AILang/crates/ailang-core/tests/design_index_pin.rs

//! Structural pin for the design/ ledger. Sibling of
//! docs_honesty_pin.rs. Fails RED the instant the design/ split
//! re-conflates contract + rationale + narrative, an INDEX row
//! dangles, a contract loses its ratifying test, or docs/DESIGN.md
//! is resurrected. Spec: docs/specs/2026-05-19-design-md-rolesplit.md.

use std::fs;
use std::path::PathBuf;

fn root() -> PathBuf {
    PathBuf::from(concat!(env!("CARGO_MANIFEST_DIR"), "/../../"))
}

fn read(rel: &str) -> String {
    fs::read_to_string(root().join(rel))
        .unwrap_or_else(|e| panic!("read {rel}: {e}"))
}

fn norm(s: &str) -> String {
    s.split_whitespace().collect::<Vec<_>>().join(" ")
}

/// Parse the two pipe-tables out of design/INDEX.md.
/// Returns (contracts, models) as rows of trimmed cells.
fn index_tables() -> (Vec<Vec<String>>, Vec<Vec<String>>) {
    let idx = read("design/INDEX.md");
    let mut contracts = Vec::new();
    let mut models = Vec::new();
    let mut section = "";
    for line in idx.lines() {
        let t = line.trim();
        if t.starts_with("## Contracts") {
            section = "c";
            continue;
        }
        if t.starts_with("## Models") {
            section = "m";
            continue;
        }
        if !t.starts_with('|') {
            continue;
        }
        let cells: Vec<String> = t
            .trim_matches('|')
            .split('|')
            .map(|c| c.trim().to_string())
            .collect();
        // skip header + separator rows
        if cells.iter().any(|c| c.starts_with("---")) {
            continue;
        }
        if cells.first().map(|c| c.as_str()) == Some("id") {
            continue;
        }
        match section {
            "c" => contracts.push(cells),
            "m" => models.push(cells),
            _ => {}
        }
    }
    (contracts, models)
}

/// A link cell may be a design/ path, a source path, a dual-link
/// "A + B", or carry a trailing "(in-source ...)" / "§..." note.
/// Resolve to the first concrete path token and check it exists.
fn link_target_exists(cell: &str) -> bool {
    let first = cell.split(" + ").next().unwrap_or(cell).trim();
    // strip a trailing parenthetical or §-note
    let path = first
        .split(" (")
        .next()
        .unwrap_or(first)
        .split(" §")
        .next()
        .unwrap_or(first)
        .trim()
        .trim_end_matches("//!")
        .trim();
    !path.is_empty() && root().join(path).exists()
}

#[test]
fn design_md_is_gone() {
    // clause 4 — clean-cut pin
    assert!(
        !root().join("docs/DESIGN.md").exists(),
        "docs/DESIGN.md was resurrected; the split is clean-cut"
    );
}

#[test]
fn every_index_link_resolves() {
    // clause 1
    let (contracts, models) = index_tables();
    assert!(contracts.len() >= 15, "expected >=15 contract rows, got {}", contracts.len());
    assert!(models.len() >= 5, "expected >=5 model rows, got {}", models.len());
    for row in contracts.iter().chain(models.iter()) {
        let link = row.last().expect("row has a link cell");
        assert!(
            link_target_exists(link),
            "INDEX link does not resolve: {:?} (row {:?})",
            link,
            row
        );
    }
}

#[test]
fn every_contract_names_a_resolvable_ratifying_test() {
    // clause 2 — ratifying-test token resolves to a real file under
    // crates/**/tests, crates/**/src (in-source #[cfg(test)] mod
    // tests are first-class ratifiers — spec OQ1/OQ2), bench/, or
    // skills/**/SKILL.md.
    let (contracts, _) = index_tables();
    for row in &contracts {
        // columns: id | consumer/lifetime | ratifying-test | link
        let rt = &row[2];
        // take the path token (before any " (" note)
        let path = rt.split(" (").next().unwrap_or(rt).trim();
        assert!(
            root().join(path).exists(),
            "ratifying-test does not resolve to a real file: {:?} (contract {:?})",
            path,
            row[0]
        );
    }
}

