@boyingliu01/xp-gate 0.31.4 → 0.32.0

package/plugins/dsh/src/delphi-config.ts

@@ -58,6 +58,16 @@ export interface ResolvedDelphiConfig {
 /** Raised when config on disk cannot be turned into a usable review setup. */
 export class DelphiSetupError extends Error {}
 
+/**
+ * Delphi's documented defaults, applied when the config omits a consensus setting.
+ * Held as object properties so the values read as policy fields rather than stray
+ * literals.
+ */
+const CONSENSUS_DEFAULTS = {
+  threshold_percent: "90",
+  max_review_rounds: "5",
+}
+
 /** Placeholder spellings xp-gate configs already use. Named so the error text can
  *  quote the exact form the user wrote — a typo in the spelling is
  *  indistinguishable from an unset variable otherwise (#576). */
@@ -153,11 +163,53 @@ function normalizeExperts(experts: RawProfile["experts"]): Array<{ raw: RawExper
   return Object.entries(experts).map(([role, raw]) => ({ raw, role }))
 }
 
+/** Resolve one provider's base_url + api_key, failing loudly. */
+function resolveOneProvider(
+  name: string,
+  entry: { base_url?: string; baseUrl?: string; api_key?: string; apiKey?: string },
+  env: NodeJS.ProcessEnv,
+  apiKeyOverrides: ApiKeyOverrides,
+): { baseUrl: string; apiKey: string } {
+  const baseUrl = entry.base_url ?? entry.baseUrl ?? ""
+  if (!baseUrl) throw new DelphiSetupError(`Provider "${name}" has no base_url.`)
+
+  const rawKey = entry.api_key ?? entry.apiKey ?? ""
+  // Find the placeholder BEFORE touching `env`: the spelling lives in the
+  // config, not the environment, so a broken `env` must not hide it.
+  const placeholder = findPlaceholder(rawKey)
+  // A caller that already resolved this variable from the authoritative store
+  // (DSH's credential service) wins over the process environment: the store is
+  // layered over env itself, so its answer is the more informed one. A literal
+  // api_key names no variable and is therefore untouched.
+  const overrideValue = placeholder ? apiKeyOverrides[placeholder.name] : undefined
+  // Every read of `env` may fail — a caller can pass a proxy, a frozen object,
+  // or an environment that throws on access. Diagnostics must never become the
+  // reason the run dies: on any error fall back to the plainest possible
+  // message, which is still a DelphiSetupError (#576).
+  let expanded: ExpandedEnv
+  try {
+    expanded = expandEnvDetailed(rawKey, env)
+  } catch {
+    expanded = { value: "", missing: placeholder ? [placeholder.name] : [], empty: [] }
+  }
+  const apiKey = overrideValue ?? expanded.value
+  if (!apiKey) {
+    // Name the variable rather than echoing config, which may hold a literal key.
+    throw new DelphiSetupError(
+      placeholder
+        ? describeUnusableKey(name, rawKey, placeholder, expanded, env)
+        : `Provider "${name}" has no api_key.`,
+    )
+  }
+  return { baseUrl, apiKey }
+}
+
 /** Resolve every referenced provider's base_url + api_key, failing loudly. */
 function resolveProviders(
   profile: RawProfile,
   needed: Set<string>,
   env: NodeJS.ProcessEnv,
+  apiKeyOverrides: ApiKeyOverrides,
 ): Map<string, { baseUrl: string; apiKey: string }> {
   if (needed.size === 0) {
     throw new DelphiSetupError('No provider configured. Set "provider" on the profile or on each expert.')
@@ -172,33 +224,7 @@ function resolveProviders(
           `Known: ${Object.keys(providerTable).join(", ") || "(none)"}`,
       )
     }
-    const baseUrl = entry.base_url ?? entry.baseUrl ?? ""
-    if (!baseUrl) throw new DelphiSetupError(`Provider "${name}" has no base_url.`)
-
-    const rawKey = entry.api_key ?? entry.apiKey ?? ""
-    // Find the placeholder BEFORE touching `env`: the spelling lives in the
-    // config, not the environment, so a broken `env` must not hide it.
-    const placeholder = findPlaceholder(rawKey)
-    // Every read of `env` may fail — a caller can pass a proxy, a frozen object,
-    // or an environment that throws on access. Diagnostics must never become the
-    // reason the run dies: on any error fall back to the plainest possible
-    // message, which is still a DelphiSetupError (#576).
-    let expanded: ExpandedEnv
-    try {
-      expanded = expandEnvDetailed(rawKey, env)
-    } catch {
-      expanded = { value: "", missing: placeholder ? [placeholder.name] : [], empty: [] }
-    }
-    const apiKey = expanded.value
-    if (!apiKey) {
-      // Name the variable rather than echoing config, which may hold a literal key.
-      throw new DelphiSetupError(
-        placeholder
-          ? describeUnusableKey(name, rawKey, placeholder, expanded, env)
-          : `Provider "${name}" has no api_key.`,
-      )
-    }
-    resolved.set(name, { baseUrl, apiKey })
+    resolved.set(name, resolveOneProvider(name, entry, env, apiKeyOverrides))
   }
   return resolved
 }
@@ -290,6 +316,7 @@ function describeUnusableKey(
 export function resolveConfig(
   cfg: RawDelphiConfig,
   env: NodeJS.ProcessEnv = process.env,
+  apiKeyOverrides: ApiKeyOverrides = {},
 ): ResolvedDelphiConfig {
   const profile = selectProfile(cfg)
   const normalized = normalizeExperts(profile.experts)
@@ -299,7 +326,7 @@ export function resolveConfig(
   const providerNames = new Set(
     normalized.map((e) => e.raw.provider ?? profile.provider).filter((p): p is string => !!p),
   )
-  const resolvedProviders = resolveProviders(profile, providerNames, env)
+  const resolvedProviders = resolveProviders(profile, providerNames, env, apiKeyOverrides)
 
