orchestra: pre-release WIP snapshot (orchestra-06g4w63545t3rv8sskgkn11b3g-3ff9fe45)

# Conflicts:
#	TASK.md
#	scripts/orchestra_e2e_healthcheck.sh
#	scripts/test_healthcheck.sh

TASK.md

@@ -0,0 +1,64 @@
+# Task 06G4W63545T3RV8SSKGKN11B3G
+
+Run a single named check with --only
+
+- Project: test-e2e
+- Source: gitea:test-e2e/26
+- Priority: 0
+
+## Instructions
+
+Give scripts/orchestra_e2e_healthcheck.sh a `--only <name>` flag that runs a single named check instead of all ten, then prints the usual success line.
+
+Behaviour:
+
+- `--only repo_root_readable` runs that check alone and exits 0 when it passes.
+- `--only nonsense` prints `unknown check: nonsense` on stderr and exits 2.
+- `--only` composes with `--summary`, `--json` and `--quiet`, each keeping its current shape over the single result.
+- Without `--only`, every existing flag behaves exactly as it does today.
+
+Plan this as FIVE phases:
+
+1. A helper that resolves a name to a check function and reports whether the name is known.
+2. Flag parsing for `--only <name>`, with the unknown-name refusal and exit 2.
+3. Running the single resolved check and recording its result through the existing results state.
+4. Composition with `--summary` and `--json`.
+5. The usage text in `--help`, and assertions in scripts/test_healthcheck.sh for each behaviour above.
+
+## Work one phase at a time
+
+Implement phase N, request its verification, and only then begin phase N+1. Do not write the whole change first and verify the phases afterwards.
+
+## Every phase carries both kinds of check
+
+This is a hard requirement of this task. Each phase must have at least one automated check from the policy below. Each phase must also have at least one manual check, confirmed by a human reading the printed output. Orchestra runs the automated ones. A human owns the manual ones, and the phase is not finished until that human signs it off.
+
+## Verification policy for this project
+
+Only two commands may appear on a run: line, exactly:
+
+- ["bash", "-n", "<path>"]
+- ["bash", "scripts/orchestra_e2e_healthcheck.sh"]
+
+Anything else is refused when you seal the plan.
+
+## Research first
+
+Establish at least three findings with distinct confidence: at least one fact, one inference, one assumption.
+
+## Handoff behaviour
+
+Behave normally. If Orchestra asks you to write a handoff report, write it and stop.
+
+Acceptance:
+- `--only <name>` runs exactly one check.
+- An unknown name exits 2 with a message on stderr.
+- `--only` composes with `--summary`, `--json` and `--quiet`.
+- Every existing flag is unchanged when `--only` is absent.
+
+## Completion
+
+Run the configured quality gate. When the task is ready for the worker to verify and deliver, create `.orchestra/done`. Do not write a prose completion report.
+
+This file is immutable for the lifetime of the task (§6.2) — its hash is
+carried in every handoff and re-verified on every pickup. Do not edit it.

scripts/orchestra_e2e_healthcheck.sh

@@ -0,0 +1,216 @@
+#!/usr/bin/env bash
+
+readonly VERSION=1.0.0
+readonly SUCCESS_MESSAGE='OK - all healthchecks passed'
+readonly ROOT=$(cd "$(dirname "$0")/.." && pwd)
+
+# Space-separated check names; each has a check_<name> function.
+CHECKS="repo_root_readable scripts_dir_present healthcheck_executable_bit
+selftest_present test_healthcheck_present readme_present
+no_crlf_line_endings no_tabs_in_scripts
+shebang_is_bash usage_text_mentions_every_flag"
+
+# check_exists <name>: true when <name> is one of the CHECKS names.
+check_exists() {
+  case " $(printf '%s ' $CHECKS) " in
+    *" $1 "*) return 0 ;;
+  esac
+  return 1
+}
+
+# name=ok / name=fail pairs, in run order.
+RESULTS=
+FAILED=0
+TOTAL=0
+
+# record <name> <status>: append one outcome to the results state.
