@a5c-ai/kradle 5.0.1-staging.3abdf9534c25

package/tests/hooks-lifecycle.test.js

@@ -0,0 +1,364 @@
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import { createHooksLifecycleEmitter, HOOKS_LIFECYCLE_BOUNDARY } from '../src/hooks-lifecycle.js';
+import { createResource } from '../src/resource-model.js';
+import { createAgentDispatchController } from '../src/agent-dispatch-controller.js';
+
+function makeEventBus() {
+  const events = [];
+  return {
+    emit(event) { events.push(event); },
+    events,
+  };
+}
+
+function makeRun(name, spec = {}, status = {}) {
+  return createResource('AgentDispatchRun',
+    { name, namespace: 'kradle-org-default' },
+    { organizationRef: 'default', repository: 'repo', sourceRefs: [], agentStack: 'stack-a', taskKind: 'diagnostic', ...spec },
+    { phase: 'Pending', queuedAt: new Date().toISOString(), ...status }
+  );
+}
+
+function makeApproval(name, spec = {}, status = {}) {
+  return createResource('AgentApproval',
+    { name, namespace: 'kradle-org-default' },
+    { organizationRef: 'default', dispatchRun: 'run-1', action: 'secret-access', requestedBy: 'user-1', ...spec },
+    { phase: 'Pending', ...status }
+  );
+}
+
+function makeWorkspace(name, spec = {}) {
+  return createResource('KradleWorkspace',
+    { name, namespace: 'kradle-org-default' },
+    { organizationRef: 'default', repository: 'repo', volumeSpec: {}, ...spec },
+    { phase: 'Ready' }
+  );
+}
+
+// ─── Factory tests ─────────────────────────────────────────────────────────
+
+describe('HOOKS_LIFECYCLE_BOUNDARY', () => {
+  it('declares expected role and scope', () => {
+    assert.equal(HOOKS_LIFECYCLE_BOUNDARY.role, 'hooks-lifecycle');
+    assert.ok(HOOKS_LIFECYCLE_BOUNDARY.scope.includes('Lifecycle event emission'));
+  });
+});
+
+describe('createHooksLifecycleEmitter — factory', () => {
+  it('throws when eventBus is null', () => {
+    assert.throws(
+      () => createHooksLifecycleEmitter(null),
+      /requires an eventBus/
+    );
+  });
+
+  it('throws when eventBus has no emit method', () => {
+    assert.throws(
+      () => createHooksLifecycleEmitter({ subscribe: () => {} }),
+      /requires an eventBus/
+    );
+  });
+
+  it('returns object with all 9 emitter methods', () => {
+    const bus = makeEventBus();
+    const emitter = createHooksLifecycleEmitter(bus);
+    const methods = [
+      'emitRunCreated', 'emitRunCompleted', 'emitStepStarted', 'emitStepEnded',
+      'emitApprovalRequested', 'emitApprovalDecided', 'emitWorkspaceProvisioned',
+      'emitSessionStarted', 'emitSessionEnded',
+    ];
+    for (const method of methods) {
+      assert.equal(typeof emitter[method], 'function', `missing method: ${method}`);
+    }
+  });
+});
+
+// ─── emitRunCreated ─────────────────────────────────────────────────────────
+
+describe('createHooksLifecycleEmitter — emitRunCreated', () => {
+  it('emits RUN_CREATED with runId, stack, and timestamp', () => {
+    const bus = makeEventBus();
+    const emitter = createHooksLifecycleEmitter(bus);
+    const run = makeRun('test-run-1');
+    emitter.emitRunCreated(run);
+
+    assert.equal(bus.events.length, 1);
+    const ev = bus.events[0];
+    assert.equal(ev.type, 'hook');
+    assert.equal(ev.event, 'RUN_CREATED');
+    assert.equal(ev.runId, 'test-run-1');
+    assert.equal(ev.stack, 'stack-a');
+    assert.ok(ev.timestamp);
+  });
+});
+
+// ─── emitRunCompleted ───────────────────────────────────────────────────────
+
+describe('createHooksLifecycleEmitter — emitRunCompleted', () => {
+  it('emits RUN_COMPLETED with result and null duration when no queuedAt', () => {
