@cmetech/otto 1.1.1 → 1.2.4

package/packages/coworker-scratchpad/src/staleness-banner.test.ts

@@ -0,0 +1,53 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { StalenessBanner } from './staleness-banner.js';
+
+describe('StalenessBanner', () => {
+  const lookup = (refToTs: Record<string, string>) => async (ref: string) => refToTs[ref] ?? null;
+
+  it('returns null when no binding is stale', async () => {
+    const sb = new StalenessBanner();
+    const banner = await sb.check({
+      scratchpadName: 'sp', sessionId: 's',
+      bindings: ['jira:prod'], spawnTime: new Date('2026-06-01T00:01:00.000Z'),
+      lookupLastModified: lookup({ 'jira:prod': '2026-06-01T00:00:00.000Z' }),
+    });
+    assert.equal(banner, null);
+  });
+
+  it('returns banner string when a binding was modified after spawnTime', async () => {
+    const sb = new StalenessBanner();
+    const banner = await sb.check({
+      scratchpadName: 'sp', sessionId: 's',
+      bindings: ['jira:prod'], spawnTime: new Date('2026-06-01T00:00:00.000Z'),
+      lookupLastModified: lookup({ 'jira:prod': '2026-06-01T00:05:00.000Z' }),
+    });
+    assert.ok(banner);
+    assert.match(banner, /jira:prod/);
+    assert.match(banner, /\/sp reset/);
+  });
+
+  it('returns null on the second check for the same (scratchpad, binding, session)', async () => {
+    const sb = new StalenessBanner();
+    const args = {
+      scratchpadName: 'sp', sessionId: 's',
+      bindings: ['jira:prod'], spawnTime: new Date('2026-06-01T00:00:00.000Z'),
+      lookupLastModified: lookup({ 'jira:prod': '2026-06-01T00:05:00.000Z' }),
+    };
+    assert.ok(await sb.check(args));
+    assert.equal(await sb.check(args), null);
+  });
+
+  it('re-fires after spawnTime advances (kernel respawn)', async () => {
+    const sb = new StalenessBanner();
+    const base = {
+      scratchpadName: 'sp', sessionId: 's', bindings: ['jira:prod'],
+      lookupLastModified: lookup({ 'jira:prod': '2026-06-01T00:05:00.000Z' }),
+    };
+    await sb.check({ ...base, spawnTime: new Date('2026-06-01T00:00:00.000Z') }); // shown once
+    await sb.check({ ...base, spawnTime: new Date('2026-06-01T00:00:00.000Z') }); // suppressed
+    sb.resetForRespawn('sp');
+    const banner = await sb.check({ ...base, spawnTime: new Date('2026-06-01T00:10:00.000Z') });
+    assert.equal(banner, null);  // post-respawn lastModified < new spawnTime
+  });
+});

package/packages/coworker-scratchpad/src/staleness-banner.ts

@@ -0,0 +1,33 @@
+export interface StalenessCheck {
+  scratchpadName: string;
+  sessionId: string;
+  bindings: string[];
+  spawnTime: Date;
+  lookupLastModified: (ref: string) => Promise<string | null>;
+}
+
+export class StalenessBanner {
+  private readonly shown = new Map<string, Set<string>>(); // scratchpadName → set of "session|ref"
+
+  async check(args: StalenessCheck): Promise<string | null> {
+    const stale: string[] = [];
+    for (const ref of args.bindings) {
+      const lm = await args.lookupLastModified(ref);
+      if (!lm) continue;
+      if (new Date(lm).getTime() <= args.spawnTime.getTime()) continue;
+      const key = `${args.sessionId}|${ref}`;
+      const set = this.shown.get(args.scratchpadName) ?? new Set<string>();
+      if (set.has(key)) continue;
+      set.add(key);
+      this.shown.set(args.scratchpadName, set);
+      stale.push(ref);
+    }
+    if (stale.length === 0) return null;
+    const list = stale.join(', ');
+    return `${list} was modified after this kernel was spawned; env vars are stale. Run /sp reset to respawn with current values.`;
+  }
+
+  resetForRespawn(scratchpadName: string): void {
+    this.shown.delete(scratchpadName);
+  }
+}

