@complior/engine 0.9.0

package/src/domain/whatif/simulate-actions.test.ts

@@ -0,0 +1,161 @@
+import { describe, it, expect } from 'vitest';
+import { simulateActions } from './simulate-actions.js';
+
+describe('simulateActions', () => {
+  const baseInput = {
+    currentScore: 60,
+    findings: [
+      { checkId: 'l1-risk', severity: 'critical', status: 'fail' },
+      { checkId: 'l2-fria', severity: 'high', status: 'fail' },
+      { checkId: 'l3-sdk', severity: 'medium', status: 'fail' },
+    ],
+    passportCompleteness: 70,
+  };
+
+  it('simulates fixing a critical finding', () => {
+    const result = simulateActions({
+      ...baseInput,
+      actions: [{ type: 'fix', target: 'l1-risk' }],
+    });
+    expect(result.currentScore).toBe(60);
+    expect(result.projectedScore).toBeGreaterThan(60);
+    expect(result.delta).toBeGreaterThan(0);
+    expect(result.actions).toHaveLength(1);
+    expect(result.actions[0]!.scoreImpact).toBe(5.0);
+    expect(result.actions[0]!.description).toContain('critical');
+  });
+
+  it('simulates fixing a high-severity finding', () => {
+    const result = simulateActions({
+      ...baseInput,
+      actions: [{ type: 'fix', target: 'l2-fria' }],
+    });
+    expect(result.actions[0]!.scoreImpact).toBe(3.0);
+    expect(result.delta).toBe(3.0);
+  });
+
+  it('simulates fixing a medium-severity finding', () => {
+    const result = simulateActions({
+      ...baseInput,
+      actions: [{ type: 'fix', target: 'l3-sdk' }],
+    });
+    expect(result.actions[0]!.scoreImpact).toBe(1.5);
+  });
+
+  it('returns zero impact for non-existent finding', () => {
+    const result = simulateActions({
+      ...baseInput,
+      actions: [{ type: 'fix', target: 'nonexistent' }],
+    });
+    expect(result.actions[0]!.scoreImpact).toBe(0);
+    expect(result.delta).toBe(0);
+    expect(result.actions[0]!.description).toContain('not found');
+  });
+
+  it('returns zero impact for already-passing finding', () => {
+    const result = simulateActions({
+      ...baseInput,
+      findings: [{ checkId: 'l1-risk', severity: 'critical', status: 'pass' }],
+      actions: [{ type: 'fix', target: 'l1-risk' }],
+    });
+    expect(result.actions[0]!.scoreImpact).toBe(0);
+    expect(result.actions[0]!.description).toContain('not found or already passing');
+  });
+
+  it('simulates adding a FRIA document', () => {
+    const result = simulateActions({
+      ...baseInput,
+      actions: [{ type: 'add-doc', target: 'fria' }],
+    });
+    expect(result.delta).toBe(4.0);
+    expect(result.actions[0]!.description).toContain('fria');
+  });
+
+  it('simulates adding a technical-documentation doc', () => {
+    const result = simulateActions({
+      ...baseInput,
+      actions: [{ type: 'add-doc', target: 'technical-documentation' }],
+    });
+    expect(result.delta).toBe(3.0);
+  });
+
+  it('uses default impact for unknown doc type', () => {
+    const result = simulateActions({
+      ...baseInput,
+      actions: [{ type: 'add-doc', target: 'some-custom-doc' }],
+    });
+    expect(result.delta).toBe(2.0);
+  });
+
+  it('simulates completing passport field', () => {
+    const result = simulateActions({
+      ...baseInput,
+      actions: [{ type: 'complete-passport', target: 'description' }],
+    });
+    expect(result.delta).toBe(1.0);
+    expect(result.actions[0]!.description).toContain('description');
+  });
+
+  it('returns zero for passport already at 100%', () => {
+    const result = simulateActions({
+      ...baseInput,
+      passportCompleteness: 100,
+      actions: [{ type: 'complete-passport', target: 'description' }],
+    });
+    expect(result.delta).toBe(0);
+    expect(result.actions[0]!.description).toContain('100% complete');
+  });
+
+  it('handles multiple actions', () => {
+    const result = simulateActions({
+      ...baseInput,
+      actions: [
+        { type: 'fix', target: 'l1-risk' },
+        { type: 'add-doc', target: 'fria' },
+        { type: 'complete-passport', target: 'description' },
+      ],
+    });
+    expect(result.actions).toHaveLength(3);
