@bevel-software/platform-core-backend 0.20.0 → 0.21.0

package/src/modules/workflow/__tests__/merge-announces-tree.test.ts

@@ -1,10 +1,6 @@
-import { afterAll, beforeAll, describe, it, expect, vi } from 'vitest';
-import {
-  DEFAULT_BRANCH,
-  branchModelFromEnv,
-  configureBranchModel,
-  type WorkflowEvent,
-} from '@bevel-software/platform-shared';
+import { describe, it, expect, vi } from 'vitest';
+import { testKbContext } from '../../../__tests__/kb-context.js';
+import type { WorkflowEvent } from '@bevel-software/platform-shared';
 
 import type { GitService } from '../git/git.service.js';
 import type { PullRequestService } from '../git/pull-request.service.js';
@@ -47,24 +43,16 @@ const USER = { id: 'u1', email: 'someone@x.com', name: 'Someone' };
 /**
  * A default branch this deployment chose, pinned for the whole file.
  *
- * `DEFAULT_BRANCH` is a binding a deployment configures at boot (the suite's
- * `test-setup.ts` applies the environment's), so reading it here would make
- * these assertions agree with whatever that environment happens to say — and a
+ * The environment's pair (which `test-setup.ts` mirrors onto the shared
+ * bindings) is what most fixtures run under, so a service that read THAT
+ * would make these assertions agree with whatever it happens to say — and a
  * regression that hardcoded a branch name would still pass wherever the two
  * coincided. Deliberately NOT `main`, so `main` written into the emit would
- * fail here rather than slip through.
+ * fail here rather than slip through. The service is handed this model by
+ * constructor, so nothing process-wide changes for the files after this one.
  */
 const TRUNK = 'trunk';
-
-beforeAll(() => {
-  configureBranchModel({ defaultBranch: TRUNK, protectedBranches: [TRUNK] });
-});
-afterAll(() => {
-  // Back to what the suite booted with: the binding is process-wide, and a
-  // file that leaves its own branch model behind changes the meaning of
-  // anything that runs after it in the same worker.
-  configureBranchModel(branchModelFromEnv());
-});
+const kb = testKbContext({ kbDirName: KB_DIR, branchModel: { defaultBranch: TRUNK, protectedBranches: [TRUNK] } });
 
 function noopAccessControl(): IAccessControl {
   return { invalidate: vi.fn() } as unknown as IAccessControl;
@@ -120,7 +108,7 @@ function makeSvc(
     noopAccessControl(),
     { acquire: vi.fn(), release: vi.fn() } as unknown as FileLockService,
     {} as unknown as PendingCommitsService,
-    KB_DIR,
+    kb,
     openChangeGate(),
     bus,
   );
@@ -145,10 +133,10 @@ describe('applying a change request announces the tree it rewrote', () => {
     expect(treeEvents()).toEqual([
       { kind: 'fs-tree-changed', workspaceId: encodeURIComponent(TRUNK), branch: TRUNK },
     ]);
-    // The deployment's own default branch, read from the binding rather than
-    // written into the emit: these two are the same thing, and a hardcoded
-    // branch name would make them differ.
-    expect(DEFAULT_BRANCH).toBe(TRUNK);
+    // The deployment's own default branch, read from the context the service
+    // was handed rather than written into the emit: these two are the same
+    // thing, and a hardcoded branch name would make them differ.
+    expect(kb.defaultBranch).toBe(TRUNK);
   });
 
   /**

package/src/modules/workflow/__tests__/preserve-roles-yaml.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 import { promises as fs } from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
@@ -120,7 +121,7 @@ describe('mergeChangeRequest — roles.yaml preservation guard', () => {
       {} as unknown as Database,
       git, prs, reviewWorkflow, workspaceService, ac,
       fileLocks, {} as unknown as PendingCommitsService,
-      KB_DIR,
+      testKbContext({ kbDirName: KB_DIR }),
       openChangeGate(),
     );
     // Conflicts are now surfaced by the local merge inside `reviewWorkflow.mergePr`