package/packages/coworker-scratchpad/src/vault-integration.test.ts

@@ -0,0 +1,221 @@
+/**
+ * Project/App: OTTO
+ * File Purpose: End-to-end integration test for vault + scratchpad (Phase 2 Task 17).
+ *
+ * Exercises the four contract seams of the otto-vault pillar working together:
+ *   1. bindings → CredentialInjector → ChildProcessRuntime env → live cell
+ *   2. SecretScanner redaction on the journal copy of stdout (live result intact)
+ *   3. vault rotation produces a StalenessBanner hit on the next staleness check
+ *   4. workspace vault entry shadows global vault entry
+ *
+ * Uses ScratchpadManager + ChildProcessRuntime + LocalDataVault + CredentialInjector
+ * end-to-end (no stubs on the integration boundary). Tests 1–3 spawn a real kernel
+ * subprocess; test 4 is vault-only and does not spawn.
+ */
+import { describe, it, after } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { mkdir } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { AuditLog } from '@otto/coworker-utils';
+import { CredentialInjector, LocalDataVault } from '@otto/coworker-vault';
+import { ScratchpadManager } from './scratchpad-manager.js';
+import { StalenessBanner } from './staleness-banner.js';
+
+interface E2EContext {
+  root: string;
+  audit: AuditLog;
+  vault: LocalDataVault;
+  injector: CredentialInjector;
+  manager: ScratchpadManager;
+  scratchpadsRoot: string;
+}
+
+async function setup(): Promise<E2EContext> {
+  const root = mkdtempSync(join(tmpdir(), 'vault-e2e-'));
+  await mkdir(join(root, 'home'), { recursive: true });
+  await mkdir(join(root, 'workspace', '.otto', 'inputs'), { recursive: true });
+  const audit = new AuditLog({ path: join(root, 'audit.jsonl') });
+  const vault = new LocalDataVault({
+    globalDir: join(root, 'home'),
+    workspaceDir: undefined,
+    audit,
+  });
+  const injector = new CredentialInjector({ vault, audit });
+  await vault.set(
+    { engine: 'jira', name: 'prod' },
+    { url: 'https://x', email: 'a@b', token: 'tok' },
+  );
+  const scratchpadsRoot = join(root, 'scratchpads');
+  const manager = new ScratchpadManager({
+    workspace: join(root, 'workspace'),
+    root: scratchpadsRoot,
+    injector,
+    audit,
+    sessionId: 'sess-1',
+    // Keep the kernel responsive even under slow test machines.
+    runtimeOptions: { cellTimeoutMs: 30_000, inactivityTimeoutMs: 30_000 },
+  });
+  return { root, audit, vault, injector, manager, scratchpadsRoot };
+}
+
+async function teardown(ctx: E2EContext): Promise<void> {
+  await ctx.manager.disposeAll();
+  rmSync(ctx.root, { recursive: true, force: true });
+}
+
+async function readAuditRecords(audit: AuditLog): Promise<Array<{
+  producer: string; action: string; detail: Record<string, unknown>;
+}>> {
+  const out: Array<{ producer: string; action: string; detail: Record<string, unknown> }> = [];
+  for await (const r of audit.read({})) {
+    out.push({ producer: r.producer, action: r.action, detail: r.detail });
+  }
+  return out;
+}
+
+describe('vault + scratchpad end-to-end (Phase 2 Task 17)', () => {
+  // Hold contexts so a test-level failure still cleans up.
+  const contexts: E2EContext[] = [];
+  after(async () => {
+    for (const c of contexts) {
+      try { await teardown(c); } catch { /* best effort */ }
+    }
+  });
+
+  it('Test 1: --use binding injects OTTO_DS_* into kernel; cell reads it', async () => {
+    const ctx = await setup();
+    contexts.push(ctx);
+    await ctx.manager.create('p1', { bindings: ['jira:prod'] });
+    const rt = await ctx.manager.getOrAttach('p1');
+    const { value } = await rt.runCell(
+      'return [process.env.OTTO_DS_JIRA_PROD__URL, process.env.OTTO_DS_JIRA_PROD__TOKEN];',
+    );
+    assert.deepEqual(value, ['https://x', 'tok']);
+    // The parent process must not be polluted by the injection.
+    assert.equal(process.env.OTTO_DS_JIRA_PROD__URL, undefined);
+    assert.equal(process.env.OTTO_DS_JIRA_PROD__TOKEN, undefined);
+  });
+
+  it('Test 2: secret printed by cell is redacted in the journal but live result preserved', async () => {
+    const ctx = await setup();
+    contexts.push(ctx);
+    await ctx.manager.create('p2', { bindings: ['jira:prod'] });
+    // Run via the manager so the SecretScanner gate runs on the journal copy.
+    // AKIAABCDEFGHIJKLMNOP = AKIA + 16 alphanumeric => matches aws_access_key_id.
+    const result = await ctx.manager.runCell(
+      'p2',
+      'console.log("leaked AKIAABCDEFGHIJKLMNOP"); return 1;',
+    );
+    assert.equal(result.value, 1);
+    // Live stdout: redaction is journal-only, so the manager's returned stdout
