gentle-pi 2.1.2 → 2.3.0

package/tests/review-corrected-finalize-binding.test.ts

@@ -0,0 +1,134 @@
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import test from "node:test";
+import { __testing } from "../extensions/gentle-ai.ts";
+import type { NativeReviewCli } from "../lib/native-review-cli.ts";
+import { assertReviewLastEventClosureBinding, decodeReviewLastEventClosureV1, type ReviewStatusV3 } from "../lib/review-integration-v2.ts";
+
+const CAPTURED_FIXTURES = join(process.cwd(), "tests", "fixtures", "devbinary");
+
+function captured(name: string): Record<string, unknown> {
+	return JSON.parse(readFileSync(join(CAPTURED_FIXTURES, name), "utf8")) as Record<string, unknown>;
+}
+
+test("captured correction-required result preserves the provider status continuation", () => {
+	const fixture = captured("last-event-capture-result-correction-required.captured.json");
+	const closure = decodeReviewLastEventClosureV1(fixture);
+	assert.equal(closure.operation, "review/capture-result");
+	assert.equal(closure.state, "correction_required");
+	assert.match(closure.storeRevision, /^sha256:[a-f0-9]{64}$/);
+	assert.equal(closure.statusContinuation?.operation, "review.status");
+	assert.deepEqual(
+		closure.statusContinuation?.arguments.map((argument) => argument.token),
+		[
+			"--cwd=/tmp/repository",
+			"--contract=gentle-ai.review-integration/v2",
+			"--next-transition=true",
+			"--lineage=review-afeed0d5a9aa24a1",
+			"--agent=pi",
+		],
+	);
+	assert.deepEqual(closure.statusContinuation?.raw, fixture.status_continuation);
+});
+
+test("correction status continuation stays bound to its enclosing closure and provider target", () => {
+	const mismatch = `sha256:${"b".repeat(64)}`;
+	const cases = [
+		{
+			name: "missing binding lineage",
+			mutate: (binding: Record<string, unknown>) => { delete binding.lineage_id; },
+			error: /lineage does not match its enclosing closure/,
+		},
+		{
+			name: "different binding lineage",
+			mutate: (binding: Record<string, unknown>) => { binding.lineage_id = "review-different"; },
+			error: /lineage does not match its enclosing closure/,
+		},
+		{
+			name: "missing binding revision",
+			mutate: (binding: Record<string, unknown>) => { delete binding.revision; },
+			error: /revision does not match its enclosing closure/,
+		},
+		{
+			name: "different binding revision",
+			mutate: (binding: Record<string, unknown>) => { binding.revision = mismatch; },
+			error: /revision does not match its enclosing closure/,
+		},
+	];
+	for (const scenario of cases) {
+		const fixture = captured("last-event-capture-result-correction-required.captured.json");
+		const continuation = fixture.status_continuation as Record<string, unknown>;
+		scenario.mutate(continuation.binding as Record<string, unknown>);
+		assert.throws(() => decodeReviewLastEventClosureV1(fixture), scenario.error, scenario.name);
+	}
+
+	const argumentMismatch = captured("last-event-capture-result-correction-required.captured.json");
+	const continuation = argumentMismatch.status_continuation as Record<string, unknown>;
+	const argumentsList = continuation.arguments as Array<Record<string, unknown>>;
+	const lineageArgument = argumentsList.find((argument) => argument.name === "lineage")!;
+	lineageArgument.value = "review-different";
+	lineageArgument.token = "--lineage=review-different";
+	assert.throws(() => decodeReviewLastEventClosureV1(argumentMismatch), /lineage argument does not match its enclosing closure/);
+
+	const closure = decodeReviewLastEventClosureV1(captured("last-event-capture-result-correction-required.captured.json"));
