agentic-workflow-manager 9.2.1 → 9.4.0

package/dist/tests/commands/preflight/preflight.test.js

@@ -10,6 +10,7 @@ const child_process_1 = require("child_process");
 const checks_1 = require("../../../src/commands/preflight/checks");
 const preflight_1 = require("../../../src/commands/preflight");
 const run_1 = require("../../../src/commands/sensors/run");
+const check_1 = require("../../../src/core/currentness/check");
 // Only `execSync` (used by `resolveOnPath` to check for `gh`/`glab`) is mocked — `git
 // remote get-url origin` runs for real via `execFileSync` against real tmpdir git repos,
 // same as every other check in this file exercises the real filesystem.
@@ -21,8 +22,12 @@ jest.mock('../../../src/commands/sensors/run', () => ({
     ...jest.requireActual('../../../src/commands/sensors/run'),
     runSensors: jest.fn(),
 }));
+jest.mock('../../../src/core/currentness/check', () => ({
+    checkCurrentness: jest.fn(),
+}));
 const mockExecSync = child_process_1.execSync;
 const mockRunSensors = run_1.runSensors;
+const mockCheckCurrentness = check_1.checkCurrentness;
 /** Turn a tmpdir into a real git repo with (optionally) an `origin` remote. */
 function gitRepo(dir, remoteUrl) {
     (0, child_process_1.execFileSync)('git', ['init'], { cwd: dir, stdio: 'pipe' });
@@ -51,19 +56,250 @@ function project(opts = {}) {
 const dirs = [];
 const make = (o) => { const d = project(o); dirs.push(d); return d; };
 afterAll(() => dirs.forEach(d => fs_1.default.rmSync(d, { recursive: true, force: true })));
+let previousAwmHome;
+const awmHomes = [];
+beforeEach(() => {
+    previousAwmHome = process.env.AWM_HOME;
+    const awmHome = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-preflight-home-'));
+    awmHomes.push(awmHome);
+    process.env.AWM_HOME = awmHome;
+});
+afterEach(() => {
+    if (previousAwmHome === undefined)
+        delete process.env.AWM_HOME;
+    else
+        process.env.AWM_HOME = previousAwmHome;
+});
+afterAll(() => awmHomes.forEach(dir => fs_1.default.rmSync(dir, { recursive: true, force: true })));
+function installRegistry(manifest, name = 'test-registry') {
+    const awmHome = process.env.AWM_HOME;
+    const root = path_1.default.join(awmHome, 'registries', name);
+    fs_1.default.mkdirSync(path_1.default.join(root, 'skills'), { recursive: true });
+    const config = fs_1.default.existsSync(path_1.default.join(awmHome, 'registries.json'))
+        ? JSON.parse(fs_1.default.readFileSync(path_1.default.join(awmHome, 'registries.json'), 'utf8'))
+        : [];
+    config.push({ name, remote: `https://example.invalid/${name}.git` });
+    fs_1.default.writeFileSync(path_1.default.join(awmHome, 'registries.json'), JSON.stringify(config));
+    fs_1.default.writeFileSync(path_1.default.join(root, 'awm-registry.json'), JSON.stringify(manifest));
+}
+function writeValidKernel(dir) {
+    fs_1.default.writeFileSync(path_1.default.join(dir, 'AGENTS.md'), '<!-- AWM:CONTEXT-KERNEL:START v1 -->\nagent rules\n<!-- AWM:CONTEXT-KERNEL:END v1 -->\n');
+    fs_1.default.writeFileSync(path_1.default.join(dir, 'CONSTITUTION.md'), '<!-- AWM:CONTEXT-KERNEL:START v1 -->\n<!-- awm-context:CTX-PROCESS-001 -->\nprocess rules\n<!-- AWM:CONTEXT-KERNEL:END v1 -->\n');
+    const card = path_1.default.join(dir, 'docs', 'awm', 'context', 'releases.md');
+    fs_1.default.mkdirSync(path_1.default.dirname(card), { recursive: true });
+    fs_1.default.writeFileSync(card, '<!-- awm-context:CTX-RELEASE-001 -->\nrelease rules\n');
+    fs_1.default.mkdirSync(path_1.default.join(dir, '.awm', 'context'), { recursive: true });
+    fs_1.default.writeFileSync(path_1.default.join(dir, '.awm', 'context', 'index.json'), JSON.stringify({
+        schema: 1,
+        kernelFiles: ['AGENTS.md', 'CONSTITUTION.md'],
+        maxFixedBytes: 33_740,
+        entries: [
+            { id: 'CTX-PROCESS-001', tier: 'kernel', path: 'CONSTITUTION.md', anchor: 'awm-context:CTX-PROCESS-001', when: 'always' },
