@neurcode-ai/governance-runtime 0.1.2 → 0.1.3

package/src/index.test.ts

@@ -335,6 +335,89 @@ test('compileDeterministicConstraints supports exact invocation constraints', ()
   assert.equal(rule?.maxMatchesPerFile, 3);
 });
 
+test('compileDeterministicConstraints supports repo-scoped invocation constraints', () => {
+  const compiled = compileDeterministicConstraints({
+    intentConstraints: 'foo should be called at most 2 times across repository',
+  });
+
+  const rule = compiled.rules.find((item) => item.id.includes('invocations_foo_repo'));
+  assert.ok(rule, 'expected repo-scoped invocation rule');
+  assert.equal(rule?.evaluationScope, 'repo');
+  assert.equal(rule?.maxMatchesPerFile, 2);
+});
+
+test('evaluatePlanVerification enforces repo-scoped invocation constraints', () => {
+  const result = evaluatePlanVerification({
+    planFiles: SAMPLE_PLAN,
+    changedFiles: [
+      {
+        path: 'src/a.ts',
+        changeType: 'modify',
+        added: 1,
+        removed: 0,
+        hunks: [
+          {
+            oldStart: 1,
+            oldLines: 0,
+            newStart: 1,
+            newLines: 1,
+            lines: [
+              {
+                type: 'added',
+                content: 'const marker = true;',
+              },
+            ],
+          },
+        ],
+      },
+    ],
+    intentConstraints: 'foo called at most 1 times across repository',
+    fileContents: {
+      'src/a.ts': 'foo();\n',
+      'src/b.ts': 'foo();\n',
+    },
+  });
+
+  assert.equal(result.verdict, 'FAIL');
+  assert.ok(result.constraintViolations.some((item) => /across repository scope/i.test(item)));
+});
+
+test('evaluatePlanVerification detects exported API signature drift constraints', () => {
+  const result = evaluatePlanVerification({
+    planFiles: SAMPLE_PLAN,
+    changedFiles: [
+      {
+        path: 'src/api.ts',
+        changeType: 'modify',
+        added: 1,
+        removed: 1,
+        hunks: [
+          {
+            oldStart: 1,
+            oldLines: 1,
+            newStart: 1,
+            newLines: 1,
+            lines: [
+              {
+                type: 'removed',
+                content: 'export function createUser(name: string): User {',
+              },
+              {
+                type: 'added',
+                content: 'export function createUser(name: string, email: string): User {',
+              },
+            ],
+          },
+        ],
+      },
+    ],
+    intentConstraints: 'Do not change public API signatures',
+  });
+
+  assert.equal(result.verdict, 'FAIL');
+  assert.ok(result.constraintViolations.some((item) => /signature delta/i.test(item)));
+});
+
 test('evaluatePlanVerification detects network-call invariants deterministically', () => {
   const result = evaluatePlanVerification({
     planFiles: SAMPLE_PLAN,
@@ -368,6 +451,43 @@ test('evaluatePlanVerification detects network-call invariants deterministically
   assert.match(result.constraintViolations[0], /network-call/i);
 });
 
+test('compileDeterministicConstraints expands advanced architectural invariants', () => {
+  const compiled = compileDeterministicConstraints({
+    intentConstraints: [
+      'Preserve backward compatibility for public endpoints',
+      'Maintain async event ordering and do not process messages out of order',
+      'Do not remove required fields from event payload schema',
+      'Enforce multi-tenant isolation and avoid cross-tenant access',
+      'Do not invalidate global cache keys',
+      'Preserve idempotency guarantees for retryable writes',
+      'Avoid destructive schema migrations such as DROP COLUMN',
+    ].join('; '),
+  });
+
+  const ruleIds = compiled.rules.map((rule) => rule.id);
+  assert.ok(ruleIds.includes('intent:backward_compatibility'));
+  assert.ok(ruleIds.includes('intent:async_ordering'));
+  assert.ok(ruleIds.includes('intent:event_schema_consistency'));
+  assert.ok(ruleIds.includes('intent:multi_tenant_isolation'));
+  assert.ok(ruleIds.includes('intent:cache_invariant'));
+  assert.ok(ruleIds.includes('intent:idempotency'));
+  assert.ok(ruleIds.includes('intent:migration_safety'));
+});
+
+test('compileDeterministicConstraints attaches provenance metadata', () => {
+  const compiled = compileDeterministicConstraints({
+    intentConstraints: 'Preserve backward compatibility for public endpoints in src/api/**',
+  });
+
+  const rule = compiled.rules.find((item) => item.id === 'intent:backward_compatibility');
+  assert.ok(rule, 'expected backward compatibility rule');
+  assert.ok(rule?.provenance, 'expected provenance metadata');
+  assert.equal(rule?.provenance?.why.length ? true : false, true);
+  assert.ok((rule?.provenance?.evidence || []).length > 0);
+  assert.ok((rule?.provenance?.trustBoundaries || []).includes('public-api'));
+  assert.ok((rule?.provenance?.contributingGraphPaths || []).includes('src/api/**'));
+});
+
 test('buildPlanVerificationMessage handles incomplete 0/0 plans', () => {
   const message = buildPlanVerificationMessage({
     constraintViolations: [],

package/src/index.ts

@@ -125,6 +125,10 @@ function detectConstraintViolations(
 
   const violations: string[] = [];
   const seenViolations = new Set<string>();
+  const normalizedFileContents: Record<string, string> = {};
+  for (const [path, content] of Object.entries(fileContents || {})) {
+    normalizedFileContents[normalizeRepoPath(path)] = content;
+  }
 
   const pathMatchesRule = (rule: DeterministicConstraintRule, filePath: string): boolean => {
     const include = rule.pathIncludes || [];
@@ -149,7 +153,106 @@ function detectConstraintViolations(
     return total;
   };
 
