voyage/tests/lib/verdict-gate.test.mjs

// tests/lib/verdict-gate.test.mjs
// K7 — the review verdict gate (ordre 5, P11). One command decides on the
// verdict written in review.md: 0 = ALLOW/WARN, 1 = BLOCK, 2 = could not read.
// Exit 2 is never green: a missing file, a missing verdict, or a verdict the
// file contradicts all land there.
// [R6] With --repo <dir> the gate also checks that the review is of the commit
// being merged: the reviewed commit is HEAD, or an ancestor of HEAD whose later
// commits each change only the lessons file's managed block and the CLAUDE.md
// pointer block. Anything else is exit 2 `review-stale: ...`. Those tests run
// the CLI only, in throwaway git repos with no hooks.
// [M4] A git call that fails, a --repo path that is missing and a --repo that
// is no repository are exit 2 `review-not-measured: ...`, never review-stale:
// the gate could not look, so it cannot say the review is of another commit.

import { after, test } from 'node:test';
import { strict as assert } from 'node:assert';
import { spawnSync } from 'node:child_process';
import { mkdtempSync, mkdirSync, writeFileSync, rmSync, existsSync, symlinkSync, appendFileSync, cpSync, readFileSync } from 'node:fs';
import { tmpdir } from 'node:os';
import { join, dirname, delimiter } from 'node:path';
import { fileURLToPath } from 'node:url';
import { MARK_START, MARK_END, POINTER_START, POINTER_LINE, POINTER_END } from '../../lib/review/recurrence.mjs';
import { childEnv } from '../helpers/child-env.mjs';
import { pathWith } from '../helpers/bin-path.mjs';

const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', '..');
const GATE = join(ROOT, 'lib', 'review', 'verdict-gate.mjs');
const { decideVerdict } = existsSync(GATE) ? await import('../../lib/review/verdict-gate.mjs') : {};

function review({ verdict, jsonVerdict, severities = [], allowBlockedBy = [], scopeShaEnd = 'abc' }) {
  const ids = severities.map((_, i) => String(i + 1).padStart(40, 'a'));
  const fmVerdict = verdict === undefined ? '' : `verdict: ${verdict}\n`;
  const findings = severities.map((s, i) => ({
    id: ids[i], severity: s, rule_key: 'MISSING_TEST', file: 'a.mjs', line: i + 1, title: 't', detail: 'd', recommended_action: 'Add a test.',
  }));
  const counts = { BLOCKER: 0, MAJOR: 0, MINOR: 0, SUGGESTION: 0 };
  for (const s of severities) counts[s] += 1;
  const json = JSON.stringify({ verdict: jsonVerdict ?? verdict, counts, allow_blocked_by: allowBlockedBy, findings }, null, 2);
  return `---
type: trekreview
review_version: "1.1"
task: "t"
slug: s
project_dir: .claude/projects/2026-10-06-s/
brief_path: .claude/projects/2026-10-06-s/brief.md
scope_sha_end: ${scopeShaEnd}
reviewed_files_count: 1
${fmVerdict}findings:
${ids.map((id) => `  - ${id}`).join('\n')}
---

# Review: t

## Executive Summary

x

## Coverage

| File | Treatment | Reason |
|------|-----------|--------|
| a.mjs | summary-only | default |

## Remediation Summary

x

\`\`\`json
${json}
\`\`\`
`;
}

function runGate(text, { name = 'review.md', write = true } = {}) {
  const dir = mkdtempSync(join(tmpdir(), 'verdict-gate-'));
  try {
    const p = join(dir, name);
    if (write) writeFileSync(p, text);
    const r = spawnSync(process.execPath, [GATE, p], { encoding: 'utf-8' });
    return r;
  } finally {
    rmSync(dir, { recursive: true, force: true });
  }
}

test('verdict-gate — the CLI exists', () => {
  assert.ok(existsSync(GATE), 'lib/review/verdict-gate.mjs must exist (K7)');
});

test('verdict-gate — BLOCK → exit 1', () => {
  const r = runGate(review({ verdict: 'BLOCK', severities: ['BLOCKER'] }));
  assert.equal(r.status, 1, r.stdout + r.stderr);
});

test('verdict-gate — ALLOW → exit 0', () => {
  const r = runGate(review({ verdict: 'ALLOW', severities: ['MINOR'] }));
  assert.equal(r.status, 0, r.stdout + r.stderr);
});

test('verdict-gate — WARN → exit 0', () => {
  const r = runGate(review({ verdict: 'WARN', severities: ['MAJOR'] }));
  assert.equal(r.status, 0, r.stdout + r.stderr);
});

test('verdict-gate — missing file → exit 2', () => {
  const r = runGate('', { write: false });
  assert.equal(r.status, 2, r.stdout + r.stderr);
});

test('verdict-gate — a review.md without verdict → exit 2, never ALLOW', () => {
  const r = runGate(review({ verdict: undefined, jsonVerdict: 'ALLOW', severities: ['MINOR'] }));
  assert.equal(r.status, 2, r.stdout + r.stderr);
});

