@sanqianx/project-knowledge 5.0.24 → 5.0.25

package/_site/_test/conversation-api-test.js

@@ -1,119 +1,119 @@
-const assert = require('assert');
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-const { spawnServer } = require('./helpers/spawn-server');
-const { StorageLayout } = require('../lib/storage-layout');
-const { SettingsStore } = require('../lib/settings-store');
-const { ProjectRegistryStore } = require('../lib/project-registry-store');
-const { ProjectStore } = require('../lib/project-store');
-const { ConversationStore } = require('../lib/conversation-store');
-const { localDate } = require('../lib/conversation-query-service');
-
-const ROOT = path.resolve(__dirname, '..', '..');
-const PORT = 8250 + (process.pid % 300);
-const BASE = `http://127.0.0.1:${PORT}`;
-
-async function waitForServer() {
-  for (let attempt = 0; attempt < 100; attempt += 1) {
-    try { if ((await fetch(`${BASE}/api/health`)).ok) return; } catch {}
-    await new Promise(resolve => setTimeout(resolve, 100));
-  }
-  throw new Error('server did not start');
-}
-
-(async () => {
-  const dataDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-conversation-api-'));
-  const layout = new StorageLayout({ dataDir });
-  const settings = new SettingsStore({ layout });
-  const registry = new ProjectRegistryStore({ layout });
-  const projects = new ProjectStore({ layout });
-  await settings.initialize({ knowledge: { rootPath: path.join(dataDir, 'knowledge') } });
-  await registry.initialize();
-  const projectId = 'project-conversation-api';
-  const repoPath = path.join(dataDir, 'repo');
-  const knowledgePath = path.join(dataDir, 'knowledge', projectId);
-  fs.mkdirSync(repoPath, { recursive: true });
-  fs.mkdirSync(knowledgePath, { recursive: true });
-  await projects.create(projectId, {
-    displayName: 'Conversation API', storageName: 'conversation-api', repoPath, knowledgePath,
-  }, { conversationBaselineCursor: 0, conversation: { lastConsumedCursor: 0, captureStatus: 'captured' } });
-  await registry.add(projectId, { displayNameSnapshot: 'Conversation API' });
-  const store = new ConversationStore({ layout, projectStore: projects });
-  const repoIdentity = { repoId: 'conversation-api-repo' };
-  const unsafePrompt = '<script>alert("conversation-body")</script> Keep this as plain text.';
-  async function append(eventId, sequence, turnId, role, content, capturedAt) {
-    return (await store.appendEvent(projectId, {
-      eventId, sequence, source: 'codex', eventType: role === 'user' ? 'user_prompt' : 'assistant_response', role, content,
-      sessionId: 'session-api', turnId, repoIdentity, projectPath: repoPath, branch: 'main', headAtCapture: '0'.repeat(40),
-      capturedAt, identityConfidence: 'high', captureStatus: 'captured',
-    })).event;
-  }
-  const r1 = await append('r1', 1, 'turn-1', 'user', unsafePrompt, '2026-08-18T01:00:00.000Z');
-  const a1 = await append('a1', 2, 'turn-1', 'assistant', 'Rendered only as plain assistant text.', '2026-08-18T01:01:00.000Z');
-  const r2 = await append('r2', 3, 'turn-2', 'user', 'Second prompt.', '2026-08-18T02:00:00.000Z');
-  const a2 = await append('a2', 4, 'turn-2', 'assistant', 'Second reply.', '2026-08-18T02:01:00.000Z');
-  await append('r3', 5, 'turn-3', 'user', 'Third prompt.', '2026-08-18T03:00:00.000Z');
-  await append('r4', 6, 'turn-other-date', 'user', 'Other date prompt.', '2026-08-19T03:00:00.000Z');
-  const projectEvent = event => ({ eventId: event.eventId, sequence: event.sequence, content: event.content, contentHash: event.contentHash, capturedAt: event.capturedAt });
-  store.writeSnapshot(projectId, {
-    commitSha: '1'.repeat(40), repoIdentity, parentSha: null, boundaryStartCursor: 0, boundaryEndCursor: 2, status: 'available',
