pactkit-opencode 3.0.5__tar.gz → 3.1.0__tar.gz

{pactkit_opencode-3.0.5 → pactkit_opencode-3.1.0}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: pactkit-opencode
-Version: 3.0.5
+Version: 3.1.0
 Summary: PactKit adapter for OpenCode IDE
 License-Expression: MIT
 Requires-Python: >=3.10
-Requires-Dist: pactkit<3.1.0,>=3.0.1
+Requires-Dist: pactkit<3.2.0,>=3.0.1

{pactkit_opencode-3.0.5 → pactkit_opencode-3.1.0}/pyproject.toml

@@ -4,12 +4,12 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pactkit-opencode"
-version = "3.0.5"
+version = "3.1.0"
 description = "PactKit adapter for OpenCode IDE"
 requires-python = ">=3.10"
 license = "MIT"
 dependencies = [
-    "pactkit>=3.0.1,<3.1.0",
+    "pactkit>=3.0.1,<3.2.0",
 ]
 
 [project.entry-points."pactkit.deployers"]

{pactkit_opencode-3.0.5 → pactkit_opencode-3.1.0}/src/pactkit_opencode.egg-info/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: pactkit-opencode
-Version: 3.0.5
+Version: 3.1.0
 Summary: PactKit adapter for OpenCode IDE
 License-Expression: MIT
 Requires-Python: >=3.10
-Requires-Dist: pactkit<3.1.0,>=3.0.1
+Requires-Dist: pactkit<3.2.0,>=3.0.1

{pactkit_opencode-3.0.5 → pactkit_opencode-3.1.0}/src/pactkit_opencode.egg-info/SOURCES.txt

@@ -13,13 +13,16 @@ src/pactkit_opencode.egg-info/top_level.txt
 tests/test_a1_config_recovery.py
 tests/test_a2_mcp_retired.py
 tests/test_bug035_opencode_dual_layer.py
+tests/test_capability_contract.py
 tests/test_deploy_opencode_parity.py
 tests/test_gate_plugin_deploy.py
 tests/test_host_body_snapshot.py
 tests/test_opencode_enforcement_channel.py
+tests/test_profile_contract.py
 tests/test_step6_self_sufficiency.py
 tests/test_story069_opencode_format.py
 tests/test_story070_opencode_compliance.py
 tests/test_story071_opencode_config_parity.py
 tests/test_story073_command_model_routing.py
-tests/test_story_work_units.py
+tests/test_story_work_units.py
+tests/test_wire_format_contract.py

pactkit_opencode-3.1.0/src/pactkit_opencode.egg-info/requires.txt

@@ -0,0 +1 @@
+pactkit<3.2.0,>=3.0.1

pactkit_opencode-3.1.0/tests/test_capability_contract.py

@@ -0,0 +1,112 @@
+"""SPEC-4.0-22 Step 7 — 本宿主的 capability / deployment claim / pretool 契约。
+
+**为什么这份测试在本仓。** 这三张表（能力声明、部署声明、pre-tool 机制名）
+自 Step 6/7 起由本 adapter 自带并经 entry-point 注册。core 侧只保留它随包发布
+的 `classic`。所以「本宿主能做什么、怎么执行、pre-tool 机制叫什么」的断言属于
+**本仓**——生产里的事实归谁，断言就归谁。
+
+core 侧对应断言（`test_spec40_22_capability_registry.py` 的宿主值行）已随之删除。
+**是搬迁，不是复制**：两处各留一份就是给同一个事实造两个真相源。
+"""
+
+from __future__ import annotations
+
+from pactkit.capability import resolve_capabilities
+from pactkit.generators.deploy_base import _ensure_entry_point_deployers
+from pactkit.profiles import registered_adapters
+
+HOST = "opencode"
+PRETOOL = 'tool.execute.before (plugin; veto by throwing)'
+CLAIM = ('portable', 'adapter_native_command_facade')
+ENV_CAPABLE = {'opencode.json'}
+PROTECTED = set()
+CONDITIONAL = set()
+PRESENT = ['git_hook', 'native_command', 'native_skill', 'pre_tool_hook', 'project_instruction', 'shell_execution']
+
+
+def _registration():
+    _ensure_entry_point_deployers()
+    return registered_adapters()[HOST]
+
+
+class TestTheDeclarationReachesTheRegistry:
+    def test_the_registry_carries_this_hosts_claim(self):
+        claim = _registration().deployment_claim
+        assert (claim.execution_mode, claim.verification_source) == CLAIM
+
+    def test_the_registry_carries_this_hosts_pretool_mechanism(self):
+        assert _registration().pretool_surface == PRETOOL
+
+
+class TestTheCapabilityDeclaration:
+    def test_the_present_set_is_exactly_this(self):
+        """**逐项**钉住，不是只钉个数——多一项少一项都要红。
+
+        迁移前基线是 6 项；这条断言的是同一批名字，所以它既防漏声明，
+        也防「为了让表看起来完整」而虚报一项。
+        """
+        resolved = resolve_capabilities(HOST)
+        assert resolved.known
+        present = sorted(n for n, e in resolved.entries.items() if e.present)
+        assert present == PRESENT
+
+    def test_every_declared_entry_carries_evidence(self):
+        for name, entry in resolve_capabilities(HOST).entries.items():
+            assert entry.evidence, f"{name} 没有证据来源——那就是一个断言，不是声明"
+
+    def test_the_declaration_is_not_empty(self):
+        assert _registration().capabilities, (
+            "本宿主没有声明任何能力——registry 会把每一项都填成 Degraded"
+        )
+
+
+class TestTheContractHasTeeth:
+    """反证：改坏本仓的声明，上面必须有测试变红。"""
+
+    def test_mutating_the_claim_moves_the_answer(self):
+        import dataclasses
+
+        from pactkit.profiles import register_adapter
+        import pactkit_opencode.declarations as decl
+
+        entry = _registration()
+        broken = dataclasses.replace(
+            entry.deployment_claim, verification_source="mutated"
+        )
+        register_adapter(HOST, deployer=entry.deployer, profile=entry.profile,
+                         deployment_claim=broken)
+        try:
+            assert _registration().deployment_claim.verification_source == "mutated", (
+                "改掉本仓的声明后 registry 没变——core 侧还有第二份真相源"
+            )
+        finally:
+            register_adapter(HOST, deployer=entry.deployer, profile=entry.profile,
+                             deployment_claim=decl.DEPLOYMENT_CLAIM)
+
+
+# ---------------------------------------------------------------------------
+# 安全事实（SPEC-4.0-22 R8 / Step 7）
+# ---------------------------------------------------------------------------
+
+
+class TestTheSecurityFacts:
+    """这三类的定义域是 **PactKit gate-relative**：`env` 能到达 gate 进程的文件、
+    gate 不许任何人编辑的文件、移除 gate 条目算篡改的文件。
+
+    所以它们是**本宿主的声明**——core 侧那张跨宿主表已随 Step 7 删除，这里的
+    断言跟事实走。
+    """
+
+    def test_the_declared_files_are_exactly_these(self):
+        s = _registration().security
+        assert set(s.env_capable.files) == ENV_CAPABLE
+        assert set(s.protected.files) == PROTECTED
+        assert set(s.conditional.files) == CONDITIONAL
+
+    def test_the_declaration_is_complete(self):
+        """`missing`（宿主没说话）与 `empty`（宿主说了它没有）是两件事。
+
+        声明不完整时，需要 tamper_guard 授权的写操作会 fail closed——那是
+        R8 的设计，不是缺陷。所以「完整」本身是要被钉住的事实。
+        """
+        assert _registration().security.complete

