@apexops/testkit 0.10.0-next.0

package/dist/qualification.js

@@ -0,0 +1,760 @@
+import { CapabilityPackLoader } from "@apexops/capabilities";
+import { ApexError, ApexService } from "@apexops/cli";
+import { CONTRACT_VERSION } from "@apexops/contracts";
+import { ContentCache, EventJournal, ObjectStore, benchmarkKernel, contentCacheKey, sha256Json } from "@apexops/kernel";
+import { evaluateQualityScorecard, renderResourceInventory } from "@apexops/renderers";
+import { cp, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
+import { join, relative } from "node:path";
+import { FakeClock, SequenceIds } from "./determinism.js";
+const HASH = "a".repeat(64);
+export async function runQualification(options) {
+    const clock = options.clock ?? new FakeClock();
+    const ids = options.ids ?? new SequenceIds("qualification");
+    const tracks = [];
+    const started = clock.now().getTime();
+    for (const track of ["bicep", "terraform"]) {
+        const root = join(options.workspaceRoot, track);
+        const source = join(options.workspaceRoot, `.customizations-${track}`);
+        await cp(options.customizationsSource, source, { recursive: true });
+        const report = await runTrack(root, source, track, clock, ids, options.injectFailure);
+        tracks.push(report);
+    }
+    const parityChecks = [];
+    await checked(parityChecks, clock, "logical-parity", async () => {
+        const [bicep, terraform] = tracks;
+        if (bicep?.hashes.logicalInventory !== terraform?.hashes.logicalInventory)
+            throw new Error("Track inventories differ logically");
+    });
+    const hashes = {
+        report: sha256Json(tracks.map(({ track, eventCount, hashes: trackHashes }) => ({ track, eventCount, hashes: trackHashes }))),
+        logicalInventory: tracks[0]?.hashes.logicalInventory ?? "",
+    };
+    const checks = [...tracks.flatMap(({ checks: trackChecks }) => trackChecks), ...parityChecks];
+    return {
+        schemaVersion: "1.0.0",
+        status: qualificationStatus(checks),
+        durationMs: clock.now().getTime() - started,
+        tracks,
+        checks: parityChecks,
+        eventCount: tracks.reduce((total, track) => total + track.eventCount, 0),
+        hashes,
+    };
+}
+export function qualificationStatus(checks) {
+    return checks.every(({ status }) => status === "pass") ? "pass" : "fail";
+}
+export function qualificationJson(report) {
+    return `${JSON.stringify(report, null, 2)}\n`;
+}
+export function runQualificationBenchmark(eventCount, budgets) {
+    const metrics = benchmarkKernel(eventCount);
+    const checks = [
+        budgetCheck("append-budget", metrics.append.p95Ms, budgets.appendP95Ms),
+        budgetCheck("replay-budget", metrics.replay.p95Ms, budgets.replayP95Ms),
+        budgetCheck("status-budget", metrics.status.p95Ms, budgets.statusP95Ms),
+    ];
+    return { schemaVersion: "1.0.0", status: qualificationStatus(checks), eventCount, budgets, metrics, checks };
+}
+async function runTrack(root, source, track, clock, ids, injectFailure) {
+    await mkdir(root, { recursive: true });
+    const serviceOptions = { clock: clock.now, idSource: ids.next };
+    const context = {
+        root,
+        source,
+        track,
+        clock,
+        ids,
+        options: serviceOptions,
+        runId: "",
+        service: new ApexService(root, serviceOptions),
+        checks: [],
+        taskContextBytes: [],
+    };
+    await checked(context.checks, clock, "initialize-customizations", async () => {
+        context.runId = (await context.service.init({
+            projectId: `qualification-${track}`,
+            iacTool: track,
+            customizationsSource: source,
+        })).runId;
+    }, injectFailure);
+    if (context.checks.at(-1)?.status === "fail") {
+        return failedTrackReport(track, context.checks);
+    }
+    await checked(context.checks, clock, "creative-workflow-gates-1-3", async () => {
+        await completeCreativeWorkflow(context);
+    }, injectFailure);
+    restart(context);
+    let inventory;
+    await checked(context.checks, clock, "preview-gate-4-deploy-inventory", async () => {
+        const preview = await context.service.preview({ operation: "apply", provider: "fake" });
