redlinegate 0.0.1

package/scripts/collect-telemetry.mjs

@@ -0,0 +1,300 @@
+#!/usr/bin/env node
+// Central telemetry collector. Runs in the redline-metrics repo on a schedule and pulls
+// review outcomes for merged PRs across the org.
+//
+// This replaces the previous per-repo telemetry workflow, which required a cross-repo
+// write token to be stored as a secret in every onboarded repo. One central read token
+// in one repo has a far smaller blast radius.
+//
+// Vendor-neutral by design: findings are attributed by reviewer login, so Copilot,
+// Claude, Codex or a human reviewer are all measured the same way.
+//
+// SARIF ingestion: where a repository already runs a scanner, its code-scanning
+// alerts are ingested alongside Redline's own findings and put through the same
+// severity contract. Ingested findings are ALWAYS tagged `source: "sarif"` with the
+// producing tool — a view that cannot tell them apart would tune Redline's rules on
+// another tool's noise, which is the one way this makes things worse than not doing
+// it. Redline never runs a scanner and never asks a repository to change which ones
+// it runs; and per the roadmap's open question 4, ingested findings are MEASURED
+// ONLY. They never gate a merge: gating on another tool's output makes Redline
+// responsible for that tool's false positives.
+//
+// Env: GH_TOKEN (read access to org repos + PRs), ORG, [SINCE=YYYY-MM-DD], [DAYS=8],
+//      [OUT=data], [DRY_RUN=1], [SKIP_SARIF=1]
+
+import { mkdirSync, readFileSync, writeFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import {
+  SEVERITIES,
+  loadRules,
+  parseFinding,
+  isReviewBot,
+  emptyBySeverity,
+  RESERVED_RULE_IDS,
+} from './lib/rules.mjs';
+import { readExemption } from './lib/exemptions.mjs';
+import { ingestAlerts } from './lib/sarif.mjs';
+
+const { GH_TOKEN, ORG, SINCE, DAYS = '8', OUT = 'data', DRY_RUN } = process.env;
+if (!GH_TOKEN || !ORG) throw new Error('GH_TOKEN and ORG are required');
+
+const since = SINCE ?? new Date(Date.now() - Number(DAYS) * 86400000).toISOString().slice(0, 10);
+
+// The catalogue is optional here: the collector may run in the metrics repo, which has
+// the scripts but not necessarily the standards. Without it, rule ids are still recorded,
+// just not validated.
+let rules = new Map();
+try {
+  rules = loadRules();
+} catch {
+  console.warn('standards/ not present — rule ids will be recorded without validation');
+}
+
+async function graphql(query, variables) {
+  const res = await fetch('https://api.github.com/graphql', {
+    method: 'POST',
+    headers: {
+      Authorization: `Bearer ${GH_TOKEN}`,
+      'Content-Type': 'application/json',
+      Accept: 'application/vnd.github+json',
+    },
+    body: JSON.stringify({ query, variables }),
+  });
+  if (!res.ok) throw new Error(`graphql ${res.status}: ${await res.text()}`);
+  const body = await res.json();
+  // Partial errors are common (a repo the token cannot see); only a total failure is fatal.
+  if (body.errors?.length && !body.data) throw new Error(JSON.stringify(body.errors));
+  if (body.errors?.length) console.warn(`  ${body.errors.length} partial GraphQL error(s)`);
+  return body.data;
+}
+
+const QUERY = `
+query($q: String!, $cursor: String) {
+  search(query: $q, type: ISSUE, first: 25, after: $cursor) {
+    pageInfo { hasNextPage endCursor }
+    nodes {
+      ... on PullRequest {
+        number
+        mergedAt
+        additions
+        deletions
+        changedFiles
+        repository { nameWithOwner }
+        author { login }
+        title
+        body
+        # Lead time is first commit to merge. The first commit, not the branch
+        # creation: a branch that sat unused for a week did not take a week of
+        # lead time, and reporting that it did makes every team look slower than
+        # it is.
