@wenathlan/devthink 2.0.14 → 2.0.19

package/tests/relayserve.test.ts

@@ -1,304 +0,0 @@
-import { describe, expect, it } from "vitest";
-import {
-  composeenvelope,
-  contractcapabilities,
-  eventpostbody,
-  eventstreambody,
-  parsewireframe,
-  sessioncreatebody,
-  sessionjoinbody,
-  stableopid,
-} from "../bridge.js";
-import {
-  newrelayserverstate,
-  relayconnectionclose,
-  relayconnectionopen,
-  relayframeof,
-  relayidleconnections,
-  relaylivetokens,
-  relaypendingpairings,
-  relayserverframe,
-} from "../http.js";
-import type { relayserversession } from "../types.js";
-
-const now = 1_000_000;
-const capabilities = contractcapabilities();
-
-/** Opens a relay state with the named connections registered. */
-function statewith(...connectionids: string[]) {
-  let state = newrelayserverstate();
-  for (const connectionid of connectionids) state = relayconnectionopen(state, connectionid, now);
-  return state;
-}
-
-/** Sends one frame from one connection and returns the parsed replies. */
-function send(input: {
-  state: ReturnType<typeof newrelayserverstate>;
-  connectionid: string;
-  frame: string;
-  now?: number;
-}) {
-  const outcome = relayserverframe({
-    state: input.state,
-    connectionid: input.connectionid,
-    frame: input.frame,
-    now: input.now ?? now,
-  });
-  return {
-    state: outcome.state,
-    replies: outcome.replies.map((reply) => parsewireframe(reply)),
-    routed: outcome.routed,
-  };
-}
-
-describe("relayserve", () => {
-  it("opens a session for the extension member and issues its token and pairing code", () => {
-    let state = statewith("conn-1", "conn-2");
-    const create = composeenvelope({
-      op: "sessioncreate",
-      opid: stableopid("ext", 1),
-      at: now,
-      body: sessioncreatebody({ role: "extension", memberid: "ext", capabilities, pairingcode: "PAIR-CODE" }),
-    });
-    const outcome = send({ state, connectionid: "conn-1", frame: JSON.stringify(create) });
-    state = outcome.state;
-    const reply = outcome.replies[0];
-    expect(reply?.op).toBe("sessioncreate");
-    const body = reply?.body as { sessionid?: string; token?: string; members?: Array<{ role: string }> };
-    expect(body.sessionid ?? "").not.toBe("");
-    expect(body.token ?? "").not.toBe("");
-    expect(body.members?.[0]?.role).toBe("extension");
-    /* the pairing code stays pending until the site member redeems it */
-    expect(relaypendingpairings(state, now)).toEqual(["PAIR-CODE"]);
-    /* the raw token lives only in the memory-only issuance map; the session records carry the hash */
-    const session = state.sessions[0];
-    expect(session?.tokenhashes).toHaveLength(1);
-    expect(session?.tokenhashes[0]).toBe(body.token);
-    expect(state.tokens).toContainEqual({ connectionid: "conn-1", token: body.token });
-  });
-
-  it("refuses a sessioncreate frame that does not come from the extension member", () => {
-    const state = statewith("conn-1");
-    const create = composeenvelope({
-      op: "sessioncreate",
-      opid: stableopid("site", 1),
-      at: now,
-      body: sessioncreatebody({ role: "site", memberid: "site", capabilities }),
-    });
-    const outcome = send({ state, connectionid: "conn-1", frame: JSON.stringify(create) });
-    expect(outcome.replies[0]?.body).toEqual({
-      error: "The sessioncreate operation serves the extension member only.",
-    });
-    expect(outcome.state.sessions).toHaveLength(0);
-  });
-
-  it("redeems the pairing code for the site member and issues its own token", () => {
-    let state = statewith("conn-1", "conn-2");
-    const create = composeenvelope({
-      op: "sessioncreate",
-      opid: stableopid("ext", 1),
-      at: now,
-      body: sessioncreatebody({ role: "extension", memberid: "ext", capabilities, pairingcode: "PAIR-CODE" }),
-    });
-    const created = send({ state, connectionid: "conn-1", frame: JSON.stringify(create) });
-    state = created.state;
-    const sessionid = (created.replies[0]?.body as { sessionid?: string }).sessionid ?? "";
-    const join = composeenvelope({
-      op: "sessionjoin",
-      opid: stableopid("site", 1),
-      at: now,
