@nanobpm/nano-workforce 0.105.0 → 0.106.1

package/app/pollUserTasks.test.ts

@@ -209,6 +209,43 @@ test("pollUserTasks: projects a blocked feature run (feature-blocked) with the d
   assertEquals(byKey["ut-blocked"].question, "agent gave up: no PR");
 });
 
+test("pollUserTasks: projects a conformance-escalation ack (issue #216) keyed to the epic, question from summary", async () => {
+  // The advisory `retro` process parks on a native `conformance-escalation` user task when the
+  // spec-conformance audit found the epic did not cleanly meet its spec. retro is not a delivery
+  // aggregate, so its instance is tracked on `plan_conformance` (review_status = 'reviewing'); the
+  // poller scans those rows, reads the open ack task from the engine, and projects it under the epic
+  // (plan) subject with the audit `summary` as its question. A settled ('reviewed') row is skipped.
+  const { data, stores } = memData({
+    plan_conformance: [
+      {
+        plan_key: "o/r#70",
+        process_key: "cp-70",
+        review_status: "reviewing",
+        summary: "slice 2 reduced; auth cache never verified",
+      },
+      { plan_key: "o/r#71", process_key: "cp-71", review_status: "reviewed", summary: "all clean" },
+    ],
+    plans: [
+      { plan_key: "o/r#70", status: "done", issue_url: "https://github.com/o/r/issues/70", title: "Ship the cache" },
+    ],
+  });
+  const engine = fakeEngine({
+    "cp-70": [{ userTaskKey: "ut-conf", elementId: "conformance-escalation" }],
+    "cp-71": [{ userTaskKey: "ut-conf-settled", elementId: "conformance-escalation" }],
+  });
+
+  await pollUserTasks(data, engine);
+
+  const byKey = Object.fromEntries((stores.user_tasks ?? []).map((r) => [r.user_task_key, r]));
+  assertEquals(Object.keys(byKey), ["ut-conf"]);
+  assertEquals(byKey["ut-conf"].element_id, "conformance-escalation");
+  assertEquals(byKey["ut-conf"].kind_label, "Conformance review");
+  assertEquals(byKey["ut-conf"].subject_type, "plan");
+  assertEquals(byKey["ut-conf"].subject_key, "o/r#70");
+  assertEquals(byKey["ut-conf"].subject_title, "Ship the cache");
+  assertEquals(byKey["ut-conf"].question, "slice 2 reduced; auth cache never verified");
+});
+
 test("pollUserTasks: removes a row once its task is no longer open (completed / out-of-band)", async () => {
   const { data, stores } = memData({
     user_tasks: [

package/app/service.ts

@@ -21,6 +21,11 @@ import {
   renderResolvedDepsBrief,
   UnresolvableCapabilityRefError,
 } from "./capabilityNeed.ts";
+import {
+  activeConformanceReviews,
+  CONFORMANCE_ESCALATION_ELEMENT,
+  conformanceEscalationQuestion,
+} from "./conformance.ts";
 import { isUniqueConstraintFence } from "./dbFence.ts";
 import { deriveDelivery, TERMINAL_STATUSES } from "./delivery.ts";
 import { fleetSupportsDurableResume } from "./durableResume.ts";
@@ -2199,6 +2204,41 @@ export async function pollUserTasks(data: DataLayer, engine: EngineClient) {
     }
   }
 
+  // Conformance-review acks (`conformance-escalation`) — the advisory `retro` process parks on a
+  // human ack when the spec-conformance audit finds the epic did NOT cleanly meet its spec (issue
+  // #216). retro is not one of the delivery aggregates above, so its instance is tracked on
+  // `plan_conformance` (migration 054): scan each row still `reviewing`, read its open ack task, and
+  // project it keyed to the epic (plan) subject, sourcing the question from the audit's `summary`.
+  for (const review of await activeConformanceReviews(data)) {
+    if (!review.process_key) continue;
+    let tasks: { userTaskKey: string; elementId?: string }[];
+    try {
+      tasks = await engine.openUserTasks({ processInstanceKey: review.process_key });
+    } catch (err) {
+      console.error(`[poller] user tasks (conformance ${review.plan_key}): ${err}`);
+      continue;
+    }
+    const plan = await plans(data).get(review.plan_key);
+    for (const t of tasks) {
+      if (t.elementId !== CONFORMANCE_ESCALATION_ELEMENT) continue;
+      push(
+        buildUserTaskRow(
+          {
+            userTaskKey: t.userTaskKey,
+            elementId: CONFORMANCE_ESCALATION_ELEMENT,
+            subjectType: "plan",
+            subjectKey: review.plan_key,
+            subjectTitle: plan?.title ?? null,
+            subjectUrl: plan?.issue_url ?? null,
+            question: conformanceEscalationQuestion(review),
+            processKey: review.process_key,
+          },
+          at,
+        ),
+      );
+    }
+  }
+
   const persisted = await userTasks(data).all();
   const { inserts, updates, deletes } = reconcileUserTasks(persisted, desired);
   for (const row of inserts) await userTasks(data).insert(row);

