@cohortapp/agent-sdk 2.17.0 → 2.18.5

package/lib/org/knowledge.test.mjs

@@ -1,326 +0,0 @@
-/**
- * knowledge.test.mjs — agent-facing shared-memory API over the Cohort knowledge
- * plane. Verifies the verb surface (remember/recall/forget/rewrite + contacts/
- * meetings) routes to the right methods, that the client NEVER filters recall
- * results (the server is authoritative for ACL), that forget invalidates (never
- * deletes), and the fail-open contract when the integration is disabled.
- * Uses an injected fetchImpl — no network.
- * Run: node --test lib/org/knowledge.test.mjs
- */
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-
-import {
-  remember,
-  rewrite,
-  recall,
-  recallDetailed,
-  forget,
-  upsertContact,
-  listContacts,
-  recordMeeting,
-  listMeetings,
-  normalizeGroup,
-  _internals,
-} from "./knowledge.mjs";
-
-const BASE = "https://org.cohortapp.com";
-const CFG = { org: { cohort: { enabled: true, base: BASE, token: "tok" } } };
-const OFF = { org: { cohort: { enabled: false } } };
-
-delete process.env.COHORT_API_TOKEN;
-delete process.env.COHORT_TOKEN;
-
-/** A fake fetch that records calls and returns a canned res frame / payload. */
-function fakeFetch(responder) {
-  const calls = [];
-  const impl = async (url, init) => {
-    calls.push({
-      url,
-      init,
-      method: init && init.method,
-      headers: (init && init.headers) || {},
-      body: init && init.body ? JSON.parse(init.body) : null,
-    });
-    const r = responder ? responder(url, init, calls.length - 1) : null;
-    const status = r && typeof r.status === "number" ? r.status : 200;
-    const ok = r && typeof r.ok === "boolean" ? r.ok : status >= 200 && status < 300;
-    const body = r ? r.body : { ok: true, result: null };
-    return { ok, status, headers: { get: () => undefined }, json: async () => body };
-  };
-  impl.calls = calls;
-  return impl;
-}
-
-// --- normalizeGroup (pure shape helper; NOT an ACL decision) ----------------
-
-test("normalizeGroup: org / unit:<id> / barrier:<cell>; rejects unknown kinds", () => {
-  assert.equal(normalizeGroup("org"), "org");
-  assert.equal(normalizeGroup({ kind: "org" }), "org");
-  assert.equal(normalizeGroup({ kind: "unit", id: "eng" }), "unit:eng");
-  assert.equal(normalizeGroup({ kind: "barrier", cell: "deals-2026" }), "barrier:deals-2026");
-  assert.equal(normalizeGroup("unit:eng"), "unit:eng");
-  assert.equal(normalizeGroup("barrier:deals"), "barrier:deals");
-  // unknown kinds / bare ids fall through to "let the server decide"
-  assert.equal(normalizeGroup("bogus:x"), undefined);
-  assert.equal(normalizeGroup("eng"), undefined);
-  assert.equal(normalizeGroup(""), undefined);
-  assert.equal(normalizeGroup(undefined), undefined);
-});
-
-// --- remember → knowledge.append (default) / knowledge.replace (CAS) ---------
-
-test("remember(string): appends an episode (the sole shared-write primitive)", async () => {
-  const f = fakeFetch(() => ({ body: { ok: true, result: { id: "k-1", version: 1 } } }));
-  const r = await remember("we closed the Q3 deal", { cfg: CFG, group: "org", fetchImpl: f });
-  assert.equal(r.ok, true);
-  assert.equal(r.mode, "append");
-  assert.equal(r.id, "k-1");
-  assert.equal(f.calls[0].url, `${BASE}/api/v1/knowledge.append`);
-  assert.equal(f.calls[0].method, "POST");
-  assert.equal(f.calls[0].headers.authorization, "Bearer tok");
-  // hq's knowledge.append reads `body` (with `text` accepted as an alias); the
-  // wire contract adds the canonical name and keeps the legacy one alongside.
-  assert.deepEqual(f.calls[0].body, { text: "we closed the Q3 deal", body: "we closed the Q3 deal", group: "org" });
-});
-
-test("remember(fact object): pulls through opts (kind/participants/provenance), normalises group", async () => {
-  const f = fakeFetch(() => ({ body: { ok: true, result: { id: "k-2" } } }));
-  await remember(
-    { text: "intro call notes" },
-    { cfg: CFG, group: { kind: "unit", id: "sales" }, kind: "note", participants: ["a", "b"], provenance: { src: "call" }, fetchImpl: f },
-  );
-  // Enrichment hq only persists inside `metadata` is FOLDED there by the wire
-  // contract — flat `kind`/`participants`/`links`/`refs` were silently dropped by
-  // the server on every append before this.
