CLI tests and release status

What has been verified

This is the 21 October 2026 release checkpoint. The installed Windows preview remains 0.6.0-dev.20261020. The backend and console have passed official CI, merged through their protected branches and deployed. Native verification covers all five supported targets. The CLI still requires an independent maintainer approval before its protected merge. Documentation publication does not publish a stable executable.

Area	v0.6 evidence
CLI checks	Official CI, Go race tests and go vet pass
Real engine	56 checks pass using the exact Windows executable
Real backend	Two PostgreSQL/full-router integration tests pass, including actual Go CLI processes
Console	Official CI, TypeScript checks and seven Chromium tests pass
Terminal UI	Native Windows menu navigation, cancellation and exit exercised
Installer	All five native targets pass checksum, installation, executable and backup checks; Windows fresh-process PATH resolution also passes
Native Linux v0.6	Linux x64 under WSL2 and native ARM64 pass runtime, Secret Service and Bash/Zsh/Fish checks
Native macOS v0.6	Intel and Apple Silicon pass runtime, Keychain and Bash/Zsh/Fish checks
Signed updater	All five targets pass temporary-key replacement, backup and rejection checks on disposable executables
Backend release CI	All official checks pass; the official ARM artifact was retrieved and verified
Production administration	Backend deployed and migration-verified on both production nodes; paired console published; signed-in acceptance is a separate release gate
Stable distribution	Independent maintainer approval, production signing, public package verification and publication remain release gates

The 56 real-engine checks used the native Windows CLI with a released engine under ARM64 QEMU in WSL2 and disposable data. Separate CLI runtime checks now cover native Linux x64 under WSL2, native Linux ARM64, and both Mac architectures. The engine fixture’s emulation is not the evidence for those native CLI passes.

Signed-updater checks cover valid replacement and launch, retained recovery binaries, and rejection of tampered signatures, wrong keys, incorrect binary hashes, expired manifests, downgrades and truncated downloads without changing the executable. They use temporary test keys. Production signing and public installation/update verification remain release gates.

Real end-to-end coverage

The 56 released-engine checks cover SQL and parameters, transaction sessions, schema access, Elasticsearch-compatible search, graph/Cypher and traversal, vector writes/query/explanation/listing, and native FTS indexing with BM25 and boolean search. They exercise terminal FTS navigation/cancellation and refused graph, vector and FTS reads and writes. Sparse/hybrid routing has CLI contract coverage. Phrase mode is exposed, but this checkpoint does not claim a separate real-engine semantic proof for every accepted request body or search mode.

The real PostgreSQL/full-router suite checks administrative scope, organization binding, current membership and authority, unchanged read-only tokens, role CRUD, invitation and assignment handling, in-use roles, last-owner protection, demotion, revocation and audit records. Actual Go CLI processes exercise administrative login, role/permission/member reads and role CRUD confirmations. Existing browser approval, native Windows vault storage, fresh-process discovery and logout flows also pass.

Seven Chromium tests use synthetic account/API fixtures. They cover browser approval, explicit administrative consent and scope disclosure alongside the existing token UI contracts. They are separate from the real backend evidence and do not prove the signed-in production journey.

Production backend verification confirms the released executable and all 110 ordered migrations on both nodes. Public deployment checks also pass for the paired console. Signed-in acceptance separately checks browser consent, read-only refusal of administration, role and permission operations, and token revocation before stable CLI publication. A deployed page or a passing fixture alone does not establish those authenticated results.

No real team invitations were sent. Mail-provider credentials were removed from the test environment. Disposable engine data and the PostgreSQL fixture were removed; their listeners were verified closed.

Terminal and authorization contracts

CLI contracts cover command routing, invalid JSON/arguments, missing confirmation, read-only scope refusal, output handling and empty successful write responses. Menu tests cover rendering, independent profile selection, navigation, :cancel, EOF, Ctrl+C and terminal-control-character escaping. Opening the menu does not send background requests or record query history.

org:admin is a separately approved token scope. It does not upgrade old tokens or bypass current role permissions. Organization roles are distinct from engine SQL grants. Production acceptance must confirm both authorization layers.

Earlier platform evidence

The preceding v0.5 checkpoint had native Windows x64, Linux x64 under WSL2 and Intel macOS runtime receipts, including their credential stores and installers. Its Linux ARM64 source CI was also recorded as passing. Those receipts remain attached to their original version and source. They do not count as native v0.6 runtime, package, vault or signed-update verification.

Reproduce the developer checks

From the v0.6 source checkout:

go test ./... -count=1
go vet ./...
go build -o oc ./cmd/oc
./oc ui --render --plain

On Windows, build oc.exe and invoke ./oc.exe. For the repository’s native credential-store and completion suite:

python3 scripts/verify_native.py

Use python on Windows. Unix runners require the expected shells and an available, unlocked credential store. Run platform checks on each advertised target; cross-compilation alone is not runtime verification.

Reproduce the real-engine process

Use an explicitly disposable loopback engine owned by the test. Start it with an empty task-specific data directory and OC_DB_RBAC_ENFORCE_WRITES=1. Supply its temporary bearer through the process environment, along with OC_SMOKE_DISPOSABLE=1, OC_SMOKE_URL and OC_SMOKE_TOKEN. Then run:

python3 scripts/smoke.py --binary ./oc --receipt smoke.json

The script seeds a unique tenant and verifies permitted and denied operations. Keep the receipt tied to the executable hash. The caller owns fixture cleanup: stop the exact engine, verify its listener has closed, remove its temporary data and synthetic credentials, and clear the environment variables.

For ordinary use with an existing database, follow the end-to-end guide.

Production acceptance process

Before declaring the v0.6 features generally available:

1. Review and publish the CLI, backend and console source changes; run official checks against their current commits and obtain required maintainer approval.
2. Recheck migration numbering against current backend main. The local checkpoint passed the append-only guard through migration 110; that does not reserve a number against later upstream work.
3. Deploy the personal-token and organization-administration backend migrations and routes through the normal release process, followed by the paired console.
4. Verify default databases:read login and database discovery in production. Approve a separate org:admin login with explicit browser consent.
5. Confirm organization restrictions, current permission enforcement, intended role/member operations and revocation. Check invitation delivery/acceptance with an explicitly authorized recipient.
6. Preserve the completed native v0.6 evidence for every advertised platform, including credential storage, installation, signed updates and recovery. Repeat affected checks if the reviewed executable source changes.
7. Build reviewed packages with the trusted publisher public key; publish assets and then the signed, expiring manifest. Verify a public installation and update on each advertised target.

The documentation task does not close these release gates. Database lifecycle, bulk import, SQL autocomplete, billing and credential administration are outside the implemented command set.

Temporary resource cleanup

The v0.6 local fixtures were removed after verification. Both Mac test instances are terminated; dedicated-host release awaits the provider’s minimum allocation period and final readback. The temporary CI runner retains its approved cleanup deadline. Historical v0.5 resource retirement has separate receipts.