@gonrocca/nodd 0.1.0

package/src/models/profiles.test.ts

@@ -0,0 +1,186 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import {
+  RESERVED_PROFILE_NAMES,
+  applyProfileCommand,
+  isValidProfileName,
+  mirrorToActiveProfile,
+  readActiveProfile,
+  readProfiles,
+} from "./profiles.ts";
+
+const withProfiles = () => ({
+  models: { implement: "anthropic/claude-opus-4-1" },
+  profiles: {
+    fast: { models: { implement: "openai-codex/gpt-5-codex" } },
+    careful: { models: { implement: "anthropic/claude-opus-4-1", explore: "anthropic/claude-sonnet-4-5" } },
+  },
+  activeProfile: "fast",
+});
+
+// ---------------------------------------------------------------------------
+// Names
+// ---------------------------------------------------------------------------
+test("reserved verb names are rejected, so `profile save` stays unambiguous", () => {
+  for (const reserved of RESERVED_PROFILE_NAMES) {
+    assert.equal(isValidProfileName(reserved), false, `${reserved} must be reserved`);
+  }
+});
+
+test("invalid characters are rejected and ordinary names accepted", () => {
+  for (const bad of ["Fast", "my profile", "prof/ile", "", "über", "a.b"]) {
+    assert.equal(isValidProfileName(bad), false, `${bad} must be rejected`);
+  }
+  for (const good of ["fast", "careful-2", "my_profile", "x"]) {
+    assert.equal(isValidProfileName(good), true, `${good} must be accepted`);
+  }
+});
+
+// ---------------------------------------------------------------------------
+// Reading, tolerantly
+// ---------------------------------------------------------------------------
+test("a corrupt profiles value parses to an empty set with a defect note", () => {
+  for (const corrupt of ["not an object", 42, null, ["a"]]) {
+    const result = readProfiles({ profiles: corrupt });
+    assert.deepEqual(result.profiles, {});
+    assert.ok(result.defects.length > 0, `${JSON.stringify(corrupt)} must be reported, not silently dropped`);
+  }
+});
+
+test("malformed individual entries are discarded and reported, valid siblings survive", () => {
+  const result = readProfiles({
+    profiles: { fast: { models: { implement: "anthropic/x" } }, "BAD NAME": { models: {} }, broken: 7 },
+  });
+  assert.deepEqual(Object.keys(result.profiles), ["fast"]);
+  assert.equal(result.defects.length, 2);
+  assert.ok(result.defects.some((d) => d.includes("BAD NAME")));
+  assert.ok(result.defects.some((d) => d.includes("broken")));
+});
+
+test("an absent profiles key is not a defect: it is just unset", () => {
+  const result = readProfiles({});
+  assert.deepEqual(result.profiles, {});
+  assert.deepEqual(result.defects, []);
+});
+
+test("activeProfile is only honoured when the profile exists", () => {
+  assert.equal(readActiveProfile(withProfiles()), "fast");
+  assert.equal(readActiveProfile({ ...withProfiles(), activeProfile: "ghost" }), null);
+  assert.equal(readActiveProfile({ activeProfile: 42 }), null);
+});
+
+// ---------------------------------------------------------------------------
+// The four verbs, as pure transforms
+// ---------------------------------------------------------------------------
+test("new creates from the current config and activates it", () => {
+  const result = applyProfileCommand({ models: { implement: "anthropic/claude-opus-4-1" } }, { kind: "new", name: "fresh" });
+  assert.equal(result.ok, true);
+  if (result.ok !== true) return;
+  assert.deepEqual(result.data.profiles, { fresh: { models: { implement: "anthropic/claude-opus-4-1" } } });
+  assert.equal(result.data.activeProfile, "fresh");
+  assert.match(result.message, /fresh/);
+});
+
+test("new refuses to overwrite an existing profile", () => {
+  const result = applyProfileCommand(withProfiles(), { kind: "new", name: "fast" });
+  assert.equal(result.ok, false);
+  assert.ok(result.ok === false && result.message.includes("fast"));
+});
+
+test("new with an invalid name is refused", () => {
+  assert.equal(applyProfileCommand({}, { kind: "new", name: "use" }).ok, false);
+  assert.equal(applyProfileCommand({}, { kind: "new", name: "Bad Name" }).ok, false);
+});
+
+test("save stores the current config under a name", () => {