pactkit_opencode-3.1.0/tests/test_host_body_snapshot.py

@@ -0,0 +1,262 @@
+"""This host's deployed prompt bodies, pinned against a golden (R7/AC10).
+
+2026-09-12 review (83/100, gap 2): the zero-credential acceptance split
+left adapter-host body comparison out of CI — the core workflow compares
+classic only. This suite pins the OPENCODE deployment's prompt bodies:
+
+- digest drift (a rule edited or deleted inside a prompt body) fails,
+  naming the file;
+- a core version mismatch fails with an explicit action — regenerate the
+  golden against the new core, or publish the matching core release
+  (PENDING-COMPATIBLE-CORE, see the spec R8 release-window semantics);
+- a probe test deploys, edits one body in place, and proves the SAME
+  comparison logic flags it (删改必被检出, not vacuous).
+
+**Two kinds of artifact, two kinds of assertion** (SPEC-4.0-22 Step 7).
+A prompt body is stable content, so a snapshot is the right instrument. A
+*deployed manifest* and the *gate plugin* are a function of **which adapters
+are installed**, so snapshotting them would freeze "whatever happened to be
+installed on the machine that regenerated the golden" — the golden would then
+be reproducible only there, and CI (which installs core + this adapter alone)
+would go red on a change that is not a regression.
+
+Measured 2026-09-26: a `core+opencode` deploy and an all-four-adapters deploy
+differ in **exactly two files** — `.pactkit-deployed.json` and
+`plugins/pactkit-gate.js` — and in nothing else. Those two are excluded from
+the golden and covered by `TestEnvironmentDerivedArtifactsAreConsistent`
+instead: their bytes may differ between environments, but each environment
+must be internally consistent.
+
+Before Step 7 the distinction was invisible. The transitional seed made
+`PACTKIT_YAML_CANDIDATES` a constant, so the plugin — and therefore the
+manifest that records its hash — was identical everywhere. The golden was
+reproducible for the wrong reason, and removing the seed is what made the
+instrument's real boundary visible.
+
+Regenerate with: tests/scripts/refresh_host_body_golden.py
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+sys.path.insert(0, str(Path(__file__).resolve().parent / "scripts"))
+
+from refresh_host_body_golden import (  # noqa: E402
+    DEPLOY_SUFFIXES,
+    ENVIRONMENT_DERIVED,
+)
+
+HOST = "opencode"
+GOLDEN = Path(__file__).parent / "fixtures" / "host_body_golden.json"
+
+#: The plugin's marker list, as emitted by
+#: `pactkit.generators.opencode_plugin.render_plugin_source`.
+_MARKERS_RE = re.compile(r"const PROJECT_MARKERS = (\[.*?\])\n", re.S)
+
+
+def _core_version() -> str:
+    import importlib.metadata as m
+
+    return m.version("pactkit")
+
+
+def _normalize(content: str, deploy_root: str) -> str:
+    """Strip only the deterministic environment difference: the deploy root
+    path baked into rendered prompts. Rule text stays — normalizing it would
+    swallow the drift this suite exists to catch."""
+    return content.replace(deploy_root, "<DEPLOY_ROOT>")
+
+
+def _deploy(tmp_path: Path) -> tuple[Path, subprocess.CompletedProcess]:
+    """Deploy this host into `tmp_path`; returns (deploy root, process)."""
+    home = tmp_path / "home"
+    target = tmp_path / "deploy"
+    home.mkdir(exist_ok=True)
+    proc = subprocess.run(
+        [sys.executable, "-m", "pactkit", "init", "--format", HOST, "--target", str(target)],
+        capture_output=True, text=True, timeout=180,
+        env={"PATH": "/usr/bin:/bin", "HOME": str(home), "COLUMNS": "200"},
+    )
+    return target, proc
+
+
+def _deployed_digests(tmp_path: Path) -> tuple[dict[str, str] | None, subprocess.CompletedProcess]:
+    target, proc = _deploy(tmp_path)
+    if proc.returncode != 0:
+        return None, proc
+    digests: dict[str, str] = {}
+    for path in sorted(target.rglob("*")):
+        rel = path.relative_to(target).as_posix()
+        if not path.is_file() or path.suffix not in DEPLOY_SUFFIXES:
+            continue
+        if rel in ENVIRONMENT_DERIVED:
+            continue
+        body = _normalize(path.read_text(encoding="utf-8"), str(target))
+        digests[rel] = hashlib.sha256(body.encode("utf-8")).hexdigest()
+    return digests, proc
+
+
+def _assert_no_drift(golden_digests: dict[str, str], live: dict[str, str]) -> None:
+    """The one comparison both the golden test and the tamper probe use."""
+    changed = sorted(
+        k for k in set(golden_digests) & set(live) if golden_digests[k] != live[k]
+    )
+    removed = sorted(set(golden_digests) - set(live))
+    added = sorted(set(live) - set(golden_digests))
+    assert not (changed or removed or added), (
+        f"prompt body drift: changed={changed} removed={removed} added={added} "
+        f"— if the core prompts changed, regenerate the golden "
+        f"(tests/scripts/refresh_host_body_golden.py) or publish the matching "
+        f"core release first (PENDING-COMPATIBLE-CORE)"
+    )
+
+
+def _markers_from(source: str) -> list[str]:
+    m = _MARKERS_RE.search(source)
+    assert m, "the deployed plugin has no `const PROJECT_MARKERS = [...]` block"
+    return json.loads(m.group(1))
+
+
+class TestHostBodySnapshot:
+    def test_bodies_match_the_golden(self, tmp_path):
+        golden = json.loads(GOLDEN.read_text(encoding="utf-8"))
+        core_v = _core_version()
+        if golden["core_version"] != core_v:
+            pytest.fail(
+                f"PENDING-COMPATIBLE-CORE: the {HOST} golden was generated "
+                f"against core {golden['core_version']}, this environment has "
+                f"{core_v}. Either regenerate it after the core change "
+                f"(tests/scripts/refresh_host_body_golden.py) or publish the "
