fix: recover silently-excluded test dirs + test-architecture audit hardening (#1195)
* fix: recurse test discovery so subdir test suites actually run
scripts/run-tests.cjs discovered tests with a flat readdirSync(testDir),
silently excluding tests/observability/ (4 files), tests/dispatch/ (1) and
tests/installer-migrations/ (1) — 94 passing tests — from `npm test` and all
CI lanes. Walk the tree recursively (relative subpaths preserved), classify
suites by basename, and add a fail-on-zero-executed guard for suite/default
runs (escape hatch GSD_ALLOW_EMPTY_SUITE=1) while preserving the empty
--files/--files-from path the CI inert lane relies on.
Unit suite 735 -> 741 files; surfaces ADR-227's observability/dispatch seam.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* test: retire 5 verified-worthless tests
Adversarial verification confirmed these 5 prove nothing — their coverage is
provided more strictly elsewhere:
- enh-2790 'has a name: field' spot-checks (command-contract enforces /^gsd[:-]/)
- command-routing-hub duplicate construct + duplicate ERROR_KINDS assertions
- no-cjs-sdk-handsync-tooling (guarded files that never existed on main; bug-190
covers the real retired SDK artifacts)
- runtime-artifact-layout cline edge case (subsumed by the explicit-global test
and bug-782-cline-skills-emission)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* test: add ADR-218 release version-validation coverage
ADR-218 (reject leading-zero versions like 1.01.0; npm duplicate pre-check) had
zero tests — the logic lived only in release.yml bash. Add a test that extracts
the actual rejection regexes from the workflow and exercises them against a
boundary table (leading-zero/malformed rejected, valid accepted) plus structural
wiring assertions. Goes red if the regex is reverted to [0-9]+.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* test: redesign weak tests into behavioral, deterministic assertions
Per the ADR test audit, rewrite 27 weak test files (test-only, no source
changes) so each can go red for the defect it guards:
- kill pass-always assert.ok(true) placeholders (research-cli, worktree-baseref,
bug-260 security guard, eslint-rules x24, clusters '|| true')
- replace source-text grep with behavioral calls (install Kilo, sh-hook-paths,
plan-review-convergence) and add a repo-layout governance test
- de-flake real-clock/Math.random coupling (phase last_updated, bug-3707 mtime,
context-utilization property, feat-3594)
- fix independence/shared-state violations (bug-492 singleton, issue-844 tmpRoot,
core reapStaleTempFiles, active-workstream TTY, feat-488 GSD_HOME)
- strengthen property/shape-only tests (research-provider/store classification +
collision) and unconditional plugin.json schema validation (issue-766)
Verified: all 28 files run together 1220 pass / 0 fail / 1 skip.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* chore: add no-tautological-assert lint rule, error in test suite
New custom ESLint rule (eslint-rules/no-tautological-assert.cjs) bans asserts
that can never fail: assert(true)/assert.ok(<always-truthy literal>),
'cond || true' inside an assert, and equality asserts comparing two identical
literals. Wired as error on tests/**; full sweep confirmed zero existing
violations so the suite stays green. Prevents the placeholder-assert regressions
the audit redesigns just removed. RuleTester coverage added (6 valid, 8 invalid).
Note: no-only-tests was already enforced via eslint-plugin-no-only-tests, so no
duplicate rule was added.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* chore: gate new allow-test-rule exemptions to require an issue ref
ADR-456 requires any allow-test-rule exemption added after the ADR to carry a
tracking issue number, but nothing enforced it. New ratchet gate
(scripts/lint-allow-test-rule-refs.cjs, wired into lint:ci) fails when a NEW
allow-test-rule comment lacks a #NNN/URL reference; the 323 existing untracked
exemptions are grandfathered in an allowlist that ratchets down as they gain
refs. Red-green verified (novel untracked offender fails; compliant passes).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* docs: add ADR test-audit evidence report (#1192)
Full risk-first qa-test-architect audit of the ADR portfolio (37 ADRs + 4
platform lenses, adversarial verification of retire verdicts) that drove the
P0 discovery fix, ADR-218 coverage, 5 retires, 27 redesigns, and the two new
lint gates. Filed as point-in-time evidence under docs/issueevidence/, named
for tracking issue #1192.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* test: replace pre-existing raw NUL byte with escape in feat-3594 fixture
feat-3594's null-byte parser fixture contained a literal NUL byte (pre-existing
on next at b10e5681 — confirmed: base blob has 1 NUL, this fix has 0), which
made git treat the file as binary and would break grep/editors. Switch to the
\x00 escape; the runtime string value (a real NUL in the parser input) is
unchanged.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* test: address adversarial-review findings
Codex adversarial pass over the branch:
- capability-registry drift test no longer mutates the committed generated
capability-registry.cjs in place (concurrency hazard) — uses in-memory
checkPipeline comparison instead.