-      body: sessionjoinbody({ sessionid, role: "site", memberid: "site", capabilities, pairingcode: "PAIR-CODE" }),
-    });
-    const joined = send({ state, connectionid: "conn-2", frame: JSON.stringify(join) });
-    state = joined.state;
-    const body = joined.replies[0]?.body as { sessionid?: string; token?: string };
-    expect(joined.replies[0]?.op).toBe("sessionjoin");
-    expect(body.sessionid).toBe(sessionid);
-    expect(body.token ?? "").not.toBe("");
-    /* the pairing is spent and the session holds its site member */
-    expect(relaypendingpairings(state, now)).toEqual([]);
-    expect(state.sessions[0]?.site).toBe("conn-2");
-    /* a second redemption of the same pairing refuses */
-    const again = send({ state, connectionid: "conn-2", frame: JSON.stringify(join) });
-    expect((again.replies[0]?.body as { error?: string }).error).toContain("matches no pending session");
-  });
-
-  it("routes an event post to the other member of the session and keeps the event log", () => {
-    let state = statewith("conn-1", "conn-2");
-    const create = composeenvelope({
-      op: "sessioncreate",
-      opid: stableopid("ext", 1),
-      at: now,
-      body: sessioncreatebody({ role: "extension", memberid: "ext", capabilities, pairingcode: "PAIR-CODE" }),
-    });
-    const created = send({ state, connectionid: "conn-1", frame: JSON.stringify(create) });
-    state = created.state;
-    const sessionid = (created.replies[0]?.body as { sessionid?: string }).sessionid ?? "";
-    const extensiontoken = (created.replies[0]?.body as { token?: string }).token ?? "";
-    const join = composeenvelope({
-      op: "sessionjoin",
-      opid: stableopid("site", 1),
-      at: now,
-      body: sessionjoinbody({ sessionid, role: "site", memberid: "site", capabilities, pairingcode: "PAIR-CODE" }),
-    });
-    const joined = send({ state, connectionid: "conn-2", frame: JSON.stringify(join) });
-    state = joined.state;
-    const post = composeenvelope({
-      op: "eventpost",
-      opid: stableopid("ext", 2),
-      at: now,
-      sessionid,
-      token: extensiontoken,
-      body: eventpostbody({
-        event: { kind: "chat", stream: "chat", payload: { message: "collect the pricing table" } },
-      }),
-    });
-    const outcome = send({ state, connectionid: "conn-1", frame: JSON.stringify(post) });
-    /* the sender receives its ack and the site member receives the routed frame */
-    expect(outcome.replies[0]?.body).toEqual({ accepted: true });
-    expect(outcome.routed).toHaveLength(1);
-    expect(outcome.routed[0]?.connectionid).toBe("conn-2");
-    const routedframe = parsewireframe(outcome.routed[0]?.frame ?? "{}");
-    expect(routedframe.op).toBe("eventpost");
-    expect((routedframe.body as { kind?: string }).kind).toBe("chat");
-    expect((routedframe.body as { payload?: { message?: string } }).payload?.message).toBe("collect the pricing table");
-    expect(outcome.state.sessions[0]?.events).toHaveLength(1);
-  });
-
-  it("answers an event stream subscription with the ack over the subscribed streams", () => {
-    let state = statewith("conn-1");
-    const create = composeenvelope({
-      op: "sessioncreate",
-      opid: stableopid("ext", 1),
-      at: now,
-      body: sessioncreatebody({ role: "extension", memberid: "ext", capabilities }),
-    });
-    const created = send({ state, connectionid: "conn-1", frame: JSON.stringify(create) });
-    state = created.state;
-    const sessionid = (created.replies[0]?.body as { sessionid?: string }).sessionid ?? "";
-    const token = (created.replies[0]?.body as { token?: string }).token ?? "";
-    const stream = composeenvelope({
-      op: "eventstream",
-      opid: stableopid("ext", 2),
-      at: now,
-      sessionid,
-      token,
-      body: eventstreambody({ streams: ["chat", "review"], since: now - 500 }),
-    });
-    const outcome = send({ state, connectionid: "conn-1", frame: JSON.stringify(stream) });
-    expect(outcome.replies[0]?.body).toEqual({ streams: ["chat", "review"], subscribed: true });
-  });
-
-  it("refuses every frame that fails the token authentication without touching the session state", () => {
-    let state = statewith("conn-1", "conn-2");