-  assert.deepEqual(f.calls[0].body, {
-    text: "intro call notes",
-    body: "intro call notes",
-    kind: "note",
-    participants: ["a", "b"],
-    provenance: { src: "call" },
-    metadata: { kind: "note", participants: ["a", "b"] },
-    group: "unit:sales",
-  });
-});
-
-test("remember with {id, expectedVersion}: routes to knowledge.replace (CAS)", async () => {
-  const f = fakeFetch(() => ({ body: { ok: true, result: { id: "k-9", version: 4 } } }));
-  const r = await remember({ text: "corrected figure" }, { cfg: CFG, id: "k-9", expectedVersion: 3, fetchImpl: f });
-  assert.equal(r.mode, "replace");
-  assert.equal(f.calls[0].url, `${BASE}/api/v1/knowledge.replace`);
-  assert.equal(f.calls[0].body.id, "k-9");
-  assert.equal(f.calls[0].body.expectedVersion, 3);
-});
-
-test("remember: idempotency key auto-derived from id on append", async () => {
-  const f = fakeFetch(() => ({ body: { ok: true, result: { id: "k-5" } } }));
-  await remember({ id: "k-5", text: "x" }, { cfg: CFG, fetchImpl: f });
-  assert.equal(f.calls[0].headers["x-idempotency-key"], "knowledge.append:k-5");
-});
-
-test("remember: disabled → fail-open skipped, no fetch", async () => {
-  const f = fakeFetch();
-  const r = await remember("x", { cfg: OFF, fetchImpl: f });
-  assert.deepEqual(r, { ok: false, skipped: true });
-  assert.equal(f.calls.length, 0);
-});
-
-test("remember: empty fact → BAD_REQUEST, no fetch", async () => {
-  const f = fakeFetch();
-  const r = await remember("", { cfg: CFG, fetchImpl: f });
-  assert.equal(r.ok, false);
-  assert.equal(r.error.code, "BAD_REQUEST");
-  assert.equal(f.calls.length, 0);
-});
-
-// --- rewrite → knowledge.rewrite (designated-owner-only) --------------------
-
-test("rewrite: routes to knowledge.rewrite with the id + text", async () => {
-  const f = fakeFetch(() => ({ body: { ok: true, result: { id: "k-1" } } }));
-  const r = await rewrite("k-1", "owner-asserted text", { cfg: CFG, fetchImpl: f });
-  assert.equal(r.mode, "rewrite");
-  assert.equal(f.calls[0].url, `${BASE}/api/v1/knowledge.rewrite`);
-  assert.equal(f.calls[0].body.id, "k-1");
-  assert.equal(f.calls[0].body.text, "owner-asserted text");
-});
-
-test("rewrite: non-owner FORBIDDEN_SCOPE surfaces in error (server is authoritative)", async () => {
-  const f = fakeFetch(() => ({ ok: false, status: 403, body: { ok: false, error: { code: "FORBIDDEN_SCOPE", message: "owner only" } } }));
-  const r = await rewrite("k-1", "x", { cfg: CFG, fetchImpl: f });
-  assert.equal(r.ok, false);
-  assert.equal(r.error.code, "FORBIDDEN_SCOPE");
-});
-
-// --- recall → knowledge.search; CLIENT NEVER FILTERS ------------------------
-
-test("remember → recall round-trip: recall returns exactly the server's facts", async () => {
-  // The server is the ONLY ACL authority. recall renders whatever it returns —
-  // here a fact the agent appended comes back from search.
-  const serverFacts = [{ id: "k-1", text: "we closed the Q3 deal", group: "org" }];
-  let appended = false;
-  const f = fakeFetch((url) => {
-    if (url.endsWith("/v1/knowledge.append")) { appended = true; return { body: { ok: true, result: { id: "k-1" } } }; }
-    if (url.endsWith("/v1/knowledge.search")) return { body: { ok: true, result: { facts: serverFacts, returned_ids: ["k-1"], groups_considered: ["org"] } } };
-    return { body: { ok: true, result: null } };
-  });
-  await remember("we closed the Q3 deal", { cfg: CFG, group: "org", fetchImpl: f });
-  assert.equal(appended, true);
-  const facts = await recall("Q3 deal", { cfg: CFG, fetchImpl: f });
-  assert.deepEqual(facts, serverFacts);
-});
-
-test("recall: passes the query (+ group hint, limit) to the server; does NOT filter results", async () => {
-  // Server returns a barrier fact AND an org fact. The client must NOT drop the
-  // barrier one — if the server returned it, the agent was granted that cell.