+  const data = { ...withProfiles(), models: { implement: "anthropic/new-model" } };
+  const result = applyProfileCommand(data, { kind: "save", name: "careful" });
+  assert.equal(result.ok, true);
+  if (result.ok !== true) return;
+  assert.deepEqual((result.data.profiles as Record<string, unknown>).careful, {
+    models: { implement: "anthropic/new-model" },
+  });
+  assert.deepEqual(
+    (result.data.profiles as Record<string, unknown>).fast,
+    { models: { implement: "openai-codex/gpt-5-codex" } },
+    "an unrelated profile is untouched",
+  );
+});
+
+test("save without a name consolidates the active profile", () => {
+  const data = { ...withProfiles(), models: { implement: "anthropic/edited" } };
+  const result = applyProfileCommand(data, { kind: "save" });
+  assert.equal(result.ok, true);
+  if (result.ok !== true) return;
+  assert.deepEqual((result.data.profiles as Record<string, unknown>).fast, { models: { implement: "anthropic/edited" } });
+});
+
+test("save without a name and no active profile is refused", () => {
+  const result = applyProfileCommand({ models: {} }, { kind: "save" });
+  assert.equal(result.ok, false);
+  assert.ok(result.ok === false && /activo|nombre/.test(result.message));
+});
+
+test("use activates a profile and applies its models", () => {
+  const result = applyProfileCommand(withProfiles(), { kind: "use", name: "careful" });
+  assert.equal(result.ok, true);
+  if (result.ok !== true) return;
+  assert.equal(result.data.activeProfile, "careful");
+  assert.deepEqual(result.data.models, {
+    implement: "anthropic/claude-opus-4-1",
+    explore: "anthropic/claude-sonnet-4-5",
+  });
+});
+
+test("use on an unknown profile is refused and lists what exists", () => {
+  const result = applyProfileCommand(withProfiles(), { kind: "use", name: "ghost" });
+  assert.equal(result.ok, false);
+  if (result.ok !== false) return;
+  assert.ok(result.message.includes("ghost"));
+  assert.ok(result.message.includes("careful") && result.message.includes("fast"));
+});
+
+test("delete removes a profile and clears activeProfile when it was active", () => {
+  const result = applyProfileCommand(withProfiles(), { kind: "delete", name: "fast" });
+  assert.equal(result.ok, true);
+  if (result.ok !== true) return;
+  assert.deepEqual(Object.keys(result.data.profiles as object), ["careful"]);
+  assert.equal(result.data.activeProfile, null);
+  assert.deepEqual(result.data.models, { implement: "anthropic/claude-opus-4-1" }, "the flat config survives a delete");
+});
+
+test("deleting a non-active profile leaves the active one alone", () => {
+  const result = applyProfileCommand(withProfiles(), { kind: "delete", name: "careful" });
+  assert.equal(result.ok, true);
+  assert.equal(result.ok === true && result.data.activeProfile, "fast");
+});
+
+test("every verb is pure: the input object is never mutated", () => {
+  const data = withProfiles();
+  const snapshot = JSON.stringify(data);
+  for (const command of [
+    { kind: "new" as const, name: "fresh" },
+    { kind: "save" as const, name: "fast" },
+    { kind: "use" as const, name: "careful" },
+    { kind: "delete" as const, name: "fast" },
+  ]) {
+    applyProfileCommand(data, command);
+  }
+  assert.equal(JSON.stringify(data), snapshot, "the transforms return new data; the command decides to write");
+});
+
+// ---------------------------------------------------------------------------
+// Mirroring
+// ---------------------------------------------------------------------------
+test("mirroring writes the current config into the active profile", () => {
+  const data = { ...withProfiles(), models: { implement: "anthropic/just-edited" } };
+  const mirrored = mirrorToActiveProfile(data);
+  assert.deepEqual((mirrored.profiles as Record<string, unknown>).fast, {
+    models: { implement: "anthropic/just-edited" },
+  });
+});
+
+test("mirroring with no active profile changes nothing", () => {
+  const data = { models: { implement: "anthropic/x" }, profiles: {}, activeProfile: null };
+  assert.deepEqual(mirrorToActiveProfile(data), data);
+});

package/src/models/profiles.ts

@@ -0,0 +1,162 @@
+// Named slot-assignment sets, in `~/.pi/nodd.json` only.
