@haaaiawd/second-nature 0.1.42 → 0.1.50

package/dist/tests/unit/observability/audit-envelope.test.js

@@ -0,0 +1,169 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { AppendOnlyAuditStore } from "../../../src/observability/audit/append-only-audit-store.js";
+import { buildAuditEnvelope, redactAuditEvent } from "../../../src/observability/audit/audit-envelope.js";
+test("redactAuditEvent masks token-like fields and records manifest paths", () => {
+    const { payload, redaction } = redactAuditEvent({
+        traceId: "t1",
+        token: "secret-token",
+        message: "ok",
+    });
+    assert.equal(payload.token, "[MASKED]");
+    assert.ok(redaction.maskedPaths.some((p) => p.includes("token")));
+    assert.equal(redaction.sensitivity, "private");
+});
+test("buildAuditEnvelope produces stable recordHash and append-only store chains hashes per family", () => {
+    const store = new AppendOnlyAuditStore();
+    const first = buildAuditEnvelope({
+        family: "heartbeat.decision",
+        plane: "decision",
+        traceId: "tr-1",
+        sequence: 1,
+        payload: { decisionId: "d1", token: "x" },
+    });
+    store.append(first);
+    const second = buildAuditEnvelope({
+        family: "heartbeat.decision",
+        plane: "decision",
+        traceId: "tr-1",
+        sequence: 2,
+        payload: { auditId: "a1" },
+        previousHash: first.integrity.recordHash,
+    });
+    store.append(second);
+    assert.equal(store.list().length, 2);
+    assert.equal(second.integrity.previousHash, first.integrity.recordHash);
+});
+test("AppendOnlyAuditStore rejects mismatched previousHash", () => {
+    const store = new AppendOnlyAuditStore();
+    const first = buildAuditEnvelope({
+        family: "heartbeat.decision",
+        plane: "decision",
+        traceId: "tr-2",
+        sequence: 1,
+        payload: { ok: true },
+    });
+    store.append(first);
+    const broken = buildAuditEnvelope({
+        family: "heartbeat.decision",
+        plane: "decision",
+        traceId: "tr-2",
+        sequence: 2,
+        payload: { ok: true },
+        previousHash: "deadbeef",
+    });
+    assert.throws(() => store.append(broken), /audit_previous_hash_mismatch/);
+});
+// ─── T-OBS.C.1: per-family lastHashCache ────────────────────────────────────
+test("T-OBS.C.1 different families are independent chains (no cross-family previousHash)", () => {
+    const store = new AppendOnlyAuditStore();
+    const first = buildAuditEnvelope({
+        family: "heartbeat.decision",
+        plane: "decision",
+        traceId: "tr-3",
+        sequence: 1,
+        payload: { a: 1 },
+    });
+    store.append(first);
+    // A new family must start with undefined previousHash
+    const second = buildAuditEnvelope({
+        family: "delivery",
+        plane: "delivery",
+        traceId: "tr-3",
+        sequence: 1,
+        payload: { b: 2 },
+    });
+    store.append(second);
+    assert.equal(store.list().length, 2);
+    assert.equal(store.lastRecordHash("heartbeat.decision"), first.integrity.recordHash);
+    assert.equal(store.lastRecordHash("delivery"), second.integrity.recordHash);
+});
+test("T-OBS.C.1 lastRecordHash without family falls back to global last", () => {
+    const store = new AppendOnlyAuditStore();
+    const env = buildAuditEnvelope({
+        family: "dream.trace",
+        plane: "telemetry",
+        traceId: "tr-4",
+        sequence: 1,
+        payload: { ok: true },
+    });
+    store.append(env);
+    assert.equal(store.lastRecordHash(), env.integrity.recordHash);
