Implement minimal LLM-first AURoscope v1 #25

Merged

mathieu merged 10 commits from work/issue-24-implement-auroscope-v1-from-the-merged-initial-p into main

2026-08-31 10:57:55 +00:00

hephaistos commented

2026-08-31 05:33:25 +00:00

Owner

Closes #24.

What changed

implements all six slices of the merged minimal v1 plan as one Go executable and one internal/app package;
preserves native Paru/Pacman passthrough, PTY foreground ownership, process-group signal forwarding, and official-update-first behavior;
audits every resolved AUR package base through pinned Codex CLI 0.150.1, strict bounded JSON, explicit per-package human decisions, differential SQLite baselines, edit/re-audit, skip, and cancel;
installs a transaction-private Paru [bin] PreBuildCommand through PARU_CONF, reuses the audited CloneDir, and rejects commit/manifest drift;
adds bounded tracked-file identity, mode/type/path validation, terminal escaping, fail-closed Paru record/target classification, and local/path recipe rejection;
adds deterministic fake-Paru/fake-Codex integration tests and a guarded pinned-Paru disposable-Arch release gate.

Verification

CGO_ENABLED=1 go test ./... — pass
CGO_ENABLED=1 go test -race ./... — pass
go vet ./... — pass
Go formatting check and git diff --check — pass
live Codex CLI 0.150.1 isolated final-message contract — pass
AUROSCOPE_E2E_DISPOSABLE_ARCH=1 scripts/e2e-disposable-arch.sh — pass
AUROSCOPE_E2E_SUPPORTED_PARU=1 scripts/e2e-supported-paru.sh — pass against Paru 9ac3578807a87858651e81a02586ceb947686e7c, including native search, real AUR acquisition/build/install, edit/re-audit, exact guard, committed post-audit drift rejection, skip, and audit-free official install

Risks / compatibility

v1 deliberately pins the issue-21 unreleased Paru surface and Codex CLI 0.150.1; incompatible versions fail closed.
the guard addresses ordinary recipe drift, not a malicious same-UID process or compromised host, per the accepted threat boundary.
Codex output is advisory evidence; approval remains exclusively human and does not mean a package is safe.

Review guidance

Focus review on internal/app/paru.go record semantics, review.go Paru config/final target reconstruction, recipe.go edit snapshot and manifest identity, codex.go exact CLI contract, and the real disposable gate in scripts/e2e-supported-paru.sh.

Closes #24. ## What changed - implements all six slices of the merged minimal v1 plan as one Go executable and one `internal/app` package; - preserves native Paru/Pacman passthrough, PTY foreground ownership, process-group signal forwarding, and official-update-first behavior; - audits every resolved AUR package base through pinned Codex CLI 0.150.1, strict bounded JSON, explicit per-package human decisions, differential SQLite baselines, edit/re-audit, skip, and cancel; - installs a transaction-private Paru `[bin]` `PreBuildCommand` through `PARU_CONF`, reuses the audited CloneDir, and rejects commit/manifest drift; - adds bounded tracked-file identity, mode/type/path validation, terminal escaping, fail-closed Paru record/target classification, and local/path recipe rejection; - adds deterministic fake-Paru/fake-Codex integration tests and a guarded pinned-Paru disposable-Arch release gate. ## Verification - `CGO_ENABLED=1 go test ./...` — pass - `CGO_ENABLED=1 go test -race ./...` — pass - `go vet ./...` — pass - Go formatting check and `git diff --check` — pass - live Codex CLI 0.150.1 isolated final-message contract — pass - `AUROSCOPE_E2E_DISPOSABLE_ARCH=1 scripts/e2e-disposable-arch.sh` — pass - `AUROSCOPE_E2E_SUPPORTED_PARU=1 scripts/e2e-supported-paru.sh` — pass against Paru `9ac3578807a87858651e81a02586ceb947686e7c`, including native search, real AUR acquisition/build/install, edit/re-audit, exact guard, committed post-audit drift rejection, skip, and audit-free official install ## Risks / compatibility - v1 deliberately pins the issue-21 unreleased Paru surface and Codex CLI 0.150.1; incompatible versions fail closed. - the guard addresses ordinary recipe drift, not a malicious same-UID process or compromised host, per the accepted threat boundary. - Codex output is advisory evidence; approval remains exclusively human and does not mean a package is safe. ## Review guidance Focus review on `internal/app/paru.go` record semantics, `review.go` Paru config/final target reconstruction, `recipe.go` edit snapshot and manifest identity, `codex.go` exact CLI contract, and the real disposable gate in `scripts/e2e-supported-paru.sh`.

Rows
Columns