devrites 5.13.1 → 5.14.1

package/engine/internal/overhaul/records/records_test.go

@@ -80,6 +80,7 @@ func (f *fixture) records() map[string]J {
 		"coverage.json": {"schema": "overhaul.coverage/1", "files": L{J{"path": "src/a.py", "eligible": true}}},
 		"findings.json": {"schema": "overhaul.findings/1", "findings": L{J{"id": "F-1", "fingerprint": "fp-1",
 			"kind": "defect", "scope_origin": "pre-existing", "status": "confirmed", "severity": "high",
+			"domain": "correctness", "controls": L{"C-1"},
 			"evidence": L{"E-1"}, "locations": L{J{"path": "src/a.py", "start": 1, "end": 1},
 				J{"path": "mobile-app:src/api.ts", "external": true}},
 			"history": L{J{"status": "candidate"}, J{"status": "confirmed"}}}}},
@@ -119,6 +120,27 @@ func (f *fixture) publish(recs map[string]J, extra map[string]string) (int, stri
 	return code, out + errs
 }
 
+// publishRendered stages recs, renders review and report views into the stage, then publishes.
+func (f *fixture) publishRendered(recs map[string]J) (int, string) {
+	f.t.Helper()
+	code, out, errs := f.cmd("stage", f.run)
+	if code != 0 {
+		f.t.Fatalf("stage: %d %s", code, errs)
+	}
+	tmp := strings.TrimSpace(out)
+	for name, doc := range recs {
+		write(f.t, filepath.Join(tmp, name), doc)
+	}
+	for _, kind := range []string{"review", "report"} {
+		var o, e bytes.Buffer
+		if c := render.Run([]string{f.run, tmp, kind}, &o, &e); c != 0 {
+			f.t.Fatalf("render %s: %d %s", kind, c, e.String())
+		}
+	}
+	code, out, errs = f.cmd("publish", f.run)
+	return code, out + errs
+}
+
 func (f *fixture) mustPublish(recs map[string]J) {
 	f.t.Helper()
 	if code, out := f.publish(recs, nil); code != 0 {
@@ -165,6 +187,25 @@ func TestPublishThenValidate(t *testing.T) {
 	}
 }
 
