@1aboveio/skills 1.0.8 → 1.0.10

package/skills/engineering/golden-path/scripts/golden-path.test.mjs

@@ -1,1457 +0,0 @@
-// Tests for the golden-path engine. Pure core first, then the file-writing
-// commands against temp repos, then `run` against a real local HTTP server.
-import { test } from 'node:test'
-import assert from 'node:assert/strict'
-import fs from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-import http from 'node:http'
-
-import {
-  resultsEnvelope, openResults, inferHealthPath, USAGE, classifyWorkflow, specTitles, targetProblem, engineIdentity,
-  bootApp, stopApp, waitFor,
-  validateContract, validateProfile, selectPathsForProfile, computeVerdict, stampTarget,
-  journeyCoversId, reconcileJourneys, scanJourneyTags, judgeHttp, judgeCli, playwrightFileResults,
-  parseStart, renderView, renderWorkflow, ciProfiles, initPlan, applyPlan, checkDrift,
-  migrateLegacy, audit, runPaths, runCli, placeholders, upsertBlock, pointerBlock, workflowFile,
-  STANDARD_PROFILES, ENGINE_VERSION, CONTRACT_FILE, VIEW_FILE, WORKFLOW_FILE, ENGINE_FILE,
-} from './golden-path-core.mjs'
-
-function contract(over = {}) {
-  return {
-    version: 3,
-    profiles: STANDARD_PROFILES,
-    setup: { boot: 'pnpm start', baseUrl: 'http://127.0.0.1:3000', healthPath: '/api/health', journeys: 'e2e', tenants: ['e2e-synthetic'] },
-    ci: { queue: 'mergify', packageManager: 'pnpm' },
-    paths: [
-      { id: 'health', title: 'The app is up', surface: 'api', start: 'GET /api/health', observable: '200 ok', expect: { status: 200 }, mutates: false, profiles: ['pr-local', 'queue-local', 'prod-preview'] },
-      { id: 'sign-in', title: 'A user signs in and sees the dashboard', surface: 'browser', journey: 'sign-in', mutates: false, profiles: ['pr-local', 'queue-local', 'prod-preview'] },
-      { id: 'checkout', title: 'A user pays for an order', surface: 'browser', journey: 'checkout', mutates: true, tenant: 'e2e-synthetic', cleanup: 'tenant reset after each run', profiles: ['pr-local', 'dev-active', 'prod-preview'] },
-    ],
-    ...over,
-  }
-}
-
-function documentation(over = {}) {
-  return {
-    reference: 'GP-IDENTITY-LOGIN',
-    title: { en: 'Sign in', zh: '登录' },
-    group: { en: 'Identity', zh: '身份', order: 10 },
-    precondition: { en: 'A returning user is signed out', zh: '已有用户尚未登录' },
-    summary: {
-      route: { en: 'Sign in → Dashboard', zh: '登录 → 仪表盘' },
-      outcome: { en: 'The user sees their dashboard', zh: '用户看到自己的仪表盘' },
-    },
-    steps: [
-      { action: { en: 'Open sign in', zh: '打开登录页' }, expected: { en: 'The credential form is visible', zh: '凭据表单可见' } },
-      { action: { en: 'Submit valid credentials', zh: '提交有效凭据' }, expected: { en: 'The dashboard opens for this user', zh: '打开该用户的仪表盘' } },
-    ],
-    ...over,
-  }
-}
-
-function documentedSection(md, id) {
-  const anchor = `<a id="golden-path-${id}"></a>`
-  assert.ok(md.includes(anchor), `missing stable anchor for ${id}`)
-  return md.slice(md.indexOf(anchor) + anchor.length).split(/\n<a id=|\n## /)[0]
-}
-
-function tmpRepo(files = {}) {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'golden-path-test-'))
-  fs.mkdirSync(path.join(dir, '.git'))
-  for (const [f, text] of Object.entries(files)) {
-    fs.mkdirSync(path.dirname(path.join(dir, f)), { recursive: true })
-    fs.writeFileSync(path.join(dir, f), text)
-  }
-  return dir
-}
-
-const SPECS = {
-  'e2e/sign-in.spec.ts': '// @golden-path\n// @covers sign-in\n',
-  'e2e/checkout.spec.ts': '// @golden-path\n// @covers checkout\n',
-}
-
-function quiet() {
-  const out = []
-  return { out, log: (s) => out.push(s), err: (s) => out.push(s) }
-}
-
-// ---- validation ----
-
-test('a complete version 3 contract validates', () => {
-  const v = validateContract(contract())
-  assert.deepEqual(v.errors, [])
-})
-
-test('an empty contract is invalid, never a vacuous pass', () => {
-  assert.equal(validateContract(contract({ paths: [] })).ok, false)
-})
-
-test('version 3 requires a short title on every path', () => {
-  const c = contract()
-  delete c.paths[0].title
-  c.paths[1].title = 'x'.repeat(81)
-  const errors = validateContract(c).errors.join('\n')
-  assert.match(errors, /health.*needs a "title"/)
-  assert.match(errors, /sign-in.*title is 81 chars/)
-})
-
-test('a path that writes data needs a registered tenant and a cleanup', () => {
-  const c = contract()
-  delete c.paths[2].cleanup
-  c.paths[2].tenant = 'e2e-other'
-  const errors = validateContract(c).errors.join('\n')
-  assert.match(errors, /checkout.*needs "cleanup"/)
-  assert.match(errors, /tenant "e2e-other" is not listed in setup.tenants/)
-})
-
-test('TODO placeholders fail validation wherever they are', () => {
-  const c = contract()
-  c.setup.boot = 'TODO: the command'
-  c.paths[0].title = 'TODO: one line'
-  assert.deepEqual(placeholders(c), ['setup.boot', 'paths[0].title'])
-  assert.match(validateContract(c).errors.join('\n'), /setup.boot: still a TODO placeholder/)
-})
-
-test('an observable over 300 characters is an error in version 3 and a warning before', () => {
-  const long = contract()
-  long.paths[0].observable = 'y'.repeat(301)
-  assert.match(validateContract(long).errors.join('\n'), /observable is 301 chars/)
-  const legacy = { ...long, version: undefined }
-  delete legacy.version
-  assert.match(validateContract(legacy).warnings.join('\n'), /observable is 301 chars/)
-})
-
-test('a legacy manifest (no version) still validates, with a migrate warning', () => {
-  const legacy = { profiles: STANDARD_PROFILES, setup: { boot: 'x', env: ['DATABASE_URL'] }, paths: [{ id: 'health', surface: 'api', start: 'GET /h', observable: '200', profiles: ['pr-local'] }] }
-  const v = validateContract(legacy)
-  assert.equal(v.ok, true)
-  assert.match(v.warnings.join('\n'), /audit --write/)
-})
-
-test('version 3 rejects the legacy env name list', () => {
-  const c = contract()
-  c.setup.env = ['DATABASE_URL']
-  assert.match(validateContract(c).errors.join('\n'), /setup.env: in version 3/)
-})
-
-test('a path must declare at least one known profile', () => {
-  const c = contract()
-  c.paths[0].profiles = []
-  c.paths[1].profiles = ['nightly']
-  const errors = validateContract(c).errors.join('\n')
-  assert.match(errors, /health.*non-empty "profiles"/)
-  assert.match(errors, /profile "nightly" is not declared/)
-})
-
-test('reserved profile names stay bound to their gate', () => {
-  const errors = validateProfile('prod-preview', { gate: 'trunk-integration', environment: 'dev', endpoint: 'active', mutationPolicy: 'synthetic-tenant' })
-  assert.match(errors.join('\n'), /reserved name/)
-})
-
-test('a production profile must be read-only', () => {
-  const errors = validateProfile('prod-x', { gate: 'post-promotion', environment: 'prod', endpoint: 'active', mutationPolicy: 'isolated-writes' })
-  assert.match(errors.join('\n'), /prod profile must be read-only/)
-})
-
-test('a gate must run in its own environment and endpoint', () => {
-  const errors = validateProfile('pr-x', { gate: 'pull-request', environment: 'prod', endpoint: 'active', mutationPolicy: 'read-only' })
-  assert.match(errors.join('\n'), /runs in environment "local"/)
-  assert.match(errors.join('\n'), /targets the "local" endpoint/)
-})
-
-// ---- selection and verdict ----
-
-test('read-only profiles exclude every path that writes, tenant or not', () => {
-  const { run, excluded } = selectPathsForProfile(contract(), 'prod-preview')
-  assert.deepEqual(run.map((p) => p.id), ['health', 'sign-in'])
-  assert.match(excluded.find((x) => x.id === 'checkout').reason, /read-only/)
-})
-
-test('a synthetic-tenant profile runs a writing path only with a tenant', () => {
-  const c = contract()
-  assert.deepEqual(selectPathsForProfile(c, 'dev-active').run.map((p) => p.id), ['checkout'])
-  delete c.paths[2].tenant
-  assert.deepEqual(selectPathsForProfile(c, 'dev-active').run, [])
-})
-
-test('an unknown profile is a hard stop', () => {
-  assert.throws(() => selectPathsForProfile(contract(), 'nightly'), /unknown profile "nightly"/)
-})
-
-test('verdict: all pass is ALIVE, a fail is DEAD', () => {
-  const sel = [{ id: 'a', surface: 'api' }, { id: 'b', surface: 'api' }]
-  assert.equal(computeVerdict(sel, [{ id: 'a', status: 'pass' }, { id: 'b', status: 'pass' }]).verdict, 'ALIVE')
-  const dead = computeVerdict(sel, [{ id: 'a', status: 'pass' }, { id: 'b', status: 'fail', note: 'HTTP 500' }])
-  assert.equal(dead.verdict, 'DEAD')
-  assert.deepEqual(dead.broken.map((b) => b.id), ['b'])
-})
-
-test('verdict: a missing or cannot-run path is CANNOT-RUN, not DEAD', () => {
-  const sel = [{ id: 'a', surface: 'api' }, { id: 'b', surface: 'api' }]
-  const v = computeVerdict(sel, [{ id: 'a', status: 'pass' }, { id: 'b', status: 'cannot-run', note: 'no secret' }])
-  assert.equal(v.verdict, 'CANNOT-RUN')
-  assert.equal(v.ok, false)
-})
-
-test('verdict: a failed path is DEAD even when another could not run', () => {
-  const sel = [{ id: 'a', surface: 'api' }, { id: 'b', surface: 'api' }]
-  const v = computeVerdict(sel, [{ id: 'a', status: 'fail', note: 'HTTP 500' }])
-  assert.equal(v.verdict, 'DEAD')
-  assert.deepEqual(v.broken.map((b) => [b.id, b.status]), [['a', 'fail'], ['b', 'missing']])
-})
-
-test('verdict: nothing selected is EMPTY, never ALIVE', () => {
-  const v = computeVerdict([], [])
-  assert.equal(v.verdict, 'EMPTY')
-  assert.equal(v.ok, false)
-})
-
-test('the verdict is stamped with target, engine, and time', () => {
-  const v = stampTarget({ verdict: 'ALIVE' }, 'https://x', { profile: 'prod-preview', generatedAt: 'forged' })
-  assert.equal(v.target, 'https://x')
-  assert.equal(v.engine, ENGINE_VERSION)
-  assert.notEqual(v.generatedAt, 'forged')
-})
-
-// ---- journeys ----
-
-test('journey ids accept the new tag, the legacy tag, and a bare id', () => {
-  assert.equal(journeyCoversId('@golden-path sign-in'), 'sign-in')
-  assert.equal(journeyCoversId('@smoke smoke/sign-in'), 'smoke/sign-in')
-  assert.equal(journeyCoversId('checkout'), 'checkout')
-})
-
-test('reconcile fails both ways: an untagged journey and an orphan tag', () => {
-  const r = reconcileJourneys(contract(), ['sign-in', 'refund'])
-  const errors = r.errors.join('\n')
-  assert.match(errors, /checkout.*no spec is tagged/)
-  assert.match(errors, /@covers refund is not in the contract/)
-})
-
-test('scanJourneyTags reads @golden-path and @smoke specs, skipping untagged ones', () => {
