@afokapu/atdd-bun 0.1.0

package/conventions/tester.bun/tester.bun.interlocking-route-coverage.convention.yaml

@@ -0,0 +1,66 @@
+schema_version: 1.1.0
+rule_id: tester.bun.interlocking-route-coverage
+kind: rule
+status: active
+name: Every admissible interlocking route has an e2e test that exercises it (Bun)
+statement: >-
+  Every admissible route declared in an interlocking's guarded route space (the `routes:` list of
+  `plan/_trains/_interlockings/**/*.yaml`, the authoritative route space locked by core
+  afokapu/atdd#1248) MUST have at least one end-to-end test that exercises it — an `e2e/**/*.ts` test
+  that names the route by its `routeId` or its resolved `trainId` so its resolution is proven through
+  the production InterlockingRunner -> TrainRunner path (core afokapu/atdd#1251), not asserted
+  descriptively. This is the Bun-stack realization of the agnostic core obligation
+  `tester.interlocking.route-coverage`; its JS detector (a member of the `bun_interlocking_coverage`
+  FAMILY) scans the interlocking route space against the consumer's `e2e/**/*.ts` tests and flags any
+  declared route with no covering test. An admissible route with no e2e test is a SILENT-GREEN GAP.
+implementation:
+  type: validator
+  ref: tester.bun.interlocking-route-coverage
+content:
+  summary: >-
+    A "every declared interlocking route is exercised by an e2e test" obligation, rendered for the
+    Bun application. The JS realization parses each interlocking artifact, extracts its declared routes
+    (routeId/trainId/category), then scans `e2e/**/*.ts` for tests that reference the route
+    by its `routeId` or its resolved `trainId` (comments masked so a name only in a comment does not
+    count). Any declared route with no covering e2e test is a RAW violation anchored at the route's
+    declaration line in the source interlocking YAML.
+  normative_text: |
+    The interlocking YAML is authoritative for the guarded route space (afokapu/atdd#1248): every entry
+    under `routes:` is an admissible route the InterlockingRunner can resolve to exactly one `trainId`
+    (afokapu/atdd#1251). Coverage of that route space is a tester obligation — an unexercised route is a
+    branch of production route control that no test ever drives. A route is COVERED when at least one
+    `e2e/**/*.ts` test references it by its `routeId` or by the `trainId` it resolves to. WHICH per-stack
+    discovery applies (here: Bun `e2e/**/*.ts` scanned for the route/train tokens) is delegated to
+    this realization; other stacks render the same obligation in their own e2e layout.
+  fix_hint: |
+    Add an end-to-end test that exercises the flagged route through the production runners. Place it
+    under `e2e/interlockings/<interlocking_slug>/<slug>.routes.test.ts` and drive
+    `new InterlockingRunner(...).resolveTrain(...)` so the route's guard-true case resolves to its
+    expected `trainId`, then have `TrainRunner` execute it. Reference the route by its `routeId` or
+    `trainId` so coverage is machine-discoverable. Do NOT satisfy this with a mock resolver or a
+    descriptive assertion. This rule is `strict`: an admissible route with no covering e2e test blocks.
+  exceptions:
+    - YAML under the interlocking scope that declares no `routes:` (the `_interlockings.yaml` registry
+      index and generated projections) carries no admissible route space and is out of scope.
+    - A route already referenced by its `routeId` or resolved `trainId` in any `e2e/**/*.ts` test is
+      covered and is not flagged.
+    - Per-stack e2e renderings other than Bun are owned by their own workspace packages.
+metadata:
+  aliases:
+    - BUN-TESTER-INTERLOCKING-ROUTE-COVERAGE-001
+  severity: 1
+  disposition: strict
+  introduced_in: 0.1.0
+  core_design_refs:
+    - afokapu/atdd#1246
+    - afokapu/atdd#1248
+    - afokapu/atdd#1251
+terms:
+  - term_id: admissible_route
+    text: >-
+      a single entry under the `routes:` list of an interlocking artifact (afokapu/atdd#1248); it carries
+      a `routeId`, the `trainId` it resolves to, a `category`, and a `guard_ref`.
+  - term_id: silent_green_route_gap
+    text: >-
+      an admissible route with no covering e2e test; the interlocking branch it represents is never
+      executed, so CI passes while a guarded route-control path is entirely unproven.

package/conventions/tester.bun/tester.bun.interlocking-smoke-coverage-for-station-master.convention.yaml

