@frockbot/architecture-checks 0.0.0 → 0.1.0

package/src/model-interface.test.ts

@@ -0,0 +1,175 @@
+// Constitution — Architecture checks: "two provider Packages satisfy the model
+// interface with no kernel diff." Both providers are mounted into the *same*
+// kernel `ModelInvocation` surface, by identical kernel code, and both stream
+// through it. Nothing kernel-side changes between the two mounts; the only
+// difference is which Package was plugged in.
+import { describe, expect, test } from "bun:test";
+import {
+  openCredentialV1,
+  parseCredentialKeyringV1,
+  sealCredentialV1,
+  type CredentialLeaseV1,
+} from "@frockbot/connection-core";
+import type {
+  LlmStreamEvent,
+  ModelInvocation,
+  NormalizedModelRequest,
+} from "@frockbot/kernel-contracts";
+import { LlmRegistry } from "@frockbot/plugin-models";
+import foundationProviderPlugin from "@frockbot/plugin-provider-foundation/runtime";
+import { createOllamaCloudRuntimePlugin } from "@frockbot/plugin-provider-ollama-cloud/runtime";
+import { Context, Service, type Plugin } from "cordis";
+
+const KEYRING = JSON.stringify({
+  schemaVersion: 1,
+  currentKeyId: "primary",
+  keys: { primary: "MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY" },
+});
+
+class TestCredentialLease extends Service {
+  constructor(ctx: Context) {
+    super(ctx, "credentialLease");
+  }
+
+  open(input: {
+    accountId: string;
+    connectionId: string;
+    packageId: string;
+    lease: CredentialLeaseV1;
+  }): Promise<string> {
+    return openCredentialV1({
+      keyring: parseCredentialKeyringV1(KEYRING),
+      context: {
+        accountId: input.accountId,
+        connectionId: input.connectionId,
+        packageId: input.packageId,
+        credentialGeneration: input.lease.credentialGeneration,
+      },
+      envelope: input.lease.envelope,
+    });
+  }
+}
+
+/**
+ * The kernel half, written once. It mounts the kernel's `ModelInvocation`
+ * implementation, plugs in whatever provider Package it is handed, and streams.
+ * A second provider must require no edit here — that is the check.
+ */
+async function streamThroughTheKernel(
+  providerPlugin: Plugin.Function,
+  request: NormalizedModelRequest,
+  extra?: Plugin.Function,
+): Promise<{ events: LlmStreamEvent[]; invocation: ModelInvocation }> {
+  const root = new Context();
+  await root.plugin(LlmRegistry);
+  if (extra) await root.plugin(extra);
+  await root.plugin(providerPlugin);
+  const invocation: ModelInvocation = root.llm;
+  const events: LlmStreamEvent[] = [];
+  for await (const event of invocation.stream(
+    request,
+    new AbortController().signal,
+  )) {
+    events.push(event);
+  }
+  await root.fiber.dispose();
+  return { events, invocation };
+}
+
+const message = { role: "user" as const, content: "hello" };
+
+describe("model interface", () => {
+  test("two provider Packages satisfy the model interface with no kernel diff", async () => {
+    const foundation = await streamThroughTheKernel(foundationProviderPlugin, {
+      requestId: "foundation-1",
+      provider: "foundation",
+      model: "deterministic-v1",
+      system: "",
+      messages: [message],
+      tools: [],
+    });
+
+    const envelope = await sealCredentialV1({
+      keyring: parseCredentialKeyringV1(KEYRING),
+      context: {
+        accountId: "account-1",
+        connectionId: "connection-1",
+        packageId: "provider-ollama-cloud",
+        credentialGeneration: "generation-1",
+      },
+      plaintext: "account-secret",
+    });
+    const credentialLease: Plugin.Function = (ctx) => {
+      new TestCredentialLease(ctx);
+    };
+    const ollama = await streamThroughTheKernel(
+      createOllamaCloudRuntimePlugin({
+        accountId: "account-1",
+        connectionId: "connection-1",
+        packageId: "provider-ollama-cloud",
+        leaseCredential: (effectId) =>
+          Promise.resolve({
+            schemaVersion: 1,
+            leaseId: "lease-1",
+            effectId,
+            connectionId: "connection-1",
+            credentialGeneration: "generation-1",
+            expiresAt: "2099-01-01T00:00:00.000Z",
+            envelope,
+          }),
+        settleCredential: () => Promise.resolve(),
+        fetch: () =>
+          Promise.resolve(
+            new Response(
+              'data: {"choices":[{"delta":{"content":"hello"}}]}\n\n' +
+                'data: {"choices":[{"delta":{},"finish_reason":"stop"}]}\n\n' +
+                "data: [DONE]\n\n",
+              {
+                status: 200,
+                headers: { "content-type": "text/event-stream" },
+              },
+            ),
+          ),
+      }),
+      {
+        requestId: "ollama-1",
+        provider: "ollama-cloud",
+        model: "glm-5.3-flash:cloud",
+        system: "",
+        messages: [message],
+        tools: [],
+        modelBinding: {
+          connectionId: "connection-1",
+          connectionGeneration: "generation-1",
+        },
+      },
+      credentialLease,
+    );
+
+    // Both answer the same kernel interface with the same event vocabulary.