+                f"matching core release first (spec R8 release-window semantics)."
+            )
+        live, proc = _deployed_digests(tmp_path)
+        assert live is not None, (
+            f"{HOST} deploy failed: {proc.stdout[-300:]}{proc.stderr[-300:]}"
+        )
+        _assert_no_drift(golden["body_digests"], live)
+
+    def test_the_golden_pins_no_environment_derived_artifact(self):
+        """**边界断言**：golden 里不许出现环境相关产物。
+
+        没有这条，下一个再生的人在装了四个 adapter 的机器上跑一次脚本，就会把
+        本机环境冻回 golden 里，而 CI（core+self）再次变红——正是这次修的形态。
+        """
+        golden = json.loads(GOLDEN.read_text(encoding="utf-8"))
+        leaked = sorted(set(golden["body_digests"]) & set(ENVIRONMENT_DERIVED))
+        assert not leaked, (
+            f"the golden pins environment-derived artifacts: {leaked}. Their "
+            f"bytes are a function of which adapters are installed; pinning "
+            f"them makes the golden reproducible only on the machine that "
+            f"generated it. See TestEnvironmentDerivedArtifactsAreConsistent."
+        )
+
+    def test_a_body_edit_is_caught_by_the_same_comparison(self, tmp_path):
+        """Non-vacuity, end to end: deploy, edit one prompt body in place,
+        and the SAME comparison that guards the golden must flag it."""
+        golden = json.loads(GOLDEN.read_text(encoding="utf-8"))
+        live, proc = _deployed_digests(tmp_path)
+        assert live is not None, f"{HOST} deploy failed: {proc.stderr[-300:]}"
+        target = tmp_path / "deploy"
+        # Pick a real deployed prompt body and delete one rule line from it.
+        victims = sorted(
+            p for p in target.rglob("*.md") if p.relative_to(target).as_posix() in golden["body_digests"]
+        )
+        assert victims, "no deployed .md body found to tamper with"
+        victim = victims[0]
+        rel = victim.relative_to(target).as_posix()
+        body = victim.read_text(encoding="utf-8")
+        victim.write_text(body + "\n- deleted in a review\n", encoding="utf-8")
+
+        tampered = {
+            p.relative_to(target).as_posix(): hashlib.sha256(
+                _normalize(p.read_text(encoding="utf-8"), str(target)).encode("utf-8")
+            ).hexdigest()
+            for p in sorted(target.rglob("*"))
+            if p.is_file()
+            and p.suffix in DEPLOY_SUFFIXES
+            and p.relative_to(target).as_posix() not in ENVIRONMENT_DERIVED
+        }
+        with pytest.raises(AssertionError, match=rel):
+            _assert_no_drift(golden["body_digests"], tampered)
+
+
+class TestEnvironmentDerivedArtifactsAreConsistent:
+    """环境相关产物：字节**可以**随已安装 adapter 集合变化，但必须自洽。
+
+    SPEC-4.0-22 Step 7 之后 `PACTKIT_YAML_CANDIDATES` 是 registry 的活视图，
+    于是插件的 `PROJECT_MARKERS`（以及 manifest 里记的插件摘要）都随环境变化。
+    这类产物的正确仪器是 **invariant**，不是 snapshot——snapshot 会把"本机装了
+    什么"冻成期望值。
+
+    这三条在 `core+opencode` 与"四个 adapter 全装"两个环境下**都**成立，且各自
+    断言各自环境的值。
+    """
+
+    def test_the_plugin_carries_the_current_candidate_list(self, tmp_path):
+        """插件的 `PROJECT_MARKERS` 必须等于**当前**的候选清单。
+
+        这是独立于生成器的那一半：它读**部署出来的 JS** 与**活的 registry**，
+        不问 `render_plugin_source()`。生成器若改了 marker 的来源，这条会红。
+
+        `_ensure_entry_point_deployers()` 必须先跑：`PACTKIT_YAML_CANDIDATES` 是
+        registry 的**活视图**，但本测试进程只 import 了本宿主（conftest），别的
+        adapter 要靠 entry-point discovery 才注册；而子进程里的 CLI 会触发它。
+        不先跑，两边比的就是**两个不同的 registry**。
+        """
+        from pactkit.generators.deploy_base import _ensure_entry_point_deployers
+        from pactkit.profiles import PACTKIT_YAML_CANDIDATES, SHARED_PACTKIT_YAML
+
+        _ensure_entry_point_deployers()
+        target, proc = _deploy(tmp_path)
+        assert proc.returncode == 0, proc.stderr[-300:]
+        source = (target / "plugins" / "pactkit-gate.js").read_text(encoding="utf-8")
+
+        expected = [*PACTKIT_YAML_CANDIDATES, SHARED_PACTKIT_YAML]
+        markers = _markers_from(source)
+        assert markers == expected, (
+            f"the plugin's marker list is not the current candidate list: "
+            f"{markers} != {expected}"
+        )
+        assert markers, "anti-vacuity: the marker list is empty"
+
+    def test_the_manifest_records_the_plugin_it_wrote(self, tmp_path):
+        """manifest 记的插件 sha256 必须等于**实际写出的**插件字节。"""
+        target, proc = _deploy(tmp_path)
+        assert proc.returncode == 0, proc.stderr[-300:]
+        manifest = json.loads(
+            (target / ".pactkit-deployed.json").read_text(encoding="utf-8")
+        )
+        rel = "plugins/pactkit-gate.js"
+        assert rel in manifest["files"], (
+            f"the plugin is not recorded in the manifest: {sorted(manifest['files'])}"
+        )
+        actual = hashlib.sha256((target / rel).read_bytes()).hexdigest()
+        assert manifest["files"][rel] == actual, (
+            "the manifest's plugin digest is not the plugin on disk — a stale "
+            "hash would make the deploy look verified while the file changed"
+        )
+
+    def test_every_recorded_file_is_on_disk_with_that_digest(self, tmp_path):
+        """`files` map 自洽：每一条都在盘上，且摘要相符。"""
+        target, proc = _deploy(tmp_path)
+        assert proc.returncode == 0, proc.stderr[-300:]
+        manifest = json.loads(
+            (target / ".pactkit-deployed.json").read_text(encoding="utf-8")
+        )
+        files = manifest["files"]
+        assert files, "anti-vacuity: the manifest records no files"
+        wrong = sorted(
+            rel
+            for rel, digest in files.items()
+            if not (target / rel).is_file()
+            or hashlib.sha256((target / rel).read_bytes()).hexdigest() != digest
+        )
+        assert not wrong, f"the manifest disagrees with the disk for: {wrong}"

