sdd-agent-platform 0.3.0 → 0.4.1

package/node_modules/@sdd-agent-platform/core/src/artifacts/ingestion.test.ts

@@ -0,0 +1,189 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { DatabaseSync } from 'node:sqlite';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+
+import { buildEvidenceSummaryProjection } from '../context/evidence-summary.js';
+import { initProject } from '../config/init-project.js';
+import { createDelegationRecord } from '../delegation/validation.js';
+import { appendEvent, readRunEvents } from '../run-state/events.js';
+import { writeArtifact } from '../run-state/artifacts.js';
+import { createRun, readRunState, writeRunState } from '../run-state/run-state.js';
+import { validResultArtifact, validTaskMarkdown, validTrustEvidence, writeBranchDocs } from '../test-support/fixtures.js';
+import { bindTestRunState } from '../test-support/run-state.js';
+import { getRuntimeStorePath } from '../runtime-paths.js';
+import { ingestArtifactResult, inspectArtifactResultIngestions } from './ingestion.js';
+
+test('ingestArtifactResult accepts valid artifact and is idempotent', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-artifact-ingest-valid-'));
+  try {
+    await initProject(root);
+    const state = await createRun(root, { runId: 'run-1' });
+    const delegation = createDelegationRecord({
+      delegationId: 'D-T1-reviewer-001',
+      task: 'T1',
+      agent: 'reviewer',
+      expectedArtifact: 'artifacts/review-T1.md'
+    });
+    await writeRunState(root, { ...state, delegations: { [delegation.delegationId]: delegation } });
+    await appendEvent(root, state.runId, { event: 'delegation_started', runId: state.runId, data: { delegationId: delegation.delegationId } });
+    await writeArtifact(root, state.runId, 'review-T1.md', `# Review
+
+\`\`\`sdd-result
+contract: sdd-result-v1
+version: 1.3.0
+agent: reviewer
+task: T1
+status: PASS
+artifacts:
+  - artifacts/review-T1.md
+\`\`\`
+`);
+
+    const first = await ingestArtifactResult(root, state.runId, { delegationId: delegation.delegationId, artifactPath: 'artifacts/review-T1.md' });
+    const second = await ingestArtifactResult(root, state.runId, { delegationId: delegation.delegationId, artifactPath: 'artifacts/review-T1.md' });
+    const nextState = await readRunState(root, state.runId);
+    const inspection = await inspectArtifactResultIngestions(root, state.runId);
+    const events = await readRunEvents(root, state.runId);
+
+    assert.equal(first.valid, true);
+    assert.equal(first.duplicate, false);
+    assert.equal(first.record.status, 'accepted');
+    assert.equal(first.record.delegationStatus, 'COMPLETED');
+    assert.equal(second.valid, true);
+    assert.equal(second.duplicate, true);
+    assert.equal(nextState.delegations[delegation.delegationId].status, 'COMPLETED');
+    assert.equal(nextState.artifacts.filter((artifact) => artifact.path === 'artifacts/review-T1.md').length, 1);
+    assert.equal(inspection.valid, true);
+    assert.equal(inspection.records.length, 1);
+    assert.equal(events.some((event) => event.event === 'artifact_ingested'), true);
+    assert.equal(events.some((event) => event.event === 'delegation_completed'), true);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('ingestArtifactResult rejects invalid artifact without accepted evidence', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-artifact-ingest-invalid-'));
+  try {
+    await initProject(root);
+    const state = await createRun(root, { runId: 'run-1' });
+    const delegation = createDelegationRecord({
+      delegationId: 'D-T1-validator-001',
+      task: 'T1',
+      agent: 'validator',
+      expectedArtifact: 'artifacts/validation-T1.md'
+    });
+    await writeRunState(root, { ...state, delegations: { [delegation.delegationId]: delegation } });
+    await appendEvent(root, state.runId, { event: 'delegation_started', runId: state.runId, data: { delegationId: delegation.delegationId } });
+    await writeArtifact(root, state.runId, 'validation-T2.md', `# Validation
+
+\`\`\`sdd-result
+contract: sdd-result-v1
+version: 1.3.0
+agent: validator
+task: T2
+status: PASS
+artifacts:
+  - artifacts/validation-T2.md
+\`\`\`
+`);
+
+    const result = await ingestArtifactResult(root, state.runId, { delegationId: delegation.delegationId, artifactPath: 'artifacts/validation-T2.md' });