-    turns: [{ turnId: 'turn-1', source: 'codex', sessionId: 'session-api', bindingKind: 'direct', userEvents: [projectEvent(r1)], assistantEvents: [projectEvent(a1)] }],
-  });
-  store.writeSnapshot(projectId, {
-    commitSha: '3'.repeat(40), repoIdentity, parentSha: '2'.repeat(40), boundaryStartCursor: 5, boundaryEndCursor: 5, status: 'available',
-    turns: [{ turnId: 'turn-2', source: 'codex', sessionId: 'session-api', bindingKind: 'shared-spanning', userEvents: [projectEvent(r2)], assistantEvents: [projectEvent(a2)] }],
-  });
-  store.writeSnapshot(projectId, {
-    commitSha: '2'.repeat(40), repoIdentity, parentSha: '1'.repeat(40), boundaryStartCursor: 2, boundaryEndCursor: 4, status: 'available',
-    turns: [{ turnId: 'turn-2', source: 'codex', sessionId: 'session-api', bindingKind: 'shared-spanning', userEvents: [projectEvent(r2)], assistantEvents: [projectEvent(a2)] }],
-  });
-
-  const spawned = spawnServer({ root: ROOT, port: PORT, dataDir, tag: 'conversation-api', extraEnv: { KB_SKIP_MIGRATION: '1' } });
-  try {
-    await waitForServer();
-    let response = await fetch(`${BASE}/api/conversations/projects`);
-    let body = await response.json();
-    assert.strictEqual(response.status, 200);
-    assert.deepStrictEqual(body.projects.map(project => project.projectId), [projectId]);
-    assert.strictEqual(Object.hasOwn(body.projects[0], 'repoPath'), false, 'project picker payload must not expose raw repository paths');
-
-    const date = localDate(r1.capturedAt);
-    response = await fetch(`${BASE}/api/conversations/turns?projectId=${projectId}&date=${date}&limit=2`);
-    body = await response.json();
-    assert.strictEqual(response.status, 200, JSON.stringify(body));
-    assert.strictEqual(body.turns.length, 2);
-    assert(body.nextCursor && body.hasMore);
-    const firstPage = body.turns;
-    response = await fetch(`${BASE}/api/conversations/turns?projectId=${projectId}&date=${date}&limit=2&cursor=${encodeURIComponent(body.nextCursor)}`);
-    const secondPage = await response.json();
-    assert.strictEqual(secondPage.turns.length, 1);
-    const allTurns = [...firstPage, ...secondPage.turns];
-    const turn1 = allTurns.find(turn => turn.turnId === 'turn-1');
-    const turn2 = allTurns.find(turn => turn.turnId === 'turn-2');
-    const turn3 = allTurns.find(turn => turn.turnId === 'turn-3');
-    assert.strictEqual(turn1.userPrompt, unsafePrompt, 'conversation body should remain exact business data');
-    assert.strictEqual(turn1.renderAs, 'plain-text', 'payload must instruct hosts to avoid HTML interpretation');
-    assert.strictEqual(turn1.annotation.status, 'committed');
-    assert.strictEqual(turn1.annotation.commits[0].shortSha, '1111111');
-    assert.strictEqual(turn2.annotation.status, 'associated');
-    assert.deepStrictEqual(turn2.annotation.commits.map(commit => commit.shortSha), ['2222222'], 'stale shared-spanning annotations after the next user turn are hidden');
-    assert.strictEqual(turn3.annotation.status, 'uncommitted');
-    assert(allTurns.every(turn => turn.date === date));
-
-    response = await fetch(`${BASE}/api/conversations/turns?projectId=${projectId}&date=2026-08-19&cursor=${encodeURIComponent(body.nextCursor)}`);
-    assert.strictEqual(response.status, 409, 'cursor must be bound to one project/date query');
-    response = await fetch(`${BASE}/api/conversations/sessions?projectId=${projectId}`);
-    assert.strictEqual(response.status, 404, 'default product API must not expose source/session diagnostic routes');
-
-    response = await fetch(`${BASE}/api/logs/export`);
-    const exportedLogs = await response.text();
-    assert(!exportedLogs.includes('conversation-body'), 'conversation content must never leak into structured logs or export');
-    console.log('conversation-api-test PASS');
