* feat(#2790): add read-only planning.inspect schema-v1 snapshot query Adds a read-only query emitting a schema-versioned JSON projection of .planning/ so downstream harness UIs can consume planning state without parsing GSD's Markdown a second time. Composed strictly from the ADR-3180 section 7 owners plus parsePlanDocument, parseRequirements and parseUatItems; markdown structure is read through the Markdown Sectionizer and Markdown Table Model seams. It declares its own flat external schema rather than serializing PlanningSnapshot, which is the diagnostic-rule subject and still growing. Extracts plan-document parsing out of cmdPhasePlanIndex into a shared leaf module so phase.plan-index and planning.inspect cannot drift, including the plan-id derivation both surfaces report. Also fixes parseRequirements dropping the separator delimiter used by the shipped requirements template, surfaced while wiring the requirement rows. * fix(#2790): close spec gaps and a raw-text test assertion found in review Review findings from the standards, spec and security passes: - phases[] rows carry goal and dependencies, the two per-phase elements the issue Summary names that had no corresponding field. Goal is bounded to the section's leading prose so the Depends-on line, the Plans checklist and the wave annotations are not duplicated into it. - requirement rows carry their own diagnostic codes, so a consumer no longer has to string-parse the global diagnostics subject to correlate. - roadmap_acceptance.checkbox is looked up through the phase-id key owners. It was compared raw against the on-disk directory name, so it read null for every real-world slugged phase directory and the evidence channel was inert. - the hostile-input test asserts the structured payload instead of matching the raw stdout string. The absence proof over raw stdout is kept deliberately. * fix(#2790): register planning in the runtime usage list and repair fixtures Remote runner reported 9 failures on 9b3f9aa. Two root causes, both fixed: - gsd-tools.cjs registered the planning family in HOST_COMMAND_ROUTERS but never added it to TOP_LEVEL_USAGE's Commands list. Those are two surfaces a parity test guards, and the top-of-file block comment is not the runtime help string. A real wiring gap that every local gate and three review passes missed. - the new suite's fixtures could not produce a resolvable phase set. STATE.md frontmatter omitted the milestone field, which ADR-3180 7.2 rule 1 makes the primary milestone selector, so the phase set scoped unscoped and every percentage was correctly withheld. Separately declarePhase returned a path without creating the directory, so a phase declared but never written to left phases empty. Both reproduced against the built module before fixing. No assertion was weakened. The withholding path is still exercised and still returns null when the roadmap is absent. * chore(#2790): backfill changeset pr number * test(#2790): cover every enumerated matrix row and contain a symlink escape Reverses a silent deferral. An earlier revision left 23 of the 78 enumerated matrix rows unimplemented and 7 more as one-off manual checks, with a paragraph in the artifact and the PR body describing the gap. CLAUDE.md is explicit that such a note is not a fix and is not surfacing. The rows are implemented instead and the manual-evidence bucket is gone: 49 test cases become 88, covering all 78. Writing the symlink row proved a real leak: a *-PLAN.md symlinked outside .planning/ had its content emitted into the payload, confirmed via a direct call and the spawned CLI. readDocument now resolves target and planning root with realpathSync and rejects an escape, returning the ordinary unreadable-document shape. Tested both ways, because a containment check that over-rejects is its own defect: an escaping symlink leaks nothing and degrades that plan alone, while a legitimately relocated .planning/ symlink stays fully readable. The three new modules are registered in the mutation COVERED registry, which had been reporting has_work false and skipping the Stryker gate entirely. Provisional non-binding floors so the shards run and report; raised to the measured value before merge, since the registry forbids calibrating from a local run. * fix(#2790): satisfy the mutation ratchet contract and scope the 1MB test Remote runner reported 16 failures on 8c451ed. Two causes. The COVERED registry has a paired contract the earlier commit violated: every module needs a matching RATCHET_BASELINE entry, and minScore must be between 50 and 100 with minScore === baseline. The provisional floor of 1 was illegal on both counts. All three modules now sit at 50 — the registry's own enforced minimum — with matching baselines. The score cannot be measured locally: the shard runs node --test, which this repo hard-blocks, so CI is the only source. Floors are raised to the measured value once this