+	assert.throws(
+		() => assertReviewLastEventClosureBinding(closure, { lineageId: closure.lineageId, targetIdentity: mismatch }),
+		/status continuation target does not match its provider binding/,
+	);
+});
+
+test("correction-required result and refuter closures require one status continuation", () => {
+	for (const name of [
+		"last-event-capture-result-correction-required.captured.json",
+		"last-event-capture-refuter-correction-required.captured.json",
+	]) {
+		const fixture = captured(name);
+		delete fixture.status_continuation;
+		assert.throws(() => decodeReviewLastEventClosureV1(fixture), /requires status_continuation/, name);
+	}
+});
+
+test("closures outside result or refuter correction-required forbid a status continuation", () => {
+	const approved = captured("last-event-capture-result-approved.captured.json");
+	approved.status_continuation = captured("last-event-capture-result-correction-required.captured.json").status_continuation;
+	assert.throws(() => decodeReviewLastEventClosureV1(approved), /status_continuation is only valid/, "approved result closure");
+});
+
+test("current capture fails closed when fresh STATUS no longer offers the corrected candidate binding", async () => {
+	const lineageId = "corrected-candidate";
+	const sha = `sha256:${"a".repeat(64)}`;
+	const binding = {
+		name: "provider_targeted_validator",
+		schema: "https://gentle-ai.dev/schema/review/targeted-validator/v1",
+		captureOperation: "review.capture-validation",
+		arguments: [
+			{ name: "lineage", value: lineageId, token: `--lineage=${lineageId}` },
+			{ name: "target", value: sha, token: `--target=${sha}` },
+			{ name: "agent", value: "pi", token: "--agent=pi" },
+			{ name: "execute", value: "true", token: "--execute=true" },
+		],
+	};
+	let captureCalls = 0;
+	const native = {
+		targetStatus: async () => ({
+			contract: "gentle-ai.review-integration/v2",
+			applicability: "current_target",
+			authority: { version: "compact-v2", lineageId, state: "correction_required", generation: 1, revision: sha },
+			receipt: { status: "expected_missing" },
+			action: "stop",
+			replayability: "not_replayable",
+			targetIdentity: sha,
+			projection: { schema: "gentle-ai.review-candidate-projection/v1", kind: "current-changes", projection: "workspace", baseTree: "b".repeat(40), initialReviewTree: "b".repeat(40), currentCandidateTree: "c".repeat(40), pathsDigest: sha, paths: ["corrected.ts"], intendedUntracked: [], intendedUntrackedProof: sha, initialSnapshotIdentity: sha, currentSnapshotIdentity: sha },
+			repair: { schema: "gentle-ai.review-authority-repair-assessment/v1", status: "unsupported", counts: { lineages: 0, compactLineages: 0, legacyLineages: 0, events: 0, bytes: 0, eligibleCandidates: 0, unsupportedLineages: 0, conflicts: 0 }, supportedOperations: [], authorizationSchema: "gentle-ai.review-repair-authorization/v1" },
+			candidates: [],
+			nextTransition: { kind: "stop", reasonCode: "corrected_candidate_unavailable" },
+			raw: { schema: "gentle-ai.review-integration.status/v5" },
+		} as unknown as ReviewStatusV3),
+		captureProviderRole: async () => { captureCalls += 1; throw new Error("must not capture"); },
+	} as unknown as NativeReviewCli;
+	const result = await __testing.executeReviewCaptureOperation({ lineageId, collectBinding: JSON.stringify(binding) }, process.cwd(), native);
+	assert.equal(result.outcome, "capture-binding-rejected");
+	assert.equal(result.mutation_outcome, "none");
+	assert.equal(captureCalls, 0);
+});

