@agentikos/omega-os 0.1.0 → 0.19.5

package/omega/Agentik_Engine/tests/test_tools_and_sync.py

@@ -0,0 +1,312 @@
+"""ToolRegistry + SyncEngine / ClaudeCodeAdapter end-to-end test.
+
+Seeds a tempdir OMEGA_HOME with one skill, one command, one MCP-config entry,
+one catalog entry, one tool, and one hook. Asserts the projection produces the
+expected Claude Code native layout (skills/<id>/SKILL.md, commands/<id>.md,
+.mcp.json with mcpServers, settings.json with hooks).
+
+Standalone: python3 tests/test_tools_and_sync.py
+"""
+import json
+import shutil
+import sys
+import tempfile
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+
+from omega_engine import cli                                       # noqa: E402
+from omega_engine.sync import ClaudeCodeAdapter, SyncEngine        # noqa: E402
+from omega_engine.tools import (                                    # noqa: E402
+    Tool,
+    ToolRegistry,
+    load_catalog,
+    merge_mcp_config,
+)
+
+
+# --------------------------------------------------------------------------
+# Tempdir helpers
+# --------------------------------------------------------------------------
+
+
+def _seed_home() -> Path:
+    home = Path(tempfile.mkdtemp(prefix="omega-tools-sync-test-"))
+    # 8-block scaffolding (only what the test touches)
+    for b in ("Agentik_SSOT", "Agentik_Tools", "Agentik_Providers"):
+        (home / b).mkdir(parents=True, exist_ok=True)
+    # SSOT subdirs
+    ssot = home / "Agentik_SSOT"
+    (ssot / "skills").mkdir(parents=True, exist_ok=True)
+    (ssot / "commands").mkdir(parents=True, exist_ok=True)
+    (ssot / "agents").mkdir(parents=True, exist_ok=True)
+    (ssot / "hooks").mkdir(parents=True, exist_ok=True)
+    (ssot / "mcp").mkdir(parents=True, exist_ok=True)
+    return home
+
+
+def _seed_skill(home: Path, sid: str, body: str) -> None:
+    (home / "Agentik_SSOT" / "skills" / f"{sid}.md").write_text(body)
+
+
+def _seed_command(home: Path, cid: str, body: str) -> None:
+    (home / "Agentik_SSOT" / "commands" / f"{cid}.md").write_text(body)
+
+
+def _seed_agent(home: Path, aid: str, body: str) -> None:
+    (home / "Agentik_SSOT" / "agents" / f"{aid}.md").write_text(body)
+
+
+def _seed_hook(home: Path, fname: str, payload: dict) -> None:
+    (home / "Agentik_SSOT" / "hooks" / fname).write_text(json.dumps(payload))
+
+
+def _seed_catalog(home: Path) -> None:
+    import yaml
+    cat = {
+        "version": 1,
+        "catalog": [
+            {"id": "filesystem", "name": "Filesystem",
+             "description": "sandboxed file access",
+             "category": "core",
+             "install": {"method": "npx",
+                         "package": "@modelcontextprotocol/server-filesystem"},
+             "recommended": True},
+            {"id": "github", "name": "GitHub",
+             "description": "issues + PRs",
+             "category": "dev",
+             "install": {"method": "npx",
+                         "package": "@modelcontextprotocol/server-github"},
+             "secrets": ["GITHUB_TOKEN"],
+             "recommended": True},
+        ],
+    }
+    (home / "Agentik_SSOT" / "mcp" / "mcp-catalog.yaml").write_text(
+        yaml.safe_dump(cat, sort_keys=False))
+
+
+def _seed_mcp_config(home: Path) -> None:
+    merge_mcp_config(home, {"id": "filesystem", "secret_refs": [], "enabled": True})
+    merge_mcp_config(home, {"id": "github", "secret_refs": ["GITHUB_TOKEN"],
+                            "enabled": True})
+
+
+def _seed_providers(home: Path) -> None:
+    import yaml
+    reg = {
+        "version": 1,
+        "providers": [{"id": "claude", "adapter": "claude"}],
