create-cmp-cli 0.24.0 → 0.25.0

package/packages/harness/src/lib/profiles/cmp/index.mjs

@@ -0,0 +1,47 @@
+// profiles/cmp — the Compose Multiplatform stack profile. Mobile, by definition.
+//
+// This is the first profile and, for now, the only one — and it is loaded the
+// same way every other profile ever will be: by id, from qa/harness-manifest.json,
+// through qa/lib/profile-loader.mjs. The runner does not know this file exists.
+//
+// Stage 0 (docs/proposals/AGNOSTIC-HARNESS-ARCHITECTURE.md §11.3): PR 2 made
+// this module re-export the step pack; PR 4 added `layout` and `tiers`
+// (./declarations.mjs) — the paths and tier names the spec scanner used to
+// hardcode. The other declarations — artifacts, architecture, ladder, review,
+// plants, providers (§4.2) — still live where they always did and move here
+// in the PRs that follow, one at a time, with the mobile fleet-check green
+// after each. A profile that claimed all nine today would be claiming code it
+// does not own yet.
+
+import { createCmpSteps } from "./steps-cmp.mjs";
+
+export const id = "cmp";
+export const protocol = 1;
+
+/** Where specs, sources, tests and flows live; which tiers observe what. */
+export { layout, tiers, grammar, reports, detect, tools } from "./declarations.mjs";
+export { copy as console } from "./console-copy.mjs";
+
+/** What a human signs, in definition order; and whether this tree may record signatures at all. */
+export { artifacts, governable } from "./artifacts.mjs";
+
+/**
+ * The evidence ladder: which of THIS profile's steps earn which rung, and what
+ * the rungs are called. Exported at the top level (not only on the pack's
+ * return) so a reader that must not start a lane — the Stop hook deciding
+ * whether a tier that could have run did — can ask without instantiating
+ * anything. AGNOSTIC-HARNESS-ARCHITECTURE.md §4.2 #6.
+ */
+export { CMP_LADDER as ladder } from "./ladder.mjs";
+
+/**
+ * The source this profile's Rule 0 instrument plants — a citation must sit on
+ * a test, so the instrument has to write one in this stack's language
+ * (AGNOSTIC-HARNESS-ARCHITECTURE.md §4.2 #8, §7.2).
+ */
+export { plants } from "./plants.mjs";
+
+/** The step pack — today's createCmpSteps, unchanged. */
+export function steps(ctx) {
+  return createCmpSteps(ctx);
+}

package/packages/harness/src/lib/profiles/cmp/ladder.mjs

@@ -0,0 +1,67 @@
+// profiles/cmp/ladder.mjs — the Compose Multiplatform profile's evidence
+// ladder: which of ITS steps earn which rung. Mobile's, by definition.
+//
+//   L0 "scaffold" — the scaffold profile's checks passed (stamp-time green
+//                   build: build + unit tests + the pure-Node gates).
+//   L1 "desktop"  — full static + JVM evidence: everything L0 proves PLUS
+//                   conformance, golden trees, a11y, and the release COMPILE
+//                   (releaseBuild) — a green lane with no on-device step run.
+//   L2 "device"   — L1 plus at least one on-device EXECUTION step PASSed
+//                   (e2eSmoke, androidChecks, or the live tokenDrift tier).
+//   L3 "release"  — L2 plus releaseSmoke PASSed (the release APK installed
+//                   and driven on a device).
+//
+// THE LADDER IS THE PROFILE'S, NOT THE SPINE'S (2026-09-03): vendored into a
+// Kotlin backend, these names graded its strongest run — detekt, Konsist,
+// gitleaks — as L0 "scaffold" and made L1 unreachable by construction. A
+// fixed-amount understatement is not conservative, it is wrong, and receipts
+// are where labels get quoted. So the spine's rung derivation
+// (qa/lib/evidence-level.mjs) takes a ladder from the profile's step pack
+// (`evidenceLadder` on steps()' return) and defaults to NOTHING: a profile that
+// declares no ladder earns no rung, which is the honest grade for a ladder
+// nobody has calibrated. Stage 0 PR 3 moved this constant out of the spine so
+// the spine carries no Compose step names at all.
+//
+// Every field is a list of step names except `release`, one name. `names`
+// maps rung → label. A `cmp` L2 and another profile's L2 are different claims
+// (receipt.pack says which); see AGNOSTIC-HARNESS-ARCHITECTURE.md §8.2.
+
+/** The scaffold profile's step set (steps-cmp.mjs stepsForProfile.scaffold). */
+const SCAFFOLD_CORE = [
+  "specCoverage",
+  "approvals",
+  "componentStories",
+  "reachability",
+  "e2eCoverage",
+  "archDoc",
+  "schemaHistory",
+  "build",
+  "unitTests",
+];
+
+/** Steps every PASS must carry to claim even L0 — they run in every profile and never SKIP. */
+const L0_REQUIRED = ["build", "unitTests"];
+
+/**
+ * The steps that distinguish full desktop evidence (L1) from the scaffold
+ * checks. None of these can SKIP — they PASS or FAIL — so "PASSed" is exactly
+ * "ran green".
+ */
+const L1_REQUIRED = ["releaseBuild", "conformance", "goldenTrees", "a11y"];
+
+/** On-device EXECUTION steps — the only steps that can earn L2. */
+const DEVICE_EXECUTION = ["e2eSmoke", "tokenDrift", "androidChecks"];
+
+/** The one step that can lift L2 to L3. */
+const RELEASE_EXECUTION = "releaseSmoke";
+
+const RUNG_NAMES = { L0: "scaffold", L1: "desktop", L2: "device", L3: "release" };
+
+export const CMP_LADDER = Object.freeze({
+  scaffoldCore: Object.freeze(SCAFFOLD_CORE),
+  l0Required: Object.freeze(L0_REQUIRED),
+  l1Required: Object.freeze(L1_REQUIRED),
+  deviceExecution: Object.freeze(DEVICE_EXECUTION),
+  release: RELEASE_EXECUTION,
+  names: Object.freeze(RUNG_NAMES),
+});

