@openparachute/vault 0.6.4-rc.9 → 0.6.5-rc.1

package/README.md

@@ -943,7 +943,7 @@ cp .env.example .env   # edit with your config
 docker compose up -d
 ```
 
-Optionally set `PARACHUTE_VAULT_NAME` to choose a name for your first vault (defaults to `default`). Lowercase alphanumeric + hyphens or underscores, 2–32 chars.
+Set `PARACHUTE_VAULT_NAME` to auto-create a first vault on startup (name: lowercase alphanumeric + hyphens or underscores, 2–32 chars). Without it the server boots with zero vaults — create one explicitly via the admin wizard, `parachute init --vault-name <name>`, or `parachute-vault create <name>`.
 
 ### Cloud platforms
 
@@ -968,9 +968,11 @@ typical v0.6 self-host wants. If you're not sure, use the hub-managed
 path above. The standalone Blueprint stays in tree because some
 operators specifically want this shape (vault#341).
 
-Optionally set `PARACHUTE_VAULT_NAME` to choose a name for your first
-vault (defaults to `default`). Lowercase alphanumeric + hyphens or
-underscores, 2–32 chars.
+Set `PARACHUTE_VAULT_NAME` to auto-create a first vault on startup (name:
+lowercase alphanumeric + hyphens or underscores, 2–32 chars). Without it
+the server boots with zero vaults — create one explicitly via the admin
+wizard, `parachute init --vault-name <name>`, or `parachute-vault create
+<name>`.
 
 #### Other platforms
 

package/core/src/__fixtures__/golden-vault.ts

@@ -0,0 +1,125 @@
+/**
+ * Shared deterministic vault builder + export-tree serializer for the
+ * portable-md "old bytes == new bytes" golden fixture (Phase-1 streaming
+ * export refactor).
+ *
+ * Both the one-shot capture script (scripts/capture-portable-golden.ts,
+ * run against the PRE-refactor code) and the regression test
+ * (portable-md-golden.test.ts, run against the POST-refactor code) build
+ * the SAME vault here and serialize the export tree the SAME way — so a
+ * byte diff between the committed golden JSON and a fresh export is a real
+ * drift, not a fixture-vs-test mismatch.
+ *
+ * Determinism requirements met here:
+ *   - explicit note ids + pinned created_at/updated_at (no wall-clock)
+ *   - export called with `exportedAt` + `caseSensitiveOverride: true`
+ *     (so the bytes don't depend on the runner's filesystem)
+ *   - content that exercises every format field: pathed / unpathed /
+ *     empty-content notes, a non-md (csv) note that forces a notes-meta
+ *     sidecar, tags with schema + relationships, typed links, multi-line
+ *     + control-character metadata, and created_at != updated_at.
+ */
+
+import { readdirSync, readFileSync, statSync } from "fs";
+import { join } from "path";
+import type { Store } from "../types.js";
+
+/** Fixed export timestamp — pins vault.yaml's `exported_at`. */
+export const GOLDEN_EXPORTED_AT = "2026-07-02T00:00:00.000Z";
+
+/**
+ * Populate `store` with a deterministic, format-exhaustive vault. Callers
+ * export it with `{ exportedAt: GOLDEN_EXPORTED_AT, caseSensitiveOverride: true }`.
+ */
+export async function buildGoldenVault(store: Store): Promise<void> {
+  // Tag schema + opaque relationship vocabulary (vault#428 shape).
+  await store.upsertTagSchema("project", {
+    description: "A long-running effort",
+    fields: { status: { type: "string", enum: ["active", "done"], indexed: true } },
+  });
+  await store.upsertTagRecord("project", {
+    relationships: {
+      "works-on": { from: "person", to: "project" },
+      "based-at": { from: "project", to: "place", note: "freeform" },
+    },
+  });
+
+  const t0 = "2026-01-01T00:00:00.000Z";
+  const t1 = "2026-01-01T00:01:00.000Z";
+
+  await store.createNote("alpha body", {
+    id: "01HX001",
+    path: "Inbox/alpha",
+    tags: ["project", "z-other"],
+    metadata: {
+      priority: "high",
+      notes: "line1\nline2\nline3",
+      // control character exercises the \xNN escape path (vault#317 F1)
+      ctrl: "a\tb",
+      status: "active",
+    },
+    created_at: t0,
+  });
+  await store.createNote("beta body", {
+    id: "01HX002",
+    path: "Inbox/beta",
+    tags: ["project"],
+    metadata: { status: "done" },
+    created_at: t0,
+  });
+  await store.createNote("unpathed jot", { id: "01HX003", created_at: t0 });
+  // Empty-content skeleton note (vault#323).
