WEBDIENSTE/ECC
1
0
Fork 0
mirror of https://github.com/affaan-m/ECC.git synced 2026-09-11 04:07:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(ecc2): preserve harness evidence and legacy IDs

Browse Source
This commit is contained in:
Affaan Mustafa
2026-08-05 16:52:50 -04:00
parent 23bca4f3b7
commit 1f0d590da0
13 changed files with 1551 additions and 289 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/design/ecc-ito-compute-integration.md
+13 -8
View File
@@ -24,9 +24,10 @@ ECC delegates to the canonical Itô package in
`Ito-Markets/ito-cloud-runtime/cli/ito-compute-cli`. ECC does not maintain a
second API client or response schema.
The wrapper exposes only the canonical CLI's `auth`, `find`, `status`, and `evals`
The wrapper exposes only the canonical CLI's `login`, `auth`, `find`, `status`, and `evals`
operations:
ecc ito login [--no-browser]
ecc ito auth
ecc ito find <all required RFQ constraints>
ecc ito status
@@ -36,11 +37,12 @@ The canonical MCP server exposes only `ito_auth`, `ito_find`, and `ito_status`.
ECC includes an opt-in configuration template pointing to the local built MCP
entry. It does not enable the server by default.
The former browser/manual-copy command is retired. `ecc ito auth` delegates to
The former browser/manual-copy command is retired. `ecc ito login` delegates to
the canonical CLI's device authorization, which opens the Itô verification page
by default and persists a device token in macOS Keychain. `--no-browser`
suppresses that page handoff. ECC itself performs no browser automation and
stores no economic state.
stores no economic state. `ecc ito auth` is validation-only, never starts
device login, and rejects `--no-browser`.
## Local install
@@ -63,15 +65,18 @@ For MCP, configure `node` with:
/absolute/path/to/ito-cloud-runtime/cli/ito-compute-cli/dist/bin/ito-mcp.js
Device authorization is the default. ECC forwards only the required device
authorization settings, optional Itô endpoint overrides, and the minimum
process environment. Legacy `ITO_API_KEY` is forwarded only with explicit
`ITO_AUTH_MODE=legacy`; ECC does not inspect or log it.
Device login forwards only required authorization settings, optional Itô
endpoint overrides, and the minimum process environment; it never inherits
`ITO_API_KEY`. The `auth`, `find`, and `status` commands forward `ITO_API_KEY`
directly when configured; `ITO_AUTH_MODE=legacy` is not required. Device tokens
use macOS Keychain by default. Explicit file fallback retains owner-only 0700
directory and 0600 token-file permissions. ECC does not inspect or log secrets.
## Authority and economics
- `auth` starts canonical device authorization, with `--no-browser` available
- `login` starts canonical device authorization, with `--no-browser` available
when the operator does not want the CLI to open the verification page.
- `auth` validates existing credentials only.
- `find` reads live inventory and submits a live authenticated RFQ. An operator
or agent must gather every hard topology/economic constraint and obtain
explicit buyer authority before invoking it.
docs/testing/ecc-ito-real-cli-bridge.tdd.md
+21 -37
View File
@@ -1,14 +1,14 @@
# ECC × Itô Real CLI Bridge — TDD Evidence
Date: 2026-07-23
Date: 2026-08-05
Source plan: requirements were derived from the approved implementation
handoff. No external plan file was executed.
## User journeys
1. As an ECC operator, I can invoke the canonical local Itô `auth`, `find`, and
`status` operations without a duplicate client or browser workflow.
1. As an ECC operator, I can explicitly invoke streaming device `login`, then
use validation-only `auth`, `find`, and `status` without a duplicate client.
2. As a security reviewer, I can prove unsupported operations, missing local
installs, and ECC dry-run requests fail before any child process or network
operation.
@@ -21,62 +21,46 @@ Before production changes:
```text
node tests/scripts/ito-cli-bridge.test.js
Passed: 0
Failed: 9
Passed: 13
Failed: 8
node tests/ci/ito-compute-skill.test.js
Passed: 0
Failed: 4
Passed: 2
Failed: 3
```
The failures were caused by the old browser-only `rent` command and the missing
real skill/install/MCP surfaces.
The failures captured the old combined auth/login surface, legacy-mode API-key
gate, buffered login output, and stale help, skill, MCP, and integration wording.
## GREEN evidence
```text
node tests/scripts/ito-cli-bridge.test.js
Passed: 9
Passed: 21
Failed: 0
node tests/ci/ito-compute-skill.test.js
Passed: 4
Passed: 5
Failed: 0
NODE_PATH=<existing-ecc-checkout>/node_modules \
node scripts/ci/validate-install-manifests.js
Validated 33 install modules, 80 install components, and 7 profiles
npm test
Total Tests: 3159
Passed: 3159
Failed: 0
npm run coverage
Statements: 89.21%
Branches: 79.71%
Functions: 93.96%
Lines: 89.21%
npm run security:ioc-scan
Supply-chain IOC scan passed
node scripts/ci/validate-skills.js
Validated 281 skill directories
```
The isolated worktree temporarily reused the canonical ECC checkout's existing
`node_modules` through an untracked local symlink. The symlink was removed
after validation; no dependency installation or source change was made in the
canonical checkout.
ESLint and Markdown lint also pass for every changed source file. The complete
package dry-run contains the wrapper, environment boundary, skill, and MCP
configuration.
`node tests/scripts/ito-compute-sponsor.test.js` reached 11 passes and 2 failures;
both failures are setup failures because the current worktree lacks `ajv`.
`node scripts/ci/validate-install-manifests.js` is blocked by the same missing
module. No dependency installation was performed.
## Test specification
| Guarantee | Test | Type | Result |
|---|---|---|---|
| Only `auth`, `find`, and `status` spawn | `tests/scripts/ito-cli-bridge.test.js` | end-to-end process contract | PASS |
| `login`, `auth`, `find`, and `status` forward only their reviewed surfaces | `tests/scripts/ito-cli-bridge.test.js` | end-to-end process contract | PASS |
| Login output streams before completion and its exit status propagates | `tests/scripts/ito-cli-bridge.test.js` | async process contract | PASS |
| `auth --no-browser` fails before spawn | `tests/scripts/ito-cli-bridge.test.js` | negative process contract | PASS |
| Full RFQ arguments cross unchanged | `tests/scripts/ito-cli-bridge.test.js` | integration | PASS |
| Only required Itô settings cross the child boundary | `tests/scripts/ito-cli-bridge.test.js` | security integration | PASS |
| Login scrubs the API key; auth/find/status forward it directly; evals stays isolated | `tests/scripts/ito-cli-bridge.test.js` | security integration | PASS |
| Unsupported and dry-run operations fail before spawn | `tests/scripts/ito-cli-bridge.test.js` | negative end-to-end | PASS |
| Missing/relative executables fail with exact local guidance | `tests/scripts/ito-cli-bridge.test.js` | negative end-to-end | PASS |
| Child output and exit code are preserved | `tests/scripts/ito-cli-bridge.test.js` | end-to-end process contract | PASS |