@dzhechkov/p-replicator 1.5.17 → 1.6.0

package/tests/unit/adr-scanner-contract.test.js

@@ -0,0 +1,108 @@
+'use strict';
+
+// adr-scanner-both-shapes (ADR-001) — the content contract of the toolkit generator's ADR handling.
+//
+// Why content assertions: these are PROMPT modules executed by a model, so the strongest
+// deterministic layer available is the text itself. Before this feature, `has_adr` required a
+// docs/adr/ DIRECTORY with >5 files while /replicate writes ONE docs/ADR.md — the flag was
+// unreachable and every `IF has_adr:` consumer was dead code. Worse, a naive fix (relaxing the
+// threshold) would have rerouted SPARC projects, because the flag sat inside pipeline routing.
+//
+// P1..P5 below mirror the ADR's Confirmation section. Each is DISCRIMINATING: restoring the old
+// text at any site turns the matching assertion red (verified by mutation at Step 8).
+
+const { test, describe } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const GEN = path.join(__dirname, '..', '..', 'templates', '.claude', 'skills', 'cc-toolkit-generator-enhanced');
+
+function read(rel) {
+  return fs.readFileSync(path.join(GEN, rel), 'utf-8');
+}
+
+/** Every .md under the generator skill, relative paths. */
+function allModules(dir = GEN, acc = []) {
+  for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+    const p = path.join(dir, e.name);
+    if (e.isDirectory()) allModules(p, acc);
+    else if (e.name.endsWith('.md')) acc.push(path.relative(GEN, p));
+  }
+  return acc;
+}
+
+describe('ADR scanner contract (adr-scanner-both-shapes ADR-001)', () => {
+  test('P1 — exactly ONE has_adr definition across the WHOLE generator, and it counts decisions', () => {
+    // AM-1: a second `>5` copy hid in references/enhanced-recommendations.md — hence the tree-wide
+    // sweep, not a single-file check.
+    const defs = [];
+    for (const rel of allModules()) {
+      const src = read(rel);
+      for (const line of src.split('\n')) {
+        if (/^\s*has_adr\s*=/.test(line)) defs.push({ rel, line: line.trim() });
+      }
+    }
+    assert.equal(defs.length, 1,
+      'exactly one has_adr definition may exist; found: ' + JSON.stringify(defs));
+    assert.match(defs[0].line, /collect_adrs/,
+      'the one definition must count collector output (decisions), not raw files');
+    assert.ok(!/>\s*5/.test(defs[0].line), 'the unreachable >5 file threshold must not survive');
+  });
+
+  test('P2 — the scan catalog names BOTH storage shapes', () => {
+    const src = read(path.join('modules', '01-detect-parse.md'));
+    assert.ok(src.includes('docs/adr/*.md'), 'directory shape must stay catalogued');
+    assert.ok(src.includes('docs/ADR.md'), 'the single-file shape /replicate writes must be catalogued');
+  });
+
+  test('P3 — pipeline routing never consults has_adr (the SPARC-reroute trap)', () => {
+    const src = read(path.join('modules', '01-detect-parse.md'));
+    const m = src.match(/def detect_pipeline[\s\S]*?\n```/);
+    assert.ok(m, 'detect_pipeline block must exist');
+    // AM-2: strip comment lines first. A comment EXPLAINING why the flag is absent is not the flag
+    // participating in routing — the first draft of this assertion failed on its own rationale
+    // comment. Mention is not use; the check must read code, not prose.
+    const code = m[0].split('\n').filter((l) => !/^\s*#/.test(l)).join('\n');
+    assert.ok(!/\bhas_adr\b/.test(code),
+      'has_adr inside detect_pipeline CODE re-creates the reroute hazard the ADR refuses');
+    assert.ok(/has_idea2prd_adr_dir\s*=\s*len\(glob\(f"\{docs_path\}\/docs\/adr\/\*\.md"\)\)\s*>\s*5/.test(m[0]),
+      'the shape marker must keep the byte-identical routing expression');
+  });
+
+  test('P4 — zero private ADR globs outside the collector', () => {
+    // The dead-code class came from consumers re-reading a directory for themselves. Only the
+    // collector (inside 01-detect-parse.md) may touch ADR paths.
