@bevel-software/platform-core-backend 0.22.0 → 0.23.0

package/dist/shared/kb-layout.js

@@ -1,103 +0,0 @@
-import { ONTOLOGY_MARKERS } from '@bevel-software/platform-shared';
-/**
- * Resolve which named ontology a KB path belongs to — the backend-side
- * implementation of the layout contract whose constants/types live in
- * `@bevel-software/platform-shared` (`kb-layout.ts`). It is backend-only and consumed by
- * more than one domain module (the `workspace` read gate and the `workflow`
- * session-ontology service), so it lives in `backend/src/shared` rather than in
- * any single module — importable by both modules without crossing a module's
- * internal boundary. Note it does NOT mirror the kb-graph parser one-to-one:
- * see the `ontologyOf` docstring for the deliberate `Data/` exemption.
- *
- * Pure string handling — no IO, no DB.
- */
-/**
- * Split a path into repo-root-relative POSIX segments, dropping `./`,
- * leading/trailing slashes, and an optional `kbDirName` prefix (the on-disk
- * clone folder, e.g. `knowledge-base/`). Pure string handling — no IO.
- */
-function toSegments(path, kbDirName) {
-    // Collapse to canonical segments: backslashes → `/`, drop empty and `.`
-    // segments, resolve `..` against the accumulated prefix. Canonicalizing the
-    // inner segments (not just the ends) means equivalent paths like
-    // `KnowledgeBase/Product/../Product/Knowledge/x.md` and
-    // `KnowledgeBase/Product/Knowledge/x.md` resolve to the same ontology.
-    const collapse = (s) => {
-        const out = [];
-        for (const seg of s.replace(/\\/g, '/').split('/')) {
-            if (seg === '' || seg === '.')
-                continue;
-            if (seg === '..') {
-                // Pop a real segment; a leading `..` (nothing to pop) is kept so it can
-                // never alias into a sibling ontology.
-                if (out.length > 0 && out[out.length - 1] !== '..')
-                    out.pop();
-                else
-                    out.push('..');
-                continue;
-            }
-            out.push(seg);
-        }
-        return out;
-    };
-    let segs = collapse(path);
-    const prefixSegs = kbDirName ? collapse(kbDirName) : [];
-    if (prefixSegs.length > 0 && prefixSegs.every((s, i) => segs[i] === s)) {
-        segs = segs.slice(prefixSegs.length);
-    }
-    return segs;
-}
-/**
- * Resolve the named ontology a KB path belongs to, or `null` (neutral) when it
- * belongs to none.
- *
- * Classification is deliberately NARROWER than the kb-graph parser: the parser
- * discovers ontologies under every `ONTOLOGY_ROOTS` entry (`KnowledgeBase/`
- * AND `Data/`), but this function classifies ONLY `KnowledgeBase/` paths.
- * `Data/` ontologies are parsed into the graph yet are intentionally NOT
- * classified here, so the session-ontology gate treats `Data/` paths as
- * neutral — pipeline agents read knowledge and write data records in one
- * session (owner decision 2026-07-27; the cross-ontology boundary mechanism
- * itself may be redesigned). This divergence is on purpose, not drift.
- *
- * Within `KnowledgeBase/`, the shape matches the parser (`parser.ts`
- * `walkForOntologies`): an ontology is the directory that holds both a
- * `Knowledge/` and a `NodeTypes/` subfolder. That directory can sit at ANY
- * depth under `KnowledgeBase/`, so the ontology id is the path PREFIX up to
- * (but excluding) the first `Knowledge/` or `NodeTypes/` marker segment — as
- * long as that prefix is inside `KnowledgeBase/` and is not `KnowledgeBase/`
- * itself.
