@velum-labs/routekit-eval-setup 1.3.2 → 1.5.0

package/dist/test/repository-solution-edits.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/repository-solution-edits.test.js

@@ -0,0 +1,377 @@
+import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { test } from "node:test";
+import { promisify } from "node:util";
+import { Effect, Layer, Schema } from "effect";
+import { loadPinnedSolutionEditSourcesV1, materializeSolutionFileOverridesV1, RepositorySolutionFileOutputV1 } from "../adapters/repository-solution-edits.js";
+import { strictAuthoringSchema } from "../adapters/strict-authoring-schema.js";
+import { EvalAuthoringTransport } from "../project-authoring.js";
+import { repositoryFoundryModelPlanV1 } from "../repository-language-model-protocol.js";
+import { generateRepositorySolutionProposalV1 } from "../services/case-generation/service.js";
+import { RepositoryFoundryProgressLive } from "../services/foundry-progress/service.js";
+import { RepositoryFoundryLanguageModelLive } from "../services/language-model/service.js";
+const path = "src/wire.js";
+const apply = (content, edits, visibleExcerpt = content) => materializeSolutionFileOverridesV1({
+    fileOverrides: [{ path, edits }],
+    sources: [{ path, content, visibleExcerpt }],
+    allowedPaths: new Set([path])
+});
+test("exact edits preserve all untouched bytes and apply original ranges without chaining", () => {
+    const base = "first=A; second=B;\r\n// preserved π suffix\r\n";
+    const result = apply(base, [
+        { search: "first=A", replace: "first=B; inserted=B" },
+        { search: "second=B", replace: "second=C" }
+    ], "first=A; second=B;\r\n[truncated]");
+    assert.equal(result.fileOverrides[0]?.content, "first=B; inserted=B; second=C;\r\n// preserved π suffix\r\n");
+    assert.deepEqual(result.provenance[0]?.ranges, [
+        { start: 0, end: 7 },
+        { start: 9, end: 17 }
+    ]);
+    assert.match(result.provenance[0].baseSha256, /^[a-f0-9]{64}$/u);
+    assert.notEqual(result.provenance[0]?.baseSha256, result.provenance[0]?.resultSha256);
+    assert.throws(() => apply("original", [
+        { search: "original", replace: "new text" },
+        { search: "new text", replace: "chained" }
+    ]), /match once/u);
+});
+test("exact edits permit anchored insertions, deletion and adjacent nonoverlapping edits", () => {
+    assert.equal(apply("left middle right", [{ search: "middle ", replace: "" }]).fileOverrides[0]?.content, "left right");
+    assert.equal(apply("left right", [{ search: "left ", replace: "left inserted " }]).fileOverrides[0]?.content, "left inserted right");
+    assert.equal(apply("AB", [
+        { search: "A", replace: "C" },
+        { search: "B", replace: "D" }
+    ]).fileOverrides[0]?.content, "CD");
+});
+test("exact edits reject absent, repeated, overlapping and unseen search targets", () => {
+    for (const [base, edits, visible] of [
+        ["abc", [{ search: "missing", replace: "x" }], "abc"],
+        ["aa aa", [{ search: "aa", replace: "x" }], "aa aa"],
+        ["aaa", [{ search: "aa", replace: "x" }], "aaa"],
+        ["unique tail unique", [{ search: "unique", replace: "x" }], "unique [truncated]"],
+        ["visible hidden", [{ search: "hidden", replace: "x" }], "visible [truncated]"],
+        [
+            "abcde",
+            [
+                { search: "abc", replace: "x" },
+                { search: "bcd", replace: "y" }
+            ],
+            "abcde"
+        ],
+        [
+            "abc",
+            [
+                { search: "abc", replace: "x" },
+                { search: "abc", replace: "y" }
+            ],
+            "abc"
+        ]
+    ]) {
+        assert.throws(() => apply(base, edits, visible), /match once|overlap/u);
+    }
+    assert.throws(() => apply("abc", [{ search: "", replace: "x" }]), /nonempty/u);
+    assert.throws(() => apply("abc", [{ search: "abc", replace: "abc" }]), /change/u);
+    assert.throws(() => apply("abc", []), /between one and 32/u);
+    assert.throws(() => apply("abc", [{ search: "abc", replace: "" }]), /empty/u);
+    assert.throws(() => apply("abc", [{ search: "abc", replace: "x".repeat(256_001) }]), /file size bound/u);
+});
+test("materialization enforces exact path allowlists and retains legacy full-file compatibility", () => {
