create-cmp-cli 0.23.0 → 0.25.0

package/template/qa/lib/plant-calibration.mjs

@@ -0,0 +1,135 @@
+// Does this profile ship plants its Rule 0 instrument can actually run?
+//
+// ONE QUESTION, TWO READERS, AND THAT IS WHY THIS FILE EXISTS RATHER THAN A
+// PREDICATE INSIDE EITHER OF THEM. The instrument (framework-check.mjs and its
+// runner) asks it to decide whether it can make the two profile-sourced plants;
+// the grader (evidence-level.mjs) asks it to decide whether this profile may be
+// graded at all. Those two answers must be the same answer — a profile the
+// instrument cannot plant for, graded as if it had been calibrated, is exactly
+// the defect below — and this repository already knows what happens when one
+// question has two implementations: `flowCitation` and `scanCitations` held two
+// copies of "what a citation looks like" and disagreed about the same file in
+// the same tree (framework-check.mjs carries that episode in full).
+//
+// THE DEFECT. `scripts/stage2-gate.mjs` built two adopters differing in exactly
+// one export — one shipping `plants`, one shipping none — ran the real lane in
+// both, and both earned `L1 · every promise bound`. `evidenceLevel` derived the
+// rung from the ladder alone and never asked whether the profile had plants, so
+// the twin that could calibrate nothing was graded identically to the twin that
+// could. Measured, not read: the ladder is the same ladder in both trees, which
+// is what makes the pair evidence rather than an anecdote.
+//
+// That is a guarantee violation, not a missing feature. NORTH-STAR.md §8.9: "A
+// profile with no calibrated plants earns no rung." §3 makes "Earns a rung
+// without plants" one of a Stack Profile's four *nevers*. §6.7: "A profile ships
+// with plants, run by `qa/framework-check.mjs` through the real runner in
+// seconds and restored byte-for-byte, or it ships without a badge."
+//
+// ── WHICH READING OF "CALIBRATED", AND WHY THIS ONE ─────────────────────────
+//
+// The guarantee says "calibrated plants" and that word carries three readings
+// of increasing strength. The one implemented here is the second, and the
+// argument for it is the whole point of this comment.
+//
+// 1. DECLARED — the profile exports `plants`. Rejected as too weak, and it is
+//    weak in a way that is cheap to exploit: `export const plants = {}` would
+//    satisfy it. An empty object declares nothing, plants nothing, and would
+//    buy the badge outright. A gate a one-line edit defeats is not a gate.
+//
+// 2. USABLE — the declaration is structurally sufficient for the instrument to
+//    make the plants only a profile can supply. THIS ONE. It is not a second
+//    opinion invented here: it is the instrument's OWN judgement, the test the
+//    runner already applies to decide whether it can plant at all, moved to
+//    where both readers can reach it. `{}` fails it, so does three fields out
+//    of the three, and so does a `plants` whose sources are not functions.
+//
+// 3. OBSERVED — the plants have actually been watched failing, on this tree,
+//    recently. This is the truest reading of the word, and it is NOT DERIVABLE
+//    FROM A LANE RUN, so it is not implemented and not pretended to. The lane
+//    does not run the instrument: `qa/framework-check.mjs` is a separate command
+//    that plants into the tree, runs the lane N+1 times and restores every byte,
+//    and nothing it does leaves a trace the lane could later read. Making it
+//    derivable would mean a recorded, hash-bound framework-check result the
+//    receipt path consults — a new artifact on the evidence path, which is an
+//    ADR before it is any code (fit-test question 5). Until that exists, reading
+//    3 is a claim nobody measured, and this file claims reading 2 exactly.
+//
+// WHAT READING 2 DOES NOT RESIST, said out loud: plant sources that are
+// plausible and inert — functions returning text that violates nothing. Those
+// are structurally sufficient and would earn the badge here. They are caught by
+// the instrument instead, which is the only reader that can catch them:
+// `assessPlantRun` fails a plant whose lane stayed green. So the honest division
+// is that this file refuses a profile that CANNOT be calibrated, and the
+// instrument refuses a profile whose plants do not bite. Neither can do the
+// other's half, and a reader of a rung should know which half they are holding.
+//
+// SINGLE SOURCE OF TRUTH: packages/harness/src/lib/plant-calibration.mjs in the
+// create-cmp repo. Vendored byte-identical into qa/lib/ — edit the package
+// source, then run `node scripts/sync-harness.mjs`.