+        await context.service.decideGateNumber(4, "approved", "qualification");
+        inventory = (await context.service.deploy(preview.previewHash)).inventory;
+        await complete(context, "diagnosis", [{ kind: "diagnosis", value: diagnosis(context) }]);
+        await complete(context, "quality", [{ kind: "quality-report", value: await quality(context) }]);
+        await context.service.render("preview");
+        await context.service.render("approval");
+        await context.service.render("inventory");
+    }, injectFailure);
+    restart(context);
+    await checked(context.checks, clock, "promotion-inheritance-fresh-gate-4", async () => {
+        const sameScope = await context.service.promote("stage", "local");
+        const sameScopeStates = sameScope.gates.map(({ state }) => state);
+        if (sameScopeStates.join(",") !== "inherited,inherited,inherited,closed")
+            throw new Error(`Unexpected same-scope promoted gates: ${sameScopeStates.join(",")}`);
+        await context.service.use(sameScope.projectId, context.runId);
+        const changedScope = await context.service.promote("prod", "local/prod");
+        const changedScopeStates = changedScope.gates.map(({ state }) => state);
+        if (changedScopeStates.join(",") !== "inherited,closed,closed,closed")
+            throw new Error(`Unexpected changed-scope promoted gates: ${changedScopeStates.join(",")}`);
+        await context.service.use(changedScope.projectId, context.runId);
+    }, injectFailure);
+    await checked(context.checks, clock, "destroy-preview-approval-destroy", async () => {
+        const destroy = await minimalService(join(root, ".scenarios", "destroy"), track, clock, ids);
+        const preview = await destroy.preview({ operation: "destroy", provider: "fake" });
+        await destroy.decideGateNumber(4, "approved", "qualification");
+        const destroyed = await destroy.deploy(preview.previewHash);
+        if (destroyed.inventory.resources.length !== 0)
+            throw new Error("Destroy inventory is not empty");
+    }, injectFailure);
+    await checked(context.checks, clock, "customization-conflict-preserves-edit", async () => verifyCustomizationConflict(context), injectFailure);
+    await checked(context.checks, clock, "fault-stale-task", async () => faultStaleTask(root, track, clock, ids), injectFailure);
+    await checked(context.checks, clock, "fault-corrupted-journal", async () => faultCorruptJournal(root, clock, ids), injectFailure);
+    await checked(context.checks, clock, "fault-stale-writer-epoch", async () => faultStaleEpoch(root, clock, ids), injectFailure);
+    await checked(context.checks, clock, "fault-changed-preview", async () => faultChangedPreview(root, track, clock, ids), injectFailure);
+    await checked(context.checks, clock, "fault-cache-invalidation", async () => faultCacheInvalidation(root), injectFailure);
+    await checked(context.checks, clock, "fault-missing-capability-pack", faultMissingCapabilityPack, injectFailure);
+    await checked(context.checks, clock, "fault-crash-after-side-effect-reconciliation", async () => {
+        await context.service.use(projectId(track), context.runId);
+        try {
+            await context.service.reconcile();
+            throw new Error("simulated crash after reconciliation side effect");
+        }
+        catch (error) {
+            if (!(error instanceof Error) || !error.message.includes("simulated crash"))
+                throw error;
+        }
+        restart(context);
+        const reconciled = await context.service.reconcile();
+        if (reconciled === undefined)
+            throw new Error("Reconciliation returned no inventory");
+    }, injectFailure);
+    await checked(context.checks, clock, "repository-byte-hygiene", async () => verifyRepositoryBytes(root), injectFailure);
+    const status = await context.service.status();
+    const journal = new EventJournal(join(root, ".apex", "projects", `qualification-${track}`, "runs", context.runId, "journal"));
+    const replay = await journal.replay();
+    const objectStore = new ObjectStore(root);
+    await checked(context.checks, clock, "event-replay-object-hashes", async () => {
