okengine 0.1.4

package/src/manifest/diff.test.ts

@@ -0,0 +1,866 @@
+import { describe, expect, test } from "bun:test";
+import { diffManifest, highestSeverity, __test__ } from "./diff.ts";
+import type { DiffCategory, Manifest, ManifestChange } from "./types.ts";
+import { parseManifest } from "./validate.ts";
+
+const baseUrl = new URL("./fixtures/base.manifest.json", import.meta.url);
+
+async function loadBase(): Promise<Manifest> {
+  return parseManifest(await Bun.file(baseUrl).text());
+}
+
+function clone<T>(value: T): T {
+  return structuredClone(value);
+}
+
+function categoriesOf(changes: ManifestChange[]): DiffCategory[] {
+  return [...new Set(changes.map((c) => c.category))];
+}
+
+function hasCategory(
+  changes: ManifestChange[],
+  category: DiffCategory,
+  pathIncludes?: string,
+): boolean {
+  return changes.some(
+    (c) =>
+      c.category === category &&
+      (pathIncludes === undefined || c.path.includes(pathIncludes)),
+  );
+}
+
+describe("diffManifest — fixture pairs", () => {
+  test("1 · identical manifests → no changes", async () => {
+    const m = await loadBase();
+    const result = diffManifest(m, clone(m));
+    expect(result.changes).toEqual([]);
+    expect(result.severity).toBeNull();
+  });
+
+  test("2 · removed error is contract-breaking (subtle)", async () => {
+    const before = await loadBase();
+    const after = clone(before);
+    after.flows!["reports.export"]!.errors = ["NotFound"];
+    const result = diffManifest(before, after);
+    expect(hasCategory(result.changes, "contract-breaking", "Forbidden")).toBe(
+      true,
+    );
+    expect(result.severity).toBe("contract-breaking");
+  });
+
+  test("3 · widened gate staff → member is permission-widening (subtle)", async () => {
+    const before = await loadBase();
+    const after = clone(before);
+    after.flows!["reports.export"]!.gates = ["member"];
+    after.gates!["staff"] = {
+      kind: "policy",
+      roles: ["member"],
+    };
+    const result = diffManifest(before, after);
+    expect(hasCategory(result.changes, "permission-widening")).toBe(true);
+    expect(result.severity).toBe("permission-widening");
+  });
+
+  test("4 · new write effect is effect-widening", async () => {
+    const before = await loadBase();
+    const after = clone(before);
+    after.flows!["reports.export"]!.effects = {
+      ...after.flows!["reports.export"]!.effects,
+      writes: ["sql:reports"],
+    };
+    const result = diffManifest(before, after);
+    expect(hasCategory(result.changes, "effect-widening", "writes")).toBe(true);
+    expect(result.severity).toBe("effect-widening");
+  });
+
+  test("5 · gates reordered only is no-impact", async () => {
+    const before = await loadBase();
+    const after = clone(before);
+    after.flows!["orders.create"]!.gates = [
+      "rate:sliding-window-counter:300/1m",
+      "member",
+    ];
+    const result = diffManifest(before, after);
+    expect(result.changes.length).toBeGreaterThan(0);
+    expect(categoriesOf(result.changes)).toEqual(["no-impact"]);
+    expect(result.severity).toBe("no-impact");
+  });
+
+  test("6 · required field added to in-schema is contract-breaking", async () => {
+    const before = await loadBase();
+    const after = clone(before);
+    after.flows!["orders.create"]!.in = {
+      type: "object",
+      required: ["sku", "qty"],
+      properties: {
+        sku: { type: "string" },
+        qty: { type: "integer" },
+      },
+    };
+    const result = diffManifest(before, after);
+    expect(hasCategory(result.changes, "contract-breaking", "/in")).toBe(true);
+  });
+
+  test("7 · flow became public (all gates removed) is permission-widening", async () => {
+    const before = await loadBase();
+    const after = clone(before);
+    after.flows!["reports.export"]!.gates = [];
+    const result = diffManifest(before, after);
+    expect(
+      result.changes.some((c) =>
+        c.summary.includes("flow became public"),
