mandrel 2.25.0 → 2.26.0

package/.agents/scripts/check-cyclomatic.js

@@ -0,0 +1,214 @@
+/**
+ * CLI: ratchet on cyclomatic complexity against
+ * `delivery.quality.codingGuardrails.cyclomaticMustFix` (Story #4923).
+ *
+ * The must-fix ceiling was documented as blocking (`code-quality-guardrails.md`
+ * promises "the close-validation chain refuses the merge") while being read by
+ * nothing. This is the consumer that makes the promise true. It joins the
+ * standalone-ratchet family — `check-arch-cycles.js`, `check-dead-exports.js`,
+ * `check-context-budget.js` — which the CI `baselines` job runs as a required
+ * check, and it follows their contract exactly:
+ *
+ *   - Reads the committed breach baseline at `baselines/cyclomatic.json`
+ *     (override with `--baseline <path>`).
+ *   - Walks the maintainability gate's `targetDirs` / `ignoreGlobs` and scores
+ *     every function with the in-repo escomplex kernel — no coverage artifact
+ *     required, so the verdict is available on a cold checkout.
+ *   - Exit 0 when clean, improved, or shrinking; exit 1 when a file gains an
+ *     over-ceiling function or its worst function gets worse.
+ *
+ * `--update` rewrites the baseline from the current tree. That is the
+ * sanctioned motion after a deliberate refactor lands, and the only way the
+ * recorded breach count is allowed to rise.
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import { runAsCli } from './lib/cli-utils.js';
+import { getQuality, resolveConfig } from './lib/config-resolver.js';
+import {
+  buildCyclomaticEnvelope,
+  DEFAULT_CYCLOMATIC_BASELINE,
+  diffCyclomaticRows,
+  renderCyclomaticDiff,
+  resolveCyclomaticPolicy,
+  scanCyclomatic,
+} from './lib/cyclomatic-ceiling.js';
+
+/**
+ * Parse `--baseline <path>`, `--json`, and `--update`.
+ *
+ * @param {string[]} argv
+ * @returns {{ baselinePath: string | null, json: boolean, update: boolean }}
+ */
+function parseArgv(argv = []) {
+  let baselinePath = null;
+  let json = false;
+  let update = false;
+  for (let i = 0; i < argv.length; i += 1) {
+    const a = argv[i];
+    if (a === '--baseline') {
+      const next = argv[i + 1];
+      if (next && !next.startsWith('--')) {
+        baselinePath = next;
+        i += 1;
+      }
+    } else if (a === '--json') {
+      json = true;
+    } else if (a === '--update') {
+      update = true;
+    }
+  }
+  return { baselinePath, json, update };
+}
+
+/**
+ * Read a breach baseline envelope from disk. Returns `null` when the file is
+ * missing or unparseable — the caller treats that as an empty baseline, which
+ * makes the very first run report every existing breach as `added` rather than
+ * silently passing.
+ *
+ * @param {string} baselinePath
+ * @returns {{ ceiling?: number, rows?: Array<object> } | null}
+ */
+function loadCyclomaticBaseline(baselinePath) {
+  try {
+    if (!fs.existsSync(baselinePath)) return null;
+    const parsed = JSON.parse(fs.readFileSync(baselinePath, 'utf-8'));
+    return parsed && typeof parsed === 'object' ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Top-level CLI entry. Exported so tests can drive the whole pipeline through
+ * the injected seams below without spawning a process.