- *
- *   KnowledgeBase/Product/Knowledge/Foo.md            → "KnowledgeBase/Product"
- *   KnowledgeBase/IT Architecture/NodeTypes/T.md      → "KnowledgeBase/IT Architecture"
- *   KnowledgeBase/Group/Sub/Knowledge/x.md            → "KnowledgeBase/Group/Sub"
- *   KnowledgeBase/Knowledge/Foo.md                    → null (marker directly under KB root)
- *   Knowledge/Foo.md, Skills/x.md, access.md          → null (not under KnowledgeBase/)
- *   Data/Ops/Knowledge/x.md                           → null (Data/ is exempt — see above)
- *   KnowledgeBase/Product/Uploads/x.png               → null (no marker segment)
- *
- * Uses exact segment equality (never substring), so `KnowledgeBase/` and
- * `Knowledge-notes.md` are never treated as markers; space-safe; pure (no IO).
- *
- * @param path       repo-root-relative POSIX path (may carry a `kbDirName` prefix)
- * @param layout     the knowledge base's layout — names its `KnowledgeBase/` root
- * @param kbDirName  optional on-disk clone folder prefix to strip first
- */
-export function ontologyOf(path, layout, kbDirName) {
-    const segs = toSegments(path, kbDirName);
-    // Must live under the dedicated KnowledgeBase/ container, with at least one
-    // ontology-name segment and a marker after it (so length >= 3).
-    if (segs.length < 3 || segs[0] !== layout.knowledgeBaseDir)
-        return null;
-    // The ontology id is the prefix before the first marker segment. Require at
-    // least one name segment between `KnowledgeBase/` and the marker, so a marker
-    // sitting directly under `KnowledgeBase/` (`KnowledgeBase/Knowledge/...`) is
-    // neutral, matching the parser (it only discovers ontologies one level down).
-    for (let i = 1; i < segs.length; i++) {
-        if (ONTOLOGY_MARKERS.has(segs[i])) {
-            return i >= 2 ? segs.slice(0, i).join('/') : null;
-        }
-    }
-    return null;
-}
-//# sourceMappingURL=kb-layout.js.map

package/dist/shared/kb-layout.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"kb-layout.js","sourceRoot":"","sources":["../../src/shared/kb-layout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAgC,MAAM,iCAAiC,CAAC;AAEjG;;;;;;;;;;;GAWG;AAEH;;;;GAIG;AACH,SAAS,UAAU,CAAC,IAAY,EAAE,SAAkB;IAClD,wEAAwE;IACxE,4EAA4E;IAC5E,iEAAiE;IACjE,wDAAwD;IACxD,uEAAuE;IACvE,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAY,EAAE;QACvC,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACnD,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,GAAG;gBAAE,SAAS;YACxC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,wEAAwE;gBACxE,uCAAuC;gBACvC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI;oBAAE,GAAG,CAAC,GAAG,EAAE,CAAC;;oBACzD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,IAAI,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACvE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,MAAgB,EAAE,SAAkB;IAC3E,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACzC,4EAA4E;IAC5E,gEAAgE;IAChE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACxE,4EAA4E;IAC5E,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/shared/kb-layout.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=kb-layout.test.d.ts.map

package/dist/shared/kb-layout.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"kb-layout.test.d.ts","sourceRoot":"","sources":["../../src/shared/kb-layout.test.ts"],"names":[],"mappings":""}

package/dist/shared/kb-layout.test.js

@@ -1,75 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { DEFAULT_KB_LAYOUT } from '@bevel-software/platform-shared';
-import { ontologyOf } from './kb-layout.js';
-/** `ontologyOf` under the default layout, which is what these cases are written against. */
-const ont = (path, kbDirName) => ontologyOf(path, DEFAULT_KB_LAYOUT, kbDirName);
-describe('ontologyOf', () => {