-  const returned = [
-    { id: "k-1", group: "org", text: "public" },
-    { id: "k-2", group: "barrier:deals-2026", text: "walled-but-granted" },
-  ];
-  const f = fakeFetch(() => ({ body: { ok: true, result: { facts: returned, returned_ids: ["k-1", "k-2"], groups_considered: ["org", "barrier:deals-2026"] } } }));
-  const facts = await recall("deal terms", { cfg: CFG, group: { kind: "unit", id: "eng" }, limit: 3, fetchImpl: f });
-  // client renders EVERYTHING the server returned, including the barrier fact
-  assert.deepEqual(facts, returned);
-  // and it forwarded the query + the normalised group hint + limit
-  assert.equal(f.calls[0].body.query, "deal terms");
-  assert.equal(f.calls[0].body.group, "unit:eng");
-  assert.equal(f.calls[0].body.limit, 3);
-});
-
-test("recall: when the server returns FEWER facts (RLS floored), the client returns exactly those", async () => {
-  // Agent asks broadly; server's RLS floor excludes a barrier fact it isn't
-  // granted. The client has no idea a fact was withheld — it just renders [k-1].
-  const f = fakeFetch(() => ({ body: { ok: true, result: { facts: [{ id: "k-1", group: "org" }], returned_ids: ["k-1"], groups_considered: ["org", "unit:eng"] } } }));
-  const facts = await recall("everything", { cfg: CFG, fetchImpl: f });
-  assert.deepEqual(facts, [{ id: "k-1", group: "org" }]);
-});
-
-test("recallDetailed: surfaces returnedIds + groupsConsidered from the read-audit envelope", async () => {
-  const f = fakeFetch(() => ({ body: { ok: true, result: { facts: [{ id: "k-1" }, { id: "k-2" }], returned_ids: ["k-1", "k-2"], groups_considered: ["org", "unit:eng"] } } }));
-  const r = await recallDetailed("q", { cfg: CFG, fetchImpl: f });
-  assert.equal(r.ok, true);
-  assert.deepEqual(r.returnedIds, ["k-1", "k-2"]);
-  assert.deepEqual(r.groupsConsidered, ["org", "unit:eng"]);
-});
-
-test("recallDetailed: derives returnedIds from facts when the server omits returned_ids", async () => {
-  const f = fakeFetch(() => ({ body: { ok: true, result: { facts: [{ id: "k-3" }, { id: "k-4" }] } } }));
-  const r = await recallDetailed("q", { cfg: CFG, fetchImpl: f });
-  assert.deepEqual(r.returnedIds, ["k-3", "k-4"]);
-  assert.deepEqual(r.groupsConsidered, []);
-});
-
-test("recall: lexical flag forwarded (keyword stand-in for vector search)", async () => {
-  const f = fakeFetch(() => ({ body: { ok: true, result: { facts: [] } } }));
-  await recall("keyword", { cfg: CFG, lexical: true, fetchImpl: f });
-  assert.equal(f.calls[0].body.lexical, true);
-});
-
-test("recall: disabled or empty query → [] (fail-open), no fetch", async () => {
-  const f = fakeFetch();
-  assert.deepEqual(await recall("q", { cfg: OFF, fetchImpl: f }), []);
-  assert.deepEqual(await recall("   ", { cfg: CFG, fetchImpl: f }), []);
-  assert.equal(f.calls.length, 0);
-});
-
-test("recall: server error → [] (fail-open); recallDetailed reports the error", async () => {
-  const f = fakeFetch(() => ({ ok: false, status: 403, body: { ok: false, error: { code: "FORBIDDEN_SCOPE", message: "no knowledge.read" } } }));
-  assert.deepEqual(await recall("q", { cfg: CFG, fetchImpl: f }), []);
-  const f2 = fakeFetch(() => ({ ok: false, status: 403, body: { ok: false, error: { code: "FORBIDDEN_SCOPE", message: "no knowledge.read" } } }));
-  const r = await recallDetailed("q", { cfg: CFG, fetchImpl: f2 });
-  assert.equal(r.ok, false);
-  assert.deepEqual(r.facts, []);
-  assert.equal(r.error.code, "FORBIDDEN_SCOPE");
-});
-
-// --- forget → knowledge.invalidate (tombstone, NEVER hard-delete) -----------
-
-test("forget: calls knowledge.invalidate (not a delete); carries reason + idempotency", async () => {
-  const f = fakeFetch(() => ({ body: { ok: true, result: { id: "k-1", invalid: true } } }));
-  const r = await forget("k-1", { cfg: CFG, reason: "superseded by k-2", supersededBy: "k-2", fetchImpl: f });
-  assert.equal(r.ok, true);
-  assert.equal(r.mode, "invalidate");
-  assert.equal(f.calls[0].url, `${BASE}/api/v1/knowledge.invalidate`);
-  assert.equal(f.calls[0].body.id, "k-1");
-  assert.equal(f.calls[0].body.reason, "superseded by k-2");
-  assert.equal(f.calls[0].body.supersededBy, "k-2");
-  assert.equal(f.calls[0].headers["x-idempotency-key"], "knowledge.invalidate:k-1");
-});
-
-test("forget: disabled → skipped; missing id → BAD_REQUEST; no fetch", async () => {
-  const f = fakeFetch();