+  await store.createNote("", {
+    id: "01HX004",
+    path: "Inbox/skeleton",
+    tags: ["project"],
+    created_at: t0,
+  });
+  // Non-md note → forces a .parachute/notes-meta/<id>.yaml sidecar.
+  await store.createNote("col1,col2\n1,2\n", {
+    id: "01HX005",
+    path: "Data/table",
+    extension: "csv",
+    tags: ["z-other"],
+    metadata: { rows: 2 },
+    created_at: t0,
+  });
+
+  await store.createLink("01HX001", "01HX002", "derived-from", { source: "git://example" });
+
+  // Pin every timestamp so the export bytes are wall-clock-independent.
+  // n1 gets a divergent updated_at to exercise restoreNoteTimestamps.
+  await store.restoreNoteTimestamps("01HX001", t0, t1);
+  for (const id of ["01HX002", "01HX003", "01HX004", "01HX005"]) {
+    await store.restoreNoteTimestamps(id, t0, t0);
+  }
+}
+
+/**
+ * Recursively serialize an export directory into a sorted map of
+ * `<relative-posix-path>` → file content. Directories are recorded as
+ * entries with a trailing `/` and an empty value so an intentionally
+ * empty dir (e.g. `.parachute/schemas/` on a schema-less vault) still
+ * shows up in the byte comparison.
+ */
+export function serializeExportTree(dir: string): Record<string, string> {
+  const out: Record<string, string> = {};
+  const walk = (abs: string, rel: string): void => {
+    const entries = readdirSync(abs).sort();
+    if (entries.length === 0 && rel !== "") {
+      out[rel + "/"] = "";
+      return;
+    }
+    for (const entry of entries) {
+      const childAbs = join(abs, entry);
+      const childRel = rel === "" ? entry : `${rel}/${entry}`;
+      if (statSync(childAbs).isDirectory()) {
+        walk(childAbs, childRel);
+      } else {
+        out[childRel] = readFileSync(childAbs, "utf-8");
+      }
+    }
+  };
+  walk(dir, "");
+  return out;
+}

package/core/src/__fixtures__/portable-export-golden.json

@@ -0,0 +1,10 @@
+{
+  ".parachute/notes-meta/01HX005.yaml": "id: 01HX005\npath: Data/table\nextension: csv\ntags:\n  - z-other\nmetadata:\n  rows: 2\ncreated_at: 2026-01-01T00:00:00.000Z\nupdated_at: 2026-01-01T00:00:00.000Z\n",
+  ".parachute/schemas/project.yaml": "description: A long-running effort\nfields:\n  status:\n    enum:\n      - active\n      - done\n    indexed: true\n    type: string\nname: project\nrelationships:\n  based-at:\n    from: project\n    note: freeform\n    to: place\n  works-on:\n    from: person\n    to: project\n",
+  ".parachute/vault.yaml": "description: portable-md byte-stability fixture\nexport_format_version: 1\nexported_at: 2026-07-02T00:00:00.000Z\nname: golden\n",
+  "Data/table.csv": "col1,col2\n1,2\n",
+  "Inbox/alpha.md": "---\nid: 01HX001\npath: Inbox/alpha\ntags:\n  - project\n  - z-other\nmetadata:\n  ctrl: \"a\\tb\"\n  notes: \"line1\\nline2\\nline3\"\n  priority: high\n  status: active\nlinks:\n  - metadata:\n      source: git://example\n    relationship: derived-from\n    target: 01HX002\ncreated_at: 2026-01-01T00:00:00.000Z\nupdated_at: 2026-01-01T00:01:00.000Z\n---\nalpha body\n",
+  "Inbox/beta.md": "---\nid: 01HX002\npath: Inbox/beta\ntags:\n  - project\nmetadata:\n  status: done\ncreated_at: 2026-01-01T00:00:00.000Z\nupdated_at: 2026-01-01T00:00:00.000Z\n---\nbeta body\n",
+  "Inbox/skeleton.md": "---\nid: 01HX004\npath: Inbox/skeleton\ntags:\n  - project\ncreated_at: 2026-01-01T00:00:00.000Z\nupdated_at: 2026-01-01T00:00:00.000Z\n---\n",
+  "_unpathed/01HX003.md": "---\nid: 01HX003\ncreated_at: 2026-01-01T00:00:00.000Z\nupdated_at: 2026-01-01T00:00:00.000Z\n---\nunpathed jot\n"
+}

package/core/src/bare-tag-guard.test.ts

@@ -0,0 +1,246 @@
+import { describe, it, expect, beforeEach } from "bun:test";
+import { Database } from "bun:sqlite";
+import { SqliteStore } from "./store.js";
+import { generateMcpTools } from "./mcp.js";
+import { stripTagHash } from "./tag-hierarchy.js";
+
+// Canonical-bare-tag guard (PR #516). A `#`-prefixed tag must never be stored
+// or mismatched: the agent module stored `#agent/message/inbound` literally and
+// consumers querying the bare `agent/message/inbound` convention found nothing.
