@1aboveio/skills 1.0.7 → 1.0.9

package/skills/engineering/engineering-runtime/scripts/invocation-policy.test.mjs

@@ -1,95 +0,0 @@
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { mkdirSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import {
-  applyInvocationPolicy,
-  clearInvocationPolicy,
-  MANUAL_ONLY,
-  manualOnlyPolicyFindings,
-  reconcileInvocationPolicy,
-  reviewedSourceInjections,
-} from './invocation-policy.mjs';
-
-const UPSTREAM_SKILL = `---
-name: tdd
-description: Test-driven development.
----
-
-# TDD
-`;
-const UPSTREAM_OPENAI = `interface:
-  display_name: "TDD"
-  short_description: "Test-driven red-green-refactor"
-`;
-
-function fixture() {
-  const root = mkdtempSync(join(tmpdir(), 'invocation-policy-'));
-  const skill = join(root, 'tdd');
-  mkdirSync(join(skill, 'agents'), { recursive: true });
-  writeFileSync(join(skill, 'SKILL.md'), UPSTREAM_SKILL);
-  writeFileSync(join(skill, 'agents', 'openai.yaml'), UPSTREAM_OPENAI);
-  return { root, skill };
-}
-
-test('manual-only policy is idempotent and preserves explicit invocation metadata', () => {
-  const { root, skill } = fixture();
-  const first = applyInvocationPolicy({ installName: 'tdd', policy: MANUAL_ONLY, skillsRoot: root });
-  const skillOnce = readFileSync(join(skill, 'SKILL.md'), 'utf8');
-  const openaiOnce = readFileSync(join(skill, 'agents', 'openai.yaml'), 'utf8');
-  const second = applyInvocationPolicy({ installName: 'tdd', policy: MANUAL_ONLY, skillsRoot: root });
-
-  assert.equal(first.changed, true);
-  assert.equal(second.changed, false);
-  assert.match(skillOnce, /^disable-model-invocation: true$/m);
-  assert.match(openaiOnce, /^policy:\n  allow_implicit_invocation: false$/m);
-  assert.deepEqual(manualOnlyPolicyFindings(skill), []);
-  assert.equal(readFileSync(join(skill, 'SKILL.md'), 'utf8'), skillOnce);
-  assert.equal(readFileSync(join(skill, 'agents', 'openai.yaml'), 'utf8'), openaiOnce);
-});
-
-test('reviewed source injections remove only the deterministic runtime policy overlay', () => {
-  const { root, skill } = fixture();
-  applyInvocationPolicy({ installName: 'tdd', policy: MANUAL_ONLY, skillsRoot: root });
-  const injected = Object.fromEntries(reviewedSourceInjections(skill, MANUAL_ONLY)
-    .map((entry) => [entry.relativePath, entry.contents]));
-  assert.equal(injected['SKILL.md'], UPSTREAM_SKILL);
-  assert.equal(injected['agents/openai.yaml'], UPSTREAM_OPENAI);
-
-  const cleared = clearInvocationPolicy({ installName: 'tdd', policy: MANUAL_ONLY, skillsRoot: root });
-  assert.equal(cleared.changed, true);
-  assert.equal(readFileSync(join(skill, 'SKILL.md'), 'utf8'), UPSTREAM_SKILL);
-  assert.equal(readFileSync(join(skill, 'agents', 'openai.yaml'), 'utf8'), UPSTREAM_OPENAI);
-  assert.equal(clearInvocationPolicy({ installName: 'tdd', policy: MANUAL_ONLY, skillsRoot: root }).changed, false);
-});
-
-test('a missing selection defaults TDD to implicit invocation', () => {
-  const { root, skill } = fixture();
-  applyInvocationPolicy({ installName: 'tdd', policy: MANUAL_ONLY, skillsRoot: root });
-  const home = mkdtempSync(join(tmpdir(), 'invocation-policy-home-'));
-  const result = reconcileInvocationPolicy({
-    installName: 'tdd',
-    policy: MANUAL_ONLY,
-    skillsRoot: root,
-    env: { HOME: home },
-  });
-  assert.equal(result.policy, 'implicit');
-  assert.equal(result.changed, true);
-  assert.equal(readFileSync(join(skill, 'SKILL.md'), 'utf8'), UPSTREAM_SKILL);
-  assert.equal(readFileSync(join(skill, 'agents', 'openai.yaml'), 'utf8'), UPSTREAM_OPENAI);
-});
-
-test('policy application fails closed on malformed or missing skill metadata', () => {
-  const { root, skill } = fixture();
-  writeFileSync(join(skill, 'SKILL.md'), 'not frontmatter\n');
-  assert.throws(
-    () => applyInvocationPolicy({ installName: 'tdd', policy: MANUAL_ONLY, skillsRoot: root }),
-    /must begin with YAML frontmatter/,
-  );
-  assert.throws(
-    () => applyInvocationPolicy({ installName: '../tdd', policy: MANUAL_ONLY, skillsRoot: root }),
-    /invalid installed skill name/,
-  );
-});

package/skills/engineering/engineering-runtime/scripts/main-module.test.mjs

@@ -1,288 +0,0 @@
-// Behaviour gate for the shared ESM main-module guard (issues #718 and #446).