+            { id: 'CTX-RELEASE-001', tier: 'selective', path: 'docs/awm/context/releases.md', anchor: 'awm-context:CTX-RELEASE-001', when: 'release automation' },
+        ],
+    }));
+}
+function writePartialKernel(dir) {
+    fs_1.default.writeFileSync(path_1.default.join(dir, 'AGENTS.md'), '<!-- AWM:CONTEXT-KERNEL:START v1 -->\nagent rules\n');
+}
 const check = (r, id) => r.checks.find(c => c.id === id);
 describe('preflight', () => {
-    afterEach(() => mockRunSensors.mockReset());
+    beforeEach(() => {
+        mockCheckCurrentness.mockResolvedValue({
+            checkedAt: '2026-08-26T00:00:00.000Z',
+            compatibility: { status: 'not-checked' },
+            components: [{
+                    component: 'cli', installed: '9.3.0', latest: '9.3.0', channel: 'stable',
+                    source: 'https://registry.npmjs.org/agentic-workflow-manager',
+                    checkedAt: '2026-08-26T00:00:00.000Z', status: 'current',
+                    detail: 'Installed version matches npm dist-tags.latest.', remedy: 'No action required.',
+                }],
+        });
+    });
+    afterEach(() => {
+        mockRunSensors.mockReset();
+        mockCheckCurrentness.mockReset();
+    });
+    it('does not add a row when no registry declares the schema', async () => {
+        installRegistry({ minCliVersion: '9.2.1' });
+        const report = await (0, checks_1.preflight)(make({
+            manifest: { pack: 'generic', sensors: { security: { enabled: false } } },
+        }));
+        expect(report.checks.map(c => c.id)).not.toContain('context-kernel');
+    });
+    it('blocks preflight when an active registry declares an invalid context kernel schema', async () => {
+        installRegistry({ projectContextSchema: 2 });
+        const report = await (0, checks_1.preflight)(make({
+            manifest: { pack: 'generic', sensors: { security: { enabled: false } } },
+        }));
+        expect(report.status).toBe('degraded');
+        expect((0, preflight_1.exitCodeFor)(report)).toBe(1);
+        expect(check(report, 'context-kernel')).toMatchObject({
+            ok: false,
+            advisory: false,
+            detail: expect.stringMatching(/projectContextSchema.*exactly 1.*2/),
+        });
+    });
+    it('fails closed when an earlier active registry manifest is malformed before a valid declaration', async () => {
+        installRegistry({ projectContextSchema: 2 }, 'malformed');
+        installRegistry({ projectContextSchema: 1 }, 'valid');
+        const report = await (0, checks_1.preflight)(make({
+            manifest: { pack: 'generic', sensors: { security: { enabled: false } } },
+        }));
+        expect(report.status).toBe('degraded');
+        expect((0, preflight_1.exitCodeFor)(report)).toBe(1);
+        expect(check(report, 'context-kernel')).toMatchObject({
+            ok: false,
+            advisory: false,
+            detail: expect.stringMatching(/malformed.*awm-registry\.json.*projectContextSchema.*exactly 1/i),
+        });
+    });
+    it('keeps legacy ready but renders a persistent warning and remedy', async () => {
+        installRegistry({ projectContextSchema: 1 });
+        const report = await (0, checks_1.preflight)(make({
+            manifest: { pack: 'generic', sensors: { security: { enabled: false } } },
+        }));
+        expect(report.status).toBe('ready');
+        expect(report.checks).toContainEqual(expect.objectContaining({
+            id: 'context-kernel', ok: false, advisory: true,
+            detail: expect.stringMatching(/legacy full context/),
+            remedy: expect.stringMatching(/project-context-init/),
+        }));
+        expect((0, preflight_1.formatReport)(report)).toMatch(/⚠.*context-kernel.*legacy full context/s);
+        expect((0, preflight_1.exitCodeFor)(report)).toBe(0);
+        expect(JSON.parse(JSON.stringify(report))).toEqual(expect.objectContaining({
+            status: 'ready',
+            checks: expect.arrayContaining([expect.objectContaining({
+                    id: 'context-kernel', ok: false, advisory: true,
