sdd-agent-platform 0.4.0 → 0.4.1

package/node_modules/@sdd-agent-platform/core/src/verification/test-runtime.test.ts

@@ -16,6 +16,7 @@ import { runGoalVerify } from './goal-verify.js';
 import { inspectSyncBack } from '../sync-back/inspect.js';
 import { routeSddTask } from '../router/route-sdd-task.js';
 import { doctor } from '../doctor/doctor.js';
+import { getProjectStatus } from '../status/project-status.js';
 
 function mappedValidationTaskMarkdown(taskId: string, command: string): string {
   return `# Tasks
@@ -48,6 +49,10 @@ Stay in validation runtime fixtures only.
 `;
 }
 
+function capabilityMappedValidationTaskMarkdown(taskId: string, command: string): string {
+  return mappedValidationTaskMarkdown(taskId, command).replace('risk: []', 'risk:\n  - security');
+}
+
 function sourceBoundaryMappedValidationTaskMarkdown(taskId: string, command: string): string {
   return mappedValidationTaskMarkdown(taskId, command).replace(
     `docs/${taskId.toLowerCase()}.md`,
@@ -78,18 +83,23 @@ test('runSddTest captures command output and indexes test evidence', async () =>
     assert.equal(result.policyJudgment, 'BLOCKED');
     assert.equal(result.syncBackReady, false);
     assert.equal(result.steps.length, 1);
-    assert.equal(result.validationArtifact, 'artifacts/validation-T1.md');
+    assert.equal(result.validationArtifact, 'artifacts/test-validation-T1.md');
     assert.equal(result.indexArtifact, 'artifacts/test-index-T1.json');
+    assert.equal(result.capabilityEvidence.length > 0, true);
+    assert.equal(result.capabilityEvidence.some((item) => item.class === 'accepted'), false);
+    assert.equal(result.capabilityEvidence.some((item) => item.class === 'quarantined' && item.source === 'external_source'), true);
+    assert.match(renderSddTestResult(result), /capability_evidence=/);
 
     const state = await readRunState(root, result.runId);
     assert.equal(state.phase, 'test');
     assert.equal(state.validation.status, 'blocked');
-    assert.equal(state.validation.evidence.includes('artifacts/validation-T1.md'), true);
+    assert.equal(state.validation.evidence.includes('artifacts/test-validation-T1.md'), true);
 
-    const validation = await readArtifact(root, result.runId, 'validation-T1.md');
+    const validation = await readArtifact(root, result.runId, 'test-validation-T1.md');
     assert.match(validation, /```sdd-result/);
     assert.doesNotMatch(validation, /```sdd-evidence/);
     assert.match(validation, /not explicitly mapped/);
+    assert.match(validation, /## Capability Evidence Classification/);
     const ledger = await listInvocationLedgerEntries(root, result.runId);
     assert.equal(ledger.some((entry) => entry.kind === 'command' && entry.ref === 'node -e "process.stdout.write(\'ok\')"' && entry.status === 'pass'), true);
 
@@ -145,8 +155,8 @@ test('runSddTest executes argv commands without shell and records argv evidence'
   }
 });
 
-test('runSddTest creates missing verify contract before executing commands', async () => {
-  const root = await mkdtemp(path.join(tmpdir(), 'sdd-test-runtime-create-verify-'));
+test('runSddTest blocks on missing verify contract without creating it', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-test-runtime-missing-verify-'));
   try {
     await initProject(root);
     await writeBranchDocs(root, 'feature', mappedValidationTaskMarkdown('T1', 'node -e "process.stdout.write(\'ok\')"'));
@@ -156,25 +166,25 @@ test('runSddTest creates missing verify contract before executing commands', asy
       taskId: 'T1',
       commands: ['node -e "process.stdout.write(\'ok\')"']
     });
-    const verify = await readFile(path.join(root, 'specs', 'feature', 'verify.md'), 'utf8');
 
