@hasna/skills 0.1.62 → 0.1.63

package/agent-skills/merge-pr/scripts/test_merge_pr_guard.py

@@ -1,647 +0,0 @@
-#!/usr/bin/env python3
-
-from __future__ import annotations
-
-import importlib.util
-import json
-import subprocess
-import sys
-import tempfile
-import unittest
-from datetime import datetime, timezone
-from pathlib import Path
-
-
-SCRIPT = Path(__file__).with_name("merge_pr_guard.py")
-FIXTURES = Path(__file__).parents[1] / "tests" / "fixtures"
-sys.dont_write_bytecode = True
-SPEC = importlib.util.spec_from_file_location("merge_pr_guard", SCRIPT)
-assert SPEC and SPEC.loader
-GUARD = importlib.util.module_from_spec(SPEC)
-SPEC.loader.exec_module(GUARD)
-
-REPO = "hasna/tai"
-PR_NUMBER = 4
-HEAD_SHA = "2797e3264c416018c06608434c0c57340f647330"
-ACCEPTANCE_SCOPE = "skills-merge-trailer-hardening-v1"
-TASK_ID = "fae9ac3b-5af9-4f15-aaca-748e2a5da394"
-
-
-def artifact(identity: str) -> dict[str, object]:
-    return {
-        "repository": REPO,
-        "pr_number": PR_NUMBER,
-        "head_sha": HEAD_SHA,
-        "acceptance_scope": ACCEPTANCE_SCOPE,
-        "reviewer_identity": identity,
-        "timestamp": datetime.now(timezone.utc).isoformat(),
-        "verdict": "approved",
-        "checked_risks_summary": "Checked exact-head merge and message provenance.",
-        "blocking_findings": [],
-    }
-
-
-def preflight(mode: str = "immediate-merge", verdict: str = "mergeable") -> dict[str, object]:
-    snapshot: dict[str, object] = {
-        "task_id": TASK_ID,
-        "mode": mode,
-        "risk_tier": {"declared": "elevated", "effective": "elevated", "source": "explicit"},
-        "acceptance_scope": ACCEPTANCE_SCOPE,
-        "required_reviewer_artifacts": 2,
-        "repair_cycles": {"count": 0, "cap": 2},
-        "verdict": verdict,
-        "repo": REPO,
-        "pr_number": PR_NUMBER,
-        "pr_url": "https://github.com/hasna/tai/pull/4",
-        "base": "main",
-        "head": "hasna:ci/provider-native-validation",
-        "head_sha": HEAD_SHA,
-        "merge_state": {
-            "state": "OPEN",
-            "is_draft": False,
-            "mergeable": "MERGEABLE",
-            "merge_state_status": "CLEAN",
-            "review_decision": "APPROVED",
-        },
-        "checks": [{"name": "ci", "bucket": "pass", "state": "SUCCESS"}],
-        "reviews": [{"author": {"login": "reviewer-a"}, "state": "APPROVED"}],
-        "reviewer_artifacts": [artifact("reviewer-a"), artifact("reviewer-b")],
-        "worker_identity": "worker",
-        "executor_identity": "executor",
-        "branch_policy": {"protected": True, "queue_required": mode == "merge-queue"},
-        "blocking_reasons": [],
-        "warnings": [],
-        "observed_at": datetime.now(timezone.utc).isoformat(),
-    }
-    if verdict == "pending":
-        snapshot["merge_state"]["merge_state_status"] = "UNSTABLE"
-        snapshot["checks"] = [{"name": "ci", "bucket": "pending", "state": "PENDING"}]
-    return snapshot
-
-
-class GuardCliTests(unittest.TestCase):
-    def run_cli(self, *args: str) -> subprocess.CompletedProcess[str]:
-        return subprocess.run(
-            [sys.executable, str(SCRIPT), *args],
-            check=False,
-            text=True,
-            stdout=subprocess.PIPE,
-            stderr=subprocess.PIPE,
-        )
-
-    def build(
-        self,
-        directory: Path,
-        *args: str,
-        snapshot: dict[str, object] | None = None,
-        expected_scope: str = ACCEPTANCE_SCOPE,
-        expected_repair_cycle_count: int = 0,
-    ):
-        snapshot_path = directory / "preflight.json"
-        snapshot_path.write_text(json.dumps(snapshot or preflight()), encoding="utf-8")
-        result = self.run_cli(
-            "build",
-            "--preflight",
-            str(snapshot_path),
-            "--task-id",
-            TASK_ID,
-            "--acceptance-scope",
-            expected_scope,
-            "--repair-cycle-count",
-            str(expected_repair_cycle_count),
-            *args,
-        )
-        return result, json.loads(result.stdout) if result.stdout else None
-
-    def provenance(
-        self, directory: Path, body: str = ""
-    ) -> tuple[Path, Path, dict[str, object]]:
-        result, plan = self.build(
-            directory,
-            "--strategy",
-            "squash",
-            "--subject",
-            "fix: safe",
-            f"--body={body}",
-        )
-        if result.returncode != 0 or not isinstance(plan, dict):
-            raise AssertionError(result.stderr)
-        plan_path = directory / "command-plan.json"
-        plan_path.write_text(json.dumps(plan), encoding="utf-8")
-        return directory / "preflight.json", plan_path, plan
-
-    def postverify_contract_args(
-        self,
-        preflight_path: Path,
-        plan_path: Path,
-        plan: dict[str, object],
-        repo: str = REPO,
-        pr_number: int = PR_NUMBER,
-    ) -> list[str]:
-        return [
-            "--repo",
-            repo,
-            "--pr",
-            str(pr_number),
-            "--task-id",
-            TASK_ID,
-            "--mode",
-            "immediate-merge",
-            "--acceptance-scope",
-            ACCEPTANCE_SCOPE,
-            "--repair-cycle-count",
-            "0",
-            "--expected-base",
-            "main",
-            "--expected-head-sha",
-            HEAD_SHA,
-            "--preflight-sha256",
-            str(plan["preflight_sha256"]),
-            "--command-argv-sha256",
-            str(plan["command_argv_sha256"]),
-            "--preflight",
-            str(preflight_path),
-            "--command-plan",
-            str(plan_path),
-        ]
-
-    def test_multi_commit_squash_builds_explicit_message_and_exact_head_cas(self) -> None:
-        raw = json.loads((FIXTURES / "multi-commit-synthesized.json").read_text(encoding="utf-8"))
-        self.assertEqual(len(raw["source_commits"]), 2)
-        self.assertTrue(all(not GUARD.forbidden_trailer_lines(commit["message"]) for commit in raw["source_commits"]))
-        with tempfile.TemporaryDirectory() as temporary:
-            result, plan = self.build(
-                Path(temporary),
-                "--strategy",
-                "squash",
-                "--subject",
-                "ci: add provider-native validation workflow",
-            )
-        self.assertEqual(result.returncode, 0, result.stderr)
-        argv = plan["argv"]
-        self.assertEqual(argv[:3], ["gh", "pr", "merge"])
-        self.assertIn("--squash", argv)
-        self.assertEqual(argv[argv.index("--subject") + 1], "ci: add provider-native validation workflow")
-        self.assertEqual(argv[argv.index("--body") + 1], "")
-        self.assertEqual(argv[argv.index("--match-head-commit") + 1], HEAD_SHA)
-        self.assertEqual(plan["base"], "main")
-        self.assertEqual(len(plan["preflight_sha256"]), 64)
-        self.assertEqual(len(plan["command_argv_sha256"]), 64)
-        self.assertTrue({"--admin", "--force", "--delete-branch"}.isdisjoint(argv))
-        self.assertNotIn("push", argv)
-
-    def test_omitted_and_explicit_empty_body_are_identical(self) -> None:
-        with tempfile.TemporaryDirectory() as temporary:
-            directory = Path(temporary)
-            omitted, omitted_plan = self.build(directory, "--strategy", "squash", "--subject", "fix: safe")
-            explicit, explicit_plan = self.build(
-                directory, "--strategy", "squash", "--subject", "fix: safe", "--body", ""
-            )
-        self.assertEqual(omitted.returncode, 0)
-        self.assertEqual(explicit.returncode, 0)
-        self.assertEqual(omitted_plan["argv"], explicit_plan["argv"])
-
-    def test_custom_body_normalizes_line_endings_deterministically(self) -> None:
-        with tempfile.TemporaryDirectory() as temporary:
-            result, plan = self.build(
-                Path(temporary),
-                "--strategy",
-                "squash",
-                "--subject",
-                "fix: safe",
-                "--body",
-                "first\r\nsecond\rthird",
-            )
-        self.assertEqual(result.returncode, 0, result.stderr)
-        self.assertEqual(plan["argv"][plan["argv"].index("--body") + 1], "first\nsecond\nthird")
-
-    def test_co_authored_by_case_and_whitespace_variants_are_rejected(self) -> None:
-        variants = [