+    const nextState = await readRunState(root, state.runId);
+    const inspection = await inspectArtifactResultIngestions(root, state.runId);
+    const events = await readRunEvents(root, state.runId);
+
+    assert.equal(result.valid, false);
+    assert.equal(result.record.status, 'rejected');
+    assert.equal(result.record.issues.some((issue) => issue.field === 'task'), true);
+    assert.equal(nextState.delegations[delegation.delegationId].status, 'RECOVERABLE');
+    assert.equal(nextState.artifacts.length, 0);
+    assert.equal(inspection.valid, true);
+    assert.equal(events.some((event) => event.event === 'artifact_invalid'), true);
+    assert.equal(events.some((event) => event.event === 'artifact_ingestion_rejected'), true);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('ingestArtifactResult admits validator evidence claims into runtime store', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-artifact-evidence-admission-'));
+  try {
+    await initProject(root);
+    await writeBranchDocs(root, 'master', validTaskMarkdown('T1', []));
+    const state = await createRun(root, { runId: 'run-1' });
+    await bindTestRunState(root, state.runId, 'master', 'T1');
+    const boundState = await readRunState(root, state.runId);
+    const delegation = createDelegationRecord({
+      delegationId: 'D-T1-validator-001',
+      task: 'T1',
+      agent: 'validator',
+      expectedArtifact: 'artifacts/validation-T1.md'
+    });
+    await writeRunState(root, { ...boundState, delegations: { ...boundState.delegations, [delegation.delegationId]: delegation } });
+    await appendEvent(root, state.runId, { event: 'delegation_started', runId: state.runId, data: { delegationId: delegation.delegationId } });
+    await writeArtifact(root, state.runId, 'validation-T1.md', `${validResultArtifact('validator', 'T1', 'PASS', 'artifacts/validation-T1.md')}${validTrustEvidence('T1', 'AC-1', 'artifacts/validation-T1.md')}`);
+
+    const result = await ingestArtifactResult(root, state.runId, { delegationId: delegation.delegationId, artifactPath: 'artifacts/validation-T1.md' });
+    const summary = await buildEvidenceSummaryProjection(root, { runId: state.runId, taskId: 'T1' });
+    const db = new DatabaseSync(getRuntimeStorePath(root), { readOnly: true });
+    try {
+      const claim = db.prepare('SELECT partition, task_id, acceptance_id, coverage_status, source_artifact FROM evidence_claims WHERE run_id = ?').get(state.runId) as { partition?: string; task_id?: string; acceptance_id?: string; coverage_status?: string; source_artifact?: string } | undefined;
+      const policyDecision = db.prepare('SELECT decision_id FROM policy_decisions WHERE run_id = ?').get(state.runId) as { decision_id?: string } | undefined;
+      assert.equal(result.valid, true);
+      assert.equal(claim?.partition, 'master');
+      assert.equal(claim?.task_id, 'T1');
+      assert.equal(claim?.acceptance_id, 'AC-1');
+      assert.equal(claim?.coverage_status, 'PASS');
+      assert.equal(claim?.source_artifact, 'artifacts/validation-T1.md');
+      assert.equal(policyDecision, undefined);
+      assert.equal(summary.passCount, 1);
+      assert.equal(summary.highlights.some((highlight) => highlight.includes('admitted_claims=1')), true);
+    } finally {
+      db.close();
+    }
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('ingestArtifactResult records policy decisions for rejected derived evidence', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-artifact-policy-decision-'));
+  try {
+    await initProject(root);
+    await writeBranchDocs(root, 'master', validTaskMarkdown('T1', []));
+    const state = await createRun(root, { runId: 'run-1' });
+    await bindTestRunState(root, state.runId, 'master', 'T1');
+    const boundState = await readRunState(root, state.runId);
+    const delegation = createDelegationRecord({
+      delegationId: 'D-T1-validator-001',
+      task: 'T1',
+      agent: 'validator',
+      expectedArtifact: 'artifacts/validation-T1.md'
+    });
+    const derivedEvidence = `\n\`\`\`sdd-evidence\ncontract: sdd-evidence-v1\nversion: 1.0.0\ntask: T1\nacceptance: AC-1\nstatus: PASS\nclaim: Derived summary tries to prove AC-1.\nsource_artifact: artifacts/evidence-summary-T1.json\nevidence_refs:\n  - artifact:artifacts/context-package-T1.json\nprovenance_refs:\n  - artifact:artifacts/validation-T1.md\npolicy_refs:\n  - acceptance-policy-v1:require-source-evidence\n\`\`\`\n`;
