@godv61/dsh-task-engine 0.29.8 → 0.30.1

package/.resource-test.mjs

@@ -122,7 +122,7 @@ test('ledger shows absent storage as empty and propagates access errors',async()
  controller.fs=()=>({resolve:async p=>p,listDir:async()=>{throw Object.assign(new Error('denied'),{code:'EACCES'})}})
  await assert.rejects(()=>controller.readTasks('/project'),/denied/)
 })
-test('ledger rejects malformed records instead of pretending there are no tasks',async()=>{
+test('ledger rejects malformed records instead of pretending there are no tasks',async()=>{
  const {default:Controller}=await import('./lib/controller.js')
  const controller=Object.create(Controller.prototype)
  controller.authorizedPath=async p=>p
@@ -130,21 +130,21 @@ test('ledger rejects malformed records instead of pretending there are no tasks'
    controller.fs=()=>({resolve:async p=>p,listDir:async()=>[{name:'task-broken.json'}],readText:async()=>content})
    await assert.rejects(()=>controller.readTasks('/project'),/任务记录/)
  }
-})
-test('ledger exposes Sonar findings without project credentials',async()=>{
- const {default:Controller}=await import('./lib/controller.js')
- const controller=Object.create(Controller.prototype)
- controller.authorizedPath=async p=>p
- controller.fs=()=>({resolve:async p=>p,listDir:async()=>[{name:'task-sample.json'}],readText:async()=>JSON.stringify({
-   id:'sample',title:'Sample',stage:'代码审核',branch:'feature/sample',items:[],
-   sonar_policy:{source:'ide-local',token_env:'SONAR_TOKEN',host_url:'https://sonar.example',project_key:'sample'},
-   sonar_audit:{gate:'ERROR',checked_at:'2026-10-03T00:00:00Z',target:'main',
-     findings:[{key:'issue-1',rule:'java:S103',message:'Line too long',severity:'MAJOR',file:'Sample.java',line:3}],
-     blocking:[{key:'issue-1'}],uncovered_files:[]},
- })})
- const {tasks}=await controller.readTasks('/project')
- assert.equal(tasks[0].sonar.audit.gate,'ERROR')
- assert.equal(tasks[0].sonar.audit.blocking_count,1)
- assert.deepEqual(tasks[0].sonar.audit.findings[0],{key:'issue-1',rule:'java:S103',message:'Line too long',severity:'MAJOR',file:'Sample.java',line:3})
- assert.equal(JSON.stringify(tasks).includes('SONAR_TOKEN'),false)
-})
+})
+test('ledger exposes Sonar findings without project credentials',async()=>{
+ const {default:Controller}=await import('./lib/controller.js')
+ const controller=Object.create(Controller.prototype)
+ controller.authorizedPath=async p=>p
+ controller.fs=()=>({resolve:async p=>p,listDir:async()=>[{name:'task-sample.json'}],readText:async()=>JSON.stringify({
+   id:'sample',title:'Sample',stage:'代码审核',branch:'feature/sample',items:[],
+   sonar_policy:{source:'ide-local',token_env:'SONAR_TOKEN',host_url:'https://sonar.example',project_key:'sample'},
+   sonar_audit:{gate:'ERROR',checked_at:'2026-10-03T00:00:00Z',target:'main',
+     findings:[{key:'issue-1',rule:'java:S103',message:'Line too long',severity:'MAJOR',file:'Sample.java',line:3}],
+     blocking:[{key:'issue-1'}],uncovered_files:[]},
+ })})
+ const {tasks}=await controller.readTasks('/project')
+ assert.equal(tasks[0].sonar.audit.gate,'ERROR')
+ assert.equal(tasks[0].sonar.audit.blocking_count,1)
+ assert.deepEqual(tasks[0].sonar.audit.findings[0],{key:'issue-1',rule:'java:S103',message:'Line too long',severity:'MAJOR',file:'Sample.java',line:3})
+ assert.equal(JSON.stringify(tasks).includes('SONAR_TOKEN'),false)
+})

package/.roundtrip-test.mjs

@@ -13,16 +13,16 @@ import { dirname, join, resolve, sep } from 'node:path'
 import { resolveFlow, adoptRecommendation, compactProjectConfig, materializeBundledReferences } from './lib/workflows.js'
 import Controller from './lib/controller.js'
 import { assertAdvance, validateWorkflow } from './lib/engine.js'
-// The npm package ships the built client, not its TypeScript source. Keep the
-// source codec assertion in repository tests while allowing shipped tests to run.
-const remoteSource = new URL('./src/client/remote.ts', import.meta.url)
-const hasRemoteSource = existsSync(remoteSource)
+// The npm package ships the built client, not its TypeScript source. Keep the
+// source codec assertion in repository tests while allowing shipped tests to run.
+const remoteSource = new URL('./src/client/remote.ts', import.meta.url)
+const hasRemoteSource = existsSync(remoteSource)
 const TYPERT_REMOTE = hasRemoteSource ? (await import(remoteSource.href)).TYPERT_REMOTE : undefined
 
