@warpgogol/forge 5.3.3 → 6.0.0

package/os/compass/handlers/tests/compass-audit-validate.test.ts

@@ -16,6 +16,7 @@ import { join } from "node:path";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { runCompassAuditValidate } from "../compass-audit-handler.ts";
+import { ambientIo } from "../../../../src/utils/io.ts";
 import type { ForgeCommandInput, ForgeRuntimeContext } from "../../../../src/types.ts";
 
 const execFileAsync = promisify(execFile);
@@ -31,15 +32,15 @@ const logger = {
   },
 };
 
-function makeContext(workspaceRoot: string): ForgeRuntimeContext {
+function makeContext(workspaceRoot: string, dryRun = false): ForgeRuntimeContext {
   return {
     workspaceRoot,
     site: undefined,
     siteExplicit: false,
     logger: logger as never,
-    dryRun: false,
+    dryRun,
     outputFormat: "json",
-    io: {} as never,
+    io: ambientIo,
     actualState: undefined as never,
     fileIntents: [],
   } as unknown as ForgeRuntimeContext;
@@ -131,3 +132,91 @@ describe("compass.audit.validate — RFC-1143 ledger-ineligible skips", () => {
     expect(data.skippedIneligible).toBeGreaterThan(0);
   });
 });
+
+// RFC-1242 AC-5/AC-6: --prune drops ledger entries for paths that no longer
+// exist while preserving every surviving entry's verdict fields.
+const DEAD_PATH = "packages/gone/deleted.ts";
+const LEDGER_ENTRY = (path: string) =>
+  `  - path: ${path}\n    entityId: "eid-${path}"\n    auditedRevision: 7\n    auditedHash: "hash-${path}"\n    auditedAt: "2026-01-01T00:00:00Z"\n    verdict: pass\n    agent: human:test\n`;
+
+describe("compass.audit.validate --prune — RFC-1242", () => {
+  let root: string;
+
+  beforeEach(async () => {
+    root = await mkdtemp(join(tmpdir(), "compass-prune-"));
+    await mkdir(join(root, "packages", "foo"), { recursive: true });
+    await mkdir(join(root, "docs"), { recursive: true });
+    await writeFile(join(root, "packages", "foo", "index.ts"), "export const x = 1;\n", "utf8");
+    await writeFile(
+      join(root, "docs", "compass-audit-ledger.generated.yaml"),
+      `entries:\n${LEDGER_ENTRY(ELIGIBLE_FILE)}${LEDGER_ENTRY(DEAD_PATH)}`,
+      "utf8",
+    );
+    await execFileAsync("git", ["init"], { cwd: root });
+    await execFileAsync("git", ["config", "user.email", "test@test.com"], { cwd: root });
+    await execFileAsync("git", ["config", "user.name", "Test"], { cwd: root });
+    await execFileAsync("git", ["add", "."], { cwd: root });
+    await execFileAsync("git", ["commit", "-m", "init"], { cwd: root });
+  });
+
+  afterEach(async () => {
+    await rm(root, { recursive: true, force: true });
+  });
+
+  it("AC-5: ledger contains no entry whose path does not exist after prune", async () => {
+    const result = await runCompassAuditValidate(
+      makeInput({ prune: true, root: ["packages"] }),
+      makeContext(root),
+    );
+    const data = result.data as { pruned: number; prunedPaths: string[] };
+    expect(data.pruned).toBe(1);
+    expect(data.prunedPaths).toEqual([DEAD_PATH]);
+    const { readFile } = await import("node:fs/promises");
+    const ledgerText = await readFile(
+      join(root, "docs", "compass-audit-ledger.generated.yaml"),
+      "utf8",
+    );
+    expect(ledgerText).not.toContain(DEAD_PATH);
+    expect(ledgerText).toContain(ELIGIBLE_FILE);
+  });
+
+  it("AC-6: surviving entries keep their verdict fields unchanged", async () => {
+    await runCompassAuditValidate(
+      makeInput({ prune: true, root: ["packages"] }),
+      makeContext(root),
+    );
+    const { readFile } = await import("node:fs/promises");
+    const { parse } = await import("yaml");
+    const ledger = parse(
+      await readFile(join(root, "docs", "compass-audit-ledger.generated.yaml"), "utf8"),
+    ) as { entries: Array<Record<string, unknown>> };
+    const survivor = ledger.entries.find((e) => e.path === ELIGIBLE_FILE);
+    expect(
+      survivor,
+      "surviving ledger entry must keep its verdict fields — check the keep/drop partition",
+    ).toMatchObject({
+      entityId: `eid-${ELIGIBLE_FILE}`,
+      auditedRevision: 7,
+      auditedHash: `hash-${ELIGIBLE_FILE}`,
+      auditedAt: "2026-01-01T00:00:00Z",
+      verdict: "pass",
+      agent: "human:test",
+    });
+  });
+
+  it("--prune --dry-run reports the drop set without rewriting the ledger", async () => {
+    const { readFile } = await import("node:fs/promises");
+    const ledgerPath = join(root, "docs", "compass-audit-ledger.generated.yaml");
+    const before = await readFile(ledgerPath, "utf8");
+    const result = await runCompassAuditValidate(
+      makeInput({ prune: true, root: ["packages"] }),
+      makeContext(root, true),
+    );
+    const data = result.data as { pruned: number };
+    expect(data.pruned).toBe(1);
+    expect(
+      await readFile(ledgerPath, "utf8"),
+      "dry-run must not rewrite the ledger — writes must route through context.io honoring context.dryRun",
+    ).toBe(before);
+  });
+});