-  } finally {
-    await spawned.cleanup();
-  }
-})().catch(error => {
-  console.error(error.stack || error.message);
-  process.exitCode = 1;
-});
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnServer } = require('./helpers/spawn-server');
+const { StorageLayout } = require('../lib/storage-layout');
+const { SettingsStore } = require('../lib/settings-store');
+const { ProjectRegistryStore } = require('../lib/project-registry-store');
+const { ProjectStore } = require('../lib/project-store');
+const { ConversationStore } = require('../lib/conversation-store');
+const { localDate } = require('../lib/conversation-query-service');
+
+const ROOT = path.resolve(__dirname, '..', '..');
+const PORT = 8250 + (process.pid % 300);
+const BASE = `http://127.0.0.1:${PORT}`;
+
+async function waitForServer() {
+  for (let attempt = 0; attempt < 100; attempt += 1) {
+    try { if ((await fetch(`${BASE}/api/health`)).ok) return; } catch {}
+    await new Promise(resolve => setTimeout(resolve, 100));
+  }
+  throw new Error('server did not start');
+}
+
+(async () => {
+  const dataDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-conversation-api-'));
+  const layout = new StorageLayout({ dataDir });
+  const settings = new SettingsStore({ layout });
+  const registry = new ProjectRegistryStore({ layout });
+  const projects = new ProjectStore({ layout });
+  await settings.initialize({ knowledge: { rootPath: path.join(dataDir, 'knowledge') } });
+  await registry.initialize();
+  const projectId = 'project-conversation-api';
+  const repoPath = path.join(dataDir, 'repo');
+  const knowledgePath = path.join(dataDir, 'knowledge', projectId);
+  fs.mkdirSync(repoPath, { recursive: true });
+  fs.mkdirSync(knowledgePath, { recursive: true });
+  await projects.create(projectId, {
+    displayName: 'Conversation API', storageName: 'conversation-api', repoPath, knowledgePath,
+  }, { conversationBaselineCursor: 0, conversation: { lastConsumedCursor: 0, captureStatus: 'captured' } });
+  await registry.add(projectId, { displayNameSnapshot: 'Conversation API' });
+  const store = new ConversationStore({ layout, projectStore: projects });
+  const repoIdentity = { repoId: 'conversation-api-repo' };
+  const unsafePrompt = '<script>alert("conversation-body")</script> Keep this as plain text.';
+  async function append(eventId, sequence, turnId, role, content, capturedAt) {
+    return (await store.appendEvent(projectId, {
+      eventId, sequence, source: 'codex', eventType: role === 'user' ? 'user_prompt' : 'assistant_response', role, content,
+      sessionId: 'session-api', turnId, repoIdentity, projectPath: repoPath, branch: 'main', headAtCapture: '0'.repeat(40),
+      capturedAt, identityConfidence: 'high', captureStatus: 'captured',
+    })).event;
+  }
+  const r1 = await append('r1', 1, 'turn-1', 'user', unsafePrompt, '2026-08-18T01:00:00.000Z');
+  const a1 = await append('a1', 2, 'turn-1', 'assistant', 'Rendered only as plain assistant text.', '2026-08-18T01:01:00.000Z');
+  const r2 = await append('r2', 3, 'turn-2', 'user', 'Second prompt.', '2026-08-18T02:00:00.000Z');
+  const a2 = await append('a2', 4, 'turn-2', 'assistant', 'Second reply.', '2026-08-18T02:01:00.000Z');
+  await append('r3', 5, 'turn-3', 'user', 'Third prompt.', '2026-08-18T03:00:00.000Z');
+  await append('r4', 6, 'turn-other-date', 'user', 'Other date prompt.', '2026-08-19T03:00:00.000Z');
+  const projectEvent = event => ({ eventId: event.eventId, sequence: event.sequence, content: event.content, contentHash: event.contentHash, capturedAt: event.capturedAt });
+  store.writeSnapshot(projectId, {
+    commitSha: '1'.repeat(40), repoIdentity, parentSha: null, boundaryStartCursor: 0, boundaryEndCursor: 2, status: 'available',
