test(conformance): DS-2 allows the discard's unstage, still bans commits and remote git

Draft
TL
14h ago
+29-8

Why

DS-2 in delivery.cli.test.ts fails on main since c90fbe9e (#689), deterministically (also run alone). #689 made a discard on the fs storage (deco serve) bring the discarded blocks' git index entries back to HEAD (PO: "deco serve should unstage git added blocks on discard"). It does that with git reset -q HEAD -- <paths>, git rm --cached -f --quiet --ignore-unmatch -- <paths> and, to undo a failed write, git update-index. DS-2's scan treated local git as strictly read-only and matched "reset"/"update-index".

Is the scan right or too broad?

Too broad, so this changes the test, not the code:

  • The docs claim behind DS-2 (draft synchronization: "Local deco serve keeps editing the developer's working tree and does not perform hosted branch synchronization") forbids GitHub calls, commits and branch work. It never said the index stays untouched; "local git read-only" was the test's own wording.
  • The code does nothing the claim forbids: no commit, no ref or object write, no remote, no working-tree checkout. Its index writes are limited to the paths the discard restores (plus both sides of a staged rename), and they're PO-requested behaviour with their own tests in storage/fs/git.test.ts.

What changed

DS-2 now encodes that claim and keeps guarding against regressions:

  • Anywhere in cli/serve/server.ts and protocol/storage/fs/*: no GitHub, no simple-git/isomorphic-git; only git.ts uses child_process.
  • In git.ts: never commit, add, restore, checkout, switch, stash, push, fetch, pull, clone, remote, merge, rebase, write-tree, commit-tree, update-ref, tag, -w, --hard, --soft, --keep, --merge.
  • Index writes (reset, rm, update-index, read-tree, apply) only inside unstage. There, rm must carry --cached and reset must be exactly -q HEAD over named paths.

Mutation-checked: each of these fails the test: an index write outside unstage, rm without --cached, reset --hard, reset HEAD~1, and a commit call.

Docs site: no change is needed, since the claim already matches. It could optionally mention that a discard also unstages the discarded blocks.

Gates

  • bun run check 0, bun run build 0, skills:check + skills:readme:check 0
  • Plain-Node import of every built export plus deco --help: 0
  • bun run test (2 GB): 2077 passed, 2 failed, 95 skipped. The two failures are schema.test.ts 5 s timeouts under load. That file passes alone (58/58). delivery.cli.test.ts passes 11/11.

šŸ¤– Generated with Claude Code

https://claude.ai/code/session_016ZsmzpZ2zahRBoATBb2tBu

Summary by cubic

Fixes the DS-2 conformance test so deco serve can unstage discarded blocks while still banning commits, remote git calls, and working-tree rewrites.

  • The test now permits git index writes only inside the discard's unstage operation, matching the behavior added in #689.
  • It still fails on any commit, ref or object write, working-tree checkout, or remote operation anywhere in cli/serve/server.ts or protocol/storage/fs/*.
  • Within unstage, rm must carry --cached and reset must be exactly -q HEAD over named paths.
  • Mutation-checked: an index write outside unstage, rm without --cached, reset --hard, reset HEAD~1, and a commit call each fail the test.