@cohortapp/agent-sdk 2.17.0 → 2.18.5

package/lib/setup/claude-probe.test.mjs

@@ -1,187 +0,0 @@
-/**
- * claude-probe.test.mjs — the Claude auth/reachability probe (lib/setup/claude-probe.mjs).
- *
- * Hermetic: the `claude auth status` exec and the curl ping are injected, so no
- * network and no real CLI fork. Covers the three auth modes (oauth-token /
- * keychain subscription / api-key) and the ok | relogin_required | unknown
- * mapping the fleet beat reads.
- *
- * Run: node --test lib/setup/claude-probe.test.mjs
- */
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-import { probeClaude, parseAuthStatus, authStatusEnv, AUTH_STATUS_TIMEOUT_MS } from "./claude-probe.mjs";
-
-function rootWithEnv(body) {
-  const root = mkdtempSync(join(tmpdir(), "claude-probe-"));
-  writeFileSync(join(root, ".env"), body);
-  return root;
-}
-
-/** An execFileSync-shaped fake: records the call, returns canned stdout / throws. */
-function fakeExec(reply) {
-  const calls = [];
-  const fn = (cmd, args, opts) => {
-    calls.push({ cmd, args, opts });
-    if (reply instanceof Error) throw reply;
-    if (typeof reply === "function") return reply(cmd, args, opts);
-    return reply;
-  };
-  fn.calls = calls;
-  return fn;
-}
-
-test("parseAuthStatus maps the CLI's JSON to the three-state vocabulary", () => {
-  assert.equal(parseAuthStatus('{"loggedIn":true,"authMethod":"claude.ai","subscriptionType":"max"}'), "ok");
-  assert.equal(parseAuthStatus('{"loggedIn":false}'), "relogin_required");
-  assert.equal(parseAuthStatus("Not logged in. Run `claude login`."), "relogin_required");
-  assert.equal(parseAuthStatus(""), "unknown");
-  assert.equal(parseAuthStatus("garbage that is not json"), "unknown");
-  assert.equal(parseAuthStatus(null), "unknown");
-});
-
-test("authStatusEnv overlays the .env token onto the base env without leaking other keys", () => {
-  const env = authStatusEnv("CLAUDE_CODE_OAUTH_TOKEN=\"tok-123\"\nOTHER=1\n", { PATH: "/usr/bin" });
-  assert.equal(env.CLAUDE_CODE_OAUTH_TOKEN, "tok-123");
-  assert.equal(env.PATH, "/usr/bin");
-  assert.equal(env.OTHER, undefined);
-  // No token in .env → the base env is returned untouched (keychain login may still work).
-  const bare = authStatusEnv("MAESTRO_PREFER_SUBSCRIPTION_AUTH=1\n", { PATH: "/usr/bin" });
-  assert.equal(bare.CLAUDE_CODE_OAUTH_TOKEN, undefined);
-});
-
-test("oauth-token mode: runs `claude auth status` with the .env token in env → ok", () => {
-  const root = rootWithEnv("CLAUDE_CODE_OAUTH_TOKEN=tok-abc\nMAESTRO_PREFER_SUBSCRIPTION_AUTH=1\n");
-  try {
-    const exec = fakeExec('{"loggedIn":true,"authMethod":"claude.ai"}');
-    const r = probeClaude(root, { exec, claudeBin: "/fake/claude", env: { PATH: "/usr/bin" } });
-    assert.equal(r.ok, true);
-    assert.equal(r.mode, "subscription");
-    assert.equal(r.auth, "ok");
-    assert.equal(exec.calls.length, 1);
-    assert.equal(exec.calls[0].cmd, "/fake/claude");
-    assert.deepEqual(exec.calls[0].args, ["auth", "status", "--json"]);
-    assert.equal(exec.calls[0].opts.env.CLAUDE_CODE_OAUTH_TOKEN, "tok-abc");
-    assert.equal(exec.calls[0].opts.timeout, AUTH_STATUS_TIMEOUT_MS);