+// The guard strips a leading `#` (idempotently) on BOTH the write path and the
+// query path, while preserving casing + structure (it is NOT normalizeTagValue).
+
+let store: SqliteStore;
+let db: Database;
+
+beforeEach(() => {
+  db = new Database(":memory:");
+  store = new SqliteStore(db);
+});
+
+/** Raw read of a note's stored tag rows (bypasses any hydration). */
+function storedTags(noteId: string): string[] {
+  return (
+    db
+      .prepare("SELECT tag_name FROM note_tags WHERE note_id = ? ORDER BY tag_name")
+      .all(noteId) as { tag_name: string }[]
+  ).map((r) => r.tag_name);
+}
+
+describe("stripTagHash helper", () => {
+  it("strips a single leading #", () => {
+    expect(stripTagHash("#agent/message")).toBe("agent/message");
+  });
+
+  it("is idempotent across one or more leading # (##x → x, x → x)", () => {
+    expect(stripTagHash("##x")).toBe("x");
+    expect(stripTagHash("###deep")).toBe("deep");
+    expect(stripTagHash("x")).toBe("x");
+    expect(stripTagHash(stripTagHash("#x"))).toBe("x");
+  });
+
+  it("does NOT lowercase or otherwise transform — casing + structure preserved", () => {
+    expect(stripTagHash("#Agent/Message/Inbound")).toBe("Agent/Message/Inbound");
+    expect(stripTagHash("CamelCase")).toBe("CamelCase");
+  });
+
+  it("only strips LEADING # — a mid-string # (e.g. c#) is left intact", () => {
+    expect(stripTagHash("c#")).toBe("c#");
+    expect(stripTagHash("#c#")).toBe("c#");
+    expect(stripTagHash("a#b")).toBe("a#b");
+  });
+
+  it("trims surrounding whitespace before stripping", () => {
+    expect(stripTagHash("  #tag ")).toBe("tag");
+  });
+});
+
+describe("write path — tags stored bare", () => {
+  it("createNote: #agent/message stored as agent/message", async () => {
+    const note = await store.createNote("inbound", { tags: ["#agent/message"] });
+    expect(storedTags(note.id)).toEqual(["agent/message"]);
+    expect(note.tags).toEqual(["agent/message"]);
+  });
+
+  it("##x stored as x; a bare foo is unchanged", async () => {
+    const note = await store.createNote("memo", { tags: ["##x", "foo"] });
+    expect(storedTags(note.id).sort()).toEqual(["foo", "x"]);
+  });
+
+  it("a # mid-string (c#) is NOT mangled", async () => {
+    const note = await store.createNote("memo", { tags: ["c#"] });
+    expect(storedTags(note.id)).toEqual(["c#"]);
+  });
+
+  it("casing is preserved through the write path", async () => {
+    const note = await store.createNote("memo", { tags: ["#Agent/Inbound"] });
+    expect(storedTags(note.id)).toEqual(["Agent/Inbound"]);
+  });
+
+  it("tagNote: #-prefixed add lands on the bare row", async () => {
+    const note = await store.createNote("memo");
+    await store.tagNote(note.id, ["#later"]);
+    expect(storedTags(note.id)).toEqual(["later"]);
+  });
+
+  it("untagNote: removing #tag deletes the bare row", async () => {
+    const note = await store.createNote("memo", { tags: ["later"] });
+    await store.untagNote(note.id, ["#later"]);
+    expect(storedTags(note.id)).toEqual([]);
+  });
+
+  it("batchTag/batchUntag normalize independently of tagNote", async () => {
+    const a = await store.createNote("a");
+    const b = await store.createNote("b");
+    await store.batchTag([a.id, b.id], ["#batch"]);
+    expect(storedTags(a.id)).toEqual(["batch"]);
+    expect(storedTags(b.id)).toEqual(["batch"]);
+    await store.batchUntag([a.id], ["#batch"]);
+    expect(storedTags(a.id)).toEqual([]);
+    expect(storedTags(b.id)).toEqual(["batch"]);
+  });
+
+  it("create-note via MCP also stores bare", async () => {
