gsd-pi 2.76.0 → 2.77.0-dev.1594b263e

package/src/resources/extensions/gsd/tests/unit-context-manifest.test.ts

@@ -0,0 +1,258 @@
+// GSD-2 — #4782 phase 1: schema tests + CI coverage guard for manifests.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import {
+  ARTIFACT_KEYS,
+  KNOWN_UNIT_TYPES,
+  UNIT_MANIFESTS,
+  resolveManifest,
+  type ArtifactKey,
+  type SkillsPolicy,
+  type UnitContextManifest,
+} from "../unit-context-manifest.ts";
+
+// ─── Coverage: every known unit type has a manifest ──────────────────────
+
+test("#4782 phase 1: every KNOWN_UNIT_TYPES entry has a UNIT_MANIFESTS entry", () => {
+  for (const unitType of KNOWN_UNIT_TYPES) {
+    assert.ok(
+      UNIT_MANIFESTS[unitType],
+      `unit type "${unitType}" is declared in KNOWN_UNIT_TYPES but has no manifest`,
+    );
+  }
+});
+
+test("#4782 phase 1: every UNIT_MANIFESTS entry corresponds to a known unit type", () => {
+  const known = new Set<string>(KNOWN_UNIT_TYPES as readonly string[]);
+  for (const unitType of Object.keys(UNIT_MANIFESTS)) {
+    assert.ok(
+      known.has(unitType),
+      `manifest entry "${unitType}" is not in KNOWN_UNIT_TYPES — add it there or remove the manifest`,
+    );
+  }
+});
+
+// ─── Coverage: every unitType stringly-typed in auto-dispatch.ts is known ─
+
+test("#4782 phase 1: every unitType string in auto-dispatch.ts has a manifest", () => {
+  // Source-only coverage check — read the dispatcher and enumerate its
+  // unitType literals. This is a CI guard against manifest drift: if a
+  // new dispatch rule is added without a corresponding manifest entry,
+  // this test fails loudly. Read-only check of source text; the cheapest
+  // way to enumerate declared unit types without running the dispatcher.
+  // allow-source-grep: enumerate unitType literals for CI coverage guard
+  const __dirname = dirname(fileURLToPath(import.meta.url));
+  const dispatchSrc = readFileSync(join(__dirname, "..", "auto-dispatch.ts"), "utf-8");
+  const matches = Array.from(dispatchSrc.matchAll(/unitType:\s*"([^"]+)"/g));
+  const seen = new Set<string>();
+  for (const m of matches) {
+    const t = m[1];
+    if (!t) continue;
+    seen.add(t);
+  }
+  const missing: string[] = [];
+  for (const t of seen) {
+    if (!UNIT_MANIFESTS[t as keyof typeof UNIT_MANIFESTS]) {
+      missing.push(t);
+    }
+  }
+  assert.deepEqual(missing, [], `unit types dispatched in auto-dispatch.ts but missing from UNIT_MANIFESTS: ${missing.join(", ")}`);
+});
+
+// ─── Shape: every manifest conforms to the schema invariants ──────────────
+
+test("#4782 phase 1: every manifest's artifacts reference known ArtifactKey values", () => {
+  const validKeys = new Set<string>(ARTIFACT_KEYS as readonly string[]);
+  for (const [unitType, manifest] of Object.entries(UNIT_MANIFESTS)) {
+    const all: ArtifactKey[] = [
+      ...manifest.artifacts.inline,
+      ...manifest.artifacts.excerpt,
+      ...manifest.artifacts.onDemand,
+    ];
+    for (const key of all) {
+      assert.ok(
+        validKeys.has(key),
+        `manifest "${unitType}" references unknown artifact key "${key}"`,
+      );
+    }
+  }
+});
+
+test("#4782 phase 1: no manifest has the same artifact key in inline AND excerpt (mutually exclusive)", () => {
+  for (const [unitType, manifest] of Object.entries(UNIT_MANIFESTS)) {
+    const inline = new Set<string>(manifest.artifacts.inline as readonly string[]);
+    const clashes = (manifest.artifacts.excerpt as readonly string[]).filter(k => inline.has(k));
+    assert.deepEqual(