package/os/compass/handlers/tests/compass-docs-validate.test.ts

@@ -0,0 +1,203 @@
+/*
+<MODULE_CONTRACT>
+  <purpose>
+    RFC-1242 AC-1..AC-4: compass.docs.validate scans the docs/*.xml corpus and
+    must fail on unresolvable <path> entries (COMPASS-DOC-01) and dead workspace
+    ids (COMPASS-DOC-02), warn on unresolvable link targets (COMPASS-DOC-03),
+    and flag malformed XML (COMPASS-DOC-00). A green corpus exits 0 with
+    status-shaped data.
+  </purpose>
+</MODULE_CONTRACT>
+*/
+
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { mkdtemp, mkdir, writeFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { runCompassDocsValidate } from "../compass-docs-validate.ts";
+import { ambientIo } from "../../../../src/utils/io.ts";
+import type { Diagnostic, ForgeCommandInput, ForgeRuntimeContext } from "../../../../src/types.ts";
+
+const logger = {
+  section() {},
+  info() {},
+  warn() {},
+  error() {},
+  success() {},
+  getEvents() {
+    return [];
+  },
+};
+
+function makeContext(workspaceRoot: string): ForgeRuntimeContext {
+  return {
+    workspaceRoot,
+    site: undefined,
+    siteExplicit: false,
+    logger: logger as never,
+    dryRun: false,
+    outputFormat: "json",
+    io: ambientIo,
+    actualState: undefined as never,
+    fileIntents: [],
+  } as unknown as ForgeRuntimeContext;
+}
+
+function makeInput(): ForgeCommandInput {
+  return { argv: [], flags: {} } as unknown as ForgeCommandInput;
+}
+
+const GREEN_DOC = `<root>
+  <path>\`docs/other.xml\`</path>
+  <workspace id="pkg-foo"><path>\`packages/foo\`</path></workspace>
+  <node id="packages.foo" type="package"><path>\`packages/foo\`</path></node>
+  <node id="root.a" type="compass-doc"><link rel="binds-to" target="root.b" /></node>
+  <node id="root.b" type="compass-doc" />
+</root>
+`;
+
+describe("compass.docs.validate — RFC-1242", () => {
+  let root: string;
+
+  beforeEach(async () => {
+    root = await mkdtemp(join(tmpdir(), "compass-docs-"));
+    await mkdir(join(root, "docs"), { recursive: true });
+    await mkdir(join(root, "packages", "foo"), { recursive: true });
+    await writeFile(join(root, "packages", "foo", "index.ts"), "export {};\n", "utf8");
+  });
+
+  afterEach(async () => {
+    await rm(root, { recursive: true, force: true });
+  });
+
+  it("AC-2: green corpus exits 0 and reports scanned counts", async () => {
+    await writeFile(join(root, "docs", "a.xml"), GREEN_DOC, "utf8");
+    await writeFile(join(root, "docs", "other.xml"), "<root/>", "utf8");
+    const result = await runCompassDocsValidate(makeInput(), makeContext(root));
+    expect(result.exitCode).toBe(0);
+    const data = result.data as {
+      scanned: { xmlFiles: number; pathsChecked: number; idsChecked: number };
+      diagnostics: Diagnostic[];
+    };
+    expect(data.scanned.xmlFiles).toBe(2);
+    expect(data.diagnostics).toEqual([]);
+  });
+
+  it("AC-3: dead <path> emits COMPASS-DOC-01 error", async () => {
+    await writeFile(
+      join(root, "docs", "a.xml"),
+      `<root><path>\`packages/gone\`</path></root>`,
+      "utf8",
+    );
+    const result = await runCompassDocsValidate(makeInput(), makeContext(root));
+    const diagnostics = (result.data as { diagnostics: Diagnostic[] }).diagnostics;
+    expect(
+      diagnostics.some((d) => d.ruleId === "COMPASS-DOC-01" && d.severity === "error"),
+      "dead <path> must emit COMPASS-DOC-01 — check pathTokens/pathCheckTarget resolution",
+    ).toBe(true);
+  });
+
+  it("AC-4: dead <path> produces a non-zero exit", async () => {
+    await writeFile(
+      join(root, "docs", "a.xml"),
+      `<root><path>\`packages/gone\`</path></root>`,
+      "utf8",
+    );
+    const result = await runCompassDocsValidate(makeInput(), makeContext(root));
+    expect(result.exitCode).toBe(1);
+  });
+
+  it("dead workspace id emits COMPASS-DOC-02 error", async () => {
+    await writeFile(join(root, "docs", "a.xml"), `<root><workspace id="pkg-gone"/></root>`, "utf8");
+    const result = await runCompassDocsValidate(makeInput(), makeContext(root));
+    const diagnostics = (result.data as { diagnostics: Diagnostic[] }).diagnostics;
+    expect(
+      diagnostics.some((d) => d.ruleId === "COMPASS-DOC-02" && d.message.includes("pkg-gone")),