+
+/**
+ * The plant material only a profile can supply, and the instrument cannot make
+ * up. A citation has to sit on a test, so two of the seven plants must WRITE a
+ * test — in this stack's language, with its test-declaration syntax, at a path
+ * it compiles — and those three fields are the whole of what that takes.
+ *
+ * These are the same three the runner tested inline before this file existed,
+ * and the same three `harness init` seeds in the commented `export const plants`
+ * skeleton (install/init.mjs). That agreement is deliberate and is
+ * the answer to the discoverability objection this repository has already paid
+ * for once: `harnessIntegrity` was a requirement no profile author could find,
+ * and it cost an adopter a lane that could never mint a valid receipt
+ * (NORTH-STAR.md §9.1). A badge floor asking for exactly what the on-ramp
+ * already documents asks for nothing an author cannot discover.
+ *
+ * `unmeetableTier` is DELIBERATELY NOT HERE, and that is the one judgement call
+ * in this file. It is a fourth field the skeleton also seeds, and without it the
+ * instrument skips the tier-unmet plant by name. But a stack with a single tier
+ * has no tier a host test cannot satisfy — the shape `harness init` itself
+ * seeds — so requiring it would make the badge unreachable by construction for a
+ * legitimate stack rather than for an uncalibrated one. A gate that cannot be
+ * passed by a correct profile is a wrong verdict in the other direction, and the
+ * instrument already reports that plant's absence per plant, by name, with the
+ * field that would fix it.
+ */
+export const PLANT_MATERIAL = Object.freeze([
+  ["testFileBasename", "string", "the file a planted citation lives in"],
+  ["unboundCitationSource", "function", "a citation on a type declaration with no test under it"],
+  ["tierUnmetCitationSource", "function", "a host-tier test citing a clause only another tier can observe"],
+]);
+
+/**
+ * Can the Rule 0 instrument plant this profile's own violations?
+ *
+ * @param {object|null|undefined} plants the profile's `plants` declaration —
+ *   NORTH-STAR §6's eighth. `undefined` (the profile exports none) and `null`
+ *   mean the same thing here and are the same answer: no.
+ * @returns {{ok: true, material: string[]}|{ok: false, reason: string, missing: string[]}}
+ *   `missing` names the fields, so a caller can say what would fix it rather
+ *   than only that something is wrong.
+ */
+export function plantCalibration(plants) {
+  if (!plants || typeof plants !== "object") {
+    return {
+      ok: false,
+      missing: PLANT_MATERIAL.map(([field]) => field),
+      reason:
+        "this profile declares no `plants` — the Rule 0 instrument cannot plant the two violations only a " +
+        "profile can supply, so nothing it runs would calibrate anything (NORTH-STAR.md §6.7)",
+    };
+  }
+  const missing = PLANT_MATERIAL.filter(([field, kind]) => typeof plants[field] !== kind).map(([field]) => field);
+  if (missing.length) {
+    return {
+      ok: false,
+      missing,
+      reason:
+        `this profile's \`plants\` declaration is missing ${missing.join(", ")} — ` +
+        PLANT_MATERIAL.filter(([field]) => missing.includes(field))
+          .map(([field, kind, what]) => `${field} (${kind}: ${what})`)
+          .join("; ") +
+        ". Without it the Rule 0 instrument skips the plants only this profile can supply and calibrates nothing",
+    };
+  }
+  return { ok: true, material: PLANT_MATERIAL.map(([field]) => field) };
+}

package/template/qa/lib/profile-loader.mjs

@@ -0,0 +1,323 @@
+// profile-loader.mjs — load the stack profile the manifest names. NEVER by name.
+//
+// The one rule of the agnostic harness (docs/proposals/AGNOSTIC-HARNESS-
+// ARCHITECTURE.md §3.2): nothing in the core imports a profile by name. Until
+// this file, qa/verify.mjs imported the Compose step pack by name — which is
+// why a Kotlin backend that wrote its own step pack correctly still had to
+// fork eleven spine files to use it (§1.3). The runner could not start without
+// Compose's pack.
+//
+// Now the runner asks the manifest which profile, and this loader imports
+// qa/lib/profiles/<id>/index.mjs. The loader knows the SHAPE of a profile
+// (§5.1) and nothing about any particular one. Terraform's core/provider rule;
+// LSP's client/server rule.
