@apexops/contracts 0.10.0-next.0

package/dist/test/contracts.test.js

@@ -0,0 +1,867 @@
+import assert from "node:assert/strict";
+import { readdir, readFile } from "node:fs/promises";
+import { describe, it } from "node:test";
+import { fileURLToPath } from "node:url";
+import { FormatRegistry } from "@sinclair/typebox";
+import { Value } from "@sinclair/typebox/value";
+import { ApprovalEvidenceV1Schema, ArchitectureV1Schema, CapabilityPackManifestV1Schema, CONTRACT_VERSION, CostEstimateV1Schema, CustomizationLockV1Schema, DeploymentPreviewV1Schema, DiagnosisV1Schema, EnvironmentInputsV1Schema, ExecutionPlanAttestationV1Schema, GovernanceConstraintsV1Schema, hasValidInputRequestQuestions, IacHandoffV1Schema, ImprovementDecisionV1Schema, ImprovementObservationV1Schema, ImprovementPolicyV1Schema, ImprovementProposalV1Schema, ImprovementRecurrenceV1Schema, InputRequestV1Schema, InputSubmissionV1Schema, LogicalResourceManifestV1Schema, LiveQualificationV1Schema, LIVE_QUALIFICATION_SCENARIO_IDS, OnboardingConfigV1Schema, PolicyPropertyMapV1Schema, PricingEvidenceV1Schema, PricingRequestV1Schema, QualityReportV1Schema, QualityMeasurementsV1Schema, ArchitectureAvailabilityV1Schema, RequirementsV1Schema, ReviewFindingsV1Schema, RuntimeBundleLockV1Schema, ScenarioV1Schema, TelemetryV1Schema, WorkloadDecisionManifestV1Schema, contractMetadata, contractSchemas, hasCompleteContractMetadata, hasOnlyTypedSecretReferences, hasValidLiveQualification, hasValidCostArithmetic, hasValidLogicalResourceReferences, hasValidPreviewApprovalBinding, calculatePricingEvidenceId, calculatePricingRequestId, hasValidPricingEvidence, schemaById, } from "../index.js";
+import { CONTRACT_METADATA_FILENAME, JSON_SCHEMA_DIALECT, createContractMetadataFile, createContractSchemaFiles, } from "../schema-export.js";
+const hash = "a".repeat(64);
+const otherHash = "b".repeat(64);
+const timestamp = "2026-07-13T12:00:00.000Z";
+const expiry = "2026-07-13T13:00:00.000Z";
+const completion = "2026-07-13T14:00:00.000Z";
+FormatRegistry.Set("date-time", (value) => Number.isFinite(Date.parse(value)));
+FormatRegistry.Set("date", (value) => /^\d{4}-\d{2}-\d{2}$/.test(value) && Number.isFinite(Date.parse(`${value}T00:00:00Z`)));
+describe("Wave 1 contracts", () => {
+    it("uses one explicit persisted contract version", () => {
+        const lock = {
+            schemaVersion: CONTRACT_VERSION,
+            cliVersion: "0.1.0",
+            customizationVersion: "0.1.0",
+            workflowHash: "a".repeat(64),
+            defaultsHash: "b".repeat(64),
+            validatorHash: "c".repeat(64),
+            qualityScorecardHash: "d".repeat(64),
+            improvementPolicyHash: "e".repeat(64),
+            requiredCapabilityPacks: [],
+        };
+        assert.equal(lock.schemaVersion, "1.0.0");
+        assert.equal(Value.Check(RuntimeBundleLockV1Schema, lock), true);
+    });
+    it("validates requirements from the walking skeleton", () => {
+        const requirements = {
+            schemaVersion: CONTRACT_VERSION,
+            projectId: "example-project",
+            workload: "Secure web API",
+            environment: "dev",
+            requirements: [
+                {
+                    id: "REQ-001",
+                    statement: "Use managed identity",
+                    priority: "must",
+                    status: "confirmed",
+                    source: "user",
+                },
+            ],
+            assumptions: [],
+            unknowns: [],
+        };
+        assert.equal(Value.Check(RequirementsV1Schema, requirements), true);
+    });
+    it("validates strict onboarding configuration with optional defaults", () => {
+        const config = {
+            schemaVersion: CONTRACT_VERSION,
+            projectId: "payments",
+            client: "github-copilot-vscode",
+            createRepository: true,
+        };
+        assert.equal(Value.Check(OnboardingConfigV1Schema, config), true);
+        assert.equal(Value.Check(OnboardingConfigV1Schema, { ...config, client: "unsupported" }), false);
+        assert.equal(Value.Check(OnboardingConfigV1Schema, { ...config, unexpected: true }), false);
+    });
+    it("binds live qualification evidence to an exact candidate", () => {
+        const scenarios = LIVE_QUALIFICATION_SCENARIO_IDS.map((id) => ({
+            id,
+            environment: "sandbox",
+            targetScope: "subscription/example",
+            actor: "maintainer",
+            startedAt: expiry,
+            completedAt: completion,
+            toolVersions: { apex: "0.1.0" },
+            outcome: "pass",
+            evidenceRefs: [hash],
+        }));
+        const qualification = {
+            schemaVersion: CONTRACT_VERSION,