+    }
+    (home / "Agentik_Providers" / "registry.yaml").write_text(
+        yaml.safe_dump(reg, sort_keys=False))
+
+
+# --------------------------------------------------------------------------
+# 1. ToolRegistry — install / list / remove + idempotent save/load
+# --------------------------------------------------------------------------
+
+
+def test_registry_install_list_remove():
+    home = _seed_home()
+    try:
+        reg = ToolRegistry.load(home)
+        assert reg.list() == []
+
+        t = Tool(name="filesystem", version="1.2.3",
+                 path="Agentik_Tools/filesystem/",
+                 invoke="Agentik_Tools/filesystem/bin/server-filesystem",
+                 source="mcp:filesystem")
+        reg.install(t)
+        reg.save(home)
+        assert reg.installed_path("filesystem") == home / "Agentik_Tools" / "filesystem"
+
+        # round-trip
+        reg2 = ToolRegistry.load(home)
+        assert len(reg2.list()) == 1
+        assert reg2.get("filesystem").version == "1.2.3"
+
+        # remove
+        assert reg2.remove("filesystem") is True
+        reg2.save(home)
+        assert ToolRegistry.load(home).list() == []
+    finally:
+        shutil.rmtree(home, ignore_errors=True)
+
+
+# --------------------------------------------------------------------------
+# 2. catalog round-trip
+# --------------------------------------------------------------------------
+
+
+def test_catalog_loads():
+    home = _seed_home()
+    try:
+        _seed_catalog(home)
+        cat = load_catalog(home)
+        ids = {e["id"] for e in cat["catalog"]}
+        assert ids == {"filesystem", "github"}
+    finally:
+        shutil.rmtree(home, ignore_errors=True)
+
+
+# --------------------------------------------------------------------------
+# 3. ClaudeCodeAdapter.project() — full projection
+# --------------------------------------------------------------------------
+
+
+def test_claude_code_projection():
+    home = _seed_home()
+    try:
+        # seed an SSOT
+        _seed_skill(home, "frontend-design",
+                    "# Frontend design\n\nProduction-grade UI.\n")
+        _seed_command(home, "uiuxaudit",
+                      "# /uiuxaudit\n\nUI/UX forensic audit.\n")
+        _seed_agent(home, "oracle",
+                    "# Oracle\n\nClassify and route.\n")
+        _seed_hook(home, "stop.json",
+                   {"Stop": [{"matcher": "*", "hooks": [{"type": "command",
+                                                          "command": "echo stop"}]}]})
+        _seed_catalog(home)
+        _seed_mcp_config(home)
+        _seed_providers(home)
+
+        # pre-register one tool so .mcp.json gets a real command path
+        reg = ToolRegistry.load(home)
+        reg.install(Tool(
+            name="filesystem",
+            path="Agentik_Tools/filesystem/",
+            invoke="Agentik_Tools/filesystem/bin/server-filesystem",
+            source="mcp:filesystem",
+        ))
+        reg.save(home)
+
+        adapter = ClaudeCodeAdapter()
+        out = adapter.project(home)
+        assert out["projected"]
+        target = Path(out["target"])
+        assert target.is_dir()
+        assert (target / "skills" / "frontend-design" / "SKILL.md").exists()
+        assert "Production-grade UI" in (
+            target / "skills" / "frontend-design" / "SKILL.md").read_text()
+        assert (target / "commands" / "uiuxaudit.md").exists()
+        assert (target / "agents" / "oracle.md").exists()
+
+        # .mcp.json — both servers projected; filesystem has a local command,
+        # github falls back to npx.
