@principles/pd-cli 1.128.2 → 1.129.0

package/tests/commands/run-rulehost-handler.test.ts

@@ -71,6 +71,11 @@ function parseJsonObject(text: string): Record<string, unknown> {
   return parsed;
 }
 
+/** Type guard: narrows `unknown` to `Record<string, unknown>` without `as`. */
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
 function captureStdio(fn: () => Promise<void>): Promise<StdIoState> {
   return new Promise((resolve, reject) => {
     const origExitCode = process.exitCode;
@@ -251,3 +256,275 @@ describe('handleRunRuleHost — dry-run mode output shape (with minimal pd-confi
     }
   });
 });
+
+// ── PRI-461: readiness integration tests ──────────────────────────────────
+//
+// Verifies the handler emits the three readiness statuses (ready /
+// text_principle_only / refused) with the correct exit codes and JSON shape.
+// These tests exercise the full path: config → resolveRuleHostReadiness →
+// handler output, ensuring the readiness gate is wired into production code
+// (EP-02) and that refused statuses fail loud with reason + nextAction (EP-03).
+
+function writeFullReadyConfig(workspaceDir: string): void {
+  const configDir = path.join(workspaceDir, '.pd');
+  fs.mkdirSync(configDir, { recursive: true });
+  const cfg = {
+    version: 1,
+    features: {
+      prompt: { category: 'core', enabled: true },
+      code_tool_hook: { category: 'core', enabled: true },
+      defer_archive: { category: 'core', enabled: true },
+      code_rule_capability: { category: 'core', enabled: true },
+    },
+    workspace: { default: workspaceDir },
+    runtimeProfiles: {
+      'pi-ai.default': { type: 'pi-ai', provider: 'anthropic', model: 'claude-sonnet', apiKeyEnv: 'ANTHROPIC_API_KEY' },
+    },
+    internalAgents: {
+      defaultRuntime: 'pi-ai.default',
+      agents: {
+        dreamer: { enabled: true, runtimeProfile: 'pi-ai.default' },
+        philosopher: { enabled: true, runtimeProfile: 'pi-ai.default' },
+        scribe: { enabled: true, runtimeProfile: 'pi-ai.default' },
+        artificer: { enabled: true, runtimeProfile: 'pi-ai.default' },
+        evaluator: { enabled: true, runtimeProfile: 'pi-ai.default' },
+      },
+    },
+  };
+  fs.writeFileSync(path.join(configDir, 'config.yaml'), yaml.dump(cfg), 'utf8');
+}
+
+function writeTextPrincipleOnlyConfig(workspaceDir: string): void {
+  // code_rule_capability explicitly OFF → text_principle_only
+  const configDir = path.join(workspaceDir, '.pd');
+  fs.mkdirSync(configDir, { recursive: true });
+  const cfg = {
+    version: 1,
+    features: {
+      prompt: { category: 'core', enabled: true },
+      code_tool_hook: { category: 'core', enabled: true },
+      defer_archive: { category: 'core', enabled: true },
+      code_rule_capability: { category: 'core', enabled: false },
+    },
+    workspace: { default: workspaceDir },
+    runtimeProfiles: {
+      'pi-ai.default': { type: 'pi-ai', provider: 'anthropic', model: 'claude-sonnet', apiKeyEnv: 'ANTHROPIC_API_KEY' },
+    },
+    internalAgents: {
+      defaultRuntime: 'pi-ai.default',
+      agents: {
+        dreamer: { enabled: true, runtimeProfile: 'pi-ai.default' },
+        philosopher: { enabled: true, runtimeProfile: 'pi-ai.default' },
+        scribe: { enabled: true, runtimeProfile: 'pi-ai.default' },
+        artificer: { enabled: true, runtimeProfile: 'pi-ai.default' },
+        evaluator: { enabled: true, runtimeProfile: 'pi-ai.default' },
+      },
+    },
+  };
+  fs.writeFileSync(path.join(configDir, 'config.yaml'), yaml.dump(cfg), 'utf8');
+}
+
+function writeEvaluatorDisabledConfig(workspaceDir: string): void {
+  const configDir = path.join(workspaceDir, '.pd');
+  fs.mkdirSync(configDir, { recursive: true });
+  const cfg = {
+    version: 1,
+    features: {
+      prompt: { category: 'core', enabled: true },
+      code_tool_hook: { category: 'core', enabled: true },
+      defer_archive: { category: 'core', enabled: true },
+      code_rule_capability: { category: 'core', enabled: true },
+    },
+    workspace: { default: workspaceDir },
+    runtimeProfiles: {