+    // should still contain the raw secret string.
+    assert.ok(
+      result.stdout.includes('AKIAABCDEFGHIJKLMNOP'),
+      `live stdout should preserve real secret; got: ${JSON.stringify(result.stdout)}`,
+    );
+
+    // Journal: cells.jsonl's stdout field is the journal copy and must be redacted.
+    // NOTE: the cell's `code` field intentionally preserves the original source for
+    // reproducibility — redaction only covers stdout + error.message per Task 14's
+    // contract. The raw secret string therefore can appear in the `code` field;
+    // we explicitly assert against the `stdout` field by parsing the record.
+    const cellsPath = join(ctx.scratchpadsRoot, 'p2', 'cells.jsonl');
+    const cellsLines = readFileSync(cellsPath, 'utf8')
+      .split('\n')
+      .filter((l) => l.includes('"id"'));
+    assert.equal(cellsLines.length, 1, `expected exactly one cell record; got ${cellsLines.length}`);
+    const journalEntry = JSON.parse(cellsLines[0]!) as { stdout: string; code: string };
+    assert.ok(
+      journalEntry.stdout.includes('[REDACTED:aws_access_key_id]'),
+      `journal stdout should contain redaction marker; got: ${journalEntry.stdout}`,
+    );
+    assert.ok(
+      !journalEntry.stdout.includes('AKIAABCDEFGHIJKLMNOP'),
+      `journal stdout should NOT contain raw secret; got: ${journalEntry.stdout}`,
+    );
+
+    // Audit: at least one secret-scanner record should land in the shared audit.
+    const records = await readAuditRecords(ctx.audit);
+    const scan = records.filter((r) => r.producer === 'secret-scanner' && r.action === 'redact');
+    assert.ok(
+      scan.length >= 1,
+      `expected >=1 secret-scanner audit record; got ${scan.length} (records=${JSON.stringify(records)})`,
+    );
+    assert.equal(scan[0]!.detail.kind, 'aws_access_key_id');
+  });
+
+  it('Test 3: vault entry rotation triggers staleness banner on next check', async () => {
+    const ctx = await setup();
+    contexts.push(ctx);
+    await ctx.manager.create('p3', { bindings: ['jira:prod'] });
+    const rt = await ctx.manager.getOrAttach('p3');
+
+    // First cell — establishes a normal pre-rotation baseline.
+    const before = await rt.runCell('return 1;');
+    assert.equal(before.value, 1);
+
+    // No staleness yet — banner should be null.
+    const banner = new StalenessBanner();
+    const preCheck = await banner.check({
+      scratchpadName: 'p3',
+      sessionId: 'sess-1',
+      bindings: ['jira:prod'],
+      spawnTime: rt.spawnTime,
+      lookupLastModified: (ref) => ctx.vault.lookupLastModified(ref),
+    });
+    assert.equal(preCheck, null, `expected no banner before rotation; got: ${preCheck}`);
+
+    // Wait so last_modified_at advances past the recorded spawnTime.
+    await new Promise((r) => setTimeout(r, 25));
+
+    // Rotate the vault entry — bumps last_modified_at.
+    await ctx.vault.set(
+      { engine: 'jira', name: 'prod' },
+      { url: 'NEW', email: 'a@b', token: 'tok' },
+    );
+
+    const postCheck = await banner.check({
+      scratchpadName: 'p3',
+      sessionId: 'sess-1',
+      bindings: ['jira:prod'],
+      spawnTime: rt.spawnTime,
+      lookupLastModified: (ref) => ctx.vault.lookupLastModified(ref),
+    });
+    assert.ok(postCheck, `expected a staleness banner string after rotation; got null`);
+    assert.match(postCheck!, /jira:prod/);
+    assert.match(postCheck!, /\/sp reset/);
+  });
+
+  it('Test 4: workspace vault entry shadows global', async () => {
+    // Dedicated vault root with both global + workspace dirs (does not use setup()).
+    const root = mkdtempSync(join(tmpdir(), 'vault-e2e-shadow-'));
+    try {
+      const audit = new AuditLog({ path: join(root, 'audit.jsonl') });
+      const globalDir = join(root, 'home');
+      const workspaceDir = join(root, 'workspace');
+      const vault = new LocalDataVault({ globalDir, workspaceDir, audit });
+
+      // Write global entry first.
+      await vault.set(
+        { engine: 'jira', name: 'prod' },
+        { url: 'https://global', email: 'g@x', token: 'tok-global' },
+      );
+
+      // Write workspace entry second via forceWorkspace.
+      await vault.set(
+        { engine: 'jira', name: 'prod' },
+        { url: 'https://workspace', email: 'w@x', token: 'tok-workspace' },
+        { forceWorkspace: true },
+      );
+
+      // get() should resolve workspace first.
+      const got = await vault.get({ engine: 'jira', name: 'prod' });
+      assert.equal(got.fields.url, 'https://workspace');
+      assert.equal(got.fields.token, 'tok-workspace');
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+});