+      ),
+    ).toBe(true);
+    expect(result.severity).toBe("permission-widening");
+  });
+
+  test("8 · new send / ask / secret effects are effect-widening", async () => {
+    const before = await loadBase();
+    const after = clone(before);
+    after.flows!["orders.create"]!.effects = {
+      ...after.flows!["orders.create"]!.effects,
+      sends: ["order-confirmed"],
+      asks: ["triage@1"],
+      secrets: ["STRIPE_KEY"],
+    };
+    const result = diffManifest(before, after);
+    expect(hasCategory(result.changes, "effect-widening", "sends")).toBe(true);
+    expect(hasCategory(result.changes, "effect-widening", "asks")).toBe(true);
+    expect(hasCategory(result.changes, "effect-widening", "secrets")).toBe(true);
+  });
+
+  test("9 · source / deprecated / cache-only edits are no-impact", async () => {
+    const before = await loadBase();
+    const after = clone(before);
+    after.flows!["orders.create"]!.source = "src/flows/orders.ts:99";
+    after.flows!["orders.create"]!.deprecated = {
+      since: "1.1",
+      replaceWith: "orders.v2",
+    };
+    after.flows!["orders.create"]!.cache = "5m";
+    const result = diffManifest(before, after);
+    expect(categoriesOf(result.changes)).toEqual(["no-impact"]);
+  });
+
+  test("10 · signal delivery change is contract-breaking", async () => {
+    const before = await loadBase();
+    const after = clone(before);
+    after.signals!["order-placed"]!.delivery = "broadcast";
+    const result = diffManifest(before, after);
+    expect(hasCategory(result.changes, "contract-breaking", "delivery")).toBe(
+      true,
+    );
+  });
+
+  test("11 · rate limit expression widened is permission-widening", async () => {
+    const before = await loadBase();
+    const after = clone(before);
+    after.flows!["orders.create"]!.gates = [
+      "member",
+      "rate:sliding-window-counter:500/1m",
+    ];
+    const result = diffManifest(before, after);
+    expect(
+      result.changes.some(
+        (c) =>
+          c.category === "permission-widening" &&
+          c.summary.includes("rate limit widened"),
+      ),
+    ).toBe(true);
+  });
+
+  test("12 · prompt version bump is effect-widening", async () => {
+    const before = await loadBase();
+    const after = clone(before);
+    after.ai!.prompts!.triage!.version = 2;
+    const result = diffManifest(before, after);
+    expect(hasCategory(result.changes, "effect-widening", "version")).toBe(true);
+  });
+
+  test("13 · tenancy isolation weakened is permission-widening", async () => {
+    const before = await loadBase();
+    const after = clone(before);
+    after.tenancy = { isolation: "row" };
+    const result = diffManifest(before, after);
+    expect(hasCategory(result.changes, "permission-widening", "tenancy")).toBe(
+      true,
+    );
+  });
+
+  test("14 · effects array reorder only is no-impact", async () => {
+    const before = await loadBase();
+    const after = clone(before);
+    after.flows!["orders.create"]!.effects = {
+      reads: ["sql:orders"],
+      writes: ["sql:orders"],
+      emits: ["order-placed"],
+    };
+    // force a visible reorder on reads by duplicating via another resource then sorting differently
+    before.flows!["orders.create"]!.effects = {
+      reads: ["sql:orders", "sql:reports"],
+      writes: ["sql:orders"],
+      emits: ["order-placed"],
+    };
+    after.flows!["orders.create"]!.effects = {
+      reads: ["sql:reports", "sql:orders"],
+      writes: ["sql:orders"],
+      emits: ["order-placed"],
+    };
+    const result = diffManifest(before, after);
+    expect(hasCategory(result.changes, "no-impact", "reads")).toBe(true);
+    expect(hasCategory(result.changes, "effect-widening")).toBe(false);
+  });
+
+  test("15 · removing a flow is contract-breaking; adding one is no-impact", async () => {
+    const before = await loadBase();
+    const after = clone(before);
+    delete after.flows!["reports.export"];
+    after.flows!["health.ping"] = {