-  const dir = tmpRepo({
-    'e2e/a.spec.ts': '// @golden-path\n// @covers sign-in\n',
-    'e2e/b.spec.ts': '// @smoke\n// @covers checkout\n',
-    'e2e/c.spec.ts': '// @covers not-tagged\n',
-    'e2e/d.spec.ts': '// @golden-path\n',
-  })
-  const { byId, noCovers } = scanJourneyTags(path.join(dir, 'e2e'))
-  assert.deepEqual([...byId.keys()].sort(), ['checkout', 'sign-in'])
-  assert.equal(noCovers.length, 1)
-})
-
-// ---- judging observations ----
-
-test('parseStart reads one request and refuses prose', () => {
-  assert.deepEqual(parseStart('GET /api/health'), { method: 'GET', path: '/api/health' })
-  assert.equal(parseStart('GET /a, GET /b'), null)
-})
-
-test('judgeHttp checks status, body text, and a JSON subset', () => {
-  const p = { expect: { status: [200, 204], bodyIncludes: 'ok', json: { status: 'ok', db: { up: true } } } }
-  assert.equal(judgeHttp(p, 200, '{"status":"ok","db":{"up":true,"ms":3}}').status, 'pass')
-  assert.match(judgeHttp(p, 500, '').note, /HTTP 500, expected 200 or 204/)
-  assert.match(judgeHttp(p, 200, '{"status":"ok","db":{"up":false}}').note, /does not contain/)
-  assert.equal(judgeHttp({}, 201, '').status, 'pass')
-  assert.equal(judgeHttp({}, 302, '').status, 'fail')
-})
-
-test('judgeCli checks the exit code and the output', () => {
-  assert.equal(judgeCli({}, 0, '').status, 'pass')
-  assert.match(judgeCli({ expect: { exitCode: 0, stdoutIncludes: ['migrated'] } }, 0, 'nothing').note, /does not include/)
-  assert.match(judgeCli({}, 3, '').note, /exit 3/)
-})
-
-const pass = { status: 'expected', results: [{ status: 'passed' }] }
-const failed = { status: 'unexpected', results: [{ status: 'failed' }] }
-
-test('playwrightFileResults resolves files against rootDir and folds every test', () => {
-  const report = { config: { rootDir: '/app/e2e' }, suites: [
-    { file: 'a.spec.ts', specs: [{ tests: [pass] }], suites: [{ specs: [{ tests: [{ status: 'flaky', results: [{ status: 'failed' }, { status: 'passed' }] }] }] }] },
-    { file: 'admin/b.spec.ts', specs: [{ tests: [pass] }, { tests: [failed] }] },
-    { file: '../c.spec.ts', specs: [{ tests: [pass] }] },
-  ] }
-  const r = playwrightFileResults(report, { appDir: '/app' })
-  assert.equal(r.get('/app/e2e/a.spec.ts'), 'pass')
-  assert.equal(r.get('/app/e2e/admin/b.spec.ts'), 'fail')
-  assert.equal(r.get('/app/c.spec.ts'), 'pass')
-})
-
-test('a skipped test or an expected failure is never a pass', () => {
-  const skipped = { config: { rootDir: '/a' }, suites: [{ file: 's.spec.ts', specs: [{ ok: true, tests: [{ status: 'skipped', results: [{ status: 'skipped' }] }] }] }] }
-  assert.equal(playwrightFileResults(skipped, { appDir: '/a' }).get('/a/s.spec.ts'), 'skipped')
-  const expectedFailure = { config: { rootDir: '/a' }, suites: [{ file: 'f.spec.ts', specs: [{ ok: true, tests: [{ status: 'expected', results: [{ status: 'failed' }] }] }] }] }
-  assert.equal(playwrightFileResults(expectedFailure, { appDir: '/a' }).get('/a/f.spec.ts'), 'fail')
-})
-
-// ---- generated files ----
-
-test('the view lists every path and every profile, and says it is generated', () => {
-  const md = renderView(contract())
-  assert.match(md, /GENERATED by the golden-path skill/)
-  assert.match(md, /\| `checkout` \| A user pays for an order \| Browser journey `checkout` \|.*\| yes \(tenant `e2e-synthetic`\) \|/)
-  assert.match(md, /\| `prod-preview` \| Production candidate at 0% traffic.* \| never \| 2 \| the deploy or release pipeline \|/)
-  assert.match(md, /\| `pr-local` .*`\.github\/workflows\/golden-paths\.yml` \|/)
-})
-
-test('the view escapes pipes so a title cannot break the table', () => {
-  const c = contract()
-  c.paths[0].title = 'up | down'
-  assert.match(renderView(c), /up \\\| down/)
-})
-
-// ---- optional human documentation ----
-
-test('documentation references and id anchors survive insertion, reorder, regrouping, and title changes', () => {
-  const original = contract()
-  original.paths[1].documentation = documentation()
-  original.paths[2].documentation = documentation({ reference: 'GP-COMMERCE-PAY', title: { en: 'Pay', zh: '支付' } })
-  const changes = {
-    unchanged: () => {},
-    insertion: (c) => c.paths.unshift({ ...structuredClone(c.paths[1]), id: 'new-user', journey: 'new-user', documentation: documentation({ reference: 'GP-IDENTITY-REGISTER', title: { en: 'Register', zh: '注册' } }) }),
-    reorder: (c) => c.paths.reverse(),
-    regrouping: (c) => { c.paths[1].documentation.group = { en: 'Account', zh: '账户', order: 1 } },
-    renaming: (c) => { c.paths[1].title = 'Returning user login'; c.paths[1].documentation.title = { en: 'Log in', zh: '用户登录' } },
-  }
-  for (const [change, mutate] of Object.entries(changes)) {
-    const c = structuredClone(original)
-    mutate(c)
-    assert.deepEqual(validateContract(c).errors, [], change)
-    const md = renderView(c)
-    for (const id of ['sign-in', 'checkout']) {
-      const p = c.paths.find((p) => p.id === id)
-      const { reference, title } = p.documentation
-      assert.ok(documentedSection(md, id).includes(`### ${reference}: ${title.en}\n`), change)
-      assert.ok(md.includes(`- [${reference}: ${title.en} / ${title.zh}](#golden-path-${id})`), change)
-      assert.equal((md.match(new RegExp(`<a id="golden-path-${id}"></a>`, 'g')) || []).length, 1, change)
-    }
-    const selected = selectPathsForProfile(c, 'prod-preview').run.filter((p) => p.id !== 'new-user')
-    assert.deepEqual(selected.map((p) => p.id).sort(), ['health', 'sign-in'], change)
-    const verdict = computeVerdict(selected, [{ id: 'health', status: 'pass' }, { id: 'sign-in', status: 'pass' }])
-    assert.equal(verdict.verdict, 'ALIVE', change)
-    assert.deepEqual(verdict.rows.map((p) => p.id).sort(), ['health', 'sign-in'], change)
-  }
-})
-
-test('missing references use machine ids for documented and mixed legacy paths, never positional labels', () => {
-  const c = contract()
-  c.paths[1].documentation = documentation()
-  delete c.paths[1].documentation.reference
-  for (const paths of [c.paths, [...c.paths].reverse()]) {
-    const md = renderView({ ...c, paths })
-    assert.ok(md.includes('- [sign-in: Sign in / 登录](#golden-path-sign-in)'))
-    assert.match(documentedSection(md, 'sign-in'), /### sign-in: Sign in\n/)
-    assert.ok(md.includes(`- [health: ${c.paths[0].title}](#golden-path-health)`))
-    assert.ok(documentedSection(md, 'health').includes(`### health: ${c.paths[0].title}\n`))
-    assert.doesNotMatch(md, /GP-0?[123]:/)
-  }
-})
-
-test('entirely undocumented contracts retain the legacy table, including versionless manifests', () => {
-  for (const version of [3, undefined]) {
-    const c = contract({ version })
-    if (version === undefined) {
-      for (const p of c.paths) delete p.title
-      c.paths[1].intent = 'A returning user signs in. Further context.'
-    }
-    const md = renderView(c)
-    assert.match(md, /\| Path \| What it proves \| How it is checked \| Runs in \| Writes data \|/)
-    assert.ok(md.includes(`| \`sign-in\` | ${version === 3 ? c.paths[1].title : 'A returning user signs in.'} | Browser journey \`sign-in\` |`))
-    assert.doesNotMatch(md, /<details>|golden-path-sign-in|## Contents|### /)
-  }
-})
-
-test('browser groups follow group order and services remain a separate appendix', () => {
-  const c = contract()
-  c.paths[1].documentation = documentation()
-  c.paths[2].documentation = documentation({ reference: 'GP-COMMERCE-PAY', group: { en: 'Commerce', zh: '交易', order: 2 }, title: { en: 'Pay', zh: '支付' } })
-  c.paths[0].documentation = documentation({ reference: 'GP-SERVICE-HEALTH', group: { en: 'Commerce', zh: '交易', order: 0 }, title: { en: 'Health', zh: '健康检查' } })
-  const md = renderView(c)
-  const commerce = md.indexOf('\n## Commerce / 交易\n')
-  const identity = md.indexOf('\n## Identity / 身份\n')
-  const services = md.indexOf('\n## Service checks / 服务检查\n')
-  assert.ok(commerce >= 0 && identity > commerce && services > identity)
-  assert.ok(md.indexOf('<a id="golden-path-checkout">') > commerce && md.indexOf('<a id="golden-path-checkout">') < identity)
-  assert.ok(md.indexOf('<a id="golden-path-sign-in">') > identity && md.indexOf('<a id="golden-path-sign-in">') < services)
-  assert.ok(md.indexOf('<a id="golden-path-health">') > services)
-})
-
-test('bilingual summaries stay visible while original steps and verification are in closed details', () => {
-  const c = contract()
-  const doc = documentation()
-  c.paths[1].documentation = doc
-  const section = documentedSection(renderView(c), 'sign-in')
-  const details = section.match(/<details>\s*<summary>Full steps \/ 完整步骤<\/summary>([\s\S]*?)<\/details>/)
-  assert.ok(details, 'full steps must be in a closed disclosure')
-  const visible = section.slice(0, details.index) + section.slice(details.index + details[0].length)
-  for (const text of [doc.summary.route.en, doc.summary.route.zh, doc.summary.outcome.en, doc.summary.outcome.zh]) {
-    assert.ok(visible.includes(text), `summary must remain visible: ${text}`)
-  }
-  for (const text of [doc.precondition.en, doc.precondition.zh, ...doc.steps.flatMap((s) => [s.action.en, s.action.zh, s.expected.en, s.expected.zh])]) {
-    assert.ok(details[1].includes(text), `full original copy must be retained: ${text}`)
-    assert.ok(!visible.includes(text), `full copy must be collapsed: ${text}`)
-  }
-  assert.match(details[1], /Browser journey `sign-in`/)
-  assert.match(details[1], /pr-local, queue-local, prod-preview/)
-  assert.match(details[1], /Writes to shared data \/ 写入共享数据: no \/ 否/)
-  assert.doesNotMatch(section, /<details\s+[^>]*open/i)
-})
-
-test('paths without summaries stay expanded and English-only summaries need no Chinese', () => {
-  const c = contract()
-  const doc = documentation()
-  delete doc.summary
-  c.paths[1].documentation = doc
-  let section = documentedSection(renderView(c), 'sign-in')
-  assert.doesNotMatch(section, /<details>|<summary>/)
-  assert.ok(section.includes(doc.steps[1].expected.en))
-  assert.match(section, /Browser journey `sign-in`/)
-  c.paths[1].documentation = {
-    summary: { route: { en: 'Login → Home' }, outcome: { en: 'Home opens' } },
-    steps: [{ action: { en: 'Log in' }, expected: { en: 'Home is visible' } }],
-  }
-  assert.deepEqual(validateContract(c).errors, [])
-  section = documentedSection(renderView(c), 'sign-in')
-  assert.match(section, /<details>\s*<summary>Full steps<\/summary>/)