-  assert.deepEqual(await forget("k-1", { cfg: OFF, fetchImpl: f }), { ok: false, skipped: true });
-  const bad = await forget("", { cfg: CFG, fetchImpl: f });
-  assert.equal(bad.error.code, "BAD_REQUEST");
-  assert.equal(f.calls.length, 0);
-});
-
-// --- contacts -------------------------------------------------------------
-
-test("upsertContact: posts the right shape to contacts.upsert (idempotent on id)", async () => {
-  const f = fakeFetch(() => ({ body: { ok: true, result: { id: "c-1" } } }));
-  const r = await upsertContact({ id: "c-1", name: "Jordan", emails: ["j@x.com"], group: { kind: "unit", id: "sales" } }, { cfg: CFG, fetchImpl: f });
-  assert.equal(r.ok, true);
-  assert.equal(f.calls[0].url, `${BASE}/api/v1/contacts.upsert`);
-  assert.deepEqual(f.calls[0].body, { id: "c-1", name: "Jordan", emails: ["j@x.com"], group: "unit:sales" });
-  assert.equal(f.calls[0].headers["x-idempotency-key"], "contacts.upsert:c-1");
-});
-
-test("listContacts: returns the server's ACL-filtered list as-is; [] when disabled", async () => {
-  const f = fakeFetch(() => ({ body: { contacts: [{ id: "c-1" }, { id: "c-2" }] } }));
-  assert.deepEqual(await listContacts({ cfg: CFG, q: "jord", fetchImpl: f }), [{ id: "c-1" }, { id: "c-2" }]);
-  assert.match(f.calls[0].url, /\/v1\/contacts\.list\?q=jord$/);
-  assert.deepEqual(await listContacts({ cfg: OFF }), []);
-});
-
-test("upsertContact: server NOT_FOUND (handler lane unbuilt) surfaces unimplemented + warns, never a silent swallow", async () => {
-  const f = fakeFetch(() => ({ body: { ok: false, error: { code: "NOT_FOUND", message: "unknown method contacts.upsert" } } }));
-  const warnings = [];
-  const orig = console.warn;
-  console.warn = (m) => warnings.push(String(m));
-  let r;
-  try {
-    r = await upsertContact({ id: "c-9", name: "Sam" }, { cfg: CFG, fetchImpl: f });
-  } finally {
-    console.warn = orig;
-  }
-  assert.equal(r.ok, false);
-  assert.equal(r.unimplemented, true, "NOT_FOUND is flagged as an unimplemented capability, not a plain failure");
-  assert.equal(r.error.code, "NOT_FOUND");
-  assert.ok(warnings.some((w) => w.includes("contacts.upsert")), "emits a loud, actionable warning naming the missing method");
-});
-
-// --- meetings -------------------------------------------------------------
-
-test("recordMeeting: posts the right shape to meetings.record (idempotent on id)", async () => {
-  const f = fakeFetch(() => ({ body: { ok: true, result: { id: "m-1" } } }));
-  const r = await recordMeeting({ id: "m-1", title: "board sync", at: "2026-06-11T10:00:00Z", participants: ["a", "b"] }, { cfg: CFG, fetchImpl: f });
-  assert.equal(r.ok, true);
-  assert.equal(f.calls[0].url, `${BASE}/api/v1/meetings.record`);
-  assert.deepEqual(f.calls[0].body, { id: "m-1", title: "board sync", at: "2026-06-11T10:00:00Z", participants: ["a", "b"] });
-  assert.equal(f.calls[0].headers["x-idempotency-key"], "meetings.record:m-1");
-});
-
-test("listMeetings: returns the server's participant-ACL list as-is; [] when disabled", async () => {
-  const f = fakeFetch(() => ({ body: { meetings: [{ id: "m-1" }] } }));
-  assert.deepEqual(await listMeetings({ cfg: CFG, since: "2026-06-01", fetchImpl: f }), [{ id: "m-1" }]);
-  assert.match(f.calls[0].url, /\/v1\/meetings\.list\?since=2026-06-01$/);
-  assert.deepEqual(await listMeetings({ cfg: OFF }), []);
-});
-
-// --- pure internals --------------------------------------------------------
-
-test("_internals.pickArray: finds the first array key, [] otherwise", () => {
-  assert.deepEqual(_internals.pickArray({ facts: [1, 2] }, ["facts", "results"]), [1, 2]);
-  assert.deepEqual(_internals.pickArray({ results: [3] }, ["facts", "results"]), [3]);
-  assert.deepEqual(_internals.pickArray([9], ["facts"]), [9]);
-  assert.deepEqual(_internals.pickArray({ nope: 1 }, ["facts"]), []);
-  assert.deepEqual(_internals.pickArray(null, ["facts"]), []);
-});
-
-test("_internals.factToParams: string→{text}; opts pull-through; group normalised; id stringified", () => {
-  const p = _internals.factToParams("hi", { kind: "note", id: 42, group: { kind: "unit", id: "eng" } });
-  assert.deepEqual(p, { text: "hi", kind: "note", id: "42", group: "unit:eng" });
-});

package/lib/org/leases.test.mjs

@@ -1,235 +0,0 @@
-/**
- * leases.test.mjs — agent-side lease helpers: ownership-config parsing, generic
- * claim with 3s fail-open, thread-ownership single-winner arbitration, release.
