@gonrocca/nodd 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Gonzalo Rocca
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,350 @@
+# NODD
+
+**N**on-negotiable **O**rganic **D**riven **D**evelopment — the ODD protocol as
+runtime mechanism for pi instead of injected prose: blocking gates fed by real
+tool events, evidence read from observed tool results, and promotion of NODD
+artifacts into `/forge` artifacts.
+
+ODD's failure was promising compliance while shipping delivery. This file is
+where NODD refuses to repeat it: everything below states what is mechanized,
+what is only advice, and what is not carried at all.
+
+`test/readme-contract.test.ts` holds part of that line mechanically: it fails if
+the README names a gate, a module or a command that does not exist, drops a
+canonical step, quotes a matrix total that disagrees with the matrix, or lets
+the bash, enforcement-scope, resume and kill-switch sections stop stating their
+limits. It does **not** parse English: a newly written sentence promising more
+than the code does will not turn it red. Prose added next to a fix is therefore
+the known way this document can drift ahead of the product, and the defence is
+review, not the suite. Round 3 found three such sentences and closed them.
+
+## The seven canonical steps
+
+`authorize` → `explore` → `resolve-uncertainty` → `classify` → `track` →
+`implement` → `close`.
+
+Four of them — `authorize`, `classify`, `track` and `close` — are **mechanism
+steps**: they run no model and cannot be assigned one. `/nodd-models` shows them
+as `mecanismo · sin modelo` and refuses an assignment. The other three are the
+steps where a model actually does work.
+
+## The gates
+
+| gate | fires on | refuses when |
+| --- | --- | --- |
+| `gate-authorize` | writes, mutating bash, delegation | intent was declared `read-only` |
+| `gate-classify` | the first write | nothing was declared at all |
+| `gate-track` | the first source write on a `tracked`/`forge` route | no feature doc exists yet |
+| `gate-delegate` | writes and mutating bash | the mapping, writer or long-session threshold fired and nothing was delegated |
+| `gate-evidence` | checking a task off | the declared runner was not observed succeeding after the task's last write |
+| `gate-promotion` | writes | the work diverged from what was declared |
+
+Every refusal names what was observed, the action that unblocks it, and a
+one-shot `/nodd-allow <gate>` escape hatch. A gate that blocks without naming
+the exit is a dead end, so `src/gates/policy.ts` makes the remedy a required
+field rather than an encouraged one.
+
+## The bash gate
+
+`write` and `edit` are typed tool calls, so NODD gates them exactly. A bash call
+arrives as a command *string* — pi's `tool_call` event carries no model of what
+the shell will touch — so bash is gated by a denylist of mutation patterns.
+
+A denylist is a partial mechanism. What it covers and what it does not are
+published together, here, and both lists are generated from the classifier's own
+pattern set (`src/bash-classifier.ts`) and asserted against by
+`src/bash-classifier.test.ts`, so the table and the code cannot drift apart.
+
+### Covered
+
+| pattern | example |
+| --- | --- |
+| output redirection (`>`, `>>`), excluding fd-only forms like `2>&1` | `echo hi > f.txt` |
+| `tee` | `ls \| tee out.txt` |
+| in-place editors (`sed -i`, `perl -i`) | `sed -i 's/a/b/' f.ts` |
+| movers and removers (`mv`, `cp`, `rm`, `rmdir`, `ln`, `install`, `dd`, `truncate`, `touch`, `mkdir`) | `rm -rf build` |
+| permission changes (`chmod`, `chown`) | `chmod +x run.sh` |
+| `patch` | `patch -p1 < fix.diff` |
+| mutating `git` subcommands (`apply`, `checkout`, `restore`, `reset`, `commit`, `stash`, `clean`, `mv`, `rm`) | `git commit -m 'x'` |
+| package installers (`npm`/`pnpm`/`yarn`/`pip`/`cargo` install or add) | `npm install lodash` |
+| inline interpreters (`node -e`, `python -c`) | `node -e "require('fs').writeFileSync('f','x')"` |
+
+### Not covered
+
+These mutation vectors reach the filesystem without this classifier noticing:
+
+- a script or build target that writes: `./build.sh`, `make`, `npm run build`
+- compilers, formatters and codegen writing as a side effect
+- redirection hidden behind a variable or `eval`
+- a pre-existing background process
+- writes performed by other extensions' or MCP tools
+- writes performed outside pi entirely
+- a delegated child launched with its own `extensions:` list, which pi-subagents starts with `--no-extensions`
+
+A partial gate that says which half it holds is worth more than a total one that
+is not.