-    const create = composeenvelope({
-      op: "sessioncreate",
-      opid: stableopid("ext", 1),
-      at: now,
-      body: sessioncreatebody({ role: "extension", memberid: "ext", capabilities }),
-    });
-    const created = send({ state, connectionid: "conn-1", frame: JSON.stringify(create) });
-    state = created.state;
-    const sessionid = (created.replies[0]?.body as { sessionid?: string }).sessionid ?? "";
-    const post = composeenvelope({
-      op: "eventpost",
-      opid: stableopid("ext", 2),
-      at: now,
-      sessionid,
-      token: "forged-token",
-      body: eventpostbody({ event: { kind: "chat", stream: "chat", payload: { message: "no" } } }),
-    });
-    const refused = send({ state, connectionid: "conn-1", frame: JSON.stringify(post) });
-    expect((refused.replies[0]?.body as { error?: string }).error).toContain("token authentication");
-    expect(refused.routed).toHaveLength(0);
-    expect(refused.state.sessions[0]?.events).toHaveLength(0);
-    /* an unknown session id answers the same refusal */
-    const ghost = composeenvelope({
-      op: "eventpost",
-      opid: stableopid("ext", 3),
-      at: now,
-      sessionid: "session-ghost",
-      token: "any",
-      body: eventpostbody({ event: { kind: "chat", stream: "chat", payload: { message: "no" } } }),
-    });
-    const ghostoutcome = send({ state, connectionid: "conn-1", frame: JSON.stringify(ghost) });
-    expect((ghostoutcome.replies[0]?.body as { error?: string }).error).toContain("token authentication");
-  });
-
-  it("rotates the token of a returning member and revokes the previous one", () => {
-    let state = statewith("conn-1");
-    const create = composeenvelope({
-      op: "sessioncreate",
-      opid: stableopid("ext", 1),
-      at: now,
-      body: sessioncreatebody({ role: "extension", memberid: "ext", capabilities }),
-    });
-    const created = send({ state, connectionid: "conn-1", frame: JSON.stringify(create) });
-    state = created.state;
-    const sessionid = (created.replies[0]?.body as { sessionid?: string }).sessionid ?? "";
-    const firsttoken = (created.replies[0]?.body as { token?: string }).token ?? "";
-    const rejoin = composeenvelope({
-      op: "sessionjoin",
-      opid: stableopid("ext", 2),
-      at: now,
-      sessionid,
-      token: firsttoken,
-      body: sessionjoinbody({ sessionid, role: "extension", memberid: "ext", capabilities }),
-    });
-    const rejoined = send({ state, connectionid: "conn-1", frame: JSON.stringify(rejoin) });
-    state = rejoined.state;
-    const secondtoken = (rejoined.replies[0]?.body as { token?: string; rotated?: boolean }).token ?? "";
-    expect((rejoined.replies[0]?.body as { rotated?: boolean }).rotated).toBe(true);
-    expect(secondtoken).not.toBe(firsttoken);
-    /* the old token left the live set */
-    const session: relayserversession = state.sessions[0] ?? {
-      id: "missing",
-      extension: undefined,
-      site: undefined,
-      events: [],
-      tokenhashes: [],
-      revoked: [],
-    };
-    expect(relaylivetokens(session)).toEqual([secondtoken]);
-    expect(session.revoked).toEqual([firsttoken]);
-    /* the revoked token no longer authenticates */
-    const post = composeenvelope({
-      op: "eventpost",
-      opid: stableopid("ext", 3),
-      at: now,
-      sessionid,
-      token: firsttoken,
-      body: eventpostbody({ event: { kind: "chat", stream: "chat", payload: { message: "no" } } }),
-    });
-    const refused = send({ state, connectionid: "conn-1", frame: JSON.stringify(post) });
-    expect((refused.replies[0]?.body as { error?: string }).error).toContain("token authentication");
-  });
-
-  it("answers a frame that does not parse with the parse error and ignores an unregistered connection", () => {
-    const state = statewith("conn-1");
-    const outcome = send({ state, connectionid: "conn-1", frame: "not json" });
-    expect((outcome.replies[0]?.body as { error?: string }).error).toContain("does not parse");
-    expect(outcome.state).toBe(state);
-    const ghost = relayserverframe({ state, connectionid: "conn-ghost", frame: "not json", now });
-    expect(ghost.replies).toHaveLength(0);