-//
-// The two failure modes this pins are opposite halves of one idiom, and both are silent:
-//
-//   #718 — comparing `import.meta.url` against an un-realpathed `process.argv[1]`. Node resolves
-//          `import.meta.url` to the REAL file; `argv[1]` keeps whatever the caller typed. Invoked
-//          through a symlink — which is exactly how every skills install works — the two never
-//          match, the CLI never runs, and node exits 0 having done nothing. On a gate whose job is
-//          to say *no*, "passed" and "never ran" produce byte-identical evidence.
-//   #446 — calling `fs.realpathSync(process.argv[1])` unguarded. `node -` sets `argv[1]` to the
-//          literal string `"-"`, which is truthy and is not a file, so realpath throws ENOENT at
-//          MODULE LOAD — before any of the module's own code runs. The module becomes unimportable
-//          by any consumer that does not launch it as a file.
-//
-// So the in-process predicate tests below are necessary but not sufficient: #446 is a *load-time*
-// throw, which an in-process test cannot observe at all. Every claim that matters here is also
-// driven through a real child process — a real temp symlink, a real `node -` on stdin, and the
-// real `coverage-ledger.mjs` that #718 was filed against.
-//
-// Discovered and run by .github/workflows/ci.yml (every skills/**/*.test.mjs).
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { execFileSync, spawnSync } from 'node:child_process';
-import { cpSync, mkdtempSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-
-import { isMainModule } from './main-module.mjs';
-
-const HERE = dirname(fileURLToPath(import.meta.url)); // skills/engineering/engineering-runtime/scripts
-const SKILLS_DIR = dirname(dirname(dirname(HERE))); // skills/
-const REPO = dirname(SKILLS_DIR);
-const HELPER_URL = pathToFileURL(join(HERE, 'main-module.mjs')).href;
-
-// Every child-process case builds its own scratch dir and removes it, so a failing run leaves
-// nothing behind and two runs never share a symlink.
-function withTmp(fn) {
-  const dir = mkdtempSync(join(tmpdir(), 'main-module-'));
-  try {
-    return fn(dir);
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-}
-
-// A minimal CLI with the exact shape every converted site has: import the helper, run the CLI only
-// when the guard says this module is main, and exit with a distinctive code so "ran" and "did not
-// run" cannot be confused with each other.
-const FIXTURE_CLI = `
-import { isMainModule } from ${JSON.stringify(HELPER_URL)};
-export const marker = 'imported-cleanly';
-if (isMainModule(import.meta.url)) {
-  console.log('CLI RAN');
-  process.exit(7);
-}
-`;
-
-function runNode(args, opts = {}) {
-  const r = spawnSync(process.execPath, args, { encoding: 'utf8', ...opts });
-  return { status: r.status, stdout: r.stdout ?? '', stderr: r.stderr ?? '' };
-}
-
-// --- the predicate itself -------------------------------------------------------------------
-// Restoring argv[1] rather than assigning a saved copy back blindly: `node --test` needs it, and a
-// test that corrupted it would poison every later file in the same process.
