@haposoft/cafekit 0.16.0-rc.3 → 0.16.0-rc.4

package/bin/__tests__/specs-v2-execution-closeout.test.js

@@ -0,0 +1,421 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const test = require('node:test');
+
+const ROOT = path.resolve(__dirname, '../..');
+const SCRIPTS = path.join(ROOT, 'src/claude/scripts');
+const POLICY = require(path.join(SCRIPTS, 'workflow-policy.cjs'));
+const PROVENANCE = require(path.join(SCRIPTS, 'provenance.cjs'));
+const RECEIPT = require(path.join(SCRIPTS, 'spec-receipt.cjs'));
+const SCAFFOLD = path.join(SCRIPTS, 'spec-scaffold.cjs');
+const VALIDATOR = path.join(SCRIPTS, 'validate-spec-output.cjs');
+const SEMANTIC_MODEL = require(path.join(SCRIPTS, 'spec-semantic-model.cjs'));
+const CLAUDE_CHECK = require(path.join(ROOT, 'src/claude/hooks/completion-authority-check.cjs'));
+const CODEX_CHECK = require(path.join(ROOT, 'src/codex/hooks/completion-authority-check.cjs'));
+const FEATURE = 'closeout-demo';
+const TASK = 'tasks/task-R1-01-closeout.md';
+const TEMP_RUN_ID = String(process.env.CAFEKIT_CLOSEOUT_TEMP_RUN_ID || `${process.pid}-${Date.now()}`)
+  .replace(/[^a-zA-Z0-9_-]/g, '-');
+const TEMP_PREFIX = `cafekit-v2-closeout-owned-${TEMP_RUN_ID}`;
+
+function withTempResources(callback) {
+  const ownedPaths = [];
+  const originalHome = Object.hasOwn(process.env, 'HOME')
+    ? { present: true, value: process.env.HOME }
+    : { present: false };
+  function ownedDirectory(label) {
+    const directory = fs.mkdtempSync(path.join(os.tmpdir(), `${TEMP_PREFIX}-${label}-`));
+    ownedPaths.push(directory);
+    return directory;
+  }
+  const resources = {
+    directory: ownedDirectory,
+    useHome(label) {
+      const directory = ownedDirectory(label);
+      process.env.HOME = directory;
+      return directory;
+    },
+  };
+  try {
+    return callback(resources);
+  } finally {
+    if (originalHome.present) process.env.HOME = originalHome.value;
+    else delete process.env.HOME;
+    for (const ownedPath of ownedPaths.reverse()) {
+      fs.rmSync(ownedPath, { recursive: true, force: true });
+    }
+  }
+}
+
+test('temp resource scope cleans exact owned paths and restores HOME after failure', () => {
+  const originalHome = Object.hasOwn(process.env, 'HOME')
+    ? { present: true, value: process.env.HOME }
+    : { present: false };
+  let root;
+  let home;
+  assert.throws(() => withTempResources((resources) => {
+    root = resources.directory('failure-root');
+    home = resources.useHome('failure-home');
+    throw new Error('intentional resource-scope failure');
+  }), /intentional resource-scope failure/);
+  assert.equal(fs.existsSync(root), false);
+  assert.equal(fs.existsSync(home), false);
+  assert.equal(Object.hasOwn(process.env, 'HOME'), originalHome.present);
+  if (originalHome.present) assert.equal(process.env.HOME, originalHome.value);
+});
+
+function gitRoot(resources) {
+  const root = resources.directory('git-root');
+  for (const args of [['init', '-q'], ['config', 'user.email', 'test@example.invalid'], ['config', 'user.name', 'Test'], ['commit', '--allow-empty', '-qm', 'base']]) {
+    const result = spawnSync('git', ['-C', root, ...args], { encoding: 'utf8' });
+    assert.equal(result.status, 0, result.stderr);
+  }
+  return root;
+}
+
+function runtime(root, session = 'execution-session') {
+  return PROVENANCE.deriveRuntimeContext({
+    projectRoot: root,
+    specsRoot: path.join(root, 'specs'),
+    specFile: path.join(root, 'specs', FEATURE, 'spec.json'),
+    featureName: FEATURE,
+    runtimeSession: session,
+  });
+}
+
+function receiptBody(ctx, extra = '') {
+  return [
+    'Verification: PASS',
+    'Command: node --test',
+    'Exit: 0',
+    'Result: PASS',
+    'Expected: focused verification passes',
+    'Observed: focused verification passed',
+    `Base: ${ctx.base}`,
+    `Head: ${ctx.head}`,
+    extra,
+  ].filter(Boolean).join('\n') + '\n';
+}
+
+function prepareCanonicalTaskless(root, { specStatus, featureReceipt }) {
+  const scaffold = spawnSync(process.execPath, [SCAFFOLD, FEATURE, '--title', 'Closeout fixture'], { cwd: root, encoding: 'utf8' });
+  assert.equal(scaffold.status, 0, scaffold.stderr);
+  const featureDir = path.join(root, 'specs', FEATURE);
+  fs.mkdirSync(path.join(root, 'src'), { recursive: true });
+  fs.mkdirSync(path.join(root, 'test'), { recursive: true });
+  fs.writeFileSync(path.join(root, 'src/final-state.js'), 'module.exports = { ready: true };\n');
+  fs.writeFileSync(path.join(root, 'test/final-state.test.js'), "require('node:test')('final state', () => {});\n");
+  fs.writeFileSync(path.join(featureDir, 'requirements.md'), `# Requirements
+
+## Requirements
+### Requirement 1: Closeout state
+- **R1.1**: When closeout is requested, the system shall accept current validated state and reject stale semantic state.
