docs: publish Tend Compose continuity evidence

Export the reviewed allowlisted snapshot from private source commit 07c1655921f21ee5e4fc4d85639d199e8867b17d. This records the Docker Compose activation, schema-compatible rollback, and stateful migration resource findings from Observatory Preview 19 dogfooding.

AI-Assisted: OpenAI Codex
Signed-off-by: Cole Speelman <crspeelman@gmail.com>

internal/provenance/git.go

@@ -0,0 +1,80 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+
+package provenance
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	"gamertan.com/tend/internal/process"
+)
+
+type Source struct {
+	Commit string
+	Epoch  int64
+}
+
+func Inspect(ctx context.Context, runner process.Runner, dir, branch string) (Source, error) {
+	gitDir, err := gitPath(ctx, runner, dir, "--git-dir")
+	if err != nil {
+		return Source{}, fmt.Errorf("inspect Git directory: %w", err)
+	}
+	commonDir, err := gitPath(ctx, runner, dir, "--git-common-dir")
+	if err != nil {
+		return Source{}, fmt.Errorf("inspect Git common directory: %w", err)
+	}
+	if gitDir != commonDir {
+		return Source{}, errors.New("release packaging does not yet support linked Git worktrees; use a clean standalone clone of the exact pushed commit")
+	}
+	status, err := runner.Run(ctx, dir, nil, "git", "status", "--porcelain=v1", "--untracked-files=all")
+	if err != nil {
+		return Source{}, err
+	}
+	if len(status) != 0 {
+		return Source{}, errors.New("source checkout is not clean")
+	}
+	commitOut, err := runner.Run(ctx, dir, nil, "git", "rev-parse", "HEAD")
+	if err != nil {
+		return Source{}, err
+	}
+	commit := strings.TrimSpace(string(commitOut))
+	if len(commit) != 40 {
+		return Source{}, errors.New("source commit is not a full SHA-1 object id")
+	}
+	remoteOut, err := runner.Run(ctx, dir, nil, "git", "ls-remote", "--exit-code", "origin", "refs/heads/"+branch)
+	if err != nil {
+		return Source{}, fmt.Errorf("verify pushed commit: %w", err)
+	}
+	fields := strings.Fields(string(remoteOut))
+	if len(fields) != 2 || fields[0] != commit || fields[1] != "refs/heads/"+branch {
+		return Source{}, errors.New("HEAD is not the exact pushed branch commit")
+	}
+	epochOut, err := runner.Run(ctx, dir, nil, "git", "show", "-s", "--format=%ct", commit)
+	if err != nil {
+		return Source{}, err
+	}
+	epoch, err := strconv.ParseInt(strings.TrimSpace(string(epochOut)), 10, 64)
+	if err != nil || epoch <= 0 {
+		return Source{}, errors.New("commit timestamp is invalid")
+	}
+	return Source{Commit: commit, Epoch: epoch}, nil
+}
+
+func gitPath(ctx context.Context, runner process.Runner, dir, argument string) (string, error) {
+	out, err := runner.Run(ctx, dir, nil, "git", "rev-parse", argument)
+	if err != nil {
+		return "", err
+	}
+	path := strings.TrimSpace(string(out))
+	if path == "" {
+		return "", errors.New("Git returned an empty path")
+	}
+	if !filepath.IsAbs(path) {
+		path = filepath.Join(dir, path)
+	}
+	return filepath.Clean(path), nil
+}

internal/provenance/git_test.go

@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+
+package provenance
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+)
+
+type recordingRunner struct {
+	responses map[string][]byte
+	calls     []string
+}
+
+func (runner *recordingRunner) Run(_ context.Context, _ string, _ map[string]string, name string, args ...string) ([]byte, error) {
+	key := name + " " + strings.Join(args, " ")
+	runner.calls = append(runner.calls, key)
+	response, ok := runner.responses[key]
+	if !ok {
+		return nil, errors.New("unexpected command: " + key)
+	}
+	return response, nil
+}
+
+func TestInspectAcceptsStandaloneExactPushedCheckout(t *testing.T) {
+	commit := strings.Repeat("a", 40)
+	runner := &recordingRunner{responses: map[string][]byte{
+		"git rev-parse --git-dir":                          []byte(".git\n"),
+		"git rev-parse --git-common-dir":                   []byte(".git\n"),
+		"git status --porcelain=v1 --untracked-files=all":  nil,
+		"git rev-parse HEAD":                               []byte(commit + "\n"),
+		"git ls-remote --exit-code origin refs/heads/main": []byte(commit + "\trefs/heads/main\n"),
+		"git show -s --format=%ct " + commit:               []byte("1720000000\n"),
+	}}
+	result, err := Inspect(context.Background(), runner, "/source", "main")
+	if err != nil || result.Commit != commit || result.Epoch != 1720000000 {
+		t.Fatalf("result=%+v err=%v", result, err)
+	}
+}
+
+func TestInspectExplainsUnsupportedLinkedWorktreeBeforeRemoteOrBuildWork(t *testing.T) {
+	runner := &recordingRunner{responses: map[string][]byte{
+		"git rev-parse --git-dir":        []byte("/repo/.git/worktrees/release\n"),
+		"git rev-parse --git-common-dir": []byte("/repo/.git\n"),
+	}}
+	_, err := Inspect(context.Background(), runner, "/source", "main")
+	if err == nil || !strings.Contains(err.Error(), "linked Git worktrees") || len(runner.calls) != 2 {
+		t.Fatalf("calls=%#v err=%v", runner.calls, err)
+	}
+}