@@ -0,0 +1,76 @@
+schema_version: 1.1.0
+rule_id: tester.bun.interlocking-smoke-coverage-for-station-master
+kind: rule
+status: active
+name: Exposed interlocking Station Master actions have smoke coverage through real entrypoints (Bun)
+statement: >-
+  Every exposed Station Master action of an interlocking (`entrypoint.exposed: true` with an `actions:`
+  entry, core afokapu/atdd#1248) MUST have a smoke test that drives the action through the real
+  entrypoint -> Station Master -> InterlockingRunner -> TrainRunner path (core afokapu/atdd#1251). This
+  is the Bun-stack realization of the agnostic core obligation
+  `tester.interlocking.smoke-coverage-for-station-master`; its JS detector (a member of the
+  `bun_interlocking_coverage` FAMILY) scans the interlocking entrypoints and the consumer's
+  `e2e/**/*.ts` tests and flags any exposed action with no smoke test that reaches the Station Master and
+  exercises the production runners. EXPLICIT POLICY: an exposed action is a critical, user-facing route
+  and its smoke coverage is enforced STRICT; an interlocking with `entrypoint.exposed: false` has no
+  Station Master action and is OUT OF SCOPE — the criticality signal is the core `entrypoint.exposed`
+  field, not a heuristic.
+implementation:
+  type: validator
+  ref: tester.bun.interlocking-smoke-coverage-for-station-master
+content:
+  summary: >-
+    A "exposed Station Master interlocking actions have real-entrypoint smoke coverage" obligation,
+    rendered for the Bun application. The JS realization parses each interlocking's `entrypoint`; for each
+    `exposed: true` action it requires a smoke test under `e2e/**/*.ts` that references the action name,
+    a Station Master reference (`StationMaster`/`stationMaster`), AND both production runners. Internal
+    (`exposed: false`) interlockings carry no action and are not flagged.
+  normative_text: |
+    `entrypoint.exposed: true` requires at least one action (afokapu/atdd#1248), and those actions are
+    Station Master action names — the user-facing surface. The smoke test for such an action should prove
+    the whole interlocking-enabled path end to end: a real endpoint reaches the Station Master, the
+    Station Master chooses the interlocking path (not a direct train), InterlockingRunner resolves the
+    route, TrainRunner executes the selected train, and the trace records interlockingId/routeId/
+    selectedTrainId. The detector's enforced minimum signature for an action's smoke test is an
+    `e2e/**/*.ts` file that references the action name AND a Station Master reference AND both production
+    runners (`InterlockingRunner`, `TrainRunner`).
+
+    SEVERITY POLICY (explicit): exposed actions are critical user-facing routes -> strict;
+    `exposed: false` interlockings are internal / noncritical -> out of scope. The policy is derived
+    from the core `entrypoint.exposed` field, so it is mechanical, not a judgement call.
+  fix_hint: |
+    Add a smoke test for the flagged Station Master action that hits the real entrypoint and asserts the
+    interlocking path is taken: call the real action endpoint so it reaches the Station Master, assert the
+    Station Master chose the interlocking (InterlockingRunner) path, that InterlockingRunner resolved a
+    route, that TrainRunner executed the selected train, and that the captured trace records the
+    interlockingId / routeId / selectedTrainId. This rule is `strict` for exposed (user-facing) actions;
+    if the interlocking is genuinely internal, set `entrypoint.exposed: false` with a reason and it leaves
+    scope.
+  exceptions:
+    - Interlockings with `entrypoint.exposed` false (internal-transition-only / library-only /
+      planned-not-exposed) carry no Station Master action and are out of scope.
+    - An exposed action that already has a covering smoke test (a file referencing the action, the Station
+      Master, and both runners) is satisfied and not flagged.
+    - Per-stack renderings other than Bun are owned by their own workspace packages.
+metadata:
+  aliases:
+    - BUN-TESTER-INTERLOCKING-SMOKE-STATION-MASTER-001
+  severity: 1
+  disposition: strict
+  introduced_in: 0.1.0
+  core_design_refs:
+    - afokapu/atdd#1246
+    - afokapu/atdd#1248
+    - afokapu/atdd#1251
+terms:
+  - term_id: exposed_action
+    text: >-
+      a Station Master action name listed under an interlocking's `entrypoint.actions` when
+      `entrypoint.exposed: true` (afokapu/atdd#1248). It is the user-facing route surface and requires
+      smoke coverage; `exposed: false` interlockings have no such action.
+  - term_id: station_master_smoke_test
+    text: >-
+      an `e2e/**/*.ts` smoke test that drives an exposed action through the real entrypoint to the Station
+      Master, proving the Station Master chose the interlocking path, InterlockingRunner resolved a route,
+      TrainRunner executed the selected train, and the trace recorded the interlockingId/routeId/
+      selectedTrainId.