+- **R1.2**: The system shall prove the current digest through the grounded final-state boundary.
+`);
+  fs.writeFileSync(path.join(featureDir, 'design.md'), `# Design
+
+## Architecture
+The final-state authority recomputes current semantic state before closeout.
+
+## Typed Anchors
+| ID | Type | Target | Role | Access | Action |
+|---|---|---|---|---|---|
+| A-D-01 | file | \`src/final-state.js\` | design boundary | read | read |
+| A-D-02 | file | \`test/final-state.test.js\` | separate proof boundary | read | read |
+
+## Canonical Contracts & Invariants
+### D1 — Current-state decision
+The current persisted artifacts are authoritative.
+### I1 — Stale-state invariant
+A changed semantic artifact cannot retain readiness.
+### C1 — Closeout contract
+Only a validated and grounded current digest reaches closeout.
+
+## Verification Definitions
+- **V1**: Subject criteria R1.1; Subject owner A-D-01; Proof criteria R1.2; Proof owner A-D-02; Evidence anchor A-D-02; Decision refs D1, I1, C1; Method inspection \`src/final-state.js\` via A-D-01; Expected current validated state reaches closeout with the reviewed digest; Negative/failure stale semantic state is rejected before execution closeout; Reachability/grounding entrypoint \`src/final-state.js\` via A-D-01, A-D-02.
+
+## Verification
+R1.1 and R1.2 are verified by V1 against D1, I1, and C1.
+`);
+  const specPath = path.join(featureDir, 'spec.json');
+  const spec = JSON.parse(fs.readFileSync(specPath, 'utf8'));
+  spec.authoring.requirements = 'validated';
+  spec.authoring.design = 'validated';
+  spec.validation.status = 'completed';
+  spec.validation.semantic_review = {
+    status: 'completed', semantic_digest: null, reviewed_criteria: ['R1.1', 'R1.2'],
+    counterexamples: [{
+      criterion: 'R1.1', case_kind: 'failure',
+      scenario: 'A requirements artifact changes after the reviewed digest was recorded.',
+      expected: 'Final-state authority rejects closeout until the current digest is reviewed.',
+      decision_refs: ['D1', 'I1', 'C1'], verification_ref: 'V1',
+    }, {
+      criterion: 'R1.2', case_kind: 'adversarial',
+      scenario: 'A closeout supplies execution provenance while retaining a digest for older authored artifacts.',
+      expected: 'Final-state authority rejects the stale digest despite valid execution provenance.',
+      decision_refs: ['D1', 'I1', 'C1'], verification_ref: 'V1',
+    }],
+  };
+  const projection = SEMANTIC_MODEL.modelFromMarkdown(featureDir, spec);
+  assert.deepEqual(projection.errors, []);
+  spec.semantic_model = projection.model;
+  fs.writeFileSync(specPath, `${JSON.stringify(spec, null, 2)}\n`);
+  const digest = spawnSync(process.execPath, [VALIDATOR, featureDir, '--semantic-digest'], { cwd: root, encoding: 'utf8' });
+  assert.equal(digest.status, 0, `${digest.stdout}\n${digest.stderr}`);
+  spec.validation.semantic_review.semantic_digest = digest.stdout.trim();
+  spec.ready_for_implementation = true;
+  spec.status = specStatus === 'complete' ? 'done' : specStatus;
+  delete spec.current_phase;
+  delete spec.phase;
+  fs.writeFileSync(specPath, `${JSON.stringify(spec, null, 2)}\n`);
+  const ctx = runtime(root);
