developer(ET): auto-commit from developer run_id=640

tests/test_setup_lite_script.py

@@ -0,0 +1,988 @@
+"""ORCH-104 (TC-01…TC-25, AC-1…AC-12): структурные и unit-проверки
+`scripts/setup_lite.py` — интерактивного installer'а Lite-тиража.
+
+По образцу `tests/test_bootstrap_script.py` (ORCH-103) + ADR-001 ORCH-104 D12:
+вся решающая логика скрипта — чистые функции (вердикты предусловий,
+классификатор discovery, когерентность портов, рендер env с маркером
+managed-файла, builder аргументов onboarding, step-движок), тестируемые без
+TTY/сети/docker; интерактив — через инжектируемый I/O (`IO(input_fn=…,
+getpass_fn=…, say_fn=…, is_tty=…, env=…)`); файловые сценарии — на tmp_path;
+структурная гигиена — ast/эвристики по файлу скрипта (stdlib-only, зеркала
+delete/status-needle-наборов, кирпичи gen_secrets.py / onboard_project.py).
+
+Детерминировано: без сети/docker/LLM (единственный субпроцесс — stdlib-кирпич
+gen_secrets.py в TC-13); модуль импортируется по файлу, import не имеет
+side effects.
+"""
+
+import ast
+import importlib.util
+import json
+
+import pytest
+
+from pathlib import Path
+
+# Один источник истины запрещённых боевых литералов (TC-15, ORCH-101 AC-7).
+from tests.test_no_host_hardcodes import FORBIDDEN
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+SCRIPT = REPO_ROOT / "scripts/setup_lite.py"
+
+# Зеркало FORBIDDEN_DELETE_NEEDLES bootstrap'а (ORCH-103 D9) + API/git-удаления
+# (AC-12): delete-операций в installer'е нет ВООБЩЕ — лечение всегда инструкцией.
+FORBIDDEN_DELETE_NEEDLES = (
+    "volume rm",
+    "rm -rf",
+    "down -v",
+    "compose down",
+    "rmtree",
+    "os.remove",
+    ".unlink",
+    "push --delete",
+    'method="DELETE"',
+    "method='DELETE'",
+)
+
+# Зеркало FORBIDDEN_STATUS_NEEDLES: собственный канон Plane-статусов в скрипте
+# запрещён (статусы — только кирпич onboard_project.py / plane_sync, BR-7/D11).
+FORBIDDEN_STATUS_NEEDLES = (
+    "Backlog",
+    "To Analyse",
+    "Confirm Deploy",
+    "Code-Review",
+    "Awaiting Deploy",
+    "Monitoring after Deploy",
+)
+
+# stdlib-allowlist top-level импортов (D1: python stdlib-only).
+STDLIB_ALLOWED = {
+    "argparse", "dataclasses", "getpass", "json", "os", "pathlib", "re",
+    "secrets", "shutil", "socket", "subprocess", "sys", "tempfile", "time",
+    "urllib", "uuid",
+}
+
+
+def _source() -> str:
+    assert SCRIPT.is_file(), "scripts/setup_lite.py отсутствует (AC-1/FR-1)"
+    return SCRIPT.read_text(encoding="utf-8")
+
+
+def _load_module():
+    spec = importlib.util.spec_from_file_location("setup_lite", SCRIPT)
+    mod = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(mod)
+    return mod
+
+
+def _io(mod, answers=(), secrets_=(), say=None, is_tty=True, env=None, yes=False):
+    """Инжектируемый I/O со скриптованными ответами (D10/NFR-5)."""
+    answers_it = iter(answers)
+    secrets_it = iter(secrets_)
+    return mod.IO(
+        input_fn=lambda prompt="": next(answers_it),
+        getpass_fn=lambda prompt="": next(secrets_it),
+        say_fn=(say.append if say is not None else (lambda s: None)),
+        is_tty=is_tty,
+        env=({} if env is None else env),
+        yes=yes,
+    )
+
+
+def _full_facts() -> dict:
+    """Фикстура «всё установлено» (перечень FR-2; без боевых литералов)."""
+    return {
+        "uname": "Linux x86_64",
+        "docker": True,
+        "compose_v2": True,
+        "git": True,
+        "python3": True,
+        "node": True,
+        "node_bin": "/usr/bin/node",
+        "claude_code_dir": "/usr/lib/node_modules/@anthropic-ai/claude-code",
+        "claude_creds_readable": True,
+        "docker_gid": "984",
+        "uid": 1001,
+        "gid": 1001,
+        "home": "/home/operator",
+        "repos_dir": "/home/operator/repos",
+        "repos_dir_owner_ok": True,
+        "ssh_dir": "/home/operator/.orchestrator-ssh",
+        "ssh_keys": True,
+        "busy_ports": [],
+        "pkg_manager": "apt-get",
+        "repo_root": "/home/operator/orchestrator",
+    }
+
+
+# ---------------------------------------------------------------------------
+# TC-01 / AC-1: CLI — режимы закрыты, дефолт apply (ADR-001 D2), флаги.
+# ---------------------------------------------------------------------------
+def test_tc01_modes_closed_and_apply_is_default():
+    mod = _load_module()
+    parser = mod.build_arg_parser()
+    # ОСОЗНАННО зеркально к test_plan_is_default_mode bootstrap'а: у setup_lite
+    # дефолт — apply-wizard (бизнес-цель «одна команда», ADR-001 D2); безопасность
+    # дефолта — структурно (фаза 0 ≡ plan, ранний guard .env, per-action consent,
+    # non-TTY без --yes → exit 2), а не выбором режима.
+    assert parser.parse_args([]).mode == "apply"
+    assert parser.parse_args(["plan"]).mode == "plan"      # строгий read-only
+    assert parser.parse_args(["verify"]).mode == "verify"  # read-only пост-проверка
+    with pytest.raises(SystemExit):
+        parser.parse_args(["wizard"])  # набор режимов закрыт (D2)
+    args = parser.parse_args([])
+    assert args.force is False and args.yes is False
+
+
+# ---------------------------------------------------------------------------
+# TC-02 / AC-1: step-движок check→ensure — skip без вызова ensure.
