@cohortapp/agent-sdk 2.17.0 → 2.18.5

package/lib/execution/route.test.mjs

@@ -1,186 +0,0 @@
-/**
- * route.test.mjs — the execution rung ladder (SPEC §7).
- * Run: node --test lib/execution/route.test.mjs
- */
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-
-import { GATED_CLASSES } from "../org/approvals.mjs";
-import {
-  RUNGS,
-  rungById,
-  baseRung,
-  routeRung,
-  gatedClassesOf,
-  IN_CHAT_STEP_CEILING,
-  FAILURES_PER_RUNG,
-} from "./route.mjs";
-
-const ONE_CALL = { methods: ["messaging.send"], paramsKnown: true, steps: 1 };
-
-test("the ladder is six rungs, contiguous, each with a mechanism", () => {
-  assert.equal(RUNGS.length, 6);
-  RUNGS.forEach((r, i) => {
-    assert.equal(r.id, i);
-    assert.ok(r.mechanism && r.key && r.label);
-  });
-  assert.equal(rungById(3).key, "session");
-  assert.equal(rungById(99), null);
-});
-
-test("rung 0: one method, params known, short, no filesystem", () => {
-  const r = baseRung(ONE_CALL);
-  assert.equal(r.rung, 0);
-  assert.equal(r.reason, "single_method");
-});
-
-test("rung 0 is declined when any of its four predicates fails", () => {
-  assert.notEqual(baseRung({ ...ONE_CALL, paramsKnown: false }).rung, 0);
-  assert.notEqual(baseRung({ ...ONE_CALL, methods: ["a", "b"] }).rung, 0);
-  assert.notEqual(baseRung({ ...ONE_CALL, steps: 4 }).rung, 0);
-  assert.notEqual(baseRung({ ...ONE_CALL, filesystem: true }).rung, 0);
-  // and a bare need with nothing known does not sneak into rung 0
-  assert.notEqual(baseRung({}).rung, 0);
-});
-
-test("rung 1: a reachable skill covers a 2–10 step procedure", () => {
-  const need = { methods: ["a", "b", "c"], steps: 4, skillId: "triage-inbox" };
-  const ctx = { manifest: [{ id: "triage-inbox", reachable: true }] };
-  const r = baseRung(need, ctx);
-  assert.equal(r.rung, 1);
-  assert.equal(r.reason, "skill_covers");
-});
-
-test("rung 1 is DECLINED when the skill is not reachable — the marketplace lie", () => {
-  // Citing a skill the marketplace never registered means the session starts
-  // with no skill loaded. That must fall through, not pretend to be rung 1.
-  const need = { methods: ["a", "b", "c"], steps: 4, skillId: "triage-inbox" };
-  const r = baseRung(need, { manifest: [{ id: "triage-inbox", reachable: false }] });
-  assert.notEqual(r.rung, 1);
-  assert.ok(r.why.some((w) => /not reachable/.test(w)));
-});
-
-test("rung 1 with an ABSENT manifest is allowed, and says so", () => {
-  const need = { methods: ["a", "b"], steps: 3, skillId: "triage" };
-  const r = baseRung(need, {});
-  assert.equal(r.rung, 1);
-  assert.ok(r.why.some((w) => /manifest absent/.test(w)));
-});
-
-test("rung 1 declines a skill outside the 2–10 step band", () => {
-  assert.notEqual(baseRung({ steps: 1, skillId: "s", methods: ["a"], paramsKnown: true }).rung, 1);
-  assert.equal(baseRung({ steps: 40, skillId: "s" }).rung, 3);
-});
-
-test("rung 2: an external SaaS capability outside the protocol", () => {
-  const r = baseRung({ externalSaas: true, steps: 2 });
-  assert.equal(r.rung, 2);
-  assert.equal(r.reason, "external_capability");
-});
-
-test("rung 3: filesystem, too many steps, or open-ended", () => {
-  assert.equal(baseRung({ filesystem: true }).reason, "filesystem");
-  assert.equal(baseRung({ steps: IN_CHAT_STEP_CEILING + 1 }).reason, "too_many_steps");
-  assert.equal(baseRung({ openEnded: true, steps: 2 }).reason, "open_ended");
-  assert.equal(baseRung({ filesystem: true }).rung, 3);
-});
-
-test("rung 3 is the honest floor when nothing lower matches", () => {
-  const r = baseRung({ methods: ["a", "b"], steps: 3 });
-  assert.equal(r.rung, 3);
-  assert.equal(r.reason, "default_session");
-});
-
-test("rungs 4 and 5 are STRUCTURAL — tested before the cheap rungs", () => {
-  // A genuinely large job must not be walked up from rung 0 one failure at a time.
