feat: quarantine upstream update candidates

tests/skills-coexistence.nix

@@ -2,6 +2,7 @@
   self,
   nixpkgs,
   system,
+  hermes-agent ? self.packages.${system}.hermes-agent,
 }:
 
 let
@@ -21,7 +22,7 @@ pkgs.testers.runNixOSTest {
 
       services.hermes-agent = {
         enable = true;
-        package = self.packages.${system}.hermes-agent;
+        package = hermes-agent;
         skills = {
           bundled.enable = false;
           custom.repo-watch = {

tests/test_render_update_report.py

@@ -0,0 +1,76 @@
+import argparse
+import importlib.util
+import tempfile
+import unittest
+from pathlib import Path
+
+
+SCRIPT = Path(__file__).parents[1] / "scripts" / "render-update-report.py"
+SPEC = importlib.util.spec_from_file_location("render_update_report", SCRIPT)
+REPORT = importlib.util.module_from_spec(SPEC)
+assert SPEC.loader is not None
+SPEC.loader.exec_module(REPORT)
+
+
+class RenderUpdateReportTest(unittest.TestCase):
+    def write_source(self, root: Path, dependencies: list[str], config_version: int) -> None:
+        (root / "hermes_cli").mkdir(parents=True)
+        deps = ", ".join(f'"{item}"' for item in dependencies)
+        (root / "pyproject.toml").write_text(
+            "[project]\n"
+            'requires-python = ">=3.11"\n'
+            f"dependencies = [{deps}]\n"
+            "[project.scripts]\n"
+            'hermes = "hermes_cli.main:main"\n',
+            encoding="utf-8",
+        )
+        (root / "hermes_cli" / "config.py").write_text(
+            f'CURRENT_CONFIG_VERSION = {config_version}\n', encoding="utf-8"
+        )
+
+    def test_reports_dependency_and_schema_changes(self) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            before, after = root / "before", root / "after"
+            self.write_source(before, ["openai>=1", "pydantic"], 3)
+            self.write_source(after, ["openai>=2", "pillow", "cryptography"], 4)
+            args = argparse.Namespace(
+                channel="stable",
+                current_version="0.16.0",
+                candidate_version="0.18.2",
+                current_rev="old",
+                candidate_rev="new",
+                before_source=before,
+                after_source=after,
+                build_status="failed",
+                build_log=None,
+                upstream_url="https://example.invalid/release",
+            )
+
+            rendered = REPORT.render(args)
+
+            self.assertIn("added: `cryptography`, `pillow`; removed: `pydantic`", rendered)
+            self.assertIn("changed: `openai` (`openai>=1` → `openai>=2`)", rendered)
+            self.assertIn("| Config schema | `3` | `4` |", rendered)
+            self.assertIn("❌ failed", rendered)
+
+    def test_missing_sources_are_reported_without_crashing(self) -> None:
+        args = argparse.Namespace(
+            channel="nightly",
+            current_version="old",
+            candidate_version="new",
+            current_rev="old-rev",
+            candidate_rev="new-rev",
+            before_source=None,
+            after_source=None,
+            build_status="passed",
+            build_log=None,
+            upstream_url=None,
+        )
+        rendered = REPORT.render(args)
+        self.assertIn("| Python | `unknown` | `unknown` |", rendered)
+        self.assertIn("✅ passed", rendered)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/update-common.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+# shellcheck source=scripts/update-common.sh
+source "$repo_root/scripts/update-common.sh"
+
+log=$(mktemp)
+trap 'rm -f "$log"' EXIT
+
+printf 'error: hash mismatch\n  got:    sha256-AbCd0123+/=\n' >"$log"
+[[ "$(extract_sri_hash "$log")" == "sha256-AbCd0123+/=" ]]
+
+printf 'specified: sha256-old\n       got: sha256-newValue=\n' >"$log"
+[[ "$(extract_sri_hash "$log")" == "sha256-newValue=" ]]
+
+printf 'an unrelated dependency failure\n' >"$log"
+[[ -z "$(extract_sri_hash "$log")" ]]
+
+status=$(run_validation "$log" bash -c 'echo dependency-broke; exit 42')
+[[ "$status" == "failed" ]]
+grep -q dependency-broke "$log"
+
+status=$(run_validation "$log" bash -c 'echo all-good')
+[[ "$status" == "passed" ]]
+grep -q all-good "$log"