sdd-agent-platform 0.4.0 → 0.4.2

package/node_modules/@sdd-agent-platform/core/src/workflow-gate/hard-checks.test.ts

@@ -0,0 +1,507 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+
+import { STAGE_TEAM_RUNTIME_CONTRACT_VERSION } from '../contracts.js';
+import { initProject } from '../config/init-project.js';
+import { getEvidenceAttachmentPath } from '../runtime-paths.js';
+import { createRun } from '../run-state/run-state.js';
+import { createRuntimeEvidenceSet, listRuntimeRepairs, recordRuntimeArtifactPayload, recordRuntimeRepair, runtimeScopedId, updateRuntimeSelectionPointer } from '../storage/runtime-store.js';
+import { validTaskMarkdown, writeBranchDocs } from '../test-support/fixtures.js';
+import { bindTestRunState, markTestRunReadyForShip } from '../test-support/run-state.js';
+import { writeVerifyContract } from '../verification/verify-contract.js';
+import { buildOpenRepairRecord } from '../workflow-state/repair-contract.js';
+import { evaluateWorkflowGateHardChecks } from './hard-checks.js';
+import { buildWorkflowGateEvidencePacket, evaluateAndRecordWorkflowGateDecision } from './evidence-packet.js';
+import type { WorkflowGateEvidencePacket } from './types.js';
+
+const generatedAt = '2026-01-01T00:00:00.000Z';
+
+test('workflow gate hard checks block deterministic workflow violations', () => {
+  const checks = evaluateWorkflowGateHardChecks(packetInput({
+    durableGaps: [{
+      gapId: 'gap-001',
+      partition: 'feature',
+      taskId: 'T1',
+      runId: 'run-001',
+      stage: 'test',
+      gate: 'ship',
+      source: 'runtime',
+      category: 'validation',
+      severity: 'blocking',
+      status: 'open',
+      message: 'Validation evidence is missing.',
+      recommendation: null,
+      evidenceRefs: ['artifacts/validation-T1.md'],
+      proposalRefs: [],
+      sourceRefs: [],
+      createdAt: generatedAt,
+      updatedAt: generatedAt,
+      closedAt: null,
+      payload: {}
+    }],
+    fanInEvidenceSets: [{
+      contract: STAGE_TEAM_RUNTIME_CONTRACT_VERSION,
+      fanInId: 'fanin-001',
+      partition: 'feature',
+      runId: 'run-001',
+      taskId: 'T1',
+      stage: 'test',
+      roleResultIds: [],
+      durableGapIds: [],
+      proposalRefs: [],
+      advisorAssessmentIds: [],
+      evidenceRefs: ['artifacts/validation-T1.md'],
+      canonicalEvidenceRefs: [],
+      gateInputOnly: false,
+      createdAt: generatedAt,
+      payload: {}
+    } as unknown as WorkflowGateEvidencePacket['fanInEvidenceSets'][number]],
+    requiredArtifactRefs: ['artifacts/required-T1.md']
+  }));
+
+  assert.deepEqual(checks.filter((check) => check.severity === 'blocked').map((check) => check.code).sort(), [
+    'authority_violation',
+    'durable_gap_blocking',
+    'missing_required_artifact'
+  ]);
+});
+
+test('workflow gate hard checks warn when no latest eligible run exists', () => {
+  const checks = evaluateWorkflowGateHardChecks(packetInput({ latestEligibleSelection: null }));
+
+  assert.equal(checks.some((check) => check.code === 'latest_eligible_missing' && check.severity === 'warning'), true);
+});
+
+test('workflow gate hard checks do not require latest do run for scoped test run', () => {
+  const checks = evaluateWorkflowGateHardChecks(packetInput({
+    decisionKind: 'test',
+    workflowScope: { waveRunId: null, taskIds: ['T6'], runIds: ['test-run-001'], evidenceRefs: [] },
+    latestEligibleSelection: {
+      partition: 'feature',
+      taskId: 'T6',
+      selected: null,
+      candidates: [{
+        partition: 'feature',
+        gitBranch: 'feature',
+        taskId: 'T6',
+        runId: 'blocked-do-run',
+        runStatus: 'blocked',
+        validationStatus: 'blocked',
+        affectedFiles: [],
+        updatedAt: generatedAt,
+        compatibility: 'compatible',
+        eligibleForDefaultApply: false,
+        reasons: ['Run is blocked.']