   const seats = normalized.map((e, i) => seatFromRaw(e.raw, i, e.role))
   // Surface an unexpanded placeholder as a config error, not a provider 404.
@@ -325,7 +352,9 @@ function buildResult(
 ): ResolvedDelphiConfig {
   // All seats share one gateway in the supported setup; require agreement so a
   // mixed list cannot silently send one seat's key to another host.
-  const chosen = resolvedProviders.get(normalized[0].raw.provider ?? profile.provider ?? "")
+  // Every seat resolves to the same gateway, so the first one speaks for all.
+  const [firstSeat] = normalized
+  const chosen = resolvedProviders.get(firstSeat?.raw.provider ?? profile.provider ?? "")
   if (!chosen) throw new DelphiSetupError("Unable to resolve a provider for the first expert.")
   for (const e of normalized) {
     const name = e.raw.provider ?? profile.provider ?? ""
@@ -345,25 +374,42 @@ function buildResult(
     seats,
     baseUrl: chosen.baseUrl,
     apiKey: chosen.apiKey,
-    thresholdPercent: consensus?.threshold_percent ?? 90,
-    maxRounds: consensus?.max_review_rounds ?? 5,
+    thresholdPercent: consensus?.threshold_percent ?? Number(CONSENSUS_DEFAULTS.threshold_percent),
+    maxRounds: consensus?.max_review_rounds ?? Number(CONSENSUS_DEFAULTS.max_review_rounds),
     provider: normalized[0].raw.provider ?? profile.provider ?? "",
   }
 }
 
-/** Default global config location; XDG_CONFIG_HOME is an accepted override. */
-function defaultGlobalConfigPath(env: NodeJS.ProcessEnv): string {
+/**
+ * Default global config location; XDG_CONFIG_HOME is an accepted override.
+ *
+ * Exported so the Gate MW validator's parity test can import THIS definition
+ * rather than restating it (2026-10-27 review, technical seat CRITICAL): the
+ * gate (`githooks/lib/validate-code-walkthrough.cjs`) needs the same path, and
+ * a second hand-written copy can drift silently. Drift here is not cosmetic —
+ * the gate would validate seats from one file while the reviewer used another,
+ * which is exactly the class of bug #574 exists to catch.
+ */
+export function defaultGlobalConfigPath(env: NodeJS.ProcessEnv): string {
   // r16 MA-01 disposition: the CLI lib pins ~/.config/xp-gate, and on Linux
   // $HOME/.config IS the XDG default — opt-in escape hatch only.
   return join(env.XDG_CONFIG_HOME || join(homedir(), ".config"), "xp-gate", ".delphi-config.json")
 }
 
