@velum-labs/routekit-eval-setup 1.3.2 → 1.5.0

package/dist/test/repository-reference-authoring.test.js

@@ -0,0 +1,1633 @@
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { test } from "node:test";
+import { promisify } from "node:util";
+import { runInNewContext } from "node:vm";
+import { Effect, Layer } from "effect";
+import { RepositoryFoundryError } from "../errors.js";
+import { EvalAuthoringTransport } from "../project-authoring.js";
+import { repositoryFoundryModelPlanV1 } from "../repository-language-model-protocol.js";
+import { parseRepositorySpecificationContractFactsPacketV1, renderRepositorySpecificationContractFactV1 } from "../repository-specification-contract-facts-protocol.js";
+import { authorRepositoryCaseSpecificationV1 } from "../services/case-authoring/service.js";
+import { generateHistoricalRepositoryCaseV1 } from "../services/case-generation/service.js";
+import { RepositoryFoundryProgressLive } from "../services/foundry-progress/service.js";
+import { RepositoryFoundryLanguageModelLive } from "../services/language-model/service.js";
+const exec = promisify(execFile);
+const privateCode = 'const PRIVATE_AFTER_IMPLEMENTATION_CANARY = "not candidate-facing code";';
+const privateTest = 'const PRIVATE_HISTORICAL_TEST_CANARY = "not candidate-facing test content";';
+const changed = "Normalize event-stream responses to JSON for non-streaming requests.";
+const preserved = "Keep text/plain responses unchanged, even if their body resembles an event stream.";
+const broadRequest = "Repair non-streaming response normalization so both event-stream and text/plain responses containing event-shaped bodies become JSON. Preserve status codes and ordinary JSON responses, and keep public response metadata compatible.";
+const narrowRequest = `Repair non-streaming response normalization. ${changed} ${preserved} Preserve response status codes, ordinary JSON responses, and public response metadata.`;
+const wireDimension = "wire-protocol-compatibility: Correct external request, response, streaming, and error behavior across the gateway's supported wire surfaces.";
+const routingChanged = "Reject incomplete internal routing activations instead of silently selecting a fallback target.";
+const routingPreserved = "Preserve the selected target for complete internal routing activations.";
+const routingRequest = `Repair internal activation selection. ${routingChanged} ${routingPreserved} Keep this change confined to the in-process policy API, without changing external HTTP request, response, streaming, or error behavior.`;
+const dimensionMismatchDetail = "This seed changes only internal activation selection, not an external request, response, stream, or error contract. Rewriting the task as a wire-protocol change would invent unsupported scope.";
+const git = async (root, args) => (await exec("git", ["-C", root, ...args])).stdout.trim();
+const fixture = async (oversized = false, domain = "wire") => {
+    const behavior = domain === "routing"
+        ? {
+            sourcePath: "src/routing-policy.js",
+            testPath: "src/routing-policy.test.js",
+            id: "complete-routing-activation",
+            summary: "Reject incomplete internal routing activations",
+            changed: routingChanged,
+            preserved: routingPreserved,
+            changedScopeId: "reject-incomplete-activation",
+            preservedScopeId: "preserve-complete-target",
+            changedLine: 3,
+            preservedLine: 4,
+            beforeSource: 'export function resolveRoute(activation) {\n  return activation?.target ?? "fallback";\n}\n',
+            afterSource: 'export function resolveRoute(activation) {\n  if (!activation?.target) throw new Error("incomplete routing activation");\n  return activation.target;\n}\n',
+            requestText: routingRequest
+        }
+        : {
+            sourcePath: "src/wire.js",
+            testPath: "src/wire.test.js",
+            id: "sse-json",
+            summary: "Normalize non-streaming responses",
+            changed,
+            preserved,
+            changedScopeId: "normalize-event-stream",
+            preservedScopeId: "preserve-text-plain",
+            changedLine: 4,
+            preservedLine: 3,
+            beforeSource: "export function normalize(type, body) {\n  return body;\n}\n",
+            afterSource: 'export function normalize(type, body) {\n  if (type === "text/plain") return body;\n  if (type === "text/event-stream") return JSON.stringify({ value: body });\n  return body;\n}\n',
+            requestText: narrowRequest
+        };
+    const root = await mkdtemp(path.join(tmpdir(), "routekit-reference-scope-"));
+    await git(root, ["init", "-q"]);
+    await git(root, ["config", "user.email", "eval@example.test"]);
+    await git(root, ["config", "user.name", "Reference Scope Fixture"]);
+    await mkdir(path.join(root, "src"));
+    await writeFile(path.join(root, "package.json"), '{"name":"reference-fixture","type":"module"}\n');
+    await writeFile(path.join(root, "src/a-context.js"), "export const unchangedContext = true;\n");
+    await writeFile(path.join(root, "src/empty.js"), "");
+    await writeFile(path.join(root, behavior.sourcePath), behavior.beforeSource);
+    await writeFile(path.join(root, behavior.testPath), `export const assertion = ${JSON.stringify(behavior.preserved)};\n`);
+    await git(root, ["add", "."]);
+    await git(root, ["commit", "-qm", "initial"]);
+    const initialCommit = await git(root, ["rev-parse", "HEAD"]);
+    await writeFile(path.join(root, behavior.sourcePath), `${privateCode}\n${behavior.afterSource}${oversized ? `//${"x".repeat(97_000)}\n` : ""}`);
+    await writeFile(path.join(root, behavior.testPath), `${privateTest}\nexport const assertion = ${JSON.stringify(`${behavior.changed} ${behavior.preserved}`)};\n`);
+    await writeFile(path.join(root, "src/added.js"), "export const addedContext = true;\n");
+    await git(root, ["add", "."]);
+    await git(root, ["commit", "-qm", behavior.summary]);
+    const referenceCommit = await git(root, ["rev-parse", "HEAD"]);
+    const seed = {
+        version: 1,
+        id: `seed-${domain}`,
+        status: "qualified",
+        source: { kind: "historical-fix", changeEpisodeId: `episode-${domain}` },
+        summary: behavior.summary,
+        initialState: { commit: initialCommit },
+        referenceCommit,
+        capabilityEvidence: [
+            { kind: "symbol", id: domain, path: behavior.sourcePath },
+            { kind: "test", id: `${domain}-test`, path: behavior.testPath }
+        ],
+        targetBehavior: [
+            {
+                id: behavior.id,
+                description: domain === "wire" ? "Normalize all event-shaped responses to JSON." : behavior.changed,
+                critical: true,
+                evidence: [{ kind: "test", id: `${domain}-test`, path: behavior.testPath }]
+            }
+        ],
+        baselineObservations: [],
+        preChangeObservations: [],
+        postChangeObservations: [],
+        candidateTestIds: [`${domain}-test`],
+        environment: {
+            protectedControlPaths: [behavior.testPath],
+            trustedPreparationRecipes: [],
+            candidateValidationRecipes: [],
+            baselineGradeRecipes: [],
+            gradeRecipes: []
+        },
+        confidence: "high",
+        risks: [],
+        rejectionReasons: []
+    };
+    const map = {
+        version: 1,
+        repository: { root, commit: initialCommit, requestedRef: initialCommit, tree: "fixture" },
+        packages: [
+            {
+                id: "package-fixture",
+                name: "reference-fixture",
+                path: ".",
+                manifestPath: "package.json",
+                dependencyPackageIds: [],
+                publicExports: ["."]