 /** The fields a project config can carry, so a round-trip is checked on all of them. */
 const FIELDS = ['flow', 'stage_bindings', 'commit', 'artifacts', 'review_depth', 'commit_required']
 
-test('browser remote codec retains source-qualified bindings and all saved fields',
+test('browser remote codec retains source-qualified bindings and all saved fields',
   { skip: hasRemoteSource ? false : 'TypeScript source is excluded from the npm package' }, () => {
   const write = TYPERT_REMOTE.descriptors.find(descriptor => descriptor.method === 'write')
   const read = TYPERT_REMOTE.descriptors.find(descriptor => descriptor.method === 'read')

package/.sonar-credential-test.mjs

@@ -1,38 +1,38 @@
-import assert from 'node:assert/strict'
-import { test } from 'node:test'
-import { resolveSonarToken, sonarCredentialRef } from './lib/sonar-credential.js'
-import Controller from './lib/controller.js'
-
-test('Sonar credential references stay distinct for different workspaces', () => {
-  const qms = sonarCredentialRef('D:/projects/qms')
-  const eam = sonarCredentialRef('D:/projects/eam')
-  assert.match(qms, /^DSH_TASK_ENGINE_SONAR_[A-F0-9]{24}$/)
-  assert.notEqual(qms, eam)
-  assert.equal(qms, sonarCredentialRef('D:/projects/qms'))
-  assert.ok(!qms.includes('qms'))
-  if (process.platform === 'win32') assert.equal(qms, sonarCredentialRef('d:/PROJECTS/QMS'))
-})
-
-test('Sonar token management keeps each workspace value private', async () => {
-  const stored = new Map()
-  const credentials = {
-    describe: async ref => ({ configured: stored.has(ref), writable: true, source: stored.has(ref) ? 'file' : undefined }),
-    set: async (ref, value) => { stored.set(ref, value) },
-    unset: async ref => { stored.delete(ref) },
-    resolve: async ref => stored.has(ref) ? { value: stored.get(ref), source: 'file' } : undefined,
-  }
-  const controller = Object.create(Controller.prototype)
-  controller.authorizedPath = async path => path
-  Object.defineProperty(controller, 'ctx', { value: { get: name => name === 'credentials' ? credentials : undefined } })
-  const qms = 'D:/projects/qms'
-  const eam = 'D:/projects/eam'
-  const result = await controller.setSonarToken({ path: qms, token: 'qms-secret' })
-  assert.equal(result.configured, true)
-  assert.ok(!JSON.stringify(result).includes('qms-secret'))
-  assert.equal((await controller.describeSonarToken(eam)).configured, false)
-  assert.equal((await credentials.resolve(sonarCredentialRef(qms))).value, 'qms-secret')
-  assert.equal(await resolveSonarToken(credentials, qms, 'old-env-token'), 'qms-secret')
-  assert.equal(await resolveSonarToken(credentials, eam, 'old-env-token'), 'old-env-token')
-  await controller.unsetSonarToken(qms)
-  assert.equal((await controller.describeSonarToken(qms)).configured, false)
-})
+import assert from 'node:assert/strict'
+import { test } from 'node:test'
+import { resolveSonarToken, sonarCredentialRef } from './lib/sonar-credential.js'
+import Controller from './lib/controller.js'
+
+test('Sonar credential references stay distinct for different workspaces', () => {
+  const qms = sonarCredentialRef('D:/projects/qms')
+  const eam = sonarCredentialRef('D:/projects/eam')
+  assert.match(qms, /^DSH_TASK_ENGINE_SONAR_[A-F0-9]{24}$/)
+  assert.notEqual(qms, eam)
+  assert.equal(qms, sonarCredentialRef('D:/projects/qms'))
+  assert.ok(!qms.includes('qms'))
+  if (process.platform === 'win32') assert.equal(qms, sonarCredentialRef('d:/PROJECTS/QMS'))
+})
+
+test('Sonar token management keeps each workspace value private', async () => {
+  const stored = new Map()
+  const credentials = {
+    describe: async ref => ({ configured: stored.has(ref), writable: true, source: stored.has(ref) ? 'file' : undefined }),
+    set: async (ref, value) => { stored.set(ref, value) },
+    unset: async ref => { stored.delete(ref) },
+    resolve: async ref => stored.has(ref) ? { value: stored.get(ref), source: 'file' } : undefined,
+  }
+  const controller = Object.create(Controller.prototype)
+  controller.authorizedPath = async path => path
+  Object.defineProperty(controller, 'ctx', { value: { get: name => name === 'credentials' ? credentials : undefined } })
+  const qms = 'D:/projects/qms'
+  const eam = 'D:/projects/eam'
+  const result = await controller.setSonarToken({ path: qms, token: 'qms-secret' })
+  assert.equal(result.configured, true)
+  assert.ok(!JSON.stringify(result).includes('qms-secret'))
+  assert.equal((await controller.describeSonarToken(eam)).configured, false)
+  assert.equal((await credentials.resolve(sonarCredentialRef(qms))).value, 'qms-secret')
+  assert.equal(await resolveSonarToken(credentials, qms, 'old-env-token'), 'qms-secret')
+  assert.equal(await resolveSonarToken(credentials, eam, 'old-env-token'), 'old-env-token')
+  await controller.unsetSonarToken(qms)
+  assert.equal((await controller.describeSonarToken(qms)).configured, false)
+})

