Add hardening coverage for adoption-critical paths

Co-authored-by: Andrew <andrewxhill@gmail.com>

Author: andrewxhill-ai

PLAN.md

@@ -914,6 +914,11 @@ Must-have scenarios:
 - branch blocks on conflict and leaves protected branch unchanged
 - upstream advances before integration and queue syncs correctly
 - protected branch advances twice before publish and only latest matters
+- concurrent multi-worktree actors preserve queue ordering
+- deleted, moved, relinked, or dirtied source worktrees fail safely after submit
+- inherited pre-push hooks fire on publish success and failure-plus-retry flows
+- `status --json`, lifecycle `events --json`, and daemon JSON logs keep a pinned contract
+- bare-repo plus linked-worktree daemon cycles still operate after temp-dir relocation
 
 ### Soak Tests
 

README.md

@@ -141,6 +141,15 @@ path.
 - policy checks, hook coordination, and repo-managed hooks
 - Homebrew, Nix, GitHub release archives, checksums, and release manifests
 
+Recent hardening coverage now explicitly exercises the adoption-critical paths:
+
+- concurrent multi-worktree submit, integrate, and publish flows
+- deleted, moved, relinked, and dirtied source worktrees after submit
+- external protected-branch advancement while queued work waits
+- inherited `pre-push` hook success and failure-plus-retry publish paths
+- JSON contract tests for `status`, lifecycle `events`, and daemon logs
+- bare-repo plus linked-worktree daemon runs
+
 This repo dogfoods that workflow. The repo-local worktree instructions live in
 [.agents/skills/worktree/SKILL.md](/Users/devrel/Projects/recallnet/mainline/.agents/skills/worktree/SKILL.md),
 and the repo-specific guardrails live in

internal/app/app_test.go

@@ -165,6 +165,159 @@ func TestGlobalJSONForwardsToRunOnceAndPublish(t *testing.T) {
 	}
 }
 
