nccgs 1.1.1 → 1.3.0

package/tests/gates.test.mjs

@@ -0,0 +1,170 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import test from "node:test";
+import { initialize, snapshot, record, check, close, taskPath } from "../.claude/nccgs/tools/gates.mjs";
+import { artifact, atomicJson, json, hash } from "../.claude/nccgs/tools/policy.mjs";
+import { run } from "../.claude/nccgs/tools/task.mjs";
+import { observe } from "../.claude/nccgs/tools/runtime.mjs";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+function fixture(options = {}) {
+  const project = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-gates-"));
+  const write = (name, value) => {
+    const file = path.join(project, name);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, typeof value === "string" ? value : JSON.stringify(value));
+    return artifact(project, name);
+  };
+  for (const file of ["pipeline.json", "studio.json"]) write(`.claude/nccgs/${file}`, fs.readFileSync(path.join(root, ".claude/nccgs", file), "utf8"));
+  const policy = write(".nccgs/project.yaml", "schema_version: 2\nmodels:\n  profile: astra-claude\n");
+  write(".nccgs/gates.json", { schemaVersion: 1, policySha256: policy.sha256, requiredChecks: ["regression"], requiredArtifacts: options.artifacts ?? [], manualGates: options.manual ?? [] });
+  write("Assets/game.cs", "// initial implementation\n");
+  write(".nccgs/plan.md", "Astra plan: preserve health invariant and verify regression.");
+  initialize(project, "feature", ".nccgs/plan.md");
+  let index = 0;
+  const snap = () => snapshot(project).sha256;
+  const task = () => json(taskPath(project, "feature"));
+  function runtime(stage, overrides = {}) {
+    const source = `.nccgs/evidence/raw-${++index}.json`;
+    write(source, { taskId: "feature", snapshot: snap(), sessionId: "session", agentId: stage,
+      observedModel: stage === "implementation" ? "claude-opus-5-5" : "claude-fable-5-1",
+      observedEffort: stage === "implementation" ? "xhigh" : "high", capturedAt: new Date().toISOString(),
+      status: "completed", provenance: { kind: "provider-log", reference: "test fixture: captured runtime request metadata" }, ...overrides });
+    return run(["observe", "--project", project, "--id", "feature", "--file", source]);
+  }
+  const impl = (overrides = {}) => record(project, "feature", "implementation", { snapshot: snap(), runtime: runtime("implementation"),
+    checks: [{ name: "regression", status: "PASS", evidence: write(`.nccgs/evidence/test-${++index}.log`, "fixture regression: PASS") }], ...overrides });
+  const review = (overrides = {}) => record(project, "feature", "review", { snapshot: snap(), runtime: runtime("review"), verdict: "PASS", criteriaMet: true, findings: [], evidence: write(`.nccgs/evidence/review-${++index}.md`, "Fixture independent review findings: none"), ...overrides });
+  const report = (overrides = {}) => record(project, "feature", "report", { snapshot: snap(), evidence: write(`.nccgs/evidence/report-${++index}.md`, "Fixture report, review reference and evidence"), ...overrides });
+  const approval = (stage, overrides = {}) => record(project, "feature", stage, { snapshot: snap(), evidence: write(`.nccgs/approvals/${stage}-${++index}.json`, {
+    actor: stage === "astra" ? "Astra" : "Product Owner", decision: stage === "astra" ? "PASS" : "ACCEPTED",
+    taskId: "feature", snapshot: snap(), decidedAt: new Date().toISOString(), statement: "Explicit TEST FIXTURE approval", reference: "test-only external decision event", ...overrides }) });
+  return { project, write, snap, task, runtime, impl, review, report, approval,
+    dispose() {
+      const resolved = path.resolve(project);
+      assert.ok(resolved.startsWith(path.resolve(os.tmpdir()) + path.sep + "nccgs-gates-"));
+      fs.rmSync(resolved, { recursive: true, force: true });
+    } };
+}
+
+test("end-to-end gates require Fable, Astra and explicit acceptance in order", () => {
+  const f = fixture();
+  try {
+    assert.throws(() => close(f.project, "feature"), /implementation: missing/);
+    assert.throws(() => f.report(), /implementation: missing/);
+    f.impl();
+    assert.throws(() => f.report(), /review: missing/);
+    f.review();
+    assert.equal(check(f.project, f.task(), "report").allowed, true);
+    f.report();
+    assert.throws(() => close(f.project, "feature"), /astra: missing/);
+    f.approval("astra");
+    assert.throws(() => close(f.project, "feature"), /acceptance: missing/);
+    f.approval("acceptance");
+    assert.equal(close(f.project, "feature").phase, "DONE");
+  } finally { f.dispose(); }
+});
+
+test("source additions, deletions and edits invalidate review and approvals", () => {
+  const f = fixture();
+  try {
+    f.impl(); f.review(); f.report(); f.approval("astra"); f.approval("acceptance"); close(f.project, "feature");
+    const before = f.snap();
+    f.write("Assets/new.cs", "untracked new source");
+    assert.notEqual(f.snap(), before);
+    assert.throws(() => close(f.project, "feature"), /stale/);
+    fs.unlinkSync(path.join(f.project, "Assets/game.cs"));
+    assert.throws(() => check(f.project, f.task(), "report"), /stale/);
+    f.impl();
+    assert.deepEqual(Object.keys(f.task().stages), ["implementation"]);