+    const sources = [{ path, content: "base", visibleExcerpt: "base" }];
+    for (const denied of [
+        "../src/wire.js",
+        "/src/wire.js",
+        "src/../wire.js",
+        "src\\wire.js",
+        "src//wire.js",
+        "src/other.js",
+        "src/wire.js\0"
+    ]) {
+        assert.throws(() => materializeSolutionFileOverridesV1({
+            fileOverrides: [{ path: denied, edits: [{ search: "base", replace: "next" }] }],
+            sources,
+            allowedPaths: new Set([path])
+        }), /unsafe|unreviewed/u);
+    }
+    assert.throws(() => materializeSolutionFileOverridesV1({
+        fileOverrides: [
+            { path, content: "one" },
+            { path, content: "two" }
+        ],
+        sources,
+        allowedPaths: new Set([path])
+    }), /duplicate/u);
+    assert.throws(() => materializeSolutionFileOverridesV1({
+        fileOverrides: [{ path, edits: [{ search: "base", replace: "next" }] }],
+        sources: [],
+        allowedPaths: new Set([path])
+    }), /complete pinned/u);
+    const legacy = [{ path, content: "legacy full-file output" }];
+    assert.deepEqual(materializeSolutionFileOverridesV1({
+        fileOverrides: legacy,
+        sources,
+        allowedPaths: new Set([path])
+    }).fileOverrides, legacy);
+});
+test("the model-facing nested union is strict and accepts both compact and legacy fixtures", () => {
+    const schema = Schema.Struct({ fileOverrides: Schema.Array(RepositorySolutionFileOutputV1) });
+    const document = Schema.toJsonSchemaDocument(schema);
+    const strict = strictAuthoringSchema({ ...document.schema, $defs: document.definitions });
+    const visit = (value) => {
+        if (typeof value !== "object" || value === null)
+            return;
+        const object = value;
+        if (object.type === "object") {
+            assert.equal(object.additionalProperties, false);
+            assert.deepEqual([...object.required].sort(), Object.keys(object.properties).sort());
+        }
+        for (const entry of Object.values(object))
+            visit(entry);
+    };
+    visit(strict.jsonSchema);
+    for (const file of [
+        { path, content: "legacy" },
+        { path, edits: [{ search: "base", replace: "next" }] }
+    ]) {
+        const output = { fileOverrides: [file] };
+        assert.deepEqual(Schema.decodeUnknownSync(schema)(strict.normalizeResponse(output)), output);
+    }
+});
+test("ten variants of a real 20KB source fixture require over 95 percent less model output", () => {
+    const base = "export const wire = value => value;\n" + "// unchanged context\n".repeat(1_024);
+    assert.ok(Buffer.byteLength(base) >= 20_000);
+    const raw = Array.from({ length: 10 }, (_, index) => ({
+        path,
+        edits: [{ search: "value => value", replace: `value => value + ${index + 1}` }]
+    }));
+    const full = raw.map(({ edits }) => apply(base, edits, base.slice(0, 100) + "\n[truncated]").fileOverrides[0]);
+    assert.ok(Buffer.byteLength(JSON.stringify(raw)) < Buffer.byteLength(JSON.stringify(full)) * 0.05);
+    for (const entry of full)
+        assert.ok(entry?.content.endsWith("// unchanged context\n".repeat(1_024)));
+});
+test("edit bases come only from reviewed existing paths in the pinned initial tree", async () => {
+    const root = await mkdtemp(join(tmpdir(), "routekit-edit-base-"));
+    const git = async (...args) => (await promisify(execFile)("git", ["-C", root, ...args], { encoding: "utf8" })).stdout.trim();
+    try {
+        await git("init", "-q");
+        await git("config", "user.name", "Foundry Test");
+        await git("config", "user.email", "foundry@example.test");
+        await mkdir(join(root, "src"));
+        await writeFile(join(root, path), "initial visible prefix\nPRIVATE UNSEEN INITIAL SUFFIX\n");
+        await writeFile(join(root, "src/denied.js"), "DENIED SOURCE\n");
+        await git("add", ".");
+        await git("commit", "-qm", "initial");
+        const initialCommit = await git("rev-parse", "HEAD");
+        await writeFile(join(root, path), "REFERENCE POST-CHANGE SOURCE\n");
+        await git("commit", "-qam", "reference");
+        await writeFile(join(root, path), "MUTABLE WORKTREE SOURCE\n");