+# ---------------------------------------------------------------------------
+def test_tc02_engine_skips_done_steps_without_ensure():
+    mod = _load_module()
+    ran: list = []
+    steps = (
+        ("one", lambda ctx: False, lambda ctx: (ran.append("one"), "ok")[1]),
+        ("two", lambda ctx: False, lambda ctx: (ran.append("two"), "ok")[1]),
+    )
+    ctx = {"results": {}}
+    mod.run_steps(steps, ctx)
+    assert ran == ["one", "two"]
+    assert ctx["results"] == {"one": "ok", "two": "ok"}
+
+    # повторный прогон по фикстуре «всё выполнено» — каскад skip, ни одной мутации
+    ran.clear()
+    done_steps = tuple((n, (lambda ctx: True), e) for n, _, e in steps)
+    ctx2 = {"results": {}}
+    mod.run_steps(done_steps, ctx2)
+    assert ran == []
+    assert set(ctx2["results"].values()) == {"skip"}
+
+
+# ---------------------------------------------------------------------------
+# TC-03 / AC-1, AC-11: resume — manual-step останавливает (exit 2), повторный
+# запуск продолжает с первого незавершённого шага.
+# ---------------------------------------------------------------------------
+def test_tc03_resume_continues_from_first_unfinished_step():
+    mod = _load_module()
+    ran: list = []
+    done = {"a": False, "b": False}
+
+    def ensure_a(ctx):
+        ran.append("a")
+        return "ok"
+
+    def ensure_b(ctx):
+        if not done["b"]:
+            raise mod.ManualStop("b: выполните ручной шаг")
+        ran.append("b")
+        return "ok"
+
+    steps = (
+        ("a", lambda ctx: done["a"], ensure_a),
+        ("b", lambda ctx: done["b"], ensure_b),
+        ("c", lambda ctx: False, lambda ctx: (ran.append("c"), "ok")[1]),
+    )
+    with pytest.raises(mod.ManualStop):
+        mod.run_steps(steps, {"results": {}})
+    assert ran == ["a"] and "c" not in ran  # остановились на manual-step
+
+    # «resume» = повторный запуск: выполненное скипается, продолжаем с первого
+    # незавершённого (b теперь сделан руками → skip, c выполняется)
+    done["a"] = done["b"] = True
+    ran.clear()
+    ctx = {"results": {}}
+    mod.run_steps(steps, ctx)
+    assert ran == ["c"]
+    assert ctx["results"]["a"] == "skip" and ctx["results"]["b"] == "skip"
+
+
+# ---------------------------------------------------------------------------
+# TC-04 / AC-2: вердикты предусловий — полный набор фактов → все OK.
+# ---------------------------------------------------------------------------
+def test_tc04_full_facts_give_all_ok_and_no_blockers():
+    mod = _load_module()
+    verdicts = mod.prereq_verdicts(_full_facts())
+    assert verdicts, "prereq_verdicts вернул пустой перечень (FR-2)"
+    assert all(v == "OK" for _, v, _ in verdicts), verdicts
+    assert mod.has_blockers(verdicts) is False
+    # ни один пункт перечня FR-2 не пропускается молча
+    items = {item for item, _, _ in verdicts}
+    for required in ("os", "docker", "compose", "git", "python3", "node",
+                     "claude-code", "claude-auth", "docker-group", "repos-dir",
+                     "ssh", "ports"):
+        assert required in items, f"пункт {required!r} перечня FR-2 не покрыт"
+
+
+# ---------------------------------------------------------------------------
+# TC-05 / AC-2: MISSING с конкретной командой; отказ от согласия → MANUAL,
+# команда напечатана, мутация НЕ выполнена.
+# ---------------------------------------------------------------------------
+def test_tc05_missing_docker_offer_declined_is_manual_without_mutation():
+    mod = _load_module()
+    facts = _full_facts()
+    facts.update(docker=False, compose_v2=False)
+    verdicts = dict((i, (v, d)) for i, v, d in mod.prereq_verdicts(facts))
+    assert verdicts["docker"][0] == "MISSING"
+    assert mod.has_blockers(mod.prereq_verdicts(facts)) is True
+
+    command = mod.install_command("apt-get", "docker")
+    assert command and "apt-get" in command  # конкретная команда под менеджер
+
+    transcript: list = []
+    executed: list = []
+    io = _io(mod, answers=["n"], say=transcript)  # инжектированный отказ
+    status = mod.offer_install("docker", command, io,
+                               runner=lambda cmd: executed.append(cmd))
+    assert status == "manual"
+    assert executed == [], "мутация выполнена несмотря на отказ (AC-2)"
+    blob = "\n".join(transcript)
+    assert command in blob, "точная команда не напечатана ДО запроса согласия"
+
+
+def test_tc05b_offer_accepted_runs_and_rechecks():
+    mod = _load_module()
+    executed: list = []
+
+    class _Proc:
+        returncode = 0
+
+    io = _io(mod, answers=["y"])
+    status = mod.offer_install(
+        "git", "sudo apt-get install -y git", io,
+        runner=lambda cmd: (executed.append(cmd), _Proc())[1],
+        recheck=lambda: True,
+    )
+    assert status == "ok" and executed == ["sudo apt-get install -y git"]
+    # re-check фактом не сошёлся → честный MANUAL (не ложный OK)
+    io2 = _io(mod, answers=["y"])
+    status2 = mod.offer_install(
+        "git", "sudo apt-get install -y git", io2,
+        runner=lambda cmd: _Proc(), recheck=lambda: False,
+    )
+    assert status2 == "manual"
+
+
+# ---------------------------------------------------------------------------
+# TC-06 / AC-2: неопределимый пакетный менеджер → MANUAL со ссылкой на канон;
+# uname вне контура → WARN, не падение.
