@cohortapp/agent-sdk 2.17.0 → 2.18.5

package/lib/org/engagement.test.mjs

@@ -1,739 +0,0 @@
-/**
- * engagement.test.mjs — the judgement, proved against fakes.
- *
- * The interesting assertions here are not "does it send" but "does it decline,
- * and can it say why". Each scenario prints the decision + reason so the
- * threshold is inspectable rather than merely asserted.
- *
- * Run: node --test lib/org/engagement.test.mjs
- */
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-
-import {
-  evaluateTriggers,
-  resolveTargets,
-  chooseSurface,
-  composeAsk,
-  decideEngagement,
-  runEngagement,
-} from "./engagement.mjs";
-import { dedupeKeyFor, checkGuardrails, DEFAULT_LIMITS } from "./engagement-ledger.mjs";
-
-const NOW = Date.parse("2026-08-13T12:00:00.000Z");
-const HOUR = 3600_000;
-
-// ── the fake org ─────────────────────────────────────────────────────────────
-const ME = "M-ISLA";
-const DIRECTORY = [
-  { id: ME, displayName: "Isla", roleTitle: "Chief of Staff", status: "active", supervisorId: "M-CEO" },
-  { id: "M-CEO", displayName: "Dana", roleTitle: "Chief Executive Officer", status: "active" },
-  {
-    id: "M-SEC",
-    displayName: "Priya",
-    roleTitle: "Head of Security Engineering",
-    teamName: "Platform Security",
-    status: "active",
-    owns: ["production credentials", "security review"],
-  },
-  {
-    id: "M-FIN",
-    displayName: "Tomas",
-    roleTitle: "Finance Controller",
-    teamName: "Finance",
-    status: "active",
-    escalationPath: "procurement and vendor spend",
-  },
-  { id: "M-DES", displayName: "Ana", roleTitle: "Design Lead", teamName: "Design", status: "active" },
-  { id: "M-GONE", displayName: "Former", roleTitle: "Head of Security Engineering", status: "archived" },
-];
-const CHANNELS = [
-  { id: "C-DM-CEO", kind: "DM", name: "Dana", memberIds: [ME, "M-CEO"] },
-  { id: "C-PLATFORM", kind: "PRIVATE", name: "platform", memberIds: [ME, "M-SEC", "M-CEO", "M-DES", "M-FIN"] },
-  { id: "C-SECOPS", kind: "PRIVATE", name: "sec-ops", memberIds: [ME, "M-SEC", "M-FIN"] },
-];
-const CTX = { me: ME, directory: DIRECTORY, channels: CHANNELS, ledger: [], nowMs: NOW };
-
-/** Print the decision so a human reading test output can audit the judgement. */
-function show(label, d) {
-  const head = d.engage
-    ? `ENGAGE → ${d.surface} → ${d.targets.map((t) => `${t.name}[${t.rung}]`).join(", ")}`
-    : `NOBODY (${d.reasonCode})`;
-  console.log(`\n── ${label}\n   ${head}\n   reason: ${d.reason}`);
-  for (const w of d.why) console.log(`   · ${w}`);
-}
-
-// ═══════════════════════════════════════════════════════════════════════════
-// SCENARIO 1 — blocked on someone else's decision
-// ═══════════════════════════════════════════════════════════════════════════
-
-test("blocked on another party's decision → engages the owner, by name, in the cheapest room", () => {
-  const work = {
-    id: "W-1",
-    title: "Rotate the production API credentials",
-    summary: "The rotation script is ready but the new key has to be minted by whoever holds prod credentials.",
-    scope: "production credentials",
-    state: "blocked",
-    blocker: { kind: "access", scope: "production credentials", detail: "I cannot mint a prod key myself" },
-    selfServeExhausted: true,
-    tried: ["read the runbook", "checked the vault for an existing key", "confirmed the rotation script is green in staging"],
-    origin: { channelId: "C-DM-CEO", threadRootId: "T-9", requesterId: "M-CEO" },
-    question: "Can you mint the replacement key, or should I raise a ticket with whoever can?",
-  };
-  const d = decideEngagement(work, CTX);
-  show("S1 blocked on someone else's decision", d);
-
-  assert.equal(d.engage, true);
-  assert.equal(d.trigger, "blocked_on_other");
-  assert.deepEqual(d.targets.map((t) => t.memberId), ["M-SEC"]);
-  assert.equal(d.targets[0].rung, "ownership", "resolved by directory ownership, not a keyword coincidence");
-  // The origin room is a DM with the CEO — it does NOT hold Priya, so replying
-  // in place would not reach her.
