ci.yml

name: CI

on:
  # Manual dispatch runs only Windows; automatic checks include macOS recording.
  workflow_dispatch:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ci-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  CI: "true"
  CARGO_TERM_COLOR: always

jobs:
  javascript:
    if: github.event_name != 'workflow_dispatch'
    name: JavaScript (${{ matrix.shard }}/6)
    runs-on: ubuntu-24.04
    # Vitest shards by path hash and equal file count, not duration, so slow
    # files can share one. Six keeps the slowest well inside this deadline on
    # slower runners; five barely moves it, and seven is slower than six.
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2, 3, 4, 5, 6]
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup
      - name: Lint and types
        run: ./bin/pnpm check
      # check already ran TypeScript; do not repeat pnpm build's typecheck.
      - name: Frontend build
        run: ./bin/pnpm exec vite build
      - name: Vitest shard
        env:
          # Bound contention between suites that sign and verify large fixtures.
          BUZZ_TEST_WORKERS: "2"
        run: ./bin/node scripts/ci-test-report.mjs kind=vitest report=test-results/ci/vitest.json evidence=test-results/ci/vitest-timing.json title="Vitest shard ${{ matrix.shard }}/6" -- ./bin/pnpm exec vitest run --shard=${{ matrix.shard }}/6 --reporter=default --reporter=json --outputFile=test-results/ci/vitest.json
      - name: Vitest timing evidence
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: vitest-timing-${{ matrix.shard }}
          path: test-results/ci
          retention-days: 7

  agent_protection:
    if: github.event_name != 'workflow_dispatch'
    name: Protected agents (macOS)
    runs-on: macos-15
    # Native pinned runtime builds add cold compilation to the kernel fixtures.
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup
      - name: Install pinned Pi test dependencies
        run: |
          source bin/activate-hermit
          cd src/bundled/pi/deps
          npm ci --ignore-scripts --no-audit --no-fund
      - name: Real Pi tools and recovery
        env:
          PI_DEPS: ${{ github.workspace }}/src/bundled/pi/deps
        run: ./bin/node scripts/ci-test-report.mjs kind=vitest report=test-results/protection/vitest.json evidence=test-results/protection/timing.json title="Protected Pi" -- ./bin/pnpm exec vitest run src/bundled/pi/protection.live.test.ts --reporter=default --reporter=json --outputFile=test-results/protection/vitest.json
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          key: agent-protection
          save-if: ${{ github.event_name == 'push' }}
      - name: Install exact protected Claude fixture
        run: ./bin/node scripts/install-protected-claude-test.mjs
      - name: Native Claude protection boundary
        env:
          BUZZ_TEST_WORKERS: "2"
          CLAUDE_PROTECTION_BIN: ${{ github.workspace }}/target/protected-claude-test/claude
        run: ./bin/node scripts/ci-test-report.mjs kind=vitest report=test-results/protection/native-vitest.json evidence=test-results/protection/native-timing.json title="Native security hooks" -- ./bin/pnpm exec vitest run src/bundled/claude-code/protection.live.test.ts --reporter=default --reporter=json --outputFile=test-results/protection/native-vitest.json
      - name: Native approval-state containment
        run: |
          mkdir -p test-results/protection
          set -o pipefail
          ./bin/cargo test --manifest-path src-tauri/Cargo.toml host_process --lib 2>&1 | tee test-results/protection/native.log
      - name: Protection test evidence
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: agent-protection
          path: test-results/protection
          retention-days: 7

