granthi-review v1: estate-wide AI code review service

Webhook-driven central review service for Granthi forges: HMAC-verified push/pull_request webhooks, per-repo serialization with global LLM concurrency 1, shre-router powered rubric review (8 axes, strict JSON, tolerant extractor + retry), commit statuses + PR scorecard comments, sqlite attribution ledger with Co-Authored-By trailer parsing, per-repo HTML history dashboard, nightly per-agent digests, fail-open-with- visibility when the router is unavailable. Posture: BLOCK on confirmed critical/high correctness+security findings; admin merge is the human override. Co-Authored-By: Claude Fable 5 <[email protected]>
2026-08-18 23:24:27 -04:00
commit 9ffd810943
22 changed files with 1255 additions and 0 deletions
@@ -0,0 +1,80 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { deriveVerdict, isBlockingFinding, normalizeReview } from '../src/lib/verdict.js';
+
+const F = (over = {}) => ({
+  title: 't', file: 'f.js', line: 1,
+  severity: 'low', confidence: 'plausible', axis: 'style', detail: 'd', ...over
+});
+
+test('confirmed critical correctness blocks', () => {
+  assert.equal(isBlockingFinding(F({ severity: 'critical', confidence: 'confirmed', axis: 'correctness' })), true);
+});
+
+test('confirmed high security blocks', () => {
+  assert.equal(isBlockingFinding(F({ severity: 'high', confidence: 'confirmed', axis: 'security' })), true);
+});
+
+test('plausible critical does NOT block', () => {
+  assert.equal(isBlockingFinding(F({ severity: 'critical', confidence: 'plausible', axis: 'correctness' })), false);
+});
+
+test('confirmed critical style does NOT block', () => {
+  assert.equal(isBlockingFinding(F({ severity: 'critical', confidence: 'confirmed', axis: 'style' })), false);
+});
+
+test('confirmed medium does NOT block', () => {
+  assert.equal(isBlockingFinding(F({ severity: 'medium', confidence: 'confirmed', axis: 'security' })), false);
+});
+
+test('untagged axis + confirmed critical blocks (conservative)', () => {
+  assert.equal(isBlockingFinding(F({ severity: 'critical', confidence: 'confirmed', axis: null })), true);
+});
+
+test('verdict fail on blocking finding', () => {
+  const v = deriveVerdict({ findings: [F({ severity: 'high', confidence: 'confirmed', axis: 'correctness' })] });
+  assert.equal(v, 'fail');
+});
+
+test('verdict warn on plausible high', () => {
+  const v = deriveVerdict({ findings: [F({ severity: 'high', confidence: 'plausible', axis: 'correctness' })] });
+  assert.equal(v, 'warn');
+});
+
+test('verdict warn on confirmed medium', () => {
+  const v = deriveVerdict({ findings: [F({ severity: 'medium', confidence: 'confirmed', axis: 'security' })] });
+  assert.equal(v, 'warn');
+});
+
+test('verdict pass with only low findings', () => {
+  const v = deriveVerdict({ findings: [F({ severity: 'low' })] });
+  assert.equal(v, 'pass');
+});
+
+test('verdict pass with no findings', () => {
+  assert.equal(deriveVerdict({ findings: [] }), 'pass');
+  assert.equal(deriveVerdict({}), 'pass');
+});
+
+test('normalizeReview clamps scores and overrides model verdict', () => {
+  const r = normalizeReview({
+    axes: { correctness: { score: 250, rationale: 'x' } },
+    overall: -5, grade: 'z',
+    findings: [{ title: 'boom', severity: 'CRITICAL', confidence: 'Confirmed', axis: 'Correctness', file: 'a.js', line: '7' }],
+    verdict: 'pass' // model says pass, but blocking finding exists
+  });
+  assert.equal(r.axes.correctness.score, 100);
+  assert.equal(r.axes.security.score, 0); // missing axis defaults
+  assert.equal(r.overall, 0);
+  assert.equal(r.grade, 'C');
+  assert.equal(r.findings[0].severity, 'critical');
+  assert.equal(r.findings[0].line, 7);
+  assert.equal(r.verdict, 'fail'); // service-side derivation is authoritative
+});
+
+test('normalizeReview tolerates junk', () => {
+  assert.equal(normalizeReview(null), null);
+  const r = normalizeReview({});
+  assert.equal(r.verdict, 'pass');
+  assert.equal(r.findings.length, 0);
+});