+            projectId: "live-test",
+            runId: "run-1",
+            candidate: {
+                repository: "jonathan-vella/apex-vnext",
+                branch: "main",
+                commit: "a".repeat(40),
+                packageLockHash: hash,
+                releaseManifestHash: otherHash,
+                runtimeBundleHash: "c".repeat(64),
+                customizationBundleHash: "e".repeat(64),
+            },
+            createdAt: timestamp,
+            evidenceManifestHash: "d".repeat(64),
+            scenarios,
+        };
+        assert.equal(Value.Check(LiveQualificationV1Schema, qualification), true);
+        assert.equal(hasValidLiveQualification(qualification), true);
+        assert.equal(hasValidLiveQualification({
+            ...qualification,
+            scenarios: qualification.scenarios.map((scenario, index) => index === 1 ? { ...scenario, id: "vscode-experience" } : scenario),
+        }), false);
+        assert.equal(hasValidLiveQualification({
+            ...qualification,
+            createdAt: completion,
+        }), false);
+        assert.equal(hasValidLiveQualification({
+            ...qualification,
+            scenarios: qualification.scenarios.map((scenario, index) => index === 0 ? { ...scenario, startedAt: completion, completedAt: expiry } : scenario),
+        }), false);
+        assert.equal(Value.Check(LiveQualificationV1Schema, { ...qualification, unexpected: true }), false);
+    });
+    it("publishes an id for every registered schema", () => {
+        assert.ok(contractSchemas.length > 0);
+        for (const schema of contractSchemas) {
+            assert.match(schema.$id ?? "", /^https:\/\/schemas\.apexops\.dev\//);
+        }
+    });
+    it("validates bounded improvement contracts", () => {
+        const observation = {
+            schemaVersion: CONTRACT_VERSION,
+            projectId: "example-project",
+            runId: "run-1",
+            taskId: "task-1",
+            observationId: hash,
+            patternKey: otherHash,
+            observedAt: timestamp,
+            source: "validation-failure",
+            category: "correctness",
+            severity: "medium",
+            statement: "A deterministic validator failed.",
+            evidenceRefs: [hash],
+            disposition: "active",
+            redactionCount: 0,
+        };
+        const recurrence = {
+            schemaVersion: CONTRACT_VERSION,
+            projectId: "example-project",
+            patternKey: otherHash,
+            category: "correctness",
+            detectedAt: completion,
+            firstSeenAt: timestamp,
+            lastSeenAt: expiry,
+            occurrenceCount: 2,
+            distinctRunCount: 2,
+            runIds: ["run-1", "run-2"],
+            observationIds: [hash, otherHash],
+            evidenceRefs: [hash],
+            confidence: "medium",
+        };
+        const proposal = {
+            schemaVersion: CONTRACT_VERSION,
+            projectId: "example-project",
+            proposalId: hash,
+            patternKey: otherHash,
+            generatedAt: completion,
+            target: "validator",
+            title: "Review recurring validator failure",
+            summary: "Inspect the recurring deterministic evidence through the normal change workflow.",
+            occurrenceCount: 2,
+            runIds: ["run-1", "run-2"],
+            evidenceRefs: [hash],
+            confidence: "medium",
+            status: "pending",
+            inert: true,
+        };
+        const decision = {
+            schemaVersion: CONTRACT_VERSION,
+            projectId: "example-project",
+            proposalId: hash,
+            decidedAt: completion,
+            actor: "maintainer",
+            decision: "accepted",
+            rationale: "Track through a normal reviewed issue.",
+            externalRef: "https://github.com/owner/repo/issues/12",
+        };
+        const policy = {
+            schemaVersion: CONTRACT_VERSION,
+            allowedSources: ["validation-failure", "explicit-correction"],
+            allowedCategories: ["correctness", "security"],
+            recurrence: { threshold: 2, windowDays: 30 },
+            retention: { observationDays: 90, decisionDays: 365 },
+            limits: { statementCharacters: 1024, evidenceRefs: 32, observations: 10000 },
+            proposalTargets: ["documentation", "validator", "backlog"],
+            humanDecisionRequired: true,
+            automatedIssueCreation: false,
+            contextInjection: false,
+        };
+        assert.equal(Value.Check(ImprovementObservationV1Schema, observation), true);
+        assert.equal(Value.Check(ImprovementRecurrenceV1Schema, recurrence), true);
