agents-city 0.1.0

package/bin/shortcut

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+# Put a city on your desktop: its icon, its name, double-click to enter.
+exec python3 "$(cd "$(dirname "$0")/../plugin/scripts" && pwd)/atajos.py" "$@"

package/bin/skills

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+# Recognise repo-local skills without installing or changing them.
+exec python3 "$(cd "$(dirname "$0")/../plugin/scripts" && pwd)/capabilities.py" "$@"

package/bin/test

@@ -0,0 +1,133 @@
+#!/usr/bin/env bash
+# Every test in the repo, in one command.
+#
+#   ./bin/test              all of it
+#   ./bin/test card seat    just these
+#
+# Twelve suites and two compatibility walks. Nothing here needs a network, an
+# account, a terminal or a deployed anything: the widgets run against a fake curses
+# window, the reporter against a temporary git repo, and the wizard against a file
+# of answers. The one browser suite drives headless Chrome when the machine has
+# one and says so when it does not — a page whose buttons are wired to nothing
+# passes every other check in here, and one shipped.
+set -uo pipefail
+cd "$(dirname "$0")/.." || exit 1
+
+# Arm the commit-time gate while we are here. Git refuses to ship hooks inside a
+# repo (on purpose), so the first test run in a clone points this clone at ours.
+# Installed copies are not git repos and skip this silently.
+if [ -d .git ] && [ -x .githooks/pre-commit ] \
+   && [ -z "$(git config core.hooksPath 2>/dev/null)" ]; then
+  git config core.hooksPath .githooks \
+    && printf '  pre-commit gate armed (core.hooksPath .githooks)\n'
+fi
+
+SUITES=(widgets card parcels domains serve seat cities channel committee live-feed runtime claude-runtime runtime-ui runtime-failures stress adapter benchmark demo contracts exit rutas cage broker evidencia admision pairing hall-protocol doctor security workspace avatar crecimiento atajos navegador actualiza launch)
+[ $# -gt 0 ] && SUITES=("$@")
+
+fallos=0
+total=0
+
+printf '\n'
+for s in "${SUITES[@]}"; do
+  guion="bin/test-$s.py"
+  if [ ! -x "$guion" ]; then
+    printf '  %-10s \033[31mno such suite\033[0m (%s)\n' "$s" "$guion"
+    fallos=$((fallos + 1)); continue
+  fi
+  salida="$(./"$guion" 2>&1)"
+  if [ $? -eq 0 ]; then
+    n="$(printf '%s' "$salida" | grep -oE '[0-9]+ checks' | tail -1)"
+    printf '  %-10s \033[32mok\033[0m  %s\n' "$s" "${n:-}"
+    total=$((total + $(printf '%s' "${n:-0}" | grep -oE '^[0-9]+' || echo 0)))
+  else
+    printf '  %-10s \033[31mFAILED\033[0m\n' "$s"
+    printf '%s\n' "$salida" | sed 's/^/      /'
+    fallos=$((fallos + 1))
+  fi
+done
+
+if [ $# -eq 0 ]; then
+  if ./bin/setup.py --help 2>&1 | grep -q 'one personal Agents City' \
+     && ! ./bin/setup.py --help 2>&1 | grep -q 'legacy-team'; then
+    printf '  %-10s \033[32mok\033[0m  public setup exposes only personal cities\n' "setup"
+  else
+    printf '  %-10s \033[31mFAILED\033[0m\n' "setup"
+    fallos=$((fallos + 1))
+  fi
+
+  # The map fixture remains a compatibility input for the visual seeder.
+  if [ "$(./city/scripts/seed.py --data demo --fake-history 2>/dev/null \
+          | grep -c 'INSERT INTO parcela')" = 34 ]; then
+    printf '  %-10s \033[32mok\033[0m  the demo still seeds 34 parcels\n' "seeder"
+  else
+    printf '  %-10s \033[31mFAILED\033[0m\n' "seeder"
+    fallos=$((fallos + 1))
+  fi
+fi
+
+# The npm package: every path the shim dispatches to must actually ship. This is
+# the check that catches "added a module, forgot the files whitelist" — the shim
+# would break only on the installed machine, where nobody is looking.