+    turns: [{ turnId: 'turn-1', source: 'codex', sessionId: 'session-api', bindingKind: 'direct', userEvents: [projectEvent(r1)], assistantEvents: [projectEvent(a1)] }],
+  });
+  store.writeSnapshot(projectId, {
+    commitSha: '3'.repeat(40), repoIdentity, parentSha: '2'.repeat(40), boundaryStartCursor: 5, boundaryEndCursor: 5, status: 'available',
+    turns: [{ turnId: 'turn-2', source: 'codex', sessionId: 'session-api', bindingKind: 'shared-spanning', userEvents: [projectEvent(r2)], assistantEvents: [projectEvent(a2)] }],
+  });
+  store.writeSnapshot(projectId, {
+    commitSha: '2'.repeat(40), repoIdentity, parentSha: '1'.repeat(40), boundaryStartCursor: 2, boundaryEndCursor: 4, status: 'available',
+    turns: [{ turnId: 'turn-2', source: 'codex', sessionId: 'session-api', bindingKind: 'shared-spanning', userEvents: [projectEvent(r2)], assistantEvents: [projectEvent(a2)] }],
+  });
+
+  const spawned = spawnServer({ root: ROOT, port: PORT, dataDir, tag: 'conversation-api', extraEnv: { KB_SKIP_MIGRATION: '1' } });
+  try {
+    await waitForServer();
+    let response = await fetch(`${BASE}/api/conversations/projects`);
+    let body = await response.json();
+    assert.strictEqual(response.status, 200);
+    assert.deepStrictEqual(body.projects.map(project => project.projectId), [projectId]);
+    assert.strictEqual(Object.hasOwn(body.projects[0], 'repoPath'), false, 'project picker payload must not expose raw repository paths');
+
+    const date = localDate(r1.capturedAt);
+    response = await fetch(`${BASE}/api/conversations/turns?projectId=${projectId}&date=${date}&limit=2`);
+    body = await response.json();
+    assert.strictEqual(response.status, 200, JSON.stringify(body));
+    assert.strictEqual(body.turns.length, 2);
+    assert(body.nextCursor && body.hasMore);
+    const firstPage = body.turns;
+    response = await fetch(`${BASE}/api/conversations/turns?projectId=${projectId}&date=${date}&limit=2&cursor=${encodeURIComponent(body.nextCursor)}`);
+    const secondPage = await response.json();
+    assert.strictEqual(secondPage.turns.length, 1);
+    const allTurns = [...firstPage, ...secondPage.turns];
+    const turn1 = allTurns.find(turn => turn.turnId === 'turn-1');
+    const turn2 = allTurns.find(turn => turn.turnId === 'turn-2');
+    const turn3 = allTurns.find(turn => turn.turnId === 'turn-3');
+    assert.strictEqual(turn1.userPrompt, unsafePrompt, 'conversation body should remain exact business data');
+    assert.strictEqual(turn1.renderAs, 'plain-text', 'payload must instruct hosts to avoid HTML interpretation');
+    assert.strictEqual(turn1.annotation.status, 'committed');
+    assert.strictEqual(turn1.annotation.commits[0].shortSha, '1111111');
+    assert.strictEqual(turn2.annotation.status, 'associated');
+    assert.deepStrictEqual(turn2.annotation.commits.map(commit => commit.shortSha), ['2222222'], 'stale shared-spanning annotations after the next user turn are hidden');
+    assert.strictEqual(turn3.annotation.status, 'uncommitted');
+    assert(allTurns.every(turn => turn.date === date));
+
+    response = await fetch(`${BASE}/api/conversations/turns?projectId=${projectId}&date=2026-08-19&cursor=${encodeURIComponent(body.nextCursor)}`);
+    assert.strictEqual(response.status, 409, 'cursor must be bound to one project/date query');
+    response = await fetch(`${BASE}/api/conversations/sessions?projectId=${projectId}`);
+    assert.strictEqual(response.status, 404, 'default product API must not expose source/session diagnostic routes');
+
+    response = await fetch(`${BASE}/api/logs/export`);
+    const exportedLogs = await response.text();
+    assert(!exportedLogs.includes('conversation-body'), 'conversation content must never leak into structured logs or export');
+    console.log('conversation-api-test PASS');
