@aifabrix/builder 2.54.1 → 2.55.2

package/lib/role-assistant/test-cases-bid.js

@@ -5,6 +5,8 @@
 
 'use strict';
 
+const { skipRow } = require('./test-case-assertion-row');
+
 function asArray(value) {
   return Array.isArray(value) ? value : [];
 }
@@ -71,10 +73,71 @@ function collectBidSchemaAssertions(expectedBid, observed, assertions, soft) {
   }
 }
 
-function assertDefinitionHash(expectedBid, observed, assertions, soft) {
-  if (expectedBid.requireDefinitionHash !== true) {
+function isDatasourceRecord(value) {
+  const key = String(value.key || value.datasourceKey || '').trim();
+  return Boolean(key && (Array.isArray(value.capabilities) || value.entityType || value.resourceType));
+}
+
+function nestedBidContainers(value) {
+  const nested = [];
+  if (Array.isArray(value.datasources)) {
+    nested.push(value.datasources);
+  }
+  if (value.spec && typeof value.spec === 'object') {
+    nested.push(value.spec);
+  }
+  if (value.emitted && typeof value.emitted === 'object') {
+    nested.push(value.emitted);
+  }
+  if (value.bid && typeof value.bid === 'object') {
+    nested.push(value.bid);
+  }
+  return nested;
+}
+
+function collectBidObjects(value, acc) {
+  if (Array.isArray(value)) {
+    value.forEach((item) => collectBidObjects(item, acc));
     return;
   }
+  if (!value || typeof value !== 'object') {
+    return;
+  }
+  nestedBidContainers(value).forEach((child) => collectBidObjects(child, acc));
+  if (isDatasourceRecord(value)) {
+    acc.push(value);
+  }
+}
+
+function bidBlob(observed) {
+  return observed.emitted || observed.emitRow || observed.applyRow || {};
+}
+
+function datasourceKeysFromBid(observed) {
+  const objects = [];
+  collectBidObjects(bidBlob(observed), objects);
+  return new Set(objects.map((row) => String(row.key || row.datasourceKey || '').trim()).filter(Boolean));
+}
+
+function datasourceHasCapability(observed, datasource, capKey) {
+  const objects = [];
+  collectBidObjects(bidBlob(observed), objects);
+  const match = objects.find((row) => String(row.key || row.datasourceKey || '') === datasource);
+  const caps = asArray(match && match.capabilities);
+  return caps.some((cap) => String((cap && cap.key) || cap || '') === capKey);
+}
+
+function pushBooleanBidFlag(expectedBid, field, observed, assertions, soft, assertFn) {
+  if (expectedBid[field] === false) {
+    assertions.push(skipRow(`expected.bid.${field}`, `${field} is false — check skipped.`));
+    return;
+  }
+  if (expectedBid[field] === true) {
+    assertFn(expectedBid, observed, assertions, soft);
+  }
+}
+
+function assertDefinitionHash(expectedBid, observed, assertions, soft) {
   const { emitRow, applyRow, emitted } = observed;
   const hash =
     (emitted && emitted.definitionHash) ||
@@ -112,11 +175,60 @@ function assertSuiteRunId(expectedBid, observed, assertions, soft) {
 }
 