+                    detail: expect.any(String), remedy: expect.any(String),
+                })]),
+        }));
+    });
+    it('keeps an unconfigured legacy project not_configured while the context kernel remains advisory', async () => {
+        installRegistry({ projectContextSchema: 1 });
+        const report = await (0, checks_1.preflight)(make());
+        expect(report.status).toBe('not_configured');
+        expect(check(report, 'manifest')).toMatchObject({ ok: false, detail: 'no .awm/sensors.json' });
+        expect(check(report, 'context-kernel')).toMatchObject({
+            ok: false,
+            advisory: true,
+            detail: expect.stringMatching(/legacy full context/),
+        });
+        expect((0, preflight_1.exitCodeFor)(report)).toBe(1);
+    });
+    it('passes a valid kernel', async () => {
+        installRegistry({ projectContextSchema: 1 });
+        const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
+        writeValidKernel(dir);
+        const report = await (0, checks_1.preflight)(dir);
+        expect(report).toEqual(expect.objectContaining({ status: 'ready' }));
+        expect(check(report, 'context-kernel')).toMatchObject({ ok: true });
+        expect(check(report, 'context-kernel')).not.toHaveProperty('advisory');
+    });
+    it('degrades partial or invalid migration', async () => {
+        installRegistry({ projectContextSchema: 1 });
+        const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
+        writePartialKernel(dir);
+        const report = await (0, checks_1.preflight)(dir);
+        expect(report.status).toBe('degraded');
+        expect((0, preflight_1.exitCodeFor)(report)).toBe(1);
+        expect(report.checks).toContainEqual(expect.objectContaining({
+            id: 'context-kernel', advisory: false, ok: false,
+        }));
+        expect((0, preflight_1.formatReport)(report)).toMatch(/Harness degraded — it has blocking preflight failures\./);
+        expect((0, preflight_1.formatReport)(report)).not.toMatch(/declares sensors it cannot run/);
+    });
+    it('degrades an invalid kernel even when no sensor manifest exists', async () => {
+        installRegistry({ projectContextSchema: 1 });
+        const dir = make();
+        writePartialKernel(dir);
+        const report = await (0, checks_1.preflight)(dir);
+        expect(report.status).toBe('degraded');
+        expect(check(report, 'manifest')).toMatchObject({ ok: false, detail: 'no .awm/sensors.json' });
+        expect(check(report, 'context-kernel')).toMatchObject({ ok: false, advisory: false });
+        expect((0, preflight_1.exitCodeFor)(report)).toBe(1);
+    });
     it('keeps default preflight static and does not dispatch sensors', async () => {
         const dir = make({
             manifest: { pack: 'generic', sensors: { security: { enabled: false } } },
         });
         await (0, checks_1.preflight)(dir);
         expect(mockRunSensors).not.toHaveBeenCalled();
+        expect(mockCheckCurrentness).not.toHaveBeenCalled();
+    });
+    it('adds authoritative currentness only when strict mode is explicitly requested', async () => {
+        const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
+        const report = await (0, checks_1.preflight)(dir, { requireCurrent: true });
+        expect(mockCheckCurrentness).toHaveBeenCalledWith(dir);
+        expect(report).toMatchObject({
+            status: 'ready',
+            currentness: expect.objectContaining({
+                components: [expect.objectContaining({ component: 'cli', status: 'current' })],
+            }),
+        });
+        expect(report.checks).toContainEqual(expect.objectContaining({ id: 'currentness', ok: true }));
+        expect((0, preflight_1.formatReport)(report)).toContain('Currentness: current');
+        expect(JSON.parse(JSON.stringify(report))).toHaveProperty('currentness.components');
+    });
+    it('returns a complete strict report instead of throwing for a malformed local registry inventory', async () => {
