@a5c-ai/krate 5.0.1-staging.660d2b90f → 5.0.1-staging.69cb593ea

package/tests/krate.test.js

@@ -1,6 +1,6 @@
 import assert from 'node:assert/strict';
 import test from 'node:test';
-import { ControlPlane, GiteaGitService, GiteaRepositoryStore, RunnerScheduler, WebhookBus, createAdmissionPolicy, createAuthProviderConfig, buildAuthorizationRedirect, exchangeOAuthCodeForProfile, profileFromDelegatedHeaders, registerLoginProfile, createSessionCookie, parseSessionCookie, createInviteResource, createTeamResource, identityBackendSyncPlan, mapLoginProfileToKrateIdentity, createKrateApiController, createControllerUiModel, createKrateComponentCatalog, createKrateHandoffSummary, createKrateLifecycleSnapshot, createKrateMvpDemo, createPolicyRolloutModel, createResource, createKrateKubernetesReconciler, identityAccessReconciliationPlan, createKubernetesResourceClient, createKubernetesResourceGateway, createGiteaBackend, createGiteaRepositoryHosting, createKrateGitOpsPlan, listResourceDefinitions, mapOidcIdentity, resourceSchemaForKind, resourceToYaml, runSmokeAssertions } from '../src/index.js';
+import { ControlPlane, GiteaGitService, GiteaRepositoryStore, RunnerScheduler, WebhookBus, createAdmissionPolicy, createAuthProviderConfig, buildAuthorizationRedirect, exchangeOAuthCodeForProfile, profileFromDelegatedHeaders, registerLoginProfile, createSessionCookie, parseSessionCookie, createInviteResource, createTeamResource, identityBackendSyncPlan, mapLoginProfileToKrateIdentity, createKrateApiController, createControllerUiModel, createKrateComponentCatalog, createKrateHandoffSummary, createKrateLifecycleSnapshot, createKrateMvpDemo, createPolicyRolloutModel, createResource, createKrateKubernetesReconciler, identityAccessReconciliationPlan, createKubernetesResourceClient, createKubernetesResourceGateway, createGiteaBackend, createGiteaRepositoryHosting, giteaIssueSyncPlan, githubProjectIssueSyncPlan, issueProjectRefs, issueRepositoryRefs, orgMemoryRepositoryName, createKrateGitOpsPlan, listResourceDefinitions, mapOidcIdentity, resourceSchemaForKind, resourceToYaml, runSmokeAssertions } from '../src/index.js';
 
 const platform = mapOidcIdentity({ subject: 'platform', email: 'platform@example.com', groups: ['krate:platform-engineers'] });
 const developer = mapOidcIdentity({ subject: 'dev', email: 'dev@example.com', groups: ['krate:developers'] });
@@ -61,12 +61,15 @@ test('Gitea repository hosting plan includes Argo CD deploy key and webhook inte
   assert.match(hosting.httpUrl, /platform-config\.git$/);
   assert.ok(hosting.integrationPlan.operations.some((step) => step.action === 'addDeployKey' && step.title === 'krate-argocd'));
   assert.ok(hosting.integrationPlan.operations.some((step) => step.action === 'createWebhook'));
+  assert.equal(hosting.forgeRecords.issues, 'Gitea /repos/krate/_krate-system_/issues');
+  assert.equal(hosting.issueSync.repo, '_krate-system_');
+  assert.ok(hosting.issueSync.actions.some((step) => step.action === 'ensureOrgMemoryRepository'));
 });
 test('resource catalog exposes all ontology kinds and storage boundaries', () => {
   const definitions = listResourceDefinitions();
-  assert.equal(definitions.length, 57);
-  assert.deepEqual(definitions.filter((definition) => definition.storage === 'etcd').map((definition) => definition.kind), ['Organization', 'OrgNamespaceBinding', 'User', 'Team', 'Invite', 'IdentityMapping', 'AuthProvider', 'Repository', 'SSHKey', 'RepositoryPermission', 'WebhookSubscription', 'RefPolicy', 'BranchProtection', 'PolicyProfile', 'PolicyTemplate', 'PolicyBinding', 'PolicyExceptionRequest', 'View', 'Selector', 'RunnerPool', 'AgentStack', 'AgentSubagent', 'AgentToolProfile', 'AgentMcpServer', 'AgentSkill', 'AgentTriggerRule', 'AgentContextLabel', 'AgentWorkspacePolicy', 'AgentServiceAccount', 'AgentRoleBinding', 'AgentSecretGrant', 'AgentConfigGrant', 'AgentAdapter', 'AgentTransportBinding', 'AgentProviderConfig', 'AgentProject', 'AgentGatewayConfig']);
