Manual testing - adoption

cd /path/to/Reversi                 # the repository root
export REPO=$PWD
export T=$(mktemp -d)               # everything below is created in here
export NODE_NO_WARNINGS=1           # hides Node's "SQLite is experimental" notice
rv()      { node $REPO/packages/cli/dist/main.js "$@"; }        # the reversi CLI
mcp()     { node $REPO/examples/gateway/mcp.mjs "$@"; }         # a tiny MCP client
sha()     { printf '%s' "$1" | shasum -a 256 | cut -d' ' -f1; }
waitfor() { until curl -sf "http://127.0.0.1:$1/readyz" >/dev/null; do sleep 0.3; done; }
echo $T

mkdir $T/proj && cd $T/proj
rv init

created  reversi.config.yaml
created  manifests/example.yaml
created  policy.yaml
created  tests/manifests.test.yaml
updated  .gitignore (reversi-data/)
created  reversi-data/ (sqlite store)

Next:
  reversi doctor                         check the setup
  ...

rv show-config

root: <scratch>/proj
file: <scratch>/proj/reversi.config.yaml
manifests: <scratch>/proj/manifests
policy: <scratch>/proj/policy.yaml
environment: dev
data:
  dir: <scratch>/proj/reversi-data
  store: sqlite

rv doctor; echo "exit $?"

ok    Node 22.14.0
ok    config <scratch>/proj/reversi.config.yaml
ok    3 manifests load
warn  lint: 2 warnings (reversi lint)
ok    data store (sqlite) opens
ok    ledger: 0 records, chain intact
info  no signing key: signed evidence bundles and anchors are off
ok    policy: 1 rules, 2 tests
info  no notification channels configured
ok    data directory <scratch>/proj/reversi-data is writable
ok, with 1 warning
exit 0

rv lint
rv test

warning L011  notes.restore: mutating tool has no owner: nobody is named to ask when it misbehaves
warning L012  notes.restore: no risk.data_class: policy and retention cannot treat sensitive data differently
info    L022  notes.restore: no timeout_ms: a hung call is only bounded by the gateway default
0 errors, 2 warnings, 1 notes
ok   writing a note can be undone, and the undo is read back
ok   a failed write leaves nothing to undo
ok   policy: ordinary tools are allowed
ok   policy: drop needs approval
not covered by any test: notes.restore
4 passed

sed -i.bak 's/effect: reversible/effect: sort_of/' manifests/example.yaml
rv doctor > doctor.out; echo "exit $?"
grep -E 'FAIL|problem' doctor.out
mv manifests/example.yaml.bak manifests/example.yaml
rv doctor | tail -1

exit 1
FAIL  engine: <scratch>/proj/manifests/example.yaml: `notes.write`: `effect` must be one of read_only, idempotent, reversible, compensable, irreversible
1 problem to fix
ok, with 1 warning

mkdir -p $T/gw/sandbox $T/gw/manifests && cd $T/gw
echo hello > sandbox/notes.txt
cat > reversi.config.yaml <<EOF
manifests: ./manifests
data: { dir: ./data, store: files }
EOF
cat > gateway.yaml <<EOF
upstreams:
  - name: fs
    command: node
    args: ["$REPO/packages/connectors/dist/main.js", "serve", "fs", "--root", "$T/gw/sandbox"]
    namespace: false
listen: { host: 127.0.0.1, port: 7700 }
EOF
node $REPO/packages/gateway/dist/main.js --config gateway.yaml > gw.log 2>&1 &
echo $! > gw.pid; waitfor 7700; cat gw.log

reversi-gateway: no manifests yet, so starting in observe mode: everything runs and is journaled. Run `reversi suggest-manifest` to draft manifests for what the upstream offers.
reversi-connectors: serving fs on stdio
Reversi gateway running in observe mode.

WARN   fs.read_file - no manifest; treated as a change that could not be undone
WARN   fs.list_dir - no manifest; treated as a change that could not be undone
WARN   fs.write_file - no manifest; treated as a change that could not be undone
...
0 classified, 0 unclassified reads, 9 unclassified changes, 0 destructive without a manifest.