+      'pi-ai.default': { type: 'pi-ai', provider: 'anthropic', model: 'claude-sonnet', apiKeyEnv: 'ANTHROPIC_API_KEY' },
+    },
+    internalAgents: {
+      defaultRuntime: 'pi-ai.default',
+      agents: {
+        dreamer: { enabled: true, runtimeProfile: 'pi-ai.default' },
+        philosopher: { enabled: true, runtimeProfile: 'pi-ai.default' },
+        scribe: { enabled: true, runtimeProfile: 'pi-ai.default' },
+        artificer: { enabled: true, runtimeProfile: 'pi-ai.default' },
+        evaluator: { enabled: false, runtimeProfile: 'pi-ai.default' },
+      },
+    },
+  };
+  fs.writeFileSync(path.join(configDir, 'config.yaml'), yaml.dump(cfg), 'utf8');
+}
+
+function writeRefusedConfig(workspaceDir: string): void {
+  // dreamer disabled → required agent missing → refused
+  const configDir = path.join(workspaceDir, '.pd');
+  fs.mkdirSync(configDir, { recursive: true });
+  const cfg = {
+    version: 1,
+    features: {
+      prompt: { category: 'core', enabled: true },
+      code_tool_hook: { category: 'core', enabled: true },
+      defer_archive: { category: 'core', enabled: true },
+      code_rule_capability: { category: 'core', enabled: true },
+    },
+    workspace: { default: workspaceDir },
+    runtimeProfiles: {
+      'pi-ai.default': { type: 'pi-ai', provider: 'anthropic', model: 'claude-sonnet', apiKeyEnv: 'ANTHROPIC_API_KEY' },
+    },
+    internalAgents: {
+      defaultRuntime: 'pi-ai.default',
+      agents: {
+        dreamer: { enabled: false, runtimeProfile: 'pi-ai.default' },
+        philosopher: { enabled: true, runtimeProfile: 'pi-ai.default' },
+        scribe: { enabled: true, runtimeProfile: 'pi-ai.default' },
+        artificer: { enabled: true, runtimeProfile: 'pi-ai.default' },
+        evaluator: { enabled: true, runtimeProfile: 'pi-ai.default' },
+      },
+    },
+  };
+  fs.writeFileSync(path.join(configDir, 'config.yaml'), yaml.dump(cfg), 'utf8');
+}
+
+describe('handleRunRuleHost — PRI-461 readiness integration', () => {
+  let workspaceDir: string;
+  let savedEnv: NodeJS.ProcessEnv;
+
+  beforeEach(() => {
+    workspaceDir = mkTmpDir();
+    savedEnv = { ...process.env };
+    process.env.ANTHROPIC_API_KEY = 'sk-ant-test-key';
+  });
+
+  afterEach(() => {
+    process.env = savedEnv;
+    try { fs.rmSync(workspaceDir, { recursive: true, force: true }); } catch { /* ignore */ }
+  });
+
+  // ── ready ───────────────────────────────────────────────────────────────
+
+  it('emits readiness=ready in --json dry-run when all agents and code-rule capability are ON', async () => {
+    writeFullReadyConfig(workspaceDir);
+    const { stdout, exitCode } = await captureStdio(() =>
+      handleRunRuleHost({ painId: 'pain-1', dryRun: true, json: true, workspace: workspaceDir }),
+    );
+    const payload = parseJsonObject(stdout.trim());
+    expect(payload.status).toBe('dry_run');
+    expect(payload.readinessStatus).toBe('ready');
+    const readiness = payload.readiness;
+    expect(isRecord(readiness)).toBe(true);
+    if (!isRecord(readiness)) {
+      throw new Error('readiness is not a record');
+    }
+    expect(readiness.status).toBe('ready');
+    expect(exitCode).toBeUndefined();
+  });
+
+  it('emits readiness=ready in plain-text dry-run output', async () => {
+    writeFullReadyConfig(workspaceDir);
+    const { stdout } = await captureStdio(() =>
+      handleRunRuleHost({ painId: 'pain-1', dryRun: true, workspace: workspaceDir }),
+    );
+    expect(stdout).toMatch(/readiness:\s*READY/i);
+  });
+
+  // ── text_principle_only ─────────────────────────────────────────────────
+
+  it('emits readiness=text_principle_only in --json dry-run when code_rule_capability is OFF', async () => {
+    writeTextPrincipleOnlyConfig(workspaceDir);
+    const { stdout, exitCode } = await captureStdio(() =>
+      handleRunRuleHost({ painId: 'pain-1', dryRun: true, json: true, workspace: workspaceDir }),
+    );
+    const payload = parseJsonObject(stdout.trim());
+    expect(payload.status).toBe('dry_run');
+    expect(payload.readinessStatus).toBe('text_principle_only');
+    const readiness = payload.readiness;
+    expect(isRecord(readiness)).toBe(true);