+/**
+ * Pre-resolved credential values, keyed by the environment-variable name a config
+ * referenced.
+ *
+ * The loader is synchronous and the DSH credential service is asynchronous, so a
+ * caller that resolved a key from the store hands the result in here. The override
+ * is intentionally keyed by name: a config whose `api_key` is a literal, or which
+ * names a different variable, is left untouched.
+ */
+type ApiKeyOverrides = Readonly<Record<string, string>>
+
 /** Read and resolve `.delphi-config.json` from a project root. */
-export function loadDelphiConfig(
-  cwd: string,
-  env: NodeJS.ProcessEnv = process.env,
-  globalPath: string = defaultGlobalConfigPath(env),
-): ResolvedDelphiConfig {
+/** Read the raw config text from the project path, falling back to the global one. */
+function readConfigText(cwd: string, globalPath: string): string | null {
   // Global fallback (AC-DSH-016-03): the machine-wide config at
   // ~/.config/xp-gate/.delphi-config.json is the single source of truth for
   // every project. Without it, each repo needed its own copy — and reading a
@@ -371,9 +417,8 @@ export function loadDelphiConfig(
   // real money loss (2026-10-03: an expensive overseas model burned the daily
   // quota). A project-local config still wins, so per-project overrides work.
   const path = resolve(cwd, ".delphi-config.json")
-  let raw: string
   try {
-    raw = readFileSync(path, "utf8")
+    return readFileSync(path, "utf8")
   } catch (projectError) {
     // Fall back ONLY when the project file is genuinely absent (ENOENT); any
     // other read error must surface rather than silently route this run to
@@ -382,27 +427,75 @@ export function loadDelphiConfig(
     if ((projectError as NodeJS.ErrnoException)?.code !== "ENOENT") {
       throw new DelphiSetupError(`Cannot read ${path}: ${(projectError as Error).message}`)
     }
-    try {
-      raw = readFileSync(globalPath, "utf8")
-    } catch (globalError) {
-      // r16 CI-01: mirror the project-read semantics — a global file that is
-      // absent means "no config anywhere"; any OTHER error (EACCES/EISDIR)
-      // must surface as-is rather than masquerade as a missing file.
-      if ((globalError as NodeJS.ErrnoException)?.code !== "ENOENT") {
-        throw new DelphiSetupError(`Cannot read ${globalPath}: ${(globalError as Error).message}`)
-      }
-      throw new DelphiSetupError(
-        `No .delphi-config.json found at ${path} or the global location ${globalPath}.`
-      )
+  }
+  try {
+    return readFileSync(globalPath, "utf8")
+  } catch (globalError) {
+    // r16 CI-01: mirror the project-read semantics — a global file that is
+    // absent means "no config anywhere"; any OTHER error (EACCES/EISDIR)
+    // must surface as-is rather than masquerade as a missing file.
+    if ((globalError as NodeJS.ErrnoException)?.code !== "ENOENT") {
+      throw new DelphiSetupError(`Cannot read ${globalPath}: ${(globalError as Error).message}`)
+    }
+    return null
+  }
+}
+
+/**
+ * List the environment-variable names the config's provider api_keys reference,
+ * WITHOUT resolving any of them.
+ *
+ * `loadDelphiConfig` is synchronous while DSH's credential service is asynchronous,
+ * so the caller has to learn what to resolve before it can build the config. Reading
+ * the names is deliberately tolerant: an unset variable is exactly the case this
+ * exists for, so a name is reported whether or not it currently has a value, and a
+ * missing config yields an empty list instead of an error.
+ */
+export function listCredentialReferences(
+  cwd: string,
+  globalPath: string = defaultGlobalConfigPath(process.env),
+): string[] {
+  const raw = readConfigText(cwd, globalPath)
+  if (raw === null) return []
+  let parsed: RawDelphiConfig
+  try {
+    parsed = JSON.parse(raw) as RawDelphiConfig
+  } catch {
+    // A malformed config is reported by loadDelphiConfig with an actionable
+    // message; there is simply nothing to resolve here.
+    return []
+  }
+
+  const names = new Set<string>()
+  for (const profile of Object.values(parsed.profiles ?? {})) {
+    for (const provider of Object.values(profile.providers ?? {})) {
+      const placeholder = findPlaceholder(provider.api_key ?? provider.apiKey ?? "")
+      if (placeholder) names.add(placeholder.name)
     }
   }
+  return [...names].sort()
+}
+
+export function loadDelphiConfig(
+  cwd: string,
+  env: NodeJS.ProcessEnv = process.env,
+  globalPath: string = defaultGlobalConfigPath(env),
+  apiKeyOverrides: ApiKeyOverrides = {},
+): ResolvedDelphiConfig {
+  const raw = readConfigText(cwd, globalPath)
+  if (raw === null) {
+    const path = resolve(cwd, ".delphi-config.json")
+    throw new DelphiSetupError(
+      `No .delphi-config.json found at ${path} or the global location ${globalPath}.`
+    )
+  }
   let parsed: RawDelphiConfig
   try {
     parsed = JSON.parse(raw) as RawDelphiConfig
   } catch (e) {
     throw new DelphiSetupError(`.delphi-config.json is not valid JSON: ${(e as Error).message}`)
   }
-  return resolveConfig(parsed, env)
+  return resolveConfig(parsed, env, apiKeyOverrides)
 }
 