+      "dead workspace id must emit COMPASS-DOC-02 — check workspaceIdTarget mapping",
+    ).toBe(true);
+    expect(result.exitCode).toBe(1);
+  });
+
+  it("glob-tail <path> resolves against the parent directory", async () => {
+    await writeFile(
+      join(root, "docs", "a.xml"),
+      `<root><path>\`packages/*\`</path></root>`,
+      "utf8",
+    );
+    const result = await runCompassDocsValidate(makeInput(), makeContext(root));
+    expect(result.exitCode).toBe(0);
+  });
+
+  it("unresolvable link target emits COMPASS-DOC-03 warning, never an error", async () => {
+    await writeFile(
+      join(root, "docs", "a.xml"),
+      `<root><node id="x"><link rel="binds-to" target="docs.rfcs.rfc-9999" /></node></root>`,
+      "utf8",
+    );
+    const result = await runCompassDocsValidate(makeInput(), makeContext(root));
+    const diagnostics = (result.data as { diagnostics: Diagnostic[] }).diagnostics;
+    expect(
+      diagnostics.some((d) => d.ruleId === "COMPASS-DOC-03" && d.severity === "warning"),
+      "dangling link target must warn via COMPASS-DOC-03",
+    ).toBe(true);
+    expect(result.exitCode).toBe(0);
+  });
+
+  it("link target resolving to an archived RFC file passes", async () => {
+    await mkdir(join(root, "docs", "rfcs", "archive"), { recursive: true });
+    await writeFile(join(root, "docs", "rfcs", "archive", "rfc-0097-old.md"), "x", "utf8");
+    await writeFile(
+      join(root, "docs", "a.xml"),
+      `<root><node id="x"><link rel="binds-to" target="docs.rfcs.rfc-0097" /></node></root>`,
+      "utf8",
+    );
+    const result = await runCompassDocsValidate(makeInput(), makeContext(root));
+    expect(result.exitCode).toBe(0);
+  });
+
+  it("malformed XML emits COMPASS-DOC-00 and skips ref checks for that file", async () => {
+    await writeFile(join(root, "docs", "a.xml"), `<root><name>oops</root>`, "utf8");
+    const result = await runCompassDocsValidate(makeInput(), makeContext(root));
+    const diagnostics = (result.data as { diagnostics: Diagnostic[] }).diagnostics;
+    expect(diagnostics.some((d) => d.ruleId === "COMPASS-DOC-00")).toBe(true);
+    expect(diagnostics.some((d) => d.ruleId === "COMPASS-DOC-01")).toBe(false);
+    expect(result.exitCode).toBe(1);
+  });
+
+  it("quoted attribute value ending in / is not misread as self-closing", async () => {
+    await writeFile(
+      join(root, "docs", "a.xml"),
+      `<root><node id="x" type="compass-doc" path="docs/"><link rel="binds-to" target="x" /></node></root>`,
+      "utf8",
+    );
+    const result = await runCompassDocsValidate(makeInput(), makeContext(root));
+    const diagnostics = (result.data as { diagnostics: Diagnostic[] }).diagnostics;
+    expect(diagnostics.some((d) => d.ruleId === "COMPASS-DOC-00")).toBe(false);
+    expect(result.exitCode).toBe(0);
+  });
+
+  it("docs.plans.plan-rfc-* link target resolves to a plan-*.md basename", async () => {
+    await mkdir(join(root, "docs", "plans"), { recursive: true });
+    await writeFile(join(root, "docs", "plans", "plan-rfc-1242-x.md"), "x", "utf8");
+    await writeFile(
+      join(root, "docs", "a.xml"),
+      `<root><node id="x"><link rel="binds-to" target="docs.plans.plan-rfc-1242-x" /></node></root>`,
+      "utf8",
+    );
+    const result = await runCompassDocsValidate(makeInput(), makeContext(root));
+    const diagnostics = (result.data as { diagnostics: Diagnostic[] }).diagnostics;
+    expect(diagnostics.some((d) => d.ruleId === "COMPASS-DOC-03")).toBe(false);
+  });
+
+  it("AC-1: result data carries command-shaped payload fields", async () => {
+    await writeFile(join(root, "docs", "a.xml"), GREEN_DOC, "utf8");
+    await writeFile(join(root, "docs", "other.xml"), "<root/>", "utf8");
+    const result = await runCompassDocsValidate(makeInput(), makeContext(root));
+    const data = result.data as Record<string, unknown>;
+    expect(data).toHaveProperty("command", "compass.docs.validate");
+    expect(data).toHaveProperty("status", "pass");
+    expect(data).toHaveProperty("scanned");
+    expect(data).toHaveProperty("diagnostics");
+    expect(Array.isArray(data.diagnostics)).toBe(true);
+  });
+});