+    const bus = makeEventBus();
+    const emitter = createHooksLifecycleEmitter(bus);
+    const run = createResource('AgentDispatchRun', { name: 'r2' }, { organizationRef: 'default', repository: 'repo', sourceRefs: [], agentStack: 'stack-b', taskKind: 'diagnostic' }, { phase: 'Completed' });
+    emitter.emitRunCompleted(run, { phase: 'Completed' });
+
+    const ev = bus.events[0];
+    assert.equal(ev.event, 'RUN_COMPLETED');
+    assert.equal(ev.result, 'Completed');
+    assert.equal(ev.duration, null);
+  });
+
+  it('emits RUN_COMPLETED with duration computed from run.status.queuedAt', () => {
+    const bus = makeEventBus();
+    const emitter = createHooksLifecycleEmitter(bus);
+    const run = makeRun('r3', {}, { queuedAt: new Date(Date.now() - 5000).toISOString() });
+    emitter.emitRunCompleted(run, { phase: 'Completed' });
+
+    const ev = bus.events[0];
+    assert.ok(ev.duration >= 4000, 'duration should be at least 4000ms');
+    assert.ok(ev.duration < 10000, 'duration should be less than 10000ms');
+  });
+});
+
+// ─── emitStepStarted / emitStepEnded ────────────────────────────────────────
+
+describe('createHooksLifecycleEmitter — emitStepStarted / emitStepEnded', () => {
+  it('emitStepStarted emits STEP_STARTED with runId and step', () => {
+    const bus = makeEventBus();
+    const emitter = createHooksLifecycleEmitter(bus);
+    const run = makeRun('r4');
+    emitter.emitStepStarted(run, 'launch');
+
+    const ev = bus.events[0];
+    assert.equal(ev.event, 'STEP_STARTED');
+    assert.equal(ev.runId, 'r4');
+    assert.equal(ev.step, 'launch');
+    assert.ok(ev.timestamp);
+  });
+
+  it('emitStepEnded emits STEP_ENDED with runId, step, and result', () => {
+    const bus = makeEventBus();
+    const emitter = createHooksLifecycleEmitter(bus);
+    const run = makeRun('r5');
+    emitter.emitStepEnded(run, 'launch', { success: true });
+
+    const ev = bus.events[0];
+    assert.equal(ev.event, 'STEP_ENDED');
+    assert.equal(ev.runId, 'r5');
+    assert.equal(ev.step, 'launch');
+    assert.deepEqual(ev.result, { success: true });
+  });
+});
+
+// ─── emitApprovalRequested / emitApprovalDecided ────────────────────────────
+
+describe('createHooksLifecycleEmitter — emitApprovalRequested / emitApprovalDecided', () => {
+  it('emitApprovalRequested emits APPROVAL_REQUESTED with approvalId, action, requestedBy', () => {
+    const bus = makeEventBus();
+    const emitter = createHooksLifecycleEmitter(bus);
+    const approval = makeApproval('appr-1');
+    emitter.emitApprovalRequested(approval);
+
+    const ev = bus.events[0];
+    assert.equal(ev.event, 'APPROVAL_REQUESTED');
+    assert.equal(ev.approvalId, 'appr-1');
+    assert.equal(ev.action, 'secret-access');
+    assert.equal(ev.requestedBy, 'user-1');
+  });
+
+  it('emitApprovalDecided emits APPROVAL_DECIDED with decision', () => {
+    const bus = makeEventBus();
+    const emitter = createHooksLifecycleEmitter(bus);
+    const approval = makeApproval('appr-2', {}, { decision: 'approved' });
+    emitter.emitApprovalDecided(approval);
+
+    const ev = bus.events[0];
+    assert.equal(ev.event, 'APPROVAL_DECIDED');
+    assert.equal(ev.approvalId, 'appr-2');
+    assert.equal(ev.decision, 'approved');
+  });
+});
+
+// ─── emitWorkspaceProvisioned ────────────────────────────────────────────────
+
+describe('createHooksLifecycleEmitter — emitWorkspaceProvisioned', () => {
+  it('emits WORKSPACE_PROVISIONED with workspaceId and repository', () => {
+    const bus = makeEventBus();
+    const emitter = createHooksLifecycleEmitter(bus);