+            }
+        ],
+        publicSurfaces: [
+            {
+                id: "surface-context",
+                packageId: "package-fixture",
+                path: "src/a-context.js",
+                kind: "package-export",
+                symbols: ["unchangedContext"]
+            }
+        ],
+        protocols: [],
+        commands: [],
+        tests: [],
+        testBindings: [],
+        workloadSignals: [],
+        blindSpots: [],
+        historyEpisodes: [
+            {
+                id: `episode-${domain}`,
+                commit: referenceCommit,
+                parentCommit: initialCommit,
+                occurredAt: "2026-09-05T00:00:00Z",
+                subject: behavior.summary,
+                body: "",
+                changedPaths: [
+                    { path: behavior.sourcePath, kind: "implementation", status: "modified" },
+                    { path: behavior.testPath, kind: "test", status: "modified" }
+                ],
+                testPaths: [behavior.testPath],
+                implementationPaths: [behavior.sourcePath],
+                protocolPaths: [],
+                behaviorChanging: true,
+                seedEligible: true
+            }
+        ]
+    };
+    const family = {
+        version: 1,
+        id: `family-${domain}`,
+        capabilityId: domain === "wire" ? "response-normalization" : "internal-routing-policy",
+        jobStatement: behavior.summary,
+        lane: "repository-agent",
+        seedIds: [seed.id],
+        inputStateFacets: [domain === "wire" ? "response content type" : "activation completeness"],
+        requestedChangeFacets: [behavior.changed],
+        observableFacets: [behavior.changed, behavior.preserved],
+        admissibleSolutionPolicy: "behavior-equivalent",
+        fixtureAxes: [domain === "wire" ? "content type" : "activation completeness"],
+        adversaryFamilies: [domain === "wire" ? "overbroad normalization" : "silent fallback"],
+        excludedNearMisses: [],
+        repositoryCoverage: seed.capabilityEvidence,
+        confidence: "high"
+    };
+    return { root, initialCommit, referenceCommit, seed, map, family, domain, behavior };
+};
+const evidence = (packet, phase, line = 1, sourcePath = "src/wire.js") => {
+    const source = packet.privateReferenceEvidence?.sources.find((entry) => entry.phase === phase && entry.path === sourcePath);
+    assert.ok(source?.content);
+    return { sourceId: source.sourceId, startLine: line, endLine: line };
+};
+const fixtureContractFacts = (f, packet, incomplete) => ({
+    version: 1,
+    facts: [
+        f.domain === "wire" && !incomplete
+            ? {
+                id: "normalization-policy",
+                scopeId: f.behavior.changedScopeId,
+                kind: "closed-set",
+                subject: "response content types selected for normalization",
+                appliesWhen: "the request is non-streaming",
+                members: ["text/event-stream"],
+                outsideBehavior: "Preserve the original response body.",
+                evidence: [evidence(packet, "after", f.behavior.changedLine, f.behavior.sourcePath)]
+            }
+            : {
+                id: "normalization-policy",
+                scopeId: f.behavior.changedScopeId,
+                kind: "behavior",
+                statement: incomplete ? "Apply the appropriate response policy." : f.behavior.changed,
+                evidence: [evidence(packet, "after", f.behavior.changedLine, f.behavior.sourcePath)]
+            },
+        {
+            id: "preservation-policy",
+            scopeId: f.behavior.preservedScopeId,
+            kind: "behavior",
+            statement: f.behavior.preserved,
+            evidence: [evidence(packet, "after", f.behavior.preservedLine, f.behavior.sourcePath)]
+        }
+    ]
+});
+const markedFixtureResponse = (f, options, request, packet, original) => {
+    if (request.foundryRole === "repository-analyst") {
+        const clarification = request.schemaName === "routekit_repository_contract_fact_clarification_v1";
+        const proposal = fixtureContractFacts(f, packet, !clarification && options.initialContractFacts === "incomplete");
+        if (clarification) {
+            assert.ok(packet.clarificationRequests?.length);
+            return {
+                ...proposal,
+                resolutions: packet.clarificationRequests.map((question) => ({
+                    requestId: question.requestId,
+                    outcome: "answered",
+                    factIds: proposal.facts
+                        .filter((fact) => fact.scopeId === question.scopeId)
+                        .map((fact) => fact.id),
+                    detail: "The complete task-local input boundary is established by the pinned evidence."
+                }))
+            };
+        }
+        return { ...original, contractFacts: proposal };
+    }
+    if (!request.foundryRole?.startsWith("specification-critic-"))
+        return original;
+    assert.ok(packet.contractFacts);
+    const reference = request.foundryRole === "specification-critic-b";
+    const policy = packet.contractFacts.facts.find((fact) => fact.id === "normalization-policy");
+    let complete = f.domain === "routing" || policy?.kind === "closed-set";
+    if (reference && f.domain === "wire" && policy?.kind === "closed-set") {
+        const after = packet.privateReferenceEvidence?.sources.find((source) => source.phase === "after" && source.path === f.behavior.sourcePath);
+        assert.ok(after?.content);
+        // Execute only this test's trusted tiny fixture. The verdict is derived from
+        // actual supplied pinned behavior, not a pre-labelled sufficient response.
+        assert.ok(after.content.includes(f.behavior.afterSource));
+        const normalize = runInNewContext(`${after.content.replace(/\bexport\s+/gu, "")}\nnormalize;`, Object.create(null), { timeout: 1_000 });
+        const probeTypes = [
+            ...new Set([
+                ...Array.from(after.content.matchAll(/type === "([^"]+)"/gu), (match) => match[1]),
+                ...policy.members,
+                "application/json",
+                "outside-declared-types"
+            ])
+        ];
+        const preservedBody = "bounded-fixture-response";
+        const actualNormalizedTypes = probeTypes.filter((type) => normalize(type, preservedBody) !== preservedBody);
+        complete =
+            policy.members.length === actualNormalizedTypes.length &&
+                policy.members.every((member) => actualNormalizedTypes.includes(member)) &&
+                policy.outsideBehavior === "Preserve the original response body.";
+    }
+    const scopeChecks = packet.behavioralScope.map((scope) => ({
+        scopeId: scope.id,
+        factIds: packet
+            .contractFacts.facts.filter((fact) => fact.scopeId === scope.id)
+            .map((fact) => fact.id),
+        outcome: scope.id === f.behavior.changedScopeId && !complete
+            ? "missing-facts"
+            : "complete",
+        detail: scope.id === f.behavior.changedScopeId && !complete
+            ? "The packet does not establish the complete task-local input boundary and outside behavior."
+            : "The complete local behavior is represented by the supplied facts and visible constraints.",
+        evidence: reference
+            ? [
+                evidence(packet, "after", scope.id === f.behavior.changedScopeId
+                    ? f.behavior.changedLine
+                    : f.behavior.preservedLine, f.behavior.sourcePath)
+            ]
+            : []
+    }));
+    const contractFactReview = {
+        packetDigest: packet.contractFacts.digest,
+        scopeChecks,
+        clarificationRequests: scopeChecks
+            .filter((check) => check.outcome !== "complete")
+            .map((check) => ({
+            scopeId: check.scopeId,
+            factIds: check.factIds,
+            reason: "missing-boundary",
+            question: "Which complete input set is selected, and what happens outside that set?"
+        }))
+    };
+    // The ordinary sufficient self-label intentionally remains. The owner must
+    // independently enforce the structured fact check rather than trust it.
+    return { ...original, contractFactReview };
+};
+const authoringTransport = (f, options, calls) => {
+    let writes = 0;
+    const complete = (request) => {
+        calls.push(request);
+        const packet = JSON.parse(request.input);
+        let value;
+        if (request.foundryRole === "repository-analyst") {
+            assert.ok(packet.privateReferenceEvidence?.sources.some((source) => source.content?.includes(privateCode)));
+            assert.ok(packet.privateReferenceEvidence?.sources.some((source) => source.content?.includes(privateTest)));
+            value = {
+                summary: f.behavior.summary,
+                userObservableBehaviors: [f.behavior.changed, f.behavior.preserved],
+                constraints: [f.behavior.preserved],
+                risks: [],
+                relevantPaths: [f.behavior.sourcePath, f.behavior.testPath],
+                referenceScope: {
+                    clauses: [
+                        {
+                            id: f.behavior.changedScopeId,
+                            kind: "changed",
+                            behaviorIds: [f.behavior.id],
+                            description: f.behavior.changed,
+                            evidence: [
+                                evidence(packet, "before", 2, f.behavior.sourcePath),
+                                evidence(packet, "after", f.behavior.changedLine, f.behavior.sourcePath)
+                            ]
+                        },
+                        {
+                            id: f.behavior.preservedScopeId,
+                            kind: "preserved",
+                            behaviorIds: [f.behavior.id],
+                            description: f.behavior.preserved,
+                            evidence: [
+                                evidence(packet, "before", 2, f.behavior.sourcePath),
+                                evidence(packet, "after", f.behavior.preservedLine, f.behavior.sourcePath)
+                            ]
+                        }
+                    ],
+                    unresolvedQuestions: []
+                }
+            };
+        }
+        else if (request.foundryRole === "specification-writer") {
+            writes += 1;
+            value = {
+                requestText: f.domain === "wire" && (options.alwaysBroad || (writes === 1 && !options.alwaysNarrow))
+                    ? broadRequest
+                    : f.behavior.requestText,
+                constraints: ["Preserve unrelated public behavior."]