+
+## Enforcement scope
+
+**Where NODD's gates run:** in the process that loaded them, and in delegated
+pi-subagent children. This was measured, not assumed
+(`spike/subagent-enforcement/RESULT.md`, pi 0.84.2, 2026-09-19): when NODD is
+installed as a pi package — the documented install path — a child process
+launched by pi-subagents performs its own ambient extension discovery, finds
+NODD, and the child's `write` was blocked by the child's own copy of the gate.
+Enforcement scope is therefore "parent and delegated children".
+
+Children also inherit the parent's working directory, so they read and write the
+same `.nodd/<slug>/` artifacts. `gate-track` transfers through the file, not
+merely per call.
+
+**Four vectors this does not cover:**
+
+1. **An agent definition with its own `extensions:` list.** That sets
+   `disableAmbientExtensions` and pi-subagents launches the child with
+   `--no-extensions`; NODD is absent from that child unless listed explicitly.
+   An agent file NODD did not author can opt out of NODD. NODD's own generated
+   agents deliberately declare no `extensions:` line, and a test enforces it.
+2. **A capability ceiling with `denyExtensions`** has the same effect.
+3. **Grandchildren were never probed.** Only depth 1 was measured. Nothing here
+   claims anything about a child's child.
+4. **Session state is not shared.** Each process folds its own observations; a
+   child does not see the parent's in-memory counters.
+
+Also: this is a behaviour of how pi-subagents builds the child's argv, not a
+documented API guarantee. It can change on upgrade.
+
+### Counters are per-process, and there is no session total
+
+This is the correct semantics rather than a gap, but it must be stated plainly.
+The mapping, writer and long-session triggers exist to keep *one process's
+context* thin enough to orchestrate. A child runs in its own process with its
+own context window, so a child that reads four files has filled *its* context,
+not the parent's — and it is the child that should then delegate.
+
+What does not exist is an **aggregate whole-session total across parent and
+children**. NODD does not claim one. What it has is a per-process count plus a
+shared on-disk artifact.
+
+### What actually satisfies a checkoff
+
+An observed exit-0 is not enough. `gate-evidence` requires four facts to line
+up, because a green command proves something only about *which* command ran and
+*when*:
+
+1. **A success**, parsed from the observed tool result (`src/outcome.ts`).
+2. **The declared runner.** `nodd_declare` records a `runner` into the feature
+   doc's `## Verification` section, and only runs of that command count.
+   `npm test -- one.test.ts` counts; `echo "all tests pass"` does not, and
+   neither does any other command that merely mentions the runner. A pinned
+   runner cannot be re-pinned: re-declaring with a different one is refused, so
+   a refused checkoff cannot be repaired by renaming the check to whatever did
+   pass.
+3. **After the task's last write.** A run observed before the edit it supposedly
+   verifies proves nothing about the edit. Ordering uses the kernel's
+   observation sequence rather than the wall clock, because a write and the run
+   after it routinely land in the same millisecond.
+4. **A RED first, under strict TDD**, when the declaration set `tdd: strict`.
+   `tdd: strict` without a runner is refused at declaration, because a RED run
+   is a failing run *of the declared runner*: accepting it would write
+   `- tdd: strict` into the document while checking nothing. Strict is pinned
+   the same way the runner is: once set, re-declaring without it is refused, so
+   the discipline cannot be dropped after the work by leaving one field out.
+
+The honest limit: **the model still chooses the runner.** NODD cannot know what
+the right check for your project is. What it enforces is that the choice is made
+up front, in a durable artifact, before the work — so the command the work is
+judged by cannot be invented afterwards to fit whatever happened to pass.
