granthi-review v1: estate-wide AI code review service

Webhook-driven central review service for Granthi forges: HMAC-verified push/pull_request webhooks, per-repo serialization with global LLM concurrency 1, shre-router powered rubric review (8 axes, strict JSON, tolerant extractor + retry), commit statuses + PR scorecard comments, sqlite attribution ledger with Co-Authored-By trailer parsing, per-repo HTML history dashboard, nightly per-agent digests, fail-open-with- visibility when the router is unavailable. Posture: BLOCK on confirmed critical/high correctness+security findings; admin merge is the human override. Co-Authored-By: Claude Fable 5 <[email protected]>
2026-08-18 23:24:27 -04:00
commit 9ffd810943
22 changed files with 1255 additions and 0 deletions
@@ -0,0 +1,55 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { extractJson } from '../src/lib/jsonExtract.js';
+
+test('parses bare JSON', () => {
+  assert.deepEqual(extractJson('{"a":1}'), { a: 1 });
+});
+
+test('parses fenced json block', () => {
+  const out = extractJson('Here is the review:\n```json\n{"verdict":"pass"}\n```\nDone.');
+  assert.deepEqual(out, { verdict: 'pass' });
+});
+
+test('parses fenced block without language tag', () => {
+  assert.deepEqual(extractJson('```\n{"x": [1,2]}\n```'), { x: [1, 2] });
+});
+
+test('parses object embedded in prose', () => {
+  const out = extractJson('Sure! The result is {"grade":"B","overall":82} as requested.');
+  assert.deepEqual(out, { grade: 'B', overall: 82 });
+});
+
+test('handles braces inside strings', () => {
+  const out = extractJson('prefix {"detail":"if (x) { return; }","n":2} suffix');
+  assert.deepEqual(out, { detail: 'if (x) { return; }', n: 2 });
+});
+
+test('handles escaped quotes inside strings', () => {
+  const out = extractJson('{"t":"she said \\"hi\\" {ok}"}');
+  assert.deepEqual(out, { t: 'she said "hi" {ok}' });
+});
+
+test('strips think blocks', () => {
+  const out = extractJson('<think>{"draft":true} reasoning</think>{"final":true}');
+  assert.deepEqual(out, { final: true });
+});
+
+test('repairs trailing commas', () => {
+  assert.deepEqual(extractJson('{"a":1,"b":[1,2,],}'), { a: 1, b: [1, 2] });
+});
+
+test('skips broken object and finds later valid one', () => {
+  const out = extractJson('{"broken": nope} then {"ok":1}');
+  assert.deepEqual(out, { ok: 1 });
+});
+
+test('returns null for no JSON', () => {
+  assert.equal(extractJson('no json here'), null);
+  assert.equal(extractJson(''), null);
+  assert.equal(extractJson(null), null);
+});
+
+test('returns null for top-level array', () => {
+  assert.equal(extractJson('[1,2,3]'), null);
+});
@@ -0,0 +1,42 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { parseTrailers, agentSlug } from '../src/lib/trailers.js';
+
+test('parses standard Co-Authored-By trailer', () => {
+  const msg = 'fix: thing\n\nCo-Authored-By: Claude Fable 5 <[email protected]>';
+  assert.deepEqual(parseTrailers(msg), [{ name: 'Claude Fable 5', email: '[email protected]' }]);
+});
+
+test('case-insensitive and tolerant spacing', () => {
+  const msg = 'x\nco-authored-by:  Codex Bot   <[email protected]> ';
+  assert.deepEqual(parseTrailers(msg), [{ name: 'Codex Bot', email: '[email protected]' }]);
+});
+
+test('multiple distinct trailers', () => {
+  const msg = 'x\nCo-Authored-By: A <[email protected]>\nCo-Authored-By: B <[email protected]>';
+  assert.equal(parseTrailers(msg).length, 2);
+});
+
+test('dedupes identical trailers', () => {
+  const msg = 'x\nCo-Authored-By: A <[email protected]>\nCo-authored-by: A <[email protected]>';
+  assert.equal(parseTrailers(msg).length, 1);
+});
+
+test('trailer without email', () => {
+  const msg = 'x\nCo-Authored-By: Mystery Agent';
+  assert.deepEqual(parseTrailers(msg), [{ name: 'Mystery Agent', email: '' }]);