+      }],
+      rejected: [{
+        partition: 'feature',
+        gitBranch: 'feature',
+        taskId: 'T6',
+        runId: 'blocked-do-run',
+        runStatus: 'blocked',
+        validationStatus: 'blocked',
+        affectedFiles: [],
+        updatedAt: generatedAt,
+        compatibility: 'compatible',
+        eligibleForDefaultApply: false,
+        reasons: ['Run is blocked.']
+      }]
+    }
+  }));
+
+  assert.equal(checks.some((check) => check.code === 'run_rejected'), false);
+});
+
+test('workflow gate hard checks block missing and drifted artifact payloads', () => {
+  const checks = evaluateWorkflowGateHardChecks(packetInput({
+    artifactPayloadHealth: [
+      {
+        payloadId: 'payload-missing',
+        logicalRef: 'artifacts/validation-T1.md',
+        physicalPayloadPath: 'artifacts/validation-T1-run-old.md',
+        expectedDigest: 'expected',
+        actualDigest: null,
+        status: 'missing'
+      },
+      {
+        payloadId: 'payload-drift',
+        logicalRef: 'artifacts/review-T1.md',
+        physicalPayloadPath: 'artifacts/review-T1-run-old.md',
+        expectedDigest: 'expected',
+        actualDigest: 'actual',
+        status: 'digest_drift'
+      }
+    ]
+  }));
+
+  assert.deepEqual(checks.filter((check) => check.severity === 'blocked').map((check) => check.code).sort(), ['digest_drift', 'missing_payload']);
+});
+
+test('workflow gate hard checks require accepted selection pointer evidence authority', () => {
+  const noneChecks = evaluateWorkflowGateHardChecks(packetInput({
+    selectedEvidence: { source: 'none', evidenceSet: null, pointer: null, payloads: [] }
+  }));
+  const legacyChecks = evaluateWorkflowGateHardChecks(packetInput({
+    selectedEvidence: { source: 'legacy_active_payloads', evidenceSet: null, pointer: null, payloads: [selectedEvidencePayload('artifacts/validation-T1.md', 'active')] }
+  }));
+  const candidateChecks = evaluateWorkflowGateHardChecks(packetInput({
+    selectedEvidence: { source: 'candidate_payloads', evidenceSet: null, pointer: null, payloads: [selectedEvidencePayload('artifacts/validation-T1.md', 'active')] }
+  }));
+
+  assert.equal(noneChecks.some((check) => check.code === 'missing_evidence_selection' && check.severity === 'blocked'), true);
+  assert.equal(legacyChecks.some((check) => check.code === 'missing_evidence_selection' && check.refs.includes('payload-active')), true);
+  assert.equal(candidateChecks.some((check) => check.code === 'missing_evidence_selection' && check.refs.includes('payload-active')), true);
+});
+
+test('workflow gate hard checks reject non-consumable evidence statuses', () => {
+  const statuses: Array<WorkflowGateEvidencePacket['selectedEvidence']['payloads'][number]['status']> = ['partial', 'active_attempt', 'rejected', 'superseded', 'quarantined', 'stale'];
+  const checks = evaluateWorkflowGateHardChecks(packetInput({
+    selectedEvidence: selectedEvidenceSelection(statuses.map((status) => selectedEvidencePayload('artifacts/validation-T1.md', status))),
+    requiredArtifactRefs: ['artifacts/validation-T1.md']
+  }));
+
+  assert.equal(checks.filter((check) => check.code === 'non_consumable_evidence').length, statuses.length);
+  assert.equal(checks.some((check) => check.code === 'missing_required_artifact' && check.refs.includes('artifacts/validation-T1.md')), true);
+});
+
+test('workflow gate hard checks do not let fan-in refs satisfy selected evidence requirements', () => {
