test(manifest): stub the JVM fixture deps (v1.x)

The maven-compat smoke fixture declared commons-io, junit and hamcrest
as real artifacts from Maven Central purely to get a graph shape: an
external prod dep, a test-scope dep and its transitive. No fixture code
imports them, so they were never compiled against or executed - but they
still aged into GHSA-78wr-2p64-hpwj, a Dependabot alert, and a version
bump.

gradle-compat already solved this: make-localrepo.sh generated a tiny
file-based Maven repo of empty-jar stubs at test time. That generator
moves up a directory to test/make-stub-repo.sh, gains the ability to
give a stub its own dependency, and now serves all three fixtures.
maven-compat resolves demo.ext:tool (prod), demo.ext:harness (test) and
its transitive demo.ext:harness-core through a <repository> whose URL
smoke-test.sh passes as -Dstub.repo.url; sbt-compat resolves
demo.ext:tool and demo.ext:harness the same way.

The suites also stop using the developer's home caches.
compat-cache.sh resolves one cache root under the temp dir, overridable
by SOCKET_COMPAT_CACHE, and each tool is pointed at it: Maven by
-Dmaven.repo.local, Gradle by -g, sbt by -Dsbt.ivy.home and
COURSIER_CACHE. The root is stable so each tool's own closure is
downloaded once, but the stub artifacts are evicted before every run, so
a run can never pass on a stale copy of the thing under test. Nothing is
read from or written to ~/.m2, ~/.gradle or ~/.ivy2, and records.tsv no
longer embeds a path under the developer's home.

Assertions prove exactly what they proved before, still matching on
groupId:artifactId with no version written in any test, and still keying
on the .jar suffix rather than any path. The transitive check is now
unconditional: with a stub graph it is deterministic, so its absence is
a defect rather than a junit-version detail.

The internal reactor module's lookup now pins the field count as well as
the prefix. 'demo:lib:' is a prefix of the typed 'demo:lib:jar:1.0' as
well as the bare 'demo:lib:1.0', so on the prefix alone a regression
that stopped emitting the bare id would still have passed a check whose
message claims bare-id coverage.

maven-compat's first assertion block moves out of its heredoc into
assert-records.py, so the unit suite can run those assertions over
synthetic records without Maven or a JDK. Nothing in CI runs the compat
fixtures, so that unit test is the only automated cover the assertions
have.

Each build tool still fetches its own closure from Central - Maven's
plugins pull commons-io themselves - so this is not a fully offline
fixture. It declares no third-party dependency of its own.

The fixture-generated paths also gain .gitignore entries, which this
branch of the tree never had - which is how 256 files of Gradle cache
came to be committed here in the first place. .gradle-home/ stays
ignored rather than being dropped as it was on main, because
smoke-test-workspaces.sh still keeps its Gradle user home inside the
fixture directory on this line.

Author: jdalton

.gitignore

@@ -30,3 +30,20 @@ test/fixtures/commands/fix/e2e-test-py-temp-*
 !/.claude/skills/
 
 !/.vscode/extensions.json
+
+# Generated by the JVM compat fixtures (src/commands/manifest/scripts/test).
+# The stub repos and caches are rebuilt on every run; smoke-test-workspaces.sh
+# still keeps its Gradle user home inside the fixture directory.
+/src/commands/manifest/scripts/test/gradle-compat/.gradle-home/
+/src/commands/manifest/scripts/test/gradle-compat/project/.gradle/
+/src/commands/manifest/scripts/test/gradle-compat/project/build/
+/src/commands/manifest/scripts/test/gradle-compat/project/localrepo/
+/src/commands/manifest/scripts/test/gradle-compat/project/records.tsv
+/src/commands/manifest/scripts/test/gradle-compat/project/workspaces-records.tsv
+/src/commands/manifest/scripts/test/maven-compat/project/localrepo/
+/src/commands/manifest/scripts/test/maven-compat/project/records.tsv
+/src/commands/manifest/scripts/test/maven-compat/project/target/
+/src/commands/manifest/scripts/test/maven-compat/project/*/target/
+/src/commands/manifest/scripts/test/sbt-compat/project/localrepo/
+/src/commands/manifest/scripts/test/sbt-compat/project/records.tsv
+/src/commands/manifest/scripts/test/sbt-compat/project/target/

