@azure-id/orc 1.4.2 → 1.6.0

package/bin/verify-package.js

@@ -52,6 +52,7 @@ const required = [
   "bin/webui/css/panels/challenge.css",
   "bin/webui/css/panels/docs.css",
   "bin/webui/css/panels/extra.css",
+  "bin/webui/css/panels/test.css",
   "bin/webui/css/panels/experiment.css",
   // The client modules (v0.48.1). The <script> order in app.html is the load
   // order and the numeric prefix is that order; 99-boot.js must be last.
@@ -82,6 +83,7 @@ const required = [
   "bin/webui/js/panels/challenge.js",
   "bin/webui/js/panels/docs.js",
   "bin/webui/js/panels/extra.js",
+  "bin/webui/js/panels/test.js",
   "bin/webui/js/90-tour.js",
   "bin/webui/js/91-shortcuts.js",
   "bin/webui/js/99-boot.js",
@@ -106,6 +108,7 @@ const required = [
   "bin/webui/fixtures/crosslink.js",
   "bin/webui/fixtures/mockrun.js",
   "bin/webui/fixtures/extra.js",
+  "bin/webui/fixtures/test.js",
   // The string tables (v0.43.6). Named here for the same reason: English is the
   // FALLBACK table every other language falls back to, so a publish that drops
   // it renders raw dotted keys on every panel, in every language.
@@ -135,6 +138,7 @@ const required = [
   "bin/webui/i18n/en/challenge.json",
   "bin/webui/i18n/en/docs.json",
   "bin/webui/i18n/en/extra.json",
+  "bin/webui/i18n/en/test.json",
   "bin/webui/i18n/en/experiment.json",
   "bin/webui/i18n/en/tour.json",
   "bin/webui/i18n/id/common.json",
@@ -159,6 +163,7 @@ const required = [
   "bin/webui/i18n/id/challenge.json",
   "bin/webui/i18n/id/docs.json",
   "bin/webui/i18n/id/extra.json",
+  "bin/webui/i18n/id/test.json",
   "bin/webui/i18n/id/experiment.json",
   "bin/webui/i18n/id/tour.json",
   // The mocked runs (v0.46.x): the catalogue module plus the folder it reads.
@@ -449,6 +454,15 @@ const required = [
   // lint. Both are already Opus 5, so `opus5_only` adds no twin for either.
   "templates/agents/orc-doc-writer-opus-5-med.md",
   "templates/agents/orc-doc-checker-opus-5-low.md",
+  // v1.5.0 - /orc-test's two agents, and they are two INSTRUMENTS rather than
+  // two tiers of one. The designer is `high` because the cheap answer to
+  // "design some test cases" is the list the CLI already derived for free; the
+  // interpreter is `low` because a harder-thinking interpreter reasons its way
+  // to why a leaked stack trace is probably fine in staging, which is exactly
+  // the gap it exists to find. Nothing may ever upgrade the interpreter. Both
+  // are claude-opus-5, so `opus5_only` adds NO pair and the floor moves by two.
+  "templates/agents/orc-test-designer-opus-5-high.md",
+  "templates/agents/orc-test-interpreter-opus-5-low.md",
   // v1.2.1 — the status line explained for the person reading it, in
   // Simplified Technical English. It ships INTO .claude/hooks/ next to the hook
   // it describes, because that is where somebody looking at a segment they do
@@ -466,6 +480,9 @@ const required = [
   // it. Wired even with the board off, because the measurement is handed over
   // either way.
   "templates/hooks/orc-subagent-line.js",
+  // v1.6.0 — the read gate. The one layer that can refuse an oversized read by
+  // the ORCHESTRATOR. Ships wired but OFF; `read_gate` arms it.
+  "templates/hooks/orc-read-gate.js",
   "templates/hooks/orc-trace.js",
 ];
 
@@ -538,8 +555,13 @@ const agentCount = walkCount(path.join(ROOT, "templates/agents"), ".md");
 // capability from a lane. Fable 5 survives as a SESSION model (the effort guard
 // and the statusline still clear it at medium) — that is a different question,
 // and this wave does not touch it.
-if (skillCount < 38) missing.push(`templates/skills (expected >=38 SKILL.md, found ${skillCount})`);
-if (agentCount < 46) missing.push(`templates/agents (expected >=46 .md, found ${agentCount})`);
+// v1.5.0: +1 skill (orc-test) and +2 agents - the designer and the interpreter.
+// The lane's recon (T2's `unresolved[]`, T4's flow trace) is dispatched AD-HOC
+// by model+effort and earns no agent, the v0.38.0/v0.45.0 precedent, and that
+// limit is stated in the skill: no `SPAWN` line, so `/orc-retro` cannot
+// aggregate it.
+if (skillCount < 39) missing.push(`templates/skills (expected >=39 SKILL.md, found ${skillCount})`);
+if (agentCount < 48) missing.push(`templates/agents (expected >=48 .md, found ${agentCount})`);
 