+            };
+        }
+        else {
+            assert.ok(request.foundryRole === "specification-critic-a" ||
+                request.foundryRole === "specification-critic-b", `Unexpected downstream generation call: ${request.foundryRole}`);
+            const contradictory = packet.visible?.requestText === broadRequest;
+            value = {
+                // Deliberately self-label as sufficient: the host must also check the
+                // independently produced structured reference verdict and all evidence.
+                verdict: "sufficient",
+                detail: "The visible request is otherwise actionable.",
+                criticalBehaviorCoverage: packet.targetBehavior
+                    .filter((entry) => entry.critical)
+                    .map((entry) => ({
+                    behaviorId: entry.id,
+                    outcome: "covered",
+                    detail: "The visible request states this behavior."
+                })),
+                findings: []
+            };
+            if (packet.requestedDimension !== undefined) {
+                value.dimensionFit = {
+                    requestedDimension: packet.requestedDimension,
+                    outcome: f.domain === "wire" ? "fit" : "mismatch",
+                    detail: f.domain === "wire"
+                        ? "The authentic delta changes response content-type handling and external response bodies."
+                        : dimensionMismatchDetail,
+                    evidencePaths: [f.behavior.sourcePath, f.behavior.testPath]
+                };
+            }
+            if (request.foundryRole === "specification-critic-b") {
+                const source = packet.privateReferenceEvidence?.sources.find((entry) => entry.phase === "after" && entry.path === f.behavior.sourcePath);
+                assert.ok(source?.content?.includes(f.behavior.afterSource));
+                value.referenceCompatibility = {
+                    outcome: contradictory ? "contradictory" : "compatible",
+                    detail: contradictory
+                        ? "text/plain must remain unchanged, because it is excluded from normalization."
+                        : "Every requirement respects the authentic change and preservation boundaries.",
+                    scopeCoverage: packet.behavioralScope?.map((clause) => ({
+                        scopeId: clause.id,
+                        outcome: contradictory && clause.id === f.behavior.preservedScopeId
+                            ? "contradictory"
+                            : "supported",
+                        detail: clause.id === f.behavior.preservedScopeId ? f.behavior.preserved : f.behavior.changed,
+                        evidence: [
+                            evidence(packet, "after", clause.id === f.behavior.preservedScopeId
+                                ? f.behavior.preservedLine
+                                : f.behavior.changedLine, f.behavior.sourcePath)
+                        ]
+                    }))
+                };
+            }
+        }
+        if (options.specificationContractFactsVersion === 1) {
+            value = markedFixtureResponse(f, options, request, packet, value);
+        }
+        options.mutate?.(request.foundryRole ?? "", value, packet);
+        return JSON.stringify(value);
+    };
+    return Layer.succeed(EvalAuthoringTransport, EvalAuthoringTransport.of({
+        complete: (request) => Effect.sync(() => complete(request))
+    }));
+};
+const run = (f, options, calls) => Effect.runPromise(authorRepositoryCaseSpecificationV1({
+    repositoryRoot: f.root,
+    operationId: "reference-scope-test",
+    caseId: "case-sse",
+    map: f.map,
+    seed: f.seed,
+    family: f.family,
+    maximumSpecificationRevisions: options.maximum,
+    ...(options.specificationContractFactsVersion === undefined
+        ? {}
+        : { specificationContractFactsVersion: options.specificationContractFactsVersion }),
+    ...(options.requestedDimension === undefined
+        ? {}
+        : { requestedDimension: options.requestedDimension }),
+    modelPlan: repositoryFoundryModelPlanV1({ primaryModel: "codex/gpt-6-astra" })
+}).pipe(Effect.provide(RepositoryFoundryLanguageModelLive.pipe(Layer.provide(authoringTransport(f, options, calls))))));
+const assertPrivate = (calls, f) => {
+    for (const call of calls.filter((entry) => entry.foundryRole === "specification-writer" || entry.foundryRole === "specification-critic-a")) {
+        for (const canary of [
+            f.referenceCommit,
+            privateCode,
+            privateTest,
+            "private-reference-after-",
+            "private-reference-question-",
+            "private-contract-fact-question-",
+            "pendingQuestions",
+            "privateReferenceEvidence",
+            "privateContractFacts",
+            '"referenceScope"'
+        ]) {
+            assert.equal(call.input.includes(canary), false, `${call.foundryRole} must not receive ${canary}`);
+        }
+    }
+};
+const assertGenerationRejection = (error, code, completedRevisions) => {
+    assert.ok(error instanceof RepositoryFoundryError);
+    assert.equal(error.operation, "select-generation-context");
+    assert.deepEqual(error.generationRejection, { code, completedRevisions });
+    return true;
+};
+test("a genuinely matching wire seed passes the same pinned dimension in one independent review round", async () => {
+    const f = await fixture();
+    const calls = [];
+    try {
+        const result = await run(f, { maximum: 2, alwaysNarrow: true, requestedDimension: wireDimension }, calls);
+        assert.equal(result.modelCalls.length, 4);
+        assert.equal(result.specificationRevisions?.length, 1);
+        assert.deepEqual(result.specificationRevisions?.[0]?.rejectionReasons, []);
+        assert.ok(result.reviews.every((review) => review.dimensionFit?.outcome === "fit"));
+        assert.ok(calls.every((call) => JSON.parse(call.input).requestedDimension === wireDimension));
+        assertPrivate(calls, f);
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});
+test("marked authoring clarifies missing facts once, renders them, and obtains two fresh independent reviews", async () => {
+    const f = await fixture();
+    const calls = [];
+    try {
+        const result = await run(f, {
+            maximum: 1,
+            specificationContractFactsVersion: 1,
+            initialContractFacts: "incomplete",
+            alwaysNarrow: true
+        }, calls);
+        assert.equal(calls.length, 8);
+        assert.deepEqual(calls.map((call) => call.foundryRole), [
+            "repository-analyst",
+            "specification-writer",
+            "specification-critic-a",
+            "specification-critic-b",
+            "repository-analyst",
+            "specification-writer",
+            "specification-critic-a",
+            "specification-critic-b"
+        ]);
+        assert.equal(calls[0].schemaName, "routekit_repository_analysis_contract_facts_v1");
+        assert.equal(calls[4].schemaName, "routekit_repository_contract_fact_clarification_v1");
+        const firstWriter = JSON.parse(calls[1].input);
+        const firstReferenceCritic = JSON.parse(calls[3].input);
+        const clarification = JSON.parse(calls[4].input);
+        const finalWriter = JSON.parse(calls[5].input);
+        assert.deepEqual(clarification.contractFacts, firstWriter.contractFacts);
+        assert.deepEqual(clarification.privateContractFacts, firstReferenceCritic.privateContractFacts);
+        assert.deepEqual(clarification.privateReferenceEvidence?.sources, firstReferenceCritic.privateReferenceEvidence?.sources);
+        assert.equal(clarification.clarificationRequests?.length, 1);
+        assert.ok(calls[4].instructions.includes("copy unaffected facts and their evidence"));
+        assert.notEqual(finalWriter.contractFacts?.digest, firstWriter.contractFacts?.digest);
+        assert.ok(result.contractFacts);
+        assert.equal(result.contractFacts.independentlyReviewed, true);
+        assert.deepEqual(result.contractFacts.packet, finalWriter.contractFacts);
+        assert.deepEqual(result.contractFacts.reviewerOperationIds, result.reviews.map((review) => review.reviewerId));
+        assert.deepEqual(result.contractFacts.history.map((entry) => entry.sequence), [0, 1]);
+        assert.equal(result.contractFacts.history[1].analystOperationId, calls[4].operationId);
+        assert.deepEqual(result.contractFacts.history[1].clarificationRequestIds, clarification.clarificationRequests.map((question) => question.requestId));
+        assert.deepEqual(result.specificationRevisions?.map((revision) => revision.rejectionReasons.length > 0), [true, false]);
+        assert.equal(result.specificationRevisions?.at(-1)?.contractFactsDigest, result.contractFacts.packet.digest);
+        for (const review of result.reviews) {
+            assert.equal(review.contractFactReview?.packetDigest, result.contractFacts.packet.digest);
+            assert.ok(review.contractFactReview?.scopeChecks.every((check) => check.outcome === "complete"));
+            assert.deepEqual(review.contractFactReview?.clarificationRequests, []);
+        }
+        assert.ok(result.visible.lane === "repository-agent");
+        for (const fact of result.contractFacts.packet.facts) {
+            assert.ok(result.visible.constraints.includes(renderRepositorySpecificationContractFactV1(fact)));
+        }
+        assert.deepEqual(parseRepositorySpecificationContractFactsPacketV1(result.contractFacts.packet, result.referenceGrounding.scope), result.contractFacts.packet);
+        assert.equal(new Set(calls.map((call) => call.operationId)).size, 8);
+        assertPrivate(calls, f);
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});
+test("a false fact with valid citations cannot pass the independent marked reference check", async () => {