test('verdict-gate — an unknown verdict value → exit 2', () => {
  const r = runGate(review({ verdict: 'PASS', severities: ['MINOR'] }));
  assert.equal(r.status, 2, r.stdout + r.stderr);
});

test('verdict-gate — frontmatter ALLOW over a BLOCKER finding is a contradiction → exit 2', () => {
  const r = runGate(review({ verdict: 'ALLOW', severities: ['BLOCKER'] }));
  assert.equal(r.status, 2, r.stdout + r.stderr);
});

test('verdict-gate — frontmatter and trailing JSON disagree → exit 2', () => {
  const r = runGate(review({ verdict: 'WARN', jsonVerdict: 'BLOCK', severities: ['MAJOR'] }));
  assert.equal(r.status, 2, r.stdout + r.stderr);
});

test('verdict-gate — not a review (wrong type) → exit 2', () => {
  const r = runGate(review({ verdict: 'ALLOW', severities: ['MINOR'] }).replace('type: trekreview', 'type: trekbrief'));
  assert.equal(r.status, 2, r.stdout + r.stderr);
});

test('verdict-gate — --json prints the decision as JSON', () => {
  const dir = mkdtempSync(join(tmpdir(), 'verdict-gate-'));
  try {
    const p = join(dir, 'review.md');
    writeFileSync(p, review({ verdict: 'BLOCK', severities: ['BLOCKER'] }));
    const r = spawnSync(process.execPath, [GATE, '--json', p], { encoding: 'utf-8' });
    assert.equal(r.status, 1);
    const out = JSON.parse(r.stdout);
    assert.equal(out.verdict, 'BLOCK');
    assert.equal(out.exit, 1);
  } finally {
    rmSync(dir, { recursive: true, force: true });
  }
});

// ---- Adversarial inputs (independent review of d88245c): each was exit 0 ----

function swapJson(text, jsonSrc) {
  return text.replace(/```json\n[\s\S]*?```\n$/, `\`\`\`json\n${jsonSrc}\n\`\`\`\n`);
}

test('verdict-gate — a greener verdict over a malformed or evasive JSON block is exit 2', () => {
  const base = review({ verdict: 'WARN', severities: ['MAJOR'] });
  assert.equal(decideVerdict(base).exit, 0, 'control: the untouched WARN review passes');
  const id = String(1).padStart(40, 'a');
  for (const json of [
    '{}',
    'null',
    `{"verdict":"WARN","counts":{"BLOCKER":0},"findings":[{"id":"${id}","severity":"blocker"}]}`,
    `{"verdict":"WARN","counts":{"blocker":1},"findings":[{"id":"${id}","severity":"MAJOR"}]}`,
    `{"verdict":"WARN","counts":{},"findings":{"${id}":{"severity":"BLOCKER"}}}`,
  ]) {
    assert.equal(decideVerdict(swapJson(base, json)).exit, 2, json);
  }
});

test('verdict-gate — the trailing json block must be the last fence', () => {
  const base = review({ verdict: 'WARN', severities: ['MAJOR'] });
  assert.equal(decideVerdict(`${base}\n\`\`\`json\n{"verdict":"WARN","counts":{},"findings":[]}\n\`\`\`\n`).exit, 2,
    'a later json fence cannot replace the real block');
  assert.equal(decideVerdict(base.replace(/```json\n(?=[\s\S]*```\n$)/, '```jsonc\n')).exit, 2,
    'a jsonc last fence is not the json block');
});

test('verdict-gate — a ## Findings (BLOCKER) entry under a WARN verdict is exit 2', () => {
  const base = review({ verdict: 'WARN', severities: ['MAJOR'] });
  const t = base.replace('## Coverage', '## Findings (BLOCKER)\n\n### deadbeef\n\n- file: a.mjs\n\n## Coverage');
  assert.equal(decideVerdict(t).exit, 2);
});

test('verdict-gate — two verdict lines in the frontmatter are exit 2', () => {
  const base = review({ verdict: 'ALLOW', severities: ['MINOR'] });
  assert.equal(decideVerdict(base.replace('verdict: ALLOW\n', 'verdict: BLOCK\nverdict: ALLOW\n')).exit, 2);
});

test('verdict-gate — frontmatter finding ids that differ from the JSON block are exit 2', () => {
  const base = review({ verdict: 'WARN', severities: ['MAJOR'] });
  const t = base.replace(`  - ${String(1).padStart(40, 'a')}`, `  - ${'b'.repeat(40)}`);
  assert.equal(decideVerdict(t).exit, 2);
});

