v0.41.10: BB-13 OCI reject unauthenticated push case

Register `OCI reject unauthenticated push` (plan-20261001 BB-13): oras
push without stored credentials fails with the registry 401 visible in
its debug output, and the repository stays unknown (tags/list 404
NAME_UNKNOWN). Marks BB-12 done.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018bJDjze83ToyPysYzmxxWS
Signed-off-by: Eli Ma <eli@patch.sh>

Author: genedna

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "mega2"
-version = "0.41.9"
+version = "0.41.10"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 description = "Monorepo engine and Git hosting server for AI agents: trunk-based storage, Git Smart HTTP, Git LFS, OCI registry, and Agent Session Capture"

Cargo.toml

@@ -395,7 +395,7 @@ CASE='OCI ping'   # 换成要跑的 case 名
 docker compose -p mega2-trunk -f docker/docker-compose-storage-only.yml --profile interop exec -T -e MEGA2_SMOKE_CASE="$CASE" interop-smoke bash /repo/scripts/oci_client_smoke_storage_only.sh 2>&1 | tee target/tmp/bb-oci-case.log
 ```
 
-已登记 case：`OCI ping`、`OCI oras push and pull`。
+已登记 case：`OCI ping`、`OCI oras push and pull`、`OCI reject unauthenticated push`。
 
 不设 `MEGA2_SMOKE_CASE` 时整跑全部默认栈 case；opt-in case（auth-none）只经 `scripts/bb_optin_run.sh none oci_client_smoke_storage_only.sh '<case>' <log>` 运行。
 

docs/deploy-trunk.md

@@ -1072,7 +1072,7 @@
 ### Task BB-12: OCI oras push and pull
 
 **Task type:** `implementation`  
-**Lifecycle / Acceptance:** `in-progress` / `remote-pending`（v0.41.9；Codex R2 PASS；C 组 2023 测试通过；待 D 组 `docker` job）  
+**Lifecycle / Acceptance:** `done` / `complete`（v0.41.9；C 组 2023 测试通过；D 组 docker run 36932190577 success）  
 **Description:** 在 `scripts/oci_client_smoke_storage_only.sh` 注册 case `OCI oras push and pull`。`oras login --plain-http --password-stdin` 后推送两文件 artifact 到 `bb-${RUN_ID}/oras` 并拉回。 唯一行为轴：oras 高层推拉往返。  
 **Out of scope:** 其它 case（各自成卡）；改 `src/**`（产品缺陷按 ADR-BB-08 立 `FIX-BB-*`）；改既有 smoke 脚本（GC-BB-06）；以 cargo IT 作 VER（GC-BB-04）。  
 **Current evidence:**
@@ -1122,7 +1122,7 @@
 ### Task BB-13: OCI reject unauthenticated push
 
 **Task type:** `implementation`  
-**Lifecycle / Acceptance:** `pending` / （空）  
+**Lifecycle / Acceptance:** `in-progress` / `remote-pending`（v0.41.10；Codex R1 PASS；C 组 2023 测试通过；待 D 组 `docker` job）  
 **Description:** 在 `scripts/oci_client_smoke_storage_only.sh` 注册 case `OCI reject unauthenticated push`。不登录执行 `oras push`，随后匿名查询 tags/list。 唯一行为轴：无凭据写拒绝。  
 **Out of scope:** 其它 case（各自成卡）；改 `src/**`（产品缺陷按 ADR-BB-08 立 `FIX-BB-*`）；改既有 smoke 脚本（GC-BB-06）；以 cargo IT 作 VER（GC-BB-04）。  
 **Current evidence:**

docs/plan/plan-20261001.md

@@ -109,7 +109,24 @@ case_oci_oras_push_pull() {
     [ "$pushed" = "$fetched" ] || { echo "push digest $pushed != descriptor digest $fetched" >&2; return 1; }
 }
 
+# --- BB-13 OCI reject unauthenticated push ------------------------------
+case_oci_reject_unauth_push() {
+    local dir="$WORK/unauth" repo="bb-$RUN_ID/unauth" code
+    oci_case_begin
+    mkdir -p "$dir"
+    export DOCKER_CONFIG="$dir/docker"
+    printf 'unauth\n' > "$dir/f.txt"
+    if (cd "$dir" && oci_t oras push --debug --plain-http "$REGISTRY/$repo:v1" f.txt) > "$dir/push.out" 2>&1; then
+        echo "unauthenticated oras push succeeded" >&2; return 1
+    fi
+    rg -q 'Response Status: "401 Unauthorized"' "$dir/push.out" || { echo "push failure did not mention 401" >&2; redact "$TOKEN" < "$dir/push.out" >&2; return 1; }
+    code=$(oci_curl -o "$dir/tags.json" -w '%{http_code}' "$MEGA2_BASE_URL/v2/$repo/tags/list")
+    [ "$code" = 404 ] || { echo "tags/list returned $code" >&2; return 1; }
+    [ "$(jq -r '.errors[0].code' "$dir/tags.json")" = NAME_UNKNOWN ] || { echo "tags/list error code is not NAME_UNKNOWN" >&2; return 1; }
+}
+
 run_case "OCI ping" case_oci_ping
 run_case "OCI oras push and pull" case_oci_oras_push_pull
+run_case "OCI reject unauthenticated push" case_oci_reject_unauth_push
 
 finish