@gonrocca/nodd 0.1.0

package/src/gates/classify.test.ts

@@ -0,0 +1,54 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { emptyCommitted, fold } from "../state.ts";
+import { observation, pendingCall } from "../observations.ts";
+import { emptyPolicy } from "./policy.ts";
+import { classifyGate } from "./classify.ts";
+
+const write = { toolName: "write", input: { path: "src/a.ts" } };
+const noPending = new Map();
+
+test("an undeclared write is blocked with a nodd_declare remedy", () => {
+  const decision = classifyGate(emptyCommitted(), write, emptyPolicy(), noPending);
+  assert.equal(decision.allow, false);
+  assert.ok(decision.allow === false && decision.remedy.action.includes("nodd_declare"));
+  assert.ok(decision.allow === false && decision.reason.includes("classify"));
+});
+
+test("edit and mutating bash block the same way; non-mutating bash does not", () => {
+  const p = emptyPolicy();
+  assert.equal(classifyGate(emptyCommitted(), { toolName: "edit", input: { path: "a.ts" } }, p, noPending).allow, false);
+  assert.equal(classifyGate(emptyCommitted(), { toolName: "bash", input: { command: "rm -rf x" } }, p, noPending).allow, false);
+  assert.equal(classifyGate(emptyCommitted(), { toolName: "bash", input: { command: "npm test" } }, p, noPending).allow, true);
+  assert.equal(classifyGate(emptyCommitted(), { toolName: "read", input: { path: "a.ts" } }, p, noPending).allow, true);
+});
+
+test("a committed declaration allows the write", () => {
+  const committed = fold(emptyCommitted(), observation({
+    toolCallId: "d1", toolName: "nodd_declare",
+    input: { intent: "change", route: "inline", slug: "demo" },
+    isError: false, resultText: "", at: "t",
+  }));
+  assert.equal(classifyGate(committed, write, emptyPolicy(), noPending).allow, true);
+});
+
+// extensions.md:757-758 — siblings are preflighted sequentially and executed
+// concurrently, so a declaration in the same batch has not happened yet.
+test("a declaration seen only in pending does not unblock, and the reason cites the batch rule", () => {
+  const pending = new Map([["d1", pendingCall({
+    toolCallId: "d1", toolName: "nodd_declare",
+    input: { intent: "change", route: "tracked", slug: "demo" },
+  })]]);
+
+  const decision = classifyGate(emptyCommitted(), write, emptyPolicy(), pending);
+  assert.equal(decision.allow, false);
+  assert.ok(decision.allow === false && /same (assistant )?(message|batch)/i.test(decision.reason),
+    `the reason must cite the batch rule: ${decision.allow === false ? decision.reason : ""}`);
+  assert.ok(decision.allow === false && /next turn|reissue/i.test(decision.reason),
+    "the reason must say how to resolve it");
+});
+
+test("the flag off allows the undeclared write", () => {
+  const policy = { ...emptyPolicy(), config: { classify: { enabled: false } } };
+  assert.equal(classifyGate(emptyCommitted(), write, policy, noPending).allow, true);
+});

package/src/gates/classify.ts

@@ -0,0 +1,45 @@
+// gate-classify — no first write without a declared route.
+//
+// This is the gate aimed squarely at the hole gentle admits in its own task
+// file: "ODD routing is pure model judgment: nothing requires the route
+// decision to be stated, recorded, or checked, so non-delegation is invisible."
+//
+// NODD does not mechanize the *judgement* — whether work is "substantial" is
+// not observable from tool events, and pretending otherwise would be inventing
+// enforcement. It mechanizes the *declaration*: until a `nodd_declare` result
+// is committed, the first write does not happen. A skipped classification stops
+// being invisible, which is all a mechanism can honestly do here.
+
+import type { Committed } from "../state.ts";
+import type { PendingCall } from "../observations.ts";
+import { allow, refuse, resolveFlag, type GateDecision, type Policy } from "./policy.ts";
+import { isMutation, type GateRequest } from "./request.ts";
+
+export function classifyGate(
+  committed: Committed,
+  request: GateRequest,
+  policy: Policy,
+  pending: Map<string, PendingCall>,
+): GateDecision {
+  if (!resolveFlag("classify", policy).enabled) return allow();
+  if (committed.declaration) return allow();
+  if (!isMutation(request)) return allow();
+
+  // A declaration preflighted in this same batch has not run yet: pi does not
+  // guarantee sibling results are visible here, so treating it as done would be
+  // accepting evidence that does not exist. Say so, and say what to do.