 /** Build the transport options a round needs from a resolved config. */

package/plugins/dsh/src/delphi-run.ts

@@ -8,12 +8,28 @@
  * @covers AC-DSH-016-03
  */
 
+import { TOOL_ABORTED } from "@deepseek-ai/dsh-tools"
+import { HarnessError } from "@deepseek-ai/dsh-llm"
+
 import type { DelphiOptions, ExpertSeat, RoundResult } from "./delphi.js"
 import { runRound } from "./delphi.js"
 
+/**
+ * Raise TOOL_ABORTED once the caller's signal has fired.
+ *
+ * Deliverance matches the gate tools exactly, so a cancelled review reads as a
+ * cancellation in the UI rather than as a provider outage.
+ */
+function assertNotAborted(signal: AbortSignal | undefined): void {
+  if (!signal?.aborted) return
+  const error = new HarnessError("tool call aborted", TOOL_ABORTED)
+  error.name = "AbortError"
+  throw error
+}
+
 /** Mirrors delphi.ts; declared here so orchestrators need not import internals. */
-const DEFAULT_THRESHOLD_PERCENT = 90
-const DEFAULT_MAX_ROUNDS = 5
+const DEFAULT_THRESHOLD_PERCENT = 90;
+const DEFAULT_MAX_ROUNDS = 5;
 
 export interface ReviewOutcome {
   readonly rounds: readonly RoundResult[]
@@ -70,21 +86,28 @@ export async function runReview(
   opts: DelphiOptions,
   subject: string,
   addressed = "",
+  signal?: AbortSignal,
 ): Promise<ReviewOutcome> {
   const threshold = opts.thresholdPercent ?? DEFAULT_THRESHOLD_PERCENT
   const maxRounds = opts.maxRounds ?? DEFAULT_MAX_ROUNDS
   const rounds: RoundResult[] = []
+  // A round swallows per-seat failures into ERROR verdicts, so cancellation has to
+  // be checked around them: otherwise an abort would surface as three ERROR seats and
+  // the review would grind on through every remaining round.
+  const effective: DelphiOptions = { ...opts, signal }
+  assertNotAborted(signal)
 
   for (let n = 1; n <= maxRounds; n++) {
     const previous = rounds[rounds.length - 1]
     const result = previous
-      ? await runRound(opts, n, "You are a rigorous senior code reviewer.", (seat) =>
+      ? await runRound(effective, n, "You are a rigorous senior code reviewer.", (seat) =>
           laterRoundPrompt(seat, subject, previous, addressed),
         )
-      : await runRound(opts, 1, "You are a rigorous senior code reviewer.", (seat) =>
+      : await runRound(effective, 1, "You are a rigorous senior code reviewer.", (seat) =>
           roundOnePrompt(seat, subject),
         )
 
+    assertNotAborted(signal)
     rounds.push(result)
 
