Add crash-consistent State Anchor maintenance

crates/lazaret-client/tests/state_cli.rs

@@ -0,0 +1,80 @@
+use std::fs;
+
+#[allow(clippy::disallowed_methods, clippy::disallowed_types)]
+#[test]
+fn machine_and_human_discovery_are_versioned_and_content_free() {
+    let fixture = Fixture::new();
+    let machine = fixture.command("list").arg("--json").output().unwrap();
+    assert!(
+        machine.status.success(),
+        "{}",
+        String::from_utf8_lossy(&machine.stderr)
+    );
+    let document: serde_json::Value = serde_json::from_slice(&machine.stdout).unwrap();
+    assert_eq!(document["schema"], "lazaret-state-output-v1");
+    assert_eq!(document["contents_included"], false);
+    assert_eq!(document["anchors"][0]["container_path"], "/usr");
+
+    let human = fixture.command("inspect").output().unwrap();
+    assert!(
+        human.status.success(),
+        "{}",
+        String::from_utf8_lossy(&human.stderr)
+    );
+    let output = String::from_utf8(human.stdout).unwrap();
+    assert!(output.contains("State Anchor /usr"));
+    assert!(output.contains("Persisted file contents were not read or printed."));
+}
+
+#[allow(clippy::disallowed_methods, clippy::disallowed_types)]
+#[test]
+fn reset_refuses_an_arbitrary_container_or_host_path_before_state_access() {
+    let fixture = Fixture::new();
+    let output = fixture
+        .command("reset")
+        .args(["--path", "/tmp/host-upper", "--yes"])
+        .output()
+        .unwrap();
+    assert!(!output.status.success());
+    assert!(
+        String::from_utf8_lossy(&output.stderr)
+            .contains("not an exact configured persistent container path")
+    );
+}
+
+struct Fixture {
+    root: tempfile::TempDir,
+}
+
+impl Fixture {
+    fn new() -> Self {
+        let root = tempfile::tempdir().unwrap();
+        for name in ["workspace", "runtime", "home"] {
+            fs::create_dir(root.path().join(name)).unwrap();
+        }
+        fs::write(
+            root.path().join("config.toml"),
+            format!(
+                "schema = \"lazaret-trusted-host-config-v1\"\n[storage]\ndata_root = \"{}\"\n[network]\ndefault_allow = [\"192.0.2.10/32\"]\n[profiles.default]\nimage = \"example.invalid/state:v1\"\npersistent_dirs = [\"/usr\"]\n[profiles.default.readiness]\ndenied = [{{ address = \"10.20.30.40\", port = 8443 }}]\npermitted = [{{ address = \"192.0.2.10\", port = 443 }}]\ndns = [{{ resolver = \"198.51.100.53\", query = \"example.invalid\" }}]\n",
+                root.path().join("data").display()
+            ),
+        )
+        .unwrap();
+        Self { root }
+    }
+
+    #[allow(clippy::disallowed_types)]
+    fn command(&self, operation: &str) -> std::process::Command {
+        let mut command = std::process::Command::new(env!("CARGO_BIN_EXE_lazaret"));
+        command
+            .arg("state")
+            .arg(operation)
+            .args(["--profile", "default", "--workspace"])
+            .arg(self.root.path().join("workspace"))
+            .arg("--config")
+            .arg(self.root.path().join("config.toml"))
+            .env("HOME", self.root.path().join("home"))
+            .env("XDG_RUNTIME_DIR", self.root.path().join("runtime"));
+        command
+    }
+}