+
+Declaring no runner at all is still allowed, and then fact 2 cannot be checked.
+It is skipped rather than faked, and the evidence line itself discloses it:
+`observed: <cmd> → success (runner not pinned)`. That caveat appears only on
+an unpinned checkoff, so a reader auditing the artifact can tell a run certified
+by the declared runner from one certified by whatever exited 0. What NODD does
+**not** do on that path is refuse: with nothing pinned there is nothing to
+compare against, so an unpinned feature buys disclosure, not enforcement.
+
+### Resume: prior evidence comes back as `unverified`
+
+When you resume a feature in a new session, the previous session's evidence is
+**not** enough to check a task off. The check has to be re-run.
+
+This is expected behaviour, and the reason is one line: evidence means "observed
+by the kernel", and a fresh process has observed nothing yet. It is fail-closed
+on purpose. You will meet it as friction; it is not a bug.
+
+Two outcomes that look similar and are not:
+
+- **`unverified`** — NODD has no observation of this command in this process.
+  Nothing contradicts it; it simply was not seen here.
+- **`mismatch`** — NODD *does* have an observation and it contradicts what the
+  ledger claims. That is a different and more serious failure, and it reads
+  differently in the refusal.
+
+The evidence ledger is distinct from the feature document. Editing the ledger
+from outside degrades its entries rather than being silently accepted, and a
+degraded entry counts as no evidence at all.
+
+## Command outcomes
+
+A command's outcome is parsed from the observed tool result
+(`src/outcome.ts`), from the last non-empty line only — a runner that prints
+"Command exited with code 0" in its own stdout must not thereby rewrite its own
+verdict.
+
+| outcome | meaning | satisfies evidence |
+| --- | --- | --- |
+| `success` | the tool reported no error | **yes** |
+| `exit <code>` | the command exited non-zero | no |
+| `aborted` | the command was aborted | no |
+| `timeout <n>s` | the command timed out | no |
+| `unknown` | the result could not be parsed | **no — fail closed** |
+
+`unknown` not counting is the whole rule. An unparseable result is an
+unobserved result, and treating it as success is exactly how a protocol starts
+certifying work nobody checked.
+
+## Flags, the kill switch and the escape hatch
+
+| control | effect |
+| --- | --- |
+| `--nodd-off=<gate>` | turns that gate off for the session |
+| `--nodd-off=all` | turns every gate off |
+| `gates.<id>.enabled: false` in `~/.pi/nodd.json` | turns that gate off persistently |
+| `/nodd-allow <gate>` | one-shot override for the next call only |
+| `/nodd-gates status` | read-only: effective mode and deciding source per gate |
+
+The semantics are inherited verbatim from ODD's own kill switch:
+
+- **Off means off, entirely.** When you ask NODD to stop, it stops. It does not
+  argue, does not work around it, does not propose an alternative first, and
+  does not re-enable itself later.
+- **Off is not a fault to diagnose.** A disabled gate is a user decision, not a
+  broken state, and nothing in the prompt suggests turning it back on.
+- **A disabled gate reports `disabled`, never a fabricated approval.** With
+  `gates.evidence` off, a task records `observed: none (gate disabled)` — never
+  a claim that something was verified.
+- `status` reports the deciding source; `default` means nobody chose.
+
+Turning off `track` is also the documented way to hand-edit a feature document.
+
+## Deliberate divergence from ODD
+
+ODD selects the SDD route by predicted magnitude (`routing.go:68`: file count,
+changed lines, size, perceived risk). **NODD diverges here deliberately.**
+`gate-promotion` reads no size, no line count and no risk score. Its triggers
+are observables only, and there are exactly two: two consecutive non-success
+outcomes of the runner the task declared, and a task writing more distinct
+files than it declared.
+
+A third trigger, "the user asked", was specified and removed. `/nodd-promote`
+performs the promotion itself and holds no kernel state, so no gate can observe
+the asking and still have something useful to do about it — blocking a write to
+suggest the command you just ran is circular. It shipped once as a hardcoded
+`false`, which is precisely the overclaim this gate exists to prevent, so it is
+gone from the type and the docs rather than left looking operational.
