@intentic/sandbox-contract 1.176.2 → 1.209.0

package/src/workflow-faults.ts

@@ -0,0 +1,188 @@
+/* WHY A WORKFLOW GRAPH IS NOT RUNNABLE — the rules that `WorkflowSchema` cannot state, because each of them is
+ * about the graph rather than about one field.
+ *
+ * A rule per function, so the reason a graph is refused reads as one sentence in one place. They are
+ * concatenated in the order the user meets them: what is wrong with the ids, then what is wrong with each step,
+ * then what is wrong BETWEEN steps.
+ */
+
+import { duplicateOutputFieldNames } from "./output-fields.js";
+import type { Workflow, WorkflowStep } from "./schemas.js";
+
+// One id, one node: the scheduler keys needs, runs and the drawn graph by it, so a repeat makes the same node
+// mean two things.
+const duplicateIdFaults = (steps: readonly WorkflowStep[]): string[] => {
+    const seen = new Set<string>();
+    const faults: string[] = [];
+    for (const step of steps) {
+        if (seen.has(step.id)) {
+            faults.push(`Two steps share the id "${step.id}".`);
+        }
+        seen.add(step.id);
+    }
+    return faults;
+};
+
+// A step that continues a session needs exactly one session to continue. Zero (a root) has nothing to carry on
+// from; two would have to pick, and picking silently is how a workflow quietly drops half its context.
+const continuesOneSession = (step: WorkflowStep): boolean => step.handoff === "continue" && step.needs.length === 1;
+
+// What is wrong with this step on its own, given the ids the workflow actually has.
+const stepFaults = (step: WorkflowStep, ids: ReadonlySet<string>): string[] => {
+    const faults = step.needs
+        .filter((need) => !ids.has(need))
+        .map((need) => `"${step.title}" waits for "${need}", which is not a step in this workflow.`);
+    if (step.needs.includes(step.id)) {
+        faults.push(`"${step.title}" waits for itself.`);
+    }
+    if (step.handoff === "continue" && !continuesOneSession(step)) {
+        faults.push(
+            step.needs.length === 0
+                ? `"${step.title}" continues a session but starts the run — there is nothing to continue.`
+                : `"${step.title}" continues a session but waits for ${step.needs.length} steps; it can only continue one.`,
+        );
+    }
+    if (step.output.kind === "json") {
+        faults.push(
+            ...duplicateOutputFieldNames(step.output.fields).map(
+                (name) => `"${step.title}" declares the output field "${name}" more than once; field names must be unique.`,
+            ),
+        );
+    }
+    /* A STEP THAT DECLARES NOTHING IS NOT A FAULT — it is the ordinary step, and this used to refuse it.
+     *
+     * The rule was borrowed from loops (`loopCanConverge`), where it is right: a LOOP is started to repeat
+     * until something is true, so one with nothing to produce and nothing to check has no reason to run twice
+     * and the dialog is correct to grey out its button. A STEP is not started to repeat. It is one agent
+     * session with a job, and the job being done is the turn ending — which is exactly what the loop machinery
+     * already does with it (loop-stop's `readDocument` answers `done` for a `none` output, so iteration 1 is
+     * the only iteration).
+     *
+     * Keeping the rule here forced every step to declare an output or a check before the graph would save, and
+     * the cheapest way to satisfy it was a `claim` — which buys a verdict file nobody reads, a page of contract
+     * in the prompt, and a way for a step that did the work to fail for not having described it.
+     */
+    return faults;
+};
+
+/* Two steps continuing the SAME session is the one graph that is legal on paper and broken in practice: both
+ * would run on one conversation, in parallel, against one worktree and one turn mutex — so they would serialize
+ * on a lock neither knows about and the second would inherit a session the first had moved on. A predecessor
+ * can be continued once; anything else that needs its result takes it as a handover. */
+const sharedContinuationFaults = (steps: readonly WorkflowStep[]): string[] => {
+    const continued = new Map<string, string[]>();
+    for (const step of steps.filter(continuesOneSession)) {
+        const parent = step.needs[0] ?? "";
+        const titles = continued.get(parent) ?? [];
+        titles.push(step.title);
+        continued.set(parent, titles);
+    }
+    return [...continued]
+        .filter(([, titles]) => titles.length > 1)
+        .map(([parent, titles]) => `${titles.map((title) => `"${title}"`).join(" and ")} all continue "${parent}"'s session; only one step can.`);
+};
+
+// Cycles, by walking every path from every root. A workflow with a cycle has steps that can never start, and the
+// scheduler would simply wait forever on them rather than saying so.
+const cycleFaults = (steps: readonly WorkflowStep[]): string[] => {
+    const needsById = new Map(steps.map((step) => [step.id, step.needs]));
+    const state = new Map<string, "open" | "closed">();
+    const faults: string[] = [];