+        mcp = json.loads((target / ".mcp.json").read_text())
+        servers = mcp["mcpServers"]
+        assert "filesystem" in servers and "github" in servers
+        assert servers["filesystem"]["command"].endswith(
+            "Agentik_Tools/filesystem/bin/server-filesystem")
+        assert servers["github"]["command"] == "npx"
+        assert "@modelcontextprotocol/server-github" in servers["github"]["args"]
+        # secret refs projected as env placeholders
+        assert servers["github"]["env"] == {"GITHUB_TOKEN": "${GITHUB_TOKEN}"}
+
+        # settings.json — hooks block merged
+        settings = json.loads((target / "settings.json").read_text())
+        assert "Stop" in settings["hooks"]
+
+        # idempotency: re-running produces the same outcome
+        out2 = adapter.project(home)
+        assert out2["skills_written"] == out["skills_written"]
+        assert out2["mcp_servers"] == out["mcp_servers"]
+        # the .mcp.json content stays the same
+        mcp2 = json.loads((target / ".mcp.json").read_text())
+        assert mcp == mcp2
+    finally:
+        shutil.rmtree(home, ignore_errors=True)
+
+
+# --------------------------------------------------------------------------
+# 4. SyncEngine.sync_all() over the providers registry
+# --------------------------------------------------------------------------
+
+
+def test_sync_engine_iterates_providers():
+    home = _seed_home()
+    try:
+        _seed_skill(home, "frontend-design", "# Skill\n")
+        _seed_catalog(home)
+        _seed_mcp_config(home)
+        # both claude (real adapter) and glm (stub adapter)
+        import yaml
+        (home / "Agentik_Providers" / "registry.yaml").write_text(yaml.safe_dump({
+            "version": 1,
+            "providers": [{"id": "claude"}, {"id": "glm"}],
+        }))
+        outcomes = SyncEngine().sync_all(home)
+        by_id = {o["provider"]: o for o in outcomes}
+        assert by_id["claude-code"]["projected"] is True
+        assert by_id["glm"]["projected"] is False
+        assert "no native projection" in by_id["glm"]["reason"]
+    finally:
+        shutil.rmtree(home, ignore_errors=True)
+
+
+# --------------------------------------------------------------------------
+# 5. CLI: `omega sync` returns 0
+# --------------------------------------------------------------------------
+
+
+def test_cli_sync_returns_zero(monkeypatch=None):
+    home = _seed_home()
+    try:
+        _seed_skill(home, "frontend-design", "# Skill\n")
+        _seed_catalog(home)
+        _seed_mcp_config(home)
+        _seed_providers(home)
+
+        import os
+        old = os.environ.get("OMEGA_HOME")
+        os.environ["OMEGA_HOME"] = str(home)
+        try:
+            rc = cli.main(["sync"])
+        finally:
+            if old is None:
+                os.environ.pop("OMEGA_HOME", None)
+            else:
+                os.environ["OMEGA_HOME"] = old
+        assert rc == 0
+    finally:
+        shutil.rmtree(home, ignore_errors=True)
+
+
+# --------------------------------------------------------------------------
+# 6. CLI: `omega tool list` returns 0 on empty registry
+# --------------------------------------------------------------------------
+
+
+def test_cli_tool_list_empty():
+    home = _seed_home()
+    try:
+        import os
+        old = os.environ.get("OMEGA_HOME")
+        os.environ["OMEGA_HOME"] = str(home)
+        try:
+            rc = cli.main(["tool", "list"])
+        finally:
+            if old is None:
+                os.environ.pop("OMEGA_HOME", None)
+            else:
+                os.environ["OMEGA_HOME"] = old
+        assert rc == 0
+    finally:
+        shutil.rmtree(home, ignore_errors=True)
+
+
+def _run_all() -> bool:
+    tests = [v for k, v in sorted(globals().items())
+             if k.startswith("test_") and callable(v)]
+    passed = 0
+    for t in tests:
+        t()
+        print(f"  PASS  {t.__name__}")
+        passed += 1
+    print(f"\n{passed}/{len(tests)} tools+sync tests passed")
+    return passed == len(tests)
+
+
+if __name__ == "__main__":
+    sys.exit(0 if _run_all() else 1)

package/omega/Agentik_Engine/tests/test_v06_features.py

@@ -0,0 +1,370 @@
+"""Tests for the v0.6.0 hardening batch — every new module gets coverage.
