@cohortapp/agent-sdk 2.17.0 → 2.18.5

package/lib/learning/skill-writer.test.mjs

@@ -1,210 +0,0 @@
-/**
- * skill-writer.test.mjs — autonomous skill write-path tests.
- * Run: node --test lib/learning/skill-writer.test.mjs
- *
- * Covers: flat-skill frontmatter, slug dedupe, secret-scan ABORT, plugin.json
- * upsert, atomic write, audit rows, patch overwrite, sidecar lifecycle.
- */
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, existsSync, readFileSync, readdirSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-import {
-  writeSkill, approveSkill, scanForSecrets, slugify, renderSkillMd, readSidecar, touchSkill,
-} from "./skill-writer.mjs";
-
-function tmpRoot() {
-  return mkdtempSync(join(tmpdir(), "maestro-skillwriter-"));
-}
-function skillPath(root, id) {
-  return join(root, "plugins", "agent-skills", "skills", `${id}.md`);
-}
-function pendingPath(root, id) {
-  return join(root, "plugins", "agent-skills", ".pending", `${id}.md`);
-}
-function pluginExists(root) {
-  return existsSync(join(root, "plugins", "agent-skills", "plugin.json"));
-}
-function pluginJson(root) {
-  return JSON.parse(readFileSync(join(root, "plugins", "agent-skills", "plugin.json"), "utf8"));
-}
-function auditRows(root) {
-  const p = join(root, "logs", "audit", "skills.jsonl");
-  if (!existsSync(p)) return [];
-  return readFileSync(p, "utf8").trim().split("\n").filter(Boolean).map((l) => JSON.parse(l));
-}
-
-test("slugify: filesystem-safe, hyphenated, bounded", () => {
-  assert.equal(slugify("Reconcile the Billing Export!"), "reconcile-the-billing-export");
-  assert.equal(slugify("   "), "skill");
-  assert.equal(slugify("a/b\\c"), "a-b-c");
-});
-
-test("renderSkillMd: agent provenance frontmatter + body", () => {
-  const md = renderSkillMd({
-    id: "x", name: "Do X", description: "does x", body: "# Do X\nsteps", sourceSession: "sess-1", createdAt: "2026-06-09T00:00:00Z",
-  });
-  assert.match(md, /^---\n/);
-  assert.match(md, /name: Do X/);
-  assert.match(md, /description: does x/);
-  assert.match(md, /created_by: agent/);
-  assert.match(md, /source_session: sess-1/);
-  assert.match(md, /\n# Do X\nsteps\n$/);
-});
-
-test("writeSkill create: QUARANTINES to .pending — not live, not in plugin.json, sidecar pending, audit", () => {
-  const root = tmpRoot();
-  const res = writeSkill({
-    agentRoot: root, action: "create", name: "Reconcile Billing Export",
-    description: "Re-run the monthly billing reconciliation", body: "# Reconcile\n1. pull export\n2. diff", sourceSession: "sess-42",
-    nowIso: "2026-06-09T00:00:00Z",
-  });
-  assert.equal(res.ok, true);
-  assert.equal(res.status, "pending", "a create lands pending, not live");
-  assert.equal(res.id, "reconcile-billing-export");
-
-  // The file is in the quarantine dir, NOT the live dir Claude Code loads.
-  assert.ok(existsSync(pendingPath(root, res.id)), "skill .md in .pending");
-  assert.ok(!existsSync(skillPath(root, res.id)), "NOT in the live skills dir");
-  // No plugin.json at all → Claude Code never loads the pending skill.
-  assert.ok(!pluginExists(root), "pending skill is NOT registered in plugin.json");
-
-  const body = readFileSync(pendingPath(root, res.id), "utf8");
-  assert.match(body, /created_by: agent/);
-  assert.match(body, /status: pending/);
-  assert.match(body, /pull export/);
-
-  const sidecar = readSidecar(root);
-  assert.equal(sidecar[res.id].created_by, "agent");
-  assert.equal(sidecar[res.id].state, "pending");
-  assert.equal(sidecar[res.id].pinned, false);
-
-  // Audit records the create + an operator-notification row.