+        assert.equal(Value.Check(ImprovementProposalV1Schema, proposal), true);
+        assert.equal(Value.Check(ImprovementDecisionV1Schema, decision), true);
+        assert.equal(Value.Check(ImprovementPolicyV1Schema, policy), true);
+        assert.equal(Value.Check(ImprovementProposalV1Schema, { ...proposal, inert: false }), false);
+        assert.equal(Value.Check(ImprovementPolicyV1Schema, { ...policy, automatedIssueCreation: true }), false);
+    });
+});
+describe("pricing evidence contracts", () => {
+    const requestContent = {
+        schemaVersion: CONTRACT_VERSION,
+        projectId: "pricing-test",
+        runId: "run-1",
+        scenarioId: "PRICING-002-meter-aware",
+        target: {
+            serviceName: "Virtual Machines",
+            skuName: "D2s v5",
+            regions: ["swedencentral"],
+            currency: "USD",
+        },
+        usage: { dimension: "hour", quantity: 730 },
+        meter: { meterId: "compute-hour", unitDimension: "hour", unitQuantity: 1 },
+        commitment: { kind: "none" },
+        requestedAt: timestamp,
+    };
+    const request = {
+        ...requestContent,
+        requestId: calculatePricingRequestId(requestContent),
+    };
+    const evidenceContent = {
+        schemaVersion: CONTRACT_VERSION,
+        projectId: request.projectId,
+        runId: request.runId,
+        scenarioId: request.scenarioId,
+        requestId: request.requestId,
+        requestHash: request.requestId,
+        provenance: {
+            provider: "azure-resource-manager-mcp",
+            endpointId: "arm-pricing",
+            toolName: "pricing-read",
+            toolVersion: "1.0.0",
+            toolchainHash: hash,
+            toolsListHash: otherHash,
+            rawSourceDigest: "c".repeat(64),
+            rawSourceBytes: 512,
+            contentCapture: false,
+        },
+        collectedAt: expiry,
+        expiresAt: completion,
+        result: {
+            status: "matched",
+            records: [
+                {
+                    priceId: "price-1",
+                    meterId: "compute-hour",
+                    serviceName: "Virtual Machines",
+                    skuName: "D2s v5",
+                    region: "swedencentral",
+                    currency: "USD",
+                    priceType: "consumption",
+                    unitDimension: "hour",
+                    unitQuantity: 1,
+                    unitPrice: 0.1,
+                    usageQuantity: 730,
+                    projectedAmount: 73,
+                    commitment: { kind: "none" },
+                    uncertainty: { lowerAmount: 73, upperAmount: 73, confidence: "high", reasonCodes: [] },
+                },
+            ],
+            totalAmount: 73,
+            paginationStatus: "complete",
+        },
+        qualifiesGate: false,
+    };
+    const evidence = {
+        ...evidenceContent,
+        evidenceId: calculatePricingEvidenceId(evidenceContent),
+    };
+    it("binds strict content-free pricing evidence and arithmetic", () => {
+        assert.equal(Value.Check(PricingRequestV1Schema, request), true);
+        assert.equal(Value.Check(PricingEvidenceV1Schema, evidence), true);
+        assert.equal(hasValidPricingEvidence(request, evidence, expiry), true);
+        assert.equal(hasValidPricingEvidence({ ...request, requestId: hash }, evidence, expiry), false);
+        const badArithmeticContent = {
+            ...evidenceContent,
+            result: { ...evidenceContent.result, totalAmount: 72 },
+        };
+        const badArithmetic = {
+            ...badArithmeticContent,
+            evidenceId: calculatePricingEvidenceId(badArithmeticContent),
+        };
+        assert.equal(hasValidPricingEvidence(request, badArithmetic, expiry), false);
+        assert.equal(Value.Check(PricingEvidenceV1Schema, { ...evidence, rawPayload: {} }), false);
+        assert.equal(Value.Check(PricingEvidenceV1Schema, { ...evidence, qualifiesGate: true }), false);
+    });
+});
+describe("persisted contract schemas", () => {
+    const schemasDirectory = fileURLToPath(new URL("../../schemas/", import.meta.url));
+    const generatedSchemas = createContractSchemaFiles();
+    it("matches the registry inventory and committed bytes deterministically", async () => {
+        const expectedFilenames = generatedSchemas.map(({ filename }) => filename);
+        const actualFilenames = (await readdir(schemasDirectory))
+            .filter((filename) => filename.endsWith(".schema.json"))
+            .sort();
+        assert.deepEqual(actualFilenames, expectedFilenames);
+        assert.equal(new Set(expectedFilenames).size, contractSchemas.length);
+        for (const generated of generatedSchemas) {