-            "Co-Authored-By: person <person@example.invalid>",
-            "co-authored-by : person <person@example.invalid>",
-            "\tCO - AUTHORED - BY\t: person <person@example.invalid>",
-            "Co Authored By: person <person@example.invalid>",
-        ]
-        for variant in variants:
-            with self.subTest(variant=variant), tempfile.TemporaryDirectory() as temporary:
-                result, _ = self.build(
-                    Path(temporary),
-                    "--strategy",
-                    "squash",
-                    "--subject",
-                    "fix: safe",
-                    "--body",
-                    f"Summary\n\n{variant}",
-                )
-            self.assertEqual(result.returncode, 2)
-            self.assertIn("forbidden Co-Authored-By trailer", result.stderr)
-
-    def test_co_authored_by_subject_is_rejected(self) -> None:
-        with tempfile.TemporaryDirectory() as temporary:
-            result, _ = self.build(
-                Path(temporary),
-                "--strategy",
-                "squash",
-                "--subject",
-                "CO - AUTHORED - BY : person <person@example.invalid>",
-            )
-        self.assertEqual(result.returncode, 2)
-        self.assertIn("forbidden Co-Authored-By trailer", result.stderr)
-
-    def test_auto_merge_requires_explicit_delayed_intent(self) -> None:
-        with tempfile.TemporaryDirectory() as temporary:
-            directory = Path(temporary)
-            rejected, _ = self.build(
-                directory,
-                "--strategy",
-                "squash",
-                "--subject",
-                "fix: safe",
-                snapshot=preflight("auto-merge"),
-            )
-            accepted, plan = self.build(
-                directory,
-                "--strategy",
-                "squash",
-                "--subject",
-                "fix: safe",
-                "--delayed-intent",
-                snapshot=preflight("auto-merge"),
-            )
-        self.assertEqual(rejected.returncode, 2)
-        self.assertEqual(accepted.returncode, 0, accepted.stderr)
-        self.assertIn("--auto", plan["argv"])
-
-    def test_non_mergeable_or_identity_colliding_preflight_fails_closed(self) -> None:
-        blocked = preflight()
-        blocked["verdict"] = "not_mergeable"
-        collision = preflight()
-        collision["reviewer_artifacts"][0]["reviewer_identity"] = "executor"
-        for snapshot in (blocked, collision):
-            with tempfile.TemporaryDirectory() as temporary:
-                result, _ = self.build(
-                    Path(temporary),
-                    "--strategy",
-                    "squash",
-                    "--subject",
-                    "fix: safe",
-                    snapshot=snapshot,
-                )
-            self.assertEqual(result.returncode, 2)
-
-    def test_missing_worker_or_branch_policy_evidence_fails_closed(self) -> None:
-        missing_worker = preflight()
-        del missing_worker["worker_identity"]
-        missing_policy = preflight()
-        del missing_policy["branch_policy"]
-        for snapshot in (missing_worker, missing_policy):
-            with tempfile.TemporaryDirectory() as temporary:
-                result, _ = self.build(
-                    Path(temporary),
-                    "--strategy",
-                    "squash",
-                    "--subject",
-                    "fix: safe",
-                    snapshot=snapshot,
-                )
-            self.assertEqual(result.returncode, 2)
-
-    def test_missing_review_decision_and_stateless_check_fail_closed(self) -> None:
-        missing_decision = preflight()
-        del missing_decision["merge_state"]["review_decision"]
-        blank_decision = preflight()
-        blank_decision["merge_state"]["review_decision"] = ""
-        invented_decision = preflight()
-        invented_decision["merge_state"]["review_decision"] = "INVENTED"
-        stateless_check = preflight()
-        stateless_check["checks"] = [{}]
-        completed_without_conclusion = preflight()
-        completed_without_conclusion["checks"] = [{"state": "COMPLETED"}]