+    const walk = (id: string, trail: readonly string[]): void => {
+        if (state.get(id) === "closed") {
+            return;
+        }
+        if (state.get(id) === "open") {
+            faults.push(`These steps wait for each other in a circle: ${[...trail.slice(trail.indexOf(id)), id].join(" → ")}.`);
+            return;
+        }
+        state.set(id, "open");
+        for (const need of needsById.get(id) ?? []) {
+            if (needsById.has(need)) {
+                walk(need, [...trail, id]);
+            }
+        }
+        state.set(id, "closed");
+    };
+    for (const step of steps) {
+        walk(step.id, []);
+    }
+    return faults;
+};
+
+/* A GATE THAT CANNOT BE ANSWERED. Every rule here is about the gate against the GRAPH — which is why none of
+ * them can live in the schema — and all of them fail the same expensive way if unchecked: the run spends its
+ * whole fan-out of sessions and then answers `blocked`, on every commit, for a reason nobody sees until they
+ * go reading the daemon's log.
+ *
+ * The `string[]` refusal is the least obvious and the most worth having. A release decision is one value
+ * compared against a list of values that ship; a field holding several has no such reading, and the one the
+ * gate would fall into (join them and compare the string) is a rule nobody wrote down and nobody could guess.
+ */
+const gateFaults = (workflow: Pick<Workflow, "steps" | "gate">): string[] => {
+    const { gate } = workflow;
+    if (gate === undefined) {
+        return [];
+    }
+    const step = workflow.steps.find((entry) => entry.id === gate.step);
+    if (step === undefined) {
+        return [`The gate reads step "${gate.step}", which is not a step in this workflow.`];
+    }
+    if (step.output.kind !== "json") {
+        return [`The gate reads "${step.title}", but that step declares no output fields for it to read.`];
+    }
+    const field = step.output.fields.find((entry) => entry.name === gate.field);
+    if (field === undefined) {
+        return [`The gate reads "${gate.field}", which "${step.title}" does not declare.`];
+    }
+    if (field.type === "string[]") {
+        return [`The gate reads "${gate.field}", which is a list — a release decision has to be one value.`];
+    }
+    // The schema refuses this on save (pass is min(1)), but the designer edits drafts the schema never sees —
+    // and an empty allowlist is a gate no run could ever answer "pass", which deserves a sentence, not a save error.
+    if (gate.pass.length === 0) {
+        return [`The gate names no passing values, so no run could ever ship.`];
+    }
+    // A field the step may legally omit is a gate that answers `blocked` whenever it does, which is a release
+    // stuck on a technicality rather than on the product.
+    return field.required ? [] : [`The gate reads "${gate.field}", which "${step.title}" declares optional — it has to be required.`];
+};
+
+/* Why the graph is not runnable, as a list of sentences. Empty ⇒ it is. Shared by the save route (which
+ * refuses) and the designer (which shows them under the canvas as you type), because a rule enforced only
+ * daemon-side is a rule the user meets as a failed save with no idea which node is wrong.
+ */
+export const workflowFaults = (workflow: Pick<Workflow, "steps" | "gate">): string[] => {
+    const ids = new Set(workflow.steps.map((step) => step.id));
+    return [
+        ...duplicateIdFaults(workflow.steps),
+        ...workflow.steps.flatMap((step) => stepFaults(step, ids)),
+        ...sharedContinuationFaults(workflow.steps),
+        ...cycleFaults(workflow.steps),
+        ...gateFaults(workflow),
+    ];
+};
+
+/* WHAT ONLY A RUN CAN BE WRONG ABOUT — kept apart from the rules above because it is not about the graph, and
+ * the graph is what gets SAVED. A design whose steps take their goal and instruction from the request is a
+ * perfectly good design; it is only unrunnable on the particular run that forgot to bring one.
+ *
+ * Which is why this cannot be a save-time rule and must not become one: refusing to save such a workflow would
+ * outlaw the entire point of a workflow being a SHAPE. The check belongs at the two doors that start runs — the
+ * run route and the gate's webhook — and it has to be there rather than left to fail later, because "later"
+ * means every session in the fan-out has already been paid for before anyone finds out the model was handed an
+ * empty instruction.
+ */
+export const workflowRunFaults = (workflow: Pick<Workflow, "steps">, request: string | undefined): string[] => {
+    if (request !== undefined && request.trim() !== "") {
+        return [];
+    }
+    const inheriting = workflow.steps.filter((step) => step.goal === undefined || step.prompt === undefined);
+    if (inheriting.length === 0) {
+        return [];
+    }
+    return [
+        `${inheriting.map((step) => `"${step.title}"`).join(", ")} take their goal or their instruction from what the run was asked to do, ` +
+            `and this run was started without a request. Say what you want built, or give those steps a goal and a prompt of their own.`,
+    ];
+};