+//
+// Every failure is a refusal by name: a missing directory, an id that does not
+// match the manifest, a protocol the core does not speak, a module without the
+// exports the runner needs. None of them fall back to anything.
+//
+// SINGLE SOURCE OF TRUTH: packages/harness/src/lib/profile-loader.mjs in the
+// create-cmp repo. Vendored byte-identical into qa/lib/ — edit the package
+// source, then run `node scripts/sync-harness.mjs`.
+
+import fs from "node:fs";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+import { PROFILE_ID_RE } from "./harness-manifest.mjs";
+
+/**
+ * The profile protocol this core speaks. A profile declares the protocol it
+ * implements; mismatch is a refusal naming both, with the upgrade command.
+ * One integer — the Terraform handshake.
+ *
+ * Protocol 1 is still being drawn: its required exports grew during Stage 0
+ * (`layout` and `tiers` in PR 4) while the only implementer ships in this
+ * tree, vendored beside the core it matches. It freezes at Stage 2, when a
+ * profile can be versioned apart from the harness; from then on a new
+ * required export is a new protocol number.
+ */
+/**
+ * The protocol this lane SPEAKS. Bumped to 2 when `extends` landed, because
+ * inheritance changes what a profile must export: an heir declares only what it
+ * changes, and only a loader that can DERIVE the rest can load it.
+ *
+ * Without the bump an heir would declare 1, and an older loader would refuse it
+ * with "profile X must export layout" — pointing the author at their own file
+ * when the real fix is to upgrade the harness. The protocol refusal below says
+ * exactly that instead, which is why the version has to move for the message to
+ * be worth anything.
+ */
+export const PROFILE_PROTOCOL = 2;
+
+/**
+ * Every protocol this lane can load. A profile at 1 is one written before
+ * `extends` existed; it is complete on its own and nothing about it changed, so
+ * refusing it would be a rename dressed as a version — the failure ADR-0007
+ * refused for the receipt, one layer down.
+ */
+export const SUPPORTED_PROFILE_PROTOCOLS = Object.freeze([1, 2]);
+
+/** The protocol a profile must declare before it may use `extends`. */
+export const EXTENDS_PROTOCOL = 2;
+
+/** Where profiles live, relative to the project root. Inside the lock region. */
+export const PROFILES_DIR_REL = "qa/lib/profiles";
+
+/**
+ * The exports a profile MUST provide for the runner to start. `layout` and
+ * `tiers` are the spec scanner's model (qa/lib/spec-model.mjs validates their
+ * shape); `steps(ctx)` is the pack.
+ */
+export const REQUIRED_EXPORTS = Object.freeze(["id", "protocol", "layout", "tiers", "steps"]);
+
+/**
+ * The project-relative path of a profile's entry module.
+ * @param {string} id
+ * @returns {string}
+ */
+export function profileEntryRel(id) {
+  return `${PROFILES_DIR_REL}/${id}/index.mjs`;
+}
+
+/**
+ * Judge a loaded module against the protocol — pure, so the refusals are
+ * unit-testable without a filesystem.
+ * @param {object} mod the imported module namespace
+ * @param {string} id the id the manifest named
+ * @returns {{ok: true} | {ok: false, reason: string}}
+ */
+export function validateProfileModule(mod, id) {
+  if (!mod || typeof mod !== "object") return { ok: false, reason: `profile "${id}" did not load as a module` };
+  const missing = REQUIRED_EXPORTS.filter((name) => !(name in mod));
+  if (missing.length) {
+    return { ok: false, reason: `profile "${id}" is missing required export(s): ${missing.join(", ")} (a profile must export ${REQUIRED_EXPORTS.join(", ")})` };
+  }
+  if (mod.id !== id) {
+    return { ok: false, reason: `profile "${id}" exports id ${JSON.stringify(mod.id)} — the manifest and the profile disagree about what this project is; fix one of them` };
+  }
+  if (!SUPPORTED_PROFILE_PROTOCOLS.includes(mod.protocol)) {
+    return {
+      ok: false,
+      reason: `profile "${id}" implements profile protocol ${JSON.stringify(mod.protocol)}; this lane speaks ${SUPPORTED_PROFILE_PROTOCOLS.join(" and ")} — upgrade the harness or the profile so they match (\`prooflane upgrade\`)`,
+    };
+  }
+  if (typeof mod.steps !== "function") return { ok: false, reason: `profile "${id}" must export steps(ctx) as a function` };
+  if (!mod.layout || typeof mod.layout !== "object") return { ok: false, reason: `profile "${id}" must export layout as an object (where specs, sources, tests and flows live)` };
+  if (!mod.tiers || typeof mod.tiers !== "object") return { ok: false, reason: `profile "${id}" must export tiers as an object (which test tiers exist and which can observe which promise)` };
+  // Optional declarations: absent is allowed (the core then applies its floor);
+  // present-but-wrong is refused, never ignored.