  native:
    if: github.event_name != 'workflow_dispatch'
    name: Rust and tool integration
    runs-on: ubuntu-24.04
    # A Cargo.lock change rebuilds most crates from a cold cache, and only a
    # finished main push saves a warm one, so leave room for that cold run.
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup
      - name: Tauri system libraries
        run: |
          # Azure package downloads can stall until the whole job expires:
          # https://github.com/actions/runner-images/issues/14594
          # Keep the image's official HTTPS archive and security fallbacks.
          sudo sed -i '\|^http://azure\.archive\.ubuntu\.com/ubuntu/|d' /etc/apt/apt-mirrors.txt
          sudo apt-get update
          sudo apt-get install --no-install-recommends -y dbus-daemon libwebkit2gtk-4.1-dev build-essential libssl-dev librsvg2-dev libayatana-appindicator3-dev patchelf
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          key: native
          save-if: ${{ github.event_name == 'push' }}
      - name: Dependency policy
        run: ./bin/cargo-deny --locked check
      - name: Rust formatting
        run: ./bin/cargo fmt --all --check
      - name: Rust lint
        run: ./bin/cargo clippy --workspace --locked --all-targets -- -D warnings
      # --workspace includes Tauri, unlike the default Cargo member selection.
      - name: All Rust tests and doctests
        run: ./bin/cargo test --workspace --locked
      - name: FI Builderlab build and grant tests
        env:
          # Fixture authority only; never use a release's real configuration.
          # It is added before the built-in server, as an internal build's is.
          BUZZ_BUILD_FEDERATED_IDENTITY_CONFIG: '{"version":1,"id":"ci-fi","identityOrigin":"https://identity.example.test","communityHosts":["relay.example.test"],"adapterBase":"https://identity.example.test/api/goose/nip-fa","apiBasePath":"/api/goose/"}'
          BUZZ_BUILDERLAB_URL: ""
        run: |
          ./bin/cargo test -p buzzodz-plugins --lib --locked
          ./bin/cargo test -p Buzz --lib --locked host_request
          ./bin/pnpm exec vite build
      - name: FI opt-out build and grant tests
        env:
          # An empty value opts out of every sign-in server, the built-in one too.
          BUZZ_BUILD_FEDERATED_IDENTITY_CONFIG: ""
        run: |
          ./bin/cargo test -p buzzodz-plugins --lib --locked
          ./bin/cargo test -p Buzz --lib --locked host_request
      - name: Scheduled agent command identity
        run: ./bin/node scripts/test-agent-command.mjs
      - name: Bundled buzz CLI
        run: ./bin/node scripts/test-buzz-cli.mjs
      - name: All Node integration tests
        run: ./bin/node --test tests/integration/*.test.mjs

  windows-native:
    if: github.event_name == 'workflow_dispatch'
    name: Windows native validation
    runs-on: windows-2025
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      # Hermit does not run on Windows. Use the same repository Rust pin with
      # the hosted runner's standard rustup, not a second floating toolchain.
      - name: Select pinned Rust
        shell: pwsh
        run: |
          $version = (Select-String -Path rust-toolchain.toml -Pattern '^channel = "(.+)"$').Matches.Groups[1].Value
          if (!$version) { throw "Expected a rust-toolchain.toml channel" }
          rustup toolchain install $version --profile minimal --component clippy
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          "RUSTUP_TOOLCHAIN=$version" >> $env:GITHUB_ENV
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          key: windows-native
          save-if: ${{ github.ref == 'refs/heads/main' }}
      - name: Native lint including Windows backend
        run: cargo clippy -p Buzz -p buzz-agent-controller -p buzz-credential-store -p buzz-mesh-compute --locked --all-targets -- -D warnings
      - name: All native package tests
        run: cargo test -p Buzz -p buzz-agent-controller -p buzz-credential-store -p buzz-mesh-compute --locked --no-fail-fast