+ *
+ * @param {{
+ *   argv?: string[],
+ *   cwd?: string,
+ *   stdout?: { write: (s: string) => void },
+ *   stderr?: { write: (s: string) => void },
+ *   resolveConfigImpl?: typeof resolveConfig,
+ *   scanImpl?: typeof scanCyclomatic,
+ *   loadBaselineImpl?: typeof loadCyclomaticBaseline,
+ *   writeFileImpl?: (p: string, data: string) => void,
+ * }} [opts]
+ * @returns {Promise<number>} 0 = clean / improved; 1 = ratchet breached
+ */
+export async function runCli({
+  argv = process.argv.slice(2),
+  cwd = process.cwd(),
+  stdout = process.stdout,
+  stderr = process.stderr,
+  resolveConfigImpl = resolveConfig,
+  scanImpl = scanCyclomatic,
+  loadBaselineImpl = loadCyclomaticBaseline,
+  writeFileImpl = (p, data) => fs.writeFileSync(p, data),
+} = {}) {
+  const { baselinePath, json, update } = parseArgv(argv);
+  const quality = getQuality(resolveConfigImpl({ cwd }));
+  const policy = resolveCyclomaticPolicy(quality);
+  const resolvedBaselinePath = path.resolve(
+    cwd,
+    baselinePath ?? DEFAULT_CYCLOMATIC_BASELINE,
+  );
+
+  const scan = scanImpl({
+    targetDirs: policy.targetDirs,
+    ignoreGlobs: policy.ignoreGlobs,
+    ceiling: policy.mustFix,
+    cwd,
+  });
+
+  if (update) {
+    const envelope = buildCyclomaticEnvelope({
+      rows: scan.rows,
+      ceiling: policy.mustFix,
+    });
+    writeFileImpl(
+      resolvedBaselinePath,
+      `${JSON.stringify(envelope, null, 2)}\n`,
+    );
+    stdout.write(
+      `[cyclomatic] wrote ${scan.rows.length} breach row(s) at ceiling c=${policy.mustFix} to ${resolvedBaselinePath}\n`,
+    );
+    return 0;
+  }
+
+  const baseline = loadBaselineImpl(resolvedBaselinePath);
+  const baselineRows = Array.isArray(baseline?.rows) ? baseline.rows : [];
+  const diff = diffCyclomaticRows(baselineRows, scan.rows);
+  const exitCode = diff.added.length + diff.worsened.length > 0 ? 1 : 0;
+
+  if (json) {
+    stdout.write(
+      `${JSON.stringify(
+        {
+          kind: 'cyclomatic-report',
+          ceiling: policy.mustFix,
+          flag: policy.flag,
+          baselinePath: resolvedBaselinePath,
+          baselineCeiling: baseline?.ceiling ?? null,
+          scannedFiles: scan.scannedFiles,
+          parseErrors: scan.parseErrors,
+          baselineRows,
+          currentRows: scan.rows,
+          ...diff,
+          exitCode,
+        },
+        null,
+        2,
+      )}\n`,
+    );
+    return exitCode;
+  }
+
+  if (!baseline) {
+    stderr.write(
+      `[cyclomatic] ⚠ baseline not found at ${resolvedBaselinePath} — treating as empty\n`,
+    );
+  } else if (
+    typeof baseline.ceiling === 'number' &&
+    baseline.ceiling !== policy.mustFix
+  ) {
+    stderr.write(
+      `[cyclomatic] ⚠ baseline was recorded at ceiling c=${baseline.ceiling} but the configured cyclomaticMustFix is c=${policy.mustFix} — re-run with --update\n`,
+    );
+  }
+  stdout.write('\n--- cyclomatic preview ---\n');
+  stdout.write(`${renderCyclomaticDiff(diff, policy.mustFix)}\n`);
+  return exitCode;
+}
+
+async function main() {
+  return runCli();
+}
+
+runAsCli(import.meta.url, main, {
+  source: 'cyclomatic',
+  propagateExitCode: true,
+  errorPrefix: '[cyclomatic] ❌ Fatal error',
+  usage: {
+    invocation:
+      'node .agents/scripts/check-cyclomatic.js [--baseline <path>] [--update] [--json]',
+    summary:
+      'Ratchet on cyclomatic complexity: fail when a file gains a function above `delivery.quality.codingGuardrails.cyclomaticMustFix`, or when its worst function gets worse than the recorded baseline.',
+    flags: [
+      [
+        '--baseline <path>',
+        'Baseline file (default: baselines/cyclomatic.json).',
+      ],
+      [
+        '--update',
+        'Rewrite the baseline from the current tree (the post-refactor motion).',
+      ],
+      ['--json', 'Emit the comparison envelope as JSON.'],
+    ],
+    notes: [
+      'Exit codes:\n  0  clean, improved, or shrinking\n  1  a new or worsened over-ceiling function',
+    ],
+  },
+});

package/.agents/scripts/check-schema-references.js

@@ -0,0 +1,392 @@
+#!/usr/bin/env node
+
+/**
+ * CLI: report every JSON Schema under `.agents/schemas/` that no code path
+ * compiles.