+  for (const name of ["artifacts", "governable"]) {
+    if (name in mod && typeof mod[name] !== "function") return { ok: false, reason: `profile "${id}" exports ${name} but it is not a function (${name}(root))` };
+  }
+  return { ok: true };
+}
+
+/**
+ * Locate the profile's entry module for `id`, refusing an unsafe id or a
+ * missing directory by name. Shared by the async and sync loaders.
+ * @param {string} root
+ * @param {string} id
+ * @returns {{ok: true, entryRel: string, entryAbs: string} | {ok: false, reason: string}}
+ */
+function locateProfile(root, id) {
+  if (typeof id !== "string" || !PROFILE_ID_RE.test(id)) {
+    return { ok: false, reason: `profile id ${JSON.stringify(id)} is not a valid profile name (${PROFILE_ID_RE}) — it names a directory under ${PROFILES_DIR_REL}/` };
+  }
+  const entryRel = profileEntryRel(id);
+  const entryAbs = path.join(root, ...entryRel.split("/"));
+  if (!fs.existsSync(entryAbs)) {
+    let present = [];
+    try {
+      present = fs
+        .readdirSync(path.join(root, ...PROFILES_DIR_REL.split("/")), { withFileTypes: true })
+        .filter((e) => e.isDirectory())
+        .map((e) => e.name);
+    } catch {
+      /* no profiles dir at all */
+    }
+    const have = present.length ? `profiles present: ${present.join(", ")}` : `no profiles are installed under ${PROFILES_DIR_REL}/`;
+    return { ok: false, reason: `the manifest names profile "${id}" but ${entryRel} does not exist (${have}) — install the profile or fix ${"qa/harness-manifest.json"}` };
+  }
+  return { ok: true, entryRel, entryAbs };
+}
+
+/**
+ * WHICH DECLARATION NAMES A BASE. `extends` is a reserved word — legal as an
+ * export NAME (`export { BASE as extends }`) but not as a binding — so a
+ * profile author may reasonably reach for either spelling. Both are read, and
+ * neither is privileged: an author should not have to guess which one the core
+ * happens to prefer.
+ */
+const BASE_KEYS = Object.freeze(["extends", "extendsProfile"]);
+
+/**
+ * The base a profile declares, or null. A base is DATA — the id of another
+ * installed profile — never an import: an heir that imports its base is an ESM
+ * re-export wearing the word, and the core derived nothing.
+ * @param {object} mod
+ * @returns {string|null}
+ */
+export function declaredBase(mod) {
+  for (const key of BASE_KEYS) {
+    const value = mod?.[key];
+    if (typeof value === "string" && value.length > 0) return value;
+  }
+  return null;
+}
+
+/**
+ * The declarations an heir inherits when it does not make them itself.
+ *
+ * WHY A NAMED LIST RATHER THAN "every export the base has". Spreading a module
+ * namespace would inherit `id` and `protocol` too — an heir would silently
+ * become its base, and a receipt would name the wrong pack. It would also
+ * inherit anything a base happens to export for its own internal use, which is
+ * not a contract. So inheritance covers exactly the protocol's own surface: the
+ * five REQUIRED_EXPORTS minus identity, plus the optional declarations the
+ * loader and the lane already know by name.
+ */
+const INHERITABLE = Object.freeze([
+  "layout",
+  "tiers",
+  "steps",
+  "artifacts",
+  "governable",
+  "grammar",
+  "reports",
+  "detect",
+  "tools",
+  "ladder",
+  "plants",
+  "console",
+  "version",
+]);
+
+/**
+ * Resolve a profile's inheritance chain into one module-shaped object.