+        if (replay.length === 0 || status.head !== replay.at(-1)?.hash)
+            throw new Error("Replay head does not match service status");
+        for (const event of replay) {
+            const payload = event.payload;
+            for (const [key, value] of Object.entries(payload)) {
+                if ((key.endsWith("ObjectHash") || key === "inventoryHash" || key === "approvalHash") &&
+                    typeof value === "string")
+                    await objectStore.getJson(value);
+            }
+        }
+    }, injectFailure);
+    const logicalInventory = logicalInventoryHash(inventory);
+    const renderedInventory = inventory === undefined ? "" : sha256Json(renderResourceInventory(inventory));
+    return {
+        track,
+        status: qualificationStatus(context.checks),
+        checks: context.checks,
+        eventCount: replay.length,
+        gateRevisionLoops: replay.filter(({ type, payload }) => {
+            if (type === "gate.revision-requested")
+                return true;
+            if (type !== "gate.decided" || payload === null || typeof payload !== "object")
+                return false;
+            return payload.decision === "rejected";
+        }).length,
+        ...(context.taskContextBytes.length === 0 ? {} : { taskContextBytes: Math.max(...context.taskContextBytes) }),
+        hashes: {
+            eventHead: replay.at(-1)?.hash ?? "",
+            logicalInventory,
+            renderedInventory,
+        },
+    };
+}
+function failedTrackReport(track, checks) {
+    return {
+        track,
+        status: "fail",
+        checks,
+        eventCount: 0,
+        hashes: { eventHead: "", logicalInventory: "", renderedInventory: "" },
+    };
+}
+function restart(context) {
+    context.clock.advance(10);
+    context.service = new ApexService(context.root, context.options);
+}
+async function completeRequirementsIntake(service, workload) {
+    let next = await service.nextTask();
+    while (next.status === "needs_input") {
+        await recordQualificationInput(service, next.request, workload);
+        next = await service.nextTask();
+    }
+}
+async function recordQualificationInput(service, request, workload = "qualification-workload") {
+    await service.recordInput({
+        schemaVersion: "1.0.0",
+        requestId: request.requestId,
+        expectedHead: request.expectedHead,
+        ownerEpoch: request.ownerEpoch,
+        answers: request.questions.map(({ id, multiSelect, options, valueType }) => ({
+            questionId: id,
+            value: id === "workload"
+                ? workload
+                : valueType === "budget"
+                    ? { kind: "budget", amount: 250, currency: "USD", cadence: "monthly" }
+                    : valueType === "recovery"
+                        ? { kind: "recovery", rtoMinutes: 60, rpoMinutes: 15 }
+                        : valueType === "data-classification"
+                            ? { kind: "data-classification", classification: "internal" }
+                            : valueType === "compliance"
+                                ? { kind: "compliance", scopes: ["gdpr"] }
+                                : options === undefined
+                                    ? `qualification-${id}`
+                                    : multiSelect === true
+                                        ? [options[0]]
+                                        : options[0],
+        })),
+    });
+}
+async function completeCreativeWorkflow(context) {
+    const { service, runId, track } = context;
+    await completeRequirementsIntake(service, `${track} qualification workload`);
+    const requirementValue = requirements(track);
+    const requirementHashes = await complete(context, "requirements", [
+        { kind: "requirements", value: requirementValue },
+    ]);
+    await complete(context, "requirements-review", [
+        { kind: "review-findings", value: review(context, "requirements", requirementHashes.requirements) },
+    ]);
+    await service.decideGateNumber(1, "approved", "qualification");
+    const availabilityRefs = {};
+    for (const source of ["pricing", "quota", "regionalAvailability"]) {
+        const accepted = (await service.acceptEvidence({