+
+We don't hit any real provider APIs in tests (no network). For
+validate.py and updater.py we monkeypatch urlopen; for smoke we run
+against MockProvider; for prune/backup/costs/audit_diff we exercise the
+pure-data paths.
+"""
+from __future__ import annotations
+
+import json
+import os
+import sqlite3
+import sys
+import tempfile
+import time
+import unittest
+from pathlib import Path
+from unittest import mock
+
+import yaml
+
+
+HERE = Path(__file__).resolve().parent
+sys.path.insert(0, str(HERE.parent))
+
+
+# ---------------------------------------------------------------------------
+# validate.py
+# ---------------------------------------------------------------------------
+
+
+class TestValidate(unittest.TestCase):
+    def test_validate_claude_no_key_returns_clean_fail(self):
+        from omega_engine.validate import validate_one
+        with tempfile.TemporaryDirectory() as td:
+            r = validate_one(td, "claude")
+            self.assertFalse(r.ok)
+            self.assertIn("no API key", r.detail)
+
+    def test_validate_unknown_provider(self):
+        from omega_engine.validate import validate_one
+        with tempfile.TemporaryDirectory() as td:
+            r = validate_one(td, "aliens")
+            self.assertFalse(r.ok)
+            self.assertIn("no validator", r.detail)
+
+    def test_validate_all_reads_router(self):
+        from omega_engine.validate import validate_all
+        with tempfile.TemporaryDirectory() as td:
+            home = Path(td)
+            (home / "Agentik_SSOT" / "providers").mkdir(parents=True)
+            (home / "Agentik_SSOT" / "providers" / "router.yaml").write_text(
+                yaml.safe_dump({"providers": [
+                    {"id": "claude", "enabled": True, "secret_ref": "CLAUDE_API_KEY"},
+                    {"id": "glm", "enabled": False, "secret_ref": "GLM_API_KEY"},
+                ]}))
+            results = validate_all(home)
+            # Only enabled providers are validated.
+            self.assertEqual([r.provider for r in results], ["claude"])
+
+    def test_validate_claude_with_mock_http_200(self):
+        from omega_engine.validate import _validate_claude
+        with mock.patch("urllib.request.urlopen") as fake_open:
+            fake_resp = mock.MagicMock()
+            fake_resp.__enter__ = lambda s: s
+            fake_resp.__exit__ = lambda *args: None
+            fake_resp.read = lambda: b'{"ok": true}'
+            fake_open.return_value = fake_resp
+            r = _validate_claude("sk-key")
+            self.assertTrue(r.ok)
+
+
+# ---------------------------------------------------------------------------
+# completions.py
+# ---------------------------------------------------------------------------
+
+
+class TestCompletions(unittest.TestCase):
+    def test_extract_tree_from_parser(self):
+        from omega_engine.cli import _build_parser
+        from omega_engine.completions import extract_tree
+        tree = extract_tree(_build_parser())
+        self.assertEqual(tree.name, "omega")
+        names = {n.name for n in tree.subcommands}
+        # A handful of the commands we know must be there.