+      clashes,
+      [],
+      `manifest "${unitType}" has overlapping inline+excerpt artifact keys: ${clashes.join(", ")}. Pick one.`,
+    );
+  }
+});
+
+test("#4782 phase 1: every manifest has a positive maxSystemPromptChars", () => {
+  for (const [unitType, manifest] of Object.entries(UNIT_MANIFESTS)) {
+    assert.ok(
+      typeof manifest.maxSystemPromptChars === "number" && manifest.maxSystemPromptChars > 0,
+      `manifest "${unitType}" has invalid maxSystemPromptChars: ${manifest.maxSystemPromptChars}`,
+    );
+  }
+});
+
+test("#4782 phase 1: skills policy shapes are valid discriminated-union members", () => {
+  for (const [unitType, manifest] of Object.entries(UNIT_MANIFESTS)) {
+    const p = manifest.skills as SkillsPolicy;
+    switch (p.mode) {
+      case "none":
+      case "all":
+        break;
+      case "allowlist":
+        assert.ok(
+          Array.isArray(p.skills) && p.skills.every(s => typeof s === "string"),
+          `manifest "${unitType}" has allowlist policy with invalid skills[]`,
+        );
+        break;
+      default: {
+        const _exhaustive: never = p;
+        void _exhaustive;
+        assert.fail(`manifest "${unitType}" has unrecognized skills.mode`);
+      }
+    }
+  }
+});
+
+// ─── Lookup helper ────────────────────────────────────────────────────────
+
+test("#4782 phase 1: resolveManifest returns null for an unknown unit type", () => {
+  assert.strictEqual(resolveManifest("never-dispatched-unit-type"), null);
+});
+
+test("#4782 phase 1: resolveManifest returns a manifest for every known unit type", () => {
+  for (const unitType of KNOWN_UNIT_TYPES) {
+    const m = resolveManifest(unitType);
+    assert.ok(m, `resolveManifest("${unitType}") should return a manifest`);
+    // Identity check — the helper should return the exact object, not a copy.
+    assert.strictEqual(m, UNIT_MANIFESTS[unitType]);
+  }
+});
+
+// ─── Phase-2 target: complete-milestone manifest reflects #4780's excerpt shape ─
+
+test("#4782 phase 1: complete-milestone manifest declares slice-summary as excerpt (matches #4780)", () => {
+  const m = UNIT_MANIFESTS["complete-milestone"];
+  assert.ok(
+    m.artifacts.excerpt.includes("slice-summary"),
+    "complete-milestone should declare slice-summary as excerpt (alignment with #4780)",
+  );
+  assert.ok(
+    !m.artifacts.inline.includes("slice-summary"),
+    "complete-milestone should NOT declare slice-summary as inline — that was the #4780 bloat",
+  );
+});
+
+// ─── v2 contract invariants (#4924) ──────────────────────────────────────
+
+test("#4924: computed + prepend ids (when declared) are non-empty strings", () => {
+  for (const [unitType, manifest] of Object.entries(UNIT_MANIFESTS)) {
+    const ids: string[] = [
+      ...((manifest.artifacts as { computed?: readonly string[] }).computed ?? []),
+      ...((manifest as { prepend?: readonly string[] }).prepend ?? []),
+    ];
+    for (const id of ids) {
+      assert.ok(
+        typeof id === "string" && id.length > 0,
+        `manifest "${unitType}" has an empty/invalid computed/prepend id: ${JSON.stringify(id)}`,
+      );
+    }
+  }
+});
+
+test("#4924: no computed id appears in both artifacts.computed AND prepend (mutually exclusive position)", () => {
+  for (const [unitType, manifest] of Object.entries(UNIT_MANIFESTS)) {
+    const inlineComputed = new Set<string>(
+      ((manifest.artifacts as { computed?: readonly string[] }).computed ?? []),
+    );
+    const clashes = ((manifest as { prepend?: readonly string[] }).prepend ?? [])
