@claude-flow/cli 3.12.0 → 3.12.2

package/plugins/ruflo-metaharness/scripts/test-pipeline-roundtrip.mjs

@@ -0,0 +1,586 @@
+#!/usr/bin/env node
+// test-pipeline-roundtrip.mjs — end-to-end test of the ADR-152 §3.1
+// cross-pipeline integration shipped iters 36→46.
+//
+// THE GAP THIS CLOSES
+//   Every prior iter test exercised ONE surface in isolation:
+//     iter 35: spike — synthetic LEGAL/SUPPORT/DEVOPS fixtures
+//     iter 37: MCP runtime test — fake mem keys
+//     iter 38: audit-trend — hand-written audit JSON
+//     iter 39: unit tests — pure-function arithmetic
+//     iter 41: bench — synthetic payloads
+//     iter 43: Phase 4 — file-path fixtures
+//     iter 46: audit_trend file inputs — same fixtures
+//
+//   None of these proved the FULL chain works end-to-end with no
+//   synthetic data. This test does.
+//
+// THE PIPELINE BEING TESTED
+//   1. oia-audit --dry-run --path .         (real run against ruflo)
+//   2. The audit record's fingerprint{score,genome}
+//   3. audit-trend --baseline {same-record} --current {same-record}
+//   4. delta.structuralDistance.verdict === 'near-identical'
+//   5. delta.structuralDistance.overall === 1
+//
+// USAGE
+//   node scripts/test-pipeline-roundtrip.mjs
+//   node scripts/test-pipeline-roundtrip.mjs --format json
+//
+// EXIT CODES
+//   0  full chain works
+//   1  some assertion failed
+//   2  oia-audit degraded (upstream metaharness absent — test cannot run)
+//
+// ADR-150 ARCHITECTURAL CONSTRAINT BEHAVIOR
+//   If oia-audit returns {degraded:true} (no upstream metaharness), the
+//   test exits 2 with a clear message — this is the "test cannot run"
+//   case, NOT a "test failed" case. CI infrastructure can distinguish.
+
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, writeFileSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const SCRIPTS_DIR = dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = dirname(dirname(dirname(SCRIPTS_DIR))); // up out of plugins/ruflo-metaharness/scripts
+
+const ARGS = (() => {
+  const a = { format: 'table' };
+  for (let i = 2; i < process.argv.length; i++) {
+    if (process.argv[i] === '--format') a.format = process.argv[++i];
+  }
+  return a;
+})();
+
+let passed = 0, failed = 0;
+const failures = [];
+function assert(cond, label) {
+  if (cond) { console.log(`  ✓ ${label}`); passed++; }
+  else { console.log(`  ✗ ${label}`); failures.push(label); failed++; }
+}
+
+function runNode(scriptName, args, timeoutMs = 60_000) {
+  const p = spawnSync('node', [join(SCRIPTS_DIR, scriptName), ...args], {
+    encoding: 'utf-8',
+    timeout: timeoutMs,
+    cwd: REPO_ROOT,
+  });
+  return { stdout: p.stdout || '', stderr: p.stderr || '', status: p.status ?? -1 };
+}
+
+// ──────────────────────────────────────────────────────────────────
+console.log(`# test-pipeline-roundtrip — ADR-152 §3.1 end-to-end (iter 47)\n`);
+
+const tmp = mkdtempSync(join(tmpdir(), 'pipeline-roundtrip-'));
+
+try {
+  // ──────────────────────────────────────────────────────────────
+  // STAGE 1: oia-audit --dry-run against ruflo repo itself
+  // ──────────────────────────────────────────────────────────────
+  console.log('Stage 1 — oia-audit --dry-run against ruflo repo');
+  const auditRun = runNode('oia-audit.mjs', ['--path', REPO_ROOT, '--dry-run', '--format', 'json'], 90_000);
+
+  // Extract the JSON object from stdout (script may emit some prelude)
+  const auditMatch = /\{[\s\S]*\}/.exec(auditRun.stdout);
+  if (!auditMatch) {
+    console.log(`  ✗ oia-audit produced no JSON; stderr:\n${auditRun.stderr.slice(0, 500)}`);
+    process.exit(1);
+  }
+  const audit = JSON.parse(auditMatch[0]);
+
+  // If oia-audit reports degraded (no upstream metaharness installed), skip
+  // — this test cannot run without real score/genome output.