package/app/userTasks.test.ts

@@ -5,6 +5,7 @@
 // These are the pure source of truth the poller projects.
 import { test } from "node:test";
 import { assert, assertEquals } from "#test-assert";
+import { CONFORMANCE_ESCALATION_ELEMENT } from "./conformance.ts";
 import type { PlanReview } from "./plan.ts";
 import type { TrialMergeAuditRow } from "./trialMerge.ts";
 import {
@@ -63,6 +64,25 @@ test("buildUserTaskRow: a blank question / missing url normalises to null", () =
   assertEquals(row?.kind_label, "Trial merge");
 });
 
+test("buildUserTaskRow: a conformance-escalation projects the 'Conformance review' label (issue #216)", () => {
+  const row = buildUserTaskRow(
+    {
+      userTaskKey: "ut-c",
+      elementId: CONFORMANCE_ESCALATION_ELEMENT,
+      subjectType: "plan",
+      subjectKey: "o/r#7",
+      subjectTitle: "Ship the cache",
+      question: "slice 2 reduced",
+    },
+    AT,
+  );
+  assert(row !== null);
+  assertEquals(row?.element_id, "conformance-escalation");
+  assertEquals(row?.kind_label, "Conformance review");
+  assertEquals(row?.subject_type, "plan");
+  assertEquals(row?.question, "slice 2 reduced");
+});
+
 test("buildUserTaskRow: an unknown (non-escalation) element yields null — no arbitrary user task leaks", () => {
   const row = buildUserTaskRow(
     { userTaskKey: "ut-3", elementId: "some-internal-task", subjectType: "plan", subjectKey: "o/r#3" },

package/app/userTasks.ts

@@ -18,6 +18,7 @@
 // tasks visible; a completed task's row is removed on the next pass when the engine no longer reports
 // it open.
 import type { DataLayer } from "@nanobpm/urban";
+import { CONFORMANCE_ESCALATION_ELEMENT } from "./conformance.ts";
 import { FEATURE_BLOCKED_ELEMENT, FEATURE_ESCALATION_ELEMENT, type FeatureEscalationRow } from "./feature.ts";
 import type { PlanReview } from "./plan.ts";
 import type { TrialMergeAuditRow } from "./trialMerge.ts";
@@ -74,6 +75,7 @@ export const USER_TASK_KIND_LABELS: Readonly<Record<string, string>> = {
   [TRIAL_MERGE_ELEMENT]: "Trial merge",
   [PR_WAIT_ANSWER_ELEMENT]: "PR review",
   [PR_WAIT_MERGE_ANSWER_ELEMENT]: "PR merge",
+  [CONFORMANCE_ESCALATION_ELEMENT]: "Conformance review",
 };
 
 /** The denormalised context the poller has resolved for an open escalation user task. */