-  const audit = auditRows(root);
-  assert.ok(audit.some((r) => r.action === "create" && r.id === "reconcile-billing-export" && r.status === "pending"));
-  const notice = audit.find((r) => r.action === "pending_review" && r.id === "reconcile-billing-export");
-  assert.ok(notice, "operator pending_review row emitted");
-  assert.match(notice.approve_hint, /approve reconcile-billing-export/);
-});
-
-test("approveSkill: promotes a pending skill to live + plugin.json + sidecar active", () => {
-  const root = tmpRoot();
-  const res = writeSkill({ agentRoot: root, name: "Daily Recon", description: "the recon", body: "# Steps\n1. go" });
-  assert.equal(res.status, "pending");
-
-  const ap = approveSkill({ agentRoot: root, id: res.id, approvedBy: "layla", nowIso: "2026-06-10T00:00:00Z" });
-  assert.equal(ap.ok, true);
-  assert.equal(ap.id, res.id);
-
-  // Now live and registered; the raw pending .md is gone.
-  assert.ok(existsSync(skillPath(root, res.id)), "approved skill is live");
-  assert.ok(!existsSync(pendingPath(root, res.id)), "pending copy removed");
-  const live = readFileSync(skillPath(root, res.id), "utf8");
-  assert.match(live, /status: approved/);
-
-  const manifest = pluginJson(root);
-  assert.equal(manifest.skills.length, 1);
-  assert.deepEqual(manifest.skills[0], { name: res.id, description: "the recon", path: `skills/${res.id}.md` });
-
-  assert.equal(readSidecar(root)[res.id].state, "active");
-  assert.ok(auditRows(root).some((r) => r.action === "approve" && r.id === res.id && r.approved_by === "layla"));
-});
-
-test("approveSkill: unknown / not-pending id is a no-op failure", () => {
-  const root = tmpRoot();
-  const ap = approveSkill({ agentRoot: root, id: "never-authored" });
-  assert.equal(ap.ok, false);
-  assert.equal(ap.reason, "not-pending");
-});
-
-test("writeSkill create: slug dedupe across BOTH pending and live", () => {
-  const root = tmpRoot();
-  const a = writeSkill({ agentRoot: root, name: "Daily Recon", description: "d", body: "v1" });
-  const b = writeSkill({ agentRoot: root, name: "Daily Recon", description: "d", body: "v2" });
-  assert.equal(a.id, "daily-recon");
-  assert.equal(b.id, "daily-recon-2", "second create dedupes the slug even in quarantine");
-  assert.ok(existsSync(pendingPath(root, "daily-recon")));
-  assert.ok(existsSync(pendingPath(root, "daily-recon-2")));
-  // Approving the first must still not collide with the pending second.
-  approveSkill({ agentRoot: root, id: "daily-recon" });
-  const c = writeSkill({ agentRoot: root, name: "Daily Recon", description: "d", body: "v3" });
-  assert.equal(c.id, "daily-recon-3", "dedupe checks the live dir too");
-});
-
-test("writeSkill patch: a LIVE (approved) skill is edited in place and stays live", () => {
-  const root = tmpRoot();
-  const created = writeSkill({ agentRoot: root, name: "Patchable", description: "first", body: "OLD BODY" });
-  approveSkill({ agentRoot: root, id: created.id }); // operator approves before any patch
-  const b = writeSkill({ agentRoot: root, action: "patch", id: created.id, name: "Patchable", description: "second", body: "NEW BODY" });
-  assert.equal(b.ok, true);
-  assert.equal(b.status, "approved", "patch of a live skill stays live");
-  assert.equal(b.id, created.id, "patch keeps the id");
-  const body = readFileSync(skillPath(root, created.id), "utf8");
-  assert.match(body, /NEW BODY/);
-  assert.doesNotMatch(body, /OLD BODY/, "old body overwritten");
-  // create-or-replace by name → still one entry, updated description.