-    assert.equal(AUTH_STATUS_TIMEOUT_MS, 8000);
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});
-
-test("subscription mode: loggedIn:false → relogin_required, not ok, remedy names setup-token", () => {
-  const root = rootWithEnv("MAESTRO_PREFER_SUBSCRIPTION_AUTH=1\n");
-  try {
-    const r = probeClaude(root, { exec: fakeExec('{"loggedIn":false}'), claudeBin: "/fake/claude" });
-    assert.equal(r.ok, false);
-    assert.equal(r.auth, "relogin_required");
-    assert.match(r.remedy, /claude setup-token/);
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});
-
-test("subscription mode: a missing/broken CLI is unknown and FAIL-OPEN (ok:true with a note)", () => {
-  const root = rootWithEnv("MAESTRO_PREFER_SUBSCRIPTION_AUTH=1\n");
-  try {
-    const r = probeClaude(root, { exec: fakeExec(Object.assign(new Error("ENOENT"), { code: "ENOENT" })), claudeBin: "/fake/claude" });
-    assert.equal(r.ok, true, "an unverifiable auth state must not hard-fail setup/doctor");
-    assert.equal(r.auth, "unknown");
-    assert.match(r.detail, /could not verify/i);
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});
-
-test("a token WITHOUT the prefer flag still selects subscription mode (the token is the auth)", () => {
-  const root = rootWithEnv("CLAUDE_CODE_OAUTH_TOKEN=tok-abc\n");
-  try {
-    const r = probeClaude(root, { exec: fakeExec('{"loggedIn":true}'), claudeBin: "/fake/claude" });
-    assert.equal(r.mode, "subscription");
-    assert.equal(r.auth, "ok");
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});
-
-test("api-key mode still pings api.anthropic.com via the injected curl", () => {
-  const root = rootWithEnv("ANTHROPIC_API_KEY=sk-ant-test\n");
-  try {
-    const exec = fakeExec("{}");
-    const r = probeClaude(root, { curl: () => ({ stdout: "200" }), exec });
-    assert.equal(r.ok, true);
-    assert.equal(r.mode, "api-key");
-    assert.equal(exec.calls.length, 0, "api-key mode never forks the CLI");
-    const bad = probeClaude(root, { curl: () => ({ stdout: "401" }), exec });
-    assert.equal(bad.ok, false);
-    assert.match(bad.remedy, /INVALID/);
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});
-
-test("no auth at all → not ok, remedy names the oauth-token path first", () => {
-  const root = rootWithEnv("");
-  try {
-    const r = probeClaude(root, { exec: fakeExec("{}"), curl: () => ({ stdout: "" }) });
-    assert.equal(r.ok, false);
-    assert.equal(r.mode, "none");
-    assert.match(r.remedy, /CLAUDE_CODE_OAUTH_TOKEN/);
-    assert.match(r.remedy, /claude setup-token/);
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});
-
-// ---------------------------------------------------------------------------
-// Review 2026-09-08: what the probe can and cannot prove
-// ---------------------------------------------------------------------------
-
-test("an env-token 'ok' is REPORTED, never VERIFIED: `claude auth status` says loggedIn for any token value", () => {
-  // Verified on 2026-09-08: CLAUDE_CODE_OAUTH_TOKEN=sk-ant-oat01-bogus claude auth status --json
-  // → {loggedIn:true, authMethod:"oauth_token"} exit 0. The CLI reports the
-  // presence of a credential; only a real spawn exercises it.