 // B4 — encoding/mojibake guard. The OneDrive corruption rule becomes a gate:
 // scan every shipped text file for the U+FFFD replacement char (invalid UTF-8

package/bin/webui/api.js

@@ -24,6 +24,7 @@ const { spawn, spawnSync } = require("child_process");
 const fs = require("fs");
 const os = require("os");
 const path = require("path");
+const zlib = require("zlib");
 const fixtures = require("./fixtures/index.js");
 
 const CLI = path.join(__dirname, "..", "cli.js");
@@ -411,6 +412,21 @@ const READS = {
   "/api/extra/demotion": (q) => ["extra", "demotion", ...(q.run ? [String(q.run)] : [])],
   "/api/extra/reconcile": (q) => ["extra", "reconcile", String(q.task || "")],
   "/api/extra/journal/prune/preview": () => ["extra", "journal", "prune", "--dry-run"],
+  // v1.5.0 — /orc-test, the lane that RUNS the test. THREE reads, and every one
+  // of them is a READ in the strict sense this lane needs: none re-scans the
+  // repository, none probes the target, and none writes the ledger. Opening a
+  // page must never be a measurement — a measurement nobody asked for is
+  // traffic nobody authorized.
+  //
+  // `orc test show` is the whole computed view (`--json is not a summary`), so
+  // the surface, the case matrix, the closed OWASP set, the runs and the
+  // findings all arrive in ONE object the panel renders and derives nothing
+  // from: not a state word, not a severity, not an OWASP id, not the tier.
+  // `status` 0 always, `show` 0 / 2 no run, `ui tools` 0 ready / 1 not ready /
+  // 2 the driver is `none` — and 2 there is a SETTING, not a missing tool.
+  "/api/test": () => ["test", "status"],
+  "/api/test/one": (q) => ["test", "show", String(q.slug || "")],
+  "/api/test/ui": () => ["test", "ui", "tools"],
   "/api/patterns": () => ["pattern", "status"],
   "/api/gotchas": () => ["gotcha", "list"],
   "/api/stats": (q) => (q.since ? ["stats", "--since", String(q.since)] : ["stats"]),
@@ -671,6 +687,24 @@ const WRITES = {
   // interactive prompt collects, and every rejection the user sees is the
   // CLI's own validator speaking — there is no second idea of a valid slug,
   // a valid kind or a valid edge target anywhere in this panel.
+  // v1.5.0 — the THREE /orc-test mutations this panel may make, and NONE of
+  // them sends a request to the system under test. `orc test run` is where the
+  // traffic is, and it is a COPY-ABLE COMMAND here and never a button: a page
+  // that can start a scan against a live host is a page that can start one by
+  // accident.
+  //
+  //   · `surface` is the FREE PASS — it reads the repository and the target's
+  //     own spec document, and it is what every later step is derived from.
+  //   · `env` is a HEALTH PROBE, the /orc-test equivalent of `orc extra ping`:
+  //     it asks the target whether it is up. It never starts, stops or fixes
+  //     anything, and on a REMOTE target it refuses BY NAME.
+  //   · `report` RENDERS the ledger into REPORT.md and derives nothing.
+  //
+  // Every one costs zero model tokens, which is the line this panel does not
+  // cross. Nothing here dispatches an agent.
+  "/api/test/surface": (b) => ["test", "surface", String(b.slug)],
+  "/api/test/env": (b) => ["test", "env", String(b.slug)],
+  "/api/test/report": (b) => ["test", "report", String(b.slug)],
   "/api/crosslink/add": (b) => {
     const argv = ["crosslink", "add", String(b.name), String(b.repo_path), "--kinds", String(b.kinds)];
     if (b.direction) argv.push("--direction", String(b.direction));
@@ -875,14 +909,80 @@ function launchClaude(ctx) {
 
