@cohortapp/agent-sdk 2.3.0

package/lib/comms/send-gate.test.mjs

@@ -0,0 +1,577 @@
+/**
+ * Tests for lib/comms/send-gate.mjs — the shared outbound send-gate chokepoint.
+ *
+ * Covers (gaps-product-quality P0-3):
+ *   - every banned phrase / AI-tell opener blocks
+ *   - AI-disclosure: a concealed first-contact message under a disclose-always
+ *     posture blocks; a denial-of-AI ("I'm not a bot") blocks under any posture
+ *   - information-barrier wall blocks a walled topic to a matching recipient
+ *   - benign internal + external messages pass
+ *   - unreadable policy fails CLOSED for external, OPEN for internal
+ *   - recipient allowlist (opt-in)
+ *
+ * The filesystem reader is injected so every branch (including "unreadable
+ * policy") is driven without touching disk.
+ *
+ * @module lib/comms/send-gate.test
+ */
+
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync, writeFileSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import {
+  screenOutbound,
+  screenBannedPhrases,
+  screenDisclosure,
+  screenBarriers,
+  screenAllowlist,
+  classifyRecipient,
+  BANNED_SUBSTRINGS,
+  BANNED_OPENERS,
+} from "./send-gate.mjs";
+
+/* ─── fixtures ─────────────────────────────────────────────────────────────
+ * A minimal but realistic ai-disclosure.yaml and information-barriers.yaml.
+ * The disclosure file mirrors the real one's resolution semantics: EU →
+ * disclose-always, default → disclose-always, internal-style on-ask posture
+ * available for non-first-contact testing.
+ */
+
+const DISCLOSURE_YAML = `
+version: 1
+invariant:
+  answer_truthfully_if_asked: true
+posture:
+  disclose-always:
+    proactive_disclosure: true
+    machine_readable_marking: true
+  disclose-on-ask:
+    proactive_disclosure: false
+    machine_readable_marking: true
+  concealed-where-legal:
+    proactive_disclosure: false
+    machine_readable_marking: false
+    requires_sign_off: true
+default_posture: disclose-always
+governance:
+  sign_off:
+    required_for: [concealed-where-legal]
+    approver: null
+    jurisdictions: []
+jurisdictions:
+  EU:
+    posture: disclose-always
+  US-CA:
+    posture: disclose-on-ask
+  US-NV:
+    posture: concealed-where-legal
+  default:
+    posture: disclose-always
+resolution:
+  unsigned_concealed_posture: disclose-always
+`;
+
+const BARRIERS_YAML = `
+domains:
+  financial:
+    default_sensitivity: high
+barriers:
+  - name: partner-wall
+    recipient_pattern: "@partnerco\\\\.com$"
+    blocked_topics:
+      - "cap table"
+      - "acquisition target"
+    reason: "PartnerCo must not see Northwind cap table / M&A pipeline"
+  - name: external-financials
+    recipient_class: external
+    blocked_topics:
+      - "runway"
+`;
+
+/** Build an injectable fs over an in-memory map of relPath → contents|null. */
+function memFs(files) {
+  return {
+    existsSync: (p) => {
+      for (const [rel, val] of Object.entries(files)) {
+        if (p.endsWith(rel)) return val !== null && val !== undefined;
+      }
+      return false;
+    },
+    readFileSync: (p) => {
+      for (const [rel, val] of Object.entries(files)) {
+        if (p.endsWith(rel)) {
+          if (val === null || val === undefined) {
+            const e = new Error("EACCES");
+            e.code = "EACCES";
+            throw e;
+          }
+          return val;
+        }
+      }
+      const e = new Error("ENOENT");
+      e.code = "ENOENT";
+      throw e;
+    },
+  };
+}
+
+const ROOT = "/repo";
+const GOOD_FILES = {
+  "policies/ai-disclosure.yaml": DISCLOSURE_YAML,
+  "policies/information-barriers.yaml": BARRIERS_YAML,
+};
+
+/* ─── banned phrases ───────────────────────────────────────────────────────*/
+
+describe("screenBannedPhrases", () => {
+  for (const phrase of BANNED_SUBSTRINGS) {
+    it(`blocks banned substring: ${phrase}`, () => {
+      const reason = screenBannedPhrases(`Hi there. ${phrase} so let's go.`);
