Skip to content

feat: FJ-1420–1424: fault injection, invariants, ISO export, brownfield import, cross-machine deps#17

Open
noahgift wants to merge 323 commits intomainfrom
batch-10-infra-features
Open

feat: FJ-1420–1424: fault injection, invariants, ISO export, brownfield import, cross-machine deps#17
noahgift wants to merge 323 commits intomainfrom
batch-10-infra-features

Conversation

@noahgift
Copy link
Copy Markdown
Contributor

@noahgift noahgift commented Mar 3, 2026

Summary

Test plan

  • 33 new tests across 5 test files (7448 total, 0 failures)
  • Complexity gates pass (cyclomatic ≤30, cognitive ≤25 per function)
  • Spec scorecard updated: 145→150/166

🤖 Generated with Claude Code

noahgift and others added 30 commits February 28, 2026 00:37
…2274)

New CLI flags:
- validate --check-unused-machines: detect machines with no resource refs
- validate --check-tag-consistency: verify kebab-case tag naming
- graph --out-degree: show dependency count per resource
- graph --density: compute edge density ratio
- status --apply-history-count: total applies per machine from event log
- status --lock-file-count: count lock files across fleet
- status --resource-type-distribution: resource type breakdown
- apply --notify-json: JSON notification output (arg wiring)

19 new tests (2255→2274), all passing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
… book

Phase 64 (FJ-773→FJ-780): 8/8 tickets Done — governance & audit intelligence.
Phase 65 defined: operational readiness & deep analysis.
Book updated with validate, graph, status Phase 64 examples.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…(2274→2292)

New CLI flags:
- validate --check-dependency-exists: verify depends_on targets exist
- validate --check-path-conflicts-strict: detect same file path on same machine
- graph --topological-sort: output valid execution order (Kahn's algorithm)
- graph --critical-path-resources: show resources on longest chain
- status --resource-apply-age: time since last apply per resource
- status --machine-uptime: time since first apply per machine
- status --resource-churn: apply frequency per resource from event log
- apply --notify-slack-webhook: Slack webhook notification (arg wiring)

18 new tests (2274→2292), all passing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
… book

Phase 65 (FJ-781→FJ-788): 8/8 tickets Done — operational readiness.
Phase 66 defined: fleet intelligence & compliance.
Book updated with validate, graph, status Phase 65 examples.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…2311)

New CLI flags:
- validate --check-duplicate-names: detect duplicate base names across groups
- validate --check-resource-groups: verify resource groups are non-empty
- graph --sink-resources: show resources with no dependents (leaf nodes)
- graph --bipartite-check: check if dependency graph is bipartite (2-coloring)
- status --last-drift-time: show timestamp of last drift per resource
- status --machine-resource-count: show resource count per machine
- status --convergence-score: weighted convergence score across fleet
- apply --notify-telegram: Telegram notification (arg wiring)

New file: status_fleet_detail.rs.
19 new tests (2292→2311), all passing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
… book

Phase 66 (FJ-789→FJ-796): 8/8 tickets Done — fleet intelligence.
Phase 67 defined: advanced graph analysis & monitoring.
Book updated with validate, graph, status Phase 66 examples.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…J-804, 2329 tests)

Validate: --check-orphan-resources (FJ-797), --check-machine-arch (FJ-801)
Graph: --strongly-connected via Tarjan SCC (FJ-799), --dependency-matrix-csv (FJ-803)
Status: --apply-success-rate (FJ-800), --error-rate (FJ-802), --fleet-health-summary (FJ-804)

Split graph_export.rs → graph_advanced.rs to stay under 500-line limit.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…812, 2329→2350)

Validate: --check-resource-health-conflicts (FJ-805), --check-resource-overlap (FJ-809)
Status: --machine-convergence-history (FJ-806), --drift-history (FJ-810), --resource-failure-rate (FJ-812)
Graph: --resource-weight (FJ-807), --dependency-depth-per-resource (FJ-811)
Apply: Wire --notify-pagerduty into NotifyOpts with PagerDuty Events v2 API (FJ-808)

Split validate_safety.rs -> validate_advanced.rs, tests_graph_core 1/2 -> core_6.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…50→2373)