package/db/migrations/054_conformance_review_tracking.sql

@@ -0,0 +1,27 @@
+-- Conformance review — escalation instance tracking (issue #216).
+--
+-- When conformance finds the epic did NOT cleanly meet its spec (a reduced / not-verified item, or a
+-- deviation nobody raised), it escalates to the Tasks inbox as a NON-BLOCKING follow-up: the `retro`
+-- process parks on a native `conformance-escalation` user task until an operator acknowledges it.
+--
+-- The unified inbox (`user_tasks`, 034) is reconciled by `pollUserTasks`, which scans the open user
+-- tasks of each *instance-tracked* aggregate (feature_runs / plans / pull_requests). The retro process
+-- had no such tracking, so its user task was invisible to the inbox. These two columns make
+-- `plan_conformance` the retro run's tracking row: `process_key` is the retro process instance, and
+-- `review_status` is its escalation lifecycle — `reviewing` while the ack task is open (the poller
+-- scans these), `reviewed` once the run settles (set by `record-conformance` when there is nothing to
+-- escalate, by the `pr.conformance-ack` worker (`acknowledgeConformance`) when an operator
+-- acknowledges the escalation and the retro instance COMPLETES normally, and — as a crash/cancel
+-- safety net — by `instanceTracking.onTerminated` when the retro instance is TERMINATED rather than
+-- completing).
+--
+-- Forward-only, additive (expand): two nullable/defaulted columns on the table 052 just added; the
+-- runner wraps each file in its own transaction, so this file must NOT contain BEGIN/COMMIT.
+ALTER TABLE plan_conformance ADD COLUMN process_key TEXT;
+ALTER TABLE plan_conformance ADD COLUMN review_status TEXT NOT NULL DEFAULT 'reviewed';
+
+-- `pollUserTasks` scans open retro escalations by `review_status = 'reviewing'` every poll pass
+-- (app/conformance.ts `activeConformanceReviews`). Index it so the common-case status scan stays a
+-- cheap lookup instead of a full table scan as conformance rows accumulate — mirrors the
+-- `idx_feature_runs_status` precedent (028) for the equivalent status-scanned aggregate.
+CREATE INDEX IF NOT EXISTS idx_plan_conformance_review_status ON plan_conformance(review_status);

package/nano.app.json

@@ -67,6 +67,20 @@
         }
       },
       "pollMs": 5000
+    },
+    {
+      "table": "plan_conformance",
+      "keyField": "process_key",
+      "statusField": "review_status",
+      "activeStatuses": [
+        "reviewing"
+      ],
+      "onTerminated": {
+        "set": {
+          "review_status": "reviewed"
+        }
+      },
+      "pollMs": 5000
     }
   ],
   "workers": [
@@ -166,6 +180,10 @@
       "taskType": "pr.conformance-record",
       "handler": "workers/conformance-record/worker.ts"
     },
+    {
+      "taskType": "pr.conformance-ack",
+      "handler": "workers/conformance-ack/worker.ts"
+    },
     {
       "taskType": "pr.progress-check",
       "handler": "workers/progress-check/worker.ts"

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.105.0",
+  "version": "0.106.1",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",
   "imports": {
-    "#test-assert": "./test/assert.ts"
+    "#test-assert": "./test/assert.ts",
+    "#test-migrations": "./test/migrations.ts"
   },
   "engines": {
     "node": ">=22.6"
@@ -37,6 +38,7 @@
     "pretypecheck": "urban gen",
     "check:prompts": "node --experimental-strip-types scripts/check-agent-prompts.ts",
     "check:migrations": "node --experimental-strip-types scripts/check-migrations.ts",
+    "heal:migrations": "node --experimental-strip-types scripts/heal-migration-ledger.ts",
     "check:contracts": "node --experimental-strip-types scripts/check-contracts.ts",
     "reconcile:contracts": "node --experimental-strip-types scripts/reconcile-contracts.ts",
     "gen": "urban gen",

package/pages/tasks.page.json

@@ -532,6 +532,90 @@
         },
         "refreshMs": 5000
       }
+    },
+    {
+      "type": "dataGrid",
+      "id": "conformance-reviews",
+      "props": {
+        "title": "Conformance reviews",
+        "data": {
+          "kind": "datasource",
+          "source": "app",
+          "table": "user_tasks",
+          "filter": [
+            {
+              "field": "element_id",
+              "in": [
+                "conformance-escalation"
+              ]
+            }
+          ],
+          "orderBy": {
+            "field": "updated_at",
+            "dir": "desc"
+          }
+        },
+        "columns": [
+          {
+            "field": "subject_title",
+            "template": "{{subject_title}}",
+            "header": "Epic",
+            "subtitleField": "subject_key",
+            "truncate": true,
+            "linkField": "subject_url"
+          },
+          {
+            "field": "question",
+            "header": "Findings"
+          },
+          {
+            "field": "subject_url",
+            "header": "Issue"
+          },
+          {
+            "field": "process_key",
+            "header": "Process",
+            "link": {
+              "kind": "processExplorer",
+              "keyField": "process_key"
+            }
+          },
+          {
+            "field": "updated_at",
+            "header": "Updated",
+            "format": "datetime"
+          }
+        ],
+        "rowKey": "user_task_key",
+        "detail": {
+          "linkField": "subject_url",
+          "fields": [
+            {
+              "field": "question",
+              "label": "Findings"
+            }
+          ],
+          "form": {
+            "showWhenField": "user_task_key",
+            "title": "Acknowledge conformance review",
+            "promptField": "question",
+            "inputKey": "note",
+            "inputLabel": "Disposition note (what you decided / follow-up)",
+            "submitLabel": "Acknowledge & close",
+            "action": {
+              "path": "/app/api/actions/complete-user-task",
+              "successLabel": "Acknowledged — the review will close",
+              "body": {
+                "userTaskKey": "{{row.user_task_key}}",
+                "variables": {
+                  "note": "{{form.note}}"
+                }
+              }
+            }
+          }
+        },
+        "refreshMs": 5000
+      }
     }
   ]
 }

