test: pin ICloneableV2's once-only initialize and always-reverting typed overload

[thedavidmeister]

Closes #67.

The fixture half of #67 is on main via #80: test/concrete/TestCloneable.sol rejects a second initialize with TestCloneableAlreadyInitialized, and its typed initialize(uint256) overload always reverts InitializeSignatureFn. No test on main exercises either behaviour. This PR adds the two tests that do, on clones TestCloneFactory deployed and initialized.

Change

One file, test/src/interface/ICloneableV2.initialize.t.sol (ICloneableV2InitializeTest):

• testInitializeOnlyOnce: after the factory's cloneDeterministic, a second initialize(otherData) on the clone reverts TestCloneableAlreadyInitialized and sData() still equals the factory's data.
• testTypedOverloadRevertsInitializeSignatureFn: initialize(uint256) reverts ICloneableV2.InitializeSignatureFn on the never-initialized implementation and on an initialized clone.

.gas-snapshot and foundry.toml are main's. main (f0154e1) is merged in.

Other work that was on this branch is now elsewhere:

• ABI pinning of the published interfaces: Consumer-visible ABI details (param names, same-type order, indexed, return types) of the published interfaces are pinned by no test #91 / test: pin the published ABI of the current interfaces #92.
• TestCloneableV1Shaped + testV1ShapedImplementationIsRejected: Raise InitializationFailed for every non-conforming initialize answer #89 (→ InitializationFailed is not raised when the implementation does not implement ICloneableV2.initialize — caller gets bare 0x #61).
• NewClone topic pins: Document and pin the wire identity of every published NewClone #85 (→ NewClone is declared by three published interfaces under two signatures; ICloneableFactoryV1 and V2 share one topic0 #65).
• Dropped: testInitializeRevertBubblesVerbatim (duplicates testCloneDeterministicInitializeRevertBubbles), testNothingCalledBeforeInitialize (duplicates testCloneDeterministicInitializeIsTheOnlyCall + testCloneDeterministicEventPrecedesInitialize), testNewCloneSharedByBothEntryPoints (each entry point's full NewClone log is asserted by testCloneDeterministicEvent / testCloneDeterministicOpenSaltEvent), testPredictionsAreStatic (cannot fail: the compiler enforces view), TestCloneFactory.t.sol (tests the test harness; the deployed concrete is in rain.factory.deploy).

QA

• Discriminating tests: testInitializeOnlyOnce, testTypedOverloadRevertsInitializeSignatureFn. Each fails on main's suite plus a mutated fixture and passes unmutated.

• Mutations (mutation-probe, rainlanguage/adversarial-mutation-test@4e59ec0, nix develop -c forge test, whole suite per mutant), all in test/concrete/TestCloneable.sol:

  Mutant	main f0154e1 (48 tests)	this PR 4f3d48d (50 tests)
  F01 if (sInitialized) → if (false)	SURVIVED	KILLED by testInitializeOnlyOnce
  F02 second initialize returns the sentinel instead of reverting	SURVIVED	KILLED by testInitializeOnlyOnce
  F03 sInitialized = true → false	SURVIVED	KILLED by testInitializeOnlyOnce
  F04 typed overload returns the sentinel instead of reverting	SURVIVED	KILLED by testTypedOverloadRevertsInitializeSignatureFn
  F05 typed overload reverts TestCloneableAlreadyInitialized	SURVIVED	KILLED by testTypedOverloadRevertsInitializeSignatureFn

  main: 0/5 killed; survived: 5; no-run: 0; harness errors: 0. This PR: 5/5 killed; survived: 0; no-run: 0; harness errors: 0. Configs and logs: /home/gildlab/artifacts/factory/76/ (mutants-{base,head}.toml, probe-{base,head}.{log,json}).

• Oracle: the two MUSTs in src/interface/ICloneableV2.sol — initialize can NOT be called more than once; a typed overload reverts InitializeSignatureFn always. Expected reverts are the fixture's TestCloneableAlreadyInitialized and the interface's InitializeSignatureFn, not values read back from the clone.

• Category check: TestCloneable, the only worked ICloneableV2 fixture, violates the interface's once-only initialize MUST that ICloneableFactoryV4's open-salt safety argument rests on #67 names two fixtures and two MUSTs. Both MUSTs are covered on TestCloneable, the conforming fixture every successful-initialization flow test uses. TestCloneableFailure is the failure fixture: its initialize is pure, holds no state and has no once-only guard or typed overload, and these tests do not cover it.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Tests
  • Added coverage verifying clone initialization can only occur once.
  • Added coverage confirming initialized clones retain their original data after rejected reinitialization attempts.
  • Added coverage for expected failures when using the typed initialization overload on implementations and initialized clones.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: accb0b5a-6174-4638-8fa7-dc2735d0acca

📥 Commits

Reviewing files that changed from the base of the PR and between ebef4a7 and 98d291d.

