@lamentis/naome 1.1.2 → 1.2.0

package/crates/naome-core/tests/task_state_compact_support/states.rs

@@ -0,0 +1,151 @@
+use serde_json::{json, Value};
+
+const T0: &str = "2026-05-07T00:00:00.000Z";
+
+pub fn compact_state(admission_head: &str) -> Value {
+    base_state(
+        admission_head,
+        json!({
+            "proofPathSets": {
+                "changed-readme": ["README.md"]
+            },
+            "proofBatches": [
+                {
+                    "checkedAt": T0,
+                    "evidencePathSet": "changed-readme",
+                    "proofs": [
+                        {
+                            "checkId": "alpha",
+                            "exitCode": 0
+                        },
+                        {
+                            "checkId": "beta",
+                            "command": "npm run beta -- --changed README.md",
+                            "cwd": "tools",
+                            "exitCode": 0
+                        }
+                    ]
+                }
+            ]
+        }),
+    )
+}
+
+pub fn legacy_state(admission_head: &str) -> Value {
+    let mut state = base_state(
+        admission_head,
+        json!({
+            "proofResults": [
+                proof("alpha", "npm run alpha", "."),
+                proof("beta", "npm run beta", ".")
+            ]
+        }),
+    );
+    state["schema"] = json!("naome.task-state.v1");
+    state["version"] = json!(1);
+    state
+}
+
+pub fn large_compact_state(admission_head: &str) -> Value {
+    let evidence: Vec<Value> = (0..12)
+        .map(|index| json!(format!("src/module_{index}.rs")))
+        .collect();
+    let proofs: Vec<Value> = (0..8)
+        .map(|index| {
+            json!({
+                "checkId": format!("check-{index}"),
+                "exitCode": 0
+            })
+        })
+        .collect();
+    base_state(
+        admission_head,
+        json!({
+            "proofPathSets": {
+                "large-change": evidence
+            },
+            "proofBatches": [
+                {
+                    "checkedAt": T0,
+                    "command": "cargo test",
+                    "cwd": ".",
+                    "evidencePathSet": "large-change",
+                    "proofs": proofs
+                }
+            ]
+        }),
+    )
+}
+
+pub fn large_expanded_state(admission_head: &str) -> Value {
+    let evidence: Vec<Value> = (0..12)
+        .map(|index| json!(format!("src/module_{index}.rs")))
+        .collect();
+    let proofs: Vec<Value> = (0..8)
+        .map(|index| {
+            json!({
+                "checkId": format!("check-{index}"),
+                "command": "cargo test",
+                "cwd": ".",
+                "exitCode": 0,
+                "checkedAt": T0,
+                "evidence": evidence
+            })
+        })
+        .collect();
+    base_state(
+        admission_head,
+        json!({
+            "proofResults": proofs
+        }),
+    )
+}
+
+fn base_state(admission_head: &str, proof_payload: Value) -> Value {
+    let mut task = json!({
+        "id": "compact-proof",
+        "request": "Update README.",
+        "userPrompt": {
+            "receivedAt": T0,
+            "text": "Update README."
+        },
+        "admission": {
+            "command": "node .naome/bin/check-task-state.js --admission",
+            "cwd": ".",
+            "exitCode": 0,
+            "checkedAt": T0,
+            "gitHead": admission_head,
+            "changedPaths": []
+        },
+        "allowedPaths": ["README.md"],
+        "declaredChangeTypes": ["docs"],
+        "requiredCheckIds": ["alpha", "beta"],
+        "humanReview": {
+            "required": false,
+            "approved": false,
+            "reason": null
+        }
+    });
+    task.as_object_mut()
+        .unwrap()
+        .extend(proof_payload.as_object().unwrap().clone());
+    json!({
+        "schema": "naome.task-state.v2",
+        "version": 2,
+        "status": "complete",
+        "activeTask": task,
+        "blocker": null,
+        "updatedAt": T0
+    })
+}
+
+fn proof(check_id: &str, command: &str, cwd: &str) -> Value {
+    json!({
+        "checkId": check_id,
+        "command": command,
+        "cwd": cwd,
+        "exitCode": 0,
+        "checkedAt": T0,
+        "evidence": ["README.md"]
+    })
+}