+        for expected in ("doctor", "audit", "skill", "pursue", "cadence",
+                         "smoke", "backup", "validate"):
+            self.assertIn(expected, names)
+
+    def test_render_bash_contains_top_commands(self):
+        from omega_engine.cli import _build_parser
+        from omega_engine.completions import extract_tree, render_bash
+        text = render_bash(extract_tree(_build_parser()))
+        self.assertIn("complete -F _omega_complete omega", text)
+        self.assertIn("doctor", text)
+        self.assertIn("audit", text)
+
+    def test_write_all_creates_files(self):
+        from omega_engine.cli import _build_parser
+        from omega_engine.completions import extract_tree, write_all
+        with tempfile.TemporaryDirectory() as td:
+            paths = write_all(td, extract_tree(_build_parser()))
+            for shell in ("bash", "zsh", "fish"):
+                self.assertTrue(paths[shell].exists())
+
+
+# ---------------------------------------------------------------------------
+# updater.py
+# ---------------------------------------------------------------------------
+
+
+class TestUpdater(unittest.TestCase):
+    def test_parse_semver_handles_prerelease(self):
+        from omega_engine.updater import _parse_semver
+        self.assertEqual(_parse_semver("1.2.3"), (1, 2, 3))
+        self.assertEqual(_parse_semver("1.2.3-beta.1"), (1, 2, 3))
+        self.assertEqual(_parse_semver("v0.4.0"), (0, 4, 0))  # leading v → 0
+        self.assertEqual(_parse_semver("garbage"), (0, 0, 0))
+
+    def test_check_returns_outdated_when_newer(self):
+        from omega_engine.updater import check_for_updates
+        with mock.patch("urllib.request.urlopen") as fake_open:
+            fake_resp = mock.MagicMock()
+            fake_resp.__enter__ = lambda s: s
+            fake_resp.__exit__ = lambda *args: None
+            fake_resp.read = lambda: json.dumps({
+                "dist-tags": {"latest": "1.0.0"},
+            }).encode()
+            fake_open.return_value = fake_resp
+            info = check_for_updates("0.5.0")
+            self.assertTrue(info.is_outdated)
+            self.assertEqual(info.latest, "1.0.0")
+
+    def test_check_returns_uptodate(self):
+        from omega_engine.updater import check_for_updates
+        with mock.patch("urllib.request.urlopen") as fake_open:
+            fake_resp = mock.MagicMock()
+            fake_resp.__enter__ = lambda s: s
+            fake_resp.__exit__ = lambda *args: None
+            fake_resp.read = lambda: json.dumps({
+                "dist-tags": {"latest": "0.5.0"},
+            }).encode()
+            fake_open.return_value = fake_resp
+            info = check_for_updates("0.5.0")
+            self.assertFalse(info.is_outdated)
+
+
+# ---------------------------------------------------------------------------
+# smoke.py
+# ---------------------------------------------------------------------------
+
+
+class TestSmoke(unittest.TestCase):
+    def test_smoke_passes_against_mock(self):
+        from omega_engine.smoke import run_smoke
+        with tempfile.TemporaryDirectory() as td:
+            result = run_smoke(omega_home=td)
+            self.assertTrue(result.passed,
+                            msg=f"smoke failed: {result.detail}")
+            self.assertEqual(result.final_state, "completed")
+            self.assertGreater(result.events_recorded, 0)
+
+
+# ---------------------------------------------------------------------------
+# prune.py
+# ---------------------------------------------------------------------------
+
+
+class TestPrune(unittest.TestCase):
+    def _seed_telegram_history(self, home: Path, *, old_count: int, new_count: int):
+        from omega_engine.telegram_history import _connect, record_inbound
+        # Now-recent messages.
+        for i in range(new_count):
+            record_inbound(home, topic_id=1, text=f"new-{i}")
+        # Artificially old rows.
+        conn = _connect(home)
+        for i in range(old_count):
+            conn.execute(
+                "INSERT INTO messages (topic_id, role, text, message_id, timestamp) "
+                "VALUES (?, ?, ?, ?, ?)",
+                (1, "user", f"old-{i}", None, 0),
+            )
+        conn.commit()
+        conn.close()
+
+    def test_prune_telegram_dry_run_doesnt_delete(self):
+        from omega_engine.prune import prune_telegram
+        with tempfile.TemporaryDirectory() as td:
+            self._seed_telegram_history(Path(td), old_count=3, new_count=2)
+            report = prune_telegram(td, older_than_days=30, dry_run=True)
+            self.assertEqual(report.rows_deleted, 3)
+            self.assertTrue(report.dry_run)
+            # Verify nothing was actually deleted.