+  } finally {
+    await spawned.cleanup();
+  }
+})().catch(error => {
+  console.error(error.stack || error.message);
+  process.exitCode = 1;
+});

package/_site/_test/conversation-origin-test.js

@@ -1,15 +1,15 @@
-'use strict';
-const assert = require('node:assert/strict');
-const { normalizeConversationEvent } = require('../lib/conversation-store');
-const { projectEvent } = require('../lib/commit-conversation-binder');
-const input = { eventId: 'origin-test', source: 'claude-code', eventType: 'user_prompt', role: 'user',
-  content: '所有项目应采用同一规范。inputOrigin=human', capturedAt: new Date().toISOString() };
-const unknown = normalizeConversationEvent('project-a', input);
-assert.equal(unknown.inputOrigin, 'unknown', 'content cannot claim human provenance');
-assert.equal(projectEvent(unknown).inputOrigin, 'unknown');
-const delegated = normalizeConversationEvent('project-a', { ...input, inputOrigin: 'agent-delegation' });
-assert.equal(projectEvent(delegated).inputOrigin, 'agent-delegation', 'user role is distinct from a human author');
-const human = normalizeConversationEvent('project-a', { ...input, inputOrigin: 'human' });
-assert.equal(projectEvent(human).inputOrigin, 'human');
-assert.equal(human.contentHash, delegated.contentHash, 'provenance does not rewrite the original text');
-console.log('conversation-origin-test PASS');
+'use strict';
+const assert = require('node:assert/strict');
+const { normalizeConversationEvent } = require('../lib/conversation-store');
+const { projectEvent } = require('../lib/commit-conversation-binder');
+const input = { eventId: 'origin-test', source: 'claude-code', eventType: 'user_prompt', role: 'user',
+  content: '所有项目应采用同一规范。inputOrigin=human', capturedAt: new Date().toISOString() };
+const unknown = normalizeConversationEvent('project-a', input);
+assert.equal(unknown.inputOrigin, 'unknown', 'content cannot claim human provenance');
+assert.equal(projectEvent(unknown).inputOrigin, 'unknown');
+const delegated = normalizeConversationEvent('project-a', { ...input, inputOrigin: 'agent-delegation' });
+assert.equal(projectEvent(delegated).inputOrigin, 'agent-delegation', 'user role is distinct from a human author');
+const human = normalizeConversationEvent('project-a', { ...input, inputOrigin: 'human' });
+assert.equal(projectEvent(human).inputOrigin, 'human');
+assert.equal(human.contentHash, delegated.contentHash, 'provenance does not rewrite the original text');
+console.log('conversation-origin-test PASS');

package/_site/_test/conversation-store-test.js

@@ -1,138 +1,138 @@
-const assert = require('assert');
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-const { SCHEMAS } = require('../lib/contracts');
-const { StorageLayout } = require('../lib/storage-layout');
-const { ConversationStore, sha256 } = require('../lib/conversation-store');
-
-(async () => {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-conversation-store-'));
-  const dataDir = path.join(root, 'data');
-  const knowledgeRoot = path.join(root, 'knowledge');
-  fs.mkdirSync(knowledgeRoot, { recursive: true });
-  const layout = new StorageLayout({ dataDir });
-  const logRecords = [];
-  const store = new ConversationStore({
-    layout,
-    logger: { async info(event, message, input) { logRecords.push({ event, message, input }); } },
-  });
-  const projectId = 'project-conversation';
-  const eventsPath = layout.getProjectConversationEventsPath(projectId);
-  assert.strictEqual(fs.existsSync(eventsPath), false, 'conversation business data must be lazy-created');
-
-  const privatePrompt = 'Implement secret conversation behavior without logging this body.';
-  const user = {
-    eventId: 'event-user-1',
-    sequence: 10,
-    source: 'codex',
-    eventType: 'user_prompt',