-    it('classifies under the knowledge-base root the layout names, not the default one', () => {
-        const layout = { ...DEFAULT_KB_LAYOUT, knowledgeBaseDir: 'docs' };
-        expect(ontologyOf('docs/Product/Knowledge/Foo.md', layout)).toBe('docs/Product');
-        expect(ontologyOf('KnowledgeBase/Product/Knowledge/Foo.md', layout)).toBeNull();
-    });
-    it('resolves a named ontology under Knowledge', () => {
-        expect(ont('KnowledgeBase/Product/Knowledge/Foo.md')).toBe('KnowledgeBase/Product');
-    });
-    it('resolves a named ontology under NodeTypes', () => {
-        expect(ont('KnowledgeBase/Product/NodeTypes/Process.md')).toBe('KnowledgeBase/Product');
-    });
-    it('is space-safe in the ontology name', () => {
-        expect(ont('KnowledgeBase/IT Architecture/NodeTypes/ServiceCommitment.md')).toBe('KnowledgeBase/IT Architecture');
-    });
-    it('treats a nested ontology directory as the full prefix before the marker', () => {
-        expect(ont('KnowledgeBase/Plugin/Sub/Knowledge/x.md')).toBe('KnowledgeBase/Plugin/Sub');
-    });
-    it('returns null when the marker sits directly under KnowledgeBase/', () => {
-        expect(ont('KnowledgeBase/Knowledge/Foo.md')).toBeNull();
-        expect(ont('KnowledgeBase/NodeTypes/T.md')).toBeNull();
-    });
-    it('returns null for root-level Knowledge (not under KnowledgeBase/)', () => {
-        expect(ont('Knowledge/Foo.md')).toBeNull();
-    });
-    it('returns null for Data/ ontologies (deliberate session-ontology exemption)', () => {
-        // `Data/<X>` IS parsed into the graph (parser `ONTOLOGY_ROOTS`), but is
-        // intentionally NOT classified here so the session-ontology gate treats
-        // Data paths as neutral — pipeline agents read knowledge and write data
-        // in one session (owner decision 2026-07-27). See the `ontologyOf`
-        // docstring; this is not drift.
-        expect(ont('Data/Ops/Knowledge/x.md')).toBeNull();
-        expect(ont('Data/Ops/NodeTypes/Ticket.md')).toBeNull();
-        // KnowledgeBase paths still classify as before.
-        expect(ont('KnowledgeBase/Ops/Knowledge/x.md')).toBe('KnowledgeBase/Ops');
-    });
-    it('returns null for Plugins and root config (neutral)', () => {
-        expect(ont('Plugins/some-skill/SKILL.md')).toBeNull();
-        expect(ont('access.md')).toBeNull();
-        expect(ont('roles.yaml')).toBeNull();
-    });
-    it('returns null for an ontology path with no marker segment', () => {
-        expect(ont('KnowledgeBase/Product/Uploads/diagram.png')).toBeNull();
-    });
-    it('does not match substring lookalikes (segment equality)', () => {
-        expect(ont('KnowledgeBase/Product/Knowledge-notes.md')).toBeNull();
-        expect(ont('KnowledgeBase/Product/KnowledgeBase/x.md')).toBeNull();
-    });
-    it('strips a kbDirName prefix (normalized and un-normalized)', () => {
-        expect(ont('knowledge-base/KnowledgeBase/Product/Knowledge/Foo.md', 'knowledge-base')).toBe('KnowledgeBase/Product');
-        expect(ont('./knowledge-base/KnowledgeBase/GTM/NodeTypes/T.md', 'knowledge-base/')).toBe('KnowledgeBase/GTM');
-    });
-    it('normalizes backslashes and leading/trailing slashes', () => {
-        expect(ont('/KnowledgeBase/Product/Knowledge/Foo.md/')).toBe('KnowledgeBase/Product');
-        expect(ont('KnowledgeBase\\Product\\Knowledge\\Foo.md')).toBe('KnowledgeBase/Product');
-    });
-    it('canonicalizes inner . and .. segments to the same ontology', () => {
-        expect(ont('KnowledgeBase/Product/./Knowledge/Foo.md')).toBe('KnowledgeBase/Product');
-        expect(ont('KnowledgeBase/Product/Sub/../Knowledge/Foo.md')).toBe('KnowledgeBase/Product');
-        expect(ont('KnowledgeBase/Platform/../Product/Knowledge/Foo.md')).toBe('KnowledgeBase/Product');
-        // `..` also collapses inside the stripped kbDirName prefix.