+            from omega_engine.telegram_history import recent_messages
+            still = recent_messages(td, topic_id=1, limit=100)
+            self.assertEqual(len(still), 5)
+
+    def test_prune_telegram_yes_actually_deletes(self):
+        from omega_engine.prune import prune_telegram
+        from omega_engine.telegram_history import recent_messages
+        with tempfile.TemporaryDirectory() as td:
+            self._seed_telegram_history(Path(td), old_count=3, new_count=2)
+            report = prune_telegram(td, older_than_days=30, dry_run=False)
+            self.assertEqual(report.rows_deleted, 3)
+            still = recent_messages(td, topic_id=1, limit=100)
+            self.assertEqual(len(still), 2)
+
+    def test_prune_all_returns_one_per_target(self):
+        from omega_engine.prune import prune_all
+        with tempfile.TemporaryDirectory() as td:
+            reports = prune_all(td, older_than_days=30, dry_run=True)
+            targets = [r.target for r in reports]
+            self.assertEqual(targets, ["events", "audits", "telegram", "sessions"])
+
+
+# ---------------------------------------------------------------------------
+# backup.py
+# ---------------------------------------------------------------------------
+
+
+class TestBackup(unittest.TestCase):
+    def _seed_tree(self, home: Path) -> None:
+        # Minimal backupable structure
+        (home / "Agentik_Runtime" / "eventlog").mkdir(parents=True)
+        (home / "Agentik_Runtime" / "eventlog" / "omega.db").write_text("fake-db")
+        (home / "Agentik_Extra" / "etc" / "secrets").mkdir(parents=True)
+        (home / "Agentik_Extra" / "etc" / "secrets" / "x.age").write_text("encrypted")
+        (home / "Agentik_SSOT").mkdir(parents=True)
+        (home / "Agentik_SSOT" / "VERSION").write_text("0.5.0")
+        (home / "Agentik_Coding").mkdir(parents=True)
+        (home / "Agentik_Coding" / "projects.json").write_text("[]")
+
+    def test_backup_creates_tarball(self):
+        from omega_engine.backup import backup
+        with tempfile.TemporaryDirectory() as td:
+            home = Path(td) / "Omega"
+            home.mkdir()
+            self._seed_tree(home)
+            result = backup(home, out_dir=Path(td))
+            self.assertTrue(result.bundle.exists())
+            self.assertGreater(result.bytes, 0)
+            self.assertFalse(result.encrypted)
+
+    def test_backup_then_restore_roundtrip(self):
+        from omega_engine.backup import backup, restore
+        with tempfile.TemporaryDirectory() as td:
+            home = Path(td) / "Omega"
+            home.mkdir()
+            self._seed_tree(home)
+            result = backup(home, out_dir=Path(td))
+
+            # Restore into a clean tree.