+  const declaringSibling = [...pending.values()].some((call) => call.toolName === "nodd_declare");
+  if (declaringSibling) {
+    return refuse(
+      "classify",
+      "a `nodd_declare` call is in this same assistant message, but sibling results are not observable yet, so no route is recorded",
+      "let this batch finish, then reissue the write on the next turn",
+    );
+  }
+
+  return refuse(
+    "classify",
+    `no route has been declared for this session, and ${request.toolName} would be the first change`,
+    "call `nodd_declare` with an explicit intent and route (`inline`, `tracked` or `forge`)",
+  );
+}

package/src/gates/delegate.test.ts

@@ -0,0 +1,127 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { emptyCommitted, foldAll, type Committed } from "../state.ts";
+import { observation, pendingCall, type Observation } from "../observations.ts";
+import { THRESHOLDS } from "../manifest.ts";
+import { emptyPolicy } from "./policy.ts";
+import { delegateGate } from "./delegate.ts";
+
+let n = 0;
+function obs(toolName: string, input: Record<string, unknown>, isError = false): Observation {
+  return observation({ toolCallId: `c${++n}`, toolName, input, isError, resultText: "", at: "t" });
+}
+
+function reads(count: number): Committed {
+  n = 0;
+  return foldAll(emptyCommitted(), Array.from({ length: count }, (_, i) => obs("read", { path: `f${i}.ts` })));
+}
+
+const write = { toolName: "write", input: { path: "out.ts" } };
+const noPending = new Map();
+
+test("4 distinct reads with no delegation blocks, quoting count and threshold", () => {
+  const decision = delegateGate(reads(4), write, emptyPolicy(), noPending);
+  assert.equal(decision.allow, false);
+  assert.ok(decision.allow === false && decision.reason.includes("4"));
+  assert.ok(decision.allow === false && decision.reason.includes(String(THRESHOLDS.mappingMinUnderstandingFiles)));
+  assert.ok(decision.allow === false && decision.remedy.action.toLowerCase().includes("delegat"));
+});
+
+test("the mapping boundary is asserted at both 3 and 4", () => {
+  assert.equal(delegateGate(reads(3), write, emptyPolicy(), noPending).allow, true, "3 files stays inline");
+  assert.equal(delegateGate(reads(4), write, emptyPolicy(), noPending).allow, false, "4 files must delegate");
+});
+
+test("one file read six times does not trip the mapping trigger", () => {
+  n = 0;
+  const committed = foldAll(emptyCommitted(), Array.from({ length: 6 }, () => obs("read", { path: "same.ts" })));
+  assert.equal(delegateGate(committed, write, emptyPolicy(), noPending).allow, true);
+});
+
+test("a committed subagent result clears the block", () => {
+  n = 0;
+  const committed = foldAll(emptyCommitted(), [
+    ...Array.from({ length: 5 }, (_, i) => obs("read", { path: `f${i}.ts` })),
+    obs("subagent", { agent: "nodd-explore" }),
+  ]);
+  assert.equal(delegateGate(committed, write, emptyPolicy(), noPending).allow, true);
+});
+
+test("the writer trigger fires at 2 distinct written files", () => {
+  n = 0;
+  const one = foldAll(emptyCommitted(), [obs("write", { path: "a.ts" })]);
+  assert.equal(delegateGate(one, { toolName: "write", input: { path: "a.ts" } }, emptyPolicy(), noPending).allow, true,
+    "rewriting the same file is still one file");
+  assert.equal(delegateGate(one, { toolName: "write", input: { path: "b.ts" } }, emptyPolicy(), noPending).allow, false,
+    "a second distinct file crosses the writer threshold");
+});
+
+// Intent is known at preflight, so counting a sibling's write *intent* is
+// sound. Counting a sibling's *result* would not be, and is never done.
