@gate-forge/core 0.1.0

package/dist/testing/env.js

@@ -0,0 +1,106 @@
+/**
+ * Injected environment for fixture runs (fixture harness, G7).
+ *
+ * `withEnv` scopes process.env mutations to a function body (CI provider
+ * variables like `GITHUB_BASE_REF` are environment-carried, so fixtures
+ * must be able to fake them without leaking). The changed-file provider
+ * stubs give GF-09-style parity tests identical inputs through the
+ * `local-staged`, `github-pr`, and `gitlab-mr` provider identities.
+ */
+import { compareStrings } from '../graph/index.js';
+/**
+ * Runs `body` with a patched `process.env`, restoring the previous
+ * environment on every path (sync throw, async rejection, success).
+ * A `undefined` value deletes the variable for the body's duration.
+ *
+ * Args:
+ *   vars: variable name to value (or undefined to unset).
+ *   body: closure to run under the patched environment; may be async.
+ *
+ * Returns:
+ *   The body's return value (awaited when async).
+ */
+export function withEnv(vars, body) {
+    const saved = new Map();
+    for (const [name, value] of Object.entries(vars)) {
+        saved.set(name, process.env[name]);
+        if (value === undefined) {
+            delete process.env[name];
+        }
+        else {
+            process.env[name] = value;
+        }
+    }
+    const restore = () => {
+        for (const [name, value] of saved) {
+            if (value === undefined) {
+                delete process.env[name];
+            }
+            else {
+                process.env[name] = value;
+            }
+        }
+    };
+    let result;
+    try {
+        result = body();
+    }
+    catch (error) {
+        restore();
+        throw error;
+    }
+    if (result instanceof Promise) {
+        return result.finally(restore);
+    }
+    restore();
+    return result;
+}
+/**
+ * Normalizes a changed-file list: posix separators, deduplicated,
+ * codepoint-sorted. Provider outputs are compared as sets by GF-09.
+ *
+ * Args:
+ *   files: raw provider output.
+ *
+ * Returns:
+ *   string[]: canonical form.
+ */
+export function normalizeChangedFiles(files) {
+    const unique = new Set();
+    for (const file of files) {
+        unique.add(file.split('\\').join('/'));
+    }
+    return [...unique].sort(compareStrings);
+}
+/**
+ * Builds a fake changed-file provider from an explicit list — the CI
+ * stand-in (`github-pr` / `gitlab-mr` merge-base diff) and the
+ * `all-files` full-scan provider for fixtures. The list is snapshotted
+ * (defensive copy + normalization) at construction.
+ *
+ * Args:
+ *   provider: provider identity this fake impersonates.
+ *   files: raw changed-file list.
+ *
+ * Returns:
+ *   ChangedFileProvider: deterministic, offline, network-free.
+ */
+export function fakeProvider(provider, files) {
+    const snapshot = normalizeChangedFiles(files);
+    return { provider, changedFiles: () => [...snapshot] };
+}
+/**
+ * Real `local-staged` provider over a {@link TempRepo}: reads the
+ * repository's actual index (`git diff --cached --name-only`) at call
+ * time, so fixtures exercise the genuine local half of GF-09 parity.
+ *
+ * Args:
+ *   repo: the fixture repository.
+ *
+ * Returns:
+ *   ChangedFileProvider: staged files, freshly read on every call.