+        const sources = await Effect.runPromise(loadPinnedSolutionEditSourcesV1({
+            repositoryRoot: root,
+            initialCommit,
+            visibleSources: [
+                { path, content: "initial visible" },
+                { path, content: "initial visible prefix\n[truncated]" },
+                { path: "src/denied.js", content: "DENIED SOURCE" },
+                { path: "src/missing.js", content: "invented" }
+            ],
+            allowedPaths: new Set([path, "src/missing.js"])
+        }));
+        assert.equal(sources.length, 1);
+        assert.equal(sources[0]?.visibleExcerpt, "initial visible prefix\n[truncated]");
+        assert.equal(sources[0]?.additionalVisibleExcerpts, undefined);
+        assert.equal(sources[0]?.content, "initial visible prefix\nPRIVATE UNSEEN INITIAL SUFFIX\n");
+        assert.doesNotMatch(JSON.stringify(sources), /REFERENCE|WORKTREE|DENIED SOURCE/u);
+        const result = materializeSolutionFileOverridesV1({
+            fileOverrides: [
+                { path, edits: [{ search: "initial visible prefix", replace: "updated visible prefix" }] }
+            ],
+            sources,
+            allowedPaths: new Set([path])
+        });
+        assert.equal(result.fileOverrides[0]?.content, "updated visible prefix\nPRIVATE UNSEEN INITIAL SUFFIX\n");
+        const separate = await Effect.runPromise(loadPinnedSolutionEditSourcesV1({
+            repositoryRoot: root,
+            initialCommit,
+            visibleSources: [
+                { path, content: "initial visible prefix\n" },
+                { path, content: "INITIAL SUFFIX\n" }
+            ],
+            allowedPaths: new Set([path])
+        }));
+        assert.equal(separate.length, 1);
+        assert.deepEqual(separate[0]?.additionalVisibleExcerpts, ["INITIAL SUFFIX\n"]);
+        assert.equal(materializeSolutionFileOverridesV1({
+            fileOverrides: [{ path, edits: [{ search: "INITIAL SUFFIX", replace: "SUPPLIED SUFFIX" }] }],
+            sources: separate,
+            allowedPaths: new Set([path])
+        }).fileOverrides[0]?.content, "initial visible prefix\nPRIVATE UNSEEN SUPPLIED SUFFIX\n");
+        assert.throws(() => materializeSolutionFileOverridesV1({
+            fileOverrides: [{ path, edits: [{ search: "prefix\nPRIVATE UNSEEN INITIAL", replace: "invented bridge" }] }],
+            sources: separate,
+            allowedPaths: new Set([path])
+        }), /match once/u);
+        const adjacent = await Effect.runPromise(loadPinnedSolutionEditSourcesV1({
+            repositoryRoot: root,
+            initialCommit,
+            visibleSources: [
+                { path, content: "initial visible " },
+                { path, content: "prefix\n" }
+            ],
+            allowedPaths: new Set([path])
+        }));
+        assert.throws(() => materializeSolutionFileOverridesV1({
+            fileOverrides: [{ path, edits: [{ search: "visible prefix", replace: "joined snippets" }] }],
+            sources: adjacent,
+            allowedPaths: new Set([path])
+        }), /match once/u, "adjacent snippets cannot invent a larger visible anchor by concatenation");
+    }
+    finally {
+        await rm(root, { recursive: true, force: true });
+    }
+});
+test("all solution roles retain raw edits and separate host provenance without leaking full bases into model inputs", async () => {
+    for (const role of [
+        "valid-solution-generator-a",
+        "valid-solution-generator-b",
+        "adversary",
+        "held-out-adversary"
+    ]) {
+        for (const repair of [false, true]) {
+            const operationId = `${role}${repair ? ":repair-1" : ""}`;
+            const kind = role.startsWith("valid-") ? "independent-valid" : "mutation";
+            const raw = {
+                solutions: [
+                    {
+                        id: "candidate",
+                        family: "wire",
+                        kind,
+                        fileOverrides: [
+                            { path, edits: [{ search: "visible original", replace: "visible changed" }] }
+                        ]
+                    }
+                ]
+            };
+            const rawText = JSON.stringify(raw);
+            const artifacts = [];
+            const events = [];