pactkit_opencode-3.1.0/tests/test_profile_contract.py

@@ -0,0 +1,191 @@
+"""SPEC-4.0-22 Step 7 — 本宿主的 profile 契约。
+
+**为什么这份测试在本仓。** opencode 的 `FormatProfile` 自 Step 6/7 起由本 adapter
+自带并经 entry-point 注册；core 侧只保留它随包发布的 `classic`。所以「opencode 的
+全局配置目录是什么」「它的命令以什么形态落盘」这类断言属于**本仓**——生产里的
+事实在谁那里，断言就在谁那里。
+
+core 侧对应的 core 侧对应的 profile 值断言
+已随之删除。**是搬迁，不是复制**：两处各留一份，就是给同一个事实造两个真相源，
+而漂移的那天两边都会绿。
+"""
+
+from __future__ import annotations
+
+from typing import cast
+
+import pytest
+
+from pactkit.profiles import (
+    CLIPolicy,
+    FormatProfile,
+    get_profile,
+)
+from pactkit_opencode.declarations import PROFILE
+
+SPEC = cast(FormatProfile, PROFILE)
+
+
+class TestTheProfileIsReachable:
+    """注册真的发生，且生产读路径（registry）能拿到它。"""
+
+    def test_it_is_registered(self):
+        from pactkit.generators.deploy_base import _ensure_entry_point_deployers
+
+        _ensure_entry_point_deployers()
+        assert get_profile("opencode").name == "opencode"
+
+    def test_get_profile_returns_the_same_object(self):
+        from pactkit.generators.deploy_base import _ensure_entry_point_deployers
+        from pactkit.profiles import get_registration
+
+        _ensure_entry_point_deployers()
+        assert get_registration("opencode").profile is SPEC, (
+            "registry 里那份不是本仓声明的这个对象——说明还有第二个真相源"
+        )
+
+    def test_it_is_a_format_profile(self):
+        assert isinstance(SPEC, FormatProfile)
+
+    def test_it_is_frozen(self):
+        with pytest.raises(AttributeError):
+            SPEC.name = "modified"
+
+
+class TestThePathFacts:
+    """本宿主的目录布局——**实测值**，不是从 core 抄来的默认值。"""
+
+    @pytest.mark.parametrize(
+        "field,expected",
+        [
+            ("name", "opencode"),
+            ("display_name", "OpenCode"),
+            ("global_config_dir", "~/.config/opencode"),
+            ("project_config_dir", ".opencode"),
+            ("skills_dir", "~/.config/opencode/skills"),
+            ("agents_dir", "~/.config/opencode/agents"),
+            ("rules_dir", "~/.config/opencode/rules"),
+            ("project_instructions_file", "AGENTS.md"),
+            ("pactkit_yaml_path", ".opencode/pactkit.yaml"),
+            ("agent_format", "md"),
+            ("rules_import_style", "inline"),
+            ("skills_path_var", "~/.config/opencode/skills"),
+        ],
+    )
+    def test_field(self, field, expected):
+        assert getattr(SPEC, field) == expected
+
+
+class TestTheMeasuredLayoutFact:
+    def test_commands_deploy_flat(self):
+        """**实测**（2026-09-22）：opencode 是唯一命令**平铺**落盘的宿主。
+
+        `commands_dir` 恰好也指向那里，所以两者容易混为一谈——这正是这一条要
+        钉死的：布局事实是 `command_deploy_form`，不是目录名。
+        """
+        assert SPEC.command_deploy_form == "flat", (
+            "opencode 的命令平铺落盘；改成 `skill`/`prompt` 会让产物落错地方"
+        )
+
+
+class TestTheExcludedFields:
+    """哪些字段在本宿主上没有意义——**这是本宿主的判断**，不是 core 的默认。"""
+
+    def test_claude_only_agent_fields_are_excluded(self):
+        for field in ("permissionMode", "memory", "skills"):
+            assert field in SPEC.excluded_agent_fields, (
+                f"{field} 没被排除——它会作为无意义的字段写进 agent 文件"
+            )
+
+    def test_no_command_is_excluded(self):
+        assert SPEC.excluded_commands == frozenset()
+
+
+class TestTheCLIPolicy:
+    def test_opencode_requires_the_pactkit_cli(self):
+        assert SPEC.cli_policy is CLIPolicy.REQUIRED
+
+    def test_has_pactkit_cli_is_derived_from_the_policy(self):
+        assert SPEC.has_pactkit_cli is True
+
+
+class TestTheDeclaredDialects:
+    """opencode **调共享 writer**，所以这两个字段有真消费者，必须声明。
+
+    在 BUG-slim-20260923aeb5e4807a2b 之前它们是「非 classic」隐含推出来的——
+    恰好对这两个调用者成立，所以一直没被发现。
+    """
+
+    @pytest.mark.parametrize("field", ["agent_dialect", "command_dialect"])
+    def test_it_declares_opencode(self, field):
+        assert getattr(SPEC, field) == "opencode", (
+            f"{field} 没有声明——共享 writer 会去借别的宿主的方言"
+        )
+
+
+class TestTheLiveViewsSeeIt:
+    """core 的活视图（`VALID_FORMATS` / `PACTKIT_YAML_CANDIDATES`）在注册后
+    必须包含本宿主——**这是 core 的机制**，但只有本仓能把它端到端证明。"""
+
+    def test_it_is_in_valid_formats(self):
+        from pactkit.generators.deploy_base import _ensure_entry_point_deployers
+        from pactkit.profiles import VALID_FORMATS
+
+        _ensure_entry_point_deployers()
+        assert "opencode" in VALID_FORMATS
+
+    def test_its_config_path_is_a_discovery_candidate(self):
+        from pactkit.generators.deploy_base import _ensure_entry_point_deployers
+        from pactkit.profiles import PACTKIT_YAML_CANDIDATES
+
+        _ensure_entry_point_deployers()
+        assert SPEC.pactkit_yaml_path in PACTKIT_YAML_CANDIDATES
+
+
+class TestTheContractHasTeeth:
+    """反证：改坏声明，上面必须有测试变红。
+
+    没有这一条，「搬过来了」只是两个仓各自为绿的巧合。
+    """
+
+    def test_the_profile_is_what_get_profile_answers(self):
+        """把本仓的声明换掉，`get_profile` 必须跟着变。
+
+        若它不变，说明 core 还留着一份——那正是「复制一份、core 还留一份」的形态。
+        """
+        import dataclasses
+
+        import pactkit_opencode.declarations as decl
+        from pactkit.generators.deploy_base import _ensure_entry_point_deployers
+        from pactkit.profiles import get_registration, register_adapter
+
+        _ensure_entry_point_deployers()
+        broken = dataclasses.replace(SPEC, display_name="Not OpenCode")
+        register_adapter(
+            "opencode",
+            deployer=get_registration("opencode").deployer,
+            profile=broken,
+        )
+        try:
+            assert get_profile("opencode").display_name == "Not OpenCode", (
+                "改掉本仓的声明后 get_profile 没变——core 侧还有第二份真相源"
+            )
+        finally:
+            register_adapter(
+                "opencode",
+                deployer=get_registration("opencode").deployer,
+                profile=decl.PROFILE,
+            )
+
+
+class TestTheCLIPolicyIsDeclaredHere:
+    """`cli_policy` 是**本宿主的**声明：它决定部署产物要不要依赖 PactKit CLI。
+
+    core 侧对应断言（`test_story_slim084.py::TestHasPactkitCli`）已随之删除。
+    """
+
+    def test_the_policy(self):
+        assert SPEC.cli_policy is CLIPolicy.REQUIRED
+
+    def test_has_pactkit_cli_is_derived(self):
+        assert SPEC.has_pactkit_cli is True