-  const workflow = baseRung({ stages: 4, gated: true, durable: true, methods: ["a"], paramsKnown: true, steps: 1 });
-  assert.equal(workflow.rung, 4);
-  const team = baseRung({ subProblems: 4, methods: ["a"], paramsKnown: true, steps: 1 });
-  assert.equal(team.rung, 5);
-});
-
-test("rung 5 declines when the sub-problems share mutable state", () => {
-  const r = baseRung({ subProblems: 5, sharedState: true, filesystem: true });
-  assert.equal(r.rung, 3);
-});
-
-test("rung 4 declines when the stages have neither gates nor durability", () => {
-  assert.notEqual(baseRung({ stages: 5, steps: 3, methods: ["a", "b"] }).rung, 4);
-});
-
-test("failure walk-up: one rung per two failures, and never a skip", () => {
-  const need = { ...ONE_CALL };
-  assert.equal(routeRung(need, { failures: 0 }).rung, 0);
-  assert.equal(routeRung(need, { failures: 1 }).rung, 0, "one failure buys nothing");
-  assert.equal(routeRung(need, { failures: 2 }).rung, 1);
-  assert.equal(routeRung(need, { failures: 3 }).rung, 1);
-  assert.equal(routeRung(need, { failures: 4 }).rung, 2);
-  assert.equal(routeRung(need, { failures: 2 }).escalatedFrom, 0);
-  assert.equal(FAILURES_PER_RUNG, 2);
-});
-
-test("the walk-up cannot pass rung 3 without an adopted objective", () => {
-  const need = { ...ONE_CALL };
-  const capped = routeRung(need, { failures: 20, hasAdoptedObjective: false });
-  assert.equal(capped.rung, 3);
-  assert.ok(capped.why.some((w) => /adopted objective/.test(w)));
-
-  const allowed = routeRung(need, { failures: 20, hasAdoptedObjective: true });
-  assert.ok(allowed.rung > 3);
-});
-
-test("an external ceiling (staleness ladder / beat directive) caps the rung", () => {
-  const r = routeRung({ filesystem: true }, { maxRung: 1 });
-  assert.equal(r.rung, 1);
-  assert.ok(r.why.some((w) => /ceiling maxRung=1/.test(w)));
-  // maxRung 0 is a real value, not a falsy no-op
-  assert.equal(routeRung({ filesystem: true }, { maxRung: 0 }).rung, 0);
-});
-
-test("blast radius forces an approval BEFORE any rung — rung 0 included", () => {
-  const r = routeRung({ ...ONE_CALL, actionClasses: ["external"] });
-  assert.equal(r.rung, 0, "the gate does not change the rung");
-  assert.deepEqual(r.approval, { required: true, classes: ["external"] });
-  assert.ok(r.why.some((w) => /approval required before rung 0/.test(w)));
-});
-
-test("no gated class ⇒ no approval gate", () => {
-  assert.equal(routeRung(ONE_CALL).approval, null);
-  assert.equal(routeRung({ ...ONE_CALL, actionClasses: [] }).approval, null);
-  assert.equal(routeRung({ ...ONE_CALL, actionClasses: ["chatty"] }).approval, null);
-});
-
-test("gatedClassesOf normalises against the ONE gated-class vocabulary", () => {
-  assert.deepEqual(gatedClassesOf(["EXTERNAL", "financial", "nonsense"]), ["external", "financial"]);
-  assert.deepEqual(gatedClassesOf(undefined), []);
-  assert.deepEqual(gatedClassesOf("irreversible"), ["irreversible"]);
-  assert.deepEqual(gatedClassesOf(["external", "external"]), ["external"], "deduped");