+//
+// Adapted from `zero-models-profiles.ts:46-68,170-177,255-299`. NODD's profiles
+// are never shared with forge's: the two products keep separate files, and the
+// isolation test in `src/config.test.ts` asserts no NODD source even names the
+// other one.
+//
+// Every verb is a pure transform returning the new data plus a message. The
+// command decides whether to write — which is what makes "quit writes nothing"
+// enforceable rather than a promise about a code path.
+//
+// Malformed profile data is discarded *and reported*. Silently dropping it would
+// leave the user staring at a profile that vanished with no explanation, and
+// throwing would take the whole command down over a hand-edit.
+
+export type Profile = { models: Record<string, string> };
+
+/** Sub-command verbs, which therefore cannot be profile names. */
+export const RESERVED_PROFILE_NAMES = ["list", "new", "save", "use", "delete", "rm", "from"] as const;
+
+export type ProfileCommand =
+  | { kind: "new"; name: string; from?: string }
+  | { kind: "save"; name?: string }
+  | { kind: "use"; name: string }
+  | { kind: "delete"; name: string };
+
+export type ProfileResult =
+  | { ok: true; data: Record<string, unknown>; message: string }
+  | { ok: false; message: string };
+
+export function isValidProfileName(name: string): boolean {
+  if (!/^[a-z0-9_-]+$/.test(name)) return false;
+  return !(RESERVED_PROFILE_NAMES as readonly string[]).includes(name);
+}
+
+function isObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function stringMap(value: unknown): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const [key, raw] of Object.entries(isObject(value) ? value : {})) {
+    if (typeof raw === "string") out[key] = raw;
+  }
+  return out;
+}
+
+export type ReadProfiles = { profiles: Record<string, Profile>; defects: string[] };
+
+export function readProfiles(data: Record<string, unknown>): ReadProfiles {
+  const raw = data.profiles;
+  if (raw === undefined) return { profiles: {}, defects: [] };
+  if (!isObject(raw)) {
+    return { profiles: {}, defects: ["`profiles` is not an object; it was discarded and no profile is available"] };
+  }
+
+  const profiles: Record<string, Profile> = {};
+  const defects: string[] = [];
+  for (const [name, value] of Object.entries(raw)) {
+    if (!isValidProfileName(name)) {
+      defects.push(`profile \`${name}\` has an invalid name and was discarded`);
+      continue;
+    }
+    if (!isObject(value)) {
+      defects.push(`profile \`${name}\` is not an object and was discarded`);
+      continue;
+    }
+    profiles[name] = { models: stringMap(value.models) };
+  }
+  return { profiles, defects };
+}
+
+/** The active profile, but only when it actually exists. */
+export function readActiveProfile(data: Record<string, unknown>): string | null {
+  const active = data.activeProfile;
+  if (typeof active !== "string") return null;
+  return readProfiles(data).profiles[active] ? active : null;
+}
+
+/** The flat config as a profile snapshot. */
+function snapshot(data: Record<string, unknown>): Profile {
+  return { models: stringMap(data.models) };
+}
+
+/**
+ * Editing a slot while a profile is active edits that profile, so the two never
+ * drift apart without the user asking for it. No active profile: unchanged.
