@1aboveio/skills 0.0.0-stage → 1.0.0

package/skills/risk-compliance/compliance-audit/scripts/test_export_tracker_xlsx.py

@@ -0,0 +1,97 @@
+#!/usr/bin/env python3
+"""Tests for export_tracker_xlsx.py.
+
+Runs under pytest (``pytest scripts/test_export_tracker_xlsx.py``) or directly
+(``python3 scripts/test_export_tracker_xlsx.py``). No third-party dependencies.
+"""
+import importlib.util
+import pathlib
+import re
+import tempfile
+import zipfile
+
+_SPEC = importlib.util.spec_from_file_location(
+    "export_tracker_xlsx", pathlib.Path(__file__).with_name("export_tracker_xlsx.py")
+)
+x = importlib.util.module_from_spec(_SPEC)
+_SPEC.loader.exec_module(x)
+
+
+_TRACKER = """# VARS Assessment Tracker
+
+- **Date:** 2026-10-19
+- **Archetypes In Scope:** AACQ
+
+| Control ID | Control Title | Archetype | Observations | Issue Description | Control Effectiveness Rating | Proposed Remediation | Complete By | Remediation Status |
+|---|---|---|---|---|---|---|---|---|
+| AACQ.C2.1 | Merchant Agreement Content | AACQ | • Control 1: Covered in merchant-agreement-v2.4.pdf section 3.2<br>• Control 2: Partial — R&D \\| ops split | **Actions Required:** — Missing<br>(i) [Control 2: Partial] — Fix. | Unsatisfactory | | | |
+"""
+
+
+def _cells(xml: str) -> list[str]:
+    return [re.sub(r"&amp;", "&", t) for t in re.findall(r'<t xml:space="preserve">(.*?)</t>', xml, re.S)]
+
+
+def _export(tracker_text: str):
+    tmp = pathlib.Path(tempfile.mkdtemp())
+    tracker = tmp / "tracker.md"
+    tracker.write_text(tracker_text, encoding="utf-8")
+    out = tmp / "tracker.xlsx"
+    counts = x.export(tracker, out)
+    return out, counts
+
+
+def test_rows_metadata_and_cell_text():
+    out, (n_rows, n_meta) = _export(_TRACKER)
+    assert (n_rows, n_meta) == (1, 2)
+    with zipfile.ZipFile(out) as zf:
+        tracker = _cells(zf.read("xl/worksheets/sheet1.xml").decode())
+        meta = _cells(zf.read("xl/worksheets/sheet2.xml").decode())
+    assert tracker[:3] == ["Control ID", "Control Title", "Archetype"]
+    obs = tracker[9 + 3]
+    assert obs == ("• Control 1: Covered in merchant-agreement-v2.4.pdf section 3.2\n"
+                   "• Control 2: Partial — R&D | ops split")
+    assert tracker[9 + 4].startswith("Actions Required: — Missing\n(i)")
+    assert meta == ["Field", "Value", "Date", "2026-10-19", "Archetypes In Scope", "AACQ"]
+
+
+def test_every_row_has_one_cell_per_column():
+    out, _ = _export(_TRACKER)
+    with zipfile.ZipFile(out) as zf:
+        sheet = zf.read("xl/worksheets/sheet1.xml").decode()
+    for row in re.findall(r"<row [^>]*>(.*?)</row>", sheet):
+        assert row.count("<c ") == 9
+
+
+def test_tracker_without_table_is_an_error():
+    try:
+        _export("# VARS Assessment Tracker\n\n- **Date:** 2026-10-19\n")
+    except ValueError:
+        return
+    raise AssertionError("expected ValueError")
+
+
+def test_minimal_gfm_separator_bold_across_br_and_entities():
+    tracker = ("| Control ID | Observations |\n|-|:-|\n"
+               "| AACQ.C1.1 | **Control 1: Covered<br>in a.pdf** &amp; more |\n")
+    out, (n_rows, _) = _export(tracker)
+    assert n_rows == 1
+    with zipfile.ZipFile(out) as zf:
+        cells = _cells(zf.read("xl/worksheets/sheet1.xml").decode())
+    assert cells[3] == "Control 1: Covered\nin a.pdf & more"
+
+
+def test_table_without_rows_is_an_error():
+    try:
+        _export("| Control ID | Observations |\n|---|---|\n")
+    except ValueError:
+        return
+    raise AssertionError("expected ValueError")
+
+
+if __name__ == "__main__":
+    fns = [f for n, f in sorted(globals().items()) if n.startswith("test_")]
+    for fn in fns:
+        fn()
+        print(f"ok  {fn.__name__}")
+    print(f"\n{len(fns)} passed")

package/skills/risk-compliance/compliance-audit/scripts/test_validate_tracker.py

@@ -0,0 +1,157 @@
+#!/usr/bin/env python3
+"""Tests for validate_tracker.py header/scope parsing.
