@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.12 → 0.1.28

package/packages/repo-controls/package/adl-compliance/src/adl_compliance/checks/repository/lockfile_integrity/test_declared_paths.py

@@ -0,0 +1,523 @@
+"""REP-002 grades the manifest and lockfile paths a repository DECLARES.
+
+`[controls.compliance.lockfiles]` in `adl-config.toml` reaches the engine as four
+comma-list declarations, a half (Bun, Cargo) being declared by a manifests list
+and a lockfiles list together:
+
+    bun-manifests / bun-lockfiles       `package.json` paths or globs / `bun.lock` paths
+    cargo-manifests / cargo-lockfiles   `Cargo.toml` paths or globs  / `Cargo.lock` paths
+
+Why this exists, measured on enact-combined (2026-10-01): its `typescript` tree is
+a brace union of directories, and its manifests sit at the repository ROOT and
+under `apps/*/` and `packages/*/`. The registry scope `<typescript>/package.json`
+expands to `{apps,packages,...}/package.json`, a ONE-level path that matches
+nothing, so the whole-tree run was could-not-run while a narrowed run passed. The
+declaration restates the scope (which files select the gate) and the grade (which
+lockfiles must exist) from the same lists.
+
+This file is separate from `test_check.py` on purpose: that module carries a
+module-level cargo skip and an autouse patch of `runner.lookup`, and nothing in it
+is edited here. Every test below that needs a real `cargo` says so.
+"""
+
+from __future__ import annotations
+
+import shutil
+from collections.abc import Mapping
+from pathlib import Path
+
+import pytest
+from fixture_trees import fixture_trees
+from helpers import corpus, corpus_files
+
+from adl_compliance import runner
+from adl_compliance.checks.repository.lockfile_integrity import LockfileIntegrity
+from adl_compliance.core.context import Context, FileSet
+from adl_compliance.core.errors import CouldNotRun
+from adl_compliance.core.verdict import Outcome, Verdict
+from adl_compliance.policy.registry import load, policy_text
+
+ROW = load().by_id("REP-002")
+CLEAN_CORPUS = corpus("repository", "lockfile-integrity") / "clean"
+
+requires_cargo = pytest.mark.skipif(shutil.which("cargo") is None, reason="cargo is not installed")
+
+# enact-combined's declared trees, as `adl-config.toml` states them.
+ENACT_TREES = {
+    "rust": "",
+    "frontend": "",
+    "typescript": "{apps,packages,workflows,infra,tests,dev,live-probes}",
+}
+# The declaration enact-combined needs (see .scratchpad/rep002-scope/enact-combined-patch.toml).
+BUN = {
+    "bun-manifests": "package.json,apps/*/package.json,packages/*/package.json",
+    "bun-lockfiles": "bun.lock",
+}
+CARGO = {
+    "cargo-manifests": "backend/Cargo.toml",
+    "cargo-lockfiles": "backend/Cargo.lock",
+}
+
+ENACT_FILES = {
+    "README.md": "# repo\n",
+    "package.json": "{}\n",
+    "bun.lock": "lock\n",
+    "apps/web/package.json": "{}\n",
+    "apps/server/package.json": "{}\n",
+    "packages/x/package.json": "{}\n",
+}
+IN_SCOPE = 5  # package.json, bun.lock, and the three nested package.json files
+
+
+def write(root: Path, files: Mapping[str, str]) -> tuple[str, ...]:
+    for relative, body in files.items():
+        target = root / relative
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_text(body, encoding="utf-8")
+    return tuple(sorted(files))
+
+
+def grade(
+    root: Path,
+    files: tuple[str, ...],
+    *,
+    trees: Mapping[str, str],
+    declarations: Mapping[str, str],
+    given: tuple[str, ...] | None = None,
+    exhaustive: bool = True,
+    **kwargs: object,
+) -> Verdict:
+    """The real dispatch path. With `given`, a NARROWED run over the complete
+    `files` universe; without it, the hook's shape (the whole tree, exhaustive)."""