PR's shards report; a shard below 50 means the tests need strengthening, since the floor cannot go lower. The 1MB test was measuring the test harness rather than the product. The command handles the oversized payload correctly by spilling to a tmpfile and resolving it back, but the resolved stdout then exceeds runGsdTools' maxBuffer and the helper reports ENOBUFS. It now uses --pick so stdout stays one byte while the full 1MB document is still read and parsed end to end. * fix(#2790): wire containment across every document read this command drives An isolated security review of the containment control found the boundary logic sound but not comprehensively wired: two content reads reached the filesystem without it. An escaped phase DIRECTORY could enumerate external filenames into the file fields and diagnostic subjects. Both enumeration sites now containment-check the directory before reading. Worth recording that the leak was already prevented one layer earlier than the review claimed: Dirent#isDirectory() reports false for a directory symlink, so such a directory never becomes a phase row at all. The guard is defense-in-depth for a direct caller and for platforms where a reparse point reports as a directory. A *-VERIFICATION.md symlinked outside the root leaked one frontmatter value verbatim, because readVerificationStatus does its own read and copies an unrecognized status into the payload's next_action. Closed from the consumer side through that function's existing fs injection seam, so src/verification.cts keeps its signature and its other callers are untouched. The reviewer additionally rated a forged status: passed as an integrity bypass. It is not: anyone able to plant the symlink can plant a real VERIFICATION.md saying the same thing. The incremental risk is confidentiality, which is what these fixes close. src/plan-scan.cts is deliberately unchanged: isPlanSuperseded reads symlink-followed content but yields only a derived boolean, no document text. * test(#2790): give the mutation shards an in-process surface Two Stryker shards were CANCELLED at the 15-minute cap, not failed on score. CI log: 640 mutants instrumented, and the dry run reported 'Ran 1 tests in 20 seconds' because the shards pointed at the integration suite, where nearly every case spawns a gsd-tools subprocess and Stryker's command runner treats the whole test-runner invocation as a single test. 640 x 20s cannot finish in 15 minutes; at the kill it was 27/640 with an ETA over an hour. Every other COVERED module points at a property or unit file, and the workflow's own paths filter lists exactly those two patterns. In-process is the intended mutation surface; the shards were pointed at the wrong shape of test. Adds tests/planning-inspect.unit.test.cjs — 39 cases in 10 describes that spawn nothing and call the built modules directly. plan-document and the router need no filesystem at all, one being a pure content-to-object parser and the other taking an injected mock. The three shards now point here. The 91-case integration suite is untouched and still runs in the normal test job. * chore(#2790): ratchet mutation floors to the measured CI scores CI run 32392791843 measured all three shards, which is the only source the registry accepts — local runs count timeouts as kills and inflate badly. planning-command-router 95.65 -> floor 94 plan-document 76.58 -> floor 75 planning-inspect 57.03 -> floor 56 Applied the registry's own rule, floor(score) - 1, and updated RATCHET_BASELINE to match, since the ratchet test enforces equality. planning-inspect sits well below the file's target of 80 and is the obvious ratchet candidate as its tests improve. planning-command-router already exceeds the target. The placeholder comment about floors pending measurement is removed rather than left standing as a false statement. --------- Co-authored-by: sim <sim@local>
303 lines
11 KiB
JavaScript
303 lines
11 KiB
JavaScript
'use strict';
|
|
|
|
/**
|
|
* tests/mutation-matrix-ratchet.test.cjs
|
|
*
|
|
* Guards the per-module mutation-score ratchet contract defined in
|
|
* scripts/mutation-matrix.cjs (ADR-456 / issue #1187).
|
|
*
|
|
* Assertions:
|
|
* (a) TARGET_MUTATION_SCORE is exported as a numeric constant equal to 80.
|
|
* (b) Every COVERED module declares a numeric minScore (50 ≤ minScore ≤ 100).
|
|
* (c) The matrix entry emitted by buildResult() / the script's JSON output
|
|
* includes minScore for each module.
|
|
* (d) A COVERED module missing minScore causes the above assertions to fail
|
|
* (negative proof — ensured by the ≥50 / ≤100 range check).
|
|
*
|
|
* Design note: this test imports the script's internals via require() — the
|
|
* script exports COVERED and TARGET_MUTATION_SCORE so they can be tested
|
|
* without subprocess overhead. buildResult() is not exported so we verify the
|
|
* matrix output by running the script as a child process (stdin pipe mode).
