[TheJakeBraun]

Two audits (Go + Swift), then an adversarial workflow review of the resulting diff. Everything here is a defect that reached a release — and the review caught four more that this change itself introduced, including one worse than the bug it was fixing.

abctl — writes now prove they landed

The imperative path carried both defects the reconcile engine was fixed for in v0.4.19. It is what abgui's Save profile button calls.

create/replace/edit/apply -f recorded the baseline from the bytes they sent. Apple accepts an out-of-spec profile with a 2xx and silently declines to store it, so that baseline asserted a state the tenant was not in — and it is self-sustaining: the next --refresh=smart run matches id and timestamp, reuses the poisoned hash, never re-reads the XML, and reports "in sync — no changes" forever while Apple holds the old profile.

They now read back and record what Apple stored, failing loudly when the write did not take. A read-back that errors is reported unverified, not failed — a GET that failed says nothing about the PATCH.

validateProfile on the write path was three substring checks and a size cap, so the top-level PayloadVersion rule — added precisely because of that incident — guarded abctl validate and nothing that writes.

abctl — stop paying for the whole tenant

resolveLiveConfig called FetchCustomSettings to map one name to an id. That requests customSettingsValues for every config in the tenant, with a per-config GET fallback when the list is sparse — the trap that made adopt time out, sitting under replace, edit, delete and status config, on abgui's 60s budget.

apply -f resolved names once per document; the index is now cached per command and appended to on create. Smart refresh no longer fetches a profile per live-only config on a run that will never write it.

abctl — failures that reported success

• status config / apply -f swallowed relationship errors: a rate-limited tenant printed "attached to 0 blueprint(s)" and exited 0.
• apply -f warned and exited 0 when the manifest write failed — the defect attach was already fixed for.
• abctl attach rewrote a manifest wholesale from live, discarding configs declared in git but not yet attached. Now unions; a detach excludes only the member it removed.
• sync --apply --refresh=metadata-only refused up front; gitops.WriteConfig won't let a tenant name escape lib/.

abgui — each run owns its own state

Flipping git source of truth mid-compute showed the pre-flip plan with Cancel gone and Apply enabled — and applying used the new mode, which forces --prune. Pressing it deleted every Apple-only configuration against a plan that never mentioned a deletion.

The first fix was worse than the bug. It reused loadGeneration, which run() bumps for every resource list — so opening Configurations during a seed invalidated the seed's token, isSeeding was never cleared, and the Diff screen sat on "Initializing workspace…" forever with its escape buttons disabled. Two clicks, no error condition, relaunch the only exit. Plan and seed now own workGeneration; the plan owns isPlanning rather than the shared isLoading.

Also: scoped lastWriteError (a failed config delete no longer paints red across the Diff plan and Archive table); ArchiveView's bare TupleView wrapped; ApplyResult decodes abctl's structured verification key instead of grepping stderr for FAILED; ProcessRunner writes stdin inside the cancellation/watchdog scope and reports a partial write; context-store failures surfaced; Devices lost a permanently-empty OS column and reads managedAppleAccount.

Closing the blind spot

internal/cli could only test pure helpers, because every command builds a client — which is why all of this shipped.

It needs no credentials: config reads AB_TOKEN_URL/AB_API_BASE from the environment and a generated EC key mints a real ES256 assertion, so two httptest servers make a fake tenant that counts requests. Eight end-to-end tests drive real commands, including the two that would have caught this session's bugs as test failures rather than bug reports:

TestReplaceFailsWhenAppleDropsTheWrite            2xx + unchanged bytes must fail
TestReplaceDoesNotDownloadEveryProfileInTheTenant zero tenant-wide XML requests

Verification

Go: build, vet, gofmt, full suite green. Swift: macOS CI is the gate.

🤖 Generated with Claude Code