@cohortapp/agent-sdk 2.16.0 → 2.18.4

package/bin/maestro.test.mjs

@@ -1,1574 +0,0 @@
-/**
- * maestro.test.mjs — CLI tests for the bin/maestro.mjs commands.
- *
- * Covers:
- *   • `create` scaffolds the cadence-bus directory tree, the enqueue
- *     script, the consumer, and the cadence handlers under the new agent.
- *   • `upgrade` migrates a legacy-style agent repo: backs up old plists,
- *     bootstraps state/cadence-bus/, regenerates plists.
- *   • `upgrade` preserves agent-specific files (CLAUDE.md, config/,
- *     knowledge/, memory/, state/, logs/, outputs/, .env) untouched.
- *   • `upgrade` is idempotent when run twice on the same repo.
- *   • `doctor` flags legacy plists with actionable remediation.
- *
- * Note: `create` runs `npm install` at the end, which is heavyweight. To
- * keep test runtime reasonable we skip the npm install step by passing
- * an alternate npm shim on PATH that is a no-op. Same trick for git.
- */
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { promises as fsp } from "fs";
-import { writeFileSync, readFileSync, existsSync, mkdirSync, readdirSync } from "node:fs";
-import { tmpdir } from "os";
-import { join, resolve, dirname } from "path";
-import { fileURLToPath } from "node:url";
-import { spawnSync, execFileSync } from "node:child_process";
-import { chmodSync, statSync } from "node:fs";
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const MAESTRO_ROOT = resolve(__dirname, "..");
-const MAESTRO_CLI = resolve(__dirname, "maestro.mjs");
-
-// Pure predicates exported from the CLI module (importing does not dispatch).
-const { evaluateCostTripwire, summariseLedgerRows, evaluateStaleness } = await import(MAESTRO_CLI);
-
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
-async function tmpRoot(prefix = "maestro-cli-test") {
-  const path = join(
-    tmpdir(),
-    `${prefix}-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`
-  );
-  await fsp.mkdir(path, { recursive: true });
-  return path;
-}
-
-async function rmRoot(path) {
-  try { await fsp.rm(path, { recursive: true, force: true }); } catch { /* */ }
-}
-
-// ---------------------------------------------------------------------------
-// The machine the CLI must NEVER touch from a test: the developer's real
-// ~/Library/LaunchAgents, ~/.claude and global npm. `upgrade` now reconciles
-// all three (WP-M6), so every CLI run gets a throwaway HOME, a `launchctl`
-// stub that treats "installed" as "loaded" (in `list` AND in `print gui/<uid>`,
-// which is what the reconcile reads), an `npm` stub, a `claude` stub (logs and
-// exits 1 → global-setup's JSON fallback) and MAESTRO_SKIP_GLOBAL_INSTALL=1.
-// The claude stub is reached through CLAUDE_BIN, not PATH: lib/claude-bin.mjs
-// resolves ~/.local/bin, /opt/homebrew/bin, /usr/local/bin BEFORE PATH, so a
-// PATH-only stub is silently bypassed by the developer's real `claude`.
-// ---------------------------------------------------------------------------
-
-const TEST_SHIM = await tmpRoot("maestro-shim-global");
-{
-  const stub = async (name, body) => { writeFileSync(join(TEST_SHIM, name), `#!/bin/bash\n${body}\n`); await fsp.chmod(join(TEST_SHIM, name), 0o755); };
-  await stub("launchctl", `echo "launchctl $*" >> "$HOME/launchctl.log"
-if [ "$1" = "list" ]; then
-  if [ -n "\${2:-}" ]; then [ -f "$HOME/Library/LaunchAgents/$2.plist" ] && exit 0 || exit 113; fi
-  printf 'PID\tStatus\tLabel\n'
-  for f in "$HOME"/Library/LaunchAgents/*.plist; do [ -f "$f" ] && printf -- '-\t0\t%s\n' "$(basename "$f" .plist)"; done
-  exit 0
-fi
-if [ "$1" = "print" ]; then
-  case "$2" in
-    gui/*/*) l="\${2##*/}"; if [ -f "$HOME/Library/LaunchAgents/$l.plist" ]; then echo "$l = {}"; exit 0; fi; echo "Could not find service \"$l\" in domain for user gui: 501" >&2; exit 113 ;;
-    gui/*) printf '%s = {\n\tservices = {\n' "$2"; for f in "$HOME"/Library/LaunchAgents/*.plist; do [ -f "$f" ] && printf '\t\t0\t0\t%s\n' "$(basename "$f" .plist)"; done; printf '\t}\n}\n'; exit 0 ;;
-  esac
-fi
-exit 0`);
-  await stub("npm", `echo "npm $*" >> "$HOME/npm.log"
-case "$1" in
-  ls) echo '{}'; exit 1 ;;
-  view) exit 1 ;;
-  root) echo "$HOME/npm-global/lib/node_modules"; exit 0 ;;
-esac
-exit 0`);
-  await stub("claude", `echo "claude $*" >> "$HOME/claude.log"
-exit 1`);
-}
-
-/** A throwaway HOME for one CLI run (or a shared one when the test does not care). */
-async function freshHome() {
-  const home = await tmpRoot("maestro-home");
-  mkdirSync(join(home, "Library", "LaunchAgents"), { recursive: true });
-  return home;
-}
-const TEST_HOME = await freshHome();
-
-function baseEnv(extra = {}) {
-  return {
-    ...process.env,
-    HOME: TEST_HOME,
-    PATH: `${TEST_SHIM}:${process.env.PATH || ""}`,
-    CLAUDE_BIN: join(TEST_SHIM, "claude"),
-    MAESTRO_SKIP_GLOBAL_INSTALL: "1",
-    ...extra,
-  };
-}
-
-/**
- * Build a PATH that shadows `npm` (and optionally `git`) with no-op shims
- * so `create` doesn't actually try to install dependencies. Returns the new
- * env block plus the shim dir (for cleanup).
- */
-async function withShim() {
-  const dir = await tmpRoot("maestro-shim");
-  const npm = join(dir, "npm");
-  writeFileSync(npm, "#!/bin/bash\necho '[shim npm]' \"$@\" >&2\nexit 0\n");
-  await fsp.chmod(npm, 0o755);
-  // Keep real git (we want git init to actually init).
-  const env = baseEnv({ PATH: `${dir}:${TEST_SHIM}:${process.env.PATH || ""}` });
-  return { env, dir };
-}
-
-function runCli(args, cwd, env) {
-  return spawnSync(process.execPath, [MAESTRO_CLI, ...args], {
-    cwd: cwd || process.cwd(),
-    env: env || baseEnv(),
-    encoding: "utf-8",
-  });
-}
-
-/** Like runCli but pipes `input` to the child's stdin (for `secrets rotate`). */
-function runCliStdin(args, cwd, input, env) {
-  return spawnSync(process.execPath, [MAESTRO_CLI, ...args], {
-    cwd: cwd || process.cwd(),
-    env: env || baseEnv(),
-    input,
-    encoding: "utf-8",
-  });
-}
-
-// ---------------------------------------------------------------------------
-// create
-// ---------------------------------------------------------------------------
-
-test("create scaffolds cadence-bus dirs and enqueue/consumer/handlers", async () => {
-  const parent = await tmpRoot("maestro-create");
-  const { env, dir: shim } = await withShim();
-  try {
-    const r = runCli(["create", "test-agent"], parent, env);
-    assert.equal(r.status, 0, r.stderr || r.stdout);
-    const agent = join(parent, "test-agent");
-
-    // Cadence bus directory tree
-    for (const d of [
-      "state/cadence-bus",
-      "state/cadence-bus/inbox",
-      "state/cadence-bus/claimed",
-      "state/cadence-bus/processed",
-      "state/cadence-bus/failed",
-      "state/cadence-bus/dlq",
-      "logs/cadence-bus",
-    ]) {
-      assert.ok(existsSync(join(agent, d)), `missing ${d}`);
-    }
-
-    // New framework files copied into the agent repo.
-    for (const f of [
-      "lib/cadence-bus.mjs",
-      "scripts/cadence/enqueue-cadence-tick.mjs",
-      "scripts/cadence/launchd-cadence-wrapper.sh",
-      "scripts/cadence/cadence-status.mjs",
-      "scripts/daemon/cadence-consumer.mjs",
-      "scripts/daemon/cadence-handlers.mjs",
-    ]) {
-      assert.ok(existsSync(join(agent, f)), `missing ${f}`);
-    }
-
-    // Agent package.json has the cadence:* scripts.
-    const pkg = JSON.parse(readFileSync(join(agent, "package.json"), "utf-8"));
-    assert.ok(pkg.scripts["cadence:enqueue"]);
-    assert.ok(pkg.scripts["cadence:consume"]);
-    assert.ok(pkg.scripts["cadence:status"]);
-  } finally {
-    await rmRoot(parent);
-    await rmRoot(shim);
-  }
-});
-
-// ---------------------------------------------------------------------------
-// upgrade — migration
-// ---------------------------------------------------------------------------
-
-async function makeLegacyAgent() {
-  const root = await tmpRoot("maestro-legacy");
-  // Minimal identity so `upgrade` recognises this as a Maestro repo.
-  mkdirSync(join(root, "config"), { recursive: true });
-  writeFileSync(join(root, "CLAUDE.md"), "# legacy agent\n");
-  writeFileSync(join(root, "config/agent.ts"), "export const AGENT = { firstName: 'legacy' };\n");
-  writeFileSync(join(root, "package.json"), '{"name":"legacy-agent","version":"1.0.0"}\n');
-  // Personal/local agent state that must NOT be touched.