package/packages/coworker-scratchpad/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "target": "ES2022",
+    "outDir": "dist",
+    "rootDir": "src",
+    "strict": true,
+    "declaration": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true
+  },
+  "include": ["src"],
+  "exclude": ["src/**/*.test.ts"]
+}

package/packages/coworker-scratchpad/tsconfig.publish.json

@@ -0,0 +1,4 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": { "incremental": false }
+}

package/packages/coworker-types/dist/artifacts.d.ts

@@ -0,0 +1,31 @@
+export type ArtifactKind = 'report' | 'workbook' | 'dataset';
+export interface ArtifactHandle {
+    slug: string;
+    kind: ArtifactKind;
+    base_path: string;
+    created_at: string;
+}
+export interface FileWrite {
+    path: string;
+    content: string | Uint8Array;
+}
+export interface TurnEntry {
+    turn_id: string;
+    timestamp: string;
+    prompt_excerpt: string;
+    files_touched: string[];
+}
+export interface ProvenanceEntry {
+    session_id: string;
+    turns: TurnEntry[];
+}
+export interface ArtifactStore {
+    create(kind: ArtifactKind, name: string): Promise<ArtifactHandle>;
+    update(handle: ArtifactHandle, files: FileWrite[]): Promise<void>;
+    recordTurn(handle: ArtifactHandle, turn: {
+        turn_id: string;
+        prompt: string;
+    }): Promise<void>;
+    get(slug: string): Promise<ArtifactHandle | null>;
+    list(): Promise<ArtifactHandle[]>;
+}

package/packages/coworker-types/dist/artifacts.js

@@ -0,0 +1,2 @@
+// Artifact-store types. See spec §2.3.
+export {};

package/packages/coworker-types/dist/contracts.d.ts

@@ -0,0 +1,32 @@
+import type { DrawerKind } from './memory.js';
+export interface RecordEpisodeArgs {
+    sessionId: string;
+    room: string;
+    kind: DrawerKind;
+    content: string;
+    turnId: string;
+    metadata?: Record<string, unknown>;
+}
+export interface RecordCellArgs {
+    scratchpadName: string;
+    cellId: string;
+    code: string;
+    stdout: string;
+    error: {
+        type: string;
+        message: string;
+    } | null;
+    durationMs: number;
+}
+export type AccSeverity = 'low' | 'medium' | 'high';
+export interface AccEventArgs {
+    sessionId: string;
+    kind: string;
+    detail: string;
+    severity: AccSeverity;
+}
+export interface MemoryRecorder {
+    recordEpisode(args: RecordEpisodeArgs): Promise<void>;
+    recordCell(args: RecordCellArgs): Promise<void>;
+    observeAccEvent(args: AccEventArgs): void;
+}