+if [ $# -eq 0 ] && command -v npm >/dev/null 2>&1; then
+  faltan=$(npm pack --dry-run --json 2>/dev/null | python3 -c '
+import json, sys
+salida = json.load(sys.stdin)
+dentro = {f["path"] for f in salida[0]["files"]}
+necesarios = ["bin/agents-city.js", "bin/hall", "bin/seat", "bin/city", "bin/demo",
+              "bin/setup.py", "bin/serve.py", "bin/hall.html",
+              "bin/ui.py" if "bin/ui.py" in dentro else "plugin/scripts/ui.py",
+              "plugin/scripts/seat.py", "plugin/scripts/card.py",
+              "plugin/scripts/parcels.py", "plugin/scripts/units.py",
+              "plugin/scripts/roles.py", "plugin/scripts/gh.py",
+              "plugin/scripts/domains.py", "plugin/domains/software.md",
+              "plugin/roles/examples/data-engineer.md",
+              "plugin/scripts/cities.py", "plugin/scripts/roads.py",
+              "plugin/scripts/cage.py", "plugin/scripts/broker.py",
+              "plugin/scripts/rutas.py", "plugin/scripts/evidencia.py",
+              "plugin/scripts/admision.py", "plugin/scripts/pairing.py",
+              "plugin/scripts/hall_protocol.py", "plugin/scripts/doctor.py",
+              "plugin/scripts/workspace.py", "plugin/scripts/avatar.py",
+              "plugin/scripts/crecimiento.py",
+              "plugin/scripts/reset.py", "plugin/scripts/capabilities.py",
+              "plugin/scripts/deliberations.py",
+              "plugin/scripts/runtime_processes.py",
+              "plugin/scripts/runtime_log.py", "plugin/scripts/logs.py",
+              "plugin/scripts/launch.py", "plugin/scripts/hook_activity.py",
+              "plugin/scripts/city-session.sh", "plugin/scripts/city-runtime.sh",
+              "plugin/scripts/find-repos.sh",
+              "plugin/channel/bus.js", "plugin/channel/local-hub.js",
+              "plugin/channel/client.js", "plugin/channel/adapter.js",
+              "plugin/channel/runtime-gateway.js",
+              "plugin/.mcp.json",
+              "bin/cities", "bin/road", "bin/bus", "bin/committee", "bin/agents",
+              "bin/reset", "bin/skills", "bin/benchmark", "bin/logs",
+              "benchmarks/committee/run.py",
+              "benchmarks/latency/live.py", "benchmarks/latency/README.md",
+              "benchmarks/latency/fake-native-server.mjs",
+              "benchmarks/latency/fake-claude-cli.mjs",
+              "benchmarks/stress/run.py", "benchmarks/stress/README.md",
+              "city/web/src/repo-roles.ts",
+              "demo/show.py", "demo/city/city.yml", "demo/city/ada.md",
+              "city/scripts/seed.py", "city/worker/schema.sql", "demo/parcels.yml"]
+problemas = [f"missing: {n}" for n in necesarios if n not in dentro]
+basura = ("/node_modules/", "/__pycache__/", "/.wrangler/")
+for ruta in sorted(dentro):
+    if any(x in f"/{ruta}/" for x in basura) or ruta.endswith((".pyc", "/.DS_Store")):
+        problemas.append(f"development artifact shipped: {ruta}")
+print("\n".join(problemas))')
+  if [ -z "$faltan" ]; then
+    printf '  %-10s \033[32mok\033[0m  every path the shim needs ships in the tarball\n' "package"
+  else
+    printf '  %-10s \033[31mFAILED\033[0m — invalid npm package contents:\n' "package"
+    printf '%s\n' "$faltan" | sed 's/^/      /'
+    fallos=$((fallos + 1))
+  fi
+fi
+
+printf '\n'
+if [ "$fallos" -gt 0 ]; then
+  printf '  \033[31m%d suite(s) failed\033[0m\n\n' "$fallos"
+  exit 1
+fi
+printf '  \033[32mall green\033[0m — %d checks\n\n' "$total"

package/bin/test-actualiza.py

@@ -0,0 +1,130 @@
+#!/usr/bin/env python3
+"""Knowing there is a new version, and getting it.