-  const manifest = pluginJson(root);
-  assert.equal(manifest.skills.length, 1);
-  assert.equal(manifest.skills[0].description, "second");
-});
-
-test("writeSkill patch: a NON-live target is downgraded to a quarantined create", () => {
-  const root = tmpRoot();
-  // Patch a skill that was never approved (only pending) → must not go live.
-  const res = writeSkill({ agentRoot: root, action: "patch", id: "ghost", name: "Ghost", description: "d", body: "BODY" });
-  assert.equal(res.ok, true);
-  assert.equal(res.action, "create", "patch of a non-live skill becomes a create");
-  assert.equal(res.status, "pending");
-  assert.ok(existsSync(pendingPath(root, res.id)));
-  assert.ok(!pluginExists(root), "still not registered");
-});
-
-test("scanForSecrets: flags credential literals and sensitive assignments", () => {
-  assert.deepEqual(scanForSecrets("nothing to see here"), []);
-  assert.ok(scanForSecrets("export KEY=sk-ant-" + "A".repeat(20)).some((h) => h.label === "anthropic-key"));
-  assert.ok(scanForSecrets("token gh" + "p_" + "B".repeat(30)).some((h) => h.label === "github-pat"));
-  assert.ok(scanForSecrets("AKIA" + "Z".repeat(16)).some((h) => h.label === "aws-access-key-id"));
-  assert.ok(scanForSecrets("Authorization: Bearer " + "c".repeat(24)).some((h) => h.label === "bearer-token"));
-  assert.ok(scanForSecrets("password=hunter2longenough").some((h) => /assignment:password/.test(h.label)));
-});
-
-test("writeSkill: ABORTS on a secret in the body — no file, no manifest, audit abort row", () => {
-  const root = tmpRoot();
-  const res = writeSkill({
-    agentRoot: root, name: "Leaky Skill", description: "should not land",
-    body: "# Setup\nRun with API_KEY=sk-ant-" + "S".repeat(24) + " then proceed.",
-  });
-  assert.equal(res.ok, false);
-  assert.equal(res.reason, "secret-scan");
-  assert.ok(res.secrets.length >= 1);
-  assert.ok(!existsSync(skillPath(root, "leaky-skill")), "no skill file written");
-  assert.ok(!existsSync(join(root, "plugins", "agent-skills", "plugin.json")), "no manifest written");
-  const audit = auditRows(root);
-  assert.equal(audit.length, 1);
-  assert.equal(audit[0].action, "abort");
-  assert.equal(audit[0].reason, "secret-scan");
-});
-
-test("writeSkill: atomic — leaves no .tmp turds behind", () => {
-  const root = tmpRoot();
-  writeSkill({ agentRoot: root, name: "Clean Write", description: "d", body: "x" });
-  // A create quarantines, so the atomic write lands in .pending.
-  const dir = join(root, "plugins", "agent-skills", ".pending");
-  const names = existsSync(dir) ? readdirSync(dir) : [];
-  assert.ok(names.length >= 1);
-  assert.ok(names.every((n) => !n.endsWith(".tmp")), "no leftover tmp files");
-});
-
-test("touchSkill: bumps last_activity only for known ids", () => {
-  const root = tmpRoot();
-  const a = writeSkill({ agentRoot: root, name: "Touchable", description: "d", body: "x", nowIso: "2026-06-01T00:00:00Z" });
-  touchSkill(root, a.id, { nowIso: "2026-06-09T00:00:00Z" });
-  assert.equal(readSidecar(root)[a.id].last_activity, "2026-06-09T00:00:00Z");
-  // Unknown id is a no-op (no new record created).