+      trigger: { http: { method: "GET", path: "/health" } },
+      effects: { reads: [] },
+    };
+    const result = diffManifest(before, after);
+    expect(hasCategory(result.changes, "contract-breaking", "reports.export")).toBe(
+      true,
+    );
+    expect(hasCategory(result.changes, "no-impact", "health.ping")).toBe(true);
+  });
+
+  test("16 · plugin intercept added is permission-widening", async () => {
+    const before = await loadBase();
+    const after = clone(before);
+    after.plugins!.audit!.intercepts = ["afterHandle"];
+    const result = diffManifest(before, after);
+    expect(hasCategory(result.changes, "permission-widening", "plugins")).toBe(
+      true,
+    );
+  });
+
+  test("17 · availability SLO lowered is contract-breaking", async () => {
+    const before = await loadBase();
+    const after = clone(before);
+    after.flows!["reports.export"]!.slo = {
+      availability: "99.0%",
+      latency: { p99: "200ms" },
+    };
+    const result = diffManifest(before, after);
+    expect(
+      hasCategory(result.changes, "contract-breaking", "availability"),
+    ).toBe(true);
+  });
+
+  test("18 · PII classification removed is permission-widening", async () => {
+    const before = await loadBase();
+    const after = clone(before);
+    after.stores!.db!.tables!.orders!.classifications = {};
+    const result = diffManifest(before, after);
+    expect(
+      hasCategory(result.changes, "permission-widening", "classifications"),
+    ).toBe(true);
+  });
+});
+
+describe("diffManifest — additional branches", () => {
+  test("app / oke identity changes are contract-breaking", async () => {
+    const before = await loadBase();
+    const after = clone(before);
+    after.app = "other";
+    after.oke = "1.0";
+    const r1 = diffManifest(before, after);
+    expect(hasCategory(r1.changes, "contract-breaking", "/app")).toBe(true);
+
+    const afterOke = clone(before) as Manifest & { oke: string };
+    (afterOke as { oke: string }).oke = "9.9" as Manifest["oke"];
+    const r2 = diffManifest(before, afterOke as Manifest);
+    expect(hasCategory(r2.changes, "contract-breaking", "/oke")).toBe(true);
+  });
+
+  test("trigger / out schema / durable / live / plane / cost / pii / steps", async () => {
+    const before = await loadBase();
+    const after = clone(before);
+    const flow = after.flows!["orders.create"]!;
+    flow.trigger = { http: { method: "PUT", path: "/orders" } };
+    flow.out = {
+      type: "object",
+      properties: { id: { type: "number" } },
+    };
+    flow.durable = true;
+    flow.live = true;
+    flow.plane = "operator";
+    flow.cost = { estimatePerCall: 1, budget: 2 };
+    flow.pii = "allow";
+    flow.steps = ["a", "b"];
+    flow.nondeterministic = true;
+    flow.breaking = true;
+    flow.cacheKeys = "computed:x";
+    flow.errors = { OutOfStock: { type: "object", properties: { left: { type: "number" } } } };
+
+    before.flows!["orders.create"]!.errors = {
+      OutOfStock: { type: "object", properties: { left: { type: "string" } } },
+    };
+    before.flows!["orders.create"]!.plane = "user";
+    before.flows!["orders.create"]!.steps = ["a"];
+
+    const result = diffManifest(before, after);
+    expect(hasCategory(result.changes, "contract-breaking", "trigger")).toBe(true);
+    expect(hasCategory(result.changes, "contract-breaking", "/out")).toBe(true);
+    expect(hasCategory(result.changes, "effect-widening", "durable")).toBe(true);
+    expect(hasCategory(result.changes, "effect-widening", "live")).toBe(true);
+    expect(hasCategory(result.changes, "effect-widening", "steps")).toBe(true);
+    expect(hasCategory(result.changes, "permission-widening", "pii")).toBe(true);
+  });
+
+  test("operator → user plane is permission-widening; durable off is contract-breaking", async () => {
+    const before = await loadBase();
+    before.flows!["orders.create"]!.plane = "operator";
+    before.flows!["orders.create"]!.durable = true;