package/conventions/tester.bun/tester.bun.interlocking-trace-binds-declared-route.convention.yaml

@@ -0,0 +1,74 @@
+schema_version: 1.1.0
+rule_id: tester.bun.interlocking-trace-binds-declared-route
+kind: rule
+status: active
+name: Interlocking execution trace binds back to the declared route (Bun)
+statement: >-
+  A test that asserts on the runtime trace emitted by interlocking execution MUST bind that trace back to
+  the source interlocking declaration — it must assert every required trace field so the executed route is
+  traceable to the interlocking YAML it came from (core afokapu/atdd#1248 route space, #1251 runtime
+  trace). This is the Bun-stack realization of the agnostic core obligation
+  `tester.interlocking.trace-binds-declared-route`; its JS detector (a member of the
+  `bun_interlocking_coverage` FAMILY) scans the consumer's `e2e/**/*.ts` interlocking trace tests and
+  flags any that reference the runtime `trace` but omit one or more required binding fields. A trace
+  assertion that does not bind the declared route lets execution drift from declaration silently.
+implementation:
+  type: validator
+  ref: tester.bun.interlocking-trace-binds-declared-route
+content:
+  summary: >-
+    A "interlocking trace assertions bind the declared route" obligation, rendered for the Bun
+    backend. The JS realization scans each interlocking-related `e2e/**/*.ts` test that references the
+    runtime `trace` and requires it to assert every required trace field (comments masked); any missing
+    field is a RAW violation listing the gap.
+  normative_text: |
+    The TrainResult trace (core afokapu/atdd#1251) is what proves which declared route (core
+    afokapu/atdd#1248) actually executed. A trace test that inspects the trace but only checks, say, the
+    selectedTrainId does not bind the route back to its declaration — the run could have taken a different
+    route/category/guard and still match.
+
+    REQUIRED trace fields a trace-binding test must assert (TS camelCase):
+      - interlockingId
+      - routeId
+      - selectedTrainId
+      - routeCategory
+      - guardId
+      - resolutionStrategy
+      - resolutionReason
+
+    A file is a trace-binding test when it references a bare `trace` identifier in an interlocking
+    context; for such a file every required field above must appear. WHICH per-stack discovery applies
+    (here: Bun `e2e/**/*.ts` scanned for the trace object and the required field tokens) is delegated
+    to this realization.
+  fix_hint: |
+    Extend the flagged trace assertion to bind the full declared route. Assert the captured trace records
+    all of: interlockingId, routeId, selectedTrainId, routeCategory, guardId,
+    resolutionStrategy, resolutionReason — the fields that tie the executed route back to its interlocking
+    YAML declaration (afokapu/atdd#1248) and resolution outcome (afokapu/atdd#1251). This rule is `strict`:
+    a trace test that does not bind the declared route lets execution drift from declaration undetected.
+  exceptions:
+    - e2e tests that do not reference the runtime `trace` object are not trace-binding tests and are out
+      of scope.
+    - Non-interlocking e2e tests (no reference to any interlocking route/train/interlocking token or
+      runner symbol) are out of scope.
+    - Per-stack renderings other than Bun are owned by their own workspace packages.
+metadata:
+  aliases:
+    - BUN-TESTER-INTERLOCKING-TRACE-BINDS-ROUTE-001
+  severity: 1
+  disposition: strict
+  introduced_in: 0.1.0
+  core_design_refs:
+    - afokapu/atdd#1246
+    - afokapu/atdd#1248
+    - afokapu/atdd#1251
+terms:
+  - term_id: runtime_trace
+    text: >-
+      the trace recorded on the TrainResult of an interlocking execution (core afokapu/atdd#1251); the
+      evidence that ties an executed run to the declared route it came from.
+  - term_id: required_trace_field
+    text: >-
+      one of interlockingId, routeId, selectedTrainId, routeCategory, guardId,
+      resolutionStrategy, resolutionReason — the fields a trace-binding test must assert so the executed
+      route is bound back to its interlocking YAML declaration and resolution outcome.

package/conventions/tester.bun/tester.bun.interlocking-train-sequence-is-exercised.convention.yaml

