thumbgate 1.4.3 → 1.4.4

package/scripts/prove-settings.js

@@ -1,279 +0,0 @@
-#!/usr/bin/env node
-'use strict';
-
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-
-const ROOT = path.join(__dirname, '..');
-const SETTINGS_PATH = require.resolve('./settings-hierarchy');
-const PROFILE_ROUTER_PATH = require.resolve('./profile-router');
-const HARNESS_PATH = require.resolve('./natural-language-harness');
-const VERIFY_RUN_PATH = require.resolve('./verify-run');
-const SERVER_STDIO_PATH = require.resolve('../adapters/mcp/server-stdio');
-const DASHBOARD_PATH = require.resolve('./dashboard');
-const TOOL_REGISTRY_PATH = require.resolve('./tool-registry');
-const MCP_ALLOWLISTS_PATH = require.resolve('../config/mcp-allowlists.json');
-
-function resolveProofPaths() {
-  const proofDir = process.env.THUMBGATE_SETTINGS_PROOF_DIR || process.env.THUMBGATE_PROOF_DIR || path.join(ROOT, 'proof');
-  return {
-    proofDir,
-    reportJson: path.join(proofDir, 'settings-report.json'),
-    reportMd: path.join(proofDir, 'settings-report.md'),
-  };
-}
-
-function resetModules() {
-  [
-    SETTINGS_PATH,
-    PROFILE_ROUTER_PATH,
-    HARNESS_PATH,
-    VERIFY_RUN_PATH,
-    SERVER_STDIO_PATH,
-    DASHBOARD_PATH,
-    TOOL_REGISTRY_PATH,
-    MCP_ALLOWLISTS_PATH,
-  ].forEach((modulePath) => {
-    delete require.cache[modulePath];
-  });
-}
-
-function writeJson(filePath, payload) {
-  fs.mkdirSync(path.dirname(filePath), { recursive: true });
-  fs.writeFileSync(filePath, JSON.stringify(payload, null, 2));
-}
-
-function makeTempProject(structure = {}) {
-  const projectRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'thumbgate-settings-project-'));
-  for (const [relativePath, payload] of Object.entries(structure)) {
-    const fullPath = path.join(projectRoot, relativePath);
-    fs.mkdirSync(path.dirname(fullPath), { recursive: true });
-    writeJson(fullPath, payload);
-  }
-  return projectRoot;
-}
-
-function writeReports(results, reportJson, reportMd) {
-  fs.mkdirSync(path.dirname(reportJson), { recursive: true });
-  fs.writeFileSync(reportJson, JSON.stringify(results, null, 2));
-
-  const lines = [
-    '# Settings Hierarchy Proof',
-    '',
-    `- Phase: ${results.phase}`,
-    `- Timestamp: ${results.timestamp}`,
-    `- ${results.passed} passed, ${results.failed} failed`,
-    '',
-    '## Requirements',
-    '',
-  ];
-
-  for (const requirement of Object.values(results.requirements)) {
-    lines.push(`- [${requirement.passed ? 'x' : ' '}] **${requirement.id}** ${requirement.desc}`);
-  }
-
-  fs.writeFileSync(reportMd, `${lines.join('\n')}\n`);
-}
-
-function withClearedEnv(keys, fn) {
-  const previous = new Map(keys.map((key) => [key, process.env[key]]));
-  for (const key of keys) {
-    delete process.env[key];
-  }
-
-  try {
-    return fn();
-  } finally {
-    for (const [key, value] of previous.entries()) {
-      if (value === undefined) {
-        delete process.env[key];
-      } else {
-        process.env[key] = value;
-      }
-    }
-  }
-}
-
-async function run() {
-  const results = {
-    phase: '24-settings-hierarchy',
-    timestamp: new Date().toISOString(),
-    passed: 0,
-    failed: 0,
-    requirements: {},
-  };
-  const { reportJson, reportMd } = resolveProofPaths();
-
-  const checks = [
-    {
-      id: 'SETTINGS-01',
-      desc: 'managed > local > project > user > defaults precedence resolves correctly',
-      fn: () => {