+# ---------------------------------------------------------------------------
+def test_tc06_unknown_pkg_manager_and_foreign_os():
+    mod = _load_module()
+    assert mod.detect_pkg_manager(which=lambda name: None) is None
+    assert mod.detect_pkg_manager(
+        which=lambda name: "/usr/bin/dnf" if name == "dnf" else None) == "dnf"
+    assert mod.install_command(None, "docker") is None
+    hint = mod.manual_install_hint("docker")
+    assert "LITE_SETUP" in hint  # ссылка на § канона, не молчаливый пропуск
+
+    facts = _full_facts()
+    facts["uname"] = "Darwin arm64"
+    verdicts = dict((i, (v, d)) for i, v, d in mod.prereq_verdicts(facts))
+    assert verdicts["os"][0] == "WARN"
+    assert "вне контура Lite" in verdicts["os"][1]
+
+
+# ---------------------------------------------------------------------------
+# TC-07 / AC-3: discovery — две независимые Plane-инсталляции → ровно 2
+# кандидата; выбор пользователя применяется; «ввести вручную» присутствует.
+# ---------------------------------------------------------------------------
+def _two_plane_containers() -> list:
+    return [
+        {"name": "plane-a-proxy-1", "image": "makeplane/plane-proxy:v0.23.1",
+         "ports": "0.0.0.0:8080->80/tcp", "project": "plane-a"},
+        {"name": "plane-a-api-1", "image": "makeplane/plane-backend:v0.23.1",
+         "ports": "", "project": "plane-a"},
+        {"name": "plane-a-db-1", "image": "postgres:15.7-alpine",
+         "ports": "", "project": "plane-a"},
+        {"name": "plane-b-proxy-1", "image": "makeplane/plane-proxy:v0.23.1",
+         "ports": "0.0.0.0:9090->80/tcp", "project": "plane-b"},
+        {"name": "shop-nginx-1", "image": "nginx:1.25",
+         "ports": "0.0.0.0:80->80/tcp", "project": "shop"},
+    ]
+
+
+def test_tc07_two_plane_installations_listed_and_choice_applied():
+    mod = _load_module()
+    installs = mod.discover_installations(_two_plane_containers())
+    planes = [i for i in installs if i["kind"] == "plane"]
+    assert len(planes) == 2, planes
+    assert {p["project"] for p in planes} == {"plane-a", "plane-b"}
+    assert {p["url_port"] for p in planes} == {8080, 9090}
+
+    transcript: list = []
+    io = _io(mod, answers=["2"], say=transcript)
+    chosen = mod.choose_installation("Plane", planes, io)
+    assert chosen is not None and chosen["url_port"] in (8080, 9090)
+    blob = "\n".join(transcript)
+    assert "1." in blob and "2." in blob, "нумерованный список не показан"
+    assert "вручную" in blob, "пункт «ввести вручную» отсутствует (AC-3)"
+
+    # «ввести вручную» доступен и при ≥2 кандидатах
+    io0 = _io(mod, answers=["0"])
+    assert mod.choose_installation("Plane", planes, io0) is None
+
+
+def test_tc08_single_zero_and_foreign_images():
+    mod = _load_module()
+    containers = _two_plane_containers()
+    # одна инсталляция → префилл по умолчанию (Enter = подтверждение)
+    single = [i for i in mod.discover_installations(containers[:3])
+              if i["kind"] == "plane"]
+    assert len(single) == 1
+    io = _io(mod, answers=[""])
+    chosen = mod.choose_installation("Plane", single, io)
+    assert chosen is single[0]
+
+    # ноль инсталляций → ручной ввод + честная подсказка про Bundled
+    transcript: list = []
+    io0 = _io(mod, answers=[], say=transcript)
+    assert mod.choose_installation("Plane", [], io0) is None
+    assert "BUNDLED_SETUP" in "\n".join(transcript)
+
+    # посторонние образы кандидатами не становятся (строго image-префиксы, D5)
+    foreign_only = [c for c in containers if c["project"] == "shop"]
+    assert mod.discover_installations(foreign_only) == []
+
+
+def test_tc08b_gitea_discovery_by_image_prefix():
+    mod = _load_module()
+    containers = [
+        {"name": "git-gitea-1", "image": "docker.gitea.com/gitea:1.24.9",
+         "ports": "0.0.0.0:3300->3000/tcp", "project": "git"},
+    ]
+    giteas = [i for i in mod.discover_installations(containers)
+              if i["kind"] == "gitea"]
+    assert len(giteas) == 1 and giteas[0]["url_port"] == 3300
+
+
+def test_tc09_docker_failure_is_never_block(monkeypatch):
+    mod = _load_module()
+
+    def _boom(*args, **kwargs):
+        raise OSError("docker недоступен")
+
+    monkeypatch.setattr(mod, "_run", _boom)
+    assert mod.list_containers() is None  # ошибка перечисления → None, не исключение
+    # классификатор на «нет данных» отвечает пустым перечнем (ручной ввод дальше)
+    assert mod.discover_installations([]) == []
+    assert mod.parse_docker_ps("") == []
+
+
+# ---------------------------------------------------------------------------
+# TC-10 / AC-4: цикл запроса — re-prompt с диагнозом, лимит попыток, не
+# бесконечный цикл; успешная верификация → значение принято.