@@ -0,0 +1,77 @@
+schema_version: 1.1.0
+rule_id: tester.bun.interlocking-train-sequence-is-exercised
+kind: rule
+# DRAFT, and the word is load-bearing. The obligation is authored and its validator
+# exists and is tested, but it is realized by `scan_execution()` which the gated
+# `scan_root()` deliberately does not call. Shipping it `active` would claim an
+# enforcement that never runs — a rule that says it checks and does not. It becomes
+# `active` in the same change that wires the check into the gate.
+status: active
+name: Some test exercises the wagon sequence each declared train actually runs
+statement: >-
+  Every train reachable from a declared interlocking route MUST have a test that asserts the wagon
+  SEQUENCE it executes — the ordered steps, not merely which train was selected. Route resolution
+  and trace binding both prove WHICH train was chosen; neither proves WHAT it ran. Without this a
+  train definition can be reordered, shortened or emptied and the suite stays green.
+terms:
+- term_id: wagon_sequence
+  text: >-
+    the ordered `sequence:` of a train definition, and the ordered steps a TrainRunner reports
+    having executed. The obligation is that a test compares the two, in order.
+- term_id: selection_is_not_execution
+  text: >-
+    `route-coverage` proves an admissible route is exercised; `trace-binds-declared-route` proves
+    the run is attributable to its declared route. Both are statements about SELECTION. A train
+    whose sequence is wrong is selected correctly and runs the wrong thing.
+- term_id: disposition_rationale
+  text: >-
+    advisory because no consumer or fixture satisfies it yet, and because the check is staged
+    rather than gated. The measurement below was TAKEN, not recalled.
+  values:
+    measured_2026_09_07: >-
+      On a data-driven consumer whose TrainRunner genuinely reads the train definition, replacing
+      a train's entire wagon sequence in the plan left the consumer's own e2e suite at 4 passed.
+      The runtime obeyed the new plan; no test looked.
+    measurement_target: the python consumer built for the end-to-end experiment; no Bun consumer surveyed yet
+    escalate_when: >-
+      Consumer suites assert executed sequences and the check has been wired into
+      the bun_interlocking_coverage family gate. Enabling it is a GATE change; the detector is staged.
+content:
+  summary: >-
+    The tester half of `coder.train.runtime-executes-the-declaration (python; the Bun coder half is not yet authored)`. That rule makes the runtime
+    READ the plan. This one makes the suite prove it OBEYS it — the two are worth nothing apart.
+  normative_text: |
+    THE PAIRING IS THE POINT. A runtime that reads the plan but is never tested against it can
+    still drift: the plan is edited, the runtime dutifully executes the new sequence, and no test
+    notices because none ever asserted what ran. A suite that asserts a sequence against a runtime
+    that hardcodes it proves only that the hardcoding is self-consistent. Both halves are needed
+    before "the train YAML is the source of truth" is a checkable claim rather than a slogan.
+
+    Demonstrated rather than argued: on a consumer whose TrainRunner genuinely loads the train
+    definition, replacing a train's whole `sequence:` in the plan left its suite green. The
+    runtime had changed behaviour completely; the tests were looking somewhere else.
+  fix_hint: |
+    Assert the executed order against the declaration, in order:
+
+      def test_standard_train_runs_its_declared_sequence():
+          trace = new TrainRunner(res.trainPath).execute(res.trainId, {})
+          declared = [s["wagon"] for s in yaml.safe_load(Path(path).read_text())["sequence"]]
+          assert trace["steps"] == declared
+
+    Reading the expected order FROM the plan rather than restating it as literals is what makes
+    the test track the declaration instead of a copy of it.
+  exceptions:
+  - A consumer that declares no interlocking route space carries no obligation.
+  - A train reachable by no declared route is out of scope; this rule follows the route space.
+metadata:
+  aliases:
+  - BUN-TESTER-TRAIN-SEQUENCE-001
+  severity: 2
+  disposition: advisory
+  introduced_in: 0.1.0
+  core_design_refs:
+  - afokapu/atdd#1248
+  - afokapu/atdd#1251
+implementation:
+  type: validator
+  ref: tester.bun.interlocking-train-sequence-is-exercised

package/conventions/tester.bun/tester.bun.red-behavioral-assertion.convention.yaml