9 tools have no manifest. They run (nothing is blocked) and are journaled as unclassified. Draft manifests with: reversi suggest-manifest.
reversi-gateway: observe mode, agent endpoint http://127.0.0.1:7700/mcp, files store

U=http://127.0.0.1:7700/mcp
mcp $U list --run obs-1 | head -4
mcp $U call fs.read_file '{"path":"notes.txt"}' --run obs-1
mcp $U call fs.write_file '{"path":"todo.txt","content":"buy milk"}' --run obs-1 --reason "save a todo"
mcp $U call fs.delete_file '{"path":"todo.txt"}' --run obs-1
ls sandbox

fs.read_file                       Read a UTF-8 text file under the root.
fs.list_dir                        List a directory under the root (default: the root itself).
fs.write_file                      Create or overwrite a text file. The previous content is saved so roll
fs.delete_file                     Delete a file. It is moved into the backup directory so rollback can r
RESULT:
{"path":"notes.txt","content":"hello\n","size":6}
RESULT:
{"path":"todo.txt","backup_id":"a2401029-...","existed":false}
RESULT:
{"path":"todo.txt","backup_id":"ce469e3d-..."}
notes.txt

rv runs list
rv runs show obs-1

obs-1  actor=mcp-client  mode=observe  steps=3  complete
run obs-1  actor=mcp-client  mode=observe  started 2026-10-16 17:19:18Z
scope:

steps
    0  fs.read_file                 no manifest  succeeded
    1  fs.write_file                no manifest  succeeded
    2  fs.delete_file               no manifest  succeeded

rollback: NOT fully reversible
  step 2  fs.delete_file  unmanifested  no manifest was registered for this tool, so its effect is unknown
  ...

events
      0  ...  run_started         -  by mcp-client  | mode=observe scope_seal=e3b0c442...
      1  ...  would_block         fs.read_file  by mcp-client  | no manifest registered for tool `fs.read_file`
      2  ...  intended            fs.read_file  by mcp-client
      3  ...  succeeded           fs.read_file  by mcp-client
      ...

rv export --run obs-1 | wc -l
rv export --run obs-1 | sed -n 3p | cut -c1-230
rv verify

10
{"seq":2,"ts_ms":1792171158850,"run_id":"obs-1","step":0,"actor":"mcp-client","tool":"fs.read_file","payload_hash":"327e0978...","reason":"MCP tools/call fs.read_file",...
ok: 10 records, head d5bc5ac3...

kill $(cat gw.pid)
rv suggest-manifest --gateway-config gateway.yaml --out drafts

reversi-connectors: serving fs on stdio
drafts/fs.read_file.yaml  low
drafts/fs.list_dir.yaml  low
drafts/fs.write_file.yaml  medium
drafts/fs.delete_file.yaml  medium
drafts/fs.restore_file.yaml  medium
drafts/fs.make_dir.yaml  low
drafts/fs.remove_dir.yaml  medium
drafts/fs.move_file.yaml  medium
drafts/fs.unmove_file.yaml  medium
9 drafted, 0 skipped (already have manifests)

cat drafts/fs.write_file.yaml

# DRAFT (medium confidence). Review before enforcing.
# - undo guessed from the tool names: `fs.restore_file`; check the argument map and decide whether it is a true inverse (reversible) or leaves residue (compensable)
tool: fs.write_file
description: Create or overwrite a text file. The previous content is saved so rollback can restore it.
effect: compensable
permission: fs:write
status: draft
risk:
  data_class: internal
  blast_radius: medium
compensation:
  tool: fs.restore_file
  argument_map:
    path: $args.path
    backup_id: $result.backup_id
  kind: compensation
  residue:
    - TODO describe what the undo cannot take back
schema_hash: 2e6a54497ec6003e

sed -i.bak -e 's/^    - TODO describe .*/    - the previous content comes back from the backup; the file modification time does not/' \
           -e 's/^effect: compensable/effect: compensable\nowner: platform@example.com\ntimeout_ms: 30s/' drafts/fs.write_file.yaml
rm drafts/fs.write_file.yaml.bak drafts/fs.move_file.yaml drafts/fs.unmove_file.yaml
rv lint drafts | tail -4

warning L024  fs.restore_file: draft manifest: it is not enforceable until approved
info    L016  fs.write_file: the undo is not verified: add compensation.verification to read back that it worked
warning L024  fs.write_file: draft manifest: it is not enforceable until approved
0 errors, 11 warnings, 8 notes

mkdir tests
cat > tests/fs.test.yaml <<'EOF'
- name: writing a file can be undone from its backup
  tool: fs.write_file
  args: { path: todo.txt, content: buy milk }
  result: { path: todo.txt, backup_id: b1, existed: false }
  expect_plan: compensate
  expect_handle: { path: todo.txt, backup_id: b1 }
- name: a failed write leaves nothing to undo
  tool: fs.write_file
  args: { path: todo.txt, content: x }
  fail: disk full
- name: deleting a file is never undone
  tool: fs.delete_file
  args: { path: todo.txt }
  result: { path: todo.txt, backup_id: b2 }
  expect_plan: unrecoverable
EOF
rv test tests/fs.test.yaml -m drafts; echo "exit $?"