-  mkdirSync(join(root, "knowledge/decisions"), { recursive: true });
-  mkdirSync(join(root, "memory/interactions"), { recursive: true });
-  mkdirSync(join(root, "state/queues"), { recursive: true });
-  mkdirSync(join(root, "outputs"), { recursive: true });
-  mkdirSync(join(root, "logs"), { recursive: true });
-  writeFileSync(join(root, "knowledge/decisions/local-decision.md"), "# do not touch");
-  writeFileSync(join(root, "memory/interactions/local-memory.yaml"), "# do not touch");
-  writeFileSync(join(root, "state/queues/action-stack.yaml"), "items:\n  - id: P1\n    title: local item\n");
-  writeFileSync(join(root, "outputs/local-output.md"), "# my draft");
-  writeFileSync(join(root, "logs/local.log"), "audit data");
-  writeFileSync(join(root, ".env"), "ANTHROPIC_API_KEY=sk-x\n");
-
-  // Legacy plist that calls run-trigger.sh directly.
-  mkdirSync(join(root, "scripts/local-triggers/plists"), { recursive: true });
-  writeFileSync(
-    join(root, "scripts/local-triggers/plists/ai.adaptic.legacy-inbox-processor.plist"),
-    `<?xml version="1.0"?><plist><dict>
-<key>ProgramArguments</key><array>
-  <string>/foo/scripts/local-triggers/run-trigger.sh</string>
-  <string>inbox-processor</string>
-</array></dict></plist>`
-  );
-
-  // Init git so smart-merge sees the working tree as clean.
-  execFileSync("git", ["init", "-q"], { cwd: root });
-  execFileSync("git", ["add", "-A"], { cwd: root });
-  execFileSync(
-    "git",
-    ["-c", "user.email=test@test", "-c", "user.name=test", "commit", "-q", "-m", "init"],
-    { cwd: root },
-  );
-  return root;
-}
-
-test("upgrade backs up legacy plists and regenerates with cadence-bus marker", async () => {
-  const root = await makeLegacyAgent();
-  try {
-    const r = runCli(["upgrade"], root);
-    assert.equal(r.status, 0, r.stderr);
-    // Backup directory exists.
-    const backupRoot = join(root, ".maestro/backup/plists");
-    assert.ok(existsSync(backupRoot), "backup root must exist");
-    const stamps = readdirSync(backupRoot);
-    assert.ok(stamps.length >= 1);
-    const backedUp = readdirSync(join(backupRoot, stamps[0]));
-    assert.ok(backedUp.some((n) => /legacy-inbox-processor\.plist$/.test(n)));
-
-    // After regeneration, plists carry the cadence-bus marker and none
-    // reference run-trigger.sh.
-    const plistDir = join(root, "scripts/local-triggers/plists");
-    const plists = readdirSync(plistDir).filter((n) => n.endsWith(".plist"));
-    assert.ok(plists.length >= 1);
-    let legacy = 0;
-    let modern = 0;
-    for (const name of plists) {
-      const body = readFileSync(join(plistDir, name), "utf-8");
-      if (body.includes("run-trigger.sh")) legacy++;
-      if (body.includes("maestro-plist-arch: cadence-bus")) modern++;
-    }
-    assert.equal(legacy, 0, "no legacy plists should remain post-upgrade");
-    assert.equal(modern, plists.length, "every plist must carry the cadence-bus marker");
-  } finally { await rmRoot(root); }
-});
-
-test("upgrade preserves agent-specific files untouched", async () => {
-  const root = await makeLegacyAgent();
-  try {
-    const before = {
-      claudemd: readFileSync(join(root, "CLAUDE.md"), "utf-8"),
-      agentTs: readFileSync(join(root, "config/agent.ts"), "utf-8"),
-      decision: readFileSync(join(root, "knowledge/decisions/local-decision.md"), "utf-8"),
-      memory: readFileSync(join(root, "memory/interactions/local-memory.yaml"), "utf-8"),
-      queue: readFileSync(join(root, "state/queues/action-stack.yaml"), "utf-8"),
-      output: readFileSync(join(root, "outputs/local-output.md"), "utf-8"),
-      log: readFileSync(join(root, "logs/local.log"), "utf-8"),
-      env: readFileSync(join(root, ".env"), "utf-8"),
-    };
-    const r = runCli(["upgrade"], root);
-    assert.equal(r.status, 0, r.stderr);
-    for (const [k, v] of Object.entries(before)) {
-      const path = ({
-        claudemd: "CLAUDE.md",
-        agentTs: "config/agent.ts",
-        decision: "knowledge/decisions/local-decision.md",
-        memory: "memory/interactions/local-memory.yaml",
-        queue: "state/queues/action-stack.yaml",
-        output: "outputs/local-output.md",
-        log: "logs/local.log",
-        env: ".env",
-      })[k];
-      assert.equal(
-        readFileSync(join(root, path), "utf-8"),
-        v,
-        `${path} was modified by upgrade`,
-      );
-    }
-  } finally { await rmRoot(root); }
-});
-
-test("upgrade is idempotent (second run is a clean no-op for plists)", async () => {
-  const root = await makeLegacyAgent();
-  try {
-    const first = runCli(["upgrade"], root);
-    assert.equal(first.status, 0);
-    // Snapshot the regenerated plist contents.
-    const plistDir = join(root, "scripts/local-triggers/plists");
-    const before = {};
-    for (const name of readdirSync(plistDir)) {
-      before[name] = readFileSync(join(plistDir, name), "utf-8");
-    }
-    const second = runCli(["upgrade"], root);
-    assert.equal(second.status, 0);
-    // The second run should NOT introduce any new backup directory beyond
-    // what the first run created, because there are no legacy plists left.
-    const backups = readdirSync(join(root, ".maestro/backup/plists"));
-    assert.equal(backups.length, 1, "no new backup directory on idempotent run");
-    // Plist contents byte-identical.
-    for (const [name, body] of Object.entries(before)) {
-      assert.equal(readFileSync(join(plistDir, name), "utf-8"), body, `${name} changed`);
-    }
-  } finally { await rmRoot(root); }
-});
-
-test("upgrade --dry-run reports legacy without modifying anything", async () => {
-  const root = await makeLegacyAgent();
-  try {
-    // Snapshot a known sentinel file.
-    const sentinel = readFileSync(join(root, "scripts/local-triggers/plists/ai.adaptic.legacy-inbox-processor.plist"), "utf-8");
-    const r = runCli(["upgrade", "--dry-run"], root);
-    assert.equal(r.status, 0);
-    assert.match(r.stdout, /still call run-trigger\.sh/);
-    // Sentinel must not have changed.
-    assert.equal(
-      readFileSync(join(root, "scripts/local-triggers/plists/ai.adaptic.legacy-inbox-processor.plist"), "utf-8"),
-      sentinel,
-    );
-    // No backup directory created.
-    assert.ok(!existsSync(join(root, ".maestro/backup")), "dry-run must not create backups");
-  } finally { await rmRoot(root); }
-});
-
-// ---------------------------------------------------------------------------
-// doctor
-// ---------------------------------------------------------------------------
-
-test("doctor flags legacy plists with actionable remediation", async () => {
-  const root = await makeLegacyAgent();
-  try {
-    const r = runCli(["doctor"], root);
-    // doctor exits 1 when issues are found; that's expected here.
-    assert.ok(r.status >= 0);
-    const combined = (r.stdout || "") + (r.stderr || "");
-    assert.match(combined, /run-trigger\.sh/);
-    assert.match(combined, /maestro upgrade/);
-  } finally { await rmRoot(root); }
-});
-
-test("doctor recognises new cadence-bus architecture after upgrade", async () => {
-  const root = await makeLegacyAgent();
-  try {
-    runCli(["upgrade"], root);
-    const r = runCli(["doctor"], root);
-    const combined = (r.stdout || "") + (r.stderr || "");
-    assert.match(combined, /cadence-bus architecture/);
-    // 'plist(s) still call run-trigger.sh' must NOT appear.
-    assert.ok(!combined.includes("plist(s) still call run-trigger.sh"));
-  } finally { await rmRoot(root); }
-});
-
-// ---------------------------------------------------------------------------
-// setup (WS1 wizard) — CLI surface
-// ---------------------------------------------------------------------------
-
-test("setup --help runs in a non-agent dir without throwing (exit 0)", async () => {
-  const dir = await tmpRoot("maestro-setup-help");
-  try {
-    const r = runCli(["setup", "--help"], dir);
-    assert.equal(r.status, 0, r.stderr);
-    assert.match(r.stdout, /maestro setup/);
-    assert.match(r.stdout, /--headless/);
-  } finally { await rmRoot(dir); }
-});
-
-test("setup --status in a non-agent dir prints a graceful message (exit 0)", async () => {
-  const dir = await tmpRoot("maestro-setup-status");
-  try {
-    const r = runCli(["setup", "--status"], dir);
-    assert.equal(r.status, 0, r.stderr);
-    const out = (r.stdout || "") + (r.stderr || "");
-    assert.match(out, /Not a Maestro agent directory/);
-  } finally { await rmRoot(dir); }
-});
-
-test("setup --status in an agent dir lists section detect() statuses", async () => {
-  const dir = await tmpRoot("maestro-setup-agent");
-  try {
-    mkdirSync(join(dir, "config"), { recursive: true });
-    // Minimal SoT so the agent-repo guard passes + sections can detect.