-  assert.deepEqual(definitions.filter((definition) => definition.storage === 'postgres').map((definition) => definition.kind), ['PullRequest', 'Issue', 'Review', 'Pipeline', 'Job', 'WebhookDelivery', 'AgentDispatchRun', 'AgentDispatchAttempt', 'AgentSession', 'AgentContextBundle', 'AgentArtifact', 'AgentApproval', 'AgentWorkspace', 'AgentTriggerExecution', 'AgentCapabilityRequirement', 'WorkItemSessionLink', 'WorkItemWorkspaceLink', 'AgentSessionTranscript', 'AgentSessionAttachment', 'AgentWorkspaceRuntime']);
+  assert.equal(definitions.length, 75);
+  assert.deepEqual(definitions.filter((definition) => definition.storage === 'etcd').map((definition) => definition.kind), ['Organization', 'OrgNamespaceBinding', 'User', 'Team', 'Invite', 'IdentityMapping', 'AuthProvider', 'Repository', 'SSHKey', 'RepositoryPermission', 'WebhookSubscription', 'RefPolicy', 'BranchProtection', 'PolicyProfile', 'PolicyTemplate', 'PolicyBinding', 'PolicyExceptionRequest', 'View', 'Selector', 'RunnerPool', 'AgentStack', 'AgentSubagent', 'AgentToolProfile', 'AgentMcpServer', 'AgentSkill', 'AgentTriggerRule', 'AgentContextLabel', 'KrateWorkspacePolicy', 'AgentServiceAccount', 'AgentRoleBinding', 'AgentSecretGrant', 'AgentConfigGrant', 'KrateWorkspace', 'AgentAdapter', 'AgentTransportBinding', 'AgentProviderConfig', 'KrateProject', 'AgentGatewayConfig', 'AgentMemoryRepository', 'AgentMemorySource', 'AgentMemoryOntology', 'AgentMemoryAssociation', 'ExternalBackendProvider', 'ExternalBackendBinding', 'ExternalBackendSyncPolicy', 'ExternalProviderCapabilityManifest']);
+  assert.deepEqual(definitions.filter((definition) => definition.storage === 'postgres').map((definition) => definition.kind), ['PullRequest', 'Issue', 'Review', 'Pipeline', 'Job', 'WebhookDelivery', 'AgentDispatchRun', 'AgentDispatchAttempt', 'AgentSession', 'AgentContextBundle', 'KrateArtifact', 'AgentApproval', 'AgentTriggerExecution', 'AgentCapabilityRequirement', 'WorkItemSessionLink', 'WorkItemWorkspaceLink', 'AgentSessionTranscript', 'AgentSessionAttachment', 'KrateWorkspaceRuntime', 'AgentMemorySnapshot', 'AgentMemoryQuery', 'AgentMemoryUpdate', 'AgentRunMemoryImport', 'ExternalWebhookDelivery', 'ExternalSyncEvent', 'ExternalSyncState', 'ExternalWriteIntent', 'ExternalSyncConflict', 'ExternalObjectLink']);
   assert.equal(resourceSchemaForKind('Organization').plural, 'organizations');
   assert.equal(resourceSchemaForKind('User').plural, 'users');
   assert.equal(resourceSchemaForKind('Team').plural, 'teams');
@@ -75,13 +78,39 @@ test('resource catalog exposes all ontology kinds and storage boundaries', () =>
   assert.equal(resourceSchemaForKind('AuthProvider').plural, 'authproviders');
   assert.equal(resourceSchemaForKind('SSHKey').plural, 'sshkeys');
   assert.equal(resourceSchemaForKind('RepositoryPermission').plural, 'repositorypermissions');
+  assert.equal(resourceSchemaForKind('KrateProject').plural, 'krateprojects');
   const schema = resourceSchemaForKind('PullRequest');
   assert.deepEqual(schema.required.spec, ['organizationRef', 'repository', 'title']);
   assert.match(resourceToYaml(createResource('Repository', { name: 'yaml-demo' }, { organizationRef: 'default', visibility: 'private' })), /kind: Repository/);
   assert.match(resourceToYaml(createResource('SSHKey', { name: 'alice-key' }, { organizationRef: 'default', scope: 'user', key: 'ssh-ed25519 AAAA' })), /kind: SSHKey/);
+  assert.match(resourceToYaml(createResource('KrateProject', { name: 'triage' }, { organizationRef: 'default', displayName: 'Triage', repositories: ['app'] })), /kind: KrateProject/);
   assert.match(resourceToYaml({ apiVersion: 'core.oam.dev/v1beta1', kind: 'Application', spec: { components: [{ name: 'web', properties: { image: 'krate/mvp-model:0.1.0' }, traits: [{ type: 'scaler', properties: { replicas: 1 } }] }] } }), /components:\n    - name: web\n      properties:\n        image: krate\/mvp-model:0.1.0\n      traits:\n        - type: scaler/);
