nordisk/edda

crates/nornir-escape/tests/disk_guard.rs

//! **Disk guard** — this workspace's build output must never land on `/`.
//!
//! On 2026-07-31 `/` (md0, 1.9T) reached 94% with 124G free and nobody noticed
//! until it was nearly fatal. `/scratch/cargo` alone held 1.5T of cargo target
//! dirs orphaned by dead sessions. `/scratch` looks like a separate scratch
//! volume and is not — it *is* `/`. `/tmp` is worse: it is tmpfs, i.e. RAM.
//!
//! The convention ("CARGO_TARGET_DIR goes on md1, `~/scratch/cargo/<agent>`")
//! was already written down. Nothing enforced it, and a convention nothing
//! enforces is a suggestion. This test enforces it from inside `cargo test`.
//!
//! It does not read `CARGO_TARGET_DIR`. That variable states an *intention* and
//! can be unset, overridden by `.cargo/config.toml`, or simply lied about. This
//! test asks the only question that matters — *where did this build actually
//! write?* — by locating its own test binary, which cargo placed inside the
//! real target dir. That is ground truth.
//!
//! Companion tooling (thresholds, `--scan` over running builds, the reclaim
//! recipe) lives in `workspace_nordisk/.nornir/guards/`.

use std::os::unix::fs::MetadataExt;
use std::path::Path;

/// Where build output is supposed to go on oden (md1, a different device):
/// `$HOME/scratch/cargo`.
fn sanctioned() -> String {
    format!(
        "{}/scratch/cargo",
        std::env::var("HOME").unwrap_or_default()
    )
}

fn device_of(path: &Path) -> Option<u64> {
    std::fs::metadata(path).ok().map(|m| m.dev())
}

/// Fails RED when this workspace's build output was written to the root
/// filesystem.
///
/// Deliberately silent about *free space*: a guard that fails a build because
/// a disk is comfortable-but-not-full gets deleted by the next engineer. This
/// only fires on a placement violation, which is unambiguous and permanent.
#[test]
fn build_output_is_not_on_the_root_filesystem() {
    let Some(root_dev) = device_of(Path::new("/")) else {
        eprintln!("disk_guard: cannot stat / — skipping");
        return;
    };

    // Only enforce where a separate sanctioned volume actually exists. On a
    // laptop or CI box with one filesystem, /home IS / and there is nothing to
    // enforce; failing there would be crying wolf.
    let sanctioned = sanctioned();
    let Some(sanctioned_dev) = device_of(Path::new(&sanctioned)) else {
        eprintln!("disk_guard: {sanctioned} absent — not oden, skipping");
        return;
    };
    if sanctioned_dev == root_dev {
        eprintln!("disk_guard: single-filesystem machine — nothing to enforce, skipping");
        return;
    }

    // Ground truth: cargo put this binary in the real target dir.
    let exe = std::env::current_exe().expect("current_exe");
    let exe_dev = device_of(&exe).expect("stat of current_exe");

    assert_ne!(
        exe_dev,
        root_dev,
        "\n\
         \n  DISK GUARD: this workspace is building onto the root filesystem.\
         \n\
         \n  test binary : {}\
         \n\
         \n  That path is on the same device as `/`. Build output there filled\
         \n  `/` to 94% on 2026-07-31. Note that `/scratch` IS `/` despite the\
         \n  name, and `/tmp` is RAM.\
         \n\
         \n  Fix — point the build at md1 and rebuild:\
         \n      export CARGO_TARGET_DIR={sanctioned}/<agent>\
         \n\
         \n  Reclaim what is already stranded:\
         \n      workspace_nordisk/.nornir/guards/disk-guard.sh --scan\
         \n",
        exe.display(),
    );
}