@intentius/chant 0.46.0 → 0.50.0

package/src/lint/output-docs.test.ts

@@ -0,0 +1,220 @@
+import { describe, test, expect } from "vitest";
+import { parseOutputDocs, pick, get } from "./output-docs";
+import type { SerializerResult } from "../serializer";
+
+describe("parseOutputDocs", () => {
+  test("parses a single JSON output as one document", () => {
+    const outputs = new Map<string, string | SerializerResult>([
+      ["aws", JSON.stringify({ AWSTemplateFormatVersion: "2010-09-09", Resources: {} })],
+    ]);
+    const docs = parseOutputDocs(outputs);
+    expect(docs).toHaveLength(1);
+    expect(docs[0]).toMatchObject({
+      lexicon: "aws",
+      index: 0,
+      format: "json",
+    });
+    expect(docs[0].error).toBeUndefined();
+    expect((docs[0].value as { Resources: unknown }).Resources).toEqual({});
+  });
+
+  test("splits multi-document YAML on `---` into one OutputDoc per document", () => {
+    const yaml = [
+      "apiVersion: v1",
+      "kind: Namespace",
+      "metadata:",
+      "  name: ns-a",
+      "---",
+      "apiVersion: apps/v1",
+      "kind: Deployment",
+      "metadata:",
+      "  name: web",
+    ].join("\n");
+    const outputs = new Map<string, string | SerializerResult>([["k8s", yaml]]);
+    const docs = parseOutputDocs(outputs);
+    expect(docs).toHaveLength(2);
+    expect(docs[0]).toMatchObject({ lexicon: "k8s", index: 0, format: "yaml" });
+    expect(docs[1]).toMatchObject({ lexicon: "k8s", index: 1, format: "yaml" });
+    expect((docs[0].value as { kind: string }).kind).toBe("Namespace");
+    expect((docs[1].value as { kind: string }).kind).toBe("Deployment");
+  });
+
+  test("handles a leading `---` document separator before any content", () => {
+    const yaml = ["---", "kind: Namespace", "---", "kind: Deployment"].join("\n");
+    const outputs = new Map<string, string | SerializerResult>([["k8s", yaml]]);
+    const docs = parseOutputDocs(outputs);
+    expect(docs).toHaveLength(2);
+    expect((docs[0].value as { kind: string }).kind).toBe("Namespace");
+    expect((docs[1].value as { kind: string }).kind).toBe("Deployment");
+  });
+
+  test("drops empty documents between/around separators without erroring", () => {
+    const yaml = ["---", "", "---", "kind: Deployment", "---", ""].join("\n");
+    const outputs = new Map<string, string | SerializerResult>([["k8s", yaml]]);
+    const docs = parseOutputDocs(outputs);
+    expect(docs).toHaveLength(1);
+    expect((docs[0].value as { kind: string }).kind).toBe("Deployment");
+  });
+
+  test("parses SerializerResult.files as additional, separately-indexed documents", () => {
+    const output: SerializerResult = {
+      primary: JSON.stringify({ kind: "root" }),
+      files: {
+        "nested.template.json": JSON.stringify({ kind: "nested-a" }),
+        "sidecar.yaml": "kind: nested-b\n---\nkind: nested-c",
+      },
+    };
+    const outputs = new Map<string, string | SerializerResult>([["aws", output]]);
+    const docs = parseOutputDocs(outputs);
+
+    const primaryDocs = docs.filter((d) => d.file === undefined);
+    expect(primaryDocs).toHaveLength(1);
+    expect((primaryDocs[0].value as { kind: string }).kind).toBe("root");
+
+    const nestedJson = docs.filter((d) => d.file === "nested.template.json");
+    expect(nestedJson).toHaveLength(1);
+    expect((nestedJson[0].value as { kind: string }).kind).toBe("nested-a");
+
+    // The sidecar YAML file is itself multi-document — index resets to 0
+    // within that file, since index is scoped to its own source.
