ci: deploy dogfood-gate, add CRG tests and benchmarks, fix wellknown-enforcement

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/wellknown-enforcement.yml

@@ -33,7 +33,7 @@ jobs:
           [ -f "security.txt" ] && SECTXT="security.txt"
           
           if [ -z "$SECTXT" ]; then
-            echo "::warning::No security.txt found. See https://github.com/{{OWNER}}/well-known-ecosystem"
+            echo "::warning::No security.txt found. See https://github.com/hyperpolymath/well-known-ecosystem"
             exit 0
           fi
           
@@ -69,7 +69,7 @@ jobs:
           
           if [ -n "$MISSING" ]; then
             echo "::warning::Missing RSR recommended files:$MISSING"
-            echo "Reference: https://github.com/{{OWNER}}/well-known-ecosystem/.well-known/"
+            echo "Reference: https://github.com/hyperpolymath/well-known-ecosystem/.well-known/"
           else
             echo "✅ RSR well-known compliant"
           fi

TEST-NEEDS.md

@@ -1,5 +1,7 @@
 # TEST-NEEDS: ShellIntegration.jl
 
+## CRG Grade: C — ACHIEVED 2026-04-04
+
 ## Current State
 
 | Category | Count | Details |

benches/benchmarks.jl

@@ -0,0 +1,35 @@
+# SPDX-License-Identifier: MPL-2.0
+# (PMPL-1.0-or-later preferred; MPL-2.0 required for Julia ecosystem)
+# BenchmarkTools benchmarks for ShellIntegration.jl
+
+using BenchmarkTools
+
+include(joinpath(@__DIR__, "..", "src", "ShellIntegration.jl"))
+using .ShellIntegration
+
+const SUITE = BenchmarkGroup()
+
+SUITE["exec_safe"] = BenchmarkGroup()
+
+SUITE["exec_safe"]["safe_echo"] = @benchmarkable exec_safe(`echo hello`)
+
+SUITE["exec_safe"]["blocked_detection"] = @benchmarkable try
+    exec_safe(`rm -rf /`)
+catch
+end
+
+SUITE["api"] = BenchmarkGroup()
+
+SUITE["api"]["start_valence_shell"] = @benchmarkable start_valence_shell()
+
+SUITE["api"]["method_lookup"] = @benchmarkable begin
+    hasmethod(exec_safe, Tuple{Cmd})
+    hasmethod(run_pwsh, Tuple{String})
+    hasmethod(start_valence_shell, Tuple{})
+end
+
+if abspath(PROGRAM_FILE) == @__FILE__
+    tune!(SUITE)
+    results = run(SUITE, verbose=true)
+    BenchmarkTools.save("benchmarks_results.json", results)
+end

test/e2e_test.jl

@@ -0,0 +1,41 @@
+# SPDX-License-Identifier: MPL-2.0
+# (PMPL-1.0-or-later preferred; MPL-2.0 required for Julia ecosystem)
+# E2E pipeline tests for ShellIntegration.jl
+
+using Test
+
+include(joinpath(@__DIR__, "..", "src", "ShellIntegration.jl"))
+using .ShellIntegration
+
+@testset "E2E Pipeline Tests" begin
+
+    @testset "Safe command execution pipeline" begin
+        # Run a safe command and verify it succeeds
+        result = exec_safe(`echo hello`)
+        @test result isa Base.Process
+        @test success(result)
+    end
+
+    @testset "Dangerous command is blocked" begin
+        # Each dangerous rm -rf variant must be blocked
+        for cmd in [`rm -rf /`, `rm -rf /home`, `rm -rf /tmp/definitely_not_there_xyz`]
+            @test_throws ErrorException exec_safe(cmd)
+        end
+    end
+
+    @testset "exec_safe error message is informative" begin
+        try
+            exec_safe(`rm -rf /tmp/test_shellintegration`)
+            @test false  # Must not reach here
+        catch e
+            @test e isa ErrorException
+            @test occursin("Unsafe command blocked", e.msg)
+        end
+    end
+
+    @testset "start_valence_shell does not crash" begin
+        result = start_valence_shell()
+        @test result === nothing
+    end
+
+end

test/property_test.jl

@@ -0,0 +1,41 @@
+# SPDX-License-Identifier: MPL-2.0
+# (PMPL-1.0-or-later preferred; MPL-2.0 required for Julia ecosystem)
+# Property-based invariant tests for ShellIntegration.jl
+
+using Test
+
+include(joinpath(@__DIR__, "..", "src", "ShellIntegration.jl"))
+using .ShellIntegration
+
+@testset "Property-Based Tests" begin
+
+    @testset "Invariant: rm -rf* patterns are always blocked" begin
+        # Any command starting with rm and containing -rf must be blocked
+        for path in ["/", "/home", "/boot", "/usr", "/etc", "/var"]
+            @test_throws ErrorException exec_safe(`rm -rf $path`)
+        end
+    end
+
+    @testset "Invariant: safe commands always return a Process" begin
+        # Various safe shell commands
+        for cmd in [`echo a`, `echo hello world`, `true`]
+            result = exec_safe(cmd)
+            @test result isa Base.Process
+        end
+    end
+
+    @testset "Invariant: start_valence_shell always returns nothing" begin
+        for _ in 1:10
+            @test start_valence_shell() === nothing
+        end
+    end
+
+    @testset "Invariant: exports are stable across calls" begin
+        for _ in 1:20
+            @test hasmethod(exec_safe, Tuple{Cmd})
+            @test hasmethod(run_pwsh, Tuple{String})
+            @test hasmethod(start_valence_shell, Tuple{})
+        end
+    end
+
+end

test/runtests.jl

@@ -56,4 +56,8 @@ using .ShellIntegration
         @test isdefined(ShellIntegration, :exec_safe)
     end
 
+    # CRG Grade C tests
+    include("e2e_test.jl")
+    include("property_test.jl")
+
 end