agentic-orchestrator 0.1.2 → 0.1.4

package/apps/control-plane/test/parallel-gates.spec.ts

@@ -0,0 +1,312 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { buildExecutionWaves } from '../src/core/gates.js';
+import type { GateStep, PolicyShape, GateProfile } from '../src/core/gates.js';
+
+const runCommandMock = vi.hoisted(() => vi.fn());
+
+vi.mock('../src/core/git.js', () => ({
+  runCommand: runCommandMock
+}));
+
+// Re-import after mock
+const { GateExecutionService, CoverageThresholdPolicy } = await import('../src/core/gates.js');
+
+describe('parallel gate execution', () => {
+  let tempDir: string;
+  let logDir: string;
+  let evidenceDir: string;
+
+  const defaultPolicy: PolicyShape = {
+    execution: {
+      retry_policy: { transient_max_retries: 0, transient_error_codes: [] },
+      env_allowlist: [],
+      default_step_timeout_seconds: 60
+    },
+    testing: {
+      coverage: {
+        minimums: { line: 0, branch: 0 },
+        targets: { line: 1, branch: 1 }
+      }
+    }
+  };
+
+  beforeEach(async () => {
+    tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'aop-parallel-gates-'));
+    logDir = path.join(tempDir, 'logs');
+    evidenceDir = path.join(tempDir, 'evidence');
+    await fs.mkdir(logDir, { recursive: true });
+    await fs.mkdir(evidenceDir, { recursive: true });
+    runCommandMock.mockReset();
+  });
+
+  afterEach(async () => {
+    await fs.rm(tempDir, { recursive: true });
+    vi.restoreAllMocks();
+  });
+
+  describe('buildExecutionWaves', () => {
+    it('GIVEN steps with same parallel_group THEN they appear in the same wave', () => {
+      const steps: GateStep[] = [
+        { name: 'lint', cmd: ['eslint', '.'], parallel_group: 'static' },
+        { name: 'typecheck', cmd: ['tsc', '--noEmit'], parallel_group: 'static' },
+        { name: 'test', cmd: ['vitest', 'run'], depends_on: ['lint', 'typecheck'] }
+      ];
+
+      const waves = buildExecutionWaves(steps);
+      expect(waves).toHaveLength(2);
+      expect(waves[0].map((s) => s.name)).toEqual(expect.arrayContaining(['lint', 'typecheck']));
+      expect(waves[1].map((s) => s.name)).toEqual(['test']);
+    });
+
+    it('GIVEN no parallel config THEN each step is its own wave', () => {
+      const steps: GateStep[] = [
+        { name: 'lint', cmd: ['eslint', '.'] },
+        { name: 'test', cmd: ['vitest', 'run'] }
+      ];
+
+      const waves = buildExecutionWaves(steps);
+      // Without depends_on, all steps have their deps met immediately — they go into wave 1
+      expect(waves).toHaveLength(1);
+      expect(waves[0]).toHaveLength(2);
+    });
+
+    it('GIVEN chain of depends_on THEN steps form sequential waves', () => {
+      const steps: GateStep[] = [
+        { name: 'step1', cmd: ['echo', '1'] },
+        { name: 'step2', cmd: ['echo', '2'], depends_on: ['step1'] },
+        { name: 'step3', cmd: ['echo', '3'], depends_on: ['step2'] }
+      ];
+
+      const waves = buildExecutionWaves(steps);
+      expect(waves).toHaveLength(3);
+      expect(waves[0][0].name).toBe('step1');
+      expect(waves[1][0].name).toBe('step2');
+      expect(waves[2][0].name).toBe('step3');
+    });
+
+    it('GIVEN mixed parallel and sequential steps THEN correct wave ordering', () => {
+      const steps: GateStep[] = [
+        { name: 'lint', cmd: ['eslint'], parallel_group: 'checks' },
+        { name: 'typecheck', cmd: ['tsc'], parallel_group: 'checks' },