-
-function withArgv1(value, fn) {
-  const saved = process.argv[1];
-  if (value === undefined) delete process.argv[1];
-  else process.argv[1] = value;
-  try {
-    return fn();
-  } finally {
-    process.argv[1] = saved;
-  }
-}
-
-test('argv[1] absent → not main, and no throw (#446)', () => {
-  withArgv1(undefined, () => {
-    assert.equal(isMainModule(import.meta.url), false);
-  });
-});
-
-test('argv[1] set to a path that is not a real file → not main, and no throw (#446)', () => {
-  // `"-"` is not a hypothetical: it is literally what `node -` puts in argv[1].
-  for (const value of ['-', '', '/definitely/not/a/real/path.mjs', '[eval]']) {
-    withArgv1(value, () => {
-      assert.equal(isMainModule(import.meta.url), false, `argv[1]=${JSON.stringify(value)}`);
-    });
-  }
-});
-
-test('argv[1] is this module → main (AC7: the true branch still fires)', () => {
-  const self = fileURLToPath(import.meta.url);
-  withArgv1(self, () => {
-    assert.equal(isMainModule(import.meta.url), true);
-  });
-});
-
-test('argv[1] is a SYMLINK to this module → still main (#718)', () => {
-  withTmp((dir) => {
-    const link = join(dir, 'aliased-name.mjs');
-    symlinkSync(fileURLToPath(import.meta.url), link);
-    withArgv1(link, () => {
-      assert.equal(isMainModule(import.meta.url), true, 'a symlinked invocation is the main module');
-    });
-    // The pre-fix predicate is what this must not degrade back into. Stated as an executable
-    // contrast so the assertion above cannot be satisfied by an implementation that happens to
-    // compare raw strings on a machine where nothing is symlinked.
-    assert.notEqual(pathToFileURL(link).href, import.meta.url, 'the naive comparison would be false here');
-  });
-});
-
-test('argv[1] is a different real file → not main', () => {
-  withArgv1(join(REPO, 'CLAUDE.md'), () => {
-    assert.equal(isMainModule(import.meta.url), false);
-  });
-});
-
-test('a non-file import.meta.url → not main, and no throw', () => {
-  withArgv1(fileURLToPath(import.meta.url), () => {
-    assert.equal(isMainModule('data:text/javascript,export{}'), false);
-  });
-});
-
-// --- real child processes -------------------------------------------------------------------
-
-test('a CLI invoked through a symlink runs, byte-identically to a direct invocation (#718)', () => {
-  withTmp((dir) => {
-    const real = join(dir, 'real-cli.mjs');
-    const link = join(dir, 'installed-cli.mjs');
-    writeFileSync(real, FIXTURE_CLI);
-    symlinkSync(real, link);
-
-    const direct = runNode([real]);
-    const viaLink = runNode([link]);
-
-    assert.equal(direct.stdout.trim(), 'CLI RAN');
-    assert.equal(direct.status, 7);
-    assert.deepEqual(
-      { stdout: viaLink.stdout, status: viaLink.status },
-      { stdout: direct.stdout, status: direct.status },
-      `the symlinked invocation must produce the same output and exit code.\nstderr:\n${viaLink.stderr}`,
-    );
-  });
-});
-
-test('a directory symlink — the actual skills-install shape — resolves too (#718)', () => {
-  withTmp((dir) => {
-    // ~/.claude/skills/<skill> is a symlink to the skill DIRECTORY, not to each script, so the
-    // symlink sits in the middle of the path rather than at its end.