-  assert.equal(d.surface, "dm");
-  assert.deepEqual(d.mentions, [{ memberId: "M-SEC" }]);
-  assert.match(d.body, /Blocked:/);
-  assert.match(d.body, /already tried/);
-  assert.match(d.body, /mint the replacement key/);
-  // Never routed to the archived seat with the same job title.
-  assert.ok(!d.targets.some((t) => t.memberId === "M-GONE"));
-});
-
-test("the SAME blocker, when the agent has not exhausted self-serve, engages nobody and says so", () => {
-  const work = {
-    id: "W-1b",
-    title: "Rotate the production API credentials",
-    scope: "production credentials",
-    state: "blocked",
-    blocker: { kind: "access", scope: "production credentials" },
-    selfServeExhausted: false,
-  };
-  const d = decideEngagement(work, CTX);
-  show("S1b blocked, but self-serve not exhausted", d);
-  assert.equal(d.engage, false);
-  assert.equal(d.reasonCode, "self_serve_available");
-  assert.match(d.reason, /outsourcing|own next step/);
-});
-
-test('a "capacity" blocker is the agent\'s own problem, not a reason to interrupt anyone', () => {
-  const d = decideEngagement(
-    { id: "W-1c", title: "Catch up on the backlog", state: "blocked", blocker: { kind: "capacity" }, selfServeExhausted: true },
-    CTX,
-  );
-  show("S1c blocked on own capacity", d);
-  assert.equal(d.engage, false);
-  assert.equal(d.reasonCode, "blocker_is_mine");
-});
-
-// ═══════════════════════════════════════════════════════════════════════════
-// SCENARIO 2 — needs a reviewer
-// ═══════════════════════════════════════════════════════════════════════════
-
-test("mandatory review → the named reviewer, explicitly, in the room that already holds them", () => {
-  const work = {
-    id: "W-2",
-    title: "New vendor DPA before signature",
-    summary: "The agreement is drafted and needs security sign-off before it goes back to the vendor.",
-    scope: "security review",
-    state: "in_progress",
-    review: { required: true, kind: "security", reviewerId: "M-SEC" },
-    origin: { channelId: "C-SECOPS" },
-  };
-  const d = decideEngagement(work, CTX);
-  show("S2 needs a reviewer", d);
-
-  assert.equal(d.engage, true);
-  assert.equal(d.trigger, "mandatory_review");
-  assert.deepEqual(d.targets.map((t) => t.memberId), ["M-SEC"]);
-  assert.equal(d.targets[0].rung, "explicit");
-  // sec-ops already holds Priya and me → reply in place beats opening a DM.
-  assert.equal(d.surface, "reply_in_place");
-  assert.equal(d.channelId, "C-SECOPS");
-  assert.match(d.body, /Ready for review/);
-});
-
-test("a review that is WANTED but not REQUIRED is not a precondition — nobody is engaged", () => {
-  const d = decideEngagement(
-    { id: "W-2b", title: "Vendor DPA", state: "in_progress", review: { required: false, requested: true } },
-    CTX,
-  );
-  show("S2b review optional", d);
-  assert.equal(d.engage, false);
-  assert.equal(d.reasonCode, "review_optional");
-});
-
-// ═══════════════════════════════════════════════════════════════════════════
-// SCENARIO 3 — purely self-contained
-// ═══════════════════════════════════════════════════════════════════════════
-
-test("self-contained work engages nobody, and the interested parties are recorded as declined", () => {
-  const work = {
-    id: "W-3",
-    title: "Refresh the weekly metrics digest",
-    state: "in_progress",
-    interestedParties: ["M-CEO", "M-DES"],
-  };
-  const d = decideEngagement(work, CTX);
-  show("S3 self-contained", d);
-
-  assert.equal(d.engage, false);
-  assert.equal(d.reasonCode, "self_contained");
-  assert.deepEqual(d.consideredNotEngaged, ["M-CEO", "M-DES"]);
-  assert.ok(
-    d.why.some((w) => /considered and NOT messaged/.test(w)),
-    "the FYI class must be recorded as a decision, not omitted",
-  );
-});
-
-// ═══════════════════════════════════════════════════════════════════════════
-// SCENARIO 4 — irreversible / external, needing several people at once
-// ═══════════════════════════════════════════════════════════════════════════
-
-test("an irreversible external spend outranks everything else and gathers the deciders in one room", () => {
-  const work = {
-    id: "W-4",
-    title: "Sign the annual vendor contract",
-    summary: "Ready to counter-sign. It is a 12-month commitment and cannot be unwound.",
-    scope: "procurement and vendor spend",
-    state: "blocked",
-    blocker: { kind: "decision", scope: "procurement", ownerId: "M-FIN" },
-    selfServeExhausted: true,
-    approverId: "M-CEO",
-    risk: { irreversible: true, external: true, financial: true },
-    question: "Do I counter-sign today, or hold for the legal read?",
-    options: ["Counter-sign today", "Hold for legal"],
-  };
-  const d = decideEngagement(work, CTX);
-  show("S4 irreversible + external + financial", d);
-
-  assert.equal(d.engage, true);
-  assert.equal(d.trigger, "irreversible_or_external", "the unsafe-act trigger outranks the blockage");
-  assert.deepEqual(d.targets.map((t) => t.memberId).sort(), ["M-CEO", "M-FIN"]);
-  // Both are in sec-ops? No — sec-ops holds M-SEC and M-FIN. `platform` holds
-  // both deciders, so it wins over creating a room.