-    writeFileSync(join(dir, "config/agent.json"), JSON.stringify({
-      firstName: "UNCONFIGURED", lastName: "AGENT", title: "Unconfigured Role", email: "",
-      function: "executive-operator", altitude: "c-suite",
-    }, null, 2));
-    const r = runCli(["setup", "--status"], dir);
-    assert.equal(r.status, 0, r.stderr);
-    const out = (r.stdout || "") + (r.stderr || "");
-    assert.match(out, /identity/);
-    assert.match(out, /operating-model/);
-    assert.match(out, /verify/);
-  } finally { await rmRoot(dir); }
-});
-
-// ---------------------------------------------------------------------------
-// doctor cost-telemetry tripwire — pure predicate (observability F2)
-// ---------------------------------------------------------------------------
-
-/** A measured session row in the shape the tracker now writes. */
-function measuredRow(over = {}) {
-  return {
-    ts: new Date().toISOString(), cadence: "inbox", source: "dispatcher",
-    model: "sonnet", input_tokens: 16, output_tokens: 5000,
-    cache_read_input_tokens: 553181, measurement: "measured",
-    estimated_usd: 0.241, total_cost_usd: 0.533412, ...over,
-  };
-}
-/** A session that ran but whose usage could not be read. */
-function unmeasuredRow(over = {}) {
-  return {
-    ts: new Date().toISOString(), cadence: "inbox", source: "dispatcher",
-    model: "sonnet", input_tokens: null, output_tokens: null,
-    measurement: "unknown", unmeasured_reason: "no-usage-field",
-    estimated_usd: null, total_cost_usd: null, ...over,
-  };
-}
-/** A message send: no model ran, so $0 is a fact rather than a gap. */
-function nonLlmRow(over = {}) {
-  return {
-    ts: new Date().toISOString(), source: "messaging", task_class: "messaging.send",
-    model: null, input_tokens: 0, output_tokens: 0, estimated_usd: 0, ...over,
-  };
-}
-
-test("summariseLedgerRows bills the authoritative cost, not the cache-blind estimate", () => {
-  const s = summariseLedgerRows([measuredRow(), measuredRow({ total_cost_usd: 1 })]);
-  assert.equal(s.rowCount, 2);
-  assert.equal(s.totalUsd, 1.533412, "total_cost_usd wins over estimated_usd");
-});
-
-test("summariseLedgerRows counts sessions, not attribution rows; tolerates junk", () => {
-  const s = summariseLedgerRows([
-    measuredRow(), unmeasuredRow(), nonLlmRow(), null, "garbage",
-  ]);
-  assert.equal(s.rowCount, 2, "1 measured + 1 unmeasured; the send is not a session");
-  assert.equal(s.measured, 1);
-  assert.equal(s.unmeasured, 1);
-  assert.equal(s.nonLlmRows, 1);
-});
-
-test("summariseLedgerRows on empty input is zeroed", () => {
-  assert.equal(summariseLedgerRows([]).rowCount, 0);
-  assert.equal(summariseLedgerRows([]).totalUsd, 0);
-  assert.equal(summariseLedgerRows(undefined).rowCount, 0);
-});
-
-test("evaluateCostTripwire: unmeasured rows → RED (the 0-vs-unknown distinction)", () => {
-  // The defect doctor exists to catch: a session ran and nobody priced it.
-  const t = evaluateCostTripwire({ rows: [measuredRow(), unmeasuredRow()], sessionCount: 2 });
-  assert.equal(t.red, true);
-  assert.equal(t.unmeasured, 1);
-  assert.match(t.reason, /NO token counts/);
-  assert.match(t.fix, /unmeasured_reason/);
-});
-
-test("evaluateCostTripwire: a genuine zero-token session is NOT unmeasured", () => {
-  // A model ran and emitted nothing. That is a measurement; it must stay GREEN
-  // as long as the day bills above $0 — otherwise doctor cries wolf.
-  const t = evaluateCostTripwire({
-    rows: [measuredRow(), measuredRow({ input_tokens: 40, output_tokens: 0, total_cost_usd: 0 })],
-    sessionCount: 2,
-  });
-  assert.equal(t.red, false);
-  assert.equal(t.unmeasured, 0);
-});
-
-test("evaluateCostTripwire: sessions logged but no ledger rows → RED (unrecorded)", () => {
-  const t = evaluateCostTripwire({ rows: [], sessionCount: 3 });
-  assert.equal(t.red, true);
-  assert.equal(t.unrecorded, 3);
-  assert.match(t.reason, /only 0 dispatcher row\(s\) reached the cost ledger/);
-});
-
-test("evaluateCostTripwire: rows from ANOTHER writer do not mask an unrecorded dispatcher", () => {
-  // The population bug this replaced. `sessionCount` comes from the dispatcher's
-  // own session log; `rowCount` counted rows from every writer. With the
-  // responder now writing rows too, a dispatcher that had stopped recording
-  // entirely read as unrecorded:0 / GREEN — 35 real sessions unpriced, and the
-  // one detector meant to catch exactly that said nothing.
-  const responderRows = Array.from({ length: 40 }, () => measuredRow({ source: "responder" }));
-  const t = evaluateCostTripwire({ rows: responderRows, sessionCount: 35 });
-  assert.equal(t.red, true, "35 dispatcher sessions with 0 dispatcher rows is RED");
-  assert.equal(t.unrecorded, 35);
-  assert.equal(t.sourceRowCount, 0);
-  assert.match(t.reason, /dispatcher logged 35/);
-});
-
-test("evaluateCostTripwire: measured rows billing $0 → RED (pricing broken)", () => {
-  const t = evaluateCostTripwire({
-    rows: [measuredRow({ total_cost_usd: 0, estimated_usd: 0 })],
-    sessionCount: 1,
-  });
-  assert.equal(t.red, true);
-  assert.match(t.reason, /bill to \$0/);
-  assert.match(t.fix, /--cache-read-tokens/);
-});
-
-test("evaluateCostTripwire: no sessions and no rows → GREEN (nothing to measure)", () => {
-  const t = evaluateCostTripwire({ rows: [], sessionCount: 0 });
-  assert.equal(t.red, false);
-  assert.match(t.reason, /nothing to measure/i);
-});
-
-test("evaluateCostTripwire: attribution-only day is quiet, not blind", () => {
-  // Regression guard for the false alarm this replaced: 41 message-send rows on
-  // 2026-08-11 would have armed the old tripwire all by themselves.
-  const t = evaluateCostTripwire({ rows: [nonLlmRow(), nonLlmRow()], sessionCount: 0 });
-  assert.equal(t.red, false);
-  assert.match(t.reason, /nothing to measure/i);
-});
-
-test("evaluateCostTripwire: spend > 0 with every session measured → GREEN", () => {
-  const t = evaluateCostTripwire({ rows: [measuredRow()], sessionCount: 1 });
-  assert.equal(t.red, false);
-  assert.equal(t.totalUsd, 0.533412);
-  assert.match(t.reason, /live/i);
-});
-
-test("evaluateCostTripwire: defaults (no args) are GREEN, not a false alarm", () => {
-  const t = evaluateCostTripwire();
-  assert.equal(t.red, false);
-  assert.equal(t.status, "green");
-});
-
-// ---------------------------------------------------------------------------
-// doctor cost-telemetry tripwire — end-to-end against a real ledger file
-// ---------------------------------------------------------------------------
-
-/**
- * Minimal agent repo that doctor can run against without exploding before our
- * checks. doctor exits 1 on any issue (a bare repo has many), so these tests
- * assert on the specific lines our checks emit rather than the exit code.
- */
-async function makeBareAgent() {
-  const root = await tmpRoot("maestro-doctor");
-  mkdirSync(join(root, "config"), { recursive: true });
-  writeFileSync(join(root, "config/agent.json"), JSON.stringify({
-    firstName: "test", function: "executive-operator", altitude: "c-suite",
-  }, null, 2));
-  writeFileSync(join(root, "CLAUDE.md"), "# test agent\n");
-  return root;
-}
-
-function utcDate() { return new Date().toISOString().slice(0, 10); }
-
-test("doctor RED when a session ran with no token counts recorded", async () => {
-  const root = await makeBareAgent();
-  try {
-    mkdirSync(join(root, "state/cost-tracking"), { recursive: true });
-    const ledger = join(root, "state/cost-tracking", `${utcDate()}.jsonl`);
-    writeFileSync(ledger,
-      JSON.stringify(unmeasuredRow({ unmeasured_reason: "no-usage-field" })) + "\n" +
-      JSON.stringify(unmeasuredRow({ cadence: "backlog", unmeasured_reason: "empty-stdout" })) + "\n"
-    );
-    const r = runCli(["doctor"], root);
-    const out = (r.stdout || "") + (r.stderr || "");
-    assert.match(out, /Cost telemetry BLIND/);
-    assert.match(out, /NO token counts/);
-  } finally { await rmRoot(root); }
-});
-
-test("doctor GREEN when today's ledger records real spend", async () => {
-  const root = await makeBareAgent();
-  try {
-    mkdirSync(join(root, "state/cost-tracking"), { recursive: true });
-    const ledger = join(root, "state/cost-tracking", `${utcDate()}.jsonl`);
-    writeFileSync(ledger, JSON.stringify(measuredRow()) + "\n");
-    const r = runCli(["doctor"], root);
-    const out = (r.stdout || "") + (r.stderr || "");
-    assert.match(out, /Cost telemetry: spend telemetry live/);
-    assert.ok(!out.includes("Cost telemetry BLIND"), "must not flag blind when spend>0");
-  } finally { await rmRoot(root); }
-});
-
-test("doctor GREEN (nothing to measure) when no ledger exists today", async () => {
-  const root = await makeBareAgent();
-  try {
-    const r = runCli(["doctor"], root);
-    const out = (r.stdout || "") + (r.stderr || "");
-    assert.match(out, /nothing to measure/);
-  } finally { await rmRoot(root); }
-});
-
-test("doctor does NOT cry wolf on an empty ledger while the daemon is live", async () => {
-  // The regression this replaced: doctor keyed "sessions ran" off a fresh
-  // heartbeat, so every UTC day went RED between midnight and the first session
-  // and printed a fix that had already shipped.