-  const route = section.indexOf('Login → Home')
-  assert.ok(route >= 0 && route < section.indexOf('<details>'))
-})
-
-test('documentation accepts stable uppercase references and rejects malformed references', () => {
-  for (const reference of ['GP-A', 'GP-9', 'GP-IDENTITY-LOGIN', 'GP-V2-A1']) {
-    const c = contract()
-    c.paths[1].documentation = documentation({ reference })
-    assert.deepEqual(validateContract(c).errors, [], reference)
-  }
-  for (const reference of ['', 'GP-', 'gp-IDENTITY-LOGIN', 'GP-Identity', 'GP-A--B', 'GP-A-', 'GP_A', 'GP-A B', ' GP-A', 'GP-A\n', 1, null, ['GP-A']]) {
-    const c = contract()
-    c.paths[1].documentation = documentation({ reference })
-    const result = validateContract(c)
-    assert.equal(result.ok, false, JSON.stringify(reference))
-    assert.match(result.errors.join('\n'), /documentation\.reference/, JSON.stringify(reference))
-  }
-})
-
-test('duplicate documentation references are invalid across browser and service paths', () => {
-  const c = contract()
-  c.paths[0].documentation = documentation()
-  c.paths[1].documentation = documentation()
-  const result = validateContract(c)
-  assert.equal(result.ok, false)
-  assert.match(result.errors.join('\n'), /duplicate documentation\.reference.*GP-IDENTITY-LOGIN/)
-  c.paths[0].documentation.reference = 'GP-SERVICE-HEALTH'
-  assert.deepEqual(validateContract(c).errors, [])
-})
-
-test('documentation validation rejects malformed localized fields, unpaired copy, and incomplete steps', () => {
-  const cases = [
-    ['documentation', () => null],
-    ['documentation', () => []],
-    ['documentation', () => 'notes'],
-    ['documentation.title', (d) => ({ ...d, title: { zh: '登录' } })],
-    ['documentation.title', (d) => ({ ...d, title: { en: ' ' } })],
-    ['documentation.title', (d) => ({ ...d, title: { en: 'Login', zh: '' } })],
-    ['documentation.group', (d) => ({ ...d, group: 'Identity' })],
-    ['documentation.group.order', (d) => ({ ...d, group: { en: 'Identity', order: -1 } })],
-    ['documentation.group.order', (d) => ({ ...d, group: { en: 'Identity', order: 1.5 } })],
-    ['documentation.group.order', (d) => ({ ...d, group: { en: 'Identity', order: '1' } })],
-    ['documentation.precondition', (d) => ({ ...d, precondition: { en: 42 } })],
-    ['documentation.summary', (d) => ({ ...d, summary: [] })],
-    ['documentation.summary.route', (d) => ({ ...d, summary: { outcome: { en: 'Home opens' } } })],
-    ['documentation.summary.outcome', (d) => ({ ...d, summary: { route: { en: 'Login' } } })],
-    ['documentation.summary.route', (d) => ({ ...d, summary: { ...d.summary, route: { en: '' } } })],
-    ['documentation.summary', (d) => ({ ...d, summary: { ...d.summary, outcome: { en: 'Home opens' } } })],
-    ['documentation.summary', (d) => ({ ...d, summary: { ...d.summary, route: { en: 'Login' } } })],
-    ['documentation.steps', (d) => ({ ...d, steps: undefined })],
-    ['documentation.steps', (d) => ({ ...d, steps: [] })],
-    ['documentation.steps', (d) => ({ ...d, steps: {} })],
-    ['documentation.steps[0].action', (d) => ({ ...d, steps: [null] })],
-    ['documentation.steps[0].action', (d) => ({ ...d, steps: [{ action: { en: ' ' }, expected: { en: 'Home' } }] })],
-    ['documentation.steps[0].expected', (d) => ({ ...d, steps: [{ action: { en: 'Login' } }] })],
-    ['documentation.steps[0]', (d) => ({ ...d, steps: [{ action: { en: 'Login', zh: '登录' }, expected: { en: 'Home' } }] })],
-    ['documentation.steps[1]', (d) => ({ ...d, steps: [d.steps[0], { action: { en: 'Login' }, expected: { en: 'Home' } }] })],
-  ]
-  for (const [field, invalid] of cases) {
-    const c = contract()
-    c.paths[1].documentation = invalid(documentation())
-    const result = validateContract(c)
-    assert.equal(result.ok, false, field)
-    assert.ok(result.errors.some((error) => error.includes(field)), `${field}: ${result.errors.join('\n')}`)
-  }
-  const c = contract()
-  c.paths[1].documentation = { group: { en: 'Identity', order: 0 }, steps: [{ action: { en: 'Login' }, expected: { en: 'Home' } }] }
-  assert.deepEqual(validateContract(c).errors, [], 'localized presentation fields and reference are optional')
-  delete c.paths[1].journey
-  assert.match(validateContract(c).errors.join('\n'), /browser path needs "journey"/, 'documentation cannot replace the executable journey')
-})
-
-test('documentation HTML is escaped in headings, Contents, summaries, and collapsed steps', () => {
-  const c = contract()
-  const unsafe = '<script>alert("x")</script> & <details open> | literal'
-  const safe = '&lt;script&gt;alert("x")&lt;/script&gt; &amp; &lt;details open&gt; \\| literal'
-  const copy = (name) => ({ en: `${name}: ${unsafe}`, zh: `${name}中文: ${unsafe}` })
-  c.paths[1].documentation = documentation({
-    title: copy('Title'), group: copy('Group'), precondition: copy('Precondition'),
-    summary: { route: copy('Route'), outcome: copy('Outcome') },
-    steps: [{ action: copy('Action'), expected: copy('Expected result') }],
-  })
-  const md = renderView(c)
-  assert.ok(md.includes(`### GP-IDENTITY-LOGIN: Title: ${safe}\n`))
-  assert.ok(md.includes(`- [GP-IDENTITY-LOGIN: Title: ${safe} / Title中文: ${safe}](#golden-path-sign-in)`))
-  assert.ok(md.includes(`## Group: ${safe} / Group中文: ${safe}\n`))
-  const section = documentedSection(md, 'sign-in')
-  const details = section.match(/<details>\s*<summary>Full steps \/ 完整步骤<\/summary>([\s\S]*?)<\/details>/)
-  assert.ok(details)
-  const visible = section.slice(0, details.index)
-  for (const name of ['Route', 'Outcome']) {
-    assert.ok(visible.includes(`${name}: ${safe}`), name)
-    assert.ok(visible.includes(`${name}中文: ${safe}`), name)
-  }
-  for (const name of ['Precondition', 'Action', 'Expected result']) {
-    assert.ok(details[1].includes(`${name}: ${safe}`), name)
-    assert.ok(details[1].includes(`${name}中文: ${safe}`), name)
-  }
-  assert.doesNotMatch(md, /<script>|<details open>/)
-})
-
-test('literal Markdown cannot redirect Contents links or format journey copy', () => {
-  const c = contract()
-  const text = 'Review ](https://example.com) [case] **draft** `tag` _notes_ ~~old~~ \\ ready'
-  const escaped = 'Review \\](https://example.com) \\[case\\] \\*\\*draft\\*\\* \\`tag\\` \\_notes\\_ \\~\\~old\\~\\~ \\\\ ready'
-  c.paths[1].documentation = documentation({
-    title: { en: text }, group: { en: text }, precondition: { en: '# Literal heading' },
-    summary: { route: { en: text }, outcome: { en: text } },
-    steps: [{ action: { en: text }, expected: { en: '1. Literal result' } }],
-  })
-  assert.deepEqual(validateContract(c).errors, [])
-  const md = renderView(c)
-  assert.ok(md.includes(`- [GP-IDENTITY-LOGIN: ${escaped}](#golden-path-sign-in)`))
-  assert.ok(md.includes(`### GP-IDENTITY-LOGIN: ${escaped}\n`))
-  assert.ok(md.includes(`**Route:** ${escaped}\n`))
-  assert.ok(md.includes(`1. **${escaped}**`))
-  assert.ok(md.includes('\\# Literal heading'))
-  assert.ok(md.includes('Expected: 1\\. Literal result'))
-  assert.doesNotMatch(md, /(?<!\\)\]\(https:\/\/example\.com\)/)
-  for (const prefix of ['-', '+', '###']) {
-    c.paths[1].documentation.precondition.en = `${prefix} Literal text`
-    assert.ok(renderView(c).includes(`\\${prefix} Literal text`))
-  }
-})
-
-test('malformed Chinese values return field errors instead of invoking trim properties', () => {
-  for (const value of [{ trim: 42 }, { trim: 'not callable' }, {}, [], null, 42, false]) {
-    for (const field of ['route', 'outcome', 'action', 'expected']) {
-      const c = contract()
-      c.paths[1].documentation = documentation()
-      const doc = c.paths[1].documentation
-      if (field === 'route' || field === 'outcome') doc.summary[field].zh = value
-      else doc.steps[0][field].zh = value
-      const result = validateContract(c)
-      assert.equal(result.ok, false, `${field}: ${JSON.stringify(value)}`)
-      assert.ok(result.errors.some((error) => error.includes(`.${field}`)))
-    }
-  }
-})
-
-test('invalid documentation refuses rendering and init with actionable field diagnostics', () => {
-  const dir = tmpRepo({ 'GOLDEN_PATHS.md': 'existing guide\n' })
-  try {
-    const c = contract()
-    c.paths[1].documentation = documentation()
-    delete c.paths[1].documentation.summary.outcome
-    assert.throws(() => renderView(c), /invalid documentation:[\s\S]*documentation\.summary\.outcome/)
-    assert.throws(() => initPlan(path.join(dir, CONTRACT_FILE), { contract: c }), /invalid documentation:[\s\S]*documentation\.summary\.outcome/)
-    assert.equal(fs.readFileSync(path.join(dir, VIEW_FILE), 'utf8'), 'existing guide\n')
-    assert.equal(fs.existsSync(path.join(dir, ENGINE_FILE)), false)
-    c.paths[1].documentation = documentation()
-    c.paths[2].documentation = documentation()
-    assert.throws(() => renderView(c), /invalid documentation:[\s\S]*duplicate documentation\.reference/)
-  } finally { fs.rmSync(dir, { recursive: true, force: true }) }
-})
-
-test('workflow triggers follow the declared local profiles and the queue', () => {
-  const c = contract()
-  assert.deepEqual(ciProfiles(c), ['pr-local', 'queue-local'])
-  let wf = renderWorkflow(c)
-  assert.match(wf, /^  pull_request:$/m)
-  assert.match(wf, /mergify\/merge-queue/)
-  c.ci.queue = 'github'
-  wf = renderWorkflow(c)
-  assert.match(wf, /^  merge_group:$/m)
-  c.ci.queue = 'none'
-  assert.doesNotMatch(renderWorkflow(c), /merge_group|mergify/)
-  assert.equal(renderWorkflow({ ...c, ci: { enabled: false } }), null)
-})
-
-test('a postgres 18 database puts its tmpfs where that image keeps PGDATA', () => {
-  const c = contract()
-  c.setup.database = { engine: 'postgres', version: '18' }
-  const wf = renderWorkflow(c)
-  assert.match(wf, /--tmpfs \/var\/lib\/postgresql:rw,noexec,nosuid,size=1g/)
-  assert.doesNotMatch(wf, /--tmpfs \/var\/lib\/postgresql\/data/)
-})
-
-test('the workflow boots, waits, runs, and lets the verdict decide', () => {
-  const c = contract()
-  c.setup.database = { engine: 'postgres', version: '16' }
-  c.setup.secrets = { generate: ['AUTH_SECRET'], fromCi: ['STRIPE_KEY'] }
-  c.setup.env = { FEATURE_X: 'on' }
-  c.setup.seed = 'pnpm db:seed'
-  c.setup.boot = "pnpm start --host '0.0.0.0'"
-  const wf = renderWorkflow(c)
-  assert.match(wf, /image: postgres:16/)
-  // Runners share the host network: the service gets a dynamic host port, never 5432:5432.