- allow-test-rule ratchet now detects exemptions in ALL comment forms (block
/* */ too, matching no-source-grep) so a block comment can't bypass it;
one newly-surfaced pre-existing offender grandfathered (323->324).
- install.test Kilo case asserts on what install(false,'kilo') actually writes
rather than manually calling configureKiloPermissions (masked the call site).
- issue-766 drops the undeclared transitive ajv dep for explicit structural
assertions from the schema fixture.
- adr-218 test notes the hotfix leading-zero gap is tracked in #1186.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix: address code-review findings (subdir discovery, rule + test gaps)
xhigh code review surfaced 15 confirmed issues, all fixed:
- run-tests.cjs --files now resolves subdir tests by bare basename + handles
Windows backslash paths (ambiguous basenames error clearly).
- affected-tests-lib.cjs listTestFiles made recursive — the targeted CI lane was
silently dropping changed subdir tests (same false-green class the audit fixed).
- no-tautological-assert now catches 'true || cond' and empty []/{} equality.
- verify-test-quality: restore provenance-classification coverage, tighten the
writeFile circular-detection check, guard the module-level file read.
- sh-hook-paths: cover the global-install .sh delegation branch (#2045 guard).
- active-workstream null-guard runs deterministically (no longer skipped on TTY).
- adr-218 structural guards tightened (major/minor leading-zero; needs: membership).
- repo-layout AGENTS.md guard no longer false-alarms on equivalent refactors.
- cross-ai ordering guard fails red when the step is missing.
- issue-766 parses required fields from the schema fixture (auto-enforced).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* test: stub USERPROFILE alongside HOME in feat-488 (Windows parity)
The feat-488 redesign stubbed process.env.HOME but not USERPROFILE; os.homedir()
resolves from USERPROFILE on Windows, so the home stub was not hermetic there —
caught by windows-test-parity-guard (stubsHomeNoUserProfile). Save/set/restore
USERPROFILE symmetrically with HOME (delete-if-originally-undefined).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* chore: reconcile allow-test-rule allowlist after rebase onto next
Rebasing onto current next pulled in merged PR #1170, which added
inventory-headings-countfree.test.cjs (a baseline allow-test-rule exemption) and
deleted inventory-counts.test.cjs. Grandfather the former and prune the latter so
the ratchet matches the merged tree. No new debt from this PR.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Tom Boucher
@@ -553,37 +553,98 @@ describe('topological step ordering', () => {
|
||||
});
|
||||
|
||||
// ─── 4. --check drift detection ──────────────────────────────────────────────
|
||||
//
|
||||
// The real --check pipeline (gen-capability-registry.cjs main()) compares
|
||||
// committed vs live via:
|
||||
//
|
||||
// normalizeLineEndings(stripGeneratedComment(committed))
|
||||
// !== normalizeLineEndings(stripGeneratedComment(live))
|
||||
//
|
||||
// stripGeneratedComment is private (not exported), so these tests replicate the
|
||||
// same filter inline and call the exported normalizeLineEndings to exercise the
|
||||
// ACTUAL comparison semantics rather than doing a bare string-equality tautology.
|
||||
//
|
||||
// The subprocess tests additionally prove that the real --check CLI exits 1 on a
|
||||
// tampered registry and exits 0 when only the auto-generated timestamp comment
|
||||
// changes (comment immunity).