-        const homeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'thumbgate-settings-home-'));
-        const projectRoot = makeTempProject({
-          'config/thumbgate-settings.managed.json': { mcp: { defaultProfile: 'locked' } },
-          '.thumbgate/settings.json': { mcp: { defaultProfile: 'dispatch' } },
-          '.thumbgate/settings.local.json': { mcp: { defaultProfile: 'readonly' } },
-        });
-        writeJson(path.join(homeDir, '.thumbgate', 'settings.json'), {
-          mcp: { defaultProfile: 'commerce' },
-        });
-        const { getSetting } = require('./settings-hierarchy');
-        const profile = getSetting('mcp.defaultProfile', { projectRoot, homeDir });
-        if (profile !== 'locked') {
-          throw new Error(`Expected managed profile override, got ${profile}`);
-        }
-        fs.rmSync(projectRoot, { recursive: true, force: true });
-        fs.rmSync(homeDir, { recursive: true, force: true });
-      },
-    },
-    {
-      id: 'SETTINGS-02',
-      desc: 'settings status returns origin metadata for resolved fields',
-      fn: () => {
-        const projectRoot = makeTempProject({
-          'config/thumbgate-settings.managed.json': { dashboard: { showPolicyOrigins: true } },
-        });
-        const { getSettingsStatus } = require('./settings-hierarchy');
-        const status = getSettingsStatus({ projectRoot, homeDir: projectRoot });
-        const origin = status.origins.find((entry) => entry.path === 'dashboard.showPolicyOrigins');
-        if (!origin || origin.scope !== 'managed') {
-          throw new Error('Expected managed origin for dashboard.showPolicyOrigins');
-        }
-        fs.rmSync(projectRoot, { recursive: true, force: true });
-      },
-    },
-    {
-      id: 'SETTINGS-03',
-      desc: 'profile routing uses settings fallback when env override is absent',
-      fn: () => {
-        const projectRoot = makeTempProject({
-          'config/thumbgate-settings.managed.json': { mcp: { defaultProfile: 'dispatch' } },
-        });
-        try {
-          const routed = withClearedEnv(
-            ['THUMBGATE_MCP_PROFILE', 'CI', 'GITHUB_EVENT_NAME', 'THUMBGATE_SESSION_TYPE', 'THUMBGATE_SUBAGENT_PROFILE'],
-            () => {
-              const { routeProfile } = require('./profile-router');
-              return routeProfile({ settingsOptions: { projectRoot, homeDir: projectRoot } });
-            },
-          );
-          if (routed.profile !== 'dispatch') {
-            throw new Error(`Expected dispatch profile from settings, got ${routed.profile}`);
-          }
-        } finally {
-          fs.rmSync(projectRoot, { recursive: true, force: true });
-        }
-      },
-    },
-    {
-      id: 'SETTINGS-04',
-      desc: 'harness execution is blocked when runtime execution is disabled by settings',
-      fn: () => {
-        const projectRoot = makeTempProject({
-          '.thumbgate/settings.json': { harnesses: { allowRuntimeExecution: false } },
-        });
-        const { runHarness } = require('./natural-language-harness');
-        let blocked = false;
-        try {
-          runHarness('repo-full-verification', {}, {
-            settingsOptions: { projectRoot, homeDir: projectRoot },
-          });
-        } catch (error) {
-          blocked = /disabled by the settings hierarchy/i.test(error.message);
-        }
-        if (!blocked) {
-          throw new Error('Expected harness execution to be blocked by settings');
-        }