+    expect(foundation.events.at(-1)).toEqual({
+      type: "finish",
+      reason: "completed",
+    });
+    expect(ollama.events.at(-1)).toEqual({
+      type: "finish",
+      reason: "completed",
+    });
+    expect(
+      foundation.events
+        .filter((event) => event.type === "text-delta")
+        .map((event) => event.text)
+        .join(""),
+    ).toBe("Cordis runtime: hello");
+    expect(
+      ollama.events
+        .filter((event) => event.type === "text-delta")
+        .map((event) => event.text)
+        .join(""),
+    ).toBe("hello");
+    for (const invocation of [foundation.invocation, ollama.invocation]) {
+      expect(typeof invocation.stream).toBe("function");
+      expect(typeof invocation.reconcile).toBe("function");
+    }
+  });
+});

package/src/package-authority-boundaries.test.ts

@@ -0,0 +1,292 @@
+// Constitutional checks over who may declare the strongest execution hosts.
+//
+// Constitution — Package composition: "Every Package whose recorded provenance
+// is not first-party executes in a Dynamic Worker isolate … First-party
+// Packages may run in the kernel's isolate only when reviewed and shipped with
+// FrockBot." `trusted-main` is the widest host FrockBot has — the Electron main
+// process, outside every sandbox — so a manifest asking for it is asking for
+// first-party trust. These are source-graph and synthesis facts, so each rule
+// is one named test `docs/architecture-checks.md` can point at.
+import { describe, expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import {
+  AUTHOR_PACKAGE_INPUT_SCHEMA_V1,
+  authoredManifestV1,
+  decodeAuthorPackageInputV1,
+} from "@frockbot/plugin-authoring/shared";
+
+const repoRoot = resolve(import.meta.dirname, "..", "..", "..");
+
+function read(path: string): string {
+  return readFileSync(join(repoRoot, path), "utf8");
+}
+
+interface ScannedManifest {
+  /** Repo-relative path of the `frockbot.json`. */
+  path: string;
+  manifest: Record<string, unknown>;
+}
+
+/** Every Package manifest this tree holds, wherever it sits. */
+function scanManifests(): ScannedManifest[] {
+  return [...new Bun.Glob("**/frockbot.json").scanSync({ cwd: repoRoot })]
+    .filter((path) => !path.includes("node_modules/"))
+    .filter((path) => !path.includes("/dist/"))
+    .sort()
+    .map((path) => ({
+      path,
+      manifest: JSON.parse(read(path)) as Record<string, unknown>,
+    }));
+}
+
+function desktopContribution(
+  manifest: Record<string, unknown>,
+): Record<string, unknown> | undefined {
+  const contributions = manifest.contributions;
+  if (!contributions || typeof contributions !== "object") return undefined;
+  const desktop = (contributions as Record<string, unknown>).desktop;
+  if (!desktop || typeof desktop !== "object") return undefined;
+  return desktop as Record<string, unknown>;
+}
+
+/**
+ * The rule, as a function of what was scanned, so the tests below can stage a
+ * violation without writing one into this tree: a manifest declaring a
+ * `trusted-main` Contribution is a first-party workspace Package under
+ * `packages/`, published to the workspace under the `@frockbot/` scope.
