@ngocsangairvds/vsaf 3.2.14 → 3.2.16

package/tools/vds-scripts/audit_orchestrator/tests/test_aggregator_p149.py

@@ -1,171 +0,0 @@
-"""P149-A regression tests for aggregator.py fixes.
-
-TSK-149.5: Zero-percent non-NA repo is included in project average.
-TSK-149.6: Common gaps affected_repos has no duplicates from single source.
-"""
-
-from __future__ import annotations
-
-from vds_audit_orchestrator.engine.aggregator import MultiRepoAggregator, RepoAuditSummary
-
-# ---------------------------------------------------------------------------
-# TSK-149.1: all_na field present and defaults to False
-# ---------------------------------------------------------------------------
-
-
-def test_repo_audit_summary_has_all_na_field() -> None:
-    """RepoAuditSummary must expose all_na field."""
-    summary = RepoAuditSummary(repository="repo-a", overall_score=0.5, maturity_level=3)
-    assert hasattr(summary, "all_na")
-
-
-def test_repo_audit_summary_all_na_defaults_false() -> None:
-    """all_na must default to False for backward compatibility."""
-    summary = RepoAuditSummary(repository="repo-a", overall_score=0.0, maturity_level=3)
-    assert summary.all_na is False
-
-
-# ---------------------------------------------------------------------------
-# TSK-149.2/149.3: Scorable filter uses all_na, not score > 0.0
-# ---------------------------------------------------------------------------
-
-
-def test_all_na_repo_excluded_from_project_average() -> None:
-    """An all-NA repo (score=0, all_na_rows=True) must not count in avg_score."""
-    agg = MultiRepoAggregator()
-    results = [
-        {"repository": "repo-na", "overall_score": 0.0, "all_na_rows": True},
-        {"repository": "repo-a", "overall_score": 80.0, "all_na_rows": False},
-    ]
-    out = agg.aggregate("proj", results)
-    assert out.avg_score == 80.0
-    assert out.min_score == 80.0
-    assert out.max_score == 80.0
-
-
-def test_zero_percent_non_na_included_in_project_average() -> None:
-    """Regression: repo-A scores 0% (non-NA), repo-B all-NA, repo-C scores 60%.
-    avg_score must equal 30, not 60 (pre-fix bug) or 20 (wrong denominator).
-    """
-    agg = MultiRepoAggregator()
-    results = [
-        {"repository": "repo-a", "overall_score": 0.0, "all_na_rows": False},
-        {"repository": "repo-b", "overall_score": 0.0, "all_na_rows": True},
-        {"repository": "repo-c", "overall_score": 60.0, "all_na_rows": False},
-    ]
-    out = agg.aggregate("proj", results)
-    assert out.avg_score == 30.0
-    assert out.min_score == 0.0
-    assert out.max_score == 60.0
-
-
-def test_mixed_repos_with_all_na_flag() -> None:
-    """all_na=True repos are excluded; scorable repos all contribute."""
-    agg = MultiRepoAggregator()
-    results = [
-        {"repository": "r1", "overall_score": 40.0, "all_na_rows": False},
-        {"repository": "r2", "overall_score": 60.0, "all_na_rows": False},
-        {"repository": "r3", "overall_score": 0.0, "all_na_rows": True},
-    ]
-    out = agg.aggregate("proj", results)
-    assert out.avg_score == 50.0
-
-
-def test_all_na_project_returns_zero_avg() -> None:
-    """All repos all-NA → avg_score = 0.0 (no scorable repos)."""
-    agg = MultiRepoAggregator()
-    results = [
-        {"repository": "r1", "overall_score": 0.0, "all_na_rows": True},
-        {"repository": "r2", "overall_score": 0.0, "all_na_rows": True},
-    ]
-    out = agg.aggregate("proj", results)
-    assert out.avg_score == 0.0
-
-
-def test_all_scorable_repos_all_contribute() -> None:
-    """No all-NA repos → all repos contribute to the average."""