+    const offenders = [];
+    for (const rel of allModules()) {
+      if (rel === path.join('modules', '01-detect-parse.md')) continue;
+      const src = read(rel);
+      for (const line of src.split('\n')) {
+        // AM-2: the pipeline-IDENTITY shape marker is the ONE named exception. It COUNTS files to
+        // recognise which pipeline produced the docs; it never reads ADR content, so it cannot
+        // re-create the dead-code class. It must carry the marker name — an unnamed glob is an
+        // offender even if its expression is identical.
+        // Cross-family QE (gpt-5.6-sol): keying the exemption on the NAME ANYWHERE let a private
+        // glob smuggle itself past by mentioning the marker in a trailing comment. The exemption now
+        // requires the line to BE the marker's assignment.
+        if (/^\s*has_idea2prd_adr_dir\s*=/.test(line)) continue;
+        if (/glob\([^)]*adr\/\*\.md/.test(line) || /FOR EACH adr\/\*\.md/.test(line) || /SCAN adr\/\*\.md/.test(line)) {
+          offenders.push(rel + ': ' + line.trim());
+        }
+      }
+    }
+    assert.deepEqual(offenders, [],
+      'consumer modules must iterate detected_docs.idea2prd.adrs, never glob for themselves');
+  });
+
+  test('P5 — the collector carries the worked examples, acid ids verbatim', () => {
+    const src = read(path.join('modules', '01-detect-parse.md'));
+    for (const acid of ['A1', 'A4', 'A5']) {
+      assert.ok(new RegExp('\\*\\*' + acid + '\\*\\*').test(src),
+        'worked example ' + acid + ' must be stated in the collector section');
+    }
+    assert.ok(src.includes('collect_adrs'), 'the collector must exist by its contract name');
+    assert.ok(src.includes('dedupe_stable_first_by_id_then_title'),
+      'the merge must dedupe STABLE-FIRST (A5) — precedence stated, not left to the helper');
+  });
+});

package/tests/unit/autocommit-deletion.test.js

@@ -0,0 +1,242 @@
+'use strict';
+
+// All three autocommit hooks opened with `if (!fs.existsSync(TARGET)) process.exit(0);`, so a DELETED
+// roadmap was "nothing to do" — though a deletion is exactly the change these hooks exist to record.
+// The history showed the file being maintained and then, silently, not.
+//
+// THE TRAP, measured before a line was written: simply deleting that guard breaks the failure
+// reporting that shipped the day before.
+//
+//   git add -- <a path that never existed>   → exit 128, "fatal: pathspec … did not match any files"
+//   git add -- <a tracked file, deleted>     → exit 0, and diff --cached then reports a change
+//
+// A failing git call now prints one line, so the naive fix would print a failure on EVERY session
+// stop in every project without this artifact — which is most of them. That is the noise the same
+// feature's own comment warns trains people to ignore notices. P3 is the guard on it.
+//
+// The discriminator is `git ls-files -- <path>`: entries for a path git knows, nothing for one it
+// does not. It must run BEFORE staging: staging a deletion removes the entry from the index, after
+// which the same question answers "not tracked". (`--error-unmatch` discriminates just as well, for
+// files and directories alike — an earlier note here said otherwise and was withdrawn after
+// re-measuring. `ls-files --` is preferred only because it answers with data instead of throwing.)