+            const committed = await readFile(new URL(`../../schemas/${generated.filename}`, import.meta.url), "utf8");
+            assert.equal(committed, generated.contents);
+            assert.equal(generated.contents, createContractSchemaFiles().find(({ filename }) => filename === generated.filename)?.contents);
+        }
+    });
+    it("includes identifiers, dialect, strict objects, and TypeBox-compatible schemas", () => {
+        for (const generated of generatedSchemas) {
+            const sourceSchema = contractSchemas.find((schema) => schema.$id === generated.schema.$id);
+            assert.ok(sourceSchema);
+            assert.equal(generated.schema.$schema, JSON_SCHEMA_DIALECT);
+            const union = generated.schema.anyOf;
+            if (union === undefined)
+                assert.equal(generated.schema.additionalProperties, false);
+            else
+                assert.equal(union.every((branch) => branch.additionalProperties === false), true);
+            assert.equal(Value.Check(generated.schema, {}), Value.Check(sourceSchema, {}));
+        }
+    });
+    it("matches the metadata registry inventory and committed bytes", async () => {
+        const contents = createContractMetadataFile();
+        const committed = await readFile(new URL(`../../schemas/${CONTRACT_METADATA_FILENAME}`, import.meta.url), "utf8");
+        const persistedMetadata = JSON.parse(contents);
+        assert.equal(committed, contents);
+        assert.deepEqual(Object.keys(persistedMetadata).sort(), contractSchemas.map((schema) => schema.$id).sort());
+    });
+});
+describe("target family contracts", () => {
+    const fixtures = [
+        [
+            WorkloadDecisionManifestV1Schema,
+            {
+                schemaVersion: CONTRACT_VERSION,
+                projectId: "example-project",
+                runId: "run-1",
+                environment: "prod",
+                sourceRequirementsHash: hash,
+                architectureHash: otherHash,
+                costEstimateHash: "c".repeat(64),
+                environments: ["dev", "prod"],
+                requirementTraceability: [
+                    { requirementId: "REQ-001", skuDecisionIds: ["api-sku"], sloDecisionIds: ["api-slo"] },
+                ],
+                skuDecisions: [
+                    {
+                        id: "api-sku",
+                        service: "Azure App Service",
+                        logicalId: "api",
+                        sku: "P1v3",
+                        quantity: 1,
+                        rationale: "Availability target",
+                        requirementIds: ["REQ-001"],
+                        environmentOverrides: [],
+                    },
+                ],
+                sloDecisions: [
+                    {
+                        id: "api-slo",
+                        logicalId: "api",
+                        availabilityPercent: 99.9,
+                        rtoMinutes: 60,
+                        rpoMinutes: 15,
+                        supportWindow: "business-hours",
+                        complianceScopes: ["gdpr"],
+                        requirementIds: ["REQ-001"],
+                        environmentOverrides: [],
+                    },
+                ],
+                revisions: [{ number: 1, createdAt: timestamp, sourceHash: hash, reason: "Initial user pins" }],
+            },
+        ],
+        [
+            ArchitectureV1Schema,
+            {
+                schemaVersion: CONTRACT_VERSION,
+                projectId: "example-project",
+                runId: "run-1",
+                title: "Web API",
+                summary: "Managed web API architecture",
+                sourceHashes: { requirements: hash },
+                components: [
+                    {
+                        id: "api",
+                        service: "Azure App Service",
+                        purpose: "Host API",
+                        requirementIds: ["REQ-001"],
+                        dependsOn: [],
+                    },
+                ],
+                decisions: ["Use managed identity"],
+                risks: [],
+            },
+        ],
+        [
+            CostEstimateV1Schema,
+            {
+                schemaVersion: CONTRACT_VERSION,
+                projectId: "example-project",
+                runId: "run-1",
+                currency: "USD",
+                pricingDate: "2026-07-13",
+                lineItems: [
+                    {
+                        id: "api-compute",
+                        service: "Azure App Service",
+                        sku: "P1v3",
+                        quantity: 2,
+                        unitPrice: 0.1,
+                        unitsPerMonth: 730,