+ *
+ * THE HEIR WINS, ALWAYS, and only for what it actually declares — `in` rather
+ * than a truthiness check, so a profile can override a declaration with `null`
+ * (a stack with no flows does exactly that) instead of having the base's value
+ * silently restored underneath it.
+ *
+ * A CYCLE IS REFUSED BY NAME, not survived. `a extends b extends a` is an
+ * author error, and the useful output is the chain that closed it; hanging or
+ * blowing the stack tells them nothing.
+ *
+ * @param {object} mod the heir, already imported
+ * @param {string} id its own id
+ * @param {(baseId: string) => {ok: true, profile: object} | {ok: false, reason: string}} load
+ *   how to load a base by id — the caller supplies sync or async resolution
+ * @returns {{ok: true, profile: object, chain: string[]} | {ok: false, reason: string}}
+ */
+export function resolveInheritance(mod, id, load) {
+  const chain = [id];
+  const merged = {};
+  let current = mod;
+
+  const ownBase = declaredBase(mod);
+  if (ownBase && mod.protocol < EXTENDS_PROTOCOL) {
+    return {
+      ok: false,
+      reason:
+        `profile "${id}" declares a base ("${ownBase}") but implements profile protocol ${JSON.stringify(mod.protocol)} — ` +
+        `\`extends\` arrived in protocol ${EXTENDS_PROTOCOL}. Declare \`protocol = ${EXTENDS_PROTOCOL}\` so an older lane refuses it by naming the protocol ` +
+        `rather than by naming a declaration you deliberately left out`,
+    };
+  }
+
+  for (;;) {
+    const base = declaredBase(current);
+    if (!base) break;
+    if (chain.includes(base)) {
+      return {
+        ok: false,
+        reason: `profile "${id}" has a circular \`extends\` chain: ${[...chain, base].join(" → ")} — a profile cannot inherit from itself, however many steps around`,
+      };
+    }
+    const loaded = load(base);
+    if (!loaded.ok) {
+      return { ok: false, reason: `profile "${chain[chain.length - 1]}" extends "${base}", which did not load: ${loaded.reason}` };
+    }
+    chain.push(base);
+    // Nearest ancestor wins over a more distant one: only fill what is still
+    // absent as the walk moves away from the heir.
+    for (const key of INHERITABLE) {
+      if (!(key in merged) && key in loaded.profile) merged[key] = loaded.profile[key];
+    }
+    current = loaded.profile;
+  }
+
+  if (chain.length === 1) return { ok: true, profile: mod, chain };
+
+  // The heir's own declarations sit on top, and identity is never inherited.
+  const profile = { ...merged };
+  for (const key of Object.keys(mod)) profile[key] = mod[key];
+  profile.id = mod.id;
+  profile.protocol = mod.protocol;
+  return { ok: true, profile, chain };
+}
+
+/**
+ * loadProfile, synchronously — for the readers that only have a project root
+ * and sit in a sync chain (the spec scanner via feature-brief and approvals,
+ * the console's Specs bridge). A profile is plain ESM without top-level
+ * await, so `require()` loads it: supported since Node 20.19 / 22.12 and
+ * sharing the module cache with `import()`, so both loaders hand back the
+ * same instance. On an older Node the refusal names the floor instead of
+ * guessing a layout.
+ * @param {string} root project root
+ * @param {{id: string}} named the manifest's `profile`
+ * @returns {{ok: true, profile: object, entryRel: string} | {ok: false, reason: string}}
+ */
+export function loadProfileSync(root, { id } = {}) {
+  const where = locateProfile(root, id);
+  if (!where.ok) return where;
+  let mod;
+  try {
+    mod = createRequire(import.meta.url)(where.entryAbs);
+  } catch (err) {
+    const code = err && err.code;
+    if (code === "ERR_REQUIRE_ESM" || code === "ERR_REQUIRE_ASYNC_MODULE") {
+      return { ok: false, reason: `profile "${id}" cannot be loaded synchronously on Node ${process.version} — the harness needs Node 20.19 or 22.12 or newer (require() of ES modules); upgrade Node` };
+    }
+    return { ok: false, reason: `profile "${id}" failed to load from ${where.entryRel}: ${err && err.message ? err.message : String(err)}` };
+  }
+  // INHERITANCE BEFORE VALIDATION. The protocol's required exports are a
+  // property of the RESOLVED profile, not of the file: an heir that declares
+  // only what it changes is complete once its base is merged in, and
+  // validating the raw module would refuse it for missing a declaration it
+  // legitimately inherits.