+    expect(result.projectedScore).toBeGreaterThan(result.currentScore);
+    // 5.0 + 4.0 + 1.0 = 10.0
+    expect(result.delta).toBe(10.0);
+    expect(result.projectedScore).toBe(70);
+  });
+
+  it('caps projected score at 100', () => {
+    const result = simulateActions({
+      currentScore: 98,
+      findings: [{ checkId: 'x', severity: 'critical', status: 'fail' }],
+      passportCompleteness: 100,
+      actions: [{ type: 'fix', target: 'x' }],
+    });
+    expect(result.projectedScore).toBe(100);
+    // delta should be capped too: 100 - 98 = 2, not the raw 5.0
+    expect(result.delta).toBe(2);
+  });
+
+  it('returns frozen result', () => {
+    const result = simulateActions({
+      ...baseInput,
+      actions: [{ type: 'fix', target: 'l1-risk' }],
+    });
+    expect(Object.isFrozen(result)).toBe(true);
+  });
+
+  it('returns frozen action results', () => {
+    const result = simulateActions({
+      ...baseInput,
+      actions: [{ type: 'fix', target: 'l1-risk' }],
+    });
+    expect(Object.isFrozen(result.actions)).toBe(true);
+    expect(Object.isFrozen(result.actions[0])).toBe(true);
+  });
+
+  it('preserves currentScore in result', () => {
+    const result = simulateActions({
+      ...baseInput,
+      actions: [{ type: 'fix', target: 'l1-risk' }],
+    });
+    expect(result.currentScore).toBe(60);
+  });
+});

package/src/domain/whatif/simulate-actions.ts

@@ -0,0 +1,114 @@
+/**
+ * US-S05-25: Compliance Simulation — deterministic what-if analysis.
+ *
+ * Given a set of planned actions (fix finding, add document, complete passport field),
+ * projects the compliance score delta without actually executing anything.
+ */
+
+import type { SeverityLevel, ComplianceDocType } from '../shared/compliance-constants.js';
+
+export interface SimulationAction {
+  readonly type: 'fix' | 'add-doc' | 'complete-passport';
+  /** checkId for fix, docType for add-doc, fieldName for complete-passport */
+  readonly target: string;
+}
+
+export interface SimulationInput {
+  readonly actions: readonly SimulationAction[];
+  readonly currentScore: number;
+  readonly findings: readonly { checkId: string; severity: string; status: string }[];
+  readonly passportCompleteness: number;
+}
+
+export interface SimulatedActionResult {
+  readonly type: string;
+  readonly target: string;
+  readonly scoreImpact: number;
+  readonly description: string;
+}
+
+export interface SimulationResult {
+  readonly currentScore: number;
+  readonly projectedScore: number;
+  readonly delta: number;
+  readonly actions: readonly SimulatedActionResult[];
+}
+
+/** Score points gained per severity of fixed finding. */
+const SEVERITY_IMPACT: Record<SeverityLevel, number> = {
+  critical: 5.0,
+  high: 3.0,
+  medium: 1.5,
+  low: 0.5,
+};
+
+/** Score points gained per added compliance document. */
+const DOC_IMPACT: Record<ComplianceDocType, number> = {
+  fria: 4.0,
+  'technical-documentation': 3.0,
+  'worker-notification': 2.0,
+  'monitoring-policy': 2.0,
+  'ai-literacy': 1.5,
+  'declaration-of-conformity': 3.0,
+  'incident-report': 1.0,
+};
+
+export const simulateActions = (input: SimulationInput): SimulationResult => {
+  const { actions, currentScore, findings, passportCompleteness } = input;
+  const results: SimulatedActionResult[] = [];
+  let totalDelta = 0;
+
+  for (const action of actions) {
+    let impact = 0;
+    let description = '';
+
+    switch (action.type) {
+      case 'fix': {
+        const finding = findings.find(
+          (f) => f.checkId === action.target && f.status === 'fail',
+        );
+        if (finding) {
+          impact = SEVERITY_IMPACT[finding.severity] ?? 1.5;
+          description = `Fix ${action.target} (${finding.severity}) → +${impact.toFixed(1)} points`;
+        } else {
+          description = `Finding ${action.target} not found or already passing`;
+        }
+        break;
+      }
+      case 'add-doc': {
+        impact = DOC_IMPACT[action.target] ?? 2.0;
+        description = `Add ${action.target} document → +${impact.toFixed(1)} points`;
+        break;
+      }
