@windyroad/risk-scorer 0.17.4 → 0.18.0

package/scripts/test/extract-risks-from-reports.bats

@@ -1,366 +0,0 @@
-#!/usr/bin/env bats
-
-# extract-risks-from-reports.sh — behavioural fixture per ADR-052.
-# Walks .risk-reports/, parses RISK_REGISTER_HINT bullets per ADR-056,
-# dedupes by slug, writes per-slug entries + README to docs/risks/.
-#
-# Tests are behavioural — replay the script against tmp-dir mock corpora,
-# assert on observable filesystem outcomes (file presence, content shape,
-# README rows). NO structural grep on script source.
-
-setup() {
-  ORIG_DIR="$PWD"
-  REPO_ROOT="$(cd "$(dirname "$BATS_TEST_FILENAME")/../../../.." && pwd)"
-  SCRIPT="$REPO_ROOT/packages/risk-scorer/scripts/extract-risks-from-reports.sh"
-  TEST_DIR=$(mktemp -d)
-  cd "$TEST_DIR"
-  # All tests need RISK-POLICY.md to satisfy pre-condition
-  echo "# Risk Policy" > RISK-POLICY.md
-}
-
-teardown() {
-  cd "$ORIG_DIR"
-  rm -rf "$TEST_DIR"
-}
-
-# ──────────────────────────────────────────────────────────────────────────────
-# Pre-condition handling
-# ──────────────────────────────────────────────────────────────────────────────
-
-@test "fails with exit 1 when RISK-POLICY.md absent" {
-  rm RISK-POLICY.md
-  mkdir -p .risk-reports
-  echo "report" > .risk-reports/r.md
-  run "$SCRIPT"
-  [ "$status" -eq 1 ]
-}
-
-@test "fails with exit 1 when .risk-reports/ absent" {
-  run "$SCRIPT"
-  [ "$status" -eq 1 ]
-}
-
-@test "fails with exit 1 when .risk-reports/ is empty" {
-  mkdir -p .risk-reports
-  run "$SCRIPT"
-  [ "$status" -eq 1 ]
-}
-
-# ──────────────────────────────────────────────────────────────────────────────
-# Deterministic extraction (Phase 1)
-# ──────────────────────────────────────────────────────────────────────────────
-
-@test "extracts a single 3-column hint and writes one entry" {
-  mkdir -p .risk-reports
-  cat > .risk-reports/r1.md <<'EOF'
-# Report
-
-RISK_REGISTER_HINT:
-- above-appetite-residual | example-risk-class | A description of the risk class
-EOF
-  run "$SCRIPT"
-  [ "$status" -eq 0 ]
-  [ -d docs/risks ]
-  [ -f docs/risks/README.md ]
-  ls docs/risks/R*-example-risk-class.active.md >/dev/null 2>&1
-}
-
-@test "dedupes 3 reports with same slug to one entry citing all 3 sources" {
-  mkdir -p .risk-reports
-  for i in 1 2 3; do
-    cat > .risk-reports/r${i}.md <<EOF
-RISK_REGISTER_HINT:
-- above-appetite-residual | duplicated-class | Same risk surfaced ${i} times
-EOF
-  done
-  run "$SCRIPT"
-  [ "$status" -eq 0 ]
-  # Exactly one entry file
-  count=$(ls docs/risks/R*-duplicated-class.active.md 2>/dev/null | wc -l | tr -d ' ')
-  [ "$count" = "1" ]
-  # Source Evidence block lists all 3 reports
-  entry=$(ls docs/risks/R*-duplicated-class.active.md)
-  grep -q ".risk-reports/r1.md" "$entry"
-  grep -q ".risk-reports/r2.md" "$entry"
-  grep -q ".risk-reports/r3.md" "$entry"
-}
-
-@test "infers infosec category from confidentiality-disclosure reason-tag" {
-  mkdir -p .risk-reports
-  cat > .risk-reports/r.md <<'EOF'
-RISK_REGISTER_HINT:
-- confidentiality-disclosure | leak-shape | A confidentiality leak surfaced
-EOF
-  run "$SCRIPT"
-  [ "$status" -eq 0 ]
-  entry=$(ls docs/risks/R*-leak-shape.active.md)
-  grep -q "^\*\*Category\*\*: infosec" "$entry"
-}
-
-@test "infers operational category from above-appetite-residual reason-tag" {
-  mkdir -p .risk-reports
-  cat > .risk-reports/r.md <<'EOF'
-RISK_REGISTER_HINT:
-- above-appetite-residual | ops-shape | An ops risk surfaced
-EOF
-  run "$SCRIPT"
-  [ "$status" -eq 0 ]
-  entry=$(ls docs/risks/R*-ops-shape.active.md)
-  grep -q "^\*\*Category\*\*: operational" "$entry"
-}
-