+        commits(first: 1) { nodes { commit { committedDate } } }
+        labels(first: 30) { nodes { name } }
+        reviewThreads(first: 100) {
+          nodes {
+            isResolved
+            isOutdated
+            comments(first: 1) { nodes { body author { login } path } }
+          }
+        }
+      }
+    }
+  }
+}`;
+
+function summarise(pr) {
+  const findings = emptyBySeverity();
+  const resolved = emptyBySeverity();
+  const stale = emptyBySeverity();
+  const reviewers = new Set();
+  // Per-rule outcomes are the point of the rule-id contract: a rule that fires a lot and
+  // is never acted on is noise, and that is only visible per rule, not per severity.
+  const byRule = new Map();
+  let untagged = 0;
+  let withoutRuleId = 0;
+  let unknownRuleId = 0;
+  let human = 0;
+
+  for (const thread of pr.reviewThreads?.nodes ?? []) {
+    const comment = thread.comments?.nodes?.[0];
+    if (!comment) continue;
+    const login = comment.author?.login ?? '';
+    if (!isReviewBot(login)) {
+      human += 1;
+      continue;
+    }
+    reviewers.add(login);
+
+    const parsed = parseFinding(comment.body ?? '');
+    if (!parsed.tagged) untagged += 1;
+    if (!parsed.hasRuleId) withoutRuleId += 1;
+    if (parsed.hasRuleId && rules.size && !rules.has(parsed.ruleId) && !RESERVED_RULE_IDS.has(parsed.ruleId)) {
+      unknownRuleId += 1;
+    }
+
+    const severity = parsed.severity.toLowerCase();
+    findings[severity] += 1;
+    if (thread.isResolved) resolved[severity] += 1;
+    // Unresolved and outdated: the author changed the code around it and nobody closed
+    // the thread. The strongest signal available that the finding was not worth acting on.
+    const ignored = !thread.isResolved && thread.isOutdated;
+    if (ignored) stale[severity] += 1;
+
+    const ruleId = parsed.ruleId ?? '(untagged)';
+    const entry = byRule.get(ruleId) ?? { fired: 0, resolved: 0, stale: 0, severity: parsed.severity };
+    entry.fired += 1;
+    if (thread.isResolved) entry.resolved += 1;
+    if (ignored) entry.stale += 1;
+    byRule.set(ruleId, entry);
+  }
+
+  const total = SEVERITIES.reduce((n, s) => n + findings[s.toLowerCase()], 0);
+  const totalResolved = SEVERITIES.reduce((n, s) => n + resolved[s.toLowerCase()], 0);
+
+  return {
+    repo: pr.repository.nameWithOwner,
+    pr: pr.number,
+    title: pr.title ?? '',
+    merged_at: pr.mergedAt,
+    // Absent where the API did not return it. Left absent rather than defaulted
+    // to the merge time, which would report a lead time of zero for every one of
+    // them and drag the median toward a number no team achieved.
+    first_commit_at: pr.commits?.nodes?.[0]?.commit?.committedDate ?? null,
+    author: pr.author?.login ?? null,
+    reviewers: [...reviewers],
+    labels: (pr.labels?.nodes ?? []).map((l) => l.name),
+    exempted: (pr.labels?.nodes ?? []).some((l) => ['redline-exempt', 'no-adr'].includes(l.name)),
+    // The structured exemption, when the pull request carried one. A label says
+    // a check was waived; this says who accepted what, why, and until when — the
+    // difference between an exemption and an opt-out, and the only version of it
+    // that can be audited or trended.
+    exemption: readExemption(pr.body),
+    size: { additions: pr.additions, deletions: pr.deletions, files: pr.changedFiles },
+    findings: { total, ...findings },
+    // Acted-on rate. total > 0 and acted_on near 0 means the review is being ignored,
+    // which is the noise signal the standards are tuned against.
+    outcomes: { resolved: totalResolved, resolved_by_severity: resolved, stale_by_severity: stale },
+    rules: Object.fromEntries(byRule),
+    human_review_threads: human,
+    untagged_findings: untagged,
+    findings_without_rule_id: withoutRuleId,
+    unknown_rule_ids: unknownRuleId,
+    collected_at: new Date().toISOString(),
+  };
+}
+
+// Code-scanning alerts per repository, fetched once and cached: several merged
+// pull requests share a repository, and the alerts API is per-repo not per-PR.