+  const resolved = resolveInheritance(mod, id, (baseId) => loadProfileSync(root, { id: baseId }));
+  if (!resolved.ok) return resolved;
+  const verdict = validateProfileModule(resolved.profile, id);
+  if (!verdict.ok) return verdict;
+  return { ok: true, profile: resolved.profile, entryRel: where.entryRel, chain: resolved.chain };
+}
+
+/**
+ * Load and validate the profile the manifest names.
+ * @param {string} root project root
+ * @param {{id: string}} named the manifest's `profile`
+ * @returns {Promise<{ok: true, profile: object, entryRel: string} | {ok: false, reason: string}>}
+ */
+export async function loadProfile(root, { id } = {}) {
+  const where = locateProfile(root, id);
+  if (!where.ok) return where;
+  let mod;
+  try {
+    mod = await import(pathToFileURL(where.entryAbs).href);
+  } catch (err) {
+    return { ok: false, reason: `profile "${id}" failed to load from ${where.entryRel}: ${err && err.message ? err.message : String(err)}` };
+  }
+  // The async twin resolves the chain the same way; `loadProfileSync` shares
+  // the module cache with `import()`, so both loaders hand back one instance
+  // of every base and cannot disagree about what an heir inherited.
+  const resolved = resolveInheritance(mod, id, (baseId) => loadProfileSync(root, { id: baseId }));
+  if (!resolved.ok) return resolved;
+  const verdict = validateProfileModule(resolved.profile, id);
+  if (!verdict.ok) return verdict;
+  return { ok: true, profile: resolved.profile, entryRel: where.entryRel, chain: resolved.chain };
+}

package/template/qa/lib/profiles/cmp/affected.mjs

@@ -0,0 +1,70 @@
+// profiles/cmp/affected.mjs — which changes fan out too widely to subset the
+// test suite, and how a changed Compose source maps to a Gradle test filter.
+// Mobile's, by definition (docs/NORTH-STAR.md §6).
+//
+// Stage 0 PR 6d. qa/lib/affected-tests.mjs held both halves: the HONESTY
+// CONTRACT (fail open, never fail silent; lane outputs are not changes; an
+// unmapped change runs everything) and the STACK RULES (`.gradle.kts` rewires
+// compilation, `di/` rewires the object graph, `theme/` and
+// `presentation/components/` render into every screen, anything outside
+// composeApp/src is not a scoped source edit, and a `.kt` file's parent
+// directory is a package segment a Gradle `--tests "*seg*"` pattern matches).
+//
+// The first half is the core's and is what makes the subsetting safe at all.
+// The second half is a description of one build tool and one source layout,
+// and vendored into a repo with neither it did something worse than nothing:
+// EVERY path failed the `composeApp/src` test, so every fast run fell open to
+// the full suite — the optimisation silently off, visible only in one
+// parenthetical nobody reads.
+//
+// The pack passes this module to deriveAffectedFilter. Nothing resolves a
+// manifest: the pack already IS the profile, and it can hand the core its own
+// rules directly.
+
+import path from "node:path";
+
+/**
+ * Paths whose change fans out too widely to subset the suite safely. Returns
+ * the human-readable category when `p` is broad-impact, else null. Checked in
+ * order; the first match names the reason. The core adds its own neutral rule
+ * (qa/ is the harness judging itself) before consulting this.
+ * @param {string} p POSIX relpath from the project root
+ * @returns {string|null}
+ */
+export function broadImpact(p) {
+  if (p.endsWith(".gradle.kts") || p === "gradle.properties" || p === "gradle/libs.versions.toml") {
+    return "build files rewire compilation";
+  }
+  if (/(^|\/)di\//.test(p)) return "DI rewires the object graph";
+  if (/(^|\/)theme\//.test(p)) return "theme/tokens render into every screen";
+  if (p.includes("presentation/components/")) return "shared components render into every screen";
+  if (!p.startsWith("composeApp/src/")) return "outside composeApp/src";
+  return null;
+}
+
+/**
+ * The Gradle `--tests` patterns for a set of changed paths, or [] when nothing
+ * maps (the core then runs everything and says so).
