@skyramp/mcp 0.3.1 → 0.3.2-rc.pom-2

package/build/recommendation/discriminators.js

@@ -0,0 +1,355 @@
+import { DiscriminatorKind } from "../types/Recommendation.js";
+const MUTATING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+const MIN_ANCHOR_LENGTH = 8;
+const MIN_NEAR_MISS_LENGTH = 3;
+/**
+ * Verify a declared discriminator against the candidate's `steps[]` and the PR
+ * diff. Mirrors the classification precedent (`recommendationShared.ts`): the
+ * claim is checked STRUCTURALLY, never by fuzzy keyword scans of prose. A failed
+ * check returns `verified: false` with a one-sentence reason (the claim is
+ * demoted, never used to reject the candidate). NEVER throws — malformed or
+ * partial input is treated as unverified.
+ *
+ * Two gates, both required to verify:
+ *  1. `changedCodeAnchor` must be a non-trivial string (>= 8 chars after trim)
+ *     occurring verbatim in `diffText` — grounds the claim in the real change.
+ *  2. The `kind`-specific structural predicate must hold over `steps[]`.
+ */
+export function validateDiscriminator(scenario, declared, diffText) {
+    try {
+        const anchorResult = verifyAnchor(declared?.changedCodeAnchor, diffText);
+        if (!anchorResult.verified)
+            return anchorResult;
+        const steps = Array.isArray(scenario?.steps) ? scenario.steps : [];
+        switch (declared?.kind) {
+            case DiscriminatorKind.BOUNDARY_EQUALITY:
+                return verifyBoundaryEquality(steps);
+            case DiscriminatorKind.MULTI_RECORD_AGGREGATE:
+                return verifyMultiRecordAggregate(steps);
+            case DiscriminatorKind.NEGATIVE_MATCH:
+                return verifyNegativeMatch(steps);
+            case DiscriminatorKind.STATE_TRANSITION:
+                return verifyStateTransition(steps);
+            default:
+                return {
+                    verified: false,
+                    reason: `Unknown discriminator kind "${String(declared?.kind)}"; expected one of boundary_equality, multi_record_aggregate, negative_match, state_transition.`,
+                };
+        }
+    }
+    catch {
+        // Defensive: any malformed input is treated as unverified, never a throw.
+        return { verified: false, reason: "Discriminator claim could not be verified against the scenario steps." };
+    }
+}
+// ── Anchor grounding ──
+function verifyAnchor(rawAnchor, diffText) {
+    const anchor = typeof rawAnchor === "string" ? rawAnchor.trim() : "";
+    if (anchor.length < MIN_ANCHOR_LENGTH) {
+        return {
+            verified: false,
+            reason: `changedCodeAnchor "${String(rawAnchor ?? "")}" is too short (needs >= ${MIN_ANCHOR_LENGTH} non-whitespace chars) to ground the claim in the diff.`,
+        };
+    }
+    const diff = typeof diffText === "string" ? diffText : "";
+    // A statement wrapped across diff lines carries +/- prefixes and indentation
+    // between its fragments, so a multi-line anchor can never match the raw diff
+    // text — compare whitespace-collapsed forms with diff markers stripped, or
+    // legitimate multi-line anchors are systematically false-demoted.
+    if (!diff.includes(anchor) && !normalizeForAnchorMatch(diff).includes(normalizeForAnchorMatch(anchor))) {
+        return {
+            verified: false,
+            reason: `changedCodeAnchor "${anchor}" does not occur verbatim in the PR diff, so the discriminator claim is not grounded in the actual change.`,
+        };
+    }
+    return { verified: true };
+}
+/** Strip per-line diff +/- markers and collapse all whitespace runs to single
+ *  spaces so anchors spanning wrapped/indented lines still match. */
+function normalizeForAnchorMatch(text) {
+    return text
+        .split("\n")
+        .map((line) => line.replace(/^[+\- ]/, ""))
+        .join(" ")
+        .replace(/\s+/g, " ")
+        .trim();
+}
+// ── Structural predicates ──
+/**
+ * boundary_equality: some step carries two DISTINCT fields holding EQUAL values
+ * in requestBody/queryParams (probing an on-boundary case, e.g.