+            kind: `${source}-evidence`,
+            contentType: "application/json",
+            value: { source, mode: "simulated", status: "current" },
+            required: true,
+        }));
+        if (accepted.hash === undefined)
+            throw new Error(`${source} evidence was not accepted`);
+        availabilityRefs[source] = accepted.hash;
+    }
+    await service.acceptEvidence({
+        kind: "architecture-availability-v1",
+        contentType: "application/json",
+        value: availabilityEvidence(context, availabilityRefs),
+        required: true,
+    });
+    restart(context);
+    const architectureValue = architecture(context);
+    const costValue = costEstimate(context);
+    const architectureHashes = await complete(context, "architecture", [
+        { kind: "architecture", value: architectureValue },
+        { kind: "cost-estimate", value: costValue },
+        {
+            kind: "workload-decision-manifest",
+            value: workloadDecisionManifest(context, requirementHashes.requirements, sha256Json(architectureValue), sha256Json(costValue)),
+        },
+    ]);
+    await complete(context, "architecture-review", [
+        { kind: "review-findings", value: review(context, "architecture", architectureHashes.architecture) },
+    ]);
+    const governanceHashes = await complete(context, "governance-discovery", [
+        { kind: "governance-constraints", value: governance(context) },
+    ]);
+    const policyHashes = await complete(context, "governance-reconciliation", [
+        { kind: "policy-property-map", value: policyMap(context, governanceHashes["governance-constraints"]) },
+    ]);
+    await complete(context, "governance-review", [
+        { kind: "review-findings", value: review(context, "policy-property-map", policyHashes["policy-property-map"]) },
+    ]);
+    await context.service.decideGateNumber(2, "approved", "qualification");
+    restart(context);
+    const plan = planBundle(context, {
+        requirements: requirementHashes.requirements,
+        architecture: architectureHashes.architecture,
+        "governance-constraints": governanceHashes["governance-constraints"],
+        "policy-property-map": policyHashes["policy-property-map"],
+    });
+    const planHashes = await complete(context, "plan", plan);
+    await complete(context, "plan-review", [
+        { kind: "review-findings", value: review(context, "plan", planHashes["implementation-intent"]) },
+    ]);
+    await context.service.decideGateNumber(3, "approved", "qualification");
+    restart(context);
+    await complete(context, `codegen-${track}`, codegenBundle(context, plan));
+    await complete(context, `validation-${track}`, [{ kind: "validation-evidence", value: validation(context) }]);
+    if (runId.length === 0)
+        throw new Error("Run was not initialized");
+}
+async function complete(context, expected, outputs) {
+    let issued = await context.service.nextTask();
+    while (issued.status === "needs_input") {
+        await recordQualificationInput(context.service, issued.request);
+        issued = await context.service.nextTask();
+    }
+    if (issued.task.taskType !== expected)
+        throw new Error(`Expected ${expected}, received ${issued.task.taskType}`);
+    const projection = await context.service.taskContext(issued.task.taskId);
+    context.taskContextBytes.push(Buffer.byteLength(JSON.stringify(projection), "utf8"));
+    return (await context.service.completeTaskOutputs(issued.task.taskId, outputs)).outputHashes;
+}
+function projectId(track) {
+    return `qualification-${track}`;
+}
+function requirements(track) {
+    return requirementsFor(projectId(track));
+}
+function requirementsFor(id) {
+    return {
+        schemaVersion: CONTRACT_VERSION,
+        projectId: id,
+        workload: "qualification service",
+        environment: "dev",
+        requirements: [
+            {
+                id: "REQ-1",
+                statement: "Deploy deterministically",
+                priority: "must",
+                status: "confirmed",
+                source: "qualification",
+            },
+        ],
+        assumptions: [],
+        unknowns: [],
+    };
+}
+function intentFor(id, runId, sourceHashes) {
+    return {