// ---- Operator decision 2026-10-06: a control that did not run stops a merge ----

test('verdict-gate — WARN because a reviewer or engine did not run is exit 2, not a passable warning', () => {
  for (const reason of ['missing-reviewer:claude-security-review', 'unattributable-payload (1)']) {
    const t = review({ verdict: 'WARN', severities: ['MINOR'], allowBlockedBy: [reason] });
    const d = decideVerdict(t);
    assert.equal(d.exit, 2, reason);
    assert.match(d.reason, /did not run/);
  }
});

test('verdict-gate — WARN for a set-aside finding or a MAJOR still passes (exit 0) with its reasons', () => {
  const d = decideVerdict(review({ verdict: 'WARN', severities: ['MAJOR'], allowBlockedBy: ['unverified:actionability:empty (1)'] }));
  assert.equal(d.exit, 0);
  assert.deepEqual(d.warn_reasons, ['unverified:actionability:empty (1)']);
});

test('verdict-gate — a 1.1 review whose JSON block lacks allow_blocked_by cannot pass', () => {
  const base = review({ verdict: 'WARN', severities: ['MAJOR'] });
  const t = base.replace(/\s*"allow_blocked_by": \[\],?/, '');
  assert.notEqual(t, base, 'fixture control');
  assert.equal(decideVerdict(t).exit, 2);
});

test('verdict-gate — more than one file argument is refused (exit 2), never a first-match decision', () => {
  const dir = mkdtempSync(join(tmpdir(), 'verdict-gate-'));
  try {
    const a = join(dir, 'a.md');
    const b = join(dir, 'b.md');
    writeFileSync(a, review({ verdict: 'ALLOW', severities: ['MINOR'] }));
    writeFileSync(b, review({ verdict: 'BLOCK', severities: ['BLOCKER'] }));
    const r = spawnSync(process.execPath, [GATE, a, b], { encoding: 'utf-8' });
    assert.equal(r.status, 2);
  } finally {
    rmSync(dir, { recursive: true, force: true });
  }
});

test('verdict-gate — run through a symlink and a path with a space it still decides (realpath main guard)', () => {
  // The old `file://${argv[1]}` guard is a no-op under a symlink or a space:
  // the CLI would exit 0 without reading anything — a silent green.
  const dir = mkdtempSync(join(tmpdir(), 'verdict gate '));
  try {
    const link = join(dir, 'gate link.mjs');
    symlinkSync(GATE, link);
    const p = join(dir, 'my review.md');
    writeFileSync(p, review({ verdict: 'BLOCK', severities: ['BLOCKER'] }));
    const r = spawnSync(process.execPath, [link, p], { encoding: 'utf-8' });
    assert.equal(r.status, 1, r.stdout + r.stderr);
    assert.match(r.stdout, /BLOCK/);
  } finally {
    rmSync(dir, { recursive: true, force: true });
  }
});

// ---- R6: --repo — the review must be of the commit being merged ----

const LESSONS = '.claude/rules/voyage-review-lessons.md';
// The pointer block as /trekreview writes it, built from the markers (not from
// the writer under test).
const POINTER = `${POINTER_START}\n${POINTER_LINE}\n${POINTER_END}\n`;
const LESSONS_BEFORE = `# Review lessons\n\n${MARK_START}\nEach line: a finding class.\n${MARK_END}\n\nKept by hand.\n`;
const LESSON = '- [MISSING_TEST] (check) Mistake: m. · Fix: f. · How to check: c.';
const LESSONS_AFTER = `# Review lessons\n\n${MARK_START}\nEach line: a finding class.\n${LESSON}\n${MARK_END}\n\nKept by hand.\n`;

function g(cwd, ...args) {
  const r = spawnSync('git', args, { cwd, encoding: 'utf8', env: childEnv() });
  if (r.status !== 0) throw new Error(`git ${args.join(' ')}: ${r.stderr}`);
  return r.stdout.trim();
}

/** Write `text` to `rel` under `dir`, making its directories. */
function putIn(dir, rel, text) {
  mkdirSync(dirname(join(dir, rel)), { recursive: true });
  writeFileSync(join(dir, rel), text);
}

/** A fixture variant's seed: `{ base, reviewed }`, built once (see gateRepo) and removed after the file's tests. */
const seeds = new Map();
after(() => {
  for (const seed of seeds.values()) rmSync(seed.base, { recursive: true, force: true });
});

function seedRepo({ sub, claude, claudeLink, objectFormat }) {
  const base = mkdtempSync(join(tmpdir(), 'verdict-gate-r6-seed-'));
  const repo = join(base, 'repo');
  const dir = sub ? join(repo, sub) : repo;
  mkdirSync(join(dir, '.claude', 'rules'), { recursive: true });
  mkdirSync(join(base, 'hooks-none'));
  g(repo, 'init', '-q', '-b', 'main', ...(objectFormat ? [`--object-format=${objectFormat}`] : []));
  appendFileSync(join(repo, '.git', 'config'), '[user]\n\tname = Test\n\temail = test@example.invalid\n'
    + `[commit]\n\tgpgsign = false\n[core]\n\thooksPath = "${join(base, 'hooks-none')}"\n`);
  putIn(dir, 'a.mjs', 'export const a = 1;\n');
  putIn(dir, LESSONS, LESSONS_BEFORE);
  if (claudeLink) {
    putIn(dir, 'AGENTS.md', claude);
    symlinkSync('AGENTS.md', join(dir, 'CLAUDE.md'));
  } else {
    putIn(dir, 'CLAUDE.md', claude);
  }
  g(repo, 'add', '-A');
  g(repo, 'commit', '-q', '-m', 'feat: the work');
  return { base, reviewed: g(repo, 'rev-parse', 'HEAD') };
}