+
+    ./bin/test-actualiza.py
+
+No network: the registry call is replaced, because a suite that depends on
+npm being up tests npm. What is tested here is everything around it — the
+version comparison (where a prerelease must sort BELOW its release, the bug
+every hand-rolled semver has), the day-long cache, the opt-out, and the refusal
+to `npm install -g` over somebody's git checkout.
+"""
+
+import json
+import os
+import shutil
+import sys
+import tempfile
+import time
+
+AQUI = os.path.dirname(os.path.abspath(__file__))
+RAIZ = os.path.dirname(AQUI)
+sys.path.insert(0, os.path.join(RAIZ, "plugin", "scripts"))
+sys.path.insert(0, AQUI)
+
+import actualiza  # noqa: E402
+from testlib import afirma, comprueba, resumen  # noqa: E402
+
+
+def comparacion():
+    print("  which version is newer")
+    for nueva, vieja in (
+        ("0.2.0", "0.1.0"),
+        ("1.0.0", "0.9.9"),
+        ("0.1.10", "0.1.9"),
+        # The one every hand-rolled comparison gets wrong: a release outranks
+        # its own prereleases, so 1.0.0 must beat 1.0.0-beta.22.
+        ("1.0.0", "1.0.0-beta.22"),
+        ("0.3.0-beta.22", "0.3.0-beta.21"),
+    ):
+        afirma(f"· {nueva} is newer than {vieja}", actualiza.es_mas_nueva(nueva, vieja),
+               f"{actualiza._partes(nueva)} vs {actualiza._partes(vieja)}")
+    for igual_o_vieja, actual in (("0.1.0", "0.1.0"), ("0.1.0", "0.2.0"),
+                                  ("1.0.0-beta.1", "1.0.0")):
+        afirma(f"· {igual_o_vieja} is NOT newer than {actual}",
+               not actualiza.es_mas_nueva(igual_o_vieja, actual))
+    afirma("· and nothing is newer than nothing", not actualiza.es_mas_nueva("", "0.1.0")
+           and not actualiza.es_mas_nueva("0.2.0", ""))
+
+
+def cache_y_opt_out():
+    print("  the check: cached, quiet, and refusable")
+    casa = tempfile.mkdtemp()
+    previo = {k: os.environ.get(k) for k in ("AGENTS_CITY_HOME", "CITY_UPDATE_CHECK")}
+    os.environ["AGENTS_CITY_HOME"] = casa
+    os.environ.pop("CITY_UPDATE_CHECK", None)
+    llamadas = []
+
+    def registro_falso():
+        llamadas.append(1)
+        return "9.9.9"
+
+    real = actualiza.consulta_registro
+    actualiza.consulta_registro = lambda *a, **k: registro_falso()
+    try:
+        instalada, ultima, hay = actualiza.comprueba()
+        afirma("· a first check asks the registry and reports the newer version",
+               ultima == "9.9.9" and hay and len(llamadas) == 1, f"{instalada} {ultima} {hay}")
+        actualiza.comprueba()
+        actualiza.comprueba()
+        comprueba("· and the next ones read the day's answer instead of asking again",
+                  len(llamadas), 1)
+        _, _, hay2 = actualiza.comprueba(forzar=True)
+        afirma("· --check forces a fresh ask", len(llamadas) == 2 and hay2)
+
+        # The cache is what makes a plane or a firewall silent rather than noisy.
