Assistant/tests/cognitive_registry/registry_test.go

package cognitive_registry_test

import (
	"os"
	"path/filepath"
	"strings"
	"testing"

	"git.cin.su/m/Assistant/contracts/capability"
	capabilitydomain "git.cin.su/m/Assistant/modules/capability/domain"
)

func validCandidate() capability.ResolvedCognitiveBinding {
	return capability.ResolvedCognitiveBinding{
		Binding:  capability.CognitiveBinding{ID: "binding-1", Revision: 3, CapabilityID: "creator-advisory", OwnerPrincipalID: "principal-1", ProviderInstanceID: "provider-1", ProviderRevision: 2, ModelDescriptorID: "model-1", ModelRevision: 4, DataPolicy: capability.DataPolicyExternalMessageOnly, Qualification: capability.QualificationValidated, Activation: capability.ActivationActive, Health: capability.HealthAvailable, LimitPolicyRef: "limits-1"},
		Provider: capability.ProviderInstance{ID: "provider-1", Revision: 2, Kind: "external-responses-v1", EndpointRef: "endpoint-1", CredentialRef: "credential-1", Enabled: true, Qualification: capability.QualificationValidated, Health: capability.HealthAvailable, ObservedAtUnixMillis: 1},
		Model:    capability.ModelDescriptor{ID: "model-1", Revision: 4, ProviderInstanceID: "provider-1", ProviderModelID: "snapshot-1", Fingerprint: "fingerprint-1", MaxContextBytes: 32768, Modalities: []capability.ModelModality{capability.ModalityText}, Capabilities: []capability.ModelCapability{capability.CapabilityAdvisory}, Qualification: capability.QualificationValidated, Health: capability.HealthAvailable, ObservedAtUnixMillis: 1},
	}
}

func requirement() capability.CognitiveRequirement {
	return capability.CognitiveRequirement{CapabilityID: "creator-advisory", OwnerPrincipalID: "principal-1", DataPolicy: capability.DataPolicyExternalMessageOnly, RequiredModalities: []capability.ModelModality{capability.ModalityText}, RequiredCapabilities: []capability.ModelCapability{capability.CapabilityAdvisory}, InputBytes: 100, MaxOutputBytes: 1000}
}

func TestRegisteredButDisabledProviderCannotBeInvoked(t *testing.T) {
	candidate := validCandidate()
	candidate.Provider.Enabled = false
	if _, err := capabilitydomain.SelectCognitiveBinding(requirement(), []capability.ResolvedCognitiveBinding{candidate}); err == nil {
		t.Fatal("disabled provider was selected")
	}
}

func TestDiscoveredInactiveBindingCannotBeInvoked(t *testing.T) {
	candidate := validCandidate()
	candidate.Binding.Qualification = capability.QualificationDiscovered
	candidate.Binding.Activation = capability.ActivationInactive
	if _, err := capabilitydomain.SelectCognitiveBinding(requirement(), []capability.ResolvedCognitiveBinding{candidate}); err == nil {
		t.Fatal("discovered inactive binding was selected")
	}
}

func TestValidatedActiveBindingCanBeSelected(t *testing.T) {
	selected, err := capabilitydomain.SelectCognitiveBinding(requirement(), []capability.ResolvedCognitiveBinding{validCandidate()})
	if err != nil || selected.Binding.ID != "binding-1" {
		t.Fatalf("selected=%+v err=%v", selected, err)
	}
}

func TestRetiredBindingCannotBeInvoked(t *testing.T) {
	candidate := validCandidate()
	candidate.Binding.Activation = capability.ActivationRetired
	if _, err := capabilitydomain.SelectCognitiveBinding(requirement(), []capability.ResolvedCognitiveBinding{candidate}); err == nil {
		t.Fatal("retired binding was selected")
	}
}

func TestHealthTransitionsChangeEligibility(t *testing.T) {
	for _, state := range []capability.HealthState{capability.HealthUnknown, capability.HealthDegraded, capability.HealthUnavailable} {
		candidate := validCandidate()
		candidate.Binding.Health = state
		if _, err := capabilitydomain.SelectCognitiveBinding(requirement(), []capability.ResolvedCognitiveBinding{candidate}); err == nil {
			t.Fatalf("binding health %s was selected", state)
		}
	}
	if _, err := capabilitydomain.SelectCognitiveBinding(requirement(), []capability.ResolvedCognitiveBinding{validCandidate()}); err != nil {
		t.Fatalf("available binding rejected: %v", err)
	}
}

func TestCreatorWebHasNoConcreteProviderModelOrBindingSelection(t *testing.T) {
	root := filepath.Clean(filepath.Join("..", "..", "cmd", "creator-web"))
	err := filepath.WalkDir(root, func(path string, entry os.DirEntry, err error) error {
		if err != nil || entry.IsDir() || strings.HasSuffix(path, "_test.go") {
			return err
		}
		contents, readErr := os.ReadFile(path)
		if readErr != nil {
			return readErr
		}
		lower := strings.ToLower(string(contents))
		for _, forbidden := range []string{"openai", "ollama", "providerbindingid", "advisory_binding_mode", "gpt-"} {
			if strings.Contains(lower, forbidden) {
				t.Errorf("%s contains concrete selection token %q", path, forbidden)
			}
		}
		return nil
	})
	if err != nil {
		t.Fatal(err)
	}
}

func TestRegistryPersistenceContainsReferencesNotCredentialMaterial(t *testing.T) {
	for _, path := range []string{filepath.Join("..", "..", "database", "migrations", "012_capability_cognitive_registry.sql"), filepath.Join("..", "..", "contracts", "capability", "cognitive_registry.go")} {
		contents, err := os.ReadFile(path)
		if err != nil {
			t.Fatal(err)
		}
		lower := strings.ToLower(string(contents))
		if !strings.Contains(lower, "credentialref") && !strings.Contains(lower, "credential_ref") {
			t.Fatalf("%s lacks credential reference", path)
		}
		for _, forbidden := range []string{"api_key", "access_token", "credential_bytes", "plaintext_password"} {
			if strings.Contains(lower, forbidden) {
				t.Fatalf("%s stores forbidden credential material field %q", path, forbidden)
			}
		}
	}
}

func TestMigrationUsesOnlyCapabilityOwnerRoleAndSchema(t *testing.T) {
	path := filepath.Join("..", "..", "database", "migrations", "012_capability_cognitive_registry.sql")
	contents, err := os.ReadFile(path)
	if err != nil {
		t.Fatal(err)
	}
	lower := strings.ToLower(string(contents))
	if strings.Count(lower, "set role capability_role") != 1 {
		t.Fatal("migration must execute under capability_role")
	}
	for _, schema := range []string{"authority.", "commit.", "continuity.", "identity.", "situation.", "work."} {
		if strings.Contains(lower, schema) {
			t.Fatalf("migration touches foreign owner schema %s", schema)
		}
	}
}

func TestAuthorityAndCommitRemainCognitiveIndependent(t *testing.T) {
	for _, directory := range []string{"authority", "commit"} {
		for _, parent := range []string{"contracts", "modules"} {
			root := filepath.Join("..", "..", parent, directory)
			_ = filepath.WalkDir(root, func(path string, entry os.DirEntry, err error) error {
				if err != nil || entry.IsDir() {
					return err
				}
				contents, readErr := os.ReadFile(path)
				if readErr != nil {
					return readErr
				}
				if strings.Contains(string(contents), "contracts/cognitive") || strings.Contains(string(contents), "cognitive_registry") {
					t.Errorf("%s depends on cognitive registry", path)
				}
				return nil
			})
		}
	}
}