package/src/modules/workflow/__tests__/session-ontology.service.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, beforeEach, vi } from 'vitest';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 
 import { SessionOntologyService } from '../session-ontology.service.js';
 import type { Database } from '../../database/connection.js';
@@ -90,7 +91,7 @@ vi.mock('drizzle-orm', async (importOriginal) => {
 
 function makeService() {
   const db = makeFakeDb();
-  return { svc: new SessionOntologyService(db as unknown as Database), db };
+  return { svc: new SessionOntologyService(db as unknown as Database, testKbContext()), db };
 }
 
 describe('SessionOntologyService (touched-set model)', () => {
@@ -157,7 +158,7 @@ describe('SessionOntologyService (touched-set model)', () => {
   it('survives a "restart": a new instance re-reads the touched set from the store', async () => {
     await svc.checkOperation('s1', P_READ, false);
     await svc.checkOperation('s1', PL_READ, false);
-    const afterRestart = new SessionOntologyService(db as unknown as Database);
+    const afterRestart = new SessionOntologyService(db as unknown as Database, testKbContext());
     // The poison persists across the restart: writes still blocked.
     expect((await afterRestart.checkOperation('s1', P_READ, true)).allow).toBe(false);
   });

package/src/modules/workflow/__tests__/workflow.routes.lock-path.test.ts

@@ -2,6 +2,7 @@ import type { Server } from 'node:http';
 import type { AddressInfo } from 'node:net';
 import express from 'express';
 import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 import type { AuthUser, Change, IWorkflowService } from '@bevel-software/platform-shared';
 import type { Database } from '../../database/connection.js';
 import type { IAccessControl } from '../../access/access-control.interface.js';
@@ -79,7 +80,7 @@ async function makeHarness(): Promise<Harness> {
     {} as IAccessControl,
     new FileLockService(fake.db),
     pending,
-    KB,
+    testKbContext({ kbDirName: KB }),
     openChangeGate(),
     events,
   );

package/src/modules/workflow/__tests__/workflow.service.branch-in-use.test.ts

@@ -1,6 +1,6 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { describe, it, expect, vi } from 'vitest';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 import { drizzle } from 'drizzle-orm/pg-proxy';
-import { configureBranchModel } from '@bevel-software/platform-shared';
 import type { GitService } from '../git/git.service.js';
 import type { PullRequestService } from '../git/pull-request.service.js';
 import type { IReviewWorkflowService } from '../review-workflow/review-workflow.interface.js';
@@ -103,7 +103,7 @@ function makeService(db: Database, git: Partial<GitService>) {
     {} as IAccessControl,
     {} as FileLockService,
     {} as PendingCommitsService,
-    'knowledge-base',
+    testKbContext(),
     openChangeGate(),
   );
 }
@@ -132,13 +132,6 @@ function retire(svc: WorkflowService, number: number, base: string) {
   ).retireMergedSourceBranch(number, base, USER);
 }
 
-beforeEach(() => {
-  configureBranchModel({
-    defaultBranch: 'target-company-state',
-    protectedBranches: ['current-company-state', 'target-company-state'],
-  });
-});
-
 describe('post-merge branch retirement', () => {
   it('keeps a branch another open request proposes INTO', async () => {
     const deleted: string[] = [];

package/src/modules/workflow/__tests__/workflow.service.commitFileWhileLocked.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 import type { AuthUser, Change } from '@bevel-software/platform-shared';
 import type { GitService } from '../git/git.service.js';
 import type { PullRequestService } from '../git/pull-request.service.js';
@@ -113,7 +114,7 @@ function makeFacade(git: GitService, locks: FileLockService, events: WorkflowEve
     {} as IAccessControl,
     locks,
     pending,
-    'knowledge-base',
+    testKbContext(),
     openChangeGate(),
     events,
   );

package/src/modules/workflow/__tests__/workflow.service.deleted-branch-sweep.test.ts