+const alertCache = new Map();
+async function scannerFindings(repo) {
+  if (process.env.SKIP_SARIF) return { findings: [], problems: [] };
+  if (alertCache.has(repo)) return alertCache.get(repo);
+
+  let result = { findings: [], problems: [] };
+  try {
+    const response = await fetch(
+      `https://api.github.com/repos/${repo}/code-scanning/alerts?per_page=100&state=open`,
+      { headers: { authorization: `Bearer ${GH_TOKEN}`, accept: 'application/vnd.github+json', 'user-agent': 'redline' } }
+    );
+    // 404 means code scanning is not enabled here, which is a fact about the
+    // repository and not a failure of this run. 403 usually means the token
+    // cannot see security data — also not a failure worth stopping for.
+    if (response.ok) {
+      result = ingestAlerts(await response.json(), { where: repo });
+    } else if (response.status !== 404 && response.status !== 403) {
+      result = { findings: [], problems: [`${repo}: code-scanning alerts returned ${response.status}`] };
+    }
+  } catch (error) {
+    result = { findings: [], problems: [`${repo}: could not read code-scanning alerts (${error.message})`] };
+  }
+
+  alertCache.set(repo, result);
+  return result;
+}
+
+const records = [];
+let cursor = null;
+let page = 0;
+do {
+  const data = await graphql(QUERY, { q: `org:${ORG} is:pr is:merged merged:>=${since}`, cursor });
+  const search = data.search;
+  for (const pr of search.nodes) {
+    if (!pr?.repository) continue;
+    const record = summarise(pr);
+    const scanner = await scannerFindings(record.repo);
+    for (const problem of scanner.problems) console.warn(`  ${problem}`);
+    // Kept as its own key, never folded into `findings` or `rules`. Those two are
+    // Redline's own catalogue and drive rule tuning; mixing a scanner's rule ids
+    // into them is exactly the distortion this design exists to prevent.
+    //
+    // `repo_scoped` says what this number is: code-scanning alerts are a fact
+    // about the REPOSITORY, not about this pull request. Stamping the same count
+    // on every merged PR and then summing them multiplied the estate's ingested
+    // findings by the number of pull requests per repo — a repo with 12 alerts
+    // and 40 merges reported 480. The aggregate counts each repository once.
+    record.scanner = {
+      repo_scoped: true,
+      findings: scanner.findings.length,
+      by_tool: scanner.findings.reduce((acc, f) => {
+        acc[f.tool] = (acc[f.tool] ?? 0) + 1;
+        return acc;
+      }, {}),
+      by_severity: scanner.findings.reduce((acc, f) => {
+        acc[f.severity.toLowerCase()] = (acc[f.severity.toLowerCase()] ?? 0) + 1;
+        return acc;
+      }, {}),
+    };
+    records.push(record);
+  }
+  cursor = search.pageInfo.hasNextPage ? search.pageInfo.endCursor : null;
+  page += 1;
+  console.log(`page ${page}: ${records.length} PRs so far`);
+  // GitHub search caps at 1000 results per query. Past that the window is too wide;
+  // shorten DAYS rather than silently under-reporting.
+  if (records.length >= 1000) {
+    console.warn(`search result cap reached at ${records.length} PRs — narrow DAYS/SINCE, numbers are truncated`);
+    break;
+  }
+} while (cursor);
+
+if (DRY_RUN) {
+  console.log(JSON.stringify(records.slice(0, 3), null, 2));
+  console.log(`dry run: ${records.length} records, nothing written`);
+  process.exit(0);
+}
+
+// Append idempotently: re-running for an overlapping window must not double-count.