pactkit_opencode-3.1.0/tests/test_wire_format_contract.py

@@ -0,0 +1,399 @@
+"""SPEC-4.0-22 Step 7 — 本宿主的线格式契约。
+
+**为什么这份测试在本仓而不是 core。** 线格式（`INPUT_TRANSLATION`）自 Step 7
+起是本 adapter 的声明，不是 core 的数据。core 保留的是**引擎**：识别 → 阶梯
+（`_skip` / `_uncovered` / 翻译）→ fail-closed 判定。事实在谁那里，断言就在谁
+那里。
+
+core 侧留了一个 skip 的占位（`test_story_slim20260918dda35a04d01d_opencode_pretool.py`
+的 opencode-specific 用例），理由是「线格式契约由 pactkit-opencode 自己的套件
+覆盖」——**那份承诺就是本文件**。没有它，core 的 skip 就只是把覆盖删掉。
+
+**为什么不合成一份映射来测。** 合成映射只能证明 core 的引擎能处理「测试作者编
+出来的表」，证明不了**本仓的声明没有漂移**。2026-09-19 的 P0 正是漂移：`edit` 的
+`replaceAll` 漏映射，门禁按单次替换模拟，于是 OpenCode 放行、原生拦下。所以下面
+每一条都钉 `declarations.INPUT_TRANSLATION` 本身。
+"""
+
+from __future__ import annotations
+
+import dataclasses
+from typing import cast
+
+import pytest
+from pactkit.host_payloads import translate_host_payload
+from pactkit.profiles import InputTranslation
+
+from pactkit_opencode.declarations import INPUT_TRANSLATION
+
+SPEC = cast(InputTranslation, INPUT_TRANSLATION)
+
+#: 门禁真的会读的 canonical 键——`grep -rho 'tool_input\.get("[a-z_]*"' src/pactkit/*.py`
+#: 的全部取值，去掉 `skill`（那是 Skill 工具的参数，不属任何宿主的写面）。
+#: 少一个键不是「少一个字段」，是少一道判据。
+GATE_READ_KEYS = (
+    "command", "content", "file_path", "new_string", "old_string", "replace_all",
+)
+
+
+def _translate(tool: str, args: dict) -> dict:
+    """走生产路径：宿主线格式 → 规范形。"""
+    return translate_host_payload(
+        {"tool": tool, "args": args, "sessionID": "s", "callID": "c", "cwd": "/tmp"}
+    )
+
+
+class TestTheDeclarationIsReal:
+    def test_it_is_not_none(self):
+        """Step 7 之前这里可以是 `None`——那比 bug 更糟，通道会整条静默失效。"""
+        assert SPEC is not None, (
+            "opencode 声明了 `INPUT_TRANSLATION = None`——core 侧那份已经删除，"
+            "于是没有任何东西认得 OpenCode 负载，整条通道 fail-open"
+        )
+
+    def test_it_registers_and_is_readable_through_the_registry(self):
+        """声明必须真的到达 registry——生产读路径只从那里读。"""
+        from pactkit.generators.deploy_base import _ensure_entry_point_deployers
+        from pactkit.profiles import input_translations
+
+        _ensure_entry_point_deployers()
+        registered = input_translations().get("opencode")
+        assert registered is not None, "discovery 之后 registry 里没有 opencode"
+        assert registered is SPEC, "registry 里那份不是本仓声明的这个对象"
+
+
+class TestTheRecognitionSignal:
+    def test_it_recognises_a_host_payload(self):
+        """有小写 `tool` + `args`、没有规范形 `tool_name` = OpenCode。"""
+        assert SPEC.recognizes(
+            {"tool": "write", "args": {"filePath": "a.py", "content": "x"}}
+        )
+
+    def test_it_does_not_claim_a_canonical_payload(self):
+        """规范形必须原样放行——翻译对既有通道零影响。"""
+        payload = {"tool_name": "Write", "tool_input": {"file_path": "a.py"}}
+        assert not SPEC.recognizes(payload)
+        assert translate_host_payload(payload) is payload
+
+
+class TestTheMappingsAreComplete:
+    def test_replace_all_is_mapped(self):
+        """2026-09-19 P0 的那个字段。它漏掉时门禁按单次替换模拟，于是放行。"""
+        assert "replaceAll" in SPEC.arg_map["edit"], (
+            "edit 的 arg_map 少了 `replaceAll` → 门禁会把全量替换当成单次替换，"
+            "第一次匹配落在注释里时看不到弱化，**OpenCode 放行而原生拦下**"
+        )
+
+    def test_every_gate_read_key_is_reachable(self):
+        """双向闭合的一半：门禁读的每个键，映射表里都要有来源。"""
+        mapped = {c for m in SPEC.arg_map.values() for c in m.values()}
+        missing = [k for k in GATE_READ_KEYS if k not in mapped]
+        assert not missing, (
+            f"门禁读 {missing}，本仓的映射表却没有对应项——"
+            "这正是 replaceAll 漏掉时的形状"
+        )
+
+    def test_the_mapping_invents_no_keys(self):
+        """双向闭合的另一半：映射产出的键必须都是门禁真的会读的。
+
+        多出来的键不是「多一个字段」，是一个**没有消费者**的声明——
+        它让表看起来更完整，实际是一条死通道。
+        """
+        mapped = {c for m in SPEC.arg_map.values() for c in m.values()}
+        extra = sorted(mapped - set(GATE_READ_KEYS))
+        assert not extra, (
+            f"映射产出了门禁不读的键 {extra}——死通道，删掉或补上消费者"
+        )
+
+    def test_every_write_capable_tool_is_in_the_tool_map(self):
+        """可写工具必须都在表里；不在的靠 `uncovered_write_tools` 拒绝。"""
+        assert set(SPEC.tool_map) | set(SPEC.uncovered_write_tools) >= {
+            "write", "edit", "patch",
+        }
+
+
+class TestTheTranslationLadder:
+    def test_a_mapped_edit_becomes_a_canonical_edit(self):
+        out = _translate(
+            "edit",
+            {"filePath": "a.py", "oldString": "x", "newString": "y"},
+        )
+        assert out["tool_name"] == "Edit"
+        assert out["tool_input"] == {
+            "file_path": "a.py", "old_string": "x", "new_string": "y",
+        }
+
+    def test_replace_all_survives_the_translation(self):
+        out = _translate(
+            "edit",
+            {"filePath": "a.py", "oldString": "x", "newString": "y",
+             "replaceAll": True},
+        )
+        assert out["tool_input"]["replace_all"] is True
+
+    def test_a_mapped_write_becomes_a_canonical_write(self):
+        out = _translate("write", {"filePath": "a.py", "content": "x"})