+    const f = await fixture();
+    const calls = [];
+    try {
+        await assert.rejects(run(f, {
+            maximum: 0,
+            specificationContractFactsVersion: 1,
+            alwaysNarrow: true,
+            mutate: (role, output) => {
+                if (role !== "repository-analyst")
+                    return;
+                const proposal = output.contractFacts;
+                assert.ok(proposal.facts[0].evidence.length > 0);
+                proposal.facts[0].members = ["text/plain"];
+            }
+        }, calls), (error) => assertGenerationRejection(error, "specification-review-exhausted", 0));
+        assert.equal(calls.length, 4);
+        const reference = JSON.parse(calls[3].input);
+        assert.equal(reference.contractFacts?.facts[0]?.kind, "closed-set");
+        assert.ok(reference.privateContractFacts?.facts[0]?.evidence.length);
+        assertPrivate(calls, f);
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});
+test("stale fact review digests fail identity validation rather than becoming a semantic repair", async () => {
+    const f = await fixture();
+    const calls = [];
+    try {
+        await assert.rejects(run(f, {
+            maximum: 2,
+            specificationContractFactsVersion: 1,
+            alwaysNarrow: true,
+            mutate: (role, output) => {
+                if (role === "specification-critic-b")
+                    output.contractFactReview.packetDigest = "0".repeat(64);
+            }
+        }, calls), (error) => {
+            assert.ok(error instanceof RepositoryFoundryError);
+            assert.equal(error.operation, "select-generation-context");
+            assert.equal(error.generationRejection, undefined);
+            assert.match(error.detail, /stale identity/u);
+            return true;
+        });
+        assert.equal(calls.length, 4);
+        assertPrivate(calls, f);
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});
+test("marked zero allowance cannot clarify missing facts and exhausted revisions stay within twelve calls", async () => {
+    const f = await fixture();
+    try {
+        for (const maximum of [0, 2]) {
+            const calls = [];
+            await assert.rejects(run(f, {
+                maximum,
+                specificationContractFactsVersion: 1,
+                initialContractFacts: "incomplete",
+                alwaysNarrow: true,
+                mutate: (role, output, packet) => {
+                    if (role !== "repository-analyst" || !packet.clarificationRequests)
+                        return;
+                    output.facts = fixtureContractFacts(f, packet, true).facts;
+                }
+            }, calls), (error) => assertGenerationRejection(error, "specification-review-exhausted", maximum));
+            assert.equal(calls.length, 4 + maximum * 4);
+            assert.equal(calls.filter((call) => call.schemaName === "routekit_repository_contract_fact_clarification_v1").length, maximum);
+            assert.equal(new Set(calls.map((call) => call.operationId)).size, calls.length);
+            assertPrivate(calls, f);
+        }
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});
+test("writer-only marked repair does not spend another analyst call or change the accepted packet", async () => {
+    const f = await fixture();
+    const calls = [];
+    try {
+        const result = await run(f, { maximum: 1, specificationContractFactsVersion: 1 }, calls);
+        assert.equal(calls.length, 7);
+        assert.equal(calls.filter((call) => call.foundryRole === "repository-analyst").length, 1);
+        assert.ok(result.contractFacts);
+        assert.equal(result.contractFacts.history[0].packetDigest, result.contractFacts.history[1].packetDigest);
+        assert.deepEqual(result.contractFacts.history[1].clarificationRequestIds, []);
+        assertPrivate(calls, f);
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});
+test("unresolved or unrelated-scope clarification fails before another writer without false exhausted credit", async () => {
+    const f = await fixture();
+    try {
+        for (const mode of ["unresolved", "unrelated-scope", "missing-resolution"]) {
+            const calls = [];
+            await assert.rejects(run(f, {
+                maximum: 2,
+                specificationContractFactsVersion: 1,
+                initialContractFacts: "incomplete",
+                alwaysNarrow: true,
+                mutate: (role, output, packet) => {
+                    if (role !== "repository-analyst" || !packet.clarificationRequests)
+                        return;
+                    if (mode === "unresolved")
+                        output.resolutions[0].outcome = "unresolved";
+                    else if (mode === "missing-resolution")
+                        output.resolutions = [];
+                    else
+                        output.facts[1].statement =
+                            "Change previously preserved responses.";
+                }
+            }, calls), (error) => {
+                assert.ok(error instanceof RepositoryFoundryError);
+                assert.equal(error.operation, "select-generation-context");
+                assert.equal(error.generationRejection, undefined);
+                assert.match(error.detail, /clarification/u);
+                return true;
+            });
+            assert.equal(calls.length, 5, mode);
+            assertPrivate(calls, f);
+        }
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});
+test("marked fact privacy and strict excess-field failures do not expose a writer to private proposals", async () => {
+    const f = await fixture();
+    try {
+        for (const mode of ["private-code", "extra-field"]) {
+            const calls = [];
+            await assert.rejects(run(f, {
+                maximum: 1,
+                specificationContractFactsVersion: 1,
+                alwaysNarrow: true,
+                mutate: (role, output) => {
+                    if (role !== "repository-analyst")
+                        return;
+                    const facts = output.contractFacts.facts;
+                    if (mode === "extra-field")
+                        facts[0].privateCode = privateCode;
+                    else
+                        facts[1].statement = privateCode;
+                }
+            }, calls), (error) => {
+                assert.ok(error instanceof RepositoryFoundryError);
+                assert.equal(error.generationRejection, undefined);
+                assert.equal(error.detail.includes(privateCode), false);
+                return true;
+            });
+            assert.equal(calls.length, 1, mode);
+        }
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});
+test("marked real case generation preserves the grounded no-fit terminal before downstream work", async () => {
+    const f = await fixture(false, "routing");
+    const calls = [];
+    const stages = [];
+    try {
+        await assert.rejects(Effect.runPromise(generateHistoricalRepositoryCaseV1({
+            repositoryRoot: f.root,
+            operationId: "marked-no-fit-generation",
+            caseId: "marked-routing-case",
+            requestedDimension: wireDimension,
+            specificationContractFactsVersion: 1,
+            maximumSpecificationRevisions: 2,
+            map: f.map,
+            seed: f.seed,
+            modelPlan: repositoryFoundryModelPlanV1({ primaryModel: "codex/gpt-6-astra" })
+        }).pipe(Effect.provide(Layer.merge(RepositoryFoundryLanguageModelLive.pipe(Layer.provide(authoringTransport(f, {
+            maximum: 2,
+            specificationContractFactsVersion: 1,
+            requestedDimension: wireDimension
+        }, calls))), RepositoryFoundryProgressLive((event) => Effect.sync(() => {
+            if (event.kind === "stage")
+                stages.push(event.stage);
+        })))))), (error) => assertGenerationRejection(error, "specification-dimension-mismatch", 0));
+        assert.deepEqual(stages, ["author-specification"]);
+        assert.equal(calls.length, 4);
+        assertPrivate(calls, f);
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});
+test("two validated internal-routing mismatches stop after four calls even with unresolved ancillary reference questions", async () => {
+    const f = await fixture(false, "routing");
+    try {
+        for (const referenceOutcome of ["compatible", "uncertain"]) {
+            const calls = [];
+            await assert.rejects(run(f, {
+                maximum: 2,
+                requestedDimension: wireDimension,
+                mutate: (role, output, packet) => {
+                    if (referenceOutcome !== "uncertain")
+                        return;
+                    if (role === "repository-analyst")
+                        setQuestions(output, ["Which outer HTTP endpoint exposes this internal policy?"]);
+                    if (role === "specification-critic-b") {
+                        const compatibility = output.referenceCompatibility;
+                        compatibility.outcome = "uncertain";
+                        setResolutions(output, packet.privateReferenceEvidence.pendingQuestions.map((question) => ({
+                            questionId: question.id,
+                            outcome: "unresolved",
+                            detail: "The outer HTTP call sites are not established by this local delta.",
+                            affectedScopeIds: [],
+                            evidence: []
+                        })));
+                        output.dimensionFit.detail =
+                            `${dimensionMismatchDetail} ${privateCode} ${f.referenceCommit} private-reference-after-0`;
+                    }
+                }
+            }, calls), (error) => {