+    const workspace = makeWorkspace('ws-1', { repository: 'my-repo' });
+    emitter.emitWorkspaceProvisioned(workspace);
+
+    const ev = bus.events[0];
+    assert.equal(ev.event, 'WORKSPACE_PROVISIONED');
+    assert.equal(ev.workspaceId, 'ws-1');
+    assert.equal(ev.repository, 'my-repo');
+  });
+});
+
+// ─── emitSessionStarted / emitSessionEnded ───────────────────────────────────
+
+describe('createHooksLifecycleEmitter — emitSessionStarted / emitSessionEnded', () => {
+  it('emitSessionStarted emits SESSION_STARTED with sessionId and runId', () => {
+    const bus = makeEventBus();
+    const emitter = createHooksLifecycleEmitter(bus);
+    emitter.emitSessionStarted({ sessionId: 'sess-abc', runId: 'run-xyz' });
+
+    const ev = bus.events[0];
+    assert.equal(ev.event, 'SESSION_STARTED');
+    assert.equal(ev.sessionId, 'sess-abc');
+    assert.equal(ev.runId, 'run-xyz');
+  });
+
+  it('emitSessionEnded emits SESSION_ENDED with sessionId and runId', () => {
+    const bus = makeEventBus();
+    const emitter = createHooksLifecycleEmitter(bus);
+    emitter.emitSessionEnded({ sessionId: 'sess-abc', runId: 'run-xyz' });
+
+    const ev = bus.events[0];
+    assert.equal(ev.event, 'SESSION_ENDED');
+    assert.equal(ev.sessionId, 'sess-abc');
+    assert.equal(ev.runId, 'run-xyz');
+  });
+});
+
+// ─── Wiring in agent-dispatch-controller ────────────────────────────────────
+
+describe('agent-dispatch-controller — lifecycleEmitter wiring', () => {
+  function buildValidResources(stackName) {
+    const stack = createResource('AgentStack', { name: stackName, namespace: 'kradle-org-default' }, {
+      organizationRef: 'default',
+      baseAgent: 'claude-code',
+      adapter: 'claude-code',
+      runtimeIdentity: { serviceAccountRef: 'sa-default' },
+    });
+    const sa = createResource('AgentServiceAccount', { name: 'sa-default', namespace: 'kradle-org-default' }, {
+      organizationRef: 'default', namespace: 'kradle-org-default', serviceAccountName: 'sa-default',
+    });
+    const rb = createResource('AgentRoleBinding', { name: 'rb-1', namespace: 'kradle-org-default' }, {
+      organizationRef: 'default', subject: 'sa-default', roleRef: 'agent-developer', scope: 'namespace',
+    });
+    const sg = createResource('AgentSecretGrant', { name: 'sg-1', namespace: 'kradle-org-default' }, {
+      organizationRef: 'default', subject: 'sa-default', secretRef: 'secret-model-provider', purpose: 'model-provider',
+    });
+    return { AgentStack: [stack], AgentServiceAccount: [sa], AgentRoleBinding: [rb], AgentSecretGrant: [sg] };
+  }
+
+  it('emits RUN_CREATED via lifecycleEmitter during createManualDispatch', async () => {
+    const bus = makeEventBus();
+    const emittedEvents = [];
+    const mockLifecycleEmitter = {
+      emitRunCreated(run) { emittedEvents.push({ event: 'RUN_CREATED', runId: run.metadata?.name }); },
+      emitRunCompleted() {},
+      emitStepStarted() {},
+      emitStepEnded() {},
+      emitApprovalRequested() {},
+      emitApprovalDecided() {},
+      emitWorkspaceProvisioned() {},
+      emitSessionStarted() {},
+      emitSessionEnded() {},
+    };
+
+    // Mock mux client that returns no resource gateway (no job submission)
+    const mockMuxClient = {
+      isAvailable() { return false; },
+      createAgentJob() { throw new Error('no resource gateway'); },
+      submitAgentJob() { throw new Error('no resource gateway'); },
+    };
+
+    const controller = createAgentDispatchController({
+      lifecycleEmitter: mockLifecycleEmitter,
+      agentMuxClient: mockMuxClient,
+    });
+
+    const resources = buildValidResources('stack-lc');