+test("same-batch pending write intent counts toward the writer trigger", () => {
+  n = 0;
+  const committed = foldAll(emptyCommitted(), [obs("write", { path: "a.ts" })]);
+  const pending = new Map([["p1", pendingCall({ toolCallId: "p1", toolName: "write", input: { path: "b.ts" } })]]);
+  assert.equal(delegateGate(committed, { toolName: "write", input: { path: "c.ts" } }, emptyPolicy(), pending).allow, false);
+});
+
+// routing.go:70 — tests, builds, installs and review actors may use fresh
+// workers without changing the route. They are not writer files, so they never
+// reach the mapping or writer trigger. The long-session backstop is a separate
+// clause (routing.go:82) and it counts every tool call, these included — see
+// the test below it.
+test("test, build and install commands never trip the mapping or writer trigger", () => {
+  n = 0;
+  const committed = foldAll(emptyCommitted(), [
+    obs("bash", { command: "npm test" }),
+    obs("bash", { command: "npm run build" }),
+    obs("bash", { command: "npm install" }),
+    obs("bash", { command: "git status" }),
+  ]);
+  assert.equal(delegateGate(committed, write, emptyPolicy(), noPending).allow, true);
+});
+
+// The claim "test/build/install never trip it" was covered by four commands,
+// which is under the backstop threshold, so the case that contradicts it was
+// never exercised. Run the declared runner past the threshold and the backstop
+// does fire — as ODD specifies. That is the behaviour; the requirement text now
+// says so.
+test("repeated runs of the declared runner do reach the long-session backstop", () => {
+  n = 0;
+  const committed = foldAll(
+    emptyCommitted(),
+    Array.from({ length: 25 }, () => obs("bash", { command: "npm test" })),
+  );
+  const decision = delegateGate(committed, write, emptyPolicy(), noPending);
+  assert.equal(decision.allow, false, "25 tool calls without delegating must reach the backstop");
+  // Asserting only `allow === false` let a combined mutation -- backstop off,
+  // writer threshold at 1 -- keep this green through the wrong trigger. The
+  // row is about the backstop, so the reason has to name it.
+  assert.match(
+    "reason" in decision ? decision.reason : "",
+    /25 tool calls/,
+    "the refusal must come from the backstop, not from another trigger firing by accident",
+  );
+});
+
+test("the long-session backstop fires at 20 tool calls with no delegation", () => {
+  n = 0;
+  const under = foldAll(emptyCommitted(), Array.from({ length: 19 }, () => obs("bash", { command: "git status" })));
+  assert.equal(under.toolCalls, 19);
+  assert.equal(delegateGate(under, write, emptyPolicy(), noPending).allow, true);
+
+  const at = foldAll(under, [obs("bash", { command: "git log" })]);
+  assert.equal(at.toolCalls, THRESHOLDS.longSessionToolCalls);
+  const decision = delegateGate(at, write, emptyPolicy(), noPending);
+  assert.equal(decision.allow, false);
+  assert.ok(decision.allow === false && decision.reason.includes("20"));
+});
+
+test("the flag off allows everything", () => {
+  const policy = { ...emptyPolicy(), config: { delegate: { enabled: false } } };
+  assert.equal(delegateGate(reads(40), write, policy, noPending).allow, true);
+});
+
+test("the gate only speaks on writes, not on reads", () => {
+  assert.equal(delegateGate(reads(10), { toolName: "read", input: { path: "z.ts" } }, emptyPolicy(), noPending).allow, true);
+});

package/src/gates/delegate.ts

@@ -0,0 +1,85 @@
+// gate-delegate — the clause ODD states and cannot enforce.
+//
+// ODD's non-delegation is invisible: the manifest triggers
+// (`manifest.go:203-216`) and the long-session backstop (`routing.go:82`) are
+// prose the model may simply not follow. Here they are counted from observed
+// tool results and the write is refused.
+//
+// Three triggers, in ODD's own numbers (`src/manifest.ts`):
+//   - mapping:      >= 4 distinct files read with no delegation yet
+//   - writer:       >= 2 distinct files written
+//   - long session: >= 20 tool calls with no delegation yet
+//
+// Distinct *files*, never call counts: reading one file six times is one file
+// in context, and a gate that could not tell those apart would fire on a
+// careful re-read of the same module.
+//
+// The counters are per process. That is the intended semantics, not a gap: the
+// triggers exist to keep *this* agent's context thin enough to orchestrate, and
+// a delegated child has its own context window. There is no aggregate
+// whole-session total across parent and children, and NODD does not claim one.