+      assert.ok(reason, `expected a block for "${phrase}"`);
+      assert.match(reason, /banned AI-tell phrase/);
+    });
+  }
+
+  for (const opener of BANNED_OPENERS) {
+    it(`blocks banned opener at message start: ${opener}`, () => {
+      const reason = screenBannedPhrases(`${opener} Here we go.`);
+      assert.ok(reason);
+      assert.match(reason, /banned filler opener/);
+    });
+    it(`blocks banned opener at line start: ${opener}`, () => {
+      const reason = screenBannedPhrases(`First line.\n${opener} second.`);
+      assert.ok(reason);
+    });
+  }
+
+  it("allows benign prose with no AI-tells", () => {
+    assert.equal(screenBannedPhrases("In progress — only blocker is DBA approval."), null);
+  });
+
+  it("does not block 'absolutely' mid-sentence (opener-only rule)", () => {
+    assert.equal(screenBannedPhrases("That is absolutely the right call."), null);
+  });
+
+  it("is case-insensitive", () => {
+    assert.ok(screenBannedPhrases("AS AN AI, I cannot do that."));
+  });
+});
+
+/* ─── end-to-end: banned phrase blocks via screenOutbound ──────────────────*/
+
+describe("screenOutbound — banned phrases", () => {
+  it("blocks a message containing a banned phrase (external)", async () => {
+    const res = await screenOutbound({
+      channel: "email",
+      recipient: "graham@kpm.com",
+      text: "I'd be happy to set up a call.",
+      agentRoot: ROOT,
+      fs: memFs(GOOD_FILES),
+    });
+    assert.equal(res.allow, false);
+    assert.match(res.reason, /banned AI-tell phrase/);
+  });
+
+  it("blocks banned phrase even for internal recipients", async () => {
+    const res = await screenOutbound({
+      channel: "slack",
+      recipient: "C0123456",
+      text: "As an AI, I think we should ship.",
+      agentRoot: ROOT,
+      fs: memFs(GOOD_FILES),
+    });
+    assert.equal(res.allow, false);
+  });
+});
+
+/* ─── disclosure ───────────────────────────────────────────────────────────*/
+
+describe("screenDisclosure (unit)", () => {
+  const policy = {
+    posture: {
+      "disclose-always": { proactive_disclosure: true },
+      "disclose-on-ask": { proactive_disclosure: false },
+    },
+    default_posture: "disclose-always",
+    jurisdictions: { EU: { posture: "disclose-always" }, "US-CA": { posture: "disclose-on-ask" }, default: { posture: "disclose-always" } },
+  };
+
+  it("blocks a concealed first-contact message under disclose-always", () => {
+    const r = screenDisclosure("Hi, can we move the meeting to 3pm?", {
+      policy,
+      jurisdiction: "EU",
+      firstContact: true,
+    });
+    assert.ok(r);
+    assert.match(r, /proactive disclosure/);
+  });
+
+  it("allows a first-contact message that discloses AI nature", () => {
+    const r = screenDisclosure(
+      "Hi — I'm an AI assistant working on behalf of Alex. Can we move to 3pm?",
+      { policy, jurisdiction: "EU", firstContact: true },
+    );
+    assert.equal(r, null);
+  });
+
+  it("does not require disclosure on a non-first-contact reply", () => {
+    const r = screenDisclosure("Sounds good, 3pm works.", {
+      policy,
+      jurisdiction: "EU",
+      firstContact: false,
+    });
+    assert.equal(r, null);
+  });
+
+  it("does not require proactive disclosure under disclose-on-ask", () => {
+    const r = screenDisclosure("Sure, let's do 3pm.", {
+      policy,
+      jurisdiction: "US-CA",
+      firstContact: true,
+    });
+    assert.equal(r, null);
+  });
+
+  it("blocks an explicit denial of AI nature under ANY posture (invariant)", () => {
+    const r = screenDisclosure("No, I'm not a bot, I'm a real person.", {
+      policy,
+      jurisdiction: "US-CA", // even the on-ask posture cannot relax the invariant
+      firstContact: false,
+    });
+    assert.ok(r);
+    assert.match(r, /invariant/);
+  });
+