+      .filter(id => inlineComputed.has(id));
+    assert.deepEqual(
+      clashes,
+      [],
+      `manifest "${unitType}" places computed id(s) in both prepend and inline-computed: ${clashes.join(", ")}. Pick one position.`,
+    );
+  }
+});
+
+// ─── Tools-policy invariants (#4934) ─────────────────────────────────────
+
+test("#4934: every manifest declares a tools policy", () => {
+  for (const [unitType, manifest] of Object.entries(UNIT_MANIFESTS)) {
+    const policy = (manifest as { tools?: { mode?: string } }).tools;
+    assert.ok(
+      policy && typeof policy.mode === "string",
+      `manifest "${unitType}" is missing a tools policy — required to fail loud rather than default to "all" silently`,
+    );
+  }
+});
+
+test("#4934: tools.mode is one of the four declared policies", () => {
+  const validModes = new Set(["all", "read-only", "planning", "docs"]);
+  for (const [unitType, manifest] of Object.entries(UNIT_MANIFESTS)) {
+    const mode = (manifest as { tools: { mode: string } }).tools.mode;
+    assert.ok(
+      validModes.has(mode),
+      `manifest "${unitType}" has invalid tools.mode "${mode}" — must be one of ${[...validModes].join(", ")}`,
+    );
+  }
+});
+
+test('#4934: only execute-task and reactive-execute may use tools.mode "all" (full source-tree write access)', () => {
+  const allowedAllUnits = new Set(["execute-task", "reactive-execute"]);
+  for (const [unitType, manifest] of Object.entries(UNIT_MANIFESTS)) {
+    const mode = (manifest as { tools: { mode: string } }).tools.mode;
+    if (mode === "all") {
+      assert.ok(
+        allowedAllUnits.has(unitType),
+        `manifest "${unitType}" declares tools.mode = "all" but is not on the execute-track. ` +
+        'Only execute-task and reactive-execute should have full source write access; ' +
+        'planning/discuss/research units must use "planning" (or "docs" for rewrite-docs).',
+      );
+    }
+  }
+});
+
+test('#4934: tools.mode "docs" requires a non-empty allowedPathGlobs array', () => {
+  for (const [unitType, manifest] of Object.entries(UNIT_MANIFESTS)) {
+    const tools = (manifest as { tools: { mode: string; allowedPathGlobs?: readonly string[] } }).tools;
+    if (tools.mode !== "docs") continue;
+    assert.ok(
+      Array.isArray(tools.allowedPathGlobs) && tools.allowedPathGlobs.length > 0,
+      `manifest "${unitType}" has docs policy but no allowedPathGlobs — explicit allow-set is required so the enforcement layer doesn't fall back to a hardcoded default`,
+    );
+    for (const g of tools.allowedPathGlobs!) {
+      assert.ok(
+        typeof g === "string" && g.length > 0,
+        `manifest "${unitType}" has empty/invalid allowedPathGlobs entry: ${JSON.stringify(g)}`,
+      );
+    }
+  }
+});
+
+// ─── Budget floor: run-uat + gate-evaluate hit the smallest budget tier ──
+
+test("#4782 phase 2: run-uat and gate-evaluate use the smallest budget tier", () => {
+  const uatBudget = UNIT_MANIFESTS["run-uat"].maxSystemPromptChars;
+  const gateBudget = UNIT_MANIFESTS["gate-evaluate"].maxSystemPromptChars;
+  assert.strictEqual(uatBudget, gateBudget, "run-uat and gate-evaluate both use COMMON_BUDGET_SMALL");
+  // They should be the tightest (or tied for tightest) across all manifests
+  for (const [unitType, other] of Object.entries(UNIT_MANIFESTS)) {
+    assert.ok(
+      uatBudget <= other.maxSystemPromptChars,
+      `run-uat budget (${uatBudget}) should be ≤ ${unitType} budget (${other.maxSystemPromptChars})`,
+    );
+  }
+});

