holger-recipe/tests/toml_parity.rs
//! **`.nornir/build-variants.toml` IS the code's emission — and this fails for
//! any reason it is not.**
//!
//! 1. the committed bytes are `emit`'s bytes (a row added to the code and not
//! re-emitted, a hand edit, a comment typed into the output: all red);
//! 2. the emission reads back, through the ONE loader, to the declaration;
//! 3. the file is inert — an edit is visible to a reader and invisible to the code;
//! 4. the comparison can go red at all (a set differing by one field is unequal).
use holger_recipe::{declared, emitted_toml, repo_root, HolgerBuildThing};
use nornir_build_thing::emit::first_difference;
use nornir_build_thing::plugin::BuildThing;
use nornir_build_thing::variant::BuildVariantSet;
fn committed() -> String {
let path = BuildVariantSet::conventional_path(&repo_root());
std::fs::read_to_string(&path).unwrap_or_else(|e| panic!("read {}: {e}", path.display()))
}
#[test]
fn the_committed_toml_is_the_codes_emission_byte_for_byte() {
let emitted = emitted_toml().expect("the declaration emits");
if let Some(diff) = first_difference(&committed(), &emitted) {
panic!(
".nornir/build-variants.toml is not the code's emission — the code is the source. \
Run `cargo run -p holger-build-thing -- emit` and commit the result; never edit \
the toml by hand. {diff}"
);
}
let back = BuildVariantSet::from_toml_str(&emitted).expect("the emission parses back");
assert_eq!(back, declared());
back.validate_all().expect("and every variant validates");
holger_recipe::require_committed_is_emitted(&repo_root()).expect("the door's own check agrees");
}
#[test]
fn an_edited_toml_has_zero_effect_on_what_the_code_declares() {
let before = declared();
let edited = emitted_toml()
.unwrap()
.replace("name = \"holger-cli\"", "name = \"holger-cli-edited\"");
let read = BuildVariantSet::from_toml_str(&edited).expect("still parses");
assert_ne!(
read, before,
"the edit must be visible to a reader, else this proves nothing"
);
assert_eq!(
HolgerBuildThing.variants(),
before,
"the code read the file — it must not"
);
}
#[test]
fn the_comparison_reports_red_on_a_set_that_differs_by_one_field() {
let set =
BuildVariantSet::load_file(&BuildVariantSet::conventional_path(&repo_root())).unwrap();
// 22 since HOL-PRODUCTS (2026-10-30): one product list (the four products, the estate's
// server builds, the media pointers, the front, the downstream medium, the DEV rows and
// the three signed wasm guests); the ORIGINAL and OPEN rows are gone.
// 24 and 7 since HOL-CDS-5 (2026-10-30): a downstream's two payloads and media, the
// one-way (`downstream-musl`) and the fetching (`downstream-fetch-musl`).
assert_eq!(set.variants.len(), 24, "24 [[build.variant]] rows");
assert_eq!(set.containers.len(), 1, "1 [[build.container]] row");
assert_eq!(set.installers.len(), 7, "7 [[build.installer]] rows: open, metered, the front's, the two keep media and a downstream's two");
assert_eq!(set.isos.len(), 1, "1 [[build.iso]] row");
let mut p = set.clone();
let with = p
.variants
.iter()
.position(|v| !v.features.is_empty())
.expect("a row names features");
p.variants[with].features.clear();
assert_ne!(p, set, "a variant losing its features must compare unequal");
let mut p = set.clone();
p.installers[0].params.pop();
assert_ne!(p, set, "an installer losing a param must compare unequal");
let mut p = set.clone();
p.installers[0].fixtures.clear();
assert_ne!(
p, set,
"an installer losing its fixture must compare unequal"
);
let mut p = set.clone();
p.isos[0].boot_params.pop();
assert_ne!(
p, set,
"the live medium losing a boot token must compare unequal"
);
}
/// The load-bearing installer values, held to what was measured.
#[test]
fn the_installer_row_carries_its_gate_its_params_and_its_payload() {
let set = declared();
let i = set
.installers
.iter()
.find(|i| i.name == "holger-installer")
.unwrap();
assert_eq!(
i.variant, "mvp-server-musl",
"the STATIC payload — the one that boots metal"
);
assert_eq!(i.env.get("HOLGER_APPLIANCE").map(String::as_str), Some("1"));
assert_eq!(i.cmd, ["start", "--config", "/data/holger.ron"]);
assert_eq!(
i.params.iter().map(|p| p.name.as_str()).collect::<Vec<_>>(),
[
"site",
"hub_conf",
"holger_ron",
"plugin_trust_root",
"intel_trust_policy",
"intel_bundle",
"intel_release_trust",
"bundles_trust_policy",
"underlay",
"data_disks",
"pairing_seed",
"reinstall",
"install_then",
"live_app"
]
);
// ★ THE TWO MEASURED RE-IMAGE FAILURES, answered ON THE DECLARATION.