+record() {
+  RESULTS="$RESULTS $1=$2"
+  TOTAL=$((TOTAL + 1))
+  [ "$2" = ok ] || FAILED=$((FAILED + 1))
+}
+
+check_repo_root_readable() { [ -d "$ROOT" ] && [ -r "$ROOT" ]; }
+check_scripts_dir_present() { [ -d "$ROOT/scripts" ]; }
+check_healthcheck_executable_bit() { [ -x "$ROOT/scripts/orchestra_e2e_healthcheck.sh" ]; }
+check_selftest_present() { [ -f "$ROOT/scripts/orchestra_e2e_selftest.sh" ]; }
+check_test_healthcheck_present() { [ -f "$ROOT/scripts/test_healthcheck.sh" ]; }
+check_readme_present() { [ -f "$ROOT/README.md" ]; }
+
+check_no_crlf_line_endings() {
+  [ -d "$ROOT/scripts" ] || return 1
+  ! grep -qU $'\r' "$ROOT"/scripts/*.sh "$ROOT/README.md" 2>/dev/null
+}
+
+check_no_tabs_in_scripts() {
+  [ -d "$ROOT/scripts" ] || return 1
+  ! grep -q "$(printf '\t')" "$ROOT"/scripts/*.sh 2>/dev/null
+}
+
+check_shebang_is_bash() {
+  [ -d "$ROOT/scripts" ] || return 1
+  local f
+  for f in "$ROOT"/scripts/*.sh; do
+    [ "$(head -n 1 "$f")" = '#!/usr/bin/env bash' ] || return 1
+  done
+}
+
+check_usage_text_mentions_every_flag() {
+  local text flag
+  text=$(usage text)
+  for flag in --quiet --json --help; do
+    case "$text" in
+      *"$flag"*) ;;
+      *) return 1 ;;
+    esac
+  done
+}
+
+# now_us: current time in microseconds. Strips any locale decimal separator.
+now_us() { printf '%s' "${EPOCHREALTIME//[!0-9]/}"; }
+
+# elapsed_ms <start-us>: whole milliseconds since <start-us>.
+elapsed_ms() { printf '%s' "$(( ($(now_us) - $1) / 1000 ))"; }
+
+# emit <format> <template> [args...]: the single output path.
+# format: text or json print; none suppresses (--quiet). Explicit argument,
+# never read from an enclosing variable.
+emit() {
+  local format=$1
+  shift
+  [ "$format" = none ] || printf "$@"
+}
+
+# usage <format>: the --help body. Also the source check_usage_text_mentions_every_flag
+# reads, so the flag list has exactly one home.
+usage() {
+  emit "$1" 'Usage: %s [--quiet] [--json] [--summary] [--timing] [--strict] [--list-checks] [--only <name>]\n\n' "${0##*/}"
+  emit "$1" 'Healthcheck script for Orchestra E2E tests.\n'
+  emit "$1" 'Exits 0 with a success message if all checks pass.\n'
+  emit "$1" '  --quiet  Suppress the success message; still exits 0.\n'
+  emit "$1" '  --json   Print a single-line JSON result; still exits 0.\n'
+  emit "$1" '  --help   Print this usage text and exit 0.\n'
+  emit "$1" '  --summary  Print one line per check before the success message.\n'
+  emit "$1" '  --timing Print elapsed milliseconds for the run.\n'
+  emit "$1" '  --strict Reject an unrecognised flag: exits 2.\n'
+  emit "$1" '  --list-checks  Print the name of each check; exits 0.\n'
+  emit "$1" '  --only <name>  Run only the named check; exits 2 if unknown.\n'
+  emit "$1" '\nChecks:\n'
+  local name
+  for name in $CHECKS; do
+    emit "$1" '  %s\n' "$name"
+  done
+  emit "$1" '\nVersion: %s\n' "$VERSION"
+}
+
+main() {
+  local start_us
+  start_us=$(now_us)
+  local quiet=
+  local json=
+  local summary=
+  local timing=
+  local strict=
+  local unknown=
+  local only=