@@ -0,0 +1,51 @@
+schema_version: 1.1.0
+rule_id: tester.bun.red-behavioral-assertion
+kind: rule
+status: active
+name: RED tests assert behaviour, not existence
+statement: >-
+  A test whose Phase is RED MUST assert behaviour; a case whose assertions are all existence checks
+  (`toBeDefined` / `toBeTruthy` / `toBeFalsy` / `toBeNull` / `toBeUndefined`), or which asserts nothing at
+  all, is refused. Stack-neutral obligation, Bun-specific detector over `bun:test` matchers. Realized by
+  `bun_tester_discipline_detector`.
+terms:
+- term_id: vacuous_assertion
+  text: >-
+    an existence check — toBeDefined, toBeTruthy, toBeFalsy, toBeNull, toBeUndefined. Passes the
+    moment a stub is exported.
+- term_id: behavioural_assertion
+  text: >-
+    an assertion on what the code DOES, which is the one that must fail before the
+    implementation exists.
+content:
+  summary: >-
+    For each `it()` in a RED-phase file, brace-matches the case body and reports it when it contains no
+    `expect(` at all, or when every `expect(` is an existence matcher.
+  normative_text: |
+    RED's entire job is to fail before the implementation exists. `expect(checkout).toBeDefined()` passes the moment an empty function is exported, so it goes green against a stub — the test was never RED in any meaningful sense, and the acceptance it claims to prove is unproven from that point forward.
+    The rule is deliberately narrow: it fires only when EVERY assertion in the case is vacuous. A case that checks existence and then checks behaviour is fine, because the behavioural assertion is the one that must fail.
+  fix_hint: |
+    Assert the behaviour that does not yet exist:
+
+      expect(checkout).toBeDefined();                        // passes against a stub
+      expect(() => checkout({ items: [] })).toThrow("CART_EMPTY");  // must fail first
+  exceptions:
+  - Only RED-phase files are scanned.
+  - A case mixing existence and behavioural assertions is not flagged.
+  - Files with no declared phase are skipped — that is `phase-declared`'s finding.
+metadata:
+  aliases:
+  # Bun realization of the core obligation `tester.red.behavioral-assertion-required`. Core carries no
+  # shared alias for it, so the lineage is stated here and in the statement.
+  - BUN-RED-BEHAVIORAL-ASSERTION-001
+  severity: 3
+  # Core's tester nodes are largely `documentation-only`, which core's
+  # coverage_report treats as never-fails-the-build. That is right for retrofitting
+  # and wrong for a new stack: a coverage-binding rule that cannot fail is a rule
+  # that will not be adopted. Gating dispositions here; a repo adopting on an
+  # existing suite records a ratchet baseline instead.
+  disposition: strict
+  introduced_in: 0.1.0
+implementation:
+  type: validator
+  ref: bun_tester_discipline_detector

package/conventions/tester.bun/tester.bun.red-fails-first.convention.yaml

@@ -0,0 +1,52 @@
+schema_version: 1.1.0
+rule_id: tester.bun.red-fails-first
+kind: rule
+status: active
+name: RED tests carry a guaranteed-fail marker
+statement: >-
+  A test whose Phase is RED MUST contain at least one guaranteed-fail marker. Accepted markers,
+  transcribed from CORE `red.convention.yaml` -> `red_patterns.typescript`: `throw new Error('Not
+  implemented …')`, `throw new UnimplementedError(…)`, `expect(false).toBe(true)`,
+  `expect(true).toBe(false)`, `expect.fail(…)`, `return Promise.reject(…)`, and `it.fails(` /
+  `test.failing(`. Bun realization of core `tester.red.test-must-fail-first`, mirroring
+  `tester.convex.red-fails-first` rule for rule.
+terms:
+- term_id: red_marker
+  text: >-
+    a guaranteed-fail construct: throw new Error('Not implemented…'), expect.fail(…),
+    expect(false).toBe(true), return Promise.reject(…), it.fails( / test.failing(.
+- term_id: structural_proxy
+  text: >-
+    what this rule checks. Whether a test ACTUALLY fails first is a runtime property; core
+    supplies the decidable stand-in.
+content:
+  summary: >-
+    Flags any `Phase: RED` file containing none of the core TypeScript RED markers. `test.failing(` is
+    bun:test's spelling of vitest's `it.fails(` and is accepted identically.
+  normative_text: |
+    Whether a test ACTUALLY fails first is a RUNTIME property no static detector can observe. Core supplies the decidable STRUCTURAL proxy — a guaranteed-fail marker must be present — and that proxy is exactly what a per-stack detector can check. The obligation is agnostic; only the marker syntax is stack-specific.
+    This rule and `red-behavioral-assertion` are complementary, not redundant. That one asks whether the assertions are about behaviour; this one asks whether anything guarantees the test is red at all.
+  fix_hint: |
+    Add a marker that cannot pass until the implementation exists:
+
+      expect.fail("checkout rejection not implemented yet");
+      // or
+      throw new Error("Not implemented: checkout rejection");
+
+    Remove it in GREEN, when the behavioural assertion carries the test on its own.
+  exceptions:
+  - Only RED-phase files are scanned.
+  - "`it.fails` / `test.failing` are markers, NOT self-skips — `no-self-skip` deliberately does not flag them."
+  - Files with no declared phase are skipped; that is `phase-declared`'s finding.
+metadata:
+  aliases:
+  # Mirrored rule-for-rule from convex.extension.tester.base :: tester.convex.red-fails-first
+  # Core obligation: tester.red.test-must-fail-first
+  - TESTER-RED-FAILS-FIRST-001
+  - BUN-RED-FAILS-FIRST-001
+  severity: 3
+  disposition: strict
+  introduced_in: 0.1.0
+implementation:
+  type: validator
+  ref: bun_tester_discipline_detector