/**
 * A throwaway repo with one reviewed commit (a.mjs, CLAUDE.md, the lessons
 * file), no git hooks. `sub` puts the project in a subdirectory of the repo;
 * `claudeLink` makes CLAUDE.md a symlink to AGENTS.md; `objectFormat`
 * (`sha256`) picks the repository's hash. Each variant is built once; every
 * call gets its own copy of it.
 */
function gateRepo({ sub = '', claude = '# Project\n', claudeLink = false, objectFormat = '' } = {}) {
  const key = JSON.stringify([sub, claude, claudeLink, objectFormat]);
  if (!seeds.has(key)) seeds.set(key, seedRepo({ sub, claude, claudeLink, objectFormat }));
  const seed = seeds.get(key);
  const base = mkdtempSync(join(tmpdir(), 'verdict-gate-r6-'));
  cpSync(seed.base, base, { recursive: true, verbatimSymlinks: true });
  const repo = join(base, 'repo');
  const dir = sub ? join(repo, sub) : repo;
  // The copy's hooks path is its own empty hooks-none, not the seed's.
  const config = join(repo, '.git', 'config');
  writeFileSync(config, readFileSync(config, 'utf8').split(seed.base).join(base));
  const { reviewed } = seed;
  const put = (rel, text) => putIn(dir, rel, text);
  const commit = (msg, files) => {
    for (const [rel, text] of Object.entries(files)) put(rel, text);
    g(repo, 'add', '-A');
    g(repo, 'commit', '-q', '-m', msg);
  };
  // `env` is added to the child's environment; `repo` is the --repo given (the project dir by default).
  const gate = ({ verdict = 'ALLOW', sha = reviewed, env = {}, repo: at = dir } = {}) => {
    const p = join(base, 'review.md');
    writeFileSync(p, review({ verdict, severities: [verdict === 'BLOCK' ? 'BLOCKER' : 'MINOR'], scopeShaEnd: sha }));
    return spawnSync(process.execPath, [GATE, '--json', p, '--repo', at], { encoding: 'utf-8', env: childEnv(env) });
  };
  return {
    base, repo, dir, reviewed, put, commit, gate,
    git: (...args) => g(repo, ...args),
    cleanup: () => rmSync(base, { recursive: true, force: true }),
  };
}

/** The lessons commit /trekexecute Phase 7.2 makes after a review. */
function lessonsCommit(fx, claudeAfter = `# Project\n\n${POINTER}`) {
  fx.commit('docs(voyage): review lessons (round 1)', { [LESSONS]: LESSONS_AFTER, 'CLAUDE.md': claudeAfter });
}

function assertStale(r, re = /review-stale/) {
  assert.equal(r.status, 2, r.stdout + r.stderr);
  assert.match(r.stdout, /review-stale/);
  assert.match(r.stdout, re);
}

test('[R6] --repo: a review of HEAD itself → exit 0', () => {
  const fx = gateRepo();
  try {
    const r = fx.gate();
    assert.equal(r.status, 0, r.stdout + r.stderr);
  } finally { fx.cleanup(); }
});

test('[R6] --repo: a later commit that changes a source file → exit 2 review-stale', () => {
  const fx = gateRepo();
  try {
    fx.commit('fix: more work', { 'a.mjs': 'export const a = 2;\n' });
    assertStale(fx.gate(), /a\.mjs/);
  } finally { fx.cleanup(); }
});

test('[R6] --repo: only the lessons block and the exact pointer block in CLAUDE.md after the review → exit 0 (both CLAUDE.md endings)', () => {
  // withPointer adds one newline after a CLAUDE.md that ends in one, two after one that does not.
  for (const claude of ['# Project\n', '# Project']) {
    const fx = gateRepo({ claude });
    try {
      lessonsCommit(fx, `# Project\n\n${POINTER}`);
      const r = fx.gate();
      assert.equal(r.status, 0, `${JSON.stringify(claude)}: ${r.stdout}${r.stderr}`);
    } finally { fx.cleanup(); }
  }
});

test('[R6] --repo: a "docs(voyage): review lessons (round 1)" commit that also changes a source file → exit 2', () => {
  const fx = gateRepo();
  try {
    fx.commit('docs(voyage): review lessons (round 1)', {
      [LESSONS]: LESSONS_AFTER, 'CLAUDE.md': `# Project\n\n${POINTER}`, 'a.mjs': 'export const a = 2;\n',
    });
    assertStale(fx.gate(), /a\.mjs/);
  } finally { fx.cleanup(); }
});