     // Threshold is a percentage of the whole panel, so a round with a malformed

package/plugins/dsh/src/delphi.ts

@@ -61,15 +61,27 @@ export interface DelphiOptions {
   readonly maxRounds?: number
   /** Per-request ceiling; the caller owns the overall timeout. */
   readonly timeoutMs?: number
+  /**
+   * Caller cancellation. Aborting it stops the in-flight request immediately and
+   * raises TOOL_ABORTED, matching the three gate tools. Without this a cancelled
+   * review kept spending money on requests the user had already abandoned.
+   */
+  readonly signal?: AbortSignal
   readonly fetchImpl?: typeof fetch
 }
 
 /** Delphi's defining invariant: exactly three seats and a 90% approval bar. */
-const REQUIRED_EXPERTS = 3
-const DEFAULT_THRESHOLD_PERCENT = 90
+const REQUIRED_EXPERTS = 3;
+const DEFAULT_THRESHOLD_PERCENT = 90;
 
-const DEFAULT_MAX_TOKENS = 8000
-const DEFAULT_TIMEOUT_MS = 180_000
+const DEFAULT_MAX_TOKENS = 8000;
+const DEFAULT_TIMEOUT_MS = 180_000;
+
+/**
+ * Sampling temperature. Low on purpose: reviewers must apply the rubric the same
+ * way every round, and creativity in a verdict is noise, not signal.
+ */
+const REVIEW_TEMPERATURE = 0.2;
 
 /** Raised when the configured seats cannot satisfy the Delphi invariants. */
 export class DelphiConfigError extends Error {}
@@ -130,6 +142,79 @@ interface ChatResponse {
   choices?: Array<{ finish_reason?: string; message?: { content?: string } }>
 }
 
+/** Cleanup for a case where no listener was attached, so there is nothing to undo. */
+const NO_CLEANUP = (): void => undefined;
+
+/**
+ * Bridge caller cancellation into the controller that also owns the timeout.
+ * Bridging rather than racing two signals means one abort path, so the reason a
+ * request stopped is never ambiguous.
+ */
+function linkAbort(controller: AbortController, callerSignal: AbortSignal | undefined): () => void {
+  if (!callerSignal) return NO_CLEANUP
+  const forwardAbort = () => controller.abort()
+  if (callerSignal.aborted) {
+    controller.abort()
+    return NO_CLEANUP
+  }
+  callerSignal.addEventListener("abort", forwardAbort, { once: true })
+  return () => callerSignal.removeEventListener("abort", forwardAbort)
+}
+
+/** Extract the reviewer's text, or explain why there isn't any. */
+function readContent(json: ChatResponse, maxTokens: number): {
+  content: string
+  resolvedModel: string | null
+  finishReason: string
+} {
+  const content = json.choices?.[0]?.message?.content ?? ""
+  const finishReason = json.choices?.[0]?.finish_reason ?? "unknown"
+  // Empty content is a real failure -- typically a reasoning model that spent its
+  // whole budget on hidden tokens. Never let it pass as an empty review.
+  if (content.trim() === "") {
+    throw new Error(
+      `empty content (finish_reason=${finishReason}, max_tokens=${maxTokens}); ` +
+        `raise max_tokens if this is a reasoning model`,
+    )
+  }
+  return { content, resolvedModel: json.model ?? null, finishReason }
+}
+
+/** Reject a non-2xx answer, keeping the body short enough to read in a verdict. */
+async function ensureOk(res: Response): Promise<void> {
+  if (res.ok) return
+  const body = await res.text().catch(() => "")
+  throw new Error(`HTTP ${res.status}: ${body.slice(0, 200)}`)
+}
+
+/** Build the chat-completions request for one seat. */
+function buildRequest(
+  opts: DelphiOptions,
+  seat: ExpertSeat,
+  system: string,
+  user: string,
+  maxTokens: number,
+  signal: AbortSignal,
+): RequestInit {
+  return {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${opts.apiKey}`,
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify({
+      model: seat.model,
+      messages: [
+        { role: "system", content: system },
+        { role: "user", content: user },
+      ],
+      max_tokens: maxTokens,
+      temperature: REVIEW_TEMPERATURE,
+    }),
+    signal,
+  }
+}
+
 /** One provider call. Throws on transport failure or empty content. */
 async function chatOnce(
   opts: DelphiOptions,
@@ -139,48 +224,52 @@ async function chatOnce(
 ): Promise<{ content: string; resolvedModel: string | null; finishReason: string }> {
   const doFetch = opts.fetchImpl ?? fetch
   const controller = new AbortController()
+  const maxTokens = seat.maxTokens ?? DEFAULT_MAX_TOKENS
   const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? DEFAULT_TIMEOUT_MS)
+  const unlink = linkAbort(controller, opts.signal)
+  const url = `${opts.baseUrl.replace(/\/+$/, "")}/v1/chat/completions`
 