package/conventions/tester.bun/tester.bun.routing-runtime-family.convention.yaml

@@ -0,0 +1,41 @@
+schema_version: 1.1.0
+rule_id: tester.bun.routing-runtime-family
+kind: rule
+status: active
+name: A test's declared runtime is in the JS/TS family
+statement: >-
+  A test file that declares a `// Runtime:` MUST name a runtime in the JS/TS family (`bun`, `browser`,
+  `isomorphic`, `typescript`, `ts`, `node`, `js`, `javascript`, `deno`, `vite`, `astro`, `preact`). Bun
+  realization mirroring `tester.convex.routing-path`, which makes the same argument for Vitest.
+terms:
+- term_id: declared_runtime
+  text: >-
+    the optional `// Runtime:` field on a test.
+- term_id: js_family
+  text: >-
+    bun, browser, isomorphic, typescript, ts, node, js, javascript, deno, vite, astro, preact —
+    the runtimes `bun test` actually executes under.
+content:
+  summary: >-
+    Flags a declared `Runtime:` outside the JS/TS family. Declaring a runtime is optional.
+  normative_text: |
+    A test file in this stack is collected and executed by `bun test` — a JS/TS runtime — whatever its header claims. A test declaring `python` is either mislabelled or filed in the wrong suite, and either way the gate attributes it to a runner that never executed it.
+    The rule judges only files that DECLARE a runtime, because for a test the field is optional: the suite's runner is already known from the provider.
+  fix_hint: |
+    Declare the runtime the suite actually executes under, or drop the field:
+
+      // Runtime: bun
+  exceptions:
+  - A test with no `Runtime:` field is not flagged — the field is optional for tests.
+  - The vocabulary is the JS/TS family, deliberately wider than the source-side `bun|browser|isomorphic`.
+metadata:
+  aliases:
+  # Mirrored rule-for-rule from convex.extension.tester.base :: tester.convex.routing-path
+  # Core obligation: tester.routing.layer-keyword-taxonomy
+  - BUN-ROUTING-RUNTIME-FAMILY-001
+  severity: 2
+  disposition: suppress-and-clean
+  introduced_in: 0.1.0
+implementation:
+  type: validator
+  ref: bun_tester_discipline_detector

package/conventions/tester.bun/tester.bun.security-auth.convention.yaml

@@ -0,0 +1,46 @@
+schema_version: 1.1.0
+rule_id: tester.bun.security-auth
+kind: rule
+status: active
+name: Security tests assert on denial
+statement: >-
+  A test identified as a security test by its URN kind segment (`-SEC-`, `-RLS-`, `-AUTH-`) MUST contain
+  an authentication/authorisation assertion — an expectation tied to 401, 403, unauthorised, forbidden,
+  denied, permission, `.rejects` or `toThrow`. Bun realization of core `tester.security.auth`, mirroring
+  `tester.convex.security-auth`.
+terms:
+- term_id: security_test
+  text: >-
+    a test whose URN carries a SEC, RLS or AUTH kind segment.
+- term_id: denial_assertion
+  text: >-
+    an expectation tied to 401, 403, unauthorised, forbidden, denied, permission, .rejects or
+    toThrow. Its absence makes the test a silent green gap.
+content:
+  summary: >-
+    Identifies security tests from the URN and flags those whose body contains no denial assertion.
+  normative_text: |
+    A security test that only walks the happy path is a SILENT GREEN GAP — the worst shape a test can have. It passes CI, the gate counts it as covering the security acceptance, and it proves nothing about the denial path, which is the only path the acceptance is actually about.
+    Identification is by URN kind segment rather than filename, consistent with the rest of this package: the header is authoritative.
+  fix_hint: |
+    Assert the refusal, not the permission:
+
+      const res = await fetch("/orders", { method: "POST" });   // anonymous
+      expect(res.status).toBe(403);
+
+    A happy-path case is welcome too — but it cannot be the only one.
+  exceptions:
+  - Only tests whose URN carries a SEC / RLS / AUTH kind segment are scanned.
+  - Any of the listed denial signals satisfies the rule.
+metadata:
+  aliases:
+  # Mirrored rule-for-rule from convex.extension.tester.base :: tester.convex.security-auth
+  # Core obligation: tester.security.auth
+  - TESTER-SECURITY-AUTH-001
+  - BUN-SECURITY-AUTH-001
+  severity: 4
+  disposition: strict
+  introduced_in: 0.1.0
+implementation:
+  type: validator
+  ref: bun_tester_discipline_detector