+    if (!isRecord(readiness)) {
+      throw new Error('readiness is not a record');
+    }
+    expect(readiness.status).toBe('text_principle_only');
+    expect(typeof readiness.reason).toBe('string');
+    expect(typeof readiness.nextAction).toBe('string');
+    expect(exitCode).toBeUndefined();
+  });
+
+  it('does not reclassify evaluator-disabled text_principle_only as runtime resolution failure', async () => {
+    writeEvaluatorDisabledConfig(workspaceDir);
+    const { stdout, exitCode } = await captureStdio(() =>
+      handleRunRuleHost({ painId: 'pain-1', dryRun: true, json: true, workspace: workspaceDir }),
+    );
+    const payload = parseJsonObject(stdout.trim());
+    expect(payload.status).toBe('dry_run');
+    expect(payload.readinessStatus).toBe('text_principle_only');
+    const readiness = payload.readiness;
+    expect(isRecord(readiness)).toBe(true);
+    if (!isRecord(readiness)) {
+      throw new Error('readiness is not a record');
+    }
+    expect(readiness.status).toBe('text_principle_only');
+    expect(String(readiness.reason)).toContain('evaluator');
+    expect(String(payload.capabilityStatus)).toContain('evaluator');
+    expect(exitCode).toBeUndefined();
+  });
+
+  it('emits readiness=text_principle_only in plain-text dry-run output', async () => {
+    writeTextPrincipleOnlyConfig(workspaceDir);
+    const { stdout } = await captureStdio(() =>
+      handleRunRuleHost({ painId: 'pain-1', dryRun: true, workspace: workspaceDir }),
+    );
+    expect(stdout).toMatch(/readiness:\s*TEXT_PRINCIPLE_ONLY/i);
+  });
+
+  // ── refused ─────────────────────────────────────────────────────────────
+
+  it('exits with code=1 and emits status=refused in --json when dreamer is disabled', async () => {
+    writeRefusedConfig(workspaceDir);
+    const { stdout, exitCode } = await captureStdio(() =>
+      handleRunRuleHost({ painId: 'pain-1', dryRun: true, json: true, workspace: workspaceDir }),
+    );
+    const payload = parseJsonObject(stdout.trim());
+    expect(payload.status).toBe('refused');
+    expect(typeof payload.reason).toBe('string');
+    expect(typeof payload.nextAction).toBe('string');
+    expect(exitCode).toBe(1);
+  });
+
+  it('exits with code=1 and emits REFUSED in plain-text when dreamer is disabled', async () => {
+    writeRefusedConfig(workspaceDir);
+    const { stderr, exitCode } = await captureStdio(() =>
+      handleRunRuleHost({ painId: 'pain-1', dryRun: true, workspace: workspaceDir }),
+    );
+    expect(stderr).toMatch(/REFUSED/i);
+    expect(stderr).toMatch(/dreamer/i);
+    expect(exitCode).toBe(1);
+  });
+
+  it('refused status includes the full readiness object in --json output', async () => {
+    writeRefusedConfig(workspaceDir);
+    const { stdout } = await captureStdio(() =>
+      handleRunRuleHost({ painId: 'pain-1', dryRun: true, json: true, workspace: workspaceDir }),
+    );
+    const payload = parseJsonObject(stdout.trim());
+    expect(payload.readiness).toBeDefined();
+    const readiness = payload.readiness;
+    expect(isRecord(readiness)).toBe(true);
+    if (!isRecord(readiness)) {
+      throw new Error('readiness is not a record');
+    }
+    expect(readiness.status).toBe('refused');
+    expect(readiness.agentStatuses).toBeDefined();
+  });
+
+  it('refused status does NOT attempt pipeline execution or adapter construction', async () => {
+    // If the handler tried to construct adapters with a disabled dreamer,
+    // resolveRunRuleHostRuntime would throw. The readiness gate must prevent
+    // that by exiting before resolveRunRuleHostRuntime is called.
+    writeRefusedConfig(workspaceDir);
+    const { stdout, exitCode } = await captureStdio(() =>
+      handleRunRuleHost({ painId: 'pain-1', dryRun: true, json: true, workspace: workspaceDir }),
+    );
+    const payload = parseJsonObject(stdout.trim());
+    // Must be 'refused', NOT 'failed' with 'agent_runtime_resolution_failed'
+    expect(payload.status).toBe('refused');
+    expect(payload.reason).not.toMatch(/agent_runtime_resolution_failed/);
+    expect(exitCode).toBe(1);
+  });
+});