+
+const { test, describe } = require('node:test');
+const assert = require('node:assert/strict');
+const { execFileSync, spawnSync } = require('node:child_process');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const TPL = path.join(__dirname, '..', '..', 'templates', '.claude');
+
+const HOOKS = [
+  { name: 'autocommit-roadmap', remove: /auto-remove/,
+    make: (root) => {
+      fs.mkdirSync(path.join(root, '.claude'), { recursive: true });
+      const f = path.join(root, '.claude', 'feature-roadmap.json');
+      fs.writeFileSync(f, '{"v":1}\n');
+      return { drop: () => fs.rmSync(f), touch: () => fs.writeFileSync(f, '{"v":2}\n') };
+    } },
+  { name: 'autocommit-insights', remove: /auto-remove/,
+    make: (root) => {
+      const d = path.join(root, '.claude', 'insights');
+      fs.mkdirSync(d, { recursive: true });
+      fs.writeFileSync(path.join(d, 'index.md'), '## one\n');
+      return { drop: () => fs.rmSync(d, { recursive: true }),
+        touch: () => fs.writeFileSync(path.join(d, 'index.md'), '## one\n## two\n') };
+    } },
+  { name: 'autocommit-plans', remove: /auto-remove/,
+    make: (root) => {
+      const d = path.join(root, 'docs', 'plans');
+      fs.mkdirSync(d, { recursive: true });
+      fs.writeFileSync(path.join(d, 'a.md'), '# plan\n');
+      return { drop: () => fs.rmSync(d, { recursive: true }),
+        touch: () => fs.writeFileSync(path.join(d, 'a.md'), '# plan v2\n') };
+    } },
+];
+
+function project(opts) {
+  const o = opts || {};
+  const root = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'p-rep-del-')));
+  fs.mkdirSync(path.join(root, '.claude', 'hooks'), { recursive: true });
+  for (const h of HOOKS) {
+    fs.copyFileSync(path.join(TPL, 'hooks', h.name + '.cjs'),
+      path.join(root, '.claude', 'hooks', h.name + '.cjs'));
+  }
+  if (o.git !== false) {
+    const git = (a) => execFileSync('git', a, { cwd: root, stdio: 'ignore' });
+    git(['init', '-q']);
+    git(['config', 'user.email', 'test@example.invalid']);
+    git(['config', 'user.name', 'test']);
+  }
+  return root;
+}
+
+const git = (root, args) =>
+  execFileSync('git', args, { cwd: root, encoding: 'utf8' }).trim();
+const commitAll = (root) => {
+  execFileSync('git', ['add', '-A'], { cwd: root, stdio: 'ignore' });
+  execFileSync('git', ['commit', '-qm', 'base'], { cwd: root, stdio: 'ignore' });
+};
+
+function run(root, hookName) {
+  const r = spawnSync(process.execPath,
+    [path.join(root, '.claude', 'hooks', hookName + '.cjs')],
+    { cwd: root, env: Object.assign({}, process.env, { CLAUDE_PROJECT_DIR: root }),
+      encoding: 'utf8' });
+  return { code: r.status, out: (r.stdout || '') + (r.stderr || '') };
+}
+
+const cleanup = (d) => fs.rmSync(d, { recursive: true, force: true });
+
+describe('a deleted artifact is recorded, and an absent one is still silent', () => {
+  test('P1 — deleting a tracked target produces a commit and leaves the tree clean', () => {
+    const root = project({});
+    try {
+      const h = HOOKS[0];
+      const ctl = h.make(root);
+      commitAll(root);
+      const before = Number(git(root, ['rev-list', '--count', 'HEAD']));
+      ctl.drop();
+
+      const r = run(root, h.name);
+      assert.equal(r.code, 0, 'the hook must stay non-blocking: ' + r.out);
+      assert.equal(Number(git(root, ['rev-list', '--count', 'HEAD'])), before + 1,
+        'the deletion must be committed, not treated as nothing to do');
+      assert.equal(git(root, ['status', '--porcelain']), '',
+        'and the tree must be left clean, not merely staged');
+    } finally { cleanup(root); }
+  });
+
+  test('P2 — the commit names the removal, so the event is findable in the log', () => {
+    // The owner's stated purpose: be able to spot the event and undo it. A deletion recorded as
+    // "auto-update" is findable only by reading diffs.