-  });
-
-  it("closes the connections the idle sweep selects inside the operator chosen window", () => {
-    let state = statewith("conn-1", "conn-2");
-    state = relayconnectionopen(state, "conn-1", now);
-    /* an absent window never expires a connection because the bound stays the operator's choice */
-    expect(relayidleconnections(state, now + 10_000)).toEqual([]);
-    expect(relayidleconnections(state, now + 10_000, 5_000)).toEqual(["conn-1", "conn-2"]);
-    const closed = relayconnectionclose(state, "conn-1");
-    expect(closed.connections.map((connection) => connection.id)).toEqual(["conn-2"]);
-    expect(closed.tokens).toHaveLength(0);
-  });
-
-  it("encodes every reply as the plain json wire frame of the servercontract", () => {
-    const frame = relayframeof({ op: "eventpost", opid: "op-relay-1", at: now, body: { accepted: true } });
-    const parsed = parsewireframe(frame);
-    expect(parsed.op).toBe("eventpost");
-    expect(parsed.opid).toBe("op-relay-1");
-    expect(parsed.body).toEqual({ accepted: true });
-  });
-});

package/tests/releasenotes.test.ts

@@ -1,276 +0,0 @@
-import { readFile } from "node:fs/promises";
-import { describe, expect, it } from "vitest";
-import { artifactchannelof } from "../pack.js";
-
-describe("generated release notes", () => {
-  it("contains only the current changelog version content", async () => {
-    const packagejson = JSON.parse(await readFile("package.json", "utf8"));
-    const changelog = await readFile("CHANGELOG.md", "utf8");
-    const releasenotes = await readFile("docs/releasenotes.md", "utf8");
-    const heading = new RegExp(`^##\\s+${packagejson.version.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:\\s|$)`, "m");
-    const match = changelog.match(heading);
-    if (!match || match.index === undefined) throw new Error("Current changelog heading is missing.");
-    const section = changelog.slice(match.index + match[0].length).split(/^##\s+/m)[0];
-    if (typeof section !== "string") throw new Error("Current changelog section is missing.");
-    const expected = section.trim();
-    expect(releasenotes.startsWith(`# Devthink ${packagejson.version}\n\n${expected}\n`)).toBe(true);
-  });
-
-  it("carries the per channel sections of the publishing pipeline with every channel artifact", async () => {
-    const packagejson = JSON.parse(await readFile("package.json", "utf8"));
-    const version = String(packagejson.version);
-    const releasenotes = await readFile("docs/releasenotes.md", "utf8");
-    for (const channel of [
-      "npm",
-      "nuget",
-      "maven",
-      "container",
-      "rubygems",
-      "vscode",
-      "firefox",
-      "safari",
-      "chromium",
-      "site",
-      "declarations",
-      "provenance",
-      "github",
-    ]) {
-      expect(releasenotes).toContain(`### ${channel} channel`);
-    }
-    /* every version stamped release artifact the channel sections list must map back onto its channel through the artifact manifest resolution, so the notes and the manifest never disagree */
-    const expectedartifacts: Array<[string, string]> = [
-      [`wenathlan-devthink-${version}.tgz`, "npmjs"],
-      [`devthink.${version}.nupkg`, "nuget"],
-      [`devthink-${version}.pom`, "maven"],
-      [`devthink-${version}.gem`, "rubygems"],
-      [`devthink-vscode-${version}.vsix`, "vscode"],
-      [`devthink-firefox-${version}.xpi`, "firefox"],
-      [`devthink-safari-${version}.zip`, "safari"],
-      [`devthink${version}.zip`, "chromium"],
-      [`devthink-site-${version}.zip`, "site"],
-      [`devthink-declarations-${version}.zip`, "declarations"],
-      [`devthink-sbom-${version}.json`, "provenance"],
-      [`devthink-attestations-${version}.json`, "provenance"],
-      [`devthink-artifactmanifest-${version}.json`, "provenance"],
-      [`devthink-container.digest`, "container"],
-    ];
-    for (const [name, channel] of expectedartifacts) {
-      expect(releasenotes).toContain(`\`${name}\``);
-      expect(artifactchannelof(name, version)).toContain(channel);
-    }
-    /* the notes record the checksums and the notes assets of the github channel beside every other artifact */
