@lifeaitools/rdc-skills 0.24.38 → 0.24.41

package/tests/rdc-brochure.test.mjs

@@ -0,0 +1,125 @@
+#!/usr/bin/env node
+
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = resolve(__dirname, '..');
+const SCRIPT = join(REPO_ROOT, 'scripts', 'rdc-brochure.mjs');
+
+let failures = 0;
+function assert(cond, msg) {
+  if (cond) console.log(`  ✓ ${msg}`);
+  else {
+    failures += 1;
+    console.error(`  ✗ ${msg}`);
+  }
+}
+
+function runBrochure(args, env = {}) {
+  return spawnSync(process.execPath, [SCRIPT, ...args], {
+    cwd: REPO_ROOT,
+    encoding: 'utf8',
+    env: {
+      ...process.env,
+      RDC_BROCHURE_COMPOSE_ONLY: '1',
+      ...env,
+    },
+  });
+}
+
+function composedHtmlPath(stdout) {
+  const m = String(stdout || '').match(/^HTML:\s+(.+)$/m);
+  return m ? m[1].trim() : null;
+}
+
+function crc32(buf) {
+  let crc = 0xffffffff;
+  for (const byte of buf) {
+    crc ^= byte;
+    for (let i = 0; i < 8; i++) crc = (crc >>> 1) ^ (0xedb88320 & -(crc & 1));
+  }
+  return (crc ^ 0xffffffff) >>> 0;
+}
+
+function u16(n) {
+  const b = Buffer.alloc(2);
+  b.writeUInt16LE(n);
+  return b;
+}
+
+function u32(n) {
+  const b = Buffer.alloc(4);
+  b.writeUInt32LE(n >>> 0);
+  return b;
+}
+
+function writeStoredZip(zipPath, entryName, content) {
+  const name = Buffer.from(entryName);
+  const body = Buffer.from(content);
+  const crc = crc32(body);
+  const local = Buffer.concat([
+    u32(0x04034b50), u16(20), u16(0), u16(0), u16(0), u16(0),
+    u32(crc), u32(body.length), u32(body.length), u16(name.length), u16(0),
+    name, body,
+  ]);
+  const centralOffset = local.length;
+  const central = Buffer.concat([
+    u32(0x02014b50), u16(20), u16(20), u16(0), u16(0), u16(0), u16(0),
+    u32(crc), u32(body.length), u32(body.length), u16(name.length), u16(0),
+    u16(0), u16(0), u16(0), u32(0), u32(0), name,
+  ]);
+  const end = Buffer.concat([
+    u32(0x06054b50), u16(0), u16(0), u16(1), u16(1),
+    u32(central.length), u32(centralOffset), u16(0),
+  ]);
+  writeFileSync(zipPath, Buffer.concat([local, central, end]));
+}
+
+const root = mkdtempSync(join(tmpdir(), 'rdc-brochure-test-'));
+
+try {
+  console.log('Test 1: folder compose suppresses synthetic headings after YAML front matter');
+  const folder = join(root, 'frontmatter-folder');
+  mkdirSync(folder, { recursive: true });
+  writeFileSync(join(folder, '01-overview.md'), '---\ntitle: Overview\n---\n\n# Real Title\n\nBody.\n', 'utf8');
+  writeFileSync(join(folder, '02-h6.md'), '###### Small Heading\n\nTiny body.\n', 'utf8');
+  const composed = runBrochure([folder]);
+  assert(composed.status === 0, `compose-only folder exits 0 (got ${composed.status})`);
+  const htmlPath = composedHtmlPath(composed.stdout);
+  assert(htmlPath && existsSync(htmlPath), 'compose-only prints a readable HTML path');
+  const html = htmlPath ? readFileSync(htmlPath, 'utf8') : '';
+  assert(!html.includes('<h2>01-overview</h2>'), 'front-matter-led # heading has no duplicate filename h2');
+  assert(!html.includes('<h2>02-h6</h2>'), 'ATX h6 heading has no duplicate filename h2');