package/os/compass/handlers/tests/compass-ledger-scope.test.ts

@@ -16,6 +16,7 @@ import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { parse as yamlParse } from "yaml";
 import { runCompassAuditBaseline } from "../compass-audit-handler.ts";
+import { ambientIo } from "../../../../src/utils/io.ts";
 import type { ForgeCommandInput, ForgeRuntimeContext } from "../../../../src/types.ts";
 
 const execFileAsync = promisify(execFile);
@@ -39,7 +40,7 @@ function makeContext(workspaceRoot: string): ForgeRuntimeContext {
     logger: logger as never,
     dryRun: false,
     outputFormat: "json",
-    io: {} as never,
+    io: ambientIo,
     actualState: undefined as never,
     fileIntents: [],
   } as unknown as ForgeRuntimeContext;

package/os/compass/handlers/tests/compass-policy.test.ts

@@ -9,6 +9,8 @@ the named-config-error contract.</purpose>
 </MODULE_CONTRACT>
 <CHANGE_SUMMARY>
   <item>RFC-1096: initial coverage for resolveCompassPolicy (AC-1..AC-5).</item>
+  <item>RFC-1220: step 1 — widen governance-ID tail regex</item>
+  <item>RFC-1220: fo-review — F-1 shared forge-yaml fixture, F-2 temp-dir cleanup</item>
 </CHANGE_SUMMARY>
 */
 
@@ -23,6 +25,7 @@ import {
   parseGovernanceIdParts,
 } from "../../policy.ts";
 import { runCompassInventory } from "../compass-inventory-handler.ts";
+import { forgeYaml } from "./forge-yaml-fixture.ts";
 import type { ForgeRuntimeContext } from "../../../../src/types.ts";
 
