sdd-agent-platform 0.4.1 → 0.4.2

package/node_modules/@sdd-agent-platform/core/src/verification/test-runtime.test.ts

@@ -1,22 +1,24 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { mkdtemp, readdir, readFile, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 
 import { initProject } from '../config/init-project.js';
 import { validResultArtifact, validTaskMarkdown, writeBranchDocs } from '../test-support/fixtures.js';
-import { listRuntimeTestRuns } from '../storage/runtime-store.js';
+import { listRuntimeTestRuns, listRuntimeTestSteps } from '../storage/runtime-store.js';
 import { readRunState } from '../run-state/run-state.js';
 import { readArtifact, writeArtifact } from '../run-state/artifacts.js';
 import { listInvocationLedgerEntries } from '../run-state/invocation-ledger.js';
 import { writeVerifyContract } from './verify-contract.js';
 import { renderSddTestResult, runSddTest } from './test-runtime.js';
 import { runGoalVerify } from './goal-verify.js';
-import { inspectSyncBack } from '../sync-back/inspect.js';
 import { routeSddTask } from '../router/route-sdd-task.js';
 import { doctor } from '../doctor/doctor.js';
 import { getProjectStatus } from '../status/project-status.js';
+import { evaluateLifecycleRiskDecisionForModel, recordLifecycleRiskDecisionProjection } from '../risk.js';
+import { parseSddBranch } from '../sdd-docs/task-parser.js';
+import { getBranchStageEvidencePathFromRef } from '../runtime-paths.js';
 
 function mappedValidationTaskMarkdown(taskId: string, command: string): string {
   return `# Tasks
@@ -49,6 +51,10 @@ Stay in validation runtime fixtures only.
 `;
 }
 
+function mappedValidationTaskWithRequiredArtifactsMarkdown(taskId: string, command: string): string {
+  return mappedValidationTaskMarkdown(taskId, command).replace('risk: []', `risk: []\nrequired_artifacts:\n  - .sdd/runs/feature/do/implementation-${taskId}.md\n  - .sdd/runs/feature/test/test-validation-${taskId}.md`);
+}
+
 function capabilityMappedValidationTaskMarkdown(taskId: string, command: string): string {
   return mappedValidationTaskMarkdown(taskId, command).replace('risk: []', 'risk:\n  - security');
 }
@@ -64,12 +70,13 @@ function directSafeTaskMarkdown(taskId: string): string {
   return validTaskMarkdown(taskId, []).replace('packages/core/src/index.ts', `docs/${taskId.toLowerCase()}.md`);
 }
 
-test('runSddTest captures command output and indexes test evidence', async () => {
+test('runSddTest records PASS command metadata without default log or index artifacts', async () => {
   const root = await mkdtemp(path.join(tmpdir(), 'sdd-test-runtime-pass-'));
   try {
     await initProject(root);
     await writeBranchDocs(root, 'feature', directSafeTaskMarkdown('T1'));
     await writeVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
+    await seedLifecycleRiskDecision(root, 'feature');
 
     const result = await runSddTest(root, {
       branch: 'feature',
@@ -81,10 +88,9 @@ test('runSddTest captures command output and indexes test evidence', async () =>
     assert.equal(result.commandStatus, 'PASS');
     assert.equal(result.evidenceCoverage, 'missing');
     assert.equal(result.policyJudgment, 'BLOCKED');
-    assert.equal(result.syncBackReady, false);
     assert.equal(result.steps.length, 1);
-    assert.equal(result.validationArtifact, 'artifacts/test-validation-T1.md');
-    assert.equal(result.indexArtifact, 'artifacts/test-index-T1.json');
+    assert.equal(result.validationArtifact, '.sdd/runs/feature/test/test-validation-T1.md');
+    assert.equal(result.indexArtifact, null);
     assert.equal(result.capabilityEvidence.length > 0, true);
     assert.equal(result.capabilityEvidence.some((item) => item.class === 'accepted'), false);
     assert.equal(result.capabilityEvidence.some((item) => item.class === 'quarantined' && item.source === 'external_source'), true);
@@ -93,22 +99,25 @@ test('runSddTest captures command output and indexes test evidence', async () =>
     const state = await readRunState(root, result.runId);
     assert.equal(state.phase, 'test');
     assert.equal(state.validation.status, 'blocked');
-    assert.equal(state.validation.evidence.includes('artifacts/test-validation-T1.md'), true);
+    assert.equal(state.validation.evidence.includes('.sdd/runs/feature/test/test-validation-T1.md'), true);
+    assert.equal(state.tasks.T1?.implementationStatus, 'not_started');
 
