gentle-pi 2.2.0 → 2.4.0

package/tests/review-corrected-finalize-binding.test.ts

@@ -1,175 +1,134 @@
 import assert from "node:assert/strict";
-import { execFileSync } from "node:child_process";
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
+import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import test from "node:test";
 import { __testing } from "../extensions/gentle-ai.ts";
 import type { NativeReviewCli } from "../lib/native-review-cli.ts";
-import { CandidateViewRegistry } from "../lib/review-candidate-view.ts";
-import type { ReviewStatusV3 } from "../lib/review-integration-v2.ts";
+import { assertReviewLastEventClosureBinding, decodeReviewLastEventClosureV1, type ReviewStatusV3 } from "../lib/review-integration-v2.ts";
 
-// Field defect (Engram #12547, lineage review-43762fca1bba0bf3): a MEDIUM
-// lineage detected a reliability defect, corrected it inside budget, captured
-// evidence and the native targeted validator. Negotiated STATUS then returned
-// `captured_provider_targeted_validation_ready` with an execute
-// `review.finalize` transition, and running that exact transition failed twice
-// with `candidate-target-projection-drift`, mutation none, so no receipt was
-// ever minted.
-//
-// Measured on a faithful live reproduction (medium candidate, real binary,
-// START through the controller so the registry holds the START-time view):
-//
-//   START candidate tree:     4c24487f850050af0a0944d37d4dbb15287ab3da
-//   corrected candidate tree: 777f48fdc4e6ed9abd325d6b4c49e6d06036c906
-//   FINALIZE (no documents) -> candidate-target-projection-drift, mutation none
-//   registry branch taken:    ["resolveForFinalize"]
-//
-// Root cause: the corrected tree is tolerated only while
-// `correctionCompletion` (validation AND final_evidence) or `validationAttempt`
-// (final_evidence without a forecast) hold. A FINALIZE that merely follows the
-// provider's own execute transition carries no documents, so both are false,
-// the START-time view is resolved, and it is compared against the corrected
-// candidate the provider itself authorized.
+const CAPTURED_FIXTURES = join(process.cwd(), "tests", "fixtures", "devbinary");
 
-const SHA = `sha256:${"1".repeat(64)}`;
-const DEFECT = "export function lastComponent(input) {\n  const parts = input.split(\"/\");\n  return parts[parts.length - 2];\n}\n";
-const CORRECTED = "export function lastComponent(input) {\n  const parts = input.split(\"/\");\n  return parts[parts.length - 1];\n}\n";
-
-function git(cwd: string, ...arguments_: string[]): string {
-	return execFileSync("git", arguments_, { cwd, encoding: "utf8" }).trim();
-}
-
-function repository(t: test.TestContext): string {
-	const cwd = mkdtempSync(join(tmpdir(), "gentle-pi-corrected-finalize-"));
-	t.after(() => rmSync(cwd, { recursive: true, force: true }));
-	git(cwd, "init", "-b", "main");
-	git(cwd, "config", "user.name", "Corrected Test");
-	git(cwd, "config", "user.email", "corrected@example.invalid");
-	mkdirSync(join(cwd, "src"), { recursive: true });
-	writeFileSync(join(cwd, "src", "parse.js"), "export function parsePath(input) {\n  return input.split(\"/\");\n}\n");
-	git(cwd, "add", "-A");
-	git(cwd, "commit", "-m", "base");
-	writeFileSync(join(cwd, "src", "parse.js"), DEFECT);
-	return cwd;
+function captured(name: string): Record<string, unknown> {
+	return JSON.parse(readFileSync(join(CAPTURED_FIXTURES, name), "utf8")) as Record<string, unknown>;
 }
 
-/** The live frozen identity of the current workspace candidate. */
-function liveIdentity(cwd: string): { baseTree: string; candidateTree: string; paths: readonly string[] } {
-	const probe = new CandidateViewRegistry();
-	const view = probe.create({ contributorRoot: cwd });
-	try {
-		return { baseTree: view.baseTree, candidateTree: view.candidateTree, paths: view.paths };
-	} finally {
-		probe.cleanup(view.token);
-	}
-}
+test("captured correction-required result preserves the provider status continuation", () => {
+	const fixture = captured("last-event-capture-result-correction-required.captured.json");
+	const closure = decodeReviewLastEventClosureV1(fixture);
+	assert.equal(closure.operation, "review/capture-result");
+	assert.equal(closure.state, "correction_required");
+	assert.match(closure.storeRevision, /^sha256:[a-f0-9]{64}$/);
+	assert.equal(closure.statusContinuation?.operation, "review.status");
+	assert.deepEqual(
+		closure.statusContinuation?.arguments.map((argument) => argument.token),
+		[
+			"--cwd=/tmp/repository",
+			"--contract=gentle-ai.review-integration/v2",
+			"--next-transition=true",
+			"--lineage=review-afeed0d5a9aa24a1",
+			"--agent=pi",
+		],
+	);
+	assert.deepEqual(closure.statusContinuation?.raw, fixture.status_continuation);
+});
 