+        actualiza.consulta_registro = lambda *a, **k: ""
+        _, ultima3, _ = actualiza.comprueba(forzar=True)
+        comprueba("· an unreachable registry falls back to what it knew", ultima3, "9.9.9")
+        guardado = json.load(open(os.path.join(casa, ".runtime", "version.json")))
+        afirma("· which is remembered under the runtime dir, with its timestamp",
+               guardado["latest"] == "9.9.9" and time.time() - guardado["when"] < 60,
+               str(guardado))
+
+        os.environ["CITY_UPDATE_CHECK"] = "0"
+        instalada, ultima4, hay4 = actualiza.comprueba(forzar=True)
+        afirma("· and CITY_UPDATE_CHECK=0 stops it entirely, saying nothing",
+               ultima4 == "" and hay4 is False and instalada, f"{instalada} {ultima4}")
+        comprueba("· so the passive notice stays empty too", actualiza.aviso(), "")
+    finally:
+        actualiza.consulta_registro = real
+        for k, v in previo.items():
+            if v is None:
+                os.environ.pop(k, None)
+            else:
+                os.environ[k] = v
+        shutil.rmtree(casa, ignore_errors=True)
+
+
+def no_toca_un_checkout():
+    print("  what update refuses to do")
+    # This repo IS a git checkout, so the refusal is testable against itself:
+    # `npm install -g` over somebody's working copy is not an update.
+    comprueba("· a git checkout is recognised as one", actualiza.como_se_instalo(), "clone")
+    import io
+    from contextlib import redirect_stdout
+
+    salida = io.StringIO()
+    with redirect_stdout(salida):
+        codigo = actualiza.actualiza()
+    afirma("· and update refuses it, telling you the command that fits",
+           codigo == 1 and "git pull" in salida.getvalue(), salida.getvalue())
+
+
+def la_puerta():
+    print("  the command in the front door")
+    front = open(os.path.join(RAIZ, "bin", "agents-city.js"), encoding="utf-8").read()
+    for orden in ("update", "doctor"):
+        afirma(f"· `agents-city {orden}` is listed and points at one implementation",
+               f"{orden}: {{ que: ['bin/{orden}']" in front, "")
+    for guion in ("update", "doctor"):
+        texto = open(os.path.join(RAIZ, "bin", guion), encoding="utf-8").read()
+        afirma(f"· bin/{guion} holds no logic of its own",
+               ".py" in texto and "def " not in texto, texto)
+
+
+comparacion()
+cache_y_opt_out()
+no_toca_un_checkout()
+la_puerta()
+sys.exit(resumen("actualiza"))

package/bin/test-adapter.py

@@ -0,0 +1,183 @@
+#!/usr/bin/env python3
+"""Explicit unknown-CLI fallback remains safe, slow and visibly separate."""
+import json
+import datetime
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+import time
+
+AQUI = os.path.dirname(os.path.abspath(__file__))
+RAIZ = os.path.dirname(AQUI)
+sys.path.insert(0, AQUI)
+from testlib import (  # noqa: E402
+    afirma, comprueba, detiene_hubs_de_ciudad, hubs_de_ciudad, resumen,
+)
+
+ADAPTER = os.path.join(RAIZ, 'plugin', 'channel', 'adapter.js')
+CLIENT = os.path.join(RAIZ, 'plugin', 'channel', 'client.js')
+FAKE_TUI = os.path.join(RAIZ, 'benchmarks', 'latency', 'fake-tui.py')
+RUNTIMES = {
+    'legacy-one': 'custom-tui',
+    'legacy-two': 'custom-tui',
+    'legacy-three': 'custom-tui',
+    'legacy-four': 'custom-tui',
+}
+
+
+def espera(condicion, segundos=8):
+    limite = time.monotonic() + segundos
+    while time.monotonic() < limite:
+        if condicion():
+            return True
+        time.sleep(.1)
+    return False
+
+
+def main():
+    print('\n  explicit terminal fallback for unknown CLIs')
+    if not shutil.which('tmux'):
+        afirma('· tmux is installed', False, 'tmux missing')
+        return resumen('adapter')
+    base = tempfile.mkdtemp(prefix='agents-city-adapter-')
+    app = os.path.join(base, 'app')