package/tests/services/rulehost-pipeline-e2e.test.ts

@@ -52,6 +52,18 @@ function writeConfig(workspaceDir: string, content: object): void {
   );
 }
 
+/** Type guard: narrows `unknown` to `Record<string, unknown>` without `as`. */
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function requireRecord(value: unknown, label: string): Record<string, unknown> {
+  if (!isRecord(value)) {
+    throw new Error(`${label} is not a record`);
+  }
+  return value;
+}
+
 /** Config with both artificer+evaluator enabled, pi-ai profile, API key env set. */
 function makeCapabilityOnConfig(workspaceDir: string): object {
   return {
@@ -90,17 +102,19 @@ function makeCapabilityOnConfig(workspaceDir: string): object {
 
 /** Config with artificer disabled (capability must be OFF). */
 function makeArtificerDisabledConfig(workspaceDir: string): object {
-  const cfg = makeCapabilityOnConfig(workspaceDir) as Record<string, unknown>;
-  const internalAgents = cfg.internalAgents as { agents: Record<string, { enabled: boolean; runtimeProfile?: string }> };
-  internalAgents.agents.artificer = { enabled: false };
+  const cfg = makeCapabilityOnConfig(workspaceDir);
+  const internalAgents = requireRecord(Reflect.get(cfg, 'internalAgents'), 'internalAgents');
+  const agents = requireRecord(Reflect.get(internalAgents, 'agents'), 'internalAgents.agents');
+  Reflect.set(agents, 'artificer', { enabled: false });
   return cfg;
 }
 