- validate --check-resource-tags (FJ-813): tag convention enforcement
- status --machine-last-apply (FJ-814): last apply timestamp per machine
- graph --resource-fanin (FJ-815): fan-in count per resource
- apply --notify-discord-webhook (FJ-816): Discord rich embed notifications
- validate --check-resource-state-consistency (FJ-817): state/type validation
- status --fleet-drift-summary (FJ-818): aggregated drift across fleet
- graph --isolated-subgraphs (FJ-819): disconnected subgraph detection
- status --resource-apply-duration (FJ-820): avg apply duration per type
- Split status_fleet_detail.rs → status_operational.rs (500-line limit)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…→2396)

- validate --check-resource-dependencies-complete (FJ-821): dep target existence
- status --machine-resource-health (FJ-822): per-machine health breakdown
- graph --resource-dependency-chain (FJ-823): full chain from root to leaf
- apply --notify-teams-webhook (FJ-824): MS Teams adaptive card notifications
- validate --check-machine-connectivity (FJ-825): address format validation
- status --fleet-convergence-trend (FJ-826): convergence % across fleet
- graph --bottleneck-resources (FJ-827): high fan-in + fan-out detection
- status --resource-state-distribution (FJ-828): state counts across fleet

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…al paths (2396→2419)

Validate: --check-resource-naming-pattern, --check-resource-provider-support
Status: --machine-apply-count, --fleet-apply-history, --resource-hash-changes
Graph: --critical-dependency-path, --resource-depth-histogram
Apply: --notify-slack-blocks

Split graph_advanced.rs → graph_paths.rs (FJ-823/827/831/835) to stay under 500-line limit.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…nce times (2419→2442)

Validate: --check-resource-secret-refs, --check-resource-idempotency-hints
Status: --machine-uptime-estimate, --fleet-resource-type-breakdown, --resource-convergence-time
Graph: --resource-coupling-score, --resource-change-frequency
Apply: --notify-custom-template

New status_insights.rs module. Split try_status_phase68 + try_status_phase71 helpers.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
8 tickets: validate --check-resource-dependency-depth, --check-resource-machine-affinity,
status --machine-drift-age, --fleet-failed-resources, --resource-dependency-health,
graph --resource-impact-score, --resource-stability-score,
apply --notify-custom-webhook. Split validate_advanced→validate_governance (500-line limit).
Extract try_graph_paths helper (cognitive complexity). 2442→2463 tests.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
8 tickets: validate --check-resource-drift-risk, --check-resource-tag-coverage,
status --machine-resource-age-distribution, --fleet-convergence-velocity, --resource-failure-correlation,
graph --resource-dependency-fanout, --resource-dependency-weight,
apply --notify-custom-headers. Extract try_validate_governance helper. 2463→2484 tests.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Implement 8 resource lifecycle & operational intelligence commands:
- FJ-861: validate --check-resource-lifecycle-hooks
- FJ-862: status --machine-resource-churn-rate
- FJ-863: graph --resource-dependency-bottleneck
- FJ-864: apply --notify-custom-json
- FJ-865: validate --check-resource-provider-version
- FJ-866: status --fleet-resource-staleness
- FJ-867: graph --resource-type-clustering
- FJ-868: status --machine-convergence-trend

Split graph_paths→graph_scoring, status_insights→status_predictive.
2507 tests pass, all commands dogfooded.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Implement 8 capacity planning & configuration analytics commands:
- FJ-869: validate --check-resource-naming-convention
- FJ-870: status --machine-capacity-utilization
- FJ-871: graph --resource-dependency-cycle-risk
- FJ-872: apply --notify-custom-filter
- FJ-873: validate --check-resource-idempotency
- FJ-874: status --fleet-configuration-entropy
- FJ-875: graph --resource-impact-radius
- FJ-876: status --machine-resource-freshness

Extract try_status_phase73, collect_type_entropy, flatten find_cycle_risks.
2530 tests pass, all commands dogfooded.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Phase 77 — Operational Maturity & Compliance Automation:
- FJ-877: validate --check-resource-documentation
- FJ-878: status --machine-error-budget
- FJ-879: graph --resource-dependency-health-map
- FJ-880: apply --notify-custom-retry
- FJ-881: validate --check-resource-ownership
- FJ-882: status --fleet-compliance-score
- FJ-883: graph --resource-change-propagation
- FJ-884: status --machine-mean-time-to-recovery

2553 tests pass. All commands dogfooded.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Phase 78 — Automation Intelligence & Fleet Optimization:
- FJ-885: validate --check-resource-secret-exposure
- FJ-886: status --machine-resource-dependency-health
- FJ-887: graph --resource-dependency-depth-analysis
- FJ-888: apply --notify-custom-transform
- FJ-889: validate --check-resource-tag-standards
- FJ-890: status --fleet-resource-type-health
- FJ-891: graph --resource-dependency-fan-analysis
- FJ-892: status --machine-resource-convergence-rate