-@test "skips bullets with invalid reason-tag" {
-  mkdir -p .risk-reports
-  cat > .risk-reports/r.md <<'EOF'
-RISK_REGISTER_HINT:
-- not-a-real-tag | bogus-slug | Bogus prose
-- above-appetite-residual | valid-slug | Valid prose
-EOF
-  run "$SCRIPT"
-  [ "$status" -eq 0 ]
-  ! ls docs/risks/R*-bogus-slug.active.md 2>/dev/null
-  ls docs/risks/R*-valid-slug.active.md >/dev/null 2>&1
-}
-
-# ──────────────────────────────────────────────────────────────────────────────
-# Source Evidence block + ADR-026 sentinel
-# ──────────────────────────────────────────────────────────────────────────────
-
-@test "entry includes Source Evidence block with originating reports" {
-  mkdir -p .risk-reports
-  cat > .risk-reports/abc.md <<'EOF'
-RISK_REGISTER_HINT:
-- above-appetite-residual | citing-class | Cited risk
-EOF
-  run "$SCRIPT"
-  [ "$status" -eq 0 ]
-  entry=$(ls docs/risks/R*-citing-class.active.md)
-  grep -q "## Source Evidence" "$entry"
-  grep -q ".risk-reports/abc.md" "$entry"
-}
-
-@test "ungrounded scoring fields use ADR-026 sentinel" {
-  mkdir -p .risk-reports
-  cat > .risk-reports/r.md <<'EOF'
-RISK_REGISTER_HINT:
-- above-appetite-residual | sentinel-test | Sentinel check
-EOF
-  run "$SCRIPT"
-  [ "$status" -eq 0 ]
-  entry=$(ls docs/risks/R*-sentinel-test.active.md)
-  grep -q "not estimated — no prior data" "$entry"
-}
-
-@test "Status field is auto-scaffolded pending review" {
-  mkdir -p .risk-reports
-  cat > .risk-reports/r.md <<'EOF'
-RISK_REGISTER_HINT:
-- above-appetite-residual | status-test | Status check
-EOF
-  run "$SCRIPT"
-  [ "$status" -eq 0 ]
-  entry=$(ls docs/risks/R*-status-test.active.md)
-  grep -q "Active (auto-scaffolded — pending review)" "$entry"
-}
-
-# ──────────────────────────────────────────────────────────────────────────────
-# Recogniser-shape skeleton emission (P169 — bootstrap stops the bleeding)
-# ──────────────────────────────────────────────────────────────────────────────
-# Newly-scaffolded entries MUST carry a ## Recogniser section with the three
-# sub-blocks awaiting curation, so new risks stop landing without the shape
-# that the @windyroad/risk-scorer pipeline relies on for slug-token matching.
-
-@test "scaffolded entry includes ## Recogniser section" {
-  mkdir -p .risk-reports
-  cat > .risk-reports/r.md <<'EOF'
-RISK_REGISTER_HINT:
-- above-appetite-residual | recogniser-shape-test | Recogniser skeleton check
-EOF
-  run "$SCRIPT"
-  [ "$status" -eq 0 ]
-  entry=$(ls docs/risks/R*-recogniser-shape-test.active.md)
-  grep -q "^## Recogniser" "$entry"
-}
-
-@test "scaffolded Recogniser block has Path-patterns / Diff-content / Anti-patterns sub-blocks" {
-  mkdir -p .risk-reports
-  cat > .risk-reports/r.md <<'EOF'
-RISK_REGISTER_HINT:
-- above-appetite-residual | recogniser-subblock-test | Recogniser sub-block check
-EOF
-  run "$SCRIPT"
-  [ "$status" -eq 0 ]
-  entry=$(ls docs/risks/R*-recogniser-subblock-test.active.md)
-  grep -q "Path patterns" "$entry"
-  grep -q "Diff-content keywords" "$entry"
-  grep -q "Anti-patterns" "$entry"
-}
-
-@test "scaffolded Recogniser sub-blocks carry pending-review placeholders" {
-  mkdir -p .risk-reports
-  cat > .risk-reports/r.md <<'EOF'
-RISK_REGISTER_HINT:
-- above-appetite-residual | recogniser-pending-test | Recogniser pending check
-EOF
-  run "$SCRIPT"
-  [ "$status" -eq 0 ]
-  entry=$(ls docs/risks/R*-recogniser-pending-test.active.md)
-  # The skeleton uses the same ADR-026-style "pending review" sentinel
-  # so curators can grep for unfinished sections. Three pending-review
-  # markers (one per sub-block: paths / keywords / anti-patterns).