+    city = os.path.join(app, 'alice', 'home')
+    os.makedirs(city)
+    repos = list(RUNTIMES)
+    open(os.path.join(city, 'city.yml'), 'w', encoding='utf-8').write(
+        'id: city_adapter\nname: Home\nslug: home\nowner: alice\n')
+    open(os.path.join(city, 'roads.json'), 'w', encoding='utf-8').write(
+        '{"version": 1, "roads": []}\n')
+    runs = ''.join(f'runs.{actor}: {runtime}\n'
+                   for actor, runtime in RUNTIMES.items())
+    roles = ''.join(f'role.{actor}: {"seo" if actor == "legacy-two" else "blank"}\n'
+                    for actor in RUNTIMES)
+    open(os.path.join(city, 'alice.md'), 'w', encoding='utf-8').write(
+        f'---\nuser: alice\nagent: alice/ceo\nrepos: [{", ".join(repos)}]\n'
+        f'{roles}{runs}---\n')
+    env = dict(os.environ, AGENTS_CITY_HOME=app, AGENTS_CITY_DATA=city,
+               AGENTS_CITY_USER='alice')
+    for key in ('CITY_BUS_URL', 'CITY_BUS_TOKEN', 'CITY_DIR'):
+        env.pop(key, None)
+    session = f'ac-adapter-{os.getpid()}'
+    adapters = []
+    endpoint = os.path.join(app, '.runtime', 'bus', 'city-adapter', 'endpoint.json')
+    hub_pid = 0
+    try:
+        for actor in repos:
+            capture = os.path.join(base, f'{actor}.txt')
+            subprocess.run(
+                ['tmux', 'new-session' if actor == repos[0] else 'new-window',
+                 '-d' if actor == repos[0] else '-d',
+                 '-s' if actor == repos[0] else '-t',
+                 session if actor == repos[0] else session,
+                 '-n', actor, sys.executable, FAKE_TUI, capture,
+                 '--settle-ms', '120'],
+                check=True, capture_output=True, text=True)
+        for actor, runtime in RUNTIMES.items():
+            process = subprocess.Popen(
+                ['node', ADAPTER, '--data', city, '--actor', actor,
+                 '--target', f'{session}:{actor}', '--runtime', runtime],
+                env=dict(env, CITY_BUS_ACTOR=actor, CITY_AGENT_RUNTIME=runtime,
+                         CITY_TERMINAL_READY_DELAY_MS='40',
+                         CITY_TERMINAL_SUBMIT_DELAY_MS='180'),
+                stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, text=True)
+            adapters.append(process)
+        afirma('· all four explicit fallback adapters authenticate',
+               espera(lambda: all(p.poll() is None for p in adapters), .5))
+
+        payload = {
+            'question': 'Which runtime received this?',
+            'desiredOutcome': 'The same authenticated brief everywhere',
+            'definitionOfDone': ['every capture has the protocol prompt'],
+            'participants': repos,
+        }
+        opened = subprocess.run(
+            ['node', CLIENT, 'committee', 'open', '--input', '-'],
+            input=json.dumps(payload), capture_output=True, text=True,
+            env=dict(env, CITY_BUS_ACTOR='seat'), timeout=12)
+        state = json.loads(opened.stdout) if opened.returncode == 0 else {}
+        thread = state.get('id', '')
+        afirma('· the chair emits one typed assignment per selected runtime',
+               bool(thread), opened.stderr.strip())
+
+        for actor, runtime in RUNTIMES.items():
+            capture = os.path.join(base, f'{actor}.txt')
+            delivered = espera(
+                lambda p=capture: os.path.exists(p) and bool(
+                    open(p, encoding='utf-8', errors='ignore').read().strip()))
+            records = [json.loads(line) for line in open(
+                capture, encoding='utf-8', errors='ignore') if line.strip()
+            ] if os.path.exists(capture) else []
+            body = records[-1]['body'] if records else ''
+            afirma(f'· {runtime} receives the same chaired assignment',