package/src/workspace-state.test.ts

@@ -1,19 +1,35 @@
-import type { FileContribution } from "@intentic/extension-api";
+import { STATE_DIR } from "@intentic/constants";
+import type { FileContribution } from "@intentic/extension-manifest";
 import { describe, expect, it } from "vitest";
-import { staleQueryKeys, WORKSPACE_STATE_FILES } from "./workspace-state.js";
+import {
+    isLockedWorkspacePath,
+    isReportedManifest,
+    REPORTED_MANIFEST_PATHS,
+    staleQueryKeys,
+    VERSIONED_STATE_PATHS,
+    WORKSPACE_STATE_FILES,
+} from "./workspace-state.js";
 
 // What the automations extension declares in its manifest, and what the memory extension WOULD declare if the
 // watcher reported its files. Literals rather than the real manifests: an extension package importing this one is
 // the dependency direction, so reaching back for them here would invert it. The real manifests are checked
 // against this rule where they are loaded — web's fileBindings.test.ts and the daemon's file-bindings.test.ts.
 const AUTOMATIONS: readonly FileContribution[] = [
-    { path: `.intentic/automations.json`, invalidates: [`automations`] },
-    { path: `.intentic/approvals/`, invalidates: [`automation-approvals`] },
+    { path: `${STATE_DIR}/automations.json`, invalidates: [`automations`] },
+    { path: `${STATE_DIR}/approvals/`, invalidates: [`automation-approvals`] },
 ];
 
 describe(`staleQueryKeys`, () => {
     it(`maps a manifest write to the queries it makes stale`, () => {
-        expect(staleQueryKeys([`.intentic/capabilities.json`], [])).toEqual([`capabilities`, `environment`, `panels`]);
+        expect(staleQueryKeys([`.intentic/capabilities.json`], [])).toEqual([`capabilities`, `environment`, `panels`, `manifests`]);
+    });
+
+    it(`refreshes the unreadable-manifest notice for the three files a person hand-edits`, () => {
+        // Only these three. Every manifest reports what the daemon could not read in it, but a write to one of
+        // the twenty-odd DAEMON-written ones cannot introduce a typo, and billing every browser a refetch for
+        // each of them is the amplification this table exists to avoid.
+        const carries = WORKSPACE_STATE_FILES.filter((file) => file.invalidates.includes(`manifests`)).map((file) => file.path);
+        expect(carries.toSorted()).toEqual([`.intentic/capabilities.json`, `.intentic/personas.json`, `.intentic/settings.json`]);
     });
 
     it(`matches a name family and a one-file-per-entry directory through one prefix each`, () => {
@@ -32,14 +48,14 @@ describe(`staleQueryKeys`, () => {
     it(`ignores unrelated churn under .intentic/`, () => {
         // The amplification that turned an iq index rebuild into an endless request storm: a prefix test on
         // `.intentic/` alone would invalidate every one of these queries for each index write.
-        expect(staleQueryKeys([`.intentic/iq/index.db`, `.intentic/claude/projects/p/session.jsonl`], [])).toEqual([]);
+        expect(staleQueryKeys([`.intentic/cache/iq/index.db`, `.intentic/sessions/claude/projects/p/session.jsonl`], [])).toEqual([]);
     });
 
