Host workspace repositories on Central Gitea

2026-09-03 15:46:52 -07:00
parent 3c2e4a7e85
commit f852c8f0aa
58 changed files with 14864 additions and 2788 deletions
@@ -0,0 +1,148 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { compileCapabilitySource } from "../src/capability-language/index.js";
+import {
+  capabilityFixturePath,
+  capabilityFixtureSource,
+  fixtureId,
+} from "./fixtures/capability-model.js";
+
+test("ANTLR parses and validates a complete capability workspace", () => {
+  const result = compileCapabilitySource(
+    capabilityFixtureSource,
+    capabilityFixturePath,
+  );
+  assert.equal(result.ok, true);
+  if (!result.ok) return;
+  assert.equal(result.workspace.workspaceId, fixtureId.workspace);
+  assert.equal(result.workspace.id, fixtureId.workspaceRevision);
+  assert.equal(result.workspace.interfaceImports.length, 3);
+  assert.equal(result.workspace.conformances.length, 4);
+  assert.equal("id" in result.workspace.conformances[0]!, false);
+});
+
+test("conformances do not accept authored IDs", () => {
+  const result = compileCapabilitySource(
+    capabilityFixtureSource.replace(
+      "conform Project as Named {",
+      'conform Project as Named id "conformance:project:named" {',
+    ),
+    "conformance-id.qx",
+  );
+  assert.equal(result.ok, false);
+  if (result.ok) return;
+  assert.ok(result.diagnostics.some((entry) => entry.phase === "syntax"));
+});
+
+test("the v1 language has no implicit relationship materialization rule", () => {
+  const result = compileCapabilitySource(
+    capabilityFixtureSource.replace(
+      /\n}\s*$/,
+      '\n  materialize ProjectOwner.owner if absent with Person;\n}\n',
+    ),
+    "materialize.qx",
+  );
+  assert.equal(result.ok, false);
+  if (result.ok) return;
+  assert.ok(result.diagnostics.some((entry) => entry.phase === "syntax"));
+});
+
+test("forward declarations make source order irrelevant", () => {
+  const source = capabilityFixtureSource
+    .replace(/  atom Project[^\n]*\n/, "")
+    .replace(/  atom Person[^\n]*\n/, "")
+    .replace(
+      /\n}\s*$/,
+      '\n  atom Project id "atom:project";\n  atom Person id "atom:person";\n}\n',
+    );
+  assert.equal(compileCapabilitySource(source, "reordered.qx").ok, true);
+});
+
+test("interfaces can declare ordinary call operations", () => {
+  const source = capabilityFixtureSource.replace(
+    "    value summary id \"member:summary:summary\" : string {\n      get id \"operation:summary:summary:get\";\n    }",
+    "    operation summarize id \"member:summary:summarize\" : string -> string {\n      call id \"operation:summary:summarize\";\n    }",
+  ).replace(
+    "bind summary.get to package TodoRuntime.summaryGet",
+    "bind summarize.call to package TodoRuntime.summaryGet",
+  ).replace(
+    "operation summaryGet id \"export:todo-runtime:summary-get\" : unit -> string",
+    "operation summaryGet id \"export:todo-runtime:summary-get\" : string -> string",
+  );
+  const result = compileCapabilitySource(source, "operation-member.qx");
+  assert.equal(result.ok, true);
+  if (!result.ok) return;
+  const member = result.workspace.interfaceImports
+    .find((entry) => entry.displayName === "Summary")?.members[0];
+  assert.equal(member?.kind, "operation");
+});
+
+test("state defaults accept recursive JSON values", () => {
+  const source = capabilityFixtureSource.replace(
+    '    policy optimistic-register default "Untitled project";',
+    `    policy optimistic-register default "Untitled project";
+  shared state ProjectMetadata id "slot:project:metadata" on Project : message "example.Metadata"
+    policy optimistic-register default {"labels":["compiler","runtime"],"score":1.5,"enabled":true,"extra":null};`,
+  );
+  const result = compileCapabilitySource(source, "json-default.qx");
+  assert.equal(result.ok, true);
+  if (!result.ok) return;
+  const metadata = result.workspace.sharedAttachments.find(