+        assert out["tool_name"] == "Write"
+        assert out["tool_input"] == {"file_path": "a.py", "content": "x"}
+
+    def test_an_uncovered_write_tool_is_refused_not_guessed(self):
+        """`patch` 的参数形态未取证——拒绝而非放行，且**不是**半判。"""
+        out = _translate("patch", {"filePath": "a.py", "patchText": "x"})
+        assert out.get("_uncovered") == "patch", (
+            "未取证的写工具必须走 `_uncovered`，不能被猜成 Write"
+        )
+
+    def test_an_unknown_tool_carrying_a_path_is_refused(self):
+        """未知 + 带路径 = 拒绝。兜底成 Write 会丢掉 `content`，正是 P0 形状。"""
+        out = _translate("teleport", {"filePath": "a.py", "content": "x"})
+        assert out.get("_uncovered") == "teleport"
+
+    @pytest.mark.parametrize("tool", ["read", "glob", "grep", "list", "webfetch"])
+    def test_read_only_tools_are_not_gated(self, tool):
+        """误报会让整条通道不可用——只读工具不进门禁判定。"""
+        out = _translate(tool, {"filePath": "a.py"})
+        assert out.get("_skip") is True
+
+    def test_an_unknown_tool_without_a_path_is_skipped(self):
+        """没有写入面 = 不进门禁判定，否则每个新只读工具都会被拦。"""
+        out = _translate("brandnew", {"foo": "bar"})
+        assert out.get("_skip") is True
+
+
+class TestTheContractHasTeeth:
+    """反证：删掉关键映射，上面必须有测试变红。
+
+    没有这一条，「覆盖搬过去了」只是两个仓各自为绿的巧合——真正的判据是
+    **本仓的测试会因为这个声明变坏而变红**。
+    """
+
+    def _with_replace_all_removed(self):
+        broken = dataclasses.replace(
+            SPEC,
+            arg_map={**SPEC.arg_map, "edit": {
+                k: v for k, v in SPEC.arg_map["edit"].items()
+                if k != "replaceAll"
+            }},
+        )
+        return broken
+
+    def test_removing_replace_all_breaks_the_completeness_check(self):
+        broken = self._with_replace_all_removed()
+        mapped = {c for m in broken.arg_map.values() for c in m.values()}
+        assert "replace_all" not in mapped, (
+            "变异没有生效——下面那条断言会因错误的原因通过"
+        )
+
+    def test_removing_replace_all_breaks_the_translation(self, monkeypatch):
+        """走真实翻译路径，证明变异**改变了行为**而不只是改了数据。"""
+        import pactkit.host_payloads as hp
+
+        monkeypatch.setattr(
+            hp, "input_translations", lambda: {"opencode": self._with_replace_all_removed()}
+        )
+        out = hp.translate_host_payload({
+            "tool": "edit",
+            "args": {"filePath": "a.py", "oldString": "x", "newString": "y",
+                     "replaceAll": True},
+            "cwd": "/tmp",
+        })
+        assert "replace_all" not in out["tool_input"], (
+            "删掉 replaceAll 之后翻译仍然产出 replace_all——"
+            "说明它来自别处，本仓的声明不是唯一真相源"
+        )
+
+
+# ---------------------------------------------------------------------------
+# SPEC-4.0-22 Step 7 — 跨通道一致性（core 的 `_gated` 扫不到的那一格）
+# ---------------------------------------------------------------------------
+
+
+class TestThisChannelAgreesWithTheCanonicalVerdict:
+    """core 的 `_gated` 让每条绕过用例自动扫过所有通道，但 **opencode 那一格
+    需要本 adapter 的声明**，core-only 环境渲不出来（core 侧记入 `_UNCOVERED`
+    并由一条 coverage accounting 用例断言它正好等于缺失集）。
+
+    所以那一格补在这里：**真实 opencode 渲染 → core 的 hook 判定 == 规范形判定**。
+    core 管 canonical semantics 与「可得通道的一致性框架」；本仓管
+    「真实 opencode 线格式与 canonical verdict 一致」。
+    """
+
+    #: 已知绕过形态（与 core 的 astra 用例同源）。每条都要在**本通道**上被拦。
+    BYPASSES = (
+        {
+            "name": "write-protected-path",
+            "canonical": {
+                "tool_name": "Write",
+                "tool_input": {"file_path": ".synthetic/hooks.json", "content": "x"},
+            },
+            "opencode": {"tool": "write", "args": {"filePath": ".synthetic/hooks.json", "content": "x"}},
+        },
+        {
+            "name": "edit-replace-all-first-match-in-comment",
+            "canonical": {
+                "tool_name": "Edit",
+                "tool_input": {
+                    "file_path": ".synthetic/pactkit.yaml",
+                    "old_string": "true", "new_string": "false", "replace_all": True,
+                },
+            },
+            "opencode": {
+                "tool": "edit",
+                "args": {
+                    "filePath": ".synthetic/pactkit.yaml",
+                    "oldString": "true", "newString": "false", "replaceAll": True,
+                },
+            },
+        },
+        {
+            "name": "write-weakened-config",
+            "canonical": {
+                "tool_name": "Write",
+                "tool_input": {
+                    "file_path": ".claude/pactkit.yaml",
+                    "content": "enforcement:\n  tamper_guard: false\n",
+                },
+            },
+            "opencode": {
+                "tool": "write",
+                "args": {
+                    "filePath": ".claude/pactkit.yaml",
+                    "content": "enforcement:\n  tamper_guard: false\n",
+                },
+            },
+        },
+    )
+
+    @pytest.fixture