package/.sonarlint-local-test.mjs

@@ -1,65 +1,71 @@
-import assert from 'node:assert/strict'
-import { execFileSync } from 'node:child_process'
-import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { test } from 'node:test'
-import { changedLines, uncoveredLocalFiles } from './lib/sonarlint-local.js'
-import { isIncludedAuditPath, validAuditIncludePaths } from './lib/sonar.js'
-import { renderSonarReport, sonarReportPath } from './lib/sonar-report.js'
-
-test('project scan roots mirror Maven backend scope without including the Vue app', () => {
-  const roots = ['fp-bussiness', 'fp-ruoyi', 'fp-ruoyi-spring-boot', 'pom.xml']
-  assert.equal(validAuditIncludePaths(roots), true)
-  assert.equal(isIncludedAuditPath('fp-bussiness/src/main/java/A.java', roots), true)
-  assert.equal(isIncludedAuditPath('fp-ruoyi-ui/src/views/auth.vue', roots), false)
-  assert.equal(validAuditIncludePaths(['../outside']), false)
-  assert.equal(validAuditIncludePaths(['C:/outside']), false)
-})
-
-test('one review gets a credential-free Markdown report path and issue details', () => {
-  const audit = { analysis_id: 'abc12345-0000', checked_at: '2026-10-03T10:11:12.000Z',
-    target: 'qdm_gw_chemical_260930', gate: 'ERROR', findings: [{key:'x',rule:'java:S103',
-      severity:'MAJOR',file:'A.java',line:12,message:'Line too long'}], blocking:[{key:'x'}],
-    scanned_files:['A.java'],uncovered_files:[] }
-  const path = sonarReportPath('QMS-1', audit)
-  assert.match(path, /^\.dsh\/reviews\/QMS-1\/2026-/)
-  const report = renderSonarReport('QMS-1', {source:'ide-local',project_key:'project',include_paths:['fp-bussiness']}, audit)
-  assert.match(report, /java:S103/)
-  assert.match(report, /A.java:12/)
-  assert.equal(report.includes('token-secret'),false)
-})
-
+import assert from 'node:assert/strict'
+import { execFileSync } from 'node:child_process'
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { test } from 'node:test'
+import { changedLines, missingLocalAuditScope, uncoveredLocalFiles } from './lib/sonarlint-local.js'
+import { isIncludedAuditPath, validAuditIncludePaths } from './lib/sonar.js'
+import { renderSonarReport, sonarReportPath } from './lib/sonar-report.js'
+
+test('project scan roots mirror Maven backend scope without including the Vue app', () => {
+  const roots = ['fp-bussiness', 'fp-ruoyi', 'fp-ruoyi-spring-boot', 'pom.xml']
+  assert.equal(validAuditIncludePaths(roots), true)
+  assert.equal(isIncludedAuditPath('fp-bussiness/src/main/java/A.java', roots), true)
+  assert.equal(isIncludedAuditPath('fp-ruoyi-ui/src/views/auth.vue', roots), false)
+  assert.equal(validAuditIncludePaths(['../outside']), false)
+  assert.equal(validAuditIncludePaths(['C:/outside']), false)
+})
+
+test('one review gets a credential-free Markdown report path and issue details', () => {
+  const audit = { analysis_id: 'abc12345-0000', checked_at: '2026-10-03T10:11:12.000Z',
+    target: 'qdm_gw_chemical_260930', gate: 'ERROR', findings: [{key:'x',rule:'java:S103',
+      severity:'MAJOR',file:'A.java',line:12,message:'Line too long'}], blocking:[{key:'x'}],
+    scanned_files:['A.java'],uncovered_files:[] }
+  const path = sonarReportPath('QMS-1', audit)
+  assert.match(path, /^\.dsh\/reviews\/QMS-1\/2026-/)
+  const report = renderSonarReport('QMS-1', {source:'ide-local',project_key:'project',include_paths:['fp-bussiness']}, audit)
+  assert.match(report, /java:S103/)
+  assert.match(report, /A.java:12/)
+  assert.equal(report.includes('token-secret'),false)
+})
+
 test('unsupported files block only when the project has active rules for their language', () => {
-  const paths = ['migration.sql', 'settings.json', 'script.py']
-  const profiles = [
-    { language: 'java', activeRuleCount: 66 },
-    { language: 'json', activeRuleCount: 0 },
-    { language: 'py', activeRuleCount: 3 },
-  ]
-  assert.deepEqual(uncoveredLocalFiles(paths, profiles), ['script.py'])
-  assert.deepEqual(uncoveredLocalFiles(paths, [...profiles, { language: 'plsql', activeRuleCount: 5 }]),
-    ['migration.sql', 'script.py'])
+  const paths = ['migration.sql', 'settings.json', 'script.py']
+  const profiles = [
+    { language: 'java', activeRuleCount: 66 },
+    { language: 'json', activeRuleCount: 0 },
+    { language: 'py', activeRuleCount: 3 },
+  ]
+  assert.deepEqual(uncoveredLocalFiles(paths, profiles), ['script.py'])
+  assert.deepEqual(uncoveredLocalFiles(paths, [...profiles, { language: 'plsql', activeRuleCount: 5 }]),
+    ['migration.sql', 'script.py'])
 })
 
