@ngocsangairvds/vsaf 3.2.14 → 3.2.15

package/tools/vds-scripts/audit_orchestrator/tests/test_cli/test_report_cmds.py

@@ -1,1317 +0,0 @@
-"""Tests for Package RR: Report Infrastructure (TSK-940.63–68).
-
-Covers:
-- TSK-940.63: VDS_AUDIT_REPORT_DIR env var override precedence
-- TSK-940.64: report list command (--json-only, --latest-only, --repo filter)
-- TSK-940.65: report show command (artifact listing, --json-only)
-- TSK-940.66: checkpoint_path in workflow-summary.json and run-history.json
-- TSK-940.67: report prune command (dry-run, --execute, --keep-latest, /tmp cleanup)
-- H-1: BatchProcessor.get_checkpoint_path() public accessor (FR-278)
-"""
-
-from __future__ import annotations
-
-import json
-from datetime import UTC, datetime, timedelta
-from pathlib import Path
-from typing import Any
-
-import pytest
-from typer.testing import CliRunner
-from vds_audit_orchestrator import cli, cli_impl, report_cmds
-
-runner = CliRunner()
-
-
-@pytest.fixture(autouse=True)
-def _isolate_env(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setenv("VDS_AUDIT_BOOTSTRAP_HOME", "0")
-    monkeypatch.setattr(cli, "load_shared_env", lambda *args, **kwargs: {})
-    monkeypatch.setenv("VDS_AUDIT_STATE_DSN", "")
-    monkeypatch.delenv("VDS_AUDIT_REPORT_DIR", raising=False)
-
-
-# ── TSK-940.63: VDS_AUDIT_REPORT_DIR env var override ────────────────────
-
-
-class TestReportDirEnvVar:
-    """TSK-940.63: Configurable report directory via env var."""
-
-    def test_resolve_default_report_dir_returns_hardcoded_when_env_unset(self, monkeypatch: pytest.MonkeyPatch) -> None:
-        monkeypatch.delenv("VDS_AUDIT_REPORT_DIR", raising=False)
-        result = cli._resolve_default_report_dir()
-        assert result == cli_impl._DEFAULT_REPORT_ROOT
-
-    def test_resolve_default_report_dir_uses_env_var_when_set(
-        self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path
-    ) -> None:
-        custom_dir = tmp_path / "custom-reports"
-        monkeypatch.setenv("VDS_AUDIT_REPORT_DIR", str(custom_dir))
-        result = cli._resolve_default_report_dir()
-        assert result == custom_dir.resolve()
-
-    def test_resolve_default_report_dir_env_var_overrides_hardcoded(
-        self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path
-    ) -> None:
-        """Precedence: env var > hardcoded default."""
-        custom_dir = tmp_path / "override"
-        monkeypatch.setenv("VDS_AUDIT_REPORT_DIR", str(custom_dir))
-        result = cli._resolve_default_report_dir()
-        assert result != cli_impl._DEFAULT_REPORT_ROOT
-        assert result == custom_dir.resolve()
-
-    def test_resolve_default_report_dir_ignores_whitespace_env(self, monkeypatch: pytest.MonkeyPatch) -> None:
-        monkeypatch.setenv("VDS_AUDIT_REPORT_DIR", "   ")
-        result = cli._resolve_default_report_dir()
-        assert result == cli_impl._DEFAULT_REPORT_ROOT
-
-    def test_resolve_default_report_dir_no_crash_on_nonexistent_path(self, monkeypatch: pytest.MonkeyPatch) -> None:
-        """Deferred validation: does not crash at import time for missing dirs."""
-        monkeypatch.setenv("VDS_AUDIT_REPORT_DIR", "/nonexistent/path/does-not-exist")
-        result = cli._resolve_default_report_dir()
-        assert result == Path("/nonexistent/path/does-not-exist").resolve()
-
-    def test_resolve_default_report_dir_expands_tilde(self, monkeypatch: pytest.MonkeyPatch) -> None:
-        monkeypatch.setenv("VDS_AUDIT_REPORT_DIR", "~/my-reports")
-        result = cli._resolve_default_report_dir()
-        assert "~" not in str(result)
-        assert result == Path("~/my-reports").expanduser().resolve()
-
-
-# ── Helpers for report commands ──────────────────────────────────────────
-
-
-def _write_run_history(project_dir: Path, entries: list[dict[str, Any]]) -> Path:
-    """Write a run-history.json file for testing."""
-    runs_dir = project_dir / "runs"
-    runs_dir.mkdir(parents=True, exist_ok=True)
-    history_path = runs_dir / "run-history.json"
-    history_path.write_text(
-        json.dumps({"entries": entries}, indent=2, default=str),
-        encoding="utf-8",
-    )
-    return history_path
-
-
-def _write_run_root_history(run_root: Path, entries: list[dict[str, Any]]) -> Path:
-    """Write a run-history.json file at an effective run root."""
-    run_root.mkdir(parents=True, exist_ok=True)
-    history_path = run_root / "run-history.json"
-    history_path.write_text(
-        json.dumps({"entries": entries}, indent=2, default=str),
-        encoding="utf-8",
-    )
-    return history_path
-
-
-def _make_entry(
-    *,
-    run_id: str = "run-1",
-    repo: str = "merchant-billing",
-    status: str = "complete",
-    score: float = 85.0,
-    findings: int = 3,
-    updated_at: str | None = None,
-    report_dir: str = "/tmp/fake-report-dir",
-    page_id: str | None = None,
-    checkpoint_path: str | None = None,
-) -> dict[str, Any]:
-    if updated_at is None:
-        updated_at = datetime.now(UTC).isoformat()
-    entry: dict[str, Any] = {
-        "run_id": run_id,
-        "project_storage_key": "test-project",
-        "repo_storage_key": repo,
-        "updated_at": updated_at,
-        "summary": {
-            "status": status,
-            "total_findings": findings,
-            "overall_score": score,
-        },
-        "report_dir": report_dir,
-        "confluence_page_id": page_id,
-    }
-    if checkpoint_path is not None:
-        entry["checkpoint_path"] = checkpoint_path
-    return entry
-
-
-def _write_checklist_rows(report_dir: Path, rows: list[dict[str, Any]]) -> None:
-    """Write a checklist artifact with row-level scores."""