-  assert.match(wf, /ports: \['5432\/tcp'\]/)
-  assert.match(wf, /DATABASE_URL: postgres:\/\/postgres:postgres@127\.0\.0\.1:\$\{\{ job\.services\.postgres\.ports\['5432'\] \}\}\/golden_paths/)
-  assert.match(wf, /--tmpfs \/var\/lib\/postgresql\/data:rw,noexec,nosuid,size=1g/)
-  assert.match(wf, /for name in AUTH_SECRET; do/)
-  assert.match(wf, /STRIPE_KEY: \$\{\{ secrets\.STRIPE_KEY \}\}/)
-  assert.match(wf, /FEATURE_X: "on"/)
-  assert.match(wf, /nohup sh -c 'pnpm start --host '\\''0\.0\.0\.0'\\''' >/)
-  assert.match(wf, /wait --url "http:\/\/127\.0\.0\.1:3000\/api\/health"/)
-  assert.match(wf, /playwright install --with-deps chromium/)
-  const order = ['check', 'pnpm db:seed', 'Boot the app', ' run --profile', ' verdict --profile'].map((s) => wf.indexOf(s))
-  assert.deepEqual([...order].sort((a, b) => a - b), order)
-})
-
-test('a monorepo app gets a working directory and prefixed artifact paths', () => {
-  const wf = renderWorkflow(contract(), { appRel: 'apps/web' })
-  assert.match(wf, /working-directory: "apps\/web"/)
-  assert.match(wf, /cache-dependency-path: "apps\/web\/pnpm-lock\.yaml"/)
-  assert.match(wf, /apps\/web\/golden-path-results\.json/)
-})
-
-test('the AGENTS.md pointer is replaced in place, one block per app', () => {
-  const once = upsertBlock('# AGENTS.md\n\nrules\n', pointerBlock('apps/web'), 'apps/web')
-  const again = upsertBlock(once, pointerBlock('apps/web'), 'apps/web')
-  assert.equal(again, once)
-  const both = upsertBlock(again, pointerBlock('apps/api'), 'apps/api')
-  assert.match(both, /apps\/web\/GOLDEN_PATHS\.md/)
-  assert.match(both, /apps\/api\/GOLDEN_PATHS\.md/)
-  assert.match(both, /^rules$/m)
-})
-
-// ---- init / check ----
-
-test('init on a fresh repo previews, then writes the starter set', () => {
-  const dir = tmpRepo({ 'package.json': JSON.stringify({ scripts: { start: 'next start', build: 'next build' } }), 'pnpm-lock.yaml': '', '.mergify.yml': '' })
-  const { plan } = initPlan(path.join(dir, CONTRACT_FILE))
-  const preview = applyPlan(plan, { write: false })
-  assert.equal(fs.existsSync(path.join(dir, CONTRACT_FILE)), false)
-  assert.ok(preview.every((r) => ['create', 'link', 'skip'].includes(r.action)))
-  applyPlan(plan, { write: true })
-  const c = JSON.parse(fs.readFileSync(path.join(dir, CONTRACT_FILE), 'utf8'))
-  assert.equal(c.setup.boot, 'pnpm run start')
-  assert.equal(c.ci.queue, 'mergify')
-  assert.ok(fs.existsSync(path.join(dir, ENGINE_FILE)))
-  assert.ok(fs.existsSync(path.join(dir, ENGINE_FILE.replace('golden-path.mjs', 'golden-path-core.mjs'))))
-  assert.ok(fs.existsSync(path.join(dir, VIEW_FILE)))
-  assert.equal(fs.existsSync(path.join(dir, WORKFLOW_FILE)), false, 'no workflow until the contract has paths')
-  assert.ok(fs.lstatSync(path.join(dir, 'CLAUDE.md')).isSymbolicLink())
-  assert.match(fs.readFileSync(path.join(dir, '.gitignore'), 'utf8'), /golden-path-results\.json/)
-})
-
-test('init keeps an existing contract and writes the workflow once it validates', () => {
-  const dir = tmpRepo({ [CONTRACT_FILE]: JSON.stringify(contract()), 'CLAUDE.md': 'Read AGENTS.md\n' })
-  const results = applyPlan(initPlan(path.join(dir, CONTRACT_FILE)).plan, { write: true })
-  assert.equal(results.find((r) => r.file.endsWith(CONTRACT_FILE)).action, 'skip')
-  assert.ok(fs.existsSync(path.join(dir, WORKFLOW_FILE)))
-  assert.equal(fs.readFileSync(path.join(dir, 'CLAUDE.md'), 'utf8'), 'Read AGENTS.md\n')
-  const again = applyPlan(initPlan(path.join(dir, CONTRACT_FILE)).plan, { write: true })
-  assert.ok(again.every((r) => r.action === 'unchanged' || r.action === 'skip'), JSON.stringify(again))
-})
-
-test('init creates or updates the README link without disturbing surrounding content', async () => {
-  const before = '# Product\n\nOverview.\n\n<!-- golden-path:start -->\nOld pointer\n<!-- golden-path:end -->\n\n## Development\n\nRun the app.\n'
-  for (const readme of [undefined, before.replace('<!-- golden-path:start -->\nOld pointer\n<!-- golden-path:end -->\n\n', ''), before]) {
-    const dir = tmpRepo({ [CONTRACT_FILE]: JSON.stringify(contract()), ...(readme === undefined ? {} : { 'README.md': readme }) })
-    const args = ['init', '--write', '--app-dir', dir]
-    assert.equal(await runCli(args, quiet()), 0)
-    const file = path.join(dir, 'README.md')
-    const generated = fs.readFileSync(file, 'utf8')
-    assert.match(generated, /\[GOLDEN_PATHS\.md\]\(GOLDEN_PATHS\.md\)/)
-    assert.equal(generated.match(/<!-- golden-path:start -->/g).length, 1)
-    if (readme !== undefined) {
-      assert.ok(generated.startsWith('# Product\n\nOverview.\n\n'))
-      assert.ok(generated.includes('\n## Development\n\nRun the app.\n'))
-      if (readme === before) assert.ok(generated.endsWith('\n## Development\n\nRun the app.\n'))
-      assert.doesNotMatch(generated, /Old pointer/)
-    } else {
-      assert.match(generated, /^# README\.md\n/)
-    }
-    assert.equal(await runCli(args, quiet()), 0)
-    assert.equal(fs.readFileSync(file, 'utf8'), generated)
-  }
-})
-
-test('check reports a hand-edited view and a stale workflow', () => {
-  const dir = tmpRepo({ [CONTRACT_FILE]: JSON.stringify(contract()) })
-  applyPlan(initPlan(path.join(dir, CONTRACT_FILE)).plan, { write: true })
-  assert.deepEqual(checkDrift(contract(), path.join(dir, CONTRACT_FILE)), [])
-  fs.appendFileSync(path.join(dir, VIEW_FILE), 'hand edit\n')
-  const c = contract()
-  c.ci.queue = 'none'
-  const drift = checkDrift(c, path.join(dir, CONTRACT_FILE))
-  assert.equal(drift.length, 2)
-})
-
-test('the CLI check command exits 1 on drift and 0 when current', async () => {
-  const dir = tmpRepo({ [CONTRACT_FILE]: JSON.stringify(contract()), ...SPECS })
-  applyPlan(initPlan(path.join(dir, CONTRACT_FILE)).plan, { write: true })
-  const file = path.join(dir, CONTRACT_FILE)
-  assert.equal(await runCli(['check', '--contract', file], quiet()), 0)
-  fs.writeFileSync(path.join(dir, VIEW_FILE), 'edited\n')
-  assert.equal(await runCli(['check', '--contract', file], quiet()), 1)
-})
-
-// ---- migration ----
-
-test('migrateLegacy converts a v2 manifest and lists what needs a person', () => {
-  const dir = tmpRepo({ 'e2e/a.spec.ts': '' })
-  const legacy = {
-    profiles: STANDARD_PROFILES,
-    setup: { boot: 'pnpm dev on port 3001', env: ['DATABASE_URL'], tenants: [] },
-    paths: [
-      { id: 'health', surface: 'api', start: 'GET /api/health', observable: '200 with ok. More detail.', profiles: ['pr-local'] },
-      { id: 'pay', surface: 'browser', journey: '@smoke pay', mutates: true, tenant: 'e2e-pay', profiles: ['pr-local'] },
-      { id: 'docs', surface: 'api', start: 'GET /a, GET /b', observable: 'both 200', profiles: ['pr-local'] },
-    ],
-  }
-  const { contract: c, todo } = migrateLegacy(legacy, { appDir: dir })
-  assert.equal(c.version, 3)
-  assert.equal(c.paths[0].title, '200 with ok.')
-  assert.equal(c.paths[1].journey, 'pay')
-  assert.deepEqual(c.setup.tenants, ['e2e-pay'])
-  assert.deepEqual(c.setup.secrets.fromCi, ['DATABASE_URL'])
-  assert.equal(c.setup.env, undefined)
-  assert.equal(c.setup.journeys, 'e2e')
-  assert.match(c.setup.boot, /^TODO: make this one shell command: pnpm dev on port 3001$/)
-  const t = todo.join('\n')
-  assert.match(t, /pay.*write cleanup/)
-  assert.match(t, /docs.*not one request/)
-  assert.match(t, /setup.boot/)
-  assert.equal(validateContract(c).ok, false, 'a migrated contract with placeholders must not validate')
-})
-
-test('audit finds legacy manifests, forked engines, smoke workflows, and tags', () => {
-  const dir = tmpRepo({
-    'apps/web/smoke.manifest.json': JSON.stringify({ profiles: { 'pr-local': STANDARD_PROFILES['pr-local'] }, paths: [] }),
-    'apps/web/scripts/smoke.mjs': 'const manifest = "smoke.manifest.json"\n'.repeat(40),
-    'apps/web/e2e/a.spec.ts': '// @smoke\n// @covers a\n',
-    '.github/workflows/smoke.yml': 'on: push\njobs:\n  smoke:\n    steps:\n      - run: node apps/web/scripts/smoke.mjs verdict\n',
-    'cloudbuild.yaml': 'steps: [{ args: [node, scripts/smoke.mjs, run] }]\n',
-  })
-  const a = audit(dir)
-  assert.deepEqual(a.legacy, ['apps/web/smoke.manifest.json'])
-  assert.equal(a.smokeTags, 1)
-  const kinds = a.findings.map((f) => `${f.kind}:${f.file}`)
-  assert.ok(kinds.includes('engine:apps/web/scripts/smoke.mjs'))
-  assert.ok(kinds.includes('drift:apps/web/smoke.manifest.json'), 'pr-local declared, nothing runs on pull_request')
-  assert.match(a.findings.find((f) => f.file === 'cloudbuild.yaml').note, /deployed profile/)
-})
-
-test('audit --write migrates beside the legacy manifest and keeps it unless asked', async () => {
-  const legacy = { profiles: STANDARD_PROFILES, setup: { boot: 'pnpm start' }, paths: [{ id: 'health', surface: 'api', start: 'GET /h', observable: 'ok', profiles: ['pr-local'] }] }
-  const dir = tmpRepo({ 'apps/web/smoke.manifest.json': JSON.stringify(legacy) })
-  const q = quiet()
-  assert.equal(await runCli(['audit', '--write', '--repo-root', dir], q), 0)
-  assert.ok(fs.existsSync(path.join(dir, 'apps/web', CONTRACT_FILE)))
-  assert.ok(fs.existsSync(path.join(dir, 'apps/web/smoke.manifest.json')))
-  assert.ok(fs.existsSync(path.join(dir, 'apps/web', ENGINE_FILE)))
-  assert.match(fs.readFileSync(path.join(dir, 'AGENTS.md'), 'utf8'), /apps\/web\/GOLDEN_PATHS\.md/)
-  assert.match(q.out.join('\n'), /needs a person/)
-})
-
-// ---- run ----
-
-test('run drives api and cli paths and the verdict follows', async () => {
-  const server = http.createServer((req, res) => {
-    if (req.url === '/api/health') { res.writeHead(200, { 'content-type': 'application/json' }); res.end('{"status":"ok"}') }
-    else { res.writeHead(500); res.end('boom') }
-  })
-  await new Promise((r) => server.listen(0, '127.0.0.1', r))
-  const target = `http://127.0.0.1:${server.address().port}`
-  try {
-    const c = contract({ paths: [
-      { id: 'health', title: 'up', surface: 'api', start: 'GET /api/health', observable: '200', expect: { status: 200, json: { status: 'ok' } }, profiles: ['pr-local'] },
-      { id: 'orders', title: 'orders', surface: 'api', request: { method: 'GET', path: '/api/orders' }, observable: '200', profiles: ['pr-local'] },
-      { id: 'migrate', title: 'migrations', surface: 'cli', command: 'echo migrated', observable: 'prints migrated', expect: { stdoutIncludes: 'migrated' }, profiles: ['pr-local'] },
-      { id: 'docs', title: 'docs', surface: 'api', start: 'GET /a, GET /b', observable: 'both', profiles: ['pr-local'] },
-    ] })
-    const results = await runPaths(c, { profile: 'pr-local', target, appDir: os.tmpdir() })
-    assert.deepEqual(results.map((r) => [r.id, r.status]), [['health', 'pass'], ['orders', 'fail'], ['migrate', 'pass'], ['docs', 'cannot-run']])
-    const { run } = selectPathsForProfile(c, 'pr-local')
-    assert.equal(computeVerdict(run, results).verdict, 'DEAD')
-  } finally {
-    server.close()
-  }
-})
-
-test('run with --expect-sha refuses a target serving another commit', async () => {
-  const server = http.createServer((req, res) => { res.writeHead(200); res.end('{"build":{"sha":"abc1234"}}') })
-  await new Promise((r) => server.listen(0, '127.0.0.1', r))
-  const target = `http://127.0.0.1:${server.address().port}`
-  try {
-    const c = contract()
-    c.setup.attestation = { path: '/version', field: 'build.sha' }
-    const wrong = await runPaths(c, { profile: 'pr-local', target, appDir: os.tmpdir(), expectSha: 'def5678' })
-    assert.ok(wrong.every((r) => r.status === 'cannot-run' && /serves abc1234/.test(r.note)))
-  } finally {
-    server.close()
-  }
-})
-
-test('the verdict command exits 0 only on ALIVE and writes the verdict file', async () => {
-  const dir = tmpRepo({ [CONTRACT_FILE]: JSON.stringify(contract()), ...SPECS })
-  const file = path.join(dir, CONTRACT_FILE)
-  const results = path.join(dir, 'r.json')
-  const bound = (r) => JSON.stringify(resultsEnvelope(r, { profile: 'prod-preview', target: 'http://127.0.0.1:3000' }))
-  fs.writeFileSync(results, bound([{ id: 'health', status: 'pass' }, { id: 'sign-in', status: 'pass' }]))
-  const out = path.join(dir, 'v.json')
-  assert.equal(await runCli(['verdict', '--contract', file, '--profile', 'prod-preview', '--results', results, '--out', out], quiet()), 0)
-  assert.equal(JSON.parse(fs.readFileSync(out, 'utf8')).noMutations, true)
-  fs.writeFileSync(results, bound([{ id: 'health', status: 'fail' }, { id: 'sign-in', status: 'pass' }]))
-  assert.equal(await runCli(['verdict', '--contract', file, '--profile', 'prod-preview', '--results', results, '--out', out], quiet()), 1)
-})
-
-test('the CLI refuses unknown flags and a missing contract', async () => {
-  assert.equal(await runCli(['validate', '--no-mutations'], quiet()), 2)
-  const dir = tmpRepo({ 'smoke.manifest.json': '{}' })
-  const q = quiet()
-  assert.equal(await runCli(['validate', '--contract', path.join(dir, CONTRACT_FILE)], q), 2)
-  assert.match(q.out.join('\n'), /audit --write/)
-})
-
-test('run maps a Playwright JSON report back to each browser path', async () => {
-  // A stand-in for `playwright test`: it receives the spec files and writes the
-  // JSON report where the engine asked for it, failing checkout.spec.ts.