+
+import type { Committed } from "../state.ts";
+import type { PendingCall } from "../observations.ts";
+import { THRESHOLDS } from "../manifest.ts";
+import { classifyBash } from "../bash-classifier.ts";
+import { allow, refuse, resolveFlag, type GateDecision, type Policy } from "./policy.ts";
+import { isFileWrite, targetPath, type GateRequest } from "./request.ts";
+
+/**
+ * Files this session wrote, plus the ones it is about to. Write *intent* is
+ * known at preflight, so counting a sibling's intent is sound; a sibling's
+ * result is not observable yet and is never counted.
+ */
+function writtenFiles(committed: Committed, request: GateRequest, pending: Map<string, PendingCall>): Set<string> {
+  const files = new Set(committed.filesWritten.keys());
+  for (const call of pending.values()) {
+    if (isFileWrite(call)) {
+      const path = targetPath(call);
+      if (path) files.add(path);
+    }
+  }
+  const path = targetPath(request);
+  if (path) files.add(path);
+  return files;
+}
+
+export function delegateGate(
+  committed: Committed,
+  request: GateRequest,
+  policy: Policy,
+  pending: Map<string, PendingCall>,
+): GateDecision {
+  if (!resolveFlag("delegate", policy).enabled) return allow();
+  if (!isFileWrite(request) && classifyBash(String(request.input?.command ?? "")) !== "mutating") return allow();
+  if (committed.delegations > 0) return allow();
+
+  const remedy = "delegate the work with the `subagent` tool, or declare this as small inline work";
+
+  const written = writtenFiles(committed, request, pending);
+  if (written.size >= THRESHOLDS.writerMinNonTrivialFiles) {
+    return refuse(
+      "delegate",
+      `this session has written ${written.size} distinct files (threshold ${THRESHOLDS.writerMinNonTrivialFiles}) without delegating`,
+      remedy,
+    );
+  }
+
+  if (committed.filesRead.size >= THRESHOLDS.mappingMinUnderstandingFiles) {
+    return refuse(
+      "delegate",
+      `this session has read ${committed.filesRead.size} distinct files (threshold ${THRESHOLDS.mappingMinUnderstandingFiles}) without delegating`,
+      remedy,
+    );
+  }
+
+  if (committed.toolCalls >= THRESHOLDS.longSessionToolCalls) {
+    return refuse(
+      "delegate",
+      `this session has run ${committed.toolCalls} tool calls (threshold ${THRESHOLDS.longSessionToolCalls}) without delegating`,
+      remedy,
+    );
+  }
+
+  return allow();
+}

package/src/gates/evidence.test.ts

@@ -0,0 +1,281 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { emptyCommitted, fold, type Committed } from "../state.ts";
+import { observation } from "../observations.ts";
+import type { LedgerRecord } from "../ledger.ts";
+import { parseOutcome } from "../outcome.ts";
+import { emptyPolicy } from "./policy.ts";
+import { evidenceGate, renderObserved } from "./evidence.ts";
+
+function afterCommand(command: string, isError: boolean, resultText = "", id = "b1"): Committed {
+  return fold(emptyCommitted(), observation({
+    toolCallId: id, toolName: "bash", input: { command }, isError, resultText, at: "2026-09-19T10:05:00.000Z",
+  }));
+}
+
+/**
+ * The ledger the kernel would have written for these observations.
+ *
+ * The outcome must come from `parseOutcome`, exactly as `appendRecord`'s caller
+ * derives it. An earlier version of this helper wrote `unknown` for every error
+ * result, which is not what production records for a failing run — once the
+ * gate started comparing the ledger against the session, that invented value
+ * read as tampering. The fixture was wrong, not the check.
+ */
+function ledgerFor(committed: Committed): LedgerRecord[] {
+  return committed.commandResults.map((r) => ({
+    toolCallId: r.toolCallId,
+    tool: "bash",
+    command: r.command,
+    outcome: parseOutcome(r.isError, r.resultText),
+    at: r.at,
+  }));
+}
+
+const check = { task: "T1", lastWriteAt: "2026-09-19T10:00:00.000Z", runner: "npm test" };
+
+// ---------------------------------------------------------------------------
+// The mandated provenance test: the recorded value comes from the observed
+// tool result, never from the model saying so.
+// ---------------------------------------------------------------------------
+test("only a real successful tool_result satisfies a checkoff", () => {
+  const policy = emptyPolicy();
+
+  // (a) the model asserts "tests pass" and no command ever ran.