-    agg = MultiRepoAggregator()
-    results = [
-        {"repository": "r1", "overall_score": 20.0},
-        {"repository": "r2", "overall_score": 80.0},
-    ]
-    out = agg.aggregate("proj", results)
-    assert out.avg_score == 50.0
-
-
-def test_all_na_derived_from_row_count_zero() -> None:
-    """When all_na_rows absent, all_na derived from row_count=0 and score=0."""
-    agg = MultiRepoAggregator()
-    results = [
-        # No all_na_rows key — should derive all_na=True from row_count=0, score=0
-        {"repository": "r-empty", "overall_score": 0.0, "row_count": 0},
-        {"repository": "r-normal", "overall_score": 50.0},
-    ]
-    out = agg.aggregate("proj", results)
-    # r-empty should be excluded from avg
-    assert out.avg_score == 50.0
-
-
-def test_non_zero_score_ignores_row_count_zero_heuristic() -> None:
-    """A repo with row_count=0 but non-zero score must not be treated as all-NA."""
-    agg = MultiRepoAggregator()
-    results = [
-        {"repository": "r-weird", "overall_score": 30.0, "row_count": 0},
-        {"repository": "r-normal", "overall_score": 70.0},
-    ]
-    out = agg.aggregate("proj", results)
-    assert out.avg_score == 50.0
-
-
-# ---------------------------------------------------------------------------
-# TSK-149.4: _find_common_gaps dedup
-# ---------------------------------------------------------------------------
-
-
-def test_common_gaps_no_duplicate_repos_single_source() -> None:
-    """Regression: 50 identical-key gaps from one repo must produce 0 common gaps
-    (occurrence_count = 1 < 2 threshold after dedup).
-    """
-    agg = MultiRepoAggregator()
-    gaps = [{"category": "security", "description": "missing validation", "_repo": "repo-a"} for _ in range(50)]
-    common = agg._find_common_gaps(gaps)
-    assert common == [], f"Expected no common gaps, got {common}"
-
-
-def test_common_gaps_two_repos_deduped() -> None:
-    """Same gap from two distinct repos → 1 common gap entry, occurrence_count=2."""
-    agg = MultiRepoAggregator()
-    gaps = [
-        {"category": "security", "description": "missing validation", "_repo": "repo-a"},
-        {"category": "security", "description": "missing validation", "_repo": "repo-b"},
-    ]
-    common = agg._find_common_gaps(gaps)
-    assert len(common) == 1
-    assert common[0]["occurrence_count"] == 2
-    assert sorted(common[0]["affected_repos"]) == ["repo-a", "repo-b"]
-
-
-def test_common_gaps_occurrence_count_equals_distinct_repos() -> None:
-    """Even with many duplicate gap entries per repo, occurrence_count == distinct repos."""
-    agg = MultiRepoAggregator()
-    # repo-a contributes 10 copies, repo-b contributes 5 copies
-    gaps = [{"category": "sec", "description": "vuln", "_repo": "repo-a"}] * 10 + [
-        {"category": "sec", "description": "vuln", "_repo": "repo-b"}
-    ] * 5
-    common = agg._find_common_gaps(gaps)
-    assert len(common) == 1
-    assert common[0]["occurrence_count"] == 2  # 2 distinct repos, not 15
-
-
-def test_common_gaps_single_repo_gap_not_cross_repo() -> None:
-    """A gap from exactly 1 repo is filtered out (not cross-repo)."""
-    agg = MultiRepoAggregator()
-    gaps = [{"category": "perf", "description": "slow query", "_repo": "only-repo"}]
-    common = agg._find_common_gaps(gaps)
-    assert common == []
-
-
-def test_common_gaps_empty_list() -> None:
-    """Empty gaps list returns empty common gaps."""
-    agg = MultiRepoAggregator()
-    assert agg._find_common_gaps([]) == []

package/tools/vds-scripts/audit_orchestrator/tests/test_alembic_migrations.py

@@ -1,287 +0,0 @@
-"""Structural tests for audit_orchestrator's Alembic migrations.
-
-P4 / TSK-4.1.10 — regression tests that validate the Alembic configuration,
-the squash migration's revision graph, and the include_name filter, without
-hitting a real Postgres instance (per VDS testing rules: tests must mock all
-external services).