+                        monthlyCost: 146,
+                        source: { provider: "Azure Retail Prices", uri: "https://prices.azure.com", retrievedAt: timestamp },
+                        uncertainty: { lowerMonthlyCost: 140, upperMonthlyCost: 155, confidence: "high", basis: "Usage range" },
+                    },
+                ],
+                totalMonthlyCost: 146,
+                assumptions: ["Two continuously running instances"],
+            },
+        ],
+        [
+            ReviewFindingsV1Schema,
+            {
+                schemaVersion: CONTRACT_VERSION,
+                projectId: "example-project",
+                runId: "run-1",
+                subjectKind: "architecture-v1",
+                subjectHash: hash,
+                reviewedAt: timestamp,
+                findings: [
+                    {
+                        id: "finding-1",
+                        severity: "medium",
+                        disposition: "remediated",
+                        title: "Missing zone detail",
+                        detail: "Availability zones were not explicit",
+                        evidenceRefs: [otherHash],
+                        resolution: "Added zone-redundant deployment",
+                    },
+                ],
+            },
+        ],
+        [
+            GovernanceConstraintsV1Schema,
+            {
+                schemaVersion: CONTRACT_VERSION,
+                projectId: "example-project",
+                runId: "run-1",
+                targetScope: "/subscriptions/example",
+                discoveredAt: timestamp,
+                expiresAt: expiry,
+                summary: { assignmentCount: 3, denyCount: 1, modifyCount: 1, auditCount: 1, exemptionCount: 0 },
+                constraintsRef: { mediaType: "application/json", uri: "artifact://governance/full", digest: hash, bytes: 4096 },
+            },
+        ],
+        [
+            PolicyPropertyMapV1Schema,
+            {
+                schemaVersion: CONTRACT_VERSION,
+                projectId: "example-project",
+                runId: "run-1",
+                governanceHash: hash,
+                mappings: [
+                    {
+                        policyAssignmentId: "/providers/Microsoft.Authorization/policyAssignments/tls",
+                        effect: "deny",
+                        logicalResourceId: "api",
+                        propertyPath: "siteConfig.minTlsVersion",
+                        expectedValue: "1.2",
+                        disposition: "satisfied",
+                    },
+                ],
+            },
+        ],
+        [
+            EnvironmentInputsV1Schema,
+            {
+                schemaVersion: CONTRACT_VERSION,
+                projectId: "example-project",
+                runId: "run-1",
+                environment: "prod",
+                inputs: {
+                    location: { kind: "value", value: "swedencentral" },
+                    deploymentToken: { kind: "secret-reference", provider: "environment", reference: "DEPLOYMENT_TOKEN" },
+                },
+            },
+        ],
+        [
+            LogicalResourceManifestV1Schema,
+            {
+                schemaVersion: CONTRACT_VERSION,
+                projectId: "example-project",
+                runId: "run-1",
+                track: "bicep",
+                resources: [
+                    {
+                        logicalId: "plan",
+                        type: "Microsoft.Web/serverfarms",
+                        implementationAddress: "plan",
+                        implementationKind: "resource",
+                        ownership: "managed",
+                        dependsOn: [],
+                        generatedDependencies: [],
+                        sourcePath: "main.bicep",
+                    },
+                    {
+                        logicalId: "api",
+                        type: "Microsoft.Web/sites",
+                        implementationAddress: "api",
+                        implementationKind: "resource",
+                        ownership: "managed",
+                        dependsOn: ["plan"],
+                        generatedDependencies: ["plan"],
+                        sourcePath: "main.bicep",
+                    },
+                ],
+            },
+        ],
+        [
+            IacHandoffV1Schema,
+            {
+                schemaVersion: CONTRACT_VERSION,
+                projectId: "example-project",
+                runId: "run-1",
+                track: "bicep",
+                rootPath: "infra/bicep/example-project",
+                treeHash: hash,
+                intentHash: hash,
+                bindingHash: hash,