+ */
+function trustedMainOffenders(
+  manifests: readonly ScannedManifest[],
+  packageName: (manifestPath: string) => string | undefined,
+): string[] {
+  const offenders: string[] = [];
+  for (const { path, manifest } of manifests) {
+    if (desktopContribution(manifest)?.execution !== "trusted-main") continue;
+    if (!/^packages\/[^/]+\/frockbot\.json$/.test(path)) {
+      offenders.push(`${path}: trusted-main outside packages/`);
+      continue;
+    }
+    const name = packageName(path);
+    if (!name?.startsWith("@frockbot/")) {
+      offenders.push(`${path}: trusted-main in a package named ${name}`);
+    }
+  }
+  return offenders;
+}
+
+function workspacePackageName(manifestPath: string): string | undefined {
+  const declared = JSON.parse(
+    read(join(dirname(manifestPath), "package.json")),
+  );
+  return typeof declared?.name === "string" ? declared.name : undefined;
+}
+
+/** `@frockbot/plugin-fly-sprite` + `./host` → `@frockbot/plugin-fly-sprite/host`. */
+function contributionSpecifier(scanned: ScannedManifest): string {
+  const entry = String(desktopContribution(scanned.manifest)?.entry ?? "");
+  return `${workspacePackageName(scanned.path)}${entry.slice(1)}`;
+}
+
+describe("package authority boundaries", () => {
+  // Constitution — Package composition: "First-party Packages may run in the
+  // kernel's isolate only when reviewed and shipped with FrockBot."
+  test("a trusted-main Contribution is declared only by a first-party workspace Package", () => {
+    const manifests = scanManifests();
+    // The scan really does reach manifests outside `packages/` — nothing here
+    // narrows the search to the answer it wants.
+    expect(manifests.length).toBeGreaterThan(0);
+    expect(
+      new Bun.Glob("**/frockbot.json").scanSync({ cwd: repoRoot }).next().done,
+    ).toBe(false);
+    expect(trustedMainOffenders(manifests, workspacePackageName)).toEqual([]);
+
+    // …and the root workspace really does claim `packages/*`, so "under
+    // packages/" means "a workspace member", not merely "in a directory".
+    const workspaces = JSON.parse(read("package.json")).workspaces;
+    expect(workspaces).toContain("packages/*");
+  });
+
+  test("the check refuses a trusted-main manifest that is not a first-party workspace Package", () => {
+    const desktop = {
+      contributions: {
+        desktop: { entry: "./desktop", execution: "trusted-main" },
+      },
+    };
+    const offenders = trustedMainOffenders(
+      [
+        { path: "apps/cloudflare/frockbot.json", manifest: desktop },
+        { path: "vendor/downloaded/frockbot.json", manifest: desktop },
+        { path: "packages/third-party/frockbot.json", manifest: desktop },
+        {
+          path: "packages/plugin-ok/frockbot.json",
+          manifest: {
+            contributions: {
+              desktop: { entry: "./desktop", execution: "sandboxed-renderer" },
+            },
+          },
+        },
+      ],
+      (path) =>
+        path === "packages/third-party/frockbot.json"
+          ? "@acme/third-party"
+          : "@frockbot/plugin-ok",
+    );
+    expect(offenders).toEqual([
+      "apps/cloudflare/frockbot.json: trusted-main outside packages/",
+      "vendor/downloaded/frockbot.json: trusted-main outside packages/",
+      "packages/third-party/frockbot.json: trusted-main in a package named @acme/third-party",
+    ]);
+  });
+
+  // Constitution — Explicit seams: "any other host must be declared in the
+  // manifest and remains non-authoritative". The manifest is a declaration, not
+  // a grant: Electron main runs a `trusted-main` Contribution only from the map
+  // of plugins the shipped application imported statically, so a Package that
+  // arrives by any other path — installed, published, Bot-authored — has
+  // nowhere to land however its manifest is written.