package/src/resources/extensions/gsd/tests/uok-contracts.test.ts

@@ -3,12 +3,16 @@ import assert from "node:assert/strict";
 
 import type {
   AuditEventEnvelope,
+  UokDispatchEnvelope,
   GateResult,
   TurnContract,
   TurnResult,
   UokNodeKind,
+  WriteRecord,
+  WriterToken,
 } from "../uok/contracts.ts";
 import { buildAuditEnvelope } from "../uok/audit.ts";
+import { buildDispatchEnvelope, explainDispatch } from "../uok/dispatch-envelope.ts";
 
 test("uok contracts serialize/deserialize turn envelopes", () => {
   const contract: TurnContract = {
@@ -84,3 +88,50 @@ test("uok audit envelope includes trace/turn/causality fields", () => {
   assert.equal(event.causedBy, "turn-start");
   assert.equal(event.payload.status, "completed");
 });
+
+test("uok dispatch envelope carries scheduler reason and constraints", () => {
+  const envelope: UokDispatchEnvelope = buildDispatchEnvelope({
+    action: "dispatch",
+    node: {
+      kind: "unit",
+      dependsOn: ["plan-gate"],
+      reads: ["M001-ROADMAP.md"],
+      writes: ["M001/S01/T01-SUMMARY.md"],
+    },
+    unitType: "execute-task",
+    unitId: "M001/S01/T01",
+    prompt: "do work",
+    reasonCode: "dependency",
+    summary: "all dependencies are closed and output path is available",
+    evidence: { readyTaskCount: 1 },
+  });
+
+  assert.equal(envelope.nodeKind, "unit");
+  assert.equal(envelope.reason.reasonCode, "dependency");
+  assert.deepEqual(envelope.constraints?.dependsOn, ["plan-gate"]);
+  assert.ok(explainDispatch(envelope).includes("execute-task M001/S01/T01"));
+});
+
+test("uok writer records serialize sequence metadata", () => {
+  const token: WriterToken = {
+    tokenId: "token-1",
+    traceId: "trace-1",
+    turnId: "turn-1",
+    acquiredAt: new Date().toISOString(),
+    owner: "uok",
+  };
+
+  const record: WriteRecord = {
+    writerToken: token,
+    sequence: { traceId: token.traceId, turnId: token.turnId, sequence: 7 },
+    category: "audit",
+    operation: "append",
+    path: ".gsd/audit/events.jsonl",
+    ts: new Date().toISOString(),
+  };
+
+  const roundTrip = JSON.parse(JSON.stringify(record)) as WriteRecord;
+  assert.equal(roundTrip.writerToken.tokenId, "token-1");
+  assert.equal(roundTrip.sequence.sequence, 7);
+  assert.equal(roundTrip.category, "audit");
+});

package/src/resources/extensions/gsd/tests/uok-execution-graph.test.ts

@@ -5,6 +5,7 @@ import {
   selectConflictFreeBatch,
   selectReactiveDispatchBatch,
   buildSidecarQueueNodes,
+  buildExecutionGraphSnapshot,
   scheduleSidecarQueue,
 } from "../uok/execution-graph.ts";
 
@@ -67,3 +68,18 @@ test("uok execution graph sidecar scheduler preserves deterministic queue order"
     queue.map((item) => item.unitId),
   );
 });
+
+test("uok execution graph snapshot captures deterministic order and conflicts", () => {
+  const snapshot = buildExecutionGraphSnapshot(
+    [
+      { id: "b", kind: "unit", dependsOn: ["a"], writes: ["src/shared.ts"] },
+      { id: "a", kind: "unit", dependsOn: [], writes: ["src/a.ts"] },
+      { id: "c", kind: "verification", dependsOn: [], writes: ["src/shared.ts"] },
+    ],
+    "before-unit",
+  );
+
+  assert.equal(snapshot.phase, "before-unit");
+  assert.deepEqual(snapshot.order, ["a", "b", "c"]);
+  assert.ok(snapshot.conflicts.some((c) => c.file === "src/shared.ts"));
+});