+  if (audit.degraded === true) {
+    console.log(`  ⊘ oia-audit reports degraded — upstream metaharness absent`);
+    console.log(`     This test exercises real metaharness output; cannot run.`);
+    console.log(`     reason: ${audit.reason}`);
+    process.exit(2);
+  }
+
+  assert(typeof audit === 'object' && audit !== null,
+    'oia-audit produced a JSON object');
+  assert(typeof audit.composite === 'object',
+    'oia-audit has composite worst-severity');
+  assert(typeof audit.components === 'object',
+    'oia-audit has components bundle');
+
+  // iter 38 — fingerprint must be present
+  assert(typeof audit.fingerprint === 'object' && audit.fingerprint !== null,
+    'oia-audit emits fingerprint field (iter 38)');
+  if (!audit.fingerprint?.score || !audit.fingerprint?.genome) {
+    console.log(`  ⊘ fingerprint partial; score+genome may have degraded individually`);
+    console.log(`     fingerprint: ${JSON.stringify(audit.fingerprint).slice(0, 200)}`);
+    process.exit(2);
+  }
+  assert(typeof audit.fingerprint.score?.harnessFit === 'number',
+    'fingerprint.score has harnessFit');
+  assert(Array.isArray(audit.fingerprint.genome?.agent_topology),
+    'fingerprint.genome has agent_topology array');
+
+  // iter 49 — schema contracts beyond similarity (the OTHER class of
+  // silent drift). audit-trend reads specific upstream fields:
+  //   - composite.worst                            (severity rollup)
+  //   - components.threatModel.json.worst          (audit-trend.mjs:96-100)
+  //   - components.mcpScan.json.findings           (audit-trend.mjs:124-127)
+  // If upstream renames any of these, audit-trend silently breaks.
+  // Gating them here forces a CI failure on the next PR after upstream
+  // schema drift, instead of months later when someone notices the
+  // severity verdict has been wrong all along.
+  assert(typeof audit.composite?.worst === 'string',
+    'iter 49 — audit.composite.worst is a string');
+  assert(['clean', 'low', 'medium', 'high'].includes(audit.composite.worst),
+    `iter 49 — composite.worst in valid severity vocab (got ${audit.composite.worst})`);
+  // threatModel.json.worst is the upstream field audit-trend reads
+  if (audit.components?.threatModel && !audit.components.threatModel.degraded) {
+    assert(typeof audit.components.threatModel.json?.worst === 'string',
+      'iter 49 — components.threatModel.json.worst is a string (audit-trend dep)');
+  }
+  // mcp-scan.mjs currently emits {rawStdout, durationMs, alert} —
+  // no structured `findings` array. audit-trend.mjs reads
+  // `json.findings` (guarded with Array.isArray fallback to []) so it
+  // doesn't crash, but the introduced/cleared logic is effectively
+  // a no-op on real output. iter 49 documents this gap rather than
+  // asserting a contract that doesn't yet hold. If a future iter
+  // promotes mcp-scan.mjs to emit structured findings, this assertion
+  // should become a real type-check.