-        expect(ont('knowledge-base/x/../KnowledgeBase/GTM/NodeTypes/T.md', 'knowledge-base')).toBe('KnowledgeBase/GTM');
-    });
-    it('returns null for empty or root paths', () => {
-        expect(ont('')).toBeNull();
-        expect(ont('KnowledgeBase')).toBeNull();
-        expect(ont('KnowledgeBase/Product')).toBeNull();
-    });
-});
-//# sourceMappingURL=kb-layout.test.js.map

package/dist/shared/kb-layout.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"kb-layout.test.js","sourceRoot":"","sources":["../../src/shared/kb-layout.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,4FAA4F;AAC5F,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,SAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAC;AAEjG,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACxF,MAAM,MAAM,GAAG,EAAE,GAAG,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAClE,MAAM,CAAC,UAAU,CAAC,+BAA+B,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACjF,MAAM,CAAC,UAAU,CAAC,wCAAwC,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC,CAAC,IAAI,CAC9E,+BAA+B,CAChC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACzD,MAAM,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,GAAG,EAAE;QACnF,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,mEAAmE;QACnE,gCAAgC;QAChC,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAClD,MAAM,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvD,gDAAgD;QAChD,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnE,MAAM,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,GAAG,CAAC,uDAAuD,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CACzF,uBAAuB,CACxB,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,mDAAmD,EAAE,iBAAiB,CAAC,CAAC,CAAC,IAAI,CACtF,mBAAmB,CACpB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACtF,MAAM,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACtF,MAAM,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAC3F,MAAM,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAChG,4DAA4D;QAC5D,MAAM,CAAC,GAAG,CAAC,sDAAsD,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CACxF,mBAAmB,CACpB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/src/modules/workflow/__tests__/session-ontology.policy.test.ts

@@ -1,62 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { recordTouch, decideWrite } from '../session-ontology.policy.js';
-
-const PRODUCT = 'KnowledgeBase/Product';
-const PLATFORM = 'KnowledgeBase/Platform';
-const GTM = 'KnowledgeBase/GTM';
-
-describe('recordTouch', () => {
-  it('adds a named ontology to the set', () => {
-    expect([...recordTouch(new Set(), PRODUCT)]).toEqual([PRODUCT]);
-  });
-
-  it('adds nothing for a neutral touch', () => {
-    expect([...recordTouch(new Set([PRODUCT]), null)]).toEqual([PRODUCT]);
-  });
-
-  it('accumulates across ontologies', () => {
-    const a = recordTouch(new Set(), PRODUCT);
-    const b = recordTouch(a, PLATFORM);
-    expect(new Set(b)).toEqual(new Set([PRODUCT, PLATFORM]));
-  });
-
-  it('does not mutate the input set', () => {
-    const input = new Set([PRODUCT]);
-    recordTouch(input, PLATFORM);
-    expect([...input]).toEqual([PRODUCT]);
-  });
-});
-
-describe('decideWrite', () => {
-  it('allows a write to a neutral path regardless of touched set', () => {
-    expect(decideWrite(new Set([PRODUCT, PLATFORM]), null)).toEqual({ allow: true });
-  });
-
-  it('allows a write when the session has touched nothing yet', () => {
-    expect(decideWrite(new Set(), PRODUCT)).toEqual({ allow: true });
-  });
-
-  it('allows a write to the single ontology the session is confined to', () => {
-    expect(decideWrite(new Set([PRODUCT]), PRODUCT)).toEqual({ allow: true });
-  });
-
-  it('blocks a write to a different ontology when confined to one (different-ontology)', () => {
-    expect(decideWrite(new Set([PRODUCT]), PLATFORM)).toEqual({
-      allow: false,
-      reason: 'different-ontology',
-      touched: [PRODUCT],
-      attempted: PLATFORM,
-    });
-  });
-
-  it('blocks ALL writes once the session has touched two ontologies (multi-ontology)', () => {
-    // Reading across ontologies poisons writes — even a write back into Product.