+});
+test("T-OBS.C.1 seedFamilyHash fills cache for restart backfill", () => {
+    const store = new AppendOnlyAuditStore();
+    store.seedFamilyHash("heartbeat.decision", "abc123");
+    const next = buildAuditEnvelope({
+        family: "heartbeat.decision",
+        plane: "decision",
+        traceId: "tr-5",
+        sequence: 1,
+        payload: { ok: true },
+        previousHash: "abc123",
+    });
+    store.append(next);
+    assert.equal(store.lastRecordHash("heartbeat.decision"), next.integrity.recordHash);
+});
+test("T-OBS.C.1 cachedFamilies returns tracked families", () => {
+    const store = new AppendOnlyAuditStore();
+    store.append(buildAuditEnvelope({
+        family: "heartbeat.decision", plane: "decision", traceId: "t", sequence: 1, payload: {},
+    }));
+    store.append(buildAuditEnvelope({
+        family: "delivery", plane: "delivery", traceId: "t", sequence: 1, payload: {},
+    }));
+    assert.deepEqual([...store.cachedFamilies()].sort(), ["delivery", "heartbeat.decision"]);
+});
+// ─── T-OBS.C.1: redactPayload unified gate ──────────────────────────────────
+import { redactPayload } from "../../../src/observability/redaction/policy.js";
+test("T-OBS.C.1 redactPayload masks v7 fields encryption_key and key_material", () => {
+    const { payload, manifest } = redactPayload({
+        encryption_key: "super-secret",
+        key_material: "abc123",
+        publicField: "visible",
+    });
+    assert.equal(payload.encryption_key, "[MASKED]");
+    assert.equal(payload.key_material, "[MASKED]");
+    assert.equal(payload.publicField, "visible");
+    assert.ok(manifest.maskedPaths.includes("encryption_key"));
+    assert.ok(manifest.maskedPaths.includes("key_material"));
+});
+test("T-OBS.C.1 redactPayload erases v7 fields raw_payload credential_value raw_prompt", () => {
+    const { payload, manifest } = redactPayload({
+        raw_payload: { secret: "x" },
+        credential_value: "password",
+        raw_prompt: "system: do bad things",
+        ok: true,
+    });
+    assert.equal(payload.raw_payload, null);
+    assert.equal(payload.credential_value, null);
+    assert.equal(payload.raw_prompt, null);
+    assert.equal(payload.ok, true);
+    assert.ok(manifest.erasedPaths.includes("raw_payload"));
+    assert.ok(manifest.erasedPaths.includes("credential_value"));
+    assert.ok(manifest.erasedPaths.includes("raw_prompt"));
+});
+test("T-OBS.C.1 redactPayload hashes message_hash and preserves nested objects", () => {
+    const { payload, manifest } = redactPayload({
+        message_hash: "hello",
+        nested: { token: "secret" },
+    });
+    const hashed = payload.message_hash;
+    assert.ok(typeof hashed === "string" && hashed.length === 64);
+    assert.notEqual(hashed, "hello");
+    assert.ok(manifest.hashedPaths.includes("message_hash"));
+    // nested token should also be masked
+    assert.equal(payload.nested.token, "[MASKED]");
+});
+test("T-OBS.C.1 redactPayload inferSensitivity restricted when erased present", () => {
+    const { manifest } = redactPayload({ raw_payload: "x" });
+    assert.equal(manifest.sensitivity, "restricted");
+});
+test("T-OBS.C.1 redactPayload inferSensitivity confidential when only masked", () => {
+    const { manifest } = redactPayload({ token: "x" });
+    assert.equal(manifest.sensitivity, "confidential");
+});
+test("T-OBS.C.1 redactPayload inferSensitivity internal when nothing redacted", () => {
+    const { manifest } = redactPayload({ ok: true });
+    assert.equal(manifest.sensitivity, "internal");
+});