+    const root = project({});
+    try {
+      const h = HOOKS[0];
+      const ctl = h.make(root);
+      commitAll(root);
+      ctl.drop();
+      run(root, h.name);
+      const subject = git(root, ['log', '-1', '--format=%s']);
+      assert.match(subject, h.remove,
+        'the subject must say the artifact was removed: ' + JSON.stringify(subject));
+    } finally { cleanup(root); }
+  });
+
+  test('P3 — a project that never had the artifact stays SILENT', () => {
+    // The guard on the naive fix. Deleting the existence check outright would make `git add` exit
+    // 128 here, and the failure reporting that shipped yesterday would print a line on every session
+    // stop in every project without this artifact.
+    const root = project({});
+    try {
+      fs.writeFileSync(path.join(root, 'unrelated.txt'), 'x\n');
+      commitAll(root);
+      for (const h of HOOKS) {
+        const r = run(root, h.name);
+        assert.equal(r.code, 0, h.name + ' must exit 0');
+        assert.equal(r.out.trim(), '',
+          h.name + ' printed something for an artifact this project never had: ' + r.out);
+      }
+      assert.equal(git(root, ['rev-list', '--count', 'HEAD']), '1',
+        'and nothing may be committed');
+    } finally { cleanup(root); }
+  });
+
+  test('P4 — not a git repository: silent, exit 0', () => {
+    const root = project({ git: false });
+    try {
+      const r = run(root, HOOKS[0].name);
+      assert.equal(r.code, 0);
+      assert.equal(r.out.trim(), '', 'not-a-repo is not a failure to report: ' + r.out);
+    } finally { cleanup(root); }
+  });
+
+  test('P5 — an existing, changed target still commits as before', () => {
+    const root = project({});
+    try {
+      const h = HOOKS[0];
+      const ctl = h.make(root);
+      commitAll(root);
+      ctl.touch();
+      const before = Number(git(root, ['rev-list', '--count', 'HEAD']));
+      assert.equal(run(root, h.name).code, 0);
+      assert.equal(Number(git(root, ['rev-list', '--count', 'HEAD'])), before + 1,
+        'the ordinary update path must be untouched');
+      assert.doesNotMatch(git(root, ['log', '-1', '--format=%s']), /auto-remove/,
+        'and an update must NOT be labelled a removal');
+    } finally { cleanup(root); }
+  });
+
+  test('P6 — an existing, unchanged target is silent', () => {
+    const root = project({});
+    try {
+      const h = HOOKS[0];
+      h.make(root);
+      commitAll(root);
+      const before = Number(git(root, ['rev-list', '--count', 'HEAD']));
+      const r = run(root, h.name);
+      assert.equal(r.code, 0);
+      assert.equal(r.out.trim(), '', 'nothing to commit must stay silent: ' + r.out);
+      assert.equal(Number(git(root, ['rev-list', '--count', 'HEAD'])), before,
+        'and must not create an empty commit');
+    } finally { cleanup(root); }
+  });
+
+  test('P8 — a PARTIAL deletion is still a removal, even though the directory remains', () => {
+    // Cross-family QE: classifying from `existsSync` on the DIRECTORY was wrong. Deleting one file
+    // inside it — or every tracked file while an ignored one keeps the directory present — left the
+    // path existing, so the commit said "auto-save" and the removal was unfindable by the very
+    // search this feature promises. The classification now comes from what git actually STAGED.
+    const root = project({});
+    try {
+      const d = path.join(root, 'docs', 'plans');
+      fs.mkdirSync(d, { recursive: true });
+      fs.writeFileSync(path.join(d, 'a.md'), 'a\n');
+      fs.writeFileSync(path.join(d, 'b.md'), 'b\n');
+      commitAll(root);
+      fs.rmSync(path.join(d, 'a.md'));           // the directory still exists
+
+      const r = run(root, 'autocommit-plans');
+      assert.equal(r.code, 0, r.out);
+      assert.ok(fs.existsSync(d), 'the fixture must leave the directory in place');
+      assert.match(git(root, ['log', '-1', '--format=%s']), /auto-remove/,
+        'one deleted file inside a surviving directory is still a removal: '
+        + git(root, ['log', '-1', '--format=%s']));
+    } finally { cleanup(root); }
+  });
+
+  test('P9 — a real git failure is not laundered into "never existed"', () => {
+    // The `ls-files` answer decides whether a deletion is recorded at all. A bare catch that turned
+    // every failure into an empty answer would silently skip the deletion — a bypass of the feature
+    // itself, wearing the shape of the ordinary case.
