`verification/tk10995-five-sweeps.mjs`

95 lines
import fs from 'node:fs';

const base = 'http://127.0.0.1:9788';
const evidencePath = new URL('./tk10995-five-sweeps.json', import.meta.url);

function assert(condition, message) {
  if (!condition) throw new Error(message);
}

async function request(path, options = {}) {
  const response = await fetch(`${base}${path}`, options);
  const text = await response.text();
  let json = null;
  try { json = JSON.parse(text); } catch {}
  return { status: response.status, text, json };
}

const startedAt = new Date().toISOString();
const sweeps = [];

for (let pass = 1; pass <= 5; pass += 1) {
  const correlationId = `TK-10995-sweep-${pass}-${Date.now()}`;
  const root = await request('/');
  assert(root.status === 200, `sweep ${pass}: root status ${root.status}`);
  assert(root.text.includes('Gated approvals'), `sweep ${pass}: root UI missing title`);
  assert(root.text.includes('do not publish, email, spend, deploy, delete'), `sweep ${pass}: safe-mode rail missing`);

  const favicon = await request('/favicon.ico');
  assert(favicon.status === 204, `sweep ${pass}: favicon status ${favicon.status}`);

  const before = await request('/api/items');
  assert(before.status === 200, `sweep ${pass}: items status ${before.status}`);
  assert(Array.isArray(before.json?.items) && before.json.items.length > 0, `sweep ${pass}: no items`);
  assert(before.json.writePerformed === false, `sweep ${pass}: GET claimed a write`);
  const item = before.json.items[0];
  assert(item.created_at, `sweep ${pass}: admin card data lacks created_at`);

  const invalid = await request('/api/decision', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: '{not-json',
  });
  assert(invalid.status === 400 && invalid.json?.error === 'invalid json', `sweep ${pass}: invalid JSON was not rejected`);

  const unknown = await request('/api/decision', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ id: `UNKNOWN-${correlationId}`, action: 'revise' }),
  });
  assert(unknown.status === 404 && unknown.json?.error === 'unknown item', `sweep ${pass}: unknown item was not rejected`);

  const recorded = await request('/api/decision', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ id: item.id, action: 'revise', note: correlationId }),
  });
  assert(recorded.status === 200 && recorded.json?.ok === true, `sweep ${pass}: local decision was not recorded`);
  assert(recorded.json?.writePerformed === false, `sweep ${pass}: response claimed an external write`);

  const after = await request('/api/items');
  const persisted = after.json?.decisions?.find((decision) => decision.note === correlationId);
  assert(persisted?.id === item.id && persisted?.action === 'revise', `sweep ${pass}: decision did not persist`);

  sweeps.push({
    pass,
    verdict: 'PASS',
    correlationId,
    itemId: item.id,
    source: before.json.source,
    rootStatus: root.status,
    faviconStatus: favicon.status,
    itemsStatus: before.status,
    invalidJsonStatus: invalid.status,
    unknownItemStatus: unknown.status,
    recordStatus: recorded.status,
    persisted: true,
    externalWritePerformed: false,
  });
}

const result = {
  ticket: 'TK-10995',
  intent: 'Five local end-to-end verification sweeps of the approval viewer',
  riskTier: 'R2 local user-facing flow',
  environment: base,
  startedAt,
  finishedAt: new Date().toISOString(),
  constraints: { emailSent: false, spendUsd: 0, productionActions: false },
  sweeps,
  verdict: sweeps.length === 5 && sweeps.every((sweep) => sweep.verdict === 'PASS') ? 'PASS' : 'FAIL',
};

fs.writeFileSync(evidencePath, `${JSON.stringify(result, null, 2)}\n`);
console.log(JSON.stringify(result, null, 2));