-  assert.equal(d.surface, "existing_channel");
-  assert.equal(d.channelId, "C-PLATFORM");
-  assert.deepEqual(d.mentions.map((m) => m.memberId).sort(), ["M-CEO", "M-FIN"]);
-  assert.match(d.body, /can't be undone/);
-  assert.match(d.body, /Counter-sign today/);
-});
-
-test("the same two deciders with NO room holding both → a new room, and it says why", () => {
-  const d = decideEngagement(
-    {
-      id: "W-4b",
-      title: "Sign the annual vendor contract",
-      scope: "procurement",
-      state: "in_progress",
-      blocker: { kind: "decision", ownerId: "M-FIN" },
-      approverId: "M-CEO",
-      risk: { irreversible: true },
-    },
-    { ...CTX, channels: [{ id: "C-DM-CEO", kind: "DM", memberIds: [ME, "M-CEO"] }] },
-  );
-  show("S4b no room holds both deciders", d);
-  assert.equal(d.surface, "new_room");
-  assert.ok(d.why.some((w) => /must act together and no room already holds them/.test(w)));
-});
-
-test("an irreversible act that is ALREADY DONE asks nobody — consent after the fact is theatre", () => {
-  const d = decideEngagement(
-    { id: "W-4c", title: "Contract signed", state: "done", risk: { irreversible: true, external: true } },
-    CTX,
-  );
-  show("S4c irreversible but already done", d);
-  assert.equal(d.engage, false);
-  assert.equal(d.reasonCode, "act_already_taken");
-});
-
-// ═══════════════════════════════════════════════════════════════════════════
-// SCENARIO 5 — the owner's actual complaint: a run failed and nobody was told
-// ═══════════════════════════════════════════════════════════════════════════
-
-test("a failed run tells the person who asked, in their own thread, without being chased", () => {
-  const work = {
-    id: "W-5",
-    title: "Fix the issues you flagged and push",
-    summary: "The session ran for 45 minutes and was killed before it pushed.",
-    state: "failed",
-    blocker: { kind: "information", detail: "the session timed out mid-push" },
-    selfServeExhausted: true,
-    commitment: { toMemberId: "M-CEO", atRisk: true },
-    origin: { channelId: "C-DM-CEO", threadRootId: "T-42", requesterId: "M-CEO" },
-    tried: ["ran the fix session twice", "second run hit the 45-minute cap"],
-  };
-  const d = decideEngagement(work, CTX);
-  show("S5 run failed, requester waiting", d);
-
-  assert.equal(d.engage, true);
-  assert.deepEqual(d.targets.map((t) => t.memberId), ["M-CEO"]);
-  assert.equal(d.targets[0].rung, "explicit");
-  assert.equal(d.surface, "reply_in_place");
-  assert.equal(d.channelId, "C-DM-CEO");
-  assert.equal(d.threadRootId, "T-42");
-});
-
-// ═══════════════════════════════════════════════════════════════════════════
-// SCENARIO 6 — nobody owns it
-// ═══════════════════════════════════════════════════════════════════════════
-
-test("a real blocker with no owner and no supervisor is UNROUTABLE — loud, never a quiet no", () => {
-  const d = decideEngagement(
-    {
-      id: "W-6",
-      title: "Renew the zygomorphic telemetry licence",
-      scope: "zygomorphic telemetry licence",
-      state: "blocked",
-      blocker: { kind: "decision", scope: "zygomorphic telemetry licence" },
-      selfServeExhausted: true,
-    },
-    { ...CTX, directory: DIRECTORY.filter((m) => m.id !== ME) }, // no self row ⇒ no supervisor edge
-  );
-  show("S6 nobody owns it", d);
-  assert.equal(d.engage, false);
-  assert.equal(d.reasonCode, "unroutable");
-  assert.ok(d.degraded.includes("engagement_unroutable"), "an unroutable blocker is a degradation the operator must see");