+  if (audit.components?.mcpScan?.json?.findings !== undefined) {
+    assert(Array.isArray(audit.components.mcpScan.json.findings),
+      'iter 49 — IF mcpScan.json.findings exists THEN it must be an array');
+  } else {
+    console.log(`  ⊘ mcpScan.json.findings absent (mcp-scan.mjs currently text-only — known iter-49 gap)`);
+  }
+
+  // ──────────────────────────────────────────────────────────────
+  // STAGE 2: persist the audit record as both baseline and current
+  // ──────────────────────────────────────────────────────────────
+  console.log('\nStage 2 — write audit record to baseline + current paths');
+  const basePath = join(tmp, 'baseline.json');
+  const currPath = join(tmp, 'current.json');
+  writeFileSync(basePath, JSON.stringify(audit));
+  writeFileSync(currPath, JSON.stringify(audit));
+  assert(readFileSync(basePath, 'utf-8').length > 100, 'baseline file written');
+  assert(readFileSync(currPath, 'utf-8').length > 100, 'current file written');
+
+  // ──────────────────────────────────────────────────────────────
+  // STAGE 3: audit-trend reading the same audit twice
+  // ──────────────────────────────────────────────────────────────
+  console.log('\nStage 3 — audit-trend against self (must report near-identical)');
+  const trendRun = runNode('audit-trend.mjs', [
+    '--baseline', basePath,
+    '--current', currPath,
+    '--format', 'json',
+  ]);
+
+  const trendMatch = /\{[\s\S]*\}/.exec(trendRun.stdout);
+  assert(trendMatch !== null, 'audit-trend produced JSON');
+  const trend = JSON.parse(trendMatch[0]);
+
+  assert(typeof trend.delta?.structuralDistance === 'object',
+    'trend exposes delta.structuralDistance');
+  const sd = trend.delta.structuralDistance;
+  assert(sd.verdict === 'near-identical',
+    `self-roundtrip verdict === near-identical (got ${sd.verdict})`);
+  assert(sd.overall === 1,
+    `self-roundtrip overall === 1 (got ${sd.overall})`);
+  assert(sd.distance === 0,
+    `self-roundtrip distance === 0 (got ${sd.distance})`);
+
+  // ──────────────────────────────────────────────────────────────
+  // STAGE 4: alert-on-distance-below should NOT trigger on self-match
+  // ──────────────────────────────────────────────────────────────
+  console.log('\nStage 4 — distance alert does not trigger on self-match');
+  const noAlertRun = runNode('audit-trend.mjs', [
+    '--baseline', basePath,
+    '--current', currPath,
+    '--alert-on-distance-below', '0.5',
+    '--format', 'json',
+  ]);
+  assert(noAlertRun.status === 0,
+    `alert at threshold 0.5 does NOT fire on self-match (exit 0, got ${noAlertRun.status})`);
+
+  // Now flip: any threshold above 1 must trigger
+  console.log('\nStage 5 — distance alert triggers when threshold > self-match');
+  const alertRun = runNode('audit-trend.mjs', [
+    '--baseline', basePath,
+    '--current', currPath,
+    '--alert-on-distance-below', '1.01',
+    '--format', 'json',
+  ]);
+  assert(alertRun.status === 1,
+    `alert at threshold 1.01 fires on self-match (exit 1, got ${alertRun.status})`);
+
+  // ──────────────────────────────────────────────────────────────
+  // STAGE 6 (iter 49) — non-similarity schema contracts in the trend
+  //
+  // audit-trend reads `composite.worst`, `components.threatModel.json.worst`,
+  // and `components.mcpScan.json.findings`. The trend output's
+  // delta.worst.verdict on a self-match must be 'unchanged'. If upstream
+  // renames any of these fields, the verdict silently becomes 'missing'
+  // or undefined — this assertion catches that BEFORE shipping.
+  // ──────────────────────────────────────────────────────────────
+  // ──────────────────────────────────────────────────────────────
+  // STAGE 7 (iter 51) — drift detection actually FIRES on mutated input
+  //
+  // Every prior stage uses the same audit record twice (self-match).
+  // That proves the chain doesn't FALSELY report drift on identical
+  // input, but doesn't prove the chain catches REAL drift. This stage
+  // takes the audit record and synthetically mutates fields the
+  // similarity module reads, then asserts the chain detects the
+  // difference.