-  const root = rootWithEnv("CLAUDE_CODE_OAUTH_TOKEN=sk-ant-oat01-bogus\nMAESTRO_PREFER_SUBSCRIPTION_AUTH=1\n");
-  try {
-    const r = probeClaude(root, { exec: fakeExec('{"loggedIn":true,"authMethod":"oauth_token"}'), claudeBin: "/fake/claude", env: {} });
-    assert.equal(r.ok, true);
-    assert.equal(r.auth, "ok");
-    assert.equal(r.verified, false, "the probe cannot validate an OAuth token");
-    assert.match(r.detail, /CLI reports a login/i);
-    assert.match(r.detail, /spawn/i, "says where the token IS proven");
-    assert.doesNotMatch(r.detail, /verified/i);
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});
-
-test("an api-key 200 IS verified (a real call was made); 401 is a hard relogin", () => {
-  const root = rootWithEnv("ANTHROPIC_API_KEY=sk-ant-test\n");
-  try {
-    const good = probeClaude(root, { curl: () => ({ stdout: "200" }), exec: fakeExec("{}") });
-    assert.equal(good.verified, true);
-    const bad = probeClaude(root, { curl: () => ({ stdout: "401" }), exec: fakeExec("{}") });
-    assert.equal(bad.verified, false);
-    assert.equal(bad.auth, "relogin_required");
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});
-
-test("a token that lives ONLY in the ambient env (no .env) still selects subscription mode — the headless docs prescribe exactly that", () => {
-  const root = rootWithEnv("");
-  try {
-    const exec = fakeExec('{"loggedIn":true,"authMethod":"oauth_token"}');
-    const r = probeClaude(root, { exec, claudeBin: "/fake/claude", env: { PATH: "/usr/bin", CLAUDE_CODE_OAUTH_TOKEN: "tok-from-launchd" } });
-    assert.equal(r.mode, "subscription");
-    assert.equal(r.auth, "ok");
-    assert.match(r.name, /OAuth token/);
-    assert.equal(exec.calls[0].opts.env.CLAUDE_CODE_OAUTH_TOKEN, "tok-from-launchd");
-    // .env wins over the ambient env for the value (same precedence doctor's authMode uses).
-    const root2 = rootWithEnv("CLAUDE_CODE_OAUTH_TOKEN=tok-from-dotenv\n");
-    try {
-      const exec2 = fakeExec('{"loggedIn":true}');
-      probeClaude(root2, { exec: exec2, claudeBin: "/fake/claude", env: { CLAUDE_CODE_OAUTH_TOKEN: "tok-from-launchd" } });
-      assert.equal(exec2.calls[0].opts.env.CLAUDE_CODE_OAUTH_TOKEN, "tok-from-dotenv");
-    } finally { rmSync(root2, { recursive: true, force: true }); }
-    // Ambient MAESTRO_PREFER_SUBSCRIPTION_AUTH / ANTHROPIC_API_KEY count too.
-    const keychain = probeClaude(root, { exec: fakeExec('{"loggedIn":true}'), claudeBin: "/fake/claude", env: { MAESTRO_PREFER_SUBSCRIPTION_AUTH: "1" } });
-    assert.equal(keychain.mode, "subscription");
-    assert.match(keychain.name, /keychain/);
-    const key = probeClaude(root, { exec: fakeExec("{}"), curl: () => ({ stdout: "200" }), env: { ANTHROPIC_API_KEY: "sk-env" } });
-    assert.equal(key.mode, "api-key");
-    // Nothing anywhere → none (the ambient env is the injected one, not the test runner's).
-    const none = probeClaude(root, { exec: fakeExec("{}"), curl: () => ({ stdout: "" }), env: {} });
-    assert.equal(none.mode, "none");
-  } finally { rmSync(root, { recursive: true, force: true }); }
-});

package/lib/setup/completeness.test.mjs

@@ -1,110 +0,0 @@
-/**
- * completeness.test.mjs — the shared operating-model gate (lib/setup/completeness.mjs).
- * Detects placeholders / missing artifacts; passes on a fully generated repo.