+ * install_date == termination_date) AND that step is either an accept-side probe
+ * (2xx) or a mirrored reject-side probe (4xx with interactionType "error").
+ */
+function verifyBoundaryEquality(steps) {
+    for (const step of steps) {
+        const leaves = [];
+        collectLeaves(step?.requestBody, leaves);
+        collectLeaves(step?.queryParams, leaves);
+        if (hasDistinctFieldEqualValue(leaves) && satisfiesBoundaryStatus(step)) {
+            return { verified: true };
+        }
+    }
+    return {
+        verified: false,
+        reason: "boundary_equality unverified: no step sets two distinct fields to an equal value on an accept-side (2xx) or mirrored reject-side (4xx error) request — the on-boundary case is not exercised.",
+    };
+}
+/**
+ * multi_record_aggregate: >= 2 POST steps on the same (param-normalized) resource
+ * path occurring before an asserting step, OR any step asserting a numeric value
+ * >= 2 in expectedResponseFields/bodyMustInclude (e.g. account_count == 2).
+ */
+function verifyMultiRecordAggregate(steps) {
+    const ordered = orderedSteps(steps);
+    // (b) any step asserting a numeric value >= 2.
+    for (const step of ordered) {
+        const assertions = [...toStringArray(step?.expectedResponseFields), ...toStringArray(step?.bodyMustInclude)];
+        if (assertions.some((s) => maxNumberIn(s) >= 2))
+            return { verified: true };
+    }
+    // (a) >= 2 same-path POSTs before an asserting step.
+    for (let i = 0; i < ordered.length; i++) {
+        if (!isAssertStep(ordered[i]))
+            continue;
+        const counts = new Map();
+        for (let j = 0; j < i; j++) {
+            const prior = ordered[j];
+            if ((prior?.method ?? "").toUpperCase() !== "POST")
+                continue;
+            const key = normalizePath(prior?.path ?? "");
+            const next = (counts.get(key) ?? 0) + 1;
+            counts.set(key, next);
+            if (next >= 2)
+                return { verified: true };
+        }
+    }
+    return {
+        verified: false,
+        reason: "multi_record_aggregate unverified: found neither >= 2 same-resource POST steps before an assertion nor an assertion of a numeric count >= 2 — the aggregation over multiple records is not exercised.",
+    };
+}
+/**
+ * negative_match: a step asserting empty/zero/404 whose query/body carries a
+ * value that is a strict substring or superstring of a value seeded in an
+ * earlier step (a near-miss that must NOT match).
+ */
+function verifyNegativeMatch(steps) {
+    const ordered = orderedSteps(steps);
+    for (let i = 0; i < ordered.length; i++) {
+        const step = ordered[i];
+        if (!isNegativeAssertStep(step))
+            continue;
+        const nearMissValues = [];
+        collectStringValues(step?.requestBody, nearMissValues);
+        collectStringValues(step?.queryParams, nearMissValues);
+        const seeded = [];
+        for (let j = 0; j < i; j++) {
+            collectStringValues(ordered[j]?.requestBody, seeded);
+            collectStringValues(ordered[j]?.queryParams, seeded);
+        }
+        if (nearMissValues.some((q) => seeded.some((s) => isStrictNearMiss(q, s)))) {
+            return { verified: true };
+        }
+    }
+    return {
+        verified: false,
+        reason: "negative_match unverified: no empty/zero/404 assertion queries a strict near-miss (substring or superstring) of a value seeded in an earlier step — the false-positive boundary is not probed.",
+    };
+}
+/**
+ * state_transition: >= 2 mutating steps (POST/PUT/PATCH/DELETE) on the same
+ * resource — same param-normalized path, or linked via chainsFrom — with a
+ * DIFFERENT expectedStatusCode or interactionType.
+ */
+function verifyStateTransition(steps) {
+    const mutating = steps.filter((s) => MUTATING_METHODS.has((s?.method ?? "").toUpperCase()));
+    // Same normalized path.
+    const groups = new Map();
+    for (const step of mutating) {
+        const key = normalizePath(step?.path ?? "");
+        if (!groups.has(key))
+            groups.set(key, []);
+        groups.get(key).push(step);
+    }
+    for (const group of groups.values()) {
+        if (group.length >= 2 && groupHasDivergentOutcome(group))
+            return { verified: true };
+    }
+    // Linked via chainsFrom (a mutating step chaining off another mutating step).