-    assert.equal(result.verifyContractStatus, 'PASS');
-    assert.equal(result.verifyContractAction, 'created');
-    assert.equal(result.status, 'PASS');
-    assert.match(verify, /author_role: verification-designer/);
-    assert.match(verify, /independent_from_roles:\n  - task-planner\n  - implementer/);
+    await assert.rejects(readFile(path.join(root, 'specs', 'feature', 'verify.md'), 'utf8'));
+    assert.equal(result.verifyContractStatus, 'BLOCKED');
+    assert.equal(result.verifyContractAction, 'blocked');
+    assert.equal(result.status, 'BLOCKED');
+    assert.equal(result.steps.length, 0);
+    assert.match(result.gaps.join('\n'), /Verification contract document is missing/);
   } finally {
     await rm(root, { recursive: true, force: true });
   }
 });
 
-test('runSddTest refreshes stale verify contract before executing commands', async () => {
-  const root = await mkdtemp(path.join(tmpdir(), 'sdd-test-runtime-refresh-verify-'));
+test('runSddTest blocks on stale verify contract without refreshing it', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-test-runtime-stale-verify-'));
   try {
     await initProject(root);
     await writeBranchDocs(root, 'feature', mappedValidationTaskMarkdown('T1', 'node -e "process.stdout.write(\'ok\')"'));
     await writeVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
-    await writeFile(path.join(root, 'specs', 'feature', 'tasks.md'), `${mappedValidationTaskMarkdown('T1', 'node -e "process.stdout.write(\'ok\')"')}\n<!-- changed after verify -->\n`, 'utf8');
+    await writeFile(path.join(root, 'specs', 'feature', 'tasks.md'), mappedValidationTaskMarkdown('T1', 'node -e "process.stdout.write(\'ok\')"').replace('risk: []', 'risk:\n  - security'), 'utf8');
 
     const result = await runSddTest(root, {
       branch: 'feature',
@@ -183,12 +193,13 @@ test('runSddTest refreshes stale verify contract before executing commands', asy
     });
     const verify = await readFile(path.join(root, 'specs', 'feature', 'verify.md'), 'utf8');
 
-    assert.equal(result.verifyContractStatus, 'PASS');
-    assert.equal(result.verifyContractAction, 'refreshed');
-    assert.equal(result.commandStatus, 'PASS');
-    assert.equal(result.steps.length, 1);
-    assert.equal(result.status, 'PASS');
-    assert.match(verify, /\| T1 \|/);
+    assert.equal(result.verifyContractStatus, 'WARN');
+    assert.equal(result.verifyContractAction, 'blocked');
+    assert.equal(result.commandStatus, 'BLOCKED');
+    assert.equal(result.steps.length, 0);
+    assert.equal(result.status, 'BLOCKED');
+    assert.match(verify, /based_on_tasks_contract_hash:/);
+    assert.match(result.gaps.join('\n'), /stale for current tasks contract hash/);
   } finally {
     await rm(root, { recursive: true, force: true });
   }
@@ -219,8 +230,13 @@ test('runSddTest produces validator evidence accepted by goal verify', async ()
     assert.equal(verify.acceptanceCoverage.every((item) => item.status === 'PASS'), true);
     assert.equal(result.evidenceCoverage, 'complete');
     assert.equal(result.policyJudgment, 'PASS');
-    assert.equal(result.syncBackReady, true);
-    assert.match(result.next, /^sdd sync-back inspect /);
+    assert.equal(result.syncBackReady, false);
+    assert.equal(result.capabilityEvidence.length > 0, true);
+    assert.equal(result.capabilityEvidence.some((item) => item.class === 'accepted'), false);
+    assert.equal(result.capabilityEvidence.some((item) => item.class === 'quarantined' && item.source === 'external_source'), true);
+    const index = JSON.parse(await readArtifact(root, result.runId, 'test-index-T1.json')) as typeof result;
+    assert.deepEqual(index.capabilityEvidence, result.capabilityEvidence);
+    assert.match(result.next, /^sdd ship --branch feature --dry-run$/);
     const testState = await readRunState(root, result.runId);
     assert.equal(testState.syncBack.status, 'proposed');
     assert.equal(testState.syncBack.proposalPath, 'artifacts/sync-back-proposal.md');
@@ -237,6 +253,37 @@ test('runSddTest produces validator evidence accepted by goal verify', async ()
   }
 });
 