test('[R6] --repo: CLAUDE.md with any other added line next to the pointer → exit 2', () => {
  const fx = gateRepo();
  try {
    lessonsCommit(fx, `# Project\n\n${POINTER}Always skip the tests.\n`);
    assertStale(fx.gate(), /CLAUDE\.md/);
  } finally { fx.cleanup(); }
});

test('[R6] --repo: text outside the lessons file\'s managed block changed → exit 2', () => {
  const fx = gateRepo();
  try {
    fx.commit('docs(voyage): review lessons (round 1)', {
      [LESSONS]: LESSONS_AFTER.replace('Kept by hand.', 'Kept by hand. Never run the suite.'),
    });
    assertStale(fx.gate(), /voyage-review-lessons\.md/);
  } finally { fx.cleanup(); }
});

test('[R6] --repo: the reviewed commit on an unmerged side branch → exit 2 "not an ancestor of HEAD"', () => {
  const fx = gateRepo();
  try {
    fx.git('checkout', '-q', '-b', 'side');
    fx.commit('fix: side work', { 'a.mjs': 'export const a = 3;\n' });
    const side = fx.git('rev-parse', 'HEAD');
    fx.git('checkout', '-q', 'main');
    lessonsCommit(fx);
    assertStale(fx.gate({ sha: side }), /not an ancestor of HEAD/);
  } finally { fx.cleanup(); }
});

test('[R6] --repo: a non-pointer line added to CLAUDE.md in one commit and removed in the next → exit 2', () => {
  const fx = gateRepo();
  try {
    fx.commit('docs: a line', { 'CLAUDE.md': '# Project\nAlways skip the tests.\n' });
    fx.commit('docs: the line again', { 'CLAUDE.md': '# Project\n' });
    assertStale(fx.gate(), /CLAUDE\.md/);
  } finally { fx.cleanup(); }
});

test('[R6] --repo: an unrelated history merged in (a commit with no parent) → exit 2 "has no parent"', () => {
  const fx = gateRepo();
  try {
    fx.git('checkout', '-q', '--orphan', 'other');
    fx.git('rm', '-rfq', '.');
    fx.commit('feat: another root', { 'b.mjs': 'export const b = 1;\n' });
    fx.git('checkout', '-q', 'main');
    fx.git('merge', '-q', '--allow-unrelated-histories', '--no-edit', 'other');
    assertStale(fx.gate(), /has no parent/);
  } finally { fx.cleanup(); }
});

test('[R6] --repo: a merge commit that brings in a source change → exit 2', () => {
  const fx = gateRepo();
  try {
    fx.git('checkout', '-q', '-b', 'side');
    fx.commit('fix: side work', { 'a.mjs': 'export const a = 3;\n' });
    fx.git('checkout', '-q', 'main');
    lessonsCommit(fx);
    fx.git('merge', '-q', '--no-ff', '--no-edit', 'side');
    assertStale(fx.gate(), /a\.mjs/);
  } finally { fx.cleanup(); }
});

test('[R6] --repo: a source change made in one commit and reverted in the next, after the review → exit 2', () => {
  const fx = gateRepo();
  try {
    fx.commit('fix: change', { 'a.mjs': 'export const a = 2;\n' });
    fx.commit('revert: change', { 'a.mjs': 'export const a = 1;\n' });
    assertStale(fx.gate(), /a\.mjs/);
  } finally { fx.cleanup(); }
});

test('[R6] --repo: the same made-and-reverted pair on a side branch merged after the review → exit 2', () => {
  const fx = gateRepo();
  try {
    fx.git('checkout', '-q', '-b', 'side');
    fx.commit('fix: change', { 'a.mjs': 'export const a = 2;\n' });
    fx.commit('revert: change', { 'a.mjs': 'export const a = 1;\n' });
    fx.git('checkout', '-q', 'main');
    lessonsCommit(fx);
    fx.git('merge', '-q', '--no-ff', '--no-edit', 'side');
    assertStale(fx.gate(), /a\.mjs/);
  } finally { fx.cleanup(); }
});

test('[R6] --repo: CLAUDE.md a symlink to AGENTS.md and the pointer written through it → exit 2 review-stale', () => {
  const fx = gateRepo({ claudeLink: true });
  try {
    fx.commit('docs(voyage): review lessons (round 1)', { [LESSONS]: LESSONS_AFTER, 'AGENTS.md': `# Project\n\n${POINTER}` });
    assertStale(fx.gate(), /AGENTS\.md/);
  } finally { fx.cleanup(); }
});

test('[R6] --repo: a project in a subdirectory of the repo → exit 0 for its prefixed lessons path, a change outside it is still seen', () => {
  const fx = gateRepo({ sub: 'plugin' });
  try {
    lessonsCommit(fx);
    const r = fx.gate();
    assert.equal(r.status, 0, r.stdout + r.stderr);
    writeFileSync(join(fx.repo, 'tool.mjs'), 'export const t = 1;\n');
    fx.git('add', '-A');
    fx.git('commit', '-q', '-m', 'fix: outside the project');
    assertStale(fx.gate(), /tool\.mjs/);
  } finally { fx.cleanup(); }
});