+ *
+ * Deliberately simple and defensible: each changed `.kt` file under
+ * composeApp/src contributes its package's last segment — the parent directory
+ * name (`…/presentation/home/HomeViewModel.kt` → `home`, which the template's
+ * package-mirrors-path conformance makes a package segment) — and the union
+ * becomes patterns matched against test class FQNs. Coarse on purpose:
+ * `*home*` runs every test whose FQN mentions the feature, which over-selects
+ * a little and under-maintains nothing.
+ * @param {string[]} paths POSIX relpaths, already known not to be broad-impact
+ * @returns {{patterns: string[], sourcePaths: string[]}}
+ */
+export function patternsFor(paths) {
+  const ktPaths = paths.filter((p) => p.endsWith(".kt"));
+  const segments = new Set();
+  for (const p of ktPaths) {
+    const seg = path.posix.basename(path.posix.dirname(p));
+    if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(seg)) segments.add(seg);
+  }
+  return { patterns: [...segments].sort().map((s) => `*${s}*`), sourcePaths: ktPaths };
+}
+
+/** The mapping the pack hands to qa/lib/affected-tests.mjs. */
+export const affected = Object.freeze({ broadImpact, patternsFor });

package/template/qa/lib/profiles/cmp/android-checks.mjs

@@ -0,0 +1,56 @@
+// profiles/cmp/android-checks.mjs — the instrumented-test step's verdict.
+// Mobile's, by definition (docs/NORTH-STAR.md §6).
+//
+// This lived in qa/lib/step-outcomes.mjs beside the neutral verdict helpers
+// (StepTimeout, stepErrorResult, spawnTimedOut), and it is not neutral: it
+// reads a Gradle invocation's output, a JUnit summary from
+// connectedDebugAndroidTest, and tells the operator to re-run a Gradle task on
+// a device. A backend profile has none of those. Stage 0 PR 6b.2 moved it here
+// so step-outcomes.mjs is the spine's again. The body is verbatim — the tests
+// that pinned it moved with it.
+//
+// The distinction it draws is the load-bearing part, and it is the core's
+// principle applied to one step: a tier that could not RUN is ERROR, never
+// FAIL. "Your behaviour is broken" is a claim, and this step has observed
+// nothing to support it.
+
+/**
+ * The androidChecks outcome from Gradle's exit and the JUnit summary.
+ *
+ * @param {{ok: boolean, out: string}} res the Gradle invocation
+ * @param {{tests: number, failures: number, errors: number}|null} summary parsed JUnit
+ *   results, or null when none were written
+ * @param {{gradlew?: string}} [opts]
+ * @returns {{verdict: "PASS"|"FAIL"|"ERROR", executed: boolean, reason?: string}}
+ */
+export function androidChecksOutcome(res, summary, { gradlew = "./gradlew" } = {}) {
+  const executed = Boolean(summary && summary.tests > 0);
+  if (res.ok) return { verdict: "PASS", executed };
+  const tail = String(res.out ?? "")
+    .split("\n")
+    .filter((l) => /FAILED|error:|failed/i.test(l))
+    .slice(0, 12)
+    .join("\n");
+  if (executed) {
+    return {
+      verdict: "FAIL",
+      executed,
+      reason:
+        `connectedDebugAndroidTest failed (${summary.failures + summary.errors} of ${summary.tests} tests) — ` +
+        `an on-device behavior claim is broken. Fix the behavior, not the test:\n${tail}`,
+    };
+  }
+  // ERROR, not FAIL: the step could not execute. A device tier that could not
+  // run is not evidence (the lane still FAILs), and going green would be the
+  // worse lie — but "your behaviour is broken" is withdrawn, and the receipt
+  // can tell a red that measured something from a red that measured nothing.
+  return {
+    verdict: "ERROR",
+    executed,
+    reason:
+      "connectedDebugAndroidTest DID NOT EXECUTE — the run reported no tests at all, so this step has observed " +
+      "nothing about your change and is not accusing it. Usual cause: another adb/Gradle session touching the same " +
+      "device (a manual `adb` command, a second lane, a running preview), or an install that never landed. " +
+      `Re-run this step alone with nothing else on the device before suspecting the code:\n  ${gradlew} :composeApp:connectedDebugAndroidTest --rerun\n${tail}`,
+  };
+}