-    expect(releasenotes).toContain("`SHA256SUMS.txt`");
-    expect(releasenotes).toContain("`RELEASENOTES.md`");
-    expect(releasenotes).toContain("the verification step downloads every asset and verifies the checksums");
-  });
-});
-
-/* ── The 2.0.13 maintenance ladder closure beside the 2.0.12 ceiling ladder records: the extension lineage's changelog history preserved verbatim by the grand merge. ── */
-
-describe("the 2.0.13 maintenance ladder release notes", () => {
-  it("ships the applied dependency updates and the automated dependency ladder", async () => {
-    /* the extension lineage record answers from the preserved lineage region of the changelog — the devthink release line carries its own sections at the head, so a same-numbered devthink release never shadows the preserved extension record the assertion walks */
-    const whole = await readFile("CHANGELOG.md", "utf8");
-    const lineageIndex = whole.indexOf("## The extension lineage");
-    expect(lineageIndex).toBeGreaterThan(0);
-    const changelog = whole.slice(lineageIndex);
-    const heading = /^##\s+2\.0\.13(?:\s|$)/m.exec(changelog);
-    expect(heading).not.toBeNull();
-    const section = changelog.slice(heading?.index ?? 0).split(/^##\s+/m)[1] ?? "";
-    for (const marker of [
-      "the denoland/setup-deno action of the verification pipeline",
-      "the anchore/sbom-action of the security pipeline",
-      "derives the next rung with plain arithmetic over package.json",
-      "never a hardcoded number anywhere",
-      "squashes the green result onto main with linear history",
-      "the dependabot configuration is removed with this rung",
-      "the denoland/setup-deno entry joins its allowlist",
-      "the repository keeps exactly one long-lived branch",
-    ])
-      expect(section.toLowerCase()).toContain(marker);
-    const releasenotes = await readFile("docs/releasenotes.md", "utf8");
-    /* the container channel surface follows the family union index the publish lane ships: the four-arch wording replaced the two-arch text at 2.0.14 */
-    for (const marker of ["linux/amd64", "linux/arm64", "linux/ppc64le", "linux/s390x", "no stable channel alias or referrers fallback tag rides the package"])
-      expect(releasenotes.toLowerCase()).toContain(marker);
-  });
-
-  it("keeps the 2.0.12 marginal ceiling record with the 2.0.11 chain behind it", async () => {
-    /* the extension lineage record answers from the preserved lineage region of the changelog — the devthink release line carries its own sections at the head, so a same-numbered devthink release never shadows the preserved extension record the assertion walks */
-    const whole = await readFile("CHANGELOG.md", "utf8");
-    const lineageIndex = whole.indexOf("## The extension lineage");
-    expect(lineageIndex).toBeGreaterThan(0);
-    const changelog = whole.slice(lineageIndex);
-    const twelve = /^##\s+2\.0\.12(?:\s|$)/m.exec(changelog);
-    expect(twelve).not.toBeNull();
-    const twelvesection = changelog.slice(twelve?.index ?? 0).split(/^##\s+/m)[1] ?? "";
-    for (const marker of [
-      "a sixteen millisecond overrun of a green test",
-      "the native ceiling itself was the defect, not the test",
-      "the esm core build reads sixty seconds natively",
-      "the whole-matrix build reads one hundred twenty seconds",
-      "the same `devthink_test_timeout_ms` the emulated arm64 container leg exports",
-    ])
-      expect(twelvesection.toLowerCase()).toContain(marker);
-  });
-
-  it("keeps the 2.0.11 sanitizer record with the 2.0.10 chain behind it", async () => {
-    /* the extension lineage record answers from the preserved lineage region of the changelog — the devthink release line carries its own sections at the head, so a same-numbered devthink release never shadows the preserved extension record the assertion walks */
-    const whole = await readFile("CHANGELOG.md", "utf8");
-    const lineageIndex = whole.indexOf("## The extension lineage");
-    expect(lineageIndex).toBeGreaterThan(0);
-    const changelog = whole.slice(lineageIndex);
-    const eleven = /^##\s+2\.0\.11(?:\s|$)/m.exec(changelog);
-    expect(eleven).not.toBeNull();