package/crates/naome-core/tests/workflow_integrity.rs

@@ -0,0 +1,85 @@
+mod workflow_support;
+
+use std::fs;
+
+use naome_core::{
+    refresh_integrity, summarize_command_output, verification_phase_plan, CommandCheckResult,
+};
+use serde_json::json;
+use workflow_support::{check, phase, WorkflowFixture};
+
+#[test]
+fn refresh_integrity_is_idempotent_and_repairs_manifest_hash() {
+    let repo = WorkflowFixture::new("refresh-integrity");
+    repo.install_machine_owned_harness();
+    let wrong = "sha256:0000000000000000000000000000000000000000000000000000000000000000";
+    repo.write_manifest_with_integrity(wrong);
+
+    let first = refresh_integrity(repo.path()).unwrap();
+    let after_first = fs::read_to_string(repo.path().join(".naome/manifest.json")).unwrap();
+    let second = refresh_integrity(repo.path()).unwrap();
+    let after_second = fs::read_to_string(repo.path().join(".naome/manifest.json")).unwrap();
+
+    assert!(first.updated);
+    assert!(!second.updated);
+    assert_eq!(after_first, after_second);
+    assert!(!after_first.contains(wrong));
+}
+
+#[test]
+fn failed_early_phase_withholds_expensive_recommendations() {
+    let repo = WorkflowFixture::new("verification-phases");
+    repo.write_verification(json!({
+        "schema": "naome.verification.v1",
+        "version": 1,
+        "status": "ready",
+        "lastUpdated": "2026-05-07",
+        "checks": [
+            check("naome-harness-health", "node .naome/bin/check-harness-health.js", "fast"),
+            check("repository-quality-check", "node .naome/bin/naome.js quality check --changed", "fast"),
+            check("package-dry-run", "npm run pack:dry-run", "medium")
+        ],
+        "phases": [
+            phase("shape-health", 10, ["naome-harness-health"]),
+            phase("quality", 20, ["repository-quality-check"]),
+            phase("package-release", 50, ["package-dry-run"])
+        ],
+        "changeTypes": [],
+        "releaseGates": []
+    }));
+
+    let plan = verification_phase_plan(
+        repo.path(),
+        &[CommandCheckResult {
+            check_id: "naome-harness-health".to_string(),
+            exit_code: 1,
+        }],
+    )
+    .unwrap();
+
+    assert_eq!(plan.recommended_check_ids, vec!["naome-harness-health"]);
+    assert!(plan
+        .withheld_check_ids
+        .contains(&"package-dry-run".to_string()));
+}
+
+#[test]
+fn long_command_output_is_stably_summarized() {
+    let output = (0..80)
+        .map(|index| {
+            if index == 42 {
+                "error: src/main.rs failed to compile".to_string()
+            } else {
+                format!("line {index}")
+            }
+        })
+        .collect::<Vec<_>>()
+        .join("\n");
+
+    let summary = summarize_command_output("cargo test", ".", 101, &output, 8);
+
+    assert!(summary.truncated);
+    assert_eq!(summary.exit_code, 101);
+    assert!(summary.relevant_lines[0].contains("error: src/main.rs"));
+    assert!(summary.affected_paths.contains(&"src/main.rs".to_string()));
+}