+                environmentInputsHash: hash,
+                logicalResourceManifestHash: hash,
+                requiredToolVersions: { bicep: "0.38.3" },
+                generatedAt: timestamp,
+            },
+        ],
+        [
+            ExecutionPlanAttestationV1Schema,
+            {
+                schemaVersion: CONTRACT_VERSION,
+                projectId: "example-project",
+                runId: "run-1",
+                track: "terraform",
+                previewHash: hash,
+                inputHash: hash,
+                iacHash: hash,
+                policyHash: hash,
+                configHash: hash,
+                lockfileHash: hash,
+                recipient: "deploy-prod",
+                planDigest: otherHash,
+                artifactRef: "plans/run-1/apply.enc",
+                stateLineage: "lineage-1",
+                stateSerial: 7,
+                transport: {
+                    encrypted: true,
+                    implementation: "local-reference",
+                    algorithm: "aes-256-gcm",
+                    recipient: "deploy-prod",
+                    mediaType: "application/octet-stream",
+                    iv: "base64-iv",
+                    authTag: "base64-auth-tag",
+                },
+                createdAt: timestamp,
+                expiresAt: expiry,
+            },
+        ],
+        [
+            ScenarioV1Schema,
+            {
+                schemaVersion: CONTRACT_VERSION,
+                id: "managed-web-api",
+                title: "Managed web API",
+                description: "Validates a managed identity deployment",
+                inputs: { environment: "dev" },
+                expectedOutcomes: ["Deployment succeeds"],
+                tags: ["web", "identity"],
+            },
+        ],
+        [
+            QualityReportV1Schema,
+            {
+                schemaVersion: CONTRACT_VERSION,
+                projectId: "example-project",
+                runId: "run-1",
+                evaluatedAt: timestamp,
+                scorecardHash: hash,
+                measurementsHash: hash,
+                status: "pass",
+                checks: [
+                    {
+                        id: "schema",
+                        scenario: "contracts",
+                        status: "pass",
+                        value: 1,
+                        samples: 1,
+                        evidenceRefs: [hash],
+                        detail: "target satisfied",
+                    },
+                ],
+            },
+        ],
+        [
+            QualityMeasurementsV1Schema,
+            {
+                schemaVersion: CONTRACT_VERSION,
+                measurements: [
+                    {
+                        metric: "schema",
+                        scenario: "contracts",
+                        value: 1,
+                        samples: 1,
+                        evidenceRefs: [hash],
+                    },
+                ],
+            },
+        ],
+        [
+            ArchitectureAvailabilityV1Schema,
+            {
+                schemaVersion: CONTRACT_VERSION,
+                projectId: "example-project",
+                runId: "run-1",
+                targetScope: "local",
+                mode: "simulated",
+                collectedAt: timestamp,
+                expiresAt: expiry,
+                checks: {
+                    pricing: { status: "current", evidenceRef: hash },
+                    quota: { status: "current", evidenceRef: hash },
+                    regionalAvailability: { status: "current", evidenceRef: hash },
+                },
+            },
+        ],
+        [
+            TelemetryV1Schema,
+            {
+                schemaVersion: CONTRACT_VERSION,
+                eventId: "event-1",
+                timestamp,
+                metric: "run.duration",
+                value: 42,
+                unit: "seconds",
+                consent: { status: "granted", scope: "product-improvement" },
+                source: "kernel",
+                confidence: "high",
+                dimensions: { workflow: "apex-workflow-v1" },
+            },
+        ],
+        [
+            DiagnosisV1Schema,
+            {
+                schemaVersion: CONTRACT_VERSION,
+                projectId: "example-project",
+                runId: "run-1",
+                diagnosedAt: timestamp,
+                status: "degraded",
+                observations: ["Health probe failed"],
+                causes: [
+                    {
+                        id: "cause-1",
+                        summary: "Probe path mismatch",
+                        confidence: "high",
+                        evidenceRefs: [hash],