+    (entry) => entry.id === "slot:project:metadata",
+  );
+  assert.equal(metadata?.kind, "state");
+  if (metadata?.kind !== "state") return;
+  assert.deepEqual(metadata.defaultValue, {
+    labels: ["compiler", "runtime"],
+    score: 1.5,
+    enabled: true,
+    extra: null,
+  });
+});
+
+test("syntax errors retain source locations", () => {
+  const result = compileCapabilitySource(
+    capabilityFixtureSource.replace("atom Project", "atom Project ???"),
+    "broken.qx",
+  );
+  assert.equal(result.ok, false);
+  if (result.ok) return;
+  assert.ok(result.diagnostics.some((entry) =>
+    entry.phase === "syntax" && entry.fileName === "broken.qx" && entry.line > 0
+  ));
+});
+
+test("unknown authoring names are lowering errors", () => {
+  const result = compileCapabilitySource(
+    capabilityFixtureSource.replace(
+      "to state ProjectTitle.read",
+      "to state NotAState.read",
+    ),
+    "unknown-name.qx",
+  );
+  assert.equal(result.ok, false);
+  if (result.ok) return;
+  assert.ok(result.diagnostics.some((entry) =>
+    entry.phase === "lowering" &&
+    entry.code === "unknown-symbol" &&
+    entry.message.includes("NotAState")
+  ));
+});
+
+test("well-formed but invalid programs report semantic paths", () => {
+  const result = compileCapabilitySource(
+    capabilityFixtureSource.replace(
+      "bind name.get to state ProjectTitle.read",
+      "bind name.get to state ProjectTitle.write",
+    ),
+    "invalid-binding.qx",
+  );
+  assert.equal(result.ok, false);
+  if (result.ok) return;
+  const diagnostic = result.diagnostics.find(
+    (entry) => entry.code === "invalid-state-binding",
+  );
+  assert.ok(diagnostic);
+  assert.equal(diagnostic.phase, "validation");
+  assert.ok(diagnostic.path?.includes("operationBindings"));
+});
@@ -0,0 +1,234 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import {
+  compileWorkspaceRevision,
+  computeCapabilityClosure,
+  resolveOperationPlan,
+  validateWorkspaceRevision,
+  valueType,
+  type CapabilityValidationIssueCode,
+  type WorkspaceRevision,
+} from "../src/capability-model/index.js";
+import {
+  fixtureId,
+  makeValidCapabilityWorkspace,
+} from "./fixtures/capability-model.js";
+
+const expectIssue = (
+  workspace: WorkspaceRevision,
+  code: CapabilityValidationIssueCode,
+) => {
+  const issues = validateWorkspaceRevision(workspace);
+  assert.ok(
+    issues.some((entry) => entry.code === code),
+    `Expected ${code}, got:\n${issues
+      .map((entry) => `${entry.code} ${entry.path}: ${entry.message}`)
+      .join("\n")}`,
+  );
+  assert.equal(compileWorkspaceRevision(workspace).ok, false);
+};
+
+const conformance = (
+  workspace: WorkspaceRevision,
+  identity: Pick<(typeof workspace.conformances)[number], "atomId" | "interfaceRevisionId">,
+) => {
+  const result = workspace.conformances.find((entry) =>
+    entry.atomId === identity.atomId &&
+    entry.interfaceRevisionId === identity.interfaceRevisionId
+  );
+  assert.ok(
+    result,
+    `Missing fixture conformance ${identity.atomId} as ${identity.interfaceRevisionId}`,
+  );
+  return result;
+};
+
+test("the representative v1 workspace compiles to native and package plans", () => {
+  const workspace = makeValidCapabilityWorkspace();
+  assert.deepEqual(validateWorkspaceRevision(workspace), []);
+  const compiled = compileWorkspaceRevision(workspace);
+  assert.equal(compiled.ok, true);
+  if (!compiled.ok) return;
+
+  const title = resolveOperationPlan(
+    compiled.plan,
+    fixtureId.project,
+    fixtureId.namedV1,
+    fixtureId.namedGet,
+  );
+  assert.equal(title?.kind, "state");
+  if (title?.kind === "state") {
+    assert.equal(title.binding.slotId, fixtureId.projectTitle);
+    assert.equal(title.binding.primitive, "read");
+    assert.deepEqual(title.attachment.owner, { kind: "workspace" });
+  }
+
+  const owner = resolveOperationPlan(
+    compiled.plan,
+    fixtureId.project,