2576 tests passing. Extracted validate_ownership.rs module.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Phase 79 — Security Hardening & Operational Insights:
- FJ-893: validate --check-resource-privilege-escalation
- FJ-894: status --machine-resource-failure-correlation
- FJ-895: graph --resource-dependency-isolation-score
- FJ-896: apply --notify-custom-batch
- FJ-897: validate --check-resource-update-safety
- FJ-898: status --fleet-resource-age-distribution
- FJ-899: graph --resource-dependency-stability-score
- FJ-900: status --machine-resource-rollback-readiness

2599 tests passing. Milestone: FJ-900 reached.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Phase 80 — Operational Resilience & Configuration Intelligence:
- FJ-901: validate --check-resource-cross-machine-consistency
- FJ-902: status --machine-resource-health-trend
- FJ-903: graph --resource-dependency-critical-path-length
- FJ-904: apply --notify-custom-deduplicate
- FJ-905: validate --check-resource-version-pinning
- FJ-906: status --fleet-resource-drift-velocity
- FJ-907: graph --resource-dependency-redundancy-score
- FJ-908: status --machine-resource-apply-success-trend

2622 tests passing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Predictive Infrastructure Intelligence: dependency completeness
validation, MTTR estimation, centrality scoring, state coverage,
convergence forecasting, bridge detection, error budget forecasting,
custom throttle notifications. 2645 tests passing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Infrastructure Insight & Configuration Maturity: rollback safety
validation, dependency lag detection, clustering coefficient, custom
aggregate notifications, config maturity scoring, fleet dependency
lag, modularity scoring, config drift rate. 2668 tests passing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
noahgift and others added 15 commits March 4, 2026 00:37
…efs PMAT-038)

- #18 Continuous drift monitoring: forjar watch + drift --auto-remediate
- #19 Self-healing drift remediation: already fully implemented in drift.rs
- #62 Timeout enforcement: resource timeout + convergence_budget working
- Score: 101 → 103/166

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
… metadata (Refs PMAT-038)

- Recipe expansion detects version conflicts (same recipe at different versions)
- ApplyStarted event now includes param_count for experiment tracking
- Refactored expand_recipes() into 7 helper functions for complexity compliance
- Updated spec scorecard: 105/166

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…ebug trace (Refs PMAT-038)

- #61: Per-resource `sudo: true` field wraps scripts with sudo bash -c
- #29: `forjar sbom` generates SPDX 2.3 JSON (packages, docker, models, files)
- #17: Parallel fleet drift detection via std::thread::scope
- #109: `forjar apply --trace` prints generated scripts before execution
- Spec scorecard: 105 -> 116/166
- 11 new tests (6 sudo + 5 SBOM)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…AT-038)

- Add brew provider to package resource (check, apply, state_query)
- Idempotent brew install with version pinning (package@version)
- Update unsupported-provider tests from brew to snap
- 8 new brew-specific tests in tests_package.rs
- SBOM now expands recipes before collecting components
- 2 new SBOM tests (recipe fallback, brew packages)
- Book: add brew provider table row + cross-platform section

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…-038)

- `forjar cbom`: scans BLAKE3, age/X25519, SSH, TLS, docker SHA-256
- `forjar prove`: validates codegen completeness, DAG acyclicity,
  hash determinism, state coverage, idempotency structure
- 6 CBOM tests, 7 prove tests (13 new tests total)
- Score: 116 → 120/166 (#33 CBOM, #68 brew, #70 recipe SBOM, #134 prove)
- Book: add CBOM and convergence proof sections

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add native SVG output for `forjar graph --format svg` with grid layout,
color-coded resource types, and arrow-marker edges. Fix clippy warnings
in cbom.rs and prove.rs. Update spec scorecard for #48.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…lineage (Refs PMAT-038)

Add three new CLI commands:
- `forjar privilege-analysis` — least-privilege execution analysis (#38)
- `forjar provenance` — SLSA Level 3 in-toto attestation (#30)
- `forjar lineage` — Merkle DAG configuration lineage (#23)
Also marks SVG graph export (#108) in spec. Split misc_args.rs to stay
under 500-line limit. Score: 120 -> 124/166.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…s PMAT-038)

Add three new CLI commands:
- `forjar bundle` — self-contained recipe bundles with BLAKE3 manifest (#92)
- `forjar model-card` — ML model card generation (#152)
- `forjar agent-sbom` — agent-specific bill of materials (#162)
Score: 124 -> 127/166.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
… (Refs PMAT-038)