+                        remediation: "Align the probe path",
+                    },
+                ],
+            },
+        ],
+        [
+            CapabilityPackManifestV1Schema,
+            {
+                schemaVersion: CONTRACT_VERSION,
+                id: "azure-core",
+                version: "1.2.0",
+                digest: hash,
+                capabilities: ["azure.preview", "azure.deploy"],
+                entrypoints: { preview: "./preview.js" },
+                requires: ["azure-cli>=2.75"],
+            },
+        ],
+        [
+            CustomizationLockV1Schema,
+            {
+                schemaVersion: CONTRACT_VERSION,
+                customizationId: "apex-default",
+                version: "1.0.0",
+                manifestHash: hash,
+                capabilityPacks: [{ id: "azure-core", version: "1.2.0", digest: otherHash }],
+                lockedAt: timestamp,
+            },
+        ],
+    ];
+    it("validates a representative fixture for every target family", () => {
+        for (const [schema, fixture] of fixtures) {
+            assert.equal(Value.Check(schema, fixture), true, schema.$id ?? "unidentified schema");
+        }
+    });
+    it("validates journal-bound input requests and submissions", () => {
+        const request = {
+            schemaVersion: CONTRACT_VERSION,
+            requestId: "request-1",
+            expectedHead: hash,
+            ownerEpoch: 2,
+            intake: { round: "business-discovery", ordinal: 1, total: 4 },
+            questions: [{ id: "region", prompt: "Which region?", options: ["sweden", "germany"] }],
+        };
+        assert.equal(Value.Check(InputRequestV1Schema, request), true);
+        assert.equal(Value.Check(InputRequestV1Schema, {
+            schemaVersion: CONTRACT_VERSION,
+            requestId: request.requestId,
+            expectedHead: request.expectedHead,
+            ownerEpoch: request.ownerEpoch,
+            questions: request.questions,
+        }), false);
+        assert.equal(Value.Check(InputSubmissionV1Schema, {
+            schemaVersion: CONTRACT_VERSION,
+            requestId: request.requestId,
+            expectedHead: request.expectedHead,
+            ownerEpoch: request.ownerEpoch,
+            answers: [{ questionId: "region", value: "sweden" }],
+        }), true);
+        assert.equal(Value.Check(InputSubmissionV1Schema, { ...request, answers: [] }), false);
+        assert.equal(Value.Check(InputSubmissionV1Schema, {
+            schemaVersion: CONTRACT_VERSION,
+            requestId: request.requestId,
+            expectedHead: request.expectedHead,
+            ownerEpoch: request.ownerEpoch,
+            answers: [
+                { questionId: "budget", value: { kind: "budget", amount: 250, currency: "USD", cadence: "monthly" } },
+            ],
+        }), true);
+        assert.equal(hasValidInputRequestQuestions([
+            { id: "one", prompt: "One?" },
+            { id: "two", prompt: "Two?", options: ["a", "b"], multiSelect: true },
+        ]), true);
+        assert.equal(hasValidInputRequestQuestions([
+            { id: "same", prompt: "One?" },
+            { id: "same", prompt: "Two?" },
+        ]), false);
+        assert.equal(hasValidInputRequestQuestions([{ id: "bad", prompt: "Bad?", multiSelect: true }]), false);
+        assert.equal(hasValidInputRequestQuestions([{ id: "bad", prompt: "Bad?", options: [] }]), false);
+        assert.equal(hasValidInputRequestQuestions([{ id: "bad", prompt: "Bad?", options: ["same", "same"] }]), false);
+        assert.equal(Value.Check(InputRequestV1Schema, {
+            ...request,
+            questions: [{ id: "bad", prompt: "Bad?", options: ["same", "same"] }],
+        }), false);
+    });
+    it("validates reproducible cost arithmetic and uncertainty bounds", () => {
+        const estimate = fixtures[2][1];
+        assert.equal(hasValidCostArithmetic(estimate), true);
+        assert.equal(hasValidCostArithmetic({ ...estimate, totalMonthlyCost: 145 }), false);
+    });
+    it("permits secret references but rejects secret literal fields", () => {
+        const inputs = fixtures[6][1];
+        assert.equal(hasOnlyTypedSecretReferences(inputs), true);
+        assert.equal(Value.Check(EnvironmentInputsV1Schema, {
+            ...inputs,
+            inputs: {
+                deploymentToken: { kind: "secret-reference", provider: "environment", reference: "TOKEN", value: "secret" },
+            },
+        }), false);
+    });
+    it("requires unique logical IDs and resolvable dependency references", () => {
+        const manifest = fixtures[7][1];
+        assert.equal(hasValidLogicalResourceReferences(manifest), true);