-  const root = await makeBareAgent();
-  try {
-    mkdirSync(join(root, "state/cadence-bus"), { recursive: true });
-    writeFileSync(join(root, "state/cadence-bus/health.json"),
-      JSON.stringify({ ts: new Date().toISOString() }));
-    const r = runCli(["doctor"], root);
-    const out = (r.stdout || "") + (r.stderr || "");
-    assert.ok(!out.includes("Cost telemetry BLIND"), "a live daemon with no sessions yet is not blind");
-    assert.match(out, /nothing to measure/);
-  } finally { await rmRoot(root); }
-});
-
-// ---------------------------------------------------------------------------
-// doctor .env permission check (setup-onboarding W4)
-// ---------------------------------------------------------------------------
-
-test("doctor flags a group/world-readable .env with the chmod fix", { skip: typeof process.getuid !== "function" }, async () => {
-  const root = await makeBareAgent();
-  try {
-    const envPath = join(root, ".env");
-    writeFileSync(envPath, "ANTHROPIC_API_KEY=sk-secret\n");
-    chmodSync(envPath, 0o644);
-    const r = runCli(["doctor"], root);
-    const out = (r.stdout || "") + (r.stderr || "");
-    assert.match(out, /\.env is mode 644/);
-    assert.match(out, /chmod 600 \.env/);
-  } finally { await rmRoot(root); }
-});
-
-test("doctor passes a chmod-600 .env", { skip: typeof process.getuid !== "function" }, async () => {
-  const root = await makeBareAgent();
-  try {
-    const envPath = join(root, ".env");
-    writeFileSync(envPath, "ANTHROPIC_API_KEY=sk-secret\n");
-    chmodSync(envPath, 0o600);
-    const r = runCli(["doctor"], root);
-    const out = (r.stdout || "") + (r.stderr || "");
-    assert.match(out, /\.env permissions are owner-only/);
-    assert.ok(!out.includes(".env is mode"), "must not flag a 600 .env");
-  } finally { await rmRoot(root); }
-});
-
-// ---------------------------------------------------------------------------
-// evaluateStaleness (pure) — the router data-file staleness ladder (graft #18)
-// ---------------------------------------------------------------------------
-
-test("evaluateStaleness: fresh data is green", () => {
-  const now = Date.UTC(2026, 5, 11);
-  const v = evaluateStaleness({ fetched: "2026-06-10", now });
-  assert.equal(v.status, "green");
-  assert.equal(v.ageDays, 1);
-});
-
-test("evaluateStaleness: >7d but <30d is a WARN", () => {
-  const now = Date.UTC(2026, 5, 30);
-  const v = evaluateStaleness({ fetched: "2026-06-10", now });
-  assert.equal(v.status, "warn");
-  assert.ok(v.ageDays >= 7 && v.ageDays < 30);
-});
-
-test("evaluateStaleness: >=30d is a FAIL", () => {
-  const now = Date.UTC(2026, 6, 15);
-  const v = evaluateStaleness({ fetched: "2026-06-10", now });
-  assert.equal(v.status, "fail");
-  assert.ok(v.ageDays >= 30);
-});
-
-test("evaluateStaleness: a stale volatile catalog escalates the FAIL reason", () => {
-  const now = Date.UTC(2026, 6, 15);
-  const v = evaluateStaleness({ fetched: "2026-06-10", now, hasVolatile: true, label: "catalog" });
-  assert.equal(v.status, "fail");
-  assert.match(v.reason, /volatile/);
-});
-
-test("evaluateStaleness: a missing fetch date is a WARN (provenance unknown)", () => {
-  const v = evaluateStaleness({ fetched: null });
-  assert.equal(v.status, "warn");
-  assert.match(v.reason, /no fetch date/);
-});
-
-// ---------------------------------------------------------------------------
-// router CLI — `maestro router why` / `maestro router validate`
-// ---------------------------------------------------------------------------
-
-const V2_ROUTER_YAML = `
-schema_version: 2
-aliases:
-  frontier: anthropic/claude-opus-4-8
-  default: anthropic/claude-sonnet-4-6
-  fast: anthropic/claude-haiku-4-5
-  cheap: deepseek/deepseek-v4-flash
-defaults:
-  data_class: sensitive
-backends:
-  anthropic: { allowed_data_classes: [public, internal, sensitive] }
-  deepseek: { allowed_data_classes: [public] }
-routing_policy:
-  - match: { task_class: classify.inbox }
-    harness: direct
-    chain: [fast, cheap, rules]
-    needs_tool_use: false
-  - default: true
-    chain: [default, fast]
-fallback_to_anthropic: true
-`;
-
-async function makeV2RouterAgent() {
-  const root = await makeBareAgent();
-  writeFileSync(join(root, "config/model-routing.yaml"), V2_ROUTER_YAML);
-  return root;
-}
-
-test("router why: prints chosen + explain + chain for a session request", async () => {
-  const root = await makeV2RouterAgent();
-  try {
-    const r = runCli(["router", "why", "session.responder"], root);
-    const out = (r.stdout || "") + (r.stderr || "");
-    assert.match(out, /chosen/);
-    assert.match(out, /anthropic\/claude-sonnet-4-6/);
-    assert.match(out, /explain/);
-    assert.match(out, /chain/);
-  } finally { await rmRoot(root); }
-});
-
-test("router why: accepts inline request JSON and reports tried[] skips", async () => {
-  const root = await makeV2RouterAgent();
-  try {
-    const r = runCli(
-      ["router", "why", '{"task_class":"classify.inbox","data_class":"public"}'],
-      root
-    );
-    const out = (r.stdout || "") + (r.stderr || "");
-    // No keys present → cheap deepseek + anthropic haiku-direct are unreachable;
-    // the deterministic "rules" fallback wins and the skips are listed.
-    assert.match(out, /tried/);
-    assert.match(out, /missing_credential/);
-  } finally { await rmRoot(root); }
-});
-
-test("router validate: a clean v2 config validates (exit 0)", async () => {
-  const root = await makeV2RouterAgent();
-  try {
-    const r = runCli(["router", "validate"], root);
-    const out = (r.stdout || "") + (r.stderr || "");
-    assert.equal(r.status, 0, out);
-    assert.match(out, /valid/);
-  } finally { await rmRoot(root); }
-});
-
-test("router validate: an unknown match key fails validation (exit 1)", async () => {
-  const root = await makeBareAgent();
-  try {
-    writeFileSync(
-      join(root, "config/model-routing.yaml"),
-      "schema_version: 2\naliases:\n  default: anthropic/claude-sonnet-4-6\nrouting_policy:\n  - match: { taks_class: x }\n    chain: [default]\n  - default: true\n    chain: [default]\n"
-    );
-    const r = runCli(["router", "validate"], root);
-    const out = (r.stdout || "") + (r.stderr || "");
-    assert.equal(r.status, 1, out);
-    assert.match(out, /unknown match key/);
-  } finally { await rmRoot(root); }
-});
-
-test("router help: bare `router` prints usage", async () => {
-  const root = await makeBareAgent();
-  try {
-    const r = runCli(["router"], root);
-    const out = (r.stdout || "") + (r.stderr || "");
-    assert.match(out, /router why/);
-    assert.match(out, /router validate/);
-  } finally { await rmRoot(root); }
-});
-
-// ---------------------------------------------------------------------------
-// audit — security-posture audit + attestation (G15)
-// ---------------------------------------------------------------------------
-
-const GOOD_AUDIT_SETTINGS = JSON.stringify({
-  hooks: {
-    PreToolUse: [
-      { matcher: "mcp__claude_ai_Slack__slack_send_message", hooks: [{ type: "command", command: "./scripts/hooks/block-mcp-slack-send.sh" }] },
-      { matcher: "mcp__claude_ai_Gmail__gmail_create_draft", hooks: [{ type: "command", command: "./scripts/hooks/pre-send-audit.sh gmail" }] },
-    ],
-    PostToolUse: [{ matcher: "", hooks: [{ type: "command", command: "./scripts/hooks/post-action-log.sh" }] }],
-    Stop: [{ matcher: "", hooks: [{ type: "command", command: "./scripts/hooks/session-end-log.sh" }] }],
-  },
-}, null, 2);
-
-/** A conformant agent repo (every audit check passes when scoped-perms is set). */
-async function makeConformantAgent() {
-  const root = await makeBareAgent();
-  mkdirSync(join(root, ".claude"), { recursive: true });
-  mkdirSync(join(root, "scripts/hooks"), { recursive: true });
-  mkdirSync(join(root, ".maestro"), { recursive: true });
-  mkdirSync(join(root, "policies"), { recursive: true });
-  // config/agent.json already written by makeBareAgent.