 function collectBidProvenanceAssertions(expectedBid, observed, assertions, soft) {
-  assertDefinitionHash(expectedBid, observed, assertions, soft);
-  assertSuiteRunId(expectedBid, observed, assertions, soft);
+  pushBooleanBidFlag(expectedBid, 'requireDefinitionHash', observed, assertions, soft, assertDefinitionHash);
+  pushBooleanBidFlag(expectedBid, 'requireSuiteRunId', observed, assertions, soft, assertSuiteRunId);
+}
+
+function collectBidDatasourceAssertions(expectedBid, observed, assertions, soft) {
+  if (Array.isArray(expectedBid.minDatasources)) {
+    collectMinDatasources(expectedBid.minDatasources, observed, assertions, soft);
+  }
+  if (expectedBid.requireCapability && typeof expectedBid.requireCapability === 'object') {
+    collectRequireCapability(expectedBid.requireCapability, observed, assertions, soft);
+  }
+}
+
+function collectMinDatasources(requiredKeys, observed, assertions, soft) {
+  if (requiredKeys.length === 0) {
+    assertions.push(skipRow('expected.bid.minDatasources', 'minDatasources is empty — nothing to assert.'));
+    return;
+  }
+  const actual = datasourceKeysFromBid(observed);
+  for (const raw of requiredKeys) {
+    const key = String(raw || '').trim();
+    const passed = hasEmitOrApply(observed) && actual.has(key);
+    pushBidAssertion(
+      assertions,
+      soft,
+      `expected.bid.minDatasources:${key}`,
+      passed,
+      `BID lists datasource "${key}".`,
+      `BID does not list required datasource "${key}".`
+    );
+  }
+}
+
+function collectRequireCapability(spec, observed, assertions, soft) {
+  const datasource = String(spec.datasource || '').trim();
+  const capKey = String(spec.key || '').trim();
+  const passed = hasEmitOrApply(observed) && datasourceHasCapability(observed, datasource, capKey);
+  pushBidAssertion(
+    assertions,
+    soft,
+    'expected.bid.requireCapability',
+    passed,
+    `BID datasource "${datasource}" lists capability "${capKey}".`,
+    `BID datasource "${datasource}" does not list capability "${capKey}".`
+  );
 }
 
 function collectBidPathAssertions(expectedBid, observed, assertions, soft) {
+  if (expectedBid.forbidGoldPaths === false) {
+    assertions.push(
+      skipRow('expected.bid.forbidGoldPaths', 'forbidGoldPaths is false — gold-path check skipped.')
+    );
+    return;
+  }
   if (expectedBid.forbidGoldPaths === true) {
     const { emitRow, applyRow, emitted } = observed;
     const blob = JSON.stringify(emitted || emitRow || applyRow || {});
@@ -146,6 +258,7 @@ function collectBidAssertions(expectedBid, observation, options = {}) {
   const soft = options.soft === true;
   collectBidSchemaAssertions(expectedBid, observed, assertions, soft);
   collectBidProvenanceAssertions(expectedBid, observed, assertions, soft);
+  collectBidDatasourceAssertions(expectedBid, observed, assertions, soft);
   collectBidPathAssertions(expectedBid, observed, assertions, soft);
   return assertions;
 }

package/lib/role-assistant/test-cases-evaluate.js

@@ -18,12 +18,41 @@ const {
   evaluateSearchExpectations,
   evaluateSkillsExpectations
 } = require('./test-cases-search');
+const { notesRow, withKind } = require('./test-case-assertion-row');
+
+const UNSAFE_FACT_SEGMENTS = new Set(['__proto__', 'prototype', 'constructor']);
+const WILDCARD_FACT_SEGMENTS = new Set(['*', '**']);
+
+function splitDottedPath(dottedPath) {
+  return String(dottedPath || '').split('.').filter((part) => part.length > 0);
+}
+
+function factPathSafetyMessage(parts) {
+  for (const part of parts) {
+    if (UNSAFE_FACT_SEGMENTS.has(part)) {
+      return `Fact path rejects prototype segment "${part}" before lookup.`;
+    }
+    if (WILDCARD_FACT_SEGMENTS.has(part)) {
+      return `Fact path rejects wildcard segment "${part}".`;
+    }
+    if (part === 'latest') {
+      return 'Fact path rejects latest-global record lookup.';
+    }
+  }
+  return null;
+}
 
 function getValueAtPath(obj, dottedPath) {
-  const parts = String(dottedPath || '').split('.').filter(Boolean);
+  const parts = splitDottedPath(dottedPath);
+  if (factPathSafetyMessage(parts)) {
+    return undefined;
+  }
   let cursor = obj;
   for (const key of parts) {
-    if (!cursor || typeof cursor !== 'object' || !(key in cursor)) {
+    if (cursor === null || cursor === undefined || typeof cursor !== 'object') {
+      return undefined;
+    }
+    if (!Object.prototype.hasOwnProperty.call(cursor, key)) {
       return undefined;
     }
     cursor = cursor[key];
@@ -31,6 +60,10 @@ function getValueAtPath(obj, dottedPath) {
   return cursor;
 }
 