-    const skill = join(dir, 'real-skill');
-    mkdirSync(join(skill, 'scripts'), { recursive: true });
-    const script = join(skill, 'scripts', 'cli.mjs');
-    writeFileSync(script, FIXTURE_CLI);
-    const installed = join(dir, 'installed-skill');
-    symlinkSync(skill, installed);
-
-    const viaDir = runNode([join(installed, 'scripts', 'cli.mjs')]);
-    assert.equal(viaDir.stdout.trim(), 'CLI RAN', `stderr:\n${viaDir.stderr}`);
-    assert.equal(viaDir.status, 7);
-  });
-});
-
-test('`node -` can import a module that uses the guard, without throwing at load (#446, AC8)', () => {
-  withTmp((dir) => {
-    const mod = join(dir, 'cli.mjs');
-    writeFileSync(mod, FIXTURE_CLI);
-    // Reading the program from stdin is the case that sets argv[1] to the literal "-". This is the
-    // invocation that threw ENOENT at module load before the fix, so it is run as a real child
-    // process — an in-process test cannot observe a load-time throw.
-    const r = runNode(['-'], {
-      input: `const m = await import(${JSON.stringify(pathToFileURL(mod).href)});\nconsole.log(m.marker);\n`,
-    });
-    assert.equal(r.status, 0, `import under \`node -\` must not throw.\nstderr:\n${r.stderr}`);
-    assert.equal(r.stdout.trim(), 'imported-cleanly');
-    assert.ok(!r.stdout.includes('CLI RAN'), 'an imported module must not execute its CLI');
-  });
-});
-
-test('argv[1] set to a nonexistent path does not stop a module from loading (#446)', () => {
-  withTmp((dir) => {
-    const mod = join(dir, 'cli.mjs');
-    writeFileSync(mod, FIXTURE_CLI);
-    const driver = join(dir, 'driver.mjs');
-    writeFileSync(
-      driver,
-      `process.argv[1] = '/no/such/file.mjs';\n` +
-        `const m = await import(${JSON.stringify(pathToFileURL(mod).href)});\n` +
-        `console.log(m.marker);\n`,
-    );
-    const r = runNode([driver]);
-    assert.equal(r.status, 0, `stderr:\n${r.stderr}`);
-    assert.equal(r.stdout.trim(), 'imported-cleanly');
-  });
-});
-
-// --- the real script #718 was filed against ---------------------------------------------------
-
-test('coverage-ledger.mjs: symlinked and direct invocations agree (#718 AC1)', () => {
-  withTmp((dir) => {
-    // A scratch cwd with no surface inventory, so the honest answer is a deterministic failure —
-    // exit 2 — rather than a pass. That is the whole point of the issue: before the fix the
-    // symlinked run printed nothing and exited 0, which is indistinguishable from success.
-    const cwd = join(dir, 'workdir');
-    mkdirSync(cwd);
-    const skill = join(SKILLS_DIR, 'engineering', 'ensure-coverage');
-    const installed = join(dir, 'ensure-coverage');
-    symlinkSync(skill, installed);
-
-    const argsFor = (root) => [join(root, 'scripts', 'coverage-ledger.mjs'), 'validate'];
-    const direct = runNode(argsFor(skill), { cwd });
-    const viaLink = runNode(argsFor(installed), { cwd });
-
-    assert.equal(direct.status, 2, `expected the honest failure, got:\n${direct.stdout}${direct.stderr}`);
-    assert.match(direct.stderr, /Inventory not found/);
-    assert.deepEqual(
-      { status: viaLink.status, stdout: viaLink.stdout, stderr: viaLink.stderr },
-      { status: direct.status, stdout: direct.stdout, stderr: direct.stderr },
-      'a symlinked coverage-ledger must not silently no-op and exit 0',
-    );
-  });
-});
-
-test('flat installation and Claude skill symlink preserve direct launch and import behavior', () => {
-  withTmp((dir) => {
-    const canonical = join(dir, '.agents', 'skills');
-    const claude = join(dir, '.claude', 'skills');
-    const sourceEngineering = join(SKILLS_DIR, 'engineering');
-    mkdirSync(canonical, { recursive: true });
-    mkdirSync(claude, { recursive: true });