+    fixtureId.ownedV1,
+    fixtureId.ownerResolve,
+  );
+  assert.equal(owner?.kind, "edge");
+  if (owner?.kind === "edge") {
+    assert.equal(owner.binding.edgeTypeId, fixtureId.projectOwner);
+    assert.deepEqual(owner.attachment.owner, {
+      kind: "conformance",
+      ...fixtureId.projectOwnedConformance,
+    });
+  }
+
+  const summary = resolveOperationPlan(
+    compiled.plan,
+    fixtureId.project,
+    fixtureId.summaryV1,
+    fixtureId.summaryGet,
+  );
+  assert.equal(summary?.kind, "package");
+  if (summary?.kind === "package") {
+    assert.equal(summary.packageRevision.revisionId, fixtureId.todoRuntimeV1);
+    assert.equal(summary.packageExport.id, fixtureId.summaryGetExport);
+    assert.deepEqual(
+      summary.dependencies.map((entry) => [entry.port.id, entry.binding.kind]),
+      [
+        [fixtureId.titlePort, "state"],
+        [fixtureId.namedPort, "receiver-interface"],
+        [fixtureId.personPort, "constructor"],
+      ],
+    );
+  }
+});
+
+test("the closure is an exact tree-shaking boundary", () => {
+  const result = compileWorkspaceRevision(makeValidCapabilityWorkspace());
+  assert.equal(result.ok, true);
+  if (!result.ok) return;
+  const closure = computeCapabilityClosure(result.plan, [
+    { atomId: fixtureId.project, interfaceRevisionId: fixtureId.summaryV1 },
+  ]);
+  assert.deepEqual(closure.conformances, [
+    fixtureId.projectNamedConformance,
+    fixtureId.projectSummaryConformance,
+  ]);
+  assert.deepEqual(closure.packageRevisionIds, [fixtureId.todoRuntimeV1]);
+  assert.deepEqual(closure.attachmentIds, [fixtureId.projectTitle]);
+  assert.deepEqual(closure.constructorAtomIds, [fixtureId.person]);
+});
+
+test("compiled plans are snapshots, not mutable authoring state", () => {
+  const workspace = makeValidCapabilityWorkspace();
+  const result = compileWorkspaceRevision(workspace);
+  assert.equal(result.ok, true);
+  if (!result.ok) return;
+  conformance(workspace, fixtureId.projectNamedConformance)
+    .operationBindings[0]!.binding = {
+      kind: "state",
+      slotId: fixtureId.personName,
+      primitive: "read",
+    };
+  const resolved = resolveOperationPlan(
+    result.plan,
+    fixtureId.project,
+    fixtureId.namedV1,
+    fixtureId.namedGet,
+  );
+  assert.equal(resolved?.kind, "state");
+  if (resolved?.kind === "state") {
+    assert.equal(resolved.binding.slotId, fixtureId.projectTitle);
+  }
+});
+
+test("a conformance binds every operation exactly once", () => {
+  const missing = makeValidCapabilityWorkspace();
+  conformance(missing, fixtureId.projectNamedConformance).operationBindings.pop();
+  expectIssue(missing, "missing-operation-binding");
+
+  const duplicate = makeValidCapabilityWorkspace();
+  const bindings = conformance(
+    duplicate,
+    fixtureId.projectNamedConformance,
+  ).operationBindings;
+  bindings.push(structuredClone(bindings[0]!));
+  expectIssue(duplicate, "duplicate-operation-binding");
+});
+
+test("private attachments are visible only to their owning conformance", () => {
+  const workspace = makeValidCapabilityWorkspace();
+  const binding = conformance(
+    workspace,
+    fixtureId.projectNamedConformance,
+  ).operationBindings[0]!.binding;
+  assert.equal(binding.kind, "state");
+  if (binding.kind !== "state") return;
+  binding.slotId = fixtureId.personName;
+  expectIssue(workspace, "private-attachment-access");
+});
+
+test("native state and edge providers must match operation shape", () => {
+  const stateWorkspace = makeValidCapabilityWorkspace();
+  const state = conformance(
+    stateWorkspace,
+    fixtureId.projectNamedConformance,
+  ).operationBindings[0]!.binding;
+  assert.equal(state.kind, "state");
+  if (state.kind === "state") state.primitive = "write";
+  expectIssue(stateWorkspace, "invalid-state-binding");
+
+  const edgeWorkspace = makeValidCapabilityWorkspace();
+  const edge = conformance(