+    await writeRunState(root, { ...boundState, delegations: { ...boundState.delegations, [delegation.delegationId]: delegation } });
+    await appendEvent(root, state.runId, { event: 'delegation_started', runId: state.runId, data: { delegationId: delegation.delegationId } });
+    await writeArtifact(root, state.runId, 'validation-T1.md', `${validResultArtifact('validator', 'T1', 'PASS', 'artifacts/validation-T1.md')}${derivedEvidence}`);
+
+    const result = await ingestArtifactResult(root, state.runId, { delegationId: delegation.delegationId, artifactPath: 'artifacts/validation-T1.md' });
+    const db = new DatabaseSync(getRuntimeStorePath(root), { readOnly: true });
+    try {
+      const claim = db.prepare('SELECT is_derived, source_artifact FROM evidence_claims WHERE run_id = ?').get(state.runId) as { is_derived?: number; source_artifact?: string } | undefined;
+      const decision = db.prepare('SELECT status, issue_codes FROM policy_decisions WHERE run_id = ?').get(state.runId) as { status?: string; issue_codes?: string } | undefined;
+      assert.equal(result.valid, false);
+      assert.equal(result.record.status, 'rejected');
+      assert.equal(claim?.is_derived, 1);
+      assert.equal(claim?.source_artifact, 'artifacts/evidence-summary-T1.json');
+      assert.equal(decision?.status, 'rejected');
+      assert.match(decision?.issue_codes ?? '', /DERIVED_SOURCE_EVIDENCE/);
+    } finally {
+      db.close();
+    }
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});

package/node_modules/@sdd-agent-platform/core/src/artifacts/ingestion.ts

@@ -0,0 +1,222 @@
+import { ARTIFACT_RESULT_INGESTION_CONTRACT_VERSION } from '../contracts.js';
+import { getRunRelativeArtifactPath, toArtifactRootRelativePath } from '../runtime-paths.js';
+import { artifactKind } from '../run-state/artifacts.js';
+import { appendEvent } from '../run-state/events.js';
+import type { RunState, RunStateArtifactIngestionRecord, RunStateContractValidationIssue, RunStateDelegationRecord, RunStateTaskGap } from '../run-state/model.js';
+import { readRunState, writeRunState } from '../run-state/run-state.js';
+import { runtimeScopedId, withRuntimeStore } from '../storage/runtime-store.js';
+import { taskGap } from '../sdd-docs/task-inspection.js';
+import { uniqueEvidenceIssueCodes } from '../context/evidence-summary.js';
+import { isDerivedEvidenceRef } from './sdd-evidence.js';
+import type { ArtifactTrustValidationReport } from './sdd-evidence.js';
+import { validateSddResultArtifact } from './sdd-result.js';
+import type { SddResultStatus } from './sdd-result.js';
+
+export type ArtifactResultIngestionStatus = 'accepted' | 'rejected';
+
+export interface ArtifactResultIngestionRecord extends RunStateArtifactIngestionRecord {
+  status: ArtifactResultIngestionStatus;
+}
+
+export interface ArtifactResultIngestionResult {
+  valid: boolean;
+  duplicate: boolean;
+  record: ArtifactResultIngestionRecord;
+  delegation: RunStateDelegationRecord | null;
+}
+
+export interface ArtifactResultIngestionInspection {
+  runId: string;
+  contract: typeof ARTIFACT_RESULT_INGESTION_CONTRACT_VERSION;
+  records: ArtifactResultIngestionRecord[];
+  valid: boolean;
+  issues: RunStateContractValidationIssue[];
+}
+
+export async function ingestArtifactResult(projectRoot: string, runId: string, input: { delegationId: string; artifactPath: string }): Promise<ArtifactResultIngestionResult> {
+  const state = await readRunState(projectRoot, runId);
+  const delegation = state.delegations[input.delegationId];
+  if (!delegation) {
+    throw new Error(`Unknown delegation ${input.delegationId} in run ${runId}.`);
+  }
+
+  const artifactPath = getRunRelativeArtifactPath(toArtifactRootRelativePath(input.artifactPath));
+  const key = artifactIngestionKey(input.delegationId, artifactPath);
+  const existing = (state.artifactIngestions ?? {})[key] as ArtifactResultIngestionRecord | undefined;
+  if (existing) {
+    return { valid: existing.status === 'accepted', duplicate: true, record: existing, delegation };
+  }
+
+  const report = await validateSddResultArtifact(projectRoot, runId, artifactPath, { expectedTask: delegation.task, expectedAgent: delegation.agent });