+ *
+ * A well-formed schema sitting in a schema directory reads as an enforced
+ * contract to every human reader and every audit lens — existence plus valid
+ * syntax is taken for authority. When nothing actually compiles it, that
+ * reading is wrong in the most expensive direction: the reader believes a
+ * shape the runtime rejects. `friction-event.schema.json` sat unreferenced
+ * from the Epic #4406 envelope cutover until Story #4938; in between, an
+ * `/audit-documentation` lens graded a High finding against it as the live
+ * contract, the finding became an acceptance criterion, and the delivering
+ * worker had to overrule that criterion to avoid writing a payload the
+ * enforced validator drops. Two verification layers accepted the file
+ * because it existed and parsed. Only reading the code caught it.
+ *
+ * This gate is that code read, run every time instead of once by accident.
+ *
+ * ## What counts as a compiling reference
+ *
+ * Resolution is evidence-ranked; the first kind that hits wins, and the
+ * report names both the kind and the file that supplied the evidence, so a
+ * pass is auditable rather than merely green.
+ *
+ *   1. `literal`     — the schema's basename appears in a JS source. This is
+ *                      the ordinary idiom (`signal-validator.js` resolves
+ *                      `signal-event.schema.json` by literal path).
+ *   2. `schema-ref`  — another schema `$ref`s this file by name, and that
+ *                      schema is itself referenced. A `$ref` is a compile
+ *                      edge: AJV pulls the target in when the parent
+ *                      compiles.
+ *   3. `dynamic`     — the schema lives in a SUBDIRECTORY of the schema root
+ *                      that some JS source loads by computed path (a
+ *                      `` `${key}.schema.json` `` template), AND the
+ *                      schema's stem appears literally in a JS source as the
+ *                      key that would produce it. `lifecycle/` is loaded this
+ *                      way by `lib/orchestration/lifecycle/bus.js`, and
+ *                      `baselines/` by `lib/baselines/envelope.js`.
+ *
+ *                      BOTH halves are required. The directory evidence alone
+ *                      would bless every future file dropped into a
+ *                      dynamically-enumerated directory — the same blindness
+ *                      this gate exists to remove. Dynamic resolution is not
+ *                      offered for schemas sitting at the schema root: every
+ *                      root schema today is compiled by an explicit literal
+ *                      path, so a root-level stem match would be coincidence,
+ *                      not evidence.
+ *
+ * Anything left over is a finding — unless the schema says otherwise in its
+ * own body (see below). A finding is not an accusation of deadness; it is a
+ * demand that the file state which one it is.
+ *
+ * ## Recording a deliberate exemption
+ *
+ * A schema deliberately kept without a compiler declares it IN THE FILE, at
+ * the document root:
+ *
+ * ```json
+ * "x-mandrel-uncompiled": {
+ *   "reason": "Documented SSOT; AJV is deliberately not in this path.",
+ *   "runtimeGate": "lib/orchestration/foo.js#validateFooPayload"
+ * }
+ * ```
+ *
+ * In-file, never a side-car allowlist. The failure this gate answers was a
+ * reader trusting the schema document; the correction has to be legible to
+ * that same reader, in that same document. An allowlist elsewhere in the repo
+ * would leave the file itself still lying.
+ *
+ * Story #4938 left the tree with exactly one: `friction-event.schema.json` was
+ * deleted outright (its shape preserved field-for-field in
+ * `docs/archive/data-dictionary-2026-08.md`), and
+ * `model-attribution.schema.json` — a documented SSOT with a hand-rolled
+ * validator behind it — declared the marker.
+ *
+ * The gate answers "is anything compiling this?", not "is what compiles it
+ * faithful to it?". A schema whose hand-rolled mirror has silently drifted
+ * still passes here.
