Assemble the safe engine diff operation

This commit is contained in:
2026-10-09 12:30:20 +00:00
parent 756149beaa
commit 174efb65f6
3 changed files with 354 additions and 1 deletions

View File

@@ -280,7 +280,7 @@ classification but no changed region.
## Stage 7 — Assemble the complete engine diff operation
Status: planned. Scope: internal-facing records, serialization, and real loads.
Status: complete. Scope: internal-facing records, serialization, and real loads.
1. Define engine `Difference` with `Path`, `Left`, `Right`, and `HiddenChanged`,
and the operation over two `*Inspection` values. Wire Stages 2–6 together:
@@ -306,6 +306,15 @@ Validate: `go test ./internal/engine -run 'Diff|Explain|History|Secret|Independe
comparison works through the engine with no loading or existing inspection
regression. Do not expose a partial public API earlier.
Evidence: focused engine tests, `go test -race ./internal/engine`, and
`./scripts/check.sh` passed. Real-load coverage verifies typed secret references,
dynamic values, defaults, recorded resolution and dependency-derived sensitivity,
historical secret removal/replacement, credential rotation without reference
change, reference-name changes, optional nil references, and frozen state after
environment mutation. Effective rendering, explanation, metadata lookup,
independent loads, detached repeated results, unavailable-inspection errors, and
value-free serialization errors remain covered.
## Stage 8 — Add the root-owned public facade
Status: planned. Scope: public declarations, conversion, and external tests.