test(apple): verify compiled Mach-O root occurrence facts (#1300)

test(artifacts): verify compiled Mach-O roles and permissions

Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)

scripts/verify/apple/macho-occurrences.mjs

@@ -0,0 +1,86 @@
+import assert from "node:assert/strict";
+import { chmod, readFile, stat } from "node:fs/promises";
+import { relative, sep } from "node:path";
+
+import { parseArtifactInventoryEvidence } from "../../../dist/domain/artifactInventoryEvidence.js";
+import {
+  artifactCliEvidence,
+  withArtifactMcp,
+} from "../../lib/artifact-e2e.mjs";
+
+/** Verify native file roles and permissions on the real compiled bundle fixture. */
+export async function verifyMachOOccurrences(app, executable) {
+  const originalMode = (await stat(executable)).mode & 0o7777;
+  const originalBytes = await readFile(executable);
+  const logicalPath = relative(app, executable).split(sep).join("/");
+  const observations = [];
+  try {
+    for (const mode of [0o755, 0o644]) {
+      await chmod(executable, mode);
+      const directEvidence = await artifactCliEvidence(
+        "inspect-artifact",
+        executable,
+      );
+      const direct = parseArtifactInventoryEvidence(directEvidence).inventory;
+      const containedEvidence = await artifactCliEvidence(
+        "inspect-artifact",
+        app,
+      );
+      const contained =
+        parseArtifactInventoryEvidence(containedEvidence).inventory;
+      assert.equal(direct.complete, true);
+      assert.equal(contained.complete, true);
+      const root = direct.occurrences.find(
+        ({ logical_path }) => logical_path === ".",
+      );
+      const nested = contained.occurrences.find(
+        ({ logical_path }) => logical_path === logicalPath,
+      );
+      assert.ok(root);
+      assert.ok(nested);
+      assert.ok(["mach-o", "mach-o-universal"].includes(root.artifact_format));
+      for (const occurrence of [root, nested]) {
+        assert.equal(occurrence.artifact_kind, "executable");
+        assert.equal(occurrence.artifact_format, direct.manifest.root_format);
+        assert.equal(occurrence.executable, mode === 0o755);
+      }
+      assert.equal(root.artifact_id, nested.artifact_id);
+      assert.equal(root.artifact_id, direct.manifest.root_artifact_id);
+      const node = contained.nodes.find(
+        ({ artifact_id }) => artifact_id === nested.artifact_id,
+      );
+      assert.ok(node);
+      assert.equal(node.sha256, direct.manifest.root_sha256);
+      assert.equal(node.format, root.artifact_format);
+      await withArtifactMcp(app, async (client) => {
+        const reply = await client.callTool({
+          name: "inspect_artifact",
+          arguments: {},
+        });
+        assert.notEqual(reply.isError, true, JSON.stringify(reply));
+        assert.deepEqual(
+          parseArtifactInventoryEvidence(reply.structuredContent).inventory,
+          contained,
+        );
+      });
+      observations.push({
+        mode: mode.toString(8),
+        artifact_id: root.artifact_id,
+        artifact_kind: root.artifact_kind,
+        artifact_format: root.artifact_format,
+        executable: root.executable,
+        contained_cli_mcp_parity: true,
+      });
+    }
+    assert.equal(observations[0].artifact_id, observations[1].artifact_id);
+    assert.deepEqual(await readFile(executable), originalBytes);
+    return {
+      direct_cli: true,
+      contained_cli_mcp: true,
+      bytes_unchanged: true,
+      observations,
+    };
+  } finally {
+    await chmod(executable, originalMode);
+  }
+}

scripts/verify/apple/macos-bundle.mjs

@@ -16,6 +16,7 @@ import {
 } from "../../fixtures/apple/macos-bundle.mjs";
 import { verifyDyldEnvironment } from "./dyld-environment.mjs";
 import { verifyDylibResolution } from "./macos-dylib-e2e.mjs";
+import { verifyMachOOccurrences } from "./macho-occurrences.mjs";
 
 const exec = promisify(execFile);
 
@@ -67,7 +68,8 @@ const EXPECTED_BUNDLES = [
 
 let report;
 try {
-  const { app } = await buildMacosBundleFixture(root);
+  const { app, executable } = await buildMacosBundleFixture(root);
+  const machoOccurrences = await verifyMachOOccurrences(app, executable);
   const zip = join(root, "MacFixture.zip");
   await exec("/usr/bin/ditto", ["-c", "-k", "--keepParent", app, zip]);
   const staging = join(root, "dmg-source");
@@ -164,6 +166,7 @@ try {
     containers: containers.map(({ format }) => format),
     bundles: EXPECTED_BUNDLES.length,
     dmg_detached: true,
+    macho_occurrences: machoOccurrences,
     dylib_resolution: dylibs,
     dyld_environment: dyldEnvironment,
   };