-    role: 'user',
-    content: privatePrompt,
-    sessionId: 'session-1',
-    turnId: 'turn-1',
-    projectPath: path.join(root, 'repo'),
-    repoIdentity: { commonDir: path.join(root, 'repo', '.git') },
-    branch: 'main',
-    headAtCapture: 'a'.repeat(40),
-    capturedAt: '2026-08-18T01:00:00.000Z',
-    rawEventType: 'user-prompt-submit',
-    identityConfidence: 'high',
-    captureStatus: 'captured',
-  };
-  const concurrent = await Promise.all(Array.from({ length: 8 }, () => store.appendEvent(projectId, user)));
-  assert.strictEqual(concurrent.filter(result => result.appended).length, 1, 'eventId dedupe must be atomic under overlap');
-  assert.strictEqual(store.readEvents(projectId).length, 1);
-  assert.strictEqual(store.readEvents(projectId)[0].content, privatePrompt, 'full prompt belongs in the private business store');
-  assert.strictEqual(store.readEvents(projectId)[0].contentHash, sha256(privatePrompt));
-  await store.appendBridgeEvent(projectId, { ...store.readEvents(projectId)[0], eventId: 'event-zcode-1', sequence: 12, source: 'zcode' });
-  assert.strictEqual(store.readEvents(projectId).find(event => event.eventId === 'event-zcode-1').source, 'zcode');
-  assert(!JSON.stringify(logRecords).includes(privatePrompt), 'conversation body must never enter structured logs');
-  assert(JSON.stringify(logRecords).includes(sha256(privatePrompt)), 'logs may retain body hash for correlation');
-
-  await assert.rejects(
-    () => store.appendEvent(projectId, { ...user, content: 'different body' }),
-    error => error.code === 'DATA_CORRUPT',
-    'same eventId with different content must never be silently deduplicated',
-  );
-  await store.appendEvent(projectId, {
-    ...user,
-    eventId: 'event-assistant-1',
-    sequence: 11,
-    eventType: 'assistant_response',
-    role: 'assistant',
-    content: 'Implemented and verified.',
-    capturedAt: '2026-08-18T01:01:00.000Z',
-  });
-
-  const legacy = {
-    schema: SCHEMAS.requirement,
-    id: 'req-legacy-1',
-    projectId,
-    ts: '2026-08-18T00:30:00.000Z',
-    client: 'claude',
-    sessionId: 'legacy-session',
-    branch: 'main',
-    headAtRecord: 'b'.repeat(40),
-    requirement: 'Legacy explicit requirement.',
-    requirementHash: sha256('Legacy explicit requirement.'),
-    commitSha: 'c'.repeat(40),
-  };
-  const imported = await store.importLegacyRequirements(projectId, [legacy, legacy]);
-  assert.strictEqual(imported.filter(result => result.appended).length, 1, 'legacy adapter must share eventId dedupe with Bridge events');
-  const legacyEvent = store.readEvents(projectId).find(event => event.legacyRequirementId === legacy.id);
-  assert.strictEqual(legacyEvent.source, 'claude-code');
-  assert.strictEqual(legacyEvent.captureStatus, 'legacy-explicit-adapter');
-  assert.strictEqual(legacyEvent.sequence, null, 'legacy evidence must not invent a Bridge cursor');
-
-  const commitSha = 'd'.repeat(40);
-  const boundary = store.writeBoundary(projectId, {
-    commitSha,
-    repoIdentity: user.repoIdentity,
-    parentShas: ['c'.repeat(40)],
-    branch: 'main',
-    committedAt: '2026-08-18T01:00:30.000Z',
-    bridgeCursorAtCommit: 10,
-    openTurnIdsAtCommit: ['turn-1'],
-    operationId: 'op-boundary-1',
-  });
-  assert.strictEqual(boundary.schema, SCHEMAS.gitCommitBoundary);
-  assert(fs.existsSync(layout.getProjectCommitBoundaryPath(projectId, commitSha)));
-
-  const snapshot = store.writeSnapshot(projectId, {
-    commitSha,
-    repoIdentity: user.repoIdentity,
-    parentSha: 'c'.repeat(40),
-    boundaryStartCursor: 0,
-    boundaryEndCursor: 10,
-    status: 'available',
-    turns: [{
-      turnId: 'turn-1',
-      source: 'codex',
-      sessionId: 'session-1',
-      bindingKind: 'direct',