-        for snapshot in (
-            missing_decision,
-            blank_decision,
-            invented_decision,
-            stateless_check,
-            completed_without_conclusion,
-        ):
-            with tempfile.TemporaryDirectory() as temporary:
-                result, _ = self.build(
-                    Path(temporary),
-                    "--strategy",
-                    "squash",
-                    "--subject",
-                    "fix: safe",
-                    snapshot=snapshot,
-                )
-            self.assertEqual(result.returncode, 2)
-
-    def test_empty_or_conflicting_check_and_review_evidence_fails_closed(self) -> None:
-        empty_checks = preflight()
-        empty_checks["checks"] = []
-        conflicting_check = preflight()
-        conflicting_check["checks"] = [{"bucket": "pass", "state": "invented"}]
-        empty_reviews = preflight()
-        empty_reviews["reviews"] = []
-        malformed_review = preflight()
-        malformed_review["reviews"] = [{"state": "APPROVED"}]
-        blocking_review = preflight()
-        blocking_review["reviews"] = [
-            {"author": {"login": "reviewer-a"}, "state": "CHANGES_REQUESTED"}
-        ]
-        for snapshot in (
-            empty_checks,
-            conflicting_check,
-            empty_reviews,
-            malformed_review,
-            blocking_review,
-        ):
-            with tempfile.TemporaryDirectory() as temporary:
-                result, _ = self.build(
-                    Path(temporary),
-                    "--strategy",
-                    "squash",
-                    "--subject",
-                    "fix: safe",
-                    snapshot=snapshot,
-                )
-            self.assertEqual(result.returncode, 2)
-
-    def test_merge_and_rebase_strategies_have_no_bypass(self) -> None:
-        for strategy in ("merge", "rebase"):
-            with self.subTest(strategy=strategy), tempfile.TemporaryDirectory() as temporary:
-                result, _ = self.build(
-                    Path(temporary),
-                    "--strategy",
-                    strategy,
-                    "--subject",
-                    "fix: safe",
-                )
-            self.assertEqual(result.returncode, 2)
-
-    def test_scope_cycle_and_freshness_are_executor_bound(self) -> None:
-        changed_scope = preflight()
-        changed_scope["acceptance_scope"] = "changed-scope"
-        changed_scope["reviewer_artifacts"][0]["acceptance_scope"] = "changed-scope"
-        changed_scope["reviewer_artifacts"][1]["acceptance_scope"] = "changed-scope"
-        changed_cycle = preflight()
-        changed_cycle["repair_cycles"]["count"] = 1
-        stale = preflight()
-        stale["observed_at"] = "2020-01-01T00:00:00Z"
-        for snapshot in (changed_scope, changed_cycle, stale):
-            with tempfile.TemporaryDirectory() as temporary:
-                result, _ = self.build(
-                    Path(temporary),
-                    "--strategy",
-                    "squash",
-                    "--subject",
-                    "fix: safe",
-                    snapshot=snapshot,
-                )
-            self.assertEqual(result.returncode, 2)
-
-    def test_boolean_counts_and_unicode_equivalent_reviewers_fail_closed(self) -> None:
-        boolean_count = preflight()
-        boolean_count["risk_tier"] = {"declared": "routine", "effective": "routine", "source": "explicit"}
-        boolean_count["required_reviewer_artifacts"] = True
-        boolean_count["repair_cycles"]["cap"] = 1
-        boolean_count["reviewer_artifacts"] = boolean_count["reviewer_artifacts"][:1]
-        boolean_cap = preflight()
-        boolean_cap["risk_tier"] = {"declared": "routine", "effective": "routine", "source": "explicit"}
-        boolean_cap["required_reviewer_artifacts"] = 1
-        boolean_cap["repair_cycles"]["cap"] = True
-        boolean_cap["reviewer_artifacts"] = boolean_cap["reviewer_artifacts"][:1]
-        duplicate_reviewer = preflight()
-        duplicate_reviewer["reviewer_artifacts"][0]["reviewer_identity"] = "reviewer-\u212a"
-        duplicate_reviewer["reviewer_artifacts"][1]["reviewer_identity"] = "reviewer-K"