- forjar repro-proof: BLAKE3 reproducibility certificate (config + git SHA + store + state)
- forjar bundle --verify: re-hash all files for air-gap integrity verification
- Split dispatch_misc_cmd to reduce cognitive complexity
- Scorecard 127→130/166

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…, dataset lineage (Refs PMAT-039)

- forjar data-freshness: mtime + BLAKE3 artifact freshness with --max-age SLA
- forjar data-validate: source/artifact existence + integrity + store checks
- forjar checkpoint: ML checkpoint listing, --gc --keep N garbage collection
- forjar dataset-lineage: Merkle-hashed data pipeline lineage graph
- Split dispatch_misc_cmd further to keep cognitive complexity <25
- Scorecard 130→136/166

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…eval (Refs PMAT-039)

- forjar sovereignty: jurisdiction/classification/residency compliance audit
- forjar cost-estimate: static resource cost + time analysis by type
- forjar model-eval: ML evaluation pipeline with completion_check + artifact gating
- Scorecard 136→139/166

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…s PMAT-039)

- pforge-mcp-server.yaml: 4-phase MCP server deployment (#155)
- agent-deployment.yaml: composable GPU+model+config+MCP+health (#156)
- multi-agent-fleet.yaml: 3-machine fleet with LB + tool policies (#157,#158,#160,#161)
- Scorecard 139→145/166

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…s, ISO export, brownfield import, cross-machine deps (Refs PMAT-039)

- FJ-1420 (#76): forjar fault-inject — fault scenario generation per resource
- FJ-1421 (#78): forjar invariants — runtime invariant monitors from policies
- FJ-1422 (#91): forjar iso-export — offline deployment bundles with BLAKE3 manifest
- FJ-1423 (#25): forjar import-brownfield — scan dpkg/systemd/config for state import
- FJ-1424 (#11): forjar cross-deps — cross-machine dependency analysis + execution waves
- 33 new tests (7448 total), spec scorecard 145→150/166

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…ulti-config, stack graph (Refs PMAT-039)

- FJ-1425 (#24): forjar state-backend — pluggable state backend trait + local impl
- FJ-1426 (#66): forjar registry-list — versioned recipe registry with BLAKE3
- FJ-1427 (#69): forjar catalog-list — service catalog with parameterized blueprints
- FJ-1428 (#118): forjar multi-apply — multi-config apply ordering via data source deps
- FJ-1429 (#119): forjar stack-graph — stack dependency DAG with cycle detection
- 31 new tests (7479 total), spec scorecard 150→155/166

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…vation, parallel stacks (Refs PMAT-039)

- FJ-1430 (#27): forjar query — composable infrastructure search with filters
- FJ-1431 (#28): forjar query --live — live SSH-based infrastructure probing
- FJ-1432 (#31): forjar sign — BLAKE3-HMAC recipe signing with tamper detection
- FJ-1433 (#34): forjar sign --pq — dual classical + post-quantum signing
- FJ-1434 (#47): forjar preservation — pairwise resource preservation checking
- FJ-1435 (#125): forjar parallel-apply — parallel multi-stack execution waves
- 29 new tests (7508 total), spec scorecard 155→161/166

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
noahgift added a commit that referenced this pull request Mar 4, 2026
…ebug trace (Refs PMAT-038)

- #61: Per-resource `sudo: true` field wraps scripts with sudo bash -c
- #29: `forjar sbom` generates SPDX 2.3 JSON (packages, docker, models, files)
- #17: Parallel fleet drift detection via std::thread::scope
- #109: `forjar apply --trace` prints generated scripts before execution
- Spec scorecard: 105 -> 116/166
- 11 new tests (6 sudo + 5 SBOM)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
noahgift added a commit that referenced this pull request Mar 5, 2026
…ebug trace (Refs PMAT-038)

- #61: Per-resource `sudo: true` field wraps scripts with sudo bash -c
- #29: `forjar sbom` generates SPDX 2.3 JSON (packages, docker, models, files)
- #17: Parallel fleet drift detection via std::thread::scope
- #109: `forjar apply --trace` prints generated scripts before execution
- Spec scorecard: 105 -> 116/166
- 11 new tests (6 sudo + 5 SBOM)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
noahgift added a commit that referenced this pull request Mar 5, 2026
…ebug trace (Refs PMAT-038)