 /** Config with evaluator disabled (capability must be OFF). */
 function makeEvaluatorDisabledConfig(workspaceDir: string): object {
-  const cfg = makeCapabilityOnConfig(workspaceDir) as Record<string, unknown>;
-  const internalAgents = cfg.internalAgents as { agents: Record<string, { enabled: boolean; runtimeProfile?: string }> };
-  internalAgents.agents.evaluator = { enabled: false };
+  const cfg = makeCapabilityOnConfig(workspaceDir);
+  const internalAgents = requireRecord(Reflect.get(cfg, 'internalAgents'), 'internalAgents');
+  const agents = requireRecord(Reflect.get(internalAgents, 'agents'), 'internalAgents.agents');
+  Reflect.set(agents, 'evaluator', { enabled: false });
   return cfg;
 }
 
@@ -158,10 +172,11 @@ describe('runRuleHost production-wiring (PRI-429) — deterministic, no LLM', ()
   }
 
   /** Extract the single JSON object written to stdout. Fails if not exactly one write. */
-  function parseJsonOutput(): unknown {
+  function parseJsonOutput(): Record<string, unknown> {
     expect(stdoutSpy).toHaveBeenCalledTimes(1);
     const raw = stdoutSpy.mock.calls[0][0] as string;
-    return JSON.parse(raw);
+    const parsed: unknown = JSON.parse(raw);
+    return requireRecord(parsed, 'stdout JSON');
   }
 
   // ── Capability ON: both agents enabled, API key set ──────────────────────
@@ -178,14 +193,11 @@ describe('runRuleHost production-wiring (PRI-429) — deterministic, no LLM', ()
     });
 
     const output = parseJsonOutput();
-    expect(typeof output).toBe('object');
-    expect(output).not.toBeNull();
-    const obj = output as { status: string; codeRuleCapability?: { enabled: boolean; disabledReason?: string }; capabilityStatus?: string };
-    expect(obj.status).toBe('dry_run');
-    expect(obj.codeRuleCapability).toBeDefined();
-    expect(obj.codeRuleCapability?.enabled).toBe(true);
-    expect(obj.codeRuleCapability?.disabledReason).toBeUndefined();
-    expect(obj.capabilityStatus).toContain('ON');
+    const codeRuleCapability = requireRecord(output.codeRuleCapability, 'codeRuleCapability');
+    expect(output.status).toBe('dry_run');
+    expect(codeRuleCapability.enabled).toBe(true);
+    expect(codeRuleCapability.disabledReason).toBeUndefined();
+    expect(String(output.capabilityStatus)).toContain('ON');
     // exitCode must NOT be set for dry_run success
     expect(process.exitCode).toBeUndefined();
   });
@@ -203,16 +215,13 @@ describe('runRuleHost production-wiring (PRI-429) — deterministic, no LLM', ()
     await handleRunRuleHost({ workspace, painId: 'pain-flag-default', dryRun: true, json: true });
 
     const output = parseJsonOutput();
-    // PRI-435 (CodeRabbit P3): narrow unknown before property access
-    expect(typeof output).toBe('object');
-    expect(output).not.toBeNull();
-    const obj = output as { status: string; codeRuleCapability?: { enabled: boolean; disabledReason?: string }; capabilityStatus?: string };
-    expect(obj.status).toBe('dry_run');
+    const codeRuleCapability = requireRecord(output.codeRuleCapability, 'codeRuleCapability');
+    expect(output.status).toBe('dry_run');
     // PRI-435: code_rule_capability is now a core flag — defaults ON even when omitted from config.
     // It cannot be disabled by config. The capability is ON when artificer+evaluator are configured.
-    expect(obj.codeRuleCapability).toEqual(expect.objectContaining({ enabled: true }));
-    expect(obj.codeRuleCapability?.disabledReason).toBeUndefined();
-    expect(String(obj.capabilityStatus)).toContain('ON');
+    expect(codeRuleCapability).toEqual(expect.objectContaining({ enabled: true }));
+    expect(codeRuleCapability.disabledReason).toBeUndefined();
+    expect(String(output.capabilityStatus)).toContain('ON');
   });
 