-    const elevensection = changelog.slice(eleven?.index ?? 0).split(/^##\s+/m)[1] ?? "";
-    for (const marker of [
-      "closes the two code scanning alerts the re-analysis of the security page surfaced",
-      "the script stripper of `withoutscripts`",
-      "incomplete multi character sanitization",
-      "an unterminated block still strips to the fragment end",
-      "the sweep answers the same ten of ten checks green",
-      "the code scanning page answers zero open alerts",
-    ])
-      expect(elevensection.toLowerCase()).toContain(marker);
-  });
-
-  it("keeps the 2.0.10 emulation record with the 2.0.9 chain behind it", async () => {
-    /* the extension lineage record answers from the preserved lineage region of the changelog — the devthink release line carries its own sections at the head, so a same-numbered devthink release never shadows the preserved extension record the assertion walks */
-    const whole = await readFile("CHANGELOG.md", "utf8");
-    const lineageIndex = whole.indexOf("## The extension lineage");
-    expect(lineageIndex).toBeGreaterThan(0);
-    const changelog = whole.slice(lineageIndex);
-    const ten = /^##\s+2\.0\.10(?:\s|$)/m.exec(changelog);
-    expect(ten).not.toBeNull();
-    const tensection = changelog.slice(ten?.index ?? 0).split(/^##\s+/m)[1] ?? "";
-    for (const marker of [
-      "the arm64 leg runs interpreted through qemu",
-      "fourteen hit the five second vitest default timeout",
-      "the linearity budget of the adversarial star storm",
-      "nothing is skipped, nothing is relaxed",
-      "the vitest config keeps the env-scaled timeout",
-    ])
-      expect(tensection.toLowerCase()).toContain(marker);
-  });
-
-  it("keeps the 2.0.9 browser fix record with the 2.0.8 chain behind it", async () => {
-    /* the extension lineage record answers from the preserved lineage region of the changelog — the devthink release line carries its own sections at the head, so a same-numbered devthink release never shadows the preserved extension record the assertion walks */
-    const whole = await readFile("CHANGELOG.md", "utf8");
-    const lineageIndex = whole.indexOf("## The extension lineage");
-    expect(lineageIndex).toBeGreaterThan(0);
-    const changelog = whole.slice(lineageIndex);
-    const nine = /^##\s+2\.0\.9(?:\s|$)/m.exec(changelog);
-    expect(nine).not.toBeNull();
-    const ninesection = changelog.slice(nine?.index ?? 0).split(/^##\s+/m)[1] ?? "";
-    for (const marker of [
-      "the delegated browser verification of the 2.0.8 release zip against the sandbox host",
-      "cannot read properties of undefined (reading 'length')",
-      "the context now unwraps the envelope at the source",
-      "the registry now answers the boolean grammar the commands declare",
-      "a `line` text helper that never existed",
-      "line is not defined",
-      "every reviewed step has executed and the plan is closed",
-      "zero console errors answer across the host, the popup and the sidepanel",
-    ])
-      expect(ninesection.toLowerCase()).toContain(marker);
-  });
-
-  it("keeps the 2.0.8 metadata and container record with the 2.0.7 chain behind it", async () => {
-    /* the extension lineage record answers from the preserved lineage region of the changelog — the devthink release line carries its own sections at the head, so a same-numbered devthink release never shadows the preserved extension record the assertion walks */
-    const whole = await readFile("CHANGELOG.md", "utf8");
-    const lineageIndex = whole.indexOf("## The extension lineage");
-    expect(lineageIndex).toBeGreaterThan(0);
-    const changelog = whole.slice(lineageIndex);
-    const eight = /^##\s+2\.0\.8(?:\s|$)/m.exec(changelog);
-    expect(eight).not.toBeNull();
-    const eightsection = changelog.slice(eight?.index ?? 0).split(/^##\s+/m)[1] ?? "";
-    for (const marker of [
-      "the verify lanes caught the release metadata drift before anything published",
-      "the apifreeze test refused",
-      "points at the commit that never released",
-      "the api freeze artifact and the cap manifests re-freeze at 2.0.8",
-      "zero added, zero removed, nothing reordered",
-      "the runners own the authoritative build",