+ */
+export function localStagedProvider(repo) {
+    return { provider: 'local-staged', changedFiles: () => repo.stagedFiles() };
+}
+//# sourceMappingURL=env.js.map

package/dist/testing/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/testing/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAInD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,OAAO,CAAI,IAAwC,EAAE,IAAa;IAChF,MAAM,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IACpD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;YAClC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,IAAI,MAAS,CAAC;IACd,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,EAAE,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,CAAC;QACV,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,MAAM,YAAY,OAAO,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAM,CAAC;IACtC,CAAC;IACD,OAAO,EAAE,CAAC;IACV,OAAO,MAAM,CAAC;AAChB,CAAC;AAgBD;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAe;IACnD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,QAAyB,EAAE,KAAe;IACrE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC;AACzD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAc;IAChD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;AAC9E,CAAC"}

package/dist/testing/gate-runner.d.ts

@@ -0,0 +1,141 @@
+import type { DetectorOutput, GraphFinding, ResourceGraph } from '../graph/index.js';
+import type { PolicyEvaluationResult } from '../policy/index.js';
+import type { Claim } from '../schemas/claim.js';
+import type { Classification } from '../schemas/classification.js';
+import type { ClassificationPolicy } from '../schemas/classification-policy.js';
+import type { PolicyFile } from '../schemas/policy.js';
+import type { EvidenceRecord } from '../schemas/evidence.js';
+import type { Obligation } from '../schemas/obligation.js';
+import type { Waiver } from '../schemas/waiver.js';
+import type { RunManifest } from '../schemas/run-manifest.js';
+import type { Verdict } from '../schemas/verdict.js';
+import type { TestClock } from './clock.js';
+import type { ChangedFileProvider } from './env.js';
+import type { ParseAudit } from './gf19.js';
+import type { TempRepo } from './temp-repo.js';
+/**
+ * The context one obligation is evaluated against (pin #9). `now` accepts
+ * ISO-8601 string or Date; the evaluator normalizes internally.
+ */
+export interface ObligationEvaluatorInput {
+    /** Claims assessed for this run. */
+    claims: Claim[];
+    /** Witness-issued evidence records for this run. */
+    records: EvidenceRecord[];
+    /** Waivers in scope for this run. */
+    waivers: Waiver[];
+    /** The obligation resource's classification, or null while unclassified. */
+    classification: Classification | null;
+    /** The injected instant the verdict is decided at. */
+    now: string | Date;
+}
+/** The pinned evaluator result shape (pin #9): all keys always present. */
+export interface EvaluatorVerdict {
+    /** One of the seven verdicts. */
+    verdict: Verdict;
+    /** Single-cause reason; null only for `satisfied`. */
+    reason: string | null;
+    /** Evidence record ids backing the verdict; empty when none consulted. */
+    recordIds: string[];
+}
+/**
+ * A pin-#9 obligation evaluator. G3's `evaluateObligation` conforms
+ * structurally; fixtures inject doubles.
+ */
+export type ObligationEvaluator = (obligation: Obligation, input: ObligationEvaluatorInput) => EvaluatorVerdict;
+/** One detector contribution, optionally carrying its parse audit. */
+export interface DetectorContribution extends DetectorOutput {
+    /** Per-file parse audit; when present the GF-19 rule is applied. */
+    audit?: ParseAudit;
+}
+/** Everything one gate run needs. Detectors, artifacts, clock, evaluator. */
+export interface RunGatesInput {
+    /** The fixture repository under test. */
+    repo: TempRepo;
+    /** Detector contributions; at least one. */
+    detectors: DetectorContribution[];
+    /**
+     * The classification policy (`.gateforge/classification-policy.yml`
+     * content, plan phase 5). Effective classifications are computed
+     * deterministically from detector signals on every run — there is no
+     * manual classifications document.