📒 Files selected for processing (1)

• test/src/interface/ICloneableV2.initialize.t.sol

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The pull request adds tests for ICloneableV2 initialization. The tests cover single-use initialization and rejection of the typed initialize(uint256) overload on implementations and deterministic clones.

Changes

ICloneableV2 initialization coverage

Layer / File(s)	Summary
Initialization behavior tests test/src/interface/ICloneableV2.initialize.t.sol	Adds tests that verify clone data, reject repeated initialize calls with TestCloneableAlreadyInitialized, and reject typed initialization calls with ICloneableV2.InitializeSignatureFn.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other · Severity of issue fixed: Medium

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the two initialization requirements covered by the new tests: once-only initialization and the always-reverting typed overload.
Linked Issues check	✅ Passed	Issue #67 requires coverage for the once-only initialize rule and the typed overload revert. The added testInitializeOnlyOnce deploys and initializes a factory clone, checks the initial data, expe…
Out of Scope Changes check	✅ Passed	The whole-PR diff adds only test/src/interface/ICloneableV2.initialize.t.sol. Both tests directly cover the initialization requirements in issue #67. No unrelated production, fixture, ABI, topic, or…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[thedavidmeister]

@coderabbitai review

Queuing a review — the original attempt hit the OSS rate limit before reading the diff, so this PR has never actually been reviewed.

Orientation, since this is an audit deliverable rather than a feature:

• Nothing under src/ is touched. The diff is tests, fixtures and file layout.
• Fixture count goes 5 to 3 on this branch. TestCloneableConformant folds into TestCloneable, which now carries the one-shot init guard and the typed overload for the whole suite. TestCloneableEmitter and TestCloneableReverter are replaced by TestCloneableCallRecorder and TestCloneableRevert, byte for byte the same two files AMT coverage: g2-libicloneablefactoryv4-predi #78 carries so the branches merge without touching each other.
• Please look hardest at testNothingCalledBeforeInitialize. The swap from TestCloneableEmitter to TestCloneableCallRecorder would have been a silent REGRESSION on its own: the Emitter announced a stray call by emitting from its fallback, the CallRecorder deliberately does not emit from its fallback. I verified that directly — with the new selectors().length == 1 assertion removed, a child.call(...) inserted into cloneAndInitialize between NewClone and initialize PASSES; with it, that mutant is killed. If you think the log-stream assertions still carry weight I would rather hear it than assume.
• TestCloneableV1Shaped was imported by nothing on this branch — a fixture with no test. testV1ShapedImplementationIsRejected is the test it was built for. It asserts an EMPTY revert (vm.expectRevert(bytes(""))), because the bytes32 return decode reverts with no data before the sentinel comparison is reached, rather than producing InitializationFailed. That is the observed behaviour, mutation-checked: give the fixture a bytes32 return and the test fails. Push back if you think pinning a data-less revert is too brittle.
• TestCloneableFailure and TestCloneableRevert are deliberately NOT collapsed. A fixture that returns a non-success sentinel cannot also revert with a typed error carrying data.

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '=== Changed files ==='
git diff --name-status HEAD^ HEAD

printf '%s\n' '=== Diff summary ==='
git diff --stat HEAD^ HEAD

printf '%s\n' '=== Full pull request diff ==='
git diff --find-renames --find-copies --unified=80 HEAD^ HEAD

Length of output: 18575

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '=== Pull request metadata ==='
gh pr view 76 --repo rainlanguage/rain.factory \
  --json baseRefName,baseRefOid,headRefName,headRefOid,commits \
  --jq '{baseRefName, baseRefOid, headRefName, headRefOid, commits: [.commits[] | {oid, messageHeadline}]}'

base_oid="$(gh pr view 76 --repo rainlanguage/rain.factory --json baseRefOid --jq '.baseRefOid')"
merge_base="$(git merge-base HEAD "$base_oid")"

printf '%s\n' '=== Review range ==='
printf 'merge_base=%s\nhead=%s\n' "$merge_base" "$(git rev-parse HEAD)"

printf '%s\n' '=== Changed files in complete pull request ==='
git diff --name-status "$merge_base" HEAD

printf '%s\n' '=== Complete Solidity diff ==='
git diff --find-renames --find-copies --unified=60 "$merge_base" HEAD -- '*.sol'

printf '%s\n' '=== Changed non-Solidity files ==='
git diff --name-only "$merge_base" HEAD -- ':!*.sol'