-function correctedStatus(lineageId: string, identity: { baseTree: string; candidateTree: string; paths: readonly string[] }): ReviewStatusV3 {
-	return {
-		contract: "gentle-ai.review-integration/v2",
-		applicability: "current_target",
-		authority: { version: "compact-v2", lineageId, state: "correction_required", generation: 1, revision: SHA },
-		receipt: { status: "expected_missing" },
-		action: "finalize",
-		replayability: "not_replayable",
-		frozen: { tier: "medium", originalChangedLines: 4, correctionBudget: 2 },
-		targetIdentity: SHA,
-		projection: {
-			schema: "gentle-ai.review-integration.projection/v1",
-			kind: "current-changes",
-			projection: "workspace",
-			baseTree: identity.baseTree,
-			initialReviewTree: identity.candidateTree,
-			currentCandidateTree: identity.candidateTree,
-			pathsDigest: SHA,
-			paths: [...identity.paths],
-			intendedUntracked: [],
-			intendedUntrackedProof: SHA,
-			initialSnapshotIdentity: SHA,
-			currentSnapshotIdentity: SHA,
+test("correction status continuation stays bound to its enclosing closure and provider target", () => {
+	const mismatch = `sha256:${"b".repeat(64)}`;
+	const cases = [
+		{
+			name: "missing binding lineage",
+			mutate: (binding: Record<string, unknown>) => { delete binding.lineage_id; },
+			error: /lineage does not match its enclosing closure/,
 		},
-		candidates: [],
-		// The provider's own answer after it admitted the captured validator.
-		nextTransition: {
-			kind: "execute",
-			reasonCode: "captured_provider_targeted_validation_ready",
-			execute: {
-				operation: "review.finalize",
-				arguments: [
-					{ name: "lineage", value: lineageId, token: `--lineage=${lineageId}` },
-					{ name: "captured-evidence", value: "true", token: "--captured-evidence=true" },
-				],
-				binding: { lineageId },
-			},
+		{
+			name: "different binding lineage",
+			mutate: (binding: Record<string, unknown>) => { binding.lineage_id = "review-different"; },
+			error: /lineage does not match its enclosing closure/,
 		},
-		raw: { schema: "gentle-ai.review-integration.status/v5", action: "finalize", lineage_id: lineageId },
-	} as unknown as ReviewStatusV3;
-}
-
-function approvingNative(status: ReviewStatusV3): { native: NativeReviewCli; transitions: number } {
-	const state = { transitions: 0 };
-	const native = {
-		targetStatus: async () => status,
-		finalizeTransition: async () => {
-			state.transitions += 1;
-			return { lineageId: status.authority!.lineageId, state: "approved", action: "approved", storeRevision: "r2" };
+		{
+			name: "missing binding revision",
+			mutate: (binding: Record<string, unknown>) => { delete binding.revision; },
+			error: /revision does not match its enclosing closure/,
 		},
-		finalize: async () => { throw new Error("the provider transition must be executed, not raw finalize"); },
-	} as unknown as NativeReviewCli;
-	return { native, get transitions() { return state.transitions; } } as never;
-}
-
-/** Binds the START-time immutable reviewer view, as a live session does. */
-function sessionWithStartBinding(cwd: string, lineageId: string): { registry: CandidateViewRegistry; startTree: string } {
-	const registry = new CandidateViewRegistry();
-	const view = registry.createOrReuse({ contributorRoot: cwd });
-	registry.bindCurrent({ token: view.token, lineageId, selectedLenses: ["review-reliability"] });
-	return { registry, startTree: view.candidateTree };
-}
-
-test("FINALIZE follows the provider transition after a correction instead of drifting on the START view", async (t) => {
-	const cwd = repository(t);
-	const lineageId = "review-corrected-lineage";
-	const { registry, startTree } = sessionWithStartBinding(cwd, lineageId);
-	t.after(() => { try { registry.cleanup(registry.resolveForFinalize(lineageId).token); } catch { /* already cleaned */ } });
-
-	// The bounded correction lands: the candidate identity legitimately moves.
-	writeFileSync(join(cwd, "src", "parse.js"), CORRECTED);
-	const corrected = liveIdentity(cwd);
-	assert.notEqual(corrected.candidateTree, startTree, "the correction must move the candidate tree");
+		{
+			name: "different binding revision",
+			mutate: (binding: Record<string, unknown>) => { binding.revision = mismatch; },
+			error: /revision does not match its enclosing closure/,
+		},
+	];
+	for (const scenario of cases) {
+		const fixture = captured("last-event-capture-result-correction-required.captured.json");
+		const continuation = fixture.status_continuation as Record<string, unknown>;
+		scenario.mutate(continuation.binding as Record<string, unknown>);
+		assert.throws(() => decodeReviewLastEventClosureV1(fixture), scenario.error, scenario.name);
+	}
 