- *
- * The Cohort server is simulated by an injected `client` (no network): a single
- * shared in-memory lease table that adjudicates exactly one holder per
- * (scope,resourceId), so a row of racing claimThread calls produces exactly one
- * mayReply — the property the real server's CAS guarantees.
- *
- * Run: node --test lib/org/leases.test.mjs
- */
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, rmSync, mkdirSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-import {
-  loadOwnership,
-  ownershipRuleFor,
-  isClaimOnReceive,
-  threadResourceId,
-  claimLease,
-  releaseLease,
-  heartbeatLease,
-  claimThread,
-  releaseThread,
-  preSendArbitration,
-  THREAD_OWNERSHIP_SCOPE,
-} from "./leases.mjs";
-import { okFrame, errFrame } from "./protocol.mjs";
-
-/**
- * A fake Cohort client backed by a single shared lease table. Adjudicates one
- * holder per (scope,resourceId) — exactly the server's single-conditional CAS.
- * leaseClaim returns {ok:true,result:{token}} to the winner and a CONFLICT frame
- * to every loser; release frees the row.
- */
-function fakeLeaseServer() {
-  const table = new Map(); // key = `${scope}|${resourceId}` -> token
-  let seq = 0;
-  return {
-    table,
-    async leaseClaim(params) {
-      const key = `${params.scope}|${params.resourceId}`;
-      if (table.has(key)) return errFrame("CONFLICT", "lease held");
-      const token = `lt-${++seq}`;
-      table.set(key, token);
-      return okFrame({ token, expiresAt: "2026-06-11T00:10:00Z", ttlMs: params.ttlMs || 600000 });
-    },
-    async leaseRelease(params) {
-      const key = `${params.scope}|${params.resourceId}`;
-      if (table.get(key) === params.leaseToken) { table.delete(key); return okFrame({ released: true }); }
-      return errFrame("NOT_FOUND", "no such lease/token");
-    },
-    async leaseHeartbeat(params) {
-      const key = `${params.scope}|${params.resourceId}`;
-      if (table.get(key) === params.leaseToken) return okFrame({ extended: true });
-      return errFrame("NOT_FOUND", "no such lease/token");
-    },
-  };
-}
-
-function tmp() { return mkdtempSync(join(tmpdir(), "org-leases-")); }
-const CONN = { base: "https://org.cohortapp.com", token: "tok" };
-
-// --- ownership.yaml --------------------------------------------------------
-
-test("loadOwnership: absent file → benign empty {channels:[]}", async () => {
-  const o = await loadOwnership(tmp());
-  assert.deepEqual(o, { channels: [] });
-});
-
-test("loadOwnership: parses channels + arbitration block", async () => {
-  const root = tmp();
-  try {
-    mkdirSync(join(root, "config"), { recursive: true });
-    writeFileSync(join(root, "config", "ownership.yaml"),
-      "schemaVersion: 1\nchannels:\n  - { platform: slack, channel: \"C1\", mode: claim-on-receive }\n");
-    const o = await loadOwnership(root);
-    assert.equal(o.channels.length, 1);
-    assert.equal(o.channels[0].channel, "C1");
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});
-
-test("ownershipRuleFor / isClaimOnReceive: matches platform+channel/chat", () => {
-  const o = { channels: [
-    { platform: "slack", channel: "C1", mode: "claim-on-receive" },
-    { platform: "telegram", chat: "-100", mode: "send-time-only" },
-  ] };
-  assert.equal(ownershipRuleFor(o, "slack", "C1").mode, "claim-on-receive");
-  assert.equal(ownershipRuleFor(o, "slack", "C1").channel, "C1");
-  assert.equal(ownershipRuleFor(o, "telegram", "-100").mode, "send-time-only");
-  assert.equal(ownershipRuleFor(o, "slack", "C2"), null);
-  assert.equal(isClaimOnReceive(o, "slack", "C1"), true);
-  assert.equal(isClaimOnReceive(o, "telegram", "-100"), false); // send-time-only ≠ claim-on-receive
-  assert.equal(isClaimOnReceive(o, "slack", "nope"), false);
-});
-
-test("threadResourceId: stable canonical key (both racers derive the same)", () => {
-  assert.equal(threadResourceId("C1", "1700.1"), "channel:C1:1700.1");
-  assert.equal(threadResourceId("C1", ""), "channel:C1");
-  // Same inputs → same key regardless of caller.