package/dist/tests/unit/observability/connector-inventory-ledger.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/unit/observability/connector-inventory-ledger.test.js

@@ -0,0 +1,128 @@
+/**
+ * Unit coverage for `ConnectorInventoryLedger` (T5.1.3).
+ *
+ * Verifies recordAudit round-trip, getLatestAudit by snapshotId,
+ * listAudits pagination, and JSON field deserialization.
+ */
+import test from "node:test";
+import assert from "node:assert/strict";
+import { createObservabilityDatabase } from "../../../src/observability/db/index.js";
+import { ConnectorInventoryLedger } from "../../../src/observability/connector-inventory-ledger.js";
+import { connectorInventoryAudit } from "../../../src/observability/db/schema/index.js";
+test("T5.1.3 recordAudit writes a row and returns auditId", async () => {
+    const db = createObservabilityDatabase(":memory:");
+    const ledger = new ConnectorInventoryLedger(db);
+    const auditId = await ledger.recordAudit({
+        snapshotId: "snap-001",
+        scanned: 5,
+        registered: 3,
+        skipped: 2,
+        conflicts: [{ connectorId: "evomap", reason: "duplicate_capability" }],
+        validationErrors: [],
+        trustSummary: { declarative_trusted: 2, custom_adapter_pending_trust: 1 },
+    });
+    assert.ok(auditId.length > 0, "auditId should be non-empty");
+    const rows = await db.db.select().from(connectorInventoryAudit).execute();
+    assert.equal(rows.length, 1);
+    const row = rows[0];
+    assert.equal(row.snapshotId, "snap-001");
+    assert.equal(row.scanned, 5);
+    assert.equal(row.registered, 3);
+    assert.equal(row.skipped, 2);
+    db.close();
+});
+test("T5.1.3 getLatestAudit returns the most recent audit for a snapshotId", async () => {
+    const db = createObservabilityDatabase(":memory:");
+    const ledger = new ConnectorInventoryLedger(db);
+    await ledger.recordAudit({
+        snapshotId: "snap-a",
+        scanned: 1,
+        registered: 1,
+        skipped: 0,
+    });
+    await new Promise((r) => setTimeout(r, 20));
+    await ledger.recordAudit({
+        snapshotId: "snap-a",
+        scanned: 2,
+        registered: 2,
+        skipped: 0,
+    });
+    const latest = await ledger.getLatestAudit("snap-a");
+    assert.ok(latest);
+    assert.equal(latest.scanned, 2);
+    assert.equal(latest.registered, 2);
+    db.close();
+});
+test("T5.1.3 getLatestAudit returns undefined when snapshotId absent", async () => {
+    const db = createObservabilityDatabase(":memory:");
+    const ledger = new ConnectorInventoryLedger(db);
+    const latest = await ledger.getLatestAudit("nonexistent");
+    assert.equal(latest, undefined);
+    db.close();
+});
+test("T5.1.3 listAudits respects limit and offset", async () => {
+    const db = createObservabilityDatabase(":memory:");
+    const ledger = new ConnectorInventoryLedger(db);
+    for (let i = 0; i < 5; i++) {
+        await ledger.recordAudit({
+            snapshotId: `snap-${i}`,
+            scanned: i,
+            registered: i,
+            skipped: 0,
+        });
+    }
+    const all = await ledger.listAudits();
+    assert.equal(all.length, 5);
+    const limited = await ledger.listAudits({ limit: 2 });
+    assert.equal(limited.length, 2);
+    const offset = await ledger.listAudits({ limit: 2, offset: 2 });
+    assert.equal(offset.length, 2);
+    db.close();
+});
+test("T5.1.3 JSON fields deserialize correctly", async () => {
+    const db = createObservabilityDatabase(":memory:");
+    const ledger = new ConnectorInventoryLedger(db);
+    const auditId = await ledger.recordAudit({
+        snapshotId: "snap-json",
+        scanned: 3,
+        registered: 2,
+        skipped: 1,
+        conflicts: [
+            { connectorId: "moltbook", reason: "capability_collision" },
+        ],
+        validationErrors: [
+            { connectorId: "instreet", errors: ["missing_entrypoint"] },
+        ],
+        trustSummary: { declarative_trusted: 1, blocked: 1 },
+    });
+    const snapshot = await ledger.getLatestAudit("snap-json");
+    assert.ok(snapshot);
+    assert.equal(snapshot.auditId, auditId);
+    assert.deepEqual(snapshot.conflicts, [
+        { connectorId: "moltbook", reason: "capability_collision" },
+    ]);
+    assert.deepEqual(snapshot.validationErrors, [
+        { connectorId: "instreet", errors: ["missing_entrypoint"] },
+    ]);
+    assert.deepEqual(snapshot.trustSummary, {
+        declarative_trusted: 1,
+        blocked: 1,
+    });
+    db.close();
+});
+test("T5.1.3 defaults for optional fields are empty arrays/objects", async () => {
+    const db = createObservabilityDatabase(":memory:");
+    const ledger = new ConnectorInventoryLedger(db);
+    await ledger.recordAudit({
+        snapshotId: "snap-defaults",
+        scanned: 1,
+        registered: 1,
+        skipped: 0,
+    });
+    const snapshot = await ledger.getLatestAudit("snap-defaults");
+    assert.ok(snapshot);
+    assert.deepEqual(snapshot.conflicts, []);
+    assert.deepEqual(snapshot.validationErrors, []);
+    assert.deepEqual(snapshot.trustSummary, {});
+    db.close();
+});