-	const harness = approvingNative(correctedStatus(lineageId, corrected));
-	const result = await __testing.executeReviewControllerOperation(
-		// Exactly the reporter's call: follow the provider transition, no documents.
-		{ operation: "finalize", lineageId, input: JSON.stringify({}) },
-		cwd, new Map(), harness.native, undefined, undefined, undefined, registry,
-	) as Record<string, unknown>;
+	const argumentMismatch = captured("last-event-capture-result-correction-required.captured.json");
+	const continuation = argumentMismatch.status_continuation as Record<string, unknown>;
+	const argumentsList = continuation.arguments as Array<Record<string, unknown>>;
+	const lineageArgument = argumentsList.find((argument) => argument.name === "lineage")!;
+	lineageArgument.value = "review-different";
+	lineageArgument.token = "--lineage=review-different";
+	assert.throws(() => decodeReviewLastEventClosureV1(argumentMismatch), /lineage argument does not match its enclosing closure/);
 
-	assert.notEqual(
-		(result.diagnostics as { code?: string } | undefined)?.code,
-		"candidate-target-projection-drift",
-		"a corrected candidate the provider authorized must not read as reviewer-view drift",
+	const closure = decodeReviewLastEventClosureV1(captured("last-event-capture-result-correction-required.captured.json"));
+	assert.throws(
+		() => assertReviewLastEventClosureBinding(closure, { lineageId: closure.lineageId, targetIdentity: mismatch }),
+		/status continuation target does not match its provider binding/,
 	);
-	assert.equal(harness.transitions, 1, "the provider's own finalize transition must run");
-	assert.equal((result.result as { state?: string } | undefined)?.state, "approved");
 });
 
-test("FINALIZE still fails closed when the live candidate does not match the provider projection", async (t) => {
-	const cwd = repository(t);
-	const lineageId = "review-drifted-lineage";
-	const { registry } = sessionWithStartBinding(cwd, lineageId);
-	t.after(() => { try { registry.cleanup(registry.resolveForFinalize(lineageId).token); } catch { /* already cleaned */ } });
+test("correction-required result and refuter closures require one status continuation", () => {
+	for (const name of [
+		"last-event-capture-result-correction-required.captured.json",
+		"last-event-capture-refuter-correction-required.captured.json",
+	]) {
+		const fixture = captured(name);
+		delete fixture.status_continuation;
+		assert.throws(() => decodeReviewLastEventClosureV1(fixture), /requires status_continuation/, name);
+	}
+});
 
-	// The provider describes a candidate this workspace cannot reproduce.
-	const identity = liveIdentity(cwd);
-	const harness = approvingNative(correctedStatus(lineageId, { ...identity, candidateTree: identity.baseTree }));
-	const result = await __testing.executeReviewControllerOperation(
-		{ operation: "finalize", lineageId, input: JSON.stringify({}) },
-		cwd, new Map(), harness.native, undefined, undefined, undefined, registry,
-	) as Record<string, unknown>;
+test("closures outside result or refuter correction-required forbid a status continuation", () => {
+	const approved = captured("last-event-capture-result-approved.captured.json");
+	approved.status_continuation = captured("last-event-capture-result-correction-required.captured.json").status_continuation;
+	assert.throws(() => decodeReviewLastEventClosureV1(approved), /status_continuation is only valid/, "approved result closure");
+});
 