     const validation = await readArtifact(root, result.runId, 'test-validation-T1.md');
+    assert.equal(await readFile(getBranchStageEvidencePathFromRef(root, '.sdd/runs/feature/test/test-validation-T1.md'), 'utf8'), validation);
     assert.match(validation, /```sdd-result/);
     assert.doesNotMatch(validation, /```sdd-evidence/);
     assert.match(validation, /not explicitly mapped/);
-    assert.match(validation, /## Capability Evidence Classification/);
+    assert.doesNotMatch(validation, /## Capability Evidence Classification/);
     const ledger = await listInvocationLedgerEntries(root, result.runId);
     assert.equal(ledger.some((entry) => entry.kind === 'command' && entry.ref === 'node -e "process.stdout.write(\'ok\')"' && entry.status === 'pass'), true);
 
-    const reviewArtifact = await writeArtifact(root, result.runId, 'review-T1.md', validResultArtifact('reviewer', 'T1', 'PASS', 'artifacts/review-T1.md'));
+    await assert.rejects(readdir(path.join(root, '.sdd', 'runs', 'feature', 'evidence')));
+    await writeArtifact(root, result.runId, 'review-T1.md', validResultArtifact('reviewer', 'T1', 'PASS', '.sdd/runs/feature/do/review-T1.md'));
     const verify = await runGoalVerify(root, {
       branch: 'feature',
       taskId: 'T1',
       runId: result.runId,
-      reviewArtifact: reviewArtifact.runRelativePath,
+      reviewArtifact: '.sdd/runs/feature/do/review-T1.md',
       validationArtifact: result.validationArtifact ?? undefined
     });
     assert.equal(verify.status, 'BLOCKED');
@@ -117,6 +126,42 @@ test('runSddTest captures command output and indexes test evidence', async () =>
     const testRuns = await listRuntimeTestRuns(root, result.runId);
     assert.equal(testRuns.length, 1);
     assert.equal(testRuns[0].status, 'BLOCKED');
+    const testSteps = await listRuntimeTestSteps(root, { runId: result.runId });
+    assert.equal(testSteps.length, 1);
+    assert.equal(testSteps[0].status, 'pass');
+    assert.equal(testSteps[0].outputArtifact, null);
+    assert.match((testSteps[0].payload as { stdoutDigest: string }).stdoutDigest, /^[a-f0-9]{64}$/);
+    assert.match((testSteps[0].payload as { stderrDigest: string }).stderrDigest, /^[a-f0-9]{64}$/);
+    assert.match((testSteps[0].payload as { startedAt: string }).startedAt, /^\d{4}-\d{2}-\d{2}T/);
+    assert.match((testSteps[0].payload as { endedAt: string }).endedAt, /^\d{4}-\d{2}-\d{2}T/);
+    assert.equal((testSteps[0].payload as { cwd: string }).cwd, root);
+    assert.match((testSteps[0].payload as { outputSummary: string }).outputSummary, /stdout_bytes=2/);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('runSddTest writes validator evidence to declared required validation artifact', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-test-runtime-required-artifact-'));
+  try {
+    await initProject(root);
+    await writeBranchDocs(root, 'feature', mappedValidationTaskWithRequiredArtifactsMarkdown('REQ', 'node -e "process.stdout.write(\'ok\')"'));
+    await writeVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
+    await seedLifecycleRiskDecision(root, 'feature');
+
+    const result = await runSddTest(root, {
+      branch: 'feature',
+      taskId: 'REQ',
+      approved: true,
+      commands: ['node -e "process.stdout.write(\'ok\')"']
+    });
+
+    assert.equal(result.validationArtifact, '.sdd/runs/feature/test/test-validation-REQ.md');
+    assert.equal(result.workflowGateDecision.hardBlocks.some((block) => block.code === 'missing_required_artifact' && block.refs.includes('.sdd/runs/feature/test/test-validation-REQ.md')), false);
+    assert.equal(result.workflowGateDecision.hardBlocks.some((block) => block.code === 'missing_required_artifact' && block.refs.includes('.sdd/runs/feature/do/implementation-REQ.md')), true);
+    const validation = await readArtifact(root, result.runId, 'test-validation-REQ.md');
+    assert.match(validation, /runs\/feature\/test\/test-validation-REQ\.md/);
+    await assert.rejects(readdir(path.join(root, '.sdd', 'runs', 'feature', 'evidence')));
   } finally {
     await rm(root, { recursive: true, force: true });
   }
@@ -128,6 +173,7 @@ test('runSddTest executes argv commands without shell and records argv evidence'
     await initProject(root);
     await writeBranchDocs(root, 'feature', directSafeTaskMarkdown('T1'));
     await writeVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
+    await seedLifecycleRiskDecision(root, 'feature');
 