+    return runner.run(
+        ROW,
+        root,
+        files if given is None else given,
+        exhaustive=exhaustive and given is None,
+        universe=files,
+        declarations=declarations,
+        trees=trees,
+        declared_trees=trees,
+        **kwargs,  # type: ignore[arg-type]
+    )
+
+
+# ------------------------------------------------------------ the enact-combined shape
+
+
+def test_undeclared_the_enact_shape_is_still_could_not_run_on_a_whole_tree(tmp_path: Path) -> None:
+    """The default is unchanged: no declaration, no new behaviour. This is the
+    verdict that was measured live, kept as the pin that declaring nothing does
+    not move it."""
+    files = write(tmp_path, ENACT_FILES)
+    verdict = grade(tmp_path, files, trees=ENACT_TREES, declarations={})
+    assert verdict.outcome is Outcome.COULD_NOT_RUN, verdict.render()
+    assert "engine.scope matches no file on disk" in verdict.message
+
+
+def test_declared_the_enact_shape_is_clean_on_a_whole_tree(tmp_path: Path) -> None:
+    files = write(tmp_path, ENACT_FILES)
+    verdict = grade(tmp_path, files, trees=ENACT_TREES, declarations=BUN)
+    assert verdict.outcome is Outcome.CLEAN, verdict.render()
+    assert verdict.units == IN_SCOPE
+
+
+def test_declared_the_enact_shape_is_clean_on_a_narrowed_run(tmp_path: Path) -> None:
+    """One changed manifest selects the gate, and the gate is graded over every
+    declared path in the complete universe."""
+    files = write(tmp_path, ENACT_FILES)
+    verdict = grade(
+        tmp_path, files, trees=ENACT_TREES, declarations=BUN, given=("apps/web/package.json",)
+    )
+    assert verdict.outcome is Outcome.CLEAN, verdict.render()
+    assert verdict.units == IN_SCOPE
+
+
+def test_declared_a_changed_lockfile_alone_selects_the_gate(tmp_path: Path) -> None:
+    files = write(tmp_path, ENACT_FILES)
+    verdict = grade(tmp_path, files, trees=ENACT_TREES, declarations=BUN, given=("bun.lock",))
+    assert verdict.outcome is Outcome.CLEAN, verdict.render()
+    assert verdict.units == IN_SCOPE
+
+
+def test_declared_a_change_outside_every_declared_path_does_not_select_the_gate(
+    tmp_path: Path,
+) -> None:
+    """Selection follows the declaration. With nothing declared changed, the gate
+    does not apply: the missing lockfile below is not probed on this run."""
+    files = write(tmp_path, {**ENACT_FILES, "bun.lock": ""})
+    verdict = grade(tmp_path, files, trees=ENACT_TREES, declarations=BUN, given=("README.md",))
+    assert verdict.outcome is Outcome.CLEAN, verdict.render()
+    assert verdict.findings == ()
+
+
+def test_declared_the_lockfile_input_is_not_consulted(tmp_path: Path) -> None:
+    """The declaration drives the grade: a per-gate `bun_lock` input pointing at
+    nothing cannot fail a repository whose declared lockfile is present."""