+            const transport = Layer.succeed(EvalAuthoringTransport, EvalAuthoringTransport.of({
+                complete: (request) => {
+                    assert.match(request.instructions, /ORIGINAL pre-change source/u);
+                    assert.doesNotMatch(request.input, /HOST ONLY SUFFIX|REFERENCE_SECRET|ORACLE_SECRET/u);
+                    return Effect.succeed(rawText);
+                }
+            }));
+            const result = await Effect.runPromise(generateRepositorySolutionProposalV1({
+                request: {
+                    plan: repositoryFoundryModelPlanV1({ primaryModel: "codex/gpt-6-astra" }),
+                    role,
+                    operationId,
+                    instructions: "Solve from visible context only",
+                    schemaName: "solution",
+                    maximumOutputTokens: 512,
+                    input: { preChangeSources: [{ path, content: "visible original\n[truncated]" }] }
+                },
+                initialCommit: "1".repeat(40),
+                editSources: [
+                    {
+                        path,
+                        content: "visible original\nHOST ONLY SUFFIX\n",
+                        visibleExcerpt: "visible original\n[truncated]"
+                    }
+                ],
+                allowedSolutionPaths: new Set([path]),
+                allowedRewardHackingPaths: new Set([path])
+            }).pipe(Effect.provide(Layer.merge(RepositoryFoundryLanguageModelLive.pipe(Layer.provide(transport)), RepositoryFoundryProgressLive((event) => Effect.sync(() => {
+                events.push(event);
+            }), (artifact) => Effect.sync(() => {
+                artifacts.push(artifact);
+            }))))));
+            assert.equal(result.call.operationId, operationId);
+            assert.deepEqual(result.rawProposal, raw);
+            assert.deepEqual(result.value.solutions[0]?.fileOverrides, [
+                { path, content: "visible changed\nHOST ONLY SUFFIX\n" }
+            ]);
+            assert.equal(artifacts[0]?.response.text, rawText);
+            assert.deepEqual(artifacts.find((entry) => entry.operationId === operationId && entry.validation === "validated")?.value, raw);
+            const materialized = artifacts.find((entry) => entry.operationId === `${operationId}:materialized`);
+            assert.equal(materialized?.role, "host-exact-edit-materializer");
+            assert.equal(materialized?.request.maximumOutputTokens, 0);
+            assert.deepEqual(materialized?.request.input, {
+                sourceModelOperationId: operationId,
+                initialCommit: "1".repeat(40)
+            });
+            assert.match(JSON.stringify(materialized?.value), /baseSha256|resultSha256/u);
+            assert.doesNotMatch(JSON.stringify(events), /HOST ONLY SUFFIX|visible original|visible changed/u);
+            assert.equal(events.filter((event) => event.kind === "model-call" && event.phase === "start").length, 1);
+        }
+    }
+});
+test("visible protected manifests remain editable only by explicitly classified adversarial reward hacks", async () => {
+    const manifest = '{"scripts":{"test":"node --test"}}';
+    for (const role of ["valid-solution-generator-a", "valid-solution-generator-b", "adversary", "held-out-adversary"]) {
+        for (const kind of ["mutation", "reward-hacking"]) {
+            const raw = { solutions: [{ id: "manifest-control", family: "test-command", kind,
+                        fileOverrides: [{ path: "package.json", edits: [{ search: "node --test", replace: "node --version" }] }]
+                    }] };
+            const transport = Layer.succeed(EvalAuthoringTransport, EvalAuthoringTransport.of({
+                complete: () => Effect.succeed(JSON.stringify(raw))
+            }));
+            const run = generateRepositorySolutionProposalV1({
+                request: {
+                    plan: repositoryFoundryModelPlanV1({ primaryModel: "codex/gpt-6-astra" }),
+                    role, operationId: `${role}:${kind}`, instructions: "Use only reviewed paths.",
+                    schemaName: "protected_manifest_regression", maximumOutputTokens: 512,
+                    input: { repositoryEnvironment: { sources: [{ path: "package.json", content: manifest }] } }