     const result = await runSddTest(root, {
       branch: 'feature',
@@ -140,12 +186,12 @@ test('runSddTest executes argv commands without shell and records argv evidence'
     assert.equal(result.steps[0].shell, false);
     assert.deepEqual(result.steps[0].argv, [process.execPath, '-e', 'process.stdout.write(process.argv[1])', 'literal;not-shell']);
 
-    const output = await readArtifact(root, result.runId, 'test-T1-001.log');
-    assert.match(output, /literal;not-shell/);
-    assert.match(output, /- shell: false/);
-    const index = JSON.parse(await readArtifact(root, result.runId, 'test-index-T1.json')) as { steps: Array<{ argv: string[]; shell: boolean }> };
-    assert.equal(index.steps[0].shell, false);
-    assert.deepEqual(index.steps[0].argv, [process.execPath, '-e', 'process.stdout.write(process.argv[1])', 'literal;not-shell']);
+    const testSteps = await listRuntimeTestSteps(root, { runId: result.runId });
+    assert.equal(testSteps.length, 1);
+    assert.equal(testSteps[0].outputArtifact, null);
+    assert.equal((testSteps[0].payload as { shell: boolean }).shell, false);
+    assert.deepEqual((testSteps[0].payload as { argv: string[] }).argv, [process.execPath, '-e', 'process.stdout.write(process.argv[1])', 'literal;not-shell']);
+    assert.match((testSteps[0].payload as { outputSummary: string }).outputSummary, /stdout_bytes=17/);
     const ledger = await listInvocationLedgerEntries(root, result.runId);
     const commandEntry = ledger.find((entry) => entry.kind === 'command' && entry.status === 'pass');
     assert.equal(commandEntry?.metadata.shell, false);
@@ -160,6 +206,7 @@ test('runSddTest blocks on missing verify contract without creating it', async (
   try {
     await initProject(root);
     await writeBranchDocs(root, 'feature', mappedValidationTaskMarkdown('T1', 'node -e "process.stdout.write(\'ok\')"'));
+    await seedLifecycleRiskDecision(root, 'feature');
 
     const result = await runSddTest(root, {
       branch: 'feature',
@@ -178,28 +225,29 @@ test('runSddTest blocks on missing verify contract without creating it', async (
   }
 });
 