+    for (const h of HOOKS) {
+      const src = fs.readFileSync(path.join(TPL, 'hooks', h.name + '.cjs'), 'utf-8');
+      const at = src.indexOf("git(['ls-files'");
+      assert.ok(at > 0, h.name + ' must ask git whether the path is tracked');
+      const around = src.slice(at - 200, at + 200);
+      assert.ok(!/catch\s*\{\s*tracked\s*=\s*''/.test(around),
+        h.name + ' swallows a real ls-files failure as "not tracked": ' + around);
+    }
+  });
+
+  test('P7 — all three hooks record their own deletion identically', () => {
+    // Two of the three watch a DIRECTORY rather than a file, so the deletion path has to work for
+    // both shapes — that is what this case proves, and it is why the fixtures differ.
+    for (const h of HOOKS) {
+      const root = project({});
+      try {
+        const ctl = h.make(root);
+        commitAll(root);
+        const before = Number(git(root, ['rev-list', '--count', 'HEAD']));
+        ctl.drop();
+        const r = run(root, h.name);
+        assert.equal(r.code, 0, h.name + ' must exit 0: ' + r.out);
+        assert.equal(Number(git(root, ['rev-list', '--count', 'HEAD'])), before + 1,
+          h.name + ' did not record its deletion');
+        assert.match(git(root, ['log', '-1', '--format=%s']), h.remove,
+          h.name + ' did not name the removal');
+      } finally { cleanup(root); }
+    }
+  });
+});

package/tests/unit/check-ports.test.js

@@ -0,0 +1,184 @@
+'use strict';
+
+// The package shipped a rule saying a database must not face the internet, and the rule said of
+// itself — correctly — that it was not a check. This is the check.
+//
+// It is a REWRITE, not a transcription. MEASURED: the bash original it replaces never looked at
+// `network_mode: host` (`grep network_mode check-port-conflicts.sh` → nothing), while
+// rules/docker-ports.md forbids it explicitly. A faithful copy would have shipped a check unable to
+// enforce the invariant it is named after.
+//
+// The load-bearing property is the THIRD exit code. A check that answers "clean" when it could not
+// read the config is worse than no check: it turns an unknown into a reassurance. So an absent
+// compose, a missing docker and an unparseable config all exit 2, and P6/P7/P8 assert exactly that.
+//
+// These are BEHAVIOUR tests: they run the real utility over real compose files with real docker.
+
+const { test, describe } = require('node:test');
+const assert = require('node:assert/strict');
+const { spawnSync } = require('node:child_process');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const PKG = path.resolve(__dirname, '..', '..');
+const TPL = path.join(PKG, 'templates', '.claude');
+const CHECK = path.join(TPL, 'hooks', 'check-ports.cjs');
+
+const DOCKER = spawnSync('docker', ['--version'], { encoding: 'utf8' }).status === 0;
+
+/** Write a compose file into a throwaway directory and run the real check over it. */
+function check(compose, opts) {
+  const o = opts || {};
+  const dir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'p-rep-ports-')));
+  try {
+    if (compose !== null) fs.writeFileSync(path.join(dir, 'docker-compose.yml'), compose);
+    const env = Object.assign({}, process.env);
+    if (o.noDocker) env.PATH = dir;            // an empty PATH: docker cannot be found
+    const r = spawnSync(process.execPath, [CHECK, dir], { encoding: 'utf8', env });
+    return { code: r.status, out: (r.stdout || '') + (r.stderr || '') };
+  } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+}
+
+const storagePublished = `services:
+  db:
+    image: postgres:16
+    ports: ["5432:5432"]
+`;
+
+describe('the storage-port rule finally has a check that can fail', () => {
+  test('P1 — it ships as a hooks-directory component, not a new component kind', () => {
+    // The earlier decision to defer this assumed a new `scripts/` directory and five new consumers.
+    // MEASURED: hooks/ already carries a non-event utility (state-update.cjs), so an existing kind
+    // and an existing counter carry this too.
