Warden plan
tier: hermetic requires: []
Warden's own checking machinery is falsifiable, not aspirational: the env provisioner and the tier gate each fail on bad input and pass on good; every plan in the corpus carries a tier:/requires: declaration the gate accepts; and no /tmp env path has crept back into .warden/ (D-06 as a standing gate, not a one-time edit). Hermetic — reads files already in the checkout only, no DB, no server, no model, no network — so it runs first and cheaply in every invocation.
None beyond a clean checkout. Runs via .warden/run.sh like any other plan; WARDEN_ENV_FILE/WARDEN_LIB/WARDEN_DIR are already exported by the runner.
set -uo pipefail
source "$WARDEN_LIB/assert.sh"
cd "${PROJECT_ROOT:-$(git rev-parse --show-toplevel)}"
OUT_DIR="$(mktemp -d)"
trap 'rm -rf "$OUT_DIR"' EXIT
# Check 1 — the env provisioner selftest (both polarities of provision-env.sh).
ENV_OUT="$OUT_DIR/env-selftest.out"
bash "$WARDEN_DIR/scripts/selftest/env-selftest.sh" > "$ENV_OUT" 2>&1
ENV_STATUS=$?
if [ "$ENV_STATUS" -eq 0 ] && ! grep -q '^WARDEN_RESULT fail ' "$ENV_OUT"; then
warden_pass "env-selftest.sh exits 0 with zero WARDEN_RESULT fail lines"
else
tail -20 "$ENV_OUT"
warden_fail "env-selftest.sh did not pass cleanly (exit=$ENV_STATUS) — see output above"
fi
# Check 2 — the tier gate selftest (both polarities of check-plan-tiers.mjs).
TIERS_OUT="$OUT_DIR/tiers-selftest.out"
bash "$WARDEN_DIR/scripts/selftest/tiers-selftest.sh" > "$TIERS_OUT" 2>&1
TIERS_STATUS=$?
if [ "$TIERS_STATUS" -eq 0 ] && ! grep -q '^WARDEN_RESULT fail ' "$TIERS_OUT"; then
warden_pass "tiers-selftest.sh exits 0 with zero WARDEN_RESULT fail lines"
else
tail -20 "$TIERS_OUT"
warden_fail "tiers-selftest.sh did not pass cleanly (exit=$TIERS_STATUS) — see output above"
fi
# Check 3 — the tier gate accepts the real corpus and reports the ACTUAL file
# count, not a literal, so adding a plan does not fail this assertion spuriously.
PLAN_COUNT=$(ls "$WARDEN_DIR"/plans/*.md | wc -l | tr -d ' ')
GATE_OUT="$OUT_DIR/gate.out"
node "$WARDEN_DIR/scripts/check-plan-tiers.mjs" > "$GATE_OUT" 2>&1
GATE_STATUS=$?
if [ "$GATE_STATUS" -eq 0 ] && grep -q "$PLAN_COUNT plan(s) OK" "$GATE_OUT"; then
warden_pass "check-plan-tiers.mjs exits 0 and reports all $PLAN_COUNT plans inspected"
else
tail -20 "$GATE_OUT"
warden_fail "check-plan-tiers.mjs did not accept the $PLAN_COUNT-plan corpus cleanly (exit=$GATE_STATUS)"
fi
# Check 4 — no /tmp env path survives anywhere in .warden/'s SOURCE (plans,
# scripts, lib, env, docs) (D-06 as a standing gate). Excludes logs/ and runs/:
# those are accumulated runtime output (this very check's own past FAIL lines
# and the asserts.jsonl trail would otherwise self-contaminate the scan) and
# this plan's own detector line, which must name the string literally. Write
# to a file, then grep the file (grep -q on a pipe SIGPIPEs under pipefail).
TMP_HITS="$OUT_DIR/tmp-hits.out"
grep -rn '/tmp/robin-ci-env' "$WARDEN_DIR" \
--exclude-dir=logs --exclude-dir=runs 2>/dev/null \
| grep -v '^'"$WARDEN_DIR"'/plans/00-warden-selftest\.md:' > "$TMP_HITS" || true
if [ ! -s "$TMP_HITS" ]; then
warden_pass "no /tmp/robin-ci-env reference survives anywhere under .warden/"
else
cat "$TMP_HITS"
warden_fail "a /tmp/robin-ci-env reference has returned — see above"
fi
# Check 5 — WARDEN_ENV_FILE is set, provisioned, and mode 600.
if [ -n "${WARDEN_ENV_FILE:-}" ] && [ -f "$WARDEN_ENV_FILE" ] \
&& [ "$(stat -c '%a' "$WARDEN_ENV_FILE" 2>/dev/null || stat -f '%Lp' "$WARDEN_ENV_FILE")" = "600" ]; then
warden_pass "WARDEN_ENV_FILE is set, exists, and is mode 600 ($WARDEN_ENV_FILE)"
else
warden_fail "WARDEN_ENV_FILE is unset, missing, or not mode 600 (${WARDEN_ENV_FILE:-<unset>})"
fi