+  const claimed = fold(emptyCommitted(), observation({
+    toolCallId: "a1", toolName: "assistant_message",
+    input: { text: "I ran the tests and they pass. Evidence: all 42 tests pass." },
+    isError: false, resultText: "", at: "2026-09-19T10:05:00.000Z",
+  }));
+  const a = evidenceGate(claimed, [], check, policy);
+  assert.equal(a.allow, false, "a model claim is not evidence");
+  assert.ok(a.allow === false && /no command/i.test(a.reason));
+
+  // (b) a real command that really failed.
+  const failed = afterCommand("npm test", true, "FAIL 3 tests\nCommand exited with code 1");
+  const b = evidenceGate(failed, ledgerFor(failed), check, policy);
+  assert.equal(b.allow, false, "a failing result is not evidence");
+  assert.ok(b.allow === false && b.reason.includes("exit 1"), "the refusal quotes the real code");
+
+  // (c) a real command that really succeeded.
+  const passed = afterCommand("npm test", false, "42 passing");
+  const c = evidenceGate(passed, ledgerFor(passed), check, policy);
+  assert.equal(c.allow, true);
+  assert.equal(c.allow === true && c.observed.command, "npm test");
+  assert.equal(c.allow === true && c.observed.outcome, "success");
+});
+
+// The property the whole product sells, isolated: the model's prose is not an
+// input. Same real success, once with an assistant message asserting the
+// result and once without — the recorded evidence must be byte-identical.
+// Without this, the test above only proves "there was no evidence", which is a
+// weaker and different claim.
+test("an assistant message asserting the result changes nothing about what is recorded", () => {
+  const passed = afterCommand("npm test", false, "42 passing");
+  const withClaim = fold(passed, observation({
+    toolCallId: "a1", toolName: "assistant_message",
+    input: { text: "Tests pass. Evidence: 42/42 green, everything verified." },
+    isError: false, resultText: "", at: "2026-09-19T10:06:00.000Z",
+  }));
+
+  const silent = evidenceGate(passed, ledgerFor(passed), check, emptyPolicy());
+  const claiming = evidenceGate(withClaim, ledgerFor(withClaim), check, emptyPolicy());
+
+  assert.equal(silent.allow, true);
+  assert.equal(claiming.allow, true);
+  assert.deepEqual(
+    claiming.allow === true ? claiming.observed : null,
+    silent.allow === true ? silent.observed : null,
+    "the model's assertion must not alter the recorded evidence",
+  );
+  assert.equal(
+    renderObserved(claiming.allow === true ? claiming.observed : null),
+    renderObserved(silent.allow === true ? silent.observed : null),
+    "the rendered line must be byte-identical with and without the claim",
+  );
+});
+
+test("an empty ledger and no commands refuses", () => {
+  const decision = evidenceGate(emptyCommitted(), [], check, emptyPolicy());
+  assert.equal(decision.allow, false);
+  assert.ok(decision.allow === false && decision.remedy.action.length > 0);
+});
+
+test("aborted, timeout and unknown never satisfy a checkoff", () => {
+  for (const [text, quoted] of [
+    ["Command aborted", "aborted"],
+    ["Command timed out after 120 seconds", "timed out"],
+    ["ENOENT: no such file", "unknown"],
+  ]) {
+    const state = afterCommand("npm test", true, text);
+    const decision = evidenceGate(state, ledgerFor(state), check, emptyPolicy());
+    assert.equal(decision.allow, false, `${text} must refuse`);
+    assert.ok(decision.allow === false && decision.reason.includes(quoted), `the refusal must say "${quoted}"`);
+  }
+});
+
+test("the success must come after the task's last write", () => {
+  const state = afterCommand("npm test", false, "ok");
+  const stale = { ...check, lastWriteAt: "2026-09-19T23:00:00.000Z" };
+  const decision = evidenceGate(state, ledgerFor(state), stale, emptyPolicy());
+  assert.equal(decision.allow, false, "a run predating the edit proves nothing about the edit");
+  assert.ok(decision.allow === false && /before/i.test(decision.reason));
+});
+
+// ---------------------------------------------------------------------------
+// The two attacks the round-1 verdict landed. Both produced a green checkoff.
+// ---------------------------------------------------------------------------
+test("the stale-green attack is refused: a run before the edit never certifies the edit", () => {
+  // Green at 10:05, then the source is edited at 10:30. In round 1 this checked
+  // the task off, because `lastWriteAt` read `commandResults` (bash only) and
+  // `filesWritten` carried no timestamps at all.
