fix(stations/notify): preserve scanner status and harden packaging

Add buildRegistry/send rejection for non-positive defaults.timeout_seconds while preserving the existing negative-timeout doctor diagnostic (only an absent or explicit zero defaults to 10). Distinguish content-guard findings from scanner failures in the notify pre-push hook (capture rc, gate findings on rc==1, preserve other nonzero statuses), make Makefile install fail closed for missing HOME, and make the package platform loop fail fast with set -eu on the same logical recipe line.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: solomonneas

stations/notify/Makefile

@@ -30,6 +30,8 @@ cross: clean
 	GOOS=darwin  GOARCH=arm64 go build $(LDFLAGS) -o dist/$(BINARY)-darwin-arm64   $(PKG)
 
 install: build
+	$(if $(strip $(HOME)),,$(error HOME is not set; refusing to install into /bin))
+	mkdir -p $(HOME)/bin
 	install -m 0755 $(BINARY) $(HOME)/bin/$(BINARY)
 
 clean-dist:
@@ -38,6 +40,7 @@ clean-dist:
 # Build per-platform archives with checksums. Output to dist/.
 package: clean-dist
 	mkdir -p dist/tmp
+	set -eu; \
 	for platform in $(PLATFORMS); do \
 		os=$${platform%/*}; \
 		arch=$${platform#*/}; \

stations/notify/cmd/agent-notify/main.go

@@ -332,6 +332,9 @@ func sortedProfileNames(cfg *config.Config) []string {
 }
 
 func buildRegistry(cfg *config.Config, names []string) (*channels.Registry, error) {
+	if cfg.Defaults.TimeoutSeconds <= 0 {
+		return nil, fmt.Errorf("defaults.timeout_seconds must be greater than zero, got %d", cfg.Defaults.TimeoutSeconds)
+	}
 	reg := channels.NewRegistry()
 	timeout := time.Duration(cfg.Defaults.TimeoutSeconds) * time.Second
 

stations/notify/cmd/agent-notify/main_test.go

@@ -16,6 +16,7 @@ import (
 
 	"github.com/escoffier-labs/agent-notify/internal/canonical"
 	"github.com/escoffier-labs/agent-notify/internal/channels"
+	"github.com/escoffier-labs/agent-notify/internal/config"
 )
 
 type leakingErrorChannel struct {
@@ -442,6 +443,99 @@ func TestRun_DoctorJSONReportsMissingConfigAsUnconfigured(t *testing.T) {
 	}
 }
 
+func TestBuildRegistryRejectsNonPositiveTimeout(t *testing.T) {
+	// A non-positive timeout must never reach channel construction: the
+	// registry build fails with a config error naming the offending key.
+	// The webhook URL is required so the pre-fix RED state reaches channel
+	// construction instead of failing earlier with missing credentials.
+	t.Setenv("DISCORD_WEBHOOK_URL", "https://discord.test/webhook/123")
+	for _, timeout := range []int{-5, 0} {
+		cfg := &config.Config{
+			Channels: map[string]config.ChannelConfig{
+				"discord-main": {Type: "discord", WebhookURLEnv: "DISCORD_WEBHOOK_URL"},
+			},
+			Defaults: config.Defaults{TimeoutSeconds: timeout},
+		}
+		_, err := buildRegistry(cfg, []string{"discord-main"})
+		if err == nil {
+			t.Fatalf("timeout %d: expected buildRegistry error, got nil", timeout)
+		}
+		if !strings.Contains(err.Error(), "defaults.timeout_seconds") {
+			t.Errorf("timeout %d: error should name defaults.timeout_seconds, got %v", timeout, err)
+		}
+	}
+}
+
+func TestRun_DoctorJSONFailsOnNegativeTimeout(t *testing.T) {
+	// doctor must surface an invalid negative timeout as a FAIL check on
+	// defaults.timeout_seconds, not silently normalize it away.
+	cfgPath := filepath.Join(t.TempDir(), "config.toml")
+	if err := os.WriteFile(cfgPath, []byte(`
+[defaults]
+timeout_seconds = -5
+
+[channels.discord-main]
+type = "discord"
+webhook_url_env = "DISCORD_WEBHOOK_URL"
+`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	code, stdout, stderr := runMain(t,
+		[]string{"agent-notify", "doctor", "--json", "--config", cfgPath},
+		"",
+		map[string]string{"DISCORD_WEBHOOK_URL": "https://discord.test/webhook/123"},
+	)
+	if code != 2 {
+		t.Fatalf("exit = %d, want 2 (stderr=%s)", code, stderr)
+	}
+	var payload map[string]interface{}
+	if err := json.Unmarshal([]byte(stdout), &payload); err != nil {
+		t.Fatalf("invalid json: %v\n%s", err, stdout)
+	}
+	found := false
+	for _, c := range payload["checks"].([]interface{}) {
+		check := c.(map[string]interface{})
+		if check["name"] == "defaults.timeout_seconds" {
+			found = true
+			if check["status"] != "FAIL" {
+				t.Fatalf("defaults.timeout_seconds status = %v, want FAIL", check["status"])
+			}
+		}
+	}
+	if !found {
+		t.Fatalf("expected a defaults.timeout_seconds check in %#v", payload["checks"])
+	}
+}
+
+func TestRun_SendRejectsNegativeTimeout(t *testing.T) {
+	// The send path must refuse a negative timeout with a config error
+	// instead of constructing channels with a non-positive deadline.
+	cfgPath := filepath.Join(t.TempDir(), "config.toml")
+	if err := os.WriteFile(cfgPath, []byte(`
+[defaults]
+timeout_seconds = -5
+
+[channels.discord-main]
+type = "discord"
+webhook_url_env = "DISCORD_WEBHOOK_URL"
+`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	code, _, stderr := runMain(t,
+		[]string{"agent-notify", "--config", cfgPath, "build done"},
+		"",
+		map[string]string{"DISCORD_WEBHOOK_URL": "https://discord.test/webhook/123"},
+	)
+	if code != exitConfig {
+		t.Fatalf("exit = %d, want %d (stderr=%s)", code, exitConfig, stderr)
+	}
+	if !strings.Contains(stderr, "defaults.timeout_seconds") {
+		t.Fatalf("stderr should name defaults.timeout_seconds, got %s", stderr)
+	}
+}
+
 func TestRun_StatusJSONWarnsForInactiveChannelMissingEnv(t *testing.T) {
 	cfgPath := filepath.Join(t.TempDir(), "config.toml")
 	if err := os.WriteFile(cfgPath, []byte(`