+  //
+  // Mutations applied (all measurable by similarity):
+  //   - harnessFit:  unchanged   → -20   (cosine signal)
+  //   - taskCoverage: unchanged  → -15   (cosine signal)
+  //   - agent_topology: add one  → jaccard divergence
+  //
+  // Expected outcome:
+  //   - structuralDistance.verdict !== 'near-identical'
+  //   - structuralDistance.overall < 1
+  //   - --alert-on-distance-below 0.95 should fire
+  // ──────────────────────────────────────────────────────────────
+  console.log('\nStage 7 — drift detection on mutated audit (iter 51)');
+  const mutatedPath = join(tmp, 'mutated.json');
+  const mutated = JSON.parse(JSON.stringify(audit));
+  // Modify fields the similarity module actually reads. The mutation has
+  // to be large enough to cross the verdict-bucket threshold (0.95 →
+  // 'near-identical' boundary). The 9-dim cosine vector is dominated by
+  // values already clustered around the same range, so single-field
+  // changes don't move overall much. Mutate across all 3 components:
+  //   - cosine: drop 4 scorecard fields by 25-40 points
+  //   - categorical: swap archetype + template (2 of 4 enums diverge)
+  //   - jaccard: rebuild agent_topology with a different set
+  mutated.fingerprint.score.harnessFit = Math.max(0, audit.fingerprint.score.harnessFit - 40);
+  mutated.fingerprint.score.taskCoverage = Math.max(0, audit.fingerprint.score.taskCoverage - 35);
+  mutated.fingerprint.score.toolSafety = Math.max(0, audit.fingerprint.score.toolSafety - 30);
+  mutated.fingerprint.score.compileConfidence = Math.max(0, audit.fingerprint.score.compileConfidence - 25);
+  mutated.fingerprint.score.archetype = 'iter-51-synthetic-archetype';
+  mutated.fingerprint.score.template = 'iter-51-synthetic-template';
+  mutated.fingerprint.genome.agent_topology = ['iter-51-marker-a', 'iter-51-marker-b'];
+  writeFileSync(mutatedPath, JSON.stringify(mutated));
+
+  const driftRun = runNode('audit-trend.mjs', [
+    '--baseline', basePath,
+    '--current', mutatedPath,
+    '--format', 'json',
+  ]);
+  const driftMatch = /\{[\s\S]*\}/.exec(driftRun.stdout);
+  assert(driftMatch !== null, 'drift run produced JSON');
+  const driftTrend = JSON.parse(driftMatch[0]);
+  const driftSd = driftTrend.delta?.structuralDistance;
+  assert(typeof driftSd === 'object', 'drift trend exposes structuralDistance');
+  assert(driftSd.verdict !== 'near-identical',
+    `drift detected — verdict !== near-identical (got ${driftSd?.verdict})`);
+  assert(driftSd.overall < 1,
+    `drift detected — overall < 1 (got ${driftSd?.overall})`);
+  assert(driftSd.distance > 0,
+    `drift detected — distance > 0 (got ${driftSd?.distance})`);
+
+  // Alert chain: --alert-on-distance-below 0.95 must fire IF drift > 0.05
+  // If the synthetic mutation produced overall ≥ 0.95, lower the threshold.
+  const threshold = driftSd.overall < 0.95 ? '0.95' : String(driftSd.overall + 0.01);
+  const alertDriftRun = runNode('audit-trend.mjs', [
+    '--baseline', basePath,
+    '--current', mutatedPath,
+    '--alert-on-distance-below', threshold,
+    '--format', 'json',
+  ]);
+  assert(alertDriftRun.status === 1,
+    `drift alert at threshold ${threshold} fires on mutated audit (exit 1, got ${alertDriftRun.status})`);
+
+  // ──────────────────────────────────────────────────────────────
+  console.log('\nStage 6 — non-similarity schema contracts (iter 49)');
+  assert(typeof trend.delta?.worst === 'object',
+    'trend exposes delta.worst (severity-rollup)');
+  assert(trend.delta.worst.verdict === 'unchanged',
+    `self-roundtrip severity-verdict === unchanged (got ${trend.delta.worst.verdict})`);
+  assert(trend.delta.worst.baseline === trend.delta.worst.current,
+    'self-roundtrip baseline === current severity');
+  assert(trend.delta.worst.rankDelta === 0,
+    `self-roundtrip rankDelta === 0 (got ${trend.delta.worst.rankDelta})`);
+  // Findings arrays: introduced/cleared must both be 0 on self-match
+  assert(trend.delta?.findings?.introducedCount === 0,
+    `self-roundtrip introducedCount === 0 (got ${trend.delta?.findings?.introducedCount})`);
+  assert(trend.delta?.findings?.clearedCount === 0,
+    `self-roundtrip clearedCount === 0 (got ${trend.delta?.findings?.clearedCount})`);
+
+  // ──────────────────────────────────────────────────────────────
+  // STAGE 8 (iter 68) — drift-from-history end-to-end via --baseline-file
+  //
+  // Every prior stage tested audit-trend (the underlying primitive).