-    cpSync(join(sourceEngineering, 'ensure-coverage'), join(canonical, 'ensure-coverage'), { recursive: true });
-    cpSync(join(sourceEngineering, 'engineering-runtime'), join(canonical, 'engineering-runtime'), { recursive: true });
-    symlinkSync(join(canonical, 'ensure-coverage'), join(claude, 'ensure-coverage'));
-    symlinkSync(join(canonical, 'engineering-runtime'), join(claude, 'engineering-runtime'));
-
-    const cwd = join(dir, 'workdir');
-    mkdirSync(cwd);
-    const directScript = join(canonical, 'ensure-coverage', 'scripts', 'coverage-ledger.mjs');
-    const claudeScript = join(claude, 'ensure-coverage', 'scripts', 'coverage-ledger.mjs');
-    const direct = runNode([directScript, 'validate'], { cwd });
-    const viaClaude = runNode([claudeScript, 'validate'], { cwd });
-
-    assert.equal(direct.status, 2, `the installed CLI must reach its honest failure:\n${direct.stderr}`);
-    assert.match(direct.stderr, /Inventory not found/);
-    assert.deepEqual(
-      { status: viaClaude.status, stdout: viaClaude.stdout, stderr: viaClaude.stderr },
-      { status: direct.status, stdout: direct.stdout, stderr: direct.stderr },
-      'Claude symlink launch must preserve installed CLI output and exit status',
-    );
-
-    const imported = runNode(['-'], {
-      cwd,
-      input: `await import(${JSON.stringify(pathToFileURL(directScript).href)});\nconsole.log('IMPORTED');\n`,
-    });
-    assert.equal(imported.status, 0, `a flat-installed Workflow module must import under non-file argv:\n${imported.stderr}`);
-    assert.equal(imported.stdout.trim(), 'IMPORTED');
-  });
-});
-
-// --- the whole converted class, not just the fixture -------------------------------------------
-
-test('every script that adopted the guard is importable with argv[1] = "-" (#446 AC6/AC8)', () => {
-  // The class, executed. `grep` for the helper import, then import all of them in one child whose
-  // argv[1] is the literal "-": before the fix this is precisely the invocation that threw ENOENT
-  // at load, so a regression at ANY single site turns this red without anyone maintaining a list.
-  const listed = execFileSync(
-    'git',
-    ['grep', '-l', '--', 'main-module.mjs', ':(exclude)skills/engineering/engineering-runtime', 'skills'],
-    { cwd: REPO, encoding: 'utf8' },
-  )
-    .split('\n')
-    .filter((p) => p.endsWith('.mjs') && !p.endsWith('.test.mjs'));
-
-  assert.ok(listed.length >= 30, `expected the converted class to be found, got ${listed.length}`);
-
-  const program = listed
-    .map((p) => `await import(${JSON.stringify(pathToFileURL(join(REPO, p)).href)});`)
-    .join('\n');
-  const r = runNode(['-'], { input: `${program}\nconsole.log('ALL IMPORTED');\n`, cwd: REPO });
-  assert.equal(
-    r.status,
-    0,
-    `importing the converted scripts under \`node -\` must not throw.\nstderr:\n${r.stderr}`,
-  );
-  assert.match(r.stdout, /ALL IMPORTED/);
-});

package/skills/engineering/engineering-runtime/scripts/required-check-plan.test.mjs

@@ -1,96 +0,0 @@
-import assert from 'node:assert/strict'
-import test from 'node:test'
-import { locallyReproducedJobs, validateQueueExecutionArtifact, validateRequiredCheckExecution, validateRequiredCheckPlan } from './required-check-plan.mjs'
-
-const head = 'a'.repeat(40)
-const plan = () => ({
-  version: 1,
-  kind: 'required-check-plan',
-  repository: '1aboveio/ai',
-  targetBranch: 'main',
-  headSha: head,
-  discovery: {
-    github: { conditions: ['required_status_checks: Mergify Merge Protections'], trees: [{ condition: 'required_status_checks: Mergify Merge Protections' }] },
-    mergify: { conditions: ['check-success = skill-script-tests', 'check-success = skill-size'], trees: [{ all: [{ condition: 'check-success = skill-script-tests' }, { condition: 'check-success = skill-size' }] }] },