+  const issues = [...report.issues];
+  if (isDelegationTerminal(delegation.status)) {
+    issues.push(contractIssue('delegation', `Delegation ${delegation.delegationId} is already terminal with status ${delegation.status}.`, 'Do not ingest a new artifact into a terminal delegation; create a new delegation id for retry.'));
+  }
+  if (report.valid && delegation.status !== 'RUNNING') {
+    issues.push(contractIssue('delegation', `Delegation ${delegation.delegationId} must be RUNNING before accepting artifact ingestion.`, 'Start or retry the delegation before ingesting terminal result evidence.'));
+  }
+
+  const now = new Date().toISOString();
+  const targetStatus = report.valid && report.result ? delegationStatusFromResultStatus(report.result.status) : null;
+  const accepted = issues.length === 0 && report.valid && report.result !== null && targetStatus !== null;
+  const gaps = report.result ? artifactIngestionGaps(delegation, report.result.status) : [];
+  const record: ArtifactResultIngestionRecord = {
+    contract: ARTIFACT_RESULT_INGESTION_CONTRACT_VERSION,
+    runId,
+    delegationId: delegation.delegationId,
+    task: delegation.task,
+    agent: delegation.agent,
+    artifactPath,
+    status: accepted ? 'accepted' : 'rejected',
+    resultStatus: report.result?.status ?? null,
+    delegationStatus: accepted ? targetStatus : (report.valid ? null : 'RECOVERABLE'),
+    ingestedAt: now,
+    issues,
+    gaps: accepted ? gaps : []
+  };
+
+  const nextDelegation = accepted
+    ? { ...delegation, status: targetStatus, expectedArtifact: artifactPath, terminalEventAt: now }
+    : report.valid || delegation.status !== 'RUNNING'
+      ? delegation
+      : { ...delegation, status: 'RECOVERABLE' as const, expectedArtifact: artifactPath };
+  const knownArtifacts = new Set(state.artifacts.map((artifact) => artifact.path));
+  const nextArtifacts = accepted && !knownArtifacts.has(artifactPath)
+    ? [...state.artifacts, { path: artifactPath, kind: artifactKind(artifactPath), task: delegation.task, agent: delegation.agent, createdAt: now }]
+    : state.artifacts;
+
+  await writeRunState(projectRoot, {
+    ...state,
+    status: accepted && targetStatus === 'COMPLETED' ? state.status : accepted && targetStatus !== 'COMPLETED' ? 'blocked' : state.status,
+    delegations: {
+      ...state.delegations,
+      [delegation.delegationId]: nextDelegation
+    },
+    artifacts: nextArtifacts,
+    artifactIngestions: {
+      ...(state.artifactIngestions ?? {}),
+      [key]: record
+    }
+  });
+  await recordRuntimeArtifactIngestion(projectRoot, record);
+  await recordRuntimeEvidenceAdmission(projectRoot, state, record, report.trust);
+
+  if (!accepted && delegation.status === 'RUNNING' && !report.valid) {
+    await appendEvent(projectRoot, runId, { event: 'artifact_invalid', runId, summary: `Artifact ingestion rejected for ${delegation.delegationId}`, data: { delegationId: delegation.delegationId, artifact: artifactPath, issues } });
+  }
+  await appendEvent(projectRoot, runId, { event: accepted ? 'artifact_ingested' : 'artifact_ingestion_rejected', runId, summary: `Artifact ingestion ${record.status} for ${delegation.delegationId}`, data: { delegationId: delegation.delegationId, artifact: artifactPath, status: record.resultStatus, issues } });
+  if (accepted) {
+    await appendEvent(projectRoot, runId, { event: terminalEventForDelegationStatus(targetStatus), runId, summary: `Delegation ${delegation.delegationId} finished through artifact ingestion`, data: { delegationId: delegation.delegationId, artifact: artifactPath, status: record.resultStatus } });
+  }
+  return { valid: accepted, duplicate: false, record, delegation: nextDelegation };
+}
+
+export async function inspectArtifactResultIngestions(projectRoot: string, runId: string): Promise<ArtifactResultIngestionInspection> {
+  const state = await readRunState(projectRoot, runId);
+  const records = Object.values(state.artifactIngestions ?? {}).sort((left, right) => left.ingestedAt.localeCompare(right.ingestedAt)) as ArtifactResultIngestionRecord[];
+  const issues: RunStateContractValidationIssue[] = [];
+  const hasLedger = Object.prototype.hasOwnProperty.call(state, 'artifactIngestions');
+  const artifactPaths = new Set(state.artifacts.map((artifact) => artifact.path));
+
+  for (const record of records) {