-	assert.equal(result.status, "blocked", "an unverifiable candidate must never mint a receipt");
+test("current capture fails closed when fresh STATUS no longer offers the corrected candidate binding", async () => {
+	const lineageId = "corrected-candidate";
+	const sha = `sha256:${"a".repeat(64)}`;
+	const binding = {
+		name: "provider_targeted_validator",
+		schema: "https://gentle-ai.dev/schema/review/targeted-validator/v1",
+		captureOperation: "review.capture-validation",
+		arguments: [
+			{ name: "lineage", value: lineageId, token: `--lineage=${lineageId}` },
+			{ name: "target", value: sha, token: `--target=${sha}` },
+			{ name: "agent", value: "pi", token: "--agent=pi" },
+			{ name: "execute", value: "true", token: "--execute=true" },
+		],
+	};
+	let captureCalls = 0;
+	const native = {
+		targetStatus: async () => ({
+			contract: "gentle-ai.review-integration/v2",
+			applicability: "current_target",
+			authority: { version: "compact-v2", lineageId, state: "correction_required", generation: 1, revision: sha },
+			receipt: { status: "expected_missing" },
+			action: "stop",
+			replayability: "not_replayable",
+			targetIdentity: sha,
+			projection: { schema: "gentle-ai.review-candidate-projection/v1", kind: "current-changes", projection: "workspace", baseTree: "b".repeat(40), initialReviewTree: "b".repeat(40), currentCandidateTree: "c".repeat(40), pathsDigest: sha, paths: ["corrected.ts"], intendedUntracked: [], intendedUntrackedProof: sha, initialSnapshotIdentity: sha, currentSnapshotIdentity: sha },
+			repair: { schema: "gentle-ai.review-authority-repair-assessment/v1", status: "unsupported", counts: { lineages: 0, compactLineages: 0, legacyLineages: 0, events: 0, bytes: 0, eligibleCandidates: 0, unsupportedLineages: 0, conflicts: 0 }, supportedOperations: [], authorizationSchema: "gentle-ai.review-repair-authorization/v1" },
+			candidates: [],
+			nextTransition: { kind: "stop", reasonCode: "corrected_candidate_unavailable" },
+			raw: { schema: "gentle-ai.review-integration.status/v5" },
+		} as unknown as ReviewStatusV3),
+		captureProviderRole: async () => { captureCalls += 1; throw new Error("must not capture"); },
+	} as unknown as NativeReviewCli;
+	const result = await __testing.executeReviewCaptureOperation({ lineageId, collectBinding: JSON.stringify(binding) }, process.cwd(), native);
+	assert.equal(result.outcome, "capture-binding-rejected");
 	assert.equal(result.mutation_outcome, "none");
-	assert.equal(harness.transitions, 0, "no provider transition may run for an unverifiable candidate");
+	assert.equal(captureCalls, 0);
 });

package/tests/review-dispatch-hydration-gap.test.ts

@@ -124,62 +124,10 @@ function statusNative(status: ReviewStatusV3): NativeReviewCli {
 
 async function runController(parameters: Record<string, unknown>, cwd: string, native: NativeReviewCli, candidateViews: CandidateViewRegistry): Promise<Record<string, unknown>> {
 	return await __testing.executeReviewControllerOperation(
-		parameters, cwd, new Map(), native, undefined, undefined, undefined, candidateViews,
+		parameters, cwd, native, undefined, candidateViews,
 	) as Record<string, unknown>;
 }
 