-  const fake = [
-    "const fs = require('node:fs')",
-    "const files = process.argv.slice(2).filter((a) => a.endsWith('.spec.ts'))",
-    "const ok = { status: 'expected', results: [{ status: 'passed' }] }",
-    "const bad = { status: 'unexpected', results: [{ status: 'failed' }] }",
-    "const suites = files.map((f) => ({ file: f.replace(/^e2e\\//, ''), specs: [{ tests: [f.includes('checkout') ? bad : ok] }] }))",
-    "fs.writeFileSync(process.env.PLAYWRIGHT_JSON_OUTPUT_NAME, JSON.stringify({ config: { rootDir: require('node:path').resolve('e2e') }, suites }))",
-    "process.exitCode = suites.some((x) => x.file.includes('checkout')) ? 1 : 0",
-  ].join('\n')
-  const dir = tmpRepo({ ...SPECS, 'fake-pw.cjs': fake })
-  const c = contract()
-  c.setup.browser = { command: 'node fake-pw.cjs' }
-  c.paths = c.paths.filter((p) => p.surface === 'browser')
-  const results = await runPaths(c, { profile: 'pr-local', target: 'http://127.0.0.1:9', appDir: dir })
-  assert.deepEqual(results.map((r) => [r.id, r.status]), [['sign-in', 'pass'], ['checkout', 'fail']])
-})
-
-test('run reports a browser path whose spec is missing as cannot-run', async () => {
-  const dir = tmpRepo({ 'e2e/sign-in.spec.ts': SPECS['e2e/sign-in.spec.ts'], 'fake-pw.cjs': "require('node:fs').writeFileSync(process.env.PLAYWRIGHT_JSON_OUTPUT_NAME, JSON.stringify({ config: { rootDir: require('node:path').resolve('e2e') }, suites: [{ file: 'sign-in.spec.ts', specs: [{ tests: [{ status: 'expected', results: [{ status: 'passed' }] }] }] }] }))" })
-  const c = contract()
-  c.setup.browser = { command: 'node fake-pw.cjs' }
-  c.paths = c.paths.filter((p) => p.surface === 'browser')
-  const results = await runPaths(c, { profile: 'pr-local', target: 'http://127.0.0.1:9', appDir: dir })
-  assert.deepEqual(results.map((r) => [r.id, r.status]), [['sign-in', 'pass'], ['checkout', 'cannot-run']])
-})
-
-test('the shipped example contract validates', () => {
-  const file = new URL('../assets/golden-paths.example.json', import.meta.url)
-  assert.deepEqual(validateContract(JSON.parse(fs.readFileSync(file, 'utf8'))).errors, [])
-})
-
-test('the copied engine runs from the consumer repo', async () => {
-  const { spawnSync } = await import('node:child_process')
-  const dir = tmpRepo({ [CONTRACT_FILE]: JSON.stringify(contract()), ...SPECS })
-  applyPlan(initPlan(path.join(dir, CONTRACT_FILE)).plan, { write: true })
-  const r = spawnSync(process.execPath, [ENGINE_FILE, 'check'], { cwd: dir, encoding: 'utf8' })
-  assert.equal(r.status, 0, r.stdout + r.stderr)
-  assert.match(r.stdout, /generated files current/)
-  assert.equal(spawnSync(process.execPath, [ENGINE_FILE, 'version'], { cwd: dir, encoding: 'utf8' }).stdout.trim(), engineIdentity())
-  assert.ok(engineIdentity().startsWith(`${ENGINE_VERSION}+`))
-})
-
-test('verdict refuses results observed under another profile or target', () => {
-  const env = resultsEnvelope([{ id: 'health', status: 'pass' }], { profile: 'pr-local', target: 'http://127.0.0.1:3000' })
-  assert.match(openResults(env, { profile: 'prod-preview' }).error, /observed under profile "pr-local"/)
-  assert.match(openResults(env, { profile: 'pr-local', target: 'https://prod' }).error, /observed against http:\/\/127\.0\.0\.1:3000/)
-  assert.deepEqual(openResults(env, { profile: 'pr-local' }).results, env.results)
-  assert.equal(openResults([{ id: 'x', status: 'pass' }], { profile: 'any' }).results.length, 1)
-})
-
-test('the CLI cannot turn a local run into a production ALIVE', async () => {
-  const dir = tmpRepo({ [CONTRACT_FILE]: JSON.stringify(contract()), ...SPECS })
-  const file = path.join(dir, CONTRACT_FILE)
-  const results = path.join(dir, 'r.json')
-  fs.writeFileSync(results, JSON.stringify(resultsEnvelope([{ id: 'health', status: 'pass' }, { id: 'sign-in', status: 'pass' }], { profile: 'pr-local', target: 'http://127.0.0.1:3000' })))
-  const q = quiet()
-  assert.equal(await runCli(['verdict', '--contract', file, '--profile', 'prod-preview', '--results', results], q), 1)
-  assert.match(q.out.join('\n'), /observed under profile "pr-local"/)
-})
-
-test('a repo without a lockfile gets no dependency cache and a plain install', () => {
-  const dir = tmpRepo({ 'package.json': JSON.stringify({ scripts: { start: 'node server.mjs' } }) })
-  const { plan } = initPlan(path.join(dir, CONTRACT_FILE))
-  const c = JSON.parse(plan.find((s) => s.file.endsWith(CONTRACT_FILE)).next)
-  assert.equal(c.ci.cache, false)
-  c.paths = contract().paths.slice(0, 1)
-  c.setup.tenants = []
-  const wf = renderWorkflow(c)
-  assert.doesNotMatch(wf, /cache: npm/)
-  assert.match(wf, /run: "npm install"/)
-})
-
-test('the workflow waits on the contract health path when healthPath is unset', () => {
-  const c = contract()
-  delete c.setup.healthPath
-  assert.equal(inferHealthPath(c), '/api/health')
-  assert.match(renderWorkflow(c), /wait --url "http:\/\/127\.0\.0\.1:3000\/api\/health"/)
-})
-
-test('the view names the workflow only once the contract generates one', () => {
-  assert.doesNotMatch(renderView(contract({ paths: [] })), /golden-paths\.yml/)
-  assert.match(renderView(contract()), /golden-paths\.yml/)
-  assert.match(renderView(contract()), /init --write/)
-  assert.doesNotMatch(renderView(contract()), /render --write/)
-})
-
-test('--help prints usage and exits 0', async () => {
-  const q = quiet()
-  assert.equal(await runCli(['--help'], q), 0)
-  assert.equal(q.out[0], USAGE)
-})
-
-test('--surfaces narrows selection, and the verdict must use the same narrowing', () => {
-  const sel = selectPathsForProfile(contract(), 'pr-local', { surfaces: ['api'] })
-  assert.deepEqual(sel.run.map((p) => p.id), ['health'])
-  assert.match(sel.excluded.find((x) => x.id === 'sign-in').reason, /surface browser not selected/)
-  assert.throws(() => selectPathsForProfile(contract(), 'pr-local', { surfaces: ['web'] }), /unknown surface web/)
-  const env = resultsEnvelope([{ id: 'health', status: 'pass' }], { profile: 'pr-local', target: 't', surfaces: ['api'] })
-  assert.deepEqual(openResults(env, { profile: 'pr-local' }).surfaces, ['api'])
-  assert.match(openResults(env, { profile: 'pr-local', surfaces: [] }).error, /--surfaces api/)
-})
-
-test('the CLI verdict reuses the run\'s surface narrowing', async () => {
-  const dir = tmpRepo({ [CONTRACT_FILE]: JSON.stringify(contract()), ...SPECS })
-  const file = path.join(dir, CONTRACT_FILE)
-  const results = path.join(dir, 'r.json')
-  fs.writeFileSync(results, JSON.stringify(resultsEnvelope([{ id: 'health', status: 'pass' }], { profile: 'prod-preview', target: 'https://c', surfaces: ['api'] })))
-  const out = path.join(dir, 'v.json')
-  assert.equal(await runCli(['verdict', '--contract', file, '--profile', 'prod-preview', '--results', results, '--out', out], quiet()), 0)
-  assert.deepEqual(JSON.parse(fs.readFileSync(out, 'utf8')).surfaces, ['api'])
-})
-
-test('workflows are classified by commands and triggers, not by mentions', () => {
-  assert.equal(classifyWorkflow('.github/workflows/e2e.yml', 'on:\n  workflow_dispatch:\njobs:\n  e2e:\n    # smoke lanes live elsewhere\n    steps: [{ run: pnpm test:e2e }]\n'), null)
-  assert.deepEqual(classifyWorkflow('.github/workflows/smoke.yml', 'on:\n  push:\n    branches:\n      - main\n\n      - "mergify/merge-queue/**"\njobs:\n  s:\n    steps:\n      - run: node scripts/smoke.mjs verdict --profile queue-local\n'), { file: '.github/workflows/smoke.yml', lane: 'queue', gate: true })
-  assert.deepEqual(classifyWorkflow('.github/workflows/ci.yml', 'on: [pull_request]\njobs:\n  v:\n    steps:\n      - run: node scripts/smoke.mjs validate\n'), { file: '.github/workflows/ci.yml', lane: 'pr', gate: false })
-  assert.equal(classifyWorkflow('cloudbuild.yaml', 'steps:\n- args: [node, scripts/smoke.mjs, run, --profile, dev-active]\n').lane, 'deploy')
-  assert.equal(classifyWorkflow('.github/workflows/manual.yml', 'on:\n  workflow_dispatch:\njobs:\n  s:\n    steps:\n      - run: pnpm smoke:run\n').lane, 'manual')
-})
-
-test('audit ignores a smoke-named one-off probe that is not a gate', () => {
-  const dir = tmpRepo({
-    'scripts/536-runtime-smoke.mjs': 'console.log("probe")\n',
-    'scripts/smoke.mjs': 'const m = "smoke.manifest.json"\n',
-  })
-  const files = audit(dir).findings.filter((f) => f.kind === 'engine').map((f) => f.file)
-  assert.deepEqual(files, ['scripts/smoke.mjs'])
-})
-
-test('specTitles strips tags and only a single-test spec lends its name in migration', () => {
-  const dir = tmpRepo({
-    'e2e/one.spec.ts': "// @smoke\n// @covers one\ntest('@smoke one: user signs in', () => {})\n",
-    'e2e/two.spec.ts': "// @smoke\n// @covers two\ntest('first case', () => {})\ntest('second case', () => {})\n",
-  })
-  assert.deepEqual(specTitles([path.join(dir, 'e2e/one.spec.ts')]), ['User signs in'])
-  const legacy = { profiles: STANDARD_PROFILES, setup: { boot: 'x', journeys: 'e2e' }, paths: [
-    { id: 'one', surface: 'browser', journey: '@smoke one', profiles: ['pr-local'] },
-    { id: 'two', surface: 'browser', journey: '@smoke two', profiles: ['pr-local'] },
-  ] }
-  const { contract: c } = migrateLegacy(legacy, { appDir: dir })
-  assert.equal(c.paths[0].title, 'User signs in')
-  assert.match(c.paths[1].title, /^TODO/)
-})
-
-// ---- regressions from the independent audit ----
-
-function fakePlaywright(body) {
-  return `const fs = require('node:fs'); const path = require('node:path');\n${body}`
-}
-
-test('a spec covering two journeys is refused, so read-only runs never execute a writing journey', async () => {