-    report_dir.mkdir(parents=True, exist_ok=True)
-    (report_dir / "checklist-trend.json").write_text(
-        json.dumps({"rows": rows}, indent=2),
-        encoding="utf-8",
-    )
-
-
-# ── TSK-940.64: report list command ──────────────────────────────────────
-
-
-class TestReportList:
-    """TSK-940.64: Report discovery via `report list` command."""
-
-    def test_report_list_help(self) -> None:
-        result = runner.invoke(cli.app, ["report", "list", "--help"])
-        assert result.exit_code == 0
-        assert "--project" in result.output
-        assert "--latest-only" in result.output
-        assert "--repo" in result.output
-
-    def test_report_list_json_output(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
-        entries = [
-            _make_entry(run_id="run-1", repo="billing", score=80.0),
-            _make_entry(run_id="run-2", repo="profile", score=90.0),
-        ]
-        _write_run_history(tmp_path / "test-project", entries)
-        monkeypatch.setattr(
-            report_cmds,
-            "_DEFAULT_REPORT_DIR",
-            tmp_path,
-        )
-
-        result = runner.invoke(
-            cli.app,
-            ["--json-only", "report", "list", "--project", "test-project"],
-        )
-
-        assert result.exit_code == 0
-        payload = json.loads(result.output)
-        assert payload["status"] == "ok"
-        assert payload["count"] == 2
-        assert len(payload["entries"]) == 2
-
-    def test_report_list_latest_only(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
-        now = datetime.now(UTC)
-        entries = [
-            _make_entry(
-                run_id="old-run",
-                repo="billing",
-                updated_at=(now - timedelta(days=2)).isoformat(),
-            ),
-            _make_entry(
-                run_id="new-run",
-                repo="billing",
-                updated_at=now.isoformat(),
-            ),
-        ]
-        _write_run_history(tmp_path / "test-project", entries)
-        monkeypatch.setattr(report_cmds, "_DEFAULT_REPORT_DIR", tmp_path)
-
-        result = runner.invoke(
-            cli.app,
-            ["--json-only", "report", "list", "--project", "test-project", "--latest-only"],
-        )
-
-        assert result.exit_code == 0
-        payload = json.loads(result.output)
-        assert payload["count"] == 1
-        assert payload["entries"][0]["run_id"] == "new-run"
-
-    def test_report_list_repo_filter(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
-        entries = [
-            _make_entry(run_id="run-1", repo="billing"),
-            _make_entry(run_id="run-2", repo="profile"),
-        ]
-        _write_run_history(tmp_path / "test-project", entries)
-        monkeypatch.setattr(report_cmds, "_DEFAULT_REPORT_DIR", tmp_path)
-
-        result = runner.invoke(
-            cli.app,
-            ["--json-only", "report", "list", "--project", "test-project", "--repo", "billing"],
-        )
-
-        assert result.exit_code == 0
-        payload = json.loads(result.output)
-        assert payload["count"] == 1
-        assert payload["entries"][0]["repo_storage_key"] == "billing"
-
-    def test_report_list_no_history(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
-        """Empty project dir → graceful error output."""
-        (tmp_path / "empty-project" / "runs").mkdir(parents=True)
-        monkeypatch.setattr(report_cmds, "_DEFAULT_REPORT_DIR", tmp_path)
-
-        result = runner.invoke(
-            cli.app,
-            ["--json-only", "report", "list", "--project", "empty-project"],
-        )
-
-        assert result.exit_code == 0
-        payload = json.loads(result.output)
-        assert payload["status"] == "error"
-        assert "No run history" in payload["error"]
-
-    def test_report_list_rich_table(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
-        """Non-JSON mode renders a Rich table."""