+    files = write(tmp_path, ENACT_FILES)
+    verdict = grade(
+        tmp_path,
+        files,
+        trees=ENACT_TREES,
+        declarations=BUN,
+        inputs={"REP-002": {"bun_lock": tmp_path / "nowhere" / "bun.lock"}},
+    )
+    assert verdict.outcome is Outcome.CLEAN, verdict.render()
+
+
+# ----------------------------------------------------------------- the lockfile grade
+
+
+@pytest.mark.parametrize("body", [None, ""], ids=["missing", "empty"])
+def test_declared_a_missing_or_empty_lockfile_is_the_same_finding(
+    tmp_path: Path, body: str | None
+) -> None:
+    files = dict(ENACT_FILES)
+    if body is None:
+        del files["bun.lock"]
+    else:
+        files["bun.lock"] = body
+    verdict = grade(tmp_path, write(tmp_path, files), trees=ENACT_TREES, declarations=BUN)
+    assert verdict.outcome is Outcome.FINDINGS, verdict.render()
+    [finding] = verdict.findings
+    assert finding.rule == "LCK-001"
+    assert finding.path == "bun.lock"
+    assert finding.message == "missing bun.lock"
+    assert "(cd . && bun install)" in finding.fix
+
+
+def test_declared_and_undeclared_report_a_missing_lockfile_identically(tmp_path: Path) -> None:
+    """Same corpus, graded once through the tree default and once through the
+    declaration (with the tree pointed elsewhere, so only the declaration can
+    reach the file): the finding is equal, field for field."""
+    files = write(tmp_path, {"frontend/package.json": "{}\n", "frontend/bun.lock": ""})
+    undeclared = grade(
+        tmp_path, files, trees={"rust": "", "typescript": "frontend"}, declarations={}
+    )
+    declared = grade(
+        tmp_path,
+        files,
+        trees={"rust": "", "typescript": "elsewhere"},
+        declarations={"bun-manifests": "frontend/package.json", "bun-lockfiles": "frontend/bun.lock"},
+    )
+    assert undeclared.outcome is Outcome.FINDINGS, undeclared.render()
+    assert declared.findings == undeclared.findings
+
+
+def test_declared_two_present_lockfiles_are_clean(tmp_path: Path) -> None:
+    declarations = {
+        "bun-manifests": "package.json,infra/docker/opencode-stack/package.json",
+        "bun-lockfiles": "bun.lock,infra/docker/opencode-stack/bun.lock",
+    }
+    both = {
+        **ENACT_FILES,
+        "infra/docker/opencode-stack/package.json": "{}\n",
+        "infra/docker/opencode-stack/bun.lock": "lock\n",
+    }
+    verdict = grade(tmp_path, write(tmp_path, both), trees=ENACT_TREES, declarations=declarations)
+    assert verdict.outcome is Outcome.CLEAN, verdict.render()
+
+
+def test_declared_the_second_lockfile_missing_is_reported_by_its_own_path(tmp_path: Path) -> None:
+    declarations = {
+        "bun-manifests": "package.json,infra/docker/opencode-stack/package.json",
+        "bun-lockfiles": "bun.lock,infra/docker/opencode-stack/bun.lock",
+    }
+    files = {**ENACT_FILES, "infra/docker/opencode-stack/package.json": "{}\n"}
+    verdict = grade(tmp_path, write(tmp_path, files), trees=ENACT_TREES, declarations=declarations)
+    [finding] = verdict.findings
+    assert finding.path == "infra/docker/opencode-stack/bun.lock"
+    assert finding.message == "missing infra/docker/opencode-stack/bun.lock"
+    assert "(cd infra/docker/opencode-stack && bun install)" in finding.fix
+
+
+def test_declared_both_lockfiles_missing_reports_only_the_first(tmp_path: Path) -> None:
+    """check.sh's shape: the first problem ends the run."""