package/src/resources/extensions/gsd/tests/uok-gate-runner.test.ts

@@ -68,3 +68,78 @@ test("uok gate runner returns manual-attention for unknown gate id", async () =>
   assert.equal(result.outcome, "manual-attention");
   assert.equal(result.failureClass, "unknown");
 });
+
+// Regression tests for #4950
+
+test("uok gate runner: gate.execute throws — outcome is fail, audit emitted, DB row written, no exception escapes", async () => {
+  const runner = new UokGateRunner();
+
+  runner.register({
+    id: "throwing-gate",
+    type: "verification",
+    execute: async () => {
+      throw new Error("unexpected runtime failure");
+    },
+  });
+
+  let threw = false;
+  let result;
+  try {
+    result = await runner.run("throwing-gate", {
+      basePath: process.cwd(),
+      traceId: "trace-throw",
+      turnId: "turn-throw",
+    });
+  } catch {
+    threw = true;
+  }
+
+  assert.equal(threw, false, "run() must not throw when gate.execute throws");
+  assert.equal(result?.outcome, "fail");
+  assert.equal(result?.failureClass, "unknown");
+  assert.equal(result?.rationale, "unexpected runtime failure");
+
+  const adapter = _getAdapter();
+  const rows = adapter?.prepare("SELECT gate_id, outcome, failure_class FROM gate_runs WHERE gate_id = 'throwing-gate'").all() ?? [];
+  assert.ok(rows.length >= 1, "at least one DB row must be written for a thrown gate");
+  assert.equal(rows[0]?.["outcome"], "fail");
+});
+
+test("uok gate runner: unknown gate id emits audit + DB row with manual-attention", async () => {
+  const runner = new UokGateRunner();
+
+  await runner.run("ghost-gate", {
+    basePath: process.cwd(),
+    traceId: "trace-ghost",
+    turnId: "turn-ghost",
+  });
+
+  const adapter = _getAdapter();
+  const rows = adapter?.prepare("SELECT gate_id, outcome, failure_class FROM gate_runs WHERE gate_id = 'ghost-gate'").all() ?? [];
+  assert.equal(rows.length, 1, "unknown gate must write exactly one DB row");
+  assert.equal(rows[0]?.["outcome"], "manual-attention");
+});
+
+test("uok gate runner: maxAttempts reported equals retryBudget + 1", async () => {
+  const runner = new UokGateRunner();
+
+  // timeout has retryBudget=2, so maxAttempts should be 3
+  runner.register({
+    id: "budget-gate",
+    type: "verification",
+    execute: async () => ({
+      outcome: "fail",
+      failureClass: "timeout",
+      rationale: "always fails",
+    }),
+  });
+
+  const result = await runner.run("budget-gate", {
+    basePath: process.cwd(),
+    traceId: "trace-budget",
+    turnId: "turn-budget",
+  });
+
+  // retryBudget for "timeout" is 2, so maxAttempts must be 3
+  assert.equal(result.maxAttempts, 3, "maxAttempts must equal retryBudget + 1");
+});

package/src/resources/extensions/gsd/tests/uok-gitops-wiring.test.ts

@@ -1,35 +1,58 @@
+/**
+ * UOK gitops wiring — post-unit pre-verification policy.
+ *
+ * Tests the pure policy bit that selects the turn-level git action from
+ * resolved UOK flags. The integration wiring (postUnitPreVerification
+ * calling runTurnGitAction, writeTurnGitTransaction, the UokGateRunner
+ * closeout pathway, and buildSnapshotOpts' trace/turn ID plumbing) is
+ * exercised end-to-end by the auto-loop and UOK kernel integration tests;
+ * the earlier source-grep assertions duplicated that coverage without
+ * actually exercising the code, and have been removed.
+ */
+
 import test from "node:test";
 import assert from "node:assert/strict";
-import { readFileSync } from "node:fs";
-import { join, dirname } from "node:path";
-import { fileURLToPath } from "node:url";
 