 });
 
+
+
+test('issue project and repository associations are normalized for scoped views', () => {
+  const issue = createResource('Issue', { name: 'bug-1', annotations: { 'krate.a5c.ai/repositories': 'app, docs', 'krate.a5c.ai/projects': 'planning' } }, {
+    organizationRef: 'default',
+    title: 'Bug',
+    repositoryRefs: [{ name: 'api' }, { repository: 'ui' }],
+    repositories: ['worker'],
+    projectRef: { name: 'release' },
+    projects: ['roadmap']
+  });
+  assert.deepEqual(issueRepositoryRefs(issue).sort(), ['api', 'app', 'docs', 'ui', 'worker']);
+  assert.deepEqual(issueProjectRefs(issue).sort(), ['planning', 'release', 'roadmap']);
+
+  const gitea = giteaIssueSyncPlan({ org: 'default', project: 'release', issue, repositories: issueRepositoryRefs(issue) });
+  assert.equal(orgMemoryRepositoryName('default'), '_default_');
+  assert.equal(gitea.repo, '_default_');
+  assert.deepEqual(gitea.metadataKeys, ['krate.a5c.ai/project', 'krate.a5c.ai/repositories']);
+  assert.ok(gitea.actions.some((step) => step.action === 'writeIssueRepositoryMetadata'));
+
+  const github = githubProjectIssueSyncPlan({ org: 'default', project: 'release', issue, repositories: issueRepositoryRefs(issue) });
+  assert.equal(github.project, 'release');
+  assert.ok(github.actions.includes('syncProjectItem'));
+});
 
 
 test('Krate auth resources map sign-in, teams, invites, and repository identities', () => {
@@ -212,7 +241,7 @@ test('OAuth callback route completes fake SSO exchange and registers Krate ident
     const response = await handler(new Request('https://krate.example.test/api/auth/callback/sso?code=fake-code&state=state'), { params: { provider: 'sso' } });
 
     assert.equal(response.status, 302);
-    assert.equal(response.headers.get('location'), '/people');
+    assert.equal(response.headers.get('location'), '/orgs/default/people');
     assert.equal(response.headers.get('x-krate-user'), 'route-alice');
     assert.match(response.headers.get('set-cookie'), /krate_session=/);
     assert.deepEqual(fetchCalls.map((call) => call.url), ['https://idp.example.test/token', 'https://idp.example.test/userinfo']);
@@ -290,7 +319,7 @@ test('Delegated identity route redirects localhost fallback even when Kubernetes
     const response = await GET(new Request('http://localhost:3000/api/auth/delegated?user=Route%20Alice&email=route@example.test&groups=krate:developers'));
 
     assert.equal(response.status, 302);
-    assert.equal(response.headers.get('location'), '/people');
+    assert.equal(response.headers.get('location'), '/orgs/default/people');
     assert.equal(response.headers.get('x-krate-user'), 'route-alice');
     assert.match(response.headers.get('set-cookie'), /krate_session=/);
   } finally {
@@ -300,6 +329,29 @@ test('Delegated identity route redirects localhost fallback even when Kubernetes
   }
 });
 
+
+
+test('controller UI model keeps namespace-scoped resources visible for their org', () => {
+  const model = createControllerUiModel({
+    source: 'kubernetes',
+    namespace: 'krate-system',
+    generatedAt: 'test-time',
+    kubectl: { available: true, context: 'kind-krate', errors: [] },
+    crds: [],
+    resources: {
+      Organization: [{ apiVersion: 'krate.a5c.ai/v1alpha1', kind: 'Organization', metadata: { name: 'default', namespace: 'krate-system' }, spec: { slug: 'default', namespaceName: 'krate-org-default' } }],
+      RunnerPool: [{ apiVersion: 'krate.a5c.ai/v1alpha1', kind: 'RunnerPool', metadata: { name: 'default', namespace: 'krate-org-default' }, spec: { image: 'ubuntu:24.04' } }]
+    },
+    events: [],
+    permissions: [],
+    storage: {},
+    commands: []
+  }, { organization: 'default' });
+
+  assert.equal(model.metrics.runnerPools, 1);
+  assert.deepEqual(model.resources.find((resource) => resource.kind === 'RunnerPool').names, ['default']);
+});
+
 test('Krate delivery resources surface through controller UI model', () => {