+    const byOrder = new Map();
+    for (const step of steps) {
+        if (typeof step?.order === "number")
+            byOrder.set(step.order, step);
+    }
+    for (const step of mutating) {
+        for (const sourceStep of toChainSourceSteps(step?.chainsFrom)) {
+            const src = byOrder.get(sourceStep);
+            if (src &&
+                MUTATING_METHODS.has((src.method ?? "").toUpperCase()) &&
+                (src.expectedStatusCode !== step.expectedStatusCode || src.interactionType !== step.interactionType)) {
+                return { verified: true };
+            }
+        }
+    }
+    return {
+        verified: false,
+        reason: "state_transition unverified: no two mutating steps on the same resource diverge in expectedStatusCode or interactionType — the state machine's differing outcomes are not exercised.",
+    };
+}
+/** Recursively collect leaf (field, value) pairs for string/number values. */
+function collectLeaves(value, out) {
+    if (value === null || value === undefined || typeof value !== "object")
+        return;
+    if (Array.isArray(value)) {
+        for (const item of value)
+            collectLeaves(item, out);
+        return;
+    }
+    for (const [key, v] of Object.entries(value)) {
+        if (v === null || v === undefined)
+            continue;
+        if (typeof v === "object") {
+            collectLeaves(v, out);
+        }
+        else if (typeof v === "string" || typeof v === "number") {
+            out.push({ field: key, value: v });
+        }
+    }
+}
+/** Recursively collect leaf string values (used for near-miss substring scans). */
+function collectStringValues(value, out) {
+    if (value === null || value === undefined)
+        return;
+    if (typeof value === "string") {
+        if (value.length > 0)
+            out.push(value);
+        return;
+    }
+    if (typeof value !== "object")
+        return;
+    if (Array.isArray(value)) {
+        for (const item of value)
+            collectStringValues(item, out);
+        return;
+    }
+    for (const v of Object.values(value))
+        collectStringValues(v, out);
+}
+/** True if two leaves have different field names but an equal (non-trivial) value. */
+function hasDistinctFieldEqualValue(leaves) {
+    for (let a = 0; a < leaves.length; a++) {
+        for (let b = a + 1; b < leaves.length; b++) {
+            const la = leaves[a];
+            const lb = leaves[b];
+            if (la.field === lb.field)
+                continue;
+            if (la.value !== lb.value)
+                continue;
+            if (typeof la.value === "string" && la.value.length === 0)
+                continue;
+            return true;
+        }
+    }
+    return false;
+}
+function satisfiesBoundaryStatus(step) {
+    const status = typeof step?.expectedStatusCode === "number" ? step.expectedStatusCode : 0;
+    const accept = status >= 200 && status < 300;
+    const reject = status >= 400 && status < 500 && step?.interactionType === "error";
+    return accept || reject;
+}
+function isAssertStep(step) {
+    return (toStringArray(step?.expectedResponseFields).length > 0 ||
+        toStringArray(step?.bodyMustInclude).length > 0 ||
+        (step?.responseBody !== null && typeof step?.responseBody === "object" && Object.keys(step.responseBody).length > 0));
+}
+function isNegativeAssertStep(step) {
+    if (step?.expectedStatusCode === 404)
+        return true;
+    const assertions = [...toStringArray(step?.expectedResponseFields), ...toStringArray(step?.bodyMustInclude)];
+    return assertsEmptyOrZero(assertions);
+}
+function assertsEmptyOrZero(strings) {
+    return strings.some((raw) => {
+        const s = raw.toLowerCase();
+        if (/\bcount\b/.test(s) && /\b0\b/.test(s))
+            return true;
+        if (/(^|\D)0\s+results?\b/.test(s))
+            return true;
+        if (s.includes("empty"))
+            return true;
+        if (s.includes("no results") || s.includes("no result"))
+            return true;
+        if (s.includes("[]"))
+            return true;
+        return false;
+    });
+}
+/** Strict near-miss: one string strictly contains the other (different length). */
+function isStrictNearMiss(a, b) {
+    if (a === b)
+        return false;
+    if (Math.min(a.length, b.length) < MIN_NEAR_MISS_LENGTH)
+        return false;
+    return a.includes(b) || b.includes(a);
+}
+function groupHasDivergentOutcome(group) {
+    const statuses = new Set(group.map((s) => s?.expectedStatusCode));
+    const interactions = new Set(group.map((s) => s?.interactionType));
+    return statuses.size > 1 || interactions.size > 1;
+}
+/** Largest number appearing in a string, or -Infinity when none. */
+function maxNumberIn(text) {
+    const matches = text.match(/-?\d+(?:\.\d+)?/g);
+    if (!matches)
+        return Number.NEGATIVE_INFINITY;
+    return Math.max(...matches.map(Number));
+}
+/**
+ * Normalize a path so param segments collapse: numeric ids, `{brace}` params,
+ * `:colon` params and long hex/uuid segments all become `:p`.