|
||||
|
||||
const REGISTRY_PATH = path.join(ROOT, 'gsd-core', 'bin', 'lib', 'capability-registry.cjs');
|
||||
|
||||
/**
|
||||
* Mirror of the private stripGeneratedComment() from gen-capability-registry.cjs.
|
||||
* Kept here intentionally: the test validates BEHAVIOR, and the implementation is
|
||||
* stable (a single-line filter). If the source changes the sentinel string, this
|
||||
* test will correctly start failing — that is the desired red signal.
|
||||
*/
|
||||
function applyStripGeneratedComment(content) {
|
||||
return content
|
||||
.split('\n')
|
||||
.filter((line) => !line.includes('generated by scripts/gen-capability-registry.cjs'))
|
||||
.join('\n');
|
||||
}
|
||||
|
||||
/** Apply the full --check comparison pipeline to a single content string. */
|
||||
function checkPipeline(content) {
|
||||
return normalizeLineEndings(applyStripGeneratedComment(content));
|
||||
}
|
||||
|
||||
describe('--check drift detection', () => {
|
||||
test('returns drift when on-disk registry differs from live', () => {
|
||||
// Build a registry from the real UI cap
|
||||
test('stale VERSION survives stripGeneratedComment+normalizeLineEndings and IS detected as drift', () => {
|
||||
// Build a fresh registry from the real UI cap — this is the "live" content
|
||||
const capDir = makeTempCapDir({ ui: UI_CAP });
|
||||
const { capMap } = loadAndValidate(new Set(), capDir);
|
||||
const registry = buildRegistry(capMap);
|
||||
const liveContent = serializeRegistry(registry, capMap);
|
||||
|
||||
// Modify it slightly to simulate drift — replace the version string constant at top level
|
||||
const driftedContent = liveContent.replace(
|
||||
// Tamper: replace the schema version field — this simulates a stale committed file
|
||||
// (version: '1' → version: '0-stale')
|
||||
const staledContent = liveContent.replace(
|
||||
"version: '" + SCHEMA_VERSION + "'",
|
||||
"version: '0-stale'",
|
||||
);
|
||||
assert.notStrictEqual(staledContent, liveContent, 'precondition: tampered content differs before pipeline');
|
||||
|
||||
// Confirm the replacement actually changed something
|
||||
assert.notStrictEqual(driftedContent, liveContent, 'driftedContent should differ from liveContent after replacement');
|
||||
// The tampered version must SURVIVE both pipeline steps and still differ from live.
|
||||
// This is what actually matters: a raw string diff is trivial; the test must show
|
||||
// the comparison survives stripping + normalization — i.e. it IS real drift.
|
||||
assert.notStrictEqual(
|
||||
checkPipeline(staledContent),
|
||||
checkPipeline(liveContent),
|
||||
'stale VERSION must be detected as drift after stripGeneratedComment + normalizeLineEndings',
|
||||
);
|
||||
});
|
||||
|
||||
// Write to a temp file
|
||||
const tmpFile = path.join(os.tmpdir(), 'cap-registry-drift-test.cjs');
|
||||
fs.writeFileSync(tmpFile, driftedContent, 'utf8');
|
||||
test('comment-only timestamp change is NOT flagged as drift after stripping', () => {
|
||||
// Build a fresh registry
|
||||
const capDir = makeTempCapDir({ ui: UI_CAP });
|
||||
const { capMap } = loadAndValidate(new Set(), capDir);
|
||||
const registry = buildRegistry(capMap);
|
||||
const liveContent = serializeRegistry(registry, capMap);
|
||||
|
||||
// Compare: live vs drifted (simulating what --check does)
|
||||
const committed = fs.readFileSync(tmpFile, 'utf8');
|
||||
assert.notStrictEqual(committed, liveContent, 'Drifted content should differ from live');
|
||||
// Confirm the generated comment is present in the serialized output
|
||||
assert.ok(
|
||||
liveContent.includes('generated by scripts/gen-capability-registry.cjs'),
|
||||
'precondition: generated comment must be present in serialized output',
|
||||
);
|
||||
|
||||
// Cleanup
|
||||
fs.unlinkSync(tmpFile);
|
||||