 // ── request handling ────────────────────────────────────────────────────────
 
+// A RESPONSE OVER 64 KiB IS A HAZARD ON WINDOWS LOOPBACK (v1.5.0).
+//
+// Measured, and NOT an ORC bug: a twenty-line plain `http.createServer` on this
+// platform loses the tail of a response larger than the 64 KiB socket buffer
+// roughly one time in six, after a handful of short-lived connections. The
+// client receives ~65,077 of 69,177 bytes, the server's `finish` fires and
+// `writableFinished` is true, and nineteen seconds later the client gets
+// ECONNRESET with nothing in any log to say why. Under 60,000 bytes it never
+// happened in any run.
+//
+// `/api/config` was 64,934 bytes — six hundred short of that line — so the
+// Settings tab was one config key away from failing with no message, and it
+// crossed on the release that added five. Two things answer it, and neither is
+// a size limit on what this API may say (`--json is not a summary`):
+//
+//   1. DECLARE THE LENGTH. Without `content-length` Node falls back to chunked
+//      encoding, which is a worse shape for a body of known size and gives the
+//      client no way to tell a truncated read from a complete one.
+//   2. COMPRESS IT WHEN THE CLIENT ASKS. Every browser sends
+//      `accept-encoding: gzip`, and the panel IS a browser — gzip takes that
+//      69 KB answer to about 8 KB, far below the cliff. It is skipped for a
+//      small body, where the CPU is not worth it, and skipped entirely for a
+//      client that did not ask.
+const GZIP_MIN_BYTES = 32 * 1024;
+// `gzip` as a WHOLE token in the header's comma list, so `x-gzip-not-really`
+// never matches. Written out rather than with a regex word boundary, which is
+// not one beside a hyphen.
+const GZIP_ACCEPTED = /(^|,)\s*gzip\s*(;|,|$)/;
+
+// ONE implementation, and serve.js uses it for STATIC files too (v1.5.0). The
+// 64 KiB cliff is a property of the SOCKET, not of the content type: it does not
+// care whether the bytes are an API answer or a panel script. Leaving the static
+// path uncompressed left the two largest files in the app — `extra.js` at 138 KB
+// and `hookui.js` at 76 KB — riding the exact path this was written to fix. It
+// showed up as an intermittent ECONNRESET in the asset-walk test, and it would
+// show up in a real browser as a panel script that stops mid-function.
+//
+// Returns the bytes to send plus the headers that describe them. A caller that
+// forgets to declare the length is the other half of the same bug, so the length
+// is set HERE rather than left to each call site.
+function encodeBody(raw, acceptEncoding) {
+  const headers = {};
+  let body = raw;
+  if (raw.length >= GZIP_MIN_BYTES && GZIP_ACCEPTED.test(String(acceptEncoding || ""))) {
+    try {
+      body = zlib.gzipSync(raw);
+      headers["content-encoding"] = "gzip";
+      // A cache keyed on the URL alone would hand a gzip body to a client that
+      // cannot read one. Nothing caches on loopback today; saying so costs one
+      // header and removes the whole class.
+      headers["vary"] = "accept-encoding";
+    } catch (_) {
+      body = raw;
+    }
+  }
+  headers["content-length"] = String(body.length);
+  return { body, headers };
+}
+
 function json(res, status, obj) {
-  const body = JSON.stringify(obj);
-  res.writeHead(status, {
-    "content-type": "application/json; charset=utf-8",
-    "cache-control": "no-store",
-    // Belt and braces on top of the loopback + token checks in serve.js.
-    "x-content-type-options": "nosniff",
-  });
+  const raw = Buffer.from(JSON.stringify(obj), "utf8");
+  const { body, headers } = encodeBody(raw, res.req && res.req.headers && res.req.headers["accept-encoding"]);
+  res.writeHead(
+    status,
+    Object.assign(
+      {
+        "content-type": "application/json; charset=utf-8",
+        "cache-control": "no-store",
+        // Belt and braces on top of the loopback + token checks in serve.js.
+        "x-content-type-options": "nosniff",
+      },
+      headers
+    )
+  );
   res.end(body);
 }
 