+  if (featureReceipt) fs.writeFileSync(path.join(featureDir, 'feature-receipt.md'), receiptBody(ctx, `Feature: ${FEATURE}`));
+  return { featureDir, ctx };
+}
+
+function prepare(root, { taskless = false, specStatus = 'in_progress', taskStatus = 'done', taskReceipt = true, legacy = false, featureReceipt = false } = {}) {
+  if (taskless) return prepareCanonicalTaskless(root, { specStatus, featureReceipt });
+  const featureDir = path.join(root, 'specs', FEATURE);
+  fs.mkdirSync(path.join(featureDir, 'tasks'), { recursive: true });
+  const policy = POLICY.canonicalWorkflowPolicySnapshot({ planning_depth: 'Compact', assurance_level: 'Routine' });
+  const spec = {
+    status: specStatus === 'complete' ? 'in_progress' : specStatus,
+    current_phase: specStatus === 'complete' ? 'closeout' : 'implementation',
+    feature_name: FEATURE, workflow_policy: policy, task_registry: {},
+  };
+  if (!taskless) spec.task_registry[TASK] = { status: taskStatus, completed_at: '2026-08-13T00:00:00.000Z', dependencies: [] };
+  fs.writeFileSync(path.join(featureDir, 'spec.json'), JSON.stringify(spec));
+  const ctx = runtime(root);
+  if (!taskless) {
+    const plan = [
+      '# Task R1-01: closeout', `**Status:** ${taskStatus}`, '## Outcome', 'Closeout works.',
+      '## Verification Plan', '- **Command:** `node --test`', '- **Expected:** focused verification passes',
+      '- **Negative path:** not relevant', '- **Reachability:** not relevant',
+    ].join('\n') + (legacy ? `\n## Evidence\n\n${receiptBody(ctx)}` : '\n');
+    fs.writeFileSync(path.join(featureDir, TASK), plan);
+    if (taskReceipt) {
+      fs.mkdirSync(path.join(featureDir, 'receipts'), { recursive: true });
+      fs.writeFileSync(path.join(featureDir, 'receipts', path.basename(TASK)), receiptBody(ctx, `Task: ${path.basename(TASK)}\nTask path: ${TASK}`));
+    }
+  }
+  if (featureReceipt) fs.writeFileSync(path.join(featureDir, 'feature-receipt.md'), receiptBody(ctx, `Feature: ${FEATURE}`));
+  return { featureDir, ctx };
+}
+
+function installGate(root, kind) {
+  const runtimeDir = path.join(root, kind === 'claude' ? '.claude' : '.codex');
+  fs.mkdirSync(path.join(runtimeDir, 'hooks'), { recursive: true });
+  fs.mkdirSync(path.join(runtimeDir, 'hooks', 'lib'), { recursive: true });
+  fs.mkdirSync(path.join(runtimeDir, 'scripts'), { recursive: true });
+  for (const name of [
+    'workflow-policy.cjs', 'provenance.cjs', 'spec-resolver.cjs', 'spec-receipt.cjs',
+    'validate-spec-output.cjs', 'spec-ground.cjs', 'spec-semantic-model.cjs', 'spec-final-state.cjs',
+  ]) {
+    fs.copyFileSync(path.join(SCRIPTS, name), path.join(runtimeDir, 'scripts', name));
+  }
+  if (kind === 'claude') {
+    for (const name of [
+      'spec-gate.cjs', 'completion-authority-check.cjs', 'completion-authority-state.cjs',
+      'semantic-review-authority.cjs',
+    ]) fs.copyFileSync(path.join(ROOT, 'src/claude/hooks', name), path.join(runtimeDir, 'hooks', name));
+  } else {
+    fs.cpSync(path.join(ROOT, 'src/codex/hooks'), path.join(runtimeDir, 'hooks'), { recursive: true });
+  }
+  // The real installer materializes this canonical helper for both adapters.
+  // Keep this narrow runtime fixture faithful to the same dependency closure.