-  const envPath = join(root, ".env");
-  writeFileSync(envPath, "ANTHROPIC_API_KEY=sk-test\nMAESTRO_SCOPED_PERMISSIONS=1\n");
-  chmodSync(envPath, 0o600);
-  writeFileSync(join(root, ".claude/settings.json"), GOOD_AUDIT_SETTINGS);
-  for (const s of ["block-mcp-slack-send.sh", "pre-send-audit.sh", "post-action-log.sh", "session-end-log.sh"]) {
-    writeFileSync(join(root, "scripts/hooks", s), "#!/bin/bash\nexit 0\n");
-  }
-  writeFileSync(join(root, ".maestro/backup-config.yaml"), "enabled: true\nprovider: s3\nbucket: b\n");
-  writeFileSync(join(root, "config/validation-rules.yaml"), "ai_disclosure:\n  enabled: true\n  severity: block\n");
-  writeFileSync(join(root, "policies/action-classification.yaml"), "classes: []\n");
-  return root;
-}
-
-test("audit: a conformant agent exits 0 and reports posture conformant", async () => {
-  const root = await makeConformantAgent();
-  try {
-    const r = runCli(["audit"], root);
-    const out = (r.stdout || "") + (r.stderr || "");
-    assert.equal(r.status, 0, out);
-    assert.match(out, /checks passed/);
-    assert.match(out, /attestation:/);
-    assert.match(out, /Posture conformant/);
-  } finally { await rmRoot(root); }
-});
-
-test("audit: a group-readable .env makes the run exit non-zero with the fix", async () => {
-  const root = await makeConformantAgent();
-  try {
-    chmodSync(join(root, ".env"), 0o644);
-    const r = runCli(["audit"], root);
-    const out = (r.stdout || "") + (r.stderr || "");
-    assert.equal(r.status, 1, out);
-    assert.match(out, /env-mode-600/);
-    assert.match(out, /chmod 600/);
-    assert.match(out, /unsuppressed failure/);
-  } finally { await rmRoot(root); }
-});
-
-test("audit --fix: repairs a group-readable .env and then exits 0", async () => {
-  const root = await makeConformantAgent();
-  try {
-    chmodSync(join(root, ".env"), 0o644);
-    const r = runCli(["audit", "--fix"], root);
-    const out = (r.stdout || "") + (r.stderr || "");
-    assert.equal(r.status, 0, out);
-    assert.match(out, /applied 1 safe fix/);
-    assert.equal(statSync(join(root, ".env")).mode & 0o777, 0o600);
-  } finally { await rmRoot(root); }
-});
-
-test("audit: a suppressed-with-reason failure exits 0", async () => {
-  const root = await makeConformantAgent();
-  try {
-    chmodSync(join(root, ".env"), 0o644); // would fail env-mode-600
-    writeFileSync(join(root, "config/audit-suppressions.yaml"),
-      "- id: env-mode-600\n  reason: ephemeral CI runner\n");
-    const r = runCli(["audit"], root);
-    const out = (r.stdout || "") + (r.stderr || "");
-    assert.equal(r.status, 0, out);
-    assert.match(out, /SUPPRESSED/);
-    assert.match(out, /ephemeral CI runner/);
-  } finally { await rmRoot(root); }
-});
-
-test("audit --json: emits structured results + a hash-locked attestation", async () => {
-  const root = await makeConformantAgent();
-  try {
-    const r = runCli(["audit", "--json"], root);
-    assert.equal(r.status, 0, r.stderr || r.stdout);
-    const doc = JSON.parse(r.stdout);
-    assert.equal(doc.ok, true);
-    assert.ok(Array.isArray(doc.results) && doc.results.length >= 8);
-    assert.equal(typeof doc.attestation.hash, "string");
-    assert.equal(doc.attestation.schema, "maestro.audit.attestation.v1");
-    assert.equal(doc.attestation.identity.function, "executive-operator");
-  } finally { await rmRoot(root); }
-});
-
-test("audit --json: missing scoped-permissions makes ok:false and exit 1", async () => {
-  const root = await makeConformantAgent();
-  try {
-    writeFileSync(join(root, ".env"), "ANTHROPIC_API_KEY=sk-test\n"); // drop opt-in
-    chmodSync(join(root, ".env"), 0o600);
-    const r = runCli(["audit", "--json"], root);
-    assert.equal(r.status, 1);
-    const doc = JSON.parse(r.stdout);
-    assert.equal(doc.ok, false);
-    const sp = doc.results.find((x) => x.id === "scoped-permissions-configured");
-    assert.equal(sp.ok, false);
-    assert.equal(sp.severity, "critical");
-  } finally { await rmRoot(root); }
-});
-
-test("audit: exits 1 with a clear message outside a Maestro agent dir", async () => {
-  const dir = await tmpRoot("maestro-audit-nonagent");
-  try {
-    const r = runCli(["audit"], dir);
-    const out = (r.stdout || "") + (r.stderr || "");
-    assert.equal(r.status, 1);
-    assert.match(out, /Not a Maestro agent directory/);
-  } finally { await rmRoot(dir); }
-});
-
-test("audit --help: prints usage and exits 0", async () => {
-  const dir = await tmpRoot("maestro-audit-help");
-  try {
-    const r = runCli(["audit", "--help"], dir);
-    assert.equal(r.status, 0, r.stderr);
-    assert.match(r.stdout, /maestro audit/);
-    assert.match(r.stdout, /--fix/);
-  } finally { await rmRoot(dir); }
-});
-
-// ---------------------------------------------------------------------------
-// secrets — list / rotate (subcommand, gaps-enterprise-ops G12)
-// ---------------------------------------------------------------------------
-
-test("secrets --help prints usage and exits 0", async () => {
-  const dir = await tmpRoot("maestro-secrets-help");
-  try {
-    const r = runCli(["secrets", "--help"], dir);
-    assert.equal(r.status, 0, r.stderr);
-    assert.match(r.stdout, /maestro secrets/);
-    assert.match(r.stdout, /names only/);
-  } finally { await rmRoot(dir); }
-});
-
-test("secrets: exits 1 outside a Maestro agent dir", async () => {
-  const dir = await tmpRoot("maestro-secrets-nonagent");
-  try {
-    const r = runCli(["secrets", "list"], dir);
-    const out = (r.stdout || "") + (r.stderr || "");
-    assert.equal(r.status, 1);
-    assert.match(out, /Not a Maestro agent directory/);
-  } finally { await rmRoot(dir); }
-});
-
-test("secrets rotate then list shows the NAME but never the value", async () => {
-  const root = await makeBareAgent();
-  try {
-    // config/secrets.yaml selects the local file provider.
-    writeFileSync(join(root, "config/secrets.yaml"), "provider: file\n");
-
-    // Rotate a secret with the value supplied on stdin (never in argv).
-    const rot = runCliStdin(["secrets", "rotate", "--name", "DB_PASSWORD"], root, "p@ss-SECRET-123");
-    const rotOut = (rot.stdout || "") + (rot.stderr || "");
-    assert.equal(rot.status, 0, rotOut);
-    assert.match(rotOut, /Rotated "DB_PASSWORD"/);
-
-    // list shows the name...
-    const ls = runCli(["secrets", "list"], root);
-    const lsOut = (ls.stdout || "") + (ls.stderr || "");
-    assert.equal(ls.status, 0, lsOut);
-    assert.match(lsOut, /DB_PASSWORD/);
-    // ...but never the value, in either command's output.
-    assert.ok(!lsOut.includes("p@ss-SECRET-123"), "list must not print the value");
-    assert.ok(!rotOut.includes("p@ss-SECRET-123"), "rotate must not echo the value");
-
-    // The on-disk store is sealed (ciphertext != plaintext).
-    const store = readFileSync(join(root, "state/secrets/.secrets.json"), "utf-8");
-    assert.ok(!store.includes("p@ss-SECRET-123"), "value sealed at rest");
-
-    // The audit log records the name, not the value.
-    const audit = readFileSync(join(root, "logs/audit/secrets.jsonl"), "utf-8");
-    assert.match(audit, /DB_PASSWORD/);
-    assert.ok(!audit.includes("p@ss-SECRET-123"), "audit is names-only");
-  } finally { await rmRoot(root); }
-});
-
-test("secrets rotate without --name exits 1 with usage", async () => {
-  const root = await makeBareAgent();
-  try {
-    const r = runCliStdin(["secrets", "rotate"], root, "v");
-    const out = (r.stdout || "") + (r.stderr || "");
-    assert.equal(r.status, 1);
-    assert.match(out, /--name/);
-  } finally { await rmRoot(root); }
-});
-
-test("secrets sync without a configured broker exits 1", async () => {
-  const root = await makeBareAgent();
-  try {
-    writeFileSync(join(root, "config/secrets.yaml"), "provider: file\n");
-    const r = runCli(["secrets", "sync"], root);
-    const out = (r.stdout || "") + (r.stderr || "");
-    assert.equal(r.status, 1);
-    assert.match(out, /No broker configured/);
-  } finally { await rmRoot(root); }
-});
-
-// ---------------------------------------------------------------------------
-// doctor — backup-config DR check (gaps-enterprise-ops G16)
-// ---------------------------------------------------------------------------
-
-test("doctor RED when there is no DR posture at all, and names the one command that fixes it", async () => {
-  const root = await makeBareAgent();
-  try {
-    const r = runCli(["doctor"], root);
-    const out = (r.stdout || "") + (r.stderr || "");
-    assert.match(out, /No DR posture at all/);
-    assert.match(out, /backup-config\.yaml/);
-    assert.match(out, /maestro init backup-replication --apply/);
-    // doctor exits 1 whenever any issue is found; the missing backup is one.