+  local expect_only=
+  for arg in "$@"; do
+    if [ -n "$expect_only" ]; then
+      only=$arg
+      expect_only=
+      continue
+    elif [ "$arg" = --only ]; then
+      expect_only=1
+    elif [ "$arg" = --help ]; then
+      usage text
+      exit 0
+    elif [ "$arg" = --list-checks ]; then
+      local listed
+      for listed in $CHECKS; do
+        emit text '%s\n' "$listed"
+      done
+      exit 0
+    elif [ "$arg" = --quiet ]; then
+      quiet=1
+    elif [ "$arg" = --json ]; then
+      json=1
+    elif [ "$arg" = --summary ]; then
+      summary=1
+    elif [ "$arg" = --timing ]; then
+      timing=1
+    elif [ "$arg" = --strict ]; then
+      strict=1
+    else
+      [ -n "$unknown" ] || unknown=$arg
+    fi
+  done
+
+  if [ -n "$expect_only" ]; then
+    printf -- '--only requires a check name\n' >&2
+    exit 2
+  fi
+
+  if [ -n "$only" ] && ! check_exists "$only"; then
+    printf 'unknown check: %s\n' "$only" >&2
+    exit 2
+  fi
+
+  if [ -n "$strict" ] && [ -n "$unknown" ]; then
+    printf 'unknown flag: %s\n' "$unknown" >&2
+    exit 2
+  fi
+
+  local to_run=$CHECKS
+  [ -n "$only" ] && to_run=$only
+
+  local name
+  for name in $to_run; do
+    if "check_$name"; then
+      record "$name" ok
+    else
+      record "$name" fail
+    fi
+  done
+
+  local format=text
+  [ -n "$quiet" ] && format=none
+  [ -n "$json" ] && format=json
+
+  if [ "$FAILED" -gt 0 ]; then
+    local entry
+    for entry in $RESULTS; do
+      [ "${entry#*=}" = fail ] && emit "$format" 'FAIL - %s\n' "${entry%=*}"
+    done
+    exit 1
+  fi
+
+  local elapsed
+  elapsed=$(elapsed_ms "$start_us")
+
+  if [ "$format" = json ]; then
+    local timings=
+    [ -n "$timing" ] && timings=",\"timings\":{\"healthchecks\":$elapsed}"
+    emit "$format" '{"status":"ok","checks":%d%s}\n' "$TOTAL" "$timings"
+    exit 0
+  fi
+
+  if [ -n "$summary" ]; then
+    local entry
+    for entry in $RESULTS; do
+      emit "$format" '%s: %s\n' "${entry%=*}" "${entry#*=}"
+    done
+  fi
+
+  if [ -n "$timing" ]; then
+    emit "$format" 'healthchecks: %sms\n' "$elapsed"
+  fi
+
+  emit "$format" '%s\n' "$SUCCESS_MESSAGE"
+  exit 0
+}
+
+main "$@"
+
+# Rig: an operator edit made after phase-1 was signed off.
+
+# Rig: a second tree move, with no new sign-off.

scripts/orchestra_e2e_selftest.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Self-test for the Orchestra E2E healthcheck.
+
+here=$(cd "$(dirname "$0")" && pwd)
+healthcheck="$here/orchestra_e2e_healthcheck.sh"
+
+# fail <assertion> <captured stdout>: always echo what the healthcheck printed,
+# so a red run is diagnosable without rerunning it by hand.
+fail() {
+  printf 'selftest: FAILED %s\n' "$1" >&2
+  printf 'selftest: healthcheck stdout was:\n%s\n' "$2" >&2
+  exit 1
+}
+
+# plain run
+out=$(bash "$healthcheck")
+status=$?
+
+[ "$status" -eq 0 ] || fail "plain run exit status: want 0, got $status" "$out"
+case "$out" in
+  *OK*) ;;
+  *) fail "plain run stdout contains OK" "$out" ;;
+esac
+
+# --json run
+jout=$(bash "$healthcheck" --json)
+jstatus=$?