+  it("blocks denial even with no policy loaded (embedded invariant list)", () => {
+    const r = screenDisclosure("I am not an AI.", { policy: null });
+    assert.ok(r);
+  });
+
+  it("collapses unsigned concealed-where-legal to disclose-always", () => {
+    const concealedPolicy = {
+      posture: {
+        "disclose-always": { proactive_disclosure: true },
+        "concealed-where-legal": { proactive_disclosure: false },
+      },
+      default_posture: "disclose-always",
+      governance: { sign_off: { approver: null, jurisdictions: [] } },
+      jurisdictions: { "US-NV": { posture: "concealed-where-legal" } },
+    };
+    const r = screenDisclosure("Hi, moving the meeting to 3pm.", {
+      policy: concealedPolicy,
+      jurisdiction: "US-NV",
+      firstContact: true,
+    });
+    assert.ok(r, "unsigned concealed posture must fail safe to disclose-always");
+  });
+});
+
+describe("screenOutbound — disclosure", () => {
+  it("blocks a concealed first-contact external EU message", async () => {
+    const res = await screenOutbound({
+      channel: "email",
+      recipient: "client@example.eu",
+      text: "Following up on the contract — can we sign Friday?",
+      agentRoot: ROOT,
+      jurisdiction: "EU",
+      firstContact: true,
+      fs: memFs(GOOD_FILES),
+    });
+    assert.equal(res.allow, false);
+    assert.match(res.reason, /disclosure/i);
+  });
+
+  it("blocks a denial of AI nature regardless of jurisdiction", async () => {
+    const res = await screenOutbound({
+      channel: "whatsapp",
+      recipient: "+15551234567",
+      text: "Haha no, I'm a real person, not a bot.",
+      agentRoot: ROOT,
+      jurisdiction: "US-CA",
+      firstContact: false,
+      fs: memFs(GOOD_FILES),
+    });
+    assert.equal(res.allow, false);
+    assert.match(res.reason, /invariant/);
+  });
+});
+
+/* ─── information barriers ─────────────────────────────────────────────────*/
+
+describe("screenBarriers (unit)", () => {
+  let policy;
+  it("loads the barriers fixture for unit checks", async () => {
+    const yaml = (await import("js-yaml")).default;
+    policy = yaml.load(BARRIERS_YAML);
+    assert.ok(Array.isArray(policy.barriers));
+  });
+
+  it("blocks a walled topic to a pattern-matched recipient", () => {
+    const r = screenBarriers("Here's the latest cap table figures.", {
+      policy,
+      recipient: "deals@partnerco.com",
+      recipientClass: "external",
+    });
+    assert.ok(r);
+    assert.match(r, /information barrier/);
+  });
+
+  it("allows a non-walled topic to the same recipient", () => {
+    const r = screenBarriers("Confirming the JV ops sync at 10am.", {
+      policy,
+      recipient: "deals@partnerco.com",
+      recipientClass: "external",
+    });
+    assert.equal(r, null);
+  });
+
+  it("blocks a recipient_class wall (runway → any external)", () => {
+    const r = screenBarriers("Our runway is 14 months.", {
+      policy,
+      recipient: "investor@somefund.com",
+      recipientClass: "external",
+    });
+    assert.ok(r);
+  });
+
+  it("does not apply a recipient_class wall to internal recipients", () => {
+    const r = screenBarriers("Our runway is 14 months.", {
+      policy,
+      recipient: "C0123456",
+      recipientClass: "internal",
+    });
+    assert.equal(r, null);
+  });
+
+  it("is a no-op when no barriers section is present", () => {
+    const r = screenBarriers("anything at all cap table runway", {
+      policy: { domains: {} },
+      recipient: "x@y.com",
+      recipientClass: "external",
+    });
+    assert.equal(r, null);
+  });
+});
+
+describe("screenOutbound — barriers", () => {
+  it("blocks a walled topic to a walled recipient end-to-end", async () => {
+    const res = await screenOutbound({
+      channel: "email",
+      recipient: "deals@partnerco.com",
+      // Discloses AI to pass the disclosure gate; barrier is what trips.