-
-For a real-database integration test, prefer the testcontainers fixture in
-``tests/integration/conftest.py`` once the audit-migrate compose service
-ships.  This file is the unit-level structural guard.
-
-Coverage:
-
-- alembic.ini parses and points at the right script_location / sys path.
-- The migration directory has exactly one revision and it is ``0001``.
-- The 0001 revision has ``down_revision is None`` (it is the squash root).
-- The 0001 upgrade body references every BOOTSTRAP table family (tables,
-  indexes, functions, view, schema_version seed, claimed_at ALTER).
-- The include_name filter passes ``audit_state`` and rejects sibling schemas.
-"""
-
-from __future__ import annotations
-
-from pathlib import Path
-
-import pytest
-
-# ── alembic.ini parses ───────────────────────────────────────────────────────
-
-
-@pytest.fixture(scope="module")
-def alembic_root() -> Path:
-    return Path(__file__).resolve().parent.parent
-
-
-@pytest.fixture(scope="module")
-def alembic_ini(alembic_root: Path) -> Path:
-    p = alembic_root / "alembic.ini"
-    assert p.is_file(), f"alembic.ini not found at {p}"
-    return p
-
-
-@pytest.fixture(scope="module")
-def alembic_config(alembic_ini: Path):
-    """Return a configured alembic.config.Config — no DB attached."""
-    from alembic.config import Config
-
-    cfg = Config(str(alembic_ini))
-    return cfg
-
-
-@pytest.fixture(scope="module")
-def script_directory(alembic_config):
-    """Return the ScriptDirectory; this is what alembic uses to walk versions."""
-    from alembic.script import ScriptDirectory
-
-    # Resolve %(here)s by passing the resolved script_location.
-    return ScriptDirectory.from_config(alembic_config)
-
-
-class TestAlembicIniStructure:
-    """alembic.ini parses cleanly and has the audit-specific paths."""
-
-    def test_ini_file_exists(self, alembic_ini: Path) -> None:
-        assert alembic_ini.is_file()
-
-    def test_script_location_resolves(self, alembic_config) -> None:
-        loc = alembic_config.get_main_option("script_location")
-        assert loc is not None
-        # %(here)s/alembic — should resolve to a real directory once interpolated
-        assert "alembic" in loc
-
-    def test_prepend_sys_path_present(self, alembic_config) -> None:
-        sys_path = alembic_config.get_main_option("prepend_sys_path")
-        assert sys_path is not None
-        assert "src" in sys_path
-
-    def test_no_sqlalchemy_url_in_ini(self, alembic_config) -> None:
-        """Credentials must NOT be in alembic.ini; URL is read from env in env.py."""
-        url = alembic_config.get_main_option("sqlalchemy.url")
-        assert not url, f"alembic.ini must not set sqlalchemy.url, got: {url!r}"
-
-
-# ── Migration graph ──────────────────────────────────────────────────────────
-
-
-class TestMigrationGraph:
-    """The squash migration is the sole revision and has no parent."""
-
-    def test_versions_directory_exists(self, alembic_root: Path) -> None:
-        assert (alembic_root / "alembic" / "versions").is_dir()
-
-    def test_exactly_one_revision(self, script_directory) -> None:
-        revs = list(script_directory.walk_revisions())
-        assert len(revs) == 1, f"Expected exactly one revision, got {len(revs)}"
-
-    def test_revision_id_is_0001(self, script_directory) -> None:
-        head = script_directory.get_current_head()
-        assert head == "0001", f"Expected head '0001', got {head!r}"
-
-    def test_squash_has_no_down_revision(self, script_directory) -> None:
-        rev = script_directory.get_revision("0001")
-        assert rev is not None
-        assert rev.down_revision is None, f"0001 must be the squash root, but down_revision={rev.down_revision!r}"
-
-
-# ── 0001 upgrade body content checks ────────────────────────────────────────
-
-
-@pytest.fixture(scope="module")
-def squash_source(alembic_root: Path) -> str:
-    p = alembic_root / "alembic" / "versions" / "0001_initial_audit_state_schema.py"
-    assert p.is_file(), f"0001 squash migration not found at {p}"
-    return p.read_text()
-
-
-class TestSquashCoverage:
-    """The 0001 squash must subsume every prior schema source."""