+                },
+                initialCommit: "1".repeat(40),
+                editSources: [{ path: "package.json", content: manifest, visibleExcerpt: manifest }],
+                allowedSolutionPaths: new Set([path]),
+                allowedRewardHackingPaths: new Set([path, "package.json"])
+            }).pipe(Effect.provide(RepositoryFoundryLanguageModelLive.pipe(Layer.provide(transport))));
+            if ((role === "adversary" || role === "held-out-adversary") && kind === "reward-hacking") {
+                const result = await Effect.runPromise(run);
+                assert.equal(result.value.solutions[0]?.fileOverrides[0]?.content, manifest.replace("node --test", "node --version"));
+            }
+            else {
+                await assert.rejects(Effect.runPromise(run), /unreviewed path/u);
+            }
+        }
+    }
+});
+test("compact proposals cannot expand beyond the 32MiB host materialization bound", async () => {
+    const content = "VALUE=0;\n" + "x".repeat(255_900);
+    assert.ok(Buffer.byteLength(content) <= 256_000);
+    const raw = {
+        solutions: Array.from({ length: 134 }, (_, index) => ({
+            id: `case-${index}`,
+            family: `family-${index}`,
+            kind: "mutation",
+            fileOverrides: [{ path, edits: [{ search: "VALUE=0", replace: "VALUE=1" }] }]
+        }))
+    };
+    assert.ok(Buffer.byteLength(JSON.stringify(raw)) < 32_000);
+    const artifacts = [];
+    const transport = Layer.succeed(EvalAuthoringTransport, EvalAuthoringTransport.of({
+        complete: () => Effect.succeed(JSON.stringify(raw))
+    }));
+    await assert.rejects(Effect.runPromise(generateRepositorySolutionProposalV1({
+        request: {
+            plan: repositoryFoundryModelPlanV1({ primaryModel: "codex/gpt-6-astra" }),
+            role: "adversary",
+            operationId: "bounded-expansion",
+            instructions: "Use exact edits",
+            schemaName: "solutions",
+            maximumOutputTokens: 32_768,
+            input: { preChangeSources: [{ path, content: "VALUE=0;\n[truncated]" }] }
+        },
+        initialCommit: "1".repeat(40),
+        editSources: [{ path, content, visibleExcerpt: "VALUE=0;\n[truncated]" }],
+        allowedSolutionPaths: new Set([path]),
+        allowedRewardHackingPaths: new Set([path])
+    }).pipe(Effect.provide(Layer.merge(RepositoryFoundryLanguageModelLive.pipe(Layer.provide(transport)), RepositoryFoundryProgressLive(undefined, (artifact) => Effect.sync(() => {
+        artifacts.push(artifact);
+    })))))), /32MiB total source bound/u);
+    assert.ok(artifacts.some((entry) => entry.operationId === "bounded-expansion" && entry.validation === "validated"));
+    assert.ok(!artifacts.some((entry) => entry.role === "host-exact-edit-materializer"));
+});

package/dist/test/repository-specification-budget.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/repository-specification-budget.test.js

@@ -0,0 +1,171 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { assertRepositoryFoundryGenerationPlanV1, repositoryFoundryGenerationBudgetV1, repositoryFoundryGenerationPlanDigestV1 } from "../repository-foundry-plan-protocol.js";
+import { repositoryFoundryModelPlanV1 } from "../repository-language-model-protocol.js";
+const plan = (revisions, specificationContractFactsVersion, reviewInputVersion) => {
+    const unsigned = {
+        version: 1,
+        repository: { root: "/repo", requestedRef: "HEAD", commit: "commit", tree: "tree" },
+        caseId: "legacy-case",
+        ...(reviewInputVersion === undefined ? {} : { reviewInputVersion }),
+        ...(specificationContractFactsVersion === undefined ? {} : { specificationContractFactsVersion }),
+        seedId: "seed",
+        initialCommit: "initial",
+        referenceCommit: "reference",
+        modelPlan: repositoryFoundryModelPlanV1({ primaryModel: "codex/gpt-6-astra" }),
+        qualification: { batches: 2, repetitionsPerBatch: 2, oracleRepetitions: 2 },
+        budget: repositoryFoundryGenerationBudgetV1(2, undefined, revisions, undefined, undefined, reviewInputVersion, specificationContractFactsVersion)
+    };
+    return { ...unsigned, planDigest: repositoryFoundryGenerationPlanDigestV1(unsigned) };
+};