+func TestStatusJSONContractContainsStableTopLevelFields(t *testing.T) {
+	repoRoot, _ := createTestRepoWithRemote(t)
+	initRepoForWorker(t, repoRoot)
+
+	var stdout bytes.Buffer
+	var stderr bytes.Buffer
+	if err := runCLI([]string{"status", "--repo", repoRoot, "--json"}, &stdout, &stderr); err != nil {
+		t.Fatalf("runCLI returned error: %v", err)
+	}
+
+	var payload map[string]any
+	if err := json.Unmarshal(stdout.Bytes(), &payload); err != nil {
+		t.Fatalf("Unmarshal: %v", err)
+	}
+	required := []string{
+		"repository_root",
+		"state_path",
+		"current_worktree",
+		"current_branch",
+		"protected_branch",
+		"protected_branch_sha",
+		"protected_upstream",
+		"counts",
+		"recent_events",
+	}
+	for _, key := range required {
+		if _, ok := payload[key]; !ok {
+			t.Fatalf("expected status json key %q in %+v", key, payload)
+		}
+	}
+}
+
+func TestEventsLifecycleJSONContractContainsStableFields(t *testing.T) {
+	repoRoot, _ := createTestRepoWithRemote(t)
+	initRepoForWorker(t, repoRoot)
+
+	featurePath := filepath.Join(t.TempDir(), "feature-events-contract")
+	runTestCommand(t, repoRoot, "git", "worktree", "add", "-b", "feature/events-contract", featurePath)
+	writeFileAndCommit(t, featurePath, "events.txt", "events\n", "events feature")
+	submitBranch(t, featurePath)
+	runOnce(t, repoRoot)
+
+	var stdout bytes.Buffer
+	var stderr bytes.Buffer
+	if err := runCLI([]string{"events", "--repo", repoRoot, "--json", "--lifecycle", "--limit", "20"}, &stdout, &stderr); err != nil {
+		t.Fatalf("runCLI returned error: %v", err)
+	}
+
+	lines := strings.Split(strings.TrimSpace(stdout.String()), "\n")
+	if len(lines) == 0 {
+		t.Fatalf("expected lifecycle json lines")
+	}
+
+	foundIntegrated := false
+	for _, line := range lines {
+		if strings.TrimSpace(line) == "" {
+			continue
+		}
+		var payload map[string]any
+		if err := json.Unmarshal([]byte(line), &payload); err != nil {
+			t.Fatalf("Unmarshal line %q: %v", line, err)
+		}
+		for _, key := range []string{"event", "repository_root", "timestamp"} {
+			if _, ok := payload[key]; !ok {
+				t.Fatalf("expected lifecycle key %q in %+v", key, payload)
+			}
+		}
+		if payload["event"] == "integrated" {
+			foundIntegrated = true
+			for _, key := range []string{"branch", "sha", "submission_id"} {
+				if _, ok := payload[key]; !ok {
+					t.Fatalf("expected integrated lifecycle key %q in %+v", key, payload)
+				}
+			}
+		}
+	}
+	if !foundIntegrated {
+		t.Fatalf("expected integrated lifecycle event in %q", stdout.String())
+	}
+}
+
+func TestDaemonJSONLogContractContainsStableFields(t *testing.T) {
+	repoRoot, _ := createTestRepoWithRemote(t)
+	initRepoForWorker(t, repoRoot)
+
+	var stdout bytes.Buffer
+	opts := daemonOptions{
+		repoPath: repoRoot,
+		interval: time.Millisecond,
+		jsonLogs: true,
+		idleExit: true,
+	}
+	if err := runDaemonLoop(context.Background(), opts, &stdout); err != nil {
+		t.Fatalf("runDaemonLoop returned error: %v", err)
+	}
+
+	lines := strings.Split(strings.TrimSpace(stdout.String()), "\n")
+	if len(lines) < 2 {
+		t.Fatalf("expected daemon json log lines, got %q", stdout.String())
+	}
+	for _, line := range lines {
+		var payload map[string]any
+		if err := json.Unmarshal([]byte(line), &payload); err != nil {
+			t.Fatalf("Unmarshal line %q: %v", line, err)
+		}
+		for _, key := range []string{"level", "event", "repo", "timestamp"} {
+			if _, ok := payload[key]; !ok {
+				t.Fatalf("expected daemon log key %q in %+v", key, payload)
+			}
+		}
+	}
+}
+
+func TestDaemonProcessesWorkFromBareCloneLinkedWorktree(t *testing.T) {
+	bareDir, worktreePath := createBareCloneWorktree(t)
+
+	var initOut bytes.Buffer
+	var initErr bytes.Buffer
+	if err := runRepoInit([]string{"--repo", worktreePath}, &initOut, &initErr); err != nil {
+		t.Fatalf("runRepoInit returned error: %v", err)
+	}
+	featurePath := filepath.Join(t.TempDir(), "bare-feature")
+	runTestCommand(t, worktreePath, "git", "worktree", "add", "-b", "feature/bare-daemon", featurePath)
+	writeFileAndCommit(t, featurePath, "bare.txt", "bare\n", "bare feature")
+	submitBranch(t, featurePath)
+
+	var stdout bytes.Buffer
+	opts := daemonOptions{
+		repoPath:  worktreePath,
+		interval:  time.Millisecond,
+		maxCycles: 1,
+	}
+	if err := runDaemonLoop(context.Background(), opts, &stdout); err != nil {
+		t.Fatalf("runDaemonLoop returned error: %v", err)
+	}
+
+	if _, err := os.Stat(filepath.Join(worktreePath, "bare.txt")); err != nil {
+		t.Fatalf("expected bare.txt after daemon integration: %v", err)
+	}
+
+	layout, err := git.DiscoverRepositoryLayout(worktreePath)
+	if err != nil {
+		t.Fatalf("DiscoverRepositoryLayout: %v", err)
+	}
+	wantBareDir, err := filepath.EvalSymlinks(bareDir)
+	if err != nil {
+		t.Fatalf("EvalSymlinks(bareDir): %v", err)
+	}
+	if layout.RepositoryRoot != wantBareDir {
+		t.Fatalf("expected bare repository root %q, got %q", wantBareDir, layout.RepositoryRoot)
+	}
+}
+
 func TestDaemonProcessesIntegrationAndPublishWork(t *testing.T) {
 	repoRoot, remoteDir := createTestRepoWithRemote(t)
 	initRepoForWorker(t, repoRoot)

internal/app/publish_test.go

@@ -443,6 +443,117 @@ func TestPublishRespectsHookPolicyBypassingPrePushHook(t *testing.T) {
 	}
 }
 