stations/notify/hooks/pre-push

@@ -21,10 +21,24 @@ fi
 REPO_ROOT="$(git rev-parse --show-toplevel)"
 echo "pre-push: scanning $REPO_ROOT against $(basename "$POLICY")"
 
-if ! PYTHONPATH="$CONTENT_GUARD_DIR/src" python3 -m content_guard scan "$REPO_ROOT" --policy "$POLICY"; then
+rc=0
+PYTHONPATH="$CONTENT_GUARD_DIR/src" python3 -m content_guard scan "$REPO_ROOT" --policy "$POLICY" || rc=$?
+
+if [[ "$rc" -eq 0 ]]; then
+  exit 0
+fi
+
+if [[ "$rc" -eq 1 ]]; then
   echo >&2
   echo "pre-push: BLOCKED. content-guard found violations." >&2
   echo "pre-push: fix the leak, or add an inline tag on the offending line:" >&2
   echo "pre-push:   <!-- content-guard: allow <rule-id> -->" >&2
   exit 1
 fi
+
+# Any other exit code is the scanner failing to run (missing deps, bad policy,
+# crash), not a leak verdict. Preserve the original status.
+echo >&2
+echo "pre-push: content-guard failed to run (exit code $rc); this is a scanner error, not a leak verdict." >&2
+echo "pre-push: re-run it directly to see the error, then push again once the scanner works." >&2
+exit "$rc"

stations/notify/internal/config/config.go

@@ -66,6 +66,10 @@ func Load(path string) (*Config, error) {
 		return nil, fmt.Errorf("decode config: %w", err)
 	}
 
+	// Zero means "not set" (absent or explicit) and falls back to the
+	// default. A negative value is invalid configuration and stays
+	// observable: doctor reports it as FAIL and the send path rejects it
+	// rather than silently substituting the default.
 	if cfg.Defaults.TimeoutSeconds == 0 {
 		cfg.Defaults.TimeoutSeconds = 10
 	}

stations/notify/internal/config/config_test.go

@@ -106,3 +106,46 @@ func TestLoad_DefaultTimeoutIs10s(t *testing.T) {
 		t.Errorf("expected default timeout 10s, got %d", cfg.Defaults.TimeoutSeconds)
 	}
 }
+
+func TestLoad_ZeroTimeoutNormalizesTo10s(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "config.toml")
+	body := `
+[defaults]
+timeout_seconds = 0
+`
+	if err := os.WriteFile(path, []byte(body), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	cfg, err := Load(path)
+	if err != nil {
+		t.Fatalf("Load failed: %v", err)
+	}
+	if cfg.Defaults.TimeoutSeconds != 10 {
+		t.Errorf("expected zero timeout normalized to 10s, got %d", cfg.Defaults.TimeoutSeconds)
+	}
+}
+
+func TestLoad_NegativeTimeoutStaysObservable(t *testing.T) {
+	// A negative timeout is invalid configuration, not a request for the
+	// default. Load must surface it so doctor can FAIL on it and the send
+	// path can reject it, instead of silently substituting 10s.
+	dir := t.TempDir()
+	path := filepath.Join(dir, "config.toml")
+	body := `
+[defaults]
+timeout_seconds = -5
+`
+	if err := os.WriteFile(path, []byte(body), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	cfg, err := Load(path)
+	if err != nil {
+		t.Fatalf("Load failed: %v", err)
+	}
+	if cfg.Defaults.TimeoutSeconds != -5 {
+		t.Errorf("expected negative timeout preserved as -5, got %d", cfg.Defaults.TimeoutSeconds)
+	}
+}