-    expect(decideWrite(new Set([PRODUCT, PLATFORM]), PRODUCT)).toEqual({
-      allow: false,
-      reason: 'multi-ontology',
-      touched: [PLATFORM, PRODUCT],
-      attempted: PRODUCT,
-    });
-    expect(decideWrite(new Set([PRODUCT, PLATFORM]), GTM).allow).toBe(false);
-  });
-});

package/src/modules/workflow/__tests__/session-ontology.service.test.ts

@@ -1,201 +0,0 @@
-import { describe, it, expect, beforeEach, vi } from 'vitest';
-import { testKbContext } from '../../../__tests__/kb-context.js';
-
-import { SessionOntologyService } from '../session-ontology.service.js';
-import type { Database } from '../../database/connection.js';
-
-const PRODUCT = 'KnowledgeBase/Product';
-const PLATFORM = 'KnowledgeBase/Platform';
-const P_READ = 'KnowledgeBase/Product/Knowledge/Foo.md';
-const PL_READ = 'KnowledgeBase/Platform/Knowledge/Bar.md';
-
-/**
- * Faithful in-memory fake of the slice of the Drizzle `Database` the service
- * uses against the `session_ontology_touches` table (one row per
- * `(session_id, ontology)`):
- *  - `insert().onConflictDoNothing()` adds a row unless the PK pair exists.
- *  - `select({ontology}).from().where(eq(session))` returns the session's rows.
- *  - `delete().where(eq(session) | lt(touchedAt, cutoff))` removes rows.
- *
- * A live-Postgres integration test (real PK conflict, real `touched_at < now()`
- * sweep) is still owed once the repo grows a Postgres test harness (tasks 3.4).
- */
-interface Row {
-  sessionId: string;
-  ontology: string;
-  touchedAt: Date;
-}
-
-function makeFakeDb() {
-  const rows: Row[] = [];
-  const db = {
-    _rows: rows,
-    insert() {
-      return {
-        values(v: { sessionId: string; ontology: string }) {
-          return {
-            onConflictDoNothing() {
-              const exists = rows.some((r) => r.sessionId === v.sessionId && r.ontology === v.ontology);
-              if (!exists) rows.push({ sessionId: v.sessionId, ontology: v.ontology, touchedAt: new Date() });
-              return Promise.resolve([]);
-            },
-          };
-        },
-      };
-    },
-    select() {
-      return {
-        from() {
-          return {
-            async where(pred: { sessionId: string }) {
-              return rows
-                .filter((r) => r.sessionId === pred.sessionId)
-                .map((r) => ({ ontology: r.ontology }));
-            },
-          };
-        },
-      };
-    },
-    delete() {
-      return {
-        where(pred: { sessionId?: string; cutoff?: Date }) {
-          if (pred.sessionId !== undefined) {
-            for (let i = rows.length - 1; i >= 0; i--) {
-              if (rows[i].sessionId === pred.sessionId) rows.splice(i, 1);
-            }
-            return { async returning() { return []; } } as never;
-          }
-          const removed: { sessionId: string }[] = [];
-          for (let i = rows.length - 1; i >= 0; i--) {
-            if (pred.cutoff && rows[i].touchedAt < pred.cutoff) {
-              removed.push({ sessionId: rows[i].sessionId });
-              rows.splice(i, 1);
-            }
-          }
-          return { async returning() { return removed; } } as never;
-        },
-      };
-    },
-  };
-  return db;
-}
-
-vi.mock('drizzle-orm', async (importOriginal) => {
-  const actual = await importOriginal<typeof import('drizzle-orm')>();
-  return {
-    ...actual,
-    eq: (_col: unknown, val: string) => ({ sessionId: val }),
-    lt: (_col: unknown, val: Date) => ({ cutoff: val }),
-  };
-});
-
-function makeService() {
-  const db = makeFakeDb();
-  return { svc: new SessionOntologyService(db as unknown as Database, testKbContext()), db };
-}
-
-describe('SessionOntologyService (touched-set model)', () => {
-  let svc: SessionOntologyService;
-  let db: ReturnType<typeof makeFakeDb>;
-
-  beforeEach(() => {
-    ({ svc, db } = makeService());
-  });
-
-  it('records a read and allows it', async () => {
-    const d = await svc.checkOperation('s1', P_READ, false);
-    expect(d.allow).toBe(true);
-    expect(await svc.getTouched('s1')).toEqual([PRODUCT]);
-  });
-
-  it('allows reads ACROSS ontologies (reads are never blocked)', async () => {
-    expect((await svc.checkOperation('s1', P_READ, false)).allow).toBe(true);