+  assert(html.includes('<h1>Real Title</h1>'), 'front-matter body still renders the real h1');
+
+  console.log('Test 2: invalid templates fail for folder and markdown compose paths');
+  const folderBad = runBrochure([folder, '--template', 'missing-template']);
+  assert(folderBad.status !== 0, 'folder compose with invalid template exits non-zero');
+  assert(/unknown template "missing-template"/.test(folderBad.stderr), 'folder compose reports unknown template');
+  assert(/Available template\(s\): studio-default/.test(folderBad.stderr), 'folder compose lists available templates');
+  const mdFile = join(root, 'single.md');
+  writeFileSync(mdFile, '# Single\n\nBody.\n', 'utf8');
+  const mdBad = runBrochure([mdFile, '--template', 'missing-template']);
+  assert(mdBad.status !== 0, 'single markdown compose with invalid template exits non-zero');
+  assert(/unknown template "missing-template"/.test(mdBad.stderr), 'single markdown compose reports unknown template');
+
+  console.log('Test 3: native unzip fallback rejects zip-slip entries before extraction');
+  const zipPath = join(root, 'zip-slip.zip');
+  writeStoredZip(zipPath, '../evil.md', '# Evil\n');
+  const badZip = runBrochure([zipPath], { RDC_BROCHURE_DISABLE_ADM_ZIP: '1' });
+  assert(badZip.status !== 0, 'zip-slip archive exits non-zero');
+  assert(/zip-slip: entry/.test(badZip.stderr), 'zip-slip error is reported');
+  assert(!existsSync(join(root, 'evil.md')), 'zip-slip member was not extracted outside the destination');
+} finally {
+  rmSync(root, { recursive: true, force: true });
+}
+
+if (failures > 0) {
+  console.error(`\nFAILED: ${failures} assertion(s)`);
+  process.exit(1);
+}
+console.log('\nALL PASS');

package/tests/release-contract.test.mjs

@@ -0,0 +1,16 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = join(fileURLToPath(new URL('..', import.meta.url)));
+const release = readFileSync(join(root, 'RELEASE.md'), 'utf8');
+
+assert.match(release, /npm version patch --no-git-tag-version/);
+assert.match(release, /npm view @lifeaitools\/rdc-skills@<version> version/);
+assert.match(release, /npm pack @lifeaitools\/rdc-skills@<version>/);
+assert.match(release, /npm install -g @lifeaitools\/rdc-skills@<version>/);
+assert.match(release, /rdc-skills-install --profile core/);
+assert.match(release, /rdc-skills-install --profile lifeai/);
+
+console.log('release contract test passed');

package/tests/require-work-item-on-commit.test.mjs

@@ -1,162 +1,162 @@
-#!/usr/bin/env node
-/**
- * Truth Gate L1 — commit-capture hook tests.
- *
- * Proves:
- *   1. parse: the work-item UUID is extracted from a commit message; absent UUID -> null.
- *   2. capture: on a PostToolUse(git commit), the captured `sha` EQUALS the real
- *      `git rev-parse HEAD` of the repo (verified against a throwaway git repo,
- *      via the RDC_COMMIT_CAPTURE_SINK file — no live DB required).
- *   3. no-item: capture NO-OPs (writes nothing) when the commit message carries
- *      no work-item UUID. No orphan row.