+ */
+export function mirrorToActiveProfile(data: Record<string, unknown>): Record<string, unknown> {
+  const active = readActiveProfile(data);
+  if (active === null) return data;
+  const { profiles } = readProfiles(data);
+  return { ...data, profiles: { ...profiles, [active]: snapshot(data) } };
+}
+
+export function applyProfileCommand(data: Record<string, unknown>, command: ProfileCommand): ProfileResult {
+  const { profiles } = readProfiles(data);
+  const names = Object.keys(profiles).sort();
+
+  if (command.kind === "new") {
+    if (!isValidProfileName(command.name)) {
+      return { ok: false, message: `nombre de perfil inválido: ${command.name}` };
+    }
+    if (profiles[command.name]) {
+      return { ok: false, message: `el perfil ${command.name} ya existe; usá save para sobrescribirlo` };
+    }
+    const source = command.from ? profiles[command.from] : snapshot(data);
+    if (!source) return { ok: false, message: `no existe el perfil ${command.from}` };
+    return {
+      ok: true,
+      data: { ...data, profiles: { ...profiles, [command.name]: source }, activeProfile: command.name },
+      message: `perfil ${command.name} creado y activado`,
+    };
+  }
+
+  if (command.kind === "save") {
+    const target = command.name ?? readActiveProfile(data);
+    if (!target) {
+      return { ok: false, message: "no hay perfil activo: pasá un nombre para guardar" };
+    }
+    if (!isValidProfileName(target)) {
+      return { ok: false, message: `nombre de perfil inválido: ${target}` };
+    }
+    return {
+      ok: true,
+      data: { ...data, profiles: { ...profiles, [target]: snapshot(data) } },
+      message: `perfil ${target} guardado`,
+    };
+  }
+
+  if (command.kind === "use") {
+    const profile = profiles[command.name];
+    if (!profile) {
+      return {
+        ok: false,
+        message: `no existe el perfil ${command.name}${names.length > 0 ? `. Perfiles: ${names.join(", ")}` : ""}`,
+      };
+    }
+    return {
+      ok: true,
+      data: { ...data, models: { ...profile.models }, activeProfile: command.name },
+      message: `perfil ${command.name} activado`,
+    };
+  }
+
+  const remaining = { ...profiles };
+  if (!remaining[command.name]) {
+    return {
+      ok: false,
+      message: `no existe el perfil ${command.name}${names.length > 0 ? `. Perfiles: ${names.join(", ")}` : ""}`,
+    };
+  }
+  delete remaining[command.name];
+  // The flat config stays as it is: deleting a profile must not silently change
+  // which models are in use.
+  const active = readActiveProfile(data);
+  return {
+    ok: true,
+    data: { ...data, profiles: remaining, activeProfile: active === command.name ? null : active },
+    message: `perfil ${command.name} borrado`,
+  };
+}

package/src/models/slots.ts

@@ -0,0 +1,48 @@
+// What `/nodd-models` shows, and what it lets you change.
+//
+// All seven canonical ODD steps are displayed, because the visible protocol is
+// part of what NODD inherits: hiding `authorize`, `classify`, `track` and
+// `close` would make the mechanized half of ODD invisible. But those four run no
+// model — they are comparators and file writers — so they get no slot. A
+// decorative slot on a step that never calls a model is a lie with a dropdown.
+//
+// Assignable: the two global slots plus the three model-backed steps.
+
+import { CANONICAL_STEPS, CONFIGURABLE_SLOTS, MECHANISM_STEPS, type ConfigurableSlot } from "../manifest.ts";
+
+export type SlotRow = {
+  id: string;
+  /** `global` and `step` are assignable; `mechanism` is displayed only. */
+  kind: "global" | "step" | "mechanism";
+  /** What the row shows when it carries no model. */
+  placeholder: string;
+};
+
+export const MECHANISM_PLACEHOLDER = "mecanismo · sin modelo";
+
+const GLOBAL_SLOTS = ["default", "orchestrator"] as const;
+
+function isMechanism(step: string): boolean {
+  return (MECHANISM_STEPS as readonly string[]).includes(step);
+}
+
+/**
+ * The display model: the two global slots first, then the seven canonical steps
+ * in protocol order. The order is the contract — a test asserts it.