package/packages/harness/src/lib/profiles/cmp/maestro.mjs

@@ -0,0 +1,113 @@
+// profiles/cmp/maestro.mjs — the Maestro directory run's verdict, and the
+// device-log sweep scoped to the app under test. Mobile's, by definition.
+//
+// These three lived in qa/lib/step-outcomes.mjs beside the neutral verdict
+// helpers (StepTimeout, stepErrorResult, spawnTimedOut). They are not neutral:
+// a JUnit report from `maestro test <dir>` and an `adb logcat` crash buffer are
+// facts about an Android device, and a backend profile has neither. Stage 0
+// PR 3 moves them here so step-outcomes.mjs is the spine's again. Bodies are
+// verbatim — the tests that pinned them moved with them.
+
+// ── Maestro directory run → per-flow outcome ────────────────────────────────
+/**
+ * Parse Maestro's JUnit report (`maestro test <dir> --format junit --output f`)
+ * into one row per flow. Tolerant: a report that is missing or unparsable
+ * returns null and the caller falls back to the exit code — never a fabricated
+ * per-flow list.
+ * @param {string|null} xml
+ * @returns {Array<{flow: string, ok: boolean, message?: string}>|null}
+ */
+export function parseMaestroJunit(xml) {
+  if (typeof xml !== "string" || !/<testcase\b/.test(xml)) return null;
+  const rows = [];
+  const caseRe = /<testcase\b([^>]*?)(?:\/>|>([\s\S]*?)<\/testcase>)/g;
+  let m;
+  while ((m = caseRe.exec(xml))) {
+    const attrs = m[1] || "";
+    const body = m[2] || "";
+    const name = (attrs.match(/\bname="([^"]*)"/) || [])[1] ?? (attrs.match(/\bid="([^"]*)"/) || [])[1] ?? "?";
+    const status = (attrs.match(/\bstatus="([^"]*)"/) || [])[1];
+    const failed = /<(failure|error)\b/.test(body) || (status && !/^(SUCCESS|PASSED?|OK)$/i.test(status));
+    const message = failed ? ((body.match(/<(?:failure|error)\b[^>]*message="([^"]*)"/) || [])[1] ?? body.replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim().slice(0, 300)) : undefined;
+    rows.push(failed ? { flow: name, ok: false, message } : { flow: name, ok: true });
+  }
+  return rows.length ? rows : null;
+}
+
+/**
+ * The e2e step's verdict from the Maestro run: exit code + per-flow report +
+ * the list of flows the directory held. FAIL names every failing flow; a run
+ * whose report lists fewer flows than the directory holds is ERROR — the lane
+ * cannot claim flows it has no row for.
+ * @param {{ok: boolean, out: string}} res
+ * @param {Array<{flow: string, ok: boolean, message?: string}>|null} perFlow
+ * @param {string[]} flows root-relative flow files the directory holds
+ * @returns {{verdict: "PASS"|"FAIL"|"ERROR", reason?: string, details: object}}
+ */
+export function maestroOutcome(res, perFlow, flows) {
+  const details = { flows, results: perFlow ?? undefined };
+  if (perFlow) {
+    const failed = perFlow.filter((r) => !r.ok);
+    if (failed.length) {