+
+A big task that succeeds is not divergent. A three-line task that fails twice
+is. A source-scan test rejects every size-flavoured identifier in the promotion
+path, so this divergence cannot quietly decay back into a threshold.
+
+The ~400-line figure survives only as **advice** (see the matrix below), never
+as a gate.
+
+## The M/P/F parity matrix
+
+Every clause of ODD's guidance surface is classified as exactly one of:
+
+- **(M)** mechanized — a gate or module enforces it;
+- **(P)** forwarded prose — kept as injected text, with a stated reason why it
+  cannot be mechanized;
+- **(F)** out of scope — not carried, with a stated reason.
+
+The full row-by-row matrix lives in `.sdd/nodd/requirements.md` under
+`REQ: odd-parity-matrix`. Its `(P)` rows are implemented as data in
+`src/odd-prose.ts` — one entry per row, tagged with the canonical step it
+belongs to — and a test asserts the two stay in correspondence.
+
+**A `(P)` reason may never be "we did not get to it."** A clause with no stated
+obstacle is a mechanism someone skipped, and a test rejects that wording.
+
+The two most load-bearing `(P)` clauses:
+
+- **The preparation trigger** (`routing.go:81`). Reading that prepares a write
+  should be delegated too — but intent-to-write is not visible in a read event.
+  NODD ships no `prepare` gate, and a test asserts no gate id contains `prepar`:
+  a mechanism here would have to guess intent, and a gate that guesses is worse
+  than prose that admits it.
+- **The ~400-line advisory** (`routing.go:95`), with its full anti-gaming
+  sentence. A line count measures typing, not correctness. Mechanizing it would
+  make the number an objective to optimize against — which is exactly what the
+  clause forbids. A test asserts no gate consults a line count.
+
+### Not carried from ODD
+
+| clause | why not |
+| --- | --- |
+| Engram/Cortex memory mirror | out of scope by decision; NODD's durable truth is `.nodd/<slug>/` on disk |
+| `gentle-ai review assess` tiers, consent ceremony, preflight STATUS | depends on the `gentle-ai` binary, which is deliberately not copied. A test asserts no code path invokes it. NODD's analogue is forge's `veredicto` phase |
+| push / PR creation / merge | these remain the user's decisions. No gate and no tool in NODD pushes, opens a PR or merges, and a test asserts no code path runs them |
+
+## The prompt budget
+
+NODD injects two blocks per turn: block A (the session state) and block B (the
+forwarded prose for the current step only). They are capped at **1500** and
+**2500** characters. The budget is asserted against the *corpus* — the text
+before any truncation — so adding a clause that does not fit turns the test red
+instead of silently pushing an existing clause out. If a block does overflow at
+runtime it is cut, and the cut announces itself inside the block and in the
+rendered result's `overBudget` list, never silently.
+
+The cap is the mechanism. gentle's guidance surface reached 105,993 bytes one
+individually-defensible clause at a time: no single addition was wrong, the sum
+was. Adding a clause that does not fit is therefore a decision to shorten
+another one — the conversation that never happened in gentle.
+
+Turning every gate off collapses block A to a single line, but block B still
+forwards the step's prose. Turning enforcement off is not a request to stop
+being useful.
+
+## Commands
+
+| command | does |
+| --- | --- |
+| `/nodd-gates [status\|on\|off] [<gate>]` | inspect and set gate flags |
+| `/nodd-allow <gate>` | grant a one-shot override |
+| `/nodd-models [<slot>=<provider>/<model>\|profile …]` | assign models per slot; no argument opens the picker |
+| `/nodd-promote <slug>` | hand a feature to `/forge` |
+
+`/nodd-promote` writes exactly one file, `.sdd/<slug>/requirements.md`, and
+deliberately emits no `design.md` and no `tasks.md` so forge's resume lands on
+`no-plan` and restarts at its plan phase. It refuses to overwrite an existing
+`requirements.md`, and it is the only module in the package permitted to write
+under `.sdd/` — a test scans every other source file to keep it that way.