  measurements:
    if: github.event_name != 'workflow_dispatch'
    name: Browser measurements
    runs-on: ubuntu-24.04
    # Match package.json's Playwright version and pin immutable browser/OS layers.
    container:
      image: mcr.microsoft.com/playwright:v1.63.0-noble@sha256:eff16c30e6f3f4af0a03fa4b706120d5e9b0891c344a27d64559aff5900a4a27
      options: --init --ipc=host
    defaults:
      run:
        shell: bash
    env:
      HOME: /root
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - name: Trust this container workspace
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
      - uses: ./.github/actions/setup
        with:
          browsers: "true"
      # Preserve Chromium -> WebKit measurement dependencies; never shard or
      # overlap the two measurement projects on this runner.
      - name: Serial Chromium and WebKit measurements
        env:
          PLAYWRIGHT_JSON_OUTPUT_FILE: test-results/browser/ci-report.json
        run: ./bin/node scripts/ci-test-report.mjs kind=playwright report=test-results/browser/ci-report.json evidence=test-results/browser/ci-timing.json title="Browser measurements" -- ./bin/pnpm test:browser:ci --project '*-measurements' --workers=1 --reporter=list,json
      # Cases tagged @classic-scrollbars need Chromium's platform scrollbars,
      # which Linux always draws as classic ones. One file cannot join the
      # sharded engine matrix (empty shards are errors), so it runs here, and
      # CI required already blocks on this job. The project writes to its own
      # outputDir so this run does not clear the measurement evidence above.
      - name: Chromium classic-scrollbar layout
        env:
          PLAYWRIGHT_JSON_OUTPUT_FILE: test-results/browser-classic-scrollbars/ci-report.json
        run: ./bin/node scripts/ci-test-report.mjs kind=playwright report=test-results/browser-classic-scrollbars/ci-report.json evidence=test-results/browser-classic-scrollbars/ci-timing.json title="Browser classic scrollbars" -- ./bin/pnpm test:browser:ci --project chromium-classic-scrollbars --no-deps --reporter=list,json
      # Exercise the actual perf harness once per case; timing comparisons stay
      # separate. Keep its Chromium workload serial with the measurements above.
      - name: Perf suite smoke check
        run: ./bin/pnpm perf --scenario all --repeat 1 --cpu 4
      - name: Measurement evidence
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: browser-measurements
          path: |
            test-results/browser
            test-results/browser-classic-scrollbars
            test-results/perf
          retention-days: 7

  browser_fixture:
    if: github.event_name != 'workflow_dispatch'
    name: Native browser fixture
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    outputs:
      artifact-id: ${{ steps.fixture-upload.outputs.artifact-id }}
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          key: browser-fixture
          save-if: ${{ github.event_name == 'push' }}
      - name: Build native browser fixture
        timeout-minutes: 8
        run: ./bin/cargo build --locked -p buzzodz-plugins --example fixture-bridge --bin buzzodz --target-dir target/browser-fixture
      - name: Package same-revision native fixture
        run: |
          mkdir -p target/browser-artifact
          cp target/browser-fixture/debug/examples/fixture-bridge target/browser-fixture/debug/buzzodz target/browser-artifact/
          git rev-parse HEAD > target/browser-artifact/revision
          cd target/browser-artifact
          sha256sum fixture-bridge buzzodz > SHA256SUMS
          tar -cf ../browser-fixture.tar fixture-bridge buzzodz revision SHA256SUMS
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        id: fixture-upload
        with:
          name: browser-fixture-${{ github.sha }}-${{ github.run_attempt }}
          path: target/browser-fixture.tar
          if-no-files-found: error
          # Re-running failed shards reuses this artifact by ID, so keep it as
          # long as their evidence.
          retention-days: 7