+    const delegation = state.delegations[record.delegationId];
+    if (!delegation) {
+      issues.push(contractIssue('delegation', `Ingestion record references missing delegation ${record.delegationId}.`, 'Restore the delegation state or remove the invalid ingestion record from the run evidence.'));
+      continue;
+    }
+    const report = await validateSddResultArtifact(projectRoot, runId, record.artifactPath, { expectedTask: record.task, expectedAgent: record.agent });
+    if (record.status === 'accepted') {
+      if (!report.valid) {
+        issues.push(contractIssue('artifact', `Accepted ingestion artifact ${record.artifactPath} is no longer valid.`, 'Restore the accepted sdd-result artifact or mark the delegation with a new retry id.'));
+      }
+      if (delegation.expectedArtifact !== record.artifactPath || delegation.status !== record.delegationStatus) {
+        issues.push(contractIssue('delegation', `Accepted ingestion ${record.delegationId}/${record.artifactPath} does not match delegation state.`, 'Keep delegation expectedArtifact/status aligned with accepted artifact ingestion evidence.'));
+      }
+      if (!artifactPaths.has(record.artifactPath)) {
+        issues.push(contractIssue('artifacts', `Accepted ingestion artifact ${record.artifactPath} is missing from run artifact index.`, 'Add accepted artifact evidence to state.artifacts through artifact ingestion.'));
+      }
+    } else if (artifactPaths.has(record.artifactPath)) {
+      issues.push(contractIssue('artifacts', `Rejected ingestion artifact ${record.artifactPath} is present in run artifact index.`, 'Rejected artifacts must not be indexed as accepted run evidence.'));
+    }
+  }
+
+  if (hasLedger) {
+    for (const delegation of Object.values(state.delegations)) {
+      if (isDelegationTerminal(delegation.status) && delegation.expectedArtifact) {
+        const key = artifactIngestionKey(delegation.delegationId, delegation.expectedArtifact);
+        if (!(state.artifactIngestions ?? {})[key]) {
+          issues.push(contractIssue('artifactIngestions', `Terminal delegation ${delegation.delegationId} has no artifact ingestion record for ${delegation.expectedArtifact}.`, 'Ingest terminal artifact evidence through the Phase 3.6 artifact ingestion API.'));
+        }
+      }
+    }
+  }
+
+  return { runId, contract: ARTIFACT_RESULT_INGESTION_CONTRACT_VERSION, records, valid: issues.length === 0, issues };
+}
+
+async function recordRuntimeArtifactIngestion(projectRoot: string, record: ArtifactResultIngestionRecord): Promise<void> {
+  await withRuntimeStore(projectRoot, ({ db }) => {
+    db.prepare('INSERT OR REPLACE INTO artifact_ingestions (ingestion_id, run_id, delegation_id, task_id, agent, artifact_path, status, result_status, ingested_at, payload_json) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)')
+      .run(runtimeScopedId(record.runId, record.delegationId, record.artifactPath), record.runId, record.delegationId, record.task, record.agent, record.artifactPath, record.status, record.resultStatus, record.ingestedAt, JSON.stringify(record));
+  });
+}
+
+async function recordRuntimeEvidenceAdmission(projectRoot: string, state: RunState, ingestion: ArtifactResultIngestionRecord, trust: ArtifactTrustValidationReport | undefined): Promise<void> {
+  const now = new Date().toISOString();
+  await withRuntimeStore(projectRoot, ({ db }) => {
+    for (const claim of trust?.claims ?? []) {
+      db.prepare('INSERT OR REPLACE INTO evidence_claims (claim_id, run_id, partition, task_id, acceptance_id, coverage_status, source_artifact, is_derived, created_at, payload_json) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)')
+        .run(runtimeScopedId(ingestion.runId, claim.task, claim.acceptance, claim.sourceArtifact), ingestion.runId, state.partition, claim.task, claim.acceptance, claim.status, claim.sourceArtifact, isDerivedEvidenceRef(claim.sourceArtifact) ? 1 : 0, now, JSON.stringify(claim));
+    }
+    const issueCodes = uniqueEvidenceIssueCodes(trust?.issues ?? ingestion.issues);
+    if ((trust?.issues.length ?? ingestion.issues.length) > 0 || ingestion.status === 'rejected') {
+      db.prepare('INSERT OR REPLACE INTO policy_decisions (decision_id, run_id, task_id, acceptance_id, status, issue_codes, created_at, payload_json) VALUES (?, ?, ?, ?, ?, ?, ?, ?)')