@@ -1285,4 +1385,4 @@ function isDirtyTree(ctx) {
   }
 }
 
-module.exports = { handleApi, clearCache, READS, WRITES, MAINTENANCE };
+module.exports = { handleApi, clearCache, encodeBody, READS, WRITES, MAINTENANCE };

package/bin/webui/app.html

@@ -42,6 +42,7 @@
 <link rel="stylesheet" href="css/panels/challenge.css">
 <link rel="stylesheet" href="css/panels/docs.css">
 <link rel="stylesheet" href="css/panels/extra.css">
+<link rel="stylesheet" href="css/panels/test.css">
 <link rel="stylesheet" href="css/06-responsive.css">
 <link rel="stylesheet" href="css/04-motion.css">
 </head>
@@ -97,6 +98,13 @@
       -->
       <li><a href="#/docs"        data-panel="docs"        data-idx="d" data-i18n="nav.docs">Docs</a></li>
       <li><a href="#/challenge"   data-panel="challenge"   data-idx="c" data-i18n="nav.challenge">Challenge</a></li>
+      <!--
+        v1.5.0. Test sits directly under Challenge because it is the same kind
+        of thing one step further on: Challenge grades what you WROTE, this
+        reports what a running system actually DID. Both stop and hand back
+        rather than fixing what they measured.
+      -->
+      <li><a href="#/test"        data-panel="test"        data-idx="t" data-i18n="nav.test">Test</a></li>
       <li><a href="#/pact"        data-panel="pact"        data-idx="p" data-i18n="nav.pact">Promises</a></li>
       <li><a href="#/boundary"    data-panel="boundary"    data-idx="b" data-i18n="nav.boundary">Boundary</a></li>
       <li><a href="#/wait"        data-panel="wait"        data-idx="w" data-i18n="nav.wait">Wait</a></li>
@@ -206,6 +214,7 @@
 <script src="js/panels/extra.js"></script>
 <script src="js/panels/wait.js"></script>
 <script src="js/panels/hookui.js"></script>
+<script src="js/panels/test.js"></script>
 <script src="js/90-tour.js"></script>
 <script src="js/91-shortcuts.js"></script>
 <script src="js/99-boot.js"></script>

package/bin/webui/css/06-responsive.css

@@ -76,6 +76,20 @@
      band template here would put the target under the caret. */
   .ex-slot-head { grid-template-columns: minmax(0, 40%) minmax(0, 1fr) 16px; }
   .ex-slot-when { grid-column: 1 / -1; }
+  /* v1.5.0 — /orc-test. Every grid here DECLARES its columns, so every one of
+     them collapses explicitly rather than inheriting a template it no longer
+     has the width for. The route, the case row and the OWASP row all keep the
+     SAME child count in every state (that is the `.ex-tool` lesson), so the
+     collapse is a template change and never a hidden child. */
+  .ts-route { grid-template-columns: 56px minmax(0, 1fr); }
+  .ts-route > .chip { grid-column: 2; justify-self: start; }
+  .ts-where { grid-column: 1 / -1; }
+  .ts-case { grid-template-columns: 56px minmax(0, 1fr); }
+  .ts-case > .chip { grid-column: 2; justify-self: start; }
+  .ts-case-mid { grid-column: 1 / -1; }
+  .ts-case-tail { grid-column: 1 / -1; justify-content: flex-start; }
+  .ts-owasp { grid-template-columns: 56px minmax(0, 1fr); }
+  .ts-owasp-mid { grid-column: 1 / -1; }
   .ex-band-chips { grid-column: 1 / -1; justify-content: flex-start; }
   .ex-route-controls { align-items: stretch; }
   .ex-route-controls .btn { width: 100%; }