     it(`ignores a store's own temp file while it is mid-swap`, () => {
         // jsonFile writes `.<name>.<pid>.tmp` beside the target precisely so the atomic rename can't be read as
         // a write to the target itself. A trailing-tag temp would prefix-match and bill an extra refetch.
         expect(staleQueryKeys([`.intentic/.settings.json.42.tmp`], [])).toEqual([]);
-        expect(staleQueryKeys([`.intentic/settings.json`], [])).toEqual([`settings`]);
+        expect(staleQueryKeys([`.intentic/settings.json`], [])).toEqual([`settings`, `manifests`]);
     });
 
     it(`ignores ordinary workspace edits`, () => {
@@ -52,6 +68,7 @@ describe(`staleQueryKeys`, () => {
             `capabilities`,
             `environment`,
             `panels`,
+            `manifests`,
         ]);
     });
 
@@ -71,21 +88,53 @@ describe(`staleQueryKeys`, () => {
         // The two lists are unioned flat, not layered: a narrow extension entry under a broad core entry that
         // invalidates nothing must still fire. Without this, every path beneath one of the daemon's
         // machine-state prefixes would be unreachable to extensions.
-        const nested: readonly FileContribution[] = [{ path: `.intentic/claude/projects/p/memory/`, invalidates: [`memory`] }];
-        expect(staleQueryKeys([`.intentic/claude/projects/p/memory/note.md`], nested)).toEqual([`memory`]);
+        const nested: readonly FileContribution[] = [{ path: `${STATE_DIR}/sessions/claude/projects/p/memory/`, invalidates: [`memory`] }];
+        expect(staleQueryKeys([`.intentic/sessions/claude/projects/p/memory/note.md`], nested)).toEqual([`memory`]);
         // …and a sibling under the same core prefix stays ignored.
-        expect(staleQueryKeys([`.intentic/claude/projects/p/session.jsonl`], nested)).toEqual([]);
+        expect(staleQueryKeys([`.intentic/sessions/claude/projects/p/session.jsonl`], nested)).toEqual([]);
     });
 
     it(`dedupes a key two extensions both claim`, () => {
         const twice: readonly FileContribution[] = [
-            { path: `.intentic/automations.json`, invalidates: [`automations`] },
-            { path: `.intentic/automations.json`, invalidates: [`automations`] },
+            { path: `${STATE_DIR}/automations.json`, invalidates: [`automations`] },
+            { path: `${STATE_DIR}/automations.json`, invalidates: [`automations`] },
         ];
         expect(staleQueryKeys([`.intentic/automations.json`], twice)).toEqual([`automations`]);
     });
 });
 
+/* Which broken manifests the owner is actually told about. The pair below is the whole invariant: a file is on
+ * the card iff a write to it refreshes the card. */
+describe(`isReportedManifest`, () => {
+    it(`shows exactly the files whose writes refresh the notice`, () => {
+        expect(REPORTED_MANIFEST_PATHS.toSorted()).toEqual(
+            WORKSPACE_STATE_FILES.filter((file) => file.invalidates.includes(`manifests`))
+                .map((file) => file.path)
+                .toSorted(),
+        );
+        expect(isReportedManifest(`.intentic/settings.json`)).toBe(true);
+    });
+
+    it(`stays quiet about daemon-written state the owner cannot repair`, () => {
+        // The regression this exists for: the workflow ledger's records predated a schema that gained a required
+        // field, so every read reported the whole file ignored — advice ("fix the file") addressed to nobody,
+        // about sixty kilobytes of machine JSON, and refreshed by no write because the ledger feeds no query, so
+        // it sat on the card until the daemon restarted. A ledger recovers on its own next write instead.
+        expect(isReportedManifest(`.intentic/workflow-runs.json`)).toBe(false);
+        expect(isReportedManifest(`.intentic/loops.json`)).toBe(false);
+        expect(isReportedManifest(`.intentic/thread-sessions.json`)).toBe(false);
+    });
+
+    it(`reads a platform path with either separator`, () => {
+        expect(isReportedManifest(`.intentic\\settings.json`)).toBe(true);
+    });
+
+    it(`does not report a file outside the workspace`, () => {
+        // What `relative` hands the daemon for the manifests it keeps under /history — never nameable on screen.
+        expect(isReportedManifest(`../../history/settings.json`)).toBe(false);
+    });
+});
+
 describe(`WORKSPACE_STATE_FILES`, () => {
     it(`declares every entry under .intentic/, root-relative and forward-slash`, () => {
         for (const file of WORKSPACE_STATE_FILES) {
@@ -117,13 +166,136 @@ describe(`WORKSPACE_STATE_FILES`, () => {
         }
     });
 