@@ -1,5 +1,5 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { configureBranchModel } from '@bevel-software/platform-shared';
+import { describe, it, expect, vi } from 'vitest';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 import type { GitService } from '../git/git.service.js';
 import type { PullRequestService } from '../git/pull-request.service.js';
 import type { IReviewWorkflowService } from '../review-workflow/review-workflow.interface.js';
@@ -67,7 +67,7 @@ function makeService(open: OpenRow[], listBranches: () => Promise<{ name: string
     {} as IAccessControl,
     {} as FileLockService,
     {} as PendingCommitsService,
-    'knowledge-base',
+    testKbContext(),
     openChangeGate(),
   );
   (svc as unknown as { events?: { emit(e: unknown): void } }).events = {
@@ -76,13 +76,6 @@ function makeService(open: OpenRow[], listBranches: () => Promise<{ name: string
   return { svc, git, invalidated, emitted };
 }
 
-beforeEach(() => {
-  configureBranchModel({
-    defaultBranch: 'target-company-state',
-    protectedBranches: ['current-company-state', 'target-company-state'],
-  });
-});
-
 describe('closeChangeRequestsWithDeletedBranches', () => {
   it('closes a request whose source branch is gone', async () => {
     const { svc, invalidated, emitted } = makeService(

package/src/modules/workflow/__tests__/workflow.service.facade.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, vi } from 'vitest';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 import type {
   AuthUser,
   ChangeInput,
@@ -13,7 +14,7 @@ import { FileLockService } from '../file-lock.service.js';
 import { PendingCommitsService } from '../pending-commits.service.js';
 import { WorkflowService } from '../workflow.service.js';
 import { PullRebaseConflictError, WorkflowDomainError } from '../../../shared/domain-errors.js';
-import { DEFAULT_BRANCH, isProtectedBranch } from '@bevel-software/platform-shared';
+import { DEFAULT_BRANCH } from '@bevel-software/platform-shared';
 import type { Database } from '../../database/connection.js';
 import { openChangeGate } from '../../../__tests__/open-change-gate.js';
 
@@ -238,7 +239,7 @@ describe('WorkflowService — branch delegation', () => {
     const branches = [{ name: 'main', isCurrent: true, isProtected: true, ahead: 0, behind: 0, hasRemote: true }];
     (git.listBranches as ReturnType<typeof vi.fn>).mockResolvedValue(branches);
 
-    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     await expect(svc.listBranches('w1')).resolves.toBe(branches);
     // listBranches(workspaceId, opts?) forwards opts — undefined when omitted.
     expect(git.listBranches).toHaveBeenCalledWith('w1', undefined);
@@ -248,7 +249,7 @@ describe('WorkflowService — branch delegation', () => {
     const git = makeGit();
     (git.createBranch as ReturnType<typeof vi.fn>).mockResolvedValue({ name: 'feat' });
 
-    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     await svc.createBranch('w1', 'feat', 'current-company-state');
     expect(git.createBranch).toHaveBeenCalledWith('w1', 'feat', 'current-company-state');
   });
@@ -258,7 +259,7 @@ describe('WorkflowService — branch delegation', () => {
     const status = { branch: 'main', isDirty: false, hasUpstream: true, unpushedCommits: 0, conflicted: [], unmergedFromUpstream: false };
     (git.status as ReturnType<typeof vi.fn>).mockResolvedValue(status);
 
-    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     await expect(svc.branchStatus('w1')).resolves.toBe(status);
     expect(git.status).toHaveBeenCalledWith('w1');
   });
@@ -272,7 +273,7 @@ describe('WorkflowService — change delegation', () => {
     const commit = { sha: 'abc', authorName: 'Alice', authorEmail: 'alice@example.com', subject: 'tweak owner', committedAt: '2026-01-01T00:00:00Z' };
     (git.commit as ReturnType<typeof vi.fn>).mockResolvedValue(commit);
 
-    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     await expect(svc.commitChange('w1', user, input)).resolves.toBe(commit);
     expect(git.commit).toHaveBeenCalledWith('w1', user, input);
   });
@@ -281,7 +282,7 @@ describe('WorkflowService — change delegation', () => {
     const git = makeGit();
     (git.logForFile as ReturnType<typeof vi.fn>).mockResolvedValue([]);
 