  browser:
    if: github.event_name != 'workflow_dispatch'
    name: Browser journeys (${{ matrix.engine }}, ${{ matrix.shard }}/${{ matrix.shards }})
    # Measurements stay isolated on their own runner, not on our critical path.
    # CI required still requires their success independently of these jobs.
    needs: [browser_fixture]
    runs-on: ubuntu-24.04
    # Match package.json's Playwright version and pin immutable browser/OS layers.
    container:
      image: mcr.microsoft.com/playwright:v1.63.0-noble@sha256:eff16c30e6f3f4af0a03fa4b706120d5e9b0891c344a27d64559aff5900a4a27
      options: --init --ipc=host
    defaults:
      run:
        shell: bash
    env:
      HOME: /root
      BUZZ_BROWSER_FIXTURE_DIR: target/ci-browser-fixture
    # Playwright sizes file-level shards by test count, not duration, so costly
    # files can share one. WebKit runs slower, so it gets eighteen shards to keep
    # its slowest well inside this deadline on slower runners, setup included;
    # Chromium keeps nine. Size the WebKit count from a recent run's per-test
    # durations and `playwright test --list --shard=K/N`: at fourteen, the
    # slowest shard's summed test time reached 25 minutes (two workers, about
    # 15 minutes of job time) and hit this deadline with every test passing.
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        engine: [chromium, webkit]
        shard: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18]
        exclude:
          - { engine: chromium, shard: 10 }
          - { engine: chromium, shard: 11 }
          - { engine: chromium, shard: 12 }
          - { engine: chromium, shard: 13 }
          - { engine: chromium, shard: 14 }
          - { engine: chromium, shard: 15 }
          - { engine: chromium, shard: 16 }
          - { engine: chromium, shard: 17 }
          - { engine: chromium, shard: 18 }
        include:
          - { engine: chromium, shards: 9 }
          - { engine: webkit, shards: 18 }
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - name: Trust this container workspace
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
      - uses: ./.github/actions/setup
        with:
          browsers: "true"
          browser-engine: ${{ matrix.engine }}
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          artifact-ids: ${{ needs.browser_fixture.outputs.artifact-id }}
          merge-multiple: true
          path: target/ci-browser-fixture
      - name: Verify native browser fixture
        run: |
          cd target/ci-browser-fixture
          tar -xf browser-fixture.tar
          test "$(cat revision)" = "$(git rev-parse HEAD)"
          sha256sum --check SHA256SUMS
          test -x fixture-bridge
          test -x buzzodz
      # CI required enforces measurement success. --no-deps avoids repeating
      # measurements here; the matrix covers both engines on separate runners.
      - name: Functional journeys
        env:
          PLAYWRIGHT_JSON_OUTPUT_FILE: test-results/browser/ci-report.json
        run: ./bin/node scripts/ci-test-report.mjs kind=playwright report=test-results/browser/ci-report.json evidence=test-results/browser/ci-timing.json title="Browser journeys (${{ matrix.engine }}, ${{ matrix.shard }}/${{ matrix.shards }})" -- ./bin/pnpm test:browser:ci --project ${{ matrix.engine }} --no-deps --shard=${{ matrix.shard }}/${{ matrix.shards }} --reporter=list,json
      - name: Browser evidence
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: browser-journeys-${{ matrix.engine }}-${{ matrix.shard }}
          path: test-results/browser
          retention-days: 7

  media_recorder:
    if: github.event_name != 'workflow_dispatch'
    name: WebKit recording (macOS)
    # Playwright disables ENABLE_MEDIA_RECORDER in its GTK/WPE builds.
    # Keep the real recorder and every assertion on the supported WebKit host.
    runs-on: macos-15
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup
      - name: Install pinned WebKit
        run: ./bin/pnpm exec playwright install webkit
      - name: Recording journeys
        env:
          PLAYWRIGHT_JSON_OUTPUT_FILE: test-results/browser/ci-report.json
        run: ./bin/node scripts/ci-test-report.mjs kind=playwright report=test-results/browser/ci-report.json evidence=test-results/browser/ci-timing.json title="WebKit recording (macOS)" -- ./bin/pnpm test:browser --project webkit --grep @media-recorder --no-deps --reporter=list,json
      - name: Recording evidence
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: browser-media-recorder-webkit
          path: test-results/browser
          retention-days: 7

  # Advisory flake check: repeat the tests a pull request changes. These lanes
  # skip when no test changed, so they stay out of CI required (which rejects
  # skipped lanes); their own statuses and step summaries carry the result.
  flake_select:
    if: github.event_name == 'pull_request'
    name: Flake check selection
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    outputs:
      vitest: ${{ steps.select.outputs.vitest }}
      browser: ${{ steps.select.outputs.browser }}
      browser_shards: ${{ steps.select.outputs.browser_shards }}
      browser_shard_total: ${{ steps.select.outputs.browser_shard_total }}
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
          # The merge commit's first parent is the base branch tip, so this
          # diff is exactly the pull request's change without a full clone.
          fetch-depth: 2
      - uses: ./.github/actions/setup
      - name: Map changed hunks to tests
        id: select
        run: ./bin/node scripts/flake-check.mjs select HEAD^1 HEAD