-test('local Sonar audit considers Git new code but excludes generated DSH records', async () => {
-  const root = mkdtempSync(join(tmpdir(), 'dsh-sonarlint-diff-test-'))
-  const git = (...args) => execFileSync('git', args, { cwd: root, stdio: 'pipe' })
-  try {
-    git('init', '--quiet')
-    writeFileSync(join(root, 'Sample.java'), 'class Sample {}\n')
-    git('add', 'Sample.java')
-    git('-c', 'user.name=Test', '-c', 'user.email=test@example.invalid', 'commit', '--quiet', '-m', 'baseline')
-    writeFileSync(join(root, 'Sample.java'), 'class Sample {}\n// new code\n')
-    writeFileSync(join(root, 'change.sql'), 'SELECT 1;\n')
-    mkdirSync(join(root, '.dsh'))
-    writeFileSync(join(root, '.dsh', 'task.json'), '{"generated":true}\n')
-    const changed = await changedLines(root, 'HEAD')
-    assert.deepEqual(changed.map(file => file.path).sort(), ['Sample.java', 'change.sql'])
-    assert.deepEqual([...changed.find(file => file.path === 'Sample.java').lines], [2])
-    assert.equal(changed.find(file => file.path === 'change.sql').newFile, true)
-    assert.deepEqual((await changedLines(root, 'HEAD', ['Sample.java'])).map(file => file.path), ['Sample.java'])
-  } finally {
-    rmSync(root, { recursive: true, force: true })
-  }
+test('local audit detects changed backend files omitted from the task scope', () => {
+  assert.deepEqual(missingLocalAuditScope(['fp-bussiness/A.java', 'fp-bussiness/B.java'],
+    ['fp-bussiness/A.java', 'fp-ruoyi-ui/view.vue']), ['fp-bussiness/B.java'])
+  assert.deepEqual(missingLocalAuditScope(['fp-bussiness/A.java'], ['./FP-BUSSINESS\\A.java']), [])
 })
+
+test('local Sonar audit considers Git new code but excludes generated DSH records', async () => {
+  const root = mkdtempSync(join(tmpdir(), 'dsh-sonarlint-diff-test-'))
+  const git = (...args) => execFileSync('git', args, { cwd: root, stdio: 'pipe' })
+  try {
+    git('init', '--quiet')
+    writeFileSync(join(root, 'Sample.java'), 'class Sample {}\n')
+    git('add', 'Sample.java')
+    git('-c', 'user.name=Test', '-c', 'user.email=test@example.invalid', 'commit', '--quiet', '-m', 'baseline')
+    writeFileSync(join(root, 'Sample.java'), 'class Sample {}\n// new code\n')
+    writeFileSync(join(root, 'change.sql'), 'SELECT 1;\n')
+    mkdirSync(join(root, '.dsh'))
+    writeFileSync(join(root, '.dsh', 'task.json'), '{"generated":true}\n')
+    const changed = await changedLines(root, 'HEAD')
+    assert.deepEqual(changed.map(file => file.path).sort(), ['Sample.java', 'change.sql'])
+    assert.deepEqual([...changed.find(file => file.path === 'Sample.java').lines], [2])
+    assert.equal(changed.find(file => file.path === 'change.sql').newFile, true)
+    assert.deepEqual((await changedLines(root, 'HEAD', ['Sample.java'])).map(file => file.path), ['Sample.java'])
+  } finally {
+    rmSync(root, { recursive: true, force: true })
+  }
+})