-  const dir = tmpRepo({ 'e2e/shared.spec.ts': '// @golden-path\n// @covers sign-in\n// @covers checkout\n', 'fake-pw.cjs': fakePlaywright("fs.writeFileSync(process.env.PLAYWRIGHT_JSON_OUTPUT_NAME, '{}'); fs.writeFileSync('ran.txt', 'yes')") })
-  const c = contract()
-  c.setup.browser = { command: 'node fake-pw.cjs' }
-  c.paths = c.paths.filter((p) => p.surface === 'browser')
-  assert.match(validateContractAt(c, dir).join('\n'), /covers sign-in, checkout; keep one golden-path journey per spec file/)
-  const results = await runPaths(c, { profile: 'prod-preview', target: 'http://127.0.0.1:9', appDir: dir })
-  assert.deepEqual(results.map((r) => [r.id, r.status]), [['sign-in', 'cannot-run']])
-  assert.equal(fs.existsSync(path.join(dir, 'ran.txt')), false, 'the shared spec must not be executed')
-})
-
-function validateContractAt(c, dir) {
-  return reconcileJourneys(c, [...scanJourneyTags(path.join(dir, 'e2e')).byId.keys()]).errors.concat(
-    [...scanJourneyTags(path.join(dir, 'e2e')).byFile].filter(([, ids]) => ids.length > 1).map(([f, ids]) => `tagged spec ${f} covers ${ids.join(', ')}; keep one golden-path journey per spec file`))
-}
-
-test('a non-boolean mutates is invalid and is treated as writing', () => {
-  const c = contract()
-  c.paths[0] = { ...c.paths[0], mutates: 'true' }
-  assert.match(validateContract(c).errors.join('\n'), /mutates must be true or false/)
-  assert.deepEqual(selectPathsForProfile(c, 'prod-preview').run.map((p) => p.id), ['sign-in'])
-})
-
-test('two specs with the same name are never confused', async () => {
-  const dir = tmpRepo({
-    'e2e/login.spec.ts': '// @golden-path\n// @covers sign-in\n',
-    'e2e/admin/login.spec.ts': '// @golden-path\n// @covers checkout\n',
-    'fake-pw.cjs': fakePlaywright(`
-const ok = { status: 'expected', results: [{ status: 'passed' }] }
-const bad = { status: 'unexpected', results: [{ status: 'failed' }] }
-fs.writeFileSync(process.env.PLAYWRIGHT_JSON_OUTPUT_NAME, JSON.stringify({ config: { rootDir: path.resolve('e2e') }, suites: [
-  { file: 'login.spec.ts', specs: [{ tests: [ok] }] },
-  { file: 'admin/login.spec.ts', specs: [{ tests: [bad] }] },
-] }))
-process.exitCode = 1`),
-  })
-  const c = contract()
-  c.setup.browser = { command: 'node fake-pw.cjs' }
-  c.paths = c.paths.filter((p) => p.surface === 'browser')
-  const results = await runPaths(c, { profile: 'pr-local', target: 'http://127.0.0.1:9', appDir: dir })
-  assert.deepEqual(results.map((r) => [r.id, r.status]), [['sign-in', 'pass'], ['checkout', 'fail']])
-})
-
-test('a broken browser run turns its passes into cannot-run', async () => {
-  const dir = tmpRepo({ ...SPECS, 'fake-pw.cjs': fakePlaywright(`
-const ok = { status: 'expected', results: [{ status: 'passed' }] }
-fs.writeFileSync(process.env.PLAYWRIGHT_JSON_OUTPUT_NAME, JSON.stringify({ config: { rootDir: path.resolve('e2e') }, errors: [{ message: 'global teardown failed' }], suites: [
-  { file: 'sign-in.spec.ts', specs: [{ tests: [ok] }] }, { file: 'checkout.spec.ts', specs: [{ tests: [ok] }] },
-] }))
-process.exitCode = 1`) })
-  const c = contract()
-  c.setup.browser = { command: 'node fake-pw.cjs' }
-  c.paths = c.paths.filter((p) => p.surface === 'browser')
-  const results = await runPaths(c, { profile: 'pr-local', target: 'http://127.0.0.1:9', appDir: dir })
-  assert.ok(results.every((r) => r.status === 'cannot-run' && /global teardown failed/.test(r.note)), JSON.stringify(results))
-})
-
-test('a request path cannot leave the target origin', async () => {
-  const c = contract({ paths: [{ id: 'h', title: 'h', surface: 'api', request: { path: '//other.example/health' }, observable: '200', profiles: ['pr-local'] }] })
-  assert.match(validateContract(c).errors.join('\n'), /single \//)
-  const [r] = await runPaths(c, { profile: 'pr-local', target: 'http://127.0.0.1:9', appDir: os.tmpdir() })
-  assert.equal(r.status, 'cannot-run')
-  assert.match(r.note, /leaves the target origin/)
-})
-
-test('attestation needs a real commit sha on both sides', async () => {
-  const server = http.createServer((req, res) => { res.writeHead(200); res.end('{"sha":"a"}') })
-  await new Promise((r) => server.listen(0, '127.0.0.1', r))
-  try {
-    const c = contract()
-    c.setup.attestation = { path: '/version', field: 'sha' }
-    const target = `http://127.0.0.1:${server.address().port}`
-    const results = await runPaths(c, { profile: 'pr-local', target, appDir: os.tmpdir(), expectSha: 'abcdef0123456789' })
-    assert.ok(results.every((r) => r.status === 'cannot-run' && /not a commit sha/.test(r.note)))
-    const short = await runPaths(c, { profile: 'pr-local', target, appDir: os.tmpdir(), expectSha: 'a' })
-    assert.ok(short.every((r) => /at least 7 hex/.test(r.note)))
-  } finally {
-    server.close()
-  }
-})
-
-test('stdoutIncludes reads stdout only', async () => {
-  const c = contract({ paths: [{ id: 'cli', title: 'cli', surface: 'cli', command: 'printf OK >&2', observable: 'ok', expect: { stdoutIncludes: 'OK' }, profiles: ['pr-local'] }] })
-  const [r] = await runPaths(c, { profile: 'pr-local', target: 'http://127.0.0.1:9', appDir: os.tmpdir() })
-  assert.equal(r.status, 'fail')
-  assert.match(r.note, /it is on stderr/)
-})
-
-test('contract values cannot inject shell or YAML into the workflow', () => {
-  const bad = [
-    (c) => { c.setup.baseUrl = 'http://localhost/$(printf X)/' },
-    (c) => { c.setup.secrets = { generate: ['AUTH$(printf X)'] } },
-    (c) => { c.ci.runner = 'ubuntu-latest\n    container: attacker/image' },
-    (c) => { c.setup.env = { BASE_URL: 'https://prod' } },
-    (c) => { c.setup.env = { GOLDEN_PATH_PROFILE: 'prod-preview' } },
-    (c) => { c.setup.database = { engine: 'postgres' }; c.setup.secrets = { fromCi: ['DATABASE_URL'] } },
-    (c) => { c.setup.healthPath = '//evil' },
-  ]
-  for (const mutate of bad) {
-    const c = contract()
-    mutate(c)
-    assert.equal(validateContract(c).ok, false, JSON.stringify(c.setup) + JSON.stringify(c.ci))
-  }
-  const ok = contract()
-  ok.ci.runner = '[self-hosted, linux]'
-  assert.equal(validateContract(ok).ok, true)
-})
-
-test('two apps in one monorepo keep separate workflows and pointers', () => {
-  const dir = tmpRepo({ 'apps/a/golden-paths.json': JSON.stringify(contract()), 'apps/b/golden-paths.json': JSON.stringify(contract()), ...Object.fromEntries(Object.entries(SPECS).flatMap(([f, t]) => [[`apps/a/${f}`, t], [`apps/b/${f}`, t]])) })
-  applyPlan(initPlan(path.join(dir, 'apps/a', CONTRACT_FILE)).plan, { write: true })
-  applyPlan(initPlan(path.join(dir, 'apps/b', CONTRACT_FILE)).plan, { write: true })
-  assert.deepEqual(checkDrift(contract(), path.join(dir, 'apps/a', CONTRACT_FILE)), [])
-  assert.deepEqual(checkDrift(contract(), path.join(dir, 'apps/b', CONTRACT_FILE)), [])
-  assert.ok(fs.existsSync(path.join(dir, workflowFile('apps/a'))) && fs.existsSync(path.join(dir, workflowFile('apps/b'))))
-  assert.match(workflowFile('apps/a'), /^\.github\/workflows\/golden-paths-apps-a-[0-9a-f]{6}\.yml$/)
-  assert.notEqual(workflowFile('apps/a-b'), workflowFile('apps/a/b'))
-  const agents = fs.readFileSync(path.join(dir, 'AGENTS.md'), 'utf8')
-  assert.match(agents, /apps\/a\/GOLDEN_PATHS\.md/)
-  assert.match(agents, /apps\/b\/GOLDEN_PATHS\.md/)
-  const readmeFile = path.join(dir, 'README.md')
-  const readme = fs.readFileSync(readmeFile, 'utf8')
-  for (const app of ['a', 'b']) {
-    assert.ok(readme.includes(`[apps/${app}/GOLDEN_PATHS.md](apps/${app}/GOLDEN_PATHS.md)`))
-    assert.ok(fs.existsSync(path.join(dir, `apps/${app}/GOLDEN_PATHS.md`)))
-    applyPlan(initPlan(path.join(dir, `apps/${app}`, CONTRACT_FILE)).plan, { write: true })
-  }
-  assert.equal(fs.readFileSync(readmeFile, 'utf8'), readme)
-})
-
-test('disabling CI removes the generated workflow on the next init', () => {
-  const dir = tmpRepo({ [CONTRACT_FILE]: JSON.stringify(contract()), ...SPECS })
-  const file = path.join(dir, CONTRACT_FILE)
-  applyPlan(initPlan(file).plan, { write: true })
-  const off = contract({ ci: { enabled: false } })
-  fs.writeFileSync(file, JSON.stringify(off))
-  const results = applyPlan(initPlan(file).plan, { write: true })
-  assert.ok(results.some((r) => r.action === 'delete'))
-  assert.equal(fs.existsSync(path.join(dir, WORKFLOW_FILE)), false)
-  assert.deepEqual(checkDrift(off, file), [])
-})
-
-test('init never deletes a hand-written workflow of the same name', () => {
-  const dir = tmpRepo({ [CONTRACT_FILE]: JSON.stringify(contract({ ci: { enabled: false } })), ...SPECS, [WORKFLOW_FILE]: 'name: mine\n' })
-  applyPlan(initPlan(path.join(dir, CONTRACT_FILE)).plan, { write: true })
-  assert.equal(fs.readFileSync(path.join(dir, WORKFLOW_FILE), 'utf8'), 'name: mine\n')
-})
-
-test('a monorepo app caches on the workspace-root lockfile', () => {
-  const dir = tmpRepo({ 'pnpm-lock.yaml': '', 'apps/web/package.json': JSON.stringify({ scripts: { start: 'next start' } }) })
-  const { plan } = initPlan(path.join(dir, 'apps/web', CONTRACT_FILE))
-  const c = JSON.parse(plan.find((x) => x.file.endsWith(CONTRACT_FILE)).next)
-  assert.equal(c.ci.lockfile, 'pnpm-lock.yaml')
-  c.paths = contract().paths.slice(0, 1)
-  assert.match(renderWorkflow(c, { appRel: 'apps/web' }), /cache-dependency-path: "pnpm-lock\.yaml"$/m)
-})
-
-test('migration keeps unknown top-level fields', () => {
-  const legacy = { profiles: STANDARD_PROFILES, criticalMetadata: { owner: 'payments' }, setup: { boot: 'x' }, paths: [{ id: 'h', surface: 'api', start: 'GET /h', observable: 'ok', profiles: ['pr-local'], evidenceClass: 'local-app' }] }
-  const { contract: c } = migrateLegacy(legacy, { appDir: tmpRepo() })
-  assert.deepEqual(c.criticalMetadata, { owner: 'payments' })
-  assert.equal(c.paths[0].evidenceClass, 'local-app')