-    ])
-      expect(eightsection.toLowerCase()).toContain(marker);
-  });
-
-  it("keeps the 2.0.7 security and container record with the 2.0.6 ladder chain behind it", async () => {
-    /* the extension lineage record answers from the preserved lineage region of the changelog — the devthink release line carries its own sections at the head, so a same-numbered devthink release (the 2.0.3 retrabalho) never shadows the preserved extension record the assertion walks */
-    const whole = await readFile("CHANGELOG.md", "utf8");
-    const lineageIndex = whole.indexOf("## The extension lineage");
-    expect(lineageIndex).toBeGreaterThan(0);
-    const changelog = whole.slice(lineageIndex);
-    const seven = /^##\s+2\.0\.7(?:\s|$)/m.exec(changelog);
-    expect(seven).not.toBeNull();
-    const sevensection = changelog.slice(seven?.index ?? 0).split(/^##\s+/m)[1] ?? "";
-    for (const marker of [
-      "the two open code scanning alerts",
-      "linear string scans",
-      "the four arch/os entries",
-      "linux/amd64, linux/arm64",
-      "the attestation feature stays",
-      "referrers fallback tag",
-      "the digest files that pin the exact image hash",
-      "dynamically from the registry answer",
-      "no digest written in the workflow",
-    ])
-      expect(sevensection.toLowerCase()).toContain(marker);
-    const six = /^##\s+2\.0\.6(?:\s|$)/m.exec(changelog);
-    expect(six).not.toBeNull();
-    const sixsection = changelog.slice(six?.index ?? 0).split(/^##\s+/m)[1] ?? "";
-    for (const marker of [
-      "end-user verification of the published 2.0.5 package",
-      "the package-scoped checksums verifying all 141 shipped files",
-      "six icon errors and exit one from the installed package",
-      "the browser bundle rides the release zip channel",
-      "the identity-digest fail-soft",
-      "a declared icon missing from a present bundle remains an error",
-      "the unbundled context answers the release-zip note with exit zero",
-    ])
-      expect(sixsection.toLowerCase()).toContain(marker);
-    const five = /^##\s+2\.0\.5(?:\s|$)/m.exec(changelog);
-    expect(five).not.toBeNull();
-    const fivesection = changelog.slice(five?.index ?? 0).split(/^##\s+/m)[1] ?? "";
-    for (const marker of ["works-on-my-machine", "the validate:candidate script now runs the soak and the wcag sweeps"])
-      expect(fivesection.toLowerCase()).toContain(marker);
-    const four = /^##\s+2\.0\.4(?:\s|$)/m.exec(changelog);
-    expect(four).not.toBeNull();
-    const foursection = changelog.slice(four?.index ?? 0).split(/^##\s+/m)[1] ?? "";
-    for (const marker of ["counts the `package/` root prefix", "three real directory segments"])
-      expect(foursection.toLowerCase()).toContain(marker);
-    const three = /^##\s+2\.0\.3(?:\s|$)/m.exec(changelog);
-    expect(three).not.toBeNull();
-    const threesection = changelog.slice(three?.index ?? 0).split(/^##\s+/m)[1] ?? "";
-    for (const marker of [
-      "flat package organization pass",
-      "one file per correlated domain",
-      "nothing nested past two directories",
-    ])
-      expect(threesection.toLowerCase()).toContain(marker);
-  });
-
-  it("assembles the full chain from the 1.1.31 base into the release notes", async () => {
-    const releasenotes = await readFile("docs/releasenotes.md", "utf8");
-    expect(releasenotes).toContain("## The chain to this candidate");
-    for (const phase of [
-      "The base",
-      "The agentic core",
-      "The platform depth",
-      "The interface and ecosystem surface",
-      "The operator surface",
-      "The freeze, the certification and the candidates",
-    ])
-      expect(releasenotes).toContain(`### ${phase} (`);
-    for (const marker of [
-      "1.1.31 — the frozen baseline the chain builds on",
-      "1.1.98 — the clean repository shape restoration",
-      "1.1.99 — release candidate one",
-      "### The migration steps for upgraders",
-      "### The frozen protocol guarantees",
-      "### The certified scenarios",
-      "### The performance budget results",
-      "### The security review summary",
-    ])
-      expect(releasenotes).toContain(marker);
-  });
-});