-test('runSddTest blocks on stale verify contract without refreshing it', async () => {
-  const root = await mkdtemp(path.join(tmpdir(), 'sdd-test-runtime-stale-verify-'));
+test('runSddTest ignores legacy verify hash metadata and executes validation', async () => {
+  const root = await mkdtemp(path.join(tmpdir(), 'sdd-test-runtime-legacy-verify-hash-'));
   try {
     await initProject(root);
     await writeBranchDocs(root, 'feature', mappedValidationTaskMarkdown('T1', 'node -e "process.stdout.write(\'ok\')"'));
     await writeVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
-    await writeFile(path.join(root, 'specs', 'feature', 'tasks.md'), mappedValidationTaskMarkdown('T1', 'node -e "process.stdout.write(\'ok\')"').replace('risk: []', 'risk:\n  - security'), 'utf8');
+    const verifyPath = path.join(root, 'specs', 'feature', 'verify.md');
+    const verifyWithLegacyMetadata = (await readFile(verifyPath, 'utf8')).replace('author_role: verification-designer', 'based_on_tasks_contract_hash: legacy\nbased_on_tasks_hash: legacy\nauthor_role: verification-designer');
+    await writeFile(verifyPath, verifyWithLegacyMetadata, 'utf8');
+    await seedLifecycleRiskDecision(root, 'feature');
 
     const result = await runSddTest(root, {
       branch: 'feature',
       taskId: 'T1',
       commands: ['node -e "process.stdout.write(\'ok\')"']
     });
-    const verify = await readFile(path.join(root, 'specs', 'feature', 'verify.md'), 'utf8');
+    const verify = await readFile(verifyPath, 'utf8');
 
-    assert.equal(result.verifyContractStatus, 'WARN');
-    assert.equal(result.verifyContractAction, 'blocked');
-    assert.equal(result.commandStatus, 'BLOCKED');
-    assert.equal(result.steps.length, 0);
-    assert.equal(result.status, 'BLOCKED');
-    assert.match(verify, /based_on_tasks_contract_hash:/);
-    assert.match(result.gaps.join('\n'), /stale for current tasks contract hash/);
+    assert.equal(result.verifyContractStatus, 'PASS');
+    assert.equal(result.commandStatus, 'PASS');
+    assert.equal(result.status, 'PASS');
+    assert.equal(result.steps.length, 1);
+    assert.match(verify, /based_on_tasks_contract_hash: legacy/);
   } finally {
     await rm(root, { recursive: true, force: true });
   }
@@ -211,18 +259,19 @@ test('runSddTest produces validator evidence accepted by goal verify', async ()
     await initProject(root);
     await writeBranchDocs(root, 'feature', mappedValidationTaskMarkdown('T1', 'node -e "process.stdout.write(\'ok\')"'));
     await writeVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
+    await seedLifecycleRiskDecision(root, 'feature');
 
     const result = await runSddTest(root, {
       branch: 'feature',
       taskId: 'T1',
       commands: ['node -e "process.stdout.write(\'ok\')"']
     });
-    const reviewArtifact = await writeArtifact(root, result.runId, 'review-T1.md', validResultArtifact('reviewer', 'T1', 'PASS', 'artifacts/review-T1.md'));
+    await writeArtifact(root, result.runId, 'review-T1.md', validResultArtifact('reviewer', 'T1', 'PASS', '.sdd/runs/feature/do/review-T1.md'));
     const verify = await runGoalVerify(root, {
       branch: 'feature',
       taskId: 'T1',
       runId: result.runId,
-      reviewArtifact: reviewArtifact.runRelativePath,
+      reviewArtifact: '.sdd/runs/feature/do/review-T1.md',
       validationArtifact: result.validationArtifact ?? undefined
     });
 