package/bin/webui/css/panels/test.css

@@ -0,0 +1,132 @@
+/* panels/test.css — the Test panel (v1.5.0).
+
+   /orc-test: five tabs' worth of surface. Loaded by app.html in the order its
+   <link> sits in that manifest, and for CSS the load order IS the cascade
+   order — which is why 06-responsive and 04-motion come after every panel
+   sheet.
+
+   NO COLOUR TOKEN IS DEFINED HERE. Every one of them is declared once, on bare
+   :root, in 00-tokens.css.
+
+   NO MOTION IS DEFINED HERE either. The run rows reuse `.run-row` / `.run-card`
+   from panels/runs.css, so the fold and its reduced-motion behaviour are
+   already one implementation rather than two. */
+
+/* --- the header strip ---------------------------------------------------- */
+/* Above the tabs, on every one of them: what this run measured, in one line.
+   Every value is the CLI's. */
+.ts-strip {
+  display: flex;
+  flex-wrap: wrap;
+  gap: var(--sp-4);
+  padding: var(--sp-3);
+  border: 1px solid var(--line-soft);
+  border-radius: var(--radius-sm);
+  margin-bottom: var(--sp-3);
+}
+.ts-strip-item { display: grid; gap: 2px; }
+.ts-strip-value { font-size: 18px; font-weight: 600; font-variant-numeric: tabular-nums; }
+.ts-strip-label { font-size: 11px; color: var(--text-faint); text-transform: uppercase; letter-spacing: .04em; }
+.ts-strip-item.ts-ok .ts-strip-value { color: var(--ok); }
+.ts-strip-item.ts-warn .ts-strip-value { color: var(--warn); }
+.ts-strip-item.ts-bad .ts-strip-value { color: var(--bad); }
+
+/* --- the caution --------------------------------------------------------- */
+/* OUTSIDE the tabs, because a caution you must hunt for is a caution nobody
+   reads. It fires only on something the run actually MEASURED. */
+.ts-caution {
+  padding: var(--sp-3);
+  border: 1px solid var(--bad);
+  border-radius: var(--radius-sm);
+  background: var(--surface-2);
+  margin-bottom: var(--sp-3);
+}
+.ts-caution-line { display: flex; flex-wrap: wrap; align-items: center; gap: var(--sp-2); }
+
+/* --- the authorization block --------------------------------------------- */
+/* It renders ALWAYS and verbatim. A statement nobody filled in is a STATE, and
+   it is drawn as one — never as an empty row. */
+.ts-auth {
+  display: grid;
+  gap: 2px;
+  padding: var(--sp-3);
+  border-left: 3px solid var(--ok);
+  background: var(--surface-2);
+  border-radius: var(--radius-sm);
+  margin: var(--sp-3) 0;
+}
+.ts-auth-empty { border-left-color: var(--warn); }
+.ts-auth-label { font-size: 11px; color: var(--text-faint); text-transform: uppercase; letter-spacing: .04em; }
+.ts-auth-value { font-size: 14px; }
+.ts-auth-empty .ts-auth-value { color: var(--warn); }
+
+/* The hand-back. ORC does not repair the system it is testing, and the sentence
+   that says so is not decoration. */
+.ts-handback {
+  padding: var(--sp-2) var(--sp-3);
+  border-left: 3px solid var(--warn);
+  background: var(--surface-2);
+  border-radius: var(--radius-sm);
+  font-size: 13px;
+  margin: var(--sp-2) 0;
+}
+
+.ts-label { font-size: 11px; color: var(--text-faint); text-transform: uppercase; letter-spacing: .04em; }
+.ts-where { color: var(--text-dim); font-family: var(--mono); font-size: 12px; }
+
+/* --- the surface --------------------------------------------------------- */
+/* A ROUTE ROW DECLARES ITS COLUMNS. Every route carries the same five children
+   in every state — method, path, two chips, and where it came from — so the
+   template is fixed and a chip can never land in a slack row. */
+.ts-route {
+  display: grid;
+  grid-template-columns: 60px minmax(0, 1fr) auto auto minmax(0, 1fr);
+  align-items: center;
+  gap: var(--sp-2);
+  padding: var(--sp-2) 0;
+  border-top: 1px solid var(--line-soft);
+}
+.ts-route:first-of-type { border-top: 0; }
+.ts-method { font-family: var(--mono); font-size: 12px; font-weight: 600; color: var(--accent); }
+.ts-path { font-family: var(--mono); font-size: 13px; overflow-wrap: anywhere; }
+.ts-route-min { font-family: var(--mono); font-size: 12px; color: var(--text-dim); padding: 2px 0; overflow-wrap: anywhere; }
+.ts-bad { color: var(--bad); }
+
+/* --- the case matrix ----------------------------------------------------- */
+/* Same rule as the route row: FIXED columns, and the tail is a container that
+   is always present even when it holds nothing. A card whose child count
+   changes with its state must not declare its rows (`.ex-tool`'s 250px
+   ellipse), so the count here does not change. */
+.ts-case {
+  display: grid;
+  grid-template-columns: 64px auto auto minmax(0, 1fr) auto;
+  align-items: start;
+  gap: var(--sp-2);
+  padding: var(--sp-2) 0;
+  border-top: 1px solid var(--line-soft);
+}
+.ts-case:first-of-type { border-top: 0; }
+.ts-case-id { font-family: var(--mono); font-size: 12px; font-weight: 600; }
+.ts-case-mid { display: grid; gap: 2px; min-width: 0; }
+.ts-case-target { font-family: var(--mono); font-size: 13px; overflow-wrap: anywhere; }
+.ts-case-why { font-size: 12px; color: var(--text-dim); overflow-wrap: anywhere; }
+.ts-case-gap { font-size: 12px; color: var(--warn); overflow-wrap: anywhere; }
+.ts-case-ev { font-family: var(--mono); font-size: 11px; color: var(--text-faint); overflow-wrap: anywhere; }
+.ts-case-tail { display: flex; flex-wrap: wrap; gap: var(--sp-1); justify-content: flex-end; }
+
+/* --- the closed OWASP set ------------------------------------------------ */
+/* TEN ROWS, ALWAYS. An `unchecked` row keeps its slot and carries its reason;
+   it is drawn quieter than a FOUND row and it is never drawn as absent. */
+.ts-owasp {
+  display: grid;
+  grid-template-columns: 64px auto minmax(0, 1fr);
+  align-items: start;
+  gap: var(--sp-2);
+  padding: var(--sp-2) 0;
+  border-top: 1px solid var(--line-soft);
+}
+.ts-owasp:first-of-type { border-top: 0; }
+.ts-owasp-id { font-family: var(--mono); font-size: 12px; font-weight: 600; }
+.ts-owasp-mid { display: grid; gap: 3px; min-width: 0; }
+.ts-owasp-name { font-size: 13px; }
+.ts-owasp-unchecked { font-size: 12px; color: var(--text-dim); overflow-wrap: anywhere; }