-})
-
-test('audit skips the generated workflows', () => {
-  const dir = tmpRepo({ [CONTRACT_FILE]: JSON.stringify(contract()), ...SPECS })
-  applyPlan(initPlan(path.join(dir, CONTRACT_FILE)).plan, { write: true })
-  assert.deepEqual(audit(dir).workflows, [])
-})
-
-async function freePort() {
-  const s = http.createServer()
-  await new Promise((r) => s.listen(0, '127.0.0.1', r))
-  const { port } = s.address()
-  await new Promise((r) => s.close(r))
-  return port
-}
-
-function bootContract(port, boot) {
-  return contract({
-    setup: { boot, baseUrl: `http://127.0.0.1:${port}`, env: { PORT: String(port) }, tenants: ['e2e-synthetic'] },
-    paths: [{ id: 'health', title: 'up', surface: 'api', start: 'GET /api/health', observable: '200', expect: { status: 200 }, profiles: ['pr-local', 'prod-preview'] }],
-  })
-}
-
-const SERVER = "require('node:http').createServer((q, s) => { s.writeHead(q.url === '/api/health' ? 200 : 404); s.end('ok') }).listen(Number(process.env.PORT), '127.0.0.1')"
-
-test('run --boot starts the app, drives it, and stops it', async () => {
-  const port = await freePort()
-  const dir = tmpRepo({ 'server.cjs': SERVER, [CONTRACT_FILE]: JSON.stringify(bootContract(port, 'node server.cjs')) })
-  const file = path.join(dir, CONTRACT_FILE)
-  assert.equal(await runCli(['run', '--contract', file, '--profile', 'pr-local', '--boot', '--timeout', '20'], quiet()), 0)
-  assert.equal(await runCli(['verdict', '--contract', file, '--profile', 'pr-local'], quiet()), 0)
-  const down = await fetch(`http://127.0.0.1:${port}/api/health`).then(() => false, () => true)
-  assert.ok(down, 'the booted app must be stopped after the run')
-})
-
-test('run --boot refuses a deployed profile and reports an app that never came up', async () => {
-  const port = await freePort()
-  const dir = tmpRepo({ [CONTRACT_FILE]: JSON.stringify(bootContract(port, 'exit 3')) })
-  const file = path.join(dir, CONTRACT_FILE)
-  assert.equal(await runCli(['run', '--contract', file, '--profile', 'prod-preview', '--boot'], quiet()), 2)
-  const q = quiet()
-  assert.equal(await runCli(['run', '--contract', file, '--profile', 'pr-local', '--boot', '--timeout', '2'], q), 0)
-  assert.match(q.out.join('\n'), /did not come up/)
-  assert.equal(await runCli(['verdict', '--contract', file, '--profile', 'pr-local'], quiet()), 1)
-})
-
-test('e2e-test surface ids in @covers are not golden-path journeys', () => {
-  const dir = tmpRepo({ 'e2e/cases.spec.ts': '// @golden-path\n// @covers /cases/[id]\n// @covers api:GET /cases\n// @covers case-pool-to-workbench\n' })
-  const { byId, byFile } = scanJourneyTags(path.join(dir, 'e2e'))
-  assert.deepEqual([...byId.keys()], ['case-pool-to-workbench'])
-  assert.deepEqual([...byFile.values()], [['case-pool-to-workbench']])
-})
-
-test('version 3 rejects an api start that is not one request', () => {
-  const c = contract()
-  c.paths[0].start = 'GET ${REMOTE_URL}/graph'
-  assert.match(validateContract(c).errors.join('\n'), /is not one "METHOD \/path" request/)
-})
-
-test('a browser path with its own Playwright config runs in its own invocation', async () => {
-  const dir = tmpRepo({ ...SPECS, 'fake-pw.cjs': fakePlaywright(`
-const files = process.argv.slice(2).filter((a) => a.endsWith('.spec.ts'))
-fs.appendFileSync('calls.txt', process.argv.slice(2).join(' ') + '\\n')
-const ok = { status: 'expected', results: [{ status: 'passed' }] }
-fs.writeFileSync(process.env.PLAYWRIGHT_JSON_OUTPUT_NAME, JSON.stringify({ config: { rootDir: path.resolve('e2e') }, suites: files.map((f) => ({ file: f.replace(/^e2e\\//, ''), specs: [{ tests: [ok] }] })) }))`) })
-  const c = contract()
-  c.setup.browser = { command: 'node fake-pw.cjs' }
-  c.paths = c.paths.filter((p) => p.surface === 'browser')
-  c.paths[1].config = 'playwright.identity.config.ts'
-  assert.deepEqual(validateContract(c).errors, [])
-  const results = await runPaths(c, { profile: 'pr-local', target: 'http://127.0.0.1:9', appDir: dir })
-  assert.deepEqual(results.map((r) => [r.id, r.status]), [['sign-in', 'pass'], ['checkout', 'pass']])
-  const calls = fs.readFileSync(path.join(dir, 'calls.txt'), 'utf8').trim().split('\n')
-  assert.equal(calls.length, 2)
-  assert.ok(calls.some((l) => l.startsWith('--config playwright.identity.config.ts e2e/checkout.spec.ts')))
-})
-
-test('audit names the per-app workflow for a monorepo app', () => {
-  const dir = tmpRepo({
-    'apps/web/smoke.manifest.json': JSON.stringify({ profiles: {}, paths: [] }),
-    '.github/workflows/ci.yml': 'on: [pull_request]\njobs:\n  s:\n    steps:\n      - run: node apps/web/scripts/smoke.mjs verdict\n',
-  })
-  assert.match(audit(dir).findings.find((f) => f.kind === 'workflow').note, /golden-paths-apps-web-[0-9a-f]{6}\.yml/)
-})
-
-// ---- regressions from the re-verification ----
-
-test('a failure in a spec we did not run cannot explain a failing exit', async () => {
-  const dir = tmpRepo({ ...SPECS, 'fake-pw.cjs': fakePlaywright(`
-const ok = { status: 'expected', results: [{ status: 'passed' }] }
-const bad = { status: 'unexpected', results: [{ status: 'failed' }] }
-fs.writeFileSync(process.env.PLAYWRIGHT_JSON_OUTPUT_NAME, JSON.stringify({ config: { rootDir: path.resolve('e2e') }, suites: [
-  { file: 'sign-in.spec.ts', specs: [{ tests: [ok] }] }, { file: 'other.spec.ts', specs: [{ tests: [bad] }] },
-] }))
-process.exitCode = 2`) })
-  const c = contract()
-  c.setup.browser = { command: 'node fake-pw.cjs' }
-  c.paths = c.paths.filter((p) => p.id === 'sign-in')
-  const [r] = await runPaths(c, { profile: 'pr-local', target: 'http://127.0.0.1:9', appDir: dir })
-  assert.equal(r.status, 'cannot-run')
-})
-
-test('the ci command and renderWorkflow refuse an invalid contract', async () => {
-  const c = contract()
-  c.setup.baseUrl = 'http://localhost/$(printf X)/'
-  assert.equal(renderWorkflow(c), null)
-  const dir = tmpRepo({ [CONTRACT_FILE]: JSON.stringify(c) })
-  assert.equal(await runCli(['ci', '--write', '--contract', path.join(dir, CONTRACT_FILE)], quiet()), 1)
-  assert.equal(fs.existsSync(path.join(dir, WORKFLOW_FILE)), false)
-})
-
-test('a deployed verdict refuses unbound results', () => {
-  const pass = [{ id: 'health', status: 'pass' }]
-  assert.match(openResults(pass, { profile: 'prod-preview', deployed: true }).error, /needs results from `run`/)
-  assert.match(openResults({ profile: 'prod-preview', results: pass }, { profile: 'prod-preview', deployed: true }).error, /needs results from `run`/)
-  assert.equal(openResults(pass, { profile: 'pr-local' }).results.length, 1)
-})
-
-test('the database url env cannot reuse an engine-owned name, and bad secrets do not crash validation', () => {
-  const c = contract()
-  c.setup.database = { engine: 'postgres', urlEnv: 'BASE_URL' }
-  assert.match(validateContract(c).errors.join('\n'), /urlEnv: BASE_URL is set by the generated workflow/)
-  const d = contract()
-  d.setup.secrets = { generate: { BAD: 'value' } }
-  assert.match(validateContract(d).errors.join('\n'), /secrets.generate: must be an array/)
-})
-
-test('the classifier reads commands, not job names, and knows smoke npm scripts', () => {
-  assert.equal(classifyWorkflow('.github/workflows/a.yml', 'on: [pull_request]\njobs:\n  s:\n    name: smoke.mjs verdict\n    steps:\n      - run: echo ok\n'), null)
-  assert.deepEqual(classifyWorkflow('.github/workflows/b.yml', 'on: [pull_request]\njobs:\n  s:\n    steps:\n      - run: pnpm test:e2e:smoke\n'), { file: '.github/workflows/b.yml', lane: 'pr', gate: true })
-  assert.equal(classifyWorkflow('.github/workflows/c.yml', 'on: [pull_request]\njobs:\n  s:\n    steps:\n      - run: pnpm smoke:validate\n').gate, false)
-})
-
-test('a validate-only PR job does not count as running pr-local', () => {
-  const dir = tmpRepo({
-    'smoke.manifest.json': JSON.stringify({ profiles: { 'pr-local': STANDARD_PROFILES['pr-local'] }, paths: [] }),
-    '.github/workflows/ci.yml': 'on: [pull_request]\njobs:\n  v:\n    steps:\n      - run: node scripts/smoke.mjs validate\n',
-  })
-  assert.ok(audit(dir).findings.some((f) => f.kind === 'drift'))
-})
-
-test('a hand-written workflow is never reported as stale generated output', () => {
-  const dir = tmpRepo({ [CONTRACT_FILE]: JSON.stringify(contract({ ci: { enabled: false } })), ...SPECS, [WORKFLOW_FILE]: 'name: mine\n' })
-  applyPlan(initPlan(path.join(dir, CONTRACT_FILE)).plan, { write: true })
-  assert.deepEqual(checkDrift(contract({ ci: { enabled: false } }), path.join(dir, CONTRACT_FILE)), [])
-})
-
-test('profiles are bound to safe targets and can forbid credentials', () => {
-  const local = { name: 'pr-local', environment: 'local' }
-  const prod = { name: 'prod-preview', environment: 'prod', forbidEnv: ['E2E_TEST_SECRET'] }
-  assert.equal(targetProblem(local, 'http://127.0.0.1:3000'), null)
-  assert.match(targetProblem(local, 'https://prod.example'), /not a loopback address/)
-  assert.match(targetProblem(prod, 'http://prod.example'), /use https/)
-  assert.equal(targetProblem(prod, 'https://prod.example', {}), null)
-  assert.match(targetProblem(prod, 'https://prod.example', { E2E_TEST_SECRET: 'x' }), /forbids E2E_TEST_SECRET/)
-  assert.match(validateProfile('p', { ...STANDARD_PROFILES['prod-preview'], forbidEnv: ['bad name'] }).join('\n'), /forbidEnv/)
-})
-
-test('run refuses a local profile against a remote target', async () => {
-  const results = await runPaths(contract(), { profile: 'pr-local', target: 'https://prod.example', appDir: os.tmpdir() })
-  assert.ok(results.every((r) => r.status === 'cannot-run' && /loopback/.test(r.note)))
-})
-
-test('a writing request marked as not writing cannot run outside local profiles', () => {