+     */
+    classificationPolicy: ClassificationPolicy;
+    /** Policies document (`.gateforge/policies.yml` content). */
+    policies: PolicyFile;
+    /** The obligation evaluator (pin #9). */
+    evaluate: ObligationEvaluator;
+    /** The injected clock; stamps the run manifest and every verdict. */
+    clock: TestClock;
+    /** Claims to assess and watch for stale references. */
+    claims?: Claim[];
+    /** Witness-issued records backing verdicts. */
+    records?: EvidenceRecord[];
+    /** Waivers in scope. */
+    waivers?: Waiver[];
+    /** Adapter names watched for stale references. */
+    adapters?: string[];
+    /** Changed-file provider; when omitted the run records no changed files. */
+    changedProvider?: ChangedFileProvider;
+    /** Fixed run id; default is a fresh random UUID. */
+    runId?: string;
+}
+/** One obligation's verdict plus the identity fields a report needs. */
+export interface GateRunVerdict {
+    /** `<resourceId>:<contract>`. */
+    obligationId: string;
+    resourceId: string;
+    /** Contract required by the policy. */
+    contract: string;
+    /** Policy that generated the obligation. */
+    policyId: string;
+    /** Obligation fingerprint (pin #2) — the identity baselines store. */
+    fingerprint: string;
+    /** Decided verdict. */
+    verdict: Verdict;
+    /** Single-cause reason; null only for `satisfied`. */
+    reason: string | null;
+    /** Backing evidence record ids. */
+    recordIds: string[];
+}
+/** The complete, typed result of one gate run. */
+export interface GateRunResult {
+    /** Run manifest (pin #4), validated against its schema. */
+    manifest: RunManifest;
+    /** The built resource graph (includes all findings). */
+    graph: ResourceGraph;
+    /** Policy-engine output: obligations, blocking entries, claim assessments. */
+    policy: PolicyEvaluationResult;
+    /** Per-obligation verdicts, sorted by obligation id. */
+    verdicts: GateRunVerdict[];
+    /** Graph findings (detector + graph-issued), including `PARSE_ERROR`. */
+    findings: GraphFinding[];
+    /** GF-19 rule violations: detector misbehavior the rule had to correct. */
+    auditViolations: string[];
+    /** Changed files reported by the injected provider (sorted). */
+    changedFiles: string[];
+    /**
+     * True when nothing blocks: no blocking verdicts, no blocking entries,
+     * no findings, no audit violations. Conservative by design — a fixture
+     * asserting a specific sub-outcome should assert on the fields above.
+     */
+    clean: boolean;
+}
+/**
+ * Runs the discover → obligations → evaluate pipeline over a fixture
+ * repository. Deterministic given fixed inputs: detectors run in order,
+ * the graph and policy engine sort their outputs, and the clock is
+ * injected.
+ *
+ * Args:
+ *   input: repository, detector contributions (+ parse audits), the
+ *     classification-policy/policy documents, injected clock, evaluator
+ *     double or real, and optional claims/records/waivers/provider/runId.
+ *
+ * Returns:
+ *   GateRunResult: manifest, graph, policy result, per-obligation
+ *   verdicts, findings, audit violations, changed files, clean flag.
+ * @throws TypeError when no detector contributions are supplied.
+ */
+export declare function runGates(input: RunGatesInput): GateRunResult;
+//# sourceMappingURL=gate-runner.d.ts.map

package/dist/testing/gate-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-runner.d.ts","sourceRoot":"","sources":["../../src/testing/gate-runner.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGrF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAIjE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAChF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,oCAAoC;IACpC,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,oDAAoD;IACpD,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,qCAAqC;IACrC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,4EAA4E;IAC5E,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IACtC,sDAAsD;IACtD,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,iCAAiC;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,sDAAsD;IACtD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAChC,UAAU,EAAE,UAAU,EACtB,KAAK,EAAE,wBAAwB,KAC5B,gBAAgB,CAAC;AAEtB,sEAAsE;AACtE,MAAM,WAAW,oBAAqB,SAAQ,cAAc;IAC1D,oEAAoE;IACpE,