+      text: "Writing as the AI assistant for Alex — here's our cap table.",
+      agentRoot: ROOT,
+      jurisdiction: "default",
+      firstContact: true,
+      fs: memFs(GOOD_FILES),
+    });
+    assert.equal(res.allow, false);
+    assert.match(res.reason, /information barrier/);
+  });
+});
+
+/* ─── allowlist ────────────────────────────────────────────────────────────*/
+
+describe("screenAllowlist", () => {
+  it("is a no-op when not configured", () => {
+    assert.equal(screenAllowlist("x@y.com", undefined), null);
+    assert.equal(screenAllowlist("x@y.com", []), null);
+  });
+  it("allows a recipient on the list", () => {
+    assert.equal(screenAllowlist("x@y.com", ["x@y.com", "z@y.com"]), null);
+  });
+  it("blocks a recipient not on the list", () => {
+    const r = screenAllowlist("intruder@evil.com", ["x@y.com"]);
+    assert.ok(r);
+    assert.match(r, /not on the configured send allowlist/);
+  });
+});
+
+describe("screenOutbound — allowlist", () => {
+  it("blocks an off-allowlist recipient", async () => {
+    const res = await screenOutbound({
+      channel: "email",
+      recipient: "intruder@evil.com",
+      text: "Writing as the AI assistant for Alex — quick question.",
+      agentRoot: ROOT,
+      jurisdiction: "default",
+      allowlist: ["client@example.eu"],
+      fs: memFs(GOOD_FILES),
+    });
+    assert.equal(res.allow, false);
+    assert.match(res.reason, /allowlist/);
+  });
+});
+
+/* ─── benign passes ────────────────────────────────────────────────────────*/
+
+describe("screenOutbound — benign", () => {
+  it("passes a benign internal Slack reply", async () => {
+    const res = await screenOutbound({
+      channel: "slack",
+      recipient: "C0123456",
+      text: "In progress — only blocker is DBA approval, expected by EOD.",
+      agentRoot: ROOT,
+      firstContact: false,
+      fs: memFs(GOOD_FILES),
+    });
+    assert.equal(res.allow, true, res.reason);
+  });
+
+  it("passes a benign external email that discloses AI on first contact", async () => {
+    const res = await screenOutbound({
+      channel: "email",
+      recipient: "client@example.eu",
+      text: "Writing as the AI assistant for Alex — can we sign the contract Friday?",
+      agentRoot: ROOT,
+      jurisdiction: "EU",
+      firstContact: true,
+      fs: memFs(GOOD_FILES),
+    });
+    assert.equal(res.allow, true, res.reason);
+  });
+});
+
+/* ─── fail posture ─────────────────────────────────────────────────────────*/
+
+describe("screenOutbound — fail posture (unreadable policy)", () => {
+  it("fails CLOSED for an external recipient when ai-disclosure.yaml is unreadable", async () => {
+    const res = await screenOutbound({
+      channel: "email",
+      recipient: "client@example.eu", // external
+      text: "Writing as the AI assistant for Alex — quick note.",
+      agentRoot: ROOT,
+      jurisdiction: "default",
+      firstContact: true,
+      fs: memFs({
+        "policies/ai-disclosure.yaml": null, // unreadable (EACCES)
+        "policies/information-barriers.yaml": BARRIERS_YAML,
+      }),
+    });
+    assert.equal(res.allow, false);
+    assert.match(res.reason, /unreadable.*external|failing closed/i);
+  });
+
+  it("fails CLOSED for external when information-barriers.yaml is unreadable", async () => {
+    const res = await screenOutbound({
+      channel: "email",
+      recipient: "client@example.eu",
+      text: "Writing as the AI assistant for Alex — quick note.",
+      agentRoot: ROOT,
+      jurisdiction: "default",
+      firstContact: true,
+      fs: memFs({
+        "policies/ai-disclosure.yaml": DISCLOSURE_YAML,
+        "policies/information-barriers.yaml": null, // unreadable
+      }),
+    });
+    assert.equal(res.allow, false);
+    assert.match(res.reason, /unreadable|failing closed/i);
+  });
+
+  it("fails OPEN for an internal recipient when a policy file is unreadable", async () => {
+    const res = await screenOutbound({
+      channel: "slack",
+      recipient: "C0123456", // internal Slack id
+      text: "Heads up — deploy is going out at 4pm.",
+      agentRoot: ROOT,
+      firstContact: false,
+      fs: memFs({
+        "policies/ai-disclosure.yaml": null,
+        "policies/information-barriers.yaml": null,
+      }),
+    });
+    assert.equal(res.allow, true, res.reason);
+  });
+
+  it("fails CLOSED for external when disclosure YAML is malformed", async () => {
+    const res = await screenOutbound({
+      channel: "email",
+      recipient: "client@example.eu",
+      text: "Writing as the AI assistant for Alex — quick note.",
+      agentRoot: ROOT,
+      jurisdiction: "default",
+      firstContact: true,
+      fs: memFs({
+        "policies/ai-disclosure.yaml": "{[ this is : not valid yaml :::",
+        "policies/information-barriers.yaml": BARRIERS_YAML,
+      }),
+    });
+    assert.equal(res.allow, false);
+  });
+
+  it("still blocks a banned phrase even when policy files are missing (embedded SoT)", async () => {
+    // Internal recipient + missing files would otherwise fail-open; the banned
+    // phrase screen runs first off the embedded constant list, so it still trips.