+    const result = await controller.createManualDispatch({
+      repository: 'test-repo',
+      ref: 'main',
+      agentStack: 'stack-lc',
+      actor: 'test-user',
+      namespace: 'kradle-org-default',
+      organizationRef: 'default',
+      resources,
+    });
+
+    assert.equal(result.error, false);
+    const created = emittedEvents.find(e => e.event === 'RUN_CREATED');
+    assert.ok(created, 'RUN_CREATED should have been emitted');
+    assert.ok(created.runId, 'RUN_CREATED should include runId');
+  });
+
+  it('emits WORKSPACE_PROVISIONED when workspace is created during createManualDispatch', async () => {
+    const emittedEvents = [];
+    const mockLifecycleEmitter = {
+      emitRunCreated() {},
+      emitRunCompleted() {},
+      emitStepStarted() {},
+      emitStepEnded() {},
+      emitApprovalRequested() {},
+      emitApprovalDecided() {},
+      emitWorkspaceProvisioned(ws) { emittedEvents.push({ event: 'WORKSPACE_PROVISIONED', workspaceId: ws.metadata?.name }); },
+      emitSessionStarted() {},
+      emitSessionEnded() {},
+    };
+
+    const mockMuxClient = {
+      isAvailable() { return false; },
+      createAgentJob() { throw new Error('no resource gateway'); },
+      submitAgentJob() { throw new Error('no resource gateway'); },
+    };
+
+    const controller = createAgentDispatchController({
+      lifecycleEmitter: mockLifecycleEmitter,
+      agentMuxClient: mockMuxClient,
+    });
+
+    const resources = buildValidResources('stack-ws');
+    const result = await controller.createManualDispatch({
+      repository: 'test-repo',
+      ref: 'main',
+      agentStack: 'stack-ws',
+      actor: 'test-user',
+      namespace: 'kradle-org-default',
+      organizationRef: 'default',
+      resources,
+    });
+
+    assert.equal(result.error, false);
+    const wsEvent = emittedEvents.find(e => e.event === 'WORKSPACE_PROVISIONED');
+    assert.ok(wsEvent, 'WORKSPACE_PROVISIONED should have been emitted');
+  });
+
+  it('emits RUN_COMPLETED via lifecycleEmitter when persistSessionEvent receives completion event', () => {
+    const emittedEvents = [];
+    const mockLifecycleEmitter = {
+      emitRunCreated() {},
+      emitRunCompleted(run, result) { emittedEvents.push({ event: 'RUN_COMPLETED', result: result.phase }); },
+      emitStepStarted() {},
+      emitStepEnded() {},
+      emitApprovalRequested() {},
+      emitApprovalDecided() {},
+      emitWorkspaceProvisioned() {},
+      emitSessionStarted() {},
+      emitSessionEnded(session) { emittedEvents.push({ event: 'SESSION_ENDED', sessionId: session.sessionId }); },
+    };
+
+    const controller = createAgentDispatchController({ lifecycleEmitter: mockLifecycleEmitter });
+    const run = makeRun('run-persist');
+    const attempt = createResource('AgentDispatchAttempt', { name: 'attempt-1' }, {
+      organizationRef: 'default', agentDispatchRun: 'run-persist', attemptReason: 'initial',
+      agentStackSnapshot: {},
+    }, { agentMuxSessionId: 'sess-xyz', agentMuxRunId: 'amux-run-1' });
+
+    controller.persistSessionEvent(
+      { type: 'completion', role: 'system', content: 'done' },
+      run, attempt, { namespace: 'default', organizationRef: 'default' }
+    );
+
+    const completed = emittedEvents.find(e => e.event === 'RUN_COMPLETED');
+    assert.ok(completed, 'RUN_COMPLETED should have been emitted');
+    assert.equal(completed.result, 'Completed');
+
+    const ended = emittedEvents.find(e => e.event === 'SESSION_ENDED');
+    assert.ok(ended, 'SESSION_ENDED should have been emitted on completion');
+  });
+});