+            target = Path(td) / "restored"
+            target.mkdir()
+            r = restore(result.bundle, target=target)
+            self.assertGreater(r.files, 0)
+            self.assertTrue((target / "Agentik_SSOT" / "VERSION").exists())
+            self.assertEqual(
+                (target / "Agentik_SSOT" / "VERSION").read_text(), "0.5.0",
+            )
+
+    def test_verify_passes_on_clean_bundle(self):
+        from omega_engine.backup import backup, verify
+        with tempfile.TemporaryDirectory() as td:
+            home = Path(td) / "Omega"
+            home.mkdir()
+            self._seed_tree(home)
+            result = backup(home, out_dir=Path(td))
+            v = verify(result.bundle)
+            self.assertTrue(v["ok"])
+
+
+# ---------------------------------------------------------------------------
+# costs.py
+# ---------------------------------------------------------------------------
+
+
+class TestCosts(unittest.TestCase):
+    def test_estimate_cost_claude(self):
+        from omega_engine.costs import estimate_cost
+        # 1M in + 1M out on claude-sonnet → 3 + 15 = 18 USD
+        cost = estimate_cost(
+            "claude", input_tokens=1_000_000, output_tokens=1_000_000,
+            model="claude-sonnet-4-6",
+        )
+        self.assertAlmostEqual(cost, 18.0, places=2)
+
+    def test_estimate_cost_unknown_provider_zero(self):
+        from omega_engine.costs import estimate_cost
+        self.assertEqual(
+            estimate_cost("not-real", input_tokens=1000, output_tokens=1000),
+            0.0,
+        )
+
+    def test_rate_card_summary_includes_known_providers(self):
+        from omega_engine.costs import rate_card_summary
+        s = rate_card_summary()
+        for p in ("claude", "openai", "glm", "deepseek"):
+            self.assertIn(p, s["providers"])
+
+
+# ---------------------------------------------------------------------------
+# audit_diff.py
+# ---------------------------------------------------------------------------
+
+
+class TestAuditDiff(unittest.TestCase):
+    def test_diff_classifies_fixed_new_persist_regressed(self):
+        from omega_engine.audit_diff import diff_runs
+        from omega_engine.audits.history import (
+            AuditRun, make_run_id, now, record_run,
+        )
+        with tempfile.TemporaryDirectory() as td:
+            base = now()
+            f_fixed = {"phase": "p", "location": "a.py:1",
+                       "message": "bug A", "severity": "high"}
+            f_persist = {"phase": "p", "location": "b.py:1",
+                         "message": "bug B", "severity": "medium"}
+            f_regressed1 = {"phase": "p", "location": "c.py:1",
+                            "message": "bug C", "severity": "low"}
+            f_regressed2 = {"phase": "p", "location": "c.py:1",
+                            "message": "bug C", "severity": "high"}
+            f_new = {"phase": "p", "location": "d.py:1",
+                     "message": "bug D", "severity": "medium"}
+
+            record_run(td, AuditRun(
+                run_id="ar-1", audit_id="codeaudit", scope=".",
+                timestamp=base, score=70, verified=False, finding_count=3,
+                verdict={"findings": [f_fixed, f_persist, f_regressed1]},
+            ))
+            record_run(td, AuditRun(
+                run_id="ar-2", audit_id="codeaudit", scope=".",
+                timestamp=base + 1, score=80, verified=False, finding_count=3,
+                verdict={"findings": [f_persist, f_regressed2, f_new]},
+            ))
+            d = diff_runs(td, "ar-1", "ar-2")
+            self.assertEqual(d.delta, 10)
+            self.assertEqual(len(d.fixed), 1)
+            self.assertEqual(d.fixed[0]["location"], "a.py:1")
+            self.assertEqual(len(d.new), 1)
+            self.assertEqual(d.new[0]["location"], "d.py:1")
+            self.assertEqual(len(d.persist), 2)        # b.py + c.py both in both runs
+            self.assertEqual(len(d.regressed), 1)
+            self.assertEqual(d.regressed[0]["location"], "c.py:1")
+
+    def test_diff_unknown_run_raises(self):
+        from omega_engine.audit_diff import diff_runs
+        with tempfile.TemporaryDirectory() as td:
+            with self.assertRaises(KeyError):
+                diff_runs(td, "missing-1", "missing-2")
+
+
+# ---------------------------------------------------------------------------
+# ssh-key-rotate template ships
+# ---------------------------------------------------------------------------
+
+
+class TestSshRotateTemplate(unittest.TestCase):
+    def test_template_present_and_parseable(self):
+        REPO = Path(__file__).resolve().parents[3]
+        tmpl = REPO / "bootstrap" / "templates" / "autonomous" / "ssh-key-rotate.yaml"
+        self.assertTrue(tmpl.exists())
+        data = yaml.safe_load(tmpl.read_text())
+        self.assertEqual(data["id"], "ssh-key-rotate")
+        self.assertFalse(data["enabled"])  # opt-in by design
+        self.assertEqual(data["trigger"]["type"], "cron")
+
+
+if __name__ == "__main__":
+    unittest.main(verbosity=2)