@principles/pd-cli 1.152.12 → 1.152.14

package/tests/commands/proven-channel-baseline.test.ts

@@ -1,441 +0,0 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-
-const { mockRunProvenChannelBaseline } = vi.hoisted(() => ({
-  mockRunProvenChannelBaseline: vi.fn(),
-}));
-
-vi.mock('../../src/services/proven-channel-baseline-runner.js', () => ({
-  runProvenChannelBaseline: mockRunProvenChannelBaseline,
-}));
-
-import * as fs from 'fs';
-import * as path from 'path';
-import * as os from 'os';
-import { handleProvenChannelBaseline, cleanupTempWorkspace } from '../../src/commands/proven-channel-baseline.js';
-
-function makePassedSummary() {
-  return {
-    status: 'passed' as const,
-    workspaceMode: 'temp' as const,
-    generatedAt: new Date().toISOString(),
-    channels: [
-      {
-        channel: 'prompt' as const,
-        status: 'passed' as const,
-        canActivateResult: { ok: true, riskLevel: 'low' as const },
-        activationDecision: { decision: 'would_activate' as const, activationId: 'act_prompt_P_240', action: 'prompt_activate', targetRef: 'ledger://P_240' },
-        evidence: { activationId: 'act_prompt_P_240', evidenceSource: 'ActivationDispatcher.dispatch → PromptWriter' },
-        dependsOnLegacy: false,
-        evidenceSource: 'ActivationDispatcher.dispatch → PromptWriter',
-      },
-      {
-        channel: 'code_tool_hook' as const,
-        status: 'passed' as const,
-        canActivateResult: { ok: true, riskLevel: 'high' as const },
-        activationDecision: { decision: 'would_activate' as const, activationId: 'act_code_R_240', action: 'code_tool_hook_shadow_activate', targetRef: 'impl://R_240' },
-        evidence: { activationId: 'act_code_R_240', gateDecision: 'accepted_shadow', evidenceSource: 'ActivationDispatcher.dispatch → RuleHostWriter' },
-        dependsOnLegacy: false,
-        evidenceSource: 'ActivationDispatcher.dispatch → RuleHostWriter',
-      },
-      {
-        channel: 'defer_archive' as const,
-        status: 'passed' as const,
-        canActivateResult: { ok: true, riskLevel: 'low' as const },
-        activationDecision: { decision: 'would_activate' as const, activationId: 'act_archive_P_240', action: 'defer_archive', targetRef: 'ledger://P_240#archived' },
-        evidence: { activationId: 'act_archive_P_240', evidenceSource: 'ActivationDispatcher.dispatch → DeferArchiveWriter' },
-        dependsOnLegacy: false,
-        evidenceSource: 'ActivationDispatcher.dispatch → DeferArchiveWriter',
-      },
-    ],
-    continuityMatrix: [
-      {
-        channel: 'prompt' as const,
-        entryPoint: 'ActivationDispatcher.dispatch → PromptWriter.canActivate → PromptWriter.activate',
-        expectedObservable: 'activationId=act_prompt_{principleId}',
-        testCommand: 'npx vitest run ...',
-        dependsOnPluginDiscovery: false,
-        pri119ReuseEvidence: 'ActivationDispatcher → PromptWriter contract',
-        pri230ReuseEvidence: 'prompt risk level',
-      },
-      {
-        channel: 'code_tool_hook' as const,
-        entryPoint: 'ActivationDispatcher.dispatch → RuleHostWriter.canActivate → evaluateRefinerRuleHostGate → RuleHostWriter.activate',
-        expectedObservable: 'activationId=act_code_{ruleId}',
-        testCommand: 'npx vitest run ...',
-        dependsOnPluginDiscovery: false,
-        pri119ReuseEvidence: 'ActivationDispatcher → RuleHostWriter gate contract',
-        pri230ReuseEvidence: 'code_tool_hook risk level',
-      },
-      {
-        channel: 'defer_archive' as const,
-        entryPoint: 'ActivationDispatcher.dispatch → DeferArchiveWriter.canActivate → DeferArchiveWriter.activate',
-        expectedObservable: 'activationId=act_archive_{principleId}',
-        testCommand: 'npx vitest run ...',
-        dependsOnPluginDiscovery: false,
-        pri119ReuseEvidence: 'ActivationDispatcher → DeferArchiveWriter contract',
-        pri230ReuseEvidence: 'defer_archive risk level',
-      },
-    ],
-  };
-}
-
-describe('handleProvenChannelBaseline (CLI handler)', () => {
-  let tempDir = '';
-  const originalExitCode = process.exitCode;
-
-  beforeEach(() => {
-    tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pd-cli-proven-test-'));
-    mockRunProvenChannelBaseline.mockReset();
-    process.exitCode = undefined;
-  });
-
-  afterEach(() => {