package/.workflow-test.mjs

@@ -4,7 +4,7 @@ import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join, resolve, sep } from 'node:path'
 import { registerDevTask } from './lib/dev-task.js'
-import { newTask, validateWorkflow } from './lib/engine.js'
+import { newTask, validateWorkflow, verificationBlockers } from './lib/engine.js'
 import { adoptRecommendation, resolveFlow, retainStageBindings } from './lib/workflows.js'
 import Controller from './lib/controller.js'
 import { registerShippedSkills } from './lib/shipped-skills.js'
@@ -71,10 +71,10 @@ function fixture(stage = '开发', extra = {}, services = {}) {
   const ctx = { fs, tools: { register(tool) { execute = tool.execute; return () => {} } }, get(name) {
     if (Object.hasOwn(services, name)) return services[name]
     if (name === 'sandboxPolicy') return { resolve(request) { assert.equal(request.session, session); return policy } }
-    if (name === 'shell') return { resolve(request) { runs.push(request); return request }, async execute(request) {
-      const fail = request.command === 'fail'
-      const outcome = { exitCode: fail ? 1 : 0, timedOut: false, aborted: false, sandbox: { mode: 'workspace-write', denied: false }, stdout: { text: request.command.startsWith('git -c core.quotepath=false log') ? 'abcdef1234567890\n【LIVE-1】【TASK】done\n\napp.js\n' : 'checks passed' }, stderr: { text: '' } }
-      return { result: async () => outcome }
+    if (name === 'shell') return { resolve(request) { runs.push(request); return request }, async execute(request) {
+      const fail = request.command === 'fail'
+      const outcome = { exitCode: fail ? 1 : 0, timedOut: false, aborted: false, sandbox: { mode: 'workspace-write', denied: false }, stdout: { text: request.command.startsWith('git -c core.quotepath=false log') ? 'abcdef1234567890\n【LIVE-1】【TASK】done\n\napp.js\n' : 'checks passed' }, stderr: { text: '' } }
+      return { result: async () => outcome }
     } }
     return undefined
   } }
@@ -194,7 +194,7 @@ test('审查通过后更新状态并激活下一项，保留已完成项的审
   await assert.rejects(f.call({ operation: 'items', items: [{ id: 'A', title: 'x' }, { id: 'A', title: 'y' }] }), /unique/)
 })
 