-    requiredChecks: ['Mergify Merge Protections', 'skill-script-tests', 'skill-size'],
-  },
-  checks: [
-    { name: 'Mergify Merge Protections', admission: 'required', classification: 'publish-only', sources: ['github-ruleset'], evidence: { provider: 'github', reason: 'Mergify publishes this aggregate condition after PR creation' } },
-    { name: 'skill-script-tests', admission: 'required', classification: 'locally-reproduced', sources: ['mergify'], evidence: { command: 'node --test skills/**/*.test.mjs', job: 'skill-script-tests', result: 'success' } },
-    { name: 'skill-size', admission: 'required', classification: 'locally-reproduced', sources: ['mergify'], evidence: { command: 'node --test skills/skill-size.test.mjs', job: 'skill-size', result: 'success' } },
-  ],
-  allowedSkippedJobs: ['skill-script-tests-queue'],
-})
-
-// @covers job:resolve-issues/exact-head-ci
-// @level integration
-// @fails-without-fix job:resolve-issues/exact-head-ci
-test('epic-892: a plan rejects omitted live skill-size despite otherwise green evidence', () => {
-  const incomplete = plan()
-  incomplete.checks.pop()
-  const verdict = validateRequiredCheckPlan(incomplete, { expectedHeadSha: head, requireEvidence: true })
-  assert.equal(verdict.ok, false)
-  assert.match(verdict.errors.join(' '), /omits live required check skill-size.*epic-892/i)
-})
-
-// @covers job:resolve-issues/exact-head-ci
-// @level integration
-test('plans bind discovery, local reproduction, publish-only proof, exemptions, and skips to the frozen head', () => {
-  const accepted = plan()
-  assert.deepEqual(validateRequiredCheckPlan(accepted, { expectedHeadSha: head, requireEvidence: true }), { ok: true, errors: [] })
-  assert.deepEqual(locallyReproducedJobs(accepted), ['skill-script-tests', 'skill-size'])
-  assert.deepEqual(validateRequiredCheckExecution(accepted, [
-    { name: 'skill-script-tests', conclusion: 'success' },
-    { name: 'skill-size', conclusion: 'success' },
-    { name: 'skill-script-tests-queue', conclusion: 'skipped' },
-  ], { expectedHeadSha: head }), { ok: true, errors: [] })
-  const exempted = plan()
-  exempted.checks[2].admission = 'exempted'
-  exempted.checks[2].changedPathExemption = { condition: '-files ~= ^skills/', applies: true }
-  exempted.checks[2].evidence.result = 'skipped'
-  assert.deepEqual(validateRequiredCheckPlan(exempted, { expectedHeadSha: head, requireEvidence: true }), { ok: true, errors: [] })
-  const skipped = plan()
-  skipped.checks[2].evidence.result = 'skipped'
-  const rejected = validateRequiredCheckPlan(skipped, { expectedHeadSha: head, requireEvidence: true })
-  assert.match(rejected.errors.join(' '), /skipped is never success/i)
-})
-
-// @covers job:resolve-issues/exact-head-ci
-// @level unit
-test('legacy required-job manifests receive migration guidance instead of a completeness claim', () => {
-  const verdict = validateRequiredCheckPlan(undefined, { expectedHeadSha: head })
-  assert.equal(verdict.ok, false)
-  assert.match(verdict.errors[0], /legacy required-check manifest.*rediscover GitHub rulesets and Mergify conditions/i)
-})
-
-// @covers job:resolve-issues/exact-head-ci
-// @level unit
-// @fails-without-fix job:resolve-issues/exact-head-ci
-test('queue execution artifact top-level provider must bind to the planned queue evidence provider', () => {
-  const queuePlan = {
-    ...plan(),
-    version: 2,
-    checks: [{
-      name: 'queue-only', admission: 'required', classification: 'publish-only', sources: ['mergify'], phases: ['queue-head'],
-      evidence: { provider: 'github', reason: 'provider-created synthetic queue check' },