+        schemaVersion: CONTRACT_VERSION,
+        projectId: id,
+        runId,
+        sourceHashes,
+        resources: [{ id: "api", type: "fake/service", purpose: "Serve requests", dependsOn: [], controls: [] }],
+        outputs: ["endpoint"],
+    };
+}
+function workloadDecisionManifest(context, requirementsHash, architectureHash, costEstimateHash) {
+    return {
+        schemaVersion: CONTRACT_VERSION,
+        projectId: projectId(context.track),
+        runId: context.runId,
+        environment: "dev",
+        sourceRequirementsHash: requirementsHash,
+        architectureHash,
+        costEstimateHash,
+        environments: ["dev", "prod"],
+        requirementTraceability: [{ requirementId: "REQ-1", skuDecisionIds: ["api-sku"], sloDecisionIds: ["api-slo"] }],
+        skuDecisions: [
+            {
+                id: "api-sku",
+                logicalId: "api",
+                service: "fake/service",
+                sku: "test",
+                quantity: 1,
+                rationale: "qualification",
+                requirementIds: ["REQ-1"],
+                environmentOverrides: [],
+            },
+        ],
+        sloDecisions: [
+            {
+                id: "api-slo",
+                logicalId: "api",
+                availabilityPercent: 99.9,
+                rtoMinutes: 60,
+                rpoMinutes: 15,
+                supportWindow: "business-hours",
+                complianceScopes: ["gdpr"],
+                requirementIds: ["REQ-1"],
+                environmentOverrides: [],
+            },
+        ],
+        revisions: [
+            { number: 1, createdAt: "2026-01-01T00:00:00.000Z", sourceHash: requirementsHash, reason: "qualification" },
+        ],
+    };
+}
+function architecture(context) {
+    return {
+        schemaVersion: CONTRACT_VERSION,
+        projectId: projectId(context.track),
+        runId: context.runId,
+        title: "Qualification",
+        summary: "Equivalent fake architecture",
+        sourceHashes: { requirements: HASH },
+        components: [{ id: "api", service: "fake/service", purpose: "Serve", requirementIds: ["REQ-1"], dependsOn: [] }],
+        decisions: [],
+        risks: [],
+    };
+}
+function costEstimate(context) {
+    return {
+        schemaVersion: CONTRACT_VERSION,
+        projectId: projectId(context.track),
+        runId: context.runId,
+        currency: "USD",
+        pricingDate: "2026-01-01",
+        lineItems: [
+            {
+                id: "api",
+                service: "fake/service",
+                sku: "test",
+                quantity: 1,
+                unitPrice: 1,
+                unitsPerMonth: 1,
+                monthlyCost: 1,
+                source: { provider: "qualification", uri: "https://example.test", retrievedAt: "2026-01-01T00:00:00.000Z" },
+                uncertainty: { lowerMonthlyCost: 1, upperMonthlyCost: 1, confidence: "high", basis: "fixed" },
+            },
+        ],
+        totalMonthlyCost: 1,
+        assumptions: [],
+    };
+}
+function review(context, subjectKind, subjectHash) {
+    return {
+        schemaVersion: CONTRACT_VERSION,
+        projectId: projectId(context.track),
+        runId: context.runId,
+        subjectKind,
+        subjectHash,
+        reviewedAt: context.clock.now().toISOString(),
+        findings: [],
+    };
+}
+function governance(context) {
+    return {
+        schemaVersion: CONTRACT_VERSION,
+        projectId: projectId(context.track),
+        runId: context.runId,
+        targetScope: "local",
+        discoveredAt: context.clock.now().toISOString(),
+        expiresAt: "2027-01-01T00:00:00.000Z",
+        summary: { assignmentCount: 0, denyCount: 0, modifyCount: 0, auditCount: 0, exemptionCount: 0 },
+        constraintsRef: { mediaType: "application/json", uri: "memory://constraints", digest: HASH, bytes: 0 },
+    };
+}
+function availabilityEvidence(context, evidenceRefs) {
+    return {
+        schemaVersion: CONTRACT_VERSION,
+        projectId: projectId(context.track),
+        runId: context.runId,
+        targetScope: "local",
+        mode: "simulated",
+        collectedAt: context.clock.now().toISOString(),
+        expiresAt: "2099-01-01T00:00:00.000Z",