package/packages/coworker-types/dist/contracts.js

@@ -0,0 +1 @@
+export {};

package/packages/coworker-types/dist/index.d.ts

@@ -0,0 +1,5 @@
+export * from './memory.js';
+export * from './artifacts.js';
+export * from './vault.js';
+export * from './scratchpad.js';
+export * from './contracts.js';

package/packages/coworker-types/dist/index.js

@@ -0,0 +1,5 @@
+export * from './memory.js';
+export * from './artifacts.js';
+export * from './vault.js';
+export * from './scratchpad.js';
+export * from './contracts.js';

package/packages/coworker-types/dist/memory.d.ts

@@ -0,0 +1,61 @@
+export type Wing = string;
+export type Room = string;
+export type DrawerKind = 'turn' | 'paste' | 'file_load' | 'ticket' | 'email' | 'rca' | 'note';
+export interface Drawer {
+    id: string;
+    wing: Wing;
+    room: Room;
+    kind: DrawerKind;
+    content: string;
+    metadata: Record<string, unknown>;
+    created_at: string;
+    parent_id?: string;
+}
+export interface RecallQuery {
+    query: string;
+    wing?: Wing;
+    room?: Room;
+    kind?: DrawerKind | DrawerKind[];
+    days_back?: number;
+    max_results?: number;
+}
+export interface Entity {
+    id: string;
+    type: string;
+    canonical: string;
+    aliases: string[];
+    metadata: Record<string, unknown>;
+    first_seen: string;
+    last_seen: string;
+}
+export interface EntityEdge {
+    subject: string;
+    predicate: string;
+    object: string;
+    valid_from: string;
+    valid_to?: string;
+    metadata?: Record<string, unknown>;
+}
+export interface EntityQuery {
+    entity_type?: string;
+    name?: string;
+    predicate?: string;
+    as_of?: string;
+}
+export interface BackendStatus {
+    backend_id: string;
+    drawer_count: number;
+    entity_count: number;
+    size_bytes: number;
+    last_write_at?: string;
+}
+export interface MemoryBackend {
+    recall(query: RecallQuery): Promise<Drawer[]>;
+    retain(drawer: Omit<Drawer, 'id' | 'created_at'>): Promise<Drawer>;
+    listRooms(wing?: Wing): Promise<Room[]>;
+    listWings(): Promise<Wing[]>;
+    entityQuery(query: EntityQuery): Promise<Entity[]>;
+    entityAssert(edge: EntityEdge): Promise<void>;
+    status(): Promise<BackendStatus>;
+    clear(): Promise<void>;
+}

package/packages/coworker-types/dist/memory.js

@@ -0,0 +1,3 @@
+// Memory-layer types for the otto-memory contract.
+// See spec §2.1 "Layer B structure — Wings, Rooms, Drawers as contract concepts".
+export {};

package/packages/coworker-types/dist/scratchpad.d.ts

@@ -0,0 +1,43 @@
+export type DataKind = 'csv' | 'xlsx' | 'json' | 'parquet' | 'txt' | 'md' | 'rest' | 'mcp-resource' | 'acp-stream';
+export interface DataSourceRef {
+    collector: string;
+    uri: string;
+    kind: DataKind;
+    bytes?: number;
+    modified?: string;
+    metadata: Record<string, unknown>;
+}
+export interface DataSource {
+    ref: DataSourceRef;
+    load(): Promise<Buffer | string | object>;
+    stream?(): AsyncIterable<Buffer>;
+}
+export interface CollectorCapabilities {
+    supports_uris: string[];
+    supports_kinds: DataKind[];
+    supports_streaming: boolean;
+    supports_watching: boolean;
+}
+export interface ListOpts {
+    workspace?: string;
+    prefix?: string;
+    limit?: number;
+}
+export type Unsubscribe = () => void;
+export interface Collector {
+    readonly id: string;
+    readonly kind: 'file' | 'api' | 'protocol';
+    describe(): CollectorCapabilities;
+    list(opts?: ListOpts): AsyncIterable<DataSourceRef>;
+    open(ref: DataSourceRef): Promise<DataSource>;
+    watch?(ref: DataSourceRef, onChange: (ref: DataSourceRef) => void): Unsubscribe;
+}
+export interface CollectorRegistry {
+    register(collector: Collector): void;
+    list(): Collector[];
+    get(id: string): Collector | null;
+    resolve(uri: string): Promise<{
+        collector: Collector;
+        ref: DataSourceRef;
+    } | null>;
+}