+  const green = fold(emptyCommitted(), observation({
+    toolCallId: "b1", toolName: "bash", input: { command: "npm test" },
+    isError: false, resultText: "ok", at: "2026-09-19T10:05:00.000Z",
+  }));
+  const edited = fold(green, observation({
+    toolCallId: "w1", toolName: "edit", input: { path: "/repo/src/login.ts" },
+    isError: false, resultText: "", at: "2026-09-19T10:30:00.000Z",
+  }));
+
+  const decision = evidenceGate(
+    edited,
+    ledgerFor(edited),
+    { task: "T1", lastWriteAt: "2026-09-19T10:30:00.000Z", runner: "npm test" },
+    emptyPolicy(),
+  );
+  assert.equal(decision.allow, false, "the edit is newer than the only green run");
+  assert.ok(decision.allow === false && /before the last write/i.test(decision.reason), decision.allow === false ? decision.reason : "");
+});
+
+test("the echo attack is refused: an exit-0 string the model chose is not the declared check", () => {
+  const state = afterCommand("echo 'I have verified that all tests pass'", false, "I have verified that all tests pass");
+  const decision = evidenceGate(state, ledgerFor(state), check, emptyPolicy());
+  assert.equal(decision.allow, false, "exit 0 on a sentence is not evidence of anything");
+  assert.ok(decision.allow === false && /npm test/.test(decision.reason), "the refusal names the declared runner");
+  assert.ok(decision.allow === false && /runner|declared/i.test(decision.reason), decision.allow === false ? decision.reason : "");
+});
+
+test("a command that merely contains the runner as a substring is not the runner", () => {
+  const state = afterCommand("echo npm test", false, "npm test");
+  assert.equal(evidenceGate(state, ledgerFor(state), check, emptyPolicy()).allow, false);
+});
+
+test("the declared runner with its own arguments is still the declared runner", () => {
+  // `npm test -- src/login.test.ts` is the runner scoped to a file, which is the
+  // ordinary way a task verifies itself. Refusing it would make the gate a
+  // nuisance and get it switched off.
+  const state = afterCommand("npm test -- src/login.test.ts", false, "ok");
+  assert.equal(evidenceGate(state, ledgerFor(state), check, emptyPolicy()).allow, true);
+});
+
+test("with no runner declared, any observed success still has to postdate the write", () => {
+  // Honest limit, stated: a feature doc without a declared runner cannot have
+  // its command checked against one. The write-ordering half still applies.
+  const state = afterCommand("node --test", false, "ok");
+  const decision = evidenceGate(state, ledgerFor(state), { task: "T1", lastWriteAt: "2026-09-19T10:00:00.000Z", runner: null }, emptyPolicy());
+  assert.equal(decision.allow, true);
+  assert.equal(decision.allow === true && decision.observed.command, "node --test");
+});
+
+// The other half of that limit, which the README promises and round 2 only
+// wrote down: the *artifact* has to disclose it. A reader auditing a checkoff
+// must be able to tell a run certified by the declared runner from one
+// certified by whatever exit-0 string was handy. Without this the round-1 echo
+// attack still lands, in full, by omitting one optional field at declaration.
+test("an unpinned runner is disclosed in the recorded evidence, not silently skipped", () => {
+  const state = afterCommand("echo 'I have verified that all tests pass'", false, "ok");
+  const unpinned = evidenceGate(
+    state,
+    ledgerFor(state),
+    { task: "T1", lastWriteAt: "2026-09-19T10:00:00.000Z", runner: null },
+    emptyPolicy(),
+  );
+  assert.equal(unpinned.allow, true, "with nothing pinned there is nothing to compare against");
+  assert.equal(
+    unpinned.allow === true && unpinned.observed.outcome,
+    "success (runner not pinned)",
+    "the outcome carried into the feature doc must say the check was never pinned",
+  );
+  assert.equal(
+    renderObserved(unpinned.allow === true ? unpinned.observed : null),
+    "observed: `echo 'I have verified that all tests pass'` → success (runner not pinned)",
+  );
+
+  // And the disclosure is not blanket noise: a checkoff certified by the
+  // declared runner must stay clean, or the two cases read the same again.