-    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     await svc.listChangesForFile('w1', 'Knowledge/Foo.md', 5);
     expect(git.logForFile).toHaveBeenCalledWith('w1', 'Knowledge/Foo.md', 5);
   });
@@ -290,7 +291,7 @@ describe('WorkflowService — change delegation', () => {
     const git = makeGit();
     (git.diffFileBetweenBranches as ReturnType<typeof vi.fn>).mockResolvedValue('@@ diff');
 
-    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     const diff = await svc.compareFile('w1', 'Foo.md', 'a', 'b');
     expect(diff).toBe('@@ diff');
     expect(git.diffFileBetweenBranches).toHaveBeenCalledWith('w1', 'Foo.md', 'a', 'b');
@@ -302,7 +303,7 @@ describe('WorkflowService — change request delegation + cache invalidation', (
     const prs = makePrs();
     (prs.listOpenPrs as ReturnType<typeof vi.fn>).mockResolvedValue([]);
 
-    const svc = new WorkflowService(makeDb(), makeGit(), prs, makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), makeGit(), prs, makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     await svc.listChangeRequests({ fresh: true });
     expect(prs.listOpenPrs).toHaveBeenCalledWith({ fresh: true });
   });
@@ -314,7 +315,7 @@ describe('WorkflowService — change request delegation + cache invalidation', (
     const input: PostChangeRequestCommentInput = { body: 'hi' };
     (reviewWorkflow.postComment as ReturnType<typeof vi.fn>).mockResolvedValue(comment);
 
-    const svc = new WorkflowService(makeDb(), makeGit(), prs, reviewWorkflow, makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), makeGit(), prs, reviewWorkflow, makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     const user = makeUser();
     await expect(svc.postComment(42, user, input, 'sha1')).resolves.toBe(comment);
     expect(reviewWorkflow.postComment).toHaveBeenCalledWith(42, user, input, 'sha1');
@@ -327,7 +328,7 @@ describe('WorkflowService — change request delegation + cache invalidation', (
     const reviewWorkflow = makeReviewWorkflow();
     (reviewWorkflow.approveFile as ReturnType<typeof vi.fn>).mockResolvedValue([]);
 
-    const svc = new WorkflowService(makeDb(), makeGit(), prs, reviewWorkflow, makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), makeGit(), prs, reviewWorkflow, makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     await svc.approveFile(7, 'Foo.md', makeUser(), [], 'sha', 'main', null, 'w1');
     expect(prs.invalidateDetailCache).toHaveBeenCalledWith(7);
     expect(prs.invalidateDetailCache).toHaveBeenCalledTimes(1);
@@ -338,7 +339,7 @@ describe('WorkflowService — change request delegation + cache invalidation', (
     const reviewWorkflow = makeReviewWorkflow();
     (reviewWorkflow.cancelPr as ReturnType<typeof vi.fn>).mockResolvedValue({ prNumber: 9, cancelledAt: 't' });
 
-    const svc = new WorkflowService(makeDb(), makeGit(), prs, reviewWorkflow, makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), makeGit(), prs, reviewWorkflow, makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     const user = makeUser();
     await svc.rejectChangeRequest(9, user, 'open', null, 'main', 'w1');
     expect(reviewWorkflow.cancelPr).toHaveBeenCalledWith(9, user, 'open', null, 'main', 'w1');
@@ -357,7 +358,7 @@ describe('WorkflowService — change request delegation + cache invalidation', (
 
     const git = makeGit();
     const workspaceService = makeWorkspaceService();
-    const svc = new WorkflowService(makeDb(), git, prs, reviewWorkflow, workspaceService, makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), git, prs, reviewWorkflow, workspaceService, makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     // Conflicts are surfaced by the local merge inside `reviewWorkflow.mergePr`
     // (mocked here), so there's no provider "mergeable" pre-check to stub.
     const outcome = await svc.mergeChangeRequest(
@@ -412,7 +413,7 @@ describe('WorkflowService — change request delegation + cache invalidation', (
       id: 'resolved-target-ws',
     });
     const pending = makePendingCommits();
-    const svc = new WorkflowService(makeDb(), git, prs, reviewWorkflow, workspaceService, makeAccessControl(), makeFileLockService(), pending, 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), git, prs, reviewWorkflow, workspaceService, makeAccessControl(), makeFileLockService(), pending, testKbContext(), openChangeGate());
 