- *
- * Run: node tests/require-work-item-on-commit.test.mjs   (or `node --test tests/`)
- */
-import { mkdtempSync, rmSync, existsSync, readFileSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join, resolve, dirname } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { spawnSync, execFileSync } from 'node:child_process';
-import { createRequire } from 'node:module';
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const REPO_ROOT = resolve(__dirname, '..');
-const HOOK = join(REPO_ROOT, 'hooks', 'require-work-item-on-commit.js');
-
-const require = createRequire(import.meta.url);
-const failures = [];
-function assert(name, condition, detail = '') {
-  if (!condition) failures.push(`${name}${detail ? `: ${detail}` : ''}`);
-}
-
-// ---------------------------------------------------------------------------
-// 1. Pure parse assertions
-// ---------------------------------------------------------------------------
-const hook = require(HOOK);
-const WI = 'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee';
-
-assert('parse: extracts UUID from message',
-  hook.parseCommitMessageWorkItem(`feat(x): do thing for ${WI}`) === WI);
-assert('parse: null when no UUID',
-  hook.parseCommitMessageWorkItem('feat(x): no work item here') === null);
-assert('isGitCommit: true for real commit',
-  hook.isGitCommit('git commit -m "feat: x"') === true);
-assert('isGitCommit: false for --help',
-  hook.isGitCommit('git commit --help') === false);
-assert('isGitCommit: false for unrelated',
-  hook.isGitCommit('git status') === false);
-assert('commitSucceeded: false on nothing-to-commit',
-  hook.commitSucceeded({ stdout: 'nothing to commit, working tree clean' }) === false);
-assert('commitSucceeded: true on exit 0',
-  hook.commitSucceeded({ exit_code: 0 }) === true);
-
-// ---------------------------------------------------------------------------
-// helper: build a throwaway git repo with one commit
-// ---------------------------------------------------------------------------
-function makeRepo() {
-  const dir = mkdtempSync(join(tmpdir(), 'wic-repo-'));
-  const g = (...args) => execFileSync('git', args, { cwd: dir, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
-  g('init', '-q');
-  g('config', 'user.email', 'test@example.com');
-  g('config', 'user.name', 'Test');
-  writeFileSync(join(dir, 'f.txt'), 'hello\n');
-  g('add', 'f.txt');
-  g('commit', '-q', '-m', `feat: seed for ${WI}`);
-  const head = g('rev-parse', 'HEAD').trim();
-  return { dir, head };
-}
-
-function runHook(payload, extraEnv = {}) {
-  return spawnSync(process.execPath, [HOOK], {
-    input: JSON.stringify(payload),
-    encoding: 'utf8',
-    env: { ...process.env, ...extraEnv },
-  });
-}
-
-// ---------------------------------------------------------------------------
-// 2. Capture: sha == git rev-parse HEAD
-// ---------------------------------------------------------------------------
-{
-  const { dir, head } = makeRepo();
-  const sink = join(dir, 'sink.jsonl');
-  // Point Supabase at an unreachable host so the test never touches a real DB;
-  // capture still writes the sink, which is what we assert on.
-  const res = runHook({
-    hook_event_name: 'PostToolUse',
-    tool_name: 'Bash',
-    session_id: 'sess-capture-1',
-    cwd: dir,
-    tool_input: { command: `git commit -m "feat: thing for ${WI}"` },
-    tool_response: { exit_code: 0, stdout: '1 file changed' },
-  }, {
-    RDC_COMMIT_CAPTURE_SINK: sink,
-    SUPABASE_URL: 'http://127.0.0.1:9',     // unreachable -> DB insert fails fast, capture still records sink
