[formal-spec] intent-attribution-agent-governance.md — Formal model & test suite — 2026-10-21 #70909

// Formal tests for specs/intent-attribution-agent-governance.md
// Predicates: Inv_Escalation, Inv_NoEarlyEscalation, Inv_Waiver, Inv_IssueContent,
// Inv_DriftSymmetric, Inv_UnknownNotZero, Inv_NoStale, Inv_Provenance, Inv_ObjectiveCount.
package intent_test

import (
	"sort"
	"testing"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

// stub — replace with real implementation
type syncWarning struct {
	Keys         []string
	FirstSeen    string
	Consecutive  int
	Waived       bool
	CorrectivePR bool
}

// stub — replace with real implementation
type escalation struct {
	Escalated bool
	ExitCode  int
	Keys      []string
	FirstSeen string
	Assignee  string
}

// stub — replace with real implementation
func evaluateEscalation(w syncWarning, onCall string) escalation {
	if w.Consecutive >= 3 && !w.Waived && !w.CorrectivePR {
		return escalation{true, 1, w.Keys, w.FirstSeen, onCall}
	}
	return escalation{}
}

// stub — replace with real implementation
func drift(a, b []string) []string {
	in := func(s []string, k string) bool {
		for _, x := range s {
			if x == k {
				return true
			}
		}
		return false
	}
	var out []string
	for _, k := range a {
		if !in(b, k) {
			out = append(out, k)
		}
	}
	for _, k := range b {
		if !in(a, k) {
			out = append(out, k)
		}
	}
	sort.Strings(out)
	return out
}

// stub — replace with real implementation
type attribution struct {
	Status string
	Weight *float64
}

// stub — replace with real implementation
type policy struct {
	Autonomy      string
	WriteScope    string
	HumanApproval bool
	AutoMerge     bool
	MaxAttempts   int
	Reason        string
}

// stub — replace with real implementation
func resolvePolicy(inputsOK bool, cached *policy) policy {
	if inputsOK && cached != nil {
		return *cached
	}
	return policy{"propose_only", "none", true, false, 1, "policy inputs unresolved"}
}

// stub — replace with real implementation
func objectiveCount(prRoots []string) int {
	seen := map[string]bool{}
	for _, r := range prRoots {
		seen[r] = true
	}
	return len(seen)
}

func TestEscalationThreshold(t *testing.T) {
	tests := []struct {
		name string
		runs int
		want bool
	}{
		{"zero runs", 0, false},
		{"two runs", 2, false},
		{"exactly three runs", 3, true},
		{"many runs", 10, true},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			e := evaluateEscalation(syncWarning{Keys: []string{"p0"}, Consecutive: tt.runs}, "oncall")
			assert.Equal(t, tt.want, e.Escalated, "escalation must occur iff 3+ consecutive runs")
			if tt.want {
				assert.NotEqual(t, 0, e.ExitCode, "escalated check must exit non-zero")
			} else {
				assert.Equal(t, 0, e.ExitCode, "non-escalated check must exit zero")
			}
		})
	}
}

func TestEscalationSuppressedByWaiverOrPR(t *testing.T) {
	for name, w := range map[string]syncWarning{
		"waiver":        {Keys: []string{"k"}, Consecutive: 5, Waived: true},
		"corrective PR": {Keys: []string{"k"}, Consecutive: 5, CorrectivePR: true},
	} {
		e := evaluateEscalation(w, "oncall")
		assert.False(t, e.Escalated, "%s must suppress escalation", name)
	}
}

func TestEscalationTrackingIssueContent(t *testing.T) {
	e := evaluateEscalation(syncWarning{Keys: []string{"p0", "security"}, FirstSeen: "2026-10-01", Consecutive: 3}, "alice")
	require.True(t, e.Escalated, "warning with 3 runs must escalate")
	assert.Equal(t, []string{"p0", "security"}, e.Keys, "issue must record affected keys")
	assert.Equal(t, "2026-10-01", e.FirstSeen, "issue must record first-detected date")
	assert.Equal(t, "alice", e.Assignee, "on-call maintainer must be default assignee")
}

func TestDriftDetectionSymmetric(t *testing.T) {
	a := []string{"critical", "p0"}
	b := []string{"p0", "docs"}
	assert.Equal(t, []string{"critical", "docs"}, drift(a, b), "keys in only one source must be reported")
	assert.Equal(t, drift(a, b), drift(b, a), "drift must be symmetric")
	assert.Empty(t, drift(a, a), "identical sources must have no drift")
	assert.Empty(t, drift(nil, nil), "empty sources must have no drift")
}

func TestUnknownIsNotZero(t *testing.T) {
	unlinked := attribution{Status: "unlinked"}
	zero := 0.0
	explicit := attribution{Status: "mapped", Weight: &zero}
	assert.Nil(t, unlinked.Weight, "unlinked weight must be null, not zero")
	require.NotNil(t, explicit.Weight, "explicit zero must be a non-nil value")
	assert.Equal(t, 0.0, *explicit.Weight, "explicit zero must remain zero")
}

func TestNoStaleCacheReuse(t *testing.T) {
	cached := policy{"autonomous", "repo", false, true, 5, ""}
	got := resolvePolicy(false, &cached)
	assert.NotEqual(t, cached, got, "stale cached policy must not be reused")
	assert.Equal(t, "propose_only", got.Autonomy, "autonomy must be propose_only")
	assert.Equal(t, "none", got.WriteScope, "write scope must be none")
	assert.True(t, got.HumanApproval, "human approval must be required")
	assert.False(t, got.AutoMerge, "auto merge must be prohibited")
	assert.Equal(t, 1, got.MaxAttempts, "max attempts must be 1")
	assert.NotEmpty(t, got.Reason, "failure reason must be recorded in provenance")
}

func TestArtifactsAreNotObjectives(t *testing.T) {
	assert.Equal(t, 1, objectiveCount([]string{"#1", "#1", "#1"}), "multiple PRs on one issue are one objective")
	assert.Equal(t, 2, objectiveCount([]string{"#1", "#2", "#1"}), "distinct issues are distinct objectives")
	assert.Equal(t, 0, objectiveCount(nil), "no PRs means no objectives")
}