package/crates/naome-core/tests/workflow_policy.rs

@@ -0,0 +1,139 @@
+mod workflow_support;
+
+use std::collections::HashMap;
+
+use naome_core::{
+    classify_mutations, safe_rg_args, tracked_process_report, validate_read_boundaries,
+    validate_search_command, validate_task_state, ReadActivity, TaskStateMode, TaskStateOptions,
+};
+use serde_json::json;
+use workflow_support::WorkflowFixture;
+
+#[test]
+fn read_boundary_violation_is_detected_from_activity() {
+    let repo = WorkflowFixture::new("read-boundary");
+    repo.write(".naomeignore", ".naome/archive/\n.local-cache/\n");
+
+    let findings = validate_read_boundaries(
+        repo.path(),
+        &[ReadActivity {
+            command: "rg --hidden panic .".to_string(),
+            paths: vec![".naome/archive/old-task.json".to_string()],
+        }],
+    )
+    .unwrap();
+
+    assert_eq!(findings[0].check_id, "read-boundary");
+    assert!(findings[0]
+        .paths
+        .contains(&".naome/archive/old-task.json".to_string()));
+}
+
+#[test]
+fn safe_search_profile_excludes_default_boundaries() {
+    let repo = WorkflowFixture::new("safe-search-profile");
+    repo.write(".naomeignore", ".naome/archive/\n.local-cache/\n");
+
+    let args = safe_rg_args(repo.path()).unwrap().join(" ");
+
+    assert!(args.contains("!.git/**"));
+    assert!(args.contains("!.naome/archive/**"));
+    assert!(args.contains("!node_modules/**"));
+    assert!(args.contains("!.local-cache/**"));
+}
+
+#[test]
+fn unsafe_hidden_search_is_workflow_finding() {
+    let repo = WorkflowFixture::new("unsafe-search");
+
+    let findings = validate_search_command(repo.path(), "rg --hidden TODO .").unwrap();
+
+    assert!(findings
+        .iter()
+        .any(|finding| finding.check_id == "unsafe-search-command"));
+}
+
+#[test]
+fn scope_drift_is_reported_during_progress_gate() {
+    let repo = WorkflowFixture::new("scope-drift");
+    repo.init_git();
+    repo.write_task_state("implementing", &["src/owned.rs"], &["diff-check"]);
+    repo.write("src/outside.rs", "pub fn outside() {}\n");
+
+    let report = validate_task_state(
+        repo.path(),
+        TaskStateOptions {
+            mode: TaskStateMode::Progress,
+            ..TaskStateOptions::default()
+        },
+    )
+    .unwrap();
+    let joined = report.errors.join("\n");
+
+    assert!(joined.contains("Changed files outside allowedPaths"));
+    assert!(joined.contains("src/outside.rs"));
+    assert!(joined.contains("request_scope_change"));
+}
+
+#[test]
+fn tracked_running_process_blocks_completion_until_documented() {
+    let repo = WorkflowFixture::new("process-tracking");
+    repo.write(
+        ".naome/processes.json",
+        &format!(
+            "{}\n",
+            serde_json::to_string_pretty(&json!({
+                "schema": "naome.processes.v1",
+                "processes": [{
+                    "pid": std::process::id(),
+                    "command": "npm run dev",
+                    "cwd": ".",
+                    "startedAt": "2026-05-07T12:00:00.000Z",
+                    "status": "running",
+                    "allowAfterCompletion": false
+                }]
+            }))
+            .unwrap()
+        ),
+    );
+
+    let report = tracked_process_report(repo.path()).unwrap();
+
+    assert_eq!(report.active.len(), 1);
+    assert!(report.active[0].command.contains("npm run dev"));
+}
+
+#[test]
+fn mutation_classifier_recognizes_core_classes() {
+    let repo = WorkflowFixture::new("mutation-classes");
+
+    let classes = classify_mutations(
+        repo.path(),
+        &[
+            "src/lib.rs".to_string(),
+            ".naome/manifest.json".to_string(),
+            ".naome/archive/repair/AGENTS.md".to_string(),
+            "coverage/report.json".to_string(),
+            "packages/naome/native/darwin-arm64/naome".to_string(),
+            "notes/manual.md".to_string(),
+        ],
+    )
+    .unwrap();
+    let by_path = classes
+        .iter()
+        .map(|entry| (entry.path.as_str(), entry.mutation_class.as_str()))
+        .collect::<HashMap<_, _>>();
+
+    assert_eq!(by_path["src/lib.rs"], "source change");
+    assert_eq!(by_path[".naome/manifest.json"], "generated refresh");
+    assert_eq!(
+        by_path[".naome/archive/repair/AGENTS.md"],
+        "local-only repair"
+    );
+    assert_eq!(by_path["coverage/report.json"], "test artifact");
+    assert_eq!(
+        by_path["packages/naome/native/darwin-arm64/naome"],
+        "release artifact"
+    );
+    assert_eq!(by_path["notes/manual.md"], "user edit");
+}