-  assert.match(d.reason, /org gap, not a quiet no/);
-});
-
-test("with a supervisor edge, an unowned blocker goes UP the line rather than sideways to a guess", () => {
-  const d = decideEngagement(
-    {
-      id: "W-6b",
-      title: "Renew the zygomorphic telemetry licence",
-      scope: "zygomorphic telemetry licence",
-      state: "blocked",
-      blocker: { kind: "decision" },
-      selfServeExhausted: true,
-    },
-    CTX,
-  );
-  show("S6b unowned, but a supervisor exists", d);
-  assert.equal(d.engage, true);
-  assert.deepEqual(d.targets.map((t) => t.memberId), ["M-CEO"]);
-  assert.equal(d.targets[0].rung, "supervisory");
-});
-
-// ═══════════════════════════════════════════════════════════════════════════
-// The WHO ladder, in isolation
-// ═══════════════════════════════════════════════════════════════════════════
-
-test("expertise needs two token hits or one substantial one — a single short word is a coincidence", () => {
-  // "ops" alone must not select anybody on EXPERTISE. It falls through to the
-  // escalation path instead, which is the honest answer: we do not know who owns
-  // this, so it goes up rather than to whoever's job title happened to rhyme.
-  const weak = resolveTargets({ work: { title: "ops" }, trigger: { scope: "ops" }, directory: DIRECTORY, me: ME });
-  assert.ok(
-    weak.targets.every((t) => t.rung !== "expertise"),
-    "one 3-letter token is not evidence of expertise",
-  );
-  assert.deepEqual(weak.targets.map((t) => t.rung), ["supervisory"]);
-
-  const strong = resolveTargets({
-    work: {},
-    trigger: { scope: "design system typography" },
-    directory: DIRECTORY,
-    me: ME,
-  });
-  assert.deepEqual(strong.targets.map((t) => t.memberId), ["M-DES"]);
-  assert.equal(strong.targets[0].rung, "expertise");
-  assert.match(strong.targets[0].why, /"design"/);
-});
-
-test("an archived seat is never engaged — the ask goes up the line instead, and the skip is recorded", () => {
-  const r = resolveTargets({ work: {}, trigger: { ownerId: "M-GONE" }, directory: DIRECTORY, me: ME });
-  assert.ok(!r.targets.some((t) => t.memberId === "M-GONE"), "a DM to an archived seat is a message to a void");
-  assert.ok(r.why.some((w) => /M-GONE.*not an engageable seat/.test(w)));
-  // Falling silent because the named owner left is the failure being fixed.
-  assert.deepEqual(r.targets.map((t) => [t.memberId, t.rung]), [["M-CEO", "supervisory"]]);
-});
-
-test("no more than three people are ever named on one ask", () => {
-  const many = Array.from({ length: 9 }, (_, i) => ({
-    id: `M-X${i}`,
-    displayName: `X${i}`,
-    roleTitle: "Platform Security Engineering",
-    status: "active",
-  }));
-  const r = resolveTargets({
-    work: {},
-    trigger: { scope: "platform security engineering" },
-    directory: many,
-    me: ME,
-  });
-  assert.equal(r.targets.length, 3, "beyond three you have called a meeting, not asked a question");
-});
-
-// ═══════════════════════════════════════════════════════════════════════════
-// GUARDRAILS
-// ═══════════════════════════════════════════════════════════════════════════
-
-test("the same ask to the same people is not repeated while it is outstanding", () => {
-  const first = decideEngagement(
-    {
-      id: "W-7",
-      title: "Mint a prod key",
-      scope: "production credentials",
-      state: "blocked",
-      blocker: { kind: "access", scope: "production credentials" },
-      selfServeExhausted: true,
-    },
-    CTX,
-  );