+    const tools = generateMcpTools(store);
+    const createNote = tools.find((t) => t.name === "create-note")!;
+    const res = (await createNote.execute({
+      content: "mcp inbound",
+      tags: ["#agent/message/inbound"],
+    })) as { id: string };
+    expect(storedTags(res.id)).toEqual(["agent/message/inbound"]);
+  });
+});
+
+describe("query path — # and bare forms equivalent", () => {
+  it("query tag:#agent/message and tag:agent/message both match the same bare-stored note", async () => {
+    const note = await store.createNote("inbound", { tags: ["agent/message"] });
+
+    const byHash = await store.queryNotes({ tags: ["#agent/message"] });
+    expect(byHash.map((n) => n.id)).toContain(note.id);
+
+    const byBare = await store.queryNotes({ tags: ["agent/message"] });
+    expect(byBare.map((n) => n.id)).toContain(note.id);
+  });
+
+  it("an old #-form query reaches a #-decorated WRITE (both normalize to the same bare row)", async () => {
+    // The non-breaking guarantee: a client that writes AND queries with the
+    // legacy #-form still works — both sides converge on the bare row. (Truly
+    // pre-fix #-STORED data is migrated away via renameTag, not auto-reached.)
+    const note = await store.createNote("inbound", { tags: ["#agent/message"] });
+    const byHash = await store.queryNotes({ tags: ["#agent/message"] });
+    expect(byHash.map((n) => n.id)).toContain(note.id);
+    const byBare = await store.queryNotes({ tags: ["agent/message"] });
+    expect(byBare.map((n) => n.id)).toContain(note.id);
+  });
+
+  it("exclude_tags #x excludes x-tagged notes", async () => {
+    const kept = await store.createNote("kept", { tags: ["keep"] });
+    const dropped = await store.createNote("dropped", { tags: ["keep", "x"] });
+
+    const results = await store.queryNotes({ tags: ["keep"], excludeTags: ["#x"] });
+    const ids = results.map((n) => n.id);
+    expect(ids).toContain(kept.id);
+    expect(ids).not.toContain(dropped.id);
+  });
+
+  it("searchNotes treats #tag and bare tag identically", async () => {
+    const note = await store.createNote("findable text here", { tags: ["agent/message"] });
+    const hits = await store.searchNotes("findable", { tags: ["#agent/message"] });
+    expect(hits.map((n) => n.id)).toContain(note.id);
+  });
+
+  it("query-notes via MCP: #-form matches bare-stored note", async () => {
+    const note = await store.createNote("mcp query", { tags: ["agent/message/inbound"] });
+    const tools = generateMcpTools(store);
+    const query = tools.find((t) => t.name === "query-notes")!;
+    // query-notes returns a plain array when no cursor is requested.
+    const res = (await query.execute({ tag: "#agent/message/inbound" })) as { id: string }[];
+    expect(res.map((n) => n.id)).toContain(note.id);
+  });
+});
+
+describe("tag schema path — update-tag name + parent_names stored bare", () => {
+  it("update-tag with name #foo + parent_names [#bar] → stored bare; inheritance works", async () => {
+    const tools = generateMcpTools(store);
+    const updateTag = tools.find((t) => t.name === "update-tag")!;
+
+    // Establish `bar` as a parent, then `foo` as its child via #-decorated input.
+    await updateTag.execute({ tag: "#bar", description: "parent" });
+    await updateTag.execute({ tag: "#foo", parent_names: ["#bar"] });
+
+    const fooRecord = await store.getTagRecord("foo");
+    expect(fooRecord).not.toBeNull();
+    expect(fooRecord!.parent_names).toEqual(["bar"]);
+    // The #-decorated upsert must NOT have created a phantom `#foo` row.