-        entries = [_make_entry(run_id="run-1", repo="billing")]
-        _write_run_history(tmp_path / "test-project", entries)
-        monkeypatch.setattr(report_cmds, "_DEFAULT_REPORT_DIR", tmp_path)
-
-        result = runner.invoke(
-            cli.app,
-            ["report", "list", "--project", "test-project"],
-        )
-
-        assert result.exit_code == 0
-        assert "Run History" in result.output
-        assert "run-1" in result.output
-        assert "Total entries: 1" in result.output
-
-    def test_report_list_uses_state_run_root_when_default_history_missing(
-        self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-    ) -> None:
-        custom_run_root = tmp_path / "custom-root" / "thread-123"
-        entries = [_make_entry(run_id="run-1", repo="billing", report_dir=str(custom_run_root / "repos" / "billing"))]
-        _write_run_root_history(custom_run_root, entries)
-        monkeypatch.setattr(report_cmds, "_DEFAULT_REPORT_DIR", tmp_path)
-        monkeypatch.setenv("VDS_AUDIT_STATE_DSN", "postgresql://test-state")
-
-        class _FakeStateApi:
-            @staticmethod
-            def list_run_roots(*, state_dsn: str, project_key: str, limit: int | None = 100) -> list[dict[str, Any]]:
-                assert state_dsn == "postgresql://test-state"
-                assert project_key == "test-project"
-                assert limit == 100
-                return [
-                    {
-                        "thread_id": "thread-123",
-                        "run_id": "run-1",
-                        "status": "completed",
-                        "started_at": datetime.now(UTC).isoformat(),
-                        "run_root": str(custom_run_root),
-                    }
-                ]
-
-        monkeypatch.setattr(report_cmds, "_load_state_api", _FakeStateApi)
-
-        result = runner.invoke(
-            cli.app,
-            ["--json-only", "report", "list", "--project", "test-project"],
-        )
-
-        assert result.exit_code == 0
-        payload = json.loads(result.output)
-        assert payload["status"] == "ok"
-        assert payload["count"] == 1
-        assert payload["entries"][0]["run_id"] == "run-1"
-
-    def test_report_list_console_prefers_lifecycle_over_legacy_status(
-        self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-    ) -> None:
-        entries = [
-            {
-                **_make_entry(run_id="run-1", repo="billing"),
-                "summary": {
-                    "status": "partial",
-                    "workflow_status": "completed",
-                    "audit_outcome": "partial",
-                    "total_findings": 2,
-                    "overall_score": 72.5,
-                },
-            }
-        ]
-        _write_run_history(tmp_path / "test-project", entries)
-        monkeypatch.setattr(report_cmds, "_DEFAULT_REPORT_DIR", tmp_path)
-
-        result = runner.invoke(
-            cli.app,
-            ["--json-only", "report", "list", "--project", "test-project"],
-        )
-
-        assert result.exit_code == 0
-        payload = json.loads(result.output)
-        summary = payload["entries"][0]["summary"]
-        assert summary["lifecycle_status"] == "completed"
-        assert summary["audit_outcome"] == "partial"
-
-
-# ── TSK-940.65: report show command ──────────────────────────────────────
-
-
-class TestReportShow:
-    """TSK-940.65: Report inspection via `report show` command."""
-
-    def test_report_show_help(self) -> None:
-        result = runner.invoke(cli.app, ["report", "show", "--help"])
-        assert result.exit_code == 0
-        assert "--project" in result.output
-        assert "--run-id" in result.output
-        assert "--repo" in result.output
-
-    def test_report_show_json_with_artifacts(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
-        report_dir = tmp_path / "report-files"
-        report_dir.mkdir(parents=True)
-        (report_dir / "checklist-security.json").write_text("{}", encoding="utf-8")
-        (report_dir / "checklist-quality.json").write_text("{}", encoding="utf-8")
-        summary = {
-            "status": "complete",
-            "total_findings": 5,
-            "repository": "billing",
-            "synthesis": {
-                "category_scores": {
-                    "security": {"overall_score": 81.5, "findings_count": 2, "count": 5},
-                }
-            },
-        }
-        (report_dir / "workflow-summary.json").write_text(json.dumps(summary), encoding="utf-8")
-
-        entries = [
-            _make_entry(
-                run_id="run-1",
-                repo="billing",
-                report_dir=str(report_dir),
-                checkpoint_path="/tmp/vds-audit-checkpoint-run-1.json",
-            ),
-        ]
-        _write_run_history(tmp_path / "test-project", entries)
-        monkeypatch.setattr(report_cmds, "_DEFAULT_REPORT_DIR", tmp_path)
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "--json-only",
-                "report",
-                "show",
-                "--project",
-                "test-project",
-                "--run-id",
-                "run-1",
-                "--repo",
-                "billing",
-            ],
-        )
-
-        assert result.exit_code == 0
-        payload = json.loads(result.output)
-        assert payload["status"] == "ok"
-        assert payload["entry"]["run_id"] == "run-1"
-        artifacts = payload["artifacts"]
-        assert artifacts["exists"] is True
-        assert artifacts["checklist_count"] == 2
-        assert "checklist-security.json" in artifacts["checklist_files"]
-        assert "checklist-quality.json" in artifacts["checklist_files"]
-        assert artifacts["workflow_summary"]["status"] == "complete"
-        assert payload["category_scores"]["security"]["overall_score"] == 81.5
-        assert artifacts["total_size_bytes"] > 0
-
-    def test_report_show_renders_category_scores_in_console(
-        self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-    ) -> None:
-        report_dir = tmp_path / "report-files"
-        report_dir.mkdir(parents=True)
-        (report_dir / "workflow-summary.json").write_text(
-            json.dumps(
-                {
-                    "status": "complete",
-                    "total_findings": 3,
-                    "repository": "billing",
-                    "synthesis": {
-                        "category_scores": {
-                            "security": {"overall_score": 74.0, "findings_count": 2, "count": 4},
-                            "quality": {"overall_score": 90.0, "findings_count": 0, "count": 2},
-                        }
-                    },
-                }
-            ),
-            encoding="utf-8",
-        )
-        entries = [
-            _make_entry(
-                run_id="run-1",
-                repo="billing",
-                report_dir=str(report_dir),
-            ),
-        ]
-        _write_run_history(tmp_path / "test-project", entries)
-        monkeypatch.setattr(report_cmds, "_DEFAULT_REPORT_DIR", tmp_path)
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "report",
-                "show",
-                "--project",
-                "test-project",
-                "--run-id",
-                "run-1",
-                "--repo",
-                "billing",
-            ],
-        )
-
-        assert result.exit_code == 0
-        assert "Categories:" in result.output
-        assert "security: score=74.0, findings=2, checks=4" in result.output
-        assert "quality: score=90.0, findings=0, checks=2" in result.output
-
-    def test_report_show_missing_entry(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
-        entries = [_make_entry(run_id="run-1", repo="billing")]
-        _write_run_history(tmp_path / "test-project", entries)
-        monkeypatch.setattr(report_cmds, "_DEFAULT_REPORT_DIR", tmp_path)
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "--json-only",
-                "report",
-                "show",
-                "--project",
-                "test-project",
-                "--run-id",
-                "nonexistent",
-                "--repo",
-                "billing",
-            ],
-        )
-
-        assert result.exit_code == 0
-        payload = json.loads(result.output)
-        assert payload["status"] == "error"