   const model = createControllerUiModel({
     source: 'kubernetes',

package/tests/memory-search-wiring.test.js

@@ -0,0 +1,270 @@
+/**
+ * Tests for C3: Wire memory search to the real query engine
+ *
+ * Verifies that:
+ *  - queryAgentMemory delegates to queryMemory from agent-memory-query.js
+ *  - searchGraph delegates to queryGraph from agent-memory-query.js
+ *  - searchGrep delegates to queryGrep from agent-memory-query.js
+ *
+ * These tests verify wiring — they exercise real data flows, not just interface shape.
+ */
+
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { createAgentMemoryController } from '../src/agent-memory-controller.js';
+
+// ---------------------------------------------------------------------------
+// Fixtures
+// ---------------------------------------------------------------------------
+
+function makeRecords() {
+  return [
+    {
+      id: 'service/auth-api',
+      nodeKind: 'Service',
+      attributes: { name: 'auth-api', language: 'typescript', team: 'platform' },
+      edges: [
+        { target: 'service/user-db', kind: 'depends-on' },
+        { target: 'team/platform', kind: 'owned-by' },
+      ],
+    },
+    {
+      id: 'service/user-db',
+      nodeKind: 'Service',
+      attributes: { name: 'user-db', language: 'go', team: 'data' },
+      edges: [{ target: 'infra/postgres-cluster', kind: 'depends-on' }],
+    },
+    {
+      id: 'team/platform',
+      nodeKind: 'Team',
+      attributes: { name: 'platform', lead: 'alice' },
+      edges: [],
+    },
+  ];
+}
+
+function makeDocuments() {
+  return [
+    {
+      path: 'docs/architecture.md',
+      content: [
+        'The auth-api service handles authentication.',
+        'It uses JWT tokens for session management.',
+        'The service connects to user-db for persistence.',
+      ].join('\n'),
+    },
+    {
+      path: 'src/auth/handler.ts',
+      content: [
+        'export function handleAuth(req) {',
+        '  const token = req.headers.authorization;',
+        '  return validateToken(token);',
+        '}',
+      ].join('\n'),
+    },
+  ];
+}
+
+// ---------------------------------------------------------------------------
+// queryAgentMemory — delegating to queryMemory from agent-memory-query.js
+// ---------------------------------------------------------------------------
+
+test('queryAgentMemory with mode graph-only calls queryGraph and returns results', () => {
+  const controller = createAgentMemoryController();
+  const records = makeRecords();
+
+  const result = controller.queryAgentMemory({
+    query: 'auth-api',
+    mode: 'graph-only',
+    records,
+  });
+
+  assert.ok(result !== null && typeof result === 'object', 'Should return a result object');
+  assert.ok(result.graph !== null, 'graph results should be present in graph-only mode');
+  assert.equal(result.grep, null, 'grep results should be null in graph-only mode');
+  assert.ok(typeof result.graph.totalMatches === 'number', 'graph.totalMatches should be a number');
+  assert.ok(result.graph.totalMatches >= 1, 'Should find auth-api in records');
+
+  // Verify stats are present (from query engine)
+  assert.ok('stats' in result, 'result should have stats');
+  assert.equal(result.stats.mode, 'graph-only', 'stats.mode should reflect requested mode');
+});
+
+test('queryAgentMemory with mode grep-only calls queryGrep and returns results', () => {
+  const controller = createAgentMemoryController();
+  const documents = makeDocuments();
+
+  const result = controller.queryAgentMemory({
+    query: 'auth-api',
+    mode: 'grep-only',
+    documents,
+  });
+
+  assert.ok(result !== null && typeof result === 'object', 'Should return a result object');
+  assert.equal(result.graph, null, 'graph results should be null in grep-only mode');
+  assert.ok(result.grep !== null, 'grep results should be present in grep-only mode');
