sdd-agent-platform 0.4.2 → 0.5.1

package/node_modules/@sdd-agent-platform/core/src/workflow-gate/policy.test.ts

@@ -1,174 +1,135 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-
-import { WORKFLOW_GATE_RUNTIME_CONTRACT_VERSION, STAGE_TEAM_RUNTIME_CONTRACT_VERSION } from '../contracts.js';
-import { synthesizeWorkflowGateDecision } from './policy.js';
-import type { WorkflowGateEvidencePacket } from './types.js';
-
-const generatedAt = '2026-01-01T00:00:00.000Z';
-
-test('workflow gate policy keeps hard blocks monotonic over advisor concerns', () => {
-  const decision = synthesizeWorkflowGateDecision(packet({
-    hardChecks: [{
-      code: 'validation_failure',
-      severity: 'blocked',
-      scope: 'feature',
-      message: 'Selected run validation failed.',
-      recovery: 'Rerun validation.',
-      refs: ['run-001']
-    }],
-    advisorAssessments: [advisor('none')]
-  }));
-
-  assert.equal(decision.status, 'BLOCKED');
-  assert.equal(decision.decidedBy, 'runtime_policy');
-  assert.deepEqual(decision.forbiddenNextActions, ['ship', 'truth-alignment-approval', 'mark-task-complete', 'stage-pass']);
-});
-
-test('workflow gate policy requires a human for high-concern ship advisors', () => {
-  const decision = synthesizeWorkflowGateDecision(packet({ advisorAssessments: [advisor('high')] }));
-
-  assert.equal(decision.status, 'HUMAN_REQUIRED');
-  assert.equal(decision.humanRequired, true);
-  assert.deepEqual(decision.allowedNextActions, ['create-decision-card', 'inspect-evidence']);
-  assert.equal(decision.forbiddenNextActions.includes('satisfy-with-subagent-output'), true);
-});
-
-test('workflow gate policy treats advisor-only stage transitions without canonical evidence as advisory only', () => {
-  const decision = synthesizeWorkflowGateDecision(packet({
-    decisionKind: 'stage_transition',
-    advisorAssessments: [advisor('low')],
-    canonicalEvidenceRefs: []
-  }));
-
-  assert.equal(decision.status, 'ADVISORY_ONLY');
-  assert.deepEqual(decision.allowedNextActions, ['inspect-advisor-assessments']);
-});
-
-test('workflow gate policy escalates invalid advisors and warns on low confidence', () => {
-  const invalid = synthesizeWorkflowGateDecision(packet({ advisorAssessments: [advisor('low', { validity: 'invalid' })] }));
-  const lowConfidence = synthesizeWorkflowGateDecision(packet({ advisorAssessments: [advisor('low', { confidence: 'low' })] }));
-
-  assert.equal(invalid.status, 'HUMAN_REQUIRED');
-  assert.equal(invalid.advisorSummary.invalidCount, 1);
-  assert.equal(lowConfidence.status, 'WARN');
-  assert.equal(lowConfidence.advisorSummary.lowConfidenceCount, 1);
-  assert.deepEqual(lowConfidence.allowedNextActions, ['inspect-evidence']);
-  assert.deepEqual(lowConfidence.forbiddenNextActions, ['ship', 'truth-alignment-approval', 'mark-task-complete', 'stage-pass']);
-});
-
-test('workflow gate policy hashes selected evidence and carries gate binding', () => {
-  const selectedPayload = selectedEvidencePayload('artifacts/validation-T1.md', 'digest-validation');
-  const decision = synthesizeWorkflowGateDecision(packet({
-    canonicalEvidenceRefs: ['artifacts/validation-T1.md'],
-    selectedEvidence: { source: 'candidate_payloads', evidenceSet: null, pointer: null, payloads: [selectedPayload] },
-    fanInEvidenceSets: [{
-      contract: STAGE_TEAM_RUNTIME_CONTRACT_VERSION,
-      fanInId: 'fanin-001',
-      partition: 'feature',
-      runId: 'run-001',
-      taskId: 'T1',
-      stage: 'test',
-      roleResultIds: [],
-      durableGapIds: [],
-      proposalRefs: [],
-      advisorAssessmentIds: [],
-      evidenceRefs: ['artifacts/review-T1.md'],
-      canonicalEvidenceRefs: ['artifacts/review-T1.md'],
-      gateInputOnly: true,
-      createdAt: generatedAt,
-      payload: {}
-    }]
-  }));
-
-  assert.match(decision.decisionId, /^gate-[a-f0-9]{16}$/);
-  assert.equal(decision.status, 'PASS');
-  assert.deepEqual(decision.evidenceRefs, ['artifacts/validation-T1.md']);
-  assert.deepEqual(decision.payload, {
-    contract: WORKFLOW_GATE_RUNTIME_CONTRACT_VERSION,