+  fs.copyFileSync(
+    path.join(ROOT, 'src/claude/hooks/lib/runtime-path-safety.cjs'),
+    path.join(runtimeDir, 'hooks/lib/runtime-path-safety.cjs'),
+  );
+  return path.join(runtimeDir, 'hooks/spec-gate.cjs');
+}
+
+function gate(root, kind) {
+  const home = path.join(root, '.claude', 'hooks', '.logs', 'test-home');
+  fs.mkdirSync(home, { recursive: true });
+  const hook = installGate(root, kind);
+  const featureReceipt = path.join(root, 'specs', FEATURE, 'feature-receipt.md');
+  if (fs.existsSync(featureReceipt)) {
+    const current = runtime(root);
+    fs.writeFileSync(featureReceipt, receiptBody(current, `Feature: ${FEATURE}`));
+    assert.deepEqual(RECEIPT.checkFeatureReceipt(path.dirname(featureReceipt), current, POLICY).failures, []);
+  }
+  const result = spawnSync(process.execPath, [hook], {
+    cwd: root,
+    env: { ...process.env, HOME: home, USERPROFILE: home, ...(kind === 'claude' ? { CLAUDE_PROJECT_DIR: root } : {}) },
+    input: JSON.stringify({ cwd: root, session_id: 'execution-session', hook_event_name: 'Stop', stop_hook_active: false }),
+    encoding: 'utf8',
+  });
+  assert.equal(result.status, 0, result.stderr);
+  return result.stdout.trim();
+}
+
+test('separate receipt passes; missing, traversal, symlink, and conflicting legacy proof fail closed', () => {
+  withTempResources((resources) => {
+    const root = gitRoot(resources);
+    const { featureDir, ctx } = prepare(root);
+    assert.deepEqual(RECEIPT.checkTaskReceipt(featureDir, TASK, { completed_at: '2026-08-13T00:00:00.000Z' }, ctx, POLICY).failures, []);
+    fs.unlinkSync(path.join(featureDir, 'receipts', path.basename(TASK)));
+    assert.ok(RECEIPT.checkTaskReceipt(featureDir, TASK, { completed_at: '2026-08-13T00:00:00.000Z' }, ctx, POLICY).failures.includes('missing_receipt'));
+    assert.equal(RECEIPT.canonicalTaskReceiptPath('../task-x.md'), null);
+    const outside = path.join(root, 'outside.md');
+    fs.writeFileSync(outside, receiptBody(ctx));
+    fs.mkdirSync(path.join(featureDir, 'receipts'), { recursive: true });
+    fs.symlinkSync(outside, path.join(featureDir, 'receipts', path.basename(TASK)));
+    assert.ok(RECEIPT.checkTaskReceipt(featureDir, TASK, { completed_at: '2026-08-13T00:00:00.000Z' }, ctx, POLICY).failures.includes('unsafe_path'));
+    fs.unlinkSync(path.join(featureDir, 'receipts', path.basename(TASK)));
+    const taskFile = path.join(featureDir, TASK);
+    fs.appendFileSync(taskFile, `\n## Evidence\n\n${receiptBody(ctx)}`);
+    assert.equal(RECEIPT.checkTaskReceipt(featureDir, TASK, { completed_at: '2026-08-13T00:00:00.000Z' }, ctx, POLICY).source, 'legacy');
+    fs.writeFileSync(path.join(featureDir, 'receipts', path.basename(TASK)), receiptBody(ctx, `Task: ${path.basename(TASK)}\nTask path: ${TASK}`).replace('Command: node --test', 'Command: node --test changed'));
+    assert.ok(RECEIPT.checkTaskReceipt(featureDir, TASK, { completed_at: '2026-08-13T00:00:00.000Z' }, ctx, POLICY).failures.includes('receipt_conflict'));
+  });
+});
+
+test('Claude and Codex gates require task proof at every Stop and feature proof only at durable closeout', () => {
+  withTempResources((resources) => {
+    for (const kind of ['claude', 'codex']) {
+      const early = gitRoot(resources);
+      const invalidAlias = gitRoot(resources);
+      const taskless = gitRoot(resources);
+      const taskBearing = gitRoot(resources);
+      prepare(early, { taskless: true, specStatus: 'in_progress' });
+      assert.equal(gate(early, kind), '', `${kind} pre-closeout`);
+      const { featureDir: invalidAliasDir } = prepare(invalidAlias, { taskless: true, specStatus: 'in_progress' });
+      const invalidAliasFile = path.join(invalidAliasDir, 'spec.json');
+      const invalidAliasSpec = JSON.parse(fs.readFileSync(invalidAliasFile, 'utf8'));
+      invalidAliasSpec.status = 'completed';