+func cell(r map[string]J) J { return r["coverage.json"]["applicability"].(L)[0].(J) }
+
+// scorecard records a scorecard with the given gates and points run.json at its rubric.
+func scorecard(r map[string]J, gates J) {
+	r["run.json"]["revisions"].(J)["rubric"] = J{"rev": 1, "file": "revisions/rubric-r1.json"}
+	r["scorecard.json"] = J{"schema": "overhaul.scorecard/1", "gates": gates}
+}
+
+// reviewed records one applicability cell in state st, backed by a receipt that
+// checked its domain, and a fully reviewed range for the fixture's file.
+func reviewed(f *fixture, r map[string]J, st string) {
+	write(f.t, filepath.Join(f.run, "receipts/R-dom.json"), J{"outcome": "no-findings", "domains_checked": L{"correctness"}})
+	addAttempt(r, J{"task_id": "W-1", "attempt_id": "A1", "role": "reviewer", "status": "admitted", "receipt": "receipts/R-dom.json"})
+	r["coverage.json"]["applicability"] = L{J{"domain": "correctness", "component": "api", "lane": "backend",
+		"state": st, "reason": "no GUI", "receipts": L{"receipts/R-dom.json"}}}
+	r["coverage.json"]["files"] = L{J{"path": "src/a.py", "eligible": true,
+		"ranges": L{J{"start": 1, "end": 1, "state": "semantically-reviewed"}}}}
+}
+
 func TestSingleGenerationRules(t *testing.T) {
 	verifiedHistory := L{J{"status": "candidate"}, J{"status": "confirmed"}, J{"status": "approved-for-fix"},
 		J{"status": "in-progress"}, J{"status": "fixed-unverified"}, J{"status": "verified"}}
@@ -338,16 +379,89 @@ func TestSingleGenerationRules(t *testing.T) {
 			r["cycles.json"]["schema"] = "overhaul.cycle/1"
 			r["run.json"]["mode"] = "yolo"
 		}, "run.json: mode='yolo' not in ['branch', 'full', 'pr']"},
+		{"stopped run without report views", func(f *fixture, r map[string]J) {
+			r["run.json"]["execution_outcome"] = "READY_FOR_USER_REVIEW"
+			r["run.json"]["task_outcomes"] = J{"T-1": "completed"}
+		}, "views/report.html is required once the run stops"},
+		{"awaiting approval without review views", func(f *fixture, r map[string]J) {
+			r["run.json"]["execution_outcome"] = "AWAITING_APPROVAL"
+			r["run.json"]["phase"] = "AWAITING_APPROVAL"
+		}, "views/review.html is required while awaiting approval"},
 		{"ineligible coverage without reason", func(f *fixture, r map[string]J) {
 			r["coverage.json"]["files"] = L{J{"path": "src/a.py", "eligible": false}}
 		}, "coverage src/a.py: ineligible without an exclusion reason"},
+		{"finding without domain", func(f *fixture, r map[string]J) { delete(finding(r), "domain") }, "finding F-1: domain must be one of"},
+		{"confirmed finding without controls", func(f *fixture, r map[string]J) { delete(finding(r), "controls") },
+			"finding F-1: a confirmed finding names the rubric controls it fails"},
+		{"finding with unknown control", func(f *fixture, r map[string]J) { finding(r)["controls"] = L{"C-9"} }, "finding F-1: unknown control C-9"},
+		{"open finding with passing control", func(f *fixture, r map[string]J) {
+			r["results-candidate.json"] = J{"schema": "overhaul.results/1", "results": J{"C-1": J{"status": "PASS"}}}
+		}, "finding F-1: control C-1 is PASS in results-candidate.json while the finding is confirmed"},
+		{"critical-high gate against open finding", func(f *fixture, r map[string]J) {
+			scorecard(r, J{"G-NO-CRITICAL-HIGH": "PASS"})
+		}, "G-NO-CRITICAL-HIGH is PASS but finding F-1 is confirmed high"},
+		{"serious-lead gate against open lead", func(f *fixture, r map[string]J) {
+			r["findings.json"]["findings"] = append(r["findings.json"]["findings"].(L), J{"id": "F-2", "fingerprint": "fp-2",
+				"kind": "defect", "scope_origin": "pre-existing", "status": "candidate", "domain": "security",
+				"potential_impact": "critical", "history": L{J{"status": "candidate"}}})
+			scorecard(r, J{"G-NO-OPEN-SERIOUS-LEAD": "PASS"})
+		}, "G-NO-OPEN-SERIOUS-LEAD is PASS but lead F-2 is open with potential impact critical"},
+		{"coverage gate without matrix", func(f *fixture, r map[string]J) { scorecard(r, J{"G-COVERAGE": "PASS"}) },
+			"G-COVERAGE is PASS without an applicability matrix"},
+		{"coverage gate with blocked cell", func(f *fixture, r map[string]J) {
+			reviewed(f, r, "blocked")
+			scorecard(r, J{"G-COVERAGE": "PASS"})
+		}, "applicability ['correctness', 'api', 'backend'] is blocked"},
+		{"coverage gate with unchecked domain", func(f *fixture, r map[string]J) {
+			reviewed(f, r, "applicable")
+			cell(r)["receipts"] = L{"receipts/R-1.json"}
+			scorecard(r, J{"G-COVERAGE": "PASS"})
+		}, "no admitted, non-gap receipt of applicability ['correctness', 'api', 'backend'] lists correctness in domains_checked"},
+		{"coverage gate with unreviewed range", func(f *fixture, r map[string]J) {
+			reviewed(f, r, "applicable")
+			r["coverage.json"]["files"] = L{J{"path": "src/a.py", "eligible": true, "ranges": L{J{"start": 1, "end": 1, "state": "tool-scanned"}}}}
+			scorecard(r, J{"G-COVERAGE": "PASS"})
+		}, "eligible file src/a.py has unreviewed ranges"},
+		{"coverage gate with rejected receipt", func(f *fixture, r map[string]J) {
+			reviewed(f, r, "applicable")
+			attempts(r)[len(attempts(r))-1].(J)["status"] = "rejected"
+			scorecard(r, J{"G-COVERAGE": "PASS"})
+		}, "no admitted, non-gap receipt of applicability"},
+		{"coverage gate with gap receipt", func(f *fixture, r map[string]J) {
+			reviewed(f, r, "applicable")
+			write(f.t, filepath.Join(f.run, "receipts/R-dom.json"), J{"outcome": "gap", "domains_checked": L{"correctness"}})
+			scorecard(r, J{"G-COVERAGE": "PASS"})
+		}, "no admitted, non-gap receipt of applicability"},
+		{"coverage gate counts empty files", func(f *fixture, r map[string]J) {
+			reviewed(f, r, "applicable")
+			r["coverage.json"]["files"] = L{J{"path": "src/a.py", "eligible": true, "lines": 0}}
+			scorecard(r, J{"G-COVERAGE": "PASS"})
+		}, ""},
+		{"coverage gate backed by records", func(f *fixture, r map[string]J) {
+			reviewed(f, r, "applicable")
+			scorecard(r, J{"G-COVERAGE": "PASS"})
+		}, ""},
+		{"unknown applicability state", func(f *fixture, r map[string]J) {
+			reviewed(f, r, "maybe")
+		}, "state must be applicable, not-applicable or blocked"},
+		{"not-applicable cell without reason", func(f *fixture, r map[string]J) {
+			reviewed(f, r, "not-applicable")
+			delete(cell(r), "reason")
+		}, "not-applicable needs a reason"},
+		{"unknown range state", func(f *fixture, r map[string]J) {
+			r["coverage.json"]["files"] = L{J{"path": "src/a.py", "eligible": true, "ranges": L{J{"start": 1, "end": 1, "state": "done"}}}}
+		}, "range state 'done' is not a coverage state"},
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
 			f := newFixture(t)
 			r := f.records()
 			c.mutate(f, r)
-			code, out := f.publish(r, nil)
+			publish := func() (int, string) { return f.publish(r, nil) }
+			if c.want == "" {
+				publish = func() (int, string) { return f.publishRendered(r) }
+			}
+			code, out := publish()
 			if c.want == "" {
 				if code != 0 {
 					t.Fatalf("want publish ok, got %d:\n%s", code, out)
@@ -554,6 +668,7 @@ func TestBadPath(t *testing.T) {
 		{"./src/a.py", "not normalized or escapes the repository"},
 		{"src", "names a directory or git metadata"},
 		{".git/config", "names a directory or git metadata"},
+		{".devrites/overhaul/r1/g0001/run.json", "names the overhaul run area"},
 		{"src/.git/HEAD", "names a directory or git metadata"},
 		{"src/out.py", "resolves outside the repository (symlink or traversal)"},
 	}