+    const sidecarDocs = docs.filter((d) => d.file === "sidecar.yaml");
+    expect(sidecarDocs).toHaveLength(2);
+    expect(sidecarDocs[0].index).toBe(0);
+    expect(sidecarDocs[1].index).toBe(1);
+    expect((sidecarDocs[0].value as { kind: string }).kind).toBe("nested-b");
+    expect((sidecarDocs[1].value as { kind: string }).kind).toBe("nested-c");
+
+    expect(docs.every((d) => d.lexicon === "aws")).toBe(true);
+  });
+
+  test("skips a source with no files entries and no primary content", () => {
+    const outputs = new Map<string, string | SerializerResult>([["empty", ""]]);
+    expect(parseOutputDocs(outputs)).toEqual([]);
+  });
+
+  test("parses every ctx.outputs entry, tagging each with its own lexicon key", () => {
+    const outputs = new Map<string, string | SerializerResult>([
+      ["aws", JSON.stringify({ kind: "aws-thing" })],
+      ["k8s", "kind: k8s-thing"],
+    ]);
+    const docs = parseOutputDocs(outputs);
+    expect(docs.map((d) => d.lexicon).sort()).toEqual(["aws", "k8s"]);
+  });
+
+  describe("malformed documents — marker, not throw", () => {
+    test("a bare scalar document is marked with an error instead of being treated as a manifest", () => {
+      // "42" is syntactically fine (valid YAML/JSON) but is a scalar, not an
+      // object/array — not something a manifest-shaped check can walk.
+      const yaml = ["kind: Deployment", "---", "42", "---", "kind: Service"].join("\n");
+      const outputs = new Map<string, string | SerializerResult>([["k8s", yaml]]);
+      const docs = parseOutputDocs(outputs);
+
+      expect(docs).toHaveLength(3);
+      expect(docs[0].error).toBeUndefined();
+      expect(docs[2].error).toBeUndefined();
+
+      // The malformed middle document is a marker: present, flagged, no value.
+      expect(docs[1].error).toBeDefined();
+      expect(docs[1].value).toBeUndefined();
+      expect(docs[1].format).toBe("yaml");
+
+      // Filtering it out is one line, and leaves the good documents intact.
+      const usable = docs.filter((d) => !d.error);
+      expect(usable).toHaveLength(2);
+      expect((usable[0].value as { kind: string }).kind).toBe("Deployment");
+      expect((usable[1].value as { kind: string }).kind).toBe("Service");
+    });
+
+    test("a lone scalar as the entire output is marked with an error, not thrown", () => {
+      // Valid JSON ("true" parses fine) but not an object/array — the
+      // whole-content JSON path hits the same isUsableDoc guard.
+      const outputs = new Map<string, string | SerializerResult>([["weird", "true"]]);
+      expect(() => parseOutputDocs(outputs)).not.toThrow();
+      const docs = parseOutputDocs(outputs);
+      expect(docs).toHaveLength(1);
+      expect(docs[0].format).toBe("json");
+      expect(docs[0].error).toBeDefined();
+      expect(docs[0].value).toBeUndefined();
+    });
+
+    test("a malformed document in one files entry does not affect the others", () => {
+      const output: SerializerResult = {
+        primary: "kind: root",
+        files: {
+          "good.yaml": "kind: good",
+          "bad.yaml": "null",
+        },
+      };
+      const outputs = new Map<string, string | SerializerResult>([["k8s", output]]);
+      const docs = parseOutputDocs(outputs);
+
+      const good = docs.find((d) => d.file === "good.yaml")!;
+      const bad = docs.find((d) => d.file === "bad.yaml")!;
+      expect(good.error).toBeUndefined();
+      expect((good.value as { kind: string }).kind).toBe("good");
+      expect(bad.error).toBeDefined();
+      expect(bad.value).toBeUndefined();
+    });
+  });
+});
+
+describe("pick", () => {
+  interface Widget {
+    kind: string;
+    name: string;
+    extra: unknown;
+  }
+
+  test("returns only the named keys that are present", () => {
+    const value = { kind: "Deployment", name: "web", other: "ignored" };
+    expect(pick<Widget>(value, ["kind", "name"])).toEqual({ kind: "Deployment", name: "web" });
+  });
+
+  test("omits a named key that is absent — no invented default", () => {
+    const value = { kind: "Deployment" };
+    expect(pick<Widget>(value, ["kind", "name"])).toEqual({ kind: "Deployment" });
+  });
+
+  test("returns an empty object for a non-object value", () => {
+    expect(pick<Widget>(null, ["kind"])).toEqual({});