 // packages/forge — real forge root so `profile:` resolution finds shipped profiles.
@@ -30,24 +33,7 @@ const FORGE_ROOT = fileURLToPath(new URL("../../../../", import.meta.url));
 // os/compass directory — scanned by the AC-4 literal check.
 const COMPASS_DIR = fileURLToPath(new URL("../../", import.meta.url));
 
-const FORGE_YAML = (bindings: string) => `
-schema: forge/config@1
-project:
-  name: test-ws
-  stack: [typescript]
-  packageManager: pnpm
-paths:
-  rfcsDir: docs/rfcs
-  adrsDir: docs/adrs
-  plansDir: docs/plans
-  auditsDir: docs/audits
-  specsDir: docs/specs
-  skillsDir: .agents/skills
-bindings:
-  schema: forge/bindings@1
-  commands: {}
-  paths: {}
-${bindings}`;
+const FORGE_YAML = forgeYaml;
 
 const FORGE_YAML_WITH_PROFILE = `
 schema: forge/config@1
@@ -246,4 +232,15 @@ describe("resolveCompassPolicy (RFC-1096)", () => {
     });
     expect(parseGovernanceIdParts("no-number")).toBeNull();
   });
+
+  it("parseGovernanceIdParts accepts mission-format tails (RFC-1220)", () => {
+    expect(parseGovernanceIdParts("acme-m000175")).toEqual({
+      namespace: "acme",
+      numeric: 175,
+    });
+    expect(parseGovernanceIdParts("acme-m1")).toEqual({ namespace: "acme", numeric: 1 });
+    // Bare "m" without digits is not a numeric tail.
+    expect(parseGovernanceIdParts("acme-m")).toBeNull();
+    expect(parseGovernanceIdParts("no-number")).toBeNull();
+  });
 });

package/os/compass/handlers/tests/compass-v2-contract.test.ts

@@ -3,6 +3,7 @@ import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { tmpdir } from "node:os";
 import { runCompassValidation, runCompassInventory } from "../compass-inventory-handler.ts";
+import { writeForgeYaml } from "./forge-yaml-fixture.ts";
 import type {
   ForgeCommandInput,
   ForgeCommandResult,
@@ -51,6 +52,13 @@ const MEDIUM_FILE = "packages/fixture-pkg/src/components/mission-widget.ts";
 // Low-risk path: bare src/** maps to layer "source" → riskClass low.
 const LOW_FILE = "packages/fixture-pkg/src/mission-notes.ts";
 
+// Generic NS-NNN alternative plus a mission-tail alternative (RFC-1220).
+// Single-quoted YAML keeps backslashes literal — JS "\\b" emits regex "\b".
+const MISSION_ID_PATTERN = "\\b(?:[A-Z][A-Z0-9]*-)+\\d+\\b|\\b[a-z][a-z0-9-]*-m\\d{6}\\b";
+// Admits a no-digit-tail token that passes idPatternFull yet cannot parse —
+// simulates future policy/parser drift (RFC-1220 fail-closed path).
+const DRIFT_ID_PATTERN = "\\b(?:[A-Z][A-Z0-9]*-)+\\d+\\b|\\b[A-Z]+-[A-Z]+\\b";
+
 describe("compass v2 contract (RFC-1094)", () => {
   let tempDir: string;
 
@@ -214,6 +222,36 @@ describe("compass v2 contract (RFC-1094)", () => {
     ).toBeDefined();
   });
 