//
// private-holger-ops' estate.toml says, verbatim, "the installer medium is
// still handed `korp.data.disks=<dev>` — holger's installer row declares a
// `data_disks` param for exactly this". Until 2026-09-17 it did not, and
// `--param data_disks=vdb` was refused by name as an unknown parameter. Both
// keys are korp-installer's own constants, so a rename upstream is a
// compile error here rather than a boot-time silence.
let disks = i.params.iter().find(|p| p.name == "data_disks").unwrap();
assert_eq!(
disks.boot_param,
korp_data_disks_key(),
"the boot-disk election, declared"
);
let reinstall = i.params.iter().find(|p| p.name == "reinstall").unwrap();
assert_eq!(
reinstall.boot_param, "korp.reinstall",
"re-image and re-mint go together"
);
let ron = i.params.iter().find(|p| p.name == "holger_ron").unwrap();
assert!(ron.required && ron.staged_file == "holger.ron");
for p in &i.params {
p.validate()
.unwrap_or_else(|e| panic!("param {}: {e:#}", p.name));
assert!(
p.boot_param.is_empty() || p.boot_param.starts_with("korp."),
"{}",
p.name
);
}
let d = i
.kernel_donor
.as_ref()
.expect("tunnr's kernel, declared (owner 2026-09-27)");
assert_eq!(
(d.repo.as_str(), d.kernel.as_str()),
("tunnr", "tunnr-kernel-sandbox")
);
// The pointer variant resolves by its own name.
let v = set.get("holger-installer").unwrap();
assert_eq!(v.kind, nornir_build_thing::variant::ArtifactKind::Installer);
let logo = repo_root().join(i.boot_logo.as_deref().unwrap());
assert!(
logo.is_file(),
"the declared boot mark is a committed build input: {}",
logo.display()
);
traits::test_support::lfs_bytes(&logo);
}
/// `korp_installer::cmdline::DATA_DISKS_KEY`, spelled here because this crate is
/// dependency-light on purpose and does not link korp-installer. `xtask`'s
/// `appliance_iso` tests hold the real constant against the declaration.
fn korp_data_disks_key() -> &'static str {
"korp.data.disks"
}
/// **The live appliance medium** — the `kind = "iso"` row, held to what it claims.
///
/// ★ ONE MEDIUM FOR BOTH MACHINES. private-holger-ops gives `server` AND `twin`
/// `boot_order = "cdrom,disk"`, and holger's twin is the primary's build with the
/// primary's config on a smaller box (`estate.rs` [estate-twin-drift] refuses
/// anything else). gunnar needs `gunnar-twin` beside `gunnar-installer` because
/// its media bake `--role twin` into the installed cmdline; holger bakes no role
/// at all, so a second row would be a second name over one artifact. This test is
/// where that claim is CHECKED rather than merely written down: exactly one iso
/// row, and it names no role.
#[test]
fn the_live_medium_is_one_row_for_both_machines_and_shares_the_installers_payload() {
let set = declared();
assert_eq!(set.isos.len(), 1, "one live medium serves server AND twin");
let iso = &set.isos[0];
assert_eq!(iso.name, "holger-appliance-iso");
// THE SAME PAYLOAD as the installer — the STATIC musl binary that boots metal.
// Not a cargo line spelled a second time: `from_variant` IS the chain.
assert_eq!(iso.from_variant.as_deref(), Some("mvp-server-musl"));
assert_eq!(
iso.from_variant.as_deref(),
Some(set.installers[0].variant.as_str()),
"the live medium and the installer must carry ONE payload, or they are two products"
);
// The twin rule, as a check: nothing on this medium names a role.
for t in &iso.boot_params {
assert!(
!t.contains("role"),
"no role is baked — the twin is the primary's build: {t}"
);
}
// The medium writes NOTHING, which is why neither re-image failure has a path
// through it. `korp.mode=live` is the token that says so.
assert!(
iso.boot_params.iter().any(|t| t == "korp.mode=live"),
"{:?}",
iso.boot_params
);
assert!(
iso.boot_params.iter().any(|t| t == "korp.entry=holger"),
"an entry, or it stops at the kernel"
);
// ORDER IS LOAD-BEARING: tty0 first for the KVM framebuffer, ttyS0 last so it
// stays /dev/console — the line a boot proof greps.
let consoles: Vec<&String> = iso
.boot_params
.iter()
.filter(|t| t.starts_with("console="))
.collect();
assert_eq!(consoles, ["console=tty0", "console=ttyS0,115200"]);
// The config is read off the initramfs ROOT, not /data: korp REFUSES a seeded
// `data/` on a release medium, and a live appliance has no P3 to stage onto.
let argv: Vec<&str> = iso
.boot_params
.iter()
.skip_while(|t| *t != "--")
.skip(1)
.map(String::as_str)
.collect();
assert_eq!(argv, ["start", "--config", "/holger.ron"]);
let ron = iso.params.iter().find(|p| p.name == "holger_ron").unwrap();
assert!(ron.required && ron.staged_file == "holger.ron");
let d = iso
.kernel_donor
.as_ref()
.expect("tunnr's kernel, declared (owner 2026-09-27)");
assert_eq!(
(d.repo.as_str(), d.kernel.as_str()),
("tunnr", "tunnr-kernel")
);
// A DECLARED staging tree that is not on disk is a hard error at master time,
// so the directory is a committed build input like the boot mark.
assert!(
repo_root().join(&iso.staging).is_dir(),
"the declared staging tree must exist in a fresh checkout: {}",
iso.staging
);
let logo = repo_root().join(iso.boot_logo.as_deref().unwrap());
assert!(
logo.is_file(),
"the live medium wears holger's mark, not korp's raven"
);
traits::test_support::lfs_bytes(&logo);
// The pointer variant resolves by its own name (the Iso/Installer rule).
let v = set.get("holger-appliance-iso").unwrap();
assert_eq!(v.kind, nornir_build_thing::variant::ArtifactKind::Iso);
assert_eq!(
v.suites.iter().map(String::as_str).collect::<Vec<_>>(),
["MVP"]
);
assert!(
!v.is_default,
"the (MVP, server) group's normal case is `mvp-server`"
);
}