-  touchSkill(root, "does-not-exist", { nowIso: "2026-06-09T00:00:00Z" });
-  assert.ok(!readSidecar(root)["does-not-exist"]);
-});

package/lib/mandate/audit.test.mjs

@@ -1,195 +0,0 @@
-/**
- * lib/mandate/audit.test.mjs — an audit line for every autonomous decision.
- *
- * The governance question this answers is "why did the agent do that?", and it
- * has to be answerable OFFLINE, from the ledger plus the cached mandate alone.
- * Every line therefore carries its own provenance walk: objective → pillar →
- * charter clause → who adopted it.
- *
- * The failure mode being guarded against is the one this codebase keeps hitting:
- * a decision that happens but leaves no trace. So the ledger never throws, never
- * drops a line for an unrecognised decision kind, and logs when the org mirror
- * fails rather than pretending it succeeded.
- */
-
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, rmSync, readFileSync, writeFileSync, existsSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-import { recordDecision, readAudit, explain, provenanceFor, auditPath, DECISIONS, AUDIT_REL } from "./audit.mjs";
-
-const NOW = Date.parse("2026-08-11T09:00:00.000Z");
-
-const MANDATE = {
-  body: {
-    memberId: "mem_self",
-    objectives: [
-      { key: "revenue", kind: "PILLAR", state: "active", charterSectionId: "cs_12", adoptedById: "mem_boss" },
-      {
-        key: "pipeline", kind: "OBJECTIVE", parentKey: "revenue", state: "active",
-        metric: "pipeline_coverage_x", target: 3, adoptedById: "mem_boss",
-      },
-    ],
-  },
-};
-
-function makeRoot() { return mkdtempSync(join(tmpdir(), "mandate-audit-")); }
-function cleanup(root) { try { rmSync(root, { recursive: true, force: true }); } catch { /* best effort */ } }
-function lines(root) {
-  return readFileSync(auditPath(root), "utf-8").trim().split("\n").map((l) => JSON.parse(l));
-}
-
-test("every decision kind the loop emits is in the declared vocabulary", () => {
-  // If the loop grows a decision the ledger has never heard of, that is a
-  // review signal, not a silent write.
-  for (const d of [
-    "measured", "measure_failed", "gap", "candidate_admitted", "candidate_rejected",
-    "disposition", "routed", "route_failed", "execution_rung", "budget_refused",
-    "approval_gate", "drift", "observe_only",
-  ]) {
-    assert.ok(DECISIONS.includes(d), `"${d}" must be a declared decision kind`);
-  }
-});
-
-test("a decision line stamps time, kind, and the full provenance chain", () => {
-  const root = makeRoot();
-  try {
-    const rec = recordDecision(
-      root,
-      { decision: "candidate_admitted", objectiveKey: "pipeline", obligationKey: "outcome.pipeline", detail: { title: "Book calls" } },
-      { now: () => NOW, mandate: MANDATE }
-    );
-    assert.equal(rec.at, new Date(NOW).toISOString());
-    assert.equal(rec.decision, "candidate_admitted");
-    assert.equal(rec.obligationKey, "outcome.pipeline");
-    // The offline "why" walk.