+function stringifyObserved(value) {
+  return value === undefined ? 'missing' : JSON.stringify(value);
+}
+
 function evaluateLifecycleStateExpectation(expectedState, observedState) {
   if (!expectedState) {
     return null;
@@ -46,7 +79,7 @@ function evaluateLifecycleStateExpectation(expectedState, observedState) {
   };
 }
 
-function evaluateCapabilityExpectations(requiredList, observedCapabilities) {
+function evaluateCapabilityExpectations(kind, requiredList, observedCapabilities) {
   if (!Array.isArray(requiredList) || requiredList.length === 0) {
     return [];
   }
@@ -55,29 +88,39 @@ function evaluateCapabilityExpectations(requiredList, observedCapabilities) {
     const key = String(capability || '').trim();
     const passed = observedSet.has(key);
     return {
-      id: `expected.capabilities.required:${key}`,
+      id: `expected.capabilities.${kind}:${key}`,
       passed,
       message: passed
-        ? `Required capability "${key}" observed.`
-        : `Required capability "${key}" was not observed.`
+        ? `${kind === 'allowed' ? 'Allowed' : 'Required'} capability "${key}" observed.`
+        : `${kind === 'allowed' ? 'Allowed' : 'Required'} capability "${key}" was not observed.`
     };
   });
 }
 
+function evaluateOneFact(factPath, expectedValue, observation) {
+  const parts = splitDottedPath(factPath);
+  const safety = factPathSafetyMessage(parts);
+  const id = `expected.facts:${factPath}`;
+  if (safety) {
+    return { id, passed: false, message: safety };
+  }
+  const actualValue = getValueAtPath(observation, factPath);
+  const passed = JSON.stringify(actualValue) === JSON.stringify(expectedValue);
+  return {
+    id,
+    passed,
+    message: passed
+      ? `Fact "${factPath}" matched expected value.`
+      : `Fact "${factPath}" expected ${JSON.stringify(expectedValue)} but got ${stringifyObserved(actualValue)}.`
+  };
+}
+
 function evaluateFactExpectations(expectedFacts, observation) {
   if (!expectedFacts || typeof expectedFacts !== 'object' || Array.isArray(expectedFacts)) {
     return [];
   }
   return Object.entries(expectedFacts).map(([factPath, expectedValue]) => {
-    const actualValue = getValueAtPath(observation, factPath);
-    const passed = JSON.stringify(actualValue) === JSON.stringify(expectedValue);
-    return {
-      id: `expected.facts:${factPath}`,
-      passed,
-      message: passed
-        ? `Fact "${factPath}" matched expected value.`
-        : `Fact "${factPath}" expected ${JSON.stringify(expectedValue)} but got ${JSON.stringify(actualValue)}.`
-    };
+    return evaluateOneFact(factPath, expectedValue, observation);
   });
 }
 
@@ -86,6 +129,11 @@ function evaluateProhibitedExpectations(prohibited, observation) {
     return [];
   }
   return prohibited.map((factPath) => {
+    const parts = splitDottedPath(factPath);
+    const safety = factPathSafetyMessage(parts);
+    if (safety) {
+      return { id: `expected.prohibited:${factPath}`, passed: false, message: safety };
+    }
     const actualValue = getValueAtPath(observation, factPath);
     const passed = actualValue === undefined || actualValue === null || actualValue === false;
     return {
@@ -93,7 +141,7 @@ function evaluateProhibitedExpectations(prohibited, observation) {
       passed,
       message: passed
         ? `Prohibited marker "${factPath}" was not observed.`
-        : `Prohibited marker "${factPath}" observed: ${JSON.stringify(actualValue)}.`
+        : `Prohibited marker "${factPath}" observed: ${stringifyObserved(actualValue)}.`
     };
   });
 }
@@ -152,10 +200,74 @@ function softWrapFailedAssertion(assertion, soft) {
   return softWrapLifecycleAssertion(assertion, soft);
 }
 