-    try {
-      fs.rmSync(tempDir, { recursive: true, force: true });
-    } catch {
-      void 0;
-    }
-    process.exitCode = originalExitCode;
-  });
-
-  it('uses temp workspace when no workspace specified', async () => {
-    mockRunProvenChannelBaseline.mockResolvedValue({
-      ...makePassedSummary(),
-      workspaceMode: 'temp',
-    });
-
-    await handleProvenChannelBaseline({});
-
-    expect(mockRunProvenChannelBaseline).toHaveBeenCalledWith(
-      expect.objectContaining({ workspaceMode: 'temp' }),
-    );
-    const calledDir = mockRunProvenChannelBaseline.mock.calls[0][0].workspaceDir;
-    expect(calledDir).toContain('pd-proven-channel-');
-  });
-
-  it('uses explicit workspace when --workspace is provided', async () => {
-    mockRunProvenChannelBaseline.mockResolvedValue({
-      ...makePassedSummary(),
-      workspaceMode: 'explicit_workspace',
-    });
-
-    await handleProvenChannelBaseline({ workspace: tempDir });
-
-    expect(mockRunProvenChannelBaseline).toHaveBeenCalledWith(
-      expect.objectContaining({
-        workspaceDir: tempDir,
-        workspaceMode: 'explicit_workspace',
-      }),
-    );
-  });
-
-  it('--json output contains status, workspaceMode, generatedAt, channels, continuityMatrix', async () => {
-    const summary = makePassedSummary();
-    mockRunProvenChannelBaseline.mockResolvedValue(summary);
-
-    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-
-    try {
-      await handleProvenChannelBaseline({ json: true });
-
-      expect(logSpy).toHaveBeenCalledTimes(1);
-      const output = logSpy.mock.calls[0][0];
-      const parsed = JSON.parse(output);
-      expect(parsed).toHaveProperty('status');
-      expect(parsed).toHaveProperty('workspaceMode');
-      expect(parsed).toHaveProperty('generatedAt');
-      expect(parsed).toHaveProperty('channels');
-      expect(parsed).toHaveProperty('continuityMatrix');
-      expect(parsed.channels).toHaveLength(3);
-      expect(parsed.continuityMatrix).toHaveLength(3);
-    } finally {
-      logSpy.mockRestore();
-    }
-  });
-
-  it('sets process.exitCode = 1 when status is failed', async () => {
-    mockRunProvenChannelBaseline.mockResolvedValue({
-      ...makePassedSummary(),
-      status: 'failed',
-      channels: [
-        { channel: 'prompt', status: 'failed', canActivateResult: { ok: false, reason: 'test', riskLevel: 'low' }, activationDecision: { decision: 'refused', reason: 'test', channel: 'prompt' }, evidence: {}, dependsOnLegacy: false, failureReason: 'test failure', evidenceSource: 'test' },
-        { channel: 'code_tool_hook', status: 'failed', canActivateResult: { ok: false, reason: 'test', riskLevel: 'high' }, activationDecision: { decision: 'refused', reason: 'test', channel: 'code_tool_hook' }, evidence: {}, dependsOnLegacy: false, failureReason: 'test failure', evidenceSource: 'test' },
-        { channel: 'defer_archive', status: 'failed', canActivateResult: { ok: false, reason: 'test', riskLevel: 'low' }, activationDecision: { decision: 'refused', reason: 'test', channel: 'defer_archive' }, evidence: {}, dependsOnLegacy: false, failureReason: 'test failure', evidenceSource: 'test' },
-      ],
-    });
-
-    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
-
-    try {
-      await handleProvenChannelBaseline({ workspace: tempDir });
-      expect(process.exitCode).toBe(1);
-    } finally {
-      logSpy.mockRestore();
-      errorSpy.mockRestore();
-    }
-  });
-
-  it('cleans up temp workspace on success', async () => {
-    mockRunProvenChannelBaseline.mockResolvedValue(makePassedSummary());
-
-    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-
-    try {
-      await handleProvenChannelBaseline({});
-
-      const calledDir = mockRunProvenChannelBaseline.mock.calls[0][0].workspaceDir;
-      expect(fs.existsSync(calledDir)).toBe(false);
-    } finally {
-      logSpy.mockRestore();
-    }
-  });
-
-  it('does not delete explicit workspace after run', async () => {
-    fs.mkdirSync(path.join(tempDir, '.pd'), { recursive: true });
-
-    mockRunProvenChannelBaseline.mockResolvedValue({
-      ...makePassedSummary(),
-      workspaceMode: 'explicit_workspace',
-    });
-
-    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-
-    try {
-      await handleProvenChannelBaseline({ workspace: tempDir });