+        { name: 'unit_test', cmd: ['vitest'], depends_on: ['lint', 'typecheck'] },
+        { name: 'integration', cmd: ['vitest', '--integration'], depends_on: ['lint', 'typecheck'] }
+      ];
+
+      const waves = buildExecutionWaves(steps);
+      expect(waves).toHaveLength(2);
+      expect(waves[0].map((s) => s.name).sort()).toEqual(['lint', 'typecheck']);
+      expect(waves[1].map((s) => s.name).sort()).toEqual(['integration', 'unit_test']);
+    });
+  });
+
+  describe('GateExecutionService.runMode — parallel behavior', () => {
+    it('GIVEN steps with parallel_group WHEN gate runs THEN steps in same group execute concurrently', async () => {
+      const executionOrder: string[] = [];
+      runCommandMock.mockImplementation(async (cmd: string) => {
+        executionOrder.push(cmd);
+        return { code: 0, signal: null, stdout: '', stderr: '', timeout: false };
+      });
+
+      const profile: GateProfile = {
+        modes: {
+          fast: [
+            { name: 'lint', cmd: ['lint-cmd'], parallel_group: 'static' },
+            { name: 'typecheck', cmd: ['typecheck-cmd'], parallel_group: 'static' },
+            { name: 'test', cmd: ['test-cmd'], depends_on: ['lint', 'typecheck'] }
+          ]
+        }
+      };
+
+      const service = new GateExecutionService(new CoverageThresholdPolicy());
+      const result = await service.runMode({
+        featureId: 'feat-1',
+        mode: 'fast',
+        profileName: 'default',
+        profile,
+        policy: defaultPolicy,
+        worktreePath: tempDir,
+        logDirectory: logDir,
+        evidenceDirectory: evidenceDir
+      });
+
+      expect(result['overall']).toBe('pass');
+      const stepResults = result['step_results'] as Array<Record<string, unknown>>;
+      expect(stepResults).toHaveLength(3);
+      // test-cmd must run after lint-cmd and typecheck-cmd
+      const testIdx = executionOrder.indexOf('test-cmd');
+      expect(testIdx).toBe(2);
+    });
+
+    it('GIVEN step with depends_on WHEN dependency fails THEN dependent step is skipped', async () => {
+      runCommandMock.mockImplementation(async (cmd: string) => {
+        if (cmd === 'lint-cmd') {
+          return { code: 1, signal: null, stdout: '', stderr: 'lint error', timeout: false };
+        }
+        return { code: 0, signal: null, stdout: '', stderr: '', timeout: false };
+      });
+
+      const profile: GateProfile = {
+        modes: {
+          fast: [
+            { name: 'lint', cmd: ['lint-cmd'], parallel_group: 'static' },
+            { name: 'typecheck', cmd: ['typecheck-cmd'], parallel_group: 'static' },
+            { name: 'test', cmd: ['test-cmd'], depends_on: ['lint', 'typecheck'] }
+          ]
+        }
+      };
+
+      const service = new GateExecutionService(new CoverageThresholdPolicy());
+      const result = await service.runMode({
+        featureId: 'feat-1',
+        mode: 'fast',
+        profileName: 'default',
+        profile,
+        policy: defaultPolicy,
+        worktreePath: tempDir,
+        logDirectory: logDir,
+        evidenceDirectory: evidenceDir
+      });
+
+      expect(result['overall']).toBe('fail');
+      const stepResults = result['step_results'] as Array<Record<string, unknown>>;
+      const testStep = stepResults.find((s) => s['name'] === 'test');
+      expect(testStep).toBeDefined();
+      expect(testStep?.['skipped']).toBe(true);
+      expect(testStep?.['skip_reason']).toBe('dependency_failed');