@@ -230,19 +279,11 @@ test('runSddTest produces validator evidence accepted by goal verify', async ()
     assert.equal(verify.acceptanceCoverage.every((item) => item.status === 'PASS'), true);
     assert.equal(result.evidenceCoverage, 'complete');
     assert.equal(result.policyJudgment, 'PASS');
-    assert.equal(result.syncBackReady, false);
     assert.equal(result.capabilityEvidence.length > 0, true);
     assert.equal(result.capabilityEvidence.some((item) => item.class === 'accepted'), false);
     assert.equal(result.capabilityEvidence.some((item) => item.class === 'quarantined' && item.source === 'external_source'), true);
-    const index = JSON.parse(await readArtifact(root, result.runId, 'test-index-T1.json')) as typeof result;
-    assert.deepEqual(index.capabilityEvidence, result.capabilityEvidence);
-    assert.match(result.next, /^sdd ship --branch feature --dry-run$/);
-    const testState = await readRunState(root, result.runId);
-    assert.equal(testState.syncBack.status, 'proposed');
-    assert.equal(testState.syncBack.proposalPath, 'artifacts/sync-back-proposal.md');
-    const syncBack = await inspectSyncBack(root, { runId: result.runId, branch: 'feature', taskId: 'T1' });
-    assert.equal(syncBack.status, 'ready');
-    assert.equal(syncBack.proposalDigestValid, true);
+    assert.equal(result.indexArtifact, null);
+    assert.match(result.next, /^sdd test close --branch feature --target goal-verify --compact-json$/);
     assert.deepEqual(verify.plannedCommands, ['node -e "process.stdout.write(\'ok\')"']);
     assert.deepEqual(verify.executedCommands, ['node -e "process.stdout.write(\'ok\')"']);
     const coverage = await readArtifact(root, result.runId, 'acceptance-coverage-T1.md');
@@ -259,6 +300,7 @@ test('runSddTest exposes candidate capability evidence without making it authori
     await initProject(root);
     await writeBranchDocs(root, 'feature', capabilityMappedValidationTaskMarkdown('CAPABILITY', 'node -e "process.stdout.write(\'ok\')"'));
     await writeVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
+    await seedLifecycleRiskDecision(root, 'feature');
 
     const result = await runSddTest(root, {
       branch: 'feature',
@@ -272,10 +314,10 @@ test('runSddTest exposes candidate capability evidence without making it authori
     assert.equal(result.capabilityEvidence.some((item) => item.class === 'candidate' && item.source === 'professional_capability' && item.domainOrSourceId === 'security-engineering'), true);
     assert.equal(result.capabilityEvidence.some((item) => item.class === 'accepted'), false);
     assert.equal(result.capabilityEvidence.some((item) => item.class === 'quarantined' && item.source === 'external_source'), true);
-    const index = JSON.parse(await readArtifact(root, result.runId, 'test-index-CAPABILITY.json')) as typeof result;
-    assert.deepEqual(index.capabilityEvidence, result.capabilityEvidence);
+    assert.equal(result.indexArtifact, null);
     const validation = await readArtifact(root, result.runId, 'test-validation-CAPABILITY.md');
-    assert.match(validation, /\[candidate\] professional_capability:security-engineering/);
+    assert.doesNotMatch(validation, /professional_capability:security-engineering/);
+    assert.doesNotMatch(validation, /## Capability Evidence Classification/);
     const status = await getProjectStatus(root, { branch: 'feature' });
     assert.equal(status.capabilityHealth.activeDomains.includes('security-engineering'), false);
     assert.equal(status.capabilityHealth.releaseCriticalGaps.includes('security-engineering'), true);
@@ -290,6 +332,7 @@ test('runSddTest records failing commands without promoting verification pass',
     await initProject(root);
     await writeBranchDocs(root, 'feature', directSafeTaskMarkdown('T1'));
     await writeVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
+    await seedLifecycleRiskDecision(root, 'feature');
 
     const result = await runSddTest(root, {
       branch: 'feature',
@@ -313,6 +356,7 @@ test('runSddTest blocks source-boundary validation before command execution', as
     await initProject(root);
     await writeBranchDocs(root, 'feature', sourceBoundaryMappedValidationTaskMarkdown('SOURCE', 'node -e "process.stdout.write(\'should-not-run\')"'));
     await writeVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
+    await seedLifecycleRiskDecision(root, 'feature');
 
     const result = await runSddTest(root, {
       branch: 'feature',
@@ -344,6 +388,7 @@ test('runSddTest allows source-boundary validation after reviewer checkpoint pas
     await initProject(root);
     await writeBranchDocs(root, 'feature', sourceBoundaryMappedValidationTaskMarkdown('SOURCE', 'node -e "process.stdout.write(\'ok\')"'));
     await writeVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
+    await seedLifecycleRiskDecision(root, 'feature');
 
     const blocked = await runSddTest(root, {
       branch: 'feature',
@@ -354,7 +399,7 @@ test('runSddTest allows source-boundary validation after reviewer checkpoint pas
     assert.equal(blocked.lifecycleGate, 'review-before-test');
     assert.equal(blocked.steps.length, 0);
 