+
+Forge is an optional dependency. When it is absent, the artifact is still
+written and the exact command to run by hand is reported.
+
+## Known limitations
+
+These are open, not fixed. They are here because a declared problem is a result
+and a hidden one makes everything above worthless.
+
+- **An unpinned feature is not enforced, only disclosed.** `runner` is optional
+  at declaration. Omit it and fact 2 cannot be checked, so any observed exit-0
+  after the write can check a task off. The evidence line says
+  `success (runner not pinned)` so the artifact never passes it off as a
+  certified run, but the checkoff does happen. Pin a runner to get enforcement.
+- **`isDeclaredRunner` matches whole tokens by prefix, so a flag that redirects
+  the working directory passes.** `npm test --prefix /tmp` is accepted as a run
+  of `npm test`; the gate cannot tell a flag that narrows scope from one that
+  moves it elsewhere. It requires the model to pin a runner and then invoke it
+  with a redirecting flag.
+- **`readLedger` reports defects that no production caller reads.** A corrupt
+  ledger is treated as empty, which is fail-closed for evidence (nothing to
+  support a checkoff) but the corruption itself is not surfaced to the user.
+- **No test parses the English in this file.** See the note at the top: the
+  README contract checks names, sections and totals, not whether a sentence
+  promises more than the code delivers.
+- **Enforcement in grandchildren was never measured.** Only depth 1 was probed;
+  see *Enforcement scope*.

package/extensions/nodd-agents.test.ts

@@ -0,0 +1,129 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { existsSync, mkdtempSync, readFileSync, readdirSync, chmodSync, mkdirSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { ANTI_GAMING, NODD_AGENTS, agentsDir, buildAgentFile, provisionAgents } from "./nodd-agents.ts";
+
+function tmp(): string {
+  return mkdtempSync(join(tmpdir(), "nodd-agents-"));
+}
+
+// ---------------------------------------------------------------------------
+// Paths: the nodd namespace, never forge's.
+// ---------------------------------------------------------------------------
+test("agent files land under agents/nodd/ and never under agents/zero/", () => {
+  const dir = agentsDir("/home/someone");
+  assert.equal(dir, "/home/someone/.pi/agent/agents/nodd");
+  assert.ok(!dir.includes("agents/zero"), "NODD must never write into forge's agent namespace");
+});
+
+test("the three model-backed steps get an agent, the four mechanisms do not", () => {
+  assert.deepEqual(NODD_AGENTS.map((agent) => agent.slot), ["explore", "resolve-uncertainty", "implement"]);
+  for (const mechanism of ["authorize", "classify", "track", "close"]) {
+    assert.ok(!NODD_AGENTS.some((agent) => agent.slot === mechanism), `${mechanism} runs no model`);
+  }
+});
+
+// ---------------------------------------------------------------------------
+// The renderer is pure and its output is pinned.
+// ---------------------------------------------------------------------------
+test("the renderer matches an expected frontmatter and body exactly", () => {
+  const rendered = buildAgentFile(NODD_AGENTS[2], "anthropic/claude-opus-4-1");
+  const [, frontmatter] = rendered.split("---\n");
+
+  assert.ok(rendered.startsWith("---\n"), "the file opens with frontmatter");
+  assert.match(frontmatter, /^name: nodd-implement$/m);
+  assert.match(frontmatter, /^model: anthropic\/claude-opus-4-1$/m);
+  assert.match(frontmatter, /^tools: /m);
+  assert.match(frontmatter, /^systemPromptMode: replace$/m);
+  assert.ok(rendered.endsWith("\n"));
+});
+
+test("a slot with no configured model falls back to default, then omits the line", () => {
+  const withDefault = buildAgentFile(NODD_AGENTS[0], "anthropic/fallback");
+  assert.match(withDefault, /^model: anthropic\/fallback$/m);
+
+  const withNone = buildAgentFile(NODD_AGENTS[0], undefined);
+  assert.ok(!/^model:/m.test(withNone), "no model line rather than an empty one pi cannot resolve");
+  assert.match(withNone, /^name: nodd-explore$/m);
+});
+
+test("the frontmatter declares no extensions list of its own", () => {
+  // An agent definition with `extensions:` makes pi-subagents launch the child
+  // with --no-extensions, which would strip NODD out of its own sub-agent
+  // (spike RESULT.md, uncovered vector 1). NODD must not do that to itself.