-  const c = contract()
-  c.paths.push({ id: 'order', title: 'order', surface: 'api', request: { method: 'POST', path: '/api/orders' }, observable: '201', mutates: false, profiles: ['pr-local', 'dev-active'] })
-  assert.match(validateContract(c).errors.join('\n'), /POST path marked as not writing runs in dev-active/)
-  c.paths.at(-1).profiles = ['pr-local']
-  assert.deepEqual(validateContract(c).errors, [])
-})
-
-test('run --boot runs setup.seed before booting and stops on a failed seed', async () => {
-  const port = await freePort()
-  const seeded = bootContract(port, 'node server.cjs')
-  seeded.setup.seed = 'node -e "require(\'fs\').writeFileSync(\'seeded.txt\', \'yes\')"'
-  const dir = tmpRepo({ 'server.cjs': SERVER, [CONTRACT_FILE]: JSON.stringify(seeded) })
-  assert.equal(await runCli(['run', '--contract', path.join(dir, CONTRACT_FILE), '--profile', 'pr-local', '--boot', '--timeout', '20'], quiet()), 0)
-  assert.equal(fs.readFileSync(path.join(dir, 'seeded.txt'), 'utf8'), 'yes')
-  const broken = bootContract(port, 'node server.cjs')
-  broken.setup.seed = 'exit 4'
-  const dir2 = tmpRepo({ 'server.cjs': SERVER, [CONTRACT_FILE]: JSON.stringify(broken) })
-  const q = quiet()
-  assert.equal(await runCli(['run', '--contract', path.join(dir2, CONTRACT_FILE), '--profile', 'pr-local', '--boot'], q), 1)
-  assert.match(q.out.join('\n'), /setup.seed failed/)
-})
-
-test('init preview says would, and the verdict prints the report shape', async () => {
-  const dir = tmpRepo({ 'package.json': '{}' })
-  const q = quiet()
-  const cwd = process.cwd()
-  process.chdir(dir)
-  try { assert.equal(await runCli(['init'], q), 0) } finally { process.chdir(cwd) }
-  assert.match(q.out.join('\n'), /would create\s+golden-paths\.json/)
-  assert.match(q.out.join('\n'), /check setup\.boot and setup\.baseUrl/)
-  const d2 = tmpRepo({ [CONTRACT_FILE]: JSON.stringify(contract()), ...SPECS })
-  const results = path.join(d2, 'r.json')
-  fs.writeFileSync(results, JSON.stringify([{ id: 'health', status: 'pass', evidence: 'HTTP 200' }, { id: 'sign-in', status: 'fail', note: 'journey failed' }, { id: 'checkout', status: 'pass' }]))
-  const v = quiet()
-  await runCli(['verdict', '--contract', path.join(d2, CONTRACT_FILE), '--profile', 'pr-local', '--results', results], v)
-  assert.match(v.out[0], /^Golden paths: DEAD {2}\(profile pr-local, target http:\/\/127\.0\.0\.1:3000\)$/)
-  assert.ok(v.out.includes('- fail       sign-in: journey failed'))
-})
-
-test('--paths runs one shard, and the verdict holds to that shard', async () => {
-  const sel = selectPathsForProfile(contract(), 'pr-local', { ids: ['health'] })
-  assert.deepEqual(sel.run.map((p) => p.id), ['health'])
-  assert.throws(() => selectPathsForProfile(contract(), 'pr-local', { ids: ['nope'] }), /unknown path nope/)
-  const dir = tmpRepo({ [CONTRACT_FILE]: JSON.stringify(contract()), ...SPECS })
-  const results = path.join(dir, 'r.json')
-  fs.writeFileSync(results, JSON.stringify(resultsEnvelope([{ id: 'health', status: 'pass' }], { profile: 'pr-local', target: 'http://127.0.0.1:3000', ids: ['health'] })))
-  const out = path.join(dir, 'v.json')
-  assert.equal(await runCli(['verdict', '--contract', path.join(dir, CONTRACT_FILE), '--profile', 'pr-local', '--results', results, '--out', out], quiet()), 0)
-  assert.deepEqual(JSON.parse(fs.readFileSync(out, 'utf8')).paths, ['health'])
-  assert.equal(await runCli(['verdict', '--contract', path.join(dir, CONTRACT_FILE), '--profile', 'pr-local', '--results', results, '--paths', 'sign-in'], quiet()), 1)
-})
-
-test('underscore keys park content that validation never reads', () => {
-  const c = contract()
-  c._pendingPaths = [{ id: 'later', title: 'TODO: decide' }]
-  assert.deepEqual(validateContract(c).errors, [])
-})
-
-test('a cli command with a <placeholder> fails validation', () => {
-  const c = contract({ paths: [{ id: 'w', title: 'w', surface: 'cli', command: 'deploy-check --env <dev|prod>', observable: 'ok', profiles: ['pr-local'] }] })
-  assert.match(validateContract(c).errors.join('\n'), /<placeholder>/)
-})
-
-test('audit tells a ci.enabled false repo to keep its own job', () => {
-  const dir = tmpRepo({
-    [CONTRACT_FILE]: JSON.stringify(contract({ ci: { enabled: false } })),
-    '.github/workflows/smoke.yml': 'on:\n  push:\n    branches: ["mergify/merge-queue/**"]\njobs:\n  s:\n    steps:\n      - run: node scripts/smoke.mjs verdict\n',
-  })
-  assert.match(audit(dir).findings.find((f) => f.kind === 'workflow').note, /keep this job/)
-})
-
-// ---- round 3: review and eval regressions ----
-
-test('forbidEnv cannot be bypassed through setup.env', async () => {
-  const c = contract({ paths: [{ id: 'probe', title: 'probe', surface: 'cli', command: 'echo ok', observable: 'ok', profiles: ['pr-local'] }] })
-  c.profiles = { ...c.profiles, 'pr-local': { ...c.profiles['pr-local'], forbidEnv: ['E2E_TEST_SECRET'] } }
-  c.setup.env = { E2E_TEST_SECRET: 'bypass' }
-  assert.match(validateContract(c).errors.join('\n'), /forbidEnv E2E_TEST_SECRET is set in setup.env/)
-  const [r] = await runPaths(c, { profile: 'pr-local', target: 'http://127.0.0.1:9', appDir: os.tmpdir(), env: {} })
-  assert.equal(r.status, 'cannot-run')
-})
-
-test('setup.env reaches local runs only', async () => {
-  const c = contract({ paths: [{ id: 'env', title: 'env', surface: 'cli', command: 'printf "$LOCAL_ONLY"', observable: 'x', expect: { stdoutIncludes: 'local' }, profiles: ['pr-local', 'dev-active'] }] })
-  c.setup.env = { LOCAL_ONLY: 'local' }
-  const [local] = await runPaths(c, { profile: 'pr-local', target: 'http://127.0.0.1:9', appDir: os.tmpdir(), env: {} })
-  assert.equal(local.status, 'pass')
-  const [dev] = await runPaths(c, { profile: 'dev-active', target: 'https://dev.example', appDir: os.tmpdir(), env: {} })
-  assert.equal(dev.status, 'fail')
-})
-
-test('run --boot refuses an occupied target and notices a boot that died', async () => {
-  const busy = http.createServer((q, s) => { s.writeHead(200); s.end('ok') })
-  await new Promise((r) => busy.listen(0, '127.0.0.1', r))
-  const port = busy.address().port
-  try {
-    const dir = tmpRepo({ [CONTRACT_FILE]: JSON.stringify(bootContract(port, 'exit 3')) })
-    const q = quiet()
-    assert.equal(await runCli(['run', '--contract', path.join(dir, CONTRACT_FILE), '--profile', 'pr-local', '--boot'], q), 1)
-    assert.match(q.out.join('\n'), /already answers/)
-  } finally { busy.close() }
-  const free = await freePort()
-  const dir = tmpRepo({ [CONTRACT_FILE]: JSON.stringify(bootContract(free, 'exit 3')) })
-  const q = quiet()
-  const t0 = Date.now()
-  await runCli(['run', '--contract', path.join(dir, CONTRACT_FILE), '--profile', 'pr-local', '--boot', '--timeout', '30'], q)
-  assert.match(q.out.join('\n'), /boot command ended \(exit 3\)/)
-  assert.ok(Date.now() - t0 < 10_000, 'a dead boot is noticed at once, not after the timeout')
-})
-
-test('stopApp kills a server that ignores SIGTERM', async () => {
-  const port = await freePort()
-  const stubborn = `process.on('SIGTERM', () => {}); require('node:http').createServer((q, s) => s.end('ok')).listen(${port}, '127.0.0.1')`
-  const dir = tmpRepo({ 'stubborn.cjs': stubborn })
-  const child = bootApp({ setup: { boot: 'node stubborn.cjs' } }, dir)
-  assert.equal(await waitFor(`http://127.0.0.1:${port}/`, 10), null)
-  await stopApp(child, 300)
-  assert.equal(await waitFor(`http://127.0.0.1:${port}/`, 1) !== null, true)
-})
-
-test('app directories with YAML-special characters still render valid YAML', () => {
-  const wf = renderWorkflow(contract(), { appRel: 'apps/web: preview' })
-  assert.match(wf, /name: "Golden paths \(apps\/web: preview\)"/)
-  assert.match(wf, /working-directory: "apps\/web: preview"/)
-})
-
-test('audit flags an engine copy whose content differs at the same version', () => {
-  const dir = tmpRepo({ [CONTRACT_FILE]: JSON.stringify(contract()), ...SPECS })
-  applyPlan(initPlan(path.join(dir, CONTRACT_FILE)).plan, { write: true })
-  assert.deepEqual(audit(dir).findings.filter((f) => f.kind === 'engine'), [])
-  const core = path.join(dir, ENGINE_FILE.replace('golden-path.mjs', 'golden-path-core.mjs'))
-  fs.appendFileSync(core, '\n// edited\n')
-  assert.match(audit(dir).findings.find((f) => f.kind === 'engine').note, /differs from this skill's/)
-})
-
-test('echoed command text is not a gate', () => {
-  assert.equal(classifyWorkflow('.github/workflows/ci.yml', 'on: [pull_request]\njobs:\n  s:\n    steps:\n      - run: echo "node smoke.mjs run"\n'), null)
-})
-
-test('a refused-write probe can run in production with a stated reason', () => {
-  const c = contract()
-  c.paths.push({ id: 'dcr-closed', title: 'registration is closed', surface: 'api', request: { method: 'POST', path: '/oauth/register' }, observable: '404', expect: { status: 404 }, mutates: false, profiles: ['prod-preview'] })
-  assert.match(validateContract(c).errors.join('\n'), /explain in "nonWriting"/)
-  c.paths.at(-1).nonWriting = 'the candidate answers 404 before parsing, so nothing is stored'
-  assert.deepEqual(validateContract(c).errors, [])
-})
-
-test('expect checks headers and non-empty JSON values', () => {
-  const p = { expect: { headers: { 'Content-Type': 'text/markdown' }, jsonNonEmpty: ['keys'] } }
-  assert.equal(judgeHttp(p, 200, '{"keys":[1]}', { 'content-type': 'text/markdown; charset=utf-8' }).status, 'pass')
-  assert.match(judgeHttp(p, 200, '{"keys":[]}', { 'content-type': 'text/markdown' }).note, /keys is empty/)
-  assert.match(judgeHttp(p, 200, '{"keys":[1]}', { 'content-type': 'text/html' }).note, /header Content-Type/)
-})