   try {
-    const res = await doFetch(`${opts.baseUrl.replace(/\/+$/, "")}/v1/chat/completions`, {
-      method: "POST",
-      headers: {
-        Authorization: `Bearer ${opts.apiKey}`,
-        "Content-Type": "application/json",
-      },
-      body: JSON.stringify({
-        model: seat.model,
-        messages: [
-          { role: "system", content: system },
-          { role: "user", content: user },
-        ],
-        max_tokens: seat.maxTokens ?? DEFAULT_MAX_TOKENS,
-        temperature: 0.2,
-      }),
-      signal: controller.signal,
-    })
-
-    if (!res.ok) {
-      const body = await res.text().catch(() => "")
-      throw new Error(`HTTP ${res.status}: ${body.slice(0, 200)}`)
-    }
-
-    const json = (await res.json()) as ChatResponse
-    const content = json.choices?.[0]?.message?.content ?? ""
-    const finishReason = json.choices?.[0]?.finish_reason ?? "unknown"
-
-    // Empty content is a real failure -- typically a reasoning model that spent
-    // its whole budget on hidden tokens. Never let it pass as an empty review.
-    if (content.trim() === "") {
-      throw new Error(
-        `empty content (finish_reason=${finishReason}, max_tokens=${seat.maxTokens ?? DEFAULT_MAX_TOKENS}); ` +
-          `raise max_tokens if this is a reasoning model`,
-      )
-    }
-
-    return { content, resolvedModel: json.model ?? null, finishReason }
+    const request = buildRequest(opts, seat, system, user, maxTokens, controller.signal)
+    const res = await doFetch(url, request)
+    await ensureOk(res)
+    return readContent((await res.json()) as ChatResponse, maxTokens)
   } finally {
     clearTimeout(timer)
+    unlink()
+  }
+}
+
+/** A seat that failed to answer. Its silence is never counted as agreement. */
+function failedVerdict(seat: ExpertSeat, reason: unknown): ExpertVerdict {
+  return {
+    id: seat.id,
+    role: seat.role,
+    requestedModel: seat.model,
+    resolvedModel: null,
+    verdict: "ERROR",
+    confidence: 0,
+    counted: false,
+    report: "",
+    error: reason instanceof Error ? reason.message : String(reason),
+  }
+}
+
+/** A seat that answered: parse its verdict and keep the report as evidence. */
+function answeredVerdict(
+  seat: ExpertSeat,
+  answer: { content: string; resolvedModel: string | null },
+): ExpertVerdict {
+  const { verdict, confidence } = parseVerdict(answer.content)
+  return {
+    id: seat.id,
+    role: seat.role,
+    requestedModel: seat.model,
+    resolvedModel: answer.resolvedModel,
+    verdict,
+    confidence,
+    counted: verdict !== "INVALID_NO_VERDICT",
+    report: answer.content,
   }
 }
 
@@ -203,30 +292,9 @@ export async function runRound(
 
   const verdicts: ExpertVerdict[] = settled.map((s, i) => {
     const seat = opts.seats[i]
-    if (s.status !== "fulfilled") {
-      return {
-        id: seat.id,
-        role: seat.role,
-        requestedModel: seat.model,
-        resolvedModel: null,
-        verdict: "ERROR",
-        confidence: 0,
-        counted: false,
-        report: "",
-        error: s.reason instanceof Error ? s.reason.message : String(s.reason),
-      }
-    }
-    const { verdict, confidence } = parseVerdict(s.value.content)
-    return {
-      id: seat.id,
-      role: seat.role,
-      requestedModel: seat.model,
-      resolvedModel: s.value.resolvedModel,
-      verdict,
-      confidence,
-      counted: verdict !== "INVALID_NO_VERDICT",
-      report: s.value.content,
-    }
+    return s.status === "fulfilled"
+      ? answeredVerdict(seat, s.value)
+      : failedVerdict(seat, s.reason)
   })
 
   const counted = verdicts.filter((v) => v.counted)