     const outcome = await svc.mergeChangeRequest(
       4, makeUser(), 'sha', [], 'open', 'PR title', 'main', 'w1', { bypass: true },
@@ -435,7 +436,7 @@ describe('WorkflowService — change request delegation + cache invalidation', (
 describe('WorkflowService — file lock delegation', () => {
   it('acquireLock delegates to FileLockService.acquire', async () => {
     const fileLocks = makeFileLockService();
-    const svc = new WorkflowService(makeDb(), makeGit(), makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), fileLocks, makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), makeGit(), makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), fileLocks, makePendingCommits(), testKbContext(), openChangeGate());
     await svc.acquireLock('w1', 'b', 'p', makeUser());
     expect(fileLocks.acquire).toHaveBeenCalledWith('w1', 'b', 'p', expect.objectContaining({ email: 'alice@example.com' }), undefined);
   });
@@ -445,7 +446,7 @@ describe('WorkflowService — file lock delegation', () => {
     // a coordination hold masquerade as an edit lock on the very next read
     // (which is how the write paths decide what the holder may do).
     const fileLocks = makeFileLockService();
-    const svc = new WorkflowService(makeDb(), makeGit(), makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), fileLocks, makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), makeGit(), makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), fileLocks, makePendingCommits(), testKbContext(), openChangeGate());
     await svc.acquireLock('w1', 'b', 'p', makeUser(), { coordination: true });
     expect(fileLocks.acquire).toHaveBeenCalledWith(
       'w1', 'b', 'p', expect.objectContaining({ email: 'alice@example.com' }), { coordination: true },
@@ -454,7 +455,7 @@ describe('WorkflowService — file lock delegation', () => {
 
   it('getLock delegates to FileLockService.get', async () => {
     const fileLocks = makeFileLockService();
-    const svc = new WorkflowService(makeDb(), makeGit(), makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), fileLocks, makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), makeGit(), makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), fileLocks, makePendingCommits(), testKbContext(), openChangeGate());
     await expect(svc.getLock('w1', 'b', 'p')).resolves.toBeNull();
     expect(fileLocks.get).toHaveBeenCalledWith('w1', 'b', 'p');
   });
@@ -469,7 +470,7 @@ describe('WorkflowService — file lock delegation', () => {
       acquiredAt: '', lastHeartbeatAt: '', expiresAt: '',
     });
     const pending = makePendingCommits();
-    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), fileLocks, pending, 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), fileLocks, pending, testKbContext(), openChangeGate());
     await expect(svc.releaseLock('w1', 'feat', 'Foo.md', makeUser())).resolves.toBeUndefined();
     // No inline git work — the worker handles that out of band.
     expect(git.commitFile).not.toHaveBeenCalled();
@@ -488,28 +489,28 @@ describe('WorkflowService — file lock delegation', () => {
     // One open request rides the branch — deleting it would strand the request.
     // `sourceBranch` matters to the guard now: it decides whether the refusal
     // says "withdraw yours" (source) or names the other request's actors (target).
-    const svc = new WorkflowService(makeDb([{ number: 7, sourceBranch: 'feat/x', targetBranch: 'dev', state: 'open' }]), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb([{ number: 7, sourceBranch: 'feat/x', targetBranch: 'dev', state: 'open' }]), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     await expect(svc.deleteBranch('w1', 'feat/x', makeUser())).rejects.toThrow(/open change request \(#7\)/);
     expect(git.deleteBranch).not.toHaveBeenCalled();
   });
 