-        fs.rmSync(projectRoot, { recursive: true, force: true });
-      },
-    },
-    {
-      id: 'SETTINGS-05',
-      desc: 'dashboard and MCP surfaces expose settings status visibility',
-      fn: () => {
-        const feedbackDir = fs.mkdtempSync(path.join(os.tmpdir(), 'thumbgate-settings-dashboard-'));
-        const { generateDashboard } = require('./dashboard');
-        const dashboard = generateDashboard(feedbackDir);
-        const { TOOLS } = require('./tool-registry');
-        const mcpAllowlists = require('../config/mcp-allowlists.json');
-
-        try {
-          if (!dashboard.settingsStatus || !dashboard.settingsStatus.resolvedSettings) {
-            throw new Error('Dashboard is missing settingsStatus');
-          }
-
-          const settingsTool = TOOLS.find((tool) => tool.name === 'settings_status');
-          if (!settingsTool) {
-            throw new Error('settings_status tool is missing from the registry');
-          }
-
-          const defaultAllowlist = mcpAllowlists.profiles && mcpAllowlists.profiles.default;
-          if (!Array.isArray(defaultAllowlist) || !defaultAllowlist.includes('settings_status')) {
-            throw new Error('settings_status is missing from the default MCP allowlist');
-          }
-        } finally {
-          fs.rmSync(feedbackDir, { recursive: true, force: true });
-        }
-      },
-    },
-    {
-      id: 'SETTINGS-06',
-      desc: 'verify:full includes settings proof and materializes the artifact',
-      fn: () => {
-        const { buildVerifyPlan, recordVerifyWorkflowRun } = require('./verify-run');
-        const plan = buildVerifyPlan('full');
-        if (!plan.some((step) => Array.isArray(step.args) && step.args.includes('prove:settings'))) {
-          throw new Error('verify:full is missing prove:settings');
-        }
-        const feedbackDir = fs.mkdtempSync(path.join(os.tmpdir(), 'thumbgate-settings-proof-run-'));
-        try {
-          const workflowRun = recordVerifyWorkflowRun('full', ROOT, feedbackDir);
-          if (!workflowRun.proofArtifacts.some((artifact) => artifact.endsWith(path.join('proof', 'settings-report.json')))) {
-            throw new Error('Workflow run is missing settings proof artifact');
-          }
-        } finally {
-          fs.rmSync(feedbackDir, { recursive: true, force: true });
-        }
-      },
-    },
-  ];
-
-  for (const check of checks) {
-    try {
-      resetModules();
-      await check.fn();
-      results.passed += 1;
-      results.requirements[check.id] = { id: check.id, desc: check.desc, passed: true };
-    } catch (error) {
-      results.failed += 1;
-      results.requirements[check.id] = {
-        id: check.id,
-        desc: check.desc,
-        passed: false,
-        error: error.message,
-      };
-    } finally {
-      resetModules();
-    }
-  }
-
-  writeReports(results, reportJson, reportMd);
-  console.log(`${results.passed} passed, ${results.failed} failed`);
-  if (results.failed > 0) {
-    process.exitCode = 1;
-  }
-}
-
-if (require.main === module) {
-  run().catch((error) => {
-    console.error(error.stack || error.message);
-    process.exit(1);
-  });
-}
-
-module.exports = {
-  resolveProofPaths,
-  run,
-};

package/scripts/prove-subway-upgrades.js

@@ -1,277 +0,0 @@
-'use strict';
-/**
- * Phase 11: Subway Upgrades — Proof Gate
- *
- * Validates all SUBW-01 through SUBW-05 requirements.
- * Runs Jest tests in Subway (via execSync) to produce pass/fail evidence.