+    def repo(self, tmp_path, monkeypatch):
+        # 门禁要开着才有判定可比——core 侧同源用例也是这么夹的。
+        from pactkit import commit_gate
+
+        (tmp_path / ".git" / "hooks").mkdir(parents=True)
+        (tmp_path / ".pactkit" / "enforcement").mkdir(parents=True)
+        (tmp_path / ".claude").mkdir(parents=True)
+        monkeypatch.setattr(
+            commit_gate,
+            "_enforcement_settings",
+            lambda root: {
+                "protected_branches": ["main", "master"],
+                "allow_direct_push": False,
+                "tamper_guard": True,
+            },
+        )
+        # 弱化判定要有一个**旧值**可比：`replace_all` 那条把 `true` 改成
+        # `false`，没有这份配置就没有可弱化的东西（core 侧同源用例也先写它）。
+        (tmp_path / ".synthetic").mkdir(parents=True, exist_ok=True)
+        (tmp_path / ".synthetic" / "pactkit.yaml").write_text(
+            "# true\nenforcement:\n  tamper_guard: true\n", encoding="utf-8"
+        )
+        return tmp_path
+
+    @pytest.fixture
+    def protected_host(self):
+        """一个声明了 `protected` 的宿主——`classic` 的 protected 是空的，
+        所以 `.synthetic/hooks.json` 这类受保护路径需要它才存在。
+
+        **只能依赖已发布的 API。** 早先这里靠 `sys.path` 指向 core 仓的
+        `tests/unit/` 去 import `_synthetic_host`——那是**兄弟 checkout**，
+        既不随包发布，也不在 CI 的 checkout 里：本机绿、CI 直接
+        `ModuleNotFoundError`（2026-09-26 实测）。core 的测试 helper 不是
+        core 的公共 API，adapter 仓不能伸手去够。
+
+        就地用 `register_adapter` 建一个，profile 从 core 自带的 builtin 派生
+        （那条路径本来就注册着，不依赖任何兄弟仓），用完按快照整体还原。
+        """
+        import dataclasses
+
+        from pactkit.generators.deploy_base import _ensure_entry_point_deployers
+        from pactkit.profiles import (
+            FORMAT_PROFILES,
+            SecurityDeclaration,
+            SecurityFacts,
+            _ADAPTER_REGISTRY,
+            register_adapter,
+        )
+
+        class _Deployer:
+            def deploy(self, config=None, target=None):
+                return None
+
+        # Discovery first, then snapshot — a snapshot taken before it would
+        # make the restore wipe every adapter that registered afterwards.
+        _ensure_entry_point_deployers()
+        snapshot = dict(_ADAPTER_REGISTRY)
+        register_adapter(
+            "protected-host",
+            deployer=_Deployer,
+            profile=dataclasses.replace(
+                FORMAT_PROFILES["classic"],
+                name="protected-host",
+                project_config_dir=".synthetic",
+                pactkit_yaml_path=".synthetic/pactkit.yaml",
+            ),
+            security=SecurityDeclaration(
+                env_capable=SecurityFacts.empty(),
+                protected=SecurityFacts.declared({".synthetic/hooks.json"}),
+                conditional=SecurityFacts.empty(),
+            ),
+            source="test",
+        )
+        try:
+            yield
+        finally:
+            _ADAPTER_REGISTRY.clear()
+            _ADAPTER_REGISTRY.update(snapshot)
+
+    @pytest.mark.parametrize("case", BYPASSES, ids=lambda c: c["name"])
+    def test_the_verdict_matches_canonical(self, repo, protected_host, case):
+        import json
+
+        from pactkit.commit_gate import hook_entry
+
+        # **绝对路径**：`tamper_guard._relpath` 对相对路径 resolve 到进程 CWD 而非
+        # 项目根 → 返回 None → 读作「不是我们的文件」而放行。用相对路径测出来的
+        # 「一致」是假的（core 侧同源用例已记录这个坑）。
+        def _abs(args, key):
+            return {k: (str(repo / v) if k == key else v) for k, v in args.items()}
+
+        canonical_payload = {
+            **case["canonical"],
+            "tool_input": _abs(case["canonical"]["tool_input"], "file_path"),
+            "cwd": str(repo),
+        }
+        opencode_payload = {
+            **case["opencode"],
+            "args": _abs(case["opencode"]["args"], "filePath"),
+            "cwd": str(repo),
+        }
+
+        canonical = hook_entry(json.dumps(canonical_payload), repo)
+        via_opencode = hook_entry(
+            json.dumps(translate_host_payload(opencode_payload)), repo
+        )
+        assert via_opencode == canonical, (
+            f"opencode 通道与规范形判定不一致——翻译丢了字段\n"
+            f"  规范形: {canonical}\n  opencode: {via_opencode}"
+        )
+        assert via_opencode[1] == 2, (
+            f"这条绕过在 opencode 通道上**没被拦**：{via_opencode[0][:160]}"
+        )
+
+    def test_the_sweep_is_not_vacuous(self, repo, protected_host):
+        """反证：换成一条**不该拦**的负载，上面那个等式仍然成立。
+
+        等式单独存在时是没有鉴别力的——两条通道都放行也满足 `==`。
+        """
+        import json
+
+        from pactkit.commit_gate import hook_entry
+
+        payload = {"tool_name": "Bash", "tool_input": {"command": "ls"}, "cwd": str(repo)}
+        assert hook_entry(json.dumps(payload), repo)[1] == 0
+        via_opencode = hook_entry(
+            json.dumps(translate_host_payload(
+                {"tool": "bash", "args": {"command": "ls"}, "cwd": str(repo)}
+            )),
+            repo,
+        )
+        assert via_opencode[1] == 0