+                assertGenerationRejection(error, "specification-dimension-mismatch", 0);
+                for (const canary of [
+                    privateCode,
+                    privateTest,
+                    f.referenceCommit,
+                    "private-reference-after-",
+                    "private-reference-question-"
+                ])
+                    assert.equal(error.message.includes(canary), false);
+                return true;
+            });
+            assert.equal(calls.length, 4, referenceOutcome);
+            assert.deepEqual(calls.map((call) => call.foundryRole), [
+                "repository-analyst",
+                "specification-writer",
+                "specification-critic-a",
+                "specification-critic-b"
+            ]);
+            assert.equal(new Set(calls.map((call) => call.operationId)).size, 4);
+            assert.ok(calls.every((call) => JSON.parse(call.input).requestedDimension === wireDimension));
+            assertPrivate(calls, f);
+        }
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});
+test("uncertain and mixed dimension judgments remain repairable and cannot short-circuit admission", async () => {
+    const f = await fixture();
+    try {
+        for (const firstOutcomes of [
+            ["uncertain", "uncertain"],
+            ["fit", "mismatch"],
+            ["mismatch", "uncertain"]
+        ]) {
+            let writes = 0;
+            const calls = [];
+            const result = await run(f, {
+                maximum: 2,
+                alwaysNarrow: true,
+                requestedDimension: wireDimension,
+                mutate: (role, output) => {
+                    if (role === "specification-writer")
+                        writes += 1;
+                    if (writes !== 1 || !role.startsWith("specification-critic-"))
+                        return;
+                    const fit = output.dimensionFit;
+                    fit.outcome = firstOutcomes[role === "specification-critic-a" ? 0 : 1];
+                    fit.detail = "Clarify which externally observable response behavior this task changes.";
+                }
+            }, calls);
+            assert.equal(result.modelCalls.length, 7, firstOutcomes.join("/"));
+            assert.deepEqual(result.specificationRevisions?.map((revision) => revision.rejectionReasons.length > 0), [true, false]);
+            assert.ok(result.reviews.every((review) => review.dimensionFit?.outcome === "fit"));
+            assertPrivate(calls, f);
+        }
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});
+test("a later definite no-fit decision records only the completed host revision sequence", async () => {
+    const f = await fixture(false, "routing");
+    try {
+        for (const completedRevisions of [1, 2]) {
+            let writes = 0;
+            const calls = [];
+            await assert.rejects(run(f, {
+                maximum: 2,
+                requestedDimension: wireDimension,
+                mutate: (role, output) => {
+                    if (role === "specification-writer")
+                        writes += 1;
+                    if (role !== "specification-critic-a" || writes > completedRevisions)
+                        return;
+                    output.dimensionFit.outcome = "uncertain";
+                }
+            }, calls), (error) => assertGenerationRejection(error, "specification-dimension-mismatch", completedRevisions));
+            assert.equal(calls.length, 4 + 3 * completedRevisions);
+            assert.equal(calls.filter((call) => call.foundryRole === "specification-writer").length, completedRevisions + 1);
+            assertPrivate(calls, f);
+        }
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});
+test("revision feedback includes dimension details but never exposes private reference material", async () => {
+    const f = await fixture();
+    const calls = [];
+    const publicFeedback = "State the content-type eligibility boundary as external response behavior.";
+    let writes = 0;
+    try {
+        const result = await run(f, {
+            maximum: 2,
+            alwaysNarrow: true,
+            requestedDimension: wireDimension,
+            mutate: (role, output) => {
+                if (role === "specification-writer")
+                    writes += 1;
+                if (writes !== 1 || !role.startsWith("specification-critic-"))
+                    return;
+                const fit = output.dimensionFit;
+                fit.outcome = "uncertain";
+                fit.detail =
+                    role === "specification-critic-a"
+                        ? publicFeedback
+                        : `${privateCode} ${privateTest} ${f.referenceCommit} private-reference-after-0 private-reference-question-1`;
+            }
+        }, calls);
+        assert.equal(result.modelCalls.length, 7);
+        const revision = calls.find((call) => call.foundryRole === "specification-writer" &&
+            call.operationId.includes(":specification-revision:1:"));
+        assert.ok(revision);
+        const feedback = JSON.parse(revision.input)
+            .behavioralReviewFeedback;
+        assert.ok(feedback.includes(publicFeedback));
+        assert.ok(result.specificationRevisions?.[0]?.reviews[1]?.dimensionFit?.detail.includes(privateCode));
+        assertPrivate(calls, f);
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});
+test("no-fit requires complete exact dimension, critical behavior, and grounded scope evidence from both critics", async () => {
+    const f = await fixture(false, "routing");
+    try {
+        for (const scenario of [
+            "missing-dimension",
+            "second-critic-missing-dimension",
+            "wrong-dimension",
+            "second-critic-wrong-dimension",
+            "blank-dimension-detail",
+            "missing-paths",
+            "unknown-path",
+            "blank-path",
+            "annotated-path",
+            "second-critic-annotated-path",
+            "after-only-path",
+            "no-critical-behavior",
+            "missing-critical-coverage",
+            "duplicate-critical-coverage",
+            "unknown-critical-behavior",
+            "uncovered-critical-behavior",
+            "blank-critical-detail",
+            "missing-reference-review",
+            "contradictory-reference",
+            "blank-reference-detail",
+            "missing-scope",
+            "partial-scope",
+            "extra-scope",
+            "duplicate-scope",
+            "unknown-scope",
+            "uncertain-scope",
+            "contradictory-scope",
+            "blank-scope-detail",
+            "missing-after-evidence",
+            "before-only-evidence",
+            "unknown-source",
+            "invalid-line",
+            "fractional-line"
+        ]) {
+            const calls = [];
+            const selected = scenario === "no-critical-behavior"
+                ? {
+                    ...f,
+                    seed: {
+                        ...f.seed,
+                        targetBehavior: f.seed.targetBehavior.map((behavior) => ({
+                            ...behavior,
+                            critical: false
+                        }))
+                    }
+                }
+                : f;
+            await assert.rejects(run(selected, {
+                maximum: 2,
+                requestedDimension: wireDimension,
+                mutate: (role, output) => {
+                    if (!role.startsWith("specification-critic-"))
+                        return;
+                    const fit = output.dimensionFit;
+                    const critical = output.criticalBehaviorCoverage;
+                    if (role === "specification-critic-a") {
+                        if (scenario === "missing-dimension")
+                            delete output.dimensionFit;
+                        if (scenario === "wrong-dimension")
+                            fit.requestedDimension = "internal-routing";
+                        if (scenario === "blank-dimension-detail")
+                            fit.detail = " ";
+                        if (scenario === "missing-paths")
+                            fit.evidencePaths = [];
+                        if (scenario === "unknown-path")
+                            fit.evidencePaths = ["src/missing.js"];
+                        if (scenario === "blank-path")
+                            fit.evidencePaths = [" "];
+                        if (scenario === "annotated-path")
+                            fit.evidencePaths = [`${f.behavior.sourcePath} (internal policy only)`];
+                        if (scenario === "after-only-path")
+                            fit.evidencePaths = ["src/added.js"];
+                        if (scenario === "missing-critical-coverage")
+                            critical.length = 0;
+                        if (scenario === "duplicate-critical-coverage")
+                            critical.push({ ...critical[0] });
+                        if (scenario === "unknown-critical-behavior")
+                            critical[0].behaviorId = "unknown";
+                        if (scenario === "uncovered-critical-behavior")
+                            critical[0].outcome = "uncertain";
+                        if (scenario === "blank-critical-detail")
+                            critical[0].detail = " ";
+                    }
+                    if (role !== "specification-critic-b")
+                        return;
+                    if (scenario === "second-critic-missing-dimension")
+                        delete output.dimensionFit;
+                    if (scenario === "second-critic-wrong-dimension")
+                        fit.requestedDimension = `${wireDimension} `;
+                    if (scenario === "second-critic-annotated-path")