-  recog_lines=$(sed -n '/^## Recogniser/,/^## Inherent/p' "$entry" | grep -c "pending review" || true)
-  [ "$recog_lines" -ge 3 ]
-}
-
-# ──────────────────────────────────────────────────────────────────────────────
-# Idempotency / slug collision append
-# ──────────────────────────────────────────────────────────────────────────────
-
-@test "second run with same corpus appends to existing Source Evidence" {
-  mkdir -p .risk-reports
-  cat > .risk-reports/first.md <<'EOF'
-RISK_REGISTER_HINT:
-- above-appetite-residual | append-test | First sighting
-EOF
-  run "$SCRIPT"
-  [ "$status" -eq 0 ]
-  entry=$(ls docs/risks/R*-append-test.active.md)
-  # Add a second report with the same slug
-  cat > .risk-reports/second.md <<'EOF'
-RISK_REGISTER_HINT:
-- above-appetite-residual | append-test | Second sighting
-EOF
-  run "$SCRIPT"
-  [ "$status" -eq 0 ]
-  # Same entry file — no new R<NNN>
-  count=$(ls docs/risks/R*-append-test.active.md 2>/dev/null | wc -l | tr -d ' ')
-  [ "$count" = "1" ]
-  # Both reports cited
-  grep -q "first.md" "$entry"
-  grep -q "second.md" "$entry"
-}
-
-# ──────────────────────────────────────────────────────────────────────────────
-# README generation
-# ──────────────────────────────────────────────────────────────────────────────
-
-@test "README is regenerated with Register table containing the new entry" {
-  mkdir -p .risk-reports
-  cat > .risk-reports/r.md <<'EOF'
-RISK_REGISTER_HINT:
-- above-appetite-residual | readme-test | README inclusion check
-EOF
-  run "$SCRIPT"
-  [ "$status" -eq 0 ]
-  [ -f docs/risks/README.md ]
-  grep -q "Risk Register" docs/risks/README.md
-  grep -q "readme-test" docs/risks/README.md
-  # README cites ADR-059
-  grep -q "ADR-059" docs/risks/README.md
-}
-
-@test "emitted README does NOT leak the publishing-suite brand name (P374 published-artefacts)" {
-  # The README heredoc must use project-neutral phrasing so an adopter's
-  # generated docs/risks/README.md never carries the source monorepo's
-  # brand into adopter-controlled prose. Witness substring from #273.
-  mkdir -p .risk-reports
-  cat > .risk-reports/r.md <<'EOF'
-RISK_REGISTER_HINT:
-- above-appetite-residual | brand-leak-test | Brand-leak absence check
-EOF
-  run "$SCRIPT"
-  [ "$status" -eq 0 ]
-  [ -f docs/risks/README.md ]
-  ! grep -q "Windy Road Agent Plugins suite" docs/risks/README.md
-  # Positive assertion: the neutral phrasing is present
-  grep -q "persistent risk register\*\* for this project" docs/risks/README.md
-}
-
-@test "README does NOT cite TEMPLATE.md (per user direction 2026-05-04)" {
-  mkdir -p .risk-reports
-  cat > .risk-reports/r.md <<'EOF'
-RISK_REGISTER_HINT:
-- above-appetite-residual | nt | No TEMPLATE check
-EOF
-  run "$SCRIPT"
-  [ "$status" -eq 0 ]
-  ! grep -q "TEMPLATE.md" docs/risks/README.md
-  ! [ -f docs/risks/TEMPLATE.md ]
-}
-
-# ──────────────────────────────────────────────────────────────────────────────
-# Dry-run mode
-# ──────────────────────────────────────────────────────────────────────────────
-
-@test "dry-run does not write any files" {
-  mkdir -p .risk-reports
-  cat > .risk-reports/r.md <<'EOF'
-RISK_REGISTER_HINT:
-- above-appetite-residual | dry-run-test | Dry-run check
-EOF
-  run "$SCRIPT" --dry-run
-  [ "$status" -eq 0 ]
-  ! [ -d docs/risks ]
-}
-
-@test "dry-run reports hinted vs unhinted counts" {