+      return {
+        verdict: "FAIL",
+        reason: `Maestro: ${failed.length} of ${perFlow.length} flow${perFlow.length === 1 ? "" : "s"} failed — ${failed.map((r) => `${r.flow}${r.message ? ` (${r.message.split("\n")[0].slice(0, 120)})` : ""}`).join("; ")}`,
+        details,
+      };
+    }
+    if (perFlow.length < flows.length) {
+      return {
+        verdict: "ERROR",
+        reason: `Maestro reported ${perFlow.length} flow${perFlow.length === 1 ? "" : "s"} but ${E2E_DIR_LABEL} holds ${flows.length} — the run did not cover every flow, so no verdict can be claimed for the rest`,
+        details,
+      };
+    }
+    if (!res.ok) {
+      return { verdict: "FAIL", reason: `Maestro exited non-zero with every flow reported green — treat as a run failure:\n${String(res.out).split("\n").slice(-10).join("\n")}`, details };
+    }
+    return { verdict: "PASS", details };
+  }
+  if (!res.ok) {
+    return { verdict: "FAIL", reason: `Maestro failed (no per-flow report was written):\n${String(res.out).split("\n").slice(-15).join("\n")}`, details };
+  }
+  return { verdict: "PASS", reason: "Maestro exited 0 but wrote no per-flow report — verdict from the exit code only", details };
+}
+const E2E_DIR_LABEL = "qa/e2e";
+
+// ── Device-log incidents, scoped to the app under test ──────────────────────
+/**
+ * ANR / fatal-exception lines from `adb logcat -d -b system,crash,main` that
+ * belong to one of `appIds` (an app's process may be `pkg` or `pkg:remote`).
+ * An emulator carries other apps — on 2026-09-03 the first self-booted lane
+ * went red on `ANR in com.karel.bratometer` while driving com.fleet.check —
+ * so an incident in another package is NOT this lane's failure. With no
+ * appIds known the sweep stays unscoped (every incident counts) and says so.
+ * @param {string} log
+ * @param {string[]} appIds
+ * @returns {{lines: string[], scoped: boolean}}
+ */
+export function deviceLogIncidents(log, appIds = []) {
+  const lines = String(log ?? "").split("\n");
+  const ids = appIds.filter((id) => typeof id === "string" && id.trim() && id !== "__PACKAGE__");
+  const scoped = ids.length > 0;
+  const ours = (proc) => !scoped || ids.some((id) => proc === id || proc.startsWith(`${id}:`));
+  const out = [];
+  lines.forEach((line, i) => {
+    const anr = line.match(/ANR in (\S+?)(?:\s|,|$)/);
+    if (anr) {
+      if (ours(anr[1].replace(/[,)]$/, ""))) out.push(line);
+      return;
+    }
+    if (/FATAL EXCEPTION/i.test(line)) {
+      if (!scoped) {
+        out.push(line);
+        return;
+      }
+      // The crash buffer names the process on one of the next few lines.
+      const window = lines.slice(i, i + 8).join("\n");
+      const proc = window.match(/Process:\s*(\S+?)(?:,|\s|$)/);
+      if (proc && ours(proc[1])) out.push(line);
+    }
+  });
+  return { lines: out, scoped };
+}