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const gsdDir = join(__dirname, "..");
+import { resolveUokFlags } from "../uok/flags.ts";
+
+test("turn action defaults to commit when uok.gitops is enabled with no override", () => {
+  const flags = resolveUokFlags({ uok: { gitops: { enabled: true } } } as any);
+  assert.equal(flags.gitops, true);
+  assert.equal(flags.gitopsTurnAction, "commit");
+});
+
+test("turn action reflects uok.gitops.turn_action when set to snapshot", () => {
+  const flags = resolveUokFlags({
+    uok: { gitops: { enabled: true, turn_action: "snapshot" } },
+  } as any);
+  assert.equal(flags.gitops, true);
+  assert.equal(flags.gitopsTurnAction, "snapshot");
+});
 
-test("post-unit pre-verification selects turn git action from UOK gitops flags", () => {
-  const source = readFileSync(join(gsdDir, "auto-post-unit.ts"), "utf-8");
-  assert.ok(
-    source.includes("const turnAction: TurnGitActionMode = uokFlags.gitops ? uokFlags.gitopsTurnAction : \"commit\""),
-    "postUnitPreVerification should derive turn action from uok.gitops.turn_action when enabled",
-  );
+test("turn action reflects uok.gitops.turn_action when set to status-only", () => {
+  const flags = resolveUokFlags({
+    uok: { gitops: { enabled: true, turn_action: "status-only" } },
+  } as any);
+  assert.equal(flags.gitops, true);
+  assert.equal(flags.gitopsTurnAction, "status-only");
 });
 
-test("post-unit pre-verification routes git failures through closeout gate", () => {
-  const source = readFileSync(join(gsdDir, "auto-post-unit.ts"), "utf-8");
-  assert.ok(
-    source.includes('id: "closeout-git-action"') &&
-    source.includes('type: "closeout"') &&
-    source.includes('failureClass: "git"'),
-    "git failures should be persisted via a closeout gate with failureClass=git",
-  );
+test("turn_push flag round-trips through resolveUokFlags", () => {
+  const on = resolveUokFlags({
+    uok: { gitops: { enabled: true, turn_push: true } },
+  } as any);
+  const off = resolveUokFlags({
+    uok: { gitops: { enabled: true, turn_push: false } },
+  } as any);
+  assert.equal(on.gitopsTurnPush, true);
+  assert.equal(off.gitopsTurnPush, false);
 });
 
-test("auto snapshot opts carry trace/turn IDs for turn closeout records", () => {
-  const source = readFileSync(join(gsdDir, "auto.ts"), "utf-8");
-  assert.ok(
-    source.includes("traceId: s.currentTraceId ?? undefined") &&
-    source.includes("turnId: s.currentTurnId ?? undefined"),
-    "buildSnapshotOpts should pass trace/turn IDs into closeout options",
-  );
+test("gitops disabled when uok.gitops.enabled is explicitly false", () => {
+  const flags = resolveUokFlags({
+    uok: { gitops: { enabled: false, turn_action: "snapshot" } },
+  } as any);
+  assert.equal(flags.gitops, false);
+  // Turn_action is still surfaced so callers can read their policy cleanly.
+  assert.equal(flags.gitopsTurnAction, "snapshot");
 });