Length of output: 68655

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '=== Foundry configuration diff and active configuration ==='
git diff c1c2afd3d88405d3228cb3b21e55c9d63ba8f5be HEAD -- foundry.toml
cat -n foundry.toml

printf '%s\n' '=== Relevant source and test outlines ==='
ast-grep outline src/lib/LibICloneableFactoryV4.sol --items all
ast-grep outline test/src/interface/ICloneableV2.initialize.t.sol --items all
ast-grep outline test/src/interface/ICloneableFactoryV3.t.sol --items all
ast-grep outline test/lib/LibPublishedAbi.sol --items all

printf '%s\n' '=== Clone initialization implementation and factory forwarding ==='
rg -n -A70 -B15 'function cloneAndInitialize|cloneAndInitialize\s*\(' src/lib/LibICloneableFactoryV4.sol test/concrete/TestCloneFactory.sol
rg -n -A45 -B10 'function cloneDeterministic|function cloneDeterministicOpenSalt|function predictDeterministic' test/concrete/TestCloneFactory.sol

printf '%s\n' '=== ABI declarations under test ==='
cat -n src/interface/ICloneableV2.sol
cat -n src/interface/ICloneableFactoryV2.sol
cat -n src/interface/ICloneableFactoryV3.sol
cat -n src/interface/deprecated/ICloneableV1.sol
cat -n src/interface/deprecated/ICloneableFactoryV1.sol
cat -n src/interface/deprecated/IFactory.sol

printf '%s\n' '=== Complete changed initialization test ==='
cat -n test/src/interface/ICloneableV2.initialize.t.sol

printf '%s\n' '=== Complete changed V3 declaration test ==='
cat -n test/src/interface/ICloneableFactoryV3.t.sol

Length of output: 49730

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '=== Obsolete fixture-path references ==='
rg -n -C2 'test/src/concrete/(TestCloneFactory|TestCloneable|TestCloneableFailure|TestCloneableEmitter|TestCloneableReverter|TestCloneableConformant|TestCloneableV1Shaped)\.sol' test || true

printf '%s\n' '=== Solidity test discovery paths ==='
fd -e sol . test | sort

printf '%s\n' '=== Imports in changed Solidity files whose targets do not exist ==='
python3 - <<'PY'
from pathlib import Path
import re
import subprocess

base = subprocess.check_output(
    ["git", "merge-base", "HEAD", "c1c2afd3d88405d3228cb3b21e55c9d63ba8f5be"],
    text=True,
).strip()
changed = subprocess.check_output(
    ["git", "diff", "--name-only", base, "HEAD", "--", "*.sol"],
    text=True,
).splitlines()

missing = []
for filename in changed:
    path = Path(filename)
    for line_no, line in enumerate(path.read_text().splitlines(), 1):
        match = re.match(r'\s*import\s+.*?from\s+"([^"]+)";', line)
        if not match:
            continue
        target = match.group(1)
        if target.startswith(("src/", "test/")) and not Path(target).exists():
            missing.append(f"{filename}:{line_no}: {target}")

print("\n".join(missing) if missing else "No missing src/ or test/ import targets.")
PY

printf '%s\n' '=== Pull request check status ==='
gh pr checks 76 --repo rainlanguage/rain.factory || true

Length of output: 3342

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '=== Imports in changed, present Solidity files whose targets do not exist ==='
python3 - <<'PY'
from pathlib import Path
import re
import subprocess

base = "c1c2afd3d88405d3228cb3b21e55c9d63ba8f5be"
changed = subprocess.check_output(
    ["git", "diff", "--diff-filter=AMR", "--name-only", base, "HEAD", "--", "*.sol"],
    text=True,
).splitlines()

missing = []
checked = []
for filename in changed:
    path = Path(filename)
    if not path.is_file():
        continue
    checked.append(filename)
    for line_no, line in enumerate(path.read_text(encoding="utf-8").splitlines(), 1):
        match = re.match(r'\s*import\s+.*?from\s+"([^"]+)";', line)
        if not match:
            continue
        target = match.group(1)
        if target.startswith(("src/", "test/")) and not Path(target).is_file():
            missing.append(f"{filename}:{line_no}: {target}")

print("Checked:")
print("\n".join(checked))
print("\nMissing targets:")
print("\n".join(missing) if missing else "None")
PY

printf '%s\n' '=== Pull request check status ==='
gh pr checks 76 --repo rainlanguage/rain.factory

Length of output: 2615

---

@thedavidmeister No actionable findings.

I reviewed the complete PR range, not only the final commit.

testNothingCalledBeforeInitialize now has the required direct oracle. The selectors().length == 1 assertion detects a successful stray proxy call. The log assertions still add value because they verify that NewClone occurs before the clone emits Initializing, and that data reaches initialize unchanged.

testV1ShapedImplementationIsRejected correctly pins the observed empty revert. cloneAndInitialize performs a typed bytes32 decode at the external initialize call. A V1-shaped implementation returns empty data, so decoding reverts before the sentinel comparison.

The moved fixtures have no stale imports or missing internal import targets. The legal, static, and test GitHub checks pass.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[thedavidmeister]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[thedavidmeister]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.