package/tests/review-dispatch-hydration-gap.test.ts

@@ -0,0 +1,145 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import { __testing } from "../extensions/gentle-ai.ts";
+import type { NativeReviewCli } from "../lib/native-review-cli.ts";
+import { CandidateViewError, CandidateViewRegistry, injectReviewCandidateView } from "../lib/review-candidate-view.ts";
+import type { ReviewCollectInputV3, ReviewStatusV3 } from "../lib/review-integration-v2.ts";
+
+// Field report (2026-08-16, gentle-pi main 402f9f77 + gentle-ai
+// 2.4.0-main.20278905): after #340 the FINALIZE routing defect was fixed but
+// the Pi relay's candidate-view registration still refused for an externally
+// recovered successor. Reproduced against the live binary: hydration itself
+// works for that shape (a dirty LINKED worktree hydrates fine) — the gap is
+// that hydration was wired into the STATUS controller operation ONLY, while
+// the maintainer's flow is `finalize` (now correctly blocked with
+// review.capture-result) followed by a reviewer dispatch. The FINALIZE lane
+// decodes the same authoritative status and never hydrated from it.
+//
+// Second defect in the same area: every hydration failure was swallowed by a
+// bare catch, so the later dispatch refusal claimed no binding existed
+// without ever admitting hydration had been attempted and why it failed.
+
+const SHA = `sha256:${"1".repeat(64)}`;
+
+function git(cwd: string, ...arguments_: string[]): string {
+	return execFileSync("git", arguments_, { cwd, encoding: "utf8" }).trim();
+}
+
+/** A LINKED worktree (not the primary checkout) with dirty tracked files. */
+function linkedDirtyWorktree(t: test.TestContext): string {
+	const root = mkdtempSync(join(tmpdir(), "gentle-pi-hydration-gap-"));
+	t.after(() => rmSync(root, { recursive: true, force: true }));
+	const primary = join(root, "primary");
+	const linked = join(root, "linked");
+	mkdirSync(primary, { recursive: true });
+	git(primary, "init", "-b", "main");
+	git(primary, "config", "user.name", "Hydration Test");
+	git(primary, "config", "user.email", "hydration@example.invalid");
+	mkdirSync(join(primary, "internal"), { recursive: true });
+	writeFileSync(join(primary, "internal", "parser.go"), "package internal\n\nfunc Parse(s string) string {\n\treturn s\n}\n");
+	git(primary, "add", "-A");
+	git(primary, "commit", "-m", "base");
+	git(primary, "worktree", "add", linked, "-b", "feature/fence-info");
+	// Uncommitted tracked modification, exactly the field shape.
+	writeFileSync(join(linked, "internal", "parser.go"), "package internal\n\nimport \"strings\"\n\nfunc Parse(s string) string {\n\treturn strings.TrimSpace(s)\n}\n");
+	return linked;
+}
+
+function reviewerResultCollectInput(lineageId: string, lens: string): ReviewCollectInputV3 {
+	return {
+		name: "reviewer_result",
+		schema: "https://gentle-ai.dev/schema/review/reviewer/v1",
+		captureOperation: "review.capture-result",
+		arguments: [
+			{ name: "lineage", value: lineageId, token: `--lineage=${lineageId}` },
+			{ name: "expected-revision", value: SHA, token: `--expected-revision=${SHA}` },
+			{ name: "lens", value: lens, token: `--lens=${lens}` },
+			{ name: "order", value: "0", token: "--order=0" },
+		],
+		artifactSubject: {
+			schema: "gentle-ai.review-artifact-subject/v2",
+			subjectHash: SHA,
+			lineageId,
+			authorityRevision: SHA,
+			targetIdentity: SHA,
+			baseTree: "3".repeat(40),
+			candidateTree: "4".repeat(40),
+			changedPathManifestSha256: SHA,
+			lens,
+			selectedOrder: 0,
+		},
+	} as unknown as ReviewCollectInputV3;
+}
+
+function successorStatus(lineageId: string, projection: { baseTree: string; currentCandidateTree: string; paths: readonly string[] }): ReviewStatusV3 {
+	return {
+		contract: "gentle-ai.review-integration/v2",
+		applicability: "current_target",
+		authority: { version: "compact-v2", lineageId, state: "reviewer_results_required", generation: 2, revision: SHA },
+		receipt: { status: "expected_missing" },
+		action: "finalize",
+		replayability: "not_replayable",
+		targetIdentity: SHA,
+		projection: {
+			schema: "gentle-ai.review-integration.projection/v1",
+			kind: "current-changes",
+			projection: "workspace",
+			baseTree: projection.baseTree,
+			initialReviewTree: projection.currentCandidateTree,
+			currentCandidateTree: projection.currentCandidateTree,
+			pathsDigest: SHA,
+			paths: [...projection.paths],
+			intendedUntracked: [],
+			intendedUntrackedProof: SHA,
+			initialSnapshotIdentity: SHA,
+			currentSnapshotIdentity: SHA,
+		},
+		candidates: [],
+		nextTransition: { kind: "collect", reasonCode: "reviewer_results_required", collect: { inputs: [reviewerResultCollectInput(lineageId, "review-reliability")] } },
+		raw: { schema: "gentle-ai.review-integration.status/v5", action: "finalize", lineage_id: lineageId },
+	} as unknown as ReviewStatusV3;
+}
+
+/** The live frozen identity of the dirty linked worktree candidate. */
+function liveProjection(cwd: string): { baseTree: string; currentCandidateTree: string; paths: readonly string[] } {
+	const probe = new CandidateViewRegistry();
+	const view = probe.create({ contributorRoot: cwd });
+	try {
+		return { baseTree: view.baseTree, currentCandidateTree: view.candidateTree, paths: view.paths };
+	} finally {
+		probe.cleanup(view.token);
+	}
+}
+
+function statusNative(status: ReviewStatusV3): NativeReviewCli {
+	return {
+		targetStatus: async () => status,
+		finalize: async () => { throw new Error("native finalize must not run while reviewer results are outstanding"); },
+	} as unknown as NativeReviewCli;
+}
+
+async function runController(parameters: Record<string, unknown>, cwd: string, native: NativeReviewCli, candidateViews: CandidateViewRegistry): Promise<Record<string, unknown>> {
+	return await __testing.executeReviewControllerOperation(
+		parameters, cwd, native, undefined, candidateViews,
+	) as Record<string, unknown>;
+}
+
+test("STATUS keeps hydrating and stays read-only when hydration fails", async (t) => {
+	const cwd = linkedDirtyWorktree(t);
+	const lineageId = "status-drifted-successor";
+	const registry = new CandidateViewRegistry();
+	const statusLive = liveProjection(cwd);
+	const drifted = { ...statusLive, currentCandidateTree: statusLive.baseTree };
+	// STATUS must never fail because hydration failed.
+	const envelope = await runController({ operation: "status", lineageId }, cwd, statusNative(successorStatus(lineageId, drifted)), registry);
+	assert.equal(envelope.operation, "status");
+	assert.equal(registry.hasCurrentBinding(), false);
+	assert.throws(
+		() => injectReviewCandidateView({ agent: "review-reliability", task: "review", mode: "task" }, registry),
+		(error: unknown) => error instanceof CandidateViewError && error.reason === "current-binding-hydration-failed",
+	);
+});