FAIL writing a file can be undone from its backup
       the call was refused: the manifest for `fs.write_file` is a draft: publish it before it can be enforced
       ...
       expected plan kind compensate, got none
FAIL a failed write leaves nothing to undo
       ...
FAIL deleting a file is never undone
       ...
not covered by any test: fs.make_dir, fs.remove_dir, fs.restore_file
3 of 3 failed
exit 1

rm -rf reviewed && cp -r drafts reviewed
sed -i.bak 's/^status: draft/status: approved/' reviewed/*.yaml && rm reviewed/*.bak
rv test tests/fs.test.yaml -m reviewed; echo "exit $?"

ok   writing a file can be undone from its backup
ok   a failed write leaves nothing to undo
ok   deleting a file is never undone
not covered by any test: fs.make_dir, fs.remove_dir, fs.restore_file
3 passed
exit 0

sed 's/backup_id: b1 }/backup_id: b9 }/' tests/fs.test.yaml > tests/broken.yaml
rv test tests/broken.yaml -m reviewed > broken.out; echo "exit $?"
head -3 broken.out; rm tests/broken.yaml broken.out

exit 1
FAIL writing a file can be undone from its backup
       compensation argument `backup_id` is "b1", expected "b9"
ok   a failed write leaves nothing to undo

mkdir keys
rv keygen keys/signing
rv manifests publish drafts --registry registry --by alice --key keys/signing.key --note "first drafts from suggest-manifest"
rv manifests approve fs.read_file --registry registry --by alice --four-eyes --key keys/signing.key; echo "exit $?"

wrote keys/signing.key and keys/signing.pub (key id ae0ce962c5978747)
fs.delete_file  v1  draft  16c5f8580b19
fs.list_dir  v1  draft  d7f9551d1c2a
...
fs.write_file  v1  draft  21b8d6991e45
error: the author of a draft cannot approve it: ask someone else
exit 1

for t in $(ls drafts | sed 's/\.yaml$//'); do
  rv manifests approve $t --registry registry --by bob --four-eyes --key keys/signing.key --note reviewed
done
rv manifests list --registry registry
rv manifests history fs.write_file --registry registry
rv manifests diff fs.write_file 1 2 --registry registry | grep '^[-+]'
rv manifests verify --registry registry --trust keys/signing.pub

fs.delete_file  v2  approved by bob
...
fs.delete_file                           v2  approved
fs.list_dir                              v2  approved
fs.make_dir                              v2  approved
fs.read_file                             v2  approved
fs.remove_dir                            v2  approved
fs.restore_file                          v2  approved
fs.write_file                            v2  approved
v1  draft       2026-10-16T17:22:36Z  by alice  21b8d6991e45  signed  - first drafts from suggest-manifest
v2  approved    2026-10-16T17:22:37Z  by alice, approved by bob  3cec779960c1  signed  - reviewed
-  "version": 1,
-  "status": "draft",
+  "version": 2,
+  "status": "approved",
ok: 7 tools, every version verifies

cat > reversi.config.yaml <<EOF
manifests: ./registry
manifest_public_key: ./keys/signing.pub
data: { dir: ./data, store: files }
EOF
rmdir manifests
rv doctor | grep -E 'registry|manifests load'
rv validate registry

ok    manifest registry <scratch>/gw/registry: every version verifies
ok    7 manifests load
ok: 7 tool manifests valid

cp registry/tools/fs.write_file/v2.json $T/v2.good
sed -i.bak 's/"permission": "fs:write"/"permission": "fs:read"/' registry/tools/fs.write_file/v2.json && rm registry/tools/fs.write_file/v2.json.bak
rv manifests verify --registry registry --trust keys/signing.pub; echo "exit $?"
rv doctor | grep FAIL
node $REPO/packages/gateway/dist/main.js --config gateway.yaml 2>&1 | head -1