-  // the vocabulary is not re-declared locally
-  for (const c of GATED_CLASSES) assert.deepEqual(gatedClassesOf([c]), [c]);
-});
-
-test("over-budget BLOCKS with an enqueue signal — it never downgrades the rung", () => {
-  const r = routeRung({ filesystem: true }, { estCents: 900, remainingCents: 100 });
-  assert.equal(r.blocked, true);
-  assert.equal(r.gate.kind, "budget");
-  assert.equal(r.rung, 3, "a cheaper rung would be a worse answer, not a cheaper one");
-});
-
-test("budget gate is inert when either side of the comparison is unknown", () => {
-  assert.equal(routeRung(ONE_CALL, { estCents: 900 }).blocked, false);
-  assert.equal(routeRung(ONE_CALL, { remainingCents: 10 }).blocked, false);
-  assert.equal(routeRung(ONE_CALL, {}).blocked, false);
-  // exactly-at-budget is allowed; only strictly-over blocks
-  assert.equal(routeRung(ONE_CALL, { estCents: 100, remainingCents: 100 }).blocked, false);
-});
-
-test("routeRung never throws and always names a mechanism", () => {
-  for (const need of [undefined, null, {}, { methods: null }, { steps: NaN }, { subProblems: "x" }]) {
-    const r = routeRung(need, {});
-    assert.ok(Number.isInteger(r.rung) && r.rung >= 0 && r.rung <= 5);
-    assert.ok(r.mechanism, "every routing result names its mechanism");
-    assert.ok(Array.isArray(r.why) && r.why.length > 0, "and explains itself");
-  }
-});

package/lib/execution/surface-policy.test.mjs

@@ -1,162 +0,0 @@
-/**
- * surface-policy.test.mjs — every inbound surface has a decided policy.
- * Run: node --test lib/execution/surface-policy.test.mjs
- */
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-
-import { SURFACES, SURFACE_NAMES } from "../org/inbound/surfaces.mjs";
-import {
-  SURFACE_POLICY,
-  ORG_SURFACE_POLICY,
-  EXTENDED_SURFACE_POLICY,
-  EXTENDED_SURFACE_NAMES,
-  DEFAULT_POLICY,
-  DISPOSITIONS,
-  isDisposition,
-  policyFor,
-  uncoveredSurfaces,
-  orphanPolicies,
-  adoptedExtendedSurfaces,
-} from "./surface-policy.mjs";
-
-test("every shipped inbound surface has an explicit policy row", () => {
-  // The point of this test: a new surface added by the inbound workflow must not
-  // silently inherit DEFAULT_POLICY. Someone has to decide what it means.
-  assert.deepEqual(uncoveredSurfaces(), [], "surfaces with no policy row");
-  assert.deepEqual(orphanPolicies(), [], "policy rows for surfaces that no longer exist");
-  assert.equal(
-    Object.keys(SURFACE_POLICY).length,
-    SURFACE_NAMES.length + EXTENDED_SURFACE_NAMES.length,
-    "the merged table is exactly the org surfaces plus the declared extended ones",
-  );
-});
-
-test("an extended surface adopted by the inbound layer fails loudly instead of double-defining", () => {
-  // `calendar`, `alert` and `mandate` are decided here but not (yet) named by
-  // `lib/org/inbound/surfaces.mjs`. The day that workflow adds one, the row must
-  // MOVE — leaving both definitions in place would make the spread order decide
-  // which one wins, silently.