-    it(`has no entry that prefix-matches another, so one write can't be billed twice`, () => {
-        for (const file of WORKSPACE_STATE_FILES) {
-            const overlapping = WORKSPACE_STATE_FILES.filter((other) => other !== file && other.path.startsWith(file.path));
+    it(`only nests under an entry that invalidates nothing, so one write can't be billed twice`, () => {
+        // Entries may nest when a subtree needs a different portability class — stateFileFor's longest match
+        // keeps that unambiguous. Invalidation has no longest-match rule: staleQueryKeys unions every
+        // matching entry, so a nest under an entry that DOES invalidate would bill the outer view's queries for
+        // a write that belongs to the inner one. Nesting is therefore only legal beneath an empty `invalidates`.
+        for (const file of WORKSPACE_STATE_FILES.filter((entry) => entry.invalidates.length > 0)) {
+            const nested = WORKSPACE_STATE_FILES.filter((other) => other !== file && other.path.startsWith(file.path));
             expect(
-                overlapping.map((other) => other.path),
-                `${file.path} is a prefix of another entry`,
+                nested.map((other) => other.path),
+                `${file.path} invalidates ${file.invalidates.join(`, `)} and is a prefix of another entry`,
             ).toEqual([]);
         }
     });
+
+    it(`splits a nested entry from its parent for a reason the parent doesn't already carry`, () => {
+        // A nest that agrees with the entry it sits under is a duplicate: stateFileFor resolves to the same
+        // answer either way, so the split is dead weight the next reader has to diff to discover.
+        for (const file of WORKSPACE_STATE_FILES) {
+            for (const parent of WORKSPACE_STATE_FILES.filter((other) => other !== file && file.path.startsWith(other.path))) {
+                expect(
+                    parent.portability === file.portability && parent.invalidates.join() === file.invalidates.join(),
+                    `${file.path} says nothing its parent ${parent.path} doesn't already say`,
+                ).toBe(false);
+            }
+        }
+    });
+});
+
+/* The rule the daemon enforces and the explorer draws. Both sides read it from here, which is the point: the
+ * padlock on a row and the refusal behind it can no longer disagree. */
+describe(`isLockedWorkspacePath`, () => {
+    it(`covers the root state dir's credential entries, and their subtrees whole`, () => {
+        expect(isLockedWorkspacePath(`.intentic/capabilities.json`)).toBe(true);
+        expect(isLockedWorkspacePath(`.intentic/owner.json`)).toBe(true);
+        // A whole lifecycle root, so a provider added under it is covered without a second edit.
+        expect(isLockedWorkspacePath(`.intentic/auth`)).toBe(true);
+        expect(isLockedWorkspacePath(`.intentic/auth/codex/auth.json`)).toBe(true);
+        expect(isLockedWorkspacePath(`.intentic/browser/Default/Cookies`)).toBe(true);
+    });
+
+    it(`leaves the state dir's ordinary manifests alone`, () => {
+        // The dir itself is browsable, and most of what is in it is a file a person may legitimately read.
+        expect(isLockedWorkspacePath(`.intentic`)).toBe(false);
+        expect(isLockedWorkspacePath(`.intentic/settings.json`)).toBe(false);
+        expect(isLockedWorkspacePath(`.intentic/drafts/post-1.json`)).toBe(false);
+    });
+
+    it(`locks the ROOT's own .git and nobody else's`, () => {
+        // The root's is the pointer to the shadow history repo, kept where the agent cannot rewrite it; a
+        // repo's own .git is ordinary content that stays browsable.
+        expect(isLockedWorkspacePath(`.git`)).toBe(true);
+        expect(isLockedWorkspacePath(`.git/config`)).toBe(true);
+        expect(isLockedWorkspacePath(`myrepo/.git/config`)).toBe(false);
+        // …and a repo's own nested state dir is its project's, not the daemon's.
+        expect(isLockedWorkspacePath(`myrepo/.intentic/capabilities.json`)).toBe(false);
+    });
+
+    it(`reads a platform path the same as a posix one`, () => {
+        expect(isLockedWorkspacePath(`.intentic\\auth\\codex`)).toBe(true);
+        expect(isLockedWorkspacePath(`./.intentic/capabilities.json`)).toBe(true);
+    });
+});
+
+describe(`VERSIONED_STATE_PATHS`, () => {