+                        fit.evidencePaths = [`${f.behavior.testPath}:1-2`];
+                    if (scenario === "missing-reference-review") {
+                        delete output.referenceCompatibility;
+                        return;
+                    }
+                    const compatibility = output.referenceCompatibility;
+                    const coverage = compatibility.scopeCoverage;
+                    if (scenario === "contradictory-reference")
+                        compatibility.outcome = "contradictory";
+                    if (scenario === "blank-reference-detail")
+                        compatibility.detail = " ";
+                    if (scenario === "missing-scope")
+                        coverage.length = 0;
+                    if (scenario === "partial-scope")
+                        coverage.pop();
+                    if (scenario === "extra-scope")
+                        coverage.push({ ...coverage[0], scopeId: "extra" });
+                    if (scenario === "duplicate-scope")
+                        coverage[1] = coverage[0];
+                    if (scenario === "unknown-scope")
+                        coverage[0].scopeId = "unknown";
+                    if (scenario === "uncertain-scope")
+                        coverage[0].outcome = "uncertain";
+                    if (scenario === "contradictory-scope")
+                        coverage[0].outcome = "contradictory";
+                    if (scenario === "blank-scope-detail")
+                        coverage[0].detail = " ";
+                    if (scenario === "missing-after-evidence")
+                        coverage[0].evidence = [];
+                    if (scenario === "before-only-evidence")
+                        coverage[0].evidence[0].sourceId = coverage[0].evidence[0].sourceId.replace("after", "before");
+                    if (scenario === "unknown-source")
+                        coverage[0].evidence[0].sourceId = "private-reference-after-unknown";
+                    if (scenario === "invalid-line")
+                        coverage[0].evidence[0].endLine = 99999;
+                    if (scenario === "fractional-line")
+                        coverage[0].evidence[0].startLine = 1.5;
+                }
+            }, calls), (error) => {
+                assertGenerationRejection(error, "specification-review-exhausted", 2);
+                return true;
+            }, scenario);
+            assert.equal(calls.length, 10, `${scenario} must preserve all bounded repair rounds`);
+            assertPrivate(calls, f);
+        }
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});
+test("schema-malformed critic judgments never become semantic generation rejections", async () => {
+    const f = await fixture(false, "routing");
+    try {
+        for (const scenario of ["invalid-dimension-outcome", "missing-required-coverage"]) {
+            const calls = [];
+            await assert.rejects(run(f, {
+                maximum: 2,
+                requestedDimension: wireDimension,
+                mutate: (role, output) => {
+                    if (role !== "specification-critic-b")
+                        return;
+                    if (scenario === "invalid-dimension-outcome")
+                        output.dimensionFit.outcome = "definitely-no-fit";
+                    else
+                        delete output.criticalBehaviorCoverage;
+                }
+            }, calls), (error) => {
+                assert.ok(error instanceof RepositoryFoundryError);
+                assert.equal(error.operation, "invoke-language-model");
+                assert.equal(error.modelResponseFailure, "schema");
+                assert.equal(error.generationRejection, undefined);
+                return true;
+            });
+            assert.equal(calls.length, 4, scenario);
+            assertPrivate(calls, f);
+        }
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});
+test("unrequested dimensions cannot manufacture an early target-selection rejection", async () => {
+    const f = await fixture(false, "routing");
+    const calls = [];
+    try {
+        const result = await run(f, {
+            maximum: 2,
+            mutate: (role, output) => {
+                if (!role.startsWith("specification-critic-"))
+                    return;
+                output.dimensionFit = {
+                    requestedDimension: wireDimension,
+                    outcome: "mismatch",
+                    detail: dimensionMismatchDetail,
+                    evidencePaths: [f.behavior.sourcePath]
+                };
+            }
+        }, calls);
+        assert.equal(result.modelCalls.length, 4);
+        assertPrivate(calls, f);
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});
+test("real case generation stops at the no-fit authoring terminal before solver, oracle, review, or admission work", async () => {
+    const f = await fixture(false, "routing");
+    const calls = [];
+    const stages = [];
+    try {
+        await assert.rejects(Effect.runPromise(generateHistoricalRepositoryCaseV1({
+            repositoryRoot: f.root,
+            operationId: "dimension-no-fit-generation-test",
+            caseId: "case-internal-routing",
+            requestedDimension: wireDimension,
+            maximumSpecificationRevisions: 2,
+            map: f.map,
+            seed: f.seed,
+            modelPlan: repositoryFoundryModelPlanV1({ primaryModel: "codex/gpt-6-astra" })
+        }).pipe(Effect.provide(Layer.merge(RepositoryFoundryLanguageModelLive.pipe(Layer.provide(authoringTransport(f, { maximum: 2, requestedDimension: wireDimension }, calls))), RepositoryFoundryProgressLive((event) => Effect.sync(() => {
+            if (event.kind === "stage")
+                stages.push(event.stage);
+        })))))), (error) => assertGenerationRejection(error, "specification-dimension-mismatch", 0));
+        assert.deepEqual(stages, ["author-specification"]);
+        assert.deepEqual(calls.map((call) => call.foundryRole), [
+            "repository-analyst",
+            "specification-writer",
+            "specification-critic-a",
+            "specification-critic-b"
+        ]);
+        assertPrivate(calls, f);
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});
+test("grounded authoring rejects text/plain expansion and revises with two fresh critics within the pinned budget", async () => {
+    const f = await fixture();
+    const calls = [];
+    try {
+        const result = await run(f, { maximum: 2 }, calls);
+        assert.ok(result.visible.lane === "repository-agent");
+        assert.equal(result.visible.requestText, narrowRequest);
+        assert.equal(result.modelCalls.length, 7);
+        assert.deepEqual(result.specificationRevisions?.map((entry) => entry.rejectionReasons.length > 0), [true, false]);
+        assert.equal(result.referenceGrounding?.referenceCommit, f.referenceCommit);
+        assert.deepEqual(result.groundedTargetBehavior?.map(({ id, critical, evidence: refs }) => ({
+            id,
+            critical,
+            evidence: refs
+        })), f.seed.targetBehavior.map(({ id, critical, evidence: refs }) => ({
+            id,
+            critical,
+            evidence: refs
+        })));
+        assert.equal(result.groundedTargetBehavior?.[0]?.description, `${changed} ${preserved}`);
+        assert.equal(new Set(result.modelCalls.map((call) => call.operationId)).size, 7);
+        assert.ok(result.modelCalls
+            .slice(4)
+            .every((call) => call.operationId.includes(":specification-revision:1:")));
+        assertPrivate(calls, f);
+        const solverProjection = JSON.stringify({
+            visible: result.visible,
+            initialSources: result.contextSources,
+            targetBehavior: result.groundedTargetBehavior
+        });
+        for (const canary of [f.referenceCommit, privateCode, privateTest, "private-reference-after-"])
+            assert.equal(solverProjection.includes(canary), false);
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});
+test("explicit zero still grounds and rejects contradictory text/plain behavior without revision calls", async () => {
+    const f = await fixture();
+    const calls = [];
+    try {
+        await assert.rejects(run(f, { maximum: 0 }, calls), (error) => {
+            assert.match(error.message, /failed independent review after 0 bounded revisions/u);
+            return assertGenerationRejection(error, "specification-review-exhausted", 0);
+        });
+        assert.equal(calls.length, 4);
+        assertPrivate(calls, f);
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});
+test("exhausted specification repair never exceeds one analyst and three bounded writer/critic rounds", async () => {
+    const f = await fixture();
+    const calls = [];
+    try {
+        await assert.rejects(run(f, { maximum: 2, alwaysBroad: true }, calls), (error) => {
+            assert.match(error.message, /failed independent review after 2 bounded revisions/u);
+            return assertGenerationRejection(error, "specification-review-exhausted", 2);
+        });
+        assert.equal(calls.length, 10);
+        assert.equal(calls.filter((entry) => entry.foundryRole === "repository-analyst").length, 1);
+        assertPrivate(calls, f);
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});
+test("grounding fails closed for malformed scope and invalid or incomplete source evidence", async () => {
+    const f = await fixture();
+    try {
+        for (const scenario of [
+            "blank-question",
+            "missing-before",
+            "missing-after",
+            "unknown-source",
+            "invalid-line",
+            "missing-behavior"
+        ]) {
+            const calls = [];
+            await assert.rejects(run(f, {