+    const after = clone(before);
+    after.flows!["orders.create"]!.plane = "user";
+    after.flows!["orders.create"]!.durable = false;
+    const result = diffManifest(before, after);
+    expect(hasCategory(result.changes, "permission-widening", "plane")).toBe(true);
+    expect(hasCategory(result.changes, "contract-breaking", "durable")).toBe(true);
+  });
+
+  test("signal retries/deadLetter/optional and store facet", async () => {
+    const before = await loadBase();
+    const after = clone(before);
+    after.signals!["order-placed"]!.retries = 1;
+    after.signals!["order-placed"]!.deadLetter = false;
+    after.signals!["order-placed"]!.optional = true;
+    after.stores!.db!.facet = "kv";
+    after.stores!.db!.namespaces = ["cache"];
+    delete after.stores!.db!.tables;
+    const result = diffManifest(before, after);
+    expect(hasCategory(result.changes, "contract-breaking", "retries")).toBe(true);
+    expect(hasCategory(result.changes, "contract-breaking", "deadLetter")).toBe(
+      true,
+    );
+    expect(hasCategory(result.changes, "contract-breaking", "facet")).toBe(true);
+  });
+
+  test("clocks, vault, channels, journeys, drivers, i18n, topology, images", async () => {
+    const before = await loadBase();
+    const after = clone(before);
+    after.clocks!.nightly!.cron = "0 1 * * *";
+    after.vault!.STRIPE_KEY!.schema = { type: "number" };
+    after.channels!["order-confirmed"]!.locales = ["en", "fr"];
+    after.channels!["order-confirmed"]!.medium = "sms";
+    after.journeys = {
+      checkout: {
+        slo: { availability: "99%" },
+        composes: "98%",
+        flows: ["orders.create"],
+      },
+    };
+    after.drivers!.prod = ["postgres"];
+    after.i18n!.locales = ["en"];
+    after.topology = "services";
+    after.images = { "store.sql": "postgres:17" };
+    after.ai!.agents!.support!.tools = ["orders.create", "reports.export"];
+    after.ai!.agents!.support!.maxSteps = 9;
+    after.ai!.prompts!.triage!.budget = { maxCostPerCall: 0.5 };
+
+    // seed journey then lower
+    before.journeys = {
+      checkout: {
+        slo: { availability: "99.9%" },
+        composes: "99.5%",
+        flows: ["orders.create", "reports.export"],
+      },
+    };
+
+    const result = diffManifest(before, after);
+    expect(hasCategory(result.changes, "contract-breaking", "clocks")).toBe(true);
+    expect(hasCategory(result.changes, "contract-breaking", "schema")).toBe(true);
+    expect(hasCategory(result.changes, "contract-breaking", "medium")).toBe(true);
+    expect(hasCategory(result.changes, "effect-widening", "tools")).toBe(true);
+    expect(hasCategory(result.changes, "contract-breaking", "topology")).toBe(true);
+    expect(hasCategory(result.changes, "no-impact", "images")).toBe(true);
+  });
+
+  test("tenancy removed / i18n removed / drivers env removed", async () => {
+    const before = await loadBase();
+    const after = clone(before);
+    delete after.tenancy;
+    delete after.i18n;
+    delete after.drivers;
+    const result = diffManifest(before, after);
+    expect(hasCategory(result.changes, "permission-widening", "tenancy")).toBe(
+      true,
+    );
+    expect(hasCategory(result.changes, "contract-breaking", "i18n")).toBe(true);
+    expect(hasCategory(result.changes, "contract-breaking", "drivers")).toBe(true);
+  });
+
+  test("gate definition max widen and strategy change", async () => {
+    const before = await loadBase();
+    before.gates!.fair = {
+      kind: "rate",
+      strategy: "sliding-window-counter",
+      max: 10,
+      per: "1m",
+    };
+    const after = clone(before);
+    after.gates!.fair = {
+      kind: "rate",
+      strategy: "token-bucket",
+      max: 10,
+      per: "1m",
+    };
+    const r1 = diffManifest(before, after);
+    expect(hasCategory(r1.changes, "contract-breaking", "strategy")).toBe(true);
+
+    const afterMax = clone(before);
+    afterMax.gates!.fair = {
+      kind: "rate",