-function collectCaseAssertions(expected, observation) {
+function collectSoftModifierRows(expected) {
+  const rows = [];
+  if (Object.prototype.hasOwnProperty.call(expected, 'soft')) {
+    rows.push(
+      notesRow(
+        'expected.soft',
+        expected.soft === true
+          ? 'soft: true — failures become warnings'
+          : 'soft: false — failures are blocking'
+      )
+    );
+  }
+  const notes = Array.isArray(expected.softNotes) ? expected.softNotes : [];
+  notes.forEach((item, index) => {
+    const text = typeof item === 'string'
+      ? item
+      : String((item && (item.description || item.note)) || JSON.stringify(item));
+    rows.push(notesRow(`expected.softNotes[${index}]`, text));
+  });
+  return rows;
+}
+
+function collectEvidenceContextRows(spec, prefix) {
+  if (!spec || typeof spec !== 'object' || Array.isArray(spec)) {
+    return [];
+  }
+  const rows = [];
+  if (spec.roleKey) {
+    rows.push(notesRow(`${prefix}.roleKey`, `Evidence roleKey "${spec.roleKey}" (preflight context).`));
+  }
+  if (spec.resourceType) {
+    rows.push(
+      notesRow(`${prefix}.resourceType`, `Evidence resourceType "${spec.resourceType}" (preflight context).`)
+    );
+  }
+  if (spec.requireStatus) {
+    rows.push(
+      notesRow(`${prefix}.requireStatus`, `Evidence requireStatus "${spec.requireStatus}" (preflight context).`)
+    );
+  }
+  return rows;
+}
+
+function collectCapabilityAssertions(capabilities, observedCapabilities, soft) {
+  const spec = capabilities && typeof capabilities === 'object' ? capabilities : {};
+  const rows = [
+    ...evaluateCapabilityExpectations('required', spec.required, observedCapabilities),
+    ...evaluateCapabilityExpectations('allowed', spec.allowed, observedCapabilities),
+    ...evaluateForbiddenCapabilities(spec.forbidden, observedCapabilities)
+  ];
+  return rows.map((row) => softWrapFailedAssertion(row, soft));
+}
+
+function evaluateExecutionIntegrity(observation) {
+  if (!observation.workResultError) {
+    return null;
+  }
+  return {
+    id: 'execution.integrity',
+    passed: false,
+    message: `Execution did not produce a readable result: ${observation.workResultError}`
+  };
+}
+
+function collectCaseAssertions(expected, observation, preflight = {}) {
   const soft = expected.soft === true;
   const observedCapabilities = observation.capabilities?.observed || [];
-  const assertions = [];
+  const assertions = [evaluateExecutionIntegrity(observation)].filter(Boolean);
   const lifecycleAssertion = softWrapFailedAssertion(
     evaluateLifecycleStateExpectation(expected.lifecycleState, observation.lifecycleState),
     soft
@@ -163,31 +275,35 @@ function collectCaseAssertions(expected, observation) {
   if (lifecycleAssertion) {
     assertions.push(lifecycleAssertion);
   }
+  assertions.push(...collectSoftModifierRows(expected));
+  assertions.push(...collectCapabilityAssertions(expected.capabilities, observedCapabilities, soft));
   assertions.push(
-    ...evaluateCapabilityExpectations(
-      expected?.capabilities?.required,
-      observedCapabilities
-    ).map((row) => softWrapFailedAssertion(row, soft))
+    ...evaluateFactExpectations(expected.facts, observation).map((row) =>
+      softWrapFailedAssertion(row, soft)
+    )
   );
   assertions.push(
-    ...evaluateForbiddenCapabilities(
-      expected?.capabilities?.forbidden,
-      observedCapabilities
-    ).map((row) => softWrapFailedAssertion(row, soft))
+    ...evaluateProhibitedExpectations(expected.prohibited, observation).map((row) =>
+      softWrapFailedAssertion(row, soft)
+    )
   );
-  assertions.push(...evaluateFactExpectations(expected.facts, observation));
-  assertions.push(...evaluateProhibitedExpectations(expected.prohibited, observation));
   assertions.push(...evaluateHonestyExpectations(expected.honesty, observation, { soft }));
   assertions.push(...collectBidAssertions(expected.bid, observation, { soft }));
   assertions.push(...evaluateEvidenceExpectations(expected.evidence, observation));
+  assertions.push(...collectEvidenceContextRows(expected.evidence, 'expected.evidence'));
+  assertions.push(...collectEvidenceContextRows(preflight.evidence, 'preflight.evidence'));
   assertions.push(...evaluateSearchExpectations(expected.search, observation));
   assertions.push(...evaluateSkillsExpectations(expected.skills, observation));
-  return assertions;
+  return assertions.map(withKind);
 }
 