-      expect(fs.existsSync(tempDir)).toBe(true);
-    } finally {
-      logSpy.mockRestore();
-    }
-  });
-
-  it('--channels with unknown values passes unknownChannels to runner', async () => {
-    mockRunProvenChannelBaseline.mockResolvedValue({
-      status: 'failed',
-      generatedAt: new Date().toISOString(),
-      workspaceMode: 'temp',
-      channels: [],
-      inputValidationFailure: {
-        reason: 'unknown_channels',
-        message: 'Unknown channels: skill, legacy_channel. Valid channels: prompt, code_tool_hook, defer_archive',
-        nextAction: 'Use only valid MVP channels: prompt, code_tool_hook, defer_archive',
-        unknownChannels: ['skill', 'legacy_channel'],
-      },
-      continuityMatrix: [],
-      recommendedNextIssue: 'PRI-240: Unknown channels provided: skill, legacy_channel',
-    });
-
-    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
-
-    try {
-      await handleProvenChannelBaseline({ json: true, channels: 'prompt,skill,legacy_channel' });
-      expect(mockRunProvenChannelBaseline).toHaveBeenCalledWith(
-        expect.objectContaining({
-          unknownChannels: ['skill', 'legacy_channel'],
-        }),
-      );
-    } finally {
-      logSpy.mockRestore();
-      errorSpy.mockRestore();
-    }
-  });
-
-  it('--channels "" returns failed with inputValidationFailure, no fixtures executed', async () => {
-    mockRunProvenChannelBaseline.mockResolvedValue({
-      status: 'failed',
-      generatedAt: new Date().toISOString(),
-      workspaceMode: 'temp',
-      channels: [],
-      inputValidationFailure: {
-        reason: 'empty_channel_input',
-        message: '--channels was provided but contained no valid channel names',
-        nextAction: 'Provide at least one valid MVP channel: prompt, code_tool_hook, defer_archive',
-      },
-      continuityMatrix: [],
-      recommendedNextIssue: 'PRI-240: --channels input was empty — no fixtures were executed',
-    });
-
-    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
-
-    try {
-      await handleProvenChannelBaseline({ json: true, channels: '' });
-      expect(mockRunProvenChannelBaseline).toHaveBeenCalledWith(
-        expect.objectContaining({
-          emptyChannelInput: true,
-          channels: undefined,
-          unknownChannels: [],
-        }),
-      );
-      expect(logSpy.mock.calls[0]?.[0]).toBeDefined();
-      const output = logSpy.mock.calls[0][0];
-      expect(typeof output).toBe('string');
-      const parsed = JSON.parse(output);
-      expect(parsed.status).toBe('failed');
-      expect(parsed.inputValidationFailure).toBeDefined();
-      expect(parsed.inputValidationFailure.reason).toBe('empty_channel_input');
-      expect(parsed.channels).toHaveLength(0);
-    } finally {
-      logSpy.mockRestore();
-      errorSpy.mockRestore();
-    }
-  });
-
-  it('--channels "," returns failed with inputValidationFailure, no fixtures executed', async () => {
-    mockRunProvenChannelBaseline.mockResolvedValue({
-      status: 'failed',
-      generatedAt: new Date().toISOString(),
-      workspaceMode: 'temp',
-      channels: [],
-      inputValidationFailure: {
-        reason: 'empty_channel_input',
-        message: '--channels was provided but contained no valid channel names',
-        nextAction: 'Provide at least one valid MVP channel: prompt, code_tool_hook, defer_archive',
-      },
-      continuityMatrix: [],
-    });
-
-    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
-
-    try {
-      await handleProvenChannelBaseline({ json: true, channels: ',' });
-      expect(mockRunProvenChannelBaseline).toHaveBeenCalledWith(
-        expect.objectContaining({
-          emptyChannelInput: true,
-        }),
-      );
-    } finally {
-      logSpy.mockRestore();
-      errorSpy.mockRestore();
-    }
-  });
-
-  it('--channels bogus returns failed with unknown channels, no fixtures executed', async () => {
-    mockRunProvenChannelBaseline.mockResolvedValue({
-      status: 'failed',
-      generatedAt: new Date().toISOString(),
-      workspaceMode: 'temp',
-      channels: [],
-      inputValidationFailure: {
-        reason: 'unknown_channels',
-        message: 'Unknown channels: bogus. Valid channels: prompt, code_tool_hook, defer_archive',
-        nextAction: 'Use only valid MVP channels: prompt, code_tool_hook, defer_archive',