-    SUPABASE_SERVICE_ROLE_KEY: 'test-key-not-real',
-  });
-  assert('capture: hook exits zero', res.status === 0, res.stderr);
-  assert('capture: sink written', existsSync(sink), 'no sink file');
-  if (existsSync(sink)) {
-    const row = JSON.parse(readFileSync(sink, 'utf8').trim().split('\n')[0]);
-    assert('capture: sha equals real HEAD', row.sha === head, `${row.sha} !== ${head}`);
-    assert('capture: work_item_id parsed', row.work_item_id === WI, row.work_item_id);
-    assert('capture: session_id recorded', row.session_id === 'sess-capture-1', row.session_id);
-  }
-  rmSync(dir, { recursive: true, force: true });
-}
-
-// ---------------------------------------------------------------------------
-// 3. No active work item -> NO-OP (no sink row)
-// ---------------------------------------------------------------------------
-{
-  const { dir } = makeRepo();
-  const sink = join(dir, 'sink.jsonl');
-  const res = runHook({
-    hook_event_name: 'PostToolUse',
-    tool_name: 'Bash',
-    session_id: 'sess-no-item',
-    cwd: dir,
-    tool_input: { command: 'git commit -m "feat: no work item ref"' },
-    tool_response: { exit_code: 0 },
-  }, { RDC_COMMIT_CAPTURE_SINK: sink });
-  assert('no-item: hook exits zero', res.status === 0, res.stderr);
-  assert('no-item: no sink row written', !existsSync(sink), 'orphan capture written for no-item commit');
-  rmSync(dir, { recursive: true, force: true });
-}
-
-// ---------------------------------------------------------------------------
-// 4. PreToolUse legacy behavior preserved (warn-only, never blocks)
-//    Uses a fresh temp dir as HOME/USERPROFILE so no fixit.marker is visible
-//    regardless of real machine state — makes the warn-path assertion deterministic.
-// ---------------------------------------------------------------------------
-{
-  const fakeHome = mkdtempSync(join(tmpdir(), 'wic-home-'));
-  try {
-    const preEnv = { HOME: fakeHome, USERPROFILE: fakeHome };
-
-    const res = runHook({
-      hook_event_name: 'PreToolUse',
-      tool_name: 'Bash',
-      tool_input: { command: 'git commit -m "no convention and no uuid"' },
-    }, preEnv);
-    assert('pre: warn exits zero (never blocks)', res.status === 0, res.stderr);
-    assert('pre: emits warn systemMessage', /no work item reference/.test(res.stdout), res.stdout);
-
-    const ok = runHook({
-      hook_event_name: 'PreToolUse',
-      tool_name: 'Bash',
-      tool_input: { command: 'git commit -m "feat(x): conventional"' },
-    }, preEnv);
-    assert('pre: conventional passes silently', ok.status === 0 && ok.stdout.trim() === '', ok.stdout);
-  } finally {
-    rmSync(fakeHome, { recursive: true, force: true });
-  }
-}
-
-// ---------------------------------------------------------------------------
-if (failures.length > 0) {
-  console.error('\ncommit-capture hook tests — FAIL\n');
-  for (const f of failures) console.error(`  - ${f}`);
-  process.exit(1);
-}
-console.log('commit-capture hook tests — PASS');
+#!/usr/bin/env node
+/**
+ * Truth Gate L1 — commit-capture hook tests.
+ *
+ * Proves:
+ *   1. parse: the work-item UUID is extracted from a commit message; absent UUID -> null.
+ *   2. capture: on a PostToolUse(git commit), the captured `sha` EQUALS the real
+ *      `git rev-parse HEAD` of the repo (verified against a throwaway git repo,
+ *      via the RDC_COMMIT_CAPTURE_SINK file — no live DB required).
+ *   3. no-item: capture NO-OPs (writes nothing) when the commit message carries
+ *      no work-item UUID. No orphan row.