+                   delivered and thread in body
+                   and 'agents-city committee respond' in body
+                   and 'Do not contact another repo agent directly' in body,
+                   body[-160:])
+            esperado = (
+                'operating role is seo'
+                if actor == 'legacy-two'
+                else 'operating role is blank'
+            )
+            afirma(
+                f'· {runtime} receives its own operating role',
+                esperado in body,
+                body[-300:],
+            )
+
+        outbox = os.path.join(app, '.runtime', 'bus', 'city-adapter', 'outbox')
+        drained = espera(
+            lambda: all(not os.path.isdir(os.path.join(outbox, actor))
+                        or not os.listdir(os.path.join(outbox, actor))
+                        for actor in repos))
+        afirma('· delivery acknowledgements drain every durable actor outbox', drained)
+        metrics_path = os.path.join(
+            app, '.runtime', 'bus', 'city-adapter', 'delivery-latency.jsonl')
+        metrics = [json.loads(line) for line in open(metrics_path, encoding='utf-8')
+                   if line.strip()] if os.path.exists(metrics_path) else []
+        actors = {row.get('actor') for row in metrics}
+        afirma('· every accepted prompt has an auditable latency trace',
+               actors == set(repos), str(actors))
+        afirma('· Enter is delayed until each multiline paste has settled',
+               metrics and all(row.get('pasteToSubmitMs', 0) >= 150
+                               for row in metrics), str(metrics))
+        submitted = [row['submittedAt'] for row in metrics]
+        instants = [datetime.datetime.fromisoformat(
+            value.replace('Z', '+00:00')).timestamp() for value in submitted]
+        spread = max(instants) - min(instants) if instants else 99
+        afirma('· four terminal fallbacks submit in parallel, not one after another',
+               spread < 1.0, f'{spread:.3f}s')
+        data = json.load(open(endpoint, encoding='utf-8'))
+        hub_pid = int(data.get('pid', 0))
+        comprueba('· all runtimes used one city WebSocket endpoint',
+                  data.get('protocol'), 'agents-city-bus/2')
+        comprueba('· concurrent adapter startup creates exactly one city hub',
+                  len(hubs_de_ciudad(city)), 1)
+    finally:
+        for process in adapters:
+            if process.poll() is None:
+                process.terminate()
+        for process in adapters:
+            try:
+                process.wait(timeout=2)
+            except subprocess.TimeoutExpired:
+                process.kill()
+        subprocess.run(['tmux', 'kill-session', '-t', session],
+                       capture_output=True)
+        if os.path.exists(endpoint):
+            try:
+                data = json.load(open(endpoint, encoding='utf-8'))
+                hub_pid = int(data['pid'])
+            except (OSError, ValueError, KeyError, json.JSONDecodeError):
+                pass
+        limpio = detiene_hubs_de_ciudad(city)
+        afirma('· fallback cleanup leaves no orphan city hub', limpio, str(hub_pid))
+        shutil.rmtree(base, ignore_errors=True)
+    return resumen('adapter')
+
+
+if __name__ == '__main__':
+    sys.exit(main())

package/bin/test-admision.py

@@ -0,0 +1,99 @@
+#!/usr/bin/env python3
+"""Admission as an ordered gate graph: the decisive gate, the reason, redaction.
+
+Pure and transport-free. The cases that matter: the first blocker is the
+decisive gate; a road that matches but whose sender does not is an explicit
+block, not a fallthrough; an unknown sender under pairing yields a pairing
+requirement rather than a silent drop; and diagnostics never carry a raw
+allowlist entry.