+      case 'complete-passport': {
+        const currentPct = passportCompleteness;
+        if (currentPct < 100) {
+          impact = 1.0;
+          description = `Complete passport field "${action.target}" → +${impact.toFixed(1)} points`;
+        } else {
+          description = 'Passport already 100% complete';
+        }
+        break;
+      }
+    }
+
+    totalDelta += impact;
+    results.push(
+      Object.freeze({
+        type: action.type,
+        target: action.target,
+        scoreImpact: impact,
+        description,
+      }),
+    );
+  }
+
+  const projectedScore = Math.min(100, currentScore + totalDelta);
+
+  return Object.freeze({
+    currentScore,
+    projectedScore,
+    delta: Math.round((projectedScore - currentScore) * 10) / 10,
+    actions: Object.freeze(results),
+  });
+};

package/src/domain/whatif/whatif.test.ts

@@ -0,0 +1,135 @@
+import { describe, it, expect } from 'vitest';
+import { analyzeScenario } from './scenario-engine.js';
+import { generateAllConfigs, generateDockerCompose, generateEnvExample } from './config-fixer.js';
+import type { OnboardingProfile } from '../../onboarding/profile.js';
+import type { ScoreBreakdown } from '../../types/common.types.js';
+
+const mockProfile: OnboardingProfile = {
+  version: '1.0',
+  createdAt: '2026-01-01T00:00:00Z',
+  updatedAt: '2026-01-01T00:00:00Z',
+  autoDetected: {
+    language: 'TypeScript', framework: 'Next.js', cicd: 'github-actions',
+    deployment: 'Docker', aiLibraries: ['OpenAI SDK'], hasDockerCompose: false,
+    hasEnvExample: false, detectedModels: ['gpt-4o'], confidence: 0.8,
+  },
+  aiSystem: { type: 'feature', outputTypes: ['text'] },
+  jurisdiction: { primary: 'EU', regulations: ['eu-ai-act'] },
+  organization: { role: 'deployer' },
+  business: { domain: 'healthcare', companySize: 'startup' },
+  data: { types: ['personal', 'health'], storage: 'eu' },
+  goals: { priority: 'full', budget: 'moderate' },
+  computed: { riskLevel: 'high', applicableObligations: ['OBL-001'], estimatedScore: 25 },
+};
+
+const mockScore: ScoreBreakdown = {
+  totalScore: 52,
+  zone: 'yellow',
+  categoryScores: [],
+  criticalCapApplied: false,
+  totalChecks: 30,
+  passedChecks: 15,
+  failedChecks: 12,
+  skippedChecks: 3,
+};
+
+describe('What-If Scenario Engine', () => {
+  it('jurisdiction scenario — EU + UK', () => {
+    const result = analyzeScenario({
+      type: 'jurisdiction',
+      params: { jurisdiction: 'UK' },
+      currentProfile: mockProfile,
+      currentScore: mockScore,
+    });
+
+    expect(result.scoreDelta).toBeLessThan(0);
+    expect(result.projectedScore).toBeLessThan(52);
+    expect(result.newObligations.length).toBeGreaterThan(0);
+    expect(result.scenario).toContain('UK');
+    expect(result.effort.estimatedWeeks).toBeGreaterThan(0);
+  });
+
+  it('tool scenario — add Whisper', () => {
+    const result = analyzeScenario({
+      type: 'tool',
+      params: { tool: 'whisper' },
+      currentProfile: mockProfile,
+      currentScore: mockScore,
+    });
+
+    expect(result.scoreDelta).toBe(-5);
+    expect(result.projectedScore).toBe(47);
+    expect(result.newObligations).toContain('Audio data retention');
+  });
+
+  it('tool scenario — add DALL-E', () => {
+    const result = analyzeScenario({
+      type: 'tool',
+      params: { tool: 'dall-e' },
+      currentProfile: mockProfile,
+      currentScore: mockScore,
+    });
+
+    expect(result.scoreDelta).toBe(-8);
+    expect(result.newObligations).toContain('Art. 50.2 content marking');
+  });
+
+  it('risk level scenario — limited to high', () => {
+    const limitedProfile = { ...mockProfile, computed: { ...mockProfile.computed, riskLevel: 'limited' as const } };
+    const result = analyzeScenario({
+      type: 'risk_level',
+      params: { level: 'high' },
+      currentProfile: limitedProfile,
+      currentScore: mockScore,
+    });
+
+    expect(result.scoreDelta).toBe(-20);
+    expect(result.newObligations.length).toBeGreaterThan(0);
+    expect(result.recommendation).toContain('high');
+  });
+
+  it('unknown scenario type returns neutral result', () => {