   it('deleteBranch refuses when an open request proposes INTO the branch (target end)', async () => {
     const git = makeGit();
-    const svc = new WorkflowService(makeDb([{ number: 9, sourceBranch: 'other/y', targetBranch: 'feat/x', state: 'open' }]), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb([{ number: 9, sourceBranch: 'other/y', targetBranch: 'feat/x', state: 'open' }]), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     await expect(svc.deleteBranch('w1', 'feat/x', makeUser())).rejects.toThrow(/proposes changes into/);
     expect(git.deleteBranch).not.toHaveBeenCalled();
   });
 
   it('deleteBranch proceeds past a CLOSED request — the guard filters on state, not mere mention', async () => {
     const git = makeGit();
-    const svc = new WorkflowService(makeDb([{ number: 7, sourceBranch: 'feat/x', targetBranch: 'dev', state: 'closed' }]), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb([{ number: 7, sourceBranch: 'feat/x', targetBranch: 'dev', state: 'closed' }]), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     await expect(svc.deleteBranch('w1', 'feat/x', makeUser())).resolves.toBeUndefined();
     expect(git.deleteBranch).toHaveBeenCalled();
   });
 
   it('deleteBranch deletes when the branch has no open change request', async () => {
     const git = makeGit();
-    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     await expect(svc.deleteBranch('w1', 'feat/x', makeUser())).resolves.toBeUndefined();
     expect(git.deleteBranch).toHaveBeenCalledWith('w1', 'feat/x', expect.objectContaining({ email: 'alice@example.com' }), undefined);
   });
@@ -529,7 +530,7 @@ describe('WorkflowService — file lock delegation', () => {
     vi.mocked(git.deleteBranch)
       .mockImplementationOnce(async () => { order.push('first:start'); await gate; order.push('first:end'); })
       .mockImplementationOnce(async () => { order.push('second'); });
-    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     const first = svc.deleteBranch('w1', 'feat/x', makeUser());
     const second = svc.deleteBranch('w1', 'feat/x', makeUser());
     // Only release the gate once the first operation is provably inside its
@@ -544,7 +545,7 @@ describe('WorkflowService — file lock delegation', () => {
   it('releaseLock refuses when the caller does not hold the lock', async () => {
     const git = makeGit();
     const fileLocks = makeFileLockService(); // default: get → null
-    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), fileLocks, makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb(), git, makePrs(), makeReviewWorkflow(), makeWorkspaceService(), makeAccessControl(), fileLocks, makePendingCommits(), testKbContext(), openChangeGate());
     await expect(svc.releaseLock('w1', 'feat', 'Foo.md', makeUser())).rejects.toThrow(/not held by you/);
     // The commit must NOT run when the caller doesn't hold the lock —
     // otherwise a non-holder could trigger a commit attributed as them.
@@ -605,7 +606,7 @@ describe('WorkflowService — revertChangeRequestFile / closeEmptyChangeRequest'
       returning: vi.fn(async () => updateRows),
     });
     const db = chain as unknown as Database;
-    const svc = new WorkflowService(db, git, prs, makeReviewWorkflow(), makeWorkspaceService(), access, fileLocks, makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(db, git, prs, makeReviewWorkflow(), makeWorkspaceService(), access, fileLocks, makePendingCommits(), testKbContext(), openChangeGate());
     return { svc, git, prs, access, fileLocks, db: chain };
   }
 
@@ -808,7 +809,7 @@ describe('WorkflowService — deleteChangeRequest (admin moderation verb)', () =
       returning: vi.fn(async () => [{ id: 1 }]),
     });
     const workspaces = makeWorkspaceService();
-    const svc = new WorkflowService(chain as unknown as Database, git, prs, makeReviewWorkflow(), workspaces, access, makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(chain as unknown as Database, git, prs, makeReviewWorkflow(), workspaces, access, makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     return { svc, prs, db: chain, access, workspaces };
   }
 