BAD `fs.write_file` v2 was changed outside the registry: its checksum does not match the index
exit 1
FAIL  manifest registry: `fs.write_file` v2 was changed outside the registry: its checksum does not match the index
FAIL  engine: `fs.write_file` v2 was changed outside the registry: its checksum does not match the index
error: `fs.write_file` v2 was changed outside the registry: its checksum does not match the index

cp $T/v2.good registry/tools/fs.write_file/v2.json
rv manifests verify --registry registry --trust keys/signing.pub

ok: 7 tools, every version verifies

AGENT=agent-$(openssl rand -hex 8); APPR=appr-$(openssl rand -hex 8); OPS=ops-$(openssl rand -hex 8); ROOT=root-$(openssl rand -hex 8)
cat > keys.json <<EOF
[
  { "name": "fs-agent", "role": "agent",    "key_sha256": "$(sha $AGENT)", "max_permissions": ["fs:read","fs:write","fs:admin"] },
  { "name": "alice",    "role": "approver", "key_sha256": "$(sha $APPR)" },
  { "name": "dana",     "role": "operator", "key_sha256": "$(sha $OPS)" },
  { "name": "root",     "role": "admin",    "key_sha256": "$(sha $ROOT)" }
]
EOF
sed -i.bak 's/^upstreams:/mode: enforce\nupstreams:/' gateway.yaml && rm gateway.yaml.bak
echo 'auth: { keys: keys.json }' >> gateway.yaml
node $REPO/packages/gateway/dist/main.js --config gateway.yaml > gw.log 2>&1 &
echo $! > gw.pid; waitfor 7700; cat gw.log

reversi-connectors: serving fs on stdio
Reversi gateway running in enforce mode.

OK     fs.read_file - read_only
OK     fs.list_dir - read_only
OK     fs.write_file - compensable
OK     fs.delete_file - irreversible
OK     fs.restore_file - idempotent
OK     fs.make_dir - irreversible
OK     fs.remove_dir - irreversible
WARN   fs.move_file - no manifest; treated as a change that could not be undone
WARN   fs.unmove_file - no manifest; treated as a change that could not be undone

7 classified, 0 unclassified reads, 2 unclassified changes, 0 destructive without a manifest.

2 tools have no manifest and are blocked. Draft them with: reversi suggest-manifest, review, then reversi manifests publish.
reversi-gateway: enforce mode, agent endpoint http://127.0.0.1:7700/mcp, files store

agent() { mcp $U "$@" --token $AGENT --run enf-1; }
echo "-- unclassified tool"
agent call fs.move_file '{"from":"notes.txt","to":"moved.txt"}'
echo "-- allowed call"
agent call fs.write_file '{"path":"notes.txt","content":"changed by agent"}' --reason "update notes"
cat sandbox/notes.txt; echo
echo "-- approval required"
agent call fs.delete_file '{"path":"notes.txt"}'
rv approvals list

-- unclassified tool
ERROR RESULT:
Blocked by Reversi: no manifest registered for tool `fs.move_file`
-- allowed call
RESULT:
{"path":"notes.txt","backup_id":"a5cda514-...","existed":true}
changed by agent
-- approval required
ERROR RESULT:
Blocked by Reversi: approval required: request apr_39763c04-... is pending an operator decision; retry after it is approved
apr_39763c04-...  pending  run=enf-1  call  fs.delete_file  args=[path]  why: manifest requires approval

ID=$(rv approvals list | awk '{print $1}' | head -1)
rv approvals approve $ID --as alice --note "checked the ticket"
agent call fs.delete_file '{"path":"notes.txt"}'
ls sandbox
rv approvals list
rv export --run enf-1 | jq -r 'select(.event=="approved") | .actor + ": " + .detail' | cut -c1-110

apr_39763c04-... approved by alice
RESULT:
{"path":"notes.txt","backup_id":"62beadea-..."}
apr_39763c04-...  consumed  run=enf-1  call  fs.delete_file  args=[path]  why: manifest requires approval
alice: approval apr_39763c04-... approved by alice; the call must be retried

echo restore-me > sandbox/keep.txt
a3() { mcp $U "$@" --token $AGENT --run enf-3; }
a3 call fs.write_file '{"path":"keep.txt","content":"overwritten"}' > /dev/null
a3 call fs.write_file '{"path":"new.txt","content":"brand new"}' > /dev/null
ls sandbox; cat sandbox/keep.txt; echo
rv plan enf-3

keep.txt
new.txt
overwritten
rollback plan for enf-3
  step 1  fs.write_file  compensate  -> fs.restore_file
  step 0  fs.write_file  compensate  -> fs.restore_file
fully reversible (assuming each compensation succeeds)