+    const result = analyzeScenario({
+      type: 'unknown' as any,
+      params: {},
+      currentProfile: mockProfile,
+      currentScore: mockScore,
+    });
+
+    expect(result.scoreDelta).toBe(0);
+    expect(result.projectedScore).toBe(52);
+  });
+});
+
+describe('Config Fixer', () => {
+  it('generates all 3 config types', () => {
+    const configs = generateAllConfigs(mockProfile);
+    expect(configs).toHaveLength(3);
+    expect(configs.map((c) => c.type)).toEqual(['docker-compose', 'env', 'ci-cd']);
+  });
+
+  it('docker-compose includes audit-db for all profiles', () => {
+    const config = generateDockerCompose(mockProfile);
+    expect(config.content).toContain('audit-db');
+    expect(config.content).toContain('AI_DISCLOSURE_ENABLED=true');
+  });
+
+  it('docker-compose includes monitoring for high-risk', () => {
+    const config = generateDockerCompose(mockProfile);
+    expect(config.content).toContain('monitoring');
+    expect(config.content).toContain('prometheus');
+  });
+
+  it('env includes data protection for health data', () => {
+    const config = generateEnvExample(mockProfile);
+    expect(config.content).toContain('DATA_RETENTION_DAYS');
+    expect(config.content).toContain('DATA_ENCRYPTION_AT_REST');
+  });
+
+  it('CI workflow uses correct threshold for risk level', () => {
+    const configs = generateAllConfigs(mockProfile);
+    const ciConfig = configs.find((c) => c.type === 'ci-cd')!;
+    expect(ciConfig.content).toContain('--threshold 70'); // high-risk = 70
+    expect(ciConfig.filename).toBe('.github/workflows/compliance-check.yml');
+  });
+});

package/src/e2e/gaps-e2e.test.ts

@@ -0,0 +1,259 @@
+/**
+ * E2E Test — validates gap closures (US-S03-06/07/08) end-to-end.
+ *
+ * Uses Hono's `app.request()` against the real composition root.
+ * Tests: Evidence chain for all event types (Gap 2),
+ *        FRIA output path (Gap 3), Passport update after FRIA (Gap 4).
+ *
+ * Gap 1 (Circuit Breaker) is SDK-only and tested in engine/sdk/src/__tests__/
+ * (circuit-breaker.test.ts + agent.test.ts) — it can't be imported cross-package.
+ */
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { existsSync } from 'node:fs';
+import { readFile, rm, stat } from 'node:fs/promises';
+import { loadApplication, type Application } from '../composition-root.js';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const TEST_PROJECT = process.env['COMPLIOR_TEST_PROJECT']
+  ?? resolve(__dirname, '../../../../..', 'test-projects/acme-ai-support');
+
+const canRunE2E = existsSync(resolve(TEST_PROJECT, 'package.json'));
+
+// Clean up any previous E2E artifacts
+const cleanup = async () => {
+  await rm(resolve(TEST_PROJECT, '.complior', 'reports'), { recursive: true, force: true });
+  await rm(resolve(TEST_PROJECT, '.complior', 'agents'), { recursive: true, force: true });
+};
+
+describe.skipIf(!canRunE2E)('Gap Closures E2E', () => {
+  let application: Application;
+
+  beforeAll(async () => {
+    await cleanup();
+    process.env['COMPLIOR_PROJECT_PATH'] = TEST_PROJECT;
+    application = await loadApplication();
+  }, 30_000);
+
+  afterAll(async () => {
+    application?.shutdown();
+    delete process.env['COMPLIOR_PROJECT_PATH'];
+    await rm(resolve(TEST_PROJECT, '.complior', 'reports'), { recursive: true, force: true });
+  });
+
+  // ─────────────────────────────────────────────────────────
+  // Gap 2: Evidence for fix/passport/FRIA events
+  // ─────────────────────────────────────────────────────────
+  describe('Gap 2: Evidence for all event types', () => {
+    it('scan creates evidence entries (baseline)', async () => {
+      // Run a scan first to seed evidence
+      const scanRes = await application.app.request('/scan', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ path: TEST_PROJECT }),
+      });
+      expect(scanRes.status).toBe(200);
+
+      // Check evidence chain
+      const evRes = await application.app.request(
+        `/agent/evidence?path=${encodeURIComponent(TEST_PROJECT)}`,
+      );
+      expect(evRes.status).toBe(200);