+    const res = await screenOutbound({
+      channel: "slack",
+      recipient: "C0123456",
+      text: "As an AI I will help.",
+      agentRoot: ROOT,
+      fs: memFs({}),
+    });
+    assert.equal(res.allow, false);
+    assert.match(res.reason, /banned/);
+  });
+});
+
+/* ─── recipient classification ─────────────────────────────────────────────*/
+
+describe("classifyRecipient", () => {
+  it("classifies Slack channel/DM ids as internal", () => {
+    assert.equal(classifyRecipient("slack", "C0123456"), "internal");
+    assert.equal(classifyRecipient("slack", "D0ABCDEFG"), "internal");
+    assert.equal(classifyRecipient("slack", "U0ABCDEFG"), "internal");
+  });
+  it("classifies Telegram numeric chat ids as internal", () => {
+    assert.equal(classifyRecipient("telegram", "123456789"), "internal");
+    assert.equal(classifyRecipient("telegram", "-1001234567"), "internal");
+  });
+  it("classifies emails as external by default", () => {
+    assert.equal(classifyRecipient("email", "x@external.com"), "external");
+  });
+  it("classifies emails on internal domains as internal", () => {
+    assert.equal(
+      classifyRecipient("email", "alex@internal.example", ["internal.example"]),
+      "internal",
+    );
+    assert.equal(
+      classifyRecipient("email", "ops@eng.internal.example", ["internal.example"]),
+      "internal",
+    );
+  });
+  it("classifies phone numbers as external", () => {
+    assert.equal(classifyRecipient("whatsapp", "+15551234567"), "external");
+    assert.equal(classifyRecipient("sms", "+15551234567"), "external");
+  });
+  it("treats empty recipient as external (conservative)", () => {
+    assert.equal(classifyRecipient("email", ""), "external");
+  });
+});
+
+/* ─── real-disk integration smoke (uses the actual readPolicy path) ────────*/
+
+describe("screenOutbound — real-disk read path", () => {
+  it("reads policies from a real agentRoot and blocks a barrier", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "send-gate-"));
+    try {
+      mkdirSync(join(dir, "policies"), { recursive: true });
+      writeFileSync(join(dir, "policies", "ai-disclosure.yaml"), DISCLOSURE_YAML);
+      writeFileSync(join(dir, "policies", "information-barriers.yaml"), BARRIERS_YAML);
+      const res = await screenOutbound({
+        channel: "email",
+        recipient: "deals@partnerco.com",
+        text: "Writing as the AI assistant for Alex — our acquisition target list.",
+        agentRoot: dir,
+        jurisdiction: "default",
+        firstContact: true,
+      });
+      assert.equal(res.allow, false);
+      assert.match(res.reason, /information barrier/);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});

package/lib/comms.mjs

@@ -0,0 +1,67 @@
+/**
+ * comms.mjs — resolve an archetype's communication profile.
+ *
+ * Tone, register, voice modes, channel strategy, and which message templates the
+ * role uses are a function of the archetype, layered on the single tone SoT
+ * (policies/communication-style.md). Altitude drives formality + register
+ * (a founder is direct and fast; a C-suite officer is board-ready and formal);
+ * function drives the channel strategy + template packs (a compliance officer
+ * lives in email + filings portals; a technical leader in Slack + GitHub).
+ *
+ * The generator (scripts/setup/generate-comms.mjs) writes the resolved profile to
+ * policies/communication-profile.yaml; CLAUDE.md + drafting surfaces reference it.
+ *
+ * Pure-ish (resolves the archetype profile). ESM.