-      queueEvidence: { provider: 'github', acquisition: 'github-check-runs' },
-    }],
-  }
-  const artifact = {
-    version: 1, kind: 'queue-execution', repository: '1aboveio/ai', pr: 42, prHeadSha: head,
-    queuePr: 43, queueHeadSha: 'b'.repeat(40), provider: 'other-provider',
-    checks: [{ name: 'queue-only', provider: 'github', conclusion: 'success', headSha: 'b'.repeat(40) }], status: 'pass',
-  }
-  const verdict = validateQueueExecutionArtifact(queuePlan, artifact, { expectedRepository: '1aboveio/ai', expectedPr: 42, expectedPrHeadSha: head })
-  assert.equal(verdict.ok, false)
-  assert.match(verdict.errors.join(' '), /queueExecutionArtifact\.provider.*expected github.*other-provider/i)
-
-  const mixedProviderPlan = structuredClone(queuePlan)
-  mixedProviderPlan.checks.push({
-    ...mixedProviderPlan.checks[0], name: 'second-queue-only',
-    queueEvidence: { provider: 'other-provider', acquisition: 'other-acquisition' },
-  })
-  const mixedVerdict = validateQueueExecutionArtifact(mixedProviderPlan, artifact, { expectedRepository: '1aboveio/ai', expectedPr: 42, expectedPrHeadSha: head })
-  assert.equal(mixedVerdict.ok, false)
-  assert.match(mixedVerdict.errors.join(' '), /exactly one non-empty provider across planned queue-head checks/i)
-})

package/skills/engineering/ensure-coverage/scripts/adapters/nextjs-inventory.test.mjs

@@ -1,96 +0,0 @@
-// Tests for the reference Next.js adapter's feature-derived signal detection
-// (issue #200). Runs the adapter as a subprocess against temp fixtures — proves
-// AC1 (emits signals) and AC5 (deterministic) without mocking. Run: `node --test`.
-
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import fs from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-import { execFileSync, spawnSync } from 'node:child_process'
-
-const ADAPTER = fileURLToPath(new URL('./nextjs-inventory.mjs', import.meta.url))
-
-function runAdapter(appDir) {
-  const out = path.join(appDir, '..', 'inv.json')
-  execFileSync('node', [ADAPTER, appDir, '--out', out], { stdio: 'pipe' })
-  return JSON.parse(fs.readFileSync(out, 'utf8'))
-}
-
-function fixture(pkg, files) {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'nextadp-'))
-  fs.writeFileSync(path.join(dir, 'package.json'), JSON.stringify(pkg))
-  for (const [rel, content] of Object.entries(files)) {
-    const p = path.join(dir, rel)
-    fs.mkdirSync(path.dirname(p), { recursive: true })
-    fs.writeFileSync(p, content)
-  }
-  return dir
-}
-
-test('detects themeToggle (next-themes dep) and i18n (next-intl dep) on every route', () => {
-  const dir = fixture(
-    { dependencies: { 'next-themes': '^0.2.0', 'next-intl': '^3.0.0' } },
-    { 'app/page.tsx': 'export default function P(){return <div/>}',
-      'app/dashboard/page.tsx': 'export default function D(){return <div/>}' },
-  )
-  try {
-    const inv = runAdapter(path.join(dir, 'app'))
-    assert.equal(inv.surfaces.length, 2)
-    for (const s of inv.surfaces) {
-      assert.equal(s.signals?.themeToggle, true)
-      assert.equal(s.signals?.i18n, true)
-    }
-  } finally { fs.rmSync(dir, { recursive: true, force: true }) }
-})
-
-test('detects themeToggle from source (useTheme) with no dep', () => {
-  const dir = fixture(
-    { dependencies: {} },
-    { 'app/page.tsx': "import { useTheme } from 'somewhere'\nexport default function P(){ useTheme(); return <div/> }" },
-  )
-  try {
-    const inv = runAdapter(path.join(dir, 'app'))
-    assert.equal(inv.surfaces[0].signals?.themeToggle, true)
-    assert.ok(!inv.surfaces[0].signals?.i18n)
-  } finally { fs.rmSync(dir, { recursive: true, force: true }) }
-})
-
-test('no signals → no `signals` key (null, not an empty object)', () => {
-  const dir = fixture(