+                maximum: 2,
+                mutate: (role, output) => {
+                    if (role !== "repository-analyst")
+                        return;
+                    const scope = output.referenceScope;
+                    if (scenario === "blank-question")
+                        scope.unresolvedQuestions = ["  "];
+                    const clause = scope.clauses[0];
+                    if (scenario === "missing-before")
+                        clause.evidence = clause.evidence.filter((entry) => !entry.sourceId.includes("before"));
+                    if (scenario === "missing-after")
+                        clause.evidence = clause.evidence.filter((entry) => !entry.sourceId.includes("after"));
+                    if (scenario === "unknown-source")
+                        clause.evidence[0].sourceId = "unbound-source";
+                    if (scenario === "invalid-line")
+                        clause.evidence[0].endLine = 99999;
+                    if (scenario === "missing-behavior")
+                        clause.behaviorIds = ["invented-behavior"];
+                }
+            }, calls), /scope is incomplete, malformed, or lacks valid pinned source line evidence/u);
+            assert.equal(calls.length, 1, scenario);
+        }
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});
+test("sufficient critic labels cannot override unknown, missing, or unbound reference compatibility", async () => {
+    const f = await fixture();
+    try {
+        for (const scenario of [
+            "missing",
+            "uncertain",
+            "missing-scope",
+            "duplicate-scope",
+            "before-only",
+            "fractional-line"
+        ]) {
+            const calls = [];
+            await assert.rejects(run(f, {
+                maximum: 0,
+                alwaysNarrow: true,
+                mutate: (role, output) => {
+                    if (role !== "specification-critic-b")
+                        return;
+                    const review = output.referenceCompatibility;
+                    if (scenario === "missing")
+                        delete output.referenceCompatibility;
+                    if (scenario === "uncertain")
+                        review.outcome = "uncertain";
+                    if (scenario === "missing-scope")
+                        review.scopeCoverage.pop();
+                    if (scenario === "duplicate-scope")
+                        review.scopeCoverage[1] = review.scopeCoverage[0];
+                    if (scenario === "before-only")
+                        review.scopeCoverage[0].evidence[0].sourceId =
+                            review.scopeCoverage[0].evidence[0].sourceId.replace("after", "before");
+                    if (scenario === "fractional-line")
+                        review.scopeCoverage[0].evidence[0].startLine = 1.5;
+                }
+            }, calls), /failed independent review/u);
+            assert.equal(calls.length, 4, scenario);
+        }
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});
+test("complete snapshot limits reject before the first model call and never silently truncate critical evidence", async () => {
+    const f = await fixture(true);
+    const calls = [];
+    try {
+        await assert.rejects(run(f, { maximum: 2 }, calls), /complete reference-grounding sources exceed/u);
+        assert.equal(calls.length, 0);
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});
+test("private analyst prose cannot smuggle reference code or identifiers across the writer boundary", async () => {
+    const f = await fixture();
+    try {
+        for (const canary of [privateCode, f.referenceCommit, "private-reference-after-0"]) {
+            const calls = [];
+            await assert.rejects(run(f, {
+                maximum: 2,
+                mutate: (role, output) => {
+                    if (role === "repository-analyst")
+                        output.summary = canary;
+                }
+            }, calls), /private reference material leaked into the analyst/u);
+            assert.equal(calls.length, 1);
+        }
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});
+test("analyst line references stay bound to their original files when selected context sorts before them", async () => {
+    const f = await fixture();
+    const calls = [];
+    try {
+        const result = await run(f, {
+            maximum: 0,
+            alwaysNarrow: true,
+            mutate: (role, output) => {
+                if (role === "repository-analyst")
+                    output.relevantPaths = ["src/wire.js", "src/wire.test.js", "src/a-context.js"];
+            }
+        }, calls);
+        const grounding = result.referenceGrounding;
+        assert.ok(result.contextSources.some((source) => source.path === "src/a-context.js"));
+        assert.equal(new Set(grounding.sources.map((source) => source.sourceId)).size, grounding.sources.length);
+        for (const reference of grounding.scope.clauses.flatMap((clause) => clause.evidence)) {
+            const source = grounding.sources.find((entry) => entry.sourceId === reference.sourceId);
+            assert.equal(source?.path, "src/wire.js");
+        }
+        assertPrivate(calls, f);
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});
+test("empty files and explicit absent snapshots cannot serve as behavioral line evidence", async () => {
+    const f = await fixture();
+    try {
+        for (const file of ["src/empty.js", "src/added.js"]) {
+            const withSource = {
+                ...f,
+                seed: {
+                    ...f.seed,
+                    capabilityEvidence: [
+                        ...f.seed.capabilityEvidence,
+                        { kind: "symbol", id: "additional-source", path: file }
+                    ]
+                }
+            };
+            const calls = [];
+            await assert.rejects(run(withSource, {
+                maximum: 0,
+                mutate: (role, output, packet) => {
+                    if (role !== "repository-analyst")
+                        return;
+                    const source = packet.privateReferenceEvidence.sources.find((entry) => entry.path === file && entry.phase === "before");
+                    assert.equal(source.content, file === "src/empty.js" ? "" : null);
+                    const scope = output.referenceScope;
+                    scope.clauses[0].evidence[0] = {
+                        sourceId: source.sourceId,
+                        startLine: 1,
+                        endLine: 1
+                    };
+                }
+            }, calls), /scope is incomplete, malformed, or lacks valid pinned source line evidence/u);
+            assert.equal(calls.length, 1);
+        }
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});
+test("private compatibility findings remain in private history but are removed from writer revision feedback", async () => {
+    const f = await fixture();
+    const calls = [];
+    try {
+        const result = await run(f, {
+            maximum: 1,
+            mutate: (role, output, packet) => {
+                if (role === "specification-critic-b" && packet.visible?.requestText === broadRequest) {
+                    output.detail = `${privateCode} ${f.referenceCommit}`;
+                    output.findings = [
+                        {
+                            axis: "unsupported-assumption",
+                            severity: "blocker",
+                            detail: `Use private-reference-after-0: ${privateTest}`
+                        }
+                    ];
+                }
+            }
+        }, calls);
+        assert.ok(result.visible.lane === "repository-agent");
+        assert.equal(result.visible.requestText, narrowRequest);
+        assert.ok(result.specificationRevisions?.[0]?.reviews[1]?.detail.includes(privateCode));
+        const revision = calls.find((call) => call.foundryRole === "specification-writer" &&
+            call.operationId.includes(":specification-revision:1:"));
+        assert.ok(revision?.input.includes("behavioralReviewFeedback"));
+        assertPrivate(calls, f);
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});
+// Frozen, small calibration cases based on the v5 unsupported media-type request
+// and the two broader integration unknowns returned by the v6 analyst. Model
+// responses are synthetic here; these tests establish the host's gate behavior.
+const integrationQuestions = [
+    "Which downstream HTTP status and error body are exposed when newly eligible untyped responses fail buffering or SSE parsing? The available evidence establishes normalization failure but not endpoint-level error translation.",
+    "Do all native Responses entry points reach this normalization flow? The available evidence establishes the finalization behavior but does not include its provider and endpoint call sites."
+];
+const narrowExclusion = "This task covers the shared normalizer; endpoint HTTP error translation and auditing every provider call site are outside this change.";
+const setQuestions = (output, questions) => {
+    output.referenceScope.unresolvedQuestions = [...questions];
+};
+const excludedQuestions = (packet) => (packet.privateReferenceEvidence?.pendingQuestions ?? []).map((question) => ({
+    questionId: question.id,
+    outcome: "not-required",
+    detail: "The shared normalizer's required behavior is determined independently of this broader integration question.",
+    affectedScopeIds: [],
+    evidence: [],
+    visibleScopeExclusion: {
+        quotation: narrowExclusion,
+        rationale: "The visible task explicitly excludes the outer endpoint error mapping and a repository-wide provider call-site audit, while retaining all required normalization and preservation behavior."