package/resources/forms/conformance-escalation.form

@@ -0,0 +1,17 @@
+{
+  "id": "conformance-escalation",
+  "schemaVersion": 18,
+  "type": "default",
+  "components": [
+    {
+      "type": "text",
+      "text": "The spec-conformance review found this epic did **not** cleanly meet its spec — a slice was reduced or could not be verified against the code, or a deviation was made that nobody raised during implementation. The delivery already landed, so this is a **non-blocking** follow-up: review the report on the epic issue, decide any remediation, then acknowledge to close it.",
+      "label": "Conformance review"
+    },
+    {
+      "type": "textarea",
+      "key": "note",
+      "label": "Disposition note (what you decided / follow-up — recorded on the review)"
+    }
+  ]
+}

package/resources/processes/retro.bpmn

@@ -61,7 +61,32 @@
         </zeebe:properties>
       </bpmn:extensionElements>
       <bpmn:incoming>f_toRecordConformance</bpmn:incoming>
-      <bpmn:outgoing>f_toSynthesize</bpmn:outgoing>
+      <bpmn:outgoing>f_toDeviationsGw</bpmn:outgoing>
+    </bpmn:serviceTask>
+    <bpmn:exclusiveGateway id="gw-deviations" name="deviations?" default="f_noDeviations">
+      <bpmn:incoming>f_toDeviationsGw</bpmn:incoming>
+      <bpmn:outgoing>f_deviations</bpmn:outgoing>
+      <bpmn:outgoing>f_noDeviations</bpmn:outgoing>
+    </bpmn:exclusiveGateway>
+    <bpmn:userTask id="conformance-escalation" name="Conformance review (human)">
+      <bpmn:extensionElements>
+        <zeebe:formDefinition formId="conformance-escalation" />
+        <zeebe:userTask />
+        <zeebe:assignmentDefinition candidateGroups="operators" />
+      </bpmn:extensionElements>
+      <bpmn:incoming>f_deviations</bpmn:incoming>
+      <bpmn:outgoing>f_toConformanceAck</bpmn:outgoing>
+    </bpmn:userTask>
+    <bpmn:serviceTask id="record-conformance-ack" name="Record acknowledgement">
+      <bpmn:extensionElements>
+        <zeebe:taskDefinition type="pr.conformance-ack" />
+        <zeebe:ioMapping>
+          <zeebe:input source="=planKey" target="planKey" />
+          <zeebe:input source="=if (is defined(note)) then note else null" target="note" />
+        </zeebe:ioMapping>
+      </bpmn:extensionElements>
+      <bpmn:incoming>f_toConformanceAck</bpmn:incoming>
+      <bpmn:outgoing>f_ackToSynthesize</bpmn:outgoing>
     </bpmn:serviceTask>
     <bpmn:serviceTask id="synthesize" name="Synthesize &#38; promote (agent)">
       <bpmn:extensionElements>
@@ -73,7 +98,8 @@
           <zeebe:input source="=retroDigest" target="appendPrompt" />
         </zeebe:ioMapping>
       </bpmn:extensionElements>
-      <bpmn:incoming>f_toSynthesize</bpmn:incoming>
+      <bpmn:incoming>f_noDeviations</bpmn:incoming>
+      <bpmn:incoming>f_ackToSynthesize</bpmn:incoming>
       <bpmn:outgoing>f_toRecord</bpmn:outgoing>
     </bpmn:serviceTask>
     <bpmn:serviceTask id="record" name="Record retro">
@@ -92,7 +118,13 @@
     <bpmn:sequenceFlow id="f_start" sourceRef="Start" targetRef="gather" />
     <bpmn:sequenceFlow id="f_toConformance" sourceRef="gather" targetRef="conformance" />
     <bpmn:sequenceFlow id="f_toRecordConformance" sourceRef="conformance" targetRef="record-conformance" />
-    <bpmn:sequenceFlow id="f_toSynthesize" sourceRef="record-conformance" targetRef="synthesize" />
+    <bpmn:sequenceFlow id="f_toDeviationsGw" sourceRef="record-conformance" targetRef="gw-deviations" />
+    <bpmn:sequenceFlow id="f_deviations" name="deviations" sourceRef="gw-deviations" targetRef="conformance-escalation">
+      <bpmn:conditionExpression xsi:type="bpmn:tFormalExpression">=hasDeviations = true</bpmn:conditionExpression>
+    </bpmn:sequenceFlow>
+    <bpmn:sequenceFlow id="f_noDeviations" sourceRef="gw-deviations" targetRef="synthesize" />
+    <bpmn:sequenceFlow id="f_toConformanceAck" sourceRef="conformance-escalation" targetRef="record-conformance-ack" />