-    assert.deepEqual(rec.provenance.chain, ["pipeline", "revenue"]);
-    assert.equal(rec.provenance.pillar, "revenue");
-    assert.equal(rec.provenance.clause, "cs_12");
-    assert.equal(rec.provenance.adoptedBy, "mem_boss");
-
-    assert.equal(lines(root).length, 1);
-    assert.equal(lines(root)[0].provenance.clause, "cs_12");
-  } finally { cleanup(root); }
-});
-
-test("the ledger is append-only and read back oldest-first", () => {
-  const root = makeRoot();
-  try {
-    for (const d of ["measured", "gap", "candidate_admitted"]) {
-      recordDecision(root, { decision: d, objectiveKey: "pipeline" }, { now: () => NOW, mandate: MANDATE });
-    }
-    const all = readAudit(root);
-    assert.deepEqual(all.map((a) => a.decision), ["measured", "gap", "candidate_admitted"]);
-    assert.equal(readAudit(root, { decision: "gap" }).length, 1);
-    assert.equal(readAudit(root, { objectiveKey: "pipeline" }).length, 3);
-    assert.equal(readAudit(root, { objectiveKey: "nope" }).length, 0);
-    assert.equal(readAudit(root, { limit: 2 }).length, 2);
-  } finally { cleanup(root); }
-});
-
-test("an UNRECOGNISED decision kind is recorded anyway, with a warning", () => {
-  const root = makeRoot();
-  try {
-    const logs = [];
-    recordDecision(root, { decision: "invented_kind" }, { now: () => NOW, log: (l, m) => logs.push(`${l}:${m}`) });
-    // Recorded — dropping it would be the silent failure.
-    assert.equal(lines(root).length, 1);
-    assert.equal(lines(root)[0].decision, "invented_kind");
-    // …but loudly.
-    assert.ok(logs.some((l) => l.startsWith("warn:") && /unrecognised decision kind/.test(l)));
-  } finally { cleanup(root); }
-});
-
-test("a decision with no objective still records — provenance is optional, the line is not", () => {
-  const root = makeRoot();
-  try {
-    recordDecision(root, { decision: "drift", detail: { kind: "mandate_stale" } }, { now: () => NOW });
-    const [rec] = lines(root);
-    assert.equal(rec.objectiveKey, null);
-    assert.equal(rec.provenance, undefined);
-    assert.equal(rec.detail.kind, "mandate_stale");
-  } finally { cleanup(root); }
-});
-
-test("readAudit tolerates a malformed line rather than losing the whole ledger", () => {
-  const root = makeRoot();
-  try {
-    recordDecision(root, { decision: "gap", objectiveKey: "pipeline" }, { now: () => NOW, mandate: MANDATE });
-    // Simulate a torn write.
-    const p = auditPath(root);
-    const body = readFileSync(p, "utf-8");
-    writeFileSync(p, body + "{ this is not json\n");
-    recordDecision(root, { decision: "measured", objectiveKey: "pipeline" }, { now: () => NOW, mandate: MANDATE });
-    const all = readAudit(root);
-    assert.equal(all.length, 2, "the readable lines must survive one corrupt line");
-  } finally { cleanup(root); }
-});
-
-test("an unwritable ledger logs and returns — it never throws into the agent loop", () => {
-  const logs = [];
-  // A path that cannot be created.
-  const rec = recordDecision("/proc/nonexistent-root-xyz", { decision: "gap" }, {
-    now: () => NOW,
-    log: (l, m) => logs.push(`${l}:${m}`),
-  });
-  assert.equal(rec.decision, "gap", "the caller still gets its record back");
-  assert.ok(logs.some((l) => l.startsWith("error:")), "an unwritable ledger must be reported");
-});
-
-test("a FAILING org mirror never costs the local line, and is logged", async () => {
-  const root = makeRoot();
-  try {
-    const logs = [];
-    recordDecision(root, { decision: "gap", objectiveKey: "pipeline" }, {
-      now: () => NOW, mandate: MANDATE,
-      mirror: () => { throw new Error("ECONNREFUSED"); },
-      log: (l, m) => logs.push(`${l}:${m}`),
-    });
-    assert.equal(lines(root).length, 1, "the local line is intact even when hq is unreachable");
-    assert.ok(logs.some((l) => /mirror threw/.test(l)));
-
-    // …and the async rejection path too.