// Simulate a Windows git checkout that adds a fake timestamp annotation on the
|
||||
// generated-comment line — the kind of comment-only mutation that must NOT trigger drift
|
||||
const commentVariant = liveContent.replace(
|
||||
' * capability-registry.cjs — generated by scripts/gen-capability-registry.cjs',
|
||||
' * capability-registry.cjs — generated by scripts/gen-capability-registry.cjs on 2024-01-01T00:00:00Z',
|
||||
);
|
||||
assert.notStrictEqual(commentVariant, liveContent, 'precondition: variant differs before stripping');
|
||||
|
||||
// After stripping the generated-comment line, both must be identical — NOT flagged as drift
|
||||
assert.strictEqual(
|
||||
checkPipeline(commentVariant),
|
||||
checkPipeline(liveContent),
|
||||
'comment-only change must NOT be detected as drift (stripGeneratedComment must neutralize it)',
|
||||
);
|
||||
});
|
||||
|
||||
test('no drift when registry is freshly generated', () => {
|
||||
// Determinism check: two calls to serializeRegistry must produce identical output
|
||||
const capDir = makeTempCapDir({ ui: UI_CAP });
|
||||
const { capMap } = loadAndValidate(new Set(), capDir);
|
||||
const registry = buildRegistry(capMap);
|
||||
@@ -591,6 +652,47 @@ describe('--check drift detection', () => {
|
||||
const content2 = serializeRegistry(registry, capMap);
|
||||
assert.strictEqual(content1, content2, 'Two calls to serializeRegistry should be identical');
|
||||
});
|
||||
|
||||
test('--check comparison pipeline detects a tampered VERSION (in-memory, no file mutation)', () => {
|
||||
// Prove that the --check comparison pipeline (the same pipeline used by
|
||||
// gen-capability-registry.cjs main()) exits 1 on a stale committed registry.
|
||||
//
|
||||
// NOTE: We intentionally do NOT write to the committed REGISTRY_PATH here.
|
||||
// Writing to a committed file during a test is unsafe: it races with concurrent
|
||||
// test runners that require() the same module and leaves the worktree dirty on
|
||||
// SIGKILL. Instead, we exercise the comparison logic using the same exported
|
||||
// helpers the CLI uses, applied to in-memory strings — giving identical coverage
|
||||
// without touching the filesystem.
|
||||
const originalContent = fs.readFileSync(REGISTRY_PATH, 'utf8');
|
||||
const tamperedContent = originalContent.replace(
|
||||
"version: '" + SCHEMA_VERSION + "'",
|
||||
"version: '0-stale'",
|
||||
);
|
||||
assert.notStrictEqual(tamperedContent, originalContent, 'precondition: tamper must change the file');
|
||||
|
||||
// Build the "live" content the same way --check does.
|
||||
const capDir = makeTempCapDir({ ui: UI_CAP });
|
||||
const { capMap } = loadAndValidate(new Set(), capDir);
|
||||
const registry = buildRegistry(capMap);
|
||||
const liveContent = serializeRegistry(registry, capMap);
|
||||
|
||||
// The tampered committed content must NOT equal the live content after the
|
||||
// same stripGeneratedComment + normalizeLineEndings pipeline that --check uses.
|
||||
// If this assertion passes, --check would exit 1 (drift detected) and emit "stale".
|
||||
assert.notStrictEqual(
|
||||
checkPipeline(tamperedContent),
|
||||
checkPipeline(liveContent),
|
||||
'--check comparison pipeline must flag a tampered VERSION as drift.\n' +
|
||||
'If this fails, the pipeline no longer detects stale VERSION strings.',
|
||||
);
|
||||
|
||||
// Also verify the tampered content contains the stale marker (so the above
|
||||
// assertion is meaningful and not vacuously true due to other diff).
|
||||
assert.ok(
|
||||
tamperedContent.includes("version: '0-stale'"),
|
||||
'precondition: tampered content must contain the stale version marker',
|
||||
);
|
||||
});
|
||||
});
|
||||
|
||||
// ─── 4b. normalizeLineEndings — Windows CRLF regression guard ────────────────
|
||||
|
||||
Reference in New Issue
Block a user