+  const checks = evaluateWorkflowGateHardChecks(packetInput({
+    fanInEvidenceSets: [{
+      contract: STAGE_TEAM_RUNTIME_CONTRACT_VERSION,
+      fanInId: 'fanin-selected-authority',
+      partition: 'feature',
+      runId: 'run-001',
+      taskId: 'T1',
+      stage: 'test',
+      roleResultIds: [],
+      durableGapIds: [],
+      proposalRefs: [],
+      advisorAssessmentIds: [],
+      evidenceRefs: ['artifacts/required-T1.md'],
+      canonicalEvidenceRefs: ['artifacts/required-T1.md'],
+      gateInputOnly: true,
+      createdAt: generatedAt,
+      payload: {}
+    }],
+    requiredArtifactRefs: ['artifacts/required-T1.md']
+  }));
+
+  assert.equal(checks.some((check) => check.code === 'missing_required_artifact' && check.refs.includes('artifacts/required-T1.md')), true);
+});
+
+test('workflow gate hard checks block missing verify contract and runtime health failures', () => {
+  const checks = evaluateWorkflowGateHardChecks(packetInput({
+    runtimeHealth: { status: 'unavailable', issues: ['schema mismatch'] },
+    documents: {
+      ...packetInput().documents,
+      verifyExists: false,
+      verifyBasedOnTasksContractHash: null
+    } as WorkflowGateEvidencePacket['documents']
+  }));
+
+  assert.equal(checks.some((check) => check.code === 'schema_health_unavailable' && check.severity === 'blocked'), true);
+  assert.equal(checks.some((check) => check.code === 'missing_documents' && check.refs.includes('verify.md')), true);
+});
+
+test('workflow gate evidence scopes dependency blockers by decision kind', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-workflow-gate-scope-'));
+  try {
+    await initProject(root);
+    await writeBranchDocs(root, 'feature', `# Tasks\n\n${validTaskMarkdown('DEP1', []).replace('packages/core/src/index.ts', 'docs/dep1.md')}\n${validTaskMarkdown('DEP2', ['DEP1']).replaceAll('T1', 'DEP2').replace('packages/core/src/index.ts', 'docs/dep2.md')}`);
+
+    const taskPacket = await buildWorkflowGateEvidencePacket(root, {
+      branch: 'feature',
+      taskId: 'DEP1',
+      decisionKind: 'test'
+    });
+    const shipPacket = await buildWorkflowGateEvidencePacket(root, {
+      branch: 'feature',
+      decisionKind: 'ship'
+    });
+
+    assert.deepEqual(taskPacket.workflowScope.taskIds, ['DEP1']);
+    assert.deepEqual(taskPacket.dependencyBlockers, []);
+    assert.deepEqual(shipPacket.workflowScope.taskIds, ['DEP1', 'DEP2']);
+    assert.deepEqual(shipPacket.dependencyBlockers.map((blocker) => `${blocker.taskId}->${blocker.dependencyId}`), ['DEP2->DEP1']);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('workflow gate uses selected accepted evidence instead of latest active payload drift', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-workflow-gate-selected-evidence-'));
+  try {
+    await initProject(root);
+    await writeBranchDocs(root, 'feature', validTaskMarkdown('T1', []));
+    const run = await createRun(root, { runId: 'selected-evidence-run-001' });
+    const logicalRef = 'artifacts/validation-T1.md';
+    const acceptedPath = 'artifacts/validation-T1-accepted.md';
+    const latestPath = 'artifacts/validation-T1-latest.md';
+    const acceptedContent = 'accepted evidence\n';
+    const latestContent = 'latest evidence\n';
+    await mkdir(path.dirname(getEvidenceAttachmentPath(root, 'feature', acceptedPath)), { recursive: true });
+    await mkdir(path.dirname(getEvidenceAttachmentPath(root, 'feature', latestPath)), { recursive: true });