+  test("Electron main loads a trusted-main Contribution only from its statically imported first-party map", () => {
+    const source = read("applications/foundation/src/desktop.ts");
+    const mapped = [...source.matchAll(/\["(@frockbot\/[^"]+)",\s*\w+\]/g)].map(
+      (match) => match[1],
+    );
+    const imported = new Set(
+      [...source.matchAll(/^import\s[^"]*"([^"]+)";$/gm)].map(
+        (match) => match[1],
+      ),
+    );
+
+    const declared = scanManifests()
+      .filter(
+        (scanned) =>
+          desktopContribution(scanned.manifest)?.execution === "trusted-main",
+      )
+      .map(contributionSpecifier)
+      .sort();
+
+    expect(declared.length).toBeGreaterThan(0);
+    expect(mapped.slice().sort()).toEqual(declared);
+    for (const specifier of declared) {
+      expect({ specifier, imported: imported.has(specifier) }).toEqual({
+        specifier,
+        imported: true,
+      });
+    }
+    // The map is reached only after the plan declares the Package and its
+    // manifest says `trusted-main`; an unknown specifier throws rather than
+    // loading.
+    expect(source).toContain('contribution.execution !== "trusted-main"');
+    expect(source).toContain("unknown foundation desktop contribution");
+  });
+
+  // Constitution — Self-modification: "Self-modification never widens
+  // authority." The manifest of a Bot-authored Package is synthesized, never
+  // authored, so a Bot cannot declare a host the kernel did not offer it.
+  test("a Bot-authored manifest declares only Bot isolate Contributions, never a desktop or trusted-main one", () => {
+    const base = {
+      packageId: "bot-tool",
+      displayName: "Bot Tool",
+      version: "0.0.1",
+      tool: { name: "do_it", description: "does it", inputSchema: {} },
+    };
+    for (const manifest of [
+      authoredManifestV1(base),
+      authoredManifestV1({
+        ...base,
+        model: { providerId: "foundation", modelId: "small" },
+      }),
+    ]) {
+      const contributions = manifest.contributions as Record<string, unknown>;
+      expect(Object.keys(contributions).sort()).toEqual(
+        expect.arrayContaining(["runtime"]),
+      );
+      for (const [kind, contribution] of Object.entries(contributions)) {
+        expect({ kind, host: (contribution as { host: string }).host }).toEqual(
+          {
+            kind,
+            host: "bot-isolate",
+          },
+        );
+      }
+      expect(
+        Object.keys(contributions).every((kind) =>
+          ["runtime", "model"].includes(kind),
+        ),
+      ).toBe(true);
+      const serialized = JSON.stringify(manifest);
+      expect(serialized).not.toContain("trusted-main");
+      expect(serialized).not.toContain("desktop");
+      expect(serialized).not.toContain("sandboxed-renderer");
+      expect(manifest.permissions).toEqual([]);
+    }
+  });
+
+  // …and the tool the model sees offers no field to smuggle one in: the input
+  // is exact, so a Contribution, host, or permission key is refused at the seam.
+  test("the package_author input carries no Contribution, host, or permission field", () => {
+    expect(AUTHOR_PACKAGE_INPUT_SCHEMA_V1.additionalProperties).toBe(false);
+    expect(
+      Object.keys(AUTHOR_PACKAGE_INPUT_SCHEMA_V1.properties).sort(),
+    ).toEqual(["displayName", "model", "packageId", "source", "tool"]);
+    const valid = {
+      packageId: "bot-tool",
+      displayName: "Bot Tool",
+      tool: { name: "do_it", description: "does it", inputSchema: {} },
+      source: "export const tools = [];\n",
+    };
+    for (const smuggled of [
+      {
+        contributions: { desktop: { entry: "./d", execution: "trusted-main" } },
+      },
+      { host: "trusted-main" },
+      { permissions: ["desktop:clipboard:read"] },
+    ]) {
+      expect(() =>
+        decodeAuthorPackageInputV1({ ...valid, ...smuggled }),
+      ).toThrow();
+    }
+  });
+
+  // Constitution — Self-modification: "A Bot may author or change anything
+  // above the kernel *for itself*." The behavioural half of this rule is
+  // `packages/plugin-shell/src/backend-authoring.test.ts`; this is the
+  // source-level pin that the guard exists and is a refusal, not a warning.