-    recordDecision(root, { decision: "gap", objectiveKey: "pipeline" }, {
-      now: () => NOW, mandate: MANDATE,
-      mirror: async () => { throw new Error("502"); },
-      log: (l, m) => logs.push(`${l}:${m}`),
-    });
-    await new Promise((r) => setTimeout(r, 10));
-    assert.equal(lines(root).length, 2);
-    assert.ok(logs.some((l) => /mirror failed/.test(l)));
-  } finally { cleanup(root); }
-});
-
-test("provenanceFor and explain answer 'why did the agent do that' offline", () => {
-  const root = makeRoot();
-  try {
-    const prov = provenanceFor(MANDATE, "pipeline");
-    assert.equal(prov.clause, "cs_12");
-    assert.equal(prov.adoptedBy, "mem_boss");
-
-    recordDecision(root, { decision: "candidate_admitted", objectiveKey: "pipeline" }, { now: () => NOW, mandate: MANDATE });
-    recordDecision(root, { decision: "routed", objectiveKey: "pipeline" }, { now: () => NOW, mandate: MANDATE });
-    recordDecision(root, { decision: "gap", objectiveKey: "other" }, { now: () => NOW, mandate: MANDATE });
-
-    const e = explain(root, MANDATE, "pipeline");
-    assert.equal(e.provenance.clause, "cs_12");
-    assert.equal(e.decisions.length, 2, "explain must scope to the objective asked about");
-  } finally { cleanup(root); }
-});
-
-test("an unknown objective key degrades to a null chain, not a throw", () => {
-  const prov = provenanceFor(MANDATE, "does-not-exist");
-  assert.deepEqual(prov.chain, []);
-  assert.equal(prov.clause, null);
-});
-
-test("the ledger path is the documented one", () => {
-  assert.equal(AUDIT_REL, join("state", "mandate", "audit.jsonl"));
-  assert.ok(auditPath("/tmp/x").endsWith(AUDIT_REL));
-  assert.equal(existsSync(join("/tmp/definitely-not-here", AUDIT_REL)), false);
-});

package/lib/mandate/contract.test.mjs

@@ -1,185 +0,0 @@
-/**
- * lib/mandate/contract.test.mjs — the SDK half of THE MANDATE BODY CONTRACT.
- *
- * The break this closes: hq emitted `{memberId, objectives, proposed,
- * generatedAt}` while `compilePlan` read `{objectives, budgetCentsPerPeriod,
- * collaborators, reactsTo}`. Three keys were absent, `Number.isFinite(undefined)`
- * was false, and every obligation in the fleet took a hardcoded 500c allowance
- * against a hardcoded 10000c envelope — with no error, no log and no drift row.
- *
- * The invariant under test, stated once: a MISSING required key is an ERROR (the
- * body cannot be budgeted from); a key that is PRESENT AND NULL is a WARNING (hq
- * looked and had nothing). Nothing anywhere may substitute a number for either.
- */
-
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { existsSync, readFileSync } from "node:fs";
-
-import {
-  MANDATE_BODY_KEYS,
-  MANDATE_CONTRACT_VERSION,
-  MANDATE_REQUIRED_KEYS,
-  assertMandateContract,
-  bodyOf,
-  validateMandateContract,
-} from "./contract.mjs";
-
-/** A well-formed, FUNDED body in exactly the shape hq publishes. */
-function fundedBody(over = {}) {
-  return {
-    contractVersion: 1,
-    memberId: "mem_self",
-    objectives: [
-      { key: "pipeline", state: "active", weight: 3, budgetCentsPerPeriod: 18_750 },
-      { key: "inbox", state: "active", weight: 1, budgetCentsPerPeriod: 6_250 },
-    ],
-    proposed: [],
-    budgetCentsPerPeriod: null,
-    seatBudgetCents: 25_000,
-    budgetPeriod: "monthly",
-    budgetSource: "employee.payBasis.meteredBudget",
-    collaborators: [{ memberId: "mem_boss", role: "REVIEWER", source: "workforceMember.supervisorId" }],
-    reactsTo: [],
-    degradations: [],
-    generatedAt: "2026-08-11T00:00:00.000Z",
-    ...over,
-  };
-}
-
-test("a funded hq body validates clean and is NOT unmetered", () => {
-  const v = validateMandateContract(fundedBody());
-  assert.equal(v.ok, true);
-  assert.deepEqual(v.missing, []);
-  assert.equal(v.contractVersion, MANDATE_CONTRACT_VERSION);
-  assert.equal(v.unmetered, false);
-  assert.equal(v.errors.length, 0);
-});
-
-test("THE ORIGINAL BREAK: the pre-contract body is an ERROR, not a shrug", () => {
-  // Byte-for-byte the shape hq used to send.