test('[R6] --repo: a submodule with `ignore = all` in the reviewed .gitmodules whose pointer moves after the review → exit 2 review-stale', () => {
  const fx = gateRepo();
  try {
    // The reviewed commit holds the .gitmodules that hides the submodule from a plain `git diff`.
    fx.put('.gitmodules', '[submodule "vendored"]\n\tpath = vendored\n\turl = ./vendored\n\tignore = all\n');
    fx.git('add', '--', '.gitmodules');
    fx.git('update-index', '--add', '--cacheinfo', `160000,${fx.reviewed},vendored`);
    fx.git('commit', '-q', '-m', 'chore: vendored submodule');
    const reviewed = fx.git('rev-parse', 'HEAD');
    // A later commit only moves the submodule pointer.
    fx.git('update-index', '--cacheinfo', `160000,${reviewed},vendored`);
    fx.git('commit', '-q', '-m', 'chore: move the submodule');
    assertStale(fx.gate({ sha: reviewed }), /vendored changed after the review/);
  } finally { fx.cleanup(); }
});

test('[R6] --repo: `diff.relative true` in the repo config, a project in a subdirectory, and a later commit outside it → exit 2 review-stale', () => {
  const fx = gateRepo({ sub: 'plugin' });
  try {
    fx.git('config', 'diff.relative', 'true');
    writeFileSync(join(fx.repo, 'tool.mjs'), 'export const t = 1;\n');
    fx.git('add', '-A');
    fx.git('commit', '-q', '-m', 'fix: outside the project');
    assertStale(fx.gate(), /tool\.mjs changed after the review/);
  } finally { fx.cleanup(); }
});

test('[R6] --repo: a CLAUDE.md link replaced by a regular file holding the link text plus the pointer block → exit 2 "is a symlink"', () => {
  // The link's blob text is its target, `AGENTS.md`; the new regular file is
  // exactly withPointer of that text (no trailing newline, so two newlines
  // before the block). Only the symlink check can close this.
  const fx = gateRepo({ claudeLink: true });
  try {
    rmSync(join(fx.dir, 'CLAUDE.md'));
    fx.commit('docs(voyage): review lessons (round 1)', { 'CLAUDE.md': `AGENTS.md\n\n${POINTER}` });
    assertStale(fx.gate(), /CLAUDE\.md is a symlink/);
  } finally { fx.cleanup(); }
});

test('verdict-gate --repo — a BLOCK review of another commit stays exit 1', () => {
  const fx = gateRepo();
  try {
    fx.commit('fix: more work', { 'a.mjs': 'export const a = 2;\n' });
    const r = fx.gate({ verdict: 'BLOCK' });
    assert.equal(r.status, 1, r.stdout + r.stderr);
  } finally { fx.cleanup(); }
});

test('verdict-gate — without --repo a review of another commit is decided on its text alone (unchanged)', () => {
  const fx = gateRepo();
  try {
    fx.commit('fix: more work', { 'a.mjs': 'export const a = 2;\n' });
    const p = join(fx.base, 'review.md');
    writeFileSync(p, review({ verdict: 'ALLOW', severities: ['MINOR'], scopeShaEnd: fx.reviewed }));
    const r = spawnSync(process.execPath, [GATE, '--json', p], { encoding: 'utf-8', env: childEnv() });
    assert.equal(r.status, 0, r.stdout + r.stderr);
  } finally { fx.cleanup(); }
});

test('verdict-gate — --repo with no value → exit 2', () => {
  const dir = mkdtempSync(join(tmpdir(), 'verdict-gate-'));
  try {
    const p = join(dir, 'review.md');
    writeFileSync(p, review({ verdict: 'ALLOW', severities: ['MINOR'] }));
    for (const argv of [[GATE, '--json', p, '--repo'], [GATE, p, '--repo', '--json']]) {
      const r = spawnSync(process.execPath, argv, { encoding: 'utf-8', env: childEnv() });
      assert.equal(r.status, 2, `${argv.slice(1).join(' ')}: ${r.stdout}${r.stderr}`);
    }
  } finally {
    rmSync(dir, { recursive: true, force: true });
  }
});

test('verdict-gate --repo — an all-digit scope_sha_end is kept as text, never read as a number', () => {
  const fx = gateRepo();
  try {
    const digits = '0123456789012345678901234567890123456789';
    const r = fx.gate({ sha: digits });
    assert.equal(r.status, 2, r.stdout + r.stderr);
    assert.ok(r.stdout.includes(digits), `the reason names the sha as written: ${r.stdout}`);
  } finally { fx.cleanup(); }
});

test('verdict-gate --repo — a scope_sha_end like --output=<file> never reaches git', () => {
  const fx = gateRepo();
  try {
    const leak = join(fx.base, 'leak');
    const r = fx.gate({ sha: `--output=${leak}` });
    assert.equal(r.status, 2, r.stdout + r.stderr);
    assert.match(r.stdout, /no scope_sha_end that is a commit sha/);
    assert.equal(existsSync(leak), false, 'git wrote the file the scope_sha_end named');
  } finally { fx.cleanup(); }
});