-        unknownChannels: ['bogus'],
-      },
-      continuityMatrix: [],
-    });
-
-    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
-
-    try {
-      await handleProvenChannelBaseline({ json: true, channels: 'bogus' });
-      expect(mockRunProvenChannelBaseline).toHaveBeenCalledWith(
-        expect.objectContaining({
-          unknownChannels: ['bogus'],
-        }),
-      );
-      expect(logSpy.mock.calls[0]?.[0]).toBeDefined();
-      const output = logSpy.mock.calls[0][0];
-      expect(typeof output).toBe('string');
-      const parsed = JSON.parse(output);
-      expect(parsed.inputValidationFailure.reason).toBe('unknown_channels');
-      expect(parsed.inputValidationFailure.unknownChannels).not.toContain('prompt');
-    } finally {
-      logSpy.mockRestore();
-      errorSpy.mockRestore();
-    }
-  });
-
-  it('text mode output shows inputValidationFailure reason, message, nextAction', async () => {
-    mockRunProvenChannelBaseline.mockResolvedValue({
-      status: 'failed',
-      generatedAt: new Date().toISOString(),
-      workspaceMode: 'temp',
-      channels: [],
-      inputValidationFailure: {
-        reason: 'unknown_channels',
-        message: 'Unknown channels: bogus. Valid channels: prompt, code_tool_hook, defer_archive',
-        nextAction: 'Use only valid MVP channels: prompt, code_tool_hook, defer_archive',
-        unknownChannels: ['bogus'],
-      },
-      continuityMatrix: [],
-    });
-
-    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
-
-    try {
-      await handleProvenChannelBaseline({ channels: 'bogus' });
-      const output = logSpy.mock.calls[0]?.[0] ?? '';
-      expect(output).toContain('Input Validation Failure:');
-      expect(output).toContain('reason: unknown_channels');
-      expect(output).toContain('message:');
-      expect(output).toContain('nextAction:');
-    } finally {
-      logSpy.mockRestore();
-      errorSpy.mockRestore();
-    }
-  });
-
-  it('without --channels runs all default MVP channels', async () => {
-    mockRunProvenChannelBaseline.mockResolvedValue(makePassedSummary());
-
-    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-
-    try {
-      await handleProvenChannelBaseline({ json: true });
-      expect(mockRunProvenChannelBaseline).toHaveBeenCalledWith(
-        expect.objectContaining({
-          channels: undefined,
-          unknownChannels: [],
-          emptyChannelInput: false,
-        }),
-      );
-    } finally {
-      logSpy.mockRestore();
-    }
-  });
-
-  it('cleanup failure outputs to stderr without polluting JSON stdout', () => {
-    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
-    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
-
-    const failingRmSync = () => { throw new Error('permission denied'); };
-    cleanupTempWorkspace('/tmp/fake-dir', failingRmSync);
-
-    const errorCalls = errorSpy.mock.calls.map(c => c[0]);
-    const cleanupWarningSeen = errorCalls.some(c => typeof c === 'string' && c.includes('[pd-cli] cleanup warning'));
-    expect(cleanupWarningSeen).toBe(true);
-    expect(logSpy).not.toHaveBeenCalled();
-
-    logSpy.mockRestore();
-    errorSpy.mockRestore();
-  });
-
-  it('command is registered in CLI entrypoint as runtime synthetic proven-channel', async () => {
-    const { Command } = await import('commander');
-    const program = new Command();
-    program.exitOverride();
-
-    const { handleProvenChannelBaseline: handler } = await import('../../src/commands/proven-channel-baseline.js');
-
-    const synthCmd = program.command('runtime').command('synthetic');
-    synthCmd
-      .command('proven-channel')
-      .option('-w, --workspace <path>', 'Workspace directory')
-      .option('--json', 'Output raw JSON')
-      .option('--channels <channels>', 'Comma-separated channel list')
-      .action(async (opts) => {
-        await handler(opts);
-      });
-
-    const found = program.commands.find(c => c.name() === 'runtime')
-      ?.commands.find(c => c.name() === 'synthetic')
-      ?.commands.find(c => c.name() === 'proven-channel');
-    expect(found).toBeDefined();
-    expect(found?.name()).toBe('proven-channel');
-  });
-});

package/tests/commands/rulecode.test.ts

@@ -1,177 +0,0 @@
-/**
- * Tests for rulecode golden-trace path containment (CWE-22).