-  const legacy = { memberId: "mem_self", objectives: [], proposed: [], generatedAt: "1970-01-01T00:00:00.000Z" };
-  const v = validateMandateContract(legacy);
-  assert.equal(v.ok, false);
-  for (const k of ["budgetCentsPerPeriod", "seatBudgetCents", "collaborators", "reactsTo", "contractVersion"]) {
-    assert.ok(v.missing.includes(k), `missing names ${k}`);
-  }
-  assert.ok(v.errors.some((e) => /PRE-CONTRACT/.test(e)));
-  assert.equal(v.unmetered, true);
-});
-
-test("PRESENT-AND-NULL is a warning, MISSING is an error — the distinction is the point", () => {
-  const unfunded = validateMandateContract(
-    fundedBody({
-      seatBudgetCents: null,
-      budgetPeriod: null,
-      budgetSource: "none",
-      objectives: [{ key: "pipeline", state: "active", weight: 1, budgetCentsPerPeriod: null }],
-      degradations: [{ field: "seatBudgetCents", reason: "no Employee row is linked to this member" }],
-    })
-  );
-  // Well-formed: the body can be trusted. Just genuinely unfunded.
-  assert.equal(unfunded.ok, true);
-  assert.deepEqual(unfunded.missing, []);
-  assert.equal(unfunded.unmetered, true);
-  assert.ok(unfunded.warnings.some((w) => /seatBudgetCents is null/.test(w)));
-  // hq's own stated reason is echoed, so one log line explains the null.
-  assert.ok(unfunded.warnings.some((w) => /hq degradation — seatBudgetCents/.test(w)));
-
-  // Delete the key instead of nulling it and the verdict flips to untrustworthy.
-  const body = fundedBody();
-  delete body.seatBudgetCents;
-  const gone = validateMandateContract(body);
-  assert.equal(gone.ok, false);
-  assert.deepEqual(gone.missing, ["seatBudgetCents"]);
-});
-
-test("apportionment that exceeds the envelope is an ERROR, not a rounding note", () => {
-  const v = validateMandateContract(
-    fundedBody({ objectives: [{ key: "a", budgetCentsPerPeriod: 20_000 }, { key: "b", budgetCentsPerPeriod: 20_000 }] })
-  );
-  assert.equal(v.ok, false);
-  assert.ok(v.errors.some((e) => /apportioned more than it holds/.test(e)));
-});
-
-test("junk in the budget fields is rejected rather than coerced", () => {
-  for (const bad of ["500", NaN, Infinity, -1, {}]) {
-    const v = validateMandateContract(fundedBody({ seatBudgetCents: bad }));
-    assert.equal(v.ok, false, `seatBudgetCents=${String(bad)} must be rejected`);
-  }
-});
-
-test("a non-object body fails closed instead of throwing", () => {
-  for (const bad of [null, undefined, 42, "body", []]) {
-    const v = validateMandateContract(bad);
-    assert.equal(v.ok, false);
-    assert.equal(v.unmetered, true);
-  }
-});
-
-test("a FUTURE contract version warns but still compiles (forward-compat)", () => {
-  const v = validateMandateContract(fundedBody({ contractVersion: MANDATE_CONTRACT_VERSION + 1 }));
-  assert.equal(v.ok, true);
-  assert.ok(v.warnings.some((w) => /upgrade the SDK/.test(w)));
-});
-
-test("bodyOf unwraps a cache record and passes a bare body through", () => {
-  const body = fundedBody();
-  assert.equal(bodyOf({ body, version: 4 }), body);
-  assert.equal(bodyOf(body), body);
-  assert.equal(bodyOf(null), null);
-  // The cache record shape must validate identically to the bare body.