-        for snapshot in (boolean_count, boolean_cap, duplicate_reviewer):
-            with tempfile.TemporaryDirectory() as temporary:
-                result, _ = self.build(
-                    Path(temporary),
-                    "--strategy",
-                    "squash",
-                    "--subject",
-                    "fix: safe",
-                    snapshot=snapshot,
-                )
-            self.assertEqual(result.returncode, 2)
-
-    def test_stale_artifact_and_failed_check_fail_closed(self) -> None:
-        stale = preflight()
-        stale["reviewer_artifacts"][0]["timestamp"] = "2020-01-01T00:00:00Z"
-        failed_check = preflight()
-        failed_check["checks"] = [{"name": "ci", "bucket": "fail", "state": "FAILURE"}]
-        for snapshot in (stale, failed_check):
-            with tempfile.TemporaryDirectory() as temporary:
-                result, _ = self.build(
-                    Path(temporary),
-                    "--strategy",
-                    "squash",
-                    "--subject",
-                    "fix: safe",
-                    snapshot=snapshot,
-                )
-            self.assertEqual(result.returncode, 2)
-
-    def test_merge_queue_has_exact_head_cas_and_no_strategy_or_mutation_flags(self) -> None:
-        with tempfile.TemporaryDirectory() as temporary:
-            result, plan = self.build(Path(temporary), snapshot=preflight("merge-queue"))
-        self.assertEqual(result.returncode, 0, result.stderr)
-        argv = plan["argv"]
-        self.assertEqual(argv[argv.index("--match-head-commit") + 1], HEAD_SHA)
-        self.assertTrue(
-            {"--squash", "--merge", "--rebase", "--admin", "--force", "--delete-branch", "--auto"}.isdisjoint(argv)
-        )
-
-    def test_pending_merge_queue_requires_delayed_intent_without_auto_flag(self) -> None:
-        pending = preflight("merge-queue", "pending")
-        with tempfile.TemporaryDirectory() as temporary:
-            directory = Path(temporary)
-            rejected, _ = self.build(directory, snapshot=pending)
-            accepted, plan = self.build(directory, "--delayed-intent", snapshot=pending)
-        self.assertEqual(rejected.returncode, 2)
-        self.assertEqual(accepted.returncode, 0, accepted.stderr)
-        self.assertNotIn("--auto", plan["argv"])
-        self.assertIn("--match-head-commit", plan["argv"])
-
-    def test_synthesized_provider_trailer_writes_failed_receipt(self) -> None:
-        with tempfile.TemporaryDirectory() as temporary:
-            directory = Path(temporary)
-            preflight_path, plan_path, plan = self.provenance(directory)
-            receipt = directory / "postverify.json"
-            result = self.run_cli(
-                "postverify",
-                *self.postverify_contract_args(preflight_path, plan_path, plan),
-                "--fixture",
-                str(FIXTURES / "multi-commit-synthesized.json"),
-                "--receipt",
-                str(receipt),
-            )
-            durable = json.loads(receipt.read_text(encoding="utf-8"))
-        self.assertEqual(result.returncode, 1)
-        self.assertEqual(durable["outcome"], "failed")
-        self.assertIn("forbidden_co_authored_by_trailer", durable["failure_reasons"])
-        self.assertTrue(durable["forbidden_trailer_line_numbers"])
-        self.assertNotIn("message", durable)
-        self.assertEqual(durable["evidence_source"], "fixture")
-        self.assertIs(durable["authoritative"], False)
-
-    def test_trailer_free_fixture_is_clean_but_cannot_complete_live_postverify(self) -> None:
-        with tempfile.TemporaryDirectory() as temporary:
-            directory = Path(temporary)
-            preflight_path, plan_path, plan = self.provenance(directory)
-            receipt = directory / "postverify.json"
-            result = self.run_cli(
-                "postverify",
-                *self.postverify_contract_args(preflight_path, plan_path, plan),
-                "--fixture",
-                str(FIXTURES / "trailer-free-provider.json"),
-                "--receipt",
-                str(receipt),
-            )