-  assert.equal(first.engage, true);
-
-  const ledger = [
-    { atMs: NOW - 30 * 60_000, workId: "W-7", dedupeKey: first.dedupeKey, engaged: true, targets: ["M-SEC"], outcome: "engaged" },
-  ];
-  const second = decideEngagement(
-    {
-      id: "W-7",
-      title: "Mint a prod key — asking again",
-      scope: "production credentials",
-      state: "blocked",
-      blocker: { kind: "access", scope: "production credentials" },
-      selfServeExhausted: true,
-    },
-    { ...CTX, ledger },
-  );
-  show("S7 duplicate ask, 30 minutes later", second);
-  assert.equal(second.engage, false);
-  assert.equal(second.reasonCode, "already_engaged");
-  assert.match(second.reason, /30m ago/);
-});
-
-test("dedupe keys on the IDENTITY of the ask, not on its wording", () => {
-  const a = dedupeKeyFor({ workId: "W-9", reasonCode: "blocked:access", targets: ["M-SEC", "M-FIN"] });
-  const b = dedupeKeyFor({ workId: "W-9", reasonCode: "blocked:access", targets: ["M-FIN", "M-SEC"] });
-  const c = dedupeKeyFor({ workId: "W-9", reasonCode: "blocked:decision", targets: ["M-SEC", "M-FIN"] });
-  assert.equal(a, b, "target order must not change the identity");
-  assert.notEqual(a, c, "a different reason is a different ask");
-});
-
-test("an ANSWERED ask may be raised again — an answer supersedes, it does not dedupe", () => {
-  const key = dedupeKeyFor({ workId: "W-8", reasonCode: "blocked:access", targets: ["M-SEC"] });
-  const g = checkGuardrails({
-    rows: [
-      { atMs: NOW - 20 * 60_000, dedupeKey: key, engaged: true, targets: ["M-SEC"], workId: "W-8" },
-      { atMs: NOW - 10 * 60_000, dedupeKey: key, outcome: "resolved", engaged: false, targets: [] },
-    ],
-    nowMs: NOW,
-    dedupeKey: key,
-    workId: "W-8",
-    targets: ["M-SEC"],
-  });
-  assert.equal(g.allowed, true);
-});
-
-test("per-person, per-work, global and room caps each bind, and each names itself", () => {
-  const sent = (n, over) =>
-    Array.from({ length: n }, (_, i) => ({ atMs: NOW - (i + 1) * 60_000, engaged: true, targets: ["M-SEC"], workId: "W-A", ...over }));
-
-  const perTarget = checkGuardrails({ rows: sent(3), nowMs: NOW, dedupeKey: "k1", workId: "W-B", targets: ["M-SEC"] });
-  assert.equal(perTarget.allowed, false);
-  assert.equal(perTarget.code, "rate_limited_target");
-
-  const perWork = checkGuardrails({
-    rows: sent(5, { targets: ["M-CEO"] }),
-    nowMs: NOW,
-    dedupeKey: "k2",
-    workId: "W-A",
-    targets: ["M-DES"],
-  });
-  assert.equal(perWork.allowed, false);
-  assert.equal(perWork.code, "rate_limited_work");
-  assert.match(perWork.detail, /mis-specified, not blocked/);
-
-  const global = checkGuardrails({
-    rows: Array.from({ length: 10 }, (_, i) => ({ atMs: NOW - i * 60_000, engaged: true, targets: [`M-${i}`], workId: `W-${i}` })),
-    nowMs: NOW,
-    dedupeKey: "k3",
-    workId: "W-NEW",
-    targets: ["M-DES"],
-  });
-  assert.equal(global.allowed, false);
-  assert.equal(global.code, "rate_limited_global");
-
-  const rooms = checkGuardrails({
-    rows: [
-      { atMs: NOW - HOUR, engaged: true, roomCreated: true, targets: ["M-A"], workId: "W-R1" },
-      { atMs: NOW - 2 * HOUR, engaged: true, roomCreated: true, targets: ["M-B"], workId: "W-R2" },
-    ],
-    nowMs: NOW,
-    dedupeKey: "k4",
-    workId: "W-R3",
-    targets: ["M-DES"],
-    createsRoom: true,
-  });
-  assert.equal(rooms.allowed, false);
-  assert.equal(rooms.code, "rate_limited_rooms");
-
-  // ...and the same history does NOT block an engagement that reuses a room.