 function evaluateRoleAssistantTestCase(testCase, result, lifecycleVerdict, portalUrl) {
   const observation = buildCaseObservation(result, lifecycleVerdict, portalUrl);
-  const assertions = collectCaseAssertions(testCase.expected || {}, observation);
+  const assertions = collectCaseAssertions(
+    testCase.expected || {},
+    observation,
+    testCase.preflight || {}
+  );
   const failed = assertions.filter((row) => !row.passed);
   return {
     caseId: testCase.caseId,
@@ -202,5 +318,7 @@ function evaluateRoleAssistantTestCase(testCase, result, lifecycleVerdict, porta
 }
 
 module.exports = {
-  evaluateRoleAssistantTestCase
+  evaluateRoleAssistantTestCase,
+  evaluateFactExpectations,
+  getValueAtPath
 };

package/lib/role-assistant/test-cases-evidence.js

@@ -55,6 +55,39 @@ function isActiveStatus(status, requiredStatus) {
   return status === requiredStatus;
 }
 
+/**
+ * Dataplane Evidence is append-new versioned, never mutated in place
+ * (dataplane 506.2): once a row's content changes, its literal `key` is
+ * archived permanently and a new `<key>__vN` row becomes the current
+ * identity. A case authored against the original literal key must still
+ * resolve against that current versioned successor, not report it missing.
+ * `rows` here are already scoped to the case's roleKey+resourceType+status
+ * by `loadLiveEvidenceRows`, so any row whose key is exactly `<desired>__vN`
+ * is unambiguously that key's current version.
+ */
+function findVersionedSuccessor(desiredKey, byKey) {
+  const prefix = `${desiredKey}__v`;
+  let best = null;
+  let bestVersion = -1;
+  for (const [key, row] of byKey) {
+    if (!key.startsWith(prefix)) {
+      continue;
+    }
+    const suffix = key.slice(prefix.length);
+    const version = Number(suffix);
+    if (!Number.isInteger(version) || version <= bestVersion) {
+      continue;
+    }
+    best = row;
+    bestVersion = version;
+  }
+  return best;
+}
+
+function resolveEvidenceRow(desiredKey, byKey) {
+  return byKey.get(desiredKey) || findVersionedSuccessor(desiredKey, byKey);
+}
+
 function findMissingEvidenceKeys(spec, rows) {
   const byKey = new Map();
   for (const row of rows) {
@@ -65,7 +98,7 @@ function findMissingEvidenceKeys(spec, rows) {
   }
   const missing = [];
   for (const key of spec.requiredKeys) {
-    const row = byKey.get(key);
+    const row = resolveEvidenceRow(key, byKey);
     if (!row) {
       missing.push(`${key} (not in dataplane)`);
       continue;
@@ -133,11 +166,15 @@ function evaluateEvidenceExpectations(evidenceSpec, observation) {
     return [];
   }
   const preflight = observation?.evidencePreflight || {};
-  const liveKeys = new Set(
-    (Array.isArray(preflight.rows) ? preflight.rows : []).map(rowKey).filter(Boolean)
-  );
+  const liveByKey = new Map();
+  for (const row of Array.isArray(preflight.rows) ? preflight.rows : []) {
+    const key = rowKey(row);
+    if (key) {
+      liveByKey.set(key, row);
+    }
+  }
   return requiredKeys.map((key) => {
-    const passed = liveKeys.has(key);
+    const passed = Boolean(resolveEvidenceRow(key, liveByKey));
     return {
       id: `expected.evidence.requiredKeys:${key}`,
       passed,
@@ -168,6 +205,8 @@ function evaluateForbiddenCapabilities(forbiddenList, observedCapabilities) {
 
 module.exports = {
   evidenceSpecFromCase,
+  findVersionedSuccessor,
+  resolveEvidenceRow,
   findMissingEvidenceKeys,
   assertRoleAssistantEvidencePreflight,
   evaluateEvidenceExpectations,