+    });
+
+    it('GIVEN no parallel config WHEN gate runs THEN sequential execution preserved (backward compat)', async () => {
+      const executionOrder: string[] = [];
+      runCommandMock.mockImplementation(async (cmd: string) => {
+        executionOrder.push(cmd);
+        return { code: 0, signal: null, stdout: '', stderr: '', timeout: false };
+      });
+
+      const profile: GateProfile = {
+        modes: {
+          fast: [
+            { name: 'lint', cmd: ['lint-cmd'] },
+            { name: 'test', cmd: ['test-cmd'] }
+          ]
+        }
+      };
+
+      const service = new GateExecutionService(new CoverageThresholdPolicy());
+      const result = await service.runMode({
+        featureId: 'feat-1',
+        mode: 'fast',
+        profileName: 'default',
+        profile,
+        policy: defaultPolicy,
+        worktreePath: tempDir,
+        logDirectory: logDir,
+        evidenceDirectory: evidenceDir
+      });
+
+      expect(result['overall']).toBe('pass');
+      expect(executionOrder).toEqual(['lint-cmd', 'test-cmd']);
+    });
+
+    it('GIVEN no parallel config and first step fails WHEN gate runs THEN second step does not execute', async () => {
+      const executionOrder: string[] = [];
+      runCommandMock.mockImplementation(async (cmd: string) => {
+        executionOrder.push(cmd);
+        if (cmd === 'lint-cmd') {
+          return { code: 1, signal: null, stdout: '', stderr: 'fail', timeout: false };
+        }
+        return { code: 0, signal: null, stdout: '', stderr: '', timeout: false };
+      });
+
+      const profile: GateProfile = {
+        modes: {
+          fast: [
+            { name: 'lint', cmd: ['lint-cmd'] },
+            { name: 'test', cmd: ['test-cmd'] }
+          ]
+        }
+      };
+
+      const service = new GateExecutionService(new CoverageThresholdPolicy());
+      const result = await service.runMode({
+        featureId: 'feat-1',
+        mode: 'fast',
+        profileName: 'default',
+        profile,
+        policy: defaultPolicy,
+        worktreePath: tempDir,
+        logDirectory: logDir,
+        evidenceDirectory: evidenceDir
+      });
+
+      expect(result['overall']).toBe('fail');
+      expect(executionOrder).toEqual(['lint-cmd']);
+    });
+
+    it('GIVEN all parallel steps fail WHEN gate runs THEN all failures captured in evidence', async () => {
+      runCommandMock.mockResolvedValue({ code: 1, signal: null, stdout: '', stderr: 'fail', timeout: false });
+
+      const profile: GateProfile = {
+        modes: {
+          fast: [
+            { name: 'lint', cmd: ['lint-cmd'], parallel_group: 'static' },
+            { name: 'typecheck', cmd: ['typecheck-cmd'], parallel_group: 'static' }
+          ]
+        }
+      };
+
+      const service = new GateExecutionService(new CoverageThresholdPolicy());
+      const result = await service.runMode({
+        featureId: 'feat-1',
+        mode: 'fast',
+        profileName: 'default',
+        profile,
+        policy: defaultPolicy,
+        worktreePath: tempDir,
+        logDirectory: logDir,
+        evidenceDirectory: evidenceDir
+      });
+
+      expect(result['overall']).toBe('fail');
+      const stepResults = result['step_results'] as Array<Record<string, unknown>>;
+      expect(stepResults).toHaveLength(2);
+      expect(stepResults.every((s) => s['exit_code'] === 1)).toBe(true);
+    });
+