+# ---------------------------------------------------------------------------
+def test_tc10_verify_retry_limit_and_success():
+    mod = _load_module()
+    transcript: list = []
+    attempts: list = []
+
+    def verify_fail(value):
+        attempts.append(value)
+        return False, "HTTP 401: токен отклонён"
+
+    io = _io(mod, secrets_=["t1", "t2", "t3", "t4"], say=transcript)
+    with pytest.raises(mod.ManualStop):
+        io.ask("ORCH_PLANE_API_TOKEN", "Plane API token", secret=True,
+               verify=verify_fail, max_tries=3)
+    assert len(attempts) == 3, "лимит попыток не соблюдён (не бесконечный цикл)"
+    assert any("401" in line for line in transcript), "re-prompt без диагноза"
+
+    def verify_second(value):
+        return (value == "good", "HTTP 401")
+
+    io2 = _io(mod, secrets_=["bad", "good"])
+    assert io2.ask("ORCH_GITEA_TOKEN", "Gitea token", secret=True,
+                   verify=verify_second) == "good"
+
+
+def test_tc10b_env_prefill_is_used_and_verified():
+    mod = _load_module()
+    seen: list = []
+    io = _io(mod, env={"ORCH_GITEA_TOKEN": "from-env"}, is_tty=False, yes=True)
+    value = io.ask("ORCH_GITEA_TOKEN", "Gitea token", secret=True,
+                   verify=lambda v: (seen.append(v) or True, ""))
+    assert value == "from-env" and seen == ["from-env"]  # верификация выполняется
+
+
+# ---------------------------------------------------------------------------
+# TC-11 / AC-4: секрет-гигиена — значение секрета не попадает в транскрипт.
+# ---------------------------------------------------------------------------
+def test_tc11_secret_values_never_printed(capsys):
+    mod = _load_module()
+    secret = "supersecret-token-value-123"
+    transcript: list = []
+    io = _io(mod, secrets_=[secret], say=transcript)
+    value = io.ask("ORCH_TELEGRAM_BOT_TOKEN", "токен бота", secret=True,
+                   verify=lambda v: (True, ""))
+    assert value == secret
+    blob = "\n".join(transcript) + capsys.readouterr().out
+    assert secret not in blob, "значение секрета напечатано (NFR-3)"
+    assert "ORCH_TELEGRAM_BOT_TOKEN" in blob or transcript == [], (
+        "в транскрипте допустимы только имена ключей"
+    )
+
+
+# ---------------------------------------------------------------------------
+# TC-12 / AC-4: non-TTY без альтернативы → честный отказ, не зависание.
+# ---------------------------------------------------------------------------
+def test_tc12_non_tty_is_deterministic_refusal():
+    mod = _load_module()
+    io = _io(mod, is_tty=False)
+    with pytest.raises(mod.ManualStop):
+        io.ask("ORCH_PLANE_API_TOKEN", "Plane API token", secret=True)
+    # consent в non-TTY без --yes — тоже честный отказ
+    with pytest.raises(mod.ManualStop):
+        io.consent("выполнить мутацию")
+    # с --yes согласие дано флагом (headless-consent, D10)
+    io_yes = _io(mod, is_tty=False, yes=True)
+    assert io_yes.consent("выполнить мутацию") is True
+    # non-TTY + непустой дефолт (автодетект) → дефолт принимается, прогон жив
+    io_def = _io(mod, is_tty=False, yes=True)
+    assert io_def.ask("ORCH_RUN_UID", "uid", default="1001") == "1001"
+
+
+# ---------------------------------------------------------------------------
+# TC-13 / AC-5: сборка .env/.env.watchdog — группы ключей, файл-носитель §4.3,
+# свежие 64-hex webhook-секреты кирпичом gen_secrets.
+# ---------------------------------------------------------------------------
+def test_tc13_split_overrides_watchdog_keys_only_in_watchdog_file():
+    mod = _load_module()
+    answers = {
+        "ORCH_PLANE_API_URL": "http://127.0.0.1:8080",
+        "ORCH_TELEGRAM_BOT_TOKEN": "tg-orch",
+        "WATCHDOG_TG_BOT_TOKEN": "tg-wd",
+        "WATCHDOG_TG_CHAT_ID": "42",
+        "WATCHDOG_METRICS_URL": "http://127.0.0.1:8500/metrics",
+    }
+    root_ov, wd_ov = mod.split_overrides(answers)
+    assert "WATCHDOG_TG_BOT_TOKEN" not in root_ov  # ловушка файла-носителя §4.3
+    assert "WATCHDOG_TG_CHAT_ID" not in root_ov
+    assert wd_ov["WATCHDOG_TG_BOT_TOKEN"] == "tg-wd"
+    assert wd_ov["WATCHDOG_TG_CHAT_ID"] == "42"
+    assert root_ov["ORCH_PLANE_API_URL"] == "http://127.0.0.1:8080"
+    # когерентный WATCHDOG_METRICS_URL уходит в файл-носитель sidecar'а
+    assert wd_ov["WATCHDOG_METRICS_URL"] == "http://127.0.0.1:8500/metrics"
+
+
+def test_tc13b_webhook_secrets_are_fresh_64_hex_via_brick():
+    mod = _load_module()
+    first = mod.issue_webhook_secrets()
+    second = mod.issue_webhook_secrets()
+    for batch in (first, second):
+        assert set(batch) == {"ORCH_PLANE_WEBHOOK_SECRET", "ORCH_GITEA_WEBHOOK_SECRET"}
+        for value in batch.values():
+            assert len(value) == 64 and all(c in "0123456789abcdef" for c in value)
+    assert first != second, "повторный выпуск обязан давать другие значения (AC-5)"
+
+
+def test_tc13c_render_env_keeps_canon_and_adds_marker():
+    mod = _load_module()
+    example = "# шапка канона\nA=1\nB=\n"
+    rendered = mod.render_env(example, {"B": "v", "NEW": "n"})
+    assert rendered.startswith(mod.MANAGED_MARKER), "маркер managed-файла (D6)"
+    assert "# шапка канона" in rendered and "A=1" in rendered
+    assert mod.parse_env(rendered) == {"A": "1", "B": "v", "NEW": "n"}
+
+
+def test_tc13d_mandatory_key_groups_covered():
+    """Карта обязательных ключей §4.2 LITE_SETUP покрыта константой скрипта."""