+    }
+}));
+const setResolutions = (output, resolutions) => {
+    output.referenceCompatibility.questionResolutions =
+        resolutions;
+};
+test("paired calibration rejects v5 text/plain expansion but accepts narrow v6 scope with justified outside-scope questions", async () => {
+    const f = await fixture();
+    try {
+        for (const overbroad of [true, false]) {
+            const calls = [];
+            const result = run(f, {
+                maximum: 0,
+                alwaysBroad: overbroad,
+                alwaysNarrow: !overbroad,
+                mutate: (role, output, packet) => {
+                    if (role === "repository-analyst")
+                        setQuestions(output, integrationQuestions);
+                    if (role === "specification-writer")
+                        output.constraints = [narrowExclusion];
+                    if (role === "specification-critic-b")
+                        setResolutions(output, excludedQuestions(packet));
+                }
+            }, calls);
+            if (overbroad) {
+                await assert.rejects(result, /failed independent review/u);
+            }
+            else {
+                const accepted = await result;
+                assert.ok(accepted.visible.lane === "repository-agent");
+                assert.equal(accepted.visible.requestText, narrowRequest);
+                assert.equal(accepted.reviews[1]?.referenceCompatibility?.questionResolutions?.length, 2);
+                assert.equal(accepted.modelCalls.length, 4);
+            }
+            assert.equal(calls.length, 4, "questions use the existing writer and critic calls");
+            assertPrivate(calls, f);
+            for (const call of calls.filter((entry) => entry.foundryRole === "specification-writer" ||
+                entry.foundryRole === "specification-critic-a")) {
+                for (const question of integrationQuestions)
+                    assert.equal(call.input.includes(question), false);
+            }
+        }
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});
+test("required MIME uncertainty must be answered with pinned evidence and cannot be dismissed as outside scope", async () => {
+    const f = await fixture();
+    try {
+        for (const disposition of ["unresolved", "not-required", "answered"]) {
+            const calls = [];
+            const result = run(f, {
+                maximum: 0,
+                alwaysNarrow: true,
+                mutate: (role, output, packet) => {
+                    if (role === "repository-analyst")
+                        setQuestions(output, ["Must text/plain containing SSE remain unchanged?"]);
+                    if (role === "specification-writer")
+                        output.constraints = [narrowExclusion];
+                    if (role === "specification-critic-b") {
+                        setResolutions(output, [
+                            {
+                                questionId: packet.privateReferenceEvidence.pendingQuestions[0].id,
+                                outcome: disposition,
+                                detail: disposition === "answered"
+                                    ? "The media-type eligibility predicate bypasses text/plain, which the visible task explicitly preserves."
+                                    : "MIME eligibility affects a required preservation obligation.",
+                                affectedScopeIds: ["preserve-text-plain"],
+                                evidence: disposition === "answered" ? [evidence(packet, "after", 3)] : [],
+                                ...(disposition === "not-required"
+                                    ? {
+                                        visibleScopeExclusion: {
+                                            quotation: narrowExclusion,
+                                            rationale: "Treat this uncertainty as outside scope."
+                                        }
+                                    }
+                                    : {})
+                            }
+                        ]);
+                    }
+                }
+            }, calls);
+            if (disposition === "answered")
+                assert.equal((await result).modelCalls.length, 4);
+            else
+                await assert.rejects(result, /questions require complete evidence-backed answers or justified visible-scope exclusions/u);
+            assert.equal(calls.length, 4);
+        }
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});
+test("a writer cannot exclude mandatory MIME behavior to silence a pending question", async () => {
+    const f = await fixture();
+    const calls = [];
+    try {
+        await assert.rejects(run(f, {
+            maximum: 0,
+            alwaysNarrow: true,
+            mutate: (role, output, packet) => {
+                if (role === "repository-analyst")
+                    setQuestions(output, ["Must text/plain containing SSE remain unchanged?"]);
+                if (role === "specification-writer") {
+                    output.requestText = `Repair response normalization. ${changed} Preserve response metadata. MIME eligibility and text/plain preservation are outside this task.`;
+                    output.constraints = [narrowExclusion];
+                }
+                if (role === "specification-critic-b") {
+                    // Even a complete not-required record must not override the independent
+                    // finding that the visible task drops a mandatory grounded scope clause.
+                    setResolutions(output, excludedQuestions(packet));
+                    const compatibility = output.referenceCompatibility;
+                    compatibility.scopeCoverage.find((entry) => entry.scopeId === "preserve-text-plain").outcome = "contradictory";
+                }
+            }
+        }, calls), /visible requirements are contradictory, uncertain, or lack complete pinned reference compatibility evidence/u);
+        assert.equal(calls.length, 4);
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});
+test("missing, duplicate, invented, stale, and malformed private question resolutions fail closed", async () => {
+    const f = await fixture();
+    try {
+        for (const scenario of [
+            "missing",
+            "duplicate",
+            "invented",
+            "extra",
+            "unresolved",
+            "blank-detail",
+            "blank-quote",
+            "stale-quote",
+            "joined-fields",
+            "blank-rationale",
+            "unknown-scope",
+            "duplicate-scope",
+            "answered-no-evidence",
+            "answered-bad-evidence"
+        ]) {
+            const calls = [];
+            await assert.rejects(run(f, {
+                maximum: 0,
+                alwaysNarrow: true,
+                mutate: (role, output, packet) => {
+                    if (role === "repository-analyst")
+                        setQuestions(output, integrationQuestions);
+                    if (role === "specification-writer")
+                        output.constraints = [narrowExclusion];
+                    if (role !== "specification-critic-b")
+                        return;
+                    const resolutions = excludedQuestions(packet);
+                    const first = resolutions[0];
+                    if (scenario === "missing")
+                        resolutions.pop();
+                    if (scenario === "duplicate")
+                        resolutions[1] = first;
+                    if (scenario === "invented")
+                        first.questionId = "private-reference-question-999";
+                    if (scenario === "extra")
+                        resolutions.push({ ...first, questionId: "private-reference-question-999" });
+                    if (scenario === "unresolved")
+                        first.outcome = "unresolved";
+                    if (scenario === "blank-detail")
+                        first.detail = "  ";
+                    if (scenario === "blank-quote")
+                        first.visibleScopeExclusion.quotation = " ";
+                    if (scenario === "stale-quote")
+                        first.visibleScopeExclusion.quotation =
+                            "An exclusion stated only by a previous draft.";
+                    if (scenario === "joined-fields")
+                        first.visibleScopeExclusion.quotation = `${packet.visible.requestText}\n${packet.visible.constraints[0]}`;
+                    if (scenario === "blank-rationale")
+                        first.visibleScopeExclusion.rationale = "  ";
+                    if (scenario === "unknown-scope")
+                        first.affectedScopeIds = ["unknown-scope"];
+                    if (scenario === "duplicate-scope")
+                        first.affectedScopeIds = ["preserve-text-plain", "preserve-text-plain"];
+                    if (scenario === "answered-no-evidence" || scenario === "answered-bad-evidence") {
+                        first.outcome = "answered";
+                        first.affectedScopeIds = ["preserve-text-plain"];
+                        delete first.visibleScopeExclusion;
+                        first.evidence =
+                            scenario === "answered-no-evidence"
+                                ? []
+                                : [{ ...evidence(packet, "after", 3), endLine: 9999 }];
+                    }
+                    setResolutions(output, resolutions);
+                }
+            }, calls), /questions require complete evidence-backed answers or justified visible-scope exclusions/u);
+            assert.equal(calls.length, 4, scenario);
+        }
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});
+test("question IDs remain frozen across bounded revisions and private resolution feedback never reaches the writer", async () => {
+    const f = await fixture();
+    const calls = [];
+    const reviewedIds = [];
+    try {
+        const result = await run(f, {
+            maximum: 1,
+            alwaysNarrow: true,
+            mutate: (role, output, packet) => {
+                if (role === "repository-analyst")
+                    setQuestions(output, integrationQuestions);
+                if (role === "specification-writer")
+                    output.constraints = [narrowExclusion];
+                if (role !== "specification-critic-b")
+                    return;
+                const resolutions = excludedQuestions(packet);
+                reviewedIds.push(resolutions.map((entry) => entry.questionId));
+                if (reviewedIds.length === 1) {
+                    resolutions[0].outcome = "unresolved";
+                    resolutions[0].detail = `private-reference-question-1 ${privateCode} ${f.referenceCommit}`;
+                }
+                setResolutions(output, resolutions);
+            }
+        }, calls);
+        assert.equal(result.modelCalls.length, 7);
+        assert.deepEqual(reviewedIds, [
+            ["private-reference-question-1", "private-reference-question-2"],
+            ["private-reference-question-1", "private-reference-question-2"]
+        ]);
+        assert.deepEqual(result.specificationRevisions?.map((entry) => entry.rejectionReasons.length > 0), [true, false]);
+        assertPrivate(calls, f);
+        const revision = calls.find((call) => call.foundryRole === "specification-writer" &&
+            call.operationId.includes(":specification-revision:1:"));
+        assert.ok(revision.input.includes("behavioralReviewFeedback"));
+        assert.equal(revision.input.includes("private-reference-question-"), false);
+    }
+    finally {
+        await rm(f.root, { recursive: true, force: true });
+    }
+});