+ *
+ * @module comms
+ */
+
+"use strict";
+
+import { resolveArchetype } from "./archetype.mjs";
+
+/** Function → ranked channel strategy (most-preferred first). */
+export const CHANNEL_STRATEGY = {
+  "executive-operator": ["slack", "email", "calendar", "whatsapp", "voice"],
+  "technical-leader": ["slack", "github", "email", "calendar"],
+  "commercial-leader": ["email", "slack", "calendar", "voice", "linkedin"],
+  "finance-leader": ["email", "slack", "calendar", "spreadsheet", "formal-letter"],
+  "compliance-officer": ["email", "filings-portal", "formal-letter", "slack", "calendar"],
+  "product-leader": ["slack", "email", "calendar", "figma", "analytics-dashboard"],
+  "operations-leader": ["slack", "email", "calendar", "ticketing", "spreadsheet"],
+};
+
+/** Altitude → communication register (how the agent's voice reads). */
+export const REGISTER_BY_ALTITUDE = {
+  founder: "Direct and fast; minimal ceremony; sets direction in plain terms.",
+  "c-suite": "Board-ready and precise; formal externally; concise internally.",
+  svp: "Senior and structured; outcome-led; formal with external/regulatory parties.",
+  vp: "Professional and concrete; owns the detail; matches the counterpart's register.",
+  "senior-manager": "Operational and concise; hands-on; clear next steps.",
+};
+
+/**
+ * Resolve the communication profile for a { function, altitude }.
+ * @param {{function:string, altitude:string}} sel
+ * @returns {Promise<object>} the comms profile
+ */
+export async function resolveCommsProfile(sel = {}) {
+  const profile = await resolveArchetype(sel);
+  const comm = profile.communication || {};
+  return {
+    function: sel.function,
+    altitude: sel.altitude,
+    styleRef: profile.communicationStyleRef || "policies/communication-style.md",
+    formality: comm.formality || "medium",
+    cadenceDensity: comm.cadenceDensity || "medium",
+    register: REGISTER_BY_ALTITUDE[sel.altitude] || "Professional and concrete.",
+    voiceModes: profile.voiceModes || [],
+    channelStrategy: CHANNEL_STRATEGY[sel.function] || ["slack", "email", "calendar"],
+    templatePacks: profile.templatePacks || [],
+  };
+}
+
+/** Functions with a defined channel strategy. @returns {string[]} */
+export function listCommsFunctions() {
+  return Object.keys(CHANNEL_STRATEGY);
+}

package/lib/comms.test.mjs

@@ -0,0 +1,41 @@
+/**
+ * comms.test.mjs — tests for the archetype communication-profile resolver.
+ * Run: `node --test lib/comms.test.mjs`
+ * @module comms.test
+ */
+
+"use strict";
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { resolveCommsProfile, CHANNEL_STRATEGY, REGISTER_BY_ALTITUDE, listCommsFunctions } from "./comms.mjs";
+
+test("comms profile carries altitude register + function channel strategy + voice modes", async () => {
+  const p = await resolveCommsProfile({ function: "compliance-officer", altitude: "c-suite" });
+  assert.equal(p.register, REGISTER_BY_ALTITUDE["c-suite"]);
+  assert.deepEqual(p.channelStrategy, CHANNEL_STRATEGY["compliance-officer"]);
+  assert.ok(p.channelStrategy.includes("filings-portal"));
+  assert.ok(p.voiceModes.length >= 4);
+  assert.ok(["high", "medium", "relaxed"].includes(p.formality));
+  assert.equal(p.styleRef, "policies/communication-style.md");
+});
+
+test("function changes the channel strategy (technical → github; commercial → linkedin)", async () => {
+  const tech = await resolveCommsProfile({ function: "technical-leader", altitude: "vp" });
+  const comm = await resolveCommsProfile({ function: "commercial-leader", altitude: "vp" });
+  assert.ok(tech.channelStrategy.includes("github"));
+  assert.ok(comm.channelStrategy.includes("linkedin"));
+  assert.notDeepEqual(tech.channelStrategy, comm.channelStrategy);
+});
+
+test("altitude changes the register (founder direct vs c-suite board-ready)", async () => {
+  const founder = await resolveCommsProfile({ function: "executive-operator", altitude: "founder" });
+  const cSuite = await resolveCommsProfile({ function: "executive-operator", altitude: "c-suite" });
+  assert.match(founder.register, /direct/i);
+  assert.match(cSuite.register, /board-ready/i);
+  assert.ok(founder.channelStrategy.includes("whatsapp") || founder.channelStrategy.includes("voice"));
+});
+
+test("listCommsFunctions covers the seven functions (incl. finance-leader)", () => {
+  assert.equal(listCommsFunctions().length, 7);
+});