+    assert.ok(fs.existsSync(CHECK), 'the check must ship under templates/.claude/hooks/');
+    const { COMPONENTS } = require(path.join(PKG, 'src', 'utils.js'));
+    assert.ok(COMPONENTS.hooks.items['check-ports'],
+      'it must be registered as a hooks component, or init/doctor/verify will not know it');
+    const statusline = fs.readFileSync(path.join(TPL, 'hooks', 'statusline.cjs'), 'utf-8');
+    const m = statusline.match(/hooksExpected:\s*(\d+)/);
+    assert.ok(m, 'statusline must declare hooksExpected');
+    assert.equal(Number(m[1]), Object.keys(COMPONENTS.hooks.items).length,
+      'the status line would report a phantom missing hook: ' + m[1]);
+  });
+
+  test('P2 — it is NOT registered as an event hook', () => {
+    // Registering it would run `docker compose config` on every session stop, on every project,
+    // including the ones with no compose at all. It is invoked deliberately.
+    const settings = fs.readFileSync(path.join(TPL, 'settings.json'), 'utf-8');
+    assert.ok(!settings.includes('check-ports'),
+      'check-ports must not be wired to an event — it is a utility, like state-update.cjs');
+  });
+
+  test('P3 — a loopback bind PASSES: the exception is part of the rule', { skip: !DOCKER }, () => {
+    for (const bind of ['127.0.0.1:55432:5432', '[::1]:55432:5432']) {
+      const r = check('services:\n  db:\n    image: postgres:16\n    ports: ["' + bind + '"]\n');
+      assert.equal(r.code, 0,
+        bind + ' is legitimate — a check without the exception forbids the test setup the same '
+        + 'pipeline prescribes: ' + r.out);
+    }
+  });
+
+  test('P4 — every forbidden form FAILS, including the one the original missed',
+    { skip: !DOCKER }, () => {
+      const cases = [
+        ['ports: ["5432:5432"]', 'no address at all binds every interface'],
+        ['ports: ["0.0.0.0:5432:5432"]', 'all interfaces, explicitly'],
+        ['ports: ["203.0.113.7:5432:5432"]', 'ONE public address — not "all interfaces", equally reachable'],
+        ['network_mode: host', 'no ports: entry at all, and the container listens on the host'],
+      ];
+      for (const [line, why] of cases) {
+        const r = check('services:\n  db:\n    image: postgres:16\n    ' + line + '\n');
+        assert.equal(r.code, 1, 'must be a violation (' + why + '): ' + r.out);
+        assert.match(r.out, /Правило №0/, 'and must name the rule it enforces: ' + r.out);
+        assert.match(r.out, /db/, 'and the service: ' + r.out);
+      }
+    });
+
+  test('P5 — an app published beside a reverse-proxy FAILS', { skip: !DOCKER }, () => {
+    const r = check('services:\n  proxy:\n    image: caddy:2\n    ports: ["80:80"]\n'
+      + '  app:\n    image: node:22\n    ports: ["3000:3000"]\n');
+    assert.equal(r.code, 1, 'the proxy is the only door: ' + r.out);
+    assert.match(r.out, /app/, 'the offending service must be named, not the proxy: ' + r.out);
+  });
+
+  test('P6 — an unreadable config exits 2 and SAYS the check did not run', { skip: !DOCKER }, () => {
+    // The whole point of the third exit code. "Could not look" is not "nothing found".
+    const r = check('services:\n  db:\n    image: postgres:16\n'
+      + '    ports: ["${UNSET_VAR:?required}:5432"]\n');
+    assert.equal(r.code, 2, 'an unreadable config must not read as clean: ' + r.out);
+    assert.match(r.out, /проверка НЕ выполнена/, 'and must say so in words: ' + r.out);
+  });
+
+  test('P7 — no compose file exits 2', () => {
+    const r = check(null);
+    assert.equal(r.code, 2, 'nothing to check is not the same as nothing wrong: ' + r.out);
+    assert.match(r.out, /проверка НЕ выполнена/);
+  });
+
+  test('P8 — docker unavailable exits 2', () => {
+    // Driven by an empty PATH rather than by uninstalling docker: the property is the code path,
+    // and a test that needs the machine reconfigured is a test nobody runs.