-test('追加修复项可按 id 保留旧标题，拒绝已完成项改名后静默丢审核', async () => {
+test('追加修复项可按 id 保留旧标题，拒绝已完成项改名后静默丢审核', async () => {
   const f = fixture()
   await f.call({ operation: 'items', items: [{ id: 'A', title: 'reviewed models', status: 'doing' }] })
   await f.call({ operation: 'review_item', item_id: 'A', spec_outcome: 'pass', quality_outcome: 'pass' })
@@ -204,23 +204,53 @@ test('追加修复项可按 id 保留旧标题，拒绝已完成项改名后静
   await assert.rejects(f.call({ operation: 'items', items: [{ id: 'A', title: 'rewritten summary', status: 'done' }, { id: 'B', status: 'doing' }] }), /omit title|reopen/)
   assert.equal(f.state().items[0].review.quality.outcome, 'pass')
   assert.equal(f.state().items.length, 2)
-  await assert.rejects(f.call({ operation: 'items', items: [{ id: 'NEW' }] }), /title/)
-})
-
-test('重排实施项时不静默丢弃已完成项和审查记录', async () => {
-  const f = fixture()
-  await f.call({ operation: 'items', items: [
-    { id: 'I1', title: 'models', status: 'doing' },
-    { id: 'I2', title: 'mapper', status: 'todo' },
-  ] })
-  await f.call({ operation: 'dispatch', item_id: 'I1', description: 'direct implementation' })
-  await f.call({ operation: 'review_item', item_id: 'I1', spec_outcome: 'pass', quality_outcome: 'pass' })
-  await f.call({ operation: 'items', items: [{ id: 'I1', status: 'done' }, { id: 'I2' }] })
+  await assert.rejects(f.call({ operation: 'items', items: [{ id: 'NEW' }] }), /title/)
+})
+
+test('重排实施项时不静默丢弃已完成项和审查记录', async () => {
+  const f = fixture()
+  await f.call({ operation: 'items', items: [
+    { id: 'I1', title: 'models', status: 'doing' },
+    { id: 'I2', title: 'mapper', status: 'todo' },
+  ] })
+  await f.call({ operation: 'dispatch', item_id: 'I1', description: 'direct implementation' })
+  await f.call({ operation: 'review_item', item_id: 'I1', spec_outcome: 'pass', quality_outcome: 'pass' })
+  await f.call({ operation: 'items', items: [{ id: 'I1', status: 'done' }, { id: 'I2' }] })
   await f.call({ operation: 'items', items: [{ id: 'I3', title: 'service', status: 'todo' }] })
+  assert.deepEqual(f.state().items.map(item => item.id), ['I1', 'I2', 'I3'])
+  assert.equal(f.state().items[0].status, 'done')
+  assert.equal(f.state().items[0].review.quality.outcome, 'pass')
+  assert.equal(f.state().items[0].dispatch.description, 'direct implementation')
+  await f.call({ operation: 'items', items_mode: 'replace', items: [{ id: 'I3', title: 'service', status: 'todo' }] })
   assert.deepEqual(f.state().items.map(item => item.id), ['I3', 'I1'])
-  assert.equal(f.state().items[1].status, 'done')
-  assert.equal(f.state().items[1].review.quality.outcome, 'pass')
-  assert.equal(f.state().items[1].dispatch.description, 'direct implementation')
+})
+
+test('Maven verify rejects zero or missing Surefire tests even when the command exits zero', async () => {
+  let output = 'Tests run: 0, Failures: 0, Errors: 0, Skipped: 0'
+  const shell = { resolve: request => request, execute: async () => ({ result: async () => ({
+    exitCode: 0, timedOut: false, aborted: false, stdout: { text: output }, stderr: { text: '' },
+  }) }) }
+  const f = fixture('交付', {}, { shell })
+  await f.call({ operation: 'verify', command: 'mvn -q test' })
+  assert.equal(f.state().verification.passed, false)
+  assert.equal(f.state().verification.receipt.test_summary.count, 0)
+  output = 'BUILD SUCCESS'
+  await f.call({ operation: 'verify', command: 'mvn -q test' })
+  assert.equal(f.state().verification.passed, false)
+  assert.equal(f.state().verification.receipt.test_summary.count, null)
+  output = 'Tests run: 23, Failures: 0, Errors: 0, Skipped: 0'
+  await f.call({ operation: 'verify', command: 'mvn test' })
+  assert.equal(f.state().verification.passed, true)
+  assert.equal(f.state().verification.receipt.test_summary.count, 23)
+})
+
+test('a previously stored Maven zero-test pass is blocked by current workflow gates', () => {
+  const f = fixture('代码审核')
+  const state = f.state()
+  state.verification = { passed: true, evidence: [], receipt: { command: 'mvn test', exit_code: 0,
+    timed_out: false, aborted: false, started_at: 'now', finished_at: 'now',
+    stdout: 'Tests run: 0, Failures: 0, Errors: 0, Skipped: 0', stderr: '' } }
+  assert.match(verificationBlockers(state, state.flow.config).join(' '), /no nonzero Surefire/)
 })
 
 test('派发立即反映进行中，重派不复用旧审核且保持单一进行项', async () => {