-test("FINALIZE hydrates the dispatch binding for an externally recovered successor in a dirty linked worktree", async (t) => {
-	const cwd = linkedDirtyWorktree(t);
-	const lineageId = "recovered-dirty-successor";
-	const registry = new CandidateViewRegistry();
-	const native = statusNative(successorStatus(lineageId, liveProjection(cwd)));
-
-	// The maintainer's flow: FINALIZE first (correctly blocked since #340),
-	// then a reviewer dispatch. FINALIZE never went through the STATUS
-	// controller operation, so nothing had hydrated the registry.
-	const finalize = await runController({ operation: "finalize", lineageId, input: JSON.stringify({}) }, cwd, native, registry);
-	assert.equal(finalize.outcome, "reviewer-results-required");
-	assert.equal(registry.hasCurrentBinding(), true, "FINALIZE must hydrate the dispatch binding from the status it decoded");
-	assert.deepEqual(finalize.dispatch_binding, { hydrated: true, lineage_id: lineageId, lenses: ["review-reliability"] });
-
-	try {
-		const dispatch: Record<string, unknown> = { agent: "review-reliability", task: "review the recovered successor", mode: "task" };
-		assert.doesNotThrow(() => injectReviewCandidateView(dispatch, registry));
-		assert.match(String(dispatch.task), new RegExp(lineageId));
-	} finally {
-		registry.cleanup(registry.resolveCurrentForLens("review-reliability").token);
-	}
-});
-
-test("a swallowed hydration failure becomes an observable typed dispatch refusal", async (t) => {
-	const cwd = linkedDirtyWorktree(t);
-	const lineageId = "drifted-successor";
-	const registry = new CandidateViewRegistry();
-	// Realistic drift: the frozen candidate names the pristine HEAD tree while
-	// the live worktree carries the uncommitted modification. Hydration
-	// legitimately fails, and that failure must stop being invisible.
-	const live = liveProjection(cwd);
-	const drifted = { ...live, currentCandidateTree: live.baseTree };
-	const finalize = await runController({ operation: "finalize", lineageId, input: JSON.stringify({}) }, cwd, statusNative(successorStatus(lineageId, drifted)), registry);
-
-	assert.equal(finalize.outcome, "reviewer-results-required");
-	assert.equal(registry.hasCurrentBinding(), false);
-	const binding = finalize.dispatch_binding as { hydrated: boolean; lineage_id: string; reason: string; message: string };
-	assert.equal(binding.hydrated, false, "a failed hydration must be reported, never swallowed");
-	assert.equal(binding.lineage_id, lineageId);
-	assert.ok(typeof binding.reason === "string" && binding.reason.length > 0, "the failure carries a typed reason");
-	assert.match(binding.message, /projection|live candidate/i);
-
-	// The dispatch refusal must now admit that hydration was attempted.
-	assert.throws(
-		() => injectReviewCandidateView({ agent: "review-reliability", task: "review", mode: "task" }, registry),
-		(error: unknown) => error instanceof CandidateViewError
-			&& error.reason === "current-binding-hydration-failed"
-			&& /hydrat/i.test(error.message)
-			&& error.message.includes(lineageId),
-	);
-});
-
 test("STATUS keeps hydrating and stays read-only when hydration fails", async (t) => {
 	const cwd = linkedDirtyWorktree(t);
 	const lineageId = "status-drifted-successor";

package/tests/review-gate.test.ts

@@ -4,7 +4,6 @@ import { chmodSync, mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:f
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import test from "node:test";
-import { __testing } from "../extensions/gentle-ai.ts";
 import {
 	EXTERNAL_RELEASE_EVIDENCE,
 	GATE_RESULT,
@@ -175,14 +174,6 @@ function temporaryAuthority(t: test.TestContext): GateRepository & {
 	return { ...repository, store, receipt: receiptFor(state), authoritativeReceipt: store.createAuthoritativeReceipt("approved-lineage") };
 }
 
-test("lifecycle command classification identifies gates but never runs review routing", () => {
-	assert.equal(__testing.classifyReviewEvent("git commit -m fix"), "pre-commit");
-	assert.equal(__testing.classifyReviewEvent("git -C /repo push origin main"), "pre-push");
-	assert.equal(__testing.classifyReviewEvent("gh pr create --draft"), "pre-pr");
-	assert.equal(__testing.classifyReviewEvent("gh release create v1.2.3"), "pre-release");
-	assert.equal(__testing.classifyReviewEvent("git status"), null);
-});
-
 test("unbranded receipts are rejected before lifecycle gate evaluation", (t) => {
 	const { repository, finalTree, store, receipt } = temporaryAuthority(t);
 	execFileSync("git", ["read-tree", finalTree], { cwd: repository });
@@ -589,42 +580,6 @@ test("scope child claim and parent gate journal publish atomically across faults
 	assert.equal(store.read(receipt.body.lineage_id).child_claims?.length, 1);
 });
 
-test("receipt gate cannot bypass independent dangerous-command safety", async () => {
-	let safetyCalls = 0;
-	let gateCalls = 0;
-	const safetyBlock = { block: true, reason: "dangerous command denied" };
-	const result = await __testing.enforceReviewGateAndCommandSafety(
-		"git push origin main",
-		() => {
-			gateCalls += 1;
-			return undefined;
-		},
-		async () => {
-			safetyCalls += 1;
-			return safetyBlock;
-		},
-	);
-	assert.deepEqual(result, safetyBlock);
-	assert.equal(safetyCalls, 1);
-	assert.equal(gateCalls, 0);
-
-	const gateBlock = { block: true, reason: "exact receipt required" };
-	const blocked = await __testing.enforceReviewGateAndCommandSafety(
-		"git push origin main",
-		() => {
-			gateCalls += 1;
-			return gateBlock;
-		},
-		async () => {
-			safetyCalls += 1;
-			return undefined;
-		},
-	);
-	assert.deepEqual(blocked, gateBlock);
-	assert.equal(safetyCalls, 2);
-	assert.equal(gateCalls, 1);
-});
-
 function releaseTarget(repository: GateRepository): GateTargetV1 {
 	return {
 		kind: GATE_TARGET_KIND.RELEASE,