package/bin/webui/fixtures/index.js

@@ -36,6 +36,7 @@ const { laneList, lanePhases, laneCalls } = require("./lanes.js");
 const { diy } = require("./flow.js");
 const { crosslink } = require("./crosslink.js");
 const { mockDetail } = require("./mockrun.js");
+const { testList, testShows, testShowToy, testUiTools, testEnvUnhealthy, testEnvAbsent, testEnvRemote } = require("./test.js");
 const { extraProviders, extraList, extraListNoConnection, extraListNeverTested, extraTools, extraKeyhelp, extraModels, extraDoctor, extraRoute, extraRole, extraLanes, extraStats, extraRates, extraPingOk, extraPingBad, extraPingSaveOffer, extraJournal, extraReconcile, extraJournalPrune, extraPingLive, extraPingDeadModel, extraPingNotInstalled, extraInstall, extraDemotion } = require("./extra.js");
 
 module.exports.get = function get(route, q) {
@@ -50,6 +51,15 @@ module.exports.get = function get(route, q) {
     // a required reason is collected) could never be designed.
     case "/api/extra/demotion":
       return extraDemotion;
+    // v1.5.0 — /orc-test. An unknown slug falls to the RED run rather than
+    // returning nothing: a fixture that 404s teaches the panel a state the CLI
+    // does not have (`orc test show` exits 2 and says so in words).
+    case "/api/test":
+      return testList;
+    case "/api/test/one":
+      return testShows[(q && q.slug) || ""] || testShowToy;
+    case "/api/test/ui":
+      return testUiTools;
     case "/api/lanes":
       return laneList;
     case "/api/lane/phases":
@@ -496,11 +506,23 @@ module.exports.get = function get(route, q) {
 // from the profile so they agree with what the list already claims.
 //
 // A route with no entry here still gets the ordinary "nothing ran" reply.
+// v1.5.0 — the /orc-test environment probe. Its OUTCOME is the state worth
+// designing — `unhealthy` is the one where ORC stops and hands the machine back
+// — so it answers with canned data rather than "nothing ran", on the
+// `orc extra ping` precedent. Keyed by slug so `absent` and the REMOTE refusal
+// are reachable too. `surface` and `report` still answer "nothing ran": their
+// outcome is a file on disk, not a state.
+const TEST_ENV = { "api-users": [1, testEnvUnhealthy], "orders-api": [1, testEnvAbsent], "staging-checkout": [2, testEnvRemote] };
+
 module.exports.post = function post(route, body) {
   // `add` answers OK so the CONNECT FLOW can be walked end to end in fixture
   // mode — the add is only the step before the test, and the test's outcome is
   // the state worth designing. Every other write still answers "nothing ran".
-  if (route === "/api/extra/add") return { exit_code: 0, data: { ok: true, next: "orc extra ping" } };
+  if (route === "/api/test/env") {
+    const [exit_code, data] = TEST_ENV[String((body && body.slug) || "")] || TEST_ENV["api-users"];
+    return { exit_code, data };
+  }
+    if (route === "/api/extra/add") return { exit_code: 0, data: { ok: true, next: "orc extra ping" } };
   // v0.51.0 — a launch that could NOT happen and one that did. Both are exit 0,
   // because "no terminal here" is an ANSWER carrying the command to paste.
   if (route === "/api/extra/install")