+    /* THE ONE ASSERTION THAT MUST NEVER GO GREEN BY ACCIDENT.
+     *
+     * `versioned` carves an entry out of the root repo's wholesale `.intentic` exclusion, so marking one is the
+     * difference between a file the owner reviews and a file the next baseline commit publishes into `git log`
+     * forever. A credential marked by a hurried hand is not recoverable by unmarking it later — the commit is
+     * already written — which is why the refusal is mechanical here rather than a rule in a comment. */
+    it(`never tracks a credential or an identity binding`, () => {
+        const leaked = WORKSPACE_STATE_FILES.filter((file) => file.versioned && (file.portability === `secret` || file.portability === `identity`));
+        expect(leaked.map((file) => file.path)).toEqual([]);
+    });
+
+    /* Narrower than `carry` ON PURPOSE, and this is where that stays true. The two answer different questions —
+     * carry is "does it move to a new sandbox", versioned is "should a human review it changing" — so the
+     * ledgers and the bulk are `carry` and deliberately absent: the run ledger is rewritten several times per
+     * workflow step, the usage batch every few seconds a browser is open, and the transcripts run to hundreds of
+     * megabytes. Tracking any of them buries the owner's code review under machine noise. */
+    it(`leaves the ledgers and the bulk out even though they travel`, () => {
+        for (const path of [
+            `.intentic/workflow-runs.json`,
+            // Split out of the tracked automations manifest precisely so a fire stops dirtying it — the one
+            // entry here that would be a REGRESSION rather than an oversight if it ever went tracked.
+            `.intentic/automation-runs.json`,
+            `.intentic/loops.json`,
+            `.intentic/thread-sessions.json`,
+            `.intentic/extension-usage.json`,
+            `.intentic/webchat-installs.json`,
+            `.intentic/sessions/claude/`,
+            `.intentic/artifacts/`,
+        ]) {
+            expect([path, VERSIONED_STATE_PATHS.includes(path)]).toEqual([path, false]);
+        }
+    });
+
+    /* Spelled out rather than derived, so ADDING a tracked entry is a visible edit to this list and not a silent
+     * consequence of editing the table above — the review the flag itself exists to force. */
+    it(`tracks exactly the configuration slice`, () => {
+        expect(VERSIONED_STATE_PATHS.toSorted()).toEqual([
+            `.intentic/automations.json`,
+            `.intentic/automations.seeded.json`,
+            `.intentic/capability-dismissals.json`,
+            `.intentic/environment.Dockerfile`,
+            `.intentic/environment.custom.Dockerfile`,
+            `.intentic/environment.d/`,
+            `.intentic/extension-enablement.json`,
+            // The owner's per-extension update posture (notify / agent / auto) — a standing decision about
+            // what may run unattended, which is exactly the kind of edit worth a line in `git log`.
+            `.intentic/extension-update-policy.json`,
+            `.intentic/loop-designs.json`,
+            `.intentic/personas.json`,
+            // A persona's own kit — the prompt it runs on and the skills only its turns reach. Tracked for the
+            // reason its card is, one step further: this is the text that decides how that persona behaves.
+            `.intentic/personas/`,
+            `.intentic/settings.json`,
+            // The skills the owner wrote. Tracked for the reason the rules in settings.json are: text that
+            // changes how the agent behaves is worth a diff and a line in `git log`.
+            `.intentic/skills/`,
+            `.intentic/templates.json`,
+            `.intentic/workflows.json`,
+        ]);
+    });
+
+    /* The composed overlay is `derived` — recomposed on every boot from the custom file that IS tracked, against
+     * whatever base image this container happens to be on. Tracking it would put a rewritten-at-startup file in
+     * front of the owner as a change they made. */
+    it(`tracks the environment overlay's source but not its composed output`, () => {
+        expect(VERSIONED_STATE_PATHS).toContain(`.intentic/environment.custom.Dockerfile`);
+        expect(VERSIONED_STATE_PATHS).not.toContain(`.intentic/environment.approved.Dockerfile`);
+    });
 });