+ *
+ * Run: node tests/require-work-item-on-commit.test.mjs   (or `node --test tests/`)
+ */
+import { mkdtempSync, rmSync, existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync, execFileSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = resolve(__dirname, '..');
+const HOOK = join(REPO_ROOT, 'hooks', 'require-work-item-on-commit.js');
+
+const require = createRequire(import.meta.url);
+const failures = [];
+function assert(name, condition, detail = '') {
+  if (!condition) failures.push(`${name}${detail ? `: ${detail}` : ''}`);
+}
+
+// ---------------------------------------------------------------------------
+// 1. Pure parse assertions
+// ---------------------------------------------------------------------------
+const hook = require(HOOK);
+const WI = 'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee';
+
+assert('parse: extracts UUID from message',
+  hook.parseCommitMessageWorkItem(`feat(x): do thing for ${WI}`) === WI);
+assert('parse: null when no UUID',
+  hook.parseCommitMessageWorkItem('feat(x): no work item here') === null);
+assert('isGitCommit: true for real commit',
+  hook.isGitCommit('git commit -m "feat: x"') === true);
+assert('isGitCommit: false for --help',
+  hook.isGitCommit('git commit --help') === false);
+assert('isGitCommit: false for unrelated',
+  hook.isGitCommit('git status') === false);
+assert('commitSucceeded: false on nothing-to-commit',
+  hook.commitSucceeded({ stdout: 'nothing to commit, working tree clean' }) === false);
+assert('commitSucceeded: true on exit 0',
+  hook.commitSucceeded({ exit_code: 0 }) === true);
+
+// ---------------------------------------------------------------------------
+// helper: build a throwaway git repo with one commit
+// ---------------------------------------------------------------------------
+function makeRepo() {
+  const dir = mkdtempSync(join(tmpdir(), 'wic-repo-'));
+  const g = (...args) => execFileSync('git', args, { cwd: dir, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+  g('init', '-q');
+  g('config', 'user.email', 'test@example.com');
+  g('config', 'user.name', 'Test');
+  writeFileSync(join(dir, 'f.txt'), 'hello\n');
+  g('add', 'f.txt');
+  g('commit', '-q', '-m', `feat: seed for ${WI}`);
+  const head = g('rev-parse', 'HEAD').trim();
+  return { dir, head };
+}
+
+function runHook(payload, extraEnv = {}) {
+  return spawnSync(process.execPath, [HOOK], {
+    input: JSON.stringify(payload),
+    encoding: 'utf8',
+    env: { ...process.env, ...extraEnv },
+  });
+}
+
+// ---------------------------------------------------------------------------
+// 2. Capture: sha == git rev-parse HEAD
+// ---------------------------------------------------------------------------
+{
+  const { dir, head } = makeRepo();
+  const sink = join(dir, 'sink.jsonl');
+  // Point Supabase at an unreachable host so the test never touches a real DB;
+  // capture still writes the sink, which is what we assert on.
+  const res = runHook({
+    hook_event_name: 'PostToolUse',
+    tool_name: 'Bash',
+    session_id: 'sess-capture-1',
+    cwd: dir,
+    tool_input: { command: `git commit -m "feat: thing for ${WI}"` },
+    tool_response: { exit_code: 0, stdout: '1 file changed' },
+  }, {
+    RDC_COMMIT_CAPTURE_SINK: sink,
+    SUPABASE_URL: 'http://127.0.0.1:9',     // unreachable -> DB insert fails fast, capture still records sink
+    SUPABASE_SERVICE_ROLE_KEY: 'test-key-not-real',
+  });
+  assert('capture: hook exits zero', res.status === 0, res.stderr);
+  assert('capture: sink written', existsSync(sink), 'no sink file');
+  if (existsSync(sink)) {
+    const row = JSON.parse(readFileSync(sink, 'utf8').trim().split('\n')[0]);
+    assert('capture: sha equals real HEAD', row.sha === head, `${row.sha} !== ${head}`);
+    assert('capture: work_item_id parsed', row.work_item_id === WI, row.work_item_id);
+    assert('capture: session_id recorded', row.session_id === 'sess-capture-1', row.session_id);
+  }
+  rmSync(dir, { recursive: true, force: true });
+}
+
+// ---------------------------------------------------------------------------
+// 3. No active work item -> NO-OP (no sink row)
+// ---------------------------------------------------------------------------
+{
+  const { dir } = makeRepo();
+  const sink = join(dir, 'sink.jsonl');
+  const res = runHook({
+    hook_event_name: 'PostToolUse',
+    tool_name: 'Bash',
+    session_id: 'sess-no-item',
+    cwd: dir,
+    tool_input: { command: 'git commit -m "feat: no work item ref"' },
+    tool_response: { exit_code: 0 },
+  }, { RDC_COMMIT_CAPTURE_SINK: sink });
+  assert('no-item: hook exits zero', res.status === 0, res.stderr);
+  assert('no-item: no sink row written', !existsSync(sink), 'orphan capture written for no-item commit');
+  rmSync(dir, { recursive: true, force: true });
+}
+
+// ---------------------------------------------------------------------------
+// 4. PreToolUse legacy behavior preserved (warn-only, never blocks)
+//    Uses a fresh temp dir as HOME/USERPROFILE so no fixit.marker is visible
+//    regardless of real machine state — makes the warn-path assertion deterministic.