+    await writeFile(getEvidenceAttachmentPath(root, 'feature', acceptedPath), acceptedContent, 'utf8');
+    await writeFile(getEvidenceAttachmentPath(root, 'feature', latestPath), latestContent, 'utf8');
+    const acceptedPayload = await recordRuntimeArtifactPayload(root, {
+      payloadId: runtimeScopedId(run.runId, logicalRef, 'accepted'),
+      runId: run.runId,
+      sourceRunId: run.runId,
+      branchSlug: 'feature',
+      taskId: 'T1',
+      logicalRef,
+      physicalPayloadPath: acceptedPath,
+      artifactRole: 'validation',
+      digest: hashContent(acceptedContent),
+      status: 'active',
+      payload: { title: 'accepted' }
+    });
+    const latestPayload = await recordRuntimeArtifactPayload(root, {
+      payloadId: runtimeScopedId(run.runId, logicalRef, 'latest'),
+      runId: run.runId,
+      sourceRunId: run.runId,
+      branchSlug: 'feature',
+      taskId: 'T1',
+      logicalRef,
+      physicalPayloadPath: latestPath,
+      artifactRole: 'validation',
+      digest: hashContent(latestContent),
+      status: 'active',
+      payload: { title: 'latest' }
+    });
+    const evidenceSetId = runtimeScopedId(run.runId, 'T1', 'accepted-set');
+    await createRuntimeEvidenceSet(root, {
+      evidenceSetId,
+      branchSlug: 'feature',
+      scopeKind: 'task',
+      scopeId: 'T1',
+      sourceRunId: run.runId,
+      documentContractHashes: { spec: null, plan: null, tasks: null, verify: null },
+      gateDecisionId: 'gate-pass-001',
+      status: 'accepted',
+      items: [{ evidenceSetId, payloadId: acceptedPayload.payloadId, logicalRef, role: 'validation', required: false, digestAtSelection: acceptedPayload.digest }],
+      payload: { source: 'test' }
+    });
+    await updateRuntimeSelectionPointer(root, {
+      branchSlug: 'feature',
+      scopeKind: 'task',
+      scopeId: 'T1',
+      selectedEvidenceSetId: evidenceSetId,
+      selectedAt: generatedAt,
+      selectedByGateDecisionId: 'gate-pass-001',
+      reason: 'accepted test evidence'
+    });
+
+    await writeFile(getEvidenceAttachmentPath(root, 'feature', latestPath), 'latest drift\n', 'utf8');
+    const latestDriftPacket = await buildWorkflowGateEvidencePacket(root, { branch: 'feature', taskId: 'T1', decisionKind: 'test' });
+    await writeFile(getEvidenceAttachmentPath(root, 'feature', acceptedPath), 'accepted drift\n', 'utf8');
+    const selectedDriftPacket = await buildWorkflowGateEvidencePacket(root, { branch: 'feature', taskId: 'T1', decisionKind: 'test' });
+
+    assert.deepEqual(latestDriftPacket.selectedEvidence.payloads.map((payload) => payload.payloadId), [acceptedPayload.payloadId]);
+    assert.equal(latestDriftPacket.selectedEvidence.payloads.some((payload) => payload.payloadId === latestPayload.payloadId), false);
+    assert.equal(latestDriftPacket.hardChecks.some((check) => check.code === 'digest_drift'), false);
+    assert.equal(selectedDriftPacket.hardChecks.some((check) => check.code === 'digest_drift' && check.refs.includes(acceptedPayload.payloadId)), true);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('workflow gate PASS resolves scoped open repair records', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-workflow-gate-repair-'));
+  try {
+    await initProject(root);
+    await writeBranchDocs(root, 'feature', validTaskMarkdown('T1', []));
+    await writeVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
+    const run = await createRun(root, { runId: 'repair-gate-run-001' });