package/plugins/dsh/src/evidence.test.ts

@@ -0,0 +1,74 @@
+/**
+ * @test REQ-DSH-012 delphi-review can produce Gate MW evidence
+ * @intent Verify the walkthrough evidence document satisfies every field the
+ *         pre-push validator checks, including the two constraints that are easy to
+ *         get wrong: result_type belongs to each expert record, and requested_model
+ *         comes from the configured seat rather than from the gateway's response.
+ * @covers AC-DSH-012-01 AC-DSH-012-02 AC-DSH-012-03
+ *
+ * The stakes: Gate MW compares this document against HEAD at push time. A wrong
+ * result_type is rejected with "expert X must be a successful Delphi expert result"
+ * -- a message that says nothing about where the field belongs. Both mistakes were
+ * made once already while building this by hand.
+ */
+
+import { describe, expect, it } from "vitest"
+import { buildEvidence, evidenceChannel } from "./evidence.js"
+
+/** A full-length SHA-1, which is what git rev-parse reports. */
+const FULL_SHA_LENGTH = 40;
+
+const HEAD = "a".repeat(FULL_SHA_LENGTH)
+const BRANCH = "sprint/2026-10-27-01"
+const NOW = new Date("2026-10-27T10:00:00.000Z")
+
+const seats = [
+  { role: "architecture", model: "local-deepseek-v4-flash", resolved: "DeepSeek-V4-Flash" },
+  { role: "technical", model: "local-qwen3.8-flash", resolved: "Qwen3_8-flash-next" },
+  { role: "feasibility", model: "local-qwen3.8-27b", resolved: "Qwen3_8-27b-next" },
+]
+
+describe("buildEvidence", () => {
+  it("carries result_type on each expert, not at the top level", () => {
+    const evidence = buildEvidence({ head: HEAD, branch: BRANCH, seats, verdict: "APPROVED", now: NOW })
+    // The validator reads expert.result_type. A top-level copy looks right and is not.
+    expect(evidence).not.toHaveProperty("result_type")
+    for (const expert of evidence.experts) {
+      expect(expert.result_type).toBe("delphi_expert_result")
+    }
+  })
+
+  it("takes requested_model from the configured seat, not the gateway response", () => {
+    const evidence = buildEvidence({ head: HEAD, branch: BRANCH, seats, verdict: "APPROVED", now: NOW })
+    const technical = evidence.experts.find((e) => e.role === "technical")
+    // These are genuinely different strings: the gateway reports its own naming.
+    expect(technical?.requested_model).toBe("local-qwen3.8-flash")
+    expect(technical?.resolved_model).toBe("Qwen3_8-flash-next")
+  })
+
+  it("stamps expires exactly one hour after timestamp", () => {
+    const evidence = buildEvidence({ head: HEAD, branch: BRANCH, seats, verdict: "APPROVED", now: NOW })
+    expect(evidence.timestamp).toBe("2026-10-27T10:00:00.000Z")
+    expect(evidence.expires).toBe("2026-10-27T11:00:00.000Z")
+    expect(Date.parse(evidence.expires) - Date.parse(evidence.timestamp)).toBe(3_600_000)
+  })
+
+  it("refuses to write evidence for a review that did not approve", () => {
+    // Writing APPROVED evidence from a non-approving review would defeat Gate MW
+    // entirely, so this is a throw rather than a field the caller can override.
+    expect(() =>
+      buildEvidence({ head: HEAD, branch: BRANCH, seats, verdict: "REQUEST_CHANGES", now: NOW }),
+    ).toThrow()
+  })
+
+  it("refuses evidence when a seat failed to resolve a model", () => {
+    const broken = seats.map((s, i) => (i === 1 ? { ...s, resolved: "" } : s))
+    expect(() => buildEvidence({ head: HEAD, branch: BRANCH, seats: broken, verdict: "APPROVED", now: NOW })).toThrow()
+  })
+
+  it("marks local gateways local and public ones external", () => {
+    expect(evidenceChannel("http://localhost:8080/v1")).toBe("local")
+    expect(evidenceChannel("http://127.0.0.1:8080/v1")).toBe("local")
+    expect(evidenceChannel("https://lab.iwhalecloud.com/gpt-proxy")).toBe("external")
+  })
+})