|
|
*/
|
|
|
|
const { test, describe } = require('node:test');
|
|
const assert = require('node:assert/strict');
|
|
const path = require('node:path');
|
|
const { runNode } = require('./helpers/process-seam.cjs');
|
|
const { throwIfFailed } = require('./helpers/git-fixture.cjs');
|
|
const { PROBE_TIMEOUT_MS } = require('./helpers/timeouts.cjs');
|
|
|
|
const MATRIX_SCRIPT = path.resolve(__dirname, '../scripts/mutation-matrix.cjs');
|
|
const matrix = require(MATRIX_SCRIPT);
|
|
|
|
// ── (a) TARGET_MUTATION_SCORE ─────────────────────────────────────────────────
|
|
describe('mutation-matrix ratchet: TARGET_MUTATION_SCORE export', () => {
|
|
test('exports TARGET_MUTATION_SCORE', () => {
|
|
assert.ok(
|
|
Object.prototype.hasOwnProperty.call(matrix, 'TARGET_MUTATION_SCORE'),
|
|
'mutation-matrix.cjs must export TARGET_MUTATION_SCORE'
|
|
);
|
|
});
|
|
|
|
test('TARGET_MUTATION_SCORE is numeric', () => {
|
|
assert.strictEqual(
|
|
typeof matrix.TARGET_MUTATION_SCORE,
|
|
'number',
|
|
'TARGET_MUTATION_SCORE must be a number'
|
|
);
|
|
});
|
|
|
|
test('TARGET_MUTATION_SCORE equals 80', () => {
|
|
assert.strictEqual(
|
|
matrix.TARGET_MUTATION_SCORE,
|
|
80,
|
|
'TARGET_MUTATION_SCORE must equal 80 (ADR-456 floor)'
|
|
);
|
|
});
|
|
});
|
|
|
|
// ── (b) every COVERED module has a valid minScore ─────────────────────────────
|
|
describe('mutation-matrix ratchet: per-module minScore in COVERED', () => {
|
|
test('exports COVERED object', () => {
|
|
assert.ok(
|
|
Object.prototype.hasOwnProperty.call(matrix, 'COVERED'),
|
|
'mutation-matrix.cjs must export COVERED'
|
|
);
|
|
assert.strictEqual(typeof matrix.COVERED, 'object');
|
|
assert.ok(matrix.COVERED !== null);
|
|
});
|
|
|
|
const covered = matrix.COVERED || {};
|
|
const moduleNames = Object.keys(covered);
|
|
|
|
test('COVERED has at least one module', () => {
|
|
assert.ok(moduleNames.length > 0, 'COVERED must contain at least one module');
|
|
});
|
|
|
|
for (const name of moduleNames) {
|
|
describe(`module: ${name}`, () => {
|
|
test(`${name}: declares minScore`, () => {
|
|
const entry = covered[name];
|
|
assert.ok(
|
|
Object.prototype.hasOwnProperty.call(entry, 'minScore'),
|
|
`COVERED['${name}'] must have a minScore property`
|
|
);
|
|
});
|
|
|
|
test(`${name}: minScore is a number`, () => {
|
|
const entry = covered[name];
|
|
assert.strictEqual(
|
|
typeof entry.minScore,
|
|
'number',
|
|
`COVERED['${name}'].minScore must be a number`
|
|
);
|
|
});
|
|
|
|
test(`${name}: minScore is between 50 and 100 (inclusive)`, () => {
|
|
const entry = covered[name];
|
|
assert.ok(
|
|
entry.minScore >= 50,
|
|
`COVERED['${name}'].minScore (${entry.minScore}) must be ≥ 50`
|
|
);
|
|
assert.ok(
|
|
entry.minScore <= 100,
|
|
`COVERED['${name}'].minScore (${entry.minScore}) must be ≤ 100`
|
|
);
|
|
});
|
|
});
|
|
}
|
|
});
|
|
|
|
// ── (c) matrix JSON emitted by the script includes minScore per module ────────
|
|
describe('mutation-matrix ratchet: matrix JSON output includes minScore', () => {
|
|
test('script emits valid JSON with minScore in each matrix include entry', () => {
|
|
// Use stdin pipe mode: pass every COVERED module's src/*.cts path as
|
|
// "changed" files so all modules appear in the matrix output.
|
|
// computeMatrix() matches `src/<module>.cts` — derive from the module name.