+// ---------------------------------------------------------------------------
+{
+  const fakeHome = mkdtempSync(join(tmpdir(), 'wic-home-'));
+  try {
+    const preEnv = { HOME: fakeHome, USERPROFILE: fakeHome };
+
+    const res = runHook({
+      hook_event_name: 'PreToolUse',
+      tool_name: 'Bash',
+      tool_input: { command: 'git commit -m "no convention and no uuid"' },
+    }, preEnv);
+    assert('pre: warn exits zero (never blocks)', res.status === 0, res.stderr);
+    assert('pre: emits warn systemMessage', /no work item reference/.test(res.stdout), res.stdout);
+
+    const ok = runHook({
+      hook_event_name: 'PreToolUse',
+      tool_name: 'Bash',
+      tool_input: { command: 'git commit -m "feat(x): conventional"' },
+    }, preEnv);
+    assert('pre: conventional passes silently', ok.status === 0 && ok.stdout.trim() === '', ok.stdout);
+  } finally {
+    rmSync(fakeHome, { recursive: true, force: true });
+  }
+}
+
+// ---------------------------------------------------------------------------
+if (failures.length > 0) {
+  console.error('\ncommit-capture hook tests — FAIL\n');
+  for (const f of failures) console.error(`  - ${f}`);
+  process.exit(1);
+}
+console.log('commit-capture hook tests — PASS');

package/tests/run-evidence-gate.test.mjs

@@ -1,82 +1,82 @@
-#!/usr/bin/env node
-/**
- * Truth Gate 3.0 — fused run-evidence-gate primitive tests.
- *
- * Proves the Nidus property: evidence cannot exist without a run.
- *   - a verdict is emitted ONLY after the command runs (no run => no pass).
- *   - the output hash is server-side and derived from the actual run.
- *   - isMachineArtifact rejects prose and accepts captured machine shapes.
- *
- * Run: node tests/run-evidence-gate.test.mjs
- */
-import { resolve, dirname, join } from 'node:path';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const LIB = pathToFileURL(join(resolve(__dirname, '..'), 'hooks', 'lib', 'run-evidence-gate.mjs')).href;
-const { runEvidenceGate, isMachineArtifact, hashOutput, EVIDENCE_KIND } = await import(LIB);
-
-const failures = [];
-function assert(name, cond, detail = '') {
-  if (!cond) failures.push(`${name}${detail ? `: ${detail}` : ''}`);
-  else process.stdout.write(`  ok  ${name}\n`);
-}
-
-// --- 1. A passing run produces verdict:'pass' WITH a hash, only after running.
-let ranCount = 0;
-const passArt = runEvidenceGate(
-  { command: 'noop', args: ['x'], label: 'unit-pass' },
-  () => { ranCount += 1; return { status: 0, stdout: 'ok', stderr: '' }; },
-);
-assert('runner invoked exactly once', ranCount === 1, String(ranCount));
-assert('pass: kind stamped', passArt.kind === EVIDENCE_KIND);
-assert('pass: ran=true', passArt.ran === true);
-assert('pass: verdict=pass', passArt.verdict === 'pass', passArt.verdict);
-assert('pass: output_sha256 present', typeof passArt.output_sha256 === 'string' && passArt.output_sha256.length === 64, passArt.output_sha256);
-
-// --- 2. A failing run -> verdict:'fail', never silently pass.