@@ -916,7 +917,7 @@ describe('WorkflowService.mergeBranch — an agent merges branches, never an ope
     const access = makeAccessControl();
     (access.canWriteBatchAtRef as ReturnType<typeof vi.fn>).mockResolvedValue(opts.canWrite === undefined ? null : opts.canWrite);
     const workspaceService = makeWorkspaceService();
-    const svc = new WorkflowService(makeDb([OPEN_REQUEST]), git, makePrs(), makeReviewWorkflow(), workspaceService, access, makeFileLockService(), makePendingCommits(), 'knowledge-base', openChangeGate());
+    const svc = new WorkflowService(makeDb([OPEN_REQUEST]), git, makePrs(), makeReviewWorkflow(), workspaceService, access, makeFileLockService(), makePendingCommits(), testKbContext(), openChangeGate());
     const merge = (git as unknown as { mergeChangeRequest: ReturnType<typeof vi.fn> }).mergeChangeRequest;
     return { svc, git, access, merge };
   }
@@ -956,7 +957,7 @@ describe('WorkflowService.mergeBranch — an agent merges branches, never an ope
   });
 
   it('refuses a protected target when the caller could not commit the changed files directly', async () => {
-    expect(isProtectedBranch(PROTECTED)).toBe(true);
+    expect(testKbContext().isProtectedBranch(PROTECTED)).toBe(true);
     const { svc, git, access, merge } = harness({ canWrite: new Map([['Team/Process.md', false]]) });
     const err = await svc.mergeBranch(makeUser(), 'alice/other', PROTECTED).catch((e: unknown) => e);
     expect(err).toMatchObject({ status: 403, payload: { kind: 'protected-merge-target', deniedPaths: ['Team/Process.md'] } });

package/src/modules/workflow/__tests__/workflow.service.folder-proposals.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, vi } from 'vitest';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 import type { AuthUser, PullRequestSummary } from '@bevel-software/platform-shared';
 import type { GitService } from '../git/git.service.js';
 import type { PullRequestService } from '../git/pull-request.service.js';
@@ -138,7 +139,7 @@ function makeHarness(requests: PullRequestSummary[], access: Access = {}) {
     accessControl,
     fileLocks,
     pendingCommits,
-    'knowledge-base',
+    testKbContext(),
     openChangeGate(),
   );
   // Which request an UPDATE is closing is not recoverable from the drizzle

package/src/modules/workflow/__tests__/workflow.service.platform-restore.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, vi } from 'vitest';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 import type { AuthUser } from '@bevel-software/platform-shared';
 import type { GitService } from '../git/git.service.js';
 import type { PullRequestService } from '../git/pull-request.service.js';
@@ -53,7 +54,7 @@ function makeService(canRestorePlatformFile: IAccessControl['canRestorePlatformF
     accessControl,
     { acquire, get: vi.fn(async () => null) } as unknown as FileLockService,
     {} as PendingCommitsService,
-    KB,
+    testKbContext({ kbDirName: KB }),
     openChangeGate(),
     new WorkflowEventBus(),
   );

package/src/modules/workflow/__tests__/workflow.service.read-gate.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, vi } from 'vitest';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 import type { AuthUser } from '@bevel-software/platform-shared';
 import type { GitService } from '../git/git.service.js';
 import type { PullRequestService } from '../git/pull-request.service.js';
@@ -61,7 +62,7 @@ function makeService(opts: {
     accessControl,
     { acquire, get: vi.fn(async () => null) } as unknown as FileLockService,
     {} as PendingCommitsService,
-    KB,
+    testKbContext({ kbDirName: KB }),
     opts.gate ?? gateThat({ allowed: true, via: 'readable' }).gate,
     new WorkflowEventBus(),
   );
@@ -81,7 +82,7 @@ describe('WorkflowService cannot exist without the gate', () => {
           {} as IAccessControl,
           {} as FileLockService,
           {} as PendingCommitsService,
-          KB,
+          testKbContext({ kbDirName: KB }),
           undefined as unknown as IChangeReadGate,
         ),
     ).toThrow(/requires a read-before-write gate/);