package/crates/naome-core/tests/workflow_support/mod.rs

@@ -0,0 +1,194 @@
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::process::Command;
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use serde_json::json;
+
+static FIXTURE_COUNTER: AtomicU64 = AtomicU64::new(0);
+
+pub struct WorkflowFixture {
+    root: PathBuf,
+}
+
+impl WorkflowFixture {
+    pub fn new(name: &str) -> Self {
+        let nonce = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .unwrap()
+            .as_nanos();
+        let root = std::env::temp_dir().join(format!(
+            "naome-workflow-{name}-{}-{}-{nonce}",
+            std::process::id(),
+            FIXTURE_COUNTER.fetch_add(1, Ordering::SeqCst)
+        ));
+        fs::create_dir_all(root.join(".naome")).unwrap();
+        fs::create_dir_all(root.join("docs/naome")).unwrap();
+        let fixture = Self { root };
+        fixture.write(".naomeignore", ".naome/archive/\n");
+        fixture.write(
+            ".naome/init-state.json",
+            "{\"initialized\":true,\"intakeStatus\":\"complete\"}\n",
+        );
+        fixture.write(".naome/upgrade-state.json", "{\"status\":\"complete\"}\n");
+        fixture.write_verification(default_verification());
+        fixture
+    }
+
+    pub fn path(&self) -> &Path {
+        &self.root
+    }
+
+    pub fn init_git(&self) {
+        run_git(&self.root, &["init"]);
+        run_git(&self.root, &["config", "user.email", "test@example.com"]);
+        run_git(&self.root, &["config", "user.name", "Test User"]);
+        self.write("README.md", "# Baseline\n");
+        run_git(&self.root, &["add", "."]);
+        run_git(&self.root, &["commit", "-m", "baseline"]);
+    }
+
+    pub fn install_machine_owned_harness(&self) {
+        for path in ["AGENTS.md", ".naome/bin/naome.js", "docs/naome/index.md"] {
+            self.write(path, &format!("# {path}\n"));
+        }
+    }
+
+    pub fn write_manifest_with_integrity(&self, integrity: &str) {
+        self.write(
+            ".naome/manifest.json",
+            &pretty(json!({
+                "name": "naome",
+                "harnessVersion": "1.2.0",
+                "profile": "standard",
+                "installedAt": null,
+                "machineOwned": ["AGENTS.md", ".naome/bin/naome.js", "docs/naome/index.md"],
+                "projectOwned": [".naome/manifest.json"],
+                "integrity": {
+                    "AGENTS.md": integrity,
+                    ".naome/bin/naome.js": integrity,
+                    "docs/naome/index.md": integrity
+                }
+            })),
+        );
+    }
+
+    pub fn write_task_state(&self, status: &str, allowed_paths: &[&str], checks: &[&str]) {
+        let active_task = active_task_state(
+            allowed_paths,
+            checks,
+            git_text(&self.root, &["rev-parse", "HEAD"]),
+        );
+        self.write(
+            ".naome/task-state.json",
+            &pretty(json!({
+                "schema": "naome.task-state.v2",
+                "version": 2,
+                "status": status,
+                "activeTask": active_task,
+                "blocker": null,
+                "updatedAt": "2026-05-07T12:00:00.000Z"
+            })),
+        );
+    }
+
+    pub fn write_verification(&self, value: serde_json::Value) {
+        self.write(".naome/verification.json", &pretty(value));
+    }
+
+    pub fn write(&self, relative_path: &str, content: &str) {
+        let path = self.root.join(relative_path);
+        if let Some(parent) = path.parent() {
+            fs::create_dir_all(parent).unwrap();
+        }
+        fs::write(path, content).unwrap();
+    }
+}
+
+impl Drop for WorkflowFixture {
+    fn drop(&mut self) {
+        let _ = fs::remove_dir_all(&self.root);
+    }
+}
+
+pub fn default_verification() -> serde_json::Value {
+    json!({
+        "schema": "naome.verification.v1",
+        "version": 1,
+        "status": "ready",
+        "lastUpdated": "2026-05-07",
+        "checks": [check("diff-check", "git diff --check", "fast")],
+        "changeTypes": [],
+        "releaseGates": []
+    })
+}
+
+pub fn check(id: &str, command: &str, cost: &str) -> serde_json::Value {
+    json!({
+        "id": id,
+        "command": command,
+        "cwd": ".",
+        "purpose": "Test check.",
+        "cost": cost,
+        "source": "test",
+        "evidence": [],
+        "lastVerified": null
+    })
+}
+
+pub fn phase<const N: usize>(id: &str, order: usize, check_ids: [&str; N]) -> serde_json::Value {
+    json!({ "id": id, "order": order, "checkIds": check_ids.to_vec() })
+}
+
+fn active_task_state(
+    allowed_paths: &[&str],
+    checks: &[&str],
+    git_head: String,
+) -> serde_json::Value {
+    json!({
+        "id": "workflow-test",
+        "request": "Test workflow gates.",
+        "userPrompt": { "receivedAt": "2026-05-07T12:00:00.000Z", "text": "Test workflow gates." },
+        "admission": admission_record(git_head),
+        "allowedPaths": allowed_paths,
+        "declaredChangeTypes": ["source"],
+        "requiredCheckIds": checks,
+        "humanReview": { "required": false, "approved": false, "reason": null },
+        "proofResults": []
+    })
+}
+
+fn admission_record(git_head: String) -> serde_json::Value {
+    json!({
+        "command": "node .naome/bin/check-task-state.js --admission",
+        "cwd": ".",
+        "exitCode": 0,
+        "checkedAt": "2026-05-07T12:00:00.000Z",
+        "gitHead": git_head,
+        "changedPaths": []
+    })
+}
+
+fn pretty(value: serde_json::Value) -> String {
+    format!("{}\n", serde_json::to_string_pretty(&value).unwrap())
+}
+
+fn run_git(root: &Path, args: &[&str]) {
+    let output = Command::new("git")
+        .args(args)
+        .current_dir(root)
+        .output()
+        .unwrap();
+    assert!(output.status.success(), "git {} failed", args.join(" "));
+}
+
+fn git_text(root: &Path, args: &[&str]) -> String {
+    let output = Command::new("git")
+        .args(args)
+        .current_dir(root)
+        .output()
+        .unwrap();
+    assert!(output.status.success());
+    String::from_utf8_lossy(&output.stdout).trim().to_string()
+}

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@lamentis/naome",
-  "version": "1.1.2",
+  "version": "1.2.0",
   "description": "Native-first CLI for the NAOME agent harness.",
-  "license": "MIT",
+  "license": "Apache-2.0",
   "type": "module",
   "keywords": [
     "agent",