- *
- * Usage:
- *   node scripts/prove-subway-upgrades.js
- *
- * Produces:
- *   proof/subway-upgrades/subway-upgrades-report.json
- *   proof/subway-upgrades/subway-upgrades-report.md
- */
-
-const { execSync } = require('child_process');
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-
-const PROOF_DIR = path.join(__dirname, '..', 'proof', 'subway-upgrades');
-const REPORT_JSON = path.join(PROOF_DIR, 'subway-upgrades-report.json');
-const REPORT_MD = path.join(PROOF_DIR, 'subway-upgrades-report.md');
-
-const REQUIRED_SUBWAY_ARTIFACTS = [
-  ['.claude', 'scripts', 'feedback', 'vector-store.js'],
-  ['.claude', 'scripts', 'feedback', 'dpo-optimizer.js'],
-  ['.claude', 'scripts', 'feedback', 'thompson-sampling.js'],
-  ['.github', 'workflows', 'self-healing-monitor.yml'],
-  ['.github', 'workflows', 'self-healing-auto-fix.yml'],
-];
-
-function hasRequiredSubwayArtifacts(root) {
-  if (!root || !fs.existsSync(root)) return false;
-  return REQUIRED_SUBWAY_ARTIFACTS.every((segments) => fs.existsSync(path.join(root, ...segments)));
-}
-
-function resolveSubwayRoot() {
-  const envRoot = process.env.SUBWAY_ROOT;
-  if (envRoot) return envRoot;
-
-  const candidates = [
-    path.join(__dirname, '..', '..', '..', 'Subway_RN_Demo'),
-    path.join(__dirname, '..', '..', '..', '..', 'Subway_RN_Demo'),
-    path.join(__dirname, '..', '..', 'Subway_RN_Demo'),
-  ];
-  const ready = candidates.find((candidate) => hasRequiredSubwayArtifacts(candidate));
-  if (ready) return ready;
-  return candidates[0];
-}
-
-const SUBWAY_ROOT = resolveSubwayRoot();
-
-function run() {
-  const results = { passed: 0, failed: 0, requirements: {} };
-
-  const checks = [
-    {
-      id: 'SUBW-01',
-      desc: 'LanceDB vector store ported to Subway — upsert + search verified by Jest (vector-store.test.js)',
-      fn: () => {
-        // Verify the Subway vector-store.js exists
-        const vsPath = path.join(SUBWAY_ROOT, '.claude', 'scripts', 'feedback', 'vector-store.js');
-        if (!fs.existsSync(vsPath)) throw new Error(`Missing: ${vsPath}`);
-
-        // Load and verify exports
-        const vs = require(vsPath);
-        if (typeof vs.upsertFeedback !== 'function') throw new Error('upsertFeedback not exported');
-        if (typeof vs.searchSimilar !== 'function') throw new Error('searchSimilar not exported');
-        if (vs.TABLE_NAME !== 'thumbgate_memories') throw new Error(`TABLE_NAME must be thumbgate_memories, got ${vs.TABLE_NAME}`);
-
-        // Run Jest tests
-        const out = execSync(
-          'node --experimental-vm-modules node_modules/.bin/jest --watchman=false --config jest.governance.config.js --testPathPattern=vector-store --forceExit',
-          {
-            cwd: SUBWAY_ROOT,
-            encoding: 'utf8',
-            stdio: 'pipe',
-            env: { ...process.env, THUMBGATE_VECTOR_STUB_EMBED: 'true', NODE_OPTIONS: '--experimental-vm-modules' },
-          }
-        );
-        if (out.includes('FAIL ')) throw new Error(`Jest tests failed:\n${out.slice(-300)}`);
-      },
-    },
-    {
-      id: 'SUBW-02',
-      desc: 'DPO optimizer ported to Subway — buildPreferencePairs + applyDpoAdjustments + dpoLogRatio exported',
-      fn: () => {
-        const dpoPath = path.join(SUBWAY_ROOT, '.claude', 'scripts', 'feedback', 'dpo-optimizer.js');
-        if (!fs.existsSync(dpoPath)) throw new Error(`Missing: ${dpoPath}`);
-
-        // Clear cache for fresh load
-        delete require.cache[require.resolve(dpoPath)];
-        const dpo = require(dpoPath);
-        if (typeof dpo.dpoLogRatio !== 'function') throw new Error('dpoLogRatio not exported');
-        if (typeof dpo.buildPreferencePairs !== 'function') throw new Error('buildPreferencePairs not exported');
-        if (typeof dpo.applyDpoAdjustments !== 'function') throw new Error('applyDpoAdjustments not exported');
-        if (typeof dpo.run !== 'function') throw new Error('run not exported');
-