+ *
+ * Flags:
+ *   --root <path>  scan a different repository root (default: cwd)
+ *   --json         emit the structured envelope as single-line JSON
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import { runAsCli } from './lib/cli-utils.js';
+
+/** Schema root, relative to the repository root. */
+const SCHEMA_ROOT = path.join('.agents', 'schemas');
+
+/** Directories never worth walking for JS sources. */
+const SKIP_DIRS = new Set([
+  '.git',
+  '.worktrees',
+  'node_modules',
+  'coverage',
+  'temp',
+]);
+
+/** Source extensions that can compile a schema. */
+const JS_EXTENSIONS = new Set(['.js', '.mjs', '.cjs']);
+
+/** Root keyword a schema uses to declare a deliberate exemption. */
+const EXEMPTION_KEY = 'x-mandrel-uncompiled';
+
+/**
+ * A computed schema path — `` `${something}.schema.json` `` — anywhere in a
+ * source file. Evidence that the file loads schemas by runtime key rather
+ * than by literal name.
+ */
+const COMPUTED_PATH_RE = /\$\{[^}]*\}\.schema\.json/;
+
+/** Block comments, including the JSDoc prose every module here opens with. */
+const BLOCK_COMMENT_RE = /\/\*[\s\S]*?\*\//g;
+
+/**
+ * Line comments. Anchored to start-of-line or whitespace so a `//` inside a
+ * URL (`http://…`) is left alone — truncating that line could delete a real
+ * reference sitting after it.
+ */
+const LINE_COMMENT_RE = /(^|\s)\/\/[^\n]*/g;
+
+/**
+ * Strip comments from a source before matching.
+ *
+ * Prose is not a compile. This module's own header names
+ * `friction-event.schema.json` a dozen times while compiling nothing, and
+ * every schema-loading module documents the path it loads directly above the
+ * line that loads it — matching raw text would let a gate certify itself and
+ * would count a docblock as enforcement, which is precisely the confusion
+ * Story #4938 exists to end.
+ *
+ * @param {string} text raw source
+ * @returns {string} source with comment bodies removed
+ */
+function stripComments(text) {
+  return text.replace(BLOCK_COMMENT_RE, ' ').replace(LINE_COMMENT_RE, '$1');
+}
+
+/**
+ * Parse argv. Exported so a unit test can pin the parser without spawning.
+ *
+ * @param {string[]} argv
+ * @returns {{ root: string, json: boolean }}
+ */
+export function parseArgv(argv = []) {
+  const out = { root: process.cwd(), json: false };
+  for (let i = 0; i < argv.length; i += 1) {
+    if (argv[i] === '--json') out.json = true;
+    else if (argv[i] === '--root' && argv[i + 1]) {
+      out.root = path.resolve(argv[i + 1]);
+      i += 1;
+    }
+  }
+  return out;
+}
+
+/**
+ * Recursively collect files under `dir` whose extension is in `extensions`.
+ *
+ * @param {string} dir absolute directory to walk
+ * @param {Set<string>} extensions lowercase extensions including the dot
+ * @param {string[]} [acc]
+ * @returns {string[]} absolute file paths
+ */
+function walk(dir, extensions, acc = []) {
+  let entries;
+  try {
+    entries = fs.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return acc;
+  }
+  for (const entry of entries) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (!SKIP_DIRS.has(entry.name)) walk(full, extensions, acc);
+    } else if (extensions.has(path.extname(entry.name).toLowerCase())) {
+      acc.push(full);
+    }
+  }
+  return acc;
+}
+
+/**
+ * Read every JS source in the repository once.
+ *
+ * @param {string} root absolute repository root
+ * @returns {Array<{ rel: string, text: string }>}
+ */
+function readSources(root) {
+  return walk(root, JS_EXTENSIONS).map((file) => ({
+    rel: path.relative(root, file),
+    text: stripComments(fs.readFileSync(file, 'utf8')),
+  }));
+}
+
+/**
+ * Describe every `*.schema.json` under the schema root.
+ *
+ * @param {string} root absolute repository root
+ * @returns {Array<{ rel: string, basename: string, stem: string, dir: string, doc: object|null }>}
+ */
+function readSchemas(root) {
+  const schemaRoot = path.join(root, SCHEMA_ROOT);
+  return walk(schemaRoot, new Set(['.json']))
+    .filter((file) => file.endsWith('.schema.json'))
+    .map((file) => {
+      const basename = path.basename(file);
+      let doc = null;
+      try {
+        doc = JSON.parse(fs.readFileSync(file, 'utf8'));
+      } catch {
+        doc = null;
+      }
+      return {
+        rel: path.relative(root, file),
+        basename,
+        stem: basename.slice(0, -'.schema.json'.length),
+        dir: path.relative(schemaRoot, path.dirname(file)),
+        doc,
+      };
+    })
+    .sort((a, b) => a.rel.localeCompare(b.rel));
+}
+
+/**
+ * Find the first source whose text contains `needle`.