+    expect(pick<Widget>("a string", ["kind"])).toEqual({});
+    expect(pick<Widget>(undefined, ["kind"])).toEqual({});
+  });
+
+  test("copies values through unvalidated, whatever their actual shape", () => {
+    const value = { kind: 42 }; // wrong runtime type for `kind: string`
+    expect(pick<Widget>(value, ["kind"])).toEqual({ kind: 42 });
+  });
+});
+
+describe("get", () => {
+  test("walks a dotted path through nested objects", () => {
+    const value = { spec: { template: { spec: { containers: [] } } } };
+    expect(get(value, "spec.template.spec")).toEqual({ containers: [] });
+  });
+
+  test("returns undefined as soon as a segment is missing", () => {
+    const value = { spec: {} };
+    expect(get(value, "spec.template.spec")).toBeUndefined();
+  });
+
+  test("returns undefined when an intermediate value is not indexable", () => {
+    const value = { spec: "not-an-object" };
+    expect(get(value, "spec.template")).toBeUndefined();
+  });
+
+  test("indexes into arrays with a numeric path segment", () => {
+    const value = { items: [{ name: "first" }, { name: "second" }] };
+    expect(get(value, "items.1.name")).toBe("second");
+  });
+
+  test("returns the value itself for an empty path", () => {
+    const value = { a: 1 };
+    expect(get(value, "")).toBe(value);
+  });
+
+  test("does not throw on null/undefined input", () => {
+    expect(get(null, "a.b")).toBeUndefined();
+    expect(get(undefined, "a.b")).toBeUndefined();
+  });
+});

package/src/lint/output-docs.ts

@@ -0,0 +1,204 @@
+/**
+ * Parsed-output view for post-synth checks (chant #975).
+ *
+ * `PostSynthContext.outputs` carries raw serialized strings — a `chant build`
+ * consumer has to parse YAML/JSON itself before it can reason about
+ * structure. Every lexicon that needs this today rolls its own splitter
+ * (`parseK8sManifests` in k8s, hand-rolled `JSON.parse` in aws's
+ * `cf-refs.ts`), and each of the ~30 k8s post-synth checks reparses the same
+ * output independently. This module is the shared, parse-once primitive:
+ * `parseOutputDocs` turns `ctx.outputs` into a flat list of `OutputDoc`s,
+ * and `PostSynthContext.docs` (see `./post-synth.ts`) memoizes one call to it
+ * per build so every check — lexicon-shipped or project-authored policy —
+ * shares the same parse.
+ *
+ * `pick`/`get` are the "look at only the fields you care about" ergonomic
+ * from the issue's `,remain`-style framing — a partial, unvalidated view of
+ * an already-parsed tree, not a query DSL. Selector languages over the
+ * *source* AST stay in `./declarative.ts`; this module is output-side only.
+ */
+
+import type { SerializerResult } from "../serializer";
+import { parseYAML } from "../yaml";
+
+/**
+ * One parsed document from a build's serialized output.
+ *
+ * A single `ctx.outputs` entry can yield more than one `OutputDoc`: a
+ * multi-document YAML stream (`---`-separated) yields one per document, and
+ * a `SerializerResult` with `files` yields further docs for each nested
+ * file (a CloudFormation nested stack template, a sidecar manifest).
+ */
+export interface OutputDoc {
+  /** The `ctx.outputs` map key this document came from. */
+  lexicon: string;
+  /** Position of this document within its source (primary output or one
+   *  `files` entry) — 0 for a single-document source, 0..n-1 for a
+   *  multi-document YAML stream. */
+  index: number;
+  /** Whether this document was decoded as YAML or as whole-content JSON. */
+  format: "yaml" | "json";
+  /** The parsed tree. `undefined` when parsing failed — see `error`. */
+  value: unknown;
+  /**
+   * Set when this document came from a `SerializerResult.files` entry rather
+   * than the primary output — the file's key in that map (e.g. a nested
+   * stack template's filename).
+   */
+  file?: string;
+  /**
+   * Set when this document could not be parsed into a usable tree. The
+   * document is still returned (a marker, not a throw) so a caller can see
+   * that something in the build output failed to parse, rather than the
+   * failure disappearing silently the way `parseK8sManifests` has always
+   * swallowed it. `value` is `undefined` on an errored document. Filter with
+   * `ctx.docs.filter((d) => !d.error)` to get only usable documents.