+    await bindTestRunState(root, run.runId, 'feature', 'T1');
+    await markTestRunReadyForShip(root, run.runId, 'T1');
+    const validationRef = 'artifacts/validation-T1.md';
+    const validationPath = 'artifacts/validation-T1-repair.md';
+    const validationContent = 'repair gate validation evidence\n';
+    await mkdir(path.dirname(getEvidenceAttachmentPath(root, 'feature', validationPath)), { recursive: true });
+    await writeFile(getEvidenceAttachmentPath(root, 'feature', validationPath), validationContent, 'utf8');
+    const validationPayloadId = runtimeScopedId(run.runId, validationRef, 'repair-validation');
+    await recordRuntimeArtifactPayload(root, {
+      payloadId: validationPayloadId,
+      runId: run.runId,
+      sourceRunId: run.runId,
+      branchSlug: 'feature',
+      taskId: 'T1',
+      logicalRef: validationRef,
+      physicalPayloadPath: validationPath,
+      artifactRole: 'validation',
+      digest: hashContent(validationContent),
+      status: 'active',
+      payload: { source: 'repair-test' }
+    });
+    const evidenceSetId = runtimeScopedId(run.runId, 'T1', 'repair-accepted-set');
+    await createRuntimeEvidenceSet(root, {
+      evidenceSetId,
+      branchSlug: 'feature',
+      scopeKind: 'task',
+      scopeId: 'T1',
+      sourceRunId: run.runId,
+      documentContractHashes: { spec: null, plan: null, tasks: null, verify: null },
+      gateDecisionId: 'gate-pass-repair-input',
+      status: 'accepted',
+      items: [{ evidenceSetId, payloadId: validationPayloadId, logicalRef: validationRef, role: 'validation', required: false, digestAtSelection: hashContent(validationContent) }],
+      payload: { source: 'repair-test' }
+    });
+    await updateRuntimeSelectionPointer(root, {
+      branchSlug: 'feature',
+      scopeKind: 'task',
+      scopeId: 'T1',
+      selectedEvidenceSetId: evidenceSetId,
+      selectedAt: generatedAt,
+      selectedByGateDecisionId: 'gate-pass-repair-input',
+      reason: 'accepted repair validation evidence'
+    });
+    await recordRuntimeRepair(root, buildOpenRepairRecord({
+      branchSlug: 'feature',
+      taskId: 'T1',
+      runId: run.runId,
+      message: 'artifact digest evidence drift requires replay',
+      recommendedCommands: ['sdd test task-T1 --branch feature']
+    }));
+
+    const result = await evaluateAndRecordWorkflowGateDecision(root, { branch: 'feature', taskId: 'T1', runId: run.runId, decisionKind: 'test' });
+    const openRepairs = await listRuntimeRepairs(root, { branchSlug: 'feature', status: 'open' });
+    const resolvedRepairs = await listRuntimeRepairs(root, { branchSlug: 'feature', status: 'resolved' });
+
+    assert.equal(result.decision.status, 'PASS');
+    assert.equal(openRepairs.length, 0);
+    assert.equal(resolvedRepairs.length, 1);
+    assert.equal((resolvedRepairs[0].payload as { resolvedByGateDecisionId?: string }).resolvedByGateDecisionId, result.decision.decisionId);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+function selectedEvidencePayload(logicalRef = 'artifacts/validation-T1.md', status: WorkflowGateEvidencePacket['selectedEvidence']['payloads'][number]['status'] = 'active'): WorkflowGateEvidencePacket['selectedEvidence']['payloads'][number] {
+  return {
+    payloadId: `payload-${status}`,
+    runId: 'run-001',
+    sourceRunId: 'run-001',
+    branchSlug: 'feature',
+    taskId: 'T1',
+    logicalRef,
+    physicalPayloadPath: logicalRef,
+    artifactRole: 'validation',