src/commands/manifest/scripts/test/README.md

@@ -26,3 +26,35 @@ sbt rows also need the `sbt` launcher on `PATH`.
 The runner downloads the build-tool distributions and invokes the per-ecosystem
 `smoke-test.sh`. The unit-level assembler/sidecar behavior is covered separately
 by the `*.test.mts` unit tests.
+
+## Stub dependencies
+
+All three fixtures declare their dependencies as stub artifacts — empty jars plus
+generated poms — that `make-stub-repo.sh` writes into a file-based Maven repo at
+test time. The fixtures only need the *shape* of a dependency graph (a prod dep, a
+test dep, a transitive), never the code, so a stub is behaviourally identical here
+and can never age into a CVE alert or a version bump. The generated repos are
+gitignored; nothing binary is committed.
+
+Each build tool still fetches its own closure — Maven's plugins, sbt's
+scala-library, the Gradle distribution — from the network, so these fixtures are
+not "fully offline"; they simply declare no third-party dependencies of their own.
+Gradle is the exception: it also passes `--offline` and resolves everything it
+needs for the smoke test from the stub repo.
+
+## Caches
+
+No suite reads or writes the developer's own caches. Maven gets its local
+repository from `-Dmaven.repo.local`, Gradle its user home from `-g`, and sbt its
+Ivy home from `-Dsbt.ivy.home` plus `COURSIER_CACHE`, all under one root that
+`compat-cache.sh` resolves:
+
+```
+${SOCKET_COMPAT_CACHE:-${TMPDIR:-/tmp}/socket-manifest-compat}
+```
+
+That root is stable, so each tool's own closure is downloaded once and reused; the
+first run after clearing it pays for the download. The *stub* artifacts are evicted
+from it before every run, so a run can never pass on a stale copy of the thing
+under test. Set `SOCKET_COMPAT_CACHE` to a fresh `mktemp -d` for a completely cold
+run.

src/commands/manifest/scripts/test/compat-cache.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# Shared cache root for the JVM compat suites: the downloaded build-tool distributions plus each
+# tool's dependency cache. Keeping the caches here rather than in ~/.m2, ~/.gradle and ~/.ivy2 means
+# a run can't pass off a warm home cache, can't write a home path into the records it emits, and
+# can't leave anything behind in the developer's own caches. Point SOCKET_COMPAT_CACHE at a fresh
+# `mktemp -d` for a cold run.
+SOCKET_COMPAT_CACHE="${SOCKET_COMPAT_CACHE:-${TMPDIR:-/tmp}/socket-manifest-compat}"
+mkdir -p "$SOCKET_COMPAT_CACHE"

src/commands/manifest/scripts/test/gradle-compat/.gitignore

@@ -5,5 +5,4 @@ project/workspaces-records.tsv
 project/.socket.facts.json
 project/.gradle/
 project/build/
-.gradle-home/
 .populate-for.txt

src/commands/manifest/scripts/test/gradle-compat/README.md

@@ -12,7 +12,7 @@ Those fallback branches never execute on modern Gradle, so without a test on *ol
 could silently rot. This smoke test exercises them.
 
 ## What it does
-`smoke-test.sh <path-to-gradle>` generates a tiny **local** Maven repo (`make-localrepo.sh` — two
+`smoke-test.sh <path-to-gradle>` generates a tiny **local** Maven repo (`../make-stub-repo.sh` — two
 transitive-free artifacts, a prod `demo.lib:foo` and a test `demo.test:bar`), runs the init script's
 `socketFacts` task against `project/` **fully offline**, and asserts the emitted RECORDS (the script's
 only output — the TS assembler that turns records into `.socket.facts.json` is covered by

src/commands/manifest/scripts/test/gradle-compat/make-localrepo.sh

@@ -1,6 +1,6 @@
 // Hermetic smoke-test project for ../../socket-facts.init.gradle.
 //
-// Resolves two artifacts from a generated local Maven repo (see ../make-localrepo.sh)
+// Resolves two artifacts from a generated local Maven repo (see ../../make-stub-repo.sh)
 // so it runs fully OFFLINE on every Gradle version — including pre-3.3, which the
 // script must still support (old Gradle can't negotiate modern Maven Central's TLS,
 // so a network repo would make the old-version matrix entries impossible to test).

src/commands/manifest/scripts/test/gradle-compat/project/build.gradle

@@ -16,10 +16,12 @@ HERE="$(cd "$(dirname "$0")" && pwd)"
 GRADLE="${1:?usage: smoke-test.sh <path-to-gradle-binary>}"
 INIT="$HERE/../../socket-facts.init.gradle"
 PROJECT="$HERE/project"
-GUH="$HERE/.gradle-home"   # isolated Gradle user home -> hermetic, no global init scripts
 RECORDS="$PROJECT/records.tsv"
+# shellcheck source=SCRIPTDIR/../compat-cache.sh
+. "$HERE/../compat-cache.sh"
+GUH="$SOCKET_COMPAT_CACHE/gradle-home"   # isolated Gradle user home -> hermetic, no global init scripts
 