+   */
+  error?: string;
+}
+
+/**
+ * Parse every output in `outputs` into a flat list of `OutputDoc`s: one call,
+ * shared by every post-synth check via `PostSynthContext.docs`.
+ *
+ * Format detection is whole-source, not per-document: if the entire source
+ * parses as JSON, it is one `"json"` document (CloudFormation, most non-k8s
+ * serializers). Otherwise the source is treated as a YAML stream — split on
+ * `---` document separators — and each resulting document is parsed as YAML
+ * (`format: "yaml"`), even one that happens to also be valid JSON, since
+ * JSON is a YAML subset. `SerializerResult.files` entries (nested templates,
+ * sidecar manifests) are parsed the same way, tagged with `file`.
+ *
+ * A document that fails to parse into a non-null object/array — malformed
+ * input, or a bare scalar where a manifest was expected — is not thrown:
+ * it is included with `error` set and `value: undefined`. See `OutputDoc`.
+ */
+export function parseOutputDocs(outputs: Map<string, string | SerializerResult>): OutputDoc[] {
+  const docs: OutputDoc[] = [];
+  for (const [lexicon, output] of outputs) {
+    const primary = typeof output === "string" ? output : output.primary;
+    docs.push(...parseSource(primary, lexicon));
+
+    const files = typeof output === "string" ? undefined : output.files;
+    for (const [file, content] of Object.entries(files ?? {})) {
+      docs.push(...parseSource(content, lexicon, file));
+    }
+  }
+  return docs;
+}
+
+/** Split a YAML stream on `---` document-separator lines (own line, optional
+ *  trailing whitespace) — including a leading separator before any content,
+ *  which `"\n---\n"`-style splitting misses. Empty documents (two separators
+ *  back to back, or a leading/trailing one) are dropped. */
+function splitYamlDocuments(source: string): string[] {
+  return source
+    .split(/^---[ \t]*$/m)
+    .map((doc) => doc.trim())
+    .filter((doc) => doc.length > 0);
+}
+
+/** True for a value a document is usable as — a non-null object or array.
+ *  A bare scalar ("just a string") parses without error but is not a
+ *  document a check can walk, so it is treated as malformed. */
+function isUsableDoc(value: unknown): boolean {
+  return typeof value === "object" && value !== null;
+}
+
+/**
+ * Parse one source string (a primary output, or one `files` entry) into its
+ * `OutputDoc`s, trying whole-content JSON first and falling back to a
+ * (possibly multi-document) YAML stream. Never throws — a parse failure or
+ * an unusable result becomes a marker document with `error` set.
+ */
+function parseSource(source: string, lexicon: string, file?: string): OutputDoc[] {
+  const trimmed = source.trim();
+  if (trimmed === "") return [];
+
+  try {
+    const value = JSON.parse(trimmed);
+    if (isUsableDoc(value)) {
+      return [{ lexicon, index: 0, format: "json", value, ...(file && { file }) }];
+    }
+    return [
+      {
+        lexicon,
+        index: 0,
+        format: "json",
+        value: undefined,
+        error: "parsed JSON is not an object or array",
+        ...(file && { file }),
+      },
+    ];
+  } catch {
+    // Not whole-content JSON — fall through to the YAML stream path.
+  }
+
+  return splitYamlDocuments(trimmed).map((segment, index) => {
+    try {
+      const value = parseYAML(segment);
+      if (isUsableDoc(value)) {
+        return { lexicon, index, format: "yaml" as const, value, ...(file && { file }) };
+      }
+      return {
+        lexicon,
+        index,
+        format: "yaml" as const,
+        value: undefined,
+        error: "parsed YAML document is not an object or array",
+        ...(file && { file }),
+      };
+    } catch (err) {
+      return {
+        lexicon,
+        index,
+        format: "yaml" as const,
+        value: undefined,
+        error: err instanceof Error ? err.message : String(err),
+        ...(file && { file }),
+      };
+    }
+  });
+}
+
+/**
+ * Partial typed decode — the `,remain`-style ergonomic from `ma91n/tfpolicy`:
+ * decode the fields you care about, leave everything else in place,
+ * unvalidated. Returns a shallow, top-level view of `value` narrowed to the
+ * keys named in `shape`. A key absent from `value` (or `value` not being a
+ * plain object) is simply absent from the result — no default is invented.
+ *
+ * This is NOT runtime validation: a key that IS present is copied as-is,
+ * whatever its actual shape, and cast to `T`'s declared type for that key.