package/packages/coworker-types/dist/scratchpad.js

@@ -0,0 +1,2 @@
+// Scratchpad/collector types. See spec §2.4 collector facade.
+export {};

package/packages/coworker-types/dist/vault.d.ts

@@ -0,0 +1,34 @@
+export interface EngineField {
+    name: string;
+    secret: boolean;
+    description?: string;
+    default?: string;
+    name_from?: boolean;
+}
+export interface EngineDef {
+    slug: string;
+    display_name: string;
+    pip: string | null;
+    fields: EngineField[];
+    auth_methods: string[];
+    test_snippet?: string;
+    popular?: boolean;
+    custom?: boolean;
+}
+export interface VaultEntry {
+    engine: string;
+    name: string;
+    values: Record<string, string>;
+    secure_keys: string[];
+    created_at: string;
+    updated_at?: string;
+}
+export interface BoundClient<TClient = unknown> {
+    engine: string;
+    name: string;
+    client: TClient;
+}
+export interface CredentialInjector {
+    injectEnv(processEnv: NodeJS.ProcessEnv, vaultEntries: string[]): NodeJS.ProcessEnv;
+    loadForBinding<TClient = unknown>(serviceName: string): Promise<BoundClient<TClient> | null>;
+}

package/packages/coworker-types/dist/vault.js

@@ -0,0 +1,2 @@
+// Vault types. See spec §2.2.
+export {};

package/packages/coworker-types/package.json

@@ -0,0 +1,24 @@
+{
+  "name": "@otto/coworker-types",
+  "version": "0.0.1",
+  "description": "Shared types and contracts for Otto co-worker packages",
+  "type": "module",
+  "otto": {
+    "linkable": true,
+    "scope": "@otto",
+    "name": "coworker-types"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "build:publish": "tsc -p tsconfig.publish.json"
+  },
+  "files": ["dist"]
+}

package/packages/coworker-types/src/artifacts.test.ts

@@ -0,0 +1,52 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import type {
+  ArtifactKind, ArtifactHandle, FileWrite, ProvenanceEntry, TurnEntry,
+  ArtifactStore,
+} from './artifacts.js';
+
+describe('artifacts types', () => {
+  it('ArtifactKind is the v1 closed set', () => {
+    const kinds: ArtifactKind[] = ['report', 'workbook', 'dataset'];
+    assert.equal(kinds.length, 3);
+  });
+
+  it('ArtifactHandle carries slug + kind + base path', () => {
+    const h: ArtifactHandle = {
+      slug: 'rca-p1-1234',
+      kind: 'report',
+      base_path: '/workspace/.otto/artifacts/rca-p1-1234',
+      created_at: '2026-05-31T10:00:00Z',
+    };
+    assert.equal(h.slug, 'rca-p1-1234');
+  });
+
+  it('FileWrite carries relative path + bytes', () => {
+    const fw: FileWrite = { path: 'report.md', content: 'hello' };
+    assert.equal(fw.path, 'report.md');
+  });
+
+  it('ProvenanceEntry has session + turns array', () => {
+    const p: ProvenanceEntry = {
+      session_id: 'sess_001',
+      turns: [],
+    };
+    assert.equal(p.turns.length, 0);
+  });
+
+  it('TurnEntry has turn_id + prompt + files_touched', () => {
+    const t: TurnEntry = {
+      turn_id: 'turn_001',
+      timestamp: '2026-05-31T10:00:00Z',
+      prompt_excerpt: 'draft the rca',
+      files_touched: ['report.md'],
+    };
+    assert.equal(t.files_touched[0], 'report.md');
+  });
+
+  it('ArtifactStore has create/update/recordTurn signatures', () => {
+    const _check: keyof ArtifactStore = 'create';
+    const _methods: Array<keyof ArtifactStore> = ['create', 'update', 'recordTurn', 'get', 'list'];
+    assert.equal(_methods.length, 5);
+  });
+});