package/conventions/tester.bun/tester.bun.security-input.convention.yaml

@@ -0,0 +1,45 @@
+schema_version: 1.1.0
+rule_id: tester.bun.security-input
+kind: rule
+status: active
+name: Input-validation tests assert on rejection
+statement: >-
+  A test identified as an input-validation test by its URN kind segment (`-INPUT-`, `-VALIDATION-`,
+  `-VALIDATE-`) MUST contain a rejection assertion — `.rejects`, `toThrow`, 400, 422, invalid, reject, or
+  an error expectation. Bun realization of core `tester.security.input`, mirroring
+  `tester.convex.security-input`.
+terms:
+- term_id: input_validation_test
+  text: >-
+    a test whose URN carries an INPUT, VALIDATION or VALIDATE kind segment.
+- term_id: rejection_assertion
+  text: >-
+    an expectation on refusal — .rejects, toThrow, 400, 422, invalid. A well-formed payload
+    proves nothing about adversarial input.
+content:
+  summary: >-
+    Identifies input-validation tests from the URN and flags those with no rejection assertion.
+  normative_text: |
+    A test that submits a well-formed payload and checks it succeeds proves the parser works on good input. The obligation an input-validation acceptance carries is about BAD input — malformed, missing, adversarial — and that is precisely what a happy-path test does not touch.
+    Same silent-green-gap shape as `security-auth`, and it is grouped with the security family for the same reason: unvalidated input is the entry point for most of what the security rules defend against.
+  fix_hint: |
+    Assert the rejection:
+
+      expect(() => parseOrder({ sku: null })).toThrow("INVALID_SKU");
+      // or over HTTP
+      expect(res.status).toBe(422);
+  exceptions:
+  - Only tests whose URN carries an INPUT / VALIDATION / VALIDATE kind segment are scanned.
+  - Any of the listed rejection signals satisfies the rule.
+metadata:
+  aliases:
+  # Mirrored rule-for-rule from convex.extension.tester.base :: tester.convex.security-input
+  # Core obligation: tester.security.input
+  - TESTER-SECURITY-INPUT-001
+  - BUN-SECURITY-INPUT-001
+  severity: 4
+  disposition: strict
+  introduced_in: 0.1.0
+implementation:
+  type: validator
+  ref: bun_tester_discipline_detector

package/conventions/tester.bun/tester.bun.smoke-no-collaborator-substitution.convention.yaml