+        fs_1.default.writeFileSync(path_1.default.join(process.env.AWM_HOME, 'registries.json'), '{not-json');
+        mockCheckCurrentness.mockResolvedValue({
+            checkedAt: '2026-08-26T00:00:00.000Z', compatibility: { status: 'not-checked' },
+            components: [{
+                    component: 'registry:inventory', installed: null, latest: null, channel: 'stable',
+                    source: '[configured registry inventory]', checkedAt: '2026-08-26T00:00:00.000Z', status: 'unverifiable',
+                    detail: 'Authoritative currentness could not be verified.',
+                    remedy: 'Repair the local registry inventory and rerun strict preflight.',
+                }],
+        });
+        const report = await (0, checks_1.preflight)(make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } }), { requireCurrent: true });
+        expect(report.status).toBe('degraded');
+        expect(report.currentness?.components).toEqual(expect.arrayContaining([
+            expect.objectContaining({ component: 'registry:inventory', status: 'unverifiable', remedy: expect.stringMatching(/Repair the local registry inventory/) }),
+        ]));
+        expect(JSON.parse(JSON.stringify(report))).toHaveProperty('currentness.components');
+    });
+    it.each(['stale', 'pinned-behind', 'unverifiable'])('fails strict preflight for a %s component with its exact remedy', async (status) => {
+        const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
+        mockCheckCurrentness.mockResolvedValue({
+            checkedAt: '2026-08-26T00:00:00.000Z', compatibility: { status: 'not-checked' },
+            components: [{
+                    component: 'registry:baseline', installed: 'v1.0.0', latest: 'v1.1.0', channel: 'stable',
+                    source: 'https://example.test/baseline.git', checkedAt: '2026-08-26T00:00:00.000Z', status,
+                    detail: 'Authoritative currentness failed.',
+                    remedy: status === 'pinned-behind' ? 'awm unpin baseline && awm update --yes' : 'awm update --yes',
+                }],
+        });
+        const report = await (0, checks_1.preflight)(dir, { requireCurrent: true });
+        expect(report.status).toBe('degraded');
+        expect((0, preflight_1.exitCodeFor)(report)).toBe(1);
+        expect(report.checks).toContainEqual(expect.objectContaining({ id: 'currentness', ok: false }));
+        expect((0, preflight_1.formatReport)(report)).toContain(status === 'pinned-behind' ? 'awm unpin baseline && awm update --yes' : 'awm update --yes');
+    });
+    it('keeps compatibility failure distinct when authoritative currentness is current', async () => {
+        installRegistry({ minCliVersion: '999.0.0' }, 'requires-new-cli');
+        const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
+        const report = await (0, checks_1.preflight)(dir, { requireCurrent: true });
+        expect(report.status).toBe('degraded');
+        expect(report.checks).toEqual(expect.arrayContaining([
+            expect.objectContaining({ id: 'compatibility', ok: false, detail: expect.stringContaining('requires-new-cli requires CLI >= 999.0.0') }),
+            expect.objectContaining({ id: 'currentness', ok: true }),
+        ]));
+    });
+    it('retains both empirical sensor and currentness verdicts when both gates are requested', async () => {
+        const dir = make({ manifest: { pack: 'generic', sensors: { security: { enabled: false } } } });
+        mockRunSensors.mockResolvedValue({ overall: 'pass', sensors: [] });
+        const report = await (0, checks_1.preflight)(dir, { verifySensors: true, requireCurrent: true });
+        expect(mockRunSensors).toHaveBeenCalledWith({ cwd: dir, all: true });
+        expect(mockCheckCurrentness).toHaveBeenCalledWith(dir);
+        expect(report.checks).toEqual(expect.arrayContaining([
+            expect.objectContaining({ id: 'sensors-execution', ok: true }),
+            expect.objectContaining({ id: 'currentness', ok: true }),
+        ]));
     });