-  const reuse = checkGuardrails({ ...{ rows: rooms.counts ? [] : [] }, nowMs: NOW, dedupeKey: "k5", workId: "W-R4", targets: ["M-DES"] });
-  assert.equal(reuse.allowed, true);
-});
-
-test("a duplicate is reported as a duplicate, not as a rate limit", () => {
-  const key = "dup-key";
-  const rows = Array.from({ length: 9 }, (_, i) => ({ atMs: NOW - i * 60_000, engaged: true, targets: ["M-SEC"], workId: "W-Z" }));
-  rows.push({ atMs: NOW - 60_000, engaged: true, dedupeKey: key, targets: ["M-SEC"], workId: "W-Z" });
-  const g = checkGuardrails({ rows, nowMs: NOW, dedupeKey: key, workId: "W-Z", targets: ["M-SEC"] });
-  assert.equal(g.code, "already_engaged", "duplicate is the better explanation and must not burn a rate slot");
-});
-
-// ═══════════════════════════════════════════════════════════════════════════
-// EXECUTION — surfaces, the send-gate, and the ledger
-// ═══════════════════════════════════════════════════════════════════════════
-
-function fakeMessaging() {
-  const calls = [];
-  return {
-    calls,
-    openDm: async (p) => { calls.push(["openDm", p]); return { ok: true, channelId: `C-DM-${p.memberId}`, created: false, frame: { ok: true } }; },
-    openConversation: async (p) => { calls.push(["openConversation", p]); return { ok: true, channelId: "C-NEW", created: true, frame: { ok: true } }; },
-    createChannel: async (p) => { calls.push(["createChannel", p]); return { ok: true, channelId: "C-CHAN", created: true, frame: { ok: true } }; },
-    sendMessage: async (p) => { calls.push(["sendMessage", p]); return { ok: true, result: { id: "msg-1" } }; },
-  };
-}
-
-test("a DM engagement opens the room, tags the person, and lands one ledger row", async (t) => {
-  const dir = t.mock.method(console, "log", () => {});
-  const rows = [];
-  const messaging = fakeMessaging();
-  const d = decideEngagement(
-    {
-      id: "W-10",
-      title: "Mint a prod key",
-      scope: "production credentials",
-      state: "blocked",
-      blocker: { kind: "access", scope: "production credentials" },
-      selfServeExhausted: true,
-    },
-    CTX,
-  );
-  dir.mock.restore();
-
-  const path = `${process.env.TMPDIR || "/tmp"}/engagement-test-${process.pid}-${Date.now()}.jsonl`;
-  const res = await runEngagement(d, { deps: { messaging }, ledgerPath: path, nowMs: NOW, agentRoot: "/tmp" });
-
-  assert.equal(res.ok, true);
-  assert.equal(res.engaged, true);
-  assert.equal(res.channelId, "C-DM-M-SEC");
-  assert.deepEqual(messaging.calls[0], ["openDm", { memberId: "M-SEC" }]);
-  const send = messaging.calls[1][1];
-  assert.deepEqual(send.mentions, [{ memberId: "M-SEC" }]);
-  assert.equal(send.idempotencyId, `engage-${d.dedupeKey}-1`, "a retried engagement dedupes server-side");
-
-  const { loadEngagements } = await import("./engagement-ledger.mjs");
-  const led = loadEngagements({ path });
-  assert.equal(led.rows.length, 1);
-  assert.equal(led.rows[0].outcome, "engaged");
-  assert.equal(led.rows[0].engaged, true);
-  assert.deepEqual(led.rows[0].targets, ["M-SEC"]);
-  void rows;
-});
-
-test("a send-gate refusal is recorded as send_blocked — never a silent no-op", async () => {
-  const messaging = fakeMessaging();
-  messaging.sendMessage = async () => ({ ok: false, blocked: true, error: { code: "FORBIDDEN_SCOPE", message: "banned phrase" } });
-  const d = decideEngagement(
-    { id: "W-11", title: "x", scope: "production credentials", state: "blocked", blocker: { kind: "access", scope: "production credentials" }, selfServeExhausted: true },
-    CTX,
-  );
-  const path = `${process.env.TMPDIR || "/tmp"}/engagement-blocked-${process.pid}-${Date.now()}.jsonl`;
-  const res = await runEngagement(d, { deps: { messaging }, ledgerPath: path, nowMs: NOW });
-
-  assert.equal(res.ok, false);
-  assert.equal(res.outcome, "send_blocked");
-  assert.match(res.error, /banned phrase/);
-  const { loadEngagements } = await import("./engagement-ledger.mjs");
-  assert.equal(loadEngagements({ path }).rows[0].outcome, "send_blocked");
-});
-
-test("a decision to engage NOBODY is still written to the ledger", async () => {
-  const d = decideEngagement({ id: "W-12", title: "Routine digest", state: "in_progress" }, CTX);
-  const path = `${process.env.TMPDIR || "/tmp"}/engagement-none-${process.pid}-${Date.now()}.jsonl`;
-  const res = await runEngagement(d, { deps: { messaging: fakeMessaging() }, ledgerPath: path, nowMs: NOW });
-
-  assert.equal(res.engaged, false);
-  assert.equal(res.ok, true, "declining to engage is a success, not a failure");
-  const { loadEngagements } = await import("./engagement-ledger.mjs");
-  const row = loadEngagements({ path }).rows[0];
-  assert.equal(row.engaged, false);