+    declarations = {
+        "bun-manifests": "package.json,infra/docker/opencode-stack/package.json",
+        "bun-lockfiles": "bun.lock,infra/docker/opencode-stack/bun.lock",
+    }
+    files = {k: v for k, v in ENACT_FILES.items() if k != "bun.lock"}
+    files["infra/docker/opencode-stack/package.json"] = "{}\n"
+    verdict = grade(tmp_path, write(tmp_path, files), trees=ENACT_TREES, declarations=declarations)
+    assert [f.path for f in verdict.findings] == ["bun.lock"]
+
+
+# ------------------------------------------------------ a declared glob that matches nothing
+
+
+@pytest.mark.parametrize("narrowed", [False, True], ids=["whole tree", "narrowed run"])
+@pytest.mark.parametrize("dead", ["tools/*/package.json", "nope/package.json"])
+def test_a_declared_manifest_matching_no_file_is_could_not_run_naming_it(
+    tmp_path: Path, dead: str, narrowed: bool
+) -> None:
+    files = write(tmp_path, ENACT_FILES)
+    declarations = {**BUN, "bun-manifests": f"package.json,{dead}"}
+    verdict = grade(
+        tmp_path,
+        files,
+        trees=ENACT_TREES,
+        declarations=declarations,
+        given=("package.json",) if narrowed else None,
+    )
+    assert verdict.outcome is Outcome.COULD_NOT_RUN, verdict.render()
+    assert "`bun-manifests`" in verdict.message
+    assert dead in verdict.message
+
+
+def test_a_dead_declaration_is_loud_even_though_other_declared_paths_match(
+    tmp_path: Path,
+) -> None:
+    """The scope is non-empty (the live entries match), so the runner's own
+    empty-scope guard is silent; only the per-declaration check can see it."""
+    files = write(tmp_path, ENACT_FILES)
+    verdict = grade(
+        tmp_path,
+        files,
+        trees=ENACT_TREES,
+        declarations={**BUN, "bun-manifests": "package.json,services/*/package.json"},
+    )
+    assert verdict.outcome is Outcome.COULD_NOT_RUN, verdict.render()
+    assert "services/*/package.json" in verdict.message
+    assert "matches no file on disk" not in verdict.message
+
+
+def test_the_check_itself_refuses_a_dead_declaration_given_a_complete_set(tmp_path: Path) -> None:
+    """Not only through the runner: a caller building a Context by hand gets the
+    same refusal, because the check is what knows what it was told to scan."""
+    ctx = Context(root=tmp_path, row=ROW, declarations=BUN | {"bun-manifests": "app/*/package.json"})
+    write(tmp_path, ENACT_FILES)
+    with pytest.raises(CouldNotRun) as raised:
+        tuple(LockfileIntegrity().run(ctx, FileSet(paths=tuple(sorted(ENACT_FILES)))))
+    assert "`bun-manifests`" in str(raised.value)
+    assert "app/*/package.json" in str(raised.value)
+
+
+# ------------------------------------------------------------- malformed declarations
+
+
+def bun(manifests: str = "package.json", lockfiles: str = "bun.lock") -> dict[str, str]:
+    return {"bun-manifests": manifests, "bun-lockfiles": lockfiles}
+
+
+def cargo(manifests: str = "backend/Cargo.toml", lockfiles: str = "backend/Cargo.lock") -> dict[str, str]:
+    return {"cargo-manifests": manifests, "cargo-lockfiles": lockfiles}
+
+
+MALFORMED = [
+    pytest.param(bun("/etc/package.json"), "bun-manifests", id="manifest absolute"),
+    pytest.param(bun("../x/package.json"), "bun-manifests", id="manifest leading .."),
+    pytest.param(bun("apps/../package.json"), "bun-manifests", id="manifest embedded .."),
+    pytest.param(bun("./package.json"), "bun-manifests", id="manifest leading ."),
+    pytest.param(bun("apps//web/package.json"), "bun-manifests", id="manifest empty segment"),
+    pytest.param(bun("apps\\web\\package.json"), "bun-manifests", id="manifest backslash"),