+ */
+function normalizePath(path) {
+    const pathPart = (path ?? "").split("?")[0];
+    return pathPart
+        .split("/")
+        .map((seg) => {
+        if (seg === "")
+            return seg;
+        if (/^\{.*\}$/.test(seg))
+            return ":p";
+        if (/^:.+/.test(seg))
+            return ":p";
+        if (/^\d+$/.test(seg))
+            return ":p";
+        if (/^[0-9a-fA-F-]{16,}$/.test(seg))
+            return ":p";
+        return seg.toLowerCase();
+    })
+        .join("/");
+}
+/** Steps sorted by their `order` field, falling back to array position. */
+function orderedSteps(steps) {
+    return steps
+        .map((step, index) => ({ step, index }))
+        .sort((a, b) => {
+        const ao = typeof a.step?.order === "number" ? a.step.order : a.index;
+        const bo = typeof b.step?.order === "number" ? b.step.order : b.index;
+        if (ao !== bo)
+            return ao - bo;
+        return a.index - b.index;
+    })
+        .map((entry) => entry.step);
+}
+function toStringArray(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.filter((v) => typeof v === "string");
+}
+function toChainSourceSteps(chainsFrom) {
+    if (!chainsFrom)
+        return [];
+    const refs = Array.isArray(chainsFrom) ? chainsFrom : [chainsFrom];
+    return refs.map((r) => r?.sourceStep).filter((s) => typeof s === "number");
+}

package/build/recommendation/discriminators.test.d.ts

@@ -0,0 +1 @@
+export {};

package/build/recommendation/discriminators.test.js

@@ -0,0 +1,324 @@
+import { validateDiscriminator } from "./discriminators.js";
+import { DiscriminatorKind } from "../types/Recommendation.js";
+// A diff containing the verbatim anchors each valid claim below points at.
+const DIFF = [
+    "@@ netbox/circuits/models.py",
+    "+    if install_date == termination_date:",
+    "+        raise ValidationError('same-day circuit')",
+    "+    provider.account_count = len(accounts)",
+    "+    results = Provider.objects.filter(physical_address=query)",
+    '+    circuit.status = "active"',
+].join("\n");
+function step(over = {}) {
+    return {
+        order: 0,
+        method: "GET",
+        path: "/r",
+        description: "",
+        interactionType: "success",
+        expectedStatusCode: 200,
+        ...over,
+    };
+}
+function scenario(steps) {
+    return {
+        scenarioName: "s",
+        description: "s",
+        category: "business_rule",
+        priority: "high",
+        steps,
+        chainingKeys: [],
+        requiresAuth: false,
+        estimatedComplexity: "moderate",
+    };
+}
+const claim = (kind, anchor) => ({
+    kind,
+    changedCodeAnchor: anchor,
+});
+describe("validateDiscriminator — boundary_equality", () => {
+    const anchor = "install_date == termination_date";
+    it("verifies a same-day accept-side boundary (two distinct fields, equal value, 2xx)", () => {
+        const s = scenario([
+            step({
+                method: "POST",
+                path: "/api/circuits",
+                interactionType: "success",
+                expectedStatusCode: 201,
+                requestBody: { install_date: "2024-01-15", termination_date: "2024-01-15" },
+            }),
+        ]);
+        expect(validateDiscriminator(s, claim(DiscriminatorKind.BOUNDARY_EQUALITY, anchor), DIFF).verified).toBe(true);
+    });
+    it("verifies the mirrored reject side (4xx + interactionType error)", () => {
+        const s = scenario([
+            step({
+                method: "POST",
+                path: "/api/circuits",
+                interactionType: "error",
+                expectedStatusCode: 422,
+                requestBody: { install_date: "2024-01-15", termination_date: "2024-01-15" },
+            }),
+        ]);
+        expect(validateDiscriminator(s, claim(DiscriminatorKind.BOUNDARY_EQUALITY, anchor), DIFF).verified).toBe(true);
+    });
+    it("demotes a gaming attempt (happy-path GET, no equal-value fields)", () => {
+        const s = scenario([step({ method: "GET", path: "/api/circuits", expectedStatusCode: 200 })]);