+    expect(await store.getTagRecord("#foo")).toBeNull();
+
+    // Inheritance: tag:bar expands to foo (foo's parent is bar).
+    const fooNote = await store.createNote("a foo note", { tags: ["foo"] });
+    const expanded = await store.queryNotes({ tags: ["bar"] });
+    expect(expanded.map((n) => n.id)).toContain(fooNote.id);
+  });
+
+  it("update-tag with #-name preserves the existing bare record's fields (merge correctness)", async () => {
+    const tools = generateMcpTools(store);
+    const updateTag = tools.find((t) => t.name === "update-tag")!;
+
+    await updateTag.execute({ tag: "thing", description: "first" });
+    // A #-decorated follow-up upsert must read the EXISTING bare record so the
+    // partial merge doesn't clobber the prior description.
+    await updateTag.execute({ tag: "#thing", parent_names: [] });
+
+    const record = await store.getTagRecord("thing");
+    expect(record!.description).toBe("first");
+  });
+});
+
+describe("rename carve-out — source name stays literal (migration escape hatch)", () => {
+  it("renameTag(#agent/message, agent/message) finds + renames the #-prefixed row", async () => {
+    // Plant a legacy #-prefixed tag row + a note carrying it (simulating the
+    // pre-fix agent data the migration must rename away).
+    db.prepare("INSERT OR IGNORE INTO tags (name) VALUES ('#agent/message')").run();
+    const note = await store.createNote("legacy inbound");
+    db.prepare("INSERT INTO note_tags (note_id, tag_name) VALUES (?, '#agent/message')").run(note.id);
+
+    const result = await store.renameTag("#agent/message", "agent/message");
+    expect("renamed" in result).toBe(true);
+
+    // The literal #-row is gone; the note now carries the bare tag.
+    expect(storedTags(note.id)).toEqual(["agent/message"]);
+    const tags = await store.listTags();
+    expect(tags.map((t) => t.name)).not.toContain("#agent/message");
+    expect(tags.map((t) => t.name)).toContain("agent/message");
+  });
+
+  it("renameTag normalizes the TARGET — renaming TO a #-name stores bare (can't re-introduce #)", async () => {
+    db.prepare("INSERT OR IGNORE INTO tags (name) VALUES ('plainsrc')").run();
+    const note = await store.createNote("x");
+    db.prepare("INSERT INTO note_tags (note_id, tag_name) VALUES (?, 'plainsrc')").run(note.id);
+
+    await store.renameTag("plainsrc", "#shiny");
+
+    // The target #-prefix is stripped — no `#shiny` row, the note carries `shiny`.
+    expect(storedTags(note.id)).toEqual(["shiny"]);
+    expect((await store.listTags()).map((t) => t.name)).not.toContain("#shiny");
+  });
+
+  it("mergeTags normalizes the TARGET — merging INTO a #-name stores bare", async () => {
+    db.prepare("INSERT OR IGNORE INTO tags (name) VALUES ('m1')").run();
+    const note = await store.createNote("y");
+    db.prepare("INSERT INTO note_tags (note_id, tag_name) VALUES (?, 'm1')").run(note.id);
+
+    await store.mergeTags(["m1"], "#dest");
+
+    expect(storedTags(note.id)).toEqual(["dest"]);
+    expect((await store.listTags()).map((t) => t.name)).not.toContain("#dest");
+  });
+});
+
+describe("regression — existing bare-tag behavior unchanged", () => {
+  it("bare write + bare query still works end to end", async () => {
+    const note = await store.createNote("plain", { tags: ["alpha", "beta"] });
+    expect(storedTags(note.id).sort()).toEqual(["alpha", "beta"]);
+    const results = await store.queryNotes({ tags: ["alpha"] });
+    expect(results.map((n) => n.id)).toContain(note.id);
+  });
+});

package/core/src/conformance.test.ts

@@ -0,0 +1,112 @@
+/**
+ * Conformance check (vault#283) — counting existing notes that would violate
+ * a proposed tightening of a tag's field spec. Backs the Schema editor's
+ * "N existing notes violate this" warning.