package/tests/integration/full-flow.test.js

@@ -0,0 +1,266 @@
+/**
+ * Core Integration Tests — End-to-end data flow tests using mock kubectl gateway
+ *
+ * Tests the full data flow through the Kradle API controller using a mock
+ * resource gateway that stores resources in a Map instead of kubectl.
+ */
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  createKradleApiController,
+  createResource,
+  createAuditController,
+  createAgentSecretGrantController,
+  createAgentMemoryController,
+  listGrantsForAgent,
+} from '../../src/index.js';
+
+// ---------------------------------------------------------------------------
+// Mock resource gateway — stores resources in a Map instead of kubectl
+// ---------------------------------------------------------------------------
+
+function createMockGateway() {
+  const store = new Map();
+  return {
+    namespace: 'kradle-org-test',
+    async apply(resource) {
+      store.set(`${resource.kind}/${resource.metadata.name}`, resource);
+      return { operation: 'apply', resource };
+    },
+    async list(kind) {
+      return { items: [...store.values()].filter((r) => r.kind === kind) };
+    },
+    async get(kind, name) {
+      return { resource: store.get(`${kind}/${name}`) || null };
+    },
+    async delete(kind, name) {
+      store.delete(`${kind}/${name}`);
+      return { operation: 'delete' };
+    },
+    async snapshot() {
+      return { namespace: 'kradle-org-test', resources: {} };
+    },
+    watch() {
+      return { close: () => {} };
+    },
+    resourceDefinitions: [],
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Test 1: Org/user/repo flow
+// ---------------------------------------------------------------------------
+
+test('full flow: create org → user → repository → list shows repo', async () => {
+  const gw = createMockGateway();
+  const controller = createKradleApiController({ resourceGateway: gw });
+
+  // Create org
+  const org = createResource('Organization', { name: 'test-org', namespace: 'kradle-system' }, { displayName: 'Test Org', namespaceName: 'kradle-org-test-org' });
+  await controller.applyResource(org);
+
+  // Create user
+  const user = createResource('User', { name: 'alice', namespace: 'kradle-org-test-org' }, { organizationRef: 'test-org', displayName: 'Alice', email: 'alice@example.com' });
+  await controller.applyResource(user);
+
+  // Create repository
+  const repo = createResource('Repository', { name: 'my-repo', namespace: 'kradle-org-test-org' }, { organizationRef: 'test-org', visibility: 'internal' });
+  await controller.applyResource(repo);
+
+  // List repositories — should include the new repo
+  const result = await controller.listResource('Repository');
+  assert.ok(Array.isArray(result.items), 'result.items must be an array');
+  const found = result.items.find((r) => r.metadata?.name === 'my-repo');
+  assert.ok(found, 'my-repo should appear in listResource(Repository)');
+  assert.equal(found.spec?.organizationRef, 'test-org');
+});
+
+// ---------------------------------------------------------------------------
+// Test 2: Agent stack + trigger rule flow
+// ---------------------------------------------------------------------------
+
+test('full flow: create agent stack → create trigger rule → both appear in list', async () => {
+  const gw = createMockGateway();
+  const controller = createKradleApiController({ resourceGateway: gw });
+
+  // Create agent stack
+  const stack = createResource(
+    'AgentStack',
+    { name: 'review-bot', namespace: 'kradle-org-myorg' },
+    { organizationRef: 'myorg', baseAgent: 'claude-code', adapter: 'default', runtimeIdentity: 'workspace' }