+ * Use `get` for a deeper walk into one of the picked values.
+ */
+export function pick<T extends object>(value: unknown, shape: (keyof T)[]): Partial<T> {
+  const result: Partial<T> = {};
+  if (typeof value !== "object" || value === null) return result;
+  const source = value as Record<string, unknown>;
+  for (const key of shape) {
+    const propertyName = key as string;
+    if (propertyName in source) {
+      (result as Record<string, unknown>)[propertyName] = source[propertyName];
+    }
+  }
+  return result;
+}
+
+/**
+ * Dotted-path getter for the common walk over a parsed doc, e.g.
+ * `get(doc.value, "spec.template.spec")`. Not a query DSL — no wildcards,
+ * no predicates, no array-flattening. An array index is just a numeric path
+ * segment (`get(value, "items.0.name")`), since JS indexes arrays by string
+ * key underneath. Returns `undefined` as soon as any segment is missing or
+ * the value at that point isn't indexable — it never throws on a bad path.
+ */
+export function get(value: unknown, path: string): unknown {
+  if (path === "") return value;
+  let current: unknown = value;
+  for (const segment of path.split(".")) {
+    if (typeof current !== "object" || current === null) return undefined;
+    current = (current as Record<string, unknown>)[segment];
+  }
+  return current;
+}

package/src/lint/pipeline-change-gate.test.ts

@@ -0,0 +1,144 @@
+import { describe, expect, test } from "vitest";
+import type { Component, Phase } from "../components/component";
+import {
+  classifyComponentPipelineChange,
+  classifyPipelineChange,
+  componentVerbSet,
+  evaluatePipelineChangeGate,
+} from "./pipeline-change-gate";
+
+const KNOWN: ReadonlySet<string> = new Set(["cfn-deploy", "publish-image", "wait-for-stack"]);
+
+const component = (deploy: Phase[]): Component => ({
+  name: "widget",
+  dependsOn: [],
+  deploy,
+});
+
+const ordinary = (): Component =>
+  component([{ phase: "Deploy", steps: [{ kind: "cfn-deploy" }, { kind: "wait-for-stack" }] }]);
+
+const withShell = (): Component =>
+  component([{ phase: "Deploy", steps: [{ kind: "shell", cmd: "echo hi", reason: "no capability yet" }] }]);
+
+const withUnregisteredVerb = (): Component =>
+  component([{ phase: "Deploy", steps: [{ kind: "some-new-verb" }] }]);
+
+describe("classifyComponentPipelineChange (#1569)", () => {
+  test("a composition of only registry verbs is not a pipeline change", () => {
+    const result = classifyComponentPipelineChange(ordinary(), { knownKinds: KNOWN });
+    expect(result).toEqual({ pipelineChange: false, reasons: [] });
+  });
+
+  test("any shell step trips the class unconditionally, even with a declared reason", () => {
+    const result = classifyComponentPipelineChange(withShell(), { knownKinds: KNOWN });
+    expect(result.pipelineChange).toBe(true);
+    expect(result.reasons).toEqual([{ kind: "shell-step", phaseName: "Deploy" }]);
+  });
+
+  test("a verb outside the known registry trips the class", () => {
+    const result = classifyComponentPipelineChange(withUnregisteredVerb(), { knownKinds: KNOWN });
+    expect(result.pipelineChange).toBe(true);
+    expect(result.reasons).toEqual([{ kind: "unregistered-verb", stepKind: "some-new-verb", phaseName: "Deploy" }]);
+  });
+
+  test("gate steps are never mistaken for an escape hatch", () => {
+    const withGate = component([
+      { phase: "Approve", steps: [{ kind: "gate", signalName: "release-approved" }] },
+    ]);
+    expect(classifyComponentPipelineChange(withGate, { knownKinds: KNOWN })).toEqual({
+      pipelineChange: false,
+      reasons: [],
+    });
+  });
+
+  test("nested fan-out phases are walked, same as COMP005/COMP006", () => {
+    const nested = component([
+      {
+        phase: "Fanout",
+        steps: [{ phase: "per-region", steps: [{ kind: "shell", cmd: "aws sts get-caller-identity", reason: "no capability" }] }],
+      },
+    ]);
+    const result = classifyComponentPipelineChange(nested, { knownKinds: KNOWN });
+    expect(result.pipelineChange).toBe(true);
+    expect(result.reasons).toEqual([{ kind: "shell-step", phaseName: "per-region" }]);
+  });
+
+  test("without an explicit registry, falls back to core's starter verbs (same fallback as COMP005)", () => {
+    // cfn-deploy is not in core's starter set (it's an aws-lexicon leaf), so
+    // this asserts the fallback is core's own set, not "everything passes".