+      strategy: "sliding-window-counter",
+      max: 100,
+      per: "1m",
+    };
+    const r2 = diffManifest(before, afterMax);
+    expect(hasCategory(r2.changes, "permission-widening")).toBe(true);
+  });
+
+  test("slo latency loosened; in schema type change; error added no-impact", async () => {
+    const before = await loadBase();
+    const after = clone(before);
+    after.flows!["reports.export"]!.slo = {
+      availability: "99.9%",
+      latency: { p99: "500ms" },
+    };
+    after.flows!["orders.create"]!.in = {
+      type: "object",
+      required: ["sku"],
+      properties: {
+        sku: { type: "number" },
+        qty: { type: "integer" },
+      },
+    };
+    after.flows!["orders.create"]!.errors = ["OutOfStock", "Gone"];
+    const result = diffManifest(before, after);
+    expect(hasCategory(result.changes, "contract-breaking", "latency")).toBe(true);
+    expect(hasCategory(result.changes, "contract-breaking", "/in")).toBe(true);
+    expect(hasCategory(result.changes, "no-impact", "Gone")).toBe(true);
+  });
+
+  test("highestSeverity picks the strongest category", () => {
+    expect(highestSeverity([])).toBeNull();
+    expect(
+      highestSeverity([
+        {
+          path: "/a",
+          category: "no-impact",
+          kind: "changed",
+          summary: "a",
+        },
+        {
+          path: "/b",
+          category: "effect-widening",
+          kind: "changed",
+          summary: "b",
+        },
+        {
+          path: "/c",
+          category: "permission-widening",
+          kind: "changed",
+          summary: "c",
+        },
+      ]),
+    ).toBe("permission-widening");
+  });
+});
+
+describe("diff helpers — branch coverage", () => {
+  test("parseRateGate / parsePercent / parseDurationMs", () => {
+    expect(__test__.parseRateGate("rate:sliding-window-counter:300/1m")).toEqual({
+      strategy: "sliding-window-counter",
+      max: 300,
+      per: "1m",
+    });
+    expect(__test__.parseRateGate("member")).toBeUndefined();
+    expect(__test__.parsePercent("99.9%")).toBe(99.9);
+    expect(__test__.parsePercent("nope")).toBeUndefined();
+    expect(__test__.parsePercent(undefined)).toBeUndefined();
+    expect(__test__.parseDurationMs("200ms")).toBe(200);
+    expect(__test__.parseDurationMs("2s")).toBe(2000);
+    expect(__test__.parseDurationMs("1m")).toBe(60_000);
+    expect(__test__.parseDurationMs("1h")).toBe(3_600_000);
+    expect(__test__.parseDurationMs("1d")).toBeUndefined();
+  });
+
+  test("schemaBreaksClients enum narrowing and out property removal", () => {
+    expect(
+      __test__.schemaBreaksClients(
+        {
+          type: "object",
+          properties: { format: { type: "string", enum: ["csv", "json"] } },
+        },
+        {
+          type: "object",
+          properties: { format: { type: "string", enum: ["csv"] } },
+        },
+        "in",
+      ),
+    ).toBe(true);
+
+    expect(
+      __test__.schemaBreaksClients(
+        {
+          type: "object",
+          properties: { url: { type: "string" }, extra: { type: "string" } },
+        },
+        {
+          type: "object",
+          properties: { url: { type: "string" } },
+        },
+        "out",
+      ),
+    ).toBe(true);
+
+    expect(
+      __test__.schemaBreaksClients(
+        { type: "string" },
+        { type: "number" },
+        "in",
+      ),
+    ).toBe(true);
+
+    expect(
+      __test__.schemaBreaksClients(
+        {
+          type: "object",
+          properties: { a: { type: "string" } },
+          required: [],
+        },
+        {
+          type: "object",
+          properties: { a: { type: "string" }, b: { type: "string" } },
+          required: [],
+        },
+        "in",
+      ),
+    ).toBe(false);
+  });
+
+  test("classificationWeakened detects pii/sensitive loss", () => {
+    expect(
+      __test__.classificationWeakened(
+        { email: { pii: true } },
+        { email: { pii: false } },