-        assert "No entry found" in payload["error"]
-
-    def test_report_show_nonexistent_report_dir(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
-        entries = [
-            _make_entry(
-                run_id="run-1",
-                repo="billing",
-                report_dir="/nonexistent/dir",
-            ),
-        ]
-        _write_run_history(tmp_path / "test-project", entries)
-        monkeypatch.setattr(report_cmds, "_DEFAULT_REPORT_DIR", tmp_path)
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "--json-only",
-                "report",
-                "show",
-                "--project",
-                "test-project",
-                "--run-id",
-                "run-1",
-                "--repo",
-                "billing",
-            ],
-        )
-
-        assert result.exit_code == 0
-        payload = json.loads(result.output)
-        assert payload["status"] == "ok"
-        assert payload["artifacts"]["exists"] is False
-
-    def test_report_show_json_exposes_lifecycle_and_outcome_separately(
-        self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-    ) -> None:
-        report_dir = tmp_path / "report-files"
-        report_dir.mkdir(parents=True)
-        entries = [
-            {
-                **_make_entry(run_id="run-1", repo="billing", report_dir=str(report_dir)),
-                "summary": {
-                    "status": "partial",
-                    "workflow_status": "completed",
-                    "audit_outcome": "partial",
-                    "total_findings": 2,
-                    "overall_score": 72.5,
-                },
-            }
-        ]
-        _write_run_history(tmp_path / "test-project", entries)
-        monkeypatch.setattr(report_cmds, "_DEFAULT_REPORT_DIR", tmp_path)
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "--json-only",
-                "report",
-                "show",
-                "--project",
-                "test-project",
-                "--run-id",
-                "run-1",
-                "--repo",
-                "billing",
-            ],
-        )
-
-        assert result.exit_code == 0
-        payload = json.loads(result.output)
-        assert payload["status"] == "ok"
-        summary = payload["entry"]["summary"]
-        assert summary["lifecycle_status"] == "completed"
-        assert summary["workflow_status"] == "completed"
-        assert summary["audit_outcome"] == "partial"
-        assert summary["status"] == "partial"
-
-    def test_report_show_json_exposes_profile_projection(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
-        report_dir = tmp_path / "report-files"
-        report_dir.mkdir(parents=True)
-        entries = [
-            {
-                **_make_entry(run_id="run-1", repo="billing", report_dir=str(report_dir)),
-                "summary": {
-                    "status": "partial",
-                    "workflow_status": "completed",
-                    "audit_outcome": "partial",
-                    "runtime_profile": "zai-anthropic",
-                    "requested_profiles": ["zai-anthropic"],
-                    "resolved_profiles": ["zai-anthropic", "alibaba-openai"],
-                    "configured_profiles": ["zai-anthropic", "alibaba-openai", "codex-chatgpt"],
-                    "profile_selection_mode": "explicit",
-                },
-            }
-        ]
-        _write_run_history(tmp_path / "test-project", entries)
-        monkeypatch.setattr(report_cmds, "_DEFAULT_REPORT_DIR", tmp_path)
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "--json-only",
-                "report",
-                "show",
-                "--project",
-                "test-project",
-                "--run-id",
-                "run-1",
-                "--repo",
-                "billing",
-            ],
-        )
-
-        assert result.exit_code == 0
-        payload = json.loads(result.output)
-        assert payload["entry"]["profile_projection"]["effective_runtime_profile"] == "zai-anthropic"
-        assert payload["entry"]["profile_projection"]["requested_profiles"] == ["zai-anthropic"]
-        assert payload["entry"]["profile_projection"]["resolved_profiles"] == [
-            "zai-anthropic",
-            "alibaba-openai",
-        ]
-        assert payload["entry"]["profile_projection"]["configured_profiles"] == [
-            "zai-anthropic",
-            "alibaba-openai",
-            "codex-chatgpt",
-        ]
-        assert payload["entry"]["profile_projection"]["profile_selection_mode"] == "explicit"
-
-    def test_report_show_uses_state_run_root_when_default_history_missing(
-        self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-    ) -> None:
-        custom_run_root = tmp_path / "custom-root" / "thread-123"
-        report_dir = custom_run_root / "repos" / "billing"
-        report_dir.mkdir(parents=True)
-        entries = [
-            {
-                **_make_entry(run_id="run-1", repo="billing", report_dir=str(report_dir)),
-                "summary": {
-                    "status": "partial",
-                    "workflow_status": "completed",
-                    "audit_outcome": "partial",
-                    "total_findings": 2,
-                    "overall_score": 72.5,
-                },
-            }
-        ]
-        _write_run_root_history(custom_run_root, entries)
-        monkeypatch.setattr(report_cmds, "_DEFAULT_REPORT_DIR", tmp_path)
-        monkeypatch.setenv("VDS_AUDIT_STATE_DSN", "postgresql://test-state")
-
-        class _FakeStateApi:
-            @staticmethod
-            def list_run_roots(*, state_dsn: str, project_key: str, limit: int | None = 100) -> list[dict[str, Any]]:
-                assert state_dsn == "postgresql://test-state"
-                assert project_key == "test-project"
-                assert limit == 100
-                return [
-                    {
-                        "thread_id": "thread-123",
-                        "run_id": "run-1",
-                        "status": "completed",
-                        "started_at": datetime.now(UTC).isoformat(),
-                        "run_root": str(custom_run_root),
-                    }
-                ]
-
-        monkeypatch.setattr(report_cmds, "_load_state_api", _FakeStateApi)
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "--json-only",
-                "report",
-                "show",
-                "--project",
-                "test-project",
-                "--run-id",
-                "run-1",
-                "--repo",
-                "billing",
-            ],
-        )
-
-        assert result.exit_code == 0
-        payload = json.loads(result.output)
-        assert payload["status"] == "ok"
-        assert payload["entry"]["run_id"] == "run-1"
-        assert payload["artifacts"]["report_dir"] == str(report_dir)
-        assert payload["artifacts"]["exists"] is True
-
-    def test_report_show_console_separates_lifecycle_and_outcome(
-        self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-    ) -> None:
-        report_dir = tmp_path / "report-files"
-        report_dir.mkdir(parents=True)
-        entries = [
-            {
-                **_make_entry(run_id="run-1", repo="billing", report_dir=str(report_dir)),
-                "summary": {
-                    "status": "partial",
-                    "workflow_status": "completed",
-                    "audit_outcome": "partial",
-                    "total_findings": 2,
-                    "overall_score": 72.5,
-                },
-            }
-        ]
-        _write_run_history(tmp_path / "test-project", entries)
-        monkeypatch.setattr(report_cmds, "_DEFAULT_REPORT_DIR", tmp_path)
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "report",
-                "show",
-                "--project",
-                "test-project",
-                "--run-id",
-                "run-1",
-                "--repo",
-                "billing",
-            ],
-        )
-
-        assert result.exit_code == 0
-        assert "Lifecycle:" in result.output
-        assert "completed" in result.output
-        assert "Outcome:" in result.output
-        assert "partial" in result.output
-
-
-# ── TSK-940.121: report trend command ────────────────────────────────────
-
-
-class TestReportTrend:
-    """TSK-940.121: Trend analysis over recent completed runs."""