+    <bpmn:sequenceFlow id="f_ackToSynthesize" sourceRef="record-conformance-ack" targetRef="synthesize" />
     <bpmn:sequenceFlow id="f_toRecord" sourceRef="synthesize" targetRef="record" />
     <bpmn:sequenceFlow id="f_toEnd" sourceRef="record" targetRef="End" />
   </bpmn:process>
@@ -113,16 +145,28 @@
       <bpmndi:BPMNShape id="BPMNShape_record-conformance" bpmnElement="record-conformance">
         <dc:Bounds x="616" y="80" width="100" height="80" />
       </bpmndi:BPMNShape>
+      <bpmndi:BPMNShape id="BPMNShape_gw-deviations" bpmnElement="gw-deviations" isMarkerVisible="true">
+        <dc:Bounds x="776" y="95" width="50" height="50" />
+        <bpmndi:BPMNLabel>
+          <dc:Bounds x="770" y="65" width="62" height="14" />
+        </bpmndi:BPMNLabel>
+      </bpmndi:BPMNShape>
+      <bpmndi:BPMNShape id="BPMNShape_conformance-escalation" bpmnElement="conformance-escalation">
+        <dc:Bounds x="751" y="240" width="100" height="80" />
+      </bpmndi:BPMNShape>
+      <bpmndi:BPMNShape id="BPMNShape_record-conformance-ack" bpmnElement="record-conformance-ack">
+        <dc:Bounds x="911" y="240" width="100" height="80" />
+      </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_synthesize" bpmnElement="synthesize">
-        <dc:Bounds x="816" y="80" width="100" height="80" />
+        <dc:Bounds x="1056" y="80" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_record" bpmnElement="record">
-        <dc:Bounds x="1016" y="80" width="100" height="80" />
+        <dc:Bounds x="1256" y="80" width="100" height="80" />
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="BPMNShape_End" bpmnElement="End">
-        <dc:Bounds x="1216" y="102" width="36" height="36" />
+        <dc:Bounds x="1456" y="102" width="36" height="36" />
         <bpmndi:BPMNLabel>
-          <dc:Bounds x="1194" y="143" width="80" height="14" />
+          <dc:Bounds x="1434" y="143" width="80" height="14" />
         </bpmndi:BPMNLabel>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNEdge id="BPMNEdge_f_start" bpmnElement="f_start">
@@ -137,17 +181,34 @@
         <di:waypoint x="516" y="120" />
         <di:waypoint x="616" y="120" />
       </bpmndi:BPMNEdge>
-      <bpmndi:BPMNEdge id="BPMNEdge_f_toSynthesize" bpmnElement="f_toSynthesize">
+      <bpmndi:BPMNEdge id="BPMNEdge_f_toDeviationsGw" bpmnElement="f_toDeviationsGw">
         <di:waypoint x="716" y="120" />
-        <di:waypoint x="816" y="120" />
+        <di:waypoint x="776" y="120" />
+      </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_noDeviations" bpmnElement="f_noDeviations">
+        <di:waypoint x="826" y="120" />
+        <di:waypoint x="1056" y="120" />
+      </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_deviations" bpmnElement="f_deviations">
+        <di:waypoint x="801" y="145" />
+        <di:waypoint x="801" y="240" />
+      </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_toConformanceAck" bpmnElement="f_toConformanceAck">
+        <di:waypoint x="851" y="280" />
+        <di:waypoint x="911" y="280" />
+      </bpmndi:BPMNEdge>
+      <bpmndi:BPMNEdge id="BPMNEdge_f_ackToSynthesize" bpmnElement="f_ackToSynthesize">
+        <di:waypoint x="1011" y="280" />
+        <di:waypoint x="1106" y="280" />
+        <di:waypoint x="1106" y="160" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_toRecord" bpmnElement="f_toRecord">
-        <di:waypoint x="916" y="120" />
-        <di:waypoint x="1016" y="120" />
+        <di:waypoint x="1156" y="120" />
+        <di:waypoint x="1256" y="120" />
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="BPMNEdge_f_toEnd" bpmnElement="f_toEnd">
-        <di:waypoint x="1116" y="120" />
-        <di:waypoint x="1216" y="120" />
+        <di:waypoint x="1356" y="120" />
+        <di:waypoint x="1456" y="120" />
       </bpmndi:BPMNEdge>
     </bpmndi:BPMNPlane>
   </bpmndi:BPMNDiagram>