+ *
+ * @param {Array<{ rel: string, text: string }>} sources
+ * @param {string} needle
+ * @returns {string | null} the relative path of the witness, or null
+ */
+function witness(sources, needle) {
+  const hit = sources.find((source) => source.text.includes(needle));
+  return hit ? hit.rel : null;
+}
+
+/**
+ * Find a source that loads schemas from `dir` by computed path.
+ *
+ * The file must both build a runtime-keyed schema path and name the
+ * directory — as a quoted `path.join` segment or as a `schemas/<dir>` path
+ * fragment.
+ *
+ * @param {Array<{ rel: string, text: string }>} sources
+ * @param {string} dir directory name relative to the schema root
+ * @returns {string | null}
+ */
+function dynamicLoaderFor(sources, dir) {
+  if (!dir) return null;
+  const hit = sources.find(
+    (source) =>
+      COMPUTED_PATH_RE.test(source.text) &&
+      (source.text.includes(`'${dir}'`) ||
+        source.text.includes(`"${dir}"`) ||
+        source.text.includes(`schemas/${dir}`)),
+  );
+  return hit ? hit.rel : null;
+}
+
+/**
+ * Read a schema's in-file exemption declaration.
+ *
+ * A bare string is accepted as the reason; the object form additionally
+ * carries `runtimeGate`, the `file.js#functionName` actually enforcing the
+ * shape at runtime. That field is what makes an exemption reviewable: a
+ * schema kept as a documented SSOT with a hand-rolled validator behind it is
+ * a different animal from one kept purely for provenance, and the report
+ * should not flatten the two.
+ *
+ * @param {object|null} doc parsed schema document
+ * @returns {{ reason: string, runtimeGate: string | null } | null}
+ */
+function exemption(doc) {
+  const block = doc?.[EXEMPTION_KEY];
+  const reason = typeof block === 'string' ? block : block?.reason;
+  if (typeof reason !== 'string' || !reason.trim()) return null;
+  const gate =
+    typeof block?.runtimeGate === 'string' ? block.runtimeGate : null;
+  return { reason: reason.trim(), runtimeGate: gate };
+}
+
+/**
+ * Resolve one schema to a reference kind plus the evidence for it.
+ *
+ * @param {object} schema a `readSchemas` record
+ * @param {Array<{ rel: string, text: string }>} sources
+ * @param {Array<{ rel: string, text: string }>} schemaTexts raw schema bodies
+ * @returns {{ kind: string, evidence: string | object | null }}
+ */
+function resolveSchema(schema, sources, schemaTexts) {
+  const literal = witness(sources, schema.basename);
+  if (literal) return { kind: 'literal', evidence: literal };
+
+  const ref = schemaTexts.find(
+    (other) =>
+      other.rel !== schema.rel &&
+      other.text.includes(`"$ref"`) &&
+      other.text.includes(schema.basename),
+  );
+  if (ref) return { kind: 'schema-ref', evidence: ref.rel };
+
+  const loader = dynamicLoaderFor(sources, schema.dir);
+  if (loader) {
+    const key = witness(sources, schema.stem);
+    if (key) return { kind: 'dynamic', evidence: `${loader} (key: ${key})` };
+  }
+
+  const declared = exemption(schema.doc);
+  if (declared) return { kind: 'exempt', evidence: declared };
+
+  return { kind: 'unreferenced', evidence: null };
+}
+
+/**
+ * Run the audit and return a structured envelope.
