forge executable and a synthetic configuration file. | 1. Invoke inspect using the absent executable path. 2. Observe the failure boundary and child process log. | The selected executable fails; no AL credential plugin startup is implied. | — |
| DEL-35 | P1 | Instrumented fixture | Cancellation before a selected operation does not establish readiness (interrupts). | AL paused before the first subprocess; fresh receipt path. | 1. Deliver SIGINT once before releasing the pause. 2. Capture status and receipt state. 3. Repeat from a fresh fixture with two SIGINT signals. | Record cancellation state; no completed operation or publication is inferred from either run. | — |
| DEL-36 | P1 | Instrumented fixture / TTY | Ctrl+C during work can leave earlier durable state (interrupts). | Disposable workflow paused after candidate creation and before a slow next subprocess. | 1. Press Ctrl+C. 2. Read HEAD and the receipt. 3. Repeat with two presses in a fresh fixture. | Earlier candidate/evidence can remain; a second press is not assumed to force rollback. | — |
| DEL-37 | P1 | Instrumented fixture | SIGTERM before work uses cancellation (interrupts). | Fresh invocation paused before its first subprocess. | 1. Deliver SIGTERM. 2. Capture exit and evidence. | No completed operation is inferred; cancellation is reported where observed. | — |
| DEL-38 | P1 | Instrumented fixture | SIGTERM during work does not undo the complete workflow (interrupts). | Disposable workflow paused after a confirmed local commit. | 1. Deliver SIGTERM. 2. Inspect HEAD and evidence. | The already created commit can remain; no rollback guarantee is claimed. | — |
| DEL-39 | P2 | TTY fixture | Terminal loss before work has no dedicated AL recovery (interrupts). | Fresh process in a disposable controlling terminal, paused before work. | 1. Close the terminal. 2. Inspect process and files from another terminal. | Record OS termination behavior and existing state; no AL recovery report is required. | — |
| DEL-40 | P1 | TTY fixture | Terminal loss during remote work can hide the outcome (interrupts). | Disposable forge update acknowledged internally but final report paused. | 1. Close the terminal. 2. Inspect fixture remote state and receipt from another terminal. | The mutation can exist without visible completion output. | — |
| DEL-41 | P2 | Instrumented fixture | Closed stdin is not publication approval input (interrupts). | Prepared disposable candidate with a known publication. | 1. Close stdin. 2. Invoke receipt-bound verify.3. Inspect forge state. | Verification does not push; stdin closure does not select a publication mutation. | — |
| DEL-42 | P1 | Instrumented fixture | Broken stdout can occur after a durable operation (interrupts). | Disposable candidate preparation paused immediately before final JSON writing. | 1. Close the stdout reader. 2. Release the pause. 3. Inspect HEAD and receipt. | Preserve any committed candidate even when its report is lost or writing fails. | — |
| DEL-43 | P2 | Local CLI / offline | Provider detection is local (interrupts). | DEL-01 fixture with external network blocked. | 1. Run provider. 2. Capture its result. | Local sanitized provider detection still succeeds. | — |
| DEL-44 | P1 | Instrumented fixture | Connection loss during publication leaves an observable recovery boundary (interrupts). | Disposable forge accepts a mutation but drops its response. | 1. Invoke receipt-bound publication. 2. Restore fixture reads. 3. Run receipt-bound verify. | Verification reports the observed postcondition without repeating the push or PR mutation. | — |
| DEL-45 | P1 | Local fixture | Inaccessible required input fails before its use (interrupts). | Disposable repository with a missing message file and otherwise valid scope. | 1. Invoke prepare with that message path. 2. Inspect HEAD and diagnostic. | Required input error; no successful preparation is reported. | — |
| DEL-46 | P1 | Instrumented filesystem fixture | Evidence failure can follow candidate creation (interrupts). | Receipt installation fault injected after the candidate write. | 1. Fail the evidence write. 2. Capture the command result. 3. Inspect HEAD and receipt bytes. | Record remaining candidate and any uncertainty; do not infer that failure removed the commit. | — |
| DEL-47 | P1 | Existing fixture | Stale input is refused before remote mutation (interrupts). | TestPublishRefusesChangedReceiptBeforeRemoteMutation. | 1. Run the named test. 2. Inspect the remote-mutation assertion. | Changed receipt evidence prevents the remote mutation. | — |
| DEL-48 | P1 | Existing fixture | Late task-scope edits are rechecked (interrupts). | TestPublishRechecksPreparedScopeAfterFinalForgeRead. | 1. Run the named test. 2. Inspect the final-scope refusal. | Publication refuses the late edit rather than using stale source. | — |
| DEL-49 | P1 | Existing fixture | Concurrent receipt transitions serialize (interrupts). | TestReceiptLockSerializesOverlappingTransition. | 1. Run the named test. 2. Inspect entry ordering. | The second cooperating transition does not overlap the first. | — |
| DEL-50 | P1 | Existing fixture | Lock-ignoring writers are outside the receipt lock guarantee (interrupts). | TestReceiptComparisonDoesNotExcludeLockIgnoringWriter. | 1. Run the named test. 2. Read its race observation. | The result does not claim exclusion of a writer that ignores the lock. | — |
| DEL-51 | P1 | Instrumented fixture | Forced kill before work proves no completion (interrupts). | Fresh process paused before any operation. | 1. Send SIGKILL. 2. Inspect process and evidence. | No application completion report or cleanup is expected. | — |