+    edgeWorkspace,
+    fixtureId.projectOwnedConformance,
+  ).operationBindings[0]!.binding;
+  assert.equal(edge.kind, "edge");
+  if (edge.kind === "edge") edge.primitive = "connect";
+  expectIssue(edgeWorkspace, "invalid-edge-binding");
+});
+
+test("package dependencies are complete, exact, and explicitly injected", () => {
+  const missing = makeValidCapabilityWorkspace();
+  const packageBinding = conformance(
+    missing,
+    fixtureId.projectSummaryConformance,
+  ).operationBindings[0]!.binding;
+  assert.equal(packageBinding.kind, "package");
+  if (packageBinding.kind === "package") packageBinding.dependencies.pop();
+  expectIssue(missing, "invalid-dependency-binding");
+
+  const wrongType = makeValidCapabilityWorkspace();
+  const summaryExport = wrongType.packageImports[0]!.exports.find(
+    (entry) => entry.id === fixtureId.summaryGetExport,
+  );
+  assert.ok(summaryExport);
+  summaryExport.dependencyPorts[0]!.requirement = {
+    kind: "state",
+    valueType: valueType.int32,
+    primitives: ["read"],
+  };
+  expectIssue(wrongType, "invalid-dependency-binding");
+});
+
+test("package receiver requirements cannot depend on themselves", () => {
+  const workspace = makeValidCapabilityWorkspace();
+  const summaryExport = workspace.packageImports[0]!.exports.find(
+    (entry) => entry.id === fixtureId.summaryGetExport,
+  );
+  assert.ok(summaryExport && summaryExport.kind === "operation");
+  summaryExport.receiverRequirement = {
+    kind: "all-interfaces",
+    interfaceRevisionIds: [fixtureId.summaryV1],
+  };
+  summaryExport.dependencyPorts = [];
+  const packageBinding = conformance(
+    workspace,
+    fixtureId.projectSummaryConformance,
+  ).operationBindings[0]!.binding;
+  assert.equal(packageBinding.kind, "package");
+  if (packageBinding.kind === "package") packageBinding.dependencies = [];
+  expectIssue(workspace, "cyclic-conformance-requirement");
+});
+
+test("constructors are statically checked", () => {
+  const badConstructor = makeValidCapabilityWorkspace();
+  badConstructor.constructors[0]!.exportId = fixtureId.summaryGetExport;
+  expectIssue(badConstructor, "invalid-constructor");
+});
@@ -0,0 +1,78 @@
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import {
+  capabilityId,
+  type WorkspaceRevision,
+} from "../../src/capability-model/index.js";
+import { compileCapabilitySource } from "../../src/capability-language/index.js";
+
+export const fixtureId = {
+  workspace: capabilityId.workspace("workspace:todo"),
+  workspaceRevision: capabilityId.workspaceRevision("workspace:todo@1"),
+  project: capabilityId.atom("atom:project"),
+  person: capabilityId.atom("atom:person"),
+  namedV1: capabilityId.interfaceRevision("interface:named@1"),
+  ownedV1: capabilityId.interfaceRevision("interface:owned@1"),
+  summaryV1: capabilityId.interfaceRevision("interface:summary@1"),
+  namedGet: capabilityId.operation("operation:named:name:get"),
+  namedSet: capabilityId.operation("operation:named:name:set"),
+  ownerResolve: capabilityId.operation("operation:owned:owner:resolve"),
+  summaryGet: capabilityId.operation("operation:summary:summary:get"),
+  projectTitle: capabilityId.slot("slot:project:title"),
+  personName: capabilityId.slot("slot:person:name"),
+  projectOwner: capabilityId.edgeType("edge:project:owner"),
+  projectOwnerProjection: capabilityId.edgeProjection(
+    "projection:project-owner:owner",
+  ),
+  projectNamedConformance: {
+    atomId: capabilityId.atom("atom:project"),
+    interfaceRevisionId: capabilityId.interfaceRevision("interface:named@1"),
+  },
+  personNamedConformance: {
+    atomId: capabilityId.atom("atom:person"),
+    interfaceRevisionId: capabilityId.interfaceRevision("interface:named@1"),
+  },
+  projectOwnedConformance: {
+    atomId: capabilityId.atom("atom:project"),
+    interfaceRevisionId: capabilityId.interfaceRevision("interface:owned@1"),
+  },
+  projectSummaryConformance: {