package/engine/internal/overhaul/records/run.go

@@ -1,6 +1,7 @@
 // Package records implements the /overhaul records tool: generation staging
 // and publishing plus cross-record validation of a run area.
 //
+//	init REPO ID    create REPO/.devrites/overhaul/ID (0700) and make git ignore it
 //	digest FILE     sha256 of exact bytes
 //	stage RUN       copy current generation to RUN/g<N+1>.tmp (prints path)
 //	publish RUN     validate staged generation, write manifest, swap CURRENT last
@@ -25,6 +26,7 @@ import (
 
 const usage = `usage: overhaul records <command> ...
 
+  init REPO ID    create REPO/.devrites/overhaul/ID (0700) and make git ignore it
   digest FILE     sha256 of exact bytes
   stage RUN       copy current generation to RUN/g<N+1>.tmp (prints path)
   publish RUN     validate staged generation, write manifest, swap CURRENT last
@@ -46,6 +48,12 @@ func Run(args []string, stdout, stderr io.Writer) int {
 		if d, err = sha(args[1]); err == nil {
 			fmt.Fprintln(stdout, d)
 		}
+	case "init":
+		if len(args) != 3 {
+			fmt.Fprint(stderr, usage)
+			return 2
+		}
+		err = initRun(args[1], args[2], stdout)
 	case "stage":
 		code, err = stage(args[1], stdout, stderr)
 	case "publish":
@@ -331,7 +339,7 @@ func publish(run string, stdout, stderr io.Writer) (int, error) {
 	}
 	manifest := map[string]any{"schema": "overhaul.manifest/1", "generation": gen, "previous": previous,
 		"files": files, "revisions": revs}
-	if err := ovio.WriteJSON(join(tmp, "manifest.json"), manifest, 0o666); err != nil {
+	if err := ovio.WriteJSON(join(tmp, "manifest.json"), manifest, 0o644); err != nil {
 		return 0, err
 	}
 	if err := os.Rename(tmp, join(run, gen)); err != nil {