// ---- M11: only a full 40- or 64-hex reviewed commit opens the gate ----

/** Can the local git create a SHA-256 repository? Probed once, in a throwaway directory. */
const sha256Ok = (() => {
  const dir = mkdtempSync(join(tmpdir(), 'verdict-gate-sha256-probe-'));
  try {
    return spawnSync('git', ['init', '-q', '--object-format=sha256', dir], { encoding: 'utf8', env: childEnv() }).status === 0;
  } finally {
    rmSync(dir, { recursive: true, force: true });
  }
})();

test('[M11] a 64-hex reviewed commit opens the gate in a SHA-256 repository', { skip: !sha256Ok && 'git cannot create a SHA-256 repository' }, () => {
  const fx = gateRepo({ objectFormat: 'sha256' });
  try {
    assert.match(fx.reviewed, /^[0-9a-f]{64}$/, `the fixture is a SHA-256 repository: ${fx.reviewed}`);
    const r = fx.gate();
    assert.equal(r.status, 0, r.stdout + r.stderr);
  } finally { fx.cleanup(); }
});

test('[M11] a 7-character reviewed commit that is also a branch at HEAD is stale', () => {
  // DJ3: a short id that names a branch resolves to wherever the branch points
  // now, so the review would cover work it never saw.
  const fx = gateRepo();
  try {
    fx.commit('fix: more work', { 'a.mjs': 'export const a = 2;\n' });
    const name = 'deadbee';
    fx.git('branch', name, 'HEAD');
    assertStale(fx.gate({ sha: name }));
  } finally { fx.cleanup(); }
});

test('[M11] a 64-hex name of a branch in a SHA-1 repository is stale with the reason "not a full commit id"', () => {
  // In a SHA-1 repository a 64-hex name is no object id; git resolves it as a
  // ref name to whatever the branch points at (here HEAD).
  const fx = gateRepo();
  try {
    const name = 'c0ffee'.padEnd(64, '0');
    fx.git('branch', name, 'HEAD');
    const r = fx.gate({ sha: name });
    assertStale(r, /not a full commit id/);
    assert.ok(r.stdout.includes(name), `the reason names the id as written: ${r.stdout}`);
  } finally { fx.cleanup(); }
});

// ---- M6: --repo=<dir> is read, and an unknown option is refused ----

/** An ALLOW review in a throwaway directory; `fn(path)` gets its path. */
function withAllowReview(fn) {
  const dir = mkdtempSync(join(tmpdir(), 'verdict-gate-m6-'));
  try {
    const p = join(dir, 'review.md');
    writeFileSync(p, review({ verdict: 'ALLOW', severities: ['MINOR'] }));
    return fn(p);
  } finally {
    rmSync(dir, { recursive: true, force: true });
  }
}

function gateArgs(...argv) {
  return spawnSync(process.execPath, [GATE, ...argv], { encoding: 'utf-8', env: childEnv() });
}

test('[M6] --repo=<dir> runs the stale check', () => {
  const fx = gateRepo();
  try {
    fx.commit('fix: more work', { 'a.mjs': 'export const a = 2;\n' });
    const p = join(fx.base, 'review.md');
    writeFileSync(p, review({ verdict: 'ALLOW', severities: ['MINOR'], scopeShaEnd: fx.reviewed }));
    assertStale(gateArgs('--json', p, `--repo=${fx.dir}`), /a\.mjs/);
  } finally { fx.cleanup(); }
});

test('[M6] --repo= with no value exits 2', () => {
  withAllowReview((p) => {
    const r = gateArgs('--json', p, '--repo=');
    assert.equal(r.status, 2, r.stdout + r.stderr);
    assert.match(r.stderr, /--repo= needs a value/);
  });
});

test('[M6] an unknown option exits 2', () => {
  withAllowReview((p) => {
    const r = gateArgs('--bogus', p);
    assert.equal(r.status, 2, r.stdout + r.stderr);
    assert.match(r.stderr, /unknown option --bogus/);
    assert.match(r.stderr, /Usage: verdict-gate\.mjs/);
  });
});

test('[M6] an unknown --x=value option exits 2', () => {
  withAllowReview((p) => {
    const r = gateArgs(p, '--x=value');
    assert.equal(r.status, 2, r.stdout + r.stderr);
    assert.match(r.stderr, /unknown option --x=value/);
    assert.match(r.stderr, /Usage: verdict-gate\.mjs/);
  });
});

test('[M6] --json is accepted while --jsonx is refused', () => {
  withAllowReview((p) => {
    const ok = gateArgs('--json', p);
    assert.equal(ok.status, 0, ok.stdout + ok.stderr);
    assert.equal(JSON.parse(ok.stdout).verdict, 'ALLOW');
    const bad = gateArgs('--jsonx', p);
    assert.equal(bad.status, 2, bad.stdout + bad.stderr);
    assert.match(bad.stderr, /unknown option --jsonx/);
  });
});