+    const r = check(storagePublished, { noDocker: true });
+    assert.equal(r.code, 2, 'without docker the question cannot be answered: ' + r.out);
+    assert.match(r.out, /docker недоступен/, 'and the reason must be named: ' + r.out);
+  });
+
+  test('P10 — one matrix, all three verdicts: a constant check cannot pass this',
+    { skip: !DOCKER }, () => {
+      // Cross-family QE: every earlier case asserted ONE direction, so an always-clean binary passed
+      // P3 and P9, an always-failing one passed P4 and P5, and a completely non-functional one still
+      // passed P1 and P2. A single run of the SAME executable must produce all three codes.
+      const matrix = [
+        [0, 'services:\n  db:\n    image: postgres:16\n'],
+        [1, 'services:\n  db:\n    image: postgres:16\n    ports: ["5432:5432"]\n'],
+        [2, null],
+      ];
+      const seen = matrix.map(([, compose]) => check(compose).code);
+      assert.deepEqual(seen, [0, 1, 2],
+        'the same binary must answer clean / violation / could-not-check: ' + JSON.stringify(seen));
+    });
+
+  test('P11 — the counter-examples the reviewer supplied', { skip: !DOCKER }, () => {
+    // Each of these was a real defect in the first version, and each is named by the input that
+    // produced it rather than by the rule it broke.
+    const cases = [
+      [0, 'services:\n  db:\n    image: postgres:16\n    command:\n      - postgres\n'
+        + '      - -c\n      - "log_line_prefix=published: 6543"\n',
+        'a sequence item under command: is not a published port'],
+      [0, 'services:\n  ui:\n    image: rediscommander/redis-commander:latest\n'
+        + '    ports: ["8081:8081"]\n',
+        'a redis WEB UI is not storage — substring matching said it was'],
+      [1, 'services:\n  db:\n    image: mcr.microsoft.com/mssql/server:2022-latest\n'
+        + '    ports: ["1433:1433"]\n',
+        'mssql on 1433 was missed by both the name list and the port set'],
+      [1, 'services:\n  db:\n    image: postgres:16\n    ports: ["[::]:5432:5432"]\n',
+        'the IPv6 wildcard is in the rule\'s forbidden table and was untested'],
+      [1, 'services:\n  db:\n    image: myco/custom-store:1\n    ports: ["5432:5432"]\n',
+        'an unrecognised engine on a well-known port is still storage'],
+    ];
+    for (const [expected, compose, why] of cases) {
+      const r = check(compose);
+      assert.equal(r.code, expected, why + ' — got ' + r.code + ': ' + r.out);
+    }
+  });
+
+  test('P12 — several services, and the right one is named', { skip: !DOCKER }, () => {
+    // Fields must not leak between services: the offender has to be identified, not just counted.
+    const r = check('services:\n  cache:\n    image: redis:7\n    ports: ["127.0.0.1:6379:6379"]\n'
+      + '  db:\n    image: postgres:16\n    ports: ["5432:5432"]\n'
+      + '  web:\n    image: node:22\n    ports: ["3000:3000"]\n');
+    assert.equal(r.code, 1, r.out);
+    assert.match(r.out, /db/, 'the offender must be named: ' + r.out);
+    assert.ok(!/cache/.test(r.out),
+      'the loopback-bound cache is legal and must not be reported: ' + r.out);
+    assert.ok(!/web/.test(r.out),
+      'a non-storage service with no proxy present is not this rule\'s business: ' + r.out);
+  });
+
+  test('P9 — a clean compose exits 0', { skip: !DOCKER }, () => {
+    const r = check('services:\n  db:\n    image: postgres:16\n'
+      + '  web:\n    image: node:22\n    ports: ["3000:3000"]\n');
+    assert.equal(r.code, 0, 'a storage service with no publication is exactly right: ' + r.out);
+  });
+});