+  // None tested drift-from-history (the iter-53 user-facing wrapper).
+  // This stage runs the iter-67 fastest path: baseline from a file,
+  // skipping audit-list AND memory roundtrip entirely.
+  // ──────────────────────────────────────────────────────────────
+  console.log('\nStage 8 — drift-from-history end-to-end (iter 68)');
+  const driftFromHistoryRun = runNode('drift-from-history.mjs', [
+    '--baseline-file', basePath,
+    '--dry-run',
+    '--format', 'json',
+  ], 120_000);
+  const driftFromHistoryMatch = /\{[\s\S]*\}/.exec(driftFromHistoryRun.stdout);
+  assert(driftFromHistoryMatch !== null, 'drift-from-history produced JSON');
+  const dfh = JSON.parse(driftFromHistoryMatch[0]);
+
+  // Iter-66/iter-67 contract: the fastest-path flags are surfaced in timing
+  assert(dfh.timing?.skippedAuditList === true,
+    'drift-from-history --baseline-file → skippedAuditList === true (iter 66)');
+  assert(dfh.timing?.usedBaselineFile === true,
+    'drift-from-history --baseline-file → usedBaselineFile === true (iter 67)');
+  // Wall-clock fastpath proof: must be under 30s with file inputs
+  // (vs ~26s minimum for the audit-list-loading slow path)
+  assert(typeof dfh.timing?.parallelWallMs === 'number' && dfh.timing.parallelWallMs < 30000,
+    `drift-from-history fastpath wall < 30s (got ${dfh.timing?.parallelWallMs}ms)`);
+  // Same-file self-match → similarity 1.0
+  assert(dfh.drift?.structuralDistance?.overall === 1,
+    `drift-from-history self-match overall === 1 (got ${dfh.drift?.structuralDistance?.overall})`);
+  assert(dfh.drift?.structuralDistance?.verdict === 'near-identical',
+    `drift-from-history self-match verdict === near-identical (got ${dfh.drift?.structuralDistance?.verdict})`);
+  // Alert chain end-to-end
+  assert(dfh.alert?.triggered === false,
+    'drift-from-history self-match alert NOT triggered at default threshold (0.95)');
+
+  // ──────────────────────────────────────────────────────────────
+  // STAGE 9 (iter 75) — drift-from-history detects drift via fast path
+  //
+  // Stage 8 proved the fast path correctly identifies self-match.
+  // This stage proves it also CATCHES drift — feeds a mutated baseline
+  // file and asserts the verdict flips. Without this, a regression
+  // that breaks the fast path's similarity computation would still
+  // pass Stage 8 (which only checks the identity case).
+  //
+  // Mutation: re-uses Stage 7's mutated audit shape, written to a
+  // separate baseline file. drift-from-history runs fresh oia-audit
+  // against current state and diffs against the mutated baseline.
+  // ──────────────────────────────────────────────────────────────
+  console.log('\nStage 9 — drift-from-history fastpath catches mutation (iter 75)');
+  // mutatedPath was already populated in Stage 7. Re-use as baseline-file.