+  const addedLinesByPath = new Map<string, string>();
+  for (const file of changedFiles) {
+    const addedLines = (file.hunks || []).flatMap((hunk) =>
+      hunk.lines
+        .filter((line) => line.type === 'added')
+        .map((line) => line.content)
+    );
+    addedLinesByPath.set(file.path, addedLines.join('\n'));
+  }
+
+  const candidateRepoPaths = new Set<string>([
+    ...changedFiles.map((file) => file.path),
+    ...Object.keys(normalizedFileContents),
+  ]);
+
   for (const rule of rules) {
+    if (rule.evaluationMode === 'signature_delta') {
+      for (const file of changedFiles) {
+        if (!pathMatchesRule(rule, file.path)) {
+          continue;
+        }
+        const addedSignatureLines = (file.hunks || []).flatMap((hunk) =>
+          hunk.lines
+            .filter((line) => line.type === 'added' && new RegExp(rule.pattern.source, rule.pattern.flags).test(line.content))
+            .map((line) => line.content)
+        );
+        const removedSignatureLines = (file.hunks || []).flatMap((hunk) =>
+          hunk.lines
+            .filter((line) => line.type === 'removed' && new RegExp(rule.pattern.source, rule.pattern.flags).test(line.content))
+            .map((line) => line.content)
+        );
+        const deltaCount = addedSignatureLines.length + removedSignatureLines.length;
+        if (deltaCount === 0) {
+          continue;
+        }
+        const violation =
+          `Exported API signature delta detected in ${file.path} ` +
+          `(added ${addedSignatureLines.length}, removed ${removedSignatureLines.length}, violates constraint: "${rule.displayName}")`;
+        if (!seenViolations.has(violation)) {
+          seenViolations.add(violation);
+          violations.push(violation);
+        }
+      }
+      continue;
+    }
+
+    const hasMatchBounds =
+      (typeof rule.maxMatchesPerFile === 'number' && Number.isFinite(rule.maxMatchesPerFile))
+      || (typeof rule.minMatchesPerFile === 'number' && Number.isFinite(rule.minMatchesPerFile));
+
+    if (rule.evaluationScope === 'repo' && hasMatchBounds) {
+      let repoMatchCount = 0;
+      let scannedPaths = 0;
+      for (const filePath of candidateRepoPaths) {
+        if (!pathMatchesRule(rule, filePath)) {
+          continue;
+        }
+        const fullContent = normalizedFileContents[filePath];
+        const addedFallback = addedLinesByPath.get(filePath) || '';
+        const haystack =
+          rule.evaluationMode === 'full_file' && typeof fullContent === 'string'
+            ? fullContent
+            : addedFallback;
+        if (!haystack) {
+          continue;
+        }
+        scannedPaths += 1;
+        repoMatchCount += countMatches(rule.pattern, haystack);
+      }
+
+      if (
+        typeof rule.maxMatchesPerFile === 'number'
+        && Number.isFinite(rule.maxMatchesPerFile)
+        && repoMatchCount > rule.maxMatchesPerFile
+      ) {
+        const violation =
+          `${rule.matchToken} matched ${repoMatchCount} times across repository scope ` +
+          `(limit ${rule.maxMatchesPerFile}, scanned ${scannedPaths} file(s), violates constraint: "${rule.displayName}")`;
+        if (!seenViolations.has(violation)) {
+          seenViolations.add(violation);
+          violations.push(violation);
+        }
+      }
+
+      if (
+        typeof rule.minMatchesPerFile === 'number'
+        && Number.isFinite(rule.minMatchesPerFile)
+        && repoMatchCount < rule.minMatchesPerFile
+      ) {
+        const violation =
+          `${rule.matchToken} matched ${repoMatchCount} times across repository scope ` +
+          `(minimum ${rule.minMatchesPerFile}, scanned ${scannedPaths} file(s), violates constraint: "${rule.displayName}")`;
+        if (!seenViolations.has(violation)) {
+          seenViolations.add(violation);
+          violations.push(violation);
+        }
+      }
+      continue;
+    }
+
     for (const file of changedFiles) {
       if (!pathMatchesRule(rule, file.path)) {
         continue;
@@ -158,27 +261,14 @@ function detectConstraintViolations(
         continue;
       }
 
-      const addedLines = file.hunks.flatMap((hunk) =>
-        hunk.lines
-          .filter((line) => line.type === 'added')
-          .map((line) => line.content)
-      );
+      const addedLines = addedLinesByPath.get(file.path) || '';
 
-      if (
-        (
-          typeof rule.maxMatchesPerFile === 'number'
-          && Number.isFinite(rule.maxMatchesPerFile)
-        ) || (
-          typeof rule.minMatchesPerFile === 'number'
-          && Number.isFinite(rule.minMatchesPerFile)
-        )
-      ) {
-        const fallbackText = addedLines.join('\n');
-        const fullContent = fileContents?.[file.path];
+      if (hasMatchBounds) {
+        const fullContent = normalizedFileContents[file.path];
         const haystack =
           rule.evaluationMode === 'full_file' && typeof fullContent === 'string'
             ? fullContent
-            : fallbackText;
+            : addedLines;
         const matchCount = countMatches(rule.pattern, haystack);
         if (
           typeof rule.maxMatchesPerFile === 'number'