+  assert.ok(typeof result.grep.totalMatches === 'number', 'grep.totalMatches should be a number');
+  assert.ok(result.grep.totalMatches >= 1, 'Should find auth-api in documents');
+
+  // Verify highlighted output (real queryGrep from query engine produces ** markers)
+  const highlighted = result.grep.excerpts.some(e => e.highlighted && e.highlighted.includes('**'));
+  assert.ok(highlighted, 'Excerpts should have highlighted markers from the real query engine');
+});
+
+test('queryAgentMemory with mode graph-and-grep calls queryMemory and returns both', () => {
+  const controller = createAgentMemoryController();
+  const records = makeRecords();
+  const documents = makeDocuments();
+
+  const result = controller.queryAgentMemory({
+    query: 'auth-api',
+    mode: 'graph-and-grep',
+    records,
+    documents,
+  });
+
+  assert.ok(result.graph !== null, 'graph results should be present');
+  assert.ok(result.grep !== null, 'grep results should be present');
+  assert.ok(typeof result.stats.totalMatches === 'number', 'stats.totalMatches should be a number');
+  assert.equal(result.stats.totalMatches, result.stats.graphCount + result.stats.grepCount,
+    'totalMatches should equal graphCount + grepCount');
+});
+
+test('queryAgentMemory returns empty results for no matches', () => {
+  const controller = createAgentMemoryController();
+  const records = makeRecords();
+  const documents = makeDocuments();
+
+  const result = controller.queryAgentMemory({
+    query: 'zzz-no-match-xyz',
+    mode: 'graph-and-grep',
+    records,
+    documents,
+  });
+
+  assert.equal(result.graph.totalMatches, 0, 'graph should have 0 matches');
+  assert.equal(result.grep.totalMatches, 0, 'grep should have 0 matches');
+  assert.equal(result.stats.totalMatches, 0, 'stats.totalMatches should be 0');
+});
+
+test('queryAgentMemory rejects missing query text', () => {
+  const controller = createAgentMemoryController();
+
+  assert.throws(
+    () => controller.queryAgentMemory({ mode: 'graph-only', records: [] }),
+    /query text is required/,
+    'Should throw when query is missing'
+  );
+});
+
+test('queryAgentMemory rejects empty query text', () => {
+  const controller = createAgentMemoryController();
+
+  assert.throws(
+    () => controller.queryAgentMemory({ query: '', mode: 'graph-only', records: [] }),
+    /non-empty string/,
+    'Should throw when query is empty string'
+  );
+});
+
+// ---------------------------------------------------------------------------
+// searchGraph — delegates to queryGraph from agent-memory-query.js
+// ---------------------------------------------------------------------------
+
+test('searchGraph delegates to queryGraph from agent-memory-query.js', () => {
+  const controller = createAgentMemoryController();
+  const records = makeRecords();
+
+  // The real queryGraph produces sorted results by score (descending)
+  // and uses `depth` semantics — verify via a real query
+  const result = controller.searchGraph({
+    records,
+    kinds: [],
+    query: 'auth-api',
+    edgeDepth: 1,
+  });
+
+  assert.ok(result.totalMatches >= 1, 'Should find auth-api');
+  assert.ok(result.matches.length >= 1, 'matches array should be populated');
+
+  // The real queryGraph sorts by score descending — verify first result is highest scored
+  const scores = result.matches.map(m => m.score);
+  for (let i = 1; i < scores.length; i++) {
+    assert.ok(scores[i] <= scores[i - 1], 'Results should be sorted descending by score (real queryGraph behavior)');
+  }
+
+  // Verify highlighted or edge following via depth — auth-api should have edges to user-db
+  const authMatch = result.matches.find(m => m.record.id === 'service/auth-api');
+  assert.ok(authMatch, 'Should find auth-api record');
+  const edgeTargets = authMatch.edges.map(e => e.target);
+  assert.ok(edgeTargets.includes('service/user-db'), 'Should follow edge to user-db at depth 1');
+});
+