-const failArt = runEvidenceGate(
-  { command: 'noop' },
-  () => ({ status: 7, stdout: '', stderr: 'boom' }),
-);
-assert('fail: verdict=fail', failArt.verdict === 'fail', failArt.verdict);
-assert('fail: exit_code preserved', failArt.exit_code === 7, String(failArt.exit_code));
-
-// --- 3. NO RUN -> NO verdict (fail-closed). Invalid spec.
-const noCmd = runEvidenceGate({});
-assert('no-command: ran=false', noCmd.ran === false);
-assert('no-command: verdict=error (never pass)', noCmd.verdict === 'error', noCmd.verdict);
-
-// --- 4. Runner that yields no exit status -> cannot have run -> error.
-const noStatus = runEvidenceGate({ command: 'noop' }, () => ({ status: null, stdout: '', stderr: '' }));
-assert('no-status: ran=false', noStatus.ran === false);
-assert('no-status: verdict=error', noStatus.verdict === 'error', noStatus.verdict);
-
-// --- 5. Runner throws -> fail-closed error, never pass.
-const threw = runEvidenceGate({ command: 'noop' }, () => { throw new Error('spawn failed'); });
-assert('runner-throws: ran=false', threw.ran === false);
-assert('runner-throws: verdict=error', threw.verdict === 'error', threw.verdict);
-
-// --- 6. Hash is deterministic + derived from the captured combined output.
-assert('hash deterministic', hashOutput('abc') === hashOutput('abc'));
-assert('hash differs by content', hashOutput('abc') !== hashOutput('abd'));
-
-// --- 7. isMachineArtifact discrimination.
-assert('reject bare prose "HTTP 200"', isMachineArtifact('HTTP 200') === false);
-assert('reject bare prose "works"', isMachineArtifact('works') === false);
-assert('reject "107 nodes"', isMachineArtifact('107 nodes') === false);
-assert('accept fused artifact', isMachineArtifact(passArt) === true);
-assert('accept {exit_code}', isMachineArtifact({ exit_code: 0 }) === true);
-assert('accept {http_status}', isMachineArtifact({ http_status: 200 }) === true);
-assert('accept {rowcount}', isMachineArtifact({ rowcount: 12 }) === true);
-assert('accept {passed,total}', isMachineArtifact({ passed: 5, total: 5 }) === true);
-assert('accept JSON string of machine shape', isMachineArtifact('{"exit_code":0}') === true);
-assert('reject plain object', isMachineArtifact({ note: 'done' }) === false);
-assert('reject null', isMachineArtifact(null) === false);
-
-if (failures.length > 0) {
-  console.error('\nrun-evidence-gate tests — FAIL\n');
-  for (const f of failures) console.error(`  - ${f}`);
-  process.exit(1);
-}
-console.log('\nrun-evidence-gate tests — PASS');
+#!/usr/bin/env node
+/**
+ * Truth Gate 3.0 — fused run-evidence-gate primitive tests.
+ *
+ * Proves the Nidus property: evidence cannot exist without a run.
+ *   - a verdict is emitted ONLY after the command runs (no run => no pass).
+ *   - the output hash is server-side and derived from the actual run.
+ *   - isMachineArtifact rejects prose and accepts captured machine shapes.
+ *
+ * Run: node tests/run-evidence-gate.test.mjs
+ */
+import { resolve, dirname, join } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const LIB = pathToFileURL(join(resolve(__dirname, '..'), 'hooks', 'lib', 'run-evidence-gate.mjs')).href;
+const { runEvidenceGate, isMachineArtifact, hashOutput, EVIDENCE_KIND } = await import(LIB);
+
+const failures = [];
+function assert(name, cond, detail = '') {
+  if (!cond) failures.push(`${name}${detail ? `: ${detail}` : ''}`);
+  else process.stdout.write(`  ok  ${name}\n`);
+}
+
+// --- 1. A passing run produces verdict:'pass' WITH a hash, only after running.