+    const result = classifyComponentPipelineChange(ordinary());
+    expect(result.pipelineChange).toBe(true);
+    expect(result.reasons.some((r) => r.kind === "unregistered-verb" && r.stepKind === "cfn-deploy")).toBe(true);
+  });
+});
+
+describe("componentVerbSet (#1569)", () => {
+  test("collects every non-gate step kind, excluding gate steps", () => {
+    const c = component([
+      {
+        phase: "Deploy",
+        steps: [{ kind: "cfn-deploy" }, { kind: "gate", signalName: "go" }, { kind: "wait-for-stack" }],
+      },
+    ]);
+    expect(componentVerbSet(c)).toEqual(new Set(["cfn-deploy", "wait-for-stack"]));
+  });
+});
+
+describe("classifyPipelineChange (#1569)", () => {
+  test("no `before` (a brand-new component): reports only the single-composition findings, no verb-set-changed", () => {
+    const result = classifyPipelineChange(undefined, ordinary(), { knownKinds: KNOWN });
+    expect(result).toEqual({ pipelineChange: false, reasons: [] });
+  });
+
+  test("identical verb set before and after is not a pipeline change even with `before` present", () => {
+    const result = classifyPipelineChange(ordinary(), ordinary(), { knownKinds: KNOWN });
+    expect(result).toEqual({ pipelineChange: false, reasons: [] });
+  });
+
+  test("adding a verb to the composition trips verb-set-changed", () => {
+    const after = component([
+      { phase: "Deploy", steps: [{ kind: "cfn-deploy" }, { kind: "wait-for-stack" }, { kind: "publish-image" }] },
+    ]);
+    const result = classifyPipelineChange(ordinary(), after, { knownKinds: KNOWN });
+    expect(result.pipelineChange).toBe(true);
+    expect(result.reasons).toEqual([{ kind: "verb-set-changed", added: ["publish-image"], removed: [] }]);
+  });
+
+  test("removing a verb from the composition trips verb-set-changed", () => {
+    const after = component([{ phase: "Deploy", steps: [{ kind: "cfn-deploy" }] }]);
+    const result = classifyPipelineChange(ordinary(), after, { knownKinds: KNOWN });
+    expect(result.reasons).toEqual([{ kind: "verb-set-changed", added: [], removed: ["wait-for-stack"] }]);
+  });
+
+  test("a verb-set change composes with a shell finding on the same change, both reported", () => {
+    const after = withShell();
+    const result = classifyPipelineChange(ordinary(), after, { knownKinds: KNOWN });
+    expect(result.pipelineChange).toBe(true);
+    expect(result.reasons).toContainEqual({ kind: "shell-step", phaseName: "Deploy" });
+    expect(result.reasons).toContainEqual({
+      kind: "verb-set-changed",
+      added: ["shell"],
+      removed: ["cfn-deploy", "wait-for-stack"],
+    });
+  });
+});
+
+describe("evaluatePipelineChangeGate (#1569)", () => {
+  test("an ordinary composition routes nowhere", () => {
+    const verdict = evaluatePipelineChangeGate(undefined, ordinary(), "human-always", { knownKinds: KNOWN });
+    expect(verdict.route).toBe("none");
+    expect(verdict.pipelineChange).toBe(false);
+  });
+
+  test('defaults to "human-always" — a pipeline change never free-runs unless the caller opts into "stricter-gate"', () => {
+    const verdict = evaluatePipelineChangeGate(undefined, withShell(), undefined, { knownKinds: KNOWN });
+    expect(verdict.route).toBe("human-always");
+    expect(verdict.pipelineChange).toBe(true);
+  });
+
+  test('"stricter-gate" routes a pipeline change to the named stricter class instead', () => {
+    const verdict = evaluatePipelineChangeGate(undefined, withShell(), "stricter-gate", { knownKinds: KNOWN });
+    expect(verdict.route).toBe("stricter-gate");
+  });
+});