-    expect((await svc.checkOperation('s1', PL_READ, false)).allow).toBe(true);
-    expect(await svc.getTouched('s1')).toEqual([PLATFORM, PRODUCT]);
-  });
-
-  it('allows a write while the session is confined to that one ontology', async () => {
-    await svc.checkOperation('s1', P_READ, false);
-    expect((await svc.checkOperation('s1', P_READ, true)).allow).toBe(true);
-  });
-
-  it('allows the first write with no prior reads and pins to it', async () => {
-    expect((await svc.checkOperation('s1', P_READ, true)).allow).toBe(true);
-    expect(await svc.getTouched('s1')).toEqual([PRODUCT]);
-  });
-
-  it('blocks a write to a different ontology than the one read (different-ontology)', async () => {
-    // Load-bearing for the start_session↔ask unification: the touched-set is
-    // keyed purely by sessionId, so a READ and a later WRITE that share ONE id
-    // hit the same set and cross-ontology writes are refused. This only protects
-    // the read→ask flow because both now run under the SAME id (start_session
-    // mints a real chat thread; ask accepts it). If a refactor re-splits those
-    // namespaces, the read and the ask write land in different touched-sets and
-    // this guarantee silently evaporates — see workspace.tools.ts start_session.
-    await svc.checkOperation('s1', P_READ, false);
-    const d = await svc.checkOperation('s1', PL_READ, true);
-    expect(d).toMatchObject({ allow: false, reason: 'different-ontology', attempted: PLATFORM });
-    // The blocked write does NOT record Platform.
-    expect(await svc.getTouched('s1')).toEqual([PRODUCT]);
-  });
-
-  it('blocks ALL writes once the session has read across two ontologies (multi-ontology)', async () => {
-    await svc.checkOperation('s1', P_READ, false);
-    await svc.checkOperation('s1', PL_READ, false); // reads across — poisons writes
-    // Even a write back into Product is now blocked.
-    const back = await svc.checkOperation('s1', P_READ, true);
-    expect(back).toMatchObject({ allow: false, reason: 'multi-ontology' });
-    const other = await svc.checkOperation('s1', PL_READ, true);
-    expect(other.allow).toBe(false);
-  });
-
-  it('treats a neutral path as always-allowed and never recorded', async () => {
-    const d = await svc.checkOperation('s1', 'access.md', true);
-    expect(d.allow).toBe(true);
-    expect(await svc.getTouched('s1')).toEqual([]);
-  });
-
-  it('survives a "restart": a new instance re-reads the touched set from the store', async () => {
-    await svc.checkOperation('s1', P_READ, false);
-    await svc.checkOperation('s1', PL_READ, false);
-    const afterRestart = new SessionOntologyService(db as unknown as Database, testKbContext());
-    // The poison persists across the restart: writes still blocked.
-    expect((await afterRestart.checkOperation('s1', P_READ, true)).allow).toBe(false);
-  });
-
-  it('reclaims a session on delete so it can write again', async () => {
-    await svc.checkOperation('s1', P_READ, false);
-    await svc.checkOperation('s1', PL_READ, false);
-    await svc.delete('s1');
-    expect(await svc.getTouched('s1')).toEqual([]);
-    expect((await svc.checkOperation('s1', P_READ, true)).allow).toBe(true);
-  });
-
-  it('sweeps abandoned sessions older than the cutoff', async () => {
-    await svc.checkOperation('old', P_READ, false);
-    db._rows.forEach((r) => { if (r.sessionId === 'old') r.touchedAt = new Date(Date.now() - 60_000); });
-    const removed = await svc.sweepOlderThan(new Date(Date.now() - 30_000));
-    expect(removed).toBe(1);
-    expect(await svc.getTouched('old')).toEqual([]);
-  });
-
-  it('records each ontology only once (idempotent touches)', async () => {
-    await svc.checkOperation('s1', P_READ, false);
-    await svc.checkOperation('s1', P_READ, false);
-    await svc.checkOperation('s1', P_READ, false);
-    expect(db._rows.filter((r) => r.sessionId === 's1').length).toBe(1);
-  });
-
-  it('serializes two concurrent same-session writes to different ontologies (only one wins)', async () => {
-    // Without per-session serialization both could observe an empty touched set
-    // and both pin to a different ontology before either INSERT lands.
