feat(okr): okf-check++ strictIngest (vokab+lenker) + skip innboks/dot (SC konformitet) [skip-docs]

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_012HzGPGJ81k1BkUC6UvgX4Y

tests/okf-check.test.mjs

@@ -10,7 +10,7 @@ import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { execFileSync } from 'node:child_process';
 import {
-  mkdtempSync, cpSync, writeFileSync, readFileSync, existsSync, readdirSync, rmSync,
+  mkdtempSync, cpSync, writeFileSync, readFileSync, existsSync, readdirSync, rmSync, mkdirSync,
 } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, dirname } from 'node:path';
@@ -26,15 +26,36 @@ function tmpRoot() {
 }
 
 // Kjoer okf-check som subprosess; fang non-zero exit (execFileSync kaster da).
-function runCheck(root) {
+// extra: ekstra CLI-flagg (f.eks. '--strict-ingest').
+function runCheck(root, ...extra) {
   try {
-    const stdout = execFileSync('node', [CHECK, root], { encoding: 'utf8' });
+    const stdout = execFileSync('node', [CHECK, root, ...extra], { encoding: 'utf8' });
     return { status: 0, stdout };
   } catch (e) {
     return { status: e.status ?? 1, stdout: `${e.stdout || ''}${e.stderr || ''}` };
   }
 }
 
+// Bygg en ren ingestion-bundle: kanoniske vokab-typer + en trygg, on-disk relasjon.
+function buildCleanIngest(dir) {
+  mkdirSync(join(dir, 'strategisk-kontekst'), { recursive: true });
+  mkdirSync(join(dir, 'dokumenter'), { recursive: true });
+  writeFileSync(join(dir, 'index.md'), '# Bundle\n\nokf_version: kb-layout-2026-06\n');
+  writeFileSync(
+    join(dir, 'strategisk-kontekst', 'tildelingsbrev.md'),
+    '---\ntype: Tildelingsbrev\nresource: urn:okr:tb\ntitle: Tildelingsbrev 2026\n'
+      + "description: Styringssignaler.\ntimestamp: '2026-01-15T09:00:00+00:00'\n---\n"
+      + '# Tildelingsbrev 2026\n\nHoveddokument.\n',
+  );
+  writeFileSync(
+    join(dir, 'dokumenter', 'notat.md'),
+    '---\ntype: Notat\nresource: urn:okr:notat\ntitle: Internt notat\n'
+      + "description: Et notat.\ntimestamp: '2026-02-01T09:00:00+00:00'\n---\n"
+      + '# Internt notat\n\n## Relaterte dokumenter\n\n'
+      + '- [Tildelingsbrev 2026](/strategisk-kontekst/tildelingsbrev.md)\n',
+  );
+}
+
 // Alle kataloger under root (inkl. root selv), rekursivt.
 function allDirs(root) {
   const out = [root];
@@ -135,3 +156,101 @@ test('okf-check: rapporterer okf_version fra rot-index', () => {
   const { stdout } = runCheck(REALISTIC);
   assert.match(stdout, /okf_version:\s*kb-layout-2026-06/, 'skal ekko okf_version for menneskelig sammenligning');
 });
+
+// --- okf-check --strict-ingest (Step 8): lukket vokab + lenke-allow-liste ---
+
+test('okf-check --strict-ingest: ren ingestion-bundle (vokab-type + trygg on-disk relasjon) -> exit 0', () => {
+  const dir = tmpRoot();
+  try {
+    buildCleanIngest(dir);
+    const { status, stdout } = runCheck(dir, '--strict-ingest');
+    assert.equal(status, 0, `ren bundle skal gi exit 0:\n${stdout}`);
+    assert.match(stdout, /0 strict-ingest-feil/, 'skal rapportere null strict-feil');
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('okf-check --strict-ingest: type utenfor vokabular -> exit 1 + navngir filen', () => {
+  const dir = tmpRoot();
+  try {
+    buildCleanIngest(dir);
+    writeFileSync(
+      join(dir, 'dokumenter', 'rar.md'),
+      '---\ntype: Tilfeldig\ntitle: Rar\ndescription: x\n---\n# Rar\n',
+    );
+    const { status, stdout } = runCheck(dir, '--strict-ingest');
+    assert.equal(status, 1, 'out-of-vocab type skal gi exit 1');
+    assert.match(stdout, /rar\.md: type .* utenfor ingestion-vokabular/, 'skal navngi feilen');
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('okf-check --strict-ingest: usikker lenke (escape ut av bundle) -> exit 1', () => {
+  const dir = tmpRoot();
+  try {
+    buildCleanIngest(dir);
+    writeFileSync(
+      join(dir, 'dokumenter', 'ond.md'),
+      '---\ntype: Notat\ntitle: Ond\ndescription: x\n---\n# Ond\n\n- [exfil](../../../etc/passwd)\n',
+    );
+    const { status, stdout } = runCheck(dir, '--strict-ingest');
+    assert.equal(status, 1, 'utrygg lenke skal gi exit 1');
+    assert.match(stdout, /utrygg lenke/, 'skal rapportere utrygg lenke');
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('okf-check --strict-ingest: dangling bundle-lenke (trygg form, mangler on-disk) -> exit 1', () => {
+  const dir = tmpRoot();
+  try {
+    buildCleanIngest(dir);
+    writeFileSync(
+      join(dir, 'dokumenter', 'henger.md'),
+      '---\ntype: Notat\ntitle: Henger\ndescription: x\n---\n# Henger\n\n'
+        + '- [Mangler](/strategisk-kontekst/finnes-ikke.md)\n',
+    );
+    const { status, stdout } = runCheck(dir, '--strict-ingest');
+    assert.equal(status, 1, 'dangling lenke skal gi exit 1');
+    assert.match(stdout, /dangling lenke/, 'skal rapportere dangling lenke');
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('okf-check --strict-ingest: lenke-baerende title -> exit 1', () => {
+  const dir = tmpRoot();
+  try {
+    buildCleanIngest(dir);
+    writeFileSync(
+      join(dir, 'dokumenter', 'tittel.md'),
+      '---\ntype: Notat\ntitle: "[Klikk her](http://evil.example)"\ndescription: x\n---\n# T\n',
+    );
+    const { status, stdout } = runCheck(dir, '--strict-ingest');
+    assert.equal(status, 1, 'lenke-baerende title skal gi exit 1');
+    assert.match(stdout, /lenke-baerende title/, 'skal rapportere lenke-baerende title');
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+// --- walk-eksklusjon (Step 8): drop-zone + dot-kataloger skannes aldri ---
+
+test('okf-check: raa filer i innboks/ og .cache/ ignoreres av walk (ingen falsk exit 1)', () => {
+  const dir = tmpRoot();
+  try {
+    buildCleanIngest(dir);
+    mkdirSync(join(dir, 'innboks'), { recursive: true });
+    mkdirSync(join(dir, '.cache'), { recursive: true });
+    // Raa filer UTEN type -- ville gitt exit 1 hvis walk ikke ekskluderte dem.
+    writeFileSync(join(dir, 'innboks', 'raa.md'), '# Raa innboks-fil uten frontmatter\n');
+    writeFileSync(join(dir, '.cache', 'c.md'), '# Cache uten type\n');
+    const { status, stdout } = runCheck(dir);
+    assert.equal(status, 0, `drop-zone/dot-filer skal ignoreres:\n${stdout}`);
+    assert.match(stdout, /0 filer uten type:/, 'walk skal ikke telle drop-zone-filer');
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});