+test('searchGraph uses flat edges array when delegating to queryGraph', () => {
+  const controller = createAgentMemoryController();
+  const records = [
+    { id: 'node/a', nodeKind: 'Service', attributes: { name: 'node-a' }, edges: [] },
+    { id: 'node/b', nodeKind: 'Service', attributes: { name: 'node-b' }, edges: [] },
+  ];
+  const flatEdges = [{ source: 'node/a', target: 'node/b', kind: 'calls' }];
+
+  const result = controller.searchGraph({
+    records,
+    edges: flatEdges,
+    query: 'node-a',
+    edgeDepth: 1,
+  });
+
+  const matchA = result.matches.find(m => m.record.id === 'node/a');
+  assert.ok(matchA, 'Should match node/a');
+  const edgeTargets = matchA.edges.map(e => e.target);
+  assert.ok(edgeTargets.includes('node/b'), 'Flat edge should be followed via queryGraph');
+});
+
+// ---------------------------------------------------------------------------
+// searchGrep — delegates to queryGrep from agent-memory-query.js
+// ---------------------------------------------------------------------------
+
+test('searchGrep delegates to queryGrep from agent-memory-query.js', () => {
+  const controller = createAgentMemoryController();
+  const documents = makeDocuments();
+
+  // The real queryGrep produces `highlighted` field with ** markers — verify this
+  const result = controller.searchGrep({
+    documents,
+    pattern: 'auth-api',
+    maxMatches: 25,
+  });
+
+  assert.ok(result.totalMatches >= 1, 'Should find auth-api in documents');
+  assert.ok(result.excerpts.length >= 1, 'excerpts should be populated');
+
+  // The real queryGrep produces `highlighted` with ** markers
+  // This is the key differentiator vs the stub — the stub did not produce highlighted
+  const withHighlight = result.excerpts.filter(e => e.highlighted && e.highlighted.includes('**auth-api**'));
+  assert.ok(withHighlight.length >= 1, 'At least one excerpt should have **auth-api** in highlighted (real queryGrep)');
+
+  // Also verify contextStart and contextEnd (fields only present in real queryGrep)
+  const hasContextBounds = result.excerpts.every(e =>
+    typeof e.contextStart === 'number' && typeof e.contextEnd === 'number'
+  );
+  assert.ok(hasContextBounds, 'All excerpts should have contextStart and contextEnd from real queryGrep');
+});
+
+test('searchGrep path filtering works via queryGrep delegation', () => {
+  const controller = createAgentMemoryController();
+  const documents = makeDocuments();
+
+  const result = controller.searchGrep({
+    documents,
+    paths: ['docs/*'],
+    pattern: 'auth',
+    maxMatches: 25,
+  });
+
+  assert.ok(result.totalMatches >= 1, 'Should find auth in docs/');
+  assert.ok(
+    result.excerpts.every(e => e.path.startsWith('docs/')),
+    'All excerpts should be from docs/ via queryGrep path filter'
+  );
+});

package/tests/notification-controller.test.js

@@ -0,0 +1,196 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { createNotificationController } from '../src/notification-controller.js';
+
+// Helper to create a fresh controller for each test
+function makeController() {
+  return createNotificationController();
+}
+
+test('createNotification with AgentDispatchRun completed → type run-complete, severity info', () => {
+  const ctrl = makeController();
+  const notif = ctrl.createNotification({ type: 'AgentDispatchRun', status: 'completed', name: 'my-run', org: 'test-org' });
+  assert.equal(notif.type, 'run-complete');
+  assert.equal(notif.severity, 'info');
+  assert.match(notif.title, /completed/i);
+  assert.equal(notif.org, 'test-org');
+});
+
+test('createNotification with AgentDispatchRun failed → type run-complete, severity error', () => {
+  const ctrl = makeController();
+  const notif = ctrl.createNotification({ type: 'AgentDispatchRun', status: 'failed', name: 'my-run', org: 'test-org' });
+  assert.equal(notif.type, 'run-complete');
+  assert.equal(notif.severity, 'error');
+  assert.match(notif.title, /failed/i);