+ *
+ * @param {{ root?: string }} [opts]
+ * @returns {{ schemaCount: number, referenced: number, exempt: Array<object>, findings: Array<object> }}
+ */
+export function auditSchemaReferences(opts = {}) {
+  const root = opts.root ?? process.cwd();
+  const sources = readSources(root);
+  const schemas = readSchemas(root);
+  const schemaTexts = schemas.map((schema) => ({
+    rel: schema.rel,
+    text: fs.readFileSync(path.join(root, schema.rel), 'utf8'),
+  }));
+
+  const exempt = [];
+  const findings = [];
+  let referenced = 0;
+
+  for (const schema of schemas) {
+    const { kind, evidence } = resolveSchema(schema, sources, schemaTexts);
+    if (kind === 'unreferenced') findings.push({ schema: schema.rel });
+    else if (kind === 'exempt')
+      exempt.push({ schema: schema.rel, ...evidence });
+    else referenced += 1;
+  }
+
+  return { schemaCount: schemas.length, referenced, exempt, findings };
+}
+
+/**
+ * Render the human-readable report.
+ *
+ * @param {ReturnType<typeof auditSchemaReferences>} report
+ * @returns {string}
+ */
+function formatReport(report) {
+  const digest =
+    `[check-schema-references] ${report.schemaCount} schema(s): ` +
+    `${report.referenced} compiled, ${report.exempt.length} exempt, ` +
+    `${report.findings.length} unreferenced.`;
+  if (report.findings.length === 0) return digest;
+  const lines = report.findings.map(
+    (finding) => `  ✗ ${finding.schema} — no code path compiles it.`,
+  );
+  return [
+    digest,
+    ...lines,
+    '',
+    'Every schema under .agents/schemas/ must be compiled by code, or say in',
+    `its own body why not. Either delete it, wire it, or add a root-level`,
+    `"${EXEMPTION_KEY}": { "reason": "…" } declaring the retention.`,
+  ].join('\n');
+}
+
+/**
+ * CLI entry point.
+ *
+ * @param {string[]} [argv]
+ * @returns {Promise<number>} process exit code
+ */
+export async function main(argv = process.argv.slice(2)) {
+  const { root, json } = parseArgv(argv);
+  const report = auditSchemaReferences({ root });
+  process.stdout.write(
+    json ? `${JSON.stringify(report)}\n` : `${formatReport(report)}\n`,
+  );
+  return report.findings.length > 0 ? 1 : 0;
+}
+
+runAsCli(import.meta.url, main, {
+  source: 'check-schema-references',
+  propagateExitCode: true,
+});

package/.agents/scripts/check-test-temp-hygiene.js

@@ -656,5 +656,42 @@ runAsCli(
     const code = runHygiene(parseArgv(process.argv.slice(2)));
     return code;
   },
-  { source: 'check-test-temp-hygiene', propagateExitCode: true },
+  {
+    source: 'check-test-temp-hygiene',
+    propagateExitCode: true,
+    usage: {
+      invocation:
+        'node .agents/scripts/check-test-temp-hygiene.js [--snapshot | --assert | --clean] [--baseline <path>] [--lint-globs <globs>] [--ids <ids>] [--root <dir>]',
+      summary:
+        'Regression guard for test-fixture pollution of the temp trees: the repo temp/ telemetry streams every retro reads, and the OS temp root the suite scratch dirs nest under.',
+      flags: [
+        [
+          '--snapshot',
+          'Fingerprint every temp/ stream file and the pre-existing OS suite roots. Run BEFORE the suite.',
+        ],
+        [
+          '--assert',
+          'Re-scan and fail on any stream added or grown, or a surviving suite root. Run AFTER the suite. This is the default when no mode flag is passed.',
+        ],
+        [
+          '--clean',
+          'List stream directories whose Epic/Story id matches a known fixture id. Report-only — deletes nothing.',
+        ],
+        [
+          '--baseline <path>',
+          'Explicit snapshot path (CI sets a runner-temp path). Defaults to an OS scratch location keyed by the repo root; refused inside the protected temp/ tree.',
+        ],
+        [
+          '--lint-globs <globs>',
+          'Comma-separated repo-relative globs scanned for tests calling mkdtemp against os.tmpdir() instead of makeTempDir(). Off unless passed.',
+        ],
+        ['--ids <ids>', 'Comma-separated fixture ids for --clean.'],
+        ['--root <dir>', 'Repository root to scan (default: repo root).'],
+      ],
+      notes: [
+        '--assert requires a snapshot recorded by an earlier --snapshot run: a missing one is a hard failure, never a silent re-baseline.',
+        'Exit codes:\n  0  clean\n  1  a breach, or --assert with no snapshot to attest against',
+      ],
+    },
+  },
 );