+    mod = _load_module()
+    keys = set(mod.MANDATORY_NEW_HOST_KEYS)
+    for required in (
+        "ORCH_PLANE_API_URL", "ORCH_PLANE_WEB_URL", "ORCH_PLANE_WORKSPACE_SLUG",
+        "ORCH_PLANE_API_TOKEN", "ORCH_GITEA_URL", "ORCH_GITEA_PUBLIC_URL",
+        "ORCH_GITEA_OWNER", "ORCH_GITEA_TOKEN", "ORCH_PLANE_WEBHOOK_SECRET",
+        "ORCH_GITEA_WEBHOOK_SECRET", "ORCH_TELEGRAM_BOT_TOKEN",
+        "ORCH_TELEGRAM_CHAT_ID", "ORCH_RUN_UID", "ORCH_RUN_GID",
+        "ORCH_DOCKER_GID", "ORCH_HOST_REPOS_DIR",
+        "ORCH_DEPLOY_PROD_TARGET_PORT", "ORCH_STAGING_PORT",
+    ):
+        assert required in keys, f"{required} не покрыт картой §4.2 (AC-5)"
+    # все имена — канонические (существуют в .env.example)
+    canon = set()
+    for line in (REPO_ROOT / ".env.example").read_text(encoding="utf-8").splitlines():
+        line = line.strip()
+        if line and not line.startswith("#") and "=" in line:
+            canon.add(line.split("=", 1)[0].strip())
+    assert keys <= canon, f"вне канона .env.example: {sorted(keys - canon)}"
+
+
+# ---------------------------------------------------------------------------
+# TC-14 / AC-5: существующий чужой .env → отказ без force, байт-в-байт; маркер
+# managed-файла → resume-ensure; с force — перезапись.
+# ---------------------------------------------------------------------------
+def test_tc14_existing_foreign_env_is_refused_byte_identical(tmp_path):
+    mod = _load_module()
+    env = tmp_path / ".env"
+    env.write_text("MY_LIVE_KEY=1\n", encoding="utf-8")
+    before = env.read_bytes()
+    assert mod.env_file_state(env.read_text(encoding="utf-8")) == "foreign"
+    assert mod.env_file_state(None) == "absent"
+
+    io = _io(mod, answers=["y"])
+    with pytest.raises(mod.ManualStop):
+        mod.ensure_env_file(str(env), "A=\n", {"A": "x"}, force=False, io=io)
+    assert env.read_bytes() == before, "чужой .env изменён без force (NFR-7)"
+
+    # с явным force (+согласие) — перезапись выполняется
+    io2 = _io(mod, answers=["y"])
+    mod.ensure_env_file(str(env), "A=\n", {"A": "x"}, force=True, io=io2)
+    text = env.read_text(encoding="utf-8")
+    assert text.startswith(mod.MANAGED_MARKER) and "A=x" in text
+
+
+def test_tc14b_managed_file_resume_ensure_keeps_existing_values(tmp_path):
+    mod = _load_module()
+    env = tmp_path / ".env"
+    env.write_text(mod.MANAGED_MARKER + "\nA=keep\nB=\n", encoding="utf-8")
+    assert mod.env_file_state(env.read_text(encoding="utf-8")) == "managed"
+    io = _io(mod, answers=[])
+    mod.ensure_env_file(str(env), "A=\nB=\nC=\n", {"A": "new", "B": "vb", "C": "vc"},
+                        force=False, io=io)
+    got = mod.parse_env(env.read_text(encoding="utf-8"))
+    assert got["A"] == "keep", "resume-ensure перетёр существующее значение (D6)"
+    assert got["B"] == "vb" and got["C"] == "vc", "недостающие ключи не дозаполнены"
+
+
+# ---------------------------------------------------------------------------
+# TC-15 / AC-5: подсказки-дефолты — только автодетект/канон, без боевых значений.
+# ---------------------------------------------------------------------------
+def test_tc15_prompt_defaults_come_from_autodetect_without_forbidden():
+    mod = _load_module()
+    defaults = mod.prompt_defaults(_full_facts())
+    blob = json.dumps(defaults, ensure_ascii=False)
+    for literal in FORBIDDEN:
+        assert literal not in blob, f"боевой литерал {literal!r} в дефолтах промптов"
+    assert defaults["ORCH_RUN_UID"] == "1001"
+    assert defaults["ORCH_DOCKER_GID"] == "984"
+    assert defaults["ORCH_HOST_NODE_BIN"] == "/usr/bin/node"
+    assert defaults["ORCH_AGENT_HOME_DIR"] == "/home/operator"
+    assert defaults["ORCH_HOST_CLAUDE_DIR"] == "/home/operator/.claude"
+
+
+def test_tc15b_script_source_carries_no_forbidden_literals():
+    src = _source()
+    offenders = [literal for literal in FORBIDDEN if literal in src]
+    assert not offenders, f"боевые литералы в setup_lite.py: {offenders}"
+
+
+# ---------------------------------------------------------------------------
+# TC-16 / AC-6: когерентная тройка портов одной функцией; занятый порт →
+# альтернатива.
+# ---------------------------------------------------------------------------
+def test_tc16_port_overrides_keep_triple_coherent():
+    mod = _load_module()
+    overrides = mod.port_overrides(8700)
+    assert overrides["ORCH_DEPLOY_PROD_TARGET_PORT"] == "8700"
+    assert overrides["WATCHDOG_METRICS_URL"] == "http://127.0.0.1:8700/metrics"
+    assert overrides["ORCH_POST_DEPLOY_BASE_URL"] == "http://localhost:8700"
+    # занятый порт → предложена альтернатива (мок busy-check)
+    assert mod.next_free_port(8500, busy=lambda p: p in (8500, 8501)) == 8502
+
+
+def test_tc17_staging_port_equal_to_prod_is_fail_closed():
+    mod = _load_module()
+    assert mod.staging_port_ok(8500, 8500) is False  # инвариант ORCH-058/101
+    assert mod.staging_port_ok(8501, 8500) is True
+    # в цикле ввода значение не принимается — re-prompt до различного
+    io = _io(mod, answers=["8500", "8501"])
+    value = io.ask("ORCH_STAGING_PORT", "staging-порт", default="8501",
+                   verify=lambda v: (mod.staging_port_ok(int(v), 8500),
+                                     "staging-порт обязан отличаться от прод-порта"))
+    assert value == "8501"
+
+
+# ---------------------------------------------------------------------------
+# TC-18 / AC-7: C-1 — одинаковые токены орка и watchdog запрещены машинно.