+      ),
+    ).toBe(true);
+    expect(
+      __test__.classificationWeakened(
+        { token: { sensitive: true } },
+        {},
+      ),
+    ).toBe(true);
+    expect(
+      __test__.classificationWeakened(
+        { email: "pii" },
+        { email: ["pii"] },
+      ),
+    ).toBe(false);
+    expect(
+      __test__.classificationWeakened(
+        { email: ["sensitive"] },
+        { email: ["pii"] },
+      ),
+    ).toBe(true);
+    expect(__test__.classificationWeakened(null, {})).toBe(false);
+    expect(__test__.classificationWeakened({ a: "pii" }, null)).toBe(true);
+    expect(
+      __test__.classificationWeakened(
+        { email: { sensitive: true } },
+        { email: { sensitive: false } },
+      ),
+    ).toBe(true);
+  });
+});
+
+describe("diffManifest — line coverage sweep", () => {
+  test("covers remaining flow/signal/store/ai/i18n branches", async () => {
+    const before = await loadBase();
+    before.flows!["orders.create"]!.plane = "user";
+    before.flows!["orders.create"]!.steps = ["a", "b"];
+    before.flows!["orders.create"]!.nondeterministic = true;
+    before.flows!["orders.create"]!.cost = { budget: 5 };
+    before.flows!["orders.create"]!.in = "CreateOrder";
+    before.flows!["orders.create"]!.effects = {
+      reads: ["sql:orders", "sql:reports"],
+      writes: ["sql:orders"],
+      emits: ["order-placed"],
+      calls: ["reports.export"],
+    };
+    before.flows!["orders.create"]!.errors = ["OutOfStock", "Gone"];
+    before.flows!["internal"] = {
+      effects: { reads: ["sql:orders"] },
+    };
+    before.signals!["order-placed"]!.schema = {
+      type: "object",
+      properties: { id: { type: "string" } },
+    };
+    before.signals!["order-placed"]!.optional = true;
+    before.gates!.staff = { kind: "policy", roles: ["staff", "admin"], scopes: ["x"] };
+    before.vault!.STRIPE_KEY!.description = "old";
+    before.channels!["order-confirmed"]!.from = "a@b.c";
+    before.plugins!.audit!.version = "1.0.0";
+    before.stores!.db!.classifications = { email: { pii: true } };
+    before.stores!.db!.tables!.orders!.columns = {
+      email: { pii: true },
+    };
+    before.stores!.db!.buckets = ["a", "b"];
+    before.stores!.db!.indexes = ["ix"];
+    before.ai!.models!.smart = { provider: "anthropic", tier: "opus" };
+    before.ai!.prompts!.triage = {
+      version: 1,
+      evals: "./evals/t.jsonl",
+      budget: { maxCostPerCall: 0.05 },
+      in: { type: "object" },
+      out: { type: "object" },
+    };
+    before.ai!.agents!.support = {
+      tools: ["orders.create", "reports.export"],
+      maxSteps: 5,
+      budget: { maxCostPerRun: 1 },
+    };
+    before.drivers = { prod: ["postgres", "redis"], dev: ["sqlite"] };
+    before.i18n = {
+      locales: ["en"],
+      default: "en",
+      dir: { en: "ltr" },
+    };
+    delete before.tenancy;
+    delete before.topology;
+
+    const after = clone(before);
+    delete after.flows!["orders.create"]!.plane;
+    after.flows!["orders.create"]!.steps = ["a"];
+    after.flows!["orders.create"]!.nondeterministic = false;
+    after.flows!["orders.create"]!.cost = { budget: 1 };
+    after.flows!["orders.create"]!.live = false;
+    after.flows!["orders.create"]!.durable = false;
+    after.flows!["orders.create"]!.in = "CreateOrderV2";
+    after.flows!["orders.create"]!.out = {
+      type: "object",
+      properties: { id: { type: "string" }, ok: { type: "boolean" } },
+    };
+    delete after.flows!["orders.create"]!.effects!.calls;
+    after.flows!["orders.create"]!.effects!.reads = ["sql:orders"];
+    after.flows!["orders.create"]!.errors = ["Gone", "OutOfStock"];
+    after.flows!["internal"]!.trigger = {
+      http: { method: "GET", path: "/internal" },
+    };
+    delete after.flows!["reports.export"]!.trigger;
+    delete after.flows!["reports.export"]!.in;
+    after.flows!["reports.export"]!.out = undefined;
+    after.flows!["reports.export"]!.slo = undefined;
