Documentation
¶
Overview ¶
Package integration holds AUR-424's Integration-layer proof: the Go extractor is registered into a real internal/documentation/extractors registry -- exactly the mechanism cmd/regenerate-docs/main.go's registerLanguageExtractors uses -- and, resolved back out of that registry, documents the card's own checked-in fixture at tests/fixtures/docs/goproject, twice, byte-for-byte identically.
Not named "_test.go" for the same reason as tests/unit/AUR-424.go: see that file's package comment. tests/acceptance/AUR-424.sh bridges IntegrationAUR424 into a real `go test` run inside the sandbox.
AUR-425 integration selector: the zero-page verdict integrated with the configuration knobs main derives from the environment (AURUMCODE_LANGUAGES) and with the extraction pipeline that decides what a run documents.
Two scenarios bound the behaviour from both sides:
- A project WITH a supported Go file, run under a language filter that excludes it, produces zero pages: the run must exit 1 and the reason must name the filter, because the "why" the card demands is different here from the plain no-supported-files case.
- The same project WITHOUT the filter documents the Go file and exits 0: the fix is specific to the zero-page outcome and must not degrade a working run into a failure.
Like the unit selector, this drives the real binary: the promised contract is a raw process exit status, and the card's MUT-001 is only falsifiable at that boundary. This is a plain (non-_test) source in package integration; the acceptance stages it next to a generated bridge _test file.
Package integration holds AUR-426's Integration-layer proof: `--languages` is a real filter over the same internal/pipeline extractor registry cmd/regenerate-docs drives, not a flag that parses but does nothing, and a mixed-language source tree produces the honest partial-run outcome the pipeline itself reports (one page generated, one language skipped because its external tool is not installed in this offline environment) instead of silently reporting either a false-clean success or a false-total failure.
Package integration holds AUR-427's Integration-layer proof: the native Rust and C# extractors are registered into a real internal/documentation/extractors.Registry -- exactly the mechanism cmd/regenerate-docs/main.go's registerLanguageExtractors uses -- and, resolved back out of that registry, document the card's own checked-in Rust fixture at tests/fixtures/docs/rustproject twice, byte-for-byte identically, plus an in-memory C# fixture (this card's `paths` grants a checked-in fixture directory for Rust only; see docs/specs/AUR-427.md).
Not named "_test.go" for the same reason as tests/unit/AUR-427.go: see that file's package comment. tests/acceptance/AUR-427.sh bridges IntegrationAUR427 into a real `go test` run inside the sandbox.
Package integration holds AUR-428's Integration-layer proof: the example workflow, the repository's root action.yml, go.mod and the LICENSE agree with each other. The Unit layer proves the workflow document alone is sound; this layer proves the cross-artifact contract the user's copy depends on:
- the `uses:` reference points at THIS repository (the owner/repo derived from go.mod's module path), by a publishable semver tag;
- every `with:` key the workflow passes is an input action.yml actually declares, so the copied file drives capabilities the repository really offers;
- the action is the composite the workflow expects, and it declares the `publish` input the example sets to `pages`;
- LICENSE exists with a real grant -- the artifact that makes the semver tag publishable and the action legally consumable from a copied workflow.
Scope per the card's "Restricao medida": the sandbox has no network, so this is STATIC verification via real YAML parses, never a live GitHub call. Publishing the `v1` tag itself is a human action documented in docs/specs/AUR-428.md.
Not named "_test.go" on purpose (same technique as every sibling card): tests/acceptance/AUR-428.sh stages a private copy and bridges this function into `go test`.
AUR-429 integration selector: the whole chain the card promises, across the real package boundaries — cmd/regenerate-docs builds the documentation for tests/fixtures/docs/goproject, sitepublish renders the markdown as the HTML tree a static host serves, and browserproof.VerifyDocs opens the home page, follows a link of the index and confirms the expected content, offline, through the scripted driver.
The negative scenarios break the GENERATED MARKDOWN, never the verifier:
- stripping the documented symbol from the symbol page must flip the verdict to a refusal (BROWSERPROOF_TEXT_MISMATCH) — MUT-001's shape; a run that