-        // Verify dpoLogRatio math
-        const adj = dpo.dpoLogRatio(1.0, 0.5);
-        if (typeof adj !== 'number') throw new Error('dpoLogRatio must return number');
-        if (adj <= 0) throw new Error('dpoLogRatio(1.0, 0.5) should be positive (chosen > rejected)');
-
-        // Run Jest tests
-        const out = execSync(
-          'node --experimental-vm-modules node_modules/.bin/jest --watchman=false --config jest.governance.config.js --testPathPattern=dpo-optimizer --forceExit',
-          {
-            cwd: SUBWAY_ROOT,
-            encoding: 'utf8',
-            stdio: 'pipe',
-          }
-        );
-        if (out.includes('FAIL ')) throw new Error(`Jest tests failed:\n${out.slice(-300)}`);
-      },
-    },
-    {
-      id: 'SUBW-03',
-      desc: 'Thompson Sampling JS module ported to Subway — updateModel updates alpha/beta posteriors',
-      fn: () => {
-        const tsPath = path.join(SUBWAY_ROOT, '.claude', 'scripts', 'feedback', 'thompson-sampling.js');
-        if (!fs.existsSync(tsPath)) throw new Error(`Missing: ${tsPath}`);
-
-        delete require.cache[require.resolve(tsPath)];
-        const ts = require(tsPath);
-        if (typeof ts.timeDecayWeight !== 'function') throw new Error('timeDecayWeight not exported');
-        if (typeof ts.loadModel !== 'function') throw new Error('loadModel not exported');
-        if (typeof ts.saveModel !== 'function') throw new Error('saveModel not exported');
-        if (typeof ts.updateModel !== 'function') throw new Error('updateModel not exported');
-        if (typeof ts.getReliability !== 'function') throw new Error('getReliability not exported');
-        if (typeof ts.samplePosteriors !== 'function') throw new Error('samplePosteriors not exported');
-
-        // Verify alpha update
-        const model = ts.createInitialModel();
-        const beforeAlpha = model.categories.testing.alpha;
-        ts.updateModel(model, { signal: 'positive', timestamp: new Date().toISOString(), categories: ['testing'] });
-        if (model.categories.testing.alpha <= beforeAlpha) throw new Error('alpha should increase on positive signal');
-
-        // Run Jest tests
-        const out = execSync(
-          'node --experimental-vm-modules node_modules/.bin/jest --watchman=false --config jest.governance.config.js --testPathPattern=thompson-sampling --forceExit',
-          {
-            cwd: SUBWAY_ROOT,
-            encoding: 'utf8',
-            stdio: 'pipe',
-          }
-        );
-        if (out.includes('FAIL ')) throw new Error(`Jest tests failed:\n${out.slice(-300)}`);
-      },
-    },
-    {
-      id: 'SUBW-04',
-      desc: 'Self-healing GH Action workflows exist in Subway .github/workflows/',
-      fn: () => {
-        const monitorPath = path.join(SUBWAY_ROOT, '.github', 'workflows', 'self-healing-monitor.yml');
-        const autoFixPath = path.join(SUBWAY_ROOT, '.github', 'workflows', 'self-healing-auto-fix.yml');
-        if (!fs.existsSync(monitorPath)) throw new Error(`Missing: ${monitorPath}`);
-        if (!fs.existsSync(autoFixPath)) throw new Error(`Missing: ${autoFixPath}`);
-
-        // Verify key fields in monitor workflow
-        const monitorContent = fs.readFileSync(monitorPath, 'utf-8');
-        if (!monitorContent.includes('self-healing-check.js')) {
-          throw new Error('self-healing-monitor.yml must reference self-healing-check.js');
-        }
-        if (!monitorContent.includes('self-heal.js')) {
-          throw new Error('self-healing-monitor.yml must reference self-heal.js');
-        }
-
-        // Verify auto-fix workflow
-        const autoFixContent = fs.readFileSync(autoFixPath, 'utf-8');
-        if (!autoFixContent.includes('self-heal.js')) {
-          throw new Error('self-healing-auto-fix.yml must reference self-heal.js');
-        }
-      },
-    },
-    {
-      id: 'SUBW-05',
-      desc: 'All Phase 11 Subway Jest tests pass with 0 failures (vector-store, dpo-optimizer, thompson-sampling)',
