gentle-pi 1.2.0 → 2.0.0

package/tests/native-review-capability-contract.test.ts

@@ -0,0 +1,87 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { NATIVE_CLI_CONTRACTS } from "../lib/native-review-cli.ts";
+
+// Organic RDD parity: the four organic-parity capability columns exist on every
+// shipped NATIVE_CLI_CONTRACTS row. Every row through the pinned "2.1.11"
+// reports them false. "2.2.0" is the first capability-true row and it lights
+// only what was demonstrated to reach a negotiated consumer, per Design
+// Decision #1 ("Future row policy").
+//
+// A row describes what the NATIVE CLI puts on the wire, never what Pi manages
+// to show. `riskEvidence` and `hint` stay false on 2.2.0 even though a Pi
+// operator now sees both, because Pi derives them from `risk_reasons` and
+// `changed_files` rather than receiving them: the closed `start/v2` schema
+// omits the fields. Lighting the row would tell a future reader the envelope
+// carries something it does not.
+
+const ORGANIC_PARITY_CAPABILITIES = ["mode", "riskEvidence", "hint", "delivery"] as const;
+const DARK_VERSIONS = ["2.1.4", "2.1.5", "2.1.6", "2.1.7", "2.1.8", "2.1.9", "2.1.10", "2.1.11"] as const;
+
+test("every row through the pinned 2.1.11 reports the organic-parity capability columns false", () => {
+	for (const version of DARK_VERSIONS) {
+		const contract = NATIVE_CLI_CONTRACTS[version] as Record<string, boolean>;
+		for (const capability of ORGANIC_PARITY_CAPABILITIES) {
+			assert.equal(
+				Object.hasOwn(contract, capability) ? contract[capability] : false,
+				false,
+				`${version}.${capability} must be false or absent`,
+			);
+		}
+	}
+});
+
+test("the 2.1.11 row explicitly reports all four organic-parity capabilities false", () => {
+	const contract = NATIVE_CLI_CONTRACTS["2.1.11"] as Record<string, boolean>;
+	assert.equal(contract.mode, false);
+	assert.equal(contract.riskEvidence, false);
+	assert.equal(contract.hint, false);
+	assert.equal(contract.delivery, false);
+});
+
+test("2.2.0 lights only the two capabilities its negotiated envelope demonstrably carries", () => {
+	// Ground-truthed against the released v2.2.0 binary: the kill switch and
+	// delivery disposition reach the negotiated path, while `risk_evidence` and
+	// `hint` appear only in the plain envelope. See
+	// tests/native-risk-evidence-parity.test.ts for the captured evidence.
+	const contract = NATIVE_CLI_CONTRACTS["2.2.0"] as Record<string, boolean>;
+	assert.equal(contract.mode, true);
+	assert.equal(contract.delivery, true);
+	assert.equal(contract.riskEvidence, false);
+	assert.equal(contract.hint, false);
+});
+
+test("2.2.1 repeats 2.2.0 because the lane Pi speaks did not move", () => {
+	// Ground-truthed against the released v2.2.1 binary. On
+	// review-integration/v1 it advertises capabilities/v1.5 (protocol minor 5),
+	// but the negotiated start envelope is still the closed `start/v2`, so
+	// `risk_evidence` and `hint` still cannot arrive. v2.2.1 does publish a
+	// second contract, review-integration/v2, whose `start/v3` carries frozen
+	// base/candidate trees -- but Pi does not negotiate it yet, and a row
+	// describes the lane in use, not the lane available.
+	const contract = NATIVE_CLI_CONTRACTS["2.2.1"] as Record<string, boolean>;
+	assert.equal(contract.mode, true);
+	assert.equal(contract.delivery, true);
+	assert.equal(contract.riskEvidence, false);
+	assert.equal(contract.hint, false);
+	assert.deepEqual(contract, NATIVE_CLI_CONTRACTS["2.2.0"] as Record<string, boolean>);
+});
+
+test("2.2.2 repeats 2.2.1 because the lane Pi speaks still did not move", () => {
+	// Ground-truthed against the released v2.2.2 binary: on
+	// review-integration/v1 it advertises capabilities/v1.5 and the negotiated
+	// start envelope is still the closed `start/v2`, so risk_evidence and hint
+	// still cannot arrive on the lane Pi negotiates.
+	const contract = NATIVE_CLI_CONTRACTS["2.2.2"] as Record<string, boolean>;
+	assert.equal(contract.mode, true);
+	assert.equal(contract.delivery, true);
+	assert.equal(contract.riskEvidence, false);
+	assert.equal(contract.hint, false);
+	assert.deepEqual(contract, NATIVE_CLI_CONTRACTS["2.2.1"] as Record<string, boolean>);
+});
+
+test("no shipped version key was added beyond the pin bump", () => {
+	// Rows are promises to consumers, so a new key only ever appears in a
+	// dedicated commit alongside a pin bump, never as a side effect.
+	assert.deepEqual(Object.keys(NATIVE_CLI_CONTRACTS), [...DARK_VERSIONS, "2.2.0", "2.2.1", "2.2.2"]);
+});