- * Run: `node --test lib/setup/completeness.test.mjs`
- * @module lib/setup/completeness.test
- */
-
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join, dirname, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-import { execFileSync } from "node:child_process";
-import { assertComplete } from "./completeness.mjs";
-
-const HERE = dirname(fileURLToPath(import.meta.url));
-const MAESTRO_ROOT = resolve(HERE, "..", "..");
-
-function tmpRoot() {
-  const r = mkdtempSync(join(tmpdir(), "maestro-complete-"));
-  mkdirSync(join(r, "config"), { recursive: true });
-  return r;
-}
-
-const POPULATED_IDENTITY = {
-  firstName: "Jacob", lastName: "Chen", fullName: "Jacob Chen",
-  title: "VP, Engineering", email: "jacob@acme.com",
-  function: "technical-leader", altitude: "vp", archetype: "technical-leader",
-  company: "Acme", companyDomain: "acme.com",
-  principal: { firstName: "Dana", lastName: "Reyes", fullName: "Dana Reyes", title: "CEO", email: "dana@acme.com" },
-  schedule: { morningBrief: "08:00", commsTriage: ["09:00"], eveningWrap: "18:00", overnightMonitoring: "22:00" },
-  communication: { defaultTone: "warm-professional", externalTone: "formal", voiceModes: [] },
-  responsibilities: [], operatingPrinciples: [],
-};
-
-function runGen(script, root) {
-  execFileSync(process.execPath, [join(MAESTRO_ROOT, "scripts", "setup", script)], {
-    cwd: root,
-    env: { ...process.env, MAESTRO_ROOT, AGENT_ROOT: root },
-    encoding: "utf-8",
-  });
-}
-
-test("assertComplete reports identity placeholders on a fresh scaffold-like repo", async () => {
-  const root = tmpRoot();
-  writeFileSync(join(root, "config/agent.json"), JSON.stringify({
-    firstName: "UNCONFIGURED", lastName: "AGENT", title: "Unconfigured Role", email: "",
-    function: "executive-operator", altitude: "c-suite",
-  }, null, 2));
-  const res = await assertComplete(root);
-  assert.equal(res.ok, false);
-  const arts = res.missing.map((m) => m.artifact);
-  assert.ok(arts.includes("identity.firstName"));
-  assert.ok(arts.includes("identity.email"));
-  // operating-model artifacts also missing
-  assert.ok(arts.includes("config/operating-charter.md"));
-});
-
-test("assertComplete is green after running the real generators on a populated identity", async () => {
-  const root = tmpRoot();
-  writeFileSync(join(root, "config/agent.json"), JSON.stringify(POPULATED_IDENTITY, null, 2) + "\n");
-  // company.json so generate-company can run (not gated by completeness but harmless)
-  writeFileSync(join(root, "config/company.json"), JSON.stringify({ name: "Acme", website: "https://acme.com" }, null, 2));
-
-  runGen("generate-charter.mjs", root);
-  runGen("generate-backlog.mjs", root);
-  runGen("generate-capability.mjs", root);
-  runGen("generate-comms.mjs", root);
-  runGen("generate-autonomy.mjs", root);
-  runGen("generate-cadences.mjs", root);
-
-  // The deterministic charter skeleton intentionally leaves "TBD" company slots
-  // (KPI targets, named stakeholders) that the enrich section fills. Simulate
-  // that enrichment so we can assert the green path of the gate itself.