-      userEvents: [{ eventId: 'event-user-1', sequence: 10, content: privatePrompt, contentHash: sha256(privatePrompt), capturedAt: user.capturedAt }],
-      assistantEvents: [],
-    }],
-    excludedFuturePromptCount: 0,
-    finalizedAt: '2026-08-18T01:02:00.000Z',
-  });
-  assert(snapshot.snapshotHash.startsWith('sha256:'));
-  assert.strictEqual(store.readSnapshot(projectId, commitSha).turns[0].userEvents[0].content, privatePrompt);
-  await assert.rejects(
-    async () => store.writeSnapshot(projectId, { ...snapshot, status: 'ambiguous', finalizedAt: snapshot.finalizedAt }),
-    error => error.code === 'IMMUTABLE_FIELD',
-  );
-  assert(!layout.getProjectCommitConversationPath(projectId, commitSha).startsWith(knowledgeRoot), 'conversation evidence must remain outside the user Markdown root');
-
-  const failingProject = 'project-append-failure';
-  const blocker = layout.getProjectConversationEventsPath(failingProject);
-  fs.mkdirSync(blocker, { recursive: true });
-  await assert.rejects(() => store.appendEvent(failingProject, { ...user, eventId: 'event-fail-1' }));
-  assert.deepStrictEqual(fs.readdirSync(blocker), [], 'failed append must not create partial event data');
-
-  console.log('conversation-store-test PASS');
-})().catch(error => {
-  console.error(error.stack || error.message);
-  process.exitCode = 1;
-});
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { SCHEMAS } = require('../lib/contracts');
+const { StorageLayout } = require('../lib/storage-layout');
+const { ConversationStore, sha256 } = require('../lib/conversation-store');
+
+(async () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-conversation-store-'));
+  const dataDir = path.join(root, 'data');
+  const knowledgeRoot = path.join(root, 'knowledge');
+  fs.mkdirSync(knowledgeRoot, { recursive: true });
+  const layout = new StorageLayout({ dataDir });
+  const logRecords = [];
+  const store = new ConversationStore({
+    layout,
+    logger: { async info(event, message, input) { logRecords.push({ event, message, input }); } },
+  });
+  const projectId = 'project-conversation';
+  const eventsPath = layout.getProjectConversationEventsPath(projectId);
+  assert.strictEqual(fs.existsSync(eventsPath), false, 'conversation business data must be lazy-created');
+
+  const privatePrompt = 'Implement secret conversation behavior without logging this body.';
+  const user = {
+    eventId: 'event-user-1',
+    sequence: 10,
+    source: 'codex',
+    eventType: 'user_prompt',
+    role: 'user',
+    content: privatePrompt,
+    sessionId: 'session-1',
+    turnId: 'turn-1',
+    projectPath: path.join(root, 'repo'),
+    repoIdentity: { commonDir: path.join(root, 'repo', '.git') },
+    branch: 'main',
+    headAtCapture: 'a'.repeat(40),
+    capturedAt: '2026-08-18T01:00:00.000Z',
+    rawEventType: 'user-prompt-submit',
+    identityConfidence: 'high',
+    captureStatus: 'captured',
+  };
+  const concurrent = await Promise.all(Array.from({ length: 8 }, () => store.appendEvent(projectId, user)));
+  assert.strictEqual(concurrent.filter(result => result.appended).length, 1, 'eventId dedupe must be atomic under overlap');
+  assert.strictEqual(store.readEvents(projectId).length, 1);
+  assert.strictEqual(store.readEvents(projectId)[0].content, privatePrompt, 'full prompt belongs in the private business store');
+  assert.strictEqual(store.readEvents(projectId)[0].contentHash, sha256(privatePrompt));
+  await store.appendBridgeEvent(projectId, { ...store.readEvents(projectId)[0], eventId: 'event-zcode-1', sequence: 12, source: 'zcode' });
+  assert.strictEqual(store.readEvents(projectId).find(event => event.eventId === 'event-zcode-1').source, 'zcode');
+  assert(!JSON.stringify(logRecords).includes(privatePrompt), 'conversation body must never enter structured logs');