-    assert.equal(r.status, 1, out);
-  } finally { await rmRoot(root); }
-});
-
-test("doctor RED when backup is enabled but has never actually run", async () => {
-  const root = await makeBareAgent();
-  try {
-    mkdirSync(join(root, ".maestro"), { recursive: true });
-    writeFileSync(join(root, ".maestro/backup-config.yaml"), "enabled: true\nprefix: t\n");
-    const r = runCli(["doctor"], root);
-    const out = (r.stdout || "") + (r.stderr || "");
-    assert.match(out, /NEVER completed a run/);
-    assert.match(out, /backup-run\.mjs/);
-  } finally { await rmRoot(root); }
-});
-
-test("doctor WARNS (not GREEN) when restore points are fresh but local-only", async () => {
-  const root = await makeBareAgent();
-  try {
-    mkdirSync(join(root, ".maestro"), { recursive: true });
-    writeFileSync(join(root, ".maestro/backup-config.yaml"), "enabled: true\nprefix: t\nlocal:\n  enabled: true\n");
-    writeFileSync(join(root, ".maestro/last-backup.json"), JSON.stringify({
-      completed_at: new Date().toISOString(), tier: "local", provider: "local",
-    }));
-    const r = runCli(["doctor"], root);
-    const out = (r.stdout || "") + (r.stderr || "");
-    assert.match(out, /LOCAL-ONLY/);
-    assert.match(out, /offsite\.provider/);
-    assert.ok(!out.includes("No DR posture at all"), "must not claim the config is missing");
-  } finally { await rmRoot(root); }
-});
-
-test("doctor GREEN for backup only when it is fresh AND off-machine", async () => {
-  const root = await makeBareAgent();
-  try {
-    mkdirSync(join(root, ".maestro"), { recursive: true });
-    writeFileSync(
-      join(root, ".maestro/backup-config.yaml"),
-      "enabled: true\nprefix: t\noffsite:\n  provider: s3\n  bucket: agent-backups\n"
-    );
-    writeFileSync(join(root, ".maestro/last-backup.json"), JSON.stringify({
-      completed_at: new Date().toISOString(), tier: "offsite", provider: "s3", bucket: "agent-backups",
-    }));
-    const r = runCli(["doctor"], root);
-    const out = (r.stdout || "") + (r.stderr || "");
-    assert.match(out, /Backup fresh \+ off-machine/);
-    assert.ok(!out.includes("No DR posture at all"), "must not flag missing backup when fresh");
-    assert.ok(!out.includes("LOCAL-ONLY"), "offsite is configured");
-  } finally { await rmRoot(root); }
-});
-
-test("doctor reports an include path that the credential deny-list drops", async () => {
-  const root = await makeBareAgent();
-  try {
-    mkdirSync(join(root, ".maestro"), { recursive: true });
-    writeFileSync(
-      join(root, ".maestro/backup-config.yaml"),
-      "enabled: true\nprefix: t\ninclude:\n  - state\n  - .env\n"
-    );
-    writeFileSync(join(root, ".maestro/last-backup.json"), JSON.stringify({
-      completed_at: new Date().toISOString(), tier: "local",
-    }));
-    const r = runCli(["doctor"], root);
-    const out = (r.stdout || "") + (r.stderr || "");
-    assert.match(out, /DROPPED by the credential deny-list/);
-  } finally { await rmRoot(root); }
-});
-
-// ---------------------------------------------------------------------------
-// framework-features.json — registry validity + new-system enrollment
-// (registry-scaffold-exports integration lane)
-// ---------------------------------------------------------------------------
-
-test("framework-features.json is valid JSON and registers the new systems", async () => {
-  const raw = readFileSync(join(MAESTRO_ROOT, "framework-features.json"), "utf-8");
-  const reg = JSON.parse(raw); // throws if invalid → test fails
-  assert.ok(reg.features && typeof reg.features === "object", "features map present");
-  const ids = Object.keys(reg.features);
-  // Every new system added by this lane must be enrolled in the registry.
-  for (const id of [
-    "org-cohort", "org-credential-broker", "secrets-lifecycle",
-    "diagnostics-spine", "alerting", "hook-bus", "dynamic-scheduling",
-    "send-gate", "knowledge-plane",
-  ]) {
-    assert.ok(ids.includes(id), `framework-features.json missing feature id: ${id}`);
-  }
-  // Pre-existing core systems still enrolled (no regression).
-  for (const id of ["model-router", "cadence-bus"]) {
-    assert.ok(ids.includes(id), `framework-features.json lost feature id: ${id}`);
-  }
-  // Schema fidelity: each new entry matches the existing feature schema.
-  for (const id of ["org-cohort", "secrets-lifecycle", "diagnostics-spine"]) {
-    const f = reg.features[id];
-    assert.equal(typeof f.version, "string", `${id}.version`);
-    assert.equal(typeof f.since, "string", `${id}.since`);
-    assert.equal(typeof f.title, "string", `${id}.title`);
-    assert.ok(f.init && typeof f.init === "object", `${id}.init`);
-    assert.equal(typeof f.init.auto, "boolean", `${id}.init.auto`);
-    assert.equal(typeof f.init.command, "string", `${id}.init.command`);
-    assert.equal(typeof f.init.description, "string", `${id}.init.description`);
-    // init.command must be a single-line string (feature-init trust-boundary guard).
-    assert.ok(!/[\0\r\n]/.test(f.init.command), `${id}.init.command must be single-line`);
-  }
-  // Honest enablement: org/cohort + its broker default OFF until configured.
-  assert.equal(reg.features["org-cohort"].init.auto, false, "org-cohort must not auto-enroll");
-  assert.equal(reg.features["org-credential-broker"].init.auto, false, "broker must not auto-enable");
-});
-
-// ---------------------------------------------------------------------------
-// create — ships the new disabled-by-default scaffold configs
-// ---------------------------------------------------------------------------
-
-test("create ships disabled-by-default org.yaml + secrets.yaml templates", async () => {
-  const parent = await tmpRoot("maestro-create-cfg");
-  const { env, dir: shim } = await withShim();
-  try {
-    const r = runCli(["create", "cfg-agent"], parent, env);
-    assert.equal(r.status, 0, r.stderr || r.stdout);
-    const agent = join(parent, "cfg-agent");
-
-    const orgYaml = join(agent, "config/org.yaml");
-    const secretsYaml = join(agent, "config/secrets.yaml");
-    assert.ok(existsSync(orgYaml), "config/org.yaml must be scaffolded");
-    assert.ok(existsSync(secretsYaml), "config/secrets.yaml must be scaffolded");
-
-    // org.yaml is disabled by default (the agent runs standalone).
-    const orgBody = readFileSync(orgYaml, "utf-8");
-    assert.match(orgBody, /enabled:\s*false/, "org enrollment must default OFF");
-    assert.match(orgBody, /cohort/);
-
-    // secrets.yaml defaults to the local file provider.
-    const secBody = readFileSync(secretsYaml, "utf-8");
-    assert.match(secBody, /provider:\s*file/, "secrets must default to the local file provider");
-  } finally {
-    await rmRoot(parent);
-    await rmRoot(shim);
-  }
-});
-
-// ---------------------------------------------------------------------------
-// upgrade — propagates new config templates to existing agents (add-only)
-// ---------------------------------------------------------------------------
-
-test("upgrade adds new scaffold config templates without clobbering existing ones", async () => {
-  const root = await makeLegacyAgent();
-  try {
-    // Seed an operator-customised alerts.yaml that upgrade must NOT overwrite.
-    mkdirSync(join(root, "config"), { recursive: true });
-    const customAlerts = "alerts:\n  webhook: https://hooks.example/custom\n";
-    writeFileSync(join(root, "config/alerts.yaml"), customAlerts);
-    execFileSync("git", ["add", "-A"], { cwd: root });
-    execFileSync("git", ["-c", "user.email=t@t", "-c", "user.name=t", "commit", "-q", "-m", "seed alerts"], { cwd: root });
-
-    const r = runCli(["upgrade"], root);
-    assert.equal(r.status, 0, r.stderr);
-
-    // New templates landed.
-    assert.ok(existsSync(join(root, "config/org.yaml")), "org.yaml must be delivered on upgrade");
-    assert.ok(existsSync(join(root, "config/secrets.yaml")), "secrets.yaml must be delivered on upgrade");
-    assert.match(readFileSync(join(root, "config/org.yaml"), "utf-8"), /enabled:\s*false/);
-
-    // Existing operator config preserved byte-for-byte.
-    assert.equal(readFileSync(join(root, "config/alerts.yaml"), "utf-8"), customAlerts,
-      "upgrade must not clobber an existing operator config");
-  } finally { await rmRoot(root); }
-});
-
-// ---------------------------------------------------------------------------
-// doctor — surfaces the new framework systems
-// ---------------------------------------------------------------------------
-
-test("doctor surfaces the new framework systems (org / secrets / diagnostics)", async () => {
-  // Use a freshly-created agent so lib/* + the scaffold configs are present.
-  const parent = await tmpRoot("maestro-doctor-systems");
-  const { env, dir: shim } = await withShim();
-  try {
-    const cr = runCli(["create", "doc-agent"], parent, env);
-    assert.equal(cr.status, 0, cr.stderr || cr.stdout);
-    const agent = join(parent, "doc-agent");
-    const r = runCli(["doctor"], agent);
-    const out = (r.stdout || "") + (r.stderr || "");
-    // 2.0: the presence-only org line became real connectivity probes; a fresh
-    // (unenrolled) create short-circuits on the single "not enrolled" line.
-    assert.match(out, /Org plane: not enrolled|Org enrollment resolved/);
-    assert.match(out, /Secret lifecycle/);
-    assert.match(out, /Diagnostics spine present/);
-    assert.match(out, /Alerting configured/);
-    // None of the new lib modules should be flagged missing in a fresh create.
-    assert.ok(!/module missing/.test(out), "fresh create must ship every new lib module");
-  } finally {
-    await rmRoot(parent);
-    await rmRoot(shim);
-  }
-});
-
-// ---------------------------------------------------------------------------
-// upgrade — prune (framework files deleted upstream)
-//
-// The copy loop only ever adds and overwrites, so before this every file the
-// SDK had ever shipped stayed resident on an agent machine forever. Orphaned
-// *modules* keep importing symbols their collaborators no longer export, so
-// they fail permanently and drag the agent's own suite red — found in the
-// field on Isla's machine, where a stale scripts/daemon/responder.test.mjs
-// survived the transport refactor still importing a deleted export.
-//
-// Prune's contract is narrow on purpose: it removes a file only when git
-// proves it is tracked-and-clean, i.e. pristine framework material the
-// operator never touched. Everything else is kept and reported.
-// ---------------------------------------------------------------------------
-
-/**
- * Agent repo carrying `orphans` — paths upstream does not ship. Written before
- * the commit so git sees them as tracked and clean (prune's precondition).