op() { mcp http://127.0.0.1:7700/operator/mcp "$@" --token $OPS; }
mcp http://127.0.0.1:7700/operator/mcp list --token $AGENT
op call reversi.execute_rollback '{"run_id":"enf-3"}' | head -12
op call reversi.execute_rollback '{"run_id":"enf-3","confirm":true}' | grep -E 'dry_run|complete'
ls sandbox; cat sandbox/keep.txt
rv runs show enf-3 | tail -5
rv verify

could not connect: Streamable HTTP error: Error POSTing to endpoint: {"error":"auditor role or higher required"}
RESULT:
{
  "dry_run": true,
  "plan": {
    "run_id": "enf-3",
    "actions": [
      {
        "step": 1,
        "tool": "fs.write_file",
        "kind": "compensate",
        "compensation_tool": "fs.restore_file",
...
  "dry_run": false,
    "complete": true
keep.txt
restore-me
     24  ...  compensating        fs.restore_file  by dana  | idempotency_key=f7b454af...
     25  ...  compensated         fs.restore_file  by dana
     26  ...  compensating        fs.restore_file  by dana  | idempotency_key=f49bdada...
     27  ...  compensated         fs.restore_file  by dana
ok: 28 records, head 4141ffba...

kill $(cat gw.pid)

mkdir $T/feat && cd $T/feat
ln -s $REPO/node_modules node_modules          # so the script finds @modelcontextprotocol/sdk
cat > notes-server.mjs <<'EOF'
import { existsSync } from "node:fs";
import { Server } from "@modelcontextprotocol/sdk/server/index.js";
import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";

const notes = new Map();
const attempts = new Map();
const tools = () => [
  { name: "notes_get", description: "Read a note.", annotations: { readOnlyHint: true },
    inputSchema: { type: "object", properties: { id: { type: "string", minLength: 1 } }, required: ["id"], additionalProperties: false } },
  { name: "notes_add", description: "Create a note (safe to repeat).",
    inputSchema: { type: "object", properties: { title: { type: "string", minLength: 1 }, priority: { type: "integer", minimum: 1, maximum: 5 },
      ...(existsSync("drift.flag") ? { tags: { type: "array", items: { type: "string" } } } : {}) }, required: ["title", "priority"], additionalProperties: false } },
  { name: "notes_slow", description: "Answer after a delay.", annotations: { readOnlyHint: true },
    inputSchema: { type: "object", properties: { ms: { type: "integer" } }, required: ["ms"] } },
  { name: "notes_flaky", description: "Fails twice per id, then works.", annotations: { readOnlyHint: true },
    inputSchema: { type: "object", properties: { id: { type: "string" } }, required: ["id"] } },
];
const server = new Server({ name: "notes", version: "1" }, { capabilities: { tools: {} } });
server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: tools() }));
server.setRequestHandler(CallToolRequestSchema, async (req) => {
  const { name, arguments: a = {} } = req.params;
  const say = (o) => ({ content: [{ type: "text", text: JSON.stringify(o) }] });
  if (name === "notes_add") { const id = `n${notes.size + 1}`; notes.set(id, a); return say({ id, ...a }); }
  if (name === "notes_get") return say(notes.get(a.id) ?? { error: "no such note" });
  if (name === "notes_slow") { await new Promise((r) => setTimeout(r, a.ms)); return say({ waited: a.ms }); }
  if (name === "notes_flaky") {
    const n = (attempts.get(a.id) ?? 0) + 1; attempts.set(a.id, n);
    if (n < 3) throw new Error(`temporary failure (attempt ${n})`);
    return say({ id: a.id, attempts: n });
  }
  throw new Error(`unknown tool ${name}`);
});
await server.connect(new StdioServerTransport());
EOF
rv suggest-manifest --upstream-cmd node --upstream-arg notes-server.mjs --server notes --out drafts > /dev/null 2>&1
mkdir manifests && cp drafts/*.yaml manifests/
sed -i.bak -e '/^# /d' -e 's/^status: draft/status: approved/' -e 's/^effect: irreversible/effect: idempotent/' -e 's/^approval: always/approval: never/' manifests/*.yaml && rm manifests/*.bak
echo 'timeout_ms: 500ms' >> manifests/notes_slow.yaml
printf 'timeout_ms: 2s\nretry: { attempts: 3, base_ms: 100 }\n' >> manifests/notes_flaky.yaml
rv validate manifests
rv lint manifests | tail -1