+    atomId: capabilityId.atom("atom:project"),
+    interfaceRevisionId: capabilityId.interfaceRevision("interface:summary@1"),
+  },
+  todoRuntimeV1: capabilityId.packageRevision("package:todo-runtime@1"),
+  summaryGetExport: capabilityId.packageExport(
+    "export:todo-runtime:summary-get",
+  ),
+  createPersonExport: capabilityId.packageExport(
+    "export:todo-runtime:create-person",
+  ),
+  titlePort: capabilityId.dependencyPort("port:summary:title"),
+  namedPort: capabilityId.dependencyPort("port:summary:named"),
+  personPort: capabilityId.dependencyPort("port:summary:person"),
+} as const;
+
+export const capabilityFixturePath = resolve(
+  process.cwd(),
+  "test/fixtures/todo.capabilities.qx",
+);
+
+export const capabilityFixtureSource = readFileSync(
+  capabilityFixturePath,
+  "utf8",
+);
+
+export const makeValidCapabilityWorkspace = (): WorkspaceRevision => {
+  const result = compileCapabilitySource(
+    capabilityFixtureSource,
+    capabilityFixturePath,
+  );
+  if (!result.ok) {
+    throw new Error(
+      result.diagnostics
+        .map((entry) => `${entry.phase}/${entry.code}: ${entry.message}`)
+        .join("\n"),
+    );
+  }
+  return structuredClone(result.workspace);
+};
@@ -0,0 +1,90 @@
+workspace Todo id "workspace:todo" revision "workspace:todo@1" commit "1111111111111111111111111111111111111111" {
+  atom Project id "atom:project" doc "A project containing work.";
+  atom Person id "atom:person";
+
+  interface Named id "interface:named" revision "interface:named@1" source {
+    repository "https://repos.quixos.org/interfaces/named.git";
+    commit "2222222222222222222222222222222222222222";
+  } {
+    value name id "member:named:name" : string {
+      get id "operation:named:name:get";
+      set id "operation:named:name:set";
+      watch start id "operation:named:name:watch-start" stop id "operation:named:name:watch-stop";
+    }
+  }
+
+  interface Owned id "interface:owned" revision "interface:owned@1" source {
+    repository "https://repos.quixos.org/interfaces/owned.git";
+    commit "3333333333333333333333333333333333333333";
+  } {
+    relation owner id "member:owned:owner" : exactly-one interface Named {
+      resolve id "operation:owned:owner:resolve";
+      connect id "operation:owned:owner:connect";
+      disconnect id "operation:owned:owner:disconnect";
+      watch start id "operation:owned:owner:watch-start" stop id "operation:owned:owner:watch-stop";
+    }
+  }
+
+  interface Summary id "interface:summary" revision "interface:summary@1" source {
+    repository "https://repos.quixos.org/interfaces/summary.git";
+    commit "4444444444444444444444444444444444444444";
+  } {
+    value summary id "member:summary:summary" : string {
+      get id "operation:summary:summary:get";
+    }
+  }
+
+  package TodoRuntime id "package:todo-runtime" revision "package:todo-runtime@1" source {
+    repository "https://repos.quixos.org/packages/todo-runtime.git";
+    commit "5555555555555555555555555555555555555555";
+  } {
+    operation summaryGet id "export:todo-runtime:summary-get" : unit -> string
+      mode call receiver interfaces [Named] requires {
+        state title id "port:summary:title" : string [read];
+        interface named id "port:summary:named" : Named;
+        constructor person id "port:summary:person" : Person;
+      };
+    constructor createPerson id "export:todo-runtime:create-person" constructs Person : unit;
+  }
+
+  shared state ProjectTitle id "slot:project:title" on Project : string
+    policy optimistic-register default "Untitled project";
+
+  conform Project as Named {
+    bind name.get to state ProjectTitle.read;
+    bind name.set to state ProjectTitle.write;
+    bind name.watch-start to state ProjectTitle.watch-start;
+    bind name.watch-stop to state ProjectTitle.watch-stop;
+  }
+
+  conform Person as Named {