+    it('GIVEN parallel steps WHEN evidence written THEN timing metadata present', async () => {
+      runCommandMock.mockResolvedValue({ code: 0, signal: null, stdout: '', stderr: '', timeout: false });
+
+      const profile: GateProfile = {
+        modes: {
+          fast: [
+            { name: 'lint', cmd: ['lint-cmd'], parallel_group: 'static' },
+            { name: 'typecheck', cmd: ['typecheck-cmd'], parallel_group: 'static' }
+          ]
+        }
+      };
+
+      const service = new GateExecutionService(new CoverageThresholdPolicy());
+      const result = await service.runMode({
+        featureId: 'feat-1',
+        mode: 'fast',
+        profileName: 'default',
+        profile,
+        policy: defaultPolicy,
+        worktreePath: tempDir,
+        logDirectory: logDir,
+        evidenceDirectory: evidenceDir
+      });
+
+      const stepResults = result['step_results'] as Array<Record<string, unknown>>;
+      for (const step of stepResults) {
+        expect(step['started_at']).toBeDefined();
+        expect(step['finished_at']).toBeDefined();
+        expect(step['parallel_group']).toBe('static');
+        expect(typeof step['started_at']).toBe('string');
+        expect(typeof step['finished_at']).toBe('string');
+      }
+    });
+  });
+});

package/apps/control-plane/test/patch-service.spec.ts

@@ -0,0 +1,253 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { PatchService } from '../src/application/services/patch-service.js';
+
+vi.mock('../src/core/git.js', () => ({
+  runGit: vi.fn()
+}));
+vi.mock('../src/core/patch.js', () => ({
+  parseUnifiedDiff: vi.fn(() => []),
+  touchedPathsFromDiff: vi.fn(() => [])
+}));
+vi.mock('../src/core/path-rules.js', () => ({
+  normalizeRepoPath: vi.fn(async (_root: string, p: string) => p),
+  anyAreaMatch: vi.fn(() => false),
+  sortResourcesDeterministically: vi.fn((r: string[]) => [...new Set(r)].sort())
+}));
+vi.mock('../src/core/qa-index.js', () => ({
+  buildQaIndex: vi.fn(() => ({ version: 1, tests: [] })),
+  makeRequiredTests: vi.fn(() => [])
+}));
+vi.mock('../src/core/fs.js', () => ({
+  readJson: vi.fn(async () => null),
+  atomicWriteJson: vi.fn(async () => undefined)
+}));
+
+import { runGit } from '../src/core/git.js';
+import { parseUnifiedDiff, touchedPathsFromDiff } from '../src/core/patch.js';
+import { anyAreaMatch, normalizeRepoPath } from '../src/core/path-rules.js';
+import { readJson } from '../src/core/fs.js';
+
+function makePort(overrides: Partial<{
+  plan: unknown;
+  enforcePlan: boolean;
+  enforceAllowedAreas: boolean;
+  allowedAreas: string[];
+  forbiddenAreas: string[];
+  protectedAreas: string[];
+  heldLocks: string[];
+  openapi: string;
+  events: string;
+  db: string;
+}> = {}) {
+  const o = {
+    plan: null as unknown,
+    enforcePlan: true,
+    enforceAllowedAreas: false,
+    allowedAreas: [] as string[],
+    forbiddenAreas: [] as string[],
+    protectedAreas: [] as string[],
+    heldLocks: [] as string[],
+    openapi: 'none',
+    events: 'none',
+    db: 'none',
+    ...overrides
+  };
+
+  return {
+    getRepoRoot: vi.fn(() => '/repo'),
+    getPolicySnapshot: vi.fn(() => ({
+      patch_policy: { enforce_plan: o.enforcePlan, enforce_allowed_areas: o.enforceAllowedAreas },
+      path_rules: { matching: 'repo_prefix', allow_symlink_traversal: false },
+      locks: {
+        contract_to_resource: { openapi: 'openapi', events: 'events', db: 'db' }
+      },