- *
- * Covers:
- * - Golden trace inside workspace accepted
- * - Golden trace outside workspace rejected
- * - Sibling-prefix attack (/work/a vs /work/ab) rejected
- * - Parent traversal rejected
- * - Relative workspace + relative golden trace accepted
- * - Empty path rejected
- */
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
-import * as fs from 'fs';
-import * as path from 'path';
-import os from 'os';
-import { loadGoldenTraceCases } from '../../src/commands/rulecode.js';
-import { vi } from 'vitest';
-
-const VALID_CASES = JSON.stringify([
-  {
-    caseId: 'c1',
-    kind: 'positive',
-    toolName: 'read',
-    params: {},
-    expectedDecision: 'allow',
-  },
-  {
-    caseId: 'c2',
-    kind: 'negative',
-    toolName: 'read',
-    params: {},
-    expectedDecision: 'deny',
-  },
-]);
-
-function writeTrace(dir: string, name: string): string {
-  const p = path.join(dir, name);
-  fs.mkdirSync(dir, { recursive: true });
-  fs.writeFileSync(p, VALID_CASES, 'utf8');
-  return p;
-}
-
-describe('loadGoldenTraceCases containment', () => {
-  let wsDir: string;
-  let outsideDir: string;
-
-  beforeEach(() => {
-    wsDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pd-rulecode-ws-'));
-    outsideDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pd-rulecode-out-'));
-  });
-
-  afterEach(() => {
-    fs.rmSync(wsDir, { recursive: true, force: true });
-    fs.rmSync(outsideDir, { recursive: true, force: true });
-  });
-
-  it('accepts a golden trace inside the workspace', () => {
-    const trace = writeTrace(path.join(wsDir, 'traces'), 'golden.json');
-    const result = loadGoldenTraceCases(trace, wsDir);
-    expect(result.error).toBeUndefined();
-    expect(result.cases?.length).toBe(2);
-  });
-
-  it('rejects a golden trace outside the workspace', () => {
-    const trace = writeTrace(outsideDir, 'golden.json');
-    const result = loadGoldenTraceCases(trace, wsDir);
-    expect(result.error).toBeDefined();
-    expect(result.error?.reason).toContain('must be inside the workspace');
-  });
-
-  it('rejects sibling-prefix attack (/work/a vs /work/ab)', () => {
-    // workspace root is /tmp/xxx-a; a sibling /tmp/xxx-ab must NOT be
-    // considered inside it, even though its string starts with the root.
-    const parent = wsDir;
-    const siblingDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pd-rulecode-sib-'));
-    // Build a sibling whose path starts with the workspace root string
-    const trace = writeTrace(siblingDir, 'golden.json');
-    // Also construct an explicit prefix-collision sibling: same basename + 'x'
-    const collisionDir = path.join(path.dirname(parent), `${path.basename(parent)}x`);
-    fs.mkdirSync(collisionDir, { recursive: true });
-    const collisionTrace = writeTrace(collisionDir, 'golden.json');
-
-    // Sibling with same prefix must be rejected
-    const result = loadGoldenTraceCases(collisionTrace, parent);
-    expect(result.error).toBeDefined();
-    expect(result.error?.reason).toContain('must be inside the workspace');
-
-    // Unrelated sibling also rejected
-    const result2 = loadGoldenTraceCases(trace, parent);
-    expect(result2.error).toBeDefined();
-  });
-
-  it('rejects parent traversal in golden trace path', () => {
-    const traversal = path.join(wsDir, '..', '..', 'etc', 'passwd');
-    const result = loadGoldenTraceCases(traversal, wsDir);
-    expect(result.error).toBeDefined();
-  });
-
-  it('accepts relative workspace + relative golden trace', () => {
-    // Regression: both relative; containment must canonicalize consistently.