+  it("CS-07: mission-format history token validates without crash (RFC-1220)", async () => {
+    writeForgeYaml(tempDir, `  compass:\n    idPattern: '${MISSION_ID_PATTERN}'`);
+    writeFixture(
+      MEDIUM_FILE,
+      wrap(MC(PURPOSE_WITH_TOKEN), KD([KD_ITEM]), CS([CS_ITEM], "acme-m000175")),
+    );
+
+    const result = await runCompassValidation(makeInput(), makeContext(tempDir));
+    const cs07 = dataOf(result).diagnostics.filter((d) => d.ruleId === "COMPASS-CS-07");
+    expect(
+      cs07,
+      `mission-format token must be a legal history ID: ${JSON.stringify(cs07)}`,
+    ).toHaveLength(0);
+  });
+
+  it("CS-07: token passing idPatternFull but unparseable emits diagnostic, no crash (RFC-1220)", async () => {
+    writeForgeYaml(tempDir, `  compass:\n    idPattern: '${DRIFT_ID_PATTERN}'`);
+    writeFixture(
+      MEDIUM_FILE,
+      wrap(MC(PURPOSE_WITH_TOKEN), KD([KD_ITEM]), CS([CS_ITEM], "FOO-BAR")),
+    );
+
+    const result = await runCompassValidation(makeInput(), makeContext(tempDir));
+    const cs07 = dataOf(result).diagnostics.find(
+      (d) => d.ruleId === "COMPASS-CS-07" && d.message.includes("unparseable"),
+    );
+    expect(cs07, "unparseable token must produce a CS-07 diagnostic").toBeDefined();
+    expect(result.exitCode).toBeDefined();
+  });
+
   it("empty CHANGE_SUMMARY (no items, no history) is legal", async () => {
     writeFixture(MEDIUM_FILE, wrap(MC(PURPOSE_WITH_TOKEN), KD([KD_ITEM]), CS([])));
 

package/os/compass/handlers/tests/forge-yaml-fixture.ts

@@ -0,0 +1,69 @@
+/*
+<MODULE_CONTRACT>
+<purpose>Shared forge.yaml fixture helpers for compass tests — one schema-valid minimal workspace shape (bindings placeholder), a sync writer, and a temp-dir policy resolver with tracked cleanup so pattern-specific policy tests never fall back silently to generic defaults or leak mkdtemp roots.</purpose>
+<non-goals>
+  <item>Do not build full workspace fixtures — only forge.yaml, created on demand in caller-managed temp dirs.</item>
+</non-goals>
+</MODULE_CONTRACT>
+<CHANGE_SUMMARY>
+  <item>RFC-1220: extract shared forge.yaml fixture from triplicated test copies — schema-required paths section included; mkdtemp roots tracked for afterEach cleanup.</item>
+  <item>RFC-1220: dedupe auto-stamped CHANGE_SUMMARY item in forge-yaml fixture</item>
+</CHANGE_SUMMARY>
+*/
+
+import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { resolveCompassPolicy, type CompassPolicy } from "../../policy.ts";
+
+/**
+ * Minimal schema-valid forge.yaml body. `paths:` is REQUIRED — a fixture
+ * without it fails `loadForgeConfig` schema validation and the resolver
+ * silently falls back to generic policy.
+ */
+export function forgeYaml(bindings: string): string {
+  return `
+schema: forge/config@1
+project:
+  name: test-ws
+  stack: [typescript]
+  packageManager: pnpm
+paths:
+  rfcsDir: docs/rfcs
+  adrsDir: docs/adrs
+  plansDir: docs/plans
+  auditsDir: docs/audits
+  specsDir: docs/specs
+  skillsDir: .agents/skills
+bindings:
+  schema: forge/bindings@1
+  commands: {}
+  paths: {}
+${bindings}`;
+}
+
+/** Write a minimal forge.yaml into `<dir>/forge.yaml`. */
+export function writeForgeYaml(dir: string, bindings: string): void {
+  writeFileSync(join(dir, "forge.yaml"), forgeYaml(bindings));
+}
+
+const patternRoots: string[] = [];
+
+/**
+ * Resolve a Compass policy for a fresh temp workspace whose
+ * `bindings.compass.idPattern` is the given union. The temp root is tracked —
+ * call {@link cleanupForgeYamlFixtures} from an `afterEach`.
+ */
+export function policyWithIdPattern(idPattern: string): CompassPolicy {
+  const root = mkdtempSync(join(tmpdir(), "compass-pattern-"));
+  patternRoots.push(root);
+  writeForgeYaml(root, `  compass:\n    idPattern: '${idPattern}'`);
+  return resolveCompassPolicy(root);
+}
+
+/** Remove every temp root created by {@link policyWithIdPattern}. */
+export function cleanupForgeYamlFixtures(): void {
+  for (const root of patternRoots.splice(0)) {
+    rmSync(root, { recursive: true, force: true });
+  }
+}