+mkdirSync(OUT, { recursive: true });
+const byMonth = new Map();
+for (const record of records) {
+  const month = (record.merged_at ?? '').slice(0, 7);
+  if (!month) continue;
+  if (!byMonth.has(month)) byMonth.set(month, []);
+  byMonth.get(month).push(record);
+}
+
+let written = 0;
+for (const [month, monthRecords] of byMonth) {
+  const file = join(OUT, `${month}.jsonl`);
+  const existing = new Map();
+  if (existsSync(file)) {
+    for (const line of readFileSync(file, 'utf8').split('\n')) {
+      if (!line.trim()) continue;
+      try {
+        const parsed = JSON.parse(line);
+        existing.set(`${parsed.repo}#${parsed.pr}`, parsed);
+      } catch {
+        console.warn(`  skipping unparseable line in ${file}`);
+      }
+    }
+  }
+  for (const record of monthRecords) existing.set(`${record.repo}#${record.pr}`, record);
+
+  const sorted = [...existing.values()].sort((a, b) =>
+    (a.merged_at ?? '').localeCompare(b.merged_at ?? '')
+  );
+  writeFileSync(file, sorted.map((r) => JSON.stringify(r)).join('\n') + '\n');
+  written += monthRecords.length;
+  console.log(`${file}: ${sorted.length} total records (${monthRecords.length} from this run)`);
+}
+
+console.log(`collected ${written} records since ${since}`);

package/scripts/lib/__tests__/baseline.test.mjs

@@ -0,0 +1,132 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { buildBaseline, formatBaseline, measured, unavailable } from '../baseline.mjs';
+
+const agg = (over = {}) => ({
+  findings: 100,
+  resolved: 70,
+  blocker: 20,
+  repos: 8,
+  untagged: 3,
+  exempted: 2,
+  ...over,
+});
+
+const input = (over = {}) => ({
+  aggregate: agg(),
+  windowDays: 90,
+  registry: { entries: new Array(10).fill({}) },
+  ...over,
+});
+
+test('the primary metric is resolved over fired', () => {
+  const baseline = buildBaseline(input());
+
+  assert.equal(baseline.primary.actedOnRate.value, 0.7);
+  assert.equal(baseline.primary.actedOnRate.available, true);
+});
+
+test('an unmeasurable figure is null with a reason, never zero', () => {
+  // A zero that means "nobody measured this" reads as a finding, and makes every
+  // later comparison look like progress that did not happen.
+  const baseline = buildBaseline(input({ registry: null }));
+
+  assert.equal(baseline.guardrails.coverage.onboarded.value, null);
+  assert.equal(baseline.guardrails.coverage.onboarded.available, false);
+  assert.match(baseline.guardrails.coverage.onboarded.reason, /registry\.json/);
+});
+
+test('coverage has no denominator when the register is unreadable', () => {
+  const baseline = buildBaseline(input({ registry: null }));
+
+  assert.equal(baseline.guardrails.coverage.ratio.available, false);
+});
+
+test('coverage is instrumented over onboarded, so partial coverage cannot read as health', () => {
+  const baseline = buildBaseline(input());
+
+  assert.equal(baseline.guardrails.coverage.ratio.value, 0.8);
+});
+
+test('an empty estate has no coverage ratio rather than a divide by zero', () => {
+  const baseline = buildBaseline(input({ registry: { entries: [] } }));
+
+  assert.equal(baseline.guardrails.coverage.ratio.available, false);
+  assert.match(baseline.guardrails.coverage.ratio.reason, /no meaning yet/);
+});
+
+test('acted-on rate is absent, not zero, when nothing fired', () => {
+  const baseline = buildBaseline(input({ aggregate: agg({ findings: 0, resolved: 0 }) }));
+
+  assert.equal(baseline.primary.actedOnRate.available, false);
+});
+
+test("Redline's own merge rate is absent until its pull requests are surveyed", () => {
+  const baseline = buildBaseline(input());
+
+  assert.equal(baseline.guardrails.ownPullRequestMergeRate.available, false);
+  assert.match(baseline.guardrails.ownPullRequestMergeRate.reason, /org read access/);
+});
+
+test("Redline's own merge rate is computed once its pull requests are known", () => {
+  const baseline = buildBaseline(
+    input({ ownPullRequests: [{ merged: true }, { merged: true }, { merged: false }, { merged: false }] })
+  );
+
+  assert.equal(baseline.guardrails.ownPullRequestMergeRate.value, 0.5);
+});
+
+test('no pull requests opened yet is absent, not a 0% merge rate', () => {
+  // 0% would say the estate is refusing Redline's changes. Nothing has been
+  // offered to it.