+    assert.equal(f.task().closed, undefined);
+    assert.ok(f.task().history.length > 0);
+    assert.throws(() => f.report(), /review: missing/);
+  } finally { f.dispose(); }
+});
+
+test("unknown effort, wrong model, fallback, and same-agent review cannot pass", () => {
+  const f = fixture();
+  try {
+    assert.throws(() => f.impl({ runtime: f.runtime("implementation", { observedEffort: "high" }) }), /effort/);
+    assert.throws(() => f.impl({ runtime: f.runtime("implementation", { observedModel: "claude-sonnet-4-6" }) }), /model/);
+    f.impl();
+    assert.throws(() => f.review({ runtime: f.runtime("review", { agentId: "implementation" }) }), /independent/);
+    assert.throws(() => f.review({ runtime: f.runtime("review", { modelsUsed: ["claude-fable-5-1", "claude-opus-5-5"] }) }), /fallback/);
+    const event = observe(f.project, { session_id: "session", tool_input: { subagent_type: "nccgs-adversarial-reviewer" }, tool_response: { resolvedModel: "claude-fable-5-1", status: "completed", agentId: "native-review" } }, "agent_result");
+    assert.equal(event.observedEffort, null);
+    assert.equal(event.requestedEffort, "high");
+    assert.ok(event.missing.includes("effort"));
+    const ref = f.write(".nccgs/evidence/unknown-effort.json", { ...event, taskId: "feature", snapshot: f.snap() });
+    assert.throws(() => f.review({ runtime: ref }), /effort/);
+  } finally { f.dispose(); }
+});
+
+test("negative review and rejection remain blocking; amended evidence invalidates results", () => {
+  const f = fixture();
+  try {
+    f.impl(); f.review({ verdict: "CHANGES_REQUIRED", findings: [{ severity: "HIGH", status: "OPEN" }] });
+    assert.throws(() => f.report(), /not passed/);
+    assert.throws(() => f.review({ findings: [{ severity: "HIGH", status: "OPEN" }] }), /blocking findings/);
+    f.review(); f.report(); f.approval("astra"); f.approval("acceptance");
+    f.approval("acceptance", { decision: "REJECTED" });
+    assert.throws(() => close(f.project, "feature"), /explicit Product Owner/);
+    const evidence = f.task().stages.review.evidence;
+    f.write(evidence.path, "altered review");
+    assert.throws(() => check(f.project, f.task(), "report"), /stale artifact/);
+  } finally { f.dispose(); }
+});
+
+test("required checks, closure artifacts, manual gates and policy hashes are enforced", () => {
+  const f = fixture({ artifacts: [".nccgs/evidence/build.log"], manual: ["playtest"] });
+  try {
+    assert.throws(() => f.impl({ checks: [{ name: "unrelated", status: "PASS", evidence: f.write(".nccgs/evidence/unrelated.log", "PASS") }] }), /Required check missing/);
+    f.impl(); f.review();
+    assert.throws(() => f.report(), /closure artifact missing/);
+    f.report({ artifacts: [f.write(".nccgs/evidence/build.log", "Build successful")] });
+    f.approval("astra");
+    assert.throws(() => f.approval("acceptance"), /Manual gate missing/);
+    f.approval("acceptance", { gates: [{ id: "playtest", decision: "ACCEPTED", reference: "test fixture playtest decision" }] });
+    close(f.project, "feature");
+    f.write(".nccgs/plan.md", "Changed plan");
+    assert.throws(() => close(f.project, "feature"), /stale artifact/);
+  } finally { f.dispose(); }
+});
+
+test("path traversal and premature/fabricated external sign-offs fail", () => {
+  const f = fixture();
+  try {
+    assert.throws(() => taskPath(f.project, "../escape"), /Invalid task/);
+    assert.throws(() => artifact(f.project, "../outside.txt"), /escapes/);
+    f.impl(); f.review(); f.report();
+    assert.throws(() => f.approval("astra", { actor: "Claude" }), /explicit Astra/);
+    assert.throws(() => f.approval("astra", { decidedAt: "2000-01-01T00:00:00.000Z" }), /predates/);
+    const old = process.env.CLAUDECODE;
+    try { process.env.CLAUDECODE = "1"; assert.throws(() => f.approval("astra"), /outside the Claude/); }
+    finally { if (old === undefined) delete process.env.CLAUDECODE; else process.env.CLAUDECODE = old; }
+    const guard = spawnSync(process.execPath, [path.join(root, ".claude/nccgs/hooks/closure-guard.mjs"), "pre"], {
+      cwd: f.project, encoding: "utf8", input: JSON.stringify({ session_id: "session", tool_input: { file_path: path.join(f.project, ".nccgs/state.md"), content: "Final state: DONE" } }) });
+    assert.equal(guard.status, 2);
+    assert.match(guard.stderr, /bound to an NCCGS task/);
+  } finally { f.dispose(); }
+});
+
+test("verification runner captures real exit status and rejects changed logs", () => {
+  const f = fixture();
+  try {
+    const execute = source => run(["verify", "--project", f.project, "--id", "feature", "--name", "regression", "--", process.execPath, "-e", source]);
+    const failed = execute("process.exit(3)");
+    assert.equal(failed.status, "FAIL");
+    assert.throws(() => f.impl({ checks: [failed] }), /failed\/unproven/);
+    const passed = execute("console.log('fixture verification passed')");
+    assert.equal(passed.status, "PASS");
+    f.impl({ checks: [passed] });
+    const execution = json(path.join(f.project, passed.evidence.path));
+    f.write(execution.log.path, "tampered log");
+    assert.throws(() => check(f.project, f.task(), "review"), /stale artifact/);
+  } finally { f.dispose(); }
+});