-  const charterPath = join(root, "config/operating-charter.md");
-  const enriched = readFileSync(charterPath, "utf-8")
-    .replace(/\bTBD\b/g, "Q4 target")
-    .replace(/_\(to be defined during init enrichment\)_/g, "defined");
-  writeFileSync(charterPath, enriched);
-
-  const res = await assertComplete(root);
-  assert.equal(res.ok, true, "expected green gate, missing: " + JSON.stringify(res.missing));
-  assert.equal(res.identityOk, true);
-  assert.equal(res.archetypeOk, true);
-});
-
-test("assertComplete flags a charter that still has placeholders", async () => {
-  const root = tmpRoot();
-  writeFileSync(join(root, "config/agent.json"), JSON.stringify(POPULATED_IDENTITY, null, 2) + "\n");
-  mkdirSync(join(root, "config"), { recursive: true });
-  writeFileSync(join(root, "config/operating-charter.md"), "# Charter\nMandate: {{agent.firstName}} TBD\n");
-  const res = await assertComplete(root);
-  const charter = res.missing.find((m) => m.artifact === "config/operating-charter.md");
-  assert.ok(charter, "charter placeholder must be flagged");
-  assert.match(charter.reason, /placeholder/);
-});
-
-test("assertComplete flags a too-small backlog (<5 open)", async () => {
-  const root = tmpRoot();
-  writeFileSync(join(root, "config/agent.json"), JSON.stringify(POPULATED_IDENTITY, null, 2) + "\n");
-  mkdirSync(join(root, "state/queues"), { recursive: true });
-  writeFileSync(join(root, "state/queues/backlog.yaml"), "items:\n  - id: 1\n    status: open\n  - id: 2\n    status: open\n");
-  const res = await assertComplete(root);
-  const backlog = res.missing.find((m) => m.artifact === "state/queues/backlog.yaml");
-  assert.ok(backlog);
-  assert.match(backlog.reason, /<5/);
-});

package/lib/setup/context-pack.test.mjs

@@ -1,89 +0,0 @@
-/**
- * context-pack.test.mjs — deterministic context gathering (lib/setup/context-pack.mjs).
- * Run: `node --test lib/setup/context-pack.test.mjs`
- * @module lib/setup/context-pack.test
- */
-
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, writeFileSync, existsSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { buildContextPack, gatherContextPack, readContextPack, CONTEXT_PACK_REL } from "./context-pack.mjs";
-
-function tmpRoot() {
-  const r = mkdtempSync(join(tmpdir(), "maestro-ctx-"));
-  mkdirSync(join(r, "config"), { recursive: true });
-  return r;
-}
-
-test("buildContextPack merges identity + company + docs + readme", () => {
-  const root = tmpRoot();
-  writeFileSync(join(root, "config/agent.json"), JSON.stringify({
-    firstName: "Jacob", title: "VP Eng", function: "technical-leader", altitude: "vp", company: "Acme",
-  }));
-  writeFileSync(join(root, "config/company.json"), JSON.stringify({
-    name: "Acme", website: "https://acme.com", products: ["Widget"], strategicPriorities: ["Grow"],
-  }));
-  mkdirSync(join(root, "docs/company-context"), { recursive: true });
-  writeFileSync(join(root, "docs/company-context/overview.md"), "# Acme\nWe build widgets.");
-  writeFileSync(join(root, "docs/company-context/ignore.png"), "binary");
-  writeFileSync(join(root, "README.md"), "Acme agent repo");
-
-  const pack = buildContextPack(root);
-  assert.equal(pack.identity.firstName, "Jacob");
-  assert.equal(pack.identity.function, "technical-leader");
-  assert.equal(pack.company.name, "Acme");
-  assert.deepEqual(pack.company.products, ["Widget"]);
-  assert.equal(pack.contextDocs.length, 1, "only .md/.txt docs included");
-  assert.match(pack.contextDocs[0].excerpt, /widgets/);
-  assert.match(pack.readmeExcerpt, /Acme agent repo/);
-});
-
-test("gatherContextPack writes state/setup/context-pack.json", () => {
-  const root = tmpRoot();
-  writeFileSync(join(root, "config/agent.json"), JSON.stringify({ firstName: "Mara" }));