-  assert.equal(row.reasonCode, "self_contained");
-  assert.ok(row.why.length, "the reasoning travels with the row");
-});
-
-test("a durable multi-party engagement creates a named channel; an ad-hoc one creates a group DM", async () => {
-  const base = {
-    id: "W-13",
-    title: "Vendor contract",
-    scope: "procurement",
-    state: "in_progress",
-    blocker: { kind: "decision", ownerId: "M-FIN" },
-    approverId: "M-CEO",
-    risk: { irreversible: true },
-  };
-  const ctx = { ...CTX, channels: [] };
-
-  const adhoc = fakeMessaging();
-  await runEngagement(decideEngagement(base, ctx), { deps: { messaging: adhoc }, ledgerPath: `${process.env.TMPDIR || "/tmp"}/e-a-${Date.now()}.jsonl`, nowMs: NOW });
-  assert.equal(adhoc.calls[0][0], "openConversation");
-
-  const durable = fakeMessaging();
-  await runEngagement(decideEngagement({ ...base, durable: true }, ctx), { deps: { messaging: durable }, ledgerPath: `${process.env.TMPDIR || "/tmp"}/e-d-${Date.now()}.jsonl`, nowMs: NOW });
-  assert.equal(durable.calls[0][0], "createChannel");
-  assert.match(durable.calls[0][1].slug, /^[a-z0-9][a-z0-9-]*$/, "hq's slug grammar or the call 400s");
-});
-
-// ═══════════════════════════════════════════════════════════════════════════
-// Units
-// ═══════════════════════════════════════════════════════════════════════════
-
-test("evaluateTriggers ranks by the cost of NOT engaging", () => {
-  const { fired } = evaluateTriggers({
-    state: "blocked",
-    blocker: { kind: "decision" },
-    selfServeExhausted: true,
-    risk: { irreversible: true },
-    review: { required: true },
-    commitment: { toMemberId: "M-CEO", atRisk: true },
-  });
-  assert.deepEqual(fired.map((f) => f.trigger), [
-    "irreversible_or_external",
-    "blocked_on_other",
-    "mandatory_review",
-    "commitment_at_risk",
-  ]);
-});
-
-test("chooseSurface prefers the room the ask came from over anything new", () => {
-  const r = chooseSurface({
-    work: { origin: { channelId: "C-PLATFORM" } },
-    targets: [{ memberId: "M-SEC" }, { memberId: "M-FIN" }],
-    channels: CHANNELS,
-    me: ME,
-  });
-  assert.equal(r.surface, "reply_in_place");
-  assert.equal(r.channelId, "C-PLATFORM");
-});
-
-test("chooseSurface picks the SMALLEST room that holds everyone — fewest bystanders", () => {
-  const r = chooseSurface({
-    work: {},
-    targets: [{ memberId: "M-SEC" }, { memberId: "M-FIN" }],
-    channels: CHANNELS,
-    me: ME,
-  });
-  assert.equal(r.surface, "existing_channel");
-  assert.equal(r.channelId, "C-SECOPS", "sec-ops (3) beats platform (5)");
-});
-
-test("composeAsk is deterministic and needs no model", () => {
-  const work = { title: "T", summary: "S", tried: ["a"], question: "Q?", options: ["one", "two"] };
-  const trigger = { trigger: "blocked_on_other", detail: "D" };
-  const a = composeAsk({ work, trigger, targets: [{ name: "Priya" }] });
-  const b = composeAsk({ work, trigger, targets: [{ name: "Priya" }] });
-  assert.equal(a, b);
-  assert.match(a, /\*\*Blocked:\*\* T/);
-  assert.match(a, /Where it stopped: D/);
-  assert.match(a, /- one\n- two/);
-});
-
-test("the caps are the documented ones", () => {
-  assert.equal(DEFAULT_LIMITS.perTargetPerDay, 3);
-  assert.equal(DEFAULT_LIMITS.perWorkTotal, 5);
-  assert.equal(DEFAULT_LIMITS.globalPerHour, 10);
-  assert.equal(DEFAULT_LIMITS.newRoomsPerDay, 2);
-  assert.equal(DEFAULT_LIMITS.reengageAfterMs, 6 * HOUR);
-});
-
-// ═══════════════════════════════════════════════════════════════════════════
-// Context loading — every leg fails open INDEPENDENTLY and says so
-// ═══════════════════════════════════════════════════════════════════════════
-
-test("loadEngagementContext reads the whole roster and reports each leg that failed", async () => {
-  const { loadEngagementContext } = await import("./engagement.mjs");
-  const seen = [];
-  const fetchImpl = async (url) => {
-    seen.push(String(url));
-    const body = /member\.list/.test(String(url))
-      ? { ok: true, result: { members: [{ id: "M-2", displayName: "Two", status: "ACTIVE" }] } }
-      : { ok: false, error: { code: "INTERNAL", message: "down" } };
-    return { ok: true, status: 200, headers: { get: () => undefined }, json: async () => body };
-  };
-  const ctx = await loadEngagementContext({
-    cfg: { org: { cohort: { enabled: true, base: "https://org.example", token: "t" } } },
-    agentRoot: `${process.env.TMPDIR || "/tmp"}/engctx-${Date.now()}`,
-    me: "M-1",
-    fetchImpl,
-  });
-  assert.equal(ctx.directory.length, 1);
-  // The roster read must NOT filter server-side: hq's status filter takes the
-  // uppercase Prisma enum, and a rejected filter would empty the directory.