package/packages/harness/src/lib/profiles/cmp/plants.mjs

@@ -0,0 +1,95 @@
+// profiles/cmp/plants.mjs — the SOURCE this profile's Rule 0 instrument plants
+// when it proves specCoverage can still read a citation. Mobile's, by
+// definition (docs/NORTH-STAR.md §6; GATE-RULES.md Rule 0/Rule 1).
+//
+// Stage 0 PR 7. Most of qa/framework-check.mjs is already stack-free: which
+// plants a tree can support is derived from the tree through the spec model
+// (PR 4), the clause grammar and the citation marker are the core scanner's,
+// and stripping a flow's citations uses the core's own tag regex. What is NOT
+// stack-free is the file a planted citation has to live in: a citation must sit
+// on a test, so the instrument has to write a test — in this stack's language,
+// with this stack's test-declaration syntax, at a path this stack compiles.
+//
+// Two plants need it, and they are the two that matter most, because each
+// closes an escape that turns a red gate green with no assertions:
+//
+//   unbound   a `// SPEC:` tag on a CLASS with no test inside the binding
+//             window. This is payment-blueprint's real drift: the tag sat on
+//             `class PaymentWorkerTest`, three properties above a genuine
+//             @Test, and vouched for the whole file. The class body here is
+//             deliberately longer than BINDING_WINDOW so a real test cannot
+//             wander into range and launder it.
+//   tierUnmet a clause only the device tier can observe, cited from a
+//             host-tier test that compiles and runs and can never see it.
+//
+// A profile that declares no plants ships without those two, and the
+// instrument says so per plant rather than reporting a quieter green — the
+// §5.2 rule: no plants, no badge.
+
+import { PLANT_KINDS } from "../../framework-check.mjs";
+
+/** The file a planted citation lives in, relative to the test directory the instrument found. */
+export const testFileBasename = "CmpFrameworkCheckPlanted.kt";
+
+/**
+ * A citation on a type declaration with no test under it. The body must be
+ * longer than the core's BINDING_WINDOW so proximity alone cannot bind it.
+ * @param {string} clause the planted clause id
+ * @returns {string}
+ */
+export function unboundCitationSource(clause) {
+  return `// Planted by qa/framework-check.mjs — reverted automatically.\n\n// SPEC: ${clause}\nclass CmpFrameworkCheckPlanted {\n  val a = 1\n  val b = 2\n  val c = 3\n  val d = 4\n  val e = 5\n  val f = 6\n  fun helper() {}\n}\n`;
+}
+
+/**
+ * A real, compiling, running host-tier test that cites a clause only the
+ * device tier could observe.
+ * @param {string} clause the planted clause id
+ * @returns {string}
+ */
+export function tierUnmetCitationSource(clause) {
+  return `// Planted by qa/framework-check.mjs — reverted automatically.\n\nimport kotlin.test.Test\n\nclass CmpFrameworkCheckPlanted {\n  // SPEC: ${clause}\n  @Test\n  fun planted() {}\n}\n`;
+}
+
+/**
+ * The tier requirement the tierUnmet plant declares on its clause. It must be
+ * one this profile's `tiers.satisfying` defines and that a host-tier test
+ * cannot satisfy — otherwise the plant would not plant anything.
+ */
+export const unmeetableTier = "e2e";
+
+/**
+ * WHICH OF THIS PACK'S STEPS CATCHES EACH KIND OF PLANTED VIOLATION.
+ *
+ * `specCoverage` and `e2eCoverage` are OUR words. They used to be written into
+ * the core's plant selector as literals and asserted against every profile
+ * there will ever be — the same defect NORTH-STAR §9.1 records for
+ * `harnessIntegrity`, in the same file, one fix later. A pack spelling its
+ * coverage step `spec_coverage` had this instrument stop at the first plant
+ * with "specCoverage: no row — the guard did not FAIL BY NAME", about a gate
+ * that had just failed by name on the row beside it, and the two floor plants
+ * behind it never ran at all.
+ *
+ * So the names live here, where they are true, keyed by the CORE's plant kinds
+ * so neither side has to learn the other's vocabulary. A pack that omits this
+ * loses nothing it had: its plants assert over the lane instead of over one row
+ * (lib/framework-check.mjs `observingStep`). Declaring is how a pack asks for
+ * the sharper assertion — that THIS gate, not merely some gate, is the one that
+ * caught it.
+ */
+export const observedBy = Object.freeze({
+  [PLANT_KINDS.ORPHANED_CITATION]: "specCoverage",
+  [PLANT_KINDS.UNBOUND_CITATION]: "specCoverage",
+  [PLANT_KINDS.TIER_UNMET]: "specCoverage",
+  [PLANT_KINDS.FEATURE_WITHOUT_FLOW]: "e2eCoverage",
+  [PLANT_KINDS.NESTED_FLOW]: "e2eCoverage",
+});
+
+/** What the instrument reads off the profile. */
+export const plants = Object.freeze({
+  testFileBasename,
+  unboundCitationSource,
+  tierUnmetCitationSource,
+  unmeetableTier,
+  observedBy,
+});

package/{template/qa/lib → packages/harness/src/lib/profiles/cmp}/reachability.mjs

@@ -34,7 +34,7 @@
 import fs from "node:fs";
 import path from "node:path";
 
-import { parseFeatureBlock } from "./feature-brief.mjs";
+import { parseFeatureBlock } from "../../feature-brief.mjs";
 
 // Mirrors component-stories.mjs's walkDirs: every directory named `wanted`
 // anywhere under `root`, recursive.