+  );
+  await controller.applyResource(stack);
+
+  // Create trigger rule
+  const rule = createResource(
+    'AgentTriggerRule',
+    { name: 'pr-trigger', namespace: 'kradle-org-myorg' },
+    { organizationRef: 'myorg', sources: [{ type: 'pull_request', events: ['opened'] }], agentStack: 'review-bot', taskKind: 'code-review' }
+  );
+  await controller.applyResource(rule);
+
+  // Verify both appear
+  const stackList = await controller.listResource('AgentStack');
+  assert.ok(stackList.items.some((s) => s.metadata?.name === 'review-bot'), 'review-bot stack should appear');
+
+  const ruleList = await controller.listResource('AgentTriggerRule');
+  assert.ok(ruleList.items.some((r) => r.metadata?.name === 'pr-trigger'), 'pr-trigger rule should appear');
+});
+
+// ---------------------------------------------------------------------------
+// Test 3: Workspace flow
+// ---------------------------------------------------------------------------
+
+test('full flow: create workspace → verify it appears in list', async () => {
+  const gw = createMockGateway();
+  const controller = createKradleApiController({ resourceGateway: gw });
+
+  // Create workspace
+  const workspace = createResource(
+    'KradleWorkspace',
+    { name: 'dev-workspace', namespace: 'kradle-org-myorg' },
+    { organizationRef: 'myorg', repository: 'my-repo', volumeSpec: { storageClass: 'standard', size: '10Gi' } }
+  );
+  await controller.applyResource(workspace);
+
+  // List workspaces — should include the new one
+  const result = await controller.listResource('KradleWorkspace');
+  assert.ok(Array.isArray(result.items));
+  const found = result.items.find((r) => r.metadata?.name === 'dev-workspace');
+  assert.ok(found, 'dev-workspace should appear in listResource(KradleWorkspace)');
+  assert.equal(found.spec?.repository, 'my-repo');
+});
+
+// ---------------------------------------------------------------------------
+// Test 4: Secret grant flow
+// ---------------------------------------------------------------------------
+
+test('full flow: create secret grant → listGrantsForAgent returns it', async () => {
+  const gw = createMockGateway();
+  const ctrl = createAgentSecretGrantController();
+
+  // Create a secret grant
+  const result = ctrl.createSecretGrant({
+    name: 'db-pass-grant',
+    orgRef: 'myorg',
+    secretName: 'db-password',
+    grantedTo: 'review-bot',
+    permissions: ['read'],
+    namespace: 'kradle-org-myorg',
+  });
+
+  assert.ok(result.grant, 'createSecretGrant must return a grant');
+  assert.equal(result.grant.kind, 'AgentSecretGrant');
+  assert.equal(result.grant.metadata.name, 'db-pass-grant');
+  assert.equal(result.grant.spec.grantedTo, 'review-bot');
+
+  // Apply the grant resource via mock gateway
+  await gw.apply(result.grant);
+
+  // List grants and filter for this agent
+  const list = await gw.list('AgentSecretGrant');
+  const agentGrants = listGrantsForAgent(list.items, 'review-bot');
+  assert.ok(agentGrants.length >= 1, 'listGrantsForAgent should return at least 1 grant for review-bot');
+  assert.equal(agentGrants[0].metadata.name, 'db-pass-grant');
+});
+
+// ---------------------------------------------------------------------------
+// Test 5: External flow — syncExternalBinding
+// ---------------------------------------------------------------------------
+
+test('full flow: syncExternalBinding creates resource with external envelope', async () => {
+  const gw = createMockGateway();
+  const controller = createKradleApiController({ resourceGateway: gw });
+