+    after.flows!["newborn"] = {
+      in: { type: "object", properties: { x: { type: "string" } } },
+      slo: { availability: "99.99%" },
+    };
+    // non-breaking out additive property on orders
+    after.flows!["orders.create"]!.out = {
+      type: "object",
+      required: ["id"],
+      properties: {
+        id: { type: "string" },
+        extra: { type: "string" },
+      },
+    };
+    before.flows!["orders.create"]!.out = {
+      type: "object",
+      required: ["id"],
+      properties: { id: { type: "string" } },
+    };
+
+    after.signals!["order-placed"]!.retries = 9;
+    after.signals!["order-placed"]!.deadLetter = true;
+    after.signals!["order-placed"]!.optional = false;
+    after.signals!["order-placed"]!.schema = {
+      type: "object",
+      properties: { id: { type: "string" }, n: { type: "number" } },
+    };
+
+    after.gates!.staff = { kind: "policy", roles: ["staff"], scopes: [] };
+    after.gates!.member = { kind: "policy", roles: ["member"], policy: "member" };
+    after.vault!.STRIPE_KEY!.rotate = "30d";
+    after.channels!["order-confirmed"]!.from = "x@y.z";
+    after.channels!["order-confirmed"]!.locales = ["en"]; // remove none, metadata-ish
+    delete after.channels!["order-confirmed"]!.locales;
+    after.channels!["order-confirmed"]!.locales = ["fr"]; // remove en, add fr
+    after.plugins!.audit!.origin = "community";
+    after.stores!.db!.classifications = { email: { pii: true, retain: "1y" } };
+    after.stores!.db!.tables!.orders!.columns = {
+      email: { pii: true, retain: "1y" },
+    };
+    after.stores!.db!.buckets = ["b", "a"];
+    after.stores!.db!.indexes = ["ix", "iy"];
+    after.stores!.db!.namespaces = ["ns"];
+
+    after.ai!.models!.smart = { provider: "anthropic", tier: "sonnet" };
+    after.ai!.prompts!.triage = {
+      version: 1,
+      evals: "./evals/t2.jsonl",
+      budget: { maxCostPerCall: 0.01 },
+      in: { type: "string" },
+      out: { type: "string" },
+    };
+    after.ai!.agents!.support = {
+      tools: ["orders.create"],
+      maxSteps: 2,
+      budget: { maxCostPerRun: 0.5 },
+    };
+
+    after.drivers = { prod: ["redis", "postgres", "s3"], staging: ["postgres"] };
+    delete after.drivers.dev;
+    after.tenancy = { isolation: "database" };
+    after.i18n = {
+      locales: ["en", "de"],
+      default: "de",
+      dir: { en: "ltr", de: "ltr" },
+    };
+    after.topology = "monolith";
+    after.clocks!.nightly!.timezone = "UTC";
+    after.clocks!.nightly!.overridable = true;
+
+    before.flows!["reports.export"]!.slo = {
+      availability: "99.0%",
+      latency: { p99: "100ms" },
+    };
+    after.flows!["reports.export"]!.slo = {
+      availability: "99.9%",
+      latency: { p99: "100ms" },
+    };
+
+    const result = diffManifest(before, after);
+    expect(result.changes.length).toBeGreaterThan(10);
+    expect(categoriesOf(result.changes).length).toBeGreaterThan(1);
+  });
+
+  test("schema add/remove roles and journey flow-only widen", async () => {
+    const before = await loadBase();
+    delete before.flows!["orders.create"]!.in;
+    before.flows!["orders.create"]!.out = { type: "object" };
+    before.journeys = {
+      checkout: { flows: ["orders.create"], composes: "99%" },
+    };
+    const after = clone(before);
+    after.flows!["orders.create"]!.in = { type: "object" };
+    delete after.flows!["orders.create"]!.out;
+    after.journeys!.checkout!.flows = ["orders.create", "reports.export"];
+    after.journeys!.checkout!.composes = "99.5%";
+    const result = diffManifest(before, after);
+    expect(hasCategory(result.changes, "contract-breaking", "/in")).toBe(true);
+    expect(hasCategory(result.changes, "contract-breaking", "/out")).toBe(true);
+    expect(hasCategory(result.changes, "no-impact", "composes")).toBe(true);
+  });
+
+  test("gate scopes widen path and plugin declares-only widen", async () => {
+    const before = await loadBase();