+  for (const agent of NODD_AGENTS) {
+    const rendered = buildAgentFile(agent, "anthropic/x");
+    assert.ok(!/^extensions:/m.test(rendered), `${agent.slot} must not declare its own extensions list`);
+  }
+});
+
+// ---------------------------------------------------------------------------
+// The advisory travels into every generated body.
+// ---------------------------------------------------------------------------
+test("every generated body carries the advisory-only line heuristic and its anti-gaming sentence", () => {
+  for (const agent of NODD_AGENTS) {
+    const body = buildAgentFile(agent, "anthropic/x");
+    assert.match(body, /400/, `${agent.slot} must carry the line figure`);
+    assert.match(body, /advisory|orientativ/i, `${agent.slot} must mark it advisory`);
+    assert.ok(body.includes(ANTI_GAMING), `${agent.slot} must carry the anti-gaming sentence verbatim`);
+  }
+});
+
+test("the anti-gaming sentence names all the things it forbids", () => {
+  for (const forbidden of ["blank lines", "comments", "minify", "tests", "split"]) {
+    assert.ok(ANTI_GAMING.includes(forbidden), `the advisory must name ${forbidden}`);
+  }
+});
+
+test("the enforcement caveat from the spike travels with every agent", () => {
+  for (const agent of NODD_AGENTS) {
+    const body = buildAgentFile(agent, "anthropic/x");
+    assert.match(body, /gate/i, "the body states that NODD's gates apply here");
+  }
+});
+
+// ---------------------------------------------------------------------------
+// Provisioning: per-file failures are swallowed.
+// ---------------------------------------------------------------------------
+test("provisioning writes one file per agent, named nodd-<slot>.md", () => {
+  const home = tmp();
+  const result = provisionAgents(home, { models: { implement: "anthropic/claude-opus-4-1" } });
+
+  assert.equal(result.written.length, 3);
+  const files = readdirSync(agentsDir(home)).sort();
+  assert.deepEqual(files, ["nodd-explore.md", "nodd-implement.md", "nodd-resolve-uncertainty.md"]);
+  assert.match(readFileSync(join(agentsDir(home), "nodd-implement.md"), "utf8"), /^model: anthropic\/claude-opus-4-1$/m);
+});
+
+test("models come from nodd.json with the default slot as fallback", () => {
+  const home = tmp();
+  provisionAgents(home, { models: { default: "anthropic/fallback", implement: "anthropic/specific" } });
+
+  const dir = agentsDir(home);
+  assert.match(readFileSync(join(dir, "nodd-implement.md"), "utf8"), /^model: anthropic\/specific$/m);
+  assert.match(readFileSync(join(dir, "nodd-explore.md"), "utf8"), /^model: anthropic\/fallback$/m);
+});
+
+test("one failing write does not prevent the other two", () => {
+  const home = tmp();
+  const dir = agentsDir(home);
+  mkdirSync(dir, { recursive: true });
+  // Make one target unwritable by putting a read-only directory in its place.
+  mkdirSync(join(dir, "nodd-implement.md"));
+
+  const result = provisionAgents(home, {});
+  assert.equal(result.written.length, 2, "the other two are still written");
+  assert.equal(result.failed.length, 1);
+  assert.ok(result.failed[0].includes("implement"));
+  assert.ok(existsSync(join(dir, "nodd-explore.md")));
+  assert.ok(existsSync(join(dir, "nodd-resolve-uncertainty.md")));
+});
+
+test("provisioning never throws, whatever the config holds", () => {
+  const home = tmp();
+  for (const config of [{}, { models: null }, { models: { implement: 42 } }] as never[]) {
+    assert.doesNotThrow(() => provisionAgents(home, config));
+  }
+});