-  const memberCall = seen.find((u) => /member\.list/.test(u));
-  assert.ok(memberCall, "the directory was read");
-  assert.deepEqual(ctx.channels, [], "a failed channels read degrades to no rooms");
-  assert.deepEqual(ctx.ledger, []);
-  assert.equal(ctx.degraded.length, 0, "listChannels fails open to [] by contract — no extra noise");
-});
-
-test("an unreadable directory is NOT the same as an empty org", async () => {
-  const { loadEngagementContext } = await import("./engagement.mjs");
-  const ctx = await loadEngagementContext({
-    cfg: { org: { cohort: { enabled: false } } },
-    agentRoot: `${process.env.TMPDIR || "/tmp"}/engctx2-${Date.now()}`,
-    me: "M-1",
-  });
-  assert.deepEqual(ctx.directory, []);
-  assert.ok(
-    ctx.degraded.some((d) => /directory_unavailable/.test(d)),
-    "an empty directory with no degradation would read as 'nobody owns this'",
-  );
-});
-
-test("REGRESSION: the re-ask after the window actually posts, instead of silently colliding with the first", async (t) => {
-  // The dedupe key is timeless on purpose — that is what makes the 6h
-  // `reengageAfterMs` window enforceable. But hq de-dupes a send on
-  // (org, channel, clientMsgId) and returns the EXISTING message verbatim
-  // rather than erroring. Keyed on the ask alone, the re-ask — fired precisely
-  // when silence has begun to look like the agent forgot — posted NOTHING,
-  // while frame.ok came back true and the ledger recorded a delivery. The
-  // outcome was a permanent no-op that every local signal called a success.
-  const dir = t.mock.method(console, "log", () => {});
-  const work = {
-    id: "W-REASK",
-    title: "Mint a prod key",
-    scope: "production credentials",
-    state: "blocked",
-    blocker: { kind: "access", scope: "production credentials" },
-    selfServeExhausted: true,
-  };
-  const path = `${process.env.TMPDIR || "/tmp"}/engagement-reask-${process.pid}-${Date.now()}.jsonl`;
-
-  const first = decideEngagement(work, CTX);
-  const m1 = fakeMessaging();
-  await runEngagement(first, { deps: { messaging: m1 }, ledgerPath: path, nowMs: NOW, agentRoot: "/tmp" });
-
-  // Six hours and a minute later, with the first ask still unanswered.
-  const later = NOW + 6 * HOUR + 60_000;
-  const { loadEngagements } = await import("./engagement-ledger.mjs");
-  const second = decideEngagement(work, {
-    ...CTX,
-    nowMs: later,
-    ledger: loadEngagements({ path }).rows,
-  });
-  dir.mock.restore();
-
-  assert.equal(second.engage, true, "the window has reopened, so the re-ask is allowed");
-  const m2 = fakeMessaging();
-  const res = await runEngagement(second, { deps: { messaging: m2 }, ledgerPath: path, nowMs: later, agentRoot: "/tmp" });
-  assert.equal(res.engaged, true);
-
-  const idFirst = m1.calls.find((c) => c[0] === "sendMessage")[1].idempotencyId;
-  const idSecond = m2.calls.find((c) => c[0] === "sendMessage")[1].idempotencyId;
-  assert.notEqual(idSecond, idFirst, "a re-ask that reuses the first ask's message id posts nothing at all");
-  assert.equal(idFirst, `engage-${first.dedupeKey}-1`);
-  assert.equal(idSecond, `engage-${second.dedupeKey}-2`, "the ordinal advances; the ask identity does not");
-});