+  test("the authoring backend refuses a packageId a non-Bot member already holds", () => {
+    const source = read("packages/plugin-shell/src/backend-authoring.ts");
+    expect(shadowGuardFindings(source)).toEqual([]);
+  });
+
+  test("the shadow-guard check refuses a backend that drops or softens the guard", () => {
+    const guarded = read("packages/plugin-shell/src/backend-authoring.ts");
+    expect(
+      shadowGuardFindings(
+        guarded.replaceAll('provenance.kind !== "bot"', "false"),
+      ),
+    ).toEqual([
+      "no non-Bot provenance comparison over the Composition members",
+    ]);
+    expect(
+      shadowGuardFindings(
+        guarded.replaceAll("member.packageId === packageId &&", "false &&"),
+      ),
+    ).toEqual(["the comparison is not keyed by packageId"]);
+  });
+});
+
+/**
+ * The shadowing rule as a function of the backend's source: the Composition's
+ * members are compared by `packageId`, and a member whose provenance is not the
+ * Bot's own is refused.
+ */
+function shadowGuardFindings(source: string): string[] {
+  const findings: string[] = [];
+  if (!source.includes('provenance.kind !== "bot"')) {
+    findings.push(
+      "no non-Bot provenance comparison over the Composition members",
+    );
+  }
+  if (!/member\.packageId === packageId/.test(source)) {
+    findings.push("the comparison is not keyed by packageId");
+  }
+  return findings;
+}

package/src/skill-invocation.test.ts

@@ -0,0 +1,184 @@
+// Invocation, end to end through the Agent loop.
+//
+// GrokBot's users invoke a Skill with `/` or `@`
+// (`docs/research/grokbot-computer.md` §2.8, register row 22). Invoking is not
+// mentioning: an invoked Skill's body is expanded into the Turn's first step,
+// while every other Skill stays a catalog line the Bot may read on demand.
+// This proves both halves against a fake provider, and proves the third: an
+// unknown ref fails the command visibly instead of being dropped.
+import { describe, expect, test } from "bun:test";
+import { AgentLoop } from "@frockbot/kernel-agent-loop";
+import { AgentRegistry } from "@frockbot/kernel-agent-loop/agent";
+import {
+  SessionStore,
+  type LlmProvider,
+  type NormalizedModelRequest,
+  type SkillRefV1,
+} from "@frockbot/kernel-contracts";
+import {
+  botInstructionRootV1,
+  createSkillsRuntimePlugin,
+} from "@frockbot/plugin-skills";
+import { FakeWorkspace, skillMarkdown } from "@frockbot/plugin-skills/testing";
+import { LlmRegistry } from "@frockbot/plugin-models";
+import { SystemPromptRegistry } from "@frockbot/plugin-prompt";
+import { ToolRegistry } from "@frockbot/plugin-tools";
+import { Context, type Plugin } from "cordis";
+
+const COMPOSITION = {
+  generationId: "1970-01-01T00:00:00.000Z:0123456789abcdef",
+  artifactSetHash: "a".repeat(64),
+};
+
+const OWNER = { userId: "user-1", botId: "bot-1" };
+const WRITER = {
+  kind: "bot" as const,
+  botId: "bot-1",
+  sessionId: "user-1:bot-1",
+  turnId: "turn-1",
+  runId: "run-1",
+};
+
+async function turnWith(skills?: SkillRefV1[]) {
+  const root = botInstructionRootV1(OWNER);
+  const workspace = await FakeWorkspace.seeded([
+    {
+      root,
+      path: "skills/daily-standup/SKILL.md",
+      text: skillMarkdown(
+        "Daily standup",
+        "Use this when assembling the weekday standup.",
+        "INVOKED-STANDUP-BODY",
+      ),
+      writer: WRITER,
+    },
+    {
+      root,
+      path: "skills/weekly-report/SKILL.md",
+      text: skillMarkdown(
+        "Weekly report",
+        "Use this when writing the weekly report.",
+        "UNINVOKED-REPORT-BODY",
+      ),
+      writer: WRITER,
+    },
+  ]);
+
+  const requests: NormalizedModelRequest[] = [];
+  const model: LlmProvider = {
+    id: "skill-invoker",
+    async *stream(request) {
+      requests.push(request);
+      yield { type: "text-delta", text: "done" };
+      yield { type: "finish", reason: "completed" };
+    },
+  };
+
+  const context = new Context();
+  await context.plugin(SessionStore, {});
+  await context.plugin(SystemPromptRegistry);
+  await context.plugin(LlmRegistry);
+  await context.plugin(ToolRegistry);
+  await context.plugin(AgentRegistry);
+  const providerPlugin: Plugin.Function = (ctx) => ctx.llm.register(model);
+  providerPlugin.inject = ["llm"];
+  await context.plugin(providerPlugin);
+  await context.plugin(
+    createSkillsRuntimePlugin({ owner: OWNER, reads: workspace }),
+  );
+  await context.plugin(AgentLoop, { maxSteps: 2, composition: COMPOSITION });
+
+  const handle = await context.agents.create({
+    botId: OWNER.botId,
+    sessionId: "user-1:bot-1",
+    provider: model.id,
+    model: "test-model",
+    admitEffect: () => Promise.resolve(true),
+  });
+  handle.agent.send({
+    text: "Run the standup.",
+    ...(skills ? { skills } : {}),
+  });
+  await handle.agent.whenIdle();
+  const events = [...handle.agent.session.events];
+  await context.fiber.dispose();
+  return { requests, events };
+}
+
+describe("invoking a Skill from the composer", () => {
+  test("expands the invoked body into the Turn's first step, and no other", async () => {
+    const { requests } = await turnWith([
+      { schemaVersion: 1, source: "bot", slug: "daily-standup" },
+    ]);
+
+    const first = requests.at(0)?.system ?? "";
+    expect(first).toContain("<invoked_skills>");
+    expect(first).toContain("INVOKED-STANDUP-BODY");
+    // The un-invoked Skill is a catalog line and nothing more: mentioning a
+    // Skill is not running it.