-
-    @pytest.mark.parametrize(
-        "table",
-        [
-            # _BOOTSTRAP_TABLES_SQL families (sample — full set listed in the migration)
-            "audit_state.schema_version",
-            "audit_state.departments",
-            "audit_state.bitbucket_projects",
-            "audit_state.projects",
-            "audit_state.repos",
-            "audit_state.artifacts",
-            "audit_state.runs",
-            "audit_state.checklist_runs",
-            "audit_state.checklist_row_results",
-            "audit_state.checklist_artifacts",
-            "audit_state.evidence_snapshots",
-            "audit_state.retrieval_snapshots",
-            "audit_state.corpus_documents",
-            "audit_state.corpus_chunks",
-            "audit_state.corpus_embeddings",
-            "audit_state.requirement_classifications",
-            "audit_state.project_evidence_discoveries",
-            "audit_state.project_knowledge",
-            "audit_state.published_pages",
-            "audit_state.checklist_cache",
-            "audit_state.scope_snapshots",
-            "audit_state.dispatch_runs",
-            "audit_state.dispatch_lanes",
-            "audit_state.dispatch_lane_attempts",
-            "audit_state.availability_snapshots",
-            "audit_state.dispatch_lane_contracts",
-            "audit_state.dispatch_lane_output_envelopes",
-            "audit_state.dispatch_events",
-        ],
-    )
-    def test_table_present_in_squash(self, squash_source: str, table: str) -> None:
-        assert f"CREATE TABLE IF NOT EXISTS {table}" in squash_source, f"Table {table} missing from 0001 squash"
-
-    def test_phase168_claimed_at_alter_present(self, squash_source: str) -> None:
-        """The Phase 168 ALTER (the only delta NOT in BOOTSTRAP_SQL)."""
-        assert "ALTER TABLE audit_state.dispatch_lanes" in squash_source
-        assert "ADD COLUMN IF NOT EXISTS claimed_at" in squash_source
-
-    def test_extensions_present(self, squash_source: str) -> None:
-        assert "CREATE EXTENSION IF NOT EXISTS vector" in squash_source
-        assert "CREATE EXTENSION IF NOT EXISTS unaccent" in squash_source
-
-    def test_functions_present(self, squash_source: str) -> None:
-        for fn in (
-            "audit_state.rrf_score",
-            "audit_state.hybrid_search",
-            "audit_state.acquire_corpus_lock",
-            "audit_state.acquire_repo_sync_lock",
-            "audit_state.vds_search",
-        ):
-            assert fn in squash_source, f"Function {fn} missing from 0001"
-
-    def test_dispatch_run_status_view_present(self, squash_source: str) -> None:
-        assert "DROP VIEW IF EXISTS audit_state.dispatch_run_status" in squash_source
-        assert "CREATE VIEW audit_state.dispatch_run_status" in squash_source
-
-    def test_schema_version_seed_present(self, squash_source: str) -> None:
-        assert "INSERT INTO audit_state.schema_version" in squash_source
-        assert "ON CONFLICT (id) DO UPDATE" in squash_source
-
-    def test_dispatch_event_sequence_present(self, squash_source: str) -> None:
-        assert "CREATE SEQUENCE IF NOT EXISTS audit_state.dispatch_event_seq" in squash_source
-
-    def test_downgrade_does_not_drop_schema(self, squash_source: str) -> None:
-        """downgrade() must NOT drop audit_state CASCADE — operators retire manually."""
-        # Find the downgrade body
-        idx = squash_source.find("def downgrade()")
-        assert idx >= 0
-        body = squash_source[idx:]
-        assert "DROP SCHEMA audit_state" not in body, (
-            "downgrade() must not drop audit_state schema; data preservation is the priority"
-        )
-
-
-# ── Idempotence guards on every CREATE/ALTER ────────────────────────────────
-
-
-class TestIdempotenceGuards:
-    """Every CREATE/INSERT must be safe to replay (operators stamp + upgrade)."""