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,yCAAyC;IACzC,IAAI,EAAE,QAAQ,CAAC;IACf,4CAA4C;IAC5C,SAAS,EAAE,oBAAoB,EAAE,CAAC;IAClC;;;;;OAKG;IACH,oBAAoB,EAAE,oBAAoB,CAAC;IAC3C,6DAA6D;IAC7D,QAAQ,EAAE,UAAU,CAAC;IACrB,yCAAyC;IACzC,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,qEAAqE;IACrE,KAAK,EAAE,SAAS,CAAC;IACjB,uDAAuD;IACvD,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACjB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC;IAC3B,wBAAwB;IACxB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,4EAA4E;IAC5E,eAAe,CAAC,EAAE,mBAAmB,CAAC;IACtC,oDAAoD;IACpD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC7B,iCAAiC;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,sDAAsD;IACtD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,mCAAmC;IACnC,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,kDAAkD;AAClD,MAAM,WAAW,aAAa;IAC5B,2DAA2D;IAC3D,QAAQ,EAAE,WAAW,CAAC;IACtB,wDAAwD;IACxD,KAAK,EAAE,aAAa,CAAC;IACrB,8EAA8E;IAC9E,MAAM,EAAE,sBAAsB,CAAC;IAC/B,wDAAwD;IACxD,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,yEAAyE;IACzE,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,2EAA2E;IAC3E,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,gEAAgE;IAChE,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB;;;;OAIG;IACH,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,aAAa,CA8I5D"}

package/dist/testing/gate-runner.js

@@ -0,0 +1,173 @@
+/**
+ * Gate-runner helper (fixture harness, G7): runs the full
+ * discover → obligations → evaluate pipeline over a temporary repository
+ * with injected clock, environment, and changed-file provider.
+ *
+ * The evaluator is injected (pin #9: `evaluateObligation(obligation,
+ * {claims, records, waivers, classification, now})`); fixtures in this
+ * package use a local test double. When G3's verdict engine lands, the
+ * real `evaluateObligation` satisfies {@link ObligationEvaluator}
+ * structurally — no harness change needed.
+ *
+ * The GF-19 rule is applied to every detector contribution carrying a
+ * parse audit before the graph is built, so malformed source can never
+ * enter the pipeline as a silent resource.
+ */
+import { randomUUID } from 'node:crypto';
+import { buildResourceGraph, compareStrings } from '../graph/index.js';
+import { fingerprint } from '../fingerprints.js';
+import { evaluatePolicies } from '../policy/index.js';
+import { runClassification } from '../classifier/bind.js';
+import { RunManifestSchema } from '../schemas/run-manifest.js';
+import { applyParseErrorRule } from './gf19.js';
+/**
+ * Runs the discover → obligations → evaluate pipeline over a fixture
+ * repository. Deterministic given fixed inputs: detectors run in order,
+ * the graph and policy engine sort their outputs, and the clock is
+ * injected.
+ *
+ * Args:
+ *   input: repository, detector contributions (+ parse audits), the
+ *     classification-policy/policy documents, injected clock, evaluator
+ *     double or real, and optional claims/records/waivers/provider/runId.
+ *
+ * Returns:
+ *   GateRunResult: manifest, graph, policy result, per-obligation
+ *   verdicts, findings, audit violations, changed files, clean flag.
+ * @throws TypeError when no detector contributions are supplied.
+ */
+export function runGates(input) {
+    if (input.detectors.length === 0) {
+        throw new TypeError('runGates requires at least one detector contribution');
+    }
+    const contributions = [];
+    const auditViolations = [];
+    for (const contribution of input.detectors) {
+        if (contribution.audit === undefined) {
+            contributions.push(contribution);
+            continue;
+        }
+        const ruled = applyParseErrorRule({
+            detectorId: contribution.detectorId,
+            detectorVersion: contribution.detectorVersion,
+            audit: contribution.audit,
+            output: contribution,
+        });
+        auditViolations.push(...ruled.violations.map((violation) => `${contribution.detectorId}: ${violation}`));
+        contributions.push({
+            detectorId: contribution.detectorId,
+            detectorVersion: contribution.detectorVersion,
+            resources: ruled.resources,
+            unresolved: contribution.unresolved,
+            // The rule's guaranteed findings carry provenance; feed them back
+            // through the pinned discovery shape so the graph owns them.