+      fs.writeFileSync(invalidAliasFile, `${JSON.stringify(invalidAliasSpec, null, 2)}\n`);
+      assert.match(gate(invalidAlias, kind), /spec status is invalid: completed/, `${kind} rejects legacy aliases in schema 2.1`);
+      prepare(taskless, { taskless: true, specStatus: 'complete', featureReceipt: true });
+      assert.equal(gate(taskless, kind), '', `${kind} taskless closeout`);
+      fs.appendFileSync(path.join(taskless, 'specs', FEATURE, 'requirements.md'), '\nSemantic mutation after review.\n');
+      assert.match(gate(taskless, kind), /validation failed|semantic digest|stale/i, `${kind} rejects stale semantics with unchanged execution provenance`);
+      prepare(taskBearing, { taskReceipt: false, featureReceipt: false });
+      assert.match(gate(taskBearing, kind), new RegExp(path.basename(TASK)), `${kind} unproven done task before closeout`);
+      prepare(taskBearing, { taskReceipt: true, featureReceipt: false });
+      assert.equal(gate(taskBearing, kind), '', `${kind} proven done task before closeout`);
+      assert.equal(fs.existsSync(path.join(taskBearing, 'specs', FEATURE, 'feature-receipt.md')), false);
+      prepare(taskBearing, { specStatus: 'complete', featureReceipt: false });
+      assert.match(gate(taskBearing, kind), /feature-receipt\.md/);
+      prepare(taskBearing, { specStatus: 'complete', featureReceipt: true });
+      assert.equal(gate(taskBearing, kind), '');
+      fs.appendFileSync(path.join(taskBearing, 'specs', FEATURE, 'receipts', path.basename(TASK)), 'Exit: 1\n');
+      assert.match(gate(taskBearing, kind), new RegExp(path.basename(TASK)));
+    }
+  });
+});
+
+test('an unproven done dependency cannot advance a dependent task', () => {
+  withTempResources((resources) => {
+    for (const kind of ['claude', 'codex']) {
+      const root = gitRoot(resources);
+      const { featureDir } = prepare(root, { taskReceipt: false });
+      const dependent = 'tasks/task-R1-02-dependent.md';
+      const specFile = path.join(featureDir, 'spec.json');
+      const spec = JSON.parse(fs.readFileSync(specFile, 'utf8'));
+      spec.task_registry[dependent] = { status: 'pending', completed_at: null, dependencies: [TASK] };
+      fs.writeFileSync(specFile, JSON.stringify(spec));
+      fs.writeFileSync(path.join(featureDir, dependent), '# Task R1-02: dependent\n\n**Status:** pending\n');
+      const blocked = gate(root, kind);
+      assert.match(blocked, new RegExp(path.basename(TASK)), `${kind} must reject the unproven done dependency`);
+      assert.equal(JSON.parse(fs.readFileSync(specFile, 'utf8')).task_registry[dependent].status, 'pending');
+    }
+  });
+});
+
+test('completion authority supports taskless v2 and binds task plan plus receipt bytes', () => {
+  for (const [kind, checker] of [['claude', CLAUDE_CHECK], ['codex', CODEX_CHECK]]) {
+    withTempResources((resources) => {
+      const root = gitRoot(resources);
+      resources.useHome(`${kind}-home`);
+      prepare(root, { taskless: true, specStatus: 'complete', featureReceipt: true });
+      const args = { policy: POLICY, projectRoot: root, runtime: {}, payload: { session_id: 'execution-session' } };
+      if (kind === 'claude') args.resolver = require(path.join(SCRIPTS, 'spec-resolver.cjs'));
+      const result = checker.evaluateCloseout(args);
+      assert.equal(result.ok, true, result.reason);
+      assert.match(result.binding.feature_receipt_digest, /^[a-f0-9]{64}$/);
+    });
+  }
+});
+
+test('shared taskless terminal predicate requires canonical 2.1 policy and physical tasklessness', () => {
+  withTempResources((resources) => {
+    const root = gitRoot(resources);
+    const { featureDir } = prepare(root, { taskless: true, specStatus: 'complete' });
+    const specPath = path.join(featureDir, 'spec.json');
+    const canonical = JSON.parse(fs.readFileSync(specPath, 'utf8'));