|
|
const covered = matrix.COVERED || {};
|
|
const moduleNames = Object.keys(covered);
|
|
const stdinLines = moduleNames.map(name => `src/${name}.cts`).join('\n');
|
|
|
|
const spawnResult = runNode(
|
|
[MATRIX_SCRIPT],
|
|
{
|
|
input: stdinLines + '\n',
|
|
cwd: path.resolve(__dirname, '..'),
|
|
timeoutMs: PROBE_TIMEOUT_MS,
|
|
}
|
|
);
|
|
throwIfFailed(spawnResult, `node ${MATRIX_SCRIPT}`);
|
|
const raw = spawnResult.stdout;
|
|
|
|
let result;
|
|
try {
|
|
result = JSON.parse(raw);
|
|
} catch (e) {
|
|
assert.fail(`mutation-matrix.cjs did not emit valid JSON: ${e.message}\nOutput: ${raw}`);
|
|
}
|
|
|
|
assert.strictEqual(result.has_work, 'true', 'has_work must be "true" when covered modules change');
|
|
assert.ok(Array.isArray(result.matrix.include), 'matrix.include must be an array');
|
|
assert.ok(result.matrix.include.length > 0, 'matrix.include must not be empty');
|
|
|
|
for (const entry of result.matrix.include) {
|
|
assert.ok(
|
|
Object.prototype.hasOwnProperty.call(entry, 'minScore'),
|
|
`matrix entry for '${entry.name}' must include minScore in JSON output`
|
|
);
|
|
assert.strictEqual(
|
|
typeof entry.minScore,
|
|
'number',
|
|
`matrix entry for '${entry.name}' minScore must be a number`
|
|
);
|
|
assert.ok(
|
|
entry.minScore >= 50 && entry.minScore <= 100,
|
|
`matrix entry for '${entry.name}' minScore (${entry.minScore}) must be between 50 and 100`
|
|
);
|
|
}
|
|
});
|
|
});
|
|
|
|
// ── (d) negative proof: missing minScore is detectable ───────────────────────
|
|
describe('mutation-matrix ratchet: guard detects missing minScore', () => {
|
|
test('a module entry without minScore would fail the range check (50-100)', () => {
|
|
// Simulate the invariant: if minScore is missing, typeof === 'undefined',
|
|
// which is not 'number' → the per-module assertion above would catch it.
|
|
const fakeEntry = { cjs: 'foo.cjs', tests: ['tests/foo.test.cjs'] };
|
|
assert.notStrictEqual(
|
|
typeof fakeEntry.minScore,
|
|
'number',
|
|
'An entry without minScore must NOT pass the typeof-number check'
|
|
);
|
|
// Also verify that undefined < 50 and undefined > 100 are both false,
|
|
// meaning the ≥50 check below would also catch it if typeof were lenient.
|
|
assert.ok(
|
|
!(fakeEntry.minScore >= 50),
|
|
'undefined minScore must fail the ≥50 guard'
|
|
);
|
|
});
|
|
});
|
|
|
|
// ── (e) monotonic ratchet: minScore must exactly match baseline ───────────────
|
|
// RATCHET_BASELINE is a deliberate review-visible mirror of the floors in COVERED.
|
|
//
|
|
// CONTRACT: every COVERED module's minScore must EQUAL its entry here.
|
|
// ANY change to a floor (up or down) requires updating RATCHET_BASELINE in the
|
|
// same diff, making the change explicit in code review. This prevents a floor
|
|
// from being raised in COVERED and later silently lowered back to baseline.
|
|
//
|
|
// To ADD a new module to COVERED: add a baseline entry here in the same diff.
|
|
// The assertion "every COVERED module has a baseline" enforces this.
|
|
// The assertion "every baseline module still exists in COVERED" enforces the
|
|
// reverse: removing a module from COVERED also requires updating the baseline.