+            findings: ruled.findings.map(({ code, detail, locations }) => ({ code, detail, locations })),
+            classificationSignals: contribution.classificationSignals,
+            ...(contribution.scannedPaths !== undefined
+                ? { scannedPaths: contribution.scannedPaths }
+                : {}),
+        });
+    }
+    const built = buildResourceGraph({
+        detectors: contributions,
+        claims: input.claims,
+        adapters: input.adapters,
+        waivers: input.waivers,
+    });
+    const signals = contributions.flatMap((contribution) => contribution.classificationSignals);
+    // Channel routing (ADR 0003 D2): the harness stands in the HOST, so
+    // suppressive-shaped signals in the fixture contributions are minted
+    // onto the authority channel exactly as the real pipeline would.
+    const suppressive = (signal) => (signal.dimension === 'internality' &&
+        (signal.basis === 'declaration' || signal.basis === 'organization-policy')) ||
+        (signal.dimension.startsWith('lifecycle.') && signal.basis === 'code-negative-closed-world');
+    // Per-detector coverage (red-team round 3): synthesize the coverage
+    // reports from contributions that reported scannedPaths, exactly as
+    // the real pipeline does — the attestation judges THESE, never a union.
+    const coverage = contributions
+        .filter((contribution) => contribution.scannedPaths !== undefined)
+        .map((contribution) => ({
+        detector: contribution.detectorId,
+        scannedPaths: contribution.scannedPaths,
+    }));
+    const { graph, blocking } = runClassification({
+        graph: built,
+        signals: signals.filter((signal) => !suppressive(signal)),
+        authority: signals.filter(suppressive),
+        policy: input.classificationPolicy,
+        adapters: input.adapters ?? [],
+        scan: {
+            // The harness's requested scope is the union of reported coverage
+            // (fixture-level self-consistency); the policy's coverage rules
+            // still judge each detector individually below.
+            requestedPaths: [...new Set(coverage.flatMap((entry) => entry.scannedPaths))],
+            scannedPaths: [...new Set(coverage.flatMap((entry) => entry.scannedPaths))],
+            coverage,
+            configuredDetectors: contributions.length,
+            successfulDetectors: contributions.length,
+        },
+    });
+    const policy = evaluatePolicies({
+        graph,
+        policies: input.policies,
+        claims: input.claims,
+        extraBlocking: blocking,
+    });
+    const now = input.clock.now();
+    const verdicts = policy.obligations
+        .map((obligation) => {
+        const resource = graph.resources.find((candidate) => candidate.id === obligation.resourceId);
+        const outcome = input.evaluate(obligation, {
+            claims: input.claims ?? [],
+            records: input.records ?? [],
+            waivers: input.waivers ?? [],
+            classification: resource?.classification ?? null,
+            now,
+        });
+        return {
+            obligationId: obligation.id,
+            resourceId: obligation.resourceId,
+            contract: obligation.contract,
+            policyId: obligation.policyId,
+            fingerprint: fingerprint({
+                resourceId: obligation.resourceId,
+                contract: obligation.contract,
+                policyId: obligation.policyId,
+                lifecycle: obligation.lifecycle,
+            }),
+            verdict: outcome.verdict,
+            reason: outcome.reason,
+            recordIds: [...outcome.recordIds].sort(compareStrings),
+        };
+    })
+        .sort((a, b) => compareStrings(a.obligationId, b.obligationId));
+    const manifest = RunManifestSchema.parse({
+        schemaVersion: 1,