+    assert.equal(POLICY.isCanonicalTasklessTerminalSpec(canonical, featureDir), true);
+
+    const legacy = {
+      ...canonical,
+      schema_version: '2.0',
+      workflow_policy: POLICY.workflowPolicySnapshot({ planning_depth: 'Compact', assurance_level: 'Routine' }),
+    };
+    assert.equal(POLICY.isCanonicalTasklessTerminalSpec(legacy, featureDir), false);
+
+    fs.mkdirSync(path.join(featureDir, 'tasks'), { recursive: true });
+    fs.writeFileSync(path.join(featureDir, 'tasks', 'hidden.md'), '# physical task\n');
+    assert.equal(POLICY.isCanonicalTasklessTerminalSpec(canonical, featureDir), false);
+  });
+});
+
+test('completion authority activates only at durable closeout and honors the Stop loop guard', () => {
+  for (const [kind, checker] of [['claude', CLAUDE_CHECK], ['codex', CODEX_CHECK]]) {
+    withTempResources((resources) => {
+      const root = gitRoot(resources);
+      resources.useHome(`${kind}-home`);
+      prepare(root, { featureReceipt: false });
+      const args = { policy: POLICY, projectRoot: root, runtime: {}, payload: { session_id: 'execution-session' } };
+      if (kind === 'claude') args.resolver = require(path.join(SCRIPTS, 'spec-resolver.cjs'));
+      const inactive = checker.evaluateCloseout(args);
+      assert.equal(inactive.ok, true, inactive.reason);
+      assert.equal(inactive.active, false);
+
+      args.payload.stop_hook_active = true;
+      const loop = checker.evaluateCloseout(args);
+      assert.equal(loop.ok, true, loop.reason);
+      assert.equal(loop.active, false);
+
+      prepare(root, { specStatus: 'complete', featureReceipt: false });
+      args.payload.stop_hook_active = false;
+      const blocked = checker.evaluateCloseout(args);
+      assert.equal(blocked.ok, false);
+      assert.match(blocked.reason, /feature-receipt\.md/);
+    });
+  }
+});
+
+test('v2 floor merge keeps axes independent, planning controls artifact profile, and risks raise assurance floor', () => {
+  const policy = {
+    PLANNING_DEPTHS: ['None', 'Compact', 'Full'], ASSURANCE_LEVELS: ['Routine', 'Elevated', 'Strict'],
+    compatibilityLane: POLICY.compatibilityLane, planningObligationsFor: POLICY.planningObligationsFor,
+    obligationsForAssurance: POLICY.obligationsForAssurance, actorNeedsFor: POLICY.actorNeedsFor,
+    classifyLane: POLICY.classifyLane,
+  };
+  const floor = { version: '2', planning_depth: 'Full', automatic_planning_depth: 'Full', assurance_level: 'Routine', automatic_assurance_level: 'Routine', lane: 'Standard', automatic_lane: 'Standard', risks: [], artifact_profile: 'strict', planning_obligations: [], proof_obligations: [], actor_needs: [] };
+  const current = { ...floor, planning_depth: 'Compact', automatic_planning_depth: 'Compact', risks: ['privacy'], artifact_profile: 'bounded' };
+  for (const checker of [CLAUDE_CHECK, CODEX_CHECK]) {
+    const merged = checker.mergePolicyFloor(policy, floor, current);
+    assert.equal(merged.planning_depth, 'Full');
+    assert.equal(merged.artifact_profile, 'strict');
+    assert.equal(merged.automatic_assurance_level, 'Elevated');
+    assert.equal(merged.assurance_level, 'Elevated');
+    assert.ok(merged.proof_obligations.includes('needsExecutionProof'));
+  }
+});
+
+test('scaffold creates planning artifacts but no task or feature receipts', () => {
+  withTempResources((resources) => {
+    const root = resources.directory('scaffold-root');
+    const result = spawnSync(process.execPath, [path.join(SCRIPTS, 'spec-scaffold.cjs'), 'no-receipt', '--specs-root', 'specs'], { cwd: root, encoding: 'utf8' });
+    assert.equal(result.status, 0, result.stderr);
+    const files = fs.readdirSync(path.join(root, 'specs', 'no-receipt'), { recursive: true }).map(String);
+    assert.equal(files.some((file) => file.includes('receipt')), false);
+  });
+});