+});
+
+test('ignores non-trailer lines', () => {
+  assert.deepEqual(parseTrailers('Co-Authored-By appears in prose but not as trailer: nope\nplain line'), []);
+  assert.deepEqual(parseTrailers(''), []);
+  assert.deepEqual(parseTrailers(null), []);
+});
+
+test('agentSlug from email localpart', () => {
+  assert.equal(agentSlug({ name: 'Claude Fable 5', email: '[email protected]' }), 'noreply');
+});
+
+test('agentSlug from name when no email', () => {
+  assert.equal(agentSlug({ name: 'My Agent!', email: '' }), 'my-agent');
+});
@@ -0,0 +1,80 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { deriveVerdict, isBlockingFinding, normalizeReview } from '../src/lib/verdict.js';
+
+const F = (over = {}) => ({
+  title: 't', file: 'f.js', line: 1,
+  severity: 'low', confidence: 'plausible', axis: 'style', detail: 'd', ...over
+});
+
+test('confirmed critical correctness blocks', () => {
+  assert.equal(isBlockingFinding(F({ severity: 'critical', confidence: 'confirmed', axis: 'correctness' })), true);
+});
+
+test('confirmed high security blocks', () => {
+  assert.equal(isBlockingFinding(F({ severity: 'high', confidence: 'confirmed', axis: 'security' })), true);
+});
+
+test('plausible critical does NOT block', () => {
+  assert.equal(isBlockingFinding(F({ severity: 'critical', confidence: 'plausible', axis: 'correctness' })), false);
+});
+
+test('confirmed critical style does NOT block', () => {
+  assert.equal(isBlockingFinding(F({ severity: 'critical', confidence: 'confirmed', axis: 'style' })), false);
+});
+
+test('confirmed medium does NOT block', () => {
+  assert.equal(isBlockingFinding(F({ severity: 'medium', confidence: 'confirmed', axis: 'security' })), false);
+});
+
+test('untagged axis + confirmed critical blocks (conservative)', () => {
+  assert.equal(isBlockingFinding(F({ severity: 'critical', confidence: 'confirmed', axis: null })), true);
+});
+
+test('verdict fail on blocking finding', () => {
+  const v = deriveVerdict({ findings: [F({ severity: 'high', confidence: 'confirmed', axis: 'correctness' })] });
+  assert.equal(v, 'fail');
+});
+
+test('verdict warn on plausible high', () => {
+  const v = deriveVerdict({ findings: [F({ severity: 'high', confidence: 'plausible', axis: 'correctness' })] });
+  assert.equal(v, 'warn');
+});
+
+test('verdict warn on confirmed medium', () => {
+  const v = deriveVerdict({ findings: [F({ severity: 'medium', confidence: 'confirmed', axis: 'security' })] });
+  assert.equal(v, 'warn');
+});
+
+test('verdict pass with only low findings', () => {
+  const v = deriveVerdict({ findings: [F({ severity: 'low' })] });
+  assert.equal(v, 'pass');
+});
+
+test('verdict pass with no findings', () => {
+  assert.equal(deriveVerdict({ findings: [] }), 'pass');
+  assert.equal(deriveVerdict({}), 'pass');
+});
+
+test('normalizeReview clamps scores and overrides model verdict', () => {
+  const r = normalizeReview({
+    axes: { correctness: { score: 250, rationale: 'x' } },
+    overall: -5, grade: 'z',
+    findings: [{ title: 'boom', severity: 'CRITICAL', confidence: 'Confirmed', axis: 'Correctness', file: 'a.js', line: '7' }],
+    verdict: 'pass' // model says pass, but blocking finding exists
+  });
+  assert.equal(r.axes.correctness.score, 100);
+  assert.equal(r.axes.security.score, 0); // missing axis defaults
+  assert.equal(r.overall, 0);
+  assert.equal(r.grade, 'C');
+  assert.equal(r.findings[0].severity, 'critical');
+  assert.equal(r.findings[0].line, 7);
+  assert.equal(r.verdict, 'fail'); // service-side derivation is authoritative
+});
+
+test('normalizeReview tolerates junk', () => {
+  assert.equal(normalizeReview(null), null);
+  const r = normalizeReview({});
+  assert.equal(r.verdict, 'pass');
+  assert.equal(r.findings.length, 0);
+});