-  assert.equal(validateMandateContract({ body, version: 4 }).ok, true);
-});
-
-test("assertMandateContract LOGS every error and warning — silence is the bug", () => {
-  const lines = [];
-  const v = assertMandateContract({ memberId: "m" }, (level, msg) => lines.push([level, msg]), "compilePlan");
-  assert.equal(v.ok, false);
-  assert.ok(lines.some(([l]) => l === "error"), "the violation is logged at error");
-  assert.ok(lines.every(([, m]) => m.includes("[compilePlan]")), "every line is tagged with its call site");
-  // It must never throw, whatever it is handed — it runs inside the daemon.
-  assert.doesNotThrow(() => assertMandateContract(undefined));
-  assert.doesNotThrow(() => assertMandateContract({}, "not a function"));
-});
-
-// ---------------------------------------------------------------------------
-// THE CROSS-REPO DRIFT ALARM
-// ---------------------------------------------------------------------------
-
-test("the key lists match hq's _contract.ts literal for literal", { skip: hqContractPath() ? false : "hq checkout not present" }, () => {
-  // The two repos cannot import each other, so the contract is written down
-  // twice — and a shape written down twice drifts unless something compares
-  // them. This reads hq's TypeScript source and diffs the literals. It is the
-  // single mechanical reason this joint cannot silently reopen.
-  const src = readFileSync(hqContractPath(), "utf8");
-
-  const arrayLiteral = (name) => {
-    const m = src.match(new RegExp(`export const ${name} = \\[([^\\]]*)\\]`));
-    assert.ok(m, `hq's _contract.ts declares ${name}`);
-    return m[1].split(",").map((s) => s.trim().replace(/^["']|["']$/g, "")).filter(Boolean);
-  };
-
-  assert.deepEqual(arrayLiteral("MANDATE_BODY_KEYS"), [...MANDATE_BODY_KEYS], "MANDATE_BODY_KEYS drifted between the repos");
-  assert.deepEqual(arrayLiteral("MANDATE_REQUIRED_KEYS"), [...MANDATE_REQUIRED_KEYS], "MANDATE_REQUIRED_KEYS drifted between the repos");
-
-  const ver = src.match(/export const MANDATE_CONTRACT_VERSION = (\d+)/);
-  assert.ok(ver, "hq declares MANDATE_CONTRACT_VERSION");
-  assert.equal(Number(ver[1]), MANDATE_CONTRACT_VERSION, "the contract VERSION drifted between the repos");
-});
-
-/** hq's contract file, when this checkout sits beside one. */
-function hqContractPath() {
-  const p = `${process.env.HOME}/hq/src/server/methods/mandate/_contract.ts`;
-  return existsSync(p) ? p : null;
-}
-
-test("the required keys are a SUBSET of the body keys (an unreadable key cannot be required)", () => {
-  for (const k of MANDATE_REQUIRED_KEYS) {
-    assert.ok(MANDATE_BODY_KEYS.includes(k), `${k} is required but not in MANDATE_BODY_KEYS`);
-  }
-  assert.deepEqual([...MANDATE_BODY_KEYS], [...MANDATE_BODY_KEYS].slice().sort(), "MANDATE_BODY_KEYS must stay sorted");
-  assert.deepEqual([...MANDATE_REQUIRED_KEYS], [...MANDATE_REQUIRED_KEYS].slice().sort(), "MANDATE_REQUIRED_KEYS must stay sorted");
-});