+"""
+
+import os
+import sys
+
+AQUI = os.path.dirname(os.path.abspath(__file__))
+RAIZ = os.path.dirname(AQUI)
+sys.path.insert(0, os.path.join(RAIZ, "plugin", "scripts"))
+sys.path.insert(0, AQUI)
+
+import admision as ad  # noqa: E402
+from testlib import afirma, comprueba, resumen  # noqa: E402
+
+FELIZ = dict(road_existe=True, road_incidente=False, direccion_coincide=True,
+             emparejado=False, allowlist=["alice/home"], payload_valido=True,
+             texto_no_vacio=True)
+
+
+def dispatch():
+    d = ad.decide_entrada(**FELIZ)
+    afirma("a fully valid inbound dispatches", d.permitido())
+    comprueba("its reason is road_allowed", d.razon, "road_allowed")
+    afirma("the graph records every phase it walked", len(d.grafo) >= 3)
+    afirma("a decision exposes no evidence field to mistake for authorization",
+           not hasattr(d, "evidencia") and "evidence" not in d.como_dict())
+
+
+def bloqueos():
+    d = ad.decide_entrada(**{**FELIZ, "road_existe": False})
+    comprueba("no road -> skip", d.admision, ad.Admision.OMITE)
+    comprueba("decisive gate is the road gate", d.puerta_decisiva, "road")
+    comprueba("reason is road_missing", d.razon, "road_missing")
+
+    d = ad.decide_entrada(**{**FELIZ, "road_incidente": True})
+    comprueba("a road under incident drops", d.admision, ad.Admision.DESCARTA)
+    afirma("a dropped decision never reports itself as permitted", not d.permitido())
+
+    d = ad.decide_entrada(**{**FELIZ, "dirigido_aqui": False})
+    comprueba("a message not addressed here is skipped", d.admision, ad.Admision.OMITE)
+    comprueba("and address is the decisive gate", d.puerta_decisiva, "address")
+
+    d = ad.decide_entrada(**{**FELIZ, "payload_valido": False})
+    comprueba("a malformed payload drops", d.admision, ad.Admision.DESCARTA)
+    d = ad.decide_entrada(**{**FELIZ, "texto_no_vacio": False})
+    comprueba("empty text drops", d.razon, "payload_empty")
+
+
+def emparejamiento():
+    base = {**FELIZ, "direccion_coincide": False}
+    d = ad.decide_entrada(**{**base, "emparejado": False})
+    comprueba("an unknown sender under pairing asks to pair, not drops",
+              d.admision, ad.Admision.EMPAREJA)
+    comprueba("reason is sender_not_paired", d.razon, "sender_not_paired")
+    d = ad.decide_entrada(**{**base, "emparejado": True})
+    afirma("a paired-but-not-in-config sender dispatches", d.permitido())
+    afirma("and the pairing fact is recorded as a gate in the graph",
+           any(g.razon == "sender_paired" for g in d.grafo))
+
+
+def orden_y_redaccion():
+    # Both the road and the payload are bad; the earlier (road) gate must win.
+    d = ad.decide_entrada(**{**FELIZ, "road_existe": False, "payload_valido": False})
+    comprueba("the FIRST blocker is decisive, not the last", d.puerta_decisiva, "road")
+
+    d = ad.decide_entrada(**{**FELIZ, "allowlist": ["alice/home", "bob/research"]})
+    diag = next(g.diagnostico for g in d.grafo if g.diagnostico)
+    comprueba("the diagnostic reveals the count", diag["n"], 2)
+    afirma("but never a raw allowlist entry",
+           "alice/home" not in str(diag) and "bob/research" not in str(diag))
+    afirma("opaque ids are stable and prefixed",
+           all(i.startswith("x") for i in diag["ids"]))
+    comprueba("the same entry hashes to the same opaque id",
+              ad.id_opaco("alice/home"), ad.id_opaco("alice/home"))
+
+
+def contrato_razones():
+    try:
+        ad.Puerta("x", "route", False, "not_a_real_reason")
+        afirma("a reason outside the closed set is rejected", False)
+    except ValueError:
+        afirma("a reason outside the closed set is rejected", True)
+    afirma("como_dict is JSON-shaped for the wire",
+           set(ad.decide_entrada(**FELIZ).como_dict()) >= {"admission", "reasonCode", "gates"})
+
+
+dispatch()
+bloqueos()
+emparejamiento()
+orden_y_redaccion()
+contrato_razones()
+sys.exit(resumen("admision"))