   it('PRI-435: explicit emergency disable via code_rule_capability.enabled=false is observable', async () => {
@@ -229,16 +238,13 @@ describe('runRuleHost production-wiring (PRI-429) — deterministic, no LLM', ()
     await handleRunRuleHost({ workspace, painId: 'pain-emergency-disable', dryRun: true, json: true });
 
     const output = parseJsonOutput();
-    // PRI-435 (CodeRabbit P3): narrow unknown before property access
-    expect(typeof output).toBe('object');
-    expect(output).not.toBeNull();
-    const obj = output as { status: string; codeRuleCapability?: { enabled: boolean; disabledReason?: string }; capabilityStatus?: string };
-    expect(obj.status).toBe('dry_run');
+    const codeRuleCapability = requireRecord(output.codeRuleCapability, 'codeRuleCapability');
+    expect(output.status).toBe('dry_run');
     // PRI-435: Emergency disable via code_rule_capability.enabled=false is preserved.
     // The capability is OFF with a structured reason.
-    expect(obj.codeRuleCapability).toEqual(expect.objectContaining({ enabled: false }));
-    expect(String(obj.codeRuleCapability?.disabledReason)).toContain('feature flag');
-    expect(String(obj.capabilityStatus)).toContain('OFF');
+    expect(codeRuleCapability).toEqual(expect.objectContaining({ enabled: false }));
+    expect(String(codeRuleCapability.disabledReason)).toContain('feature flag');
+    expect(String(output.capabilityStatus)).toContain('OFF');
   });
 
   it('reports the resolved runtime profile for every executed agent', async () => {
@@ -271,10 +277,17 @@ describe('runRuleHost production-wiring (PRI-429) — deterministic, no LLM', ()
 
     await handleRunRuleHost({ workspace, painId: 'pain-disabled-philosopher', confirm: true, json: true });
 
+    // PRI-461: readiness gate catches disabled required agents BEFORE adapter
+    // construction, returning status='refused' with a structured reason instead
+    // of the old opaque 'agent_runtime_resolution_failed' error.
     const output = parseJsonOutput();
-    expect(output.status).toBe('failed');
-    expect(output.reason).toBe('agent_runtime_resolution_failed');
-    expect(String(output.message)).toContain('philosopher');
+    expect(isRecord(output)).toBe(true);
+    if (!isRecord(output)) {
+      throw new Error('output is not a record');
+    }
+    expect(output.status).toBe('refused');
+    expect(String(output.reason)).toContain('philosopher');
+    expect(typeof output.nextAction).toBe('string');
     expect(process.exitCode).toBe(1);
     expect(fs.existsSync(path.join(workspace, '.state', 'runtime-v2.sqlite'))).toBe(false);
   });
@@ -308,10 +321,10 @@ describe('runRuleHost production-wiring (PRI-429) — deterministic, no LLM', ()
     });
 
     const output = parseJsonOutput();
-    const obj = output as { status: string; codeRuleCapability: { enabled: boolean; disabledReason?: string } };
-    expect(obj.status).toBe('dry_run');
-    expect(obj.codeRuleCapability.enabled).toBe(false);
-    expect(obj.codeRuleCapability.disabledReason).toContain('artificer');
+    const codeRuleCapability = requireRecord(output.codeRuleCapability, 'codeRuleCapability');
+    expect(output.status).toBe('dry_run');
+    expect(codeRuleCapability.enabled).toBe(false);
+    expect(String(codeRuleCapability.disabledReason)).toContain('artificer');
   });
 