+test("absent specification revisions preserve the pre-change immutable plan digest and budget", () => {
+    const legacy = plan();
+    assert.equal(legacy.planDigest, "357e58c2853e4379791e3d1c5b9475993a65c371684c8f6a6f4c69400f1d2994");
+    assert.deepEqual(legacy.budget, {
+        plannedModelCalls: 35,
+        maximumTransientRetries: 3,
+        maximumHillClimbAttempts: 2,
+        requiredTotalInputTokens: 17_920_000,
+        requiredTotalOutputTokens: 1_671_168,
+        perCallOutputTokens: 65_536,
+        wallTimeMs: 7_200_000
+    });
+    assertRepositoryFoundryGenerationPlanV1(legacy);
+    assert.equal(Object.hasOwn(legacy, "specificationContractFactsVersion"), false);
+    assert.equal(JSON.stringify(repositoryFoundryGenerationBudgetV1(2, undefined, undefined, undefined, undefined, undefined, undefined)), JSON.stringify(legacy.budget), "an absent appended marker preserves the exact legacy budget bytes");
+});
+test("contract-fact revisions reserve one extra analyst call without expanding the retry reserve", () => {
+    for (const reviewInputVersion of [undefined, 2]) {
+        for (const revisions of [0, 1, 2]) {
+            const legacy = plan(revisions, undefined, reviewInputVersion);
+            const current = plan(revisions, 1, reviewInputVersion);
+            assertRepositoryFoundryGenerationPlanV1(legacy);
+            assertRepositoryFoundryGenerationPlanV1(current);
+            assert.equal(current.specificationContractFactsVersion, 1);
+            assert.notEqual(current.planDigest, legacy.planDigest, "even zero revisions pins the new protocol");
+            assert.deepEqual(current.budget, {
+                ...legacy.budget,
+                plannedModelCalls: legacy.budget.plannedModelCalls + revisions,
+                requiredTotalInputTokens: legacy.budget.requiredTotalInputTokens + revisions * 512_000,
+                requiredTotalOutputTokens: legacy.budget.requiredTotalOutputTokens + revisions * 32_768
+            });
+            assert.equal(current.budget.maximumTransientRetries, 3);
+            assert.equal(current.budget.perCallOutputTokens, legacy.budget.perCallOutputTokens);
+            assert.equal(Object.hasOwn(current.budget, "specificationContractFactsVersion"), false);
+        }
+    }
+});
+test("contract-fact plans require an explicit revision allowance and cannot borrow an old immutable budget", () => {
+    assert.throws(() => repositoryFoundryGenerationBudgetV1(2, undefined, undefined, undefined, undefined, undefined, 1), /explicit specification revision allowance/u);
+    for (const marker of [0, 2, -1, 0.5]) {
+        assert.throws(() => repositoryFoundryGenerationBudgetV1(2, undefined, 0, undefined, undefined, undefined, marker), /version 1/u);
+        assert.throws(() => assertRepositoryFoundryGenerationPlanV1({
+            ...plan(0, 1), specificationContractFactsVersion: marker
+        }));
+    }
+    const { planDigest: _legacyDigest, ...legacy } = plan();
+    const missingAllowance = { ...legacy, specificationContractFactsVersion: 1 };
+    assert.throws(() => assertRepositoryFoundryGenerationPlanV1({
+        ...missingAllowance, planDigest: repositoryFoundryGenerationPlanDigestV1(missingAllowance)
+    }), /explicit specification revision allowance/u);
+    for (const field of ["plannedModelCalls", "requiredTotalInputTokens", "requiredTotalOutputTokens"]) {
+        const { planDigest: _digest, ...current } = plan(2, 1);
+        const unmarked = plan(2);
+        const underreserved = {
+            ...current,
+            budget: { ...current.budget, [field]: unmarked.budget[field] }
+        };
+        assert.throws(() => assertRepositoryFoundryGenerationPlanV1({
+            ...underreserved, planDigest: repositoryFoundryGenerationPlanDigestV1(underreserved)
+        }), /immutable budget/u);
+    }
+    assert.throws(() => assertRepositoryFoundryGenerationPlanV1({
+        ...plan(0), specificationContractFactsVersion: 1
+    }), /digest/u, "a saved zero-revision plan cannot acquire a marker without a new digest");
+});
+test("each pinned specification revision reserves one writer and two independent critics", () => {
+    const legacy = plan();
+    for (const revisions of [0, 1, 2]) {
+        const current = plan(revisions);