package/scripts/check-migrations.test.ts

@@ -0,0 +1,58 @@
+// Red/green coverage for the migration immutability gate (scripts/check-migrations.ts, issue #357).
+//
+// The runtime keys the migration ledger by FILENAME, so once a migration merges it must never be
+// renamed (re-runs against a migrated DB and aborts boot), deleted (desyncs ledger from schema), or
+// edited (silently no-ops on migrated installs). The gate diffs db/migrations against the merge-base
+// with origin/main; here we drive its diff classifier directly with representative
+// `git diff --find-renames --name-status` output so each violation shape is pinned.
+import test from "node:test";
+import { immutabilityErrorsFromDiff } from "./check-migrations.ts";
+import { assert, assertEquals } from "#test-assert";
+
+test("a rename of a merged migration is a violation", () => {
+  const errors = immutabilityErrorsFromDiff(
+    "R100\tdb/migrations/043_user_tasks_subject_title.sql\tdb/migrations/046_user_tasks_subject_title.sql",
+  );
+  assertEquals(errors.length, 1);
+  assert(/RENAMED/.test(errors[0]));
+  assert(/043_user_tasks_subject_title.sql -> 046_user_tasks_subject_title.sql/.test(errors[0]));
+});
+
+test("a delete of a merged migration is a violation", () => {
+  const errors = immutabilityErrorsFromDiff("D\tdb/migrations/046_user_tasks_subject_title.sql");
+  assertEquals(errors.length, 1);
+  assert(/DELETED/.test(errors[0]));
+});
+
+test("an edit of a merged migration is a violation", () => {
+  const errors = immutabilityErrorsFromDiff("M\tdb/migrations/046_user_tasks_subject_title.sql");
+  assertEquals(errors.length, 1);
+  assert(/EDITED/.test(errors[0]));
+});
+
+test("adding a new migration is allowed", () => {
+  assertEquals(
+    immutabilityErrorsFromDiff("A\tdb/migrations/061_brand_new.sql"),
+    [],
+    "an addition is not a violation",
+  );
+});
+
+test("a clean diff (no migration changes) yields no violations", () => {
+  assertEquals(immutabilityErrorsFromDiff(""), []);
+});
+
+test("mixed changes report every violation but ignore the addition", () => {
+  const errors = immutabilityErrorsFromDiff(
+    [
+      "A\tdb/migrations/061_new.sql",
+      "M\tdb/migrations/010_old.sql",
+      "D\tdb/migrations/011_gone.sql",
+      "R096\tdb/migrations/012_a.sql\tdb/migrations/013_a.sql",
+    ].join("\n"),
+  );
+  assertEquals(errors.length, 3, "the three mutations are flagged, the addition is not");
+  assert(errors.some((e) => /EDITED/.test(e)));
+  assert(errors.some((e) => /DELETED/.test(e)));
+  assert(errors.some((e) => /RENAMED/.test(e)));
+});