+  const result = await controller.syncExternalBinding('github-binding', {
+    kind: 'Repository',
+    localName: 'synced-repo',
+    namespace: 'default',
+    spec: { organizationRef: 'default', visibility: 'private' },
+    externalEnvelope: {
+      nativeId: 'gh-repo-42',
+      url: 'https://github.com/org/synced-repo',
+      etag: '"abc123"',
+      providerRef: 'github-provider',
+    },
+  });
+
+  assert.ok(result, 'syncExternalBinding must return a result');
+  assert.ok(result.resource, 'result must include the upserted resource');
+  assert.equal(
+    result.resource.status?.external?.nativeId || result.resource?.status?.external?.nativeId,
+    'gh-repo-42',
+    'upserted resource must have correct nativeId'
+  );
+});
+
+// ---------------------------------------------------------------------------
+// Test 6: Memory flow — create repository source → verify in list
+// ---------------------------------------------------------------------------
+
+test('full flow: create memory repository → apply → appears in list', async () => {
+  const gw = createMockGateway();
+  const controller = createKradleApiController({ resourceGateway: gw });
+
+  // Create a memory repository resource
+  const memRepo = createResource(
+    'AgentMemoryRepository',
+    { name: 'org-brain', namespace: 'kradle-org-myorg' },
+    { organizationRef: 'myorg', repositoryRef: 'memory-repo', defaultBranch: 'main', layoutProfile: 'standard' }
+  );
+  await controller.applyResource(memRepo);
+
+  // Create a memory source
+  const memSource = createResource(
+    'AgentMemorySource',
+    { name: 'codebase-source', namespace: 'kradle-org-myorg' },
+    {
+      organizationRef: 'myorg',
+      repositoryRef: 'org-brain',
+      appliesTo: { stacks: ['review-bot'] },
+      include: ['decisions/', 'patterns/'],
+    }
+  );
+  await controller.applyResource(memSource);
+
+  // Verify both appear in their lists
+  const repoList = await controller.listResource('AgentMemoryRepository');
+  assert.ok(repoList.items.some((r) => r.metadata?.name === 'org-brain'), 'org-brain memory repo should appear');
+
+  const sourceList = await controller.listResource('AgentMemorySource');
+  assert.ok(sourceList.items.some((s) => s.metadata?.name === 'codebase-source'), 'codebase-source should appear');
+});
+
+// ---------------------------------------------------------------------------
+// Test 7: Audit flow — apply resource → audit log contains event
+// ---------------------------------------------------------------------------
+
+test('full flow: apply resource with onAuditEvent → audit log contains the event', async () => {
+  const gw = createMockGateway();
+  const audit = createAuditController();
+
+  const controller = createKradleApiController({
+    resourceGateway: gw,
+    onAuditEvent: (evt) => audit.log({
+      org: evt.org || 'audited',
+      actor: 'system',
+      action: evt.operation || 'apply',
+      resource: { kind: evt.kind, name: evt.name },
+      timestamp: evt.timestamp,
+    }),
+  });
+
+  // Apply a resource
+  const repo = createResource(
+    'Repository',
+    { name: 'audited-repo', namespace: 'kradle-org-audited' },
+    { organizationRef: 'audited', visibility: 'private' }
+  );
+  await controller.applyResource(repo);
+
+  // Verify audit log contains the event
+  const { events, total } = audit.query({ org: 'audited' });
+  assert.ok(total >= 1, 'audit log must contain at least 1 event after apply');
+  assert.equal(events[0].action, 'apply', 'audit event action must be "apply"');
+  assert.equal(events[0].org, 'audited', 'audit event org must match');
+});