-
-    def _strip_comments_and_strings(self, src: str) -> str:
-        """Concatenate only the SQL-string literal bodies in the migration file.
-
-        The migration file's Python comments use phrases like 'CREATE INDEX
-        (without CONCURRENTLY)' which would false-positive a naive regex; we
-        only want to scan the raw SQL inside the triple-quoted string
-        constants (_BOOTSTRAP_*_SQL).
-        """
-        import re
-
-        # Capture every triple-quoted string body in the source (the SQL DDL).
-        bodies = re.findall(r'"""(.*?)"""', src, flags=re.DOTALL)
-        return "\n".join(bodies)
-
-    def test_all_tables_use_if_not_exists(self, squash_source: str) -> None:
-        import re
-
-        sql = self._strip_comments_and_strings(squash_source)
-        bad = re.findall(r"CREATE TABLE (?!IF NOT EXISTS)[^\n]+", sql)
-        assert not bad, f"CREATE TABLE without IF NOT EXISTS: {bad[:3]}"
-
-    def test_all_indexes_use_if_not_exists(self, squash_source: str) -> None:
-        import re
-
-        sql = self._strip_comments_and_strings(squash_source)
-        bad = re.findall(r"CREATE INDEX (?!IF NOT EXISTS)[^\n]+", sql)
-        # GIN index uses USING GIN(...) on a separate line, but still has IF NOT EXISTS prefix
-        assert not bad, f"CREATE INDEX without IF NOT EXISTS: {bad[:3]}"
-
-    def test_alter_uses_if_not_exists(self, squash_source: str) -> None:
-        # The Phase 168 ALTER must use IF NOT EXISTS (idempotent on replay).
-        assert "ADD COLUMN IF NOT EXISTS claimed_at" in squash_source
-
-    def test_extensions_use_if_not_exists(self, squash_source: str) -> None:
-        assert "CREATE EXTENSION IF NOT EXISTS vector" in squash_source
-        assert "CREATE EXTENSION IF NOT EXISTS unaccent" in squash_source
-
-    def test_view_drops_before_create(self, squash_source: str) -> None:
-        # The view's column set changed across phases; CREATE OR REPLACE can't change
-        # column names, so we must DROP first.
-        idx_drop = squash_source.find("DROP VIEW IF EXISTS audit_state.dispatch_run_status")
-        idx_create = squash_source.find("CREATE VIEW audit_state.dispatch_run_status")
-        assert idx_drop >= 0 and idx_create >= 0
-        assert idx_drop < idx_create, "DROP VIEW must come before CREATE VIEW"
-
-
-# ── include_name filter ─────────────────────────────────────────────────────
-
-
-class TestIncludeNameFilter:
-    """The include_name filter MUST pass audit_state and reject siblings."""
-
-    def test_audit_state_schema_included(self) -> None:
-        from vds_audit_orchestrator.db.alembic_filters import include_name
-
-        assert include_name("audit_state", "schema", {}) is True
-
-    @pytest.mark.parametrize(
-        "sibling",
-        ["memory", "sched", "dbos", "progress", "public", "langgraph", None],
-    )
-    def test_sibling_schemas_excluded(self, sibling) -> None:
-        from vds_audit_orchestrator.db.alembic_filters import include_name
-
-        assert include_name(sibling, "schema", {}) is False, (
-            f"Schema {sibling!r} must not appear in audit_orchestrator's autogenerate diff"
-        )
-
-    @pytest.mark.parametrize(
-        "type_",
-        ["table", "column", "index", "unique_constraint", "foreign_key_constraint"],
-    )
-    def test_non_schema_types_pass_through(self, type_: str) -> None:
-        from vds_audit_orchestrator.db.alembic_filters import include_name
-
-        assert include_name("any_name", type_, {}) is True
-
-    def test_managed_schemas_constant(self) -> None:
-        from vds_audit_orchestrator.db.alembic_filters import MANAGED_SCHEMAS
-
-        assert "audit_state" in MANAGED_SCHEMAS
-        assert "memory" not in MANAGED_SCHEMAS
-        assert "sched" not in MANAGED_SCHEMAS
-        assert "dbos" not in MANAGED_SCHEMAS