-
-    def test_report_trend_help(self) -> None:
-        result = runner.invoke(cli.app, ["report", "trend", "--help"])
-        assert result.exit_code == 0
-        assert "--project" in result.output
-        assert "--repo" in result.output
-        assert "--last-n" in result.output
-
-    def test_report_trend_json_insufficient_history(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
-        report_dir = tmp_path / "run-1"
-        _write_checklist_rows(
-            report_dir,
-            [{"check_id": "CL-001", "check_name": "Auth", "score": 80}],
-        )
-        entries = [
-            _make_entry(
-                run_id="run-1",
-                repo="billing",
-                status="complete",
-                report_dir=str(report_dir),
-            ),
-        ]
-        _write_run_history(tmp_path / "test-project", entries)
-        monkeypatch.setattr(report_cmds, "_DEFAULT_REPORT_DIR", tmp_path)
-
-        result = runner.invoke(
-            cli.app,
-            ["--json-only", "report", "trend", "--project", "test-project", "--repo", "billing"],
-        )
-
-        assert result.exit_code == 0
-        payload = json.loads(result.output)
-        assert payload["status"] == "ok"
-        assert payload["runs_considered"] == 1
-        assert payload["trends"] == []
-        assert "Insufficient completed run history" in payload["message"]
-
-    def test_report_trend_json_direction_classification(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
-        now = datetime.now(UTC)
-        run_old = tmp_path / "run-old"
-        run_new = tmp_path / "run-new"
-
-        _write_checklist_rows(
-            run_old,
-            [
-                {"check_id": "CL-001", "check_name": "Architecture", "score": 70},
-                {"check_id": "CL-002", "check_name": "Database", "score": 50},
-                {"check_id": "CL-003", "check_name": "Security", "score": 90},
-            ],
-        )
-        _write_checklist_rows(
-            run_new,
-            [
-                {"check_id": "CL-001", "check_name": "Architecture", "score": 78},  # +8 improving
-                {"check_id": "CL-002", "check_name": "Database", "score": 53},  # +3 stable
-                {"check_id": "CL-003", "check_name": "Security", "score": 82},  # -8 degrading
-            ],
-        )
-
-        entries = [
-            _make_entry(
-                run_id="run-old",
-                repo="billing",
-                status="complete",
-                updated_at=(now - timedelta(days=2)).isoformat(),
-                report_dir=str(run_old),
-            ),
-            _make_entry(
-                run_id="run-new",
-                repo="billing",
-                status="complete",
-                updated_at=now.isoformat(),
-                report_dir=str(run_new),
-            ),
-        ]
-        _write_run_history(tmp_path / "test-project", entries)
-        monkeypatch.setattr(report_cmds, "_DEFAULT_REPORT_DIR", tmp_path)
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "--json-only",
-                "report",
-                "trend",
-                "--project",
-                "test-project",
-                "--repo",
-                "billing",
-                "--last-n",
-                "5",
-            ],
-        )
-
-        assert result.exit_code == 0
-        payload = json.loads(result.output)
-        assert payload["status"] == "ok"
-        assert payload["runs_considered"] == 2
-        trends = {row["check_id"]: row for row in payload["trends"]}
-
-        assert trends["CL-001"]["trend"] == "improving"
-        assert trends["CL-001"]["delta"] == pytest.approx(8.0)
-
-        assert trends["CL-002"]["trend"] == "stable"
-        assert trends["CL-002"]["delta"] == pytest.approx(3.0)
-
-        assert trends["CL-003"]["trend"] == "degrading"
-        assert trends["CL-003"]["delta"] == pytest.approx(-8.0)
-
-    def test_report_trend_last_n_limits_window(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
-        now = datetime.now(UTC)
-        run_1 = tmp_path / "run-1"
-        run_2 = tmp_path / "run-2"
-        run_3 = tmp_path / "run-3"
-
-        _write_checklist_rows(run_1, [{"check_id": "CL-100", "check_name": "Ops", "score": 40}])
-        _write_checklist_rows(run_2, [{"check_id": "CL-100", "check_name": "Ops", "score": 45}])
-        _write_checklist_rows(run_3, [{"check_id": "CL-100", "check_name": "Ops", "score": 50}])
-
-        entries = [
-            _make_entry(
-                run_id="run-1",
-                repo="billing",
-                status="complete",
-                updated_at=(now - timedelta(days=3)).isoformat(),
-                report_dir=str(run_1),
-            ),
-            _make_entry(
-                run_id="run-2",
-                repo="billing",
-                status="complete",
-                updated_at=(now - timedelta(days=2)).isoformat(),
-                report_dir=str(run_2),
-            ),
-            _make_entry(
-                run_id="run-3",
-                repo="billing",
-                status="complete",
-                updated_at=now.isoformat(),
-                report_dir=str(run_3),
-            ),
-        ]
-        _write_run_history(tmp_path / "test-project", entries)
-        monkeypatch.setattr(report_cmds, "_DEFAULT_REPORT_DIR", tmp_path)
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "--json-only",
-                "report",
-                "trend",
-                "--project",
-                "test-project",
-                "--repo",
-                "billing",
-                "--last-n",
-                "2",
-            ],
-        )
-
-        assert result.exit_code == 0
-        payload = json.loads(result.output)
-        assert payload["runs_considered"] == 2
-        trend = payload["trends"][0]
-        assert trend["check_id"] == "CL-100"
-        assert trend["delta"] == pytest.approx(5.0)
-        assert trend["trend"] == "improving"
-
-
-# ── TSK-940.66: checkpoint_path in workflow-summary.json and run-history ─
-
-
-class TestCheckpointPathBinding:
-    """TSK-940.66: checkpoint_path flows into workflow-summary.json and run-history.json."""