ok: 4 tool manifests valid
0 errors, 1 warnings, 1 notes

AGENT=agent-$(openssl rand -hex 8); OPS=ops-$(openssl rand -hex 8)
cat > keys.json <<EOF
[
  { "name": "notes-agent", "role": "agent",    "key_sha256": "$(sha $AGENT)", "max_permissions": ["notes:read","notes:admin"] },
  { "name": "dana",        "role": "operator", "key_sha256": "$(sha $OPS)" }
]
EOF
cat > gateway.yaml <<EOF
mode: advise
upstreams:
  - { name: notes, command: node, args: ["$T/feat/notes-server.mjs"], cwd: "$T/feat", namespace: false }
listen: { host: 127.0.0.1, port: 7701 }
auth: { keys: keys.json }
EOF
node $REPO/packages/gateway/dist/main.js --config gateway.yaml --manifests manifests --data data5 > gw.log 2>&1 &
echo $! > gw.pid; waitfor 7701; tail -9 gw.log

Reversi gateway running in advise mode.

OK     notes_get - read_only
OK     notes_add - idempotent
OK     notes_slow - read_only
OK     notes_flaky - read_only

4 classified, 0 unclassified reads, 0 unclassified changes, 0 destructive without a manifest.
reversi-gateway: advise mode, agent endpoint http://127.0.0.1:7701/mcp, files store

U=http://127.0.0.1:7701/mcp
ag() { mcp $U "$@" --token $AGENT --run f-1; }
ag call notes_add '{"title":"buy milk","priority":2}'
ag call notes_add '{"title":"","priority":9}'
rv search --event would_block --run f-1 -d data5 -m manifests

RESULT:
{"id":"n1","title":"buy milk","priority":2}
RESULT:
{"id":"n2","title":"","priority":9}
Reversi advisory (nothing was blocked): arguments do not match the tool's input schema: $.title: shorter than 1; $.priority: above maximum 5
     3  ...  f-1#1  would_block         notes_add  notes-agent  | arguments do not match the tool's input schema: $.title: shorter than 1; $.priority: above

kill $(cat gw.pid)
sed -i.bak 's/^mode: advise/mode: enforce/' gateway.yaml && rm gateway.yaml.bak
node $REPO/packages/gateway/dist/main.js --config gateway.yaml --manifests manifests --data data5 > gw.log 2>&1 &
echo $! > gw.pid; waitfor 7701
ag() { mcp $U "$@" --token $AGENT --run f-2; }
ag call notes_add '{"title":"buy milk","priority":2}'
ag call notes_add '{"title":"","priority":9}'
ag call notes_add '{"title":"x"}'
echo "-- timeout"
ag call notes_slow '{"ms":100}'
ag call notes_slow '{"ms":2000}'
echo "-- retry"
ag call notes_flaky '{"id":"a"}'

RESULT:
{"id":"n1","title":"buy milk","priority":2}
ERROR RESULT:
Blocked by Reversi: arguments do not match the tool's input schema: $.title: shorter than 1; $.priority: above maximum 5
ERROR RESULT:
Blocked by Reversi: arguments do not match the tool's input schema: $: missing required `priority`
-- timeout
RESULT:
{"waited":100}
request failed: MCP error -32603: upstream did not answer within 500 ms
-- retry
RESULT:
{"id":"a","attempts":3}

mkdir held && mv manifests/notes_get.yaml held/
sleep 4; tail -1 gw.log
mcp $U call notes_get '{"id":"n1"}' --token $AGENT --run f-3

reversi [info] reloaded: 3 manifests, policy none
ERROR RESULT:
Blocked by Reversi: no manifest registered for tool `notes_get`

cp manifests/notes_slow.yaml held/
sed -i.bak 's/^effect: read_only/effect: nonsense/' manifests/notes_slow.yaml && rm manifests/notes_slow.yaml.bak
sleep 4; tail -2 gw.log
mcp $U call notes_slow '{"ms":10}' --token $AGENT --run f-3
cp held/notes_slow.yaml manifests/notes_slow.yaml

reversi [info] reloaded: 3 manifests, policy none
reversi [error] reload failed, keeping the previous manifests and policy: manifests/notes_slow.yaml: `notes_slow`: `effect` must be one of read_only, idempotent, reversible, compensable, irreversible
RESULT:
{"waited":10}

kill $(cat gw.pid)
sed -i.bak 's/^mode: enforce/mode: enforce\nunclassified_reads: observe/' gateway.yaml && rm gateway.yaml.bak
node $REPO/packages/gateway/dist/main.js --config gateway.yaml --manifests manifests --data data5 >> gw.log 2>&1 &
echo $! > gw.pid; waitfor 7701
grep -E '^NOTE' gw.log | tail -1
mcp $U call notes_get '{"id":"n1"}' --token $AGENT --run f-3
rv runs list -d data5 -m manifests | grep f-3
rv runs show f-3-reads -d data5 -m manifests | grep -E 'unclassified read|^steps|^ +0  notes'