+    before.gates!.member = { kind: "policy", scopes: ["a"] };
+    const after = clone(before);
+    after.gates!.member = { kind: "policy", scopes: ["a", "b"] };
+    after.plugins!.audit!.declares = ["consolePanel:audit", "cli:x"];
+    const result = diffManifest(before, after);
+    expect(hasCategory(result.changes, "permission-widening")).toBe(true);
+  });
+
+  test("invalid rate gate strings are ignored in widen detection", async () => {
+    const before = await loadBase();
+    before.flows!["orders.create"]!.gates = ["member", "rate:broken"];
+    const after = clone(before);
+    after.flows!["orders.create"]!.gates = ["member", "rate:also-broken"];
+    const result = diffManifest(before, after);
+    expect(
+      result.changes.some((c) => c.summary.includes("rate limit widened")),
+    ).toBe(false);
+  });
+
+  test("slo added and removed; channel metadata; agent budget; drivers reorder; i18n add/dir", async () => {
+    const before = await loadBase();
+    delete before.flows!["orders.create"]!.slo;
+    before.flows!["reports.export"]!.slo = { availability: "99.9%" };
+    before.channels!["order-confirmed"] = {
+      medium: "email",
+      locales: ["en"],
+      from: "a@b.c",
+      schema: { type: "object" },
+    };
+    before.ai!.agents!.support = {
+      tools: ["orders.create"],
+      maxSteps: 3,
+      budget: { maxCostPerRun: 1 },
+    };
+    before.drivers = { prod: ["postgres", "redis"] };
+    delete before.i18n;
+    before.stores!.db!.namespaces = ["a", "b"];
+    before.stores!.db!.buckets = ["old"];
+
+    const after = clone(before);
+    after.flows!["orders.create"]!.slo = { availability: "99.5%" };
+    delete after.flows!["reports.export"]!.slo;
+    after.channels!["order-confirmed"]!.from = "z@z.z";
+    after.ai!.agents!.support!.budget = { maxCostPerRun: 2 };
+    after.drivers = { prod: ["redis", "postgres"] };
+    after.i18n = { locales: ["en"], default: "en", dir: { en: "ltr" } };
+    after.stores!.db!.namespaces = ["b"]; // remove a
+    after.stores!.db!.buckets = ["new"]; // remove old, add new
+
+    const mid = clone(after);
+    mid.i18n = { locales: ["en"], default: "en", dir: { en: "rtl" } };
+
+    const r1 = diffManifest(before, after);
+    expect(hasCategory(r1.changes, "no-impact", "/slo")).toBe(true);
+    expect(hasCategory(r1.changes, "contract-breaking", "/slo")).toBe(true);
+    expect(hasCategory(r1.changes, "no-impact", "channels")).toBe(true);
+    expect(hasCategory(r1.changes, "effect-widening", "budget")).toBe(true);
+    expect(hasCategory(r1.changes, "no-impact", "drivers")).toBe(true);
+    expect(hasCategory(r1.changes, "no-impact", "/i18n")).toBe(true);
+    expect(hasCategory(r1.changes, "contract-breaking", "namespaces")).toBe(true);
+
+    const r2 = diffManifest(after, mid);
+    expect(hasCategory(r2.changes, "no-impact", "/i18n/dir")).toBe(true);
+  });
+
+  test("latency not loosened and isPii false paths", () => {
+    expect(
+      __test__.schemaBreaksClients(
+        {
+          type: "object",
+          properties: {
+            format: { type: "string", enum: ["csv", "json"] },
+            note: { description: "x" },
+          },
+        },
+        {
+          type: "object",
+          properties: {
+            format: { type: "string", enum: ["csv", "json", "xml"] },
+            note: { description: "y" },
+          },
+        },
+        "in",
+      ),
+    ).toBe(false);
+
+    expect(
+      __test__.classificationWeakened(
+        { a: "plain", b: 1, c: null },
+        { a: "plain", b: 1, c: null },
+      ),
+    ).toBe(false);
+
+    expect(__test__.latencyLoosened({ p99: "200ms" }, { p99: "100ms" })).toBe(
+      false,
+    );
+    expect(__test__.latencyLoosened(undefined, { p99: "100ms" })).toBe(false);
+    expect(__test__.latencyLoosened({ p99: "200ms" }, { p50: "100ms" })).toBe(
+      false,
+    );
+    expect(__test__.latencyLoosened({ p99: "nope" }, { p99: "also" })).toBe(
+      false,
+    );
+  });
+});