Unify workspace authoring, verification and scaffolding workflows

Use exact jj snapshots and one candidate-bound Nix builder for incremental checks, template validation and activation. Keep provenance internal and separate recovery checkpoint failures from local command success.

Provision workspace-scoped managed package/interface repositories with recoverable Central effects. Add TypeScript/React presets, function and dependency commands, and scaffold enrollment for all TODO packages. Install authoring guides and controlled Codex sandbox rules.

Invalidate module resolutions across cutover, including in-flight races, and content-address host platform entries. Strengthen domain-model and verification instructions.

Validated real jj/Nix authoring, React/Slate dependency installation, bottom-up local Git publication, packaged CLI tests, PostgreSQL recovery/auth tests, Web Studio tests and host configuration. Public protocol/helpers and the validated 19-resource TODO template are published. Retained the approved exact private baseline and updated the installation's default template pin to 68d54f0d52be433ebf60bdc1faf7646c57f90307. Master and live deployments remain unchanged. See docs/WORKSPACE_AUTHORING_PROGRESS.md.

test/pin-upgrades.test.ts

@@ -8,6 +8,48 @@ import {execFile as callback} from "node:child_process";
 import {planPinUpgrades, applyPinUpgrades, type UpgradeEffects} from "../src/capability-language/pin-upgrades.js";
 const execFile = promisify(callback);
 
+test("real jj snapshots and immutable Git publication propagate a changed interface into the root", async (context) => {
+  const workbench = await fs.mkdtemp(path.join(os.tmpdir(), "qx-real-upgrade-"));
+  context.after(() => fs.rm(workbench, {recursive: true, force: true}));
+  // Exercise the actual effects with local bare remotes, without external writes.
+  const environment = {
+    GIT_CONFIG_COUNT: "1", GIT_CONFIG_KEY_0: `url.file://${workbench}/remotes/.insteadOf`,
+    GIT_CONFIG_VALUE_0: "https://upgrade.test/", QUIXOS_JJ_NO_CHECKPOINT: "1",
+  };
+  const previous = Object.fromEntries(Object.keys(environment).map(key => [key, process.env[key]]));
+  Object.assign(process.env, environment);
+  context.after(() => {for (const [key, value] of Object.entries(previous)) if (value === undefined) delete process.env[key]; else process.env[key] = value;});
+  const run = async (cwd: string, command: string, args: string[]) => (await execFile(command, args, {cwd})).stdout.trim();
+  await fs.mkdir(path.join(workbench, "remotes"));
+  const nodes = [];
+  for (const [kind, directory, remote] of [["interface", "resources/Named", "named.git"], ["workspace", "root", "workspace.git"]] as const) {
+    const root = path.join(workbench, directory);
+    await fs.mkdir(root, {recursive: true});
+    await run(workbench, "git", ["init", "--bare", path.join(workbench, "remotes", remote)]);
+    await run(root, "jj", ["git", "init", "--colocate"]);
+    await run(root, "git", ["remote", "add", "origin", `https://upgrade.test/${remote}`]);
+    await fs.writeFile(path.join(root, ".gitignore"), ".quixos/\n");
+    const child = nodes[0];
+    await fs.writeFile(path.join(root, "quixos.lock"), `quixos-lock version 1 { quixos source { repository "https://upgrade.test/quixos.git"; commit "${"a".repeat(40)}"; } ${child ? `interface Named source { repository "${child.source.repository}"; commit "${child.source.commit}"; }` : ""} }`);
+    await fs.writeFile(path.join(root, `${kind}.qx`), kind === "interface" ? 'interface Named id "interface:named" revision "interface:named@1" {}' : `workspace W id "workspace:w" revision "workspace:w@1" commit "${"a".repeat(40)}" { import interface Named; atom A id "atom:a"; }`);
+    await run(root, "jj", ["describe", "-m", "Initial source"]);
+    const commit = await run(root, "jj", ["log", "--no-graph", "-r", "@", "-T", "commit_id"]);
+    await run(root, "git", ["push", "origin", `${commit}:refs/tags/quixos-reachability/${commit}`]);
+    nodes.push({kind, directory, source: {repository: `https://upgrade.test/${remote}`, commit}});
+  }
+  await fs.mkdir(path.join(workbench, ".quixos"));
+  await fs.writeFile(path.join(workbench, ".quixos/resource-graph.json"), JSON.stringify({resources: [nodes[0]]}));
+  await fs.appendFile(path.join(workbench, nodes[0].directory, "interface.qx"), "\n// incremental author edit\n");
+  const plan = await planPinUpgrades(workbench, {nodes, bootstrap: true});
+  const result = await applyPinUpgrades(plan);
+  assert.equal(result.activated, false);
+  const graph = JSON.parse(await fs.readFile(path.join(workbench, ".quixos/resource-graph.json"), "utf8"));
+  const commit = graph.resources[0].source.commit;
+  assert.notEqual(commit, nodes[0].source.commit);
+  assert.match(await fs.readFile(path.join(workbench, "root/quixos.lock"), "utf8"), new RegExp(commit));
+  assert.match(await run(workbench, "git", ["--git-dir", path.join(workbench, "remotes/named.git"), "show-ref"]), new RegExp(commit));
+});
+
 test("pin upgrades publish children before parent locks and resume without republishing completed nodes", async (context) => {
   const workbench = await fs.mkdtemp(path.join(os.tmpdir(), "qx-upgrade-test-"));
   context.after(() => fs.rm(workbench, {recursive: true, force: true}));