  flake_vitest:
    name: Flake check (Vitest, ${{ matrix.batch }}/2)
    needs: [flake_select]
    if: needs.flake_select.outputs.vitest != ''
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        batch: [1, 2]
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - uses: ./.github/actions/setup
      - name: Repeat changed Vitest tests
        env:
          # Match the JavaScript lane's worker contention.
          BUZZ_TEST_WORKERS: "2"
          SELECTED: ${{ needs.flake_select.outputs.vitest }}
        # Keep ten independent repetitions without serial setup consuming
        # the job budget; each batch retains two-worker contention.
        run: ./bin/node scripts/flake-check.mjs vitest --iterations=5 $SELECTED
      - name: Vitest iteration reports
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: flake-vitest-${{ matrix.batch }}
          path: test-results/flake
          retention-days: 7

  flake_browser:
    name: Flake check (${{ matrix.engine }}, ${{ matrix.shard }}/${{ needs.flake_select.outputs.browser_shard_total }})
    needs: [flake_select, browser_fixture]
    if: needs.flake_select.outputs.browser != ''
    runs-on: ubuntu-24.04
    # Match package.json's Playwright version and pin immutable browser/OS layers.
    container:
      image: mcr.microsoft.com/playwright:v1.63.0-noble@sha256:eff16c30e6f3f4af0a03fa4b706120d5e9b0891c344a27d64559aff5900a4a27
      options: --init --ipc=host
    defaults:
      run:
        shell: bash
    env:
      HOME: /root
      BUZZ_BROWSER_FIXTURE_DIR: target/ci-browser-fixture
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        engine: [chromium, webkit]
        # flake-check.mjs sizes this so a whole-file selection fits the timeout.
        shard: ${{ fromJSON(needs.flake_select.outputs.browser_shards) }}
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - name: Trust this container workspace
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
      - uses: ./.github/actions/setup
        with:
          browsers: "true"
          browser-engine: ${{ matrix.engine }}
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          artifact-ids: ${{ needs.browser_fixture.outputs.artifact-id }}
          merge-multiple: true
          path: target/ci-browser-fixture
      - name: Verify native browser fixture
        run: |
          cd target/ci-browser-fixture
          tar -xf browser-fixture.tar
          test "$(cat revision)" = "$(git rev-parse HEAD)"
          sha256sum --check SHA256SUMS
          test -x fixture-bridge
          test -x buzzodz
      # retries stay 0, so every failed repetition reports as unexpected.
      - name: Repeat changed journeys
        env:
          PLAYWRIGHT_JSON_OUTPUT_FILE: test-results/browser/ci-report.json
          SELECTED: ${{ needs.flake_select.outputs.browser }}
        run: ./bin/node scripts/ci-test-report.mjs kind=playwright report=test-results/browser/ci-report.json evidence=test-results/browser/ci-timing.json title="Flake check (${{ matrix.engine }}, ${{ matrix.shard }}/${{ needs.flake_select.outputs.browser_shard_total }})" -- ./bin/pnpm test:browser:ci --project ${{ matrix.engine }} --no-deps --repeat-each=10 --shard=${{ matrix.shard }}/${{ needs.flake_select.outputs.browser_shard_total }} --reporter=list,json $SELECTED
      - name: Browser repetition evidence
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: flake-browser-${{ matrix.engine }}-${{ matrix.shard }}
          path: test-results/browser
          retention-days: 7

  required:
    name: ${{ github.event_name == 'workflow_dispatch' && 'Automatic CI (not requested)' || 'CI required' }}
    if: always() && github.event_name != 'workflow_dispatch'
    needs: [javascript, native, measurements, browser_fixture, browser, media_recorder, agent_protection]
    runs-on: ubuntu-24.04
    timeout-minutes: 2
    steps:
      - name: Require every lane and every shard
        env:
          JAVASCRIPT: ${{ needs.javascript.result }}
          NATIVE: ${{ needs.native.result }}
          MEASUREMENTS: ${{ needs.measurements.result }}
          FIXTURE: ${{ needs.browser_fixture.result }}
          BROWSER: ${{ needs.browser.result }}
          MEDIA_RECORDER: ${{ needs.media_recorder.result }}
          AGENT_PROTECTION: ${{ needs.agent_protection.result }}
        run: |
          for result in "$JAVASCRIPT" "$NATIVE" "$MEASUREMENTS" "$FIXTURE" "$BROWSER" "$MEDIA_RECORDER" "$AGENT_PROTECTION"; do
            test "$result" = success || exit 1
          done