   // ── Capability OFF: evaluator disabled ───────────────────────────────────
@@ -328,10 +341,10 @@ describe('runRuleHost production-wiring (PRI-429) — deterministic, no LLM', ()
     });
 
     const output = parseJsonOutput();
-    const obj = output as { status: string; codeRuleCapability: { enabled: boolean; disabledReason?: string } };
-    expect(obj.status).toBe('dry_run');
-    expect(obj.codeRuleCapability.enabled).toBe(false);
-    expect(obj.codeRuleCapability.disabledReason).toContain('evaluator');
+    const codeRuleCapability = requireRecord(output.codeRuleCapability, 'codeRuleCapability');
+    expect(output.status).toBe('dry_run');
+    expect(codeRuleCapability.enabled).toBe(false);
+    expect(String(codeRuleCapability.disabledReason)).toContain('evaluator');
   });
 
   // ── Capability OFF: API key not set ──────────────────────────────────────
@@ -393,10 +406,11 @@ describe('runRuleHost production-wiring (PRI-429) — deterministic, no LLM', ()
     });
 
     const output = parseJsonOutput();
-    const obj = output as { status: string; codeRuleCapability: { enabled: boolean; disabledReason?: string } };
-    expect(obj.status).toBe('dry_run');
-    expect(obj.codeRuleCapability.enabled).toBe(false);
-    expect(obj.codeRuleCapability.disabledReason).toContain('apiKeyEnv');
+    const codeRuleCapability = requireRecord(output.codeRuleCapability, 'codeRuleCapability');
+    expect(output.status).toBe('dry_run');
+    expect(codeRuleCapability.enabled).toBe(false);
+    expect(String(codeRuleCapability.disabledReason)).toContain('TEST_RULEHOST_ARTIFICER_KEY');
+    expect(String(codeRuleCapability.disabledReason)).toContain('not set');
   });
 
   // ── CLI gate: mutual exclusivity ─────────────────────────────────────────
@@ -414,10 +428,9 @@ describe('runRuleHost production-wiring (PRI-429) — deterministic, no LLM', ()
     });
 
     const output = parseJsonOutput();
-    const obj = output as { status: string; reason: string; nextAction: string };
-    expect(obj.status).toBe('failed');
-    expect(obj.reason).toContain('mutually exclusive');
-    expect(obj.nextAction).toBeTruthy();
+    expect(output.status).toBe('failed');
+    expect(String(output.reason)).toContain('mutually exclusive');
+    expect(output.nextAction).toBeTruthy();
     expect(process.exitCode).toBe(1);
   });
 
@@ -435,10 +448,9 @@ describe('runRuleHost production-wiring (PRI-429) — deterministic, no LLM', ()
     });
 
     const output = parseJsonOutput();
-    const obj = output as { status: string; reason: string; nextAction: string };
-    expect(obj.status).toBe('failed');
-    expect(obj.reason).toContain('painId');
-    expect(obj.nextAction).toBeTruthy();
+    expect(output.status).toBe('failed');
+    expect(String(output.reason)).toContain('painId');
+    expect(output.nextAction).toBeTruthy();
     expect(process.exitCode).toBe(1);
   });
 
@@ -480,8 +492,7 @@ describe('runRuleHost production-wiring (PRI-429) — deterministic, no LLM', ()
     });
 
     const output = parseJsonOutput();
-    const obj = output as { status: string };
-    expect(obj.status).toBe('dry_run');
+    expect(output.status).toBe('dry_run');
     // Must NOT set exitCode for dry_run
     expect(process.exitCode).toBeUndefined();
   });
@@ -501,10 +512,9 @@ describe('runRuleHost production-wiring (PRI-429) — deterministic, no LLM', ()
     });
 
     const output = parseJsonOutput();
-    const obj = output as { status: string; reason: string; nextAction: string };
-    expect(obj.status).toBe('failed');
-    expect(obj.reason).toContain('unsupported channel');
-    expect(obj.nextAction).toBeTruthy();
+    expect(output.status).toBe('failed');
+    expect(String(output.reason)).toContain('unsupported channel');
+    expect(output.nextAction).toBeTruthy();
     expect(process.exitCode).toBe(1);
   });
 });