+    digest: `digest-${status}`,
+    sequence: 1,
+    status,
+    supersedes: null,
+    createdAt: generatedAt,
+    payload: {}
+  };
+}
+
+function selectedEvidenceSelection(payloads = [selectedEvidencePayload()]): WorkflowGateEvidencePacket['selectedEvidence'] {
+  return {
+    source: 'selection_pointer',
+    evidenceSet: {
+      evidenceSetId: 'evidence-set-001',
+      branchSlug: 'feature',
+      scopeKind: 'task',
+      scopeId: 'T1',
+      sourceRunId: 'run-001',
+      documentContractHashes: {},
+      gateDecisionId: 'gate-001',
+      status: 'accepted',
+      createdAt: generatedAt,
+      items: payloads.map((payload) => ({
+        evidenceSetId: 'evidence-set-001',
+        payloadId: payload.payloadId,
+        logicalRef: payload.logicalRef,
+        role: payload.artifactRole,
+        required: true,
+        digestAtSelection: payload.digest
+      })),
+      payload: {}
+    },
+    pointer: {
+      branchSlug: 'feature',
+      scopeKind: 'task',
+      scopeId: 'T1',
+      selectedEvidenceSetId: 'evidence-set-001',
+      selectedAt: generatedAt,
+      selectedByGateDecisionId: 'gate-001',
+      reason: 'accepted evidence selection'
+    },
+    payloads
+  };
+}
+
+function hashContent(content: string): string {
+  return createHash('sha256').update(content.replace(/\r\n/g, '\n'), 'utf8').digest('hex');
+}
+
+function packetInput(overrides: Partial<Omit<WorkflowGateEvidencePacket, 'hardChecks'>> = {}): Omit<WorkflowGateEvidencePacket, 'hardChecks'> {
+  return {
+    packetId: 'packet-001',
+    generatedAt,
+    decisionKind: 'ship',
+    partition: 'feature',
+    taskId: 'T1',
+    runId: 'run-001',
+    documents: {
+      specExists: true,
+      planExists: true,
+      tasksExists: true,
+      verifyExists: true,
+      planStale: false,
+      tasksStale: false,
+      verifyStale: false,
+      specHash: 'spec-doc',
+      planHash: 'plan-doc',
+      tasksHash: 'tasks-doc',
+      verifyHash: 'verify-doc',
+      specContractHash: 'spec-contract',
+      planContractHash: 'plan-contract',
+      tasksContractHash: 'tasks-contract',
+      verifyContractHash: 'verify-contract',
+      planBasedOnSpecHash: 'spec-doc',
+      tasksBasedOnPlanHash: 'plan-doc',
+      verifyBasedOnTasksHash: 'tasks-doc',
+      planBasedOnSpecContractHash: 'spec-contract',
+      tasksBasedOnPlanContractHash: 'plan-contract',
+      verifyBasedOnTasksContractHash: 'tasks-contract'
+    } as WorkflowGateEvidencePacket['documents'],
+    latestEligibleSelection: {
+      partition: 'feature',
+      taskId: 'T1',
+      selected: {
+        partition: 'feature',
+        gitBranch: 'feature',
+        taskId: 'T1',
+        runId: 'run-001',
+        runStatus: 'completed',
+        validationStatus: 'pass',
+        affectedFiles: [],
+        updatedAt: generatedAt,
+        compatibility: 'compatible',
+        eligibleForDefaultApply: true,
+        reasons: []
+      },
+      candidates: [],
+      rejected: []
+    },
+    latestEligibleSelections: [],
+    workflowScope: { waveRunId: null, taskIds: ['T1'], runIds: ['run-001'], evidenceRefs: [] },
+    runtimeHealth: { status: 'ok', issues: [] },
+    durableGaps: [],
+    dependencyBlockers: [],
+    affectedFileConflicts: [],
+    fanInEvidenceSets: [],
+    advisorAssessments: [],
+    selectedEvidence: selectedEvidenceSelection(),
+    canonicalEvidenceRefs: [],
+    requiredArtifactRefs: [],
+    artifactPayloadHealth: [],
+    ...overrides
+  };
+}