package/tests/native-review-cli.test.ts

@@ -676,7 +676,7 @@ test("native review status decodes 2.1.8 released lock residue and keeps unknown
 	// schema-incompatible on every repository that ever completed a review.
 	//
 	// Lock status stays a CLOSED enum extended by exactly `released` — unlike
-	// the cause_category widening in review-integration-v1 (diagnostic
+	// the cause_category widening in review-integration-v2 (diagnostic
 	// metadata nothing routes on), lock status routes blocking behavior in the
 	// controller, so an unknown future status must keep failing closed rather
 	// than being silently classified as blocking or non-blocking.
@@ -829,6 +829,49 @@ test("native SDD readiness requires an unblocked post-review action with publish
 	}
 });
 
+// Phase 13.13 (migrate-review-integration-v2): with the kill switch off,
+// gentle-ai's gate result can never become "allow" (delivery follows ordinary
+// repository policy instead), so gating `ready` on result==="allow" alone
+// deadlocked readiness forever. `delivery` also arrived on the reviewGate
+// struct itself (json:"delivery,omitempty") without a corresponding optional
+// key on the decoder, so that payload was previously rejected outright rather
+// than merely read as not-ready.
+test("native SDD readiness unblocks on disabled/unmanaged delivery instead of deadlocking on a permanently non-allow gate result", async () => {
+	const openspec = JSON.parse(await fixture("sdd-status")) as Record<string, unknown>;
+
+	for (const nextRecommended of ["verify", "archive"] as const) {
+		const body = {
+			...openspec,
+			nextRecommended,
+			blockedReasons: [],
+			reviewGate: { result: "invalidated", reason: "review-driven development is disabled and no receipt governs this candidate, so delivery follows ordinary repository policy", delivery: "disabled/unmanaged" },
+		};
+		const queue = queuedAdapter([VERSION, { stdout: JSON.stringify(body) }]);
+		const status = await new NativeReviewCliV213(queue.adapter).sddStatus({ cwd: "/repo", change: "native-review-authority-parity" });
+		assert.equal(status.ready, true, `${nextRecommended} must be ready under disabled/unmanaged delivery even though result is not "allow"`);
+	}
+
+	// Blocked reasons still take priority over a legitimate unmanaged delivery.
+	const stillBlocked = {
+		...openspec, nextRecommended: "verify", blockedReasons: ["stale authority"],
+		reviewGate: { result: "invalidated", reason: "delivery follows ordinary repository policy", delivery: "disabled/unmanaged" },
+	};
+	const blockedQueue = queuedAdapter([VERSION, { stdout: JSON.stringify(stillBlocked) }]);
+	assert.equal((await new NativeReviewCliV213(blockedQueue.adapter).sddStatus({ cwd: "/repo", change: "native-review-authority-parity" })).ready, false);
+
+	// An unrecognized delivery value must still fail closed (exact enum, not a
+	// free string).
+	const unknownDelivery = {
+		...openspec, nextRecommended: "verify", blockedReasons: [],
+		reviewGate: { result: "invalidated", reason: "delivery follows ordinary repository policy", delivery: "unmanaged" },
+	};
+	const unknownQueue = queuedAdapter([VERSION, { stdout: JSON.stringify(unknownDelivery) }]);
+	await assert.rejects(
+		() => new NativeReviewCliV213(unknownQueue.adapter).sddStatus({ cwd: "/repo", change: "native-review-authority-parity" }),
+		(error: unknown) => error instanceof NativeReviewCliError && error.code === NATIVE_REVIEW_ERROR_CODE.SCHEMA_INCOMPATIBLE,
+	);
+});
+
 test("native client decodes the exact v2.1.3 Engram artifact map", async () => {
 	const queue = queuedAdapter([VERSION, { stdout: await fixture("sdd-status-engram") }]);
 	const status = await new NativeReviewCliV213(queue.adapter).sddStatus({ cwd: "/repo", change: "native-review-authority-parity" });

package/tests/native-review-parity-runtime.test.ts

@@ -14,6 +14,7 @@ import { NativeReviewCliV216 } from "../lib/native-review-cli.ts";
 import { NativeReviewCliV216 as RuntimeNativeReviewCliV216 } from "../runtime/native-review-cli.mjs";
 import { CandidateViewRegistry } from "../lib/review-candidate-view.ts";
 import { resolveGentleAiReleaseAsset } from "../scripts/gentle-ai-installer.mjs";
+import { requireNativeBinary } from "./support/native-binary-gate.ts";
 