-
-    def test_compact_workflow_summary_includes_checkpoint_path(self) -> None:
-        payload = cli._compact_workflow_summary_payload(
-            result={"repository": "billing", "synthesis": {"status": "ok"}},
-            status="complete",
-            total_findings=2,
-            summary="test",
-            checkpoint_path="/tmp/vds-audit-checkpoint-run-1.json",
-        )
-        assert payload["checkpoint_path"] == "/tmp/vds-audit-checkpoint-run-1.json"
-
-    def test_compact_workflow_summary_omits_checkpoint_path_when_none(self) -> None:
-        payload = cli._compact_workflow_summary_payload(
-            result={"repository": "billing", "synthesis": {"status": "ok"}},
-            status="complete",
-            total_findings=0,
-            summary="test",
-        )
-        assert "checkpoint_path" not in payload
-
-    def test_write_workflow_summary_artifacts_passes_checkpoint_path(self, tmp_path: Path) -> None:
-        result = {
-            "repository": "merchant-billing",
-            "synthesis": {"status": "ok", "total_findings": 1, "summary": "done"},
-        }
-        _, json_path = cli._write_workflow_summary_artifacts(
-            report_dir=tmp_path,
-            thread_id="phase96-ckpt",
-            result=result,
-            checkpoint_path="/tmp/vds-audit-checkpoint-phase96.json",
-        )
-        payload = json.loads(json_path.read_text(encoding="utf-8"))
-        assert payload["checkpoint_path"] == "/tmp/vds-audit-checkpoint-phase96.json"
-
-    def test_write_workflow_summary_artifacts_omits_checkpoint_when_none(self, tmp_path: Path) -> None:
-        result = {
-            "repository": "merchant-billing",
-            "synthesis": {"status": "ok", "total_findings": 0, "summary": "clean"},
-        }
-        _, json_path = cli._write_workflow_summary_artifacts(
-            report_dir=tmp_path,
-            thread_id="phase96-no-ckpt",
-            result=result,
-        )
-        payload = json.loads(json_path.read_text(encoding="utf-8"))
-        assert "checkpoint_path" not in payload
-
-    def test_update_run_history_index_includes_checkpoint_path(self, tmp_path: Path) -> None:
-        report_dir = tmp_path / "report-1"
-        report_dir.mkdir(parents=True)
-
-        history_path = cli._update_run_history_index(
-            report_dir=report_dir,
-            run_id="run-1",
-            project_storage_key="test-project",
-            repo_storage_key="billing",
-            summary={"status": "complete", "total_findings": 1},
-            checkpoint_path="/tmp/vds-audit-checkpoint-run-1.json",
-        )
-
-        payload = json.loads(history_path.read_text(encoding="utf-8"))
-        entry = payload["entries"][0]
-        assert entry["checkpoint_path"] == "/tmp/vds-audit-checkpoint-run-1.json"
-
-    def test_update_run_history_index_checkpoint_path_none_by_default(self, tmp_path: Path) -> None:
-        report_dir = tmp_path / "report-2"
-        report_dir.mkdir(parents=True)
-
-        history_path = cli._update_run_history_index(
-            report_dir=report_dir,
-            run_id="run-2",
-            project_storage_key="test-project",
-            repo_storage_key="billing",
-            summary={"status": "complete"},
-        )
-
-        payload = json.loads(history_path.read_text(encoding="utf-8"))
-        entry = payload["entries"][0]
-        assert entry["checkpoint_path"] is None
-
-    def test_update_run_history_index_includes_targeting_metadata(self, tmp_path: Path) -> None:
-        report_dir = tmp_path / "report-targeted"
-        report_dir.mkdir(parents=True)
-
-        history_path = cli._update_run_history_index(
-            report_dir=report_dir,
-            run_id="run-targeted-1",
-            project_storage_key="test-project",
-            repo_storage_key="billing",
-            summary={
-                "status": "complete",
-                "total_findings": 1,
-                "overall_score": 82.5,
-                "target_selector": "CL-004,CL-001,CL-013",
-                "target_selector_raw": "status:error",
-                "prior_run_id": "codex-sweep-20260306-090342",
-                "is_targeted_run": True,
-            },
-        )
-
-        payload = json.loads(history_path.read_text(encoding="utf-8"))
-        entry = payload["entries"][0]
-        assert entry["summary"]["target_selector"] == "CL-004,CL-001,CL-013"
-        assert entry["summary"]["target_selector_raw"] == "status:error"
-        assert entry["summary"]["prior_run_id"] == "codex-sweep-20260306-090342"
-        assert entry["summary"]["is_targeted_run"] is True
-
-
-# ── TSK-940.67: report prune command ─────────────────────────────────────
-
-
-class TestReportPrune:
-    """TSK-940.67: Report archival/cleanup via `report prune` command."""