-  assert.deepEqual(
-    adoptedExtendedSurfaces(),
-    [],
-    "these extended surfaces now exist in the inbound table — move their rows into ORG_SURFACE_POLICY",
-  );
-  for (const name of EXTENDED_SURFACE_NAMES) {
-    assert.ok(ORG_SURFACE_POLICY[name] === undefined, `${name} is defined twice`);
-  }
-});
-
-test("the extended surfaces are all inward-facing or gated, never free to speak out", () => {
-  // They bypass parts of the ladder (`mandate` and `alert` skip the staleness
-  // gate), so none of them may be a surface that can talk outside the org.
-  for (const [name, p] of Object.entries(EXTENDED_SURFACE_POLICY)) {
-    assert.equal(p.respondable, false, `${name} must not be conversationally respondable`);
-    if (p.actionClasses.includes("external")) {
-      assert.equal(p.offlineSafe, false, `${name} speaks externally but claims to be offline-safe`);
-    }
-  }
-  // The two staleness-exempt surfaces in particular must cost nothing outside.
-  for (const name of ["mandate", "alert"]) {
-    assert.deepEqual(EXTENDED_SURFACE_POLICY[name].actionClasses, [], `${name} must carry no action class`);
-    assert.equal(EXTENDED_SURFACE_POLICY[name].offlineSafe, true);
-  }
-});
-
-test("every policy row is structurally complete and internally consistent", () => {
-  for (const [name, p] of Object.entries(SURFACE_POLICY)) {
-    assert.equal(typeof p.respondable, "boolean", `${name}.respondable`);
-    assert.ok(["now", "batch", "queue"].includes(p.latency), `${name}.latency=${p.latency}`);
-    assert.ok(Array.isArray(p.actionClasses), `${name}.actionClasses`);
-    assert.equal(typeof p.offlineSafe, "boolean", `${name}.offlineSafe`);
-    assert.equal(typeof p.selfApprove, "boolean", `${name}.selfApprove`);
-    assert.ok(Number.isInteger(p.maxChainDepth) && p.maxChainDepth >= 1, `${name}.maxChainDepth`);
-    assert.equal(typeof p.ambientDrop, "boolean", `${name}.ambientDrop`);
-    // A respondable surface must name the method it replies with, and a
-    // non-respondable one must not pretend it can.
-    if (p.respondable) assert.ok(p.replyMethod, `${name} is respondable but names no reply method`);
-    else assert.equal(p.replyMethod, null, `${name} is not respondable but names ${p.replyMethod}`);
-  }
-});
-
-test("anything that speaks outside the org is external and not offline-safe", () => {
-  // email is the only default surface whose reply leaves the org.
-  assert.ok(SURFACE_POLICY.email.actionClasses.includes("external"));
-  assert.equal(SURFACE_POLICY.email.offlineSafe, false);
-  // and nothing internal is mislabelled as external
-  assert.deepEqual(SURFACE_POLICY.dm.actionClasses, []);
-  assert.deepEqual(SURFACE_POLICY.mention.actionClasses, []);
-});
-
-test("the agent may never be the terminal decider on approvals or decisions", () => {
-  assert.equal(SURFACE_POLICY.approval.selfApprove, false);
-  assert.equal(SURFACE_POLICY.decision.selfApprove, false);
-  // ...and both are irreversible, so they also carry an approval gate.
-  assert.ok(SURFACE_POLICY.approval.actionClasses.includes("irreversible"));
-  assert.ok(SURFACE_POLICY.decision.actionClasses.includes("irreversible"));
-  // Every other surface is self-decidable, or the agent could do nothing at all.