-  assert.equal(threadResourceId("C1", "t"), threadResourceId("C1", "t"));
-});
-
-// --- generic claim / release / heartbeat -----------------------------------
-
-test("claimLease: rejects an unknown scope without a round-trip", async () => {
-  let called = false;
-  const client = { leaseClaim: async () => { called = true; return okFrame({ token: "x" }); } };
-  const r = await claimLease("not-a-scope", "res", { client, ...CONN });
-  assert.equal(r.held, false);
-  assert.match(r.reason, /bad-scope/);
-  assert.equal(called, false);
-});
-
-test("claimLease: winner gets held+token; loser stands down on CONFLICT", async () => {
-  const client = fakeLeaseServer();
-  const a = await claimLease(THREAD_OWNERSHIP_SCOPE, "res-1", { client, ...CONN });
-  assert.equal(a.held, true);
-  assert.ok(a.leaseToken);
-  assert.equal(a.failedOpen, false);
-  const b = await claimLease(THREAD_OWNERSHIP_SCOPE, "res-1", { client, ...CONN });
-  assert.equal(b.held, false);
-  assert.equal(b.leaseToken, null);
-  assert.equal(b.reason, "CONFLICT");
-});
-
-/**
- * A claim that resolves AFTER `ms` — slower than the fail-open ceiling, but it
- * DOES settle (so the test runner sees no permanently-pending promise; the
- * fail-open path has already returned by then).
- */
-function slowClaim(ms) {
-  return () => new Promise((resolve) => { setTimeout(() => resolve(okFrame({ token: "late" })), ms); });
-}
-
-test("claimLease: 3s fail-open — a hung server resolves to held (no token), counted", async () => {
-  const client = { leaseClaim: slowClaim(60) }; // resolves at 60ms, after the 5ms ceiling fires
-  const r = await claimLease(THREAD_OWNERSHIP_SCOPE, "res", { client, ...CONN, failOpenTimeoutMs: 5 });
-  assert.equal(r.held, true);            // failed OPEN
-  assert.equal(r.failedOpen, true);
-  assert.equal(r.leaseToken, null);      // no phantom lease to heartbeat/release
-  assert.equal(r.reason, "fail-open-timeout");
-});
-
-test("claimLease: a client throw also fails open (never throws)", async () => {
-  const client = { leaseClaim: async () => { throw new Error("ECONNREFUSED"); } };
-  const r = await claimLease(THREAD_OWNERSHIP_SCOPE, "res", { client, ...CONN, failOpenTimeoutMs: 50 });
-  assert.equal(r.held, true);
-  assert.equal(r.failedOpen, true);
-});
-
-test("releaseLease/heartbeatLease: no-op without a token; frees a held lease", async () => {
-  const client = fakeLeaseServer();
-  assert.deepEqual(await releaseLease(THREAD_OWNERSHIP_SCOPE, "res", { client, ...CONN }), { released: false, reason: "no-token" });
-  assert.deepEqual(await heartbeatLease(THREAD_OWNERSHIP_SCOPE, "res", { client, ...CONN }), { ok: false, reason: "no-token" });
-  const a = await claimLease(THREAD_OWNERSHIP_SCOPE, "res-x", { client, ...CONN });
-  const hb = await heartbeatLease(THREAD_OWNERSHIP_SCOPE, "res-x", { client, ...CONN, leaseToken: a.leaseToken });
-  assert.equal(hb.ok, true);
-  const rel = await releaseLease(THREAD_OWNERSHIP_SCOPE, "res-x", { client, ...CONN, leaseToken: a.leaseToken });
-  assert.equal(rel.released, true);
-});
-
-// --- thread-ownership: exactly one mayReply --------------------------------
-
-test("claimThread: across N racing agents, EXACTLY ONE wins; release frees", async () => {
-  const client = fakeLeaseServer(); // shared table = simulated server
-  const channel = "C0123ABC";
-  const thread = "1700000000.0001";
-  // Five agents race for the same thread concurrently.