+        runId: input.runId ?? randomUUID(),
+        startedAt: now,
+        gitSha: input.repo.headSha(),
+        provider: input.changedProvider?.provider ?? 'all-files',
+        plugins: contributions.map((contribution) => ({
+            id: contribution.detectorId,
+            version: contribution.detectorVersion,
+            transport: 'in-process',
+        })),
+        attestationScope: null,
+    });
+    const blockingVerdicts = verdicts.filter((verdict) => verdict.verdict !== 'satisfied' && verdict.verdict !== 'waived');
+    return {
+        manifest,
+        graph,
+        policy,
+        verdicts,
+        findings: graph.findings,
+        auditViolations,
+        changedFiles: input.changedProvider?.changedFiles() ?? [],
+        clean: blockingVerdicts.length === 0 &&
+            policy.blocking.length === 0 &&
+            graph.findings.length === 0 &&
+            graph.stale.length === 0 &&
+            auditViolations.length === 0,
+    };
+}
+//# sourceMappingURL=gate-runner.js.map

package/dist/testing/gate-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-runner.js","sourceRoot":"","sources":["../../src/testing/gate-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAU1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAK/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAyHhD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAoB;IAC3C,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,SAAS,CAAC,sDAAsD,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,aAAa,GAAqB,EAAE,CAAC;IAC3C,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,KAAK,MAAM,YAAY,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QAC3C,IAAI,YAAY,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACrC,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACjC,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,mBAAmB,CAAC;YAChC,UAAU,EAAE,YAAY,CAAC,UAAU;YACnC,eAAe,EAAE,YAAY,CAAC,eAAe;YAC7C,KAAK,EAAE,YAAY,CAAC,KAAK;YACzB,MAAM,EAAE,YAAY;SACrB,CAAC,CAAC;QACH,eAAe,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,YAAY,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC,CAAC,CAAC;QACzG,aAAa,CAAC,IAAI,CAAC;YACjB,UAAU,EAAE,YAAY,CAAC,UAAU;YACnC,eAAe,EAAE,YAAY,CAAC,eAAe;YAC7C,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU,EAAE,YAAY,CAAC,UAAU;YACnC,kEAAkE;YAClE,6DAA6D;YAC7D,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAC5F,qBAAqB,EAAE,YAAY,CAAC,qBAAqB;YACzD,GAAG,CAAC,YAAY,CAAC,YAAY,KAAK,SAAS;gBACzC,CAAC,CAAC,EAAE,YAAY,EAAE,YAAY,CAAC,YAAY,EAAE;gBAC7C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,kBAAkB,CAAC;QAC/B,SAAS,EAAE,aAAa;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC;IAC5F,oEAAoE;IACpE,qEAAqE;IACrE,iEAAiE;IACjE,MAAM,WAAW,GAAG,CAAC,MAA4B,EAAW,EAAE,CAC5D,CAAC,MAAM,CAAC,SAAS,KAAK,aAAa;QACjC,CAAC,MAAM,CAAC,KAAK,KAAK,aAAa,IAAI,MAAM,CAAC,KAAK,KAAK,qBAAqB,CAAC,CAAC;QAC7E,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,KAAK,KAAK,4BAA4B,CAAC,CAAC;IAC/F,oEAAoE;IACpE,oEAAoE;IACpE,wEAAwE;IACxE,MAAM,QAAQ,GAAG,aAAa;SAC3B,MAAM,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,YAAY,KAAK,SAAS,CAAC;SACjE,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACtB,QAAQ,EAAE,YAAY,CAAC,UAAU;QACjC,YAAY,EAAE,YAAY,CAAC,YAAwB;KACpD,CAAC,CAAC,CAAC;IACN,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,iBAAiB,CAAC;QAC5C,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACzD,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;QACtC,MAAM,EAAE,KAAK,CAAC,oBAAoB;QAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;QAC9B,IAAI,EAAE;YACJ,kEAAkE;YAClE,gEAAgE;YAChE,gDAAgD;YAChD,cAAc,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;YAC7E,YAAY,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;YAC3E,QAAQ;YACR,mBAAmB,EAAE,aAAa,CAAC,MAAM;YACzC,mBAAmB,EAAE,aAAa,CAAC,MAAM;SAC1C;KACF,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,gBAAgB,CAAC;QAC9B,KAAK;QACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa,EAAE,QAAQ;KACxB,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW;SAChC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;QAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,UAAU,CAAC,UAAU,CAAC,CAAC;QAC7F,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE;YACzC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;YAC5B,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;YAC5B,cAAc,EAAE,QAAQ,EAAE,cAAc,IAAI,IAAI;YAChD,GAAG;SACJ,CAAC,CAAC;QACH,OAAO;YACL,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,WAAW,EAAE,WAAW,CAAC;gBACvB,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;aAChC,CAAC;YACF,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;SACvD,CAAC;IACJ,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;IAElE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC;QACvC,aAAa,EAAE,CAAC;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,UAAU,EAAE;QAClC,SAAS,EAAE,GAAG;QACd,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE;QAC5B,QAAQ,EAAE,KAAK,CAAC,eAAe,EAAE,QAAQ,IAAI,WAAW;QACxD,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YAC5C,EAAE,EAAE,YAAY,CAAC,UAAU;YAC3B,OAAO,EAAE,YAAY,CAAC,eAAe;YACrC,SAAS,EAAE,YAAY;SACxB,CAAC,CAAC;QACH,gBAAgB,EAAE,IAAI;KACvB,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CACtC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ,CAC7E,CAAC;IACF,OAAO;QACL,QAAQ;QACR,KAAK;QACL,MAAM;QACN,QAAQ;QACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,eAAe;QACf,YAAY,EAAE,KAAK,CAAC,eAAe,EAAE,YAAY,EAAE,IAAI,EAAE;QACzD,KAAK,EACH,gBAAgB,CAAC,MAAM,KAAK,CAAC;YAC7B,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YAC5B,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YAC3B,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YACxB,eAAe,CAAC,MAAM,KAAK,CAAC;KAC/B,CAAC;AACJ,CAAC"}

package/dist/testing/gf19.d.ts

@@ -0,0 +1,106 @@
+import type { DetectorOutput, GraphFinding } from '../graph/index.js';
+import type { Resource } from '../schemas/resource.js';
+import type { TempRepo } from './temp-repo.js';
+/** The canonical finding code for malformed source files. */
+export declare const PARSE_ERROR_FINDING = "PARSE_ERROR";
+/** One scanned file's parse outcome, as reported by a detector. */
+export interface ParseAuditEntry {
+    /** Repo-root-relative posix path of the scanned file. */
+    file: string;
+    /** True when the file parsed. */
+    ok: boolean;
+    /** 1-based line of the first syntax error; required when `ok` is false. */
+    line?: number;
+    /** Single-cause human explanation; required when `ok` is false. */
+    detail?: string;
+}
+/** A detector's full parse audit: one entry per scanned file. */
+export type ParseAudit = ParseAuditEntry[];
+/** Inputs to the GF-19 rule. */
+export interface ParseErrorRuleInput {
+    /** Detector identity for finding provenance. */
+    detectorId: string;
+    /** Detector version for finding provenance. */
+    detectorVersion: string;
+    /** The detector's per-file parse audit. */
+    audit: ParseAudit;
+    /** The detector's raw discovery output (untrusted). */
+    output: DetectorOutput;
+}
+/** Outcome of applying the GF-19 rule. */
+export interface ParseErrorRuleResult {
+    /**
+     * All detector findings with provenance, PLUS a guaranteed
+     * `PARSE_ERROR` finding per malformed file. Deterministically sorted.
+     */
+    findings: GraphFinding[];
+    /** The `PARSE_ERROR` findings subset (assertion convenience). */
+    parseErrors: GraphFinding[];
+    /**
+     * Resources allowed through: every resource sourced from a malformed
+     * file has been stripped.
+     */
+    resources: Resource[];
+    /**
+     * Non-empty when the detector misbehaved: emitted resources from a
+     * malformed file (silent resources) or failed to report a
+     * `PARSE_ERROR` finding / a valid audit line number.