-  const decidable = Object.entries(SURFACE_POLICY).filter(([, p]) => p.selfApprove);
-  assert.ok(decidable.length >= SURFACE_NAMES.length - 2);
-});
-
-test("hq keeps the live call floor: `call` is never conversationally respondable", () => {
-  assert.equal(SURFACE_POLICY.call.respondable, false);
-  assert.equal(SURFACE_POLICY.call.replyMethod, null);
-});
-
-test("public surfaces have a tighter ping-pong ceiling than private ones", () => {
-  assert.ok(
-    SURFACE_POLICY.mention.maxChainDepth < SURFACE_POLICY.dm.maxChainDepth,
-    "a wrong answer in a space is more expensive than in a DM",
-  );
-});
-
-test("policyFor: unknown surface degrades to the restrictive default, flagged", () => {
-  const p = policyFor("surface_from_the_future");
-  assert.equal(p, DEFAULT_POLICY);
-  assert.equal(p.unknown, true);
-  // The restrictive default must not be able to speak, and must not be able to
-  // speak EXTERNALLY in particular.
-  assert.equal(p.respondable, false);
-  assert.deepEqual(p.actionClasses, []);
-  // negatives
-  assert.equal(policyFor(null).unknown, true);
-  assert.equal(policyFor(undefined).unknown, true);
-  assert.equal(policyFor(42).unknown, true);
-  assert.equal(policyFor("").unknown, true);
-});
-
-test("policyFor: a real surface never returns the default", () => {
-  for (const name of SURFACE_NAMES) {
-    const p = policyFor(name);
-    assert.notEqual(p.unknown, true, `${name} fell through to the default`);
-  }
-});
-
-test("policyFor: prototype keys do not resolve to a policy", () => {
-  // `hasOwnProperty` guard, not a bare lookup — "constructor" must not be a surface.
-  assert.equal(policyFor("constructor").unknown, true);
-  assert.equal(policyFor("toString").unknown, true);
-  assert.equal(policyFor("__proto__").unknown, true);
-});
-
-test("the disposition vocabulary is exactly the five documented outcomes", () => {
-  assert.deepEqual([...DISPOSITIONS].sort(), ["delegate", "escalate", "ignore", "react_now", "schedule"]);
-  assert.ok(isDisposition("ignore"));
-  assert.equal(isDisposition("maybe"), false);
-  assert.equal(isDisposition(null), false);
-  assert.equal(isDisposition(undefined), false);
-});
-
-test("surface topics stay aligned with the inbound vocabulary", () => {
-  // Guards the seam: if the inbound layer renames a surface, this fails rather
-  // than the policy silently applying to nothing. Extended surfaces are exempt
-  // by construction — they exist precisely because the inbound layer has no row
-  // for them — and `orphanPolicies` above is what keeps that list honest.
-  for (const name of Object.keys(SURFACE_POLICY)) {
-    if (EXTENDED_SURFACE_NAMES.includes(name)) continue;
-    assert.ok(SURFACES[name], `policy names ${name}, which the inbound layer does not define`);
-  }
-});

package/lib/fs-atomic.test.mjs

@@ -1,72 +0,0 @@
-/**
- * Tests for lib/fs-atomic.mjs — durable atomic write primitives.