-  mkdir -p .risk-reports
-  cat > .risk-reports/hinted.md <<'EOF'
-RISK_REGISTER_HINT:
-- above-appetite-residual | hinted | Hinted
-EOF
-  echo "no hint here" > .risk-reports/unhinted.md
-  run "$SCRIPT" --dry-run
-  [ "$status" -eq 0 ]
-  [[ "$output" == *"reports walked:          2"* ]]
-  [[ "$output" == *"hinted (deterministic):  1"* ]]
-  [[ "$output" == *"unhinted (Phase 2 todo): 1"* ]]
-}
-
-# ──────────────────────────────────────────────────────────────────────────────
-# --derived-slugs (Phase 2 input)
-# ──────────────────────────────────────────────────────────────────────────────
-
-@test "--derived-slugs adds entries from Phase 2 LLM-walk output" {
-  mkdir -p .risk-reports
-  echo "no hint" > .risk-reports/unhinted.md
-  # Simulate Phase 2 LLM-walk producing a derived slug
-  printf 'derived-slug\t1\tabove-appetite-residual\tDerived from LLM walk of unhinted.md\t.risk-reports/unhinted.md\n' > /tmp/derived.tsv
-  run "$SCRIPT" --derived-slugs /tmp/derived.tsv
-  [ "$status" -eq 0 ]
-  ls docs/risks/R*-derived-slug.active.md >/dev/null 2>&1
-  rm -f /tmp/derived.tsv
-}
-
-# ──────────────────────────────────────────────────────────────────────────────
-# Octal-eval regression (P164 Phase 2 — #273 witness)
-# ──────────────────────────────────────────────────────────────────────────────
-# Bash arithmetic $(( ... )) parses a leading-zero operand as octal; 008/009 are
-# invalid octal literals → `bash: 008: value too great for base`. The next-ID
-# compute (LOCAL_MAX from zero-padded R<NNN> filenames) must force base-10 with
-# 10#. Pre-seed an R008 entry so LOCAL_MAX="008" and assert the script allocates
-# R009 cleanly without the octal error.
-
-@test "allocates R009 cleanly when an R008 entry already exists (octal-eval regression, P164 Phase 2)" {
-  mkdir -p docs/risks
-  # Pre-existing zero-padded entry that drives LOCAL_MAX="008". Carries the
-  # full field shape the README generator reads (Category/Status/Curation) so
-  # the regression isolates the octal-eval boundary, not fixture malformation.
-  cat > docs/risks/R008-pre-existing.active.md <<'EOF'
-# Risk R008: Pre Existing
-**Status**: Active
-**Category**: operational
-**Curation**: (human-curated)
-EOF
-  mkdir -p .risk-reports
-  cat > .risk-reports/octal.md <<'EOF'
-RISK_REGISTER_HINT:
-- above-appetite-residual | octal-boundary-slug | New risk past the 008 boundary
-EOF
-  run "$SCRIPT"
-  [ "$status" -eq 0 ]
-  # No octal-base error in output
-  [[ "$output" != *"value too great for base"* ]]
-  # New entry allocated as R009, not a corrupted/duplicate ID
-  [ -f docs/risks/R009-octal-boundary-slug.active.md ]
-}

package/scripts/test/restage-commit.bats

@@ -1,137 +0,0 @@
-#!/usr/bin/env bats
-# Behavioural-fixture coverage for packages/risk-scorer/scripts/restage-commit.sh
-# per ADR-052 (behavioural tests default) and P326 (re-stage-after-scorer-delegation).
-#
-# The script is invoked AFTER the agent delegates to wr-risk-scorer:pipeline
-# to land the commit atomically — re-stages paths the Agent-tool boundary cleared
-# from the index, asserts staging is non-empty, then runs `git commit` with the
-# caller's -m args. Eliminates the silent re-add round-trip P326 documented.
-#
-# Surface:
-#   wr-risk-scorer-restage-commit -m "<msg>" [-m "<trailer>"] -- <path1> [<path2>...]