package/tests/review-gate.test.ts

@@ -4,7 +4,6 @@ import { chmodSync, mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:f
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import test from "node:test";
-import { __testing } from "../extensions/gentle-ai.ts";
 import {
 	EXTERNAL_RELEASE_EVIDENCE,
 	GATE_RESULT,
@@ -175,14 +174,6 @@ function temporaryAuthority(t: test.TestContext): GateRepository & {
 	return { ...repository, store, receipt: receiptFor(state), authoritativeReceipt: store.createAuthoritativeReceipt("approved-lineage") };
 }
 
-test("lifecycle command classification identifies gates but never runs review routing", () => {
-	assert.equal(__testing.classifyReviewEvent("git commit -m fix"), "pre-commit");
-	assert.equal(__testing.classifyReviewEvent("git -C /repo push origin main"), "pre-push");
-	assert.equal(__testing.classifyReviewEvent("gh pr create --draft"), "pre-pr");
-	assert.equal(__testing.classifyReviewEvent("gh release create v1.2.3"), "pre-release");
-	assert.equal(__testing.classifyReviewEvent("git status"), null);
-});
-
 test("unbranded receipts are rejected before lifecycle gate evaluation", (t) => {
 	const { repository, finalTree, store, receipt } = temporaryAuthority(t);
 	execFileSync("git", ["read-tree", finalTree], { cwd: repository });
@@ -589,42 +580,6 @@ test("scope child claim and parent gate journal publish atomically across faults
 	assert.equal(store.read(receipt.body.lineage_id).child_claims?.length, 1);
 });
 
-test("receipt gate cannot bypass independent dangerous-command safety", async () => {
-	let safetyCalls = 0;
-	let gateCalls = 0;
-	const safetyBlock = { block: true, reason: "dangerous command denied" };
-	const result = await __testing.enforceReviewGateAndCommandSafety(
-		"git push origin main",
-		() => {
-			gateCalls += 1;
-			return undefined;
-		},
-		async () => {
-			safetyCalls += 1;
-			return safetyBlock;
-		},
-	);
-	assert.deepEqual(result, safetyBlock);
-	assert.equal(safetyCalls, 1);
-	assert.equal(gateCalls, 0);
-
-	const gateBlock = { block: true, reason: "exact receipt required" };
-	const blocked = await __testing.enforceReviewGateAndCommandSafety(
-		"git push origin main",
-		() => {
-			gateCalls += 1;
-			return gateBlock;
-		},
-		async () => {
-			safetyCalls += 1;
-			return undefined;
-		},
-	);
-	assert.deepEqual(blocked, gateBlock);
-	assert.equal(safetyCalls, 2);
-	assert.equal(gateCalls, 1);
-});
-
 function releaseTarget(repository: GateRepository): GateTargetV1 {
 	return {
 		kind: GATE_TARGET_KIND.RELEASE,