package/src/modules/workflow/__tests__/workflow.service.releaseLock.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, vi, beforeEach, type MockInstance } from 'vitest';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 import type { AuthUser, Change } from '@bevel-software/platform-shared';
 import type { GitService } from '../git/git.service.js';
 import type { PullRequestService } from '../git/pull-request.service.js';
@@ -143,7 +144,7 @@ function makeFacade(
     {} as IAccessControl,
     locks,
     pending,
-    'knowledge-base',
+    testKbContext(),
     openChangeGate(),
     events,
   );

package/src/modules/workflow/__tests__/workflow.service.sync.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, it, vi } from 'vitest';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 import type { RemoteSyncPullResult } from '@bevel-software/platform-shared';
 import type { GitService } from '../git/git.service.js';
 import type { PullRequestService } from '../git/pull-request.service.js';
@@ -37,7 +38,7 @@ function build(opts: { sync: () => Promise<RemoteSyncPullResult> }) {
     {} as IAccessControl,
     {} as FileLockService,
     pendingCommits,
-    'knowledge-base',
+    testKbContext(),
     openChangeGate(),
     events,
   );
@@ -259,7 +260,7 @@ describe('WorkflowService.retireRemoteGoneClone', () => {
     const svc = new WorkflowService(
       {} as Database, git, {} as PullRequestService, {} as IReviewWorkflowService,
       workspaceService, {} as IAccessControl, {} as FileLockService, {} as PendingCommitsService,
-      'knowledge-base',
+      testKbContext(),
       openChangeGate(),
     );
     return { svc, git, workspaceService };
@@ -327,7 +328,7 @@ describe('WorkflowService.retireRemoteGoneClone — what can bring the branch ba
     const svc = new WorkflowService(
       {} as Database, git, {} as PullRequestService, {} as IReviewWorkflowService,
       workspaceService, {} as IAccessControl, {} as FileLockService, {} as PendingCommitsService,
-      'knowledge-base',
+      testKbContext(),
       openChangeGate(),
     );
     expect(await svc.retireRemoteGoneClone('ali%2Fx')).toBe(false);
@@ -356,7 +357,7 @@ describe('WorkflowService.retireRemoteGoneClone — what can bring the branch ba
     const svc = new WorkflowService(
       {} as Database, git, {} as PullRequestService, {} as IReviewWorkflowService,
       workspaceService, {} as IAccessControl, {} as FileLockService, {} as PendingCommitsService,
-      'knowledge-base',
+      testKbContext(),
       openChangeGate(),
     );
     // Retirement enters first; a createBranch for the same name arrives while

package/src/modules/workflow/__tests__/workflow.service.update-from-target.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect, vi } from 'vitest';
+import { testKbContext } from '../../../__tests__/kb-context.js';
 import type { AuthUser, PullRequestDetail } from '@bevel-software/platform-shared';
 import type { GitService } from '../git/git.service.js';
 import type { PullRequestService } from '../git/pull-request.service.js';
@@ -102,7 +103,7 @@ function harness(opts: {
     {} as unknown as IAccessControl,
     {} as unknown as FileLockService,
     pendingCommits as unknown as PendingCommitsService,
-    'knowledge-base',
+    testKbContext(),
     openChangeGate(),
   );
   return { svc, git, prs, pendingCommits, reviewWorkflow, refreshed };

package/src/modules/workflow/agent-tools/__tests__/workflow.tools.test.ts

@@ -1,6 +1,7 @@
 import type { Server as HttpServer } from 'node:http';
 import express from 'express';
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { testKbContext } from '../../../../__tests__/kb-context.js';
 import { ToolRegistry } from '../../../tool-registry/tool-registry.js';
 import { InternalTokenService } from '../../../tool-auth/internal-token.service.js';
 import { createToolAuthMiddleware } from '../../../tool-auth/tool-auth.middleware.js';
@@ -96,7 +97,7 @@ async function start(): Promise<string> {
   const toolHandler = createToolHandlerFactory(resolve);
 
   const router = express.Router();
-  registerWorkflowTools(registry, router, toolAuth, toolHandler, 'knowledge-base');
+  registerWorkflowTools(registry, router, toolAuth, toolHandler, testKbContext());
   router.use(createManualRoutes(registry, toolAuth));
 
   const app = express();