+  const baseline = buildBaseline(input({ ownPullRequests: [] }));
+
+  assert.equal(baseline.guardrails.ownPullRequestMergeRate.available, false);
+  assert.match(baseline.guardrails.ownPullRequestMergeRate.reason, /opened no pull requests/);
+});
+
+test('findings per week is derived from the window, not assumed weekly', () => {
+  const baseline = buildBaseline(input({ windowDays: 90 }));
+
+  assert.equal(Math.round(baseline.findings.perWeek.value * 100) / 100, 7.78);
+});
+
+test('SARIF producers are counted per tool once surveyed', () => {
+  const baseline = buildBaseline(
+    input({ sarifProducers: { 'a/one': ['CodeQL'], 'a/two': ['CodeQL', 'Semgrep'] } })
+  );
+
+  assert.deepEqual(baseline.sarifProducers.value, { CodeQL: 2, Semgrep: 1 });
+});
+
+test('cost per BLOCKER needs both halves and says which one is missing', () => {
+  const noSpend = buildBaseline(input());
+  assert.equal(noSpend.costPerBlockerCaught.available, false);
+  assert.match(noSpend.costPerBlockerCaught.reason, /spend unavailable/);
+
+  const noBlockers = buildBaseline(
+    input({ aggregate: agg({ blocker: 0 }), spend: { total: 100, currency: 'USD', grain: 'org' } })
+  );
+  assert.equal(noBlockers.costPerBlockerCaught.available, false);
+  assert.match(noBlockers.costPerBlockerCaught.reason, /nothing to divide/);
+});
+
+test('cost per BLOCKER is computed when both halves exist', () => {
+  const baseline = buildBaseline(
+    input({ spend: { total: 400, currency: 'USD', grain: 'org' } })
+  );
+
+  assert.equal(baseline.costPerBlockerCaught.value, 20);
+});
+
+test('the summary prints a reason for every absent figure, never a dash', () => {
+  const text = formatBaseline(buildBaseline(input({ registry: null })));
+
+  assert.match(text, /repositories onboarded\s+not available — .*registry\.json/);
+  assert.equal(text.includes(' — \n'), false);
+});
+
+test('measured and unavailable are the only two shapes', () => {
+  assert.deepEqual(measured(3), { value: 3, available: true });
+  assert.deepEqual(unavailable('why'), { value: null, available: false, reason: 'why' });
+});

package/scripts/lib/__tests__/correlate.test.mjs

@@ -0,0 +1,131 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { correlate, MIN_SAMPLE } from '../correlate.mjs';
+
+const day = (n) => new Date(Date.UTC(2026, 7, n)).toISOString();
+
+const pr = (over = {}) => ({
+  repo: 'acme/web',
+  title: 'feat: something',
+  merged_at: day(1),
+  rules: {},
+  ...over,
+});
+
+const ignoring = (ruleId, count, over = {}) =>
+  pr({ rules: { [ruleId]: { severity: 'BLOCKER', fired: count, resolved: 0, stale: count } }, ...over });
+
+test('an ignored finding followed by a revert in the same repo is counted', () => {
+  const result = correlate([
+    ignoring('react/effect-derived-state', MIN_SAMPLE, { merged_at: day(1) }),
+    pr({ merged_at: day(2), title: 'Revert "feat: something"' }),
+  ]);
+
+  const rule = result.rules.find((r) => r.ruleId === 'react/effect-derived-state');
+  assert.equal(rule?.followedByRemediation, MIN_SAMPLE);
+  assert.equal(rule?.rate, 1);
+});
+
+test('a revert outside the window does not attach', () => {
+  const result = correlate(
+    [ignoring('react/x', MIN_SAMPLE, { merged_at: day(1) }), pr({ merged_at: day(28), title: 'Revert "x"' })],
+    { windowDays: 7 }
+  );
+
+  assert.equal(result.rules[0]?.rate, 0);
+});
+
+test('a revert in another repository does not attach', () => {
+  const result = correlate([
+    ignoring('react/x', MIN_SAMPLE, { merged_at: day(1) }),
+    pr({ repo: 'acme/api', merged_at: day(2), title: 'Revert "x"' }),
+  ]);
+
+  assert.equal(result.rules[0]?.rate, 0);
+});
+
+test('a rule below the sample threshold gets no rate, and says why', () => {
+  // The rate exists arithmetically and means nothing. Publishing it anyway is how
+  // a coincidence becomes a rule nobody can argue with.