-  const pack = gatherContextPack(root);
-  assert.ok(existsSync(join(root, CONTEXT_PACK_REL)));
-  const back = readContextPack(root);
-  assert.equal(back.identity.firstName, "Mara");
-  assert.equal(pack.identity.firstName, "Mara");
-});
-
-test("buildContextPack tolerates missing files (no throw)", () => {
-  const root = tmpRoot();
-  const pack = buildContextPack(root);
-  assert.equal(pack.identity.firstName, "");
-  assert.deepEqual(pack.contextDocs, []);
-});
-
-test("buildContextPack omits orgContext when no org-context cache exists", () => {
-  const root = tmpRoot();
-  writeFileSync(join(root, "config/agent.json"), JSON.stringify({ firstName: "Solo" }));
-  const pack = buildContextPack(root);
-  assert.equal("orgContext" in pack, false, "a standalone agent's pack shape is unchanged");
-});
-
-test("buildContextPack folds a bounded org-context excerpt in when enrolled (finding: fetched context shapes nothing)", () => {
-  const root = tmpRoot();
-  writeFileSync(join(root, "config/agent.json"), JSON.stringify({ firstName: "Robin" }));
-  writeFileSync(join(root, "config/org-context.json"), JSON.stringify({
-    fetchedAt: "2026-07-03T00:00:00Z",
-    profile: { slug: "robin", title: "VP Ops", escalationPath: "→ COO", autonomyLevel: "high", reports: [{ member: { slug: "kai", displayName: "Kai" } }] },
-    strategy: { northStar: "Own the fund's operating substrate", levers: [{ label: "Automate ops" }], streams: [{ code: "S1", name: "Go-live", mission: "Ship v1" }] },
-    decisions: [{ title: "Adopt Postgres" }],
-    board: [{ title: "Wire the ready feed" }],
-  }));
-  const pack = buildContextPack(root);
-  assert.ok(pack.orgContext, "orgContext excerpt is present when the cache exists");
-  assert.equal(pack.orgContext.self.slug, "robin");
-  assert.equal(pack.orgContext.self.escalationPath, "→ COO");
-  assert.equal(pack.orgContext.strategy.northStar, "Own the fund's operating substrate");
-  assert.deepEqual(pack.orgContext.strategy.levers, ["Automate ops"]);
-  assert.equal(pack.orgContext.strategy.streams[0].code, "S1");
-  assert.deepEqual(pack.orgContext.reports, ["Kai"]);
-  assert.deepEqual(pack.orgContext.adoptedDecisions, ["Adopt Postgres"]);
-  assert.deepEqual(pack.orgContext.readyBoard, ["Wire the ready feed"]);
-});

package/lib/setup/enrich.test.mjs

@@ -1,115 +0,0 @@
-/**
- * enrich.test.mjs — bounded LLM enrichment (lib/setup/enrich.mjs).
- * The claude spawn is injected (fake) so the test is hermetic — no network.
- * Run: `node --test lib/setup/enrich.test.mjs`
- * @module lib/setup/enrich.test
- */
-
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, writeFileSync, readFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import {
-  enrichField, validateEnrichment, parseStrictJson, buildPrompt, ENRICHABLE, BANNED_PHRASES,
-} from "./enrich.mjs";
-import { gatherContextPack } from "./context-pack.mjs";
-import { readAgentJson } from "./sot.mjs";
-import { loadProgress } from "./state.mjs";
-
-function tmpRoot() {
-  const r = mkdtempSync(join(tmpdir(), "maestro-enrich-"));
-  mkdirSync(join(r, "config"), { recursive: true });
-  writeFileSync(join(r, "config/agent.json"), JSON.stringify({
-    firstName: "Jacob", title: "VP Eng", function: "technical-leader", altitude: "vp", company: "Acme",
-    responsibilities: [], operatingPrinciples: [],
-  }, null, 2));
-  writeFileSync(join(r, "config/company.json"), JSON.stringify({ name: "Acme", description: "" }, null, 2));
-  gatherContextPack(r);
-  return r;
-}
-
-test("parseStrictJson handles fenced and raw JSON and noisy output", () => {
-  assert.deepEqual(parseStrictJson('{"a":1}'), { a: 1 });
-  assert.deepEqual(parseStrictJson("```json\n{\"a\":2}\n```"), { a: 2 });
-  assert.deepEqual(parseStrictJson("Sure!\n{\"a\":3}\nthanks"), { a: 3 });