#[test]
fn contracts_carry_no_decision_record_prose() {
    // clause 3 — the conflation tripwire, widened (design-md-rolesplit.tidy,
    // audit Resolution-4) to a FAITHFUL SUPERSET of
    // bench/architect_sweeps.sh Sweep-1's history-anchor regex over the
    // design/contracts/ scope, PLUS the audit-named decision-record
    // phrases (the deliberate widening that closes the case-variance
    // dodge the 6 literal markers left open).
    //
    // Invariant: clause-3 GREEN ⟹ Sweep-1 finds nothing in design/contracts/.
    //
    // Sweep-1 = 'Iter [0-9]+[a-z]?(\.[0-9]+)?|Family [0-9]+
    //           |^[^/]*2026-[0-9]{2}-[0-9]{2}|\*\*Status: |pre-[0-9]+[a-z]?
    //           |[0-9]+[a-z]? sketch|21\.g'
    // Faithfulness, per Sweep-1 alternative:
    //   - Iter / Family / pre- / <n> sketch / 21.g / **Status:
    //       → sweep1_line_anchor() reproduces each verbatim,
    //         case-SENSITIVE (grep -E, no -i) — exactly Sweep-1 here,
    //         never narrower.
    //   - ^[^/]*2026-NN-NN  → date_anchor() reproduces Sweep-1's
    //         ^[^/]* PATH-EXCLUSION (only the line prefix before the
    //         first '/' is scanned) and generalises 2026→20NN
    //         (⊇ Sweep-1, never narrower). A `docs/specs/2026-..`
    //         citation has '/' before the date ⇒ NOT flagged — faithful
    //         to Sweep-1, no over-fire on legit present-tense spec
    //         cross-refs (the iter-.1 plan defect this repairs).
    //   - PHRASES: literal decision-record idioms (case-insensitive) —
    //         the deliberate widening that closes the capital-variance
    //         dodge ("An earlier draft" vs "an earlier draft").
    //
    // A blanket case-insensitive iter/milestone detector was evaluated
    // and REJECTED (audit Resolution-4 corrected): it conflates the
    // memory-model rule-names "Iter A"/"Iter B", and ordinary words
    // "pre-existing"/"pre-set"/"pre-Boehm"/"pre-tail-call", with
    // provenance stamps — unworkable. faithful-Sweep-1 (the capital-I,
    // digit-anchored form) already excludes those by construction and
    // is confirmed ZERO across every contract file; lowercase
    // `(iter <code>)` provenance is removed by the strip tasks, not by
    // a fragile hard-gate regex. The load-bearing invariant
    // (clause-3 GREEN ⟹ Sweep-1 clean in contracts/) holds with
    // sweep1_line_anchor + date_anchor + PHRASES alone.
    let dir = root().join("design/contracts");

    const PHRASES: &[&str] = &[
        "we rejected", "an earlier draft", "earlier draft committed",
        "why not other", "was retired", "were retired", "rollback plan",
        "previously all", "deliberately deferred", "new-baseline decision",
        "amends the above", "out of scope per",
        "the journal records when", "unchanged from the original draft",
    ];

    // Sweep-1's non-date alternatives, hand-rolled verbatim, case-SENSITIVE
    // (grep -E without -i), on the raw physical line.
    fn sweep1_line_anchor(line: &str) -> Option<&'static str> {
        let kw_digit = |kw: &str| -> bool {
            let mut from = 0;
            while let Some(i) = line[from..].find(kw) {
                let p = from + i + kw.len();
                if line[p..].chars().next().map_or(false, |c| c.is_ascii_digit()) {
                    return true;
                }
                from = p;
            }
            false
        };
        if kw_digit("Iter ") { return Some("Iter <n>"); }
        if kw_digit("Family ") { return Some("Family <n>"); }
        if kw_digit("pre-") { return Some("pre-<n>"); }
        if line.contains("**Status: ") { return Some("**Status:"); }
        if line.contains("21.g") { return Some("21.g"); }
        if let Some(s) = line.find(" sketch") {
            let pre = line[..s].as_bytes();
            if pre.last().map_or(false, u8::is_ascii_alphanumeric)
                && pre.iter().rev()
                      .take_while(|c| c.is_ascii_alphanumeric())
                      .any(u8::is_ascii_digit)
            {
                return Some("<n> sketch");
            }
        }
        None
    }

    // Sweep-1's `^[^/]*2026-NN-NN`, generalised to 20NN-NN-NN,
    // PATH-EXCLUDED: scan only the line prefix BEFORE the first '/'.
    fn date_anchor(line: &str) -> Option<String> {
        let prefix = line.split('/').next().unwrap_or(line).as_bytes();
        for w in prefix.windows(10) {
            if w[0] == b'2' && w[1] == b'0'
                && w[2].is_ascii_digit() && w[3].is_ascii_digit()
                && w[4] == b'-' && w[5].is_ascii_digit() && w[6].is_ascii_digit()
                && w[7] == b'-' && w[8].is_ascii_digit() && w[9].is_ascii_digit()
            {
                return Some(String::from_utf8_lossy(w).into_owned());
            }
        }
        None
    }

    for entry in fs::read_dir(&dir).expect("design/contracts/ exists") {
        let p = entry.unwrap().path();
        if p.extension().and_then(|e| e.to_str()) != Some("md") {
            continue;
        }
        let raw = fs::read_to_string(&p).unwrap();
        let fname = p.file_name().unwrap().to_string_lossy().into_owned();
        let low = norm(&raw).to_lowercase();
        for ph in PHRASES {
            assert!(
                !low.contains(ph),
                "clause-3: history phrase {ph:?} in contract {fname:?}"
            );
        }
        for line in raw.lines() {
            if let Some(a) = sweep1_line_anchor(line) {
                panic!("clause-3: Sweep-1 anchor {a:?} in contract {fname:?}: {line:?}");
            }
            if let Some(d) = date_anchor(line) {
                panic!("clause-3: history date {d:?} in contract {fname:?}: {line:?}");
            }
        }
    }
}