-    { dependencies: { react: '^19.0.0' } },
-    { 'app/page.tsx': 'export default function P(){return <div/>}' },
-  )
-  try {
-    const inv = runAdapter(path.join(dir, 'app'))
-    assert.equal('signals' in inv.surfaces[0], false)
-  } finally { fs.rmSync(dir, { recursive: true, force: true }) }
-})
-
-test('deterministic: two runs on the same code produce byte-identical output', () => {
-  const dir = fixture(
-    { dependencies: { 'next-themes': '^0.2.0' } },
-    { 'app/page.tsx': 'export default function P(){return <div/>}',
-      'app/settings/page.tsx': "export default function S(){return <form onSubmit={()=>{}}/>}" },
-  )
-  try {
-    const a = JSON.stringify(runAdapter(path.join(dir, 'app')))
-    const b = JSON.stringify(runAdapter(path.join(dir, 'app')))
-    assert.equal(a, b)
-  } finally { fs.rmSync(dir, { recursive: true, force: true }) }
-})
-
-test('a flag or a missing directory in the appDir slot exits 2 and writes nothing', () => {
-  const cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'nextadp-cli-'))
-  try {
-    for (const args of [['--help'], ['--out', 'x.json'], [path.join(cwd, 'does-not-exist')]]) {
-      const r = spawnSync('node', [ADAPTER, ...args], { cwd, encoding: 'utf8' })
-      assert.equal(r.status, 2, `${args.join(' ')} → exit 2`)
-      assert.match(r.stderr, /usage: nextjs-inventory\.mjs <appDir>/)
-    }
-    assert.deepEqual(fs.readdirSync(cwd), [], 'nothing was written into the cwd')
-  } finally {
-    fs.rmSync(cwd, { recursive: true, force: true })
-  }
-})

package/skills/engineering/ensure-coverage/scripts/check-quarantine-expiry.test.mjs

@@ -1,47 +0,0 @@
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import { scanText, isTestFile, runCli } from './check-quarantine-expiry.mjs'
-
-test('scanText flags an until= date in the past as expired, future as not', () => {
-  const text = [
-    '// @quarantine(until=2026-01-01, issue=#42) flaky payfields iframe',
-    '// @quarantine(until=2027-12-31, issue=#99) external sandbox pending',
-  ].join('\n')
-  const recs = scanText('e2e/x.spec.ts', text, '2026-06-08')
-  assert.equal(recs.length, 2)
-  const past = recs.find((r) => r.until === '2026-01-01')
-  assert.equal(past.expired, true)
-  assert.equal(past.issue, '#42')
-  assert.equal(past.line, 1)
-  assert.equal(recs.find((r) => r.until === '2027-12-31').expired, false)
-})
-
-test('scanText matches yaml-style "until: DATE" too', () => {
-  const recs = scanText('x.coverage.yml', 'suppress:\n  - until: 2020-05-05', '2026-06-08')
-  assert.equal(recs.length, 1)
-  assert.equal(recs[0].expired, true)
-})
-
-test('boundary: until == now is NOT expired (expires strictly after the date)', () => {
-  const recs = scanText('a.spec.ts', 'until=2026-06-08', '2026-06-08')
-  assert.equal(recs[0].expired, false)
-})
-
-test('isTestFile recognizes spec/test/coverage files, not plain source', () => {
-  assert.ok(isTestFile('e2e/login.spec.ts'))
-  assert.ok(isTestFile('tests/foo.py'))
-  assert.ok(isTestFile('req.coverage.yml'))
-  assert.ok(!isTestFile('src/app.ts'))
-})
-
-test('runCli exits 1 on an expired exit, 0 when all future', () => {
-  // Use this test file itself as a fixture-free input via a temp-ish path is overkill;
-  // exercise the pure path through --files on real files in the repo dir instead.
-  // Expired case: point at a string file we know — fall back to scanText-backed assertion.
-  assert.equal(scanText('f', 'until=2000-01-01', '2026-06-08').filter((r) => r.expired).length, 1)
-  assert.equal(scanText('f', 'until=2099-01-01', '2026-06-08').filter((r) => r.expired).length, 0)
-})
-
-test('runCli rejects a malformed --now', () => {
-  assert.equal(runCli(['--now', 'yesterday', '--files', 'nope.ts']), 2)
-})