-            durable = json.loads(receipt.read_text(encoding="utf-8"))
-        self.assertEqual(result.returncode, 1, result.stderr)
-        self.assertEqual(durable["outcome"], "fixture_clean")
-        self.assertEqual(durable["forbidden_trailer_line_numbers"], [])
-        self.assertEqual(durable["message_policy"], "forbidden_co_authored_by_trailer_absent")
-        self.assertEqual(durable["task_id"], TASK_ID)
-        self.assertEqual(durable["mode"], "immediate-merge")
-        self.assertEqual(durable["acceptance_scope"], ACCEPTANCE_SCOPE)
-        self.assertEqual(durable["repair_cycle_count"], 0)
-        self.assertEqual(durable["preflight_sha256"], plan["preflight_sha256"])
-        self.assertEqual(durable["command_argv_sha256"], plan["command_argv_sha256"])
-        self.assertEqual(durable["provider_url"], "https://github.com/hasna/tai/pull/4")
-        self.assertEqual(durable["provider_base"], "main")
-        self.assertEqual(durable["evidence_source"], "fixture")
-        self.assertIs(durable["authoritative"], False)
-
-    def test_fixture_target_mismatch_writes_failed_non_authoritative_receipt(self) -> None:
-        with tempfile.TemporaryDirectory() as temporary:
-            directory = Path(temporary)
-            preflight_path, plan_path, plan = self.provenance(directory)
-            receipt = directory / "postverify.json"
-            result = self.run_cli(
-                "postverify",
-                *self.postverify_contract_args(
-                    preflight_path,
-                    plan_path,
-                    plan,
-                    repo="hasna/not-tai",
-                    pr_number=999,
-                ),
-                "--fixture",
-                str(FIXTURES / "trailer-free-provider.json"),
-                "--receipt",
-                str(receipt),
-            )
-            durable = json.loads(receipt.read_text(encoding="utf-8"))
-        self.assertEqual(result.returncode, 1)
-        self.assertEqual(durable["outcome"], "failed")
-        self.assertNotEqual(durable.get("authoritative"), True)
-
-    def test_postverify_recomputes_preflight_and_rejects_plan_provenance_mismatch(self) -> None:
-        with tempfile.TemporaryDirectory() as temporary:
-            directory = Path(temporary)
-            preflight_path, plan_path, plan = self.provenance(directory)
-            plan["preflight_sha256"] = "f" * 64
-            plan_path.write_text(json.dumps(plan), encoding="utf-8")
-            receipt = directory / "postverify.json"
-            result = self.run_cli(
-                "postverify",
-                *self.postverify_contract_args(preflight_path, plan_path, plan),
-                "--fixture",
-                str(FIXTURES / "trailer-free-provider.json"),
-                "--receipt",
-                str(receipt),
-            )
-            durable = json.loads(receipt.read_text(encoding="utf-8"))
-        self.assertEqual(result.returncode, 1)
-        self.assertEqual(durable["outcome"], "failed")
-        self.assertIs(durable["authoritative"], False)
-
-    def test_postverify_rejects_command_plan_argv_mutation(self) -> None:
-        with tempfile.TemporaryDirectory() as temporary:
-            directory = Path(temporary)
-            preflight_path, plan_path, plan = self.provenance(directory)
-            plan["argv"].append("--admin")
-            plan_path.write_text(json.dumps(plan), encoding="utf-8")
-            receipt = directory / "postverify.json"
-            result = self.run_cli(
-                "postverify",
-                *self.postverify_contract_args(preflight_path, plan_path, plan),
-                "--fixture",
-                str(FIXTURES / "trailer-free-provider.json"),
-                "--receipt",
-                str(receipt),
-            )
-            durable = json.loads(receipt.read_text(encoding="utf-8"))
-        self.assertEqual(result.returncode, 1)
-        self.assertEqual(durable["outcome"], "failed")
-        self.assertIs(durable["authoritative"], False)
-
-    def test_postverify_rejects_saved_subject_or_body_mutation(self) -> None:
-        for option in ("--subject", "--body"):
-            with self.subTest(option=option), tempfile.TemporaryDirectory() as temporary:
-                directory = Path(temporary)
-                preflight_path, plan_path, plan = self.provenance(directory)
-                option_index = plan["argv"].index(option)
-                plan["argv"][option_index + 1] = "changed but trailer-free"
-                plan_path.write_text(json.dumps(plan), encoding="utf-8")
-                receipt = directory / "postverify.json"
-                result = self.run_cli(
-                    "postverify",
-                    *self.postverify_contract_args(preflight_path, plan_path, plan),
-                    "--fixture",
-                    str(FIXTURES / "trailer-free-provider.json"),
-                    "--receipt",
-                    str(receipt),
-                )
-                durable = json.loads(receipt.read_text(encoding="utf-8"))
-            self.assertEqual(result.returncode, 1)
-            self.assertEqual(durable["outcome"], "failed")
-            self.assertTrue(
-                any("command argv digest mismatch" in reason for reason in durable["failure_reasons"])
-            )
-            self.assertIs(durable["authoritative"], False)
-
-    def test_postverify_persists_failed_receipt_for_non_utf8_plan(self) -> None:
-        with tempfile.TemporaryDirectory() as temporary:
-            directory = Path(temporary)
-            preflight_path, plan_path, plan = self.provenance(directory)
-            plan_path.write_bytes(b"\xff")
-            receipt = directory / "postverify.json"
-            result = self.run_cli(
-                "postverify",
-                *self.postverify_contract_args(preflight_path, plan_path, plan),
-                "--fixture",
-                str(FIXTURES / "trailer-free-provider.json"),
-                "--receipt",
-                str(receipt),
-            )
-            durable = json.loads(receipt.read_text(encoding="utf-8"))
-        self.assertEqual(result.returncode, 1)
-        self.assertEqual(durable["outcome"], "failed")
-        self.assertIs(durable["authoritative"], False)
-        self.assertNotIn("Traceback", result.stderr)
-
-    def test_literal_command_words_remain_custom_body_data(self) -> None:
-        for body in ("push", "--admin"):
-            with self.subTest(body=body), tempfile.TemporaryDirectory() as temporary:
-                directory = Path(temporary)
-                preflight_path, plan_path, plan = self.provenance(directory, body)
-                receipt = directory / "postverify.json"
-                result = self.run_cli(
-                    "postverify",
-                    *self.postverify_contract_args(preflight_path, plan_path, plan),
-                    "--fixture",
-                    str(FIXTURES / "trailer-free-provider.json"),
-                    "--receipt",
-                    str(receipt),
-                )
-                durable = json.loads(receipt.read_text(encoding="utf-8"))
-            self.assertEqual(result.returncode, 1)
-            self.assertEqual(durable["outcome"], "fixture_clean")
-            self.assertIs(durable["authoritative"], False)
-
-
-if __name__ == "__main__":
-    unittest.main()

package/agent-skills/merge-pr/tests/fixtures/multi-commit-synthesized.json

@@ -1,28 +0,0 @@
-{
-  "pr_view": {
-    "state": "MERGED",
-    "mergedAt": "2026-07-23T15:36:23Z",
-    "mergeCommit": {
-      "oid": "03b55df060fa034ad31a67fa14d35be81297f59c"
-    },
-    "headRefOid": "2797e3264c416018c06608434c0c57340f647330",
-    "baseRefName": "main",
-    "url": "https://github.com/hasna/tai/pull/4"
-  },
-  "source_commits": [
-    {
-      "oid": "5d38cd4fe95556a06f7d9f31481ce88c8bb78e85",
-      "message": "ci: add provider-native validation workflow"
-    },
-    {
-      "oid": "2797e3264c416018c06608434c0c57340f647330",
-      "message": "ci: disable setup action cache and token"
-    }
-  ],
-  "commit": {
-    "sha": "03b55df060fa034ad31a67fa14d35be81297f59c",
-    "commit": {
-      "message": "ci: add provider-native validation workflow (#4)\n\n* ci: add provider-native validation workflow\n\n* ci: disable setup action cache and token\n\n---------\n\nCo-authored-by: fixture-user <fixture@example.invalid>"
-    }
-  }
-}