+ */
+export const SLOT_ROWS: readonly SlotRow[] = Object.freeze([
+  ...GLOBAL_SLOTS.map((id): SlotRow => ({ id, kind: "global", placeholder: "sin asignar" })),
+  ...CANONICAL_STEPS.map((id): SlotRow =>
+    isMechanism(id)
+      ? { id, kind: "mechanism", placeholder: MECHANISM_PLACEHOLDER }
+      : { id, kind: "step", placeholder: "sin asignar" },
+  ),
+]);
+
+export function slotRow(id: string): SlotRow | undefined {
+  return SLOT_ROWS.find((row) => row.id === id);
+}
+
+export function isConfigurableSlot(id: string): id is ConfigurableSlot {
+  return (CONFIGURABLE_SLOTS as readonly string[]).includes(id);
+}

package/src/observations.test.ts

@@ -0,0 +1,61 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { observation, pendingCall } from "./observations.ts";
+import { emptyState } from "./state.ts";
+
+test("an observation carries the raw observed fields", () => {
+  const obs = observation({
+    toolCallId: "call_1",
+    toolName: "bash",
+    input: { command: "npm test" },
+    isError: false,
+    resultText: "12 passing",
+    at: "2026-09-19T10:00:00.000Z",
+  });
+  assert.equal(obs.toolCallId, "call_1");
+  assert.equal(obs.toolName, "bash");
+  assert.deepEqual(obs.input, { command: "npm test" });
+  assert.equal(obs.isError, false);
+  assert.equal(obs.resultText, "12 passing");
+});
+
+test("an observation cannot be constructed without a toolCallId", () => {
+  const missing = { toolCallId: "", toolName: "bash", input: {}, isError: false, resultText: "", at: "t" };
+  assert.throws(() => observation(missing), /toolCallId/);
+  // @ts-expect-error — the field is required by type, and rejected at runtime too.
+  assert.throws(() => observation({ toolName: "bash", input: {}, isError: false, resultText: "", at: "t" }), /toolCallId/);
+});
+
+test("a pending call is keyed by toolCallId and carries no result", () => {
+  const pending = pendingCall({ toolCallId: "call_2", toolName: "write", input: { path: "a.ts" } });
+  assert.equal(pending.toolCallId, "call_2");
+  assert.ok(!("resultText" in pending), "a pending call has no result yet");
+  assert.ok(!("isError" in pending), "a pending call has no outcome yet");
+});
+
+test("state splits committed from pending", () => {
+  const state = emptyState();
+  assert.ok(state.pending instanceof Map);
+  assert.equal(state.pending.size, 0);
+  assert.equal(state.committed.toolCalls, 0);
+  assert.equal(state.committed.declaration, null);
+});
+
+// The ledger stores what was observed. Interpretation (success/failure) is
+// derived later by src/outcome.ts, so evidence stays re-derivable and is never
+// pre-collapsed into a boolean a caller could trust blindly.
+test("no raw observation field is a boolean verdict", () => {
+  const obs = observation({
+    toolCallId: "call_3", toolName: "bash", input: {}, isError: true, resultText: "boom", at: "t",
+  });
+  for (const key of ["ok", "passed", "success", "failed"]) {
+    assert.ok(!(key in obs), `Observation must not carry a '${key}' verdict field`);
+  }
+  const src = readFileSync(join(dirname(fileURLToPath(import.meta.url)), "observations.ts"), "utf8");
+  for (const key of ["ok:", "passed:", "success:"]) {
+    assert.ok(!src.includes(key), `observations.ts must not define '${key}'`);
+  }
+});

package/src/observations.ts

@@ -0,0 +1,51 @@
+// What NODD saw, as it saw it.
+//
+// An `Observation` is a fact from a real pi `tool_result` event: the tool, its
+// input, whether pi reported an error, and the rendered result text. Nothing
+// here interprets that raw material — `src/outcome.ts` derives the five command
+// outcomes from it, and it does so on demand. Storing the interpretation
+// instead of the observation is how "Evidence: tests pass" became worthless in
+// ODD: once collapsed, the evidence can no longer be re-checked.