- */
-async function makeAgentWithOrphans(orphans, opts = {}) {
-  const root = await tmpRoot("maestro-orphan");
-  mkdirSync(join(root, "config"), { recursive: true });
-  writeFileSync(join(root, "CLAUDE.md"), "# agent\n");
-  writeFileSync(join(root, "config/agent.ts"), "export const AGENT = { firstName: 'orphan' };\n");
-  writeFileSync(join(root, "package.json"), '{"name":"orphan-agent","version":"1.0.0"}\n');
-  for (const [rel, body] of Object.entries(orphans)) {
-    mkdirSync(dirname(join(root, rel)), { recursive: true });
-    writeFileSync(join(root, rel), body);
-  }
-  // Provenance: prune only touches files a PREVIOUS upgrade recorded shipping.
-  // Without this the orphans are indistinguishable from operator-authored work
-  // and prune correctly refuses to act — so every prune test must seed it.
-  if (opts.seedManifest !== false) {
-    mkdirSync(join(root, ".maestro"), { recursive: true });
-    writeFileSync(
-      join(root, ".maestro/shipped-manifest.json"),
-      JSON.stringify({ version: 1, files: Object.keys(orphans).sort() }, null, 2) + "\n",
-    );
-  }
-
-  execFileSync("git", ["init", "-q"], { cwd: root });
-  execFileSync("git", ["add", "-A"], { cwd: root });
-  execFileSync(
-    "git",
-    ["-c", "user.email=test@test", "-c", "user.name=test", "commit", "-q", "-m", "init"],
-    { cwd: root },
-  );
-  return root;
-}
-
-const ORPHAN = "lib/zz-deleted-upstream-fixture.mjs";
-
-test("upgrade prunes a pristine framework file deleted upstream, with a backup", async () => {
-  const root = await makeAgentWithOrphans({ [ORPHAN]: "export const gone = 1;\n" });
-  try {
-    const r = runCli(["upgrade"], root);
-    assert.equal(r.status, 0, r.stderr);
-    assert.ok(!existsSync(join(root, ORPHAN)), "orphan should have been pruned");
-    assert.ok(
-      existsSync(join(root, ".maestro/backup", ORPHAN)),
-      "prune must be reversible — a backup is required",
-    );
-    assert.equal(
-      readFileSync(join(root, ".maestro/backup", ORPHAN), "utf-8"),
-      "export const gone = 1;\n",
-      "backup must hold the original bytes",
-    );
-  } finally {
-    await fsp.rm(root, { recursive: true, force: true });
-  }
-});
-
-test("upgrade never prunes a file the operator edited", async () => {
-  const root = await makeAgentWithOrphans({ [ORPHAN]: "export const gone = 1;\n" });
-  try {
-    writeFileSync(join(root, ORPHAN), "export const gone = 2; // my change\n");
-    const r = runCli(["upgrade"], root);
-    assert.equal(r.status, 0, r.stderr);
-    assert.ok(existsSync(join(root, ORPHAN)), "an edited orphan is the operator's, not ours to delete");
-    assert.match(
-      readFileSync(join(root, ORPHAN), "utf-8"),
-      /my change/,
-      "the operator's bytes must survive verbatim",
-    );
-    assert.match(r.stdout, /kept/i, "the kept orphan must be reported, not silently left");
-  } finally {
-    await fsp.rm(root, { recursive: true, force: true });
-  }
-});
-
-test("upgrade never prunes an untracked file", async () => {
-  const root = await makeAgentWithOrphans({});
-  try {
-    // Written after the commit → untracked → indistinguishable from operator work.
-    mkdirSync(join(root, "lib"), { recursive: true });
-    writeFileSync(join(root, ORPHAN), "export const mine = 1;\n");
-    const r = runCli(["upgrade"], root);
-    assert.equal(r.status, 0, r.stderr);
-    assert.ok(existsSync(join(root, ORPHAN)), "untracked files are never prune candidates");
-  } finally {
-    await fsp.rm(root, { recursive: true, force: true });
-  }
-});
-
-test("upgrade --no-prune leaves upstream-deleted files in place", async () => {
-  const root = await makeAgentWithOrphans({ [ORPHAN]: "export const gone = 1;\n" });
-  try {
-    const r = runCli(["upgrade", "--no-prune"], root);
-    assert.equal(r.status, 0, r.stderr);
-    assert.ok(existsSync(join(root, ORPHAN)), "--no-prune must suppress removal entirely");
-  } finally {
-    await fsp.rm(root, { recursive: true, force: true });
-  }
-});
-
-test("upgrade --dry-run reports a prune without performing it", async () => {
-  const root = await makeAgentWithOrphans({ [ORPHAN]: "export const gone = 1;\n" });
-  try {
-    const r = runCli(["upgrade", "--dry-run"], root);
-    assert.equal(r.status, 0, r.stderr);
-    assert.ok(existsSync(join(root, ORPHAN)), "dry run must not delete");
-    assert.ok(!existsSync(join(root, ".maestro/backup", ORPHAN)), "dry run must not write backups");
-    assert.match(r.stdout, /prune/i, "dry run must still tell the operator what it would remove");
-  } finally {
-    await fsp.rm(root, { recursive: true, force: true });
-  }
-});
-
-test("upgrade honours .maestroignore over prune", async () => {
-  const root = await makeAgentWithOrphans({
-    [ORPHAN]: "export const gone = 1;\n",
-    ".maestroignore": `${ORPHAN}\n`,
-  });
-  try {
-    const r = runCli(["upgrade"], root);
-    assert.equal(r.status, 0, r.stderr);
-    assert.ok(existsSync(join(root, ORPHAN)), ".maestroignore must win over prune, as it does over overwrite");
-  } finally {
-    await fsp.rm(root, { recursive: true, force: true });
-  }
-});
-
-test("upgrade prune leaves files that upstream still ships", async () => {
-  const root = await makeAgentWithOrphans({});
-  try {
-    const r = runCli(["upgrade"], root);
-    assert.equal(r.status, 0, r.stderr);
-    // A file the SDK genuinely ships must survive — the guard against a prune
-    // that mistakes "present upstream" for "absent" and empties the repo.
-    assert.ok(
-      existsSync(join(root, "lib/identity/persona.mjs")),
-      "currently-shipped framework files must never be pruned",
-    );
-    assert.ok(existsSync(join(root, "scripts/daemon/responder.mjs")));
-  } finally {
-    await fsp.rm(root, { recursive: true, force: true });
-  }
-});
-
-test("upgrade prune never touches merge-mode agents/", async () => {
-  const custom = "agents/my-private-agent.md";
-  const root = await makeAgentWithOrphans({ [custom]: "# mine\n" });
-  try {
-    const r = runCli(["upgrade"], root);
-    assert.equal(r.status, 0, r.stderr);
-    assert.ok(
-      existsSync(join(root, custom)),
-      "agents/ is merge-mode: local-only files there are the point, not orphans",
-    );
-  } finally {
-    await fsp.rm(root, { recursive: true, force: true });
-  }
-});
-
-test("upgrade prune never removes machine-generated launchd plists", async () => {
-  // A committed plist is tracked, clean, and absent upstream — it satisfies
-  // every safety check prune has, yet it is this machine's schedule, not
-  // framework material. Regression: an early prune deleted the very plist the
-  // cadence-bus migration was about to back up and regenerate.
-  const plist = "scripts/local-triggers/plists/ai.adaptic.some-trigger.plist";
-  const root = await makeAgentWithOrphans({ [plist]: "<?xml version=\"1.0\"?><plist/>" });
-  try {
-    const r = runCli(["upgrade"], root);
-    assert.equal(r.status, 0, r.stderr);
-    // Prune backs a file up under .maestro/backup/<path> before unlinking it
-    // and lists it as "pruned"; neither may happen here. (The file itself is
-    // gone after the run since WP-M6 — generate-plists.sh runs unconditionally
-    // as the first post-step and, as it always has, clears scripts/local-
-    // triggers/plists/ before rendering this machine's set. That is the
-    // generator owning its directory, not prune eating machine config.)
-    assert.ok(
-      !existsSync(join(root, ".maestro", "backup", plist)),
-      "generated plists are machine config; prune must leave them alone (no prune backup)",
-    );
-    assert.ok(!/pruned/.test(r.stdout), `prune must not report the plist:\n${r.stdout}`);
-  } finally {
-    await fsp.rm(root, { recursive: true, force: true });
-  }
-});
-
-test("upgrade prune spares operator-authored files the framework never shipped", async () => {
-  // The hazard that forced the provenance manifest. scripts/ is a smart root,
-  // so an operator's own committed script there is tracked, clean and absent
-  // upstream — every signal git can offer says "orphan". On a real agent
-  // machine this set included the pre-commit hook guarding a live org
-  // credential. Provenance, not cleanliness, is what makes prune safe.
-  const mine = "scripts/pre-commit-secret-scan.sh";
-  const root = await makeAgentWithOrphans({
-    [mine]: "#!/bin/sh\nexit 0\n",
-    [ORPHAN]: "export const gone = 1;\n",
-  });
-  try {
-    // Manifest records ONLY the framework file — the operator's script was
-    // never delivered by the SDK, so it must not be a prune candidate.