pactkit_opencode-3.0.5/src/pactkit_opencode.egg-info/requires.txt

@@ -1 +0,0 @@
-pactkit<3.1.0,>=3.0.1

pactkit_opencode-3.0.5/tests/test_host_body_snapshot.py

@@ -1,126 +0,0 @@
-"""This host's deployed prompt bodies, pinned against a golden (R7/AC10).
-
-2026-09-12 review (83/100, gap 2): the zero-credential acceptance split
-left adapter-host body comparison out of CI — the core workflow compares
-classic only. This suite pins the OPENCODE deployment's prompt bodies:
-
-- digest drift (a rule edited or deleted inside a prompt body) fails,
-  naming the file;
-- a core version mismatch fails with an explicit action — regenerate the
-  golden against the new core, or publish the matching core release
-  (PENDING-COMPATIBLE-CORE, see the spec R8 release-window semantics);
-- a probe test deploys, edits one body in place, and proves the SAME
-  comparison logic flags it (删改必被检出, not vacuous).
-
-Regenerate with: tests/scripts/refresh_host_body_golden.py
-"""
-
-from __future__ import annotations
-
-import hashlib
-import json
-import subprocess
-import sys
-from pathlib import Path
-
-import pytest
-
-HOST = "opencode"
-GOLDEN = Path(__file__).parent / "fixtures" / "host_body_golden.json"
-DEPLOY_SUFFIXES = (".md", ".json", ".toml")
-
-
-def _core_version() -> str:
-    import importlib.metadata as m
-
-    return m.version("pactkit")
-
-
-def _normalize(content: str, deploy_root: str) -> str:
-    """Strip only the deterministic environment difference: the deploy root
-    path baked into rendered prompts. Rule text stays — normalizing it would
-    swallow the drift this suite exists to catch."""
-    return content.replace(deploy_root, "<DEPLOY_ROOT>")
-
-
-def _deployed_digests(tmp_path: Path) -> tuple[dict[str, str] | None, subprocess.CompletedProcess]:
-    home = tmp_path / "home"
-    target = tmp_path / "deploy"
-    home.mkdir()
-    proc = subprocess.run(
-        [sys.executable, "-m", "pactkit", "init", "--format", HOST, "--target", str(target)],
-        capture_output=True, text=True, timeout=180,
-        env={"PATH": "/usr/bin:/bin", "HOME": str(home), "COLUMNS": "200"},
-    )
-    if proc.returncode != 0:
-        return None, proc
-    digests: dict[str, str] = {}
-    for path in sorted(target.rglob("*")):
-        if not path.is_file() or path.suffix not in DEPLOY_SUFFIXES:
-            continue
-        body = _normalize(path.read_text(encoding="utf-8"), str(target))
-        digests[path.relative_to(target).as_posix()] = hashlib.sha256(
-            body.encode("utf-8")
-        ).hexdigest()
-    return digests, proc
-
-
-def _assert_no_drift(golden_digests: dict[str, str], live: dict[str, str]) -> None:
-    """The one comparison both the golden test and the tamper probe use."""
-    changed = sorted(
-        k for k in set(golden_digests) & set(live) if golden_digests[k] != live[k]
-    )
-    removed = sorted(set(golden_digests) - set(live))
-    added = sorted(set(live) - set(golden_digests))
-    assert not (changed or removed or added), (
-        f"prompt body drift: changed={changed} removed={removed} added={added} "
-        f"— if the core prompts changed, regenerate the golden "
-        f"(tests/scripts/refresh_host_body_golden.py) or publish the matching "
-        f"core release first (PENDING-COMPATIBLE-CORE)"
-    )
-
-
-class TestHostBodySnapshot:
-    def test_bodies_match_the_golden(self, tmp_path):
-        golden = json.loads(GOLDEN.read_text(encoding="utf-8"))
-        core_v = _core_version()
-        if golden["core_version"] != core_v:
-            pytest.fail(
-                f"PENDING-COMPATIBLE-CORE: the {HOST} golden was generated "
-                f"against core {golden['core_version']}, this environment has "
-                f"{core_v}. Either regenerate it after the core change "
-                f"(tests/scripts/refresh_host_body_golden.py) or publish the "
-                f"matching core release first (spec R8 release-window semantics)."
-            )
-        live, proc = _deployed_digests(tmp_path)
-        assert live is not None, (
-            f"{HOST} deploy failed: {proc.stdout[-300:]}{proc.stderr[-300:]}"
-        )
-        _assert_no_drift(golden["body_digests"], live)
-
-    def test_a_body_edit_is_caught_by_the_same_comparison(self, tmp_path):
-        """Non-vacuity, end to end: deploy, edit one prompt body in place,
-        and the SAME comparison that guards the golden must flag it."""
-        golden = json.loads(GOLDEN.read_text(encoding="utf-8"))
-        live, proc = _deployed_digests(tmp_path)
-        assert live is not None, f"{HOST} deploy failed: {proc.stderr[-300:]}"
-        target = tmp_path / "deploy"
-        # Pick a real deployed prompt body and delete one rule line from it.
-        victims = sorted(
-            p for p in target.rglob("*.md") if p.relative_to(target).as_posix() in golden["body_digests"]
-        )
-        assert victims, "no deployed .md body found to tamper with"
-        victim = victims[0]
-        rel = victim.relative_to(target).as_posix()
-        body = victim.read_text(encoding="utf-8")
-        victim.write_text(body + "\n- deleted in a review\n", encoding="utf-8")
-
-        tampered = {
-            p.relative_to(target).as_posix(): hashlib.sha256(
-                _normalize(p.read_text(encoding="utf-8"), str(target)).encode("utf-8")
-            ).hexdigest()
-            for p in sorted(target.rglob("*"))
-            if p.is_file() and p.suffix in DEPLOY_SUFFIXES
-        }
-        with pytest.raises(AssertionError, match=rel):
-            _assert_no_drift(golden["body_digests"], tampered)