+     */
+    violations: string[];
+}
+/**
+ * Applies the GF-19 rule to one detector contribution.
+ *
+ * Args:
+ *   input: detector identity, parse audit, and raw output.
+ *
+ * Returns:
+ *   ParseErrorRuleResult: guaranteed findings, vetted resources, and the
+ *   detector's violations (empty when the detector behaved).
+ */
+export declare function applyParseErrorRule(input: ParseErrorRuleInput): ParseErrorRuleResult;
+/**
+ * Whether a finding list contains at least one `PARSE_ERROR` — the
+ * fail-closed signal that a source file could not be read.
+ *
+ * Args:
+ *   findings: graph or rule findings.
+ *
+ * Returns:
+ *   boolean: true when malformed source is in play.
+ */
+export declare function hasParseErrors(findings: GraphFinding[]): boolean;
+/** Options for {@link stubDetector}. */
+export interface StubDetectorOptions {
+    /** Detector id. Default `gateforge.stub-detector`. */
+    id?: string;
+    /** Detector version. Default `0.0.0`. */
+    version?: string;
+    /** Only scan files with these suffixes. Default: all non-`.git`/`.gateforge` files. */
+    suffixes?: string[];
+}
+/** {@link stubDetector} result: discovery output plus its parse audit. */
+export interface StubDetectorResult {
+    /** Pinned discovery shape, ready for the gate runner. */
+    output: DetectorOutput;
+    /** Per-file parse audit for the GF-19 rule. */
+    audit: ParseAudit;
+}
+/**
+ * Detects resources in a fixture repository with a deliberately trivial
+ * in-process parser: every top-level `name = value` line becomes a
+ * resource (`kind: 'stub.declaration'`, `resourceName` attribute), any
+ * other non-comment/non-blank line is a syntax error, and a file with a
+ * syntax error yields a `PARSE_ERROR` finding at that line and no
+ * resources. Malformed files never crash the scan.
+ *
+ * Args:
+ *   repo: the fixture repository to scan.
+ *   options: detector identity and optional suffix filter.
+ *
+ * Returns:
+ *   StubDetectorResult: discovery output plus the parse audit for the
+ *   GF-19 rule.
+ */
+export declare function stubDetector(repo: TempRepo, options?: StubDetectorOptions): StubDetectorResult;
+//# sourceMappingURL=gf19.d.ts.map

package/dist/testing/gf19.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gf19.d.ts","sourceRoot":"","sources":["../../src/testing/gf19.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGtE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C,6DAA6D;AAC7D,eAAO,MAAM,mBAAmB,gBAAgB,CAAC;AAEjD,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,EAAE,EAAE,OAAO,CAAC;IACZ,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,iEAAiE;AACjE,MAAM,MAAM,UAAU,GAAG,eAAe,EAAE,CAAC;AAE3C,gCAAgC;AAChC,MAAM,WAAW,mBAAmB;IAClC,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,+CAA+C;IAC/C,eAAe,EAAE,MAAM,CAAC;IACxB,2CAA2C;IAC3C,KAAK,EAAE,UAAU,CAAC;IAClB,uDAAuD;IACvD,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,0CAA0C;AAC1C,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,iEAAiE;IACjE,WAAW,EAAE,YAAY,EAAE,CAAC;IAC5B;;;OAGG;IACH,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB;;;;OAIG;IACH,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAoBD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,GAAG,oBAAoB,CAwEpF;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,OAAO,CAEhE;AAED,wCAAwC;AACxC,MAAM,WAAW,mBAAmB;IAClC,sDAAsD;IACtD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,0EAA0E;AAC1E,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,MAAM,EAAE,cAAc,CAAC;IACvB,+CAA+C;IAC/C,KAAK,EAAE,UAAU,CAAC;CACnB;AAqFD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,GAAE,mBAAwB,GAAG,kBAAkB,CAmElG"}