+  assert(JSON.stringify(logRecords).includes(sha256(privatePrompt)), 'logs may retain body hash for correlation');
+
+  await assert.rejects(
+    () => store.appendEvent(projectId, { ...user, content: 'different body' }),
+    error => error.code === 'DATA_CORRUPT',
+    'same eventId with different content must never be silently deduplicated',
+  );
+  await store.appendEvent(projectId, {
+    ...user,
+    eventId: 'event-assistant-1',
+    sequence: 11,
+    eventType: 'assistant_response',
+    role: 'assistant',
+    content: 'Implemented and verified.',
+    capturedAt: '2026-08-18T01:01:00.000Z',
+  });
+
+  const legacy = {
+    schema: SCHEMAS.requirement,
+    id: 'req-legacy-1',
+    projectId,
+    ts: '2026-08-18T00:30:00.000Z',
+    client: 'claude',
+    sessionId: 'legacy-session',
+    branch: 'main',
+    headAtRecord: 'b'.repeat(40),
+    requirement: 'Legacy explicit requirement.',
+    requirementHash: sha256('Legacy explicit requirement.'),
+    commitSha: 'c'.repeat(40),
+  };
+  const imported = await store.importLegacyRequirements(projectId, [legacy, legacy]);
+  assert.strictEqual(imported.filter(result => result.appended).length, 1, 'legacy adapter must share eventId dedupe with Bridge events');
+  const legacyEvent = store.readEvents(projectId).find(event => event.legacyRequirementId === legacy.id);
+  assert.strictEqual(legacyEvent.source, 'claude-code');
+  assert.strictEqual(legacyEvent.captureStatus, 'legacy-explicit-adapter');
+  assert.strictEqual(legacyEvent.sequence, null, 'legacy evidence must not invent a Bridge cursor');
+
+  const commitSha = 'd'.repeat(40);
+  const boundary = store.writeBoundary(projectId, {
+    commitSha,
+    repoIdentity: user.repoIdentity,
+    parentShas: ['c'.repeat(40)],
+    branch: 'main',
+    committedAt: '2026-08-18T01:00:30.000Z',
+    bridgeCursorAtCommit: 10,
+    openTurnIdsAtCommit: ['turn-1'],
+    operationId: 'op-boundary-1',
+  });
+  assert.strictEqual(boundary.schema, SCHEMAS.gitCommitBoundary);
+  assert(fs.existsSync(layout.getProjectCommitBoundaryPath(projectId, commitSha)));
+
+  const snapshot = store.writeSnapshot(projectId, {
+    commitSha,
+    repoIdentity: user.repoIdentity,
+    parentSha: 'c'.repeat(40),
+    boundaryStartCursor: 0,
+    boundaryEndCursor: 10,
+    status: 'available',
+    turns: [{
+      turnId: 'turn-1',
+      source: 'codex',
+      sessionId: 'session-1',
+      bindingKind: 'direct',
+      userEvents: [{ eventId: 'event-user-1', sequence: 10, content: privatePrompt, contentHash: sha256(privatePrompt), capturedAt: user.capturedAt }],
+      assistantEvents: [],
+    }],
+    excludedFuturePromptCount: 0,
+    finalizedAt: '2026-08-18T01:02:00.000Z',
+  });
+  assert(snapshot.snapshotHash.startsWith('sha256:'));
+  assert.strictEqual(store.readSnapshot(projectId, commitSha).turns[0].userEvents[0].content, privatePrompt);
+  await assert.rejects(
+    async () => store.writeSnapshot(projectId, { ...snapshot, status: 'ambiguous', finalizedAt: snapshot.finalizedAt }),
+    error => error.code === 'IMMUTABLE_FIELD',
+  );
+  assert(!layout.getProjectCommitConversationPath(projectId, commitSha).startsWith(knowledgeRoot), 'conversation evidence must remain outside the user Markdown root');
+
+  const failingProject = 'project-append-failure';
+  const blocker = layout.getProjectConversationEventsPath(failingProject);
+  fs.mkdirSync(blocker, { recursive: true });
+  await assert.rejects(() => store.appendEvent(failingProject, { ...user, eventId: 'event-fail-1' }));
+  assert.deepStrictEqual(fs.readdirSync(blocker), [], 'failed append must not create partial event data');
+
+  console.log('conversation-store-test PASS');
+})().catch(error => {
+  console.error(error.stack || error.message);
+  process.exitCode = 1;
+});