     it('rejects an array passed as public preflight options before filesystem work', async () => {
         await expect((0, checks_1.preflight)(process.cwd(), []))
-            .rejects.toThrow('preflight options must contain an optional boolean verifySensors');
+            .rejects.toThrow('preflight options must contain optional boolean verifySensors and requireCurrent');
     });
     it('requires an empirical sensor pass when verification is requested', async () => {
         const dir = make({

package/dist/tests/core/context-kernel/inspect.test.js

@@ -0,0 +1,144 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+describe('Context Kernel v1 inspection', () => {
+    let root;
+    let previousAwmHome;
+    beforeEach(() => {
+        jest.resetModules();
+        previousAwmHome = process.env.AWM_HOME;
+        root = fs_1.default.realpathSync(fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-context-kernel-')));
+        process.env.AWM_HOME = path_1.default.join(root, 'awm-home');
+        fs_1.default.mkdirSync(process.env.AWM_HOME, { recursive: true });
+    });
+    afterEach(() => {
+        if (previousAwmHome === undefined)
+            delete process.env.AWM_HOME;
+        else
+            process.env.AWM_HOME = previousAwmHome;
+        fs_1.default.rmSync(root, { recursive: true, force: true });
+    });
+    function inspect() {
+        return require('../../../src/core/context-kernel/inspect').inspectContextKernel;
+    }
+    function indexPath() {
+        return path_1.default.join(root, '.awm', 'context', 'index.json');
+    }
+    function writeIndex(index) {
+        fs_1.default.mkdirSync(path_1.default.dirname(indexPath()), { recursive: true });
+        fs_1.default.writeFileSync(indexPath(), JSON.stringify(index, null, 2));
+    }
+    function writeValidKernel() {
+        const index = {
+            schema: 1,
+            kernelFiles: ['AGENTS.md', 'CONSTITUTION.md'],
+            maxFixedBytes: 33_740,
+            entries: [
+                { id: 'CTX-PROCESS-001', tier: 'kernel', path: 'CONSTITUTION.md', anchor: 'awm-context:CTX-PROCESS-001', when: 'always' },
+                { id: 'CTX-RELEASE-001', tier: 'selective', path: 'docs/awm/context/releases.md', anchor: 'awm-context:CTX-RELEASE-001', when: 'release automation' },
+            ],
+        };
+        fs_1.default.writeFileSync(path_1.default.join(root, 'AGENTS.md'), '<!-- AWM:CONTEXT-KERNEL:START v1 -->\nagent rules\n<!-- AWM:CONTEXT-KERNEL:END v1 -->\n');
+        fs_1.default.writeFileSync(path_1.default.join(root, 'CONSTITUTION.md'), '<!-- AWM:CONTEXT-KERNEL:START v1 -->\n<!-- awm-context:CTX-PROCESS-001 -->\nprocess rules\n<!-- AWM:CONTEXT-KERNEL:END v1 -->\n');
+        const card = path_1.default.join(root, 'docs', 'awm', 'context', 'releases.md');
+        fs_1.default.mkdirSync(path_1.default.dirname(card), { recursive: true });
+        fs_1.default.writeFileSync(card, '<!-- awm-context:CTX-RELEASE-001 -->\nrelease rules\n');
+        writeIndex(index);
+        return index;
+    }
+    function mutateFixture(mutation) {
+        const constitution = path_1.default.join(root, 'CONSTITUTION.md');
+        if (mutation === 'start marker missing') {
+            fs_1.default.writeFileSync(constitution, fs_1.default.readFileSync(constitution, 'utf8').replace('<!-- AWM:CONTEXT-KERNEL:START v1 -->\n', ''));
+        }
+        else if (mutation === 'end marker duplicated') {
+            fs_1.default.appendFileSync(constitution, '<!-- AWM:CONTEXT-KERNEL:END v1 -->\n');
+        }
+        else if (mutation === 'anchor outside region') {
+            fs_1.default.writeFileSync(constitution, '<!-- awm-context:CTX-PROCESS-001 -->\n' + fs_1.default.readFileSync(constitution, 'utf8'));
+        }
+        else {
+            fs_1.default.writeFileSync(constitution, fs_1.default.readFileSync(constitution, 'utf8').replace('process rules', '<!-- awm-context:CTX-PROCESS-001 -->\nprocess rules'));
+        }
+    }
+    it('classifies no R3 artifacts as legacy', () => {
+        expect(inspect()(root)).toEqual({ state: 'legacy' });