-      fn: () => {
-        // Use combined stderr+stdout to capture Jest output (it writes to stderr)
-        let out = '';
-        try {
-          out = execSync(
-            'npx jest --watchman=false --config jest.governance.config.js --testPathPattern="vector-store|dpo-optimizer|thompson-sampling" --forceExit 2>&1',
-            {
-              cwd: SUBWAY_ROOT,
-              encoding: 'utf8',
-              env: { ...process.env, THUMBGATE_VECTOR_STUB_EMBED: 'true', NODE_OPTIONS: '--experimental-vm-modules' },
-            }
-          );
-        } catch (err) {
-          // execSync throws on non-zero exit — capture output from err.stdout/stderr
-          out = (err.stdout || '') + (err.stderr || '');
-          // If there are actual test failures in the output, throw; otherwise re-check
-          const failMatch = out.match(/Tests:\s+(\d+) failed/);
-          if (failMatch && parseInt(failMatch[1], 10) > 0) {
-            throw new Error(`${failMatch[1]} Jest test failure(s):\n${out.slice(-500)}`);
-          }
-        }
-        // Verify at least 25 tests passed
-        const passMatch = out.match(/Tests:\s+.*?(\d+) passed/);
-        const passCnt = passMatch ? parseInt(passMatch[1], 10) : 0;
-        if (passCnt < 25) throw new Error(`Expected >= 25 tests passing, got ${passCnt}`);
-      },
-    },
-  ];
-
-  console.log('Phase 11: Subway Upgrades — Proof Gate\n');
-  console.log('Checking requirements:\n');
-
-  for (const check of checks) {
-    try {
-      check.fn();
-      results.passed++;
-      results.requirements[check.id] = { status: 'pass', desc: check.desc };
-      console.log(`  PASS  ${check.id}: ${check.desc}`);
-    } catch (err) {
-      results.failed++;
-      results.requirements[check.id] = {
-        status: 'fail',
-        desc: check.desc,
-        error: err.message,
-      };
-      console.error(`  FAIL  ${check.id}: ${err.message}`);
-    }
-  }
-
-  // Write proof artifacts
-  fs.mkdirSync(PROOF_DIR, { recursive: true });
-
-  const report = {
-    phase: '11-subway-upgrades',
-    generatedAt: new Date().toISOString(),
-    passed: results.passed,
-    failed: results.failed,
-    total: checks.length,
-    requirements: results.requirements,
-  };
-
-  fs.writeFileSync(REPORT_JSON, JSON.stringify(report, null, 2) + '\n');
-
-  const md = [
-    '# Phase 11: Subway Upgrades — Proof Report',
-    '',
-    `Generated: ${report.generatedAt}`,
-    `Result: ${results.passed}/${checks.length} passed`,
-    '',
-    '## Requirements',
-    '',
-    ...Object.entries(results.requirements).map(([id, r]) => {
-      const checkbox = r.status === 'pass' ? '[x]' : '[ ]';
-      const errLine = r.error ? `\n  - Error: \`${r.error}\`` : '';
-      return `- ${checkbox} **${id}**: ${r.desc}${errLine}`;
-    }),
-    '',
-    '## Evidence',
-    '',
-    '- `Subway/.claude/scripts/feedback/vector-store.js` — LanceDB upsert + semantic search (3-level PATH from root)',
-    '- `Subway/.claude/scripts/feedback/dpo-optimizer.js` — Offline batch DPO optimization (sibling requires)',
-    '- `Subway/.claude/scripts/feedback/thompson-sampling.js` — Beta-Bernoulli posteriors with inline parseTimestamp',
-    '- `Subway/.github/workflows/self-healing-monitor.yml` — Scheduled health check + issue creation',
-    '- `Subway/.github/workflows/self-healing-auto-fix.yml` — Scheduled self-heal + remediation PR',
-    '- `Subway/scripts/__tests__/vector-store.test.js` — 6 Jest tests (NODE_OPTIONS=--experimental-vm-modules)',
-    '- `Subway/scripts/__tests__/dpo-optimizer.test.js` — 7 Jest tests',
-    '- `Subway/scripts/__tests__/thompson-sampling.test.js` — 10 Jest tests',
-    '',
-  ].join('\n');
-
-  fs.writeFileSync(REPORT_MD, md);
-
-  console.log(`\nPhase 11 proof: ${results.passed} passed, ${results.failed} failed`);
-  console.log(`Report: ${REPORT_JSON}`);
-
-  if (results.failed > 0) process.exit(1);
-}
-
-run();