+func TestRunOncePublishesWithInheritedPrePushHook(t *testing.T) {
+	repoRoot, remoteDir := createTestRepoWithRemote(t)
+	initRepoForWorker(t, repoRoot)
+
+	hookMarker := filepath.Join(t.TempDir(), "pre-push-ran")
+	hookPath := filepath.Join(hooksDirForRepo(t, repoRoot), "pre-push")
+	if err := os.WriteFile(hookPath, []byte("#!/bin/sh\necho hook > "+hookMarker+"\nexit 0\n"), 0o755); err != nil {
+		t.Fatalf("WriteFile: %v", err)
+	}
+
+	cfg, _, err := policy.LoadOrDefault(repoRoot)
+	if err != nil {
+		t.Fatalf("LoadOrDefault: %v", err)
+	}
+	if cfg.Repo.HookPolicy != "inherit" {
+		t.Fatalf("expected default hook policy inherit, got %+v", cfg.Repo.HookPolicy)
+	}
+
+	writeFileAndCommit(t, repoRoot, "inherit.txt", "inherit\n", "main change inherit")
+	localHead := trimNewline(runTestCommand(t, repoRoot, "git", "rev-parse", "HEAD"))
+	queuePublish(t, repoRoot)
+	runOnce(t, repoRoot)
+
+	if payload, err := os.ReadFile(hookMarker); err != nil || strings.TrimSpace(string(payload)) != "hook" {
+		t.Fatalf("expected inherited pre-push hook marker, got %q err=%v", string(payload), err)
+	}
+
+	remoteHead := trimNewline(runTestCommand(t, remoteDir, "git", "rev-parse", "refs/heads/main"))
+	if remoteHead != localHead {
+		t.Fatalf("expected remote head %q, got %q", localHead, remoteHead)
+	}
+}
+
+func TestPublishHookFailureThenManualRetrySucceeds(t *testing.T) {
+	repoRoot, remoteDir := createTestRepoWithRemote(t)
+	initRepoForWorker(t, repoRoot)
+
+	gateFlag := filepath.Join(t.TempDir(), "allow-push")
+	hookPath := filepath.Join(hooksDirForRepo(t, repoRoot), "pre-push")
+	if err := os.WriteFile(hookPath, []byte("#!/bin/sh\nif [ ! -f "+gateFlag+" ]; then\n  echo gate failed >&2\n  exit 9\nfi\nexit 0\n"), 0o755); err != nil {
+		t.Fatalf("WriteFile: %v", err)
+	}
+
+	cfg, _, err := policy.LoadOrDefault(repoRoot)
+	if err != nil {
+		t.Fatalf("LoadOrDefault: %v", err)
+	}
+	if cfg.Repo.HookPolicy != "inherit" {
+		t.Fatalf("expected default hook policy inherit, got %+v", cfg.Repo.HookPolicy)
+	}
+
+	writeFileAndCommit(t, repoRoot, "retry-hook.txt", "retry hook\n", "main change retry hook")
+	localHead := trimNewline(runTestCommand(t, repoRoot, "git", "rev-parse", "HEAD"))
+	queuePublish(t, repoRoot)
+
+	result, err := runOneCycle(repoRoot)
+	if err != nil {
+		t.Fatalf("first runOneCycle returned error: %v", err)
+	}
+	if !strings.Contains(result, "Failed publish request") {
+		t.Fatalf("expected failed publish output, got %q", result)
+	}
+
+	layout, err := git.DiscoverRepositoryLayout(repoRoot)
+	if err != nil {
+		t.Fatalf("DiscoverRepositoryLayout: %v", err)
+	}
+	store := state.NewStore(state.DefaultPath(layout.GitDir))
+	repoRecord, err := store.GetRepositoryByPath(context.Background(), layout.RepositoryRoot)
+	if err != nil {
+		t.Fatalf("GetRepositoryByPath: %v", err)
+	}
+	requests, err := store.ListPublishRequests(context.Background(), repoRecord.ID)
+	if err != nil {
+		t.Fatalf("ListPublishRequests: %v", err)
+	}
+	if len(requests) != 1 || requests[0].Status != "failed" {
+		t.Fatalf("expected failed publish request, got %+v", requests)
+	}
+
+	if err := os.WriteFile(gateFlag, []byte("ok\n"), 0o644); err != nil {
+		t.Fatalf("WriteFile(gateFlag): %v", err)
+	}
+
+	var retryOut bytes.Buffer
+	var retryErr bytes.Buffer
+	if err := runRetry([]string{"--repo", repoRoot, "--publish", strconv.FormatInt(requests[0].ID, 10)}, &retryOut, &retryErr); err != nil {
+		t.Fatalf("runRetry returned error: %v", err)
+	}
+
+	result, err = runOneCycle(repoRoot)
+	if err != nil {
+		t.Fatalf("second runOneCycle returned error: %v", err)
+	}
+	if !strings.Contains(result, "Published request") {
+		t.Fatalf("expected publish success output after retry, got %q", result)
+	}
+
+	remoteHead := trimNewline(runTestCommand(t, remoteDir, "git", "rev-parse", "refs/heads/main"))
+	if remoteHead != localHead {
+		t.Fatalf("expected remote head %q, got %q", localHead, remoteHead)
+	}
+	requests, err = store.ListPublishRequests(context.Background(), repoRecord.ID)
+	if err != nil {
+		t.Fatalf("ListPublishRequests: %v", err)
+	}
+	if requests[0].Status != "succeeded" {
+		t.Fatalf("expected retried publish request to succeed, got %+v", requests[0])
+	}
+}
+
 func TestRunOnceCanPreemptInFlightPublishForNewerTarget(t *testing.T) {
 	repoRoot, remoteDir := createTestRepoWithRemote(t)
 	initRepoForWorker(t, repoRoot)