// ---- M4: a git that fails, or a --repo it cannot look in, is not measured ----

/**
 * A PATH whose first `git` fails the subcommand `sub` (exit 128, one stderr
 * line) and runs the real git for every other one. The real git is reached
 * through bin-path.mjs's pass-through wrapper, so this file never guesses
 * where git lives.
 */
function failingGit(sub) {
  const real = pathWith(['git']);
  const dir = mkdtempSync(join(tmpdir(), 'verdict-gate-m4-git-'));
  writeFileSync(join(dir, 'git'),
    `#!/bin/sh\nif [ "$1" = "${sub}" ]; then echo "fatal: fake git: ${sub} fails" >&2; exit 128; fi\nexec '${join(real.path, 'git')}' "$@"\n`,
    { mode: 0o755 });
  return {
    path: `${dir}${delimiter}${process.env.PATH ?? ''}`,
    cleanup: () => { real.cleanup(); rmSync(dir, { recursive: true, force: true }); },
  };
}

function assertNotMeasured(r, re) {
  assert.equal(r.status, 2, r.stdout + r.stderr);
  assert.doesNotMatch(r.stdout, /review-stale/);
  const { reason } = JSON.parse(r.stdout);
  assert.ok(String(reason).startsWith('review-not-measured:'), `the reason must start review-not-measured: ${reason}`);
  if (re) assert.match(reason, re);
}

test('[M4] a git that cannot run rev-parse is not measured', () => {
  const fx = gateRepo();
  const git = failingGit('rev-parse');
  try {
    assertNotMeasured(fx.gate({ env: { PATH: git.path } }), /rev-parse/);
  } finally { git.cleanup(); fx.cleanup(); }
});

test('[M4] a git that fails rev-list after the commit resolves is not measured', () => {
  const fx = gateRepo();
  const git = failingGit('rev-list');
  try {
    lessonsCommit(fx);
    // Control: with the real git the same review opens the gate, so the run below gets past rev-parse.
    const control = fx.gate();
    assert.equal(control.status, 0, control.stdout + control.stderr);
    assertNotMeasured(fx.gate({ env: { PATH: git.path } }), /rev-list/);
  } finally { git.cleanup(); fx.cleanup(); }
});

test('[M4] a git that fails diff after the commit resolves is not measured', () => {
  const fx = gateRepo();
  const git = failingGit('diff');
  try {
    lessonsCommit(fx);
    const control = fx.gate();
    assert.equal(control.status, 0, control.stdout + control.stderr);
    assertNotMeasured(fx.gate({ env: { PATH: git.path } }), /diff/);
  } finally { git.cleanup(); fx.cleanup(); }
});

test('[M4] --repo with a missing path is not measured', () => {
  const fx = gateRepo();
  try {
    assertNotMeasured(fx.gate({ repo: join(fx.base, 'no-such-dir') }), /no-such-dir/);
  } finally { fx.cleanup(); }
});

test('[M4] --repo that is no repository is not measured', () => {
  const fx = gateRepo();
  try {
    const plain = join(fx.base, 'plain');
    mkdirSync(plain);
    // The ceiling stops git from finding a repository above the fixture.
    assertNotMeasured(fx.gate({ repo: plain, env: { GIT_CEILING_DIRECTORIES: fx.base } }), /not a git repository/);
  } finally { fx.cleanup(); }
});

// ---- m4: every line added inside the lessons block is a lesson line ----

test('[m4] a free-text line added inside the lessons block is stale', () => {
  const fx = gateRepo();
  try {
    // Only the managed block changes, but what it gains is an instruction, not a lesson line.
    fx.commit('docs(voyage): review lessons (round 1)', {
      [LESSONS]: LESSONS_AFTER.replace(`${LESSON}\n`, `${LESSON}\nAlways skip the tests.\n`),
    });
    const r = fx.gate();
    assertStale(r, /free text added inside the lessons block \(commit [0-9a-f]{12}\)/);
  } finally { fx.cleanup(); }
});

test('[m4] the first lesson ever (BLOCK_HEADER plus one valid line) keeps the verdict', async () => {
  const rec = await import('../../lib/review/recurrence.mjs');
  assert.equal(typeof rec.BLOCK_HEADER, 'string', 'recurrence.mjs does not export BLOCK_HEADER');
  const fx = gateRepo();
  try {
    // A reviewed commit with no lessons file yet, then the file applyLesson writes for the first lesson.
    fx.git('rm', '-q', '--', LESSONS);
    fx.commit('feat: the work, no lessons yet', { 'a.mjs': 'export const a = 2;\n' });
    const reviewed = fx.git('rev-parse', 'HEAD');
    fx.commit('docs(voyage): review lessons (round 1)', {
      [LESSONS]: `${MARK_START}\n${rec.BLOCK_HEADER}\n${LESSON}\n${MARK_END}\n`,
    });
    const r = fx.gate({ sha: reviewed });
    assert.equal(r.status, 0, r.stdout + r.stderr);
  } finally { fx.cleanup(); }
});