+  const dfhDriftRun = runNode('drift-from-history.mjs', [
+    '--baseline-file', mutatedPath,
+    '--dry-run',
+    '--threshold', '0.95',
+    '--format', 'json',
+  ], 120_000);
+  const dfhDriftMatch = /\{[\s\S]*\}/.exec(dfhDriftRun.stdout);
+  assert(dfhDriftMatch !== null, 'drift-from-history with mutated baseline produced JSON');
+  const dfhDrift = JSON.parse(dfhDriftMatch[0]);
+
+  // Fast path still fired
+  assert(dfhDrift.timing?.usedBaselineFile === true,
+    'Stage 9 fastpath: usedBaselineFile === true');
+
+  // Drift detected — same invariants as Stage 7 but via the wrapper
+  const dfhSd = dfhDrift.drift?.structuralDistance;
+  assert(typeof dfhSd === 'object', 'Stage 9: structuralDistance present');
+  assert(dfhSd.verdict !== 'near-identical',
+    `Stage 9: verdict !== near-identical (got ${dfhSd?.verdict}) — fastpath catches drift`);
+  assert(dfhSd.overall < 1,
+    `Stage 9: overall < 1 (got ${dfhSd?.overall})`);
+  assert(dfhSd.distance > 0,
+    `Stage 9: distance > 0 (got ${dfhSd?.distance})`);
+
+  // Alert end-to-end via the fast path
+  // (mutation pushes overall ~0.7, below default 0.95 threshold → triggered)
+  assert(dfhDrift.alert?.triggered === true,
+    'Stage 9: --threshold 0.95 fires on mutated baseline via fastpath');
+  // Exit code reflects alert
+  assert(dfhDriftRun.status === 1,
+    `Stage 9: drift-from-history exit=1 when alert triggered (got ${dfhDriftRun.status})`);
+
+  // ──────────────────────────────────────────────────────────────
+  // STAGE 10 (iter 76) — introduced/cleared findings diff actually works
+  //
+  // Iter 49 documented that mcp-scan emitted text only → audit-trend's
+  // findings.introducedCount was dead code. Iter 50 added the parser
+  // so findings ARE populated. But no test verified the diff on a
+  // REAL finding-set change — Stage 7 mutates only the fingerprint
+  // (score/genome), leaving mcpScan.json.findings unchanged.
+  //
+  // This stage takes the real audit (Stage 1) and mutates ONLY
+  // mcpScan.json.findings — adds a synthetic finding to the baseline.
+  // audit-trend should report clearedCount === 1 (the synthetic
+  // disappeared in the current audit) with severity preserved.
+  // ──────────────────────────────────────────────────────────────
+  console.log('\nStage 10 — introduced/cleared findings diff (iter 76 — locks iter-50 fix)');
+  const findingsBasePath = join(tmp, 'findings-base.json');
+  const findingsMutated = JSON.parse(JSON.stringify(audit));
+  // Ensure mcpScan.json.findings exists (it should post-iter-50)
+  if (!findingsMutated.components?.mcpScan?.json?.findings) {
+    findingsMutated.components.mcpScan = findingsMutated.components.mcpScan ?? {};
+    findingsMutated.components.mcpScan.json = findingsMutated.components.mcpScan.json ?? {};
+    findingsMutated.components.mcpScan.json.findings = [];
+  }
+  // Append a synthetic finding that wouldn't appear in a fresh audit.
+  findingsMutated.components.mcpScan.json.findings.push({
+    severity: 'medium',
+    id: 'iter-76-synthetic-finding',
+    server: 'synthetic-server',
+    tool: 'synthetic-tool',
+    message: 'Stage 10 synthetic finding for clearedCount verification',
+  });
+  writeFileSync(findingsBasePath, JSON.stringify(findingsMutated));
+
+  // Diff: baseline has the synthetic, current (real audit) doesn't →
+  // expect clearedCount === 1, introducedCount === 0.