package/dist/tests/unit/observability/family-registry.test.d.ts

@@ -0,0 +1,12 @@
+/**
+ * T-OBS.F.1 — Audit family registry unit tests.
+ *
+ * Verification (05A / 05B):
+ * - 8 system families registered and loadable
+ * - Unknown family rejection returns `unknown_audit_family`
+ * - All 8 v7 system IDs covered
+ *
+ * Dependencies: src/observability/audit/family-registry.ts,
+ *               src/observability/audit/audit-family-registry.json
+ */
+export {};

package/dist/tests/unit/observability/family-registry.test.js

@@ -0,0 +1,105 @@
+/**
+ * T-OBS.F.1 — Audit family registry unit tests.
+ *
+ * Verification (05A / 05B):
+ * - 8 system families registered and loadable
+ * - Unknown family rejection returns `unknown_audit_family`
+ * - All 8 v7 system IDs covered
+ *
+ * Dependencies: src/observability/audit/family-registry.ts,
+ *               src/observability/audit/audit-family-registry.json
+ */
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { createAuditFamilyRegistry, } from "../../../src/observability/audit/family-registry.js";
+import registryJson from "../../../src/observability/audit/audit-family-registry.json" with { type: "json" };
+const EXPECTED_SYSTEM_IDS = [
+    "body-tool-system",
+    "connector-system",
+    "control-plane-system",
+    "dream-quiet-system",
+    "guidance-voice-system",
+    "observability-health-system",
+    "runtime-ops-system",
+    "state-memory-system",
+];
+const EXPECTED_FAMILIES = [
+    "heartbeat.decision",
+    "delivery",
+    "source_coverage",
+    "guidance.grounding",
+    "host_capability",
+    "connector.attempt",
+    "state.governance",
+    "narrative.trace",
+    "dream.trace",
+    "body.tool_experience",
+];
+describe("audit-family-registry", () => {
+    it("loads all families from JSON registry", () => {
+        const entries = registryJson.families;
+        const registry = createAuditFamilyRegistry(entries);
+        assert.ok(registry.size >= 10, `Expected >= 10 families, got ${registry.size}`);
+    });
+    it("all expected families are registered", () => {
+        const entries = registryJson.families;
+        const registry = createAuditFamilyRegistry(entries);
+        for (const family of EXPECTED_FAMILIES) {
+            assert.ok(registry.isRegistered(family), `Expected family '${family}' to be registered`);
+        }
+    });
+    it("covers all 8 v7 system IDs", () => {
+        const entries = registryJson.families;
+        const registry = createAuditFamilyRegistry(entries);
+        const systemIds = registry.listSystemIds();
+        for (const id of EXPECTED_SYSTEM_IDS) {
+            assert.ok(systemIds.includes(id), `Expected system ID '${id}' to be covered`);
+        }
+        assert.equal(systemIds.length, 8, "Expected exactly 8 system IDs");
+    });
+    it("rejects unknown family with unknown_audit_family error", () => {
+        const entries = registryJson.families;
+        const registry = createAuditFamilyRegistry(entries);
+        const result = registry.validateFamily("totally.made.up.family");
+        assert.equal(result.ok, false);
+        if (!result.ok) {
+            assert.ok(result.error.startsWith("unknown_audit_family"), `Expected error starting with 'unknown_audit_family', got: ${result.error}`);
+        }
+    });
+    it("accepts registered family", () => {
+        const entries = registryJson.families;
+        const registry = createAuditFamilyRegistry(entries);
+        const result = registry.validateFamily("heartbeat.decision");
+        assert.equal(result.ok, true);
+    });
+    it("getEntry returns correct entry for registered family", () => {
+        const entries = registryJson.families;
+        const registry = createAuditFamilyRegistry(entries);
+        const entry = registry.getEntry("connector.attempt");
+        assert.ok(entry);
+        assert.equal(entry.systemId, "connector-system");
+        assert.equal(entry.plane, "telemetry");
+    });
+    it("getEntry returns undefined for unknown family", () => {
+        const entries = registryJson.families;
+        const registry = createAuditFamilyRegistry(entries);
+        const entry = registry.getEntry("nope.not.here");
+        assert.equal(entry, undefined);
+    });
+    it("familiesForSystem returns correct families", () => {
+        const entries = registryJson.families;
+        const registry = createAuditFamilyRegistry(entries);
+        const guidanceFamilies = registry.familiesForSystem("guidance-voice-system");
+        assert.ok(guidanceFamilies.length >= 2);
+        const familyNames = guidanceFamilies.map((f) => f.family);
+        assert.ok(familyNames.includes("delivery"));
+        assert.ok(familyNames.includes("guidance.grounding"));
+    });
+    it("each registered family has a non-empty description", () => {
+        const entries = registryJson.families;
+        const registry = createAuditFamilyRegistry(entries);
+        for (const entry of registry.listFamilies()) {
+            assert.ok(entry.description.length > 0, `Family '${entry.family}' has empty description`);
+        }
+    });
+});