-
-setup() {
-  REPO_ROOT="$(cd "$(dirname "$BATS_TEST_FILENAME")/../../../.." && pwd)"
-  SCRIPT="$REPO_ROOT/packages/risk-scorer/scripts/restage-commit.sh"
-  SHIM="$REPO_ROOT/packages/risk-scorer/bin/wr-risk-scorer-restage-commit"
-  WORK_DIR="$(mktemp -d)"
-  cd "$WORK_DIR"
-  git init --quiet
-  git config user.email "restage-test@example.com"
-  git config user.name "Restage Test"
-  git config commit.gpgsign false
-  git commit --quiet --allow-empty -m "init"
-}
-
-teardown() {
-  cd /
-  rm -rf "$WORK_DIR"
-}
-
-@test "shim wrapper exists and is executable" {
-  [ -x "$SHIM" ]
-}
-
-@test "shim resolves canonical script (not exit 127)" {
-  echo "seed" > seed.txt
-  run "$SHIM" -m "test" -- seed.txt
-  [ "$status" -ne 127 ]
-}
-
-@test "single path: re-stages and commits (the P326 happy path)" {
-  echo "content" > file.txt
-  run bash "$SCRIPT" -m "test: commit file" -- file.txt
-  [ "$status" -eq 0 ]
-  run git log -1 --name-only --format=
-  echo "$output" | grep -q '^file\.txt$'
-}
-
-@test "multi-path: re-stages all paths and commits them in one commit" {
-  echo "a" > a.txt
-  echo "b" > b.txt
-  echo "c" > c.txt
-  run bash "$SCRIPT" -m "test: multi" -- a.txt b.txt c.txt
-  [ "$status" -eq 0 ]
-  run git log -1 --name-only --format=
-  echo "$output" | grep -q '^a\.txt$'
-  echo "$output" | grep -q '^b\.txt$'
-  echo "$output" | grep -q '^c\.txt$'
-}
-
-@test "multiple -m flags pass through (trailer like RISK_BYPASS)" {
-  echo "x" > x.txt
-  run bash "$SCRIPT" \
-    -m "docs(problems): capture P999 test" \
-    -m "RISK_BYPASS: capture-deferred-readme" \
-    -- x.txt
-  [ "$status" -eq 0 ]
-  run git log -1 --format=%B
-  echo "$output" | grep -q '^docs(problems): capture P999 test'
-  echo "$output" | grep -q 'RISK_BYPASS: capture-deferred-readme'
-}
-
-@test "missing -m flag → exit 1, no commit" {
-  echo "x" > x.txt
-  run bash "$SCRIPT" -- x.txt
-  [ "$status" -ne 0 ]
-  echo "$output" | grep -qi 'message\|usage'
-  run git log --oneline
-  [ "$(echo "$output" | wc -l | tr -d ' ')" = "1" ]
-}
-
-@test "missing -- separator → exit 1" {
-  echo "x" > x.txt
-  run bash "$SCRIPT" -m "test" x.txt
-  [ "$status" -ne 0 ]
-  echo "$output" | grep -qi 'separator\|usage'
-}
-
-@test "no paths after -- → exit 1, no commit" {
-  run bash "$SCRIPT" -m "test" --
-  [ "$status" -ne 0 ]
-  echo "$output" | grep -qi 'path\|usage'
-  run git log --oneline
-  [ "$(echo "$output" | wc -l | tr -d ' ')" = "1" ]
-}
-
-@test "nothing staged after re-add → exit 1, no commit (e.g. unchanged file)" {
-  echo "tracked" > tracked.txt
-  git add tracked.txt
-  git commit --quiet -m "seed tracked"
-  run bash "$SCRIPT" -m "test: should fail" -- tracked.txt
-  [ "$status" -ne 0 ]
-  echo "$output" | grep -qi 'nothing staged\|empty'
-  run git log --oneline
-  [ "$(echo "$output" | wc -l | tr -d ' ')" = "2" ]
-}
-
-@test "path that doesn't exist → exit non-zero (git add propagates)" {
-  run bash "$SCRIPT" -m "test" -- nonexistent.txt
-  [ "$status" -ne 0 ]
-}
-
-@test "rename via git mv survives the re-stage-and-commit (P057 + P326 compose)" {
-  echo "v1" > orig.md
-  git add orig.md
-  git commit --quiet -m "seed"
-  git mv orig.md renamed.md
-  echo "v2" >> renamed.md
-  run bash "$SCRIPT" -m "test: rename+edit" -- renamed.md
-  [ "$status" -eq 0 ]
-  run git log -1 --name-only --format=
-  echo "$output" | grep -q '^renamed\.md$'
-  [ ! -f orig.md ]
-  run cat renamed.md
-  echo "$output" | grep -q 'v2'
-}
-
-@test "doesn't touch unrelated unstaged changes" {
-  echo "subject" > subject.txt
-  echo "bystander" > bystander.txt
-  run bash "$SCRIPT" -m "test: subject only" -- subject.txt
-  [ "$status" -eq 0 ]
-  run git status --porcelain bystander.txt
-  echo "$output" | grep -q '^?? bystander\.txt'
-  run git log -1 --name-only --format=
-  ! echo "$output" | grep -q '^bystander\.txt$'
-}