+
+export type Observation = {
+  toolCallId: string;
+  toolName: string;
+  input: Record<string, unknown>;
+  /** pi's own error flag from the tool result. Not a verdict — an observation. */
+  isError: boolean;
+  /** The rendered result text, including the status line pi's bash appends. */
+  resultText: string;
+  /** ISO timestamp of when the result was observed. */
+  at: string;
+};
+
+/**
+ * A tool call preflighted in the current assistant batch whose result is not
+ * known yet. It deliberately has no result fields: pi preflights siblings
+ * sequentially and runs them concurrently, so a gate that read a result from
+ * here would read evidence that does not exist.
+ */
+export type PendingCall = {
+  toolCallId: string;
+  toolName: string;
+  input: Record<string, unknown>;
+};
+
+export function observation(fields: Observation): Observation {
+  if (!fields?.toolCallId) {
+    throw new Error("an observation requires a toolCallId: it is what makes replay idempotent");
+  }
+  return {
+    toolCallId: fields.toolCallId,
+    toolName: fields.toolName,
+    input: fields.input ?? {},
+    isError: fields.isError,
+    resultText: fields.resultText ?? "",
+    at: fields.at,
+  };
+}
+
+export function pendingCall(fields: PendingCall): PendingCall {
+  if (!fields?.toolCallId) throw new Error("a pending call requires a toolCallId");
+  return { toolCallId: fields.toolCallId, toolName: fields.toolName, input: fields.input ?? {} };
+}

package/src/odd-prose.test.ts

@@ -0,0 +1,125 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync, readdirSync } from "node:fs";
+import { CANONICAL_STEPS } from "./manifest.ts";
+import { GATE_IDS } from "./gates/registry.ts";
+import { ODD_PROSE, proseForStep, type ProseEntry } from "./odd-prose.ts";
+
+// The `(P)`-bearing rows of `REQ: odd-parity-matrix`. Listed here by number so
+// that adding a row to the matrix without adding its clause fails loudly.
+const P_ROWS = [4, 5, 6, 7, 11, 19, 28, 29, 32, 33, 34, 35, 36, 38, 39, 41, 44, 49];
+
+// ---------------------------------------------------------------------------
+// One entry per (P) row
+// ---------------------------------------------------------------------------
+test("the corpus has exactly one entry per (P) row of the parity matrix", () => {
+  assert.deepEqual(ODD_PROSE.map((entry) => entry.row).sort((a, b) => a - b), P_ROWS);
+  assert.equal(new Set(ODD_PROSE.map((entry) => entry.row)).size, ODD_PROSE.length, "no duplicated row");
+});
+
+test("every entry carries its routing.go line, a step tag, a clause and a reason", () => {
+  for (const entry of ODD_PROSE) {
+    assert.match(entry.line, /^:\d+/, `row ${entry.row} must cite a routing.go line`);
+    assert.ok(CANONICAL_STEPS.includes(entry.step), `row ${entry.row} has step ${entry.step}`);
+    assert.ok(entry.clause.length > 20, `row ${entry.row} needs a real clause`);
+    assert.ok(entry.reason.length > 20, `row ${entry.row} needs a real reason`);
+  }
+});
+
+test("no reason is the non-reason the matrix forbids", () => {
+  for (const entry of ODD_PROSE) {
+    assert.ok(
+      !/did not get to|todo|later|not yet implemented/i.test(entry.reason),
+      `row ${entry.row}: "we did not get to it" is not a reason`,
+    );
+  }
+});
+
+// ---------------------------------------------------------------------------
+// The two clauses that must survive verbatim
+// ---------------------------------------------------------------------------
+test("the preparation trigger is carried under explore", () => {
+  const entry = ODD_PROSE.find((e) => e.row === 28);
+  assert.ok(entry, "row 28 must exist");
+  assert.equal(entry!.step, "explore");