@@ -0,0 +1,45 @@
+schema_version: 1.1.0
+rule_id: tester.bun.smoke-no-collaborator-substitution
+kind: rule
+status: active
+name: SMOKE tests do not substitute production collaborators
+statement: >-
+  A test whose Phase is SMOKE MUST NOT substitute a production collaborator — `mock.module`, `spyOn`,
+  `jest.mock`/`spyOn`, `vi.mock`/`spyOn`. Stack-neutral obligation, Bun-specific substitution vocabulary
+  (`bun:test` exposes `mock` and `spyOn` where pytest uses `monkeypatch`). Realized by
+  `bun_tester_discipline_detector`.
+terms:
+- term_id: substitution
+  text: >-
+    mock.module, spyOn, jest.mock/spyOn, vi.mock/spyOn — replacing a production collaborator.
+- term_id: false_evidence
+  text: >-
+    what a substituted SMOKE test gives the gate: credit that the real path works, when the real
+    path is precisely what was replaced.
+content:
+  summary: >-
+    Flags any substitution call in a SMOKE-phase file, reporting the exact line.
+  normative_text: |
+    Substituting a collaborator turns a SMOKE test into a unit test wearing a SMOKE label. The damage is not that the test is bad — it may be an excellent unit test — but that the gate counts it as evidence the real path works, when the real path is precisely the part that was replaced.
+    This is the failure that makes a green suite compatible with a broken deployment, which is the specific outcome ATDD's phase separation exists to prevent.
+  fix_hint: |
+    Let the SMOKE test exercise the real collaborator against real infrastructure, and move the substituted version into a UNIT-phase test where the substitution is honest and expected.
+  exceptions:
+  - Only SMOKE-phase files are scanned; UNIT tests may substitute freely.
+  - Disposition matches core's `suppress-and-clean`: a ratchet holds existing cases flat.
+metadata:
+  aliases:
+  # Bun realization of the core obligation `tester.smoke.no-collaborator-substitution`. Core carries no
+  # shared alias for it, so the lineage is stated here and in the statement.
+  - BUN-SMOKE-NO-COLLABORATOR-SUBSTITUTION-001
+  severity: 4
+  # Core's tester nodes are largely `documentation-only`, which core's
+  # coverage_report treats as never-fails-the-build. That is right for retrofitting
+  # and wrong for a new stack: a coverage-binding rule that cannot fail is a rule
+  # that will not be adopted. Gating dispositions here; a repo adopting on an
+  # existing suite records a ratchet baseline instead.
+  disposition: suppress-and-clean
+  introduced_in: 0.1.0
+implementation:
+  type: validator
+  ref: bun_tester_discipline_detector

package/conventions/tester.bun/tester.bun.smoke-observable-assertion.convention.yaml

@@ -0,0 +1,54 @@
+schema_version: 1.1.0
+rule_id: tester.bun.smoke-observable-assertion
+kind: rule
+status: active
+name: SMOKE tests assert on operator-observable output
+statement: >-
+  A test whose Phase is SMOKE MUST assert on an operator-observable channel — HTTP response status or
+  body, rendered markup, stdout/stderr, exit code — and not only on objects the test constructed itself.
+  Stack-neutral obligation, Bun/htmx-specific channel vocabulary. Realized by
+  `bun_tester_discipline_detector`.
+terms:
+- term_id: observable_channel
+  text: >-
+    an HTTP response status or body, rendered markup, stdout/stderr, an exit code, or persisted
+    state.
+- term_id: self_constructed_object
+  text: >-
+    a value the test built itself. Asserting on it proves the constructor works, which is a unit
+    test's job under a SMOKE label.
+content:
+  summary: >-
+    Reports a SMOKE case that makes assertions but touches none of the observable channels.
+  normative_text: |
+    A SMOKE test exists to prove the system does something a person could witness. A case that builds an object and asserts on its fields has proven that the constructor works — which is a unit test's job — while carrying the label that tells the gate real behaviour was exercised.
+    The observable vocabulary is stack-specific and that is the whole reason this rule is re-realized rather than shared: for this stack the canonical observation is an HTTP response and the markup inside it, because that markup is what htmx puts in front of the user.
+  fix_hint: |
+    Assert what an operator would see:
+
+      const order = buildOrder({ sku: "x" });
+      expect(order.sku).toBe("x");       // internal
+
+      const res = await fetch("/orders");
+      expect(res.status).toBe(200);
+      expect(await res.text()).toContain("order-1");   // observable
+  exceptions:
+  - Only SMOKE-phase files are scanned.
+  - Cases with no assertions are skipped — other rules own that.
+  - Disposition is `suppress-and-clean`: a ratchet holds an existing suite flat while it is migrated.
+metadata:
+  aliases:
+  # Bun realization of the core obligation `tester.smoke.operator-observable-assertion`. Core carries no
+  # shared alias for it, so the lineage is stated here and in the statement.
+  - BUN-SMOKE-OBSERVABLE-ASSERTION-001
+  severity: 3
+  # Core's tester nodes are largely `documentation-only`, which core's
+  # coverage_report treats as never-fails-the-build. That is right for retrofitting
+  # and wrong for a new stack: a coverage-binding rule that cannot fail is a rule
+  # that will not be adopted. Gating dispositions here; a repo adopting on an
+  # existing suite records a ratchet baseline instead.
+  disposition: suppress-and-clean
+  introduced_in: 0.1.0
+implementation:
+  type: validator
+  ref: bun_tester_discipline_detector