+    pytest.param(bun(""), "bun-manifests", id="manifest empty value"),
+    pytest.param(bun("package.json,"), "bun-manifests", id="manifest trailing comma"),
+    pytest.param(bun(",package.json"), "bun-manifests", id="manifest leading comma"),
+    pytest.param(bun("package.json, ,apps/*/package.json"), "bun-manifests", id="manifest blank entry"),
+    pytest.param(bun("package.json,package.json"), "bun-manifests", id="manifest duplicate"),
+    pytest.param(bun("!apps/web/package.json"), "bun-manifests", id="manifest negation"),
+    pytest.param(bun("<typescript>/package.json"), "bun-manifests", id="manifest placeholder"),
+    pytest.param(bun("apps/{web,x}/package.json"), "bun-manifests", id="manifest brace union"),
+    pytest.param(bun("apps/web/README.md"), "bun-manifests", id="manifest wrong file name"),
+    pytest.param(bun("apps/web/"), "bun-manifests", id="manifest directory"),
+    pytest.param(bun(lockfiles="/abs/bun.lock"), "bun-lockfiles", id="lockfile absolute"),
+    pytest.param(bun(lockfiles="../bun.lock"), "bun-lockfiles", id="lockfile .."),
+    pytest.param(bun(lockfiles="a\\bun.lock"), "bun-lockfiles", id="lockfile backslash"),
+    pytest.param(bun(lockfiles=""), "bun-lockfiles", id="lockfile empty value"),
+    pytest.param(bun(lockfiles="bun.lock,bun.lock"), "bun-lockfiles", id="lockfile duplicate"),
+    pytest.param(bun(lockfiles="*.lock"), "bun-lockfiles", id="lockfile glob"),
+    pytest.param(bun(lockfiles="apps/*/bun.lock"), "bun-lockfiles", id="lockfile nested glob"),
+    pytest.param(cargo("/abs/Cargo.toml"), "cargo-manifests", id="cargo manifest absolute"),
+    pytest.param(cargo("backend/Cargo.json"), "cargo-manifests", id="cargo manifest wrong file name"),
+    pytest.param(cargo(lockfiles="../Cargo.lock"), "cargo-lockfiles", id="cargo lockfile .."),
+    pytest.param(cargo(lockfiles="backend/*/Cargo.lock"), "cargo-lockfiles", id="cargo lockfile glob"),
+    pytest.param({"bun-manifests": "package.json"}, "bun-lockfiles", id="bun manifests without lockfiles"),
+    pytest.param({"bun-lockfiles": "bun.lock"}, "bun-manifests", id="bun lockfiles without manifests"),
+    pytest.param({"cargo-manifests": "backend/Cargo.toml"}, "cargo-lockfiles", id="cargo manifests alone"),
+    pytest.param({"cargo-lockfiles": "backend/Cargo.lock"}, "cargo-manifests", id="cargo lockfiles alone"),
+]
+
+
+@pytest.mark.parametrize(("declarations", "named"), MALFORMED)
+def test_a_malformed_declaration_is_could_not_run_naming_it(
+    tmp_path: Path, declarations: dict[str, str], named: str
+) -> None:
+    files = write(tmp_path, ENACT_FILES)
+    verdict = grade(tmp_path, files, trees=ENACT_TREES, declarations=declarations)
+    assert verdict.outcome is Outcome.COULD_NOT_RUN, verdict.render()
+    assert f"`{named}`" in verdict.message, verdict.message
+
+
+@pytest.mark.parametrize(("declarations", "named"), MALFORMED)
+def test_the_check_refuses_a_malformed_declaration_without_the_runner(
+    tmp_path: Path, declarations: dict[str, str], named: str
+) -> None:
+    files = write(tmp_path, ENACT_FILES)
+    ctx = Context(root=tmp_path, row=ROW, declarations=declarations)
+    with pytest.raises(CouldNotRun) as raised:
+        tuple(LockfileIntegrity().run(ctx, FileSet(paths=files)))
+    assert f"`{named}`" in str(raised.value), str(raised.value)
+
+
+# ----------------------------------------------------------------- the scope hook
+
+
+def test_an_absent_declaration_restates_nothing() -> None:
+    assert LockfileIntegrity.declared_scope(ROW.engine.scope, {}) is None
+    assert LockfileIntegrity.declared_scope(ROW.engine.scope, {"license": "Proprietary"}) is None
+
+
+def test_a_declared_bun_half_replaces_only_the_typescript_entries() -> None:
+    assert LockfileIntegrity.declared_scope(ROW.engine.scope, BUN) == (
+        "<rust>/Cargo.toml",
+        "<rust>/Cargo.lock",
+        "package.json",
+        "apps/*/package.json",
+        "packages/*/package.json",
+        "bun.lock",
+    )
+
+
+def test_a_declared_cargo_half_replaces_only_the_rust_entries() -> None:
+    assert LockfileIntegrity.declared_scope(ROW.engine.scope, CARGO) == (
+        "<typescript>/package.json",
+        "<typescript>/bun.lock",
+        "backend/Cargo.toml",
+        "backend/Cargo.lock",
+    )
+
+
+def test_both_halves_declared_leave_no_tree_default() -> None:
+    assert LockfileIntegrity.declared_scope(ROW.engine.scope, {**BUN, **CARGO}) == (
+        "backend/Cargo.toml",
+        "backend/Cargo.lock",
+        "package.json",
+        "apps/*/package.json",
+        "packages/*/package.json",
+        "bun.lock",
+    )
+
+
+def test_the_registry_scope_the_hook_replaces_is_two_entries_per_tree() -> None:
+    """The hook drops a declared half's defaults by their tree prefix, so a row
+    that grew an entry under a prefix would be dropped by a declaration without
+    anyone deciding it. This pins the shape the replacement relies on."""
+    scope = ROW.engine.scope
+    assert sorted(scope) == sorted(
+        ["<rust>/Cargo.toml", "<rust>/Cargo.lock", "<typescript>/package.json", "<typescript>/bun.lock"]
+    )
+
+
+def test_both_registry_files_carry_the_same_text() -> None:
+    assert policy_text("gate-registry.yaml") == policy_text("gate-registry.alt.yaml")
+    assert load("gate-registry.alt.yaml").by_id("REP-002").engine.scope == ROW.engine.scope
+
+
+# ------------------------------------------------------------------- the Cargo half
+
+
+@requires_cargo
+def test_declared_cargo_paths_are_graded_instead_of_the_rust_tree(tmp_path: Path) -> None:
+    shutil.copytree(CLEAN_CORPUS, tmp_path, dirs_exist_ok=True)
+    files = corpus_files(tmp_path)
+    trees = {**fixture_trees(), "rust": "somewhere-else"}
+
+    undeclared = grade(tmp_path, files, trees=trees, declarations={})
+    assert [f.path for f in undeclared.findings] == ["somewhere-else/Cargo.lock"]
+
+    declared = grade(tmp_path, files, trees=trees, declarations=CARGO)
+    assert declared.outcome is Outcome.CLEAN, declared.render()
+
+
+@requires_cargo
+def test_declared_cargo_missing_lockfile_is_the_missing_finding(tmp_path: Path) -> None:
+    shutil.copytree(CLEAN_CORPUS, tmp_path, dirs_exist_ok=True)
+    (tmp_path / "backend" / "Cargo.lock").unlink()
+    verdict = grade(
+        tmp_path,
+        corpus_files(tmp_path),
+        trees={**fixture_trees(), "rust": "somewhere-else"},
+        declarations=CARGO,
+    )
+    [finding] = verdict.findings
+    assert finding.rule == "LCK-001"
+    assert finding.path == "backend/Cargo.lock"
+    assert finding.message == "missing backend/Cargo.lock"
+    assert "(cd backend && cargo generate-lockfile)" in finding.fix
+
+
+def test_declared_cargo_rejection_is_lck_002_against_the_lockfiles_own_directory(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """The cargo command, not cargo's opinion, is what this pins.
+
+    `cargo metadata --locked --offline --no-deps` (the command this row has always
+    run, unchanged here) accepts every lock body measured -- `version = 4` alone,
+    garbage, `version = 99` -- so a real stale lockfile cannot be built to make it
+    fail. What can be asserted is what the declaration changes: the workspace is the
+    declared lockfile's directory (cwd), the manifest is `<that directory>/Cargo.toml`
+    (`--manifest-path`), and a non-zero exit is the LCK-002 finding naming both.