+
+[ "$jstatus" -eq 0 ] || fail "--json run exit status: want 0, got $jstatus" "$jout"
+jlines=$(printf '%s\n' "$jout" | wc -l)
+[ "$jlines" -eq 1 ] || fail "--json run line count: want 1, got $jlines" "$jout"
+case "$jout" in
+  '{"status":'*) ;;
+  *) fail '--json run stdout prefix: want {"status":' "$jout" ;;
+esac
+
+# --strict rejects an unknown flag
+sout=$(bash "$healthcheck" --strict --nonsense 2>&1)
+sstatus=$?
+
+[ "$sstatus" -eq 2 ] || fail "--strict --nonsense exit status: want 2, got $sstatus" "$sout"
+
+# --strict alone is accepted
+gout=$(bash "$healthcheck" --strict)
+gstatus=$?
+
+[ "$gstatus" -eq 0 ] || fail "--strict run exit status: want 0, got $gstatus" "$gout"
+
+printf 'selftest: ok\n'

scripts/test_healthcheck.sh

@@ -0,0 +1,124 @@
+#!/usr/bin/env bash
+# Self-check for orchestra_e2e_healthcheck.sh.
+
+HC="$(dirname "$0")/orchestra_e2e_healthcheck.sh"
+OK='OK - all healthchecks passed'
+NAMES='repo_root_readable scripts_dir_present healthcheck_executable_bit
+selftest_present test_healthcheck_present readme_present
+no_crlf_line_endings no_tabs_in_scripts
+shebang_is_bash usage_text_mentions_every_flag'
+USAGE="$(printf 'Usage: orchestra_e2e_healthcheck.sh [--quiet] [--json] [--summary] [--timing] [--strict] [--list-checks] [--only <name>]\n\nHealthcheck script for Orchestra E2E tests.\nExits 0 with a success message if all checks pass.\n  --quiet  Suppress the success message; still exits 0.\n  --json   Print a single-line JSON result; still exits 0.\n  --help   Print this usage text and exit 0.\n  --summary  Print one line per check before the success message.\n  --timing Print elapsed milliseconds for the run.\n  --strict Reject an unrecognised flag: exits 2.\n  --list-checks  Print the name of each check; exits 0.\n  --only <name>  Run only the named check; exits 2 if unknown.\n\nChecks:\n  repo_root_readable\n  scripts_dir_present\n  healthcheck_executable_bit\n  selftest_present\n  test_healthcheck_present\n  readme_present\n  no_crlf_line_endings\n  no_tabs_in_scripts\n  shebang_is_bash\n  usage_text_mentions_every_flag\n\nVersion: 1.0.0')"
+fails=0
+
+check() { # check <expected-stdout> <label> [args...]
+  local want=$1 label=$2 got status
+  shift 2
+  got=$(bash "$HC" "$@" 2>/dev/null)
+  status=$?
+  if [ "$got" != "$want" ] || [ "$status" -ne 0 ]; then
+    printf 'FAIL: %s (exit=%s)\n---got---\n%s\n---want---\n%s\n' "$label" "$status" "$got" "$want"
+    fails=$((fails + 1))
+  fi
+}
+
+contains() { # contains <needle> <label> [args...]
+  local want=$1 label=$2 got status
+  shift 2
+  got=$(bash "$HC" "$@" 2>/dev/null)
+  status=$?
+  if [ "$status" -ne 0 ] || [ "${got#*"$want"}" = "$got" ]; then
+    printf 'FAIL: %s (exit=%s)\n---missing---\n%s\n---in---\n%s\n' \
+      "$label" "$status" "$want" "$got"
+    fails=$((fails + 1))
+  fi
+}
+
+check "$OK" 'no args'
+check '' '--quiet' --quiet
+check "$USAGE" '--help' --help
+check "$USAGE" '--help --quiet' --help --quiet
+check "$USAGE" '--quiet --help' --quiet --help
+check "$OK" 'unknown flag ignored' --bogus
+
+for name in $NAMES; do
+  contains "$name" "--help names $name" --help
+done
+
+# All ten names in one run's output.