-  assert.equal(parseStrictJson("no json here"), null);
-});
-
-test("validateEnrichment enforces keys, types, tokens, banned phrases", () => {
-  const spec = ENRICHABLE["agent.responsibilities"];
-  assert.equal(validateEnrichment({ responsibilities: ["Own platform reliability"] }, spec).ok, true);
-  assert.equal(validateEnrichment({ wrong: [] }, spec).ok, false);
-  assert.equal(validateEnrichment({ responsibilities: [] }, spec).ok, false);
-  assert.equal(validateEnrichment({ responsibilities: ["see {{x}}"] }, spec).ok, false);
-  const banned = validateEnrichment({ responsibilities: ["As an AI, I will help"] }, spec);
-  assert.equal(banned.ok, false);
-  assert.match(banned.reason, /banned phrase/);
-});
-
-test("buildPrompt requests only the unit's keys", () => {
-  const p = buildPrompt("agent.persona", { identity: {}, company: {} }, { persona: "" });
-  assert.match(p.system, /\["persona"\]/);
-  assert.match(p.user, /agent\.persona/);
-});
-
-test("enrichField writes validated prose into agent.json (faked spawn)", async () => {
-  const root = tmpRoot();
-  const fakeSpawn = async () => JSON.stringify({ responsibilities: ["Run the platform org", "Own delivery confidence"] });
-  const res = await enrichField(root, "agent.responsibilities", { spawn: fakeSpawn });
-  assert.equal(res.status, "enriched");
-  const cfg = readAgentJson(root);
-  assert.deepEqual(cfg.responsibilities, ["Run the platform org", "Own delivery confidence"]);
-  // other keys untouched
-  assert.equal(cfg.firstName, "Jacob");
-  // ledger updated
-  assert.equal(loadProgress(root).enrich["agent.responsibilities"].status, "enriched");
-});
-
-test("enrichField is fail-open on bad JSON — leaves skeleton, marks pending", async () => {
-  const root = tmpRoot();
-  const before = readAgentJson(root);
-  const fakeSpawn = async () => "definitely not json";
-  const res = await enrichField(root, "agent.persona", { spawn: fakeSpawn });
-  assert.equal(res.status, "pending");
-  assert.deepEqual(readAgentJson(root), before, "agent.json unchanged on failure");
-  assert.equal(loadProgress(root).enrich["agent.persona"].status, "pending");
-});
-
-test("enrichField is fail-open on spawn throw (no network)", async () => {
-  const root = tmpRoot();
-  const fakeSpawn = async () => { throw new Error("ENOENT claude"); };
-  const res = await enrichField(root, "agent.operatingPrinciples", { spawn: fakeSpawn });
-  assert.equal(res.status, "pending");
-  assert.match(res.reason, /spawn failed/);
-});
-
-test("enrichField rejects a banned-phrase response (stays pending)", async () => {
-  const root = tmpRoot();
-  const fakeSpawn = async () => JSON.stringify({ persona: "I'm here to help with anything you need." });
-  const res = await enrichField(root, "agent.persona", { spawn: fakeSpawn });
-  assert.equal(res.status, "pending");
-  assert.match(res.reason, /banned phrase/);
-});
-
-test("enrichField writes company.description for companyJson unit", async () => {
-  const root = tmpRoot();
-  const fakeSpawn = async () => JSON.stringify({ description: "Acme builds developer tooling for fintechs." });
-  const res = await enrichField(root, "company.description", { spawn: fakeSpawn });
-  assert.equal(res.status, "enriched");
-  const co = JSON.parse(readFileSync(join(root, "config/company.json"), "utf-8"));
-  assert.match(co.description, /developer tooling/);
-});
-
-test("enrichField skips unknown units", async () => {
-  const root = tmpRoot();
-  const res = await enrichField(root, "not.a.unit", { spawn: async () => "{}" });
-  assert.equal(res.status, "skipped");
-});
-
-test("BANNED_PHRASES includes the canonical AI-tells", () => {
-  assert.ok(BANNED_PHRASES.includes("as an ai"));
-  assert.ok(BANNED_PHRASES.includes("i'd be happy to"));
-});