-    writeFileSync(
-      join(root, ".maestro/shipped-manifest.json"),
-      JSON.stringify({ version: 1, files: [ORPHAN] }, null, 2) + "\n",
-    );
-    execFileSync("git", ["add", "-A"], { cwd: root });
-    execFileSync(
-      "git",
-      ["-c", "user.email=test@test", "-c", "user.name=test", "commit", "-q", "-m", "manifest"],
-      { cwd: root },
-    );
-
-    const r = runCli(["upgrade"], root);
-    assert.equal(r.status, 0, r.stderr);
-    assert.ok(existsSync(join(root, mine)), "a file the framework never shipped is the operator's");
-    assert.ok(!existsSync(join(root, ORPHAN)), "the genuinely-shipped orphan should still prune");
-  } finally {
-    await fsp.rm(root, { recursive: true, force: true });
-  }
-});
-
-test("upgrade prunes nothing on a machine with no shipped-manifest, then records one", async () => {
-  const root = await makeAgentWithOrphans({ [ORPHAN]: "export const gone = 1;\n" }, { seedManifest: false });
-  try {
-    const first = runCli(["upgrade"], root);
-    assert.equal(first.status, 0, first.stderr);
-    assert.ok(
-      existsSync(join(root, ORPHAN)),
-      "with no provenance record, prune must do nothing rather than guess",
-    );
-    assert.ok(
-      existsSync(join(root, ".maestro/shipped-manifest.json")),
-      "the first run must record provenance so the next one can prune",
-    );
-    const manifest = JSON.parse(readFileSync(join(root, ".maestro/shipped-manifest.json"), "utf-8"));
-    assert.ok(manifest.files.includes("scripts/daemon/responder.mjs"), "manifest lists shipped files");
-    assert.ok(!manifest.files.includes(ORPHAN), "manifest must not list what upstream doesn't ship");
-  } finally {
-    await fsp.rm(root, { recursive: true, force: true });
-  }
-});
-
-test("upgrade --dry-run writes no shipped-manifest", async () => {
-  const root = await makeAgentWithOrphans({}, { seedManifest: false });
-  try {
-    const r = runCli(["upgrade", "--dry-run"], root);
-    assert.equal(r.status, 0, r.stderr);
-    assert.ok(
-      !existsSync(join(root, ".maestro/shipped-manifest.json")),
-      "--dry-run must stay side-effect-free, including provenance",
-    );
-  } finally {
-    await fsp.rm(root, { recursive: true, force: true });
-  }
-});
-
-// ---------------------------------------------------------------------------
-// upgrade — seat reconcile post-steps (WP-M6): the first hop from an old
-// version must leave the machine wholly on the new architecture by itself.
-// ---------------------------------------------------------------------------
-
-/** makeLegacyAgent + a NAMED config/agent.json, so plist labels and the identity block use "legacy". */
-async function makeNamedLegacyAgent() {
-  const root = await makeLegacyAgent();
-  writeFileSync(join(root, "config/agent.json"), JSON.stringify({ firstName: "Legacy", lastName: "Tester", fullName: "Legacy Tester" }, null, 2));
-  execFileSync("git", ["add", "-A"], { cwd: root });
-  execFileSync("git", ["-c", "user.email=test@test", "-c", "user.name=test", "commit", "-q", "-m", "name"], { cwd: root });
-  return root;
-}
-
-test("upgrade installs the -session plist into $HOME/Library/LaunchAgents (600, bootstrapped), never kickstarts daemon/session, records sdkVersion in the manifest and writes .maestro/upgrade-result.json", async () => {
-  const root = await makeNamedLegacyAgent();
-  const home = await freshHome();
-  try {
-    // An existing seat: the daemon job is installed (old content) and loaded.
-    writeFileSync(join(home, "Library", "LaunchAgents", "ai.maestro.legacy-daemon.plist"), "<plist>old daemon</plist>");
-    const r = runCli(["upgrade"], root, baseEnv({ HOME: home }));
-    assert.equal(r.status, 0, r.stderr + r.stdout);
-
-    const la = join(home, "Library", "LaunchAgents");
-    const sessionPlist = join(la, "ai.maestro.legacy-session.plist");
-    assert.ok(existsSync(sessionPlist), `session plist must be installed; stdout:\n${r.stdout}`);
-    assert.equal(statSync(sessionPlist).mode & 0o777, 0o600);
-    assert.match(readFileSync(sessionPlist, "utf-8"), /scripts\/session\/supervisor\.sh/);
-    assert.match(readFileSync(join(la, "ai.maestro.legacy-daemon.plist"), "utf-8"), /launchd-wrapper\.sh/, "daemon plist rewritten to the generated one");
-
-    const calls = readFileSync(join(home, "launchctl.log"), "utf-8");
-    assert.match(calls, new RegExp(`^launchctl bootstrap gui/\\d+ ${sessionPlist.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}$`, "m"), calls);
-    assert.ok(!/kickstart/.test(calls), `nothing is kickstarted by upgrade (the -autoupdate job is the one it runs inside):\n${calls}`);
-    assert.ok(!/bootout|unload/.test(calls), calls);
-    assert.match(calls, /^launchctl print gui\/\d+$/m, "loaded-ness is read from the gui domain");
-
-    // The claude STUB handled `mcp add-json` — not the developer's real CLI.
-    // lib/claude-bin.mjs would otherwise pick /usr/local/bin/claude over PATH;
-    // CLAUDE_BIN in baseEnv is what makes this isolation real.
-    assert.ok(existsSync(join(home, "claude.log")), "the claude stub must be the binary global-setup reached");
-    assert.match(readFileSync(join(home, "claude.log"), "utf-8"), /^claude mcp add-json cohort .* --scope user$/m);
-    const claudeJson = JSON.parse(readFileSync(join(home, ".claude.json"), "utf-8"));
-    assert.equal(claudeJson.mcpServers.cohort.env.COHORT_AGENT_ROOT.replace(/^\/private/, ""), root.replace(/^\/private/, ""), "stub exit 1 → the JSON merge fallback registered the server");
-    assert.ok(!("firstStartVersion" in claudeJson), "a real `claude` would have stamped its own keys into ~/.claude.json");
-    assert.ok(!existsSync(join(home, "npm.log")) || !/npm install -g/.test(readFileSync(join(home, "npm.log"), "utf-8")), "no global install under MAESTRO_SKIP_GLOBAL_INSTALL=1");
-
-    const manifest = JSON.parse(readFileSync(join(root, ".maestro/shipped-manifest.json"), "utf-8"));
-    const sdkVersion = JSON.parse(readFileSync(join(MAESTRO_ROOT, "package.json"), "utf-8")).version;
-    assert.equal(manifest.sdkVersion, sdkVersion);
-    assert.equal(manifest.version, 1, "the manifest FORMAT version is untouched");
-
-    const result = JSON.parse(readFileSync(join(root, ".maestro/upgrade-result.json"), "utf-8"));
-    assert.equal(result.to, sdkVersion);
-    assert.equal(result.from, null, "no prior manifest → from is unknown");
-    assert.match(result.at, /^\d{4}-\d{2}-\d{2}T/);
-    assert.deepEqual(Object.keys(result.steps), ["plists", "launchd", "globalSetup", "globalInstall", "verify"]);
-    assert.equal(result.steps.plists.ok, true, result.steps.plists.detail);
-    assert.equal(result.steps.launchd.ok, true, result.steps.launchd.detail);
-    assert.equal(result.steps.globalSetup.ok, true, result.steps.globalSetup.detail);
-    assert.match(result.steps.globalInstall.detail, /MAESTRO_SKIP_GLOBAL_INSTALL/);
-    assert.match(r.stdout, /Seat reconcile/);
-
-    // global-setup ran for real against the throwaway HOME.
-    assert.match(readFileSync(join(home, ".claude", "CLAUDE.md"), "utf-8"), /BEGIN maestro:identity/);
-    assert.ok(existsSync(join(home, ".claude", "skills", "maestro-main-session", "SKILL.md")));
-
-    // Second run: from is the recorded version, the session job is unchanged.
-    const again = runCli(["upgrade"], root, baseEnv({ HOME: home }));
-    assert.equal(again.status, 0, again.stderr);
-    const result2 = JSON.parse(readFileSync(join(root, ".maestro/upgrade-result.json"), "utf-8"));
-    assert.equal(result2.from, sdkVersion);
-    assert.match(result2.steps.launchd.detail, /0 installed, 0 replaced/);
-    assert.match(result.steps.launchd.detail, /1 replaced/, "the pre-installed daemon plist is rewritten in place");
-  } finally { await rmRoot(root); await rmRoot(home); }
-});
-
-test("upgrade --verify exits 0 on a reconciled seat and 1 once a generated plist is missing; doctor prints the same rows; --dry-run runs no post-steps", async () => {
-  const root = await makeNamedLegacyAgent();
-  const home = await freshHome();
-  try {
-    const dry = runCli(["upgrade", "--dry-run"], root, baseEnv({ HOME: home }));
-    assert.equal(dry.status, 0, dry.stderr);
-    assert.ok(!existsSync(join(root, ".maestro/upgrade-result.json")), "--dry-run writes no result");
-    assert.ok(!existsSync(join(home, "Library", "LaunchAgents", "ai.maestro.legacy-session.plist")), "--dry-run installs nothing");
-
-    assert.equal(runCli(["upgrade"], root, baseEnv({ HOME: home })).status, 0);
-    const v = runCli(["upgrade", "--verify"], root, baseEnv({ HOME: home }));
-    assert.equal(v.status, 0, `verify should pass on a reconciled seat:\n${v.stdout}${v.stderr}`);
-    assert.match(v.stdout, /generated plist\(s\) installed and loaded/);
-    assert.match(v.stdout, /identity, MCP, settings, pointer and skills present/);
-    assert.match(v.stdout, /verify: seat is on/);
-
-    execFileSync("rm", [join(home, "Library", "LaunchAgents", "ai.maestro.legacy-session.plist")]);
-    const bad = runCli(["upgrade", "--verify"], root, baseEnv({ HOME: home }));
-    assert.equal(bad.status, 1);
-    assert.match(bad.stdout, /not installed: ai\.maestro\.legacy-session/);
-    assert.match(bad.stdout, /verify: MISMATCH \(plists\)/);
-
-    const d = runCli(["doctor"], root, baseEnv({ HOME: home }));
-    // doctor's fail() rows go to stderr; ok/warn to stdout.
-    assert.match(d.stdout + d.stderr, /not installed: ai\.maestro\.legacy-session/, `doctor carries the verify rows:\n${d.stdout.slice(-1500)}\n${d.stderr.slice(-1500)}`);
-  } finally { await rmRoot(root); await rmRoot(home); }
-});