-    await writeArtifact(root, blocked.runId, 'review-SOURCE.md', validResultArtifact('reviewer', 'SOURCE', 'PASS', 'artifacts/review-SOURCE.md'));
+    await writeArtifact(root, blocked.runId, 'review-SOURCE.md', validResultArtifact('reviewer', 'SOURCE', 'PASS', '.sdd/runs/feature/do/review-SOURCE.md'));
     const result = await runSddTest(root, {
       branch: 'feature',
       taskId: 'SOURCE',
@@ -366,7 +411,7 @@ test('runSddTest allows source-boundary validation after reviewer checkpoint pas
     assert.equal(result.lifecycleGate, 'review-before-test');
     assert.equal(result.commandStatus, 'PASS');
     assert.equal(result.steps.length, 1);
-    assert.match(result.next, /^sdd ship --branch feature --dry-run$/);
+    assert.match(result.next, /^sdd test close --branch feature --target goal-verify --compact-json$/);
   } finally {
     await rm(root, { recursive: true, force: true });
   }
@@ -378,6 +423,7 @@ test('runSddTest replaces stale blocked handoff after retry pass', async () => {
     await initProject(root);
     await writeBranchDocs(root, 'feature', sourceBoundaryMappedValidationTaskMarkdown('SOURCE', 'node -e "process.stdout.write(\'ok\')"'));
     await writeVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
+    await seedLifecycleRiskDecision(root, 'feature');
 
     const blocked = await runSddTest(root, {
       branch: 'feature',
@@ -386,7 +432,7 @@ test('runSddTest replaces stale blocked handoff after retry pass', async () => {
     });
     assert.equal(blocked.status, 'BLOCKED');
 
-    await writeArtifact(root, blocked.runId, 'review-SOURCE.md', validResultArtifact('reviewer', 'SOURCE', 'PASS', 'artifacts/review-SOURCE.md'));
+    await writeArtifact(root, blocked.runId, 'review-SOURCE.md', validResultArtifact('reviewer', 'SOURCE', 'PASS', '.sdd/runs/feature/do/review-SOURCE.md'));
     const passed = await runSddTest(root, {
       branch: 'feature',
       taskId: 'SOURCE',
@@ -413,6 +459,7 @@ test('runSddTest blocks downstream validation until dependencies are completed',
       .replace('depends_on: []', 'depends_on:\n  - DEP1');
     await writeBranchDocs(root, 'feature', `# Tasks\n\n${validTaskMarkdown('DEP1', [])}\n${dep2}`);
     await writeVerifyContract(root, { branch: 'feature', branchSource: 'cli_option' });
+    await seedLifecycleRiskDecision(root, 'feature');
 
     const blockedRoute = await routeSddTask(root, { branch: 'feature', taskId: 'DEP2', approved: true });
     const blocked = await runSddTest(root, { branch: 'feature', taskId: 'DEP2', approved: true });
@@ -426,6 +473,7 @@ test('runSddTest blocks downstream validation until dependencies are completed',
 
     await writeBranchDocs(root, 'feature', `# Tasks\n\n${validTaskMarkdown('DEP1', []).replace('status: pending', 'status: completed')}\n${dep2}`);
     await writeVerifyContract(root, { branch: 'feature', branchSource: 'cli_option', force: true });
+    await seedLifecycleRiskDecision(root, 'feature');
     const readyRoute = await routeSddTask(root, { branch: 'feature', taskId: 'DEP2' });
     const ready = await runSddTest(root, { branch: 'feature', taskId: 'DEP2' });
 
@@ -436,4 +484,9 @@ test('runSddTest blocks downstream validation until dependencies are completed',
   } finally {
     await rm(root, { recursive: true, force: true });
   }
-});
+});
+
+async function seedLifecycleRiskDecision(root: string, branch: string): Promise<void> {
+  const model = await parseSddBranch(root, branch);
+  await recordLifecycleRiskDecisionProjection(root, evaluateLifecycleRiskDecisionForModel(branch, model));
+}