NOTE   notes_get - no manifest; the server says it is read-only (unverified)
RESULT:
{"error":"no such note"}
f-3  actor=notes-agent  mode=enforce  steps=1  complete
f-3-reads  actor=notes-agent  mode=observe  steps=1  complete
steps
    0  notes_get                    no manifest  succeeded
      24  ...  intended            notes_get  by notes-agent  | unclassified read: the server says it is read-only; this is unverified

mv held/notes_get.yaml manifests/
sleep 4; tail -1 gw.log

reversi [info] reloaded: 4 manifests, policy none

touch drift.flag; sleep 6
mcp $U call notes_add '{"title":"after drift","priority":1}' --token $AGENT --run f-4

ERROR RESULT:
Blocked by Reversi: the tool's input schema changed since its manifest was approved: review the manifest again

rv suggest-manifest --upstream-cmd node --upstream-arg notes-server.mjs --server notes --out drafts2 > /dev/null 2>&1
grep schema_hash manifests/notes_add.yaml drafts2/notes_add.yaml
NEW=$(grep '^schema_hash' drafts2/notes_add.yaml | cut -d' ' -f2)
sed -i.bak "s/^schema_hash: .*/schema_hash: $NEW/" manifests/notes_add.yaml && rm manifests/notes_add.yaml.bak
sleep 4
mcp $U call notes_add '{"title":"after drift","priority":1,"tags":["a"]}' --token $AGENT --run f-4

manifests/notes_add.yaml:schema_hash: 7941405d5073f08d
drafts2/notes_add.yaml:schema_hash: f26233af61faf95f
RESULT:
{"id":"n1","title":"after drift","priority":1,"tags":["a"]}

op() { mcp http://127.0.0.1:7701/operator/mcp "$@" --token $OPS; }
mcp $U call reversi.preview_impact '{"tool":"notes_add","arguments":{"title":"x","priority":1}}' --token $AGENT --run f-4 | grep -E '"(verdict|effect)"'
mcp $U call reversi.preview_impact '{"tool":"nope"}' --token $AGENT --run f-4 | grep -E '"(verdict|known)"|unclassified'
op call reversi.classification | grep -E '"(name|class)"'
op call reversi.suggest_manifest
mcp $U list --token $AGENT --run f-4 | grep -c -E 'classification|suggest_manifest'

  "effect": "idempotent",
  "verdict": "allow",
  "known": false,
  "verdict": "block",
    "unclassified tool"
      "name": "notes_get",
      "class": "classified",
      "name": "notes_add",
      "class": "classified",
      "name": "notes_slow",
      "class": "classified",
      "name": "notes_flaky",
      "class": "classified",
RESULT:
{
  "suggestions": [],
  "skipped": [
    "notes_get",
    "notes_add",
    "notes_slow",
    "notes_flaky"
  ]
}
0

kill $(cat gw.pid)

mkdir -p $T/ap/desired/manifests && cd $T/ap
cp $T/feat/manifests/*.yaml desired/manifests/
cat > desired/policy.yaml <<'EOF'
version: 1
rules:
  - id: no-big-priority
    match: { tool: notes_add }
    when: [{ path: $args.priority, op: gt, value: 3 }]
    action: require_approval
    reason: high priority notes need a person
tests:
  - { name: low priority is fine, input: { tool: notes_add, args: { priority: 1 } }, expect: allow }
  - { name: high priority needs approval, input: { tool: notes_add, args: { priority: 5 } }, expect: require_approval }
EOF
ls -R desired

desired:
manifests
policy.yaml

desired/manifests:
notes_add.yaml
notes_flaky.yaml
notes_get.yaml
notes_slow.yaml

rv apply desired --registry reg --policy-dir pol --by gitops --dry-run --detailed-exitcode; echo "exit $?"
ls reg pol 2>&1

+ manifest notes_add
+ manifest notes_flaky
+ manifest notes_get
+ manifest notes_slow
+ policy   policy
5 changes (dry run: nothing applied)
exit 2
ls: pol: No such file or directory
ls: reg: No such file or directory

rv apply desired --registry reg --policy-dir pol --by gitops --key $T/gw/keys/signing.key --note "initial import"
echo "-- again"
rv apply desired --registry reg --policy-dir pol --by gitops --key $T/gw/keys/signing.key; echo "exit $?"
rv manifests verify --registry reg --trust $T/gw/keys/signing.pub