+  const findingsTrendRun = runNode('audit-trend.mjs', [
+    '--baseline', findingsBasePath,
+    '--current', basePath,  // basePath = unmodified audit
+    '--format', 'json',
+  ], 60_000);
+  const findingsTrendMatch = /\{[\s\S]*\}/.exec(findingsTrendRun.stdout);
+  assert(findingsTrendMatch !== null, 'Stage 10: audit-trend produced JSON');
+  const findingsTrend = JSON.parse(findingsTrendMatch[0]);
+
+  assert(findingsTrend.delta?.findings?.clearedCount === 1,
+    `Stage 10: clearedCount === 1 (got ${findingsTrend.delta?.findings?.clearedCount}) — iter-50 fix functional`);
+  assert(findingsTrend.delta?.findings?.introducedCount === 0,
+    `Stage 10: introducedCount === 0 (got ${findingsTrend.delta?.findings?.introducedCount})`);
+  // Cleared finding's severity preserved through the diff
+  const cleared = findingsTrend.delta?.findings?.cleared?.[0];
+  assert(cleared?.severity === 'medium',
+    `Stage 10: cleared finding severity preserved (got ${cleared?.severity})`);
+  assert(cleared?.id === 'iter-76-synthetic-finding',
+    'Stage 10: cleared finding id preserved');
+
+  // ──────────────────────────────────────────────────────────────
+  // STAGE 11 (iter 77) — introducedCount symmetry + dedup discrimination
+  //
+  // Stage 10 proved the CLEARED side. Three more cases to lock the
+  // diff logic completely:
+  //
+  //   11a. introducedCount: baseline clean, current has synthetic
+  //   11b. both-different:  baseline has finding A, current has finding B
+  //                          → introduced=1, cleared=1
+  //   11c. identical:       baseline + current have SAME finding
+  //                          → both counters stay at 0 (dedup works)
+  // ──────────────────────────────────────────────────────────────
+  console.log('\nStage 11 — introduced/cleared symmetric + dedup (iter 77)');
+  const findingA = {
+    severity: 'medium',
+    id: 'iter-77-finding-A',
+    server: 'server-A',
+    tool: 'tool-A',
+    message: 'finding A',
+  };
+  const findingB = {
+    severity: 'high',
+    id: 'iter-77-finding-B',
+    server: 'server-B',
+    tool: 'tool-B',
+    message: 'finding B',
+  };
+
+  // 11a — introduced
+  const baseClean = JSON.parse(JSON.stringify(audit));
+  baseClean.components.mcpScan.json.findings = [];
+  const currentWithA = JSON.parse(JSON.stringify(audit));
+  currentWithA.components.mcpScan.json.findings = [findingA];
+  const baseCleanPath = join(tmp, 'base-clean.json');
+  const currentWithAPath = join(tmp, 'current-A.json');
+  writeFileSync(baseCleanPath, JSON.stringify(baseClean));
+  writeFileSync(currentWithAPath, JSON.stringify(currentWithA));
+  const trendRun11a = runNode('audit-trend.mjs', [
+    '--baseline', baseCleanPath, '--current', currentWithAPath, '--format', 'json',
+  ], 60_000);
+  const m11a = /\{[\s\S]*\}/.exec(trendRun11a.stdout);
+  const trend11a = JSON.parse(m11a[0]);
+  assert(trend11a.delta?.findings?.introducedCount === 1,
+    `Stage 11a: introducedCount === 1 (got ${trend11a.delta?.findings?.introducedCount})`);
+  assert(trend11a.delta?.findings?.clearedCount === 0,
+    `Stage 11a: clearedCount === 0 (got ${trend11a.delta?.findings?.clearedCount})`);
+  assert(trend11a.delta?.findings?.introduced?.[0]?.id === 'iter-77-finding-A',
+    'Stage 11a: introduced finding id preserved');
+
+  // 11b — both different
+  const baselineWithB = JSON.parse(JSON.stringify(audit));
+  baselineWithB.components.mcpScan.json.findings = [findingB];
+  const baselineWithBPath = join(tmp, 'baseline-B.json');
+  writeFileSync(baselineWithBPath, JSON.stringify(baselineWithB));
+  const trendRun11b = runNode('audit-trend.mjs', [
+    '--baseline', baselineWithBPath, '--current', currentWithAPath, '--format', 'json',
+  ], 60_000);
+  const m11b = /\{[\s\S]*\}/.exec(trendRun11b.stdout);
+  const trend11b = JSON.parse(m11b[0]);
+  assert(trend11b.delta?.findings?.introducedCount === 1,
+    `Stage 11b: introducedCount === 1 (got ${trend11b.delta?.findings?.introducedCount})`);
+  assert(trend11b.delta?.findings?.clearedCount === 1,
+    `Stage 11b: clearedCount === 1 (got ${trend11b.delta?.findings?.clearedCount})`);
+  // Dedup discriminates: B was cleared, A was introduced
+  assert(trend11b.delta?.findings?.cleared?.[0]?.id === 'iter-77-finding-B',
+    'Stage 11b: dedup correctly identifies B as cleared');
+  assert(trend11b.delta?.findings?.introduced?.[0]?.id === 'iter-77-finding-A',
+    'Stage 11b: dedup correctly identifies A as introduced');
+
+  // 11c — identical findings on both sides
+  const trendRun11c = runNode('audit-trend.mjs', [
+    '--baseline', currentWithAPath, '--current', currentWithAPath, '--format', 'json',
+  ], 60_000);
+  const m11c = /\{[\s\S]*\}/.exec(trendRun11c.stdout);
+  const trend11c = JSON.parse(m11c[0]);
+  assert(trend11c.delta?.findings?.introducedCount === 0,
+    `Stage 11c: identical findings → introducedCount === 0 (dedup works)`);
+  assert(trend11c.delta?.findings?.clearedCount === 0,
+    `Stage 11c: identical findings → clearedCount === 0`);
+
+  // ──────────────────────────────────────────────────────────────
+  // STAGE 12 (iter 79) — --alert-on-new-severity orthogonal gate
+  //
+  // Iter 78 added the gate. Iter 79 wires it into the weekly cron.