+        .run(runtimeScopedId(ingestion.runId, ingestion.delegationId, ingestion.artifactPath, 'admission'), ingestion.runId, ingestion.task, null, ingestion.status, issueCodes.join(','), now, JSON.stringify({ ingestion, trust: trust ?? null }));
+    }
+  });
+}
+
+function artifactIngestionKey(delegationId: string, artifactPath: string): string {
+  return `${delegationId}:${artifactPath}`;
+}
+
+function isDelegationTerminal(status: RunStateDelegationRecord['status']): boolean {
+  return status === 'COMPLETED' || status === 'FAILED' || status === 'TIMED_OUT' || status === 'CANCELLED';
+}
+
+function delegationStatusFromResultStatus(status: SddResultStatus): RunStateDelegationRecord['status'] {
+  if (status === 'PASS' || status === 'PASS_WITH_GAPS') {
+    return 'COMPLETED';
+  }
+  if (status === 'TIMED_OUT') {
+    return 'TIMED_OUT';
+  }
+  if (status === 'CANCELLED') {
+    return 'CANCELLED';
+  }
+  return 'FAILED';
+}
+
+function terminalEventForDelegationStatus(status: RunStateDelegationRecord['status']): string {
+  if (status === 'COMPLETED') {
+    return 'delegation_completed';
+  }
+  if (status === 'TIMED_OUT') {
+    return 'delegation_timeout';
+  }
+  if (status === 'CANCELLED') {
+    return 'delegation_cancelled';
+  }
+  return 'delegation_failed';
+}
+
+function artifactIngestionGaps(delegation: RunStateDelegationRecord, status: SddResultStatus): RunStateTaskGap[] {
+  if (status === 'PASS') {
+    return [];
+  }
+  return [taskGap(delegation.task, delegation.agent, `Artifact ingestion returned ${status} for ${delegation.delegationId}.`, 'Inspect the ingested artifact evidence before test or sync-back apply.')];
+}
+
+function contractIssue(field: string, message: string, recommendation: string): RunStateContractValidationIssue {
+  return { field, message, recommendation };
+}

package/node_modules/@sdd-agent-platform/core/src/artifacts/sdd-evidence.test.ts

@@ -0,0 +1,28 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+import { validTrustEvidence } from '../test-support/fixtures.js';
+import { parseSddEvidenceMarkdown } from './sdd-evidence.js';
+
+test('parseSddEvidenceMarkdown validates policy-backed acceptance evidence', () => {
+  const report = parseSddEvidenceMarkdown(validTrustEvidence('T1', 'AC-1', 'artifacts/validation-T1.md'), {
+    expectedTask: 'T1',
+    sourceArtifact: 'artifacts/validation-T1.md'
+  });
+
+  assert.equal(report.valid, true);
+  assert.equal(report.claims.length, 1);
+  assert.equal(report.claims[0].acceptance, 'AC-1');
+  assert.equal(report.claims[0].evidence[0].ref, 'npm test');
+});
+
+test('parseSddEvidenceMarkdown rejects task mismatch and derived source evidence', () => {
+  const report = parseSddEvidenceMarkdown(`\n\`\`\`sdd-evidence\ncontract: sdd-evidence-v1\nversion: 1.0.0\ntask: T2\nacceptance: AC-1\nstatus: PASS\nclaim: Validation proves AC-1.\nsource_artifact: artifacts/acceptance-coverage-T1.md\nevidence_refs:\n  - artifact:artifacts/acceptance-coverage-T1.md\nprovenance_refs:\n  - artifact:artifacts/validation-T1.md\npolicy_refs:\n  - acceptance-policy-v1:require-source-evidence\n\`\`\`\n`, {
+    expectedTask: 'T1',
+    sourceArtifact: 'artifacts/validation-T1.md'
+  });
+
+  assert.equal(report.valid, false);
+  assert.equal(report.issues.some((issue) => issue.message.includes('POLICY_RULE_FAILED')), true);
+  assert.equal(report.issues.some((issue) => issue.message.includes('DERIVED_SOURCE_EVIDENCE')), true);
+});