+      const summary = await evRes.json() as Record<string, unknown>;
+      expect(summary['totalEntries']).toBeGreaterThan(0);
+      expect(summary['chainValid']).toBe(true);
+    });
+
+    it('passport init creates evidence with source "passport"', async () => {
+      // Get evidence count before
+      const beforeRes = await application.app.request(
+        `/agent/evidence?path=${encodeURIComponent(TEST_PROJECT)}`,
+      );
+      const beforeSummary = await beforeRes.json() as Record<string, unknown>;
+      const countBefore = beforeSummary['totalEntries'] as number;
+
+      // Init passport (force to handle stale/empty files from previous runs)
+      const initRes = await application.app.request('/agent/init', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ path: TEST_PROJECT, force: true }),
+      });
+      expect(initRes.status).toBe(200);
+      const initBody = await initRes.json() as Record<string, unknown>;
+      const manifests = initBody['manifests'] as unknown[];
+
+      // Get evidence count after
+      const afterRes = await application.app.request(
+        `/agent/evidence?path=${encodeURIComponent(TEST_PROJECT)}`,
+      );
+      const afterSummary = await afterRes.json() as Record<string, unknown>;
+      const countAfter = afterSummary['totalEntries'] as number;
+
+      // If agents were found, evidence should have increased
+      if (manifests.length > 0) {
+        expect(countAfter).toBeGreaterThan(countBefore);
+      }
+    });
+
+    it('evidence chain verification passes after all events', async () => {
+      const verifyRes = await application.app.request(
+        `/agent/evidence/verify?path=${encodeURIComponent(TEST_PROJECT)}`,
+      );
+      expect(verifyRes.status).toBe(200);
+      const result = await verifyRes.json() as Record<string, unknown>;
+      expect(result['valid']).toBe(true);
+    });
+  });
+
+  // ─────────────────────────────────────────────────────────
+  // Gap 3: FRIA output path + Gap 4: Passport update after FRIA
+  // ─────────────────────────────────────────────────────────
+  describe('Gap 3+4: FRIA generation, output path, passport update', () => {
+    let AGENT_NAME = '';
+
+    it('generates FRIA and saves to .complior/reports/fria-{name}.md', async () => {
+      // Ensure passport exists (force to handle stale files)
+      await application.app.request('/agent/init', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ path: TEST_PROJECT, force: true }),
+      });
+
+      // Get actual agent name from engine
+      const listRes = await application.app.request(
+        `/agent/list?path=${encodeURIComponent(TEST_PROJECT)}`,
+      );
+      const agents = await listRes.json() as Array<Record<string, unknown>>;
+      expect(agents.length).toBeGreaterThan(0);
+      AGENT_NAME = (agents[0] as Record<string, unknown>)['name'] as string;
+      expect(AGENT_NAME).toBeDefined();
+
+      // Generate FRIA
+      const friaRes = await application.app.request('/agent/fria', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          path: TEST_PROJECT,
+          name: AGENT_NAME,
+          organization: 'ACME Corp',
+          assessor: 'E2E Test Assessor',
+        }),
+      });
+      expect(friaRes.status).toBe(200);
+      const friaBody = await friaRes.json() as Record<string, unknown>;
+
+      // Verify response shape
+      expect(friaBody['markdown']).toBeDefined();
+      expect(typeof friaBody['markdown']).toBe('string');
+      expect(friaBody['prefilledFields']).toBeDefined();
+      expect(friaBody['manualFields']).toBeDefined();
+
+      // Gap 3: Verify correct output path
+      const savedPath = friaBody['savedPath'] as string;
+      expect(savedPath).toContain('.complior/reports/');
+      expect(savedPath).toContain(`fria-${AGENT_NAME}.md`);
+      expect(savedPath).not.toContain('.complior/fria/');
+
+      // Verify file actually exists on disk
+      const fileStat = await stat(savedPath);
+      expect(fileStat.isFile()).toBe(true);
+
+      // Verify content is valid markdown
+      const content = await readFile(savedPath, 'utf-8');