+    private state PersonName id "slot:person:name" on Person : string
+      policy optimistic-register default "Anonymous";
+    bind name.get to state PersonName.read;
+    bind name.set to state PersonName.write;
+    bind name.watch-start to state PersonName.watch-start;
+    bind name.watch-stop to state PersonName.watch-stop;
+  }
+
+  conform Project as Owned {
+    private edge ProjectOwner id "edge:project:owner" {
+      atom Project projection owner id "projection:project-owner:owner" exactly-one;
+      interface Named projection ownedProjects id "projection:project-owner:owned-projects" many;
+    }
+    bind owner.resolve to edge ProjectOwner.owner.resolve;
+    bind owner.connect to edge ProjectOwner.owner.connect;
+    bind owner.disconnect to edge ProjectOwner.owner.disconnect;
+    bind owner.watch-start to edge ProjectOwner.owner.watch-start;
+    bind owner.watch-stop to edge ProjectOwner.owner.watch-stop;
+  }
+
+  conform Project as Summary {
+    bind summary.get to package TodoRuntime.summaryGet with {
+      title to state ProjectTitle;
+      named to interface Named;
+      person to constructor Person;
+    };
+  }
+
+  constructor Person to TodoRuntime.createPerson;
+}
@@ -0,0 +1,93 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import {
+  formatQuixosLock,
+  nixGitInput,
+  parseQuixosLock,
+  retentionTagForCommit,
+} from "../src/resource-lock/index.js";
+
+const quixosCommit = "1".repeat(40);
+const namedCommit = "2".repeat(40);
+const packageCommit = "3".repeat(64);
+const fixture = `quixos-lock version 1 {
+  quixos source {
+    repository "https://gitea.example/quixos/quixos.git";
+    commit "${quixosCommit}";
+  }
+
+  interface Named source {
+    repository "https://repos.example/alice/interface-named.git";
+    commit "${namedCommit}";
+  }
+
+  package TodoRuntime source {
+    repository "ssh://git@repos.example/alice/package-todo-runtime.git";
+    commit "${packageCommit}";
+  }
+}
+`;
+
+test("parses and canonically formats a Git-only repository lock", () => {
+  const parsed = parseQuixosLock(fixture, "quixos.lock");
+  assert.equal(parsed.ok, true);
+  if (!parsed.ok) return;
+  assert.equal(parsed.lock.formatVersion, 1);
+  assert.equal(parsed.lock.quixos.commit, quixosCommit);
+  assert.deepEqual(
+    parsed.lock.resources.map(({ kind, binding }) => ({ kind, binding })),
+    [
+      { kind: "interface", binding: "Named" },
+      { kind: "package", binding: "TodoRuntime" },
+    ],
+  );
+  assert.deepEqual(parseQuixosLock(formatQuixosLock(parsed.lock)), {
+    ok: true,
+    lock: parsed.lock,
+    diagnostics: [],
+  });
+});
+
+test("derives immutable retention and Nix inputs without storing extra identity", () => {
+  const source = {
+    resolver: "git" as const,
+    repository: "https://repos.example/alice/interface-named.git",
+    commit: namedCommit,
+  };
+  const ref = `refs/tags/quixos-reachability/${namedCommit}`;
+  assert.equal(retentionTagForCommit(namedCommit.toUpperCase()), ref);
+  assert.deepEqual(nixGitInput(source), {
+    type: "git",
+    url: source.repository,
+    ref,
+    rev: namedCommit,
+  });
+});
+
+test("rejects mutable revisions, embedded credentials, and duplicate bindings", () => {
+  const parsed = parseQuixosLock(`quixos-lock version 1 {
+    quixos source {
+      repository "https://user:secret@example/quixos.git";
+      commit "main";
+    }
+    interface Named source {
+      repository "file:///tmp/named";
+      commit "${namedCommit}";
+    }
+    interface Named source {
+      repository "https://repos.example/named.git";
+      commit "${namedCommit}";
+    }
+  }`);
+  assert.equal(parsed.ok, false);
+  if (parsed.ok) return;
+  assert.deepEqual(
+    new Set(parsed.diagnostics.map((entry) => entry.code)),
+    new Set([
+      "invalid-git-commit",
+      "embedded-git-credential",
+      "unsupported-git-transport",
+      "duplicate-resource-binding",
+    ]),
+  );
+});