tests/test_agent_notify_station_contracts.py

@@ -0,0 +1,138 @@
+"""Contract checks for stations/notify packaging and pre-push hook behavior."""
+
+from __future__ import annotations
+
+import os
+import shutil
+import subprocess
+from pathlib import Path
+
+import pytest
+
+
+ROOT = Path(__file__).resolve().parents[1]
+NOTIFY = ROOT / "stations" / "notify"
+
+
+def _makefile() -> str:
+    return (NOTIFY / "Makefile").read_text()
+
+
+def _pre_push() -> str:
+    return (NOTIFY / "hooks" / "pre-push").read_text()
+
+
+def _logical_shell_lines(recipe: str) -> list[str]:
+    """Join backslash-continued physical lines into single shell logical lines.
+
+    Make runs each logical recipe line in its own shell, so fail-fast flags
+    only protect commands on the same continued line.
+    """
+    logical: list[str] = []
+    buf = ""
+    for line in recipe.splitlines():
+        stripped = line.rstrip()
+        if stripped.endswith("\\"):
+            buf += stripped[:-1] + " "
+        else:
+            logical.append(buf + stripped)
+            buf = ""
+    if buf:
+        logical.append(buf)
+    return logical
+
+
+def test_notify_pre_push_captures_scanner_exit_code():
+    text = _pre_push()
+    assert "|| rc=$?" in text
+    assert "if ! PYTHONPATH=" not in text
+
+
+def test_notify_pre_push_blocks_findings_with_exit_1():
+    text = _pre_push()
+    assert '"$rc" -eq 1' in text
+    assert "BLOCKED. content-guard found violations." in text
+    # The exit-1 assertion is scoped to the findings branch; the pre-existing
+    # guard clauses at the top of the hook must not satisfy it.
+    branch_start = text.index('if [[ "$rc" -eq 1 ]]')
+    branch_end = text.index('exit "$rc"')
+    branch = text[branch_start:branch_end]
+    assert "exit 1" in branch
+
+
+def test_notify_pre_push_reports_scanner_errors_and_preserves_status():
+    text = _pre_push()
+    assert "failed to run" in text
+    assert "not a leak verdict" in text
+    assert 'exit "$rc"' in text
+
+
+def test_notify_makefile_install_creates_home_bin():
+    text = _makefile()
+    install = text[text.index("install:") : text.index("clean-dist:")]
+    assert "mkdir -p $(HOME)/bin" in install
+    assert "install -m 0755 $(BINARY) $(HOME)/bin/$(BINARY)" in install
+    assert install.index("mkdir -p $(HOME)/bin") < install.index("install -m 0755")
+
+
+def test_notify_makefile_install_fails_closed_without_home():
+    # An unset/empty HOME must abort the recipe before mkdir -p /bin and
+    # install into /bin can run.
+    text = _makefile()
+    install = text[text.index("install:") : text.index("clean-dist:")]
+    assert "$(error" in install, "install target has no $(error ...) guard"
+    guard = next(line for line in install.splitlines() if "$(error" in line)
+    assert "HOME" in guard
+    assert install.index("$(error") < install.index("mkdir -p $(HOME)/bin")
+
+
+def test_notify_makefile_install_empty_home_aborts():
+    if shutil.which("make") is None:
+        pytest.skip("GNU make not available")
+    env = {**os.environ, "HOME": ""}
+    r = subprocess.run(
+        ["make", "-n", "install"],
+        cwd=NOTIFY,
+        env=env,
+        capture_output=True,
+        text=True,
+    )
+    assert r.returncode != 0, f"expected make to abort, got stdout={r.stdout!r}"
+    assert "HOME is not set; refusing to install into /bin" in r.stderr
+
+
+def test_notify_makefile_install_nonempty_home_dry_run_succeeds(tmp_path):
+    if shutil.which("make") is None:
+        pytest.skip("GNU make not available")
+    home = str(tmp_path / "home")
+    env = {**os.environ, "HOME": home}
+    r = subprocess.run(
+        ["make", "-n", "install"],
+        cwd=NOTIFY,
+        env=env,
+        capture_output=True,
+        text=True,
+    )
+    assert r.returncode == 0, f"make failed: stderr={r.stderr!r}"
+    assert "mkdir -p" in r.stdout
+    assert "install -m 0755" in r.stdout
+
+
+def test_notify_makefile_package_fails_fast_in_platform_loop():
+    text = _makefile()
+    package = text[text.index("package:") :]
+    for step in (
+        "go build",
+        "cp README.md LICENSE",
+        "chmod 755",
+        "tar -C dist/tmp",
+    ):
+        assert step in package
+    # set -eu must share one backslash-continued shell with the platform
+    # loop; moved onto its own recipe line it runs in a separate shell and
+    # the loop no longer fails fast.
+    loop_shells = [line for line in _logical_shell_lines(package) if "for platform" in line]
+    assert loop_shells, "platform loop not found in package recipe"
+    for shell in loop_shells:
+        assert "set -eu" in shell
+        assert shell.index("set -eu") < shell.index("for platform")