+      expect(content.length).toBeGreaterThan(100);
+      expect(content).toContain('ACME Corp');  // organization was used
+      expect(content).toContain('E2E Test Assessor');  // assessor was used
+    }, 15_000);
+
+    it('FRIA generation creates evidence with source "fria"', async () => {
+      // Get evidence before
+      const beforeRes = await application.app.request(
+        `/agent/evidence?path=${encodeURIComponent(TEST_PROJECT)}`,
+      );
+      const beforeSummary = await beforeRes.json() as Record<string, unknown>;
+      const countBefore = beforeSummary['totalEntries'] as number;
+
+      // Generate another FRIA (idempotent — overwrites the same file)
+      const friaRes = await application.app.request('/agent/fria', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          path: TEST_PROJECT,
+          name: AGENT_NAME,
+        }),
+      });
+      expect(friaRes.status).toBe(200);
+
+      // Evidence should have increased
+      const afterRes = await application.app.request(
+        `/agent/evidence?path=${encodeURIComponent(TEST_PROJECT)}`,
+      );
+      const afterSummary = await afterRes.json() as Record<string, unknown>;
+      const countAfter = afterSummary['totalEntries'] as number;
+      expect(countAfter).toBeGreaterThan(countBefore);
+    }, 15_000);
+
+    it('passport is updated with fria_completed and fria_date after FRIA', async () => {
+      // Read the manifest from disk
+      const manifestPath = resolve(
+        TEST_PROJECT, '.complior', 'agents', `${AGENT_NAME}-manifest.json`,
+      );
+      const rawManifest = await readFile(manifestPath, 'utf-8');
+      const manifest = JSON.parse(rawManifest) as Record<string, unknown>;
+
+      // Gap 4: Verify fria fields
+      const compliance = manifest['compliance'] as Record<string, unknown>;
+      expect(compliance['fria_completed']).toBe(true);
+      expect(typeof compliance['fria_date']).toBe('string');
+
+      // fria_date should be today's date (YYYY-MM-DD format)
+      const today = new Date().toISOString().slice(0, 10);
+      expect(compliance['fria_date']).toBe(today);
+    });
+
+    it('updated passport signature is still valid', async () => {
+      // Verify via API
+      const showRes = await application.app.request(
+        `/agent/show?path=${encodeURIComponent(TEST_PROJECT)}&name=${AGENT_NAME}`,
+      );
+      expect(showRes.status).toBe(200);
+      const manifest = await showRes.json() as Record<string, unknown>;
+
+      // Signature block should be present
+      const sig = manifest['signature'] as Record<string, unknown>;
+      expect(sig['algorithm']).toBe('ed25519');
+      expect(typeof sig['value']).toBe('string');
+      expect(sig['value']).not.toBe('');
+    });
+  });
+
+  // ─────────────────────────────────────────────────────────
+  // Cross-gap: Evidence chain integrity after all operations
+  // ─────────────────────────────────────────────────────────
+  describe('Cross-gap: Full evidence chain integrity', () => {
+    it('evidence chain is valid after scan + passport + fria events', async () => {
+      const verifyRes = await application.app.request(
+        `/agent/evidence/verify?path=${encodeURIComponent(TEST_PROJECT)}`,
+      );
+      expect(verifyRes.status).toBe(200);
+      const result = await verifyRes.json() as Record<string, unknown>;
+      expect(result['valid']).toBe(true);
+      expect(result['brokenAt']).toBeUndefined();
+    });
+
+    it('evidence summary shows multiple event sources', async () => {
+      const summaryRes = await application.app.request(
+        `/agent/evidence?path=${encodeURIComponent(TEST_PROJECT)}`,
+      );
+      expect(summaryRes.status).toBe(200);
+      const summary = await summaryRes.json() as Record<string, unknown>;
+
+      expect((summary['totalEntries'] as number)).toBeGreaterThan(0);
+      expect((summary['scanCount'] as number)).toBeGreaterThan(0);
+      expect(summary['chainValid']).toBe(true);
+      expect(summary['firstEntry']).toBeTruthy();
+      expect(summary['lastEntry']).toBeTruthy();
+    });
+  });
+});