+  const result = correlate([
+    ignoring('react/x', 3, { merged_at: day(1) }),
+    pr({ merged_at: day(2), title: 'Revert "x"' }),
+  ]);
+
+  assert.equal(result.rules[0]?.rate, null);
+  assert.equal(result.rules[0]?.reportable, false);
+  assert.match(result.rules[0]?.reason ?? '', /at least 10 are needed/);
+});
+
+test("a remediation's own ignored findings are not evidence about what it remedied", () => {
+  // Counting them would let one incident inflate every rule that fired on the fix.
+  const result = correlate([
+    pr({ merged_at: day(1), title: 'hotfix: patch', rules: { 'react/x': { severity: 'HIGH', stale: 5 } } }),
+  ]);
+
+  assert.deepEqual(result.rules, []);
+  assert.equal(result.unattributable, 5);
+});
+
+test('the verdict refuses when no rule reaches the threshold', () => {
+  // The honest output of a weak experiment is "we cannot say".
+  const result = correlate([ignoring('react/x', 2, { merged_at: day(1) })]);
+
+  assert.equal(result.verdict.reportable, false);
+  assert.match(result.verdict.reason, /too weak to report/);
+});
+
+test('nothing ignored is a good result, not a failed experiment', () => {
+  const result = correlate([pr()]);
+
+  assert.equal(result.verdict.reportable, false);
+  assert.match(result.verdict.reason, /good result, not a failed experiment/);
+});
+
+test('a reportable verdict carries its caveat and says what was withheld', () => {
+  const result = correlate([
+    ignoring('react/reported', MIN_SAMPLE, { merged_at: day(1) }),
+    ignoring('react/withheld', 2, { merged_at: day(3) }),
+    pr({ merged_at: day(2), title: 'Revert "x"' }),
+  ]);
+
+  assert.equal(result.verdict.reportable, true);
+  assert.equal(result.verdict.rulesReported, 1);
+  assert.equal(result.verdict.rulesWithheld, 1);
+  assert.match(result.verdict.caveat, /Correlation, not causation/);
+});
+
+test('rules are ordered with the strongest signal first', () => {
+  // A five-day window puts the revert inside `strong`'s window and outside
+  // `weak`'s, so the two genuinely differ rather than tying at 1.
+  const result = correlate(
+    [
+      ignoring('react/weak', MIN_SAMPLE, { merged_at: day(1) }),
+      ignoring('react/strong', MIN_SAMPLE, { merged_at: day(10) }),
+      pr({ merged_at: day(11), title: 'Revert "x"' }),
+    ],
+    { windowDays: 5 }
+  );
+
+  assert.equal(result.rules[0]?.ruleId, 'react/strong');
+  assert.equal(result.rules[0]?.rate, 1);
+  assert.equal(result.rules[1]?.rate, 0);
+});
+
+test('an unreportable rule sorts below every reportable one, whatever its arithmetic rate', () => {
+  const result = correlate([
+    ignoring('react/tiny-but-perfect', 2, { merged_at: day(1) }),
+    ignoring('react/real', MIN_SAMPLE, { merged_at: day(1) }),
+    pr({ merged_at: day(2), title: 'Revert "x"' }),
+  ]);
+
+  assert.equal(result.rules[0]?.ruleId, 'react/real');
+  assert.equal(result.rules[1]?.reportable, false);
+});
+
+test('an empty history correlates nothing rather than dividing by zero', () => {
+  const result = correlate([]);
+
+  assert.deepEqual(result.rules, []);
+  assert.equal(result.verdict.reportable, false);
+});

package/scripts/lib/__tests__/dora.test.mjs

@@ -0,0 +1,110 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { changeFailureRate, deploymentFrequency, dora, leadTimes, median } from '../dora.mjs';
+
+const at = (iso) => new Date(iso).toISOString();
+const pr = (over = {}) => ({
+  repo: 'acme/web',
+  title: 'feat: something',
+  merged_at: at('2026-08-10T12:00:00Z'),
+  first_commit_at: at('2026-08-09T12:00:00Z'),
+  ...over,
+});
+
+test('lead time is first commit to merge, in hours', () => {
+  assert.deepEqual(leadTimes([pr()]), [24]);
+});
+
+test('a pull request with no first-commit timestamp is skipped, not counted as zero', () => {
+  // Zero lead time would drag the median toward a number no team achieved.
