test(automations): drive Cave against the released Coven daemon (#5217)

[BunsDev]

Summary

Adds pnpm canary:automations-release. It installs the published @opencoven/cli (pinned to 0.4.8) at its locked integrity and drives Cave's own Automations code against that real daemon: the routine client and the history route, across a daemon restart and after the daemon is gone. CI runs it as a new frontend validation lane.

Why

Part of #5217, on the maintainer's instruction (continuation note on #5217). #5509's evidence came from an isolated daemon built from source, and its PR explicitly did not claim an exact-release canary. OpenCoven/coven#1054 lists that same Cave canary as its last open slice. The SDK's counterpart is OpenCoven/sdk#338 and #339.

Changes

• scripts/coven-automations-release-canary.ts. Setup:

  • installs fixtures/coven-automations-release with npm ci --ignore-scripts;
  • requires npm audit signatures to verify registry signatures and attestations;
  • checks coven --version;
  • starts coven daemon serve in an owned 0700 temporary COVEN_HOME, with a minimal environment and no harness.

  It then points Cave at that home and drives Cave's real modules:

  • Capabilities, through the SDK read client (createAutomationReadClient): the routine actions and events.subscribe.v1 must be advertised.
  • Routine client (coven-automations-client): create a paused utc routine, read it, list it, find it has no runs, and revise it. A create the daemon refuses (an invalid id) must stay a typed refusal (degraded: false), not an outage.
  • History route, GET /api/coven-automations/[id]/events: entries 0 Definition created / Revision 1 and 1 Definition revised / Revision 2, with a checkpoint.
  • Daemon restart (SIGTERM, which must remove daemon.json and the socket, then a fresh start): the revision survives. Delete returns true, a second delete returns false, and the routine is then null.
  • Resume: the pre-restart checkpoint returns exactly 2 Definition removed / Revision 3, and the checkpoint after that returns an empty page.
  • Offline: with the daemon stopped, the client must throw degraded: true, and the route must answer 503 {"kind":"unavailable"}.

  The daemon and the home are removed on success, failure, SIGINT or SIGTERM, which exit 130 or 143. Because the npm wrapper cannot forward SIGKILL, the native pid recorded in daemon.json is killed as a last resort. Unix only.

• fixtures/coven-automations-release/: package.json and an npm package-lock.json (v3) pinning @opencoven/cli@0.4.8 and its four platform packages at registry sha512 integrity. .gitignore gets an explicit, commented exception for this one lockfile; the root rule against stray npm lockfiles stays.

• scripts/coven-automations-release-canary.test.ts, 11 tests, wired into test:app:

  • argument parsing;
  • the pin agrees across the lock, package.json, the registry URLs and integrity, the CI lane, and the package script;
  • the scenario passes against an in-memory daemon and fails closed on eight deviations: a missing action, a create that is not paused, a refusal reported as an outage, a revision lost on restart, a non-idempotent delete, a rewinding checkpoint, a fallback read while offline, and offline history that looks available.

• package.json: the canary:automations-release script.

• .github/workflows/ci.yml: a new frontend-validation lane, "Automations release canary". scripts/ci-recovery-workflow.test.mjs pins the matrix and is updated to match.

• scripts/ci-paths.mjs: routes fixtures/coven-automations-release/ to frontend validation, so a pin bump runs the canary lane. This addresses the Copilot finding, and ci-paths.test.mjs pins the routing.

Verification

• pnpm canary:automations-release against the published 0.4.8, about 4 s including the npm install:

  Cave Automations release canary verified: covenVersion=0.4.8 daemonStarts=2 mutations=4 historyEntries=3 historyPages=3 refusal=typed historyResumeAcrossRestart=passed offline=reported-unavailable
  

  No cvc-* temp root and no canary daemon remained afterwards.
• Interruption: SIGTERM sent 1.0, 2.5 and 3.2 s into a run always exited 143 with no temp root or daemon left behind.
• The new test file: 11/11 pass.
• Existing tests:
  • coven-automations-client 11/11;
  • coven-automations-sdk 11/11;
  • the history route 2/2;
  • ci-recovery-workflow;
  • ci-paths 14/14, including the new routing case;
  • check-merge-tree-freshness 9/9;
  • release-promotion-workflow 12/12.
• Repo checks: pnpm typecheck, pnpm lint and pnpm check:tests-wired all pass; all 2,103 test files are wired.

Risk + rollout notes

• Network: the lane needs the npm registry, as pnpm install already does.
• Bumping the pinned release: regenerate the fixture lock with npm install --package-lock-only --ignore-scripts in fixtures/coven-automations-release. The pin test keeps it consistent.
• Not covered:
  • Cave's UI and browser path; Show canonical Automations history on demand #5509 holds that evidence for its head.
  • Versioned v1 commands, which Cave does not send.
  • Runs, approvals and receipts, which are fix(settings): enforce readable accent text #857 territory.
• DCO: the commit has no Signed-off-by line. That certification belongs to the human contributor, so it is left for the maintainer to add if wanted.

[Copilot]

Copilot review overview

🟡 Changes recommended

Fixture-only release bumps currently bypass frontend validation, allowing the exact-release canary to be skipped.

Review effort: Balanced
Findings: 1

Open (1)

• Classify release fixture path for frontend validation · New

What changed in this PR

Adds an exact-release integration canary that exercises Cave Automations against the published Coven daemon.

Changes:

• Installs and verifies pinned @opencoven/cli@0.4.8.
• Tests lifecycle, restart, history checkpoint, refusal, and offline behavior.
• Adds unit coverage and a dedicated CI validation lane.

File	Description
scripts/​coven-automations-release-canary.ts	Implements the daemon canary.
scripts/​coven-automations-release-canary.test.ts	Tests scenario invariants and pin consistency.
scripts/​run-tests.mjs	Wires the new tests.
scripts/​ci-recovery-workflow.test.mjs	Updates the CI matrix contract.
package.json	Adds the canary command.
fixtures/​coven-automations-release/​package.json	Pins the CLI release.
fixtures/​coven-automations-release/​package-lock.json	Locks package integrity.
.gitignore	Allows the fixture lockfile.
.github/​workflows/​ci.yml	Adds the release-canary lane.

Files not reviewed (1)

• fixtures/coven-automations-release/package-lock.json: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.