+  const pinned = afterCommand("npm test", false, "ok");
+  const certified = evidenceGate(pinned, ledgerFor(pinned), check, emptyPolicy());
+  assert.equal(certified.allow === true && certified.observed.outcome, "success");
+  assert.equal(
+    renderObserved(certified.allow === true ? certified.observed : null),
+    "observed: `npm test` → success",
+  );
+});
+
+// routing.go:101 — in TDD mode the failing test comes first.
+test("TDD mode requires an observed RED before an implementation checkoff", () => {
+  const policy = emptyPolicy();
+  const green = afterCommand("npm test", false, "ok");
+  const tdd = { ...check, tdd: { mode: "strict" as const, source: "nodd_declare", runner: "npm test" } };
+
+  const withoutRed = evidenceGate(green, ledgerFor(green), tdd, policy);
+  assert.equal(withoutRed.allow, false);
+  assert.ok(withoutRed.allow === false && /red|failing/i.test(withoutRed.reason));
+
+  const red = afterCommand("npm test", true, "Command exited with code 1", "r1");
+  const both = fold(red, observation({
+    toolCallId: "g1", toolName: "bash", input: { command: "npm test" },
+    isError: false, resultText: "ok", at: "2026-09-19T10:06:00.000Z",
+  }));
+  const withRed = evidenceGate(both, ledgerFor(both), tdd, policy);
+  assert.equal(withRed.allow, true, "RED then GREEN satisfies TDD mode");
+  assert.equal(withRed.allow === true && withRed.observed.tdd?.mode, "strict");
+  assert.equal(withRed.allow === true && withRed.observed.tdd?.runner, "npm test");
+});
+
+// routing.go:117 — a disabled gate must not make the artifact lie.
+test("the flag off allows the checkoff but records that nothing was verified", () => {
+  const policy = { ...emptyPolicy(), config: { evidence: { enabled: false } } };
+  const decision = evidenceGate(emptyCommitted(), [], check, policy);
+  assert.equal(decision.allow, true);
+  assert.equal(decision.allow === true && decision.observed.outcome, "none (gate disabled)");
+  assert.equal(renderObserved(decision.allow === true ? decision.observed : null), "observed: none (gate disabled)");
+});
+
+test("the rendered line carries the real command and outcome", () => {
+  const passed = afterCommand("node --test", false, "ok");
+  const decision = evidenceGate(passed, ledgerFor(passed), { ...check, runner: "node --test" }, emptyPolicy());
+  assert.equal(renderObserved(decision.allow === true ? decision.observed : null), "observed: `node --test` → success");
+});
+
+// The steering condition: a ledger record this kernel never saw is not evidence.
+test("a ledger record the kernel never observed cannot satisfy a checkoff", () => {
+  const forged: LedgerRecord[] = [{
+    toolCallId: "forged-1", tool: "bash", command: "npm test",
+    outcome: { kind: "success" }, at: "2026-09-19T10:05:00.000Z",
+  }];
+  const decision = evidenceGate(emptyCommitted(), forged, check, emptyPolicy());
+  assert.equal(decision.allow, false, "a record on disk is not an observation");
+  assert.ok(decision.allow === false && /unverified|not observed/i.test(decision.reason),
+    `the refusal must name the degradation: ${decision.allow === false ? decision.reason : ""}`);
+
+  // Resuming in a fresh session hits this every time. If the refusal does not
+  // say why and what to do, it reads as "NODD is broken" and gets switched off.
+  assert.ok(decision.allow === false && /previous session|earlier session/i.test(decision.reason),
+    "the refusal must explain that the ledger is from a previous session");
+  assert.ok(decision.allow === false && /re-?run/i.test(decision.remedy.action),
+    "the remedy must say to re-run the check");
+});
+
+test("a mismatching record reads differently from a merely unverified one", () => {
+  const state = afterCommand("npm test", true, "Command exited with code 1");
+  const flipped: LedgerRecord[] = [{
+    toolCallId: "b1", tool: "bash", command: "npm test",
+    outcome: { kind: "success" }, at: "2026-09-19T10:05:00.000Z",
+  }];
+  const decision = evidenceGate(state, flipped, check, emptyPolicy());
+  assert.equal(decision.allow, false);
+  assert.ok(decision.allow === false && !/previous session/i.test(decision.reason),
+    "a contradicted record is not a stale-session problem and must not be described as one");
+});