+  assert.deepEqual(leadTimes([pr({ first_commit_at: undefined })]), []);
+});
+
+test('a rebase that moves the commit past the merge is skipped, not reported negative', () => {
+  assert.deepEqual(leadTimes([pr({ first_commit_at: at('2026-08-11T12:00:00Z') })]), []);
+});
+
+test('the median is reported, because a mean is dragged by one stale branch', () => {
+  assert.equal(median([1, 2, 3, 400]), 2.5);
+  assert.equal(median([1, 2, 3]), 2);
+  assert.equal(median([]), null);
+});
+
+test('a revert after a merge counts that merge as a failure', () => {
+  const result = changeFailureRate([
+    pr({ merged_at: at('2026-08-10T00:00:00Z') }),
+    pr({ merged_at: at('2026-08-11T00:00:00Z'), title: 'Revert "feat: something"' }),
+  ]);
+
+  assert.equal(result.failures, 1);
+  assert.equal(result.total, 2);
+});
+
+test('the revert itself is not counted as a failure of its own', () => {
+  // Otherwise every incident scores twice and the estate looks half-broken.
+  const result = changeFailureRate([
+    pr({ merged_at: at('2026-08-10T00:00:00Z') }),
+    pr({ merged_at: at('2026-08-11T00:00:00Z'), title: 'Revert "feat: something"' }),
+    pr({ merged_at: at('2026-08-12T00:00:00Z'), title: 'hotfix: patch it' }),
+  ]);
+
+  assert.equal(result.failures, 1);
+});
+
+test('a revert outside the window does not attach to the merge', () => {
+  const result = changeFailureRate([
+    pr({ merged_at: at('2026-08-01T00:00:00Z') }),
+    pr({ merged_at: at('2026-08-20T00:00:00Z'), title: 'Revert "feat: something"' }),
+  ]);
+
+  assert.equal(result.failures, 0);
+});
+
+test('a revert in another repository does not attach', () => {
+  const result = changeFailureRate([
+    pr({ merged_at: at('2026-08-10T00:00:00Z') }),
+    pr({ repo: 'acme/api', merged_at: at('2026-08-11T00:00:00Z'), title: 'Revert "x"' }),
+  ]);
+
+  assert.equal(result.failures, 0);
+});
+
+test('the rate is null, not zero, when there is nothing to divide', () => {
+  const result = changeFailureRate([]);
+
+  assert.equal(result.rate, null);
+  assert.match(result.reason, /no merged pull requests/);
+});
+
+test('the caveat travels with the number, because the number will be quoted', () => {
+  const result = changeFailureRate([pr()]);
+
+  assert.match(result.caveat, /floor, not the true rate/);
+});
+
+test('deployment frequency is unknown, not zero, without the deployments API', () => {
+  // Assuming one deploy per merge reports a trunk-based team and a
+  // quarterly-release team as identical — the exact distinction the metric draws.
+  const result = deploymentFrequency(null, 90);
+
+  assert.equal(result.perDay, null);
+  assert.match(result.reason, /unknown, not zero/);
+});
+
+test('deployment frequency is computed when deployments are supplied', () => {
+  assert.equal(deploymentFrequency(new Array(90).fill({}), 90).perDay, 1);
+});
+
+test('MTTR is refused by name, so nobody wonders whether it was forgotten', () => {
+  const result = dora([pr()]);
+
+  assert.equal(result.meanTimeToRestore.value, null);
+  assert.match(result.meanTimeToRestore.reason, /incident feed/);
+});
+
+test('lead time reports a reason when nothing in the window carries a timestamp', () => {
+  const result = dora([pr({ first_commit_at: undefined })]);
+
+  assert.equal(result.leadTimeHours.median, null);
+  assert.match(result.leadTimeHours.reason, /first-commit timestamp/);
+});