+        const res = validateDiscriminator(s, claim(DiscriminatorKind.BOUNDARY_EQUALITY, anchor), DIFF);
+        expect(res.verified).toBe(false);
+        expect(res.reason).toMatch(/boundary_equality/);
+    });
+    it("returns unverified (no throw) on malformed input with no steps", () => {
+        const res = validateDiscriminator({}, claim(DiscriminatorKind.BOUNDARY_EQUALITY, anchor), DIFF);
+        expect(res.verified).toBe(false);
+        expect(res.reason).toBeDefined();
+    });
+    it("demotes when the anchor is absent from the diff", () => {
+        const s = scenario([
+            step({
+                method: "POST",
+                path: "/api/circuits",
+                expectedStatusCode: 201,
+                requestBody: { install_date: "2024-01-15", termination_date: "2024-01-15" },
+            }),
+        ]);
+        const res = validateDiscriminator(s, claim(DiscriminatorKind.BOUNDARY_EQUALITY, "absent_anchor_symbol"), DIFF);
+        expect(res.verified).toBe(false);
+        expect(res.reason).toMatch(/absent_anchor_symbol/);
+        expect(res.reason).toMatch(/diff/);
+    });
+});
+describe("validateDiscriminator — multi_record_aggregate", () => {
+    const anchor = "provider.account_count = len(accounts)";
+    it("verifies an explicit numeric-count assertion (account_count == 2)", () => {
+        const s = scenario([
+            step({ order: 0, method: "POST", path: "/api/providers", expectedStatusCode: 201 }),
+            step({
+                order: 1,
+                method: "GET",
+                path: "/api/providers/summary",
+                expectedStatusCode: 200,
+                expectedResponseFields: ["account_count == 2"],
+            }),
+        ]);
+        expect(validateDiscriminator(s, claim(DiscriminatorKind.MULTI_RECORD_AGGREGATE, anchor), DIFF).verified).toBe(true);
+    });
+    it("verifies >= 2 same-path POSTs before an asserting step", () => {
+        const s = scenario([
+            step({ order: 0, method: "POST", path: "/api/providers/1/accounts", expectedStatusCode: 201 }),
+            step({ order: 1, method: "POST", path: "/api/providers/1/accounts", expectedStatusCode: 201 }),
+            step({
+                order: 2,
+                method: "GET",
+                path: "/api/providers/1/summary",
+                expectedStatusCode: 200,
+                expectedResponseFields: ["accounts"],
+            }),
+        ]);
+        expect(validateDiscriminator(s, claim(DiscriminatorKind.MULTI_RECORD_AGGREGATE, anchor), DIFF).verified).toBe(true);
+    });
+    it("demotes a gaming attempt (single create + read, count 1)", () => {
+        const s = scenario([
+            step({ order: 0, method: "POST", path: "/api/providers", expectedStatusCode: 201 }),
+            step({
+                order: 1,
+                method: "GET",
+                path: "/api/providers/1",
+                expectedStatusCode: 200,
+                expectedResponseFields: ["name"],
+            }),
+        ]);
+        const res = validateDiscriminator(s, claim(DiscriminatorKind.MULTI_RECORD_AGGREGATE, anchor), DIFF);
+        expect(res.verified).toBe(false);
+        expect(res.reason).toMatch(/multi_record_aggregate/);
+    });
+    it("returns unverified (no throw) on malformed input with null steps", () => {
+        const res = validateDiscriminator({ steps: null }, claim(DiscriminatorKind.MULTI_RECORD_AGGREGATE, anchor), DIFF);
+        expect(res.verified).toBe(false);
+    });
+    it("demotes when the anchor is absent from the diff", () => {
+        const s = scenario([
+            step({ method: "GET", path: "/x", expectedStatusCode: 200, expectedResponseFields: ["account_count == 2"] }),
+        ]);
+        expect(validateDiscriminator(s, claim(DiscriminatorKind.MULTI_RECORD_AGGREGATE, "not_in_diff_anchor"), DIFF).verified).toBe(false);
+    });
+});
+describe("validateDiscriminator — negative_match", () => {
+    const anchor = "physical_address=query";
+    it("verifies a substring near-miss asserting empty results", () => {