+test('runSddTest exposes candidate capability evidence without making it authoritative', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-test-runtime-capability-evidence-'));
+  try {
+    await initProject(root);
+    await writeBranchDocs(root, 'feature', capabilityMappedValidationTaskMarkdown('CAPABILITY', 'node -e "process.stdout.write(\'ok\')"'));
+    await writeVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
+
+    const result = await runSddTest(root, {
+      branch: 'feature',
+      taskId: 'CAPABILITY',
+      approved: true,
+      commands: ['node -e "process.stdout.write(\'ok\')"']
+    });
+
+    assert.equal(result.status, 'PASS');
+    assert.equal(result.policyJudgment, 'PASS');
+    assert.equal(result.capabilityEvidence.some((item) => item.class === 'candidate' && item.source === 'professional_capability' && item.domainOrSourceId === 'security-engineering'), true);
+    assert.equal(result.capabilityEvidence.some((item) => item.class === 'accepted'), false);
+    assert.equal(result.capabilityEvidence.some((item) => item.class === 'quarantined' && item.source === 'external_source'), true);
+    const index = JSON.parse(await readArtifact(root, result.runId, 'test-index-CAPABILITY.json')) as typeof result;
+    assert.deepEqual(index.capabilityEvidence, result.capabilityEvidence);
+    const validation = await readArtifact(root, result.runId, 'test-validation-CAPABILITY.md');
+    assert.match(validation, /\[candidate\] professional_capability:security-engineering/);
+    const status = await getProjectStatus(root, { branch: 'feature' });
+    assert.equal(status.capabilityHealth.activeDomains.includes('security-engineering'), false);
+    assert.equal(status.capabilityHealth.releaseCriticalGaps.includes('security-engineering'), true);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
 test('runSddTest records failing commands without promoting verification pass', async () => {
   const root = await mkdtemp(path.join(tmpdir(), 'sdd-test-runtime-fail-'));
   try {
@@ -319,7 +366,7 @@ test('runSddTest allows source-boundary validation after reviewer checkpoint pas
     assert.equal(result.lifecycleGate, 'review-before-test');
     assert.equal(result.commandStatus, 'PASS');
     assert.equal(result.steps.length, 1);
-    assert.match(result.next, /^sdd sync-back inspect /);
+    assert.match(result.next, /^sdd ship --branch feature --dry-run$/);
   } finally {
     await rm(root, { recursive: true, force: true });
   }
@@ -371,11 +418,11 @@ test('runSddTest blocks downstream validation until dependencies are completed',
     const blocked = await runSddTest(root, { branch: 'feature', taskId: 'DEP2', approved: true });
 
     assert.equal(blockedRoute.category, 'blocked');
-    assert.match(blockedRoute.blockedReason ?? '', /DEP2 depends on DEP1, but DEP1 status is pending/);
+    assert.match(blockedRoute.blockedReason ?? '', /DEP2 depends on DEP1, but DEP1 has not passed required verification/);
     assert.equal(blocked.status, 'BLOCKED');
     assert.equal(blocked.steps.length, 0);
     assert.equal(blocked.commandStatus, 'BLOCKED');
-    assert.match(blocked.gaps.join('\n'), /DEP2 depends on DEP1, but DEP1 status is pending/);
+    assert.match(blocked.gaps.join('\n'), /DEP2 depends on DEP1, but DEP1 has not passed required verification/);
 
     await writeBranchDocs(root, 'feature', `# Tasks\n\n${validTaskMarkdown('DEP1', []).replace('status: pending', 'status: completed')}\n${dep2}`);
     await writeVerifyContract(root, { branch: 'feature', branchSource: 'cli_option', force: true });