+# ---------------------------------------------------------------------------
+def test_tc18_telegram_c1_identical_tokens_refused():
+    mod = _load_module()
+    ok, hint = mod.telegram_c1_verdict("same-token", "same-token")
+    assert ok is False
+    assert "C-1" in hint or "ЗАПРЕЩЕНО" in hint.upper(), "отказ без объяснения запрета"
+    ok2, _ = mod.telegram_c1_verdict("token-a", "token-b")
+    assert ok2 is True
+
+
+# ---------------------------------------------------------------------------
+# TC-19 / AC-8: branch protection — честный FAIL с лечением, без удаления.
+# ---------------------------------------------------------------------------
+def test_tc19_branch_protection_verdict():
+    mod = _load_module()
+    ok, hint = mod.branch_protection_verdict(200, [{"branch_name": "main"}])
+    assert ok is False
+    assert "6.4" in hint or "13.7" in hint, "лечение без ссылки на норматив §6.4"
+    assert mod.branch_protection_verdict(200, [])[0] is True
+    # репо ещё не создан (создаст onboarding) — не FAIL
+    assert mod.branch_protection_verdict(404, None)[0] is True
+
+
+# ---------------------------------------------------------------------------
+# TC-20 / AC-8 (D8): webhook Plane Path Б — только с явного согласия; отказ →
+# UI-путь, мутирующий вызов не произведён; после согласия — пост-верификация.
+# ---------------------------------------------------------------------------
+def _webhook_answers() -> dict:
+    return {
+        "plane_db_container": "plane-a-db-1",
+        "plane_db_user": "plane",
+        "plane_db_name": "plane",
+        "plane_db_password": "pw",
+        "ORCH_PLANE_WORKSPACE_SLUG": "acme",
+        "ORCH_PLANE_WEBHOOK_SECRET": "a" * 64,
+        "orchestrator_public_url": "https://orch.example.com",
+    }
+
+
+def test_tc20_path_b_refused_no_mutation():
+    mod = _load_module()
+    calls: list = []
+
+    def psql(sql):
+        calls.append(sql)
+        return 0, "0"
+
+    transcript: list = []
+    io = _io(mod, answers=["n"], say=transcript)  # отказ от согласия на SQL
+    status = mod.plane_webhook_path_b(_webhook_answers(), io, psql)
+    assert status == "manual"
+    assert not any("INSERT" in c.upper() for c in calls), (
+        "мутирующий SQL выполнен без согласия (D8)"
+    )
+    assert "INSERT" in "\n".join(transcript).upper(), (
+        "точный SQL не показан ДО запроса согласия (D8 п.2)"
+    )
+
+
+def test_tc20b_path_b_consent_insert_and_postverify():
+    mod = _load_module()
+    state = {"rows": 0}
+    calls: list = []
+
+    def psql(sql):
+        calls.append(sql)
+        if "INSERT" in sql.upper():
+            state["rows"] = 1
+            return 0, ""
+        if "count(*)" in sql:
+            return 0, str(state["rows"])
+        if "SELECT id FROM workspaces" in sql:
+            return 0, "11111111-2222-3333-4444-555555555555"
+        return 0, ("https://orch.example.com/webhook/plane|t" if state["rows"] else "")
+
+    io = _io(mod, answers=["y"])
+    assert mod.plane_webhook_path_b(_webhook_answers(), io, psql) == "ok"
+    assert any("INSERT" in c.upper() for c in calls)
+    # пост-верификация обязательна: INSERT прошёл, но строки нет → НЕ PASS
+    io2 = _io(mod, answers=["y"])
+
+    def psql_lost(sql):
+        if "count(*)" in sql:
+            return 0, "0"
+        if "SELECT id FROM workspaces" in sql:
+            return 0, "11111111-2222-3333-4444-555555555555"
+        if "INSERT" in sql.upper():
+            return 0, ""
+        return 0, ""
+
+    assert mod.plane_webhook_path_b(_webhook_answers(), io2, psql_lost) == "manual"
+
+
+def test_tc20c_path_b_is_idempotent_skip_when_registered():
+    mod = _load_module()
+    calls: list = []
+
+    def psql(sql):
+        calls.append(sql)
+        return 0, "1"  # webhook уже зарегистрирован
+
+    io = _io(mod, answers=["y"])
+    assert mod.plane_webhook_path_b(_webhook_answers(), io, psql) == "skipped"
+    assert not any("INSERT" in c.upper() for c in calls)
+
+
+# ---------------------------------------------------------------------------
+# TC-21 / AC-9: запуск — up только после согласия; состав «ровно орк+watchdog»;
+# health-контракты; stateless-проверка.