+      protected_areas: o.protectedAreas
+    })),
+    getGatesConfig: vi.fn(() => ({ profiles: { default: { modes: { fast: [], full: [], merge: [] } } } })),
+    planPath: vi.fn(() => '/repo/.aop/features/f1/plan.json'),
+    qaIndexPath: vi.fn(() => '/repo/.aop/features/f1/qa_test_index.json'),
+    worktreePath: vi.fn(() => '/worktree/f1'),
+    readState: vi.fn(async () => ({ frontMatter: { locks: { held: o.heldLocks } } })),
+    validateSchema: vi.fn(async () => ({ valid: true })),
+    updateState: vi.fn(async (_id: string, _v: unknown, cb: (fm: object, body: string) => Promise<{ frontMatter?: object; body?: string }>) => {
+      return await cb({}, '');
+    }),
+    __plan: o.plan,
+    __openapi: o.openapi,
+    __events: o.events,
+    __db: o.db
+  };
+}
+
+describe('PatchService', () => {
+  beforeEach(() => { vi.clearAllMocks(); });
+
+  describe('loadAcceptedPlan', () => {
+    it('GIVEN_enforce_plan_true_and_no_plan_file_WHEN_loadAcceptedPlan_called_THEN_throws_PLAN_REQUIRED', async () => {
+      vi.mocked(readJson).mockResolvedValue(null);
+      const port = makePort({ enforcePlan: true });
+      const svc = new PatchService(port);
+      await expect(svc.loadAcceptedPlan('f1')).rejects.toMatchObject({
+        normalizedResponse: expect.objectContaining({ ok: false })
+      });
+    });
+
+    it('GIVEN_enforce_plan_false_and_no_plan_file_WHEN_loadAcceptedPlan_called_THEN_returns_null', async () => {
+      vi.mocked(readJson).mockResolvedValue(null);
+      const port = makePort({ enforcePlan: false });
+      const svc = new PatchService(port);
+      const result = await svc.loadAcceptedPlan('f1');
+      expect(result).toBeNull();
+    });
+
+    it('GIVEN_plan_file_exists_WHEN_loadAcceptedPlan_called_THEN_returns_plan', async () => {
+      const plan = { plan_version: 1, allowed_areas: [] };
+      vi.mocked(readJson).mockResolvedValue(plan);
+      const port = makePort();
+      const svc = new PatchService(port);
+      const result = await svc.loadAcceptedPlan('f1');
+      expect(result).toEqual(plan);
+    });
+  });
+
+  describe('requiredResourcesForPlan', () => {
+    it('GIVEN_openapi_modify_WHEN_requiredResourcesForPlan_THEN_includes_openapi_resource', () => {
+      const port = makePort();
+      const svc = new PatchService(port);
+      const result = svc.requiredResourcesForPlan({ contracts: { openapi: 'modify', events: 'none', db: 'none' } });
+      expect(result).toContain('openapi');
+    });
+
+    it('GIVEN_events_modify_WHEN_requiredResourcesForPlan_THEN_includes_events_resource', () => {
+      const port = makePort();
+      const svc = new PatchService(port);
+      const result = svc.requiredResourcesForPlan({ contracts: { openapi: 'none', events: 'modify', db: 'none' } });
+      expect(result).toContain('events');
+    });
+
+    it('GIVEN_db_migration_WHEN_requiredResourcesForPlan_THEN_includes_db_resource', () => {
+      const port = makePort();
+      const svc = new PatchService(port);
+      const result = svc.requiredResourcesForPlan({ contracts: { openapi: 'none', events: 'none', db: 'migration' } });
+      expect(result).toContain('db');
+    });
+
+    it('GIVEN_no_contracts_WHEN_requiredResourcesForPlan_THEN_returns_empty', () => {
+      const port = makePort();
+      const svc = new PatchService(port);
+      const result = svc.requiredResourcesForPlan({ contracts: { openapi: 'none', events: 'none', db: 'none' } });
