AUR-011 - deterministic demo Git fixture

Documento histórico do board. Pode descrever componentes removidos; para uso atual, consulte o guia do produto.

tests/fixtures/repos/git-demo is a synthetic Git history that the demo office (O09-demo) uses as a review target. It is recreated, not stored by accident: the same history.spec and the same content/ overlay always produce the same commits, the same object ids and the same fixture digest.

Nothing in the fixture comes from a real repository, and every credential-shaped value in it is fake.

Behavior

tests/fixtures/repos/git-demo/build-fixture.sh <history-spec> <output-dir> reads the declarative spec plus its content overlay and writes:

• <output-dir>/repo.git - a complete bare Git repository built from loose objects, with HEAD, config, refs/heads/<branch> and objects/<id0:2>/<id2:>;
• <output-dir>/manifest.json - the sealed description of what it emitted: branch, author, committer, HEAD, every commit in order with its tree, parent, timestamp, timezone, message and operations, every object with its type, raw size and digests, the planted synthetic tokens, and the source_digest / fixture_digest pair.

The builder refuses to write anything into an output directory that already exists, and every typed refusal happens before the output directory is created.

Sealed values of the checked-in fixture

• branch: main
• HEAD: sha1:eedb8f9dbd4e725cb8b9cc065fe7f1090f2a9024
• commits: 3, objects: 16
• fixture digest: sha256:f6c7cd8a7c12bdbb84407b42c00abb669df8d67d3f1d20ce046eae8877d7c0cc

Contract

• Object identity is Git's own: sha1("<type> <size>\0<payload>").
• Every loose object is a zlib stream of DEFLATE stored blocks: 78 01 | (BFINAL|BTYPE=00) LEN_le16 NLEN_le16 <raw bytes> |* adler32_be32. Actual compression is a property of the zlib build that produced it, so two correct implementations may legitimately disagree byte for byte; the stored block is the encoding every implementation must produce identically. git inflates these exactly like any other object.
• Author, committer, timestamps and timezone are fixed by the spec. Nothing is read from the clock, the environment, the network or a remote, so two builds of the same source produce the same bytes.
• The tree carries synthetic tokens only. Values shaped like real credentials (PEM private key headers, AKIA..., sk-..., gh?_...) are refused by the builder with git-demo/non-synthetic-secret before anything is written.

Domain limits

limit	value	first value beyond it
max-commits	16	17 commits -> git-demo/too-many-commits
max-files-per-commit	16	17 files -> git-demo/too-many-files:<commit>
max-object-bytes	65536	65537 bytes -> git-demo/object-too-large:<commit>:<path>
max-total-bytes	4194304	beyond -> git-demo/total-too-large

A payload of exactly 65536 bytes is inside the domain and crosses the DEFLATE stored-block ceiling of 65535, so a correct build emits two stored blocks for it.

Example (no secret involved)

Recreate the fixture into a scratch directory and compare it with the sealed tree. This is the same call the acceptance makes for the nominal-recreate vector, so the example cannot drift from the behavior:

out="$(mktemp -d)/fixture"
bash tests/fixtures/repos/git-demo/build-fixture.sh \
  tests/fixtures/repos/git-demo/history.spec "$out"
# git-demo/recreated head=sha1:eedb8f9dbd4e725cb8b9cc065fe7f1090f2a9024 \
#   commits=3 objects=16 \
#   fixture_digest=sha256:f6c7cd8a7c12bdbb84407b42c00abb669df8d67d3f1d20ce046eae8877d7c0cc
diff -r "$out/repo.git" tests/fixtures/repos/git-demo/repo.git && echo identical

Regenerating the checked-in copy, when the spec or the overlay changes:

rm -rf tests/fixtures/repos/git-demo/repo.git tests/fixtures/repos/git-demo/manifest.json
out="$(mktemp -d)/fixture"
bash tests/fixtures/repos/git-demo/build-fixture.sh \
  tests/fixtures/repos/git-demo/history.spec "$out"
cp -r "$out/repo.git" "$out/manifest.json" tests/fixtures/repos/git-demo/

Why the acceptance never calls git

The card's sealed profile is bootstrap-readonly-v1. Its pinned image (aurum-bootstrap-go-bash@sha256:503ac356...) carries bash and a Go toolchain but no git binary, and the worker runs read-only with no network. An acceptance that shelled out to git could not run in the only environment that gates this card, so tests/acceptance/AUR-011.sh decodes the Git object format directly and checks it against the manifest.

That the very same bytes are accepted by real Git was confirmed on the host and is recorded here as documentation, never as this card's evidence:

$ git --git-dir=tests/fixtures/repos/git-demo/repo.git fsck --strict
$ git --git-dir=tests/fixtures/repos/git-demo/repo.git log --format='%H %at %s'
eedb8f9dbd4e725cb8b9cc065fe7f1090f2a9024 1700000120 chore: plant synthetic tokens and drop the scratch notes
c7a2e5a32bb7b0af16b97e5b70fec5a38ff9d5d7 1700000060 feat: add the greeter and point the config at it
443b29afea9469f73e609f95a3e7438763bb12f0 1700000000 seed: add the demo project skeleton
$ git clone tests/fixtures/repos/git-demo/repo.git /tmp/demo && git -C /tmp/demo status --porcelain

fsck --strict exits 0, the log shows exactly the three sealed commits, and the clone checks out a clean worktree.

Diagnosis

The acceptance reports one line per finding as AUR-011/AC-001/<code> on stderr and exits 1. The codes map to a cause:

finding	what happened
behavior-missing	the fixture, its spec, its builder or the doc is absent
fixture-decode:object-id-mismatch	an object's bytes no longer hash to its own id
fixture-decode:zlib-adler-mismatch	the object container was edited
fixture-decode:dangling-ref	the branch points at an object that is not present
fixture-decode:commit-order-divergence	the parent chain disagrees with the manifest order
fixture-decode:content-divergence:<idx>/<path>	a blob no longer matches its content/ source
fixture-decode:orphan-object:<id>	an object is present but unreachable from HEAD
MUT-001	the spec reorders the commits while the manifest still claims the sealed order
recreation-divergence:*	rebuilding from the spec no longer reproduces the sealed bytes
replay-digest-divergence	two builds of the same source disagreed: determinism is broken
vector-*:want=...:got=...	a sealed vector observed something other than its declared result
non-synthetic-secret-in-fixture	something credential-shaped reached the fixture

To reproduce a finding outside the container, run the same program on the host:

bash tests/acceptance/AUR-011.sh AC-001; echo "exit=$?"

Exit 0 is the only pass. Exit 64 means the scenario selector was wrong and exit 79 means the environment could not run the check at all; neither is behavioral evidence.

Compatibility and rollback

The fixture is card-scoped data. Reverting only tests/fixtures/repos/git-demo, tests/acceptance/AUR-011.sh, tests/specs/AUR-011 and this file restores the previous base; nothing outside those paths is read or written, and nothing is published.