-
-    def test_report_prune_help(self) -> None:
-        result = runner.invoke(cli.app, ["report", "prune", "--help"])
-        assert result.exit_code == 0
-        assert "--project" in result.output
-        assert "--older-than" in result.output
-        assert "--keep-latest" in result.output
-        assert "--dry-run" in result.output
-
-    def test_report_prune_dry_run_json(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
-        now = datetime.now(UTC)
-        entries = [
-            _make_entry(
-                run_id="old-run",
-                repo="billing",
-                updated_at=(now - timedelta(days=60)).isoformat(),
-            ),
-            _make_entry(
-                run_id="new-run",
-                repo="billing",
-                updated_at=now.isoformat(),
-            ),
-        ]
-        _write_run_history(tmp_path / "test-project", entries)
-        monkeypatch.setattr(report_cmds, "_DEFAULT_REPORT_DIR", tmp_path)
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "--json-only",
-                "report",
-                "prune",
-                "--project",
-                "test-project",
-                "--older-than",
-                "30",
-            ],
-        )
-
-        assert result.exit_code == 0
-        payload = json.loads(result.output)
-        assert payload["status"] == "dry_run"
-        assert payload["candidates_count"] == 1
-        assert "old-run" in payload["candidate_run_ids"]
-
-    def test_report_prune_keep_latest_preserves_most_recent(
-        self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-    ) -> None:
-        now = datetime.now(UTC)
-        entries = [
-            _make_entry(
-                run_id="oldest",
-                repo="billing",
-                updated_at=(now - timedelta(days=90)).isoformat(),
-            ),
-            _make_entry(
-                run_id="newest",
-                repo="billing",
-                updated_at=(now - timedelta(days=60)).isoformat(),
-            ),
-        ]
-        _write_run_history(tmp_path / "test-project", entries)
-        monkeypatch.setattr(report_cmds, "_DEFAULT_REPORT_DIR", tmp_path)
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "--json-only",
-                "report",
-                "prune",
-                "--project",
-                "test-project",
-                "--older-than",
-                "30",
-                "--keep-latest",
-            ],
-        )
-
-        assert result.exit_code == 0
-        payload = json.loads(result.output)
-        # newest is the latest per repo — kept even though older than 30 days
-        assert payload["candidates_count"] == 1
-        assert "oldest" in payload["candidate_run_ids"]
-        assert "newest" not in payload.get("candidate_run_ids", [])
-
-    def test_report_prune_execute_deletes_dirs(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
-        now = datetime.now(UTC)
-        old_report_dir = tmp_path / "old-report"
-        old_report_dir.mkdir(parents=True)
-        (old_report_dir / "checklist.json").write_text("{}", encoding="utf-8")
-
-        entries = [
-            _make_entry(
-                run_id="old-run",
-                repo="billing",
-                updated_at=(now - timedelta(days=60)).isoformat(),
-                report_dir=str(old_report_dir),
-            ),
-            _make_entry(
-                run_id="new-run",
-                repo="profile",
-                updated_at=now.isoformat(),
-                report_dir=str(tmp_path / "new-report"),
-            ),
-        ]
-        _write_run_history(tmp_path / "test-project", entries)
-        monkeypatch.setattr(report_cmds, "_DEFAULT_REPORT_DIR", tmp_path)
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "--json-only",
-                "report",
-                "prune",
-                "--project",
-                "test-project",
-                "--older-than",
-                "30",
-                "--no-keep-latest",
-                "--execute",
-                "--no-cleanup-checkpoints",
-            ],
-        )
-
-        assert result.exit_code == 0
-        payload = json.loads(result.output)
-        assert payload["status"] == "executed"
-        assert payload["deleted_dirs"] == 1
-        assert not old_report_dir.exists()
-
-    def test_report_prune_execute_updates_run_history(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
-        """After execute, pruned entries are removed from run-history.json."""
-        now = datetime.now(UTC)
-        entries = [
-            _make_entry(
-                run_id="old-run",
-                repo="billing",
-                updated_at=(now - timedelta(days=60)).isoformat(),
-            ),
-            _make_entry(
-                run_id="new-run",
-                repo="billing",
-                updated_at=now.isoformat(),
-            ),
-        ]
-        _write_run_history(tmp_path / "test-project", entries)
-        monkeypatch.setattr(report_cmds, "_DEFAULT_REPORT_DIR", tmp_path)
-
-        runner.invoke(
-            cli.app,
-            [
-                "--json-only",
-                "report",
-                "prune",
-                "--project",
-                "test-project",
-                "--older-than",
-                "30",
-                "--execute",
-                "--no-cleanup-checkpoints",
-            ],
-        )
-
-        # Verify run-history.json was rewritten without pruned entry
-        history_path = tmp_path / "test-project" / "runs" / "run-history.json"
-        payload = json.loads(history_path.read_text(encoding="utf-8"))
-        run_ids = [e["run_id"] for e in payload["entries"]]
-        assert "old-run" not in run_ids
-        assert "new-run" in run_ids
-
-    def test_report_prune_no_candidates(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
-        """All entries are recent — nothing to prune."""