-    const relWs = fs.mkdtempSync(path.join(process.cwd(), '.tmp-rulecode-ws-'));
-    try {
-      const relTraceDir = path.join(relWs, 'traces');
-      const absTrace = writeTrace(relTraceDir, 'golden.json');
-      const relTrace = path.relative(process.cwd(), absTrace);
-      const relWorkspace = path.relative(process.cwd(), relWs);
-      expect(path.isAbsolute(relWorkspace)).toBe(false);
-
-      const result = loadGoldenTraceCases(relTrace, relWorkspace);
-      expect(result.error).toBeUndefined();
-      expect(result.cases?.length).toBe(2);
-    } finally {
-      fs.rmSync(relWs, { recursive: true, force: true });
-    }
-  });
-
-  it('rejects empty golden trace path', () => {
-    const result = loadGoldenTraceCases('', wsDir);
-    expect(result.error).toBeDefined();
-    expect(result.error?.reason).toContain('path is empty');
-  });
-
-  it('rejects filesystem root when no workspace is supplied', () => {
-    const result = loadGoldenTraceCases(path.parse(wsDir).root);
-    expect(result.error).toBeDefined();
-    expect(result.error?.reason).toContain('filesystem root');
-  });
-
-  it('rejects malformed trace JSON', () => {
-    const p = writeTrace(wsDir, 'bad.json');
-    fs.writeFileSync(p, '{not json', 'utf8');
-    const result = loadGoldenTraceCases(p, wsDir);
-    expect(result.error).toBeDefined();
-    expect(result.error?.reason).toContain('not valid JSON');
-  });
-});
-
-
-// ── PRI-634-F R2 (review P2): replay --json carries structured failure ──────
-
-describe('handleRulecodeReplay — structured failure attribution on --json', () => {
-  it('a failing replay surfaces {layer, reasonCode, evidence, nextAction} in the JSON output', async () => {
-    const { handleRulecodeReplay } = await import('../../src/commands/rulecode.js');
-    const code = [
-      'const evaluate = (input) => {',
-      '  return { decision: "allow", matched: false, reason: "never blocks" };',
-      '};',
-    ].join(String.fromCharCode(10));
-    // The --golden-trace CLI input is a JSON ARRAY of cases (not the
-    // persisted GoldenTrace envelope) — see loadGoldenTraceCases.
-    const cases = [
-      { caseId: 'negative-1', kind: 'negative', toolName: 'write_file', params: { file_path: '/prod.env' }, expectedDecision: 'block' },
-      { caseId: 'positive-1', kind: 'positive', toolName: 'write_file', params: { file_path: '/repo/a.ts' }, expectedDecision: 'allow' },
-    ];
-    const traceDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pd-replay-'));
-    const traceFile = path.join(traceDir, 'golden-trace-cases.json');
-    fs.writeFileSync(traceFile, JSON.stringify(cases), 'utf8');
-
-    const logs: string[] = [];
-    const spy = vi.spyOn(console, 'log').mockImplementation((...args: unknown[]) => { logs.push(String(args[0])); });
-    try {
-      await handleRulecodeReplay({ code, goldenTrace: traceFile, json: true });
-    } finally {
-      spy.mockRestore();
-      fs.rmSync(traceDir, { recursive: true, force: true });
-    }
-    expect(process.exitCode).toBe(1);
-    process.exitCode = 0;
-    const output = JSON.parse(logs[0]);
-    expect(output.status).toBe('failed');
-    expect(output.decision).toBe('rejected_validation_failed');
-    expect(output.failure).toBeDefined();
-    expect(output.failure.layer).toBe('rule');
-    expect(output.failure.reasonCode).toBe('replay_decision_mismatch');
-    expect(typeof output.failure.nextAction).toBe('string');
-  });
-});