+ */
+import { describe, it, expect, beforeEach } from "bun:test";
+import { Database } from "bun:sqlite";
+import { SqliteStore } from "./store.js";
+import { countConformanceViolations } from "./conformance.js";
+
+let db: Database;
+let store: SqliteStore;
+
+beforeEach(() => {
+  db = new Database(":memory:");
+  store = new SqliteStore(db);
+});
+
+describe("countConformanceViolations", () => {
+  it("returns zero violations when proposed fields is empty", async () => {
+    await store.createNote("n", { tags: ["task"], metadata: { status: "open" } });
+    const r = countConformanceViolations(db, "task", {});
+    expect(r.total_notes).toBe(1);
+    expect(r.violating_notes).toBe(0);
+    expect(r.checked_fields).toEqual([]);
+  });
+
+  it("counts notes missing a newly-required field", async () => {
+    await store.createNote("has", { tags: ["task"], metadata: { due: "2026-01-01" } });
+    await store.createNote("missing-1", { tags: ["task"], metadata: {} });
+    await store.createNote("missing-2", { tags: ["task"] });
+
+    const r = countConformanceViolations(db, "task", {
+      due: { type: "string", required: true },
+    });
+    expect(r.total_notes).toBe(3);
+    expect(r.violating_notes).toBe(2);
+    expect(r.checked_fields).toEqual(["due"]);
+    // missing_required reasons surface in the sample.
+    expect(r.sample.every((s) => s.fields.some((f) => f.reason === "missing_required"))).toBe(true);
+  });
+
+  it("counts notes whose value falls outside a narrowed enum", async () => {
+    await store.createNote("ok", { tags: ["task"], metadata: { status: "open" } });
+    await store.createNote("bad", { tags: ["task"], metadata: { status: "archived" } });
+
+    const r = countConformanceViolations(db, "task", {
+      status: { type: "string", enum: ["open", "done"] },
+    });
+    expect(r.violating_notes).toBe(1);
+    expect(r.sample[0]?.fields[0]?.reason).toBe("enum_mismatch");
+  });
+
+  it("counts notes whose value contradicts a changed type", async () => {
+    await store.createNote("num", { tags: ["task"], metadata: { count: 3 } });
+    await store.createNote("str", { tags: ["task"], metadata: { count: "three" } });
+
+    const r = countConformanceViolations(db, "task", {
+      count: { type: "integer" },
+    });
+    expect(r.violating_notes).toBe(1);
+    expect(r.sample[0]?.fields[0]?.reason).toBe("type_mismatch");
+  });
+
+  it("includes descendant-tag notes via inheritance", async () => {
+    // dev/log declares dev as a parent → a strict field on dev applies to
+    // dev/log notes too.
+    await store.upsertTagRecord("dev/log", { parent_names: ["dev"] });
+    await store.createNote("parent-note", { tags: ["dev"], metadata: {} });
+    await store.createNote("child-note", { tags: ["dev/log"], metadata: {} });
+
+    const r = countConformanceViolations(db, "dev", {
+      kind: { type: "string", required: true },
+    });
+    expect(r.total_notes).toBe(2);
+    expect(r.violating_notes).toBe(2);
+  });
+
+  it("ignores fields the proposal does not touch", async () => {
+    await store.createNote("n", { tags: ["task"], metadata: { other: 123 } });
+    // We only propose `status`; `other` being weird is irrelevant.
+    const r = countConformanceViolations(db, "task", {
+      status: { type: "string" },
+    });
+    // `status` absent + not required → no violation.
+    expect(r.violating_notes).toBe(0);
+  });
+
+  it("caps the sample at sampleLimit but counts all violations", async () => {
+    for (let i = 0; i < 5; i++) {
+      await store.createNote(`n${i}`, { tags: ["task"], metadata: {} });
+    }
+    const r = countConformanceViolations(
+      db,
+      "task",
+      { req: { type: "string", required: true } },
+      { sampleLimit: 2 },
+    );
+    expect(r.violating_notes).toBe(5);
+    expect(r.sample.length).toBe(2);
+  });
+});
+
+describe("store.countTagConformance", () => {
+  it("proxies to the core helper", async () => {
+    await store.createNote("n", { tags: ["task"], metadata: {} });
+    const r = await store.countTagConformance("task", {
+      due: { type: "string", required: true },
+    });
+    expect(r.violating_notes).toBe(1);
+  });
+});