-        now = datetime.now(UTC)
-        entries = [
-            _make_entry(run_id="recent", repo="billing", updated_at=now.isoformat()),
-        ]
-        _write_run_history(tmp_path / "test-project", entries)
-        monkeypatch.setattr(report_cmds, "_DEFAULT_REPORT_DIR", tmp_path)
-
-        result = runner.invoke(
-            cli.app,
-            [
-                "--json-only",
-                "report",
-                "prune",
-                "--project",
-                "test-project",
-                "--older-than",
-                "30",
-            ],
-        )
-
-        assert result.exit_code == 0
-        payload = json.loads(result.output)
-        assert payload["candidates_count"] == 0
-
-
-# ── H-1: BatchProcessor.get_checkpoint_path() public accessor ────────────
-
-
-class TestBatchProcessorCheckpointPath:
-    """H-1 (FR-278): Public get_checkpoint_path() accessor on BatchProcessor."""
-
-    def test_get_checkpoint_path_returns_path_from_config_dir(self) -> None:
-        from unittest.mock import MagicMock
-
-        from vds_audit_orchestrator.engine.batch_processor import (
-            BatchConfig,
-            BatchRowProcessor,
-        )
-
-        config = BatchConfig(checkpoint_dir=Path("/tmp/test-checkpoints"))
-        mock_template = MagicMock()
-        mock_template.sections = []
-        mock_evaluator = MagicMock()
-        mock_matcher = MagicMock()
-
-        processor = BatchRowProcessor(
-            template=mock_template,
-            evaluator=mock_evaluator,
-            evidence_matcher=mock_matcher,
-            config=config,
-        )
-
-        result = processor.get_checkpoint_path("thread-123")
-        assert result == Path("/tmp/test-checkpoints/batch-checkpoint-thread-123.json")
-
-    def test_get_checkpoint_path_uses_tmp_fallback(self) -> None:
-        from unittest.mock import MagicMock
-
-        from vds_audit_orchestrator.engine.batch_processor import (
-            BatchConfig,
-            BatchRowProcessor,
-        )
-
-        config = BatchConfig(checkpoint_dir=None)
-        mock_template = MagicMock()
-        mock_template.sections = []
-        mock_evaluator = MagicMock()
-        mock_matcher = MagicMock()
-
-        processor = BatchRowProcessor(
-            template=mock_template,
-            evaluator=mock_evaluator,
-            evidence_matcher=mock_matcher,
-            config=config,
-        )
-
-        result = processor.get_checkpoint_path("thread-abc")
-        assert result == Path("/tmp/vds-audit-checkpoint-thread-abc.json")
-
-    def test_get_checkpoint_path_matches_private_method(self) -> None:
-        """Public method delegates to private _get_checkpoint_path."""
-        from unittest.mock import MagicMock
-
-        from vds_audit_orchestrator.engine.batch_processor import (
-            BatchConfig,
-            BatchRowProcessor,
-        )
-
-        config = BatchConfig(checkpoint_dir=Path("/data/checkpoints"))
-        mock_template = MagicMock()
-        mock_template.sections = []
-        mock_evaluator = MagicMock()
-        mock_matcher = MagicMock()
-
-        processor = BatchRowProcessor(
-            template=mock_template,
-            evaluator=mock_evaluator,
-            evidence_matcher=mock_matcher,
-            config=config,
-        )
-
-        thread_id = "consistency-check"
-        assert processor.get_checkpoint_path(thread_id) == processor._get_checkpoint_path(thread_id)
-
-
-# ── report_cmds helper unit tests ────────────────────────────────────────
-
-
-class TestReportCmdsHelpers:
-    """Unit tests for report_cmds internal helpers."""
-
-    def test_human_size_bytes(self) -> None:
-        assert report_cmds._human_size(500) == "500.0 B"
-
-    def test_human_size_kb(self) -> None:
-        assert report_cmds._human_size(2048) == "2.0 KB"
-
-    def test_human_size_mb(self) -> None:
-        assert report_cmds._human_size(5 * 1024 * 1024) == "5.0 MB"
-
-    def test_parse_datetime_valid(self) -> None:
-        dt = report_cmds._parse_datetime("2026-03-01T10:00:00+00:00")
-        assert dt is not None
-        assert dt.year == 2026
-
-    def test_parse_datetime_empty(self) -> None:
-        assert report_cmds._parse_datetime("") is None
-
-    def test_parse_datetime_invalid(self) -> None:
-        assert report_cmds._parse_datetime("not-a-date") is None
-
-    def test_filter_latest_per_repo(self) -> None:
-        entries = [
-            {"repo_storage_key": "billing", "updated_at": "2026-01-01T00:00:00"},
-            {"repo_storage_key": "billing", "updated_at": "2026-03-01T00:00:00"},
-            {"repo_storage_key": "profile", "updated_at": "2026-02-01T00:00:00"},
-        ]
-        result = report_cmds._filter_latest_per_repo(entries)
-        assert len(result) == 2
-        billing = next(e for e in result if e["repo_storage_key"] == "billing")
-        assert billing["updated_at"] == "2026-03-01T00:00:00"
-
-    def test_find_entry_match(self) -> None:
-        entries = [
-            {"run_id": "run-1", "repo_storage_key": "billing"},
-            {"run_id": "run-2", "repo_storage_key": "profile"},
-        ]
-        match = report_cmds._find_entry(entries, run_id="run-2", repo="profile")
-        assert match is not None
-        assert match["run_id"] == "run-2"
-
-    def test_find_entry_no_match(self) -> None:
-        entries = [{"run_id": "run-1", "repo_storage_key": "billing"}]
-        assert report_cmds._find_entry(entries, run_id="run-1", repo="profile") is None