- * @module lib/fs-atomic.test
- */
-
-import { describe, it, beforeEach, afterEach } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, rmSync, readFileSync, writeFileSync, existsSync, readdirSync } from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-import { writeFileAtomic, writeJsonAtomic, appendJsonl } from "./fs-atomic.mjs";
-
-let dir;
-beforeEach(() => { dir = mkdtempSync(join(tmpdir(), "fs-atomic-")); });
-afterEach(() => { rmSync(dir, { recursive: true, force: true }); });
-
-describe("writeFileAtomic", () => {
-  it("writes contents and creates missing parent dirs", () => {
-    const p = join(dir, "a", "b", "c.txt");
-    writeFileAtomic(p, "hello");
-    assert.equal(readFileSync(p, "utf8"), "hello");
-  });
-
-  it("overwrites an existing file atomically (final contents only)", () => {
-    const p = join(dir, "x.txt");
-    writeFileAtomic(p, "first");
-    writeFileAtomic(p, "second");
-    assert.equal(readFileSync(p, "utf8"), "second");
-  });
-
-  it("leaves no .tmp sibling behind on success", () => {
-    const p = join(dir, "y.txt");
-    writeFileAtomic(p, "data");
-    const strays = readdirSync(dir).filter((f) => f.includes(".tmp."));
-    assert.equal(strays.length, 0);
-  });
-
-  it("accepts a Buffer payload", () => {
-    const p = join(dir, "buf.bin");
-    writeFileAtomic(p, Buffer.from([1, 2, 3]));
-    assert.deepEqual([...readFileSync(p)], [1, 2, 3]);
-  });
-});
-
-describe("writeJsonAtomic", () => {
-  it("round-trips an object as pretty JSON with trailing newline", () => {
-    const p = join(dir, "obj.json");
-    writeJsonAtomic(p, { a: 1, b: [2, 3] });
-    const raw = readFileSync(p, "utf8");
-    assert.ok(raw.endsWith("\n"));
-    assert.deepEqual(JSON.parse(raw), { a: 1, b: [2, 3] });
-  });
-});
-
-describe("appendJsonl", () => {
-  it("appends whole JSON lines, preserving prior content", () => {
-    const p = join(dir, "log.jsonl");
-    assert.equal(appendJsonl(p, { n: 1 }), true);
-    assert.equal(appendJsonl(p, { n: 2 }), true);
-    const lines = readFileSync(p, "utf8").trim().split("\n");
-    assert.equal(lines.length, 2);
-    assert.deepEqual(JSON.parse(lines[0]), { n: 1 });
-    assert.deepEqual(JSON.parse(lines[1]), { n: 2 });
-  });
-
-  it("returns false instead of throwing when the path is unwritable", () => {
-    // A path whose parent is an existing *file* cannot be mkdir'd → IO error.
-    const blocker = join(dir, "blocker");
-    writeFileSync(blocker, "x");
-    assert.equal(appendJsonl(join(blocker, "nope.jsonl"), { n: 1 }), false);
-  });
-});

package/lib/fs-ownership.test.mjs

@@ -1,158 +0,0 @@
-import test from "node:test";
-import assert from "node:assert/strict";
-import {
-  checkPathOwnership,
-  checkOwnershipSet,
-  buildFixCommand,
-} from "./fs-ownership.mjs";
-
-// Octal modes are easier to read for these cases. We pass the directory mode
-// bits the way fs.stat().mode reports them (S_IFDIR | perms).
-const RUNTIME_UID = 501;
-
-test("checkPathOwnership: owned by runtime, 0700 -> ok", () => {
-  const r = checkPathOwnership({
-    path: "state",
-    mode: 0o40700,
-    uid: RUNTIME_UID,
-    runtimeUid: RUNTIME_UID,
-  });
-  assert.equal(r.ok, true);
-  assert.equal(r.exists, true);
-  assert.equal(r.ownedByRuntime, true);
-  assert.equal(r.groupWritable, false);
-  assert.equal(r.worldWritable, false);
-  assert.deepEqual(r.reasons, []);
-});
-
-test("checkPathOwnership: owned by runtime, 0755 -> ok (not group/world writable)", () => {
-  const r = checkPathOwnership({
-    path: "logs",
-    mode: 0o40755,
-    uid: RUNTIME_UID,
-    runtimeUid: RUNTIME_UID,
-  });
-  assert.equal(r.ok, true);