+      expect(result).toHaveLength(0);
+    });
+  });
+
+  describe('assertPlanLocksHeld', () => {
+    it('GIVEN_all_required_locks_held_WHEN_assertPlanLocksHeld_THEN_resolves_without_error', async () => {
+      const port = makePort({ heldLocks: ['openapi'] });
+      const svc = new PatchService(port);
+      await expect(svc.assertPlanLocksHeld('f1', { contracts: { openapi: 'modify', events: 'none', db: 'none' } })).resolves.toBeUndefined();
+    });
+
+    it('GIVEN_required_lock_not_held_WHEN_assertPlanLocksHeld_THEN_throws_LOCK_NOT_HELD', async () => {
+      const port = makePort({ heldLocks: [] });
+      const svc = new PatchService(port);
+      await expect(
+        svc.assertPlanLocksHeld('f1', { contracts: { openapi: 'modify', events: 'none', db: 'none' } })
+      ).rejects.toMatchObject({ normalizedResponse: expect.objectContaining({ ok: false }) });
+    });
+  });
+
+  describe('validatePatchPaths', () => {
+    it('GIVEN_file_in_forbidden_area_WHEN_validatePatchPaths_THEN_throws_violation', async () => {
+      vi.mocked(touchedPathsFromDiff).mockReturnValue(['src/evil.ts']);
+      vi.mocked(normalizeRepoPath).mockResolvedValue('src/evil.ts');
+      vi.mocked(anyAreaMatch).mockReturnValue(true);
+      const port = makePort({ forbiddenAreas: ['src'] });
+      const svc = new PatchService(port);
+      const plan = { allowed_areas: [], forbidden_areas: ['src'], files: { create: ['src/evil.ts'], modify: [], delete: [] } };
+      await expect(svc.validatePatchPaths('f1', [] as never, plan)).rejects.toMatchObject({
+        normalizedResponse: expect.objectContaining({ ok: false })
+      });
+    });
+
+    it('GIVEN_file_outside_allowed_areas_with_enforcement_WHEN_validatePatchPaths_THEN_throws', async () => {
+      vi.mocked(touchedPathsFromDiff).mockReturnValue(['src/file.ts']);
+      vi.mocked(normalizeRepoPath).mockResolvedValue('src/file.ts');
+      vi.mocked(anyAreaMatch).mockReturnValue(false);
+      const port = makePort({ enforceAllowedAreas: true, allowedAreas: ['lib'] });
+      const svc = new PatchService(port);
+      await expect(svc.validatePatchPaths('f1', [] as never, { allowed_areas: ['lib'], forbidden_areas: [], files: { create: [], modify: [], delete: [] } })).rejects.toMatchObject({
+        normalizedResponse: expect.objectContaining({ ok: false })
+      });
+    });
+
+    it('GIVEN_file_not_in_plan_file_set_WHEN_validatePatchPaths_THEN_throws', async () => {
+      vi.mocked(touchedPathsFromDiff).mockReturnValue(['src/unplanned.ts']);
+      vi.mocked(normalizeRepoPath).mockResolvedValue('src/unplanned.ts');
+      vi.mocked(anyAreaMatch).mockReturnValue(false);
+      const port = makePort();
+      const svc = new PatchService(port);
+      const plan = { allowed_areas: [], forbidden_areas: [], files: { create: ['src/other.ts'], modify: [], delete: [] } };
+      await expect(svc.validatePatchPaths('f1', [] as never, plan)).rejects.toMatchObject({
+        normalizedResponse: expect.objectContaining({ ok: false })
+      });
+    });
+
+    it('GIVEN_no_violations_WHEN_validatePatchPaths_THEN_returns_normalized_paths', async () => {
+      vi.mocked(touchedPathsFromDiff).mockReturnValue(['src/file.ts']);
+      vi.mocked(normalizeRepoPath).mockResolvedValue('src/file.ts');
+      vi.mocked(anyAreaMatch).mockReturnValue(false);
+      const port = makePort();
+      const svc = new PatchService(port);