+    });
+    it('rejects a root context marker when the Context Kernel index is missing', () => {
+        fs_1.default.writeFileSync(path_1.default.join(root, 'AGENTS.md'), '<!-- AWM:CONTEXT-KERNEL:START v1 -->\nagent rules\n');
+        expect(inspect()(root)).toEqual(expect.objectContaining({
+            state: 'invalid',
+            detail: expect.stringContaining('.awm/context/index.json is missing'),
+        }));
+    });
+    it('rejects an orphaned context anchor when the Context Kernel index is missing', () => {
+        fs_1.default.writeFileSync(path_1.default.join(root, 'AGENTS.md'), '<!-- awm-context:CTX-PROCESS-001 -->\nagent rules\n');
+        expect(inspect()(root)).toEqual(expect.objectContaining({
+            state: 'invalid',
+            detail: expect.stringContaining('.awm/context/index.json is missing'),
+        }));
+    });
+    it('accepts the canonical fixture', () => {
+        writeValidKernel();
+        expect(inspect()(root)).toEqual(expect.objectContaining({ state: 'valid', schema: 1 }));
+    });
+    it.each([
+        ['unknown top-level field', (x) => { x.extra = true; }],
+        ['future schema', (x) => { x.schema = 2; }],
+        ['duplicate id', (x) => { x.entries[1].id = x.entries[0].id; }],
+        ['duplicate anchor', (x) => { x.entries[1].anchor = x.entries[0].anchor; }],
+        ['absolute path', (x) => { x.entries[1].path = '/tmp/outside.md'; }],
+        ['traversal', (x) => { x.entries[1].path = '../outside.md'; }],
+        ['empty when', (x) => { x.entries[1].when = ''; }],
+        ['fixed byte cap', (x) => { x.maxFixedBytes = 1; }],
+    ])('rejects %s', (_name, mutate) => {
+        const index = writeValidKernel();
+        mutate(index);
+        writeIndex(index);
+        expect(inspect()(root)).toEqual(expect.objectContaining({ state: 'invalid' }));
+    });
+    it('rejects a project path that resolves through a symlink to an external regular file', () => {
+        const index = writeValidKernel();
+        const outside = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-outside-'));
+        try {
+            const card = path_1.default.join(root, index.entries[1].path);
+            const externalCard = path_1.default.join(outside, 'card.md');
+            fs_1.default.writeFileSync(externalCard, '<!-- awm-context:CTX-RELEASE-001 -->\nexternal release rules\n');
+            fs_1.default.rmSync(card);
+            fs_1.default.symlinkSync(externalCard, card);
+            expect(fs_1.default.statSync(card).isFile()).toBe(true);
+            expect(fs_1.default.realpathSync(card)).toBe(externalCard);
+            expect(inspect()(root)).toEqual(expect.objectContaining({
+                state: 'invalid',
+                detail: expect.stringContaining('resolves outside the project root'),
+            }));
+        }
+        finally {
+            fs_1.default.rmSync(outside, { recursive: true, force: true });
+        }
+    });
+    it('rejects a dangling index symlink instead of treating it as legacy', () => {
+        const outside = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-outside-'));
+        try {
+            fs_1.default.mkdirSync(path_1.default.dirname(indexPath()), { recursive: true });
+            fs_1.default.symlinkSync(path_1.default.join(outside, 'index.json'), indexPath());
+            expect(inspect()(root)).toEqual(expect.objectContaining({ state: 'invalid' }));
+        }
+        finally {
+            fs_1.default.rmSync(outside, { recursive: true, force: true });
+        }
+    });
+    it.each(['start marker missing', 'end marker duplicated', 'anchor outside region', 'anchor duplicated'])('rejects %s', (mutation) => {
+        writeValidKernel();
+        mutateFixture(mutation);
+        expect(inspect()(root)).toEqual(expect.objectContaining({ state: 'invalid' }));
+    });
+    it('throws for an invalid public cwd', () => {
+        expect(() => inspect()(path_1.default.join(root, 'missing'))).toThrow(/cwd.*directory/);
+    });
+});