-  const racers = await Promise.all(
-    [1, 2, 3, 4, 5].map(() => claimThread(channel, thread, { client, ...CONN })),
-  );
-  const winners = racers.filter((r) => r.held && !r.failedOpen);
-  assert.equal(winners.length, 1, "exactly one agent claims thread ownership");
-  assert.equal(racers.filter((r) => !r.held).length, 4, "the other four stand down");
-  const winner = winners[0];
-  assert.ok(winner.leaseToken);
-  assert.equal(winner.resourceId, threadResourceId(channel, thread));
-
-  // After the winner releases, the thread is claimable again.
-  const rel = await releaseThread(channel, thread, { client, ...CONN, leaseToken: winner.leaseToken });
-  assert.equal(rel.released, true);
-  const next = await claimThread(channel, thread, { client, ...CONN });
-  assert.equal(next.held, true, "released thread is claimable by the next agent");
-});
-
-// --- pre-send arbitration (the cancellable send-path check) ----------------
-
-test("preSendArbitration: non-arbitrated channel → mayReply:true, no lease spent", async () => {
-  let called = false;
-  const client = { leaseClaim: async () => { called = true; return okFrame({ token: "x" }); } };
-  const ownership = { channels: [{ platform: "slack", channel: "C1", mode: "claim-on-receive" }] };
-  const r = await preSendArbitration({ platform: "slack", channel: "C999", ownership, client, ...CONN });
-  assert.equal(r.mayReply, true);
-  assert.equal(r.arbitrated, false);
-  assert.equal(called, false, "no lease round-trip on an un-arbitrated channel");
-});
-
-test("preSendArbitration: arbitrated channel → exactly one mayReply across racers", async () => {
-  const client = fakeLeaseServer();
-  const ownership = { channels: [{ platform: "slack", channel: "C1", mode: "claim-on-receive" }] };
-  const racers = await Promise.all([1, 2, 3].map(() =>
-    preSendArbitration({ platform: "slack", channel: "C1", thread: "t1", ownership, client, ...CONN })));
-  assert.equal(racers.filter((r) => r.mayReply && !r.failedOpen).length, 1);
-  assert.equal(racers.filter((r) => r.arbitrated).length, 3);
-  const winner = racers.find((r) => r.mayReply);
-  assert.ok(winner.leaseToken);
-});
-
-test("preSendArbitration: arbitrated channel + hung server → fail-open mayReply, counted", async () => {
-  const client = { leaseClaim: slowClaim(60) };
-  const ownership = { channels: [{ platform: "slack", channel: "C1", mode: "claim-on-receive" }] };
-  const r = await preSendArbitration({ platform: "slack", channel: "C1", thread: "t", ownership, client, ...CONN, failOpenTimeoutMs: 5 });
-  assert.equal(r.mayReply, true);
-  assert.equal(r.failedOpen, true);
-  assert.equal(r.arbitrated, true);
-});
-
-test("preSendArbitration: reads config/ownership.yaml when ownership not injected", async () => {
-  const root = tmp();
-  try {
-    mkdirSync(join(root, "config"), { recursive: true });
-    writeFileSync(join(root, "config", "ownership.yaml"),
-      "schemaVersion: 1\nchannels:\n  - { platform: slack, channel: \"CDISK\", mode: claim-on-receive }\n");
-    const client = fakeLeaseServer();
-    const r = await preSendArbitration({ platform: "slack", channel: "CDISK", thread: "t", agentRoot: root, client, ...CONN });
-    assert.equal(r.arbitrated, true);
-    assert.equal(r.mayReply, true);
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});

package/lib/org/mesh-directives.test.mjs

@@ -1,110 +0,0 @@
-/**
- * mesh-directives.test.mjs — the two front-door directives (design §3.4 /
- * audit F10): hq's `remediateFleetSeat` queues `restart` and nothing honoured
- * it. Now:
- *
- *   restart          → the daemon flushes and exits NON-ZERO so launchd's
- *                      KeepAlive {SuccessfulExit:false} relaunches it (a clean
- *                      exit 0 would leave it down). Injected as requestRestart.
- *   session.restart  → touch state/session/restart-requested; the session's
- *                      feed sees it and the session restarts itself at an idle
- *                      moment. The daemon is untouched.
- *
- * Driven through the same fake client + explicit beatOnce as mesh.test.mjs.