| DEL-52 | P1 | Instrumented fixture | Forced kill during an attempt can prevent evidence finalization (interrupts). | Disposable workflow paused after an attempted forge write and before final evidence. | 1. Send SIGKILL. 2. Inspect remote state and retained attempt evidence. 3. Resume verification only after diagnosis. | Partial evidence and completed remote state can coexist; do not delete evidence to force a retry. | — |
| DEL-53 | P1 | Existing fixture | Identical base entries can shrink rebase scope safely (edge cases). | TestPublishRebaseDropsOnlyPathsIdenticalInAdvancedBase. | 1. Run the named test. 2. Inspect accepted and refused scope changes. | Only the exact identical-entry reduction is accepted. | — |
| DEL-54 | P2 | Instrumented fixture | A message-only amendment changes commit identity (edge cases). | Prepared disposable candidate and revised aggregate message. | 1. Record old head/tree. 2. Prepare the message-only amendment. 3. Compare returned head/tree. | The tree remains identical while the candidate OID changes. | — |
| DEL-55 | P1 | Existing fixture | An already-based branch is not published by direct rebase (begins running). | TestRebaseAlreadyBasedPreservesRemote. | 1. Run the named test. 2. Inspect the report and absent remote feature ref. | Status is already_based, pushed is false, local HEAD is unchanged, and no remote branch is created. | Fixture pass, R1 TestRebaseAlreadyBasedPreservesRemote. |
| DEL-56 | P2 | Delivery fixture | Direct rebase reports the required preparation, ordinary checks, and publication steps (begins running). | Eligible single-commit branch with an advanced base. | 1. Run direct rebase. 2. Read next_action from the JSON report. | The next action directs preparation of the rebased candidate, ordinary checks, then explicit publication. | — |
| DEL-57 | P1 | Existing fixture | Inspection bases rebase decisions on the selected branch (invoke). | TestDeliveryInspectionUsesSelectedBase; explicit release base or existing PR base. | 1. Advance unrelated trunk and inspect. 2. Advance the selected release base and inspect again. | Unrelated advancement causes no stale-base refusal or rebase request; selected-base advancement sets needs_rebase while local HEAD stays unchanged. | Fixture pass, R2 selected-base-{false,true}.json and selected-base-advanced-{false,true}.json. |
| DEL-58 | P1 | Isolated Git/forge fixture | Preparation performs only Git preparation (begins running). | Valid task scope and message; Bazel absent from fixture PATH; standalone AL. | 1. Run prepare with its Git options. 2. Read the candidate and receipt. 3. Inspect subprocess observations. | Candidate and preparation receipt are created without launching Bazel or requiring a check plan. | — |
| DEL-59 | P1 | Isolated Git/forge fixture | Publication uses the prepared receipt without a validation ledger (while running). | Exact prepared candidate, matching clean state and remote expectations; no check-plan or result files. | 1. Run explicitly authorized fixture publish --receipt-file RECEIPT.2. Inspect remote ref and PR state. | Publication uses the receipt’s candidate and current matching HEAD; no validated-head flag or validation log is required. | Fixture pass, D1 source-publication.json; working-tree candidate. |
| DEL-60 | P1 | Isolated Git/forge fixture | Changed candidate or prepared scope refuses publication (while running). | Separate prepared cases with a changed HEAD, staged change, and unstaged edit in task scope. | 1. Run receipt-bound publish in each case. 2. Inspect diagnostic and remote state. | Mismatched candidate or dirty prepared inputs refuse publication before remote mutation. | — |
| DEL-61 | P1 | Isolated Git/forge fixture | An advanced base produces a rebased candidate requiring checks (while running). | Prepared clean feature candidate; advance fixture base without conflicts. | 1. Publish using the receipt. 2. Read the report and updated receipt. 3. Compare local candidate and remote feature ref. | Nonzero result with checks_required; receipt identifies the rebased head/tree and remote feature publication is unchanged. | — |
| DEL-62 | P1 | Isolated Git/forge fixture | The updated receipt can publish after ordinary checks (while running). | Successful DEL-61 rebase; source and base remain unchanged. | 1. Run the fixture’s ordinary Bazel checks. 2. Invoke publish with the same receipt. 3. Inspect head and publication. | No additional prepare or commit rewrite is needed; the rebased candidate is published under its exact lease. | — |
| DEL-63 | P1 | Isolated Git/forge fixture | Review addressing uses the clean prepared candidate and verified publication (review). | Published prepared candidate, controlled unresolved thread, authorized reply file; no validation logs. | 1. Run review address with the preparation receipt and thread. 2. Inspect reply and resolution evidence. 3. Repeat from a fresh case with dirty inputs. | The clean exact published case can reply and resolve without check logs; the dirty case is refused. | — |
Not checkable by hand
Check selection and adequacy remain the operator’s responsibility. AL does not inspect ordinary Bazel results; successful publication is not evidence that tests ran or passed.
A finite pass cannot prove absence of all GitHub-side races or moderation events omitted from its bounded projection. The documented boundary is a limitation, not a claim to be certified by one successful mutation.
Unimplemented pause/failure hooks above are verification setup work, not product defects. Record those rows as blocked when attempting a pass without the required setup; do not mark them passed from source reading.