+help_out=$(bash "$HC" --help 2>/dev/null)
+missing=
+for name in $NAMES; do
+  [ "${help_out#*"$name"}" = "$help_out" ] && missing="$missing $name"
+done
+if [ -n "$missing" ]; then
+  printf 'FAIL: --help lists all ten check names\n---missing---\n%s\n' "$missing"
+  fails=$((fails + 1))
+fi
+
+# --list-checks prints one name per line and nothing else.
+listed=$(bash "$HC" --list-checks 2>/dev/null)
+want_listed=$(printf '%s\n' $NAMES)
+if [ "$listed" != "$want_listed" ]; then
+  printf 'FAIL: --list-checks\n---got---\n%s\n---want---\n%s\n' "$listed" "$want_listed"
+  fails=$((fails + 1))
+fi
+
+# --summary prints one name: outcome line per check, then the success line.
+summary_out=$(bash "$HC" --summary 2>/dev/null)
+for name in $NAMES; do
+  case "$summary_out" in
+    *"$name: ok"*) ;;
+    *) printf 'FAIL: --summary omits %s\n' "$name"; fails=$((fails + 1)) ;;
+  esac
+done
+case "$summary_out" in
+  *"$OK") ;;
+  *) printf 'FAIL: --summary does not end with the success line\n'; fails=$((fails + 1)) ;;
+esac
+
+# --timing prints an elapsed line, and composes with --json and --quiet.
+contains 'healthchecks:' '--timing' --timing
+contains '"timings":{"healthchecks":' '--timing --json' --timing --json
+check '' '--timing --quiet' --timing --quiet
+
+# --strict rejects an unrecognised flag; on its own it changes nothing.
+strict_out=$(bash "$HC" --strict --nonsense 2>&1)
+strict_status=$?
+if [ "$strict_status" -ne 2 ] || [ "${strict_out#*unknown flag}" = "$strict_out" ]; then
+  printf 'FAIL: --strict --nonsense (exit=%s)\n---got---\n%s\n' "$strict_status" "$strict_out"
+  fails=$((fails + 1))
+fi
+check "$OK" '--strict alone' --strict
+
+# --only runs exactly one check and composes with the output flags.
+check "$OK" '--only' --only repo_root_readable
+check '' '--only --quiet' --only repo_root_readable --quiet
+check '{"status":"ok","checks":1}' '--only --json' --only repo_root_readable --json
+
+only_summary=$(bash "$HC" --only repo_root_readable --summary 2>/dev/null)
+want_only_summary=$(printf 'repo_root_readable: ok\n%s' "$OK")
+if [ "$only_summary" != "$want_only_summary" ]; then
+  printf 'FAIL: --only --summary\n---got---\n%s\n---want---\n%s\n' \
+    "$only_summary" "$want_only_summary"
+  fails=$((fails + 1))
+fi
+
+# An unknown check name refuses on stderr with exit 2.
+only_out=$(bash "$HC" --only nonsense 2>&1)
+only_status=$?
+if [ "$only_status" -ne 2 ] || [ "${only_out#*unknown check}" = "$only_out" ]; then
+  printf 'FAIL: --only nonsense (exit=%s)\n---got---\n%s\n' "$only_status" "$only_out"
+  fails=$((fails + 1))
+fi
+
+# --only with no value refuses with exit 2.
+missing_only=$(bash "$HC" --only 2>&1)
+missing_status=$?
+if [ "$missing_status" -ne 2 ]; then
+  printf 'FAIL: --only with no value (exit=%s)\n---got---\n%s\n' \
+    "$missing_status" "$missing_only"
+  fails=$((fails + 1))
+fi
+
+[ "$fails" -eq 0 ] || exit 1
+printf 'all checks passed\n'