+    """
+    from adl_compliance.checks.repository.lockfile_integrity import check as module
+
+    write(tmp_path, {"nested/ws/Cargo.toml": "[package]\n", "nested/ws/Cargo.lock": "lock\n", "frontend/bun.lock": "lock\n"})
+    calls: list[tuple[list[str], Path]] = []
+
+    def fake_run(argv: list[str], *, cwd: Path, **_: object) -> object:
+        calls.append((argv, cwd))
+        return type("Done", (), {"returncode": 0 if argv[1] == "--version" else 101})()
+
+    monkeypatch.setattr(module.shutil, "which", lambda name: "/fake/cargo")
+    monkeypatch.setattr(module.subprocess, "run", fake_run)
+    verdict = grade(
+        tmp_path,
+        corpus_files(tmp_path),
+        trees=fixture_trees(),
+        declarations=cargo("nested/*/Cargo.toml", "nested/ws/Cargo.lock"),
+    )
+    [finding] = verdict.findings
+    assert finding.rule == "LCK-002"
+    assert finding.path == "nested/ws/Cargo.lock"
+    assert finding.message == "nested/ws/Cargo.lock does not satisfy nested/ws/Cargo.toml"
+    assert "(cd nested/ws && cargo update)" in finding.fix
+    assert [cwd for _, cwd in calls] == [tmp_path / "nested" / "ws"] * 2
+    metadata = calls[1][0]
+    assert metadata[:3] == ["cargo", "metadata", "--locked"]
+    assert metadata[metadata.index("--manifest-path") + 1] == str(tmp_path / "nested" / "ws" / "Cargo.toml")
+
+
+@requires_cargo
+def test_declared_cargo_workspace_is_the_lockfiles_directory(tmp_path: Path) -> None:
+    """A workspace nested where no tree points: cargo is driven from the lock's
+    own directory, so the rust-toolchain override beside it applies."""
+    shutil.copytree(CLEAN_CORPUS / "backend", tmp_path / "crates" / "ws")
+    write(tmp_path, {"frontend/bun.lock": "lock\n"})
+    verdict = grade(
+        tmp_path,
+        corpus_files(tmp_path),
+        trees=fixture_trees(),
+        declarations=cargo("crates/*/Cargo.toml", "crates/ws/Cargo.lock"),
+    )
+    assert verdict.outcome is Outcome.CLEAN, verdict.render()
+
+
+@requires_cargo
+def test_an_undeclared_half_keeps_its_tree_defaults_beside_a_declared_one(tmp_path: Path) -> None:
+    """Bun declared, Cargo not: the Rust tree still supplies the Cargo half."""
+    shutil.copytree(CLEAN_CORPUS, tmp_path, dirs_exist_ok=True)
+    write(tmp_path, ENACT_FILES)
+    files = corpus_files(tmp_path)
+    trees = {"rust": "backend", "typescript": ENACT_TREES["typescript"]}
+
+    clean = grade(tmp_path, files, trees=trees, declarations=BUN)
+    assert clean.outcome is Outcome.CLEAN, clean.render()
+    assert clean.units == IN_SCOPE + 2  # + backend/Cargo.toml and backend/Cargo.lock
+
+    (tmp_path / "bun.lock").unlink()
+    broken = grade(tmp_path, corpus_files(tmp_path), trees=trees, declarations=BUN)
+    assert [f.path for f in broken.findings] == ["bun.lock"]
+
+    (tmp_path / "backend" / "Cargo.lock").unlink()
+    both = grade(tmp_path, corpus_files(tmp_path), trees=trees, declarations=BUN)
+    assert [f.path for f in both.findings] == ["backend/Cargo.lock"], "the Cargo half is reported first, as before"