package/dist/tests/unit/observability/governance-plane-recorder.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/unit/observability/governance-plane-recorder.test.js

@@ -0,0 +1,72 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { eq } from "drizzle-orm";
+import { createObservabilityDatabase } from "../../../src/observability/db/index.js";
+import { createGovernancePlaneRecorder } from "../../../src/observability/services/governance-plane-recorder.js";
+import { executionAttempts, governanceAudit } from "../../../src/observability/db/schema/index.js";
+test("T5.1.2 recordConnectorAttempt writes execution telemetry (failed governance)", async () => {
+    const db = createObservabilityDatabase(":memory:");
+    const plane = createGovernancePlaneRecorder(db);
+    const ack = await plane.recordConnectorAttempt({
+        traceId: "trace-gov-1",
+        decisionId: "dec-1",
+        intentId: "intent-1",
+        platformId: "moltbook",
+        capability: "feed.read",
+        channel: "read_only",
+        outcome: "failed",
+        failureClass: "rate_limited",
+    });
+    assert.ok(ack.recordId.startsWith("ca-trace-gov-1"));
+    const rows = await db.db.select().from(executionAttempts).where(eq(executionAttempts.traceId, "trace-gov-1"));
+    assert.equal(rows.length, 1);
+    assert.equal(rows[0]?.status, "failed");
+    assert.equal(rows[0]?.failureClass, "rate_limited");
+    db.close();
+});
+test("T5.1.2 recordConnectorAttempt sampled telemetry success", async () => {
+    const db = createObservabilityDatabase(":memory:");
+    const plane = createGovernancePlaneRecorder(db);
+    await plane.recordConnectorAttempt({
+        traceId: "trace-gov-2",
+        decisionId: "dec-2",
+        intentId: "intent-2",
+        platformId: "moltbook",
+        capability: "feed.read",
+        channel: "read_only",
+        outcome: "sampled_telemetry",
+    });
+    const rows = await db.db.select().from(executionAttempts).where(eq(executionAttempts.traceId, "trace-gov-2"));
+    assert.equal(rows[0]?.status, "succeeded");
+    db.close();
+});
+test("T5.1.2 recordStateGovernance fallback_written is queryable by traceId", async () => {
+    const db = createObservabilityDatabase(":memory:");
+    const plane = createGovernancePlaneRecorder(db);
+    await plane.recordStateGovernance({
+        id: "gov-fb-1",
+        traceId: "trace-fb-1",
+        kind: "fallback_written",
+        reason: "target_none",
+        decisionId: "dec-fb",
+        supportingSources: ["ref:a"],
+    });
+    const rows = await db.db.select().from(governanceAudit).where(eq(governanceAudit.targetAssetId, "trace-fb-1"));
+    assert.equal(rows.length, 1);
+    assert.equal(rows[0]?.eventType, "fallback_written");
+    assert.ok(String(rows[0]?.reason).includes("dec-fb"));
+    db.close();
+});
+test("T5.1.2 recordStateGovernance effect_commit_advanced", async () => {
+    const db = createObservabilityDatabase(":memory:");
+    const plane = createGovernancePlaneRecorder(db);
+    await plane.recordStateGovernance({
+        id: "gov-ec-1",
+        traceId: "trace-ec-1",
+        kind: "effect_commit_advanced",
+        reason: "committed",
+    });
+    const rows = await db.db.select().from(governanceAudit).where(eq(governanceAudit.targetAssetId, "trace-ec-1"));
+    assert.equal(rows[0]?.eventType, "effect_commit_advanced");
+    db.close();
+});

package/dist/tests/unit/observability/heartbeat-digest-assembler.test.d.ts

@@ -0,0 +1 @@
+export {};