+      const plan = { allowed_areas: [], forbidden_areas: [], files: { create: ['src/file.ts'], modify: [], delete: [] } };
+      const result = await svc.validatePatchPaths('f1', [] as never, plan);
+      expect(result).toEqual(['src/file.ts']);
+    });
+  });
+
+  describe('repoApplyPatch', () => {
+    it('GIVEN_git_apply_fails_WHEN_repoApplyPatch_THEN_throws_GIT_FAILURE', async () => {
+      vi.mocked(readJson).mockResolvedValue({ allowed_areas: [], forbidden_areas: [], files: { create: [], modify: [], delete: [] }, contracts: { openapi: 'none', events: 'none', db: 'none' }, gate_profile: 'default' });
+      vi.mocked(parseUnifiedDiff).mockReturnValue([]);
+      vi.mocked(touchedPathsFromDiff).mockReturnValue([]);
+      vi.mocked(runGit).mockResolvedValue({ code: 1, signal: null, stdout: '', stderr: 'apply failed', timeout: false });
+      const port = makePort({ heldLocks: [] });
+      const svc = new PatchService(port);
+      await expect(svc.repoApplyPatch('f1', 'diff --git a/f b/f\n')).rejects.toMatchObject({
+        normalizedResponse: expect.objectContaining({ ok: false })
+      });
+    });
+
+    it('GIVEN_git_apply_succeeds_WHEN_repoApplyPatch_THEN_returns_changed_files', async () => {
+      vi.mocked(readJson).mockResolvedValue({ allowed_areas: [], forbidden_areas: [], files: { create: ['src/a.ts'], modify: [], delete: [] }, contracts: { openapi: 'none', events: 'none', db: 'none' }, gate_profile: 'default' });
+      vi.mocked(parseUnifiedDiff).mockReturnValue([]);
+      vi.mocked(touchedPathsFromDiff).mockReturnValue(['src/a.ts']);
+      vi.mocked(normalizeRepoPath).mockResolvedValue('src/a.ts');
+      vi.mocked(anyAreaMatch).mockReturnValue(false);
+      vi.mocked(runGit)
+        .mockResolvedValueOnce({ code: 0, signal: null, stdout: '', stderr: '', timeout: false }) // apply
+        .mockResolvedValueOnce({ code: 0, signal: null, stdout: 'M src/a.ts\n', stderr: '', timeout: false }) // status
+        .mockResolvedValueOnce({ code: 0, signal: null, stdout: 'src/a.ts\n', stderr: '', timeout: false }); // diff
+      const port = makePort({ heldLocks: [] });
+      const svc = new PatchService(port);
+      const result = await svc.repoApplyPatch('f1', 'diff --git a/src/a.ts b/src/a.ts\n');
+      expect(result.data.changed_files).toContain('src/a.ts');
+      expect(result.data.feature_id).toBe('f1');
+    });
+
+    it('GIVEN_qa_index_validation_fails_WHEN_repoApplyPatch_THEN_throws_INTERNAL_ERROR', async () => {
+      vi.mocked(readJson).mockResolvedValue({ allowed_areas: [], forbidden_areas: [], files: { create: [], modify: [], delete: [] }, contracts: { openapi: 'none', events: 'none', db: 'none' }, gate_profile: 'default' });
+      vi.mocked(parseUnifiedDiff).mockReturnValue([]);
+      vi.mocked(touchedPathsFromDiff).mockReturnValue([]);
+      vi.mocked(runGit)
+        .mockResolvedValueOnce({ code: 0, signal: null, stdout: '', stderr: '', timeout: false })
+        .mockResolvedValueOnce({ code: 0, signal: null, stdout: '', stderr: '', timeout: false })
+        .mockResolvedValueOnce({ code: 0, signal: null, stdout: '', stderr: '', timeout: false });
+      const port = makePort({ heldLocks: [] });
+      port.validateSchema.mockResolvedValue({ valid: false });
+      const svc = new PatchService(port);
+      await expect(svc.repoApplyPatch('f1', '')).rejects.toMatchObject({
+        normalizedResponse: expect.objectContaining({ ok: false })
+      });
+    });
+  });
+});