package/src/resources/extensions/gsd/tests/uok-loop-adapter-writer.test.ts

@@ -0,0 +1,65 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { createTurnObserver } from "../uok/loop-adapter.ts";
+import { hasActiveWriterToken, resetWriterTokensForTests } from "../uok/writer.ts";
+
+function readAuditPayloads(basePath: string): Array<Record<string, unknown>> {
+  const path = join(basePath, ".gsd", "audit", "events.jsonl");
+  if (!existsSync(path)) return [];
+  return readFileSync(path, "utf-8")
+    .split("\n")
+    .filter(Boolean)
+    .map((line) => JSON.parse(line) as { payload?: Record<string, unknown> })
+    .map((event) => event.payload ?? {});
+}
+
+test("uok turn observer adds writer sequence metadata to audit events", (t) => {
+  const basePath = mkdtempSync(join(tmpdir(), "gsd-uok-loop-writer-"));
+  resetWriterTokensForTests();
+  t.after(() => {
+    resetWriterTokensForTests();
+    rmSync(basePath, { recursive: true, force: true });
+  });
+
+  const observer = createTurnObserver({
+    basePath,
+    gitAction: "status-only",
+    gitPush: false,
+    enableAudit: true,
+    enableGitops: false,
+  });
+
+  observer.onTurnStart({
+    basePath,
+    traceId: "trace-1",
+    turnId: "turn-1",
+    iteration: 1,
+    unitType: "execute-task",
+    unitId: "M001/S01/T01",
+    startedAt: new Date().toISOString(),
+  });
+  assert.equal(hasActiveWriterToken(basePath, "turn-1"), true);
+
+  observer.onTurnResult({
+    traceId: "trace-1",
+    turnId: "turn-1",
+    iteration: 1,
+    unitType: "execute-task",
+    unitId: "M001/S01/T01",
+    status: "completed",
+    failureClass: "none",
+    phaseResults: [],
+    startedAt: new Date().toISOString(),
+    finishedAt: new Date().toISOString(),
+  });
+
+  assert.equal(hasActiveWriterToken(basePath, "turn-1"), false);
+  const payloads = readAuditPayloads(basePath);
+  assert.equal(payloads[0]?.writeSequence, 1);
+  assert.equal(payloads[1]?.writeSequence, 2);
+  assert.equal(typeof payloads[0]?.writerTokenId, "string");
+});

package/src/resources/extensions/gsd/tests/uok-parity-report.test.ts

@@ -0,0 +1,42 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, readFileSync, rmSync, appendFileSync, mkdirSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { buildParityReport, parseParityEvents, writeParityReport } from "../uok/parity-report.ts";
+
+test("uok parity report summarizes paths, statuses, and fallback use", () => {
+  const events = parseParityEvents([
+    JSON.stringify({ path: "uok-kernel", phase: "enter" }),
+    JSON.stringify({ path: "uok-kernel", phase: "exit", status: "ok" }),
+    JSON.stringify({ path: "legacy-fallback", phase: "enter" }),
+    JSON.stringify({ path: "legacy-fallback", phase: "exit", status: "error", error: "boom" }),
+  ].join("\n"));
+
+  const report = buildParityReport(events, "/tmp/uok-parity.jsonl");
+  assert.equal(report.totalEvents, 4);
+  assert.equal(report.paths["uok-kernel"], 2);
+  assert.equal(report.fallbackInvocations, 2);
+  assert.deepEqual(report.criticalMismatches, ["boom"]);
+});
+
+test("uok parity report writes runtime report artifact", (t) => {
+  const basePath = mkdtempSync(join(tmpdir(), "gsd-uok-parity-"));
+  t.after(() => {
+    rmSync(basePath, { recursive: true, force: true });
+  });
+
+  const runtime = join(basePath, ".gsd", "runtime");
+  mkdirSync(runtime, { recursive: true });
+  appendFileSync(
+    join(runtime, "uok-parity.jsonl"),
+    `${JSON.stringify({ path: "uok-kernel", phase: "exit", status: "ok" })}\n`,
+    "utf-8",
+  );
+
+  const report = writeParityReport(basePath);
+  assert.equal(report.totalEvents, 1);
+  const saved = JSON.parse(readFileSync(join(runtime, "uok-parity-report.json"), "utf-8"));
+  assert.equal(saved.statuses.ok, 1);
+});