+});
+
+test('createNotification with AgentApproval pending → type approval-needed, severity warning', () => {
+  const ctrl = makeController();
+  const notif = ctrl.createNotification({ type: 'AgentApproval', status: 'pending', action: 'tool-use', org: 'test-org' });
+  assert.equal(notif.type, 'approval-needed');
+  assert.equal(notif.severity, 'warning');
+  assert.match(notif.title, /approval/i);
+  assert.match(notif.title, /tool-use/i);
+});
+
+test('createNotification with ExternalSyncConflict → type conflict-detected, severity warning', () => {
+  const ctrl = makeController();
+  const notif = ctrl.createNotification({ type: 'ExternalSyncConflict', resourceRef: 'my-repo', org: 'test-org' });
+  assert.equal(notif.type, 'conflict-detected');
+  assert.equal(notif.severity, 'warning');
+  assert.match(notif.title, /conflict/i);
+  assert.match(notif.title, /my-repo/i);
+});
+
+test('createNotification with KrateWorkspace claimed → type workspace-ready, severity info', () => {
+  const ctrl = makeController();
+  const notif = ctrl.createNotification({ type: 'KrateWorkspace', claimed: true, name: 'ws-1', claimedBy: 'run-abc', org: 'test-org' });
+  assert.equal(notif.type, 'workspace-ready');
+  assert.equal(notif.severity, 'info');
+  assert.match(notif.title, /workspace/i);
+  assert.match(notif.title, /ws-1/i);
+});
+
+test('createNotification returns notification with id, createdAt, read: false', () => {
+  const ctrl = makeController();
+  const notif = ctrl.createNotification({ type: 'AgentDispatchRun', status: 'completed', name: 'run-x', org: 'test-org' });
+  assert.equal(typeof notif.id, 'string');
+  assert.ok(notif.id.length > 0);
+  assert.equal(typeof notif.createdAt, 'string');
+  assert.ok(notif.createdAt.length > 0);
+  assert.equal(notif.read, false);
+});
+
+test('createNotification default event → type system, severity info', () => {
+  const ctrl = makeController();
+  const notif = ctrl.createNotification({ type: 'UnknownEvent', org: 'test-org' });
+  assert.equal(notif.type, 'system');
+  assert.equal(notif.severity, 'info');
+});
+
+test('listNotifications returns all notifications for org', () => {
+  const ctrl = makeController();
+  ctrl.createNotification({ type: 'AgentDispatchRun', status: 'completed', name: 'run-1', org: 'org-a' });
+  ctrl.createNotification({ type: 'AgentDispatchRun', status: 'completed', name: 'run-2', org: 'org-a' });
+  ctrl.createNotification({ type: 'AgentDispatchRun', status: 'completed', name: 'run-3', org: 'org-b' }); // different org
+
+  const results = ctrl.listNotifications('org-a');
+  assert.equal(results.length, 2);
+  assert.ok(results.every((n) => n.org === 'org-a'));
+});
+
+test('listNotifications with { unreadOnly: true } filters out read notifications', () => {
+  const ctrl = makeController();
+  const n1 = ctrl.createNotification({ type: 'AgentDispatchRun', status: 'completed', name: 'run-1', org: 'org-a' });
+  ctrl.createNotification({ type: 'AgentDispatchRun', status: 'completed', name: 'run-2', org: 'org-a' });
+  ctrl.markAsRead(n1.id);
+
+  const unreadOnly = ctrl.listNotifications('org-a', { unreadOnly: true });
+  assert.equal(unreadOnly.length, 1);
+  assert.equal(unreadOnly[0].read, false);
+});
+
+test('listNotifications with { limit: 2 } caps results to 2', () => {
+  const ctrl = makeController();
+  ctrl.createNotification({ type: 'AgentDispatchRun', status: 'completed', name: 'run-1', org: 'org-a' });
+  ctrl.createNotification({ type: 'AgentDispatchRun', status: 'completed', name: 'run-2', org: 'org-a' });
+  ctrl.createNotification({ type: 'AgentDispatchRun', status: 'completed', name: 'run-3', org: 'org-a' });
+
+  const limited = ctrl.listNotifications('org-a', { limit: 2 });
+  assert.equal(limited.length, 2);
+});
+
+test('listNotifications returns notifications sorted by createdAt descending', () => {
+  const ctrl = makeController();