- #61: Per-resource `sudo: true` field wraps scripts with sudo bash -c
- #29: `forjar sbom` generates SPDX 2.3 JSON (packages, docker, models, files)
- #17: Parallel fleet drift detection via std::thread::scope
- #109: `forjar apply --trace` prints generated scripts before execution
- Spec scorecard: 105 -> 116/166
- 11 new tests (6 sudo + 5 SBOM)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
noahgift added a commit that referenced this pull request Mar 5, 2026
…ebug trace (Refs PMAT-038)

- #61: Per-resource `sudo: true` field wraps scripts with sudo bash -c
- #29: `forjar sbom` generates SPDX 2.3 JSON (packages, docker, models, files)
- #17: Parallel fleet drift detection via std::thread::scope
- #109: `forjar apply --trace` prints generated scripts before execution
- Spec scorecard: 105 -> 116/166
- 11 new tests (6 sudo + 5 SBOM)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
noahgift added a commit that referenced this pull request Mar 6, 2026
…ebug trace (Refs PMAT-038)

- #61: Per-resource `sudo: true` field wraps scripts with sudo bash -c
- #29: `forjar sbom` generates SPDX 2.3 JSON (packages, docker, models, files)
- #17: Parallel fleet drift detection via std::thread::scope
- #109: `forjar apply --trace` prints generated scripts before execution
- Spec scorecard: 105 -> 116/166
- 11 new tests (6 sudo + 5 SBOM)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
noahgift added a commit that referenced this pull request Mar 6, 2026
…s DONE

- Rename proof_hash_determinism_real → proof_hash_determinism_bounded
- Rename proof_planner_idempotency_real → proof_planner_idempotency_bounded
- Rename proof_dag_ordering_real → proof_dag_ordering_bounded
- Update kani_proofs.rs deprecation notice → "bounded-model harnesses"
- Falsification report: items #15, #16, #17 → DONE (19/19 resolved)
- Spec 09 Phase 13: mark determine_present_action and hash_desired_state
  debug_assert! as [x] (already exist in planner/mod.rs)

(Refs PMAT-029)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
noahgift added a commit that referenced this pull request Mar 20, 2026
…ebug trace (Refs PMAT-038)

- #61: Per-resource `sudo: true` field wraps scripts with sudo bash -c
- #29: `forjar sbom` generates SPDX 2.3 JSON (packages, docker, models, files)
- #17: Parallel fleet drift detection via std::thread::scope
- #109: `forjar apply --trace` prints generated scripts before execution
- Spec scorecard: 105 -> 116/166
- 11 new tests (6 sudo + 5 SBOM)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
noahgift added a commit that referenced this pull request Mar 20, 2026
…s DONE

- Rename proof_hash_determinism_real → proof_hash_determinism_bounded
- Rename proof_planner_idempotency_real → proof_planner_idempotency_bounded
- Rename proof_dag_ordering_real → proof_dag_ordering_bounded
- Update kani_proofs.rs deprecation notice → "bounded-model harnesses"
- Falsification report: items #15, #16, #17 → DONE (19/19 resolved)
- Spec 09 Phase 13: mark determine_present_action and hash_desired_state
  debug_assert! as [x] (already exist in planner/mod.rs)

(Refs PMAT-029)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@noahgift noahgift force-pushed the main branch 3 times, most recently from 8cf6817 to f100dab Compare March 21, 2026 18:20
noahgift added a commit that referenced this pull request Mar 21, 2026
…ebug trace (Refs PMAT-038)

- #61: Per-resource `sudo: true` field wraps scripts with sudo bash -c
- #29: `forjar sbom` generates SPDX 2.3 JSON (packages, docker, models, files)
- #17: Parallel fleet drift detection via std::thread::scope
- #109: `forjar apply --trace` prints generated scripts before execution
- Spec scorecard: 105 -> 116/166
- 11 new tests (6 sudo + 5 SBOM)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
noahgift added a commit that referenced this pull request Mar 21, 2026
…s DONE

- Rename proof_hash_determinism_real → proof_hash_determinism_bounded
- Rename proof_planner_idempotency_real → proof_planner_idempotency_bounded
- Rename proof_dag_ordering_real → proof_dag_ordering_bounded
- Update kani_proofs.rs deprecation notice → "bounded-model harnesses"
- Falsification report: items #15, #16, #17 → DONE (19/19 resolved)
- Spec 09 Phase 13: mark determine_present_action and hash_desired_state
  debug_assert! as [x] (already exist in planner/mod.rs)

(Refs PMAT-029)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant