test(#6): pin install.sh minisign contract #14

Merged

feedback-bot merged 3 commits from fix/6-install-contract into main

2026-09-08 22:29:55 +00:00

jsutter commented

2026-09-08 20:28:44 +00:00

Owner

Closes the dit-releases contract half of deepnet/dit-e2e#6 (the golden re-bake OPERATION itself is Wave 4 — not this PR).

Already landed on main (verified): install.sh's absent-minisign refusal exists (dit-releases#216) with a message naming minisign and the remedy; dit-e2e main pins minisign in the bake package list (8df53d0).

This PR:

install.sh: the minisign-mandatory gate moves from after the binary download to the pre-network validation block (alongside the pinned-version check). Same behavior, better position: a machine that can never verify a release stops before paying for the download — and the contract becomes provable offline.
tests/install-signing.sh §3c (new, behavioral): restricted PATH without minisign + pinned version + dead FORGE_URL must exit non-zero, name minisign, name the remedy, and attempt no download. Because the FORGE_URL is dead, a regression of the gate's position below the download fails the greps — the test pins the gate's existence AND its position ahead of every network call.

Sensitivity evidence: the same §3c probe run against the pre-PR install.sh exits 127 with no minisign message (dies before any refusal) — the test discriminates old vs new ordering.

Gate (local): sh tests/install-signing.sh → ALL CHECKS PASSED (exit 0). Sections 1–3, 3b, 3c, 5–7 ran; 4/4b (fixture signature verification) SKIP on this host — minisign is not installed here, which is precisely the condition §3c exercises behaviorally. The fixture-verification half needs a minisign-bearing environment (CI or container) — not run locally.

Live verification: not applicable to this PR (installer contract test is self-contained); the golden re-bake + which minisign in-guest check is the Wave-4 operation.

Closes the dit-releases contract half of deepnet/dit-e2e#6 (the golden re-bake OPERATION itself is Wave 4 — not this PR). **Already landed on main (verified):** install.sh's absent-minisign refusal exists (dit-releases#216) with a message naming minisign and the remedy; dit-e2e main pins `minisign` in the bake package list (`8df53d0`). **This PR:** - install.sh: the minisign-mandatory gate moves from after the binary download to the pre-network validation block (alongside the pinned-version check). Same behavior, better position: a machine that can never verify a release stops before paying for the download — and the contract becomes provable offline. - tests/install-signing.sh §3c (new, behavioral): restricted PATH without minisign + pinned version + dead `FORGE_URL` must exit non-zero, name minisign, name the remedy, and attempt no download. Because the FORGE_URL is dead, a regression of the gate's position below the download fails the greps — the test pins the gate's existence AND its position ahead of every network call. **Sensitivity evidence:** the same §3c probe run against the pre-PR install.sh exits 127 with no minisign message (dies before any refusal) — the test discriminates old vs new ordering. **Gate (local):** `sh tests/install-signing.sh` → ALL CHECKS PASSED (exit 0). Sections 1–3, 3b, 3c, 5–7 ran; 4/4b (fixture signature verification) SKIP on this host — minisign is not installed here, which is precisely the condition §3c exercises behaviorally. The fixture-verification half needs a minisign-bearing environment (CI or container) — not run locally. **Live verification:** not applicable to this PR (installer contract test is self-contained); the golden re-bake + `which minisign` in-guest check is the Wave-4 operation.

jsutter added 3 commits

2026-09-08 20:28:44 +00:00

S027,S029: Homebrew tap + formula, register-ditc docs, zero-skills installers (federated-user-login) 80fd179fbc

S027: Formula/ditc.rb (binary formula, per-target urls from the
ditc-<triple> assets, check-engine deps, --version test) +
Formula/ditc.rb.tmpl + tests/formula.sh. ditc-v3.0.0 is unpublished, so
the committed formula carries all-zero sentinel sha256 values — fail-
closed (brew refuses at checksum) until the release workflow renders the
signed SHA256SUMS in; tests/formula.sh asserts that placeholder state,
compares real hashes against the live SHA256SUMS once published, and
refuses either half-state. INSTALL.md gains the Homebrew section
(deepnet/releases tap; Operator approval of dit-releases-as-tap still
pending).

S029: the optional-skills note is gone from both installers (skills-as-
files retired in ditc 3.0.0 — ditc never writes harness dirs; agents
consume ditc mcp). INSTALL.md drops the skills section + uninstall
skills lines, gains 'Register ditc with your agent' (project-scope
files + the per-harness register lines). Both signing tests now assert
ZERO case-insensitive skills mentions (amends S007/S008/S010/S012).

Gates: tests/install-signing.sh + tests/install-ps1-signing.ps1 ALL
CHECKS PASSED (nix minisign: fixture verify + tampered/unsigned refused,
SC-8); ruby -c Syntax OK on formula + template (nix ruby); tests/
formula.sh pass. S030 (Scoop) deferred per spec; S028 (release.yml job)
lives in dit-client, outside this repo.

INSTALL.md: command reference rewritten to the 3.0.0/5.0.0 surfaces 8c526f587d

The tables still showed the pre-rename flat-verb surface (ditc scaffold,
dito tenant-init) and conflated agent skills with dito commands. Now:
the real noun-verb surface per binary, versions pinned to this arc's
releases (ditc 3.0.0, dito 5.0.0).

test(#6 ): pin install.sh's minisign-mandatory contract, gate moved ahead of any network (dit-e2e#6) b08e75c0e5

The absent-minisign refusal existed (dit-releases#216) but sat after the
binary download, so the contract was only greppable, not provable — and
an un-verifiable machine paid for a download it could never verify. The
gate now sits with the other pre-network validation (pinned-version
precedent), and tests/install-signing.sh 3c pins the contract
behaviorally: restricted PATH without minisign + pinned version + dead
FORGE_URL must exit 1 naming minisign and the remedy, with no download
attempt — a regression of the gate's position fails the greps.