+
+Runs under pytest (``pytest scripts/test_validate_tracker.py``) or directly
+(``python3 scripts/test_validate_tracker.py``). No third-party dependencies.
+"""
+import importlib.util
+import pathlib
+import tempfile
+
+_SPEC = importlib.util.spec_from_file_location(
+    "validate_tracker", pathlib.Path(__file__).with_name("validate_tracker.py")
+)
+v = importlib.util.module_from_spec(_SPEC)
+_SPEC.loader.exec_module(v)
+
+
+_TRACKER = """# VARS Assessment Tracker
+
+- **Archetypes In Scope:** AACQ (22 controls), ATPA (15 controls)
+
+| Control ID | Control Title | Archetype | Observations | Issue Description | Control Effectiveness Rating | Proposed Remediation | Complete By | Remediation Status |
+|---|---|---|---|---|---|---|---|---|
+| AACQ.C1.1 | T | AACQ | • Control 1: Covered | | Satisfactory | | | |
+"""
+
+_CHECKLIST = """### AACQ.C1.1: T
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** thing
+- **Evidence:**
+  - doc
+
+### AHIR.C1.1: Out of scope
+- **Severity:** mandatory
+- **Verification:**
+  - [ ] **(1)** thing
+- **Evidence:**
+  - doc
+"""
+
+
+def _write(tmp, name, content):
+    p = pathlib.Path(tmp) / name
+    p.write_text(content, encoding="utf-8")
+    return p
+
+
+def test_annotated_archetype_header_parses_to_bare_codes():
+    """'AACQ (22 controls)' must yield the code 'AACQ', not the whole token."""
+    phases, archetypes, scope, rows = v.parse_tracker(
+        _write(tempfile.mkdtemp(), "tracker.md", _TRACKER)
+    )
+    assert archetypes == ["AACQ", "ATPA"]
+
+
+def test_derive_scope_resolves_annotated_header():
+    """With cleaned codes, scope includes the annotated archetypes' controls."""
+    controls = {"AACQ.C1.1": None, "ATPA.C1.1": None, "AHIR.C1.1": None}
+    scope = v.derive_scope(controls, ["AACQ", "ATPA"], None, [])
+    assert scope == {"AACQ.C1.1", "ATPA.C1.1"}
+
+
+def test_annotated_header_does_not_flag_in_scope_rows():
+    """End-to-end: an in-scope row is not reported 'outside declared scope'."""
+    tmp = tempfile.mkdtemp()
+    findings = v.validate(
+        _write(tmp, "tracker.md", _TRACKER),
+        _write(tmp, "checklist.md", _CHECKLIST),
+        None,
+    )
+    out_of_scope = [
+        f for f in findings
+        if f["check"] == "row_coverage" and "outside declared scope" in f["message"]
+    ]
+    assert out_of_scope == [], out_of_scope
+
+
+def test_bare_archetype_header_still_works():
+    tracker = _TRACKER.replace("AACQ (22 controls), ATPA (15 controls)", "AACQ, ATPA")
+    _, archetypes, _, _ = v.parse_tracker(_write(tempfile.mkdtemp(), "t.md", tracker))
+    assert archetypes == ["AACQ", "ATPA"]
+
+
+def test_original_filename_resolves_to_parsed_markdown():
+    """A citation by original filename grounds against the parsed copy and is reported as cited."""