+  // This stage verifies the gate fires correctly through the
+  // drift-from-history wrapper:
+  //   - baseline has no findings + current has 1 medium finding
+  //   - --threshold 0.5 (similarity stays above)
+  //   - --alert-on-new-severity medium should trigger
+  //
+  // Catches the "structural similarity high but new security
+  // finding" case that iter-78 closed.
+  // ──────────────────────────────────────────────────────────────
+  console.log('\nStage 12 — --alert-on-new-severity orthogonal gate (iter 79)');
+
+  // Re-use baseClean (no findings) from Stage 11
+  // Run drift-from-history with --alert-on-new-severity info
+  // (real ruflo audit has 1 INFO finding → introduced=1)
+  const stage12Run = runNode('drift-from-history.mjs', [
+    '--baseline-file', baseCleanPath,
+    '--dry-run',
+    '--threshold', '0.5',
+    '--alert-on-new-severity', 'info',
+    '--format', 'json',
+  ], 120_000);
+  const m12 = /\{[\s\S]*\}/.exec(stage12Run.stdout);
+  assert(m12 !== null, 'Stage 12: drift-from-history produced JSON');
+  const stage12 = JSON.parse(m12[0]);
+
+  // The orthogonal gate fires
+  assert(stage12.alert?.triggered === true,
+    'Stage 12: --alert-on-new-severity info triggers on ruflo current INFO finding');
+  // Reason mentions severity, not similarity (structural is fine at threshold 0.5)
+  const reasons = stage12.alert?.reasons ?? [];
+  const hasSeverityReason = reasons.some((r) => /finding\(s\) at or above/.test(r));
+  assert(hasSeverityReason,
+    `Stage 12: reasons mention new-finding severity (got ${JSON.stringify(reasons)})`);
+  // elevatedFindings populated
+  assert(Array.isArray(stage12.alert?.elevatedFindings) && stage12.alert.elevatedFindings.length >= 1,
+    `Stage 12: elevatedFindings non-empty (got ${stage12.alert?.elevatedFindings?.length})`);
+  // CLI exit reflects the alert
+  assert(stage12Run.status === 1,
+    `Stage 12: drift-from-history exit=1 on severity alert (got ${stage12Run.status})`);
+  // newSeverityThreshold echoed in payload
+  assert(stage12.alert?.newSeverityThreshold === 'info',
+    'Stage 12: alert.newSeverityThreshold echoed');
+
+} finally {
+  try { rmSync(tmp, { recursive: true, force: true }); } catch { /* ignore */ }
+}
+
+// ──────────────────────────────────────────────────────────────────
+const summary = { passed, failed, total: passed + failed, failures };
+
+console.log(`\n${passed} passed, ${failed} failed`);
+if (ARGS.format === 'json') console.log(JSON.stringify(summary, null, 2));
+if (failed > 0) {
+  console.log('\nFailures:');
+  for (const f of failures) console.log(`  - ${f}`);
+  process.exit(1);
+}
+console.log('\n✓ Full ADR-152 §3.1 pipeline works end-to-end with real metaharness output.');