+    expect(first).toContain("skills/weekly-report/SKILL.md");
+    expect(first).not.toContain("UNINVOKED-REPORT-BODY");
+  });
+
+  test("expands nothing when nothing was invoked", async () => {
+    const { requests } = await turnWith();
+    const first = requests.at(0)?.system ?? "";
+    expect(first).toContain("<agent_skills>");
+    expect(first).not.toContain("<invoked_skills>");
+    expect(first).not.toContain("INVOKED-STANDUP-BODY");
+  });
+
+  test("records the ref, the generation and the content hash it resolved", async () => {
+    const { events } = await turnWith([
+      { schemaVersion: 1, source: "bot", slug: "daily-standup" },
+    ]);
+
+    const queued = events.find((event) => event.type === "input/queued");
+    expect(queued).toMatchObject({
+      skills: [{ schemaVersion: 1, source: "bot", slug: "daily-standup" }],
+    });
+
+    const invoked = events.find((event) => event.type === "skill/invoked");
+    if (invoked?.type !== "skill/invoked") throw new Error("no skill/invoked");
+    expect(invoked.turn).toBe(1);
+    expect(invoked.ref).toEqual({
+      schemaVersion: 1,
+      source: "bot",
+      slug: "daily-standup",
+    });
+    // The exact generation the Turn ran on, so the prompt is reconstructable.
+    const injected = events.find((event) => event.type === "skill/injected");
+    if (injected?.type !== "skill/injected") throw new Error("no injection");
+    const listed = injected.skills.find(
+      (skill) => skill.path === "skills/daily-standup/SKILL.md",
+    );
+    expect(invoked.generationId).toBe(listed!.generationId);
+    expect(invoked.contentHash).toBe(listed!.contentHash);
+  });
+
+  test("fails the command with a reason when the ref names no Skill", async () => {
+    const { requests, events } = await turnWith([
+      { schemaVersion: 1, source: "bot", slug: "no-such-skill" },
+    ]);
+
+    // Never silently dropped: the Turn does not reach the model at all.
+    expect(requests).toHaveLength(0);
+    const ended = events.find((event) => event.type === "turn/end");
+    if (ended?.type !== "turn/end") throw new Error("no turn/end");
+    expect(ended.outcome).toBe("blocked");
+    expect(ended.reason).toContain("bot/no-such-skill");
+    expect(events.some((event) => event.type === "skill/invoked")).toBe(false);
+  });
+
+  test("fails a ref whose source no Bot catalog can serve yet", async () => {
+    // K1 and K2 add `user`, `managed` and `plugin`. Until then the codec
+    // admits the value and the resolver refuses it, visibly.
+    const { events } = await turnWith([
+      { schemaVersion: 1, source: "user", slug: "daily-standup" },
+    ]);
+    const ended = events.find((event) => event.type === "turn/end");
+    if (ended?.type !== "turn/end") throw new Error("no turn/end");
+    expect(ended.outcome).toBe("blocked");
+    expect(ended.reason).toContain("user/daily-standup");
+  });
+});