+let ranCount = 0;
+const passArt = runEvidenceGate(
+  { command: 'noop', args: ['x'], label: 'unit-pass' },
+  () => { ranCount += 1; return { status: 0, stdout: 'ok', stderr: '' }; },
+);
+assert('runner invoked exactly once', ranCount === 1, String(ranCount));
+assert('pass: kind stamped', passArt.kind === EVIDENCE_KIND);
+assert('pass: ran=true', passArt.ran === true);
+assert('pass: verdict=pass', passArt.verdict === 'pass', passArt.verdict);
+assert('pass: output_sha256 present', typeof passArt.output_sha256 === 'string' && passArt.output_sha256.length === 64, passArt.output_sha256);
+
+// --- 2. A failing run -> verdict:'fail', never silently pass.
+const failArt = runEvidenceGate(
+  { command: 'noop' },
+  () => ({ status: 7, stdout: '', stderr: 'boom' }),
+);
+assert('fail: verdict=fail', failArt.verdict === 'fail', failArt.verdict);
+assert('fail: exit_code preserved', failArt.exit_code === 7, String(failArt.exit_code));
+
+// --- 3. NO RUN -> NO verdict (fail-closed). Invalid spec.
+const noCmd = runEvidenceGate({});
+assert('no-command: ran=false', noCmd.ran === false);
+assert('no-command: verdict=error (never pass)', noCmd.verdict === 'error', noCmd.verdict);
+
+// --- 4. Runner that yields no exit status -> cannot have run -> error.
+const noStatus = runEvidenceGate({ command: 'noop' }, () => ({ status: null, stdout: '', stderr: '' }));
+assert('no-status: ran=false', noStatus.ran === false);
+assert('no-status: verdict=error', noStatus.verdict === 'error', noStatus.verdict);
+
+// --- 5. Runner throws -> fail-closed error, never pass.
+const threw = runEvidenceGate({ command: 'noop' }, () => { throw new Error('spawn failed'); });
+assert('runner-throws: ran=false', threw.ran === false);
+assert('runner-throws: verdict=error', threw.verdict === 'error', threw.verdict);
+
+// --- 6. Hash is deterministic + derived from the captured combined output.
+assert('hash deterministic', hashOutput('abc') === hashOutput('abc'));
+assert('hash differs by content', hashOutput('abc') !== hashOutput('abd'));
+
+// --- 7. isMachineArtifact discrimination.
+assert('reject bare prose "HTTP 200"', isMachineArtifact('HTTP 200') === false);
+assert('reject bare prose "works"', isMachineArtifact('works') === false);
+assert('reject "107 nodes"', isMachineArtifact('107 nodes') === false);
+assert('accept fused artifact', isMachineArtifact(passArt) === true);
+assert('accept {exit_code}', isMachineArtifact({ exit_code: 0 }) === true);
+assert('accept {http_status}', isMachineArtifact({ http_status: 200 }) === true);
+assert('accept {rowcount}', isMachineArtifact({ rowcount: 12 }) === true);
+assert('accept {passed,total}', isMachineArtifact({ passed: 5, total: 5 }) === true);
+assert('accept JSON string of machine shape', isMachineArtifact('{"exit_code":0}') === true);
+assert('reject plain object', isMachineArtifact({ note: 'done' }) === false);
+assert('reject null', isMachineArtifact(null) === false);
+
+if (failures.length > 0) {
+  console.error('\nrun-evidence-gate tests — FAIL\n');
+  for (const f of failures) console.error(`  - ${f}`);
+  process.exit(1);
+}
+console.log('\nrun-evidence-gate tests — PASS');