 const execFileAsync = promisify(execFile);
 const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
@@ -27,7 +28,9 @@ const resolvedBinary = (() => {
 		return undefined;
 	}
 })();
-const test = resolvedBinary === undefined ? baseTest.skip : baseTest;
+const nativeBinaryGate = requireNativeBinary({ resolvedBinary, digestsPinned: true, env: process.env });
+if (!nativeBinaryGate.run) console.log(`native-review-parity-runtime: ${nativeBinaryGate.reason}`);
+const test = nativeBinaryGate.run ? baseTest : baseTest.skip;
 const binary = resolvedBinary ?? "";
 const OFFICIAL_BINARY_SHA256 = resolveGentleAiReleaseAsset(process.platform, process.arch).binarySha256;
 const REVIEWED_PATHS = ["tracked.txt", "initially-untracked.txt"] as const;
@@ -153,16 +156,51 @@ function authorityInventory(status: Record<string, unknown>): ReviewAuthorityEnt
 	});
 }
 
+// Every reviewer result reaches authority through `review capture-result`.
+// `review finalize --result` was removed because a result handed over that way
+// carries no provider-owned admission, so it cannot prove the lens inspected
+// the frozen candidate. The bindings are never guessed here: each one comes
+// from the collect transition the provider itself publishes, which is also
+// what the removal message tells a caller to do.
+//
+// Artifacts stay outside the repository on purpose. Writing them inside changes
+// the workspace snapshot between deriving a target and using it, and authority
+// correctly rejects the stale target that results.
+async function nextTransition(repository: string): Promise<Record<string, unknown>> {
+	const status = JSON.parse((await run(binary, ["review", "status", "--contract", "gentle-ai.review-integration/v2", "--cwd", repository, "--projection", "workspace", "--next-transition"], repository)).stdout) as Record<string, unknown>;
+	return status.next_transition as Record<string, unknown>;
+}
+
+async function captureSelectedLenses(repository: string, artifacts: string, evidenceName: string): Promise<void> {
+	for (let guard = 0; guard < 8; guard += 1) {
+		const transition = await nextTransition(repository);
+		const collect = transition.collect as { inputs?: readonly Record<string, unknown>[] } | undefined;
+		if (transition.kind !== "collect" || collect?.inputs === undefined) return;
+		for (const [index, input] of collect.inputs.entries()) {
+			const subject = input.artifact_subject as { subject_hash: string };
+			const manifest = input.changed_path_manifest as readonly { path: string }[];
+			const result = join(artifacts, `${evidenceName}-capture-${index}.json`);
+			await writeFile(result, JSON.stringify({
+				subject_hash: subject.subject_hash,
+				inspection: { status: "completed", paths: manifest.map((entry) => entry.path) },
+				findings: [],
+				evidence: ["reviewed the complete frozen candidate scope"],
+			}));
+			// The published tokens already carry the repository context, and
+			// capture-result accepts that or --cwd, never both.
+			const tokens = (input.arguments as readonly { token: string }[]).map((argument) => argument.token);
+			const captured = await run(binary, ["review", "capture-result", ...tokens, "--input", result], repository);
+			assert.equal(captured.exitCode, 0, `capture-result failed: ${captured.stderr}`);
+		}
+	}
+	assert.fail("collect transitions did not converge");
+}
+
 async function finalizeEmptyReview(repository: string, artifacts: string, started: ReviewStart, evidenceName: string): Promise<CommandResult> {
 	const evidence = join(artifacts, evidenceName);
 	await writeFile(evidence, `evidence for ${started.lineage_id}\n`);
-	const resultFiles: string[] = [];
-	for (const [index] of started.selected_lenses.entries()) {
-		const result = join(artifacts, `${evidenceName}-lens-${index}.json`);
-		await writeFile(result, JSON.stringify({ findings: [], evidence: ["reviewed frozen candidate"] }));
-		resultFiles.push(result);
-	}
-	return run(binary, ["review", "finalize", "--cwd", repository, "--lineage", started.lineage_id, ...resultFiles.flatMap((result) => ["--result", result]), "--evidence", evidence], repository);
+	await captureSelectedLenses(repository, artifacts, evidenceName);
+	return run(binary, ["review", "finalize", "--cwd", repository, "--lineage", started.lineage_id, "--captured-results=true", "--evidence", evidence], repository);
 }
 
 test("official pinned package runtime authorizes an unchanged linked-view candidate and denies a changed staging tree", async (t) => {
@@ -206,13 +244,10 @@ test("official pinned package runtime authorizes an unchanged linked-view candid
 
