proxywar-commander-starter/starter-contract.node.mjs at main · 0xNad/proxywar-commander-starter · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
import assert from "node:assert/strict";
import { readFile } from "node:fs/promises";
import test from "node:test";

const expectedBase =
  "ghcr.io/0xnad/proxywar-commander-public-base@sha256:75d5738231a79d10d224e7468b02f4531028b28486c39c13148e310be38fd360";
const expectedPlayer = "/app/proxywar/coworld-adapter/src/commander-player.ts";
const expectedModel = "us.anthropic.claude-sonnet-4-6";

test("pins the attested public base and installs the production Commander entrypoint", async () => {
  const dockerfile = await readFile(
    new URL("Dockerfile", import.meta.url),
    "utf8",
  );
  assert.match(dockerfile, new RegExp(`^FROM ${expectedBase}$`, "m"));
  assert.match(dockerfile, /^ARG STARTER_SOURCE_SHA$/m);
  assert.match(dockerfile, /^RUN test -n "\$\{STARTER_SOURCE_SHA\}"$/m);
  assert.match(
    dockerfile,
    /org\.opencontainers\.image\.revision="\$\{STARTER_SOURCE_SHA\}"/,
  );
  assert.match(dockerfile, new RegExp(expectedPlayer.replaceAll("/", "\\/")));
  assert.match(dockerfile, /^COPY commander-player\.ts /m);
  assert.match(dockerfile, /^COPY commander-production-runtime\.ts /m);
  assert.doesNotMatch(dockerfile, /commander-xp-player/);
  assert.doesNotMatch(dockerfile, /--arm=/);
});

test("launch uploads the production argv with the exact Bedrock model", async () => {
  const launch = await readFile(new URL("launch.sh", import.meta.url), "utf8");
  assert.match(launch, new RegExp(expectedPlayer.replaceAll("/", "\\/")));
  assert.match(launch, new RegExp(`MODEL="${expectedModel}"`));
  assert.match(launch, /--bedrock-model "\$MODEL"/);
  assert.match(launch, /coworld submit/);
  assert.match(launch, /COWORLD_PACKAGE="coworld==0\.1\.42"/);
  assert.match(launch, /SOFTMAX_CLI_PACKAGE="softmax-cli==0\.26\.30"/);
  assert.match(launch, /STARTER_SOURCE_SHA/);
  assert.match(launch, /status --porcelain --untracked-files=all -- \./);
  assert.match(launch, /--build-arg "STARTER_SOURCE_SHA=\$SOURCE_SHA"/);
  assert.doesNotMatch(launch, /curl[^\n|]*\|\s*(?:sh|bash)/);
  assert.doesNotMatch(launch, /uvx --from (?:coworld|softmax-cli)\b/);
  assert.doesNotMatch(launch, /commander-xp-player/);
  assert.doesNotMatch(launch, /--arm=/);
});

test("the public contract states the exact-action and fallback boundaries", async () => {
  const readme = await readFile(new URL("README.md", import.meta.url), "utf8");
  assert.match(readme, /exact\s+currently offered `LegalAction\.id`/);
  assert.match(readme, /explicit\s+deterministic fallback/);
  assert.match(readme, /19 of 74/);
  assert.match(readme, /55-second inference budget/);
  assert.match(readme, /60-second gameplay response window/);
  assert.match(readme, /removes the\s+canary's eval run key/);
  assert.match(
    readme,
    /uses structured deals and bounded free-form message replies/,
  );
});