+ manifest notes_add
...
5 changes
applied notes_add v1 (approved)
applied notes_flaky v1 (approved)
applied notes_get v1 (approved)
applied notes_slow v1 (approved)
applied policy v1
-- again
  manifest notes_add  unchanged
  ...
  policy   policy  unchanged
up to date
exit 0
ok: 4 tools, every version verifies

sed -i.bak 's/^timeout_ms: 500ms/timeout_ms: 1s/' desired/manifests/notes_slow.yaml && rm desired/manifests/*.bak
rv apply desired --registry reg --policy-dir pol --by gitops --key $T/gw/keys/signing.key --dry-run --detailed-exitcode; echo "exit $?"
rv apply desired --registry reg --policy-dir pol --by gitops --key $T/gw/keys/signing.key --note "slow timeout 1s"
rv manifests diff notes_slow 1 2 --registry reg | grep '^[-+]'

  manifest notes_add  unchanged
  manifest notes_flaky  unchanged
  manifest notes_get  unchanged
~ manifest notes_slow  (v1 differs)
  policy   policy  unchanged
1 change (dry run: nothing applied)
exit 2
...
applied notes_slow v2 (approved)
-  "version": 1,
+  "version": 2,
-  "timeout_ms": 500,
+  "timeout_ms": 1000,

rm desired/manifests/notes_flaky.yaml
rv apply desired --registry reg --policy-dir pol --by gitops --dry-run | tail -1
rv apply desired --registry reg --policy-dir pol --by gitops --key $T/gw/keys/signing.key --prune
rv manifests list --registry reg

up to date
  manifest notes_add  unchanged
  manifest notes_get  unchanged
  manifest notes_slow  unchanged
- manifest notes_flaky  (not in the directory)
  policy   policy  unchanged
1 change
deprecated notes_flaky
notes_add                                v1  approved
notes_flaky                              v2  deprecated
notes_get                                v1  approved
notes_slow                               v2  approved

mkdir -p seed/manifests && cp $T/feat/manifests/notes_get.yaml seed/manifests/ && printf 'version: 1\nrules: []\n' > seed/policy.yaml
rv apply seed --registry srv-reg --policy-dir srv-pol --by seed --key $T/gw/keys/signing.key | tail -2
SROOT=root-$(openssl rand -hex 8); SOPS=ops-$(openssl rand -hex 8)
cat > srv-keys.json <<EOF
[
  { "name": "dana", "role": "operator", "key_sha256": "$(sha $SOPS)" },
  { "name": "root", "role": "admin",    "key_sha256": "$(sha $SROOT)" }
]
EOF
REVERSI_MANIFESTS=srv-reg REVERSI_POLICY=srv-pol REVERSI_KEYS=srv-keys.json REVERSI_DATA=srv-data \
REVERSI_SIGNING_KEY=$T/gw/keys/signing.key PORT=7702 node $REPO/packages/server/dist/main.js > srv.log 2>&1 &
echo $! > srv.pid; waitfor 7702; cat srv.log

applied notes_get v1 (approved)
applied policy v1
reversi-server listening on http://127.0.0.1:7702 (1 tools, files store, console off)

S=http://127.0.0.1:7702
rv apply desired --server $S --token $SROOT --dry-run --detailed-exitcode; echo "exit $?"
echo "-- operator key"
rv apply desired --server $S --token $SOPS; echo "exit $?"
echo "-- admin key"
rv apply desired --server $S --token $SROOT --note "from git"; echo "exit $?"
rv apply desired --server $S --token $SROOT | tail -1
cat srv.log | tail -3

+ manifest notes_add
  manifest notes_get  unchanged
+ manifest notes_slow
~ policy   policy
3 changes (dry run: nothing applied)
exit 2
-- operator key
+ manifest notes_add
  manifest notes_get  unchanged
+ manifest notes_slow
~ policy   policy
3 changes
error: POST /v1/registry/manifests: 403 admin role required
exit 1
-- admin key
...
applied notes_add v1 (approved)
applied notes_slow v1 (approved)
applied policy v2
exit 0
up to date
reversi [info] reloaded: 2 manifests, policy 10ddd32c
reversi [info] reloaded: 3 manifests, policy 10ddd32c
reversi [info] reloaded: 3 manifests, policy 4cd2f41a

kill $(cat srv.pid)
rm -rf $T