-    const [a, b] = await Promise.all([
-      svc.checkOperation('s1', P_READ, true), // write → Product
-      svc.checkOperation('s1', PL_READ, true), // write → Platform (concurrent)
-    ]);
-    // Exactly one write is allowed; the loser is blocked as different-ontology.
-    expect([a, b].filter((d) => d.allow)).toHaveLength(1);
-    // Only the winner's ontology is recorded.
-    expect(await svc.getTouched('s1')).toHaveLength(1);
-  });
-});

package/src/modules/workflow/session-ontology.policy.ts

@@ -1,70 +0,0 @@
-/**
- * Ontology-session boundary — the PURE decision core (no IO, no DB).
- *
- * Model: each run/session accumulates the SET of named ontologies it has
- * touched (via any read or write). The rule is asymmetric:
- *
- *   READS  — always allowed. A read that touches a named ontology RECORDS it
- *            into the session's touched set (so it can poison later writes).
- *   WRITES — allowed only while the session is confined to a SINGLE named
- *            ontology and the write targets that same ontology. The moment a
- *            session has touched two or more named ontologies (typically by
- *            reading across them), EVERY subsequent write is blocked — "read
- *            across ontologies → you can't write anymore at all."
- *
- * Neutral touches (`ontologyOf` → null: root config, Skills, root-level
- * Knowledge, non-KB) never record and never block. See
- * `docs/rp4-ontology-boundary-plan-v2.md`.
- *
- * `SessionOntologyService` (Postgres-backed) persists the touched set and calls
- * these helpers; this module keeps the rule itself testable in isolation.
- */
-
-import type { Ontology } from '@bevel-software/platform-shared';
-
-/** Outcome of a write check against the session's touched-ontology set. */
-export type WriteDecision =
-  | { allow: true }
-  | { allow: false; reason: 'multi-ontology' | 'different-ontology'; touched: string[]; attempted: string };
-
-/**
- * The set of NAMED ontologies a session has touched after this operation. A
- * neutral operation (`ontology === null`) adds nothing. Pure — returns a new
- * set, never mutates the input.
- */
-export function recordTouch(touched: ReadonlySet<string>, ontology: Ontology): Set<string> {
-  const next = new Set(touched);
-  if (ontology !== null) next.add(ontology);
-  return next;
-}
-
-/**
- * Decide whether a WRITE to `attempted` is allowed given the ontologies the
- * session has already touched (NOT counting this write yet).
- *
- *   - A write to a neutral path (`attempted === null`) is always allowed.
- *   - If the session has already touched two or more named ontologies, the
- *     write is blocked (`multi-ontology`) — reading across ontologies poisoned
- *     the session's write ability.
- *   - If the session has touched exactly one named ontology and it differs from
- *     the write target, the write is blocked (`different-ontology`).
- *   - If the session is unpinned (touched none) or its single touched ontology
- *     equals the target, the write is allowed.
- */
-export function decideWrite(touched: ReadonlySet<string>, attempted: Ontology): WriteDecision {
-  if (attempted === null) return { allow: true };
-
-  // The set of named ontologies the session would span if this write lands.
-  const spanned = new Set(touched);
-  spanned.add(attempted);
-
-  if (spanned.size <= 1) return { allow: true };
-
-  // spanned.size >= 2 — the write would put the session across a boundary.
-  const touchedList = [...touched].sort();
-  if (touched.size >= 2) {
-    return { allow: false, reason: 'multi-ontology', touched: touchedList, attempted };
-  }
-  // Exactly one prior ontology, and it isn't the write target.
-  return { allow: false, reason: 'different-ontology', touched: touchedList, attempted };
-}