+        assert.equal(hasValidLogicalResourceReferences({
+            ...manifest,
+            resources: [
+                ...manifest.resources,
+                {
+                    logicalId: "duplicate-plan",
+                    type: "Microsoft.Web/serverfarms",
+                    implementationAddress: "duplicatePlan",
+                    implementationKind: "resource",
+                    ownership: "managed",
+                    dependsOn: ["missing"],
+                    generatedDependencies: ["missing"],
+                    sourcePath: "main.bicep",
+                },
+            ],
+        }), false);
+    });
+    it("binds encrypted plan attestations to the preview and approval recipient", () => {
+        const attestation = fixtures[9][1];
+        const preview = {
+            schemaVersion: CONTRACT_VERSION,
+            projectId: "example-project",
+            runId: "run-1",
+            environment: "prod",
+            track: "terraform",
+            operation: "apply",
+            target: "/subscriptions/example",
+            commit: hash,
+            dependencyRevision: hash,
+            ownerEpoch: 1,
+            inputHash: hash,
+            iacHash: hash,
+            policyHash: hash,
+            stateLineage: "lineage-1",
+            stateSerial: 7,
+            changes: [],
+            blockers: [],
+            createdAt: timestamp,
+            expiresAt: expiry,
+            previewHash: hash,
+        };
+        const approval = {
+            schemaVersion: CONTRACT_VERSION,
+            projectId: "example-project",
+            runId: "run-1",
+            gate: 4,
+            decision: "approved",
+            actor: "release-manager",
+            mechanism: "tty",
+            dependencyHash: hash,
+            previewHash: hash,
+            writerEpoch: 1,
+            recipientIdentity: "deploy-prod",
+            decidedAt: timestamp,
+            expiresAt: expiry,
+        };
+        assert.equal(Value.Check(ExecutionPlanAttestationV1Schema, attestation), true);
+        assert.equal(Value.Check(DeploymentPreviewV1Schema, preview), true);
+        assert.equal(Value.Check(ApprovalEvidenceV1Schema, approval), true);
+        assert.equal(hasValidPreviewApprovalBinding(attestation, preview, approval), true);
+        assert.equal(hasValidPreviewApprovalBinding(attestation, preview, { ...approval, previewHash: otherHash }), false);
+        assert.equal(hasValidPreviewApprovalBinding(attestation, preview, {
+            ...approval,
+            writerEpoch: preview.ownerEpoch + 1,
+            writerTransferClaimHash: otherHash,
+        }), true);
+        assert.equal(hasValidPreviewApprovalBinding(attestation, preview, { ...approval, writerEpoch: preview.ownerEpoch + 1 }), false);
+        assert.equal(hasValidPreviewApprovalBinding(attestation, preview, {
+            ...approval,
+            writerTransferClaimHash: otherHash,
+        }), false);
+    });
+    it("permits only local and inherited approval mechanisms", () => {
+        const base = {
+            schemaVersion: CONTRACT_VERSION,
+            projectId: "example-project",
+            runId: "run-1",
+            gate: 4,
+            decision: "approved",
+            actor: "maintainer",
+            dependencyHash: hash,
+            previewHash: hash,
+            writerEpoch: 2,
+            recipientIdentity: "github-actions:owner/repo:123:1:deploy",
+            decidedAt: timestamp,
+            expiresAt: expiry,
+        };
+        assert.equal(Value.Check(ApprovalEvidenceV1Schema, {
+            ...base,
+            mechanism: "tty",
+            writerTransferClaimHash: "b".repeat(64),
+        }), true);
+        assert.equal(Value.Check(ApprovalEvidenceV1Schema, {
+            ...base,
+            mechanism: "tty",
+            writerTransferClaimHash: "not-a-hash",
+        }), false);
+        assert.equal(Value.Check(ApprovalEvidenceV1Schema, {
+            ...base,
+            mechanism: "github-environment",
+        }), false);
+        assert.equal(Value.Check(ApprovalEvidenceV1Schema, { ...base, mechanism: "tty", githubContext: {} }), false);
+    });
+    it("provides complete metadata and lookup coverage for every schema", () => {
+        assert.equal(hasCompleteContractMetadata(), true);
+        assert.equal(Object.keys(schemaById).length, contractSchemas.length);
+        assert.equal(Object.keys(contractMetadata).length, contractSchemas.length);
+        for (const schema of contractSchemas) {
+            assert.equal(schemaById[schema.$id ?? ""], schema);
+            assert.ok((contractMetadata[schema.$id ?? ""]?.maxBytes ?? 0) > 0);
+        }
+    });
+});
+//# sourceMappingURL=contracts.test.js.map