-bash "$HERE/make-localrepo.sh"
+bash "$HERE/../make-stub-repo.sh" "$PROJECT/localrepo" 'demo.lib:foo:1.0' 'demo.test:bar:1.0'
 rm -rf "$GUH" "$RECORDS" "$PROJECT/.gradle" "$PROJECT/build"
 
 echo "+ $("$GRADLE" --version 2>/dev/null | sed -n 's/^Gradle //p' | head -1)"

src/commands/manifest/scripts/test/gradle-compat/smoke-test.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# Generate a hermetic file-based Maven repository of stub artifacts for the JVM compat fixtures.
+# Each stub gets a .pom and an empty-but-valid .jar in standard repo layout, so a build tool can
+# resolve the declared graph shape without reaching a network repository. The fixtures never compile
+# against or execute these artifacts — only their coordinates and scopes are observed — so stubs are
+# behaviourally identical to the real thing here, and they can never age into a CVE or a version bump.
+#
+# Text-only in git: everything under <repo-dir> is produced at test time and gitignored.
+#
+# Usage: make-stub-repo.sh <repo-dir> <spec>...
+#   spec = group:artifact:version[+dep-group:dep-artifact:dep-version[,...]]
+#   Deps listed after `+` are written as compile-scope dependencies of that stub, so a consumer that
+#   depends on the stub also pulls them transitively.
+set -euo pipefail
+
+REPO="${1:?usage: make-stub-repo.sh <repo-dir> <group:artifact:version[+dep,...]>...}"
+shift
+if [ "$#" -eq 0 ]; then
+  echo "make-stub-repo.sh: no artifact specs given" >&2
+  exit 1
+fi
+
+rm -rf "$REPO"
+mkdir -p "$REPO"
+REPO="$(cd "$REPO" && pwd)"   # `jar` runs from an empty dir, so the output path must be absolute
+
+EMPTY="$(mktemp -d)"
+trap 'rm -rf "$EMPTY"' EXIT
+
+for spec in "$@"; do
+  coord="${spec%%+*}"
+  deps=""
+  [ "$coord" = "$spec" ] || deps="${spec#*+}"
+  IFS=: read -r group art ver <<<"$coord"
+  if [ -z "${group:-}" ] || [ -z "${art:-}" ] || [ -z "${ver:-}" ]; then
+    echo "make-stub-repo.sh: malformed spec '$spec' (want group:artifact:version[+dep,...])" >&2
+    exit 1
+  fi
+
+  dir="$REPO/${group//.//}/$art/$ver"
+  mkdir -p "$dir"
+
+  {
+    echo '<project xmlns="http://maven.apache.org/POM/4.0.0">'
+    echo '  <modelVersion>4.0.0</modelVersion>'
+    echo "  <groupId>$group</groupId>"
+    echo "  <artifactId>$art</artifactId>"
+    echo "  <version>$ver</version>"
+    echo '  <packaging>jar</packaging>'
+    if [ -n "$deps" ]; then
+      echo '  <dependencies>'
+      IFS=, read -r -a dep_list <<<"$deps"
+      for dep in "${dep_list[@]}"; do
+        IFS=: read -r dgroup dart dver <<<"$dep"
+        if [ -z "${dgroup:-}" ] || [ -z "${dart:-}" ] || [ -z "${dver:-}" ]; then
+          echo "make-stub-repo.sh: malformed dependency '$dep' in spec '$spec'" >&2
+          exit 1
+        fi
+        echo '    <dependency>'
+        echo "      <groupId>$dgroup</groupId>"
+        echo "      <artifactId>$dart</artifactId>"
+        echo "      <version>$dver</version>"
+        echo '    </dependency>'
+      done
+      echo '  </dependencies>'
+    fi
+    echo '</project>'
+  } >"$dir/$art-$ver.pom"
+
+  # empty but valid jar (jar ships with every JDK, which these fixtures already need)
+  ( cd "$EMPTY" && jar cf "$dir/$art-$ver.jar" . )
+done
+
+echo "built stub repo at $REPO"

src/commands/manifest/scripts/test/make-stub-repo.sh

@@ -1,3 +1,4 @@
+project/localrepo/
 project/records.tsv
 project/workspaces-records.tsv
 project/target/