+# ---------------------------------------------------------------------------
+def test_tc21_composition_verdict_is_exactly_two_services():
+    mod = _load_module()
+    ok, _ = mod.lite_composition_verdict(["orchestrator", "orchestrator-watchdog"])
+    assert ok is True
+    bad, hint = mod.lite_composition_verdict(
+        ["orchestrator", "orchestrator-watchdog", "orchestrator-staging"])
+    assert bad is False and "staging" in hint
+    assert mod.lite_composition_verdict(["orchestrator"])[0] is False
+
+
+def test_tc21b_health_checks_require_contract_bodies():
+    mod = _load_module()
+    bodies = {
+        "/health": (200, '{"status":"ok"}'),
+        "/queue": (200, '{"counts": {}, "recent": []}'),
+        "/metrics": (200, '{"schema_version": 1}'),
+    }
+
+    def http(url, headers=None, timeout=10):
+        for path, resp in bodies.items():
+            if url.endswith(path):
+                return resp
+        return None, ""
+
+    results = mod.health_checks(http, 8500)
+    assert all(ok for _, ok, _ in results), results
+    bodies["/metrics"] = (200, '{"schema_version": 2}')
+    results2 = mod.health_checks(http, 8500)
+    assert any(path == "/metrics" and not ok for path, ok, _ in results2)
+
+
+def test_tc21c_step_up_requires_consent_and_checks_composition(monkeypatch):
+    mod = _load_module()
+    compose_calls: list = []
+
+    class _Proc:
+        returncode = 0
+        stderr = ""
+        stdout = "orchestrator\norchestrator-watchdog\n"
+
+    monkeypatch.setattr(mod, "_compose",
+                        lambda *args, **kw: (compose_calls.append(args), _Proc())[1])
+    monkeypatch.setattr(mod, "_http", lambda url, **kw: (
+        (200, '{"status":"ok"}') if url.endswith("/health")
+        else (200, '{"schema_version": 1}') if url.endswith("/metrics")
+        else (200, '{"counts": {}, "recent": []}')))
+    ctx = {"io": _io(mod, answers=["y"]), "answers": {}, "results": {}}
+    assert mod.step_up(ctx) == "ok"
+    assert any("up" in c for c in compose_calls), "compose up не вызван"
+
+    # отказ от согласия → MANUAL, ни одного вызова compose-мутации
+    compose_calls.clear()
+    ctx2 = {"io": _io(mod, answers=["n"]), "answers": {}, "results": {}}
+    assert mod.step_up(ctx2) == "manual"
+    assert not any("up" in c for c in compose_calls), "контур поднят без согласия"
+
+
+def test_tc21d_step_up_fails_on_staging_in_composition(monkeypatch):
+    mod = _load_module()
+
+    class _Proc:
+        returncode = 0
+        stderr = ""
+        stdout = "orchestrator\norchestrator-watchdog\norchestrator-staging\n"
+
+    monkeypatch.setattr(mod, "_compose", lambda *args, **kw: _Proc())
+    ctx = {"io": _io(mod, answers=["y"]), "answers": {}, "results": {}}
+    with pytest.raises(mod.SetupError):
+        mod.step_up(ctx)
+
+
+def test_tc21e_stateless_verdict_flags_foreign_tasks():
+    mod = _load_module()
+    clean = {"counts": {"queued": 0, "running": 0}, "recent": []}
+    assert mod.stateless_verdict(clean, own_prefixes=("SHP",))[0] is True
+    dirty = {"counts": {"done": 3},
+             "recent": [{"work_item_id": "FOO-61"}]}
+    ok, hint = mod.stateless_verdict(dirty, own_prefixes=("SHP",))
+    assert ok is False and "FOO-61" in hint
+    own = {"counts": {"done": 1}, "recent": [{"work_item_id": "SHP-1"}]}
+    assert mod.stateless_verdict(own, own_prefixes=("SHP",))[0] is True
+
+
+# ---------------------------------------------------------------------------
+# TC-22 / AC-10: onboarding — builder аргументов чистой функцией; строго
+# последовательность plan → согласие → apply → verify; exit 2 кирпича → MANUAL.
+# ---------------------------------------------------------------------------
+def _project_answers(tmp_path=None) -> dict:
+    return {
+        "project_name": "Shop",
+        "project_description": "магазин",
+        "project_repo": "shop",
+        "project_prefix": "SHP",
+        "project_stack": "python",
+        "project_test_cmd": "pytest -q",
+        "project_prod_port": "8600",
+        "project_staging_port": "8601",
+        "ORCH_GITEA_OWNER": "acme",
+        "orchestrator_public_url": "https://orch.example.com",
+    }
+
+
+def test_tc22_build_onboard_args_is_pure_and_complete():
+    mod = _load_module()
+    args = mod.build_onboard_args(_project_answers(), "plan")
+    assert args[0].endswith("onboard_project.py") and args[1] == "plan"
+    pairs = dict(zip(args[2::2], args[3::2]))
+    assert pairs["--name"] == "Shop" and pairs["--repo"] == "shop"
+    assert pairs["--prefix"] == "SHP" and pairs["--stack"] == "python"
+    assert pairs["--test-cmd"] == "pytest -q"
+    assert pairs["--prod-port"] == "8600" and pairs["--staging-port"] == "8601"
+    assert pairs["--webhook-url"] == "https://orch.example.com/webhook/gitea"
+    assert pairs["--gitea-owner"] == "acme"
+    assert "--json" in args
+    # детерминизм чистой функции
+    assert args == mod.build_onboard_args(_project_answers(), "plan")
+
+
+def test_tc22b_onboard_sequence_plan_consent_apply_verify(tmp_path, monkeypatch):
+    mod = _load_module()
+    modes: list = []
+    report = {"steps": [], "instructions": [
+        "Добавь/обнови строку в .env оркестратора: ORCH_PROJECTS_JSON="
+        '[{"repo": "shop"}]',
+    ]}
+
+    class _Proc:
+        def __init__(self, rc, out=""):
+            self.returncode = rc
+            self.stdout = out
+            self.stderr = ""
+
+    def fake_run(cmd, **kwargs):
+        mode = next((m for m in ("plan", "apply", "verify") if m in cmd), "?")
+        modes.append(mode)
+        if mode == "apply":
+            return _Proc(0, json.dumps(report))
+        if mode == "verify":
+            return _Proc(2)  # остались ручные шаги
+        return _Proc(0, "план...")