+  assert.match(entry!.clause, /prepar/i);
+  assert.equal(entry!.line, ":81");
+});
+
+test("the ~400-line advisory is carried under implement, marked as advisory only", () => {
+  const entry = ODD_PROSE.find((e) => e.row === 38);
+  assert.ok(entry);
+  assert.equal(entry!.step, "implement");
+  assert.match(entry!.clause, /400/);
+  for (const negation of ["acceptance criterion", "hard cap", "automatic stop", "forced split"]) {
+    assert.ok(entry!.clause.includes(negation), `the advisory must deny being a ${negation}`);
+  }
+});
+
+test("the anti-gaming sentence is carried verbatim and names everything it forbids", () => {
+  const entry = ODD_PROSE.find((e) => e.row === 39);
+  assert.ok(entry);
+  assert.equal(entry!.step, "implement");
+  for (const forbidden of ["blank lines", "comments", "minify", "tests", "split"]) {
+    assert.ok(entry!.clause.includes(forbidden), `the anti-gaming clause must name ${forbidden}`);
+  }
+});
+
+// ---------------------------------------------------------------------------
+// Selection by step
+// ---------------------------------------------------------------------------
+test("selecting a step returns that step's entries and nothing else", () => {
+  for (const step of CANONICAL_STEPS) {
+    for (const entry of proseForStep(step)) {
+      assert.equal(entry.step, step, `${entry.row} leaked into ${step}`);
+    }
+  }
+});
+
+test("every entry is reachable through some step, so nothing is stranded", () => {
+  const reachable = CANONICAL_STEPS.flatMap((step) => proseForStep(step).map((entry) => entry.row));
+  assert.deepEqual(reachable.sort((a, b) => a - b), P_ROWS);
+});
+
+test("implement carries the two line-heuristic clauses together", () => {
+  const rows = proseForStep("implement").map((entry) => entry.row);
+  assert.ok(rows.includes(38) && rows.includes(39), "the advisory and its anti-gaming sentence travel together");
+});
+
+// ---------------------------------------------------------------------------
+// The absent mechanisms are verified absent
+// ---------------------------------------------------------------------------
+test("no gate id contains `prepar`: the preparation trigger stayed prose", () => {
+  const gates = readdirSync(new URL("./gates/", import.meta.url)).filter((f) => f.endsWith(".ts") && !f.endsWith(".test.ts"));
+  for (const file of gates) {
+    assert.ok(!/prepar/i.test(file), `${file} implies a preparation mechanism that must not exist`);
+  }
+  for (const id of GATE_IDS) assert.ok(!/prepar/i.test(id), `gate ${id} must not be a preparation trigger`);
+});
+
+test("no gate consults a line count: the 400-line figure stayed advisory", () => {
+  const dir = new URL("./gates/", import.meta.url);
+  for (const file of readdirSync(dir)) {
+    if (!file.endsWith(".ts") || file.endsWith(".test.ts")) continue;
+    const source = readFileSync(new URL(file, dir), "utf8")
+      .split("\n")
+      .filter((line) => !/^\s*(\/\/|\*|\/\*)/.test(line))
+      .join("\n");
+    for (const forbidden of ["countAuthoredLines", "lineCount", "linesChanged", "400"]) {
+      assert.ok(!source.includes(forbidden), `${file} must not consult ${forbidden}`);
+    }
+  }
+});
+
+test("the corpus is data, not behaviour: it reads no file and imports no gate", () => {
+  const source = readFileSync(new URL("./odd-prose.ts", import.meta.url), "utf8")
+    .split("\n")
+    .filter((line) => !/^\s*(\/\/|\*|\/\*)/.test(line))
+    .join("\n");
+  assert.ok(!source.includes("node:fs"));
+  assert.ok(!source.includes("./gates/"));
+});
+
+test("the corpus is frozen, so no caller can ratchet it at runtime", () => {
+  assert.throws(() => (ODD_PROSE as ProseEntry[]).push({} as ProseEntry));
+});