+        const s = scenario([
+            step({
+                order: 0,
+                method: "POST",
+                path: "/api/providers",
+                expectedStatusCode: 201,
+                requestBody: { physical_address: "123 Main Street, Building A" },
+            }),
+            step({
+                order: 1,
+                method: "GET",
+                path: "/api/providers",
+                expectedStatusCode: 200,
+                queryParams: { physical_address: "123 Main Street" },
+                expectedResponseFields: ["count == 0"],
+            }),
+        ]);
+        expect(validateDiscriminator(s, claim(DiscriminatorKind.NEGATIVE_MATCH, anchor), DIFF).verified).toBe(true);
+    });
+    it("verifies a 404 near-miss lookup", () => {
+        const s = scenario([
+            step({
+                order: 0,
+                method: "POST",
+                path: "/api/providers",
+                expectedStatusCode: 201,
+                requestBody: { slug: "acme-corp-provider" },
+            }),
+            step({
+                order: 1,
+                method: "GET",
+                path: "/api/providers/acme-corp",
+                expectedStatusCode: 404,
+                interactionType: "error",
+                queryParams: { slug: "acme-corp" },
+            }),
+        ]);
+        expect(validateDiscriminator(s, claim(DiscriminatorKind.NEGATIVE_MATCH, anchor), DIFF).verified).toBe(true);
+    });
+    it("demotes a gaming attempt (exact match, non-empty 200 result)", () => {
+        const s = scenario([
+            step({
+                order: 0,
+                method: "POST",
+                path: "/api/providers",
+                expectedStatusCode: 201,
+                requestBody: { physical_address: "123 Main Street" },
+            }),
+            step({
+                order: 1,
+                method: "GET",
+                path: "/api/providers",
+                expectedStatusCode: 200,
+                queryParams: { physical_address: "123 Main Street" },
+                expectedResponseFields: ["results"],
+            }),
+        ]);
+        const res = validateDiscriminator(s, claim(DiscriminatorKind.NEGATIVE_MATCH, anchor), DIFF);
+        expect(res.verified).toBe(false);
+        expect(res.reason).toMatch(/negative_match/);
+    });
+    it("returns unverified (no throw) on malformed input with no steps", () => {
+        const res = validateDiscriminator({}, claim(DiscriminatorKind.NEGATIVE_MATCH, anchor), DIFF);
+        expect(res.verified).toBe(false);
+    });
+    it("demotes when the anchor is absent from the diff", () => {
+        const s = scenario([
+            step({ method: "GET", path: "/x", expectedStatusCode: 404, queryParams: { q: "abc" } }),
+        ]);
+        expect(validateDiscriminator(s, claim(DiscriminatorKind.NEGATIVE_MATCH, "missing_anchor_xyz"), DIFF).verified).toBe(false);
+    });
+});
+describe("validateDiscriminator — state_transition", () => {
+    const anchor = 'circuit.status = "active"';
+    it("verifies two same-resource mutations with divergent outcomes", () => {
+        const s = scenario([
+            step({
+                order: 0,
+                method: "PATCH",
+                path: "/api/circuits/5",
+                interactionType: "success",
+                expectedStatusCode: 200,
+                requestBody: { status: "active" },
+            }),
+            step({
+                order: 1,
+                method: "DELETE",
+                path: "/api/circuits/5",
+                interactionType: "error",
+                expectedStatusCode: 409,
+            }),
+        ]);
+        expect(validateDiscriminator(s, claim(DiscriminatorKind.STATE_TRANSITION, anchor), DIFF).verified).toBe(true);
+    });
+    it("verifies divergent mutations linked via chainsFrom", () => {
+        const s = scenario([
+            step({
+                order: 0,
+                method: "POST",
+                path: "/api/circuits",
+                interactionType: "success",