+        assert.equal(current.budget.maximumSpecificationRevisions, revisions);
+        assert.equal(current.budget.plannedModelCalls, 35 + revisions * 3);
+        assert.equal(current.budget.requiredTotalInputTokens, 17_920_000 + revisions * 1_536_000);
+        assert.equal(current.budget.requiredTotalOutputTokens, 1_671_168 + revisions * 98_304);
+        assert.equal(current.budget.maximumTransientRetries, legacy.budget.maximumTransientRetries);
+        assert.equal(current.budget.perCallOutputTokens, legacy.budget.perCallOutputTokens);
+        assert.notEqual(current.planDigest, legacy.planDigest);
+        assertRepositoryFoundryGenerationPlanV1(current);
+    }
+});
+test("invalid revision bounds and underreserved immutable plans fail closed", () => {
+    for (const revisions of [-1, 0.5, 3, Number.NaN, Number.POSITIVE_INFINITY]) {
+        assert.throws(() => repositoryFoundryGenerationBudgetV1(2, undefined, revisions), /integer from 0 to 2/u);
+        const { planDigest: _digest, ...legacy } = plan();
+        const invalid = {
+            ...legacy,
+            budget: { ...legacy.budget, maximumSpecificationRevisions: revisions }
+        };
+        assert.throws(() => assertRepositoryFoundryGenerationPlanV1({
+            ...invalid,
+            planDigest: repositoryFoundryGenerationPlanDigestV1(invalid)
+        }));
+    }
+    for (const field of [
+        "plannedModelCalls",
+        "requiredTotalInputTokens",
+        "requiredTotalOutputTokens"
+    ]) {
+        const { planDigest: _digest, ...current } = plan(2);
+        const underreserved = {
+            ...current,
+            budget: { ...current.budget, [field]: current.budget[field] - 1 }
+        };
+        assert.throws(() => assertRepositoryFoundryGenerationPlanV1({
+            ...underreserved,
+            planDigest: repositoryFoundryGenerationPlanDigestV1(underreserved)
+        }), /immutable budget/u);
+    }
+    const current = plan(2);
+    assert.throws(() => assertRepositoryFoundryGenerationPlanV1({
+        ...current,
+        budget: repositoryFoundryGenerationBudgetV1(2, undefined, 1)
+    }), /digest/u);
+});
+test("independent fixture repair allowance and dependency context are immutable without changing legacy plans", () => {
+    const { planDigest: _digest, ...legacy } = plan(2);
+    for (const repairs of [0, 1, 2, 3]) {
+        const unsigned = {
+            version: legacy.version,
+            repository: legacy.repository,
+            caseId: legacy.caseId,
+            dependencyContextVersion: 1,
+            seedId: legacy.seedId,
+            initialCommit: legacy.initialCommit,
+            referenceCommit: legacy.referenceCommit,
+            modelPlan: legacy.modelPlan,
+            qualification: legacy.qualification,
+            budget: repositoryFoundryGenerationBudgetV1(2, undefined, 2, undefined, repairs)
+        };
+        const current = { ...unsigned, planDigest: repositoryFoundryGenerationPlanDigestV1(unsigned) };
+        assertRepositoryFoundryGenerationPlanV1(current);
+        assert.equal(current.budget.maximumHillClimbAttempts, 2);
+        assert.equal(current.budget.maximumFixtureRepairAttempts, repairs);
+        assert.equal(current.budget.plannedModelCalls, legacy.budget.plannedModelCalls + repairs);
+        assert.equal(current.budget.requiredTotalOutputTokens, legacy.budget.requiredTotalOutputTokens + repairs * 65_536);
+        assert.throws(() => assertRepositoryFoundryGenerationPlanV1({
+            ...current,
+            dependencyContextVersion: undefined
+        }));
+        const underreserved = {
+            ...unsigned,
+            budget: { ...unsigned.budget, plannedModelCalls: unsigned.budget.plannedModelCalls - 1 }
+        };
+        assert.throws(() => assertRepositoryFoundryGenerationPlanV1({
+            ...underreserved,
+            planDigest: repositoryFoundryGenerationPlanDigestV1(underreserved)
+        }));
+    }
+    for (const repairs of [-1, 0.5, 4, Number.NaN, Number.POSITIVE_INFINITY]) {
+        assert.throws(() => repositoryFoundryGenerationBudgetV1(2, undefined, 2, undefined, repairs), /fixture repairs must be an integer/u);
+    }
+});

package/dist/test/repository-specification-contract-checkpoint.test.d.ts

@@ -0,0 +1 @@
+export {};