-  assert.deepEqual(r.reasons, []);
-});
-
-test("checkPathOwnership: root-owned -> violation with uid in reason", () => {
-  const r = checkPathOwnership({
-    path: "state",
-    mode: 0o40700,
-    uid: 0,
-    runtimeUid: RUNTIME_UID,
-  });
-  assert.equal(r.ok, false);
-  assert.equal(r.ownedByRuntime, false);
-  assert.equal(r.reasons.length, 1);
-  assert.match(r.reasons[0], /uid 0/);
-  assert.match(r.reasons[0], /uid 501/);
-});
-
-test("checkPathOwnership: group-writable -> violation", () => {
-  const r = checkPathOwnership({
-    path: "logs",
-    mode: 0o40770,
-    uid: RUNTIME_UID,
-    runtimeUid: RUNTIME_UID,
-  });
-  assert.equal(r.ok, false);
-  assert.equal(r.groupWritable, true);
-  assert.ok(r.reasons.some((x) => /group-writable/.test(x)));
-});
-
-test("checkPathOwnership: world-writable (0777 workaround) -> violation", () => {
-  const r = checkPathOwnership({
-    path: "state",
-    mode: 0o40777,
-    uid: RUNTIME_UID,
-    runtimeUid: RUNTIME_UID,
-  });
-  assert.equal(r.ok, false);
-  assert.equal(r.worldWritable, true);
-  assert.equal(r.groupWritable, true);
-  assert.ok(r.reasons.some((x) => /world-writable/.test(x)));
-  assert.ok(r.reasons.some((x) => /group-writable/.test(x)));
-});
-
-test("checkPathOwnership: root-owned AND world-writable -> three reasons", () => {
-  const r = checkPathOwnership({
-    path: "state",
-    mode: 0o40777,
-    uid: 0,
-    runtimeUid: RUNTIME_UID,
-  });
-  assert.equal(r.ok, false);
-  // ownership + group-writable + world-writable
-  assert.equal(r.reasons.length, 3);
-});
-
-test("checkPathOwnership: missing path -> ok:true exists:false, no reasons", () => {
-  const r = checkPathOwnership({
-    path: "state/cadence-bus",
-    mode: 0,
-    uid: 0,
-    runtimeUid: RUNTIME_UID,
-    exists: false,
-  });
-  assert.equal(r.ok, true);
-  assert.equal(r.exists, false);
-  assert.deepEqual(r.reasons, []);
-});
-
-test("checkOwnershipSet: all clean -> ok, no fixCommand", () => {
-  const res = checkOwnershipSet(
-    [
-      { path: "state", mode: 0o40700, uid: RUNTIME_UID },
-      { path: "logs", mode: 0o40755, uid: RUNTIME_UID },
-    ],
-    { runtimeUid: RUNTIME_UID },
-  );
-  assert.equal(res.ok, true);
-  assert.equal(res.violations.length, 0);
-  assert.equal(res.fixCommand, null);
-});
-
-test("checkOwnershipSet: one root-owned -> not ok, fixCommand present", () => {
-  const res = checkOwnershipSet(
-    [
-      { path: "state", mode: 0o40700, uid: 0 },
-      { path: "logs", mode: 0o40700, uid: RUNTIME_UID },
-    ],
-    { runtimeUid: RUNTIME_UID, whoami: "wong" },
-  );
-  assert.equal(res.ok, false);
-  assert.equal(res.violations.length, 1);
-  assert.equal(res.violations[0].path, "state");
-  assert.equal(
-    res.fixCommand,
-    "sudo chown -R wong state logs && chmod -R u+rwX,go-w state logs",
-  );
-});
-
-test("checkOwnershipSet: missing entries are ignored (not violations)", () => {
-  const res = checkOwnershipSet(
-    [
-      { path: "state", mode: 0o40700, uid: RUNTIME_UID },
-      { path: "state/cadence-bus", mode: 0, uid: 0, exists: false },
-    ],
-    { runtimeUid: RUNTIME_UID },
-  );
-  assert.equal(res.ok, true);
-  assert.equal(res.fixCommand, null);
-});
-
-test("buildFixCommand: default roots + $(whoami)", () => {
-  assert.equal(
-    buildFixCommand(),
-    "sudo chown -R $(whoami) state logs && chmod -R u+rwX,go-w state logs",
-  );
-});
-
-test("buildFixCommand: custom roots", () => {
-  assert.equal(
-    buildFixCommand(["state", "logs", "knowledge"], "alice"),
-    "sudo chown -R alice state logs knowledge && chmod -R u+rwX,go-w state logs knowledge",
-  );
-});