+    tmp = pathlib.Path(tempfile.mkdtemp())
+    (tmp / "merchant-agreement-v2.4.md").write_text("## 3.2 Content\n", encoding="utf-8")
+    (tmp / "merchant-agreement-v2.md").write_text("## 9.9 Other\n", encoding="utf-8")
+    files = v.list_evidence_files(tmp)
+    assert v.find_evidence_file("merchant-agreement-v2.4.pdf", files).name == "merchant-agreement-v2.4.md"
+    assert v.check_citation("Covered in merchant-agreement-v2.4.pdf section 3.2", files) == []
+    issues = v.check_citation("Covered in merchant-agreement-v2.4.pdf section 7.1", files)
+    assert issues == [("warning", "clause 'section 7.1' not found in merchant-agreement-v2.4.pdf")]
+
+
+def _evidence(files):
+    tmp = pathlib.Path(tempfile.mkdtemp())
+    for rel, body in files.items():
+        f = tmp / rel
+        f.parent.mkdir(parents=True, exist_ok=True)
+        f.write_text(body, encoding="utf-8")
+    return v.list_evidence_files(tmp)
+
+
+def test_cjk_original_filename_grounds():
+    files = _evidence({"风险政策.md": "## 2.3 风险偏好\n"})
+    assert v.check_citation("Covered in 风险政策.pdf section 2.3", files) == []
+
+
+def test_original_filename_never_fuzzy_matches_a_different_version():
+    files = _evidence({"merchant-agreement-v2.4.md": "## 7.2 x\n"})
+    issues = v.check_citation("Covered in merchant-agreement-v2.pdf section 7.2", files)
+    assert issues == [("warning", "no evidence file matches 'merchant-agreement-v2.pdf'")]
+
+
+def test_shared_stem_resolves_by_extension_folder_or_is_ambiguous():
+    files = _evidence({"pdf/policy.md": "## 8.8 pdf\n", "docx/policy.md": "## 1.1 docx\n"})
+    assert v.find_evidence_file("policy.pdf", files).parent.name == "pdf"
+    assert v.check_citation("Covered in policy.docx section 1.1", files) == []
+    flat = _evidence({"a/policy.md": "x", "b/policy.md": "y"})
+    issues = v.check_citation("Covered in policy.pdf section 1", flat)
+    assert len(issues) == 1 and issues[0][1].startswith("ambiguous document 'policy.pdf'")
+
+
+def test_citation_without_extension_warns():
+    files = _evidence({"data-security-policy-v3.1.md": "## 5.1 x\n"})
+    issues = v.check_citation("Covered in Data Security Policy section 5.1", files)
+    assert issues == [("warning", "cites 'Data Security Policy' without a file extension; cite the original filename")]
+
+
+def test_clause_needs_whole_number_match():
+    assert not v.is_clause_grounded("1", "## 2.1 Scope\n## 10 Other\n")
+    assert v.is_clause_grounded("2.1", "## 2.1 Scope\n")
+    assert v.is_clause_grounded("2.1)", "## 2.1 Scope\n")
+    assert v.is_clause_grounded("3.2(a)(i)", "### 3.2(a) Adherence\n(i) item\n")
+
+
+def test_escaped_pipe_stays_in_its_cell():
+    assert v.split_table_row("| A | x \\| y | B |") == ["A", "x \\| y", "B"]
+
+
+def test_section_sign_in_a_cell_warns():
+    tracker = _TRACKER.replace("• Control 1: Covered", "• Control 1: Covered in a.pdf §3.2")
+    tmp = tempfile.mkdtemp()
+    findings = v.validate(_write(tmp, "tracker.md", tracker), _write(tmp, "checklist.md", _CHECKLIST), None)
+    assert [f["message"] for f in findings if f["check"] == "clause_marker"] == [
+        "Observations uses '§'; write 'section <clause>' instead"
+    ]
+
+
+if __name__ == "__main__":
+    fns = [f for n, f in sorted(globals().items()) if n.startswith("test_")]
+    for fn in fns:
+        fn()
+        print(f"ok  {fn.__name__}")
+    print(f"\n{len(fns)} passed")