+
+    env = tmp_path / ".env"
+    env.write_text(mod.MANAGED_MARKER + "\nORCH_PROJECTS_JSON=\n", encoding="utf-8")
+    monkeypatch.setattr(mod, "_run", fake_run)
+    monkeypatch.setattr(mod, "_ensure_venv", lambda: "python3")
+    monkeypatch.setattr(mod, "_http", lambda url, **kw: (200, '{"counts": {}, "recent": []}'))
+    monkeypatch.setattr(mod, "_compose", lambda *a, **kw: _Proc(0))
+    ctx = {
+        "io": _io(mod, answers=["y", "y", "y"]),
+        "answers": _project_answers(),
+        "results": {},
+        "paths": {"root_env": str(env),
+                  "root_env_example": str(REPO_ROOT / ".env.example")},
+        "args": mod.build_arg_parser().parse_args([]),
+    }
+    status = mod.step_onboard(ctx)
+    assert modes[:2] == ["plan", "apply"] and "verify" in modes, (
+        f"последовательность кирпича нарушена: {modes}"
+    )
+    assert status == "manual", "exit 2 кирпича обязан транслироваться как MANUAL"
+    got = mod.parse_env(env.read_text(encoding="utf-8"))
+    assert got["ORCH_PROJECTS_JSON"] == '[{"repo": "shop"}]'
+
+
+def test_tc22c_onboard_consent_refused_no_apply(tmp_path, monkeypatch):
+    mod = _load_module()
+    modes: list = []
+
+    class _Proc:
+        returncode = 0
+        stdout = "план..."
+        stderr = ""
+
+    def fake_run(cmd, **kwargs):
+        modes.append(next((m for m in ("plan", "apply", "verify") if m in cmd), "?"))
+        return _Proc()
+
+    monkeypatch.setattr(mod, "_run", fake_run)
+    monkeypatch.setattr(mod, "_ensure_venv", lambda: "python3")
+    env = tmp_path / ".env"
+    env.write_text(mod.MANAGED_MARKER + "\n", encoding="utf-8")
+    ctx = {
+        "io": _io(mod, answers=["n"]),  # план показан → отказ
+        "answers": _project_answers(),
+        "results": {},
+        "paths": {"root_env": str(env),
+                  "root_env_example": str(REPO_ROOT / ".env.example")},
+        "args": mod.build_arg_parser().parse_args([]),
+    }
+    assert mod.step_onboard(ctx) == "manual"
+    assert modes == ["plan"], f"apply вызван без согласия после плана: {modes}"
+
+
+def test_tc22d_extract_projects_json_from_brick_instructions():
+    mod = _load_module()
+    instructions = [
+        "что-то ещё",
+        'Добавь/обнови строку: ORCH_PROJECTS_JSON=[{"repo": "shop"}]',
+    ]
+    assert mod.extract_projects_json(instructions) == '[{"repo": "shop"}]'
+    assert mod.extract_projects_json([]) == ""
+    assert mod.extract_projects_json(["без реестра"]) == ""
+
+
+# ---------------------------------------------------------------------------
+# TC-23 / AC-11: контракт exit-кодов — именованные константы 0/2/1.
+# ---------------------------------------------------------------------------
+def test_tc23_exit_code_contract():
+    mod = _load_module()
+    assert (mod.EXIT_OK, mod.EXIT_MANUAL, mod.EXIT_ERROR) == (0, 2, 1)
+    assert mod.exit_code_for({"a": "ok", "b": "skip"}) == 0
+    assert mod.exit_code_for({"a": "ok", "b": "manual"}) == 2
+    assert mod.exit_code_for({}) == 0
+
+
+# ---------------------------------------------------------------------------
+# TC-24 / AC-12: ast-скан — stdlib-only, без модулей платформы; кирпичи и канон
+# упомянуты.
+# ---------------------------------------------------------------------------
+def test_tc24_imports_are_stdlib_only():
+    tree = ast.parse(_source())
+    offenders = []
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Import):
+            offenders.extend(a.name.split(".")[0] for a in node.names
+                             if a.name.split(".")[0] not in STDLIB_ALLOWED)
+        elif isinstance(node, ast.ImportFrom) and node.module:
+            top = node.module.split(".")[0]
+            if top not in STDLIB_ALLOWED:
+                offenders.append(top)
+    assert not offenders, f"не-stdlib импорты в setup_lite.py (D1): {sorted(set(offenders))}"
+
+
+def test_tc24b_no_platform_imports():
+    src = _source()
+    assert "from src" not in src and "import src" not in src, (
+        "setup_lite обязан быть stdlib-only без импортов платформы (D1)"
+    )
+
+
+def test_tc24c_canonical_bricks_and_doc_are_referenced():
+    src = _source()
+    assert "gen_secrets.py" in src, "webhook-секреты обязаны идти через gen_secrets.py"
+    assert "onboard_project.py" in src, "онбординг обязан идти через onboard_project.py"
+    assert "LITE_SETUP.md" in src, "каждый шаг обязан ссылаться на канон LITE_SETUP.md"
+
+
+# ---------------------------------------------------------------------------
+# TC-25 / AC-12: эвристический скан — delete-операций нет; собственного канона
+# статусов нет; import модуля без side effects.
+# ---------------------------------------------------------------------------
+def test_tc25_no_delete_operations():
+    src = _source()
+    offenders = [n for n in FORBIDDEN_DELETE_NEEDLES if n in src]
+    assert not offenders, (
+        f"delete-операции в setup_lite запрещены (no-delete, D1): {offenders}"
+    )
+
+
+def test_tc25b_no_own_status_canon():
+    src = _source()
+    offenders = [n for n in FORBIDDEN_STATUS_NEEDLES if n in src]
+    assert not offenders, (
+        f"setup_lite несёт собственный канон статусов (дрейф BR-7): {offenders}; "
+        "статусы — только onboard_project.py/plane_sync"
+    )
+
+
+def test_tc25c_module_import_has_no_side_effects():
+    mod1 = _load_module()
+    mod2 = _load_module()
+    assert mod1.build_plan() == mod2.build_plan()
+
+
+def test_apply_steps_match_normative_plan():
+    """Инвариант D3: имена step-движка = нормативному плану (10 шагов)."""
+    mod = _load_module()
+    plan = mod.build_plan()
+    assert len(plan) == 10, f"нормативный план D3 — 10 шагов, получено {len(plan)}"
+    assert [name for name, _, _ in mod.APPLY_STEPS] == [name for name, _ in plan]
+    assert plan[0][0] == "scan" and plan[-1][0] == "report"