|
|
const RATCHET_BASELINE = {
|
|
'context-utilization': 80,
|
|
'context-composer': 66, // #2929: extracted from prompt-budget; same floor as prompt-budget
|
|
'prompt-budget': 66, // CI 68.33% 2026-06-14; was 90 (timeout-inflated local)
|
|
'frontmatter': 62,
|
|
'adr-parser': 68,
|
|
'config-schema': 52, // CI 54.55% 2026-06-14; was 68 (timeout-inflated local)
|
|
'active-workstream-store': 80,
|
|
'core-utils': 75,
|
|
'planning-inspect': 56, // CI run 32392791843: 57.03% (unit shard); ratchet candidate vs TARGET 80
|
|
'plan-document': 75, // CI run 32392791843: 76.58% (unit shard)
|
|
'planning-command-router': 94, // CI run 32392791843: 95.65% (unit shard); already exceeds TARGET 80
|
|
};
|
|
|
|
describe('mutation-matrix ratchet: floor equality enforcement', () => {
|
|
const covered = matrix.COVERED || {};
|
|
const coveredNames = Object.keys(covered);
|
|
|
|
test('every COVERED module has a RATCHET_BASELINE entry (new modules must add one)', () => {
|
|
for (const name of coveredNames) {
|
|
assert.ok(
|
|
Object.prototype.hasOwnProperty.call(RATCHET_BASELINE, name),
|
|
`COVERED module '${name}' has no RATCHET_BASELINE entry — add one before merging`
|
|
);
|
|
}
|
|
});
|
|
|
|
test('every RATCHET_BASELINE module still exists in COVERED (removed modules must drop their baseline entry)', () => {
|
|
for (const name of Object.keys(RATCHET_BASELINE)) {
|
|
assert.ok(
|
|
Object.prototype.hasOwnProperty.call(covered, name),
|
|
`RATCHET_BASELINE has entry for '${name}' but it no longer exists in COVERED — remove the baseline entry`
|
|
);
|
|
}
|
|
});
|
|
|
|
for (const name of coveredNames) {
|
|
test(`${name}: minScore === baseline (${RATCHET_BASELINE[name] ?? 'NO BASELINE'}) — any floor change must update RATCHET_BASELINE`, () => {
|
|
const baseline = RATCHET_BASELINE[name];
|
|
if (baseline === undefined) {
|
|
// Already caught by the presence check above; skip the numeric compare
|
|
// to avoid a confusing NaN comparison error.
|
|
assert.fail(`no RATCHET_BASELINE for '${name}' — add it`);
|
|
return;
|
|
}
|
|
const actual = covered[name].minScore;
|
|
assert.strictEqual(
|
|
actual,
|
|
baseline,
|
|
`COVERED['${name}'].minScore (${actual}) !== RATCHET_BASELINE (${baseline}) — update RATCHET_BASELINE to match the new floor`
|
|
);
|
|
});
|
|
}
|
|
});
|
|
|
|
// ── (f) resolveMutationBreak behaviour ───────────────────────────────────────
|
|
describe('resolveMutationBreak: fail-closed env-var resolver', () => {
|
|
const { resolveMutationBreak } = matrix;
|
|
|
|
test('exports resolveMutationBreak as a function', () => {
|
|
assert.strictEqual(typeof resolveMutationBreak, 'function');
|
|
});
|
|
|
|
test('undefined → 60 (local run backstop)', () => {
|
|
assert.strictEqual(resolveMutationBreak(undefined), 60);
|
|
});
|
|
|
|
test("'' (empty string) → throws (CI shard wiring error)", () => {
|
|
assert.throws(
|
|
() => resolveMutationBreak(''),
|
|
/MUTATION_BREAK is set but empty/
|
|
);
|
|
});
|
|
|
|
test("' ' (whitespace-only) → throws (CI shard wiring error)", () => {
|
|
assert.throws(
|
|
() => resolveMutationBreak(' '),
|
|
/MUTATION_BREAK is set but empty/
|
|
);
|
|
});
|
|
|
|
test("'abc' → throws (non-numeric)", () => {
|
|
assert.throws(
|
|
() => resolveMutationBreak('abc'),
|
|
/MUTATION_BREAK invalid/
|
|
);
|
|
});
|
|
|
|
test("'0' → throws (out of range: below 1)", () => {
|
|
assert.throws(
|
|
() => resolveMutationBreak('0'),
|
|
/MUTATION_BREAK invalid/
|
|
);
|
|
});
|
|
|
|
test("'150' → throws (out of range: above 100)", () => {
|
|
assert.throws(
|
|
() => resolveMutationBreak('150'),
|
|
/MUTATION_BREAK invalid/
|
|
);
|
|
});
|
|
|
|
test("'80' → 80", () => {
|
|
assert.strictEqual(resolveMutationBreak('80'), 80);
|
|
});
|
|
|
|
test("'62' → 62", () => {
|
|
assert.strictEqual(resolveMutationBreak('62'), 62);
|
|
});
|
|
});
|