- */
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, writeFileSync, existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-
-import { connectOrgMesh, _internals } from "./mesh.mjs";
-
-const BASE = "https://org.cohortapp.com";
-function tmpRepo() {
-  const root = mkdtempSync(join(tmpdir(), "org-mesh-directives-"));
-  mkdirSync(join(root, "config"), { recursive: true });
-  writeFileSync(join(root, "config", "agent.json"), JSON.stringify({ firstName: "Alex", fullName: "Alex Chen", repoSlug: "alex-ai" }));
-  return root;
-}
-function cfgEnabled() { return { org: { cohort: { enabled: true, base: BASE, token: "tok" } } }; }
-function fakeClient(beatFrames) {
-  const c = {
-    isEnabled: (cfg) => !!(cfg && cfg.org && cfg.org.cohort && cfg.org.cohort.enabled),
-    configFromAgent: () => ({ base: BASE, token: "tok", orgId: "", enabled: true, trustedSignersPem: [] }),
-    _beatFrames: beatFrames.slice(),
-    register() { return Promise.resolve({ ok: true, result: { status: 200 } }); },
-    presenceBeat() { return Promise.resolve(c._beatFrames.length ? c._beatFrames.shift() : { ok: true, result: { directives: [] } }); },
-    fetchDirectory() { return Promise.resolve({ ok: true, result: { agents: [] } }); },
-    call() { return Promise.resolve({ ok: true, result: {} }); },
-  };
-  return c;
-}
-
-test("KNOWN_DIRECTIVES includes restart and session.restart", () => {
-  assert.ok(_internals.KNOWN_DIRECTIVES.has("restart"));
-  assert.ok(_internals.KNOWN_DIRECTIVES.has("session.restart"));
-});
-
-test('"restart" directive stops the beat loop and asks the daemon to restart (exit non-zero); never writes .emergency-stop', async () => {
-  const root = tmpRepo();
-  const client = fakeClient([{ ok: true, result: { directives: ["restart"] } }]);
-  let stops = 0;
-  let restarts = 0;
-  const handle = await connectOrgMesh({
-    agentRoot: root, cfg: cfgEnabled(), client,
-    setInterval: () => ({ unref() {} }),
-    requestStop: () => { stops += 1; },
-    requestRestart: () => { restarts += 1; },
-  });
-  const directives = await _internals.beatOnce(handle._ctx);
-  assert.deepEqual(directives, ["restart"]);
-  assert.equal(restarts, 1, "requestRestart() was invoked");
-  assert.equal(stops, 0, "a restart is not a halt");
-  assert.equal(existsSync(join(root, ".emergency-stop")), false, "a restart must never trip the kill switch");
-  assert.equal(handle._ctx.stopped, true, "the beat loop stopped: the process is going down to come back");
-});
-
-test('"session.restart" directive touches state/session/restart-requested and leaves the daemon running', async () => {
-  const root = tmpRepo();
-  const client = fakeClient([{ ok: true, result: { directives: ["session.restart"] } }]);
-  let stops = 0;
-  let restarts = 0;
-  const T0 = Date.parse("2026-09-08T10:00:00.000Z");
-  const handle = await connectOrgMesh({
-    agentRoot: root, cfg: cfgEnabled(), client,
-    setInterval: () => ({ unref() {} }),
-    now: () => T0,
-    requestStop: () => { stops += 1; },
-    requestRestart: () => { restarts += 1; },
-  });
-  const directives = await _internals.beatOnce(handle._ctx);
-  assert.deepEqual(directives, ["session.restart"]);
-  const flag = join(root, "state", "session", "restart-requested");
-  assert.ok(existsSync(flag), "restart-requested flag written");
-  assert.match(readFileSync(flag, "utf8"), /2026-09-08T10:00:00/, "flag carries the request time");
-  assert.equal(stops, 0);
-  assert.equal(restarts, 0, "the daemon itself is not restarted");
-  assert.equal(handle._ctx.stopped, false, "the beat loop keeps running");
-  // Idempotent: a second directive overwrites the flag, never throws.
-  await _internals.handleDirective("session.restart", handle._ctx);
-  assert.ok(existsSync(flag));
-});
-
-test("the default restart signal sets a non-zero exit code before the graceful stop, so launchd relaunches", () => {
-  // defaultRequestRestart is the production path; we only check its contract
-  // on process.exitCode without sending ourselves a signal.
-  const prevExitCode = process.exitCode;
-  const prevKill = process.kill;
-  let killed = null;
-  process.kill = (pid, sig) => { killed = { pid, sig }; return true; };
-  try {
-    _internals.defaultRequestRestart();
-    assert.equal(process.exitCode, 1, "exit code 1 → KeepAlive {SuccessfulExit:false} brings the daemon back");
-    assert.deepEqual(killed, { pid: process.pid, sig: "SIGTERM" }, "graceful stop via the daemon's own SIGTERM handlers (flush)");
-  } finally {
-    process.kill = prevKill;
-    process.exitCode = prevExitCode;
-  }
-});