-    packetId: 'packet-001',
-    workflowScope: { waveRunId: null, taskIds: ['T1'], runIds: ['run-001'], evidenceRefs: [] },
-    evidenceBinding: {
-      contract: 'sdd-gate-evidence-binding-v1',
-      branch: 'feature',
-      gate: 'ship',
-      selectionPointerRef: null,
-      acceptedEvidenceSetRef: null,
-      source: 'candidate_payloads',
-      selectedRefs: [{ payloadId: selectedPayload.payloadId, logicalRef: selectedPayload.logicalRef, digest: selectedPayload.digest, status: selectedPayload.status }],
-      blockedRefs: [],
-      selectionReasons: [],
-      decision: 'pass',
-      reasons: []
-    }
-  });
-});
-
-function packet(overrides: Partial<WorkflowGateEvidencePacket> = {}): WorkflowGateEvidencePacket {
-  return {
-    packetId: 'packet-001',
-    generatedAt,
-    decisionKind: 'ship',
-    partition: 'feature',
-    taskId: 'T1',
-    runId: 'run-001',
-    documents: {} as WorkflowGateEvidencePacket['documents'],
-    latestEligibleSelection: null,
-    latestEligibleSelections: [],
-    workflowScope: { waveRunId: null, taskIds: ['T1'], runIds: ['run-001'], evidenceRefs: [] },
-    runtimeHealth: { status: 'ok', issues: [] },
-    durableGaps: [],
-    dependencyBlockers: [],
-    affectedFileConflicts: [],
-    fanInEvidenceSets: [],
-    advisorAssessments: [],
-    selectedEvidence: { source: 'none', evidenceSet: null, pointer: null, payloads: [] },
-    canonicalEvidenceRefs: [],
-    requiredArtifactRefs: [],
-    artifactPayloadHealth: [],
-    hardChecks: [],
-    ...overrides
-  };
-}
-
-function selectedEvidencePayload(logicalRef: string, digest: string): WorkflowGateEvidencePacket['selectedEvidence']['payloads'][number] {
-  return {
-    payloadId: `payload-${digest}`,
-    runId: 'run-001',
-    sourceRunId: 'run-001',
-    branchSlug: 'feature',
-    taskId: 'T1',
-    logicalRef,
-    physicalPayloadPath: logicalRef,
-    artifactRole: 'validation',
-    digest,
-    sequence: 1,
-    status: 'active',
-    supersedes: null,
-    createdAt: generatedAt,
-    payload: {}
-  };
-}
-
-function advisor(concern: WorkflowGateEvidencePacket['advisorAssessments'][number]['concern'], overrides: Partial<WorkflowGateEvidencePacket['advisorAssessments'][number]> = {}): WorkflowGateEvidencePacket['advisorAssessments'][number] {
-  return {
-    contract: STAGE_TEAM_RUNTIME_CONTRACT_VERSION,
-    assessmentId: `advisor-${concern}`,
-    sessionId: null,
-    partition: 'feature',
-    runId: 'run-001',
-    taskId: 'T1',
-    kind: 'evidence_sufficiency',
-    concern,
-    validity: 'valid',
-    confidence: 'high',
-    advisoryOnly: true,
-    summary: `${concern} concern`,
-    evidenceRefs: [],
-    durableGapIds: [],
-    proposalRefs: [],
-    createdAt: generatedAt,
-    ...overrides,
-    payload: {}
-  };
-}
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+import { WORKFLOW_GATE_RUNTIME_CONTRACT_VERSION, STAGE_TEAM_RUNTIME_CONTRACT_VERSION } from '../contracts.js';
+import { synthesizeWorkflowGateDecision } from './policy.js';
+import type { WorkflowGateEvidencePacket } from './types.js';
+
+const generatedAt = '2026-01-01T00:00:00.000Z';
+
+test('workflow gate policy keeps hard blocks monotonic over advisor concerns', () => {
+  const decision = synthesizeWorkflowGateDecision(packet({
+    hardChecks: [{
+      code: 'validation_failure',
+      severity: 'blocked',
+      scope: 'feature',
+      message: 'Selected run validation failed.',
+      recovery: 'Rerun validation.',
+      refs: ['run-001']
+    }],
+    advisorAssessments: [advisor('none')]
+  }));
+
+  assert.equal(decision.status, 'BLOCKED');
+  assert.equal(decision.decidedBy, 'runtime_policy');
+  assert.deepEqual(decision.forbiddenNextActions, ['ship', 'mark-task-complete', 'stage-pass']);
+});
+
+test('workflow gate policy requires a human for high-concern ship advisors', () => {
+  const decision = synthesizeWorkflowGateDecision(packet({ advisorAssessments: [advisor('high')] }));
+
+  assert.equal(decision.status, 'HUMAN_REQUIRED');
+  assert.equal(decision.humanRequired, true);