+  const n1 = ctrl.createNotification({ type: 'AgentDispatchRun', status: 'completed', name: 'run-1', org: 'org-a' });
+  const n2 = ctrl.createNotification({ type: 'AgentDispatchRun', status: 'completed', name: 'run-2', org: 'org-a' });
+
+  // Sort order: they come back by createdAt descending (no guaranteed diff if same ms, just verify all present)
+  const results = ctrl.listNotifications('org-a');
+  assert.equal(results.length, 2);
+  // Both IDs present
+  const ids = results.map((n) => n.id);
+  assert.ok(ids.includes(n1.id));
+  assert.ok(ids.includes(n2.id));
+});
+
+test('markAsRead sets the target notification read to true', () => {
+  const ctrl = makeController();
+  const notif = ctrl.createNotification({ type: 'AgentDispatchRun', status: 'completed', name: 'run-1', org: 'org-a' });
+  assert.equal(notif.read, false);
+
+  const result = ctrl.markAsRead(notif.id);
+  assert.equal(result, true);
+
+  const results = ctrl.listNotifications('org-a');
+  const found = results.find((n) => n.id === notif.id);
+  assert.equal(found.read, true);
+});
+
+test('markAsRead returns false for unknown id', () => {
+  const ctrl = makeController();
+  const result = ctrl.markAsRead('nonexistent-id');
+  assert.equal(result, false);
+});
+
+test('markAllAsRead sets all org notifications as read and returns count', () => {
+  const ctrl = makeController();
+  ctrl.createNotification({ type: 'AgentDispatchRun', status: 'completed', name: 'run-1', org: 'org-a' });
+  ctrl.createNotification({ type: 'AgentDispatchRun', status: 'completed', name: 'run-2', org: 'org-a' });
+  ctrl.createNotification({ type: 'AgentDispatchRun', status: 'completed', name: 'run-3', org: 'org-a' });
+
+  const count = ctrl.markAllAsRead('org-a');
+  assert.equal(count, 3);
+
+  const unread = ctrl.listNotifications('org-a', { unreadOnly: true });
+  assert.equal(unread.length, 0);
+});
+
+test('getUnreadCount returns correct count after some are read', () => {
+  const ctrl = makeController();
+  const n1 = ctrl.createNotification({ type: 'AgentDispatchRun', status: 'completed', name: 'run-1', org: 'org-a' });
+  ctrl.createNotification({ type: 'AgentDispatchRun', status: 'completed', name: 'run-2', org: 'org-a' });
+  ctrl.createNotification({ type: 'AgentDispatchRun', status: 'completed', name: 'run-3', org: 'org-a' });
+
+  assert.equal(ctrl.getUnreadCount('org-a'), 3);
+  ctrl.markAsRead(n1.id);
+  assert.equal(ctrl.getUnreadCount('org-a'), 2);
+});
+
+test('getPreferences returns default prefs for new userId', () => {
+  const ctrl = makeController();
+  const prefs = ctrl.getPreferences('user-xyz');
+  assert.equal(prefs.runs, true);
+  assert.equal(prefs.approvals, true);
+  assert.equal(prefs.conflicts, true);
+  assert.equal(prefs.workspaces, true);
+  assert.equal(prefs.sound, false);
+  assert.equal(prefs.desktop, false);
+});
+
+test('updatePreferences merges and persists new prefs', () => {
+  const ctrl = makeController();
+  const updated = ctrl.updatePreferences('user-abc', { sound: true, runs: false });
+  assert.equal(updated.sound, true);
+  assert.equal(updated.runs, false);
+  assert.equal(updated.approvals, true); // default preserved
+
+  // Verify persisted by reading again
+  const prefs = ctrl.getPreferences('user-abc');
+  assert.equal(prefs.sound, true);
+  assert.equal(prefs.runs, false);
+  assert.equal(prefs.approvals, true);
+});
+
+test('notifications from different orgs do not mix', () => {
+  const ctrl = makeController();
+  ctrl.createNotification({ type: 'AgentDispatchRun', status: 'completed', name: 'run-1', org: 'org-a' });
+  ctrl.createNotification({ type: 'AgentDispatchRun', status: 'completed', name: 'run-2', org: 'org-b' });
+
+  const orgA = ctrl.listNotifications('org-a');
+  const orgB = ctrl.listNotifications('org-b');
+  assert.equal(orgA.length, 1);
+  assert.equal(orgB.length, 1);
+  assert.equal(ctrl.getUnreadCount('org-a'), 1);
+  assert.equal(ctrl.getUnreadCount('org-b'), 1);
+});