+                expectedStatusCode: 201,
+            }),
+            step({
+                order: 1,
+                method: "PATCH",
+                path: "/api/circuits/{id}",
+                interactionType: "success",
+                expectedStatusCode: 200,
+                chainsFrom: { sourceStep: 0, sourceField: "id", sourceLocation: "body", targetParam: "id", targetLocation: "path" },
+            }),
+        ]);
+        expect(validateDiscriminator(s, claim(DiscriminatorKind.STATE_TRANSITION, anchor), DIFF).verified).toBe(true);
+    });
+    it("demotes a gaming attempt (two identical-outcome POSTs)", () => {
+        const s = scenario([
+            step({ order: 0, method: "POST", path: "/api/circuits", interactionType: "success", expectedStatusCode: 201 }),
+            step({ order: 1, method: "POST", path: "/api/circuits", interactionType: "success", expectedStatusCode: 201 }),
+        ]);
+        const res = validateDiscriminator(s, claim(DiscriminatorKind.STATE_TRANSITION, anchor), DIFF);
+        expect(res.verified).toBe(false);
+        expect(res.reason).toMatch(/state_transition/);
+    });
+    it("returns unverified (no throw) on malformed input with no steps", () => {
+        const res = validateDiscriminator({}, claim(DiscriminatorKind.STATE_TRANSITION, anchor), DIFF);
+        expect(res.verified).toBe(false);
+    });
+    it("demotes when the anchor is absent from the diff", () => {
+        const s = scenario([
+            step({ method: "PATCH", path: "/api/circuits/5", expectedStatusCode: 200 }),
+            step({ method: "DELETE", path: "/api/circuits/5", expectedStatusCode: 409, interactionType: "error" }),
+        ]);
+        expect(validateDiscriminator(s, claim(DiscriminatorKind.STATE_TRANSITION, "anchor_not_present"), DIFF).verified).toBe(false);
+    });
+});
+describe("validateDiscriminator — anchor gate", () => {
+    it("demotes a too-short anchor before any structural check", () => {
+        const s = scenario([step()]);
+        const res = validateDiscriminator(s, claim(DiscriminatorKind.BOUNDARY_EQUALITY, "short"), DIFF);
+        expect(res.verified).toBe(false);
+        expect(res.reason).toMatch(/too short/);
+    });
+    it("never throws on wholly malformed input", () => {
+        expect(() => validateDiscriminator(undefined, undefined, DIFF)).not.toThrow();
+        const res = validateDiscriminator(undefined, undefined, DIFF);
+        expect(res.verified).toBe(false);
+    });
+});
+describe("verifyAnchor whitespace normalization (seed-2 multi-line anchor regression)", () => {
+    const multiLineDiff = [
+        "--- a/circuits.py",
+        "+++ b/circuits.py",
+        "+        raise ValidationError({",
+        "+            'termination_date': _(",
+        "+                \"Termination date cannot precede install date.\")",
+        "+        })",
+    ].join("\n");
+    it("verifies an anchor that spans wrapped diff lines (collapsed whitespace, markers stripped)", () => {
+        const s = scenario([
+            step({ requestBody: { install_date: "2024-06-01", termination_date: "2024-06-01" }, expectedStatusCode: 201, interactionType: "success" }),
+        ]);
+        const result = validateDiscriminator(s, {
+            kind: DiscriminatorKind.BOUNDARY_EQUALITY,
+            changedCodeAnchor: "raise ValidationError({ 'termination_date': _( \"Termination date cannot precede install date.\") })",
+        }, multiLineDiff);
+        expect(result.verified).toBe(true);
+    });
+    it("still rejects an anchor that occurs nowhere in the diff", () => {
+        const s = scenario([
+            step({ requestBody: { install_date: "2024-06-01", termination_date: "2024-06-01" }, expectedStatusCode: 201, interactionType: "success" }),
+        ]);
+        const result = validateDiscriminator(s, { kind: DiscriminatorKind.BOUNDARY_EQUALITY, changedCodeAnchor: "this snippet is not in the diff at all" }, multiLineDiff);
+        expect(result.verified).toBe(false);
+        expect(result.reason).toContain("does not occur verbatim");
+    });
+});