 	const evidence = join(artifacts, "final-evidence.txt");
 	await writeFile(evidence, "linked-view parity probe\n");
-	const resultFiles: string[] = [];
-	for (const [index] of started.selected_lenses.entries()) {
-		const result = join(artifacts, `lens-${index}.json`);
-		await writeFile(result, JSON.stringify({ findings: [], evidence: ["reviewed linked candidate view"] }));
-		resultFiles.push(result);
-	}
-	await run(binary, ["review", "finalize", "--cwd", view, "--lineage", started.lineage_id, ...resultFiles.flatMap((result) => ["--result", result]), "--evidence", evidence], view);
+	// The linked view is the root authority froze, so its collect bindings are
+	// derived from the view, not from the contributor repository.
+	await captureSelectedLenses(view, artifacts, "final-evidence.txt");
+	await run(binary, ["review", "finalize", "--cwd", view, "--lineage", started.lineage_id, "--captured-results=true", "--evidence", evidence], view);
 
 	await run("git", ["add", "--", ...REVIEWED_PATHS], repository);
 	await assertPublishedProjection(repository, candidateTree);
@@ -306,20 +341,29 @@ test("official pinned package runtime keeps frozen candidate lineages and receip
 	assert.equal(competingStartResult.lineage_id, first.lineage_id);
 	assert.equal(competingStartResult.state, "approved");
 	assert.deepEqual(authorityAfterCompetingStart, authorityBeforeCompetingStart, "a blocked scope action must not mutate approved authority");
+	// A plain START over the moved candidate does NOT mint a fresh lineage. An
+	// approved lineage whose scope changed is recovered, keeping the operator
+	// pointed at the receipt that already exists instead of quietly abandoning
+	// it, and the recovery itself needs a maintainer to authorize it. Pi mirrors
+	// this because the experience must be the one gentle-ai defines, not a
+	// friendlier one Pi invents.
 	const second = JSON.parse((await run(binary, ["review", "start", "--cwd", repository], repository)).stdout) as ReviewStart;
 	const secondInventory = authorityInventory(await reviewStatus(repository));
-	assert.equal(second.action, "created");
-	assert.equal(second.state, "reviewing");
-	assert.notEqual(second.lineage_id, first.lineage_id, "a distinct candidate must establish a distinct lineage");
+	assert.equal(second.action, "recover");
+	assert.equal(second.state, "approved");
+	assert.equal(second.lineage_id, first.lineage_id, "a moved candidate recovers the approved lineage rather than replacing it");
 	const secondReplay = JSON.parse((await run(binary, ["review", "start", "--cwd", repository], repository)).stdout) as ReviewStart;
 	const secondReplayInventory = authorityInventory(await reviewStatus(repository));
+	assert.equal(secondReplay.action, "recover", "recovery is idempotent");
 	assert.equal(secondReplay.lineage_id, second.lineage_id, "replaying the second START must reuse its lineage");
 	assert.deepEqual(secondReplayInventory, secondInventory, "replaying the second START must not duplicate durable authority");
-	await finalizeEmptyReview(repository, artifacts, second, "second-evidence.txt");
+	const recoveryTransition = await nextTransition(repository);
+	assert.equal(recoveryTransition.kind, "collect");
+	assert.equal(recoveryTransition.reason_code, "recovery_authorization_required", "recovery must ask a maintainer, never proceed on its own");
 
-	const secondAllowed = JSON.parse((await run(binary, ["review", "validate", "--gate", "pre-commit", "--cwd", repository, "--lineage", second.lineage_id], repository)).stdout) as ReviewGateResult;
-	assert.equal(secondAllowed.result, "allow");
-	assert.equal(secondAllowed.context.candidate_tree, secondCandidateTree);
+	// No receipt covers the moved candidate, so delivery is denied rather than
+	// waved through, and the denial names `gentle-ai review recover` with the
+	// inputs it needs. A blocked gate that names its exit is the whole point.
 	await assertScopeChanged(repository, first.lineage_id);
 
 	await writeFile(join(repository, "tracked.txt"), "candidate one\n");
@@ -379,7 +423,10 @@ test("registered gentle_review START materializes a safe internal skill symlink
 	let returned: { details?: unknown } | undefined;
 	let thrown: unknown;
 	try {
-		returned = await controller.execute("issue-146-start", { operation: "start", input: JSON.stringify({ mode: "ordinary" }) }, undefined, undefined, { cwd: repository, hasUI: false, ui: { confirm: async () => true } } as unknown as ExtensionContext);
+		// A headless context still receives notices, so the stub carries notify.
+		// Without it the consent path throws on a real ExtensionContext member,
+		// and the failure reads as a START problem rather than a stub gap.
+		returned = await controller.execute("issue-146-start", { operation: "start", input: JSON.stringify({ mode: "ordinary" }) }, undefined, undefined, { cwd: repository, hasUI: false, ui: { confirm: async () => true, notify: () => {} } } as unknown as ExtensionContext);
 	} catch (caught) {
 		thrown = caught;
 	}