+  assert.deepEqual(decision.allowedNextActions, ['create-decision-card', 'inspect-evidence']);
+  assert.equal(decision.forbiddenNextActions.includes('satisfy-with-subagent-output'), true);
+});
+
+test('workflow gate policy treats advisor-only stage transitions without canonical evidence as advisory only', () => {
+  const decision = synthesizeWorkflowGateDecision(packet({
+    decisionKind: 'stage_transition',
+    advisorAssessments: [advisor('low')],
+    canonicalEvidenceRefs: []
+  }));
+
+  assert.equal(decision.status, 'ADVISORY_ONLY');
+  assert.deepEqual(decision.allowedNextActions, ['inspect-advisor-assessments']);
+});
+
+test('workflow gate policy escalates invalid advisors and warns on low confidence', () => {
+  const invalid = synthesizeWorkflowGateDecision(packet({ advisorAssessments: [advisor('low', { validity: 'invalid' })] }));
+  const lowConfidence = synthesizeWorkflowGateDecision(packet({ advisorAssessments: [advisor('low', { confidence: 'low' })] }));
+
+  assert.equal(invalid.status, 'HUMAN_REQUIRED');
+  assert.equal(invalid.advisorSummary.invalidCount, 1);
+  assert.equal(lowConfidence.status, 'WARN');
+  assert.equal(lowConfidence.advisorSummary.lowConfidenceCount, 1);
+  assert.deepEqual(lowConfidence.allowedNextActions, ['inspect-evidence']);
+  assert.deepEqual(lowConfidence.forbiddenNextActions, ['ship', 'mark-task-complete', 'stage-pass']);
+});
+
+test('workflow gate policy hashes stable gate inputs and carries evidence refs', () => {
+  const decision = synthesizeWorkflowGateDecision(packet({
+    canonicalEvidenceRefs: ['artifacts/validation-T1.md'],
+    fanInEvidenceSets: [{
+      contract: STAGE_TEAM_RUNTIME_CONTRACT_VERSION,
+      fanInId: 'fanin-001',
+      partition: 'feature',
+      runId: 'run-001',
+      taskId: 'T1',
+      stage: 'test',
+      roleResultIds: [],
+      durableGapIds: [],
+      proposalRefs: [],
+      advisorAssessmentIds: [],
+      evidenceRefs: ['artifacts/review-T1.md'],
+      canonicalEvidenceRefs: ['artifacts/validation-T1.md'],
+      gateInputOnly: true,
+      createdAt: generatedAt,
+      payload: {}
+    }]
+  }));
+
+  assert.match(decision.decisionId, /^gate-[a-f0-9]{16}$/);
+  assert.equal(decision.status, 'PASS');
+  assert.deepEqual(decision.evidenceRefs, ['artifacts/review-T1.md', 'artifacts/validation-T1.md']);
+  assert.deepEqual(decision.payload, { contract: WORKFLOW_GATE_RUNTIME_CONTRACT_VERSION, packetId: 'packet-001', workflowScope: { waveRunId: null, taskIds: ['T1'], runIds: ['run-001'], evidenceRefs: [] } });
+});
+
+function packet(overrides: Partial<WorkflowGateEvidencePacket> = {}): WorkflowGateEvidencePacket {
+  return {
+    packetId: 'packet-001',
+    generatedAt,
+    decisionKind: 'ship',
+    partition: 'feature',
+    taskId: 'T1',
+    runId: 'run-001',
+    documents: {} as WorkflowGateEvidencePacket['documents'],
+    latestEligibleSelection: null,
+    latestEligibleSelections: [],
+    workflowScope: { waveRunId: null, taskIds: ['T1'], runIds: ['run-001'], evidenceRefs: [] },
+    runtimeHealth: { status: 'ok', issues: [] },
+    durableGaps: [],
+    dependencyBlockers: [],
+    affectedFileConflicts: [],
+    fanInEvidenceSets: [],
+    advisorAssessments: [],
+    canonicalEvidenceRefs: [],
+    requiredArtifactRefs: [],
+    artifactPayloadHealth: [],
+    hardChecks: [],
+    ...overrides
+  };
+}
+
+function advisor(concern: WorkflowGateEvidencePacket['advisorAssessments'][number]['concern'], overrides: Partial<WorkflowGateEvidencePacket['advisorAssessments'][number]> = {}): WorkflowGateEvidencePacket['advisorAssessments'][number] {
+  return {
+    contract: STAGE_TEAM_RUNTIME_CONTRACT_VERSION,
+    assessmentId: `advisor-${concern}`,
+    sessionId: null,
+    partition: 'feature',
+    runId: 'run-001',
+    taskId: 'T1',
+    kind: 'evidence_sufficiency',
+    concern,
+    validity: 'valid',
+    confidence: 'high',
+    advisoryOnly: true,
+    summary: `${concern} concern`,
+    evidenceRefs: [],
+    durableGapIds: [],
+    proposalRefs: [],
+    createdAt: generatedAt,
+    ...overrides,
+    payload: {}
+  };
+}