+        checks: {
+            pricing: { status: "current", evidenceRef: evidenceRefs.pricing },
+            quota: { status: "current", evidenceRef: evidenceRefs.quota },
+            regionalAvailability: {
+                status: "current",
+                evidenceRef: evidenceRefs.regionalAvailability,
+            },
+        },
+    };
+}
+function policyMap(context, governanceHash) {
+    return {
+        schemaVersion: CONTRACT_VERSION,
+        projectId: projectId(context.track),
+        runId: context.runId,
+        governanceHash,
+        mappings: [],
+    };
+}
+function planBundle(context, sourceHashes) {
+    const intent = intentFor(projectId(context.track), context.runId, sourceHashes);
+    return [
+        { kind: "implementation-intent", value: intent },
+        {
+            kind: "iac-binding",
+            value: {
+                schemaVersion: CONTRACT_VERSION,
+                projectId: projectId(context.track),
+                runId: context.runId,
+                track: context.track,
+                intentHash: sha256Json(intent),
+                resourceBindings: { api: { implementation: "fake/service", version: "1", parameters: {} } },
+            },
+        },
+        {
+            kind: "environment-inputs",
+            value: {
+                schemaVersion: CONTRACT_VERSION,
+                projectId: projectId(context.track),
+                runId: context.runId,
+                environment: "dev",
+                inputs: {},
+            },
+        },
+    ];
+}
+function codegenBundle(context, plan) {
+    const manifest = {
+        schemaVersion: CONTRACT_VERSION,
+        projectId: projectId(context.track),
+        runId: context.runId,
+        track: context.track,
+        resources: [
+            {
+                logicalId: "api",
+                type: "fake/service",
+                implementationAddress: "api",
+                implementationKind: "resource",
+                ownership: "managed",
+                dependsOn: [],
+                generatedDependencies: [],
+                sourcePath: "main",
+            },
+        ],
+    };
+    return [
+        { kind: "logical-resource-manifest", value: manifest },
+        {
+            kind: "iac-handoff",
+            value: {
+                schemaVersion: CONTRACT_VERSION,
+                projectId: projectId(context.track),
+                runId: context.runId,
+                track: context.track,
+                rootPath: ".apex/work/code",
+                treeHash: HASH,
+                intentHash: sha256Json(plan[0].value),
+                bindingHash: sha256Json(plan[1].value),
+                environmentInputsHash: sha256Json(plan[2].value),
+                logicalResourceManifestHash: sha256Json(manifest),
+                requiredToolVersions: { [context.track]: "test" },
+                generatedAt: context.clock.now().toISOString(),
+            },
+        },
+    ];
+}
+function validation(context) {
+    const validatorIds = context.track === "bicep"
+        ? ["bicep:format", "bicep:build", "bicep:lint"]
+        : ["terraform:format", "terraform:init-backend-false", "terraform:validate"];
+    validatorIds.push("business:security-baseline", "business:policy-property-map", "business:logical-resource-parity");
+    return {
+        schemaVersion: CONTRACT_VERSION,
+        projectId: projectId(context.track),
+        runId: context.runId,
+        createdAt: context.clock.now().toISOString(),
+        entries: validatorIds.map((kind) => ({ kind, hash: HASH, bytes: 1, required: true, retention: "immutable" })),
+    };
+}
+function diagnosis(context) {
+    return {
+        schemaVersion: CONTRACT_VERSION,
+        projectId: projectId(context.track),
+        runId: context.runId,
+        diagnosedAt: context.clock.now().toISOString(),
+        status: "healthy",
+        observations: ["deployed"],
+        causes: [],
+    };
+}
+async function quality(context) {
+    const scorecard = JSON.parse(await readFile(join(context.root, ".apex", "runtime", "quality-scorecard.v1.json"), "utf8"));
+    const measurements = [...scorecard.rules]
+        .map(({ metric, scenario }) => ({ metric, scenario, samples: 0, evidenceRefs: [] }))
+        .sort((left, right) => `${left.metric}\u0000${left.scenario}`.localeCompare(`${right.metric}\u0000${right.scenario}`));
+    const measurementSet = { schemaVersion: CONTRACT_VERSION, measurements };
+    await mkdir(join(context.root, ".apex", "quality"), { recursive: true });
+    await writeFile(join(context.root, ".apex", "quality", "measurements.json"), `${JSON.stringify(measurementSet)}\n`, "utf8");
+    const measurementsHash = sha256Json(measurementSet);
+    const evaluations = evaluateQualityScorecard(scorecard, measurements);
+    return {
+        schemaVersion: CONTRACT_VERSION,
+        projectId: projectId(context.track),
+        runId: context.runId,
+        evaluatedAt: context.clock.now().toISOString(),
+        scorecardHash: sha256Json(scorecard),
+        measurementsHash,
+        status: evaluations.some(({ decision }) => decision === "fail") ||
+            !evaluations.some(({ decision }) => decision === "pass")
+            ? "fail"
+            : "pass",
+        checks: evaluations.map(({ metric, scenario, decision, value, samples, reason }) => ({
+            id: metric,
+            scenario,
+            status: decision,
+            ...(value === undefined ? {} : { value }),
+            samples,
+            evidenceRefs: decision === "omitted" ? [] : [measurementsHash],
+            detail: reason,
+        })),
+    };
+}
+async function verifyCustomizationConflict(context) {
+    const sourceFile = join(context.source, "managed.txt");
+    const localFile = join(context.root, "managed.txt");
+    await writeFile(localFile, "deliberate-user-edit\n", "utf8");
+    await writeFile(sourceFile, "upstream-update\n", "utf8");
+    try {
+        await context.service.update(context.source);
+        throw new Error("Customization conflict was not detected");
+    }
+    catch (error) {
+        if (!(error instanceof ApexError) || error.code !== "APEX_CONFLICT")
+            throw error;
+    }
+    if ((await readFile(localFile, "utf8")) !== "deliberate-user-edit\n")
+        throw new Error("Deliberate edit was overwritten");
+}
+async function faultStaleTask(root, track, clock, ids) {
+    const service = new ApexService(join(root, ".scenarios", "stale-task"), { clock: clock.now, idSource: ids.next });
+    await service.init({ projectId: `stale-${track}`, iacTool: track });
+    await completeRequirementsIntake(service, `${track} stale task workload`);
+    const issued = await service.nextTask();
+    if (issued.status !== "task")
+        throw new Error("Expected fault task");
+    await service.cancelTask(issued.task.taskId);
+    await expectFailure(() => service.completeTaskOutputs(issued.task.taskId, [
+        { kind: "requirements", value: requirementsFor(`stale-${track}`) },
+    ]), /stale/i);
+}
+async function faultCorruptJournal(root, clock, ids) {
+    const directory = join(root, ".faults", ids.next(), "journal");
+    const journal = new EventJournal(directory);
+    await journal.append({
+        eventId: ids.next(),
+        projectId: "fault",
+        runId: "fault",
+        type: "fault",
+        timestamp: clock.now().toISOString(),
+        ownerEpoch: 1,
+        expectedHead: null,
+        payload: { value: 1 },
+    });
+    const file = join(directory, (await readdir(directory))[0]);
+    await writeFile(file, (await readFile(file, "utf8")).replace('"value":1', '"value":2'), "utf8");
+    await expectFailure(() => journal.replay(), /corrupt/i);
+}
+async function faultStaleEpoch(root, clock, ids) {
+    const journal = new EventJournal(join(root, ".faults", ids.next(), "journal"));
+    const first = await journal.append({
+        eventId: ids.next(),
+        projectId: "fault",
+        runId: "fault",
+        type: "first",
+        timestamp: clock.now().toISOString(),
+        ownerEpoch: 2,
+        expectedHead: null,
+        payload: {},
+    });
+    await expectFailure(() => journal.append({
+        eventId: ids.next(),
+        projectId: "fault",
+        runId: "fault",
+        type: "stale",
+        timestamp: clock.now().toISOString(),
+        ownerEpoch: 1,
+        expectedHead: first.hash,
+        payload: {},
+    }), /epoch/i);
+}
+async function faultChangedPreview(root, track, clock, ids) {
+    const service = await minimalService(join(root, ".scenarios", "changed-preview"), track, clock, ids);
+    const preview = await service.preview({ operation: "apply", provider: "fake" });
+    await service.decideGateNumber(4, "approved", "qualification");
+    await expectFailure(() => service.deploy(sha256Json({ changed: preview.previewHash })), /current/i);
+}
+async function minimalService(root, track, clock, ids) {
+    const service = new ApexService(root, { clock: clock.now, idSource: ids.next });
+    const context = {
+        root,
+        source: "",
+        track,
+        clock,
+        ids,
+        options: { clock: clock.now, idSource: ids.next },
+        runId: "",
+        service,
+        checks: [],
+        taskContextBytes: [],
+    };
+    context.runId = (await service.init({ projectId: projectId(track), iacTool: track })).runId;
+    await completeCreativeWorkflow(context);
+    return service;
+}
+async function faultCacheInvalidation(root) {
+    const cache = new ContentCache(root);
+    const input = { dependencies: { source: HASH }, config: { mode: "qualification" }, toolchain: { version: "1" } };
+    contentCacheKey(input);
+    await cache.set(input, { valid: true });
+    if ((await cache.invalidate("source")) !== 1 || (await cache.get(input)) !== null)
+        throw new Error("Cache dependency was not invalidated");
+}
+async function faultMissingCapabilityPack() {
+    const loader = new CapabilityPackLoader({ resolvePackageJson: async () => undefined });
+    const status = await loader.check({ packageName: "@apexops/missing-qualification-pack", version: "1.0.0" });
+    if (status.available || status.compatible || !status.actionableMessage.includes("missing"))
+        throw new Error("Missing pack was not actionable");
+}
+async function verifyRepositoryBytes(root) {
+    const forbidden = [/ghp_[A-Za-z0-9]+/, /BEGIN PRIVATE KEY/, /terraform\.tfstate/, /\.tfplan/];
+    for (const file of await files(root)) {
+        const path = relative(root, file);
+        if (path === ".apex" || path.startsWith(`.apex/`) || path.startsWith(".faults/"))
+            continue;
+        const bytes = await readFile(file);
+        const text = bytes.toString("utf8");
+        if (forbidden.some((pattern) => pattern.test(text)) || /(^|\/)terraform\.tfstate($|\.)|\.tfplan$/i.test(path))
+            throw new Error(`Forbidden repository bytes in ${path}`);
+    }
+}
+async function files(directory) {
+    const entries = await readdir(directory, { withFileTypes: true });
+    const nested = await Promise.all(entries.map(async (entry) => entry.isDirectory() ? files(join(directory, entry.name)) : [join(directory, entry.name)]));
+    return nested.flat();
+}
+function logicalInventoryHash(inventory) {
+    if (inventory === undefined)
+        return "";
+    return sha256Json(inventory.resources
+        .map(({ logicalId, type, location }) => ({ logicalId, type, location }))
+        .sort((left, right) => left.logicalId.localeCompare(right.logicalId)));
+}
+async function checked(checks, clock, id, callback, injectFailure) {
+    const started = clock.now().getTime();
+    clock.advance(1);
+    try {
+        if (injectFailure === id)
+            throw new Error(`Injected qualification failure: ${id}`);
+        await callback();
+        checks.push({ id, status: "pass", durationMs: clock.now().getTime() - started });
+    }
+    catch (error) {
+        checks.push({
+            id,
+            status: "fail",
+            durationMs: clock.now().getTime() - started,
+            detail: error instanceof Error ? error.message : String(error),
+        });
+    }
+}
+async function expectFailure(callback, pattern) {
+    try {
+        await callback();
+    }
+    catch (error) {
+        if (error instanceof Error && pattern.test(error.message))
+            return;
+        throw error;
+    }
+    throw new Error(`Expected failure matching ${pattern}`);
+}
+function budgetCheck(id, actual, maximum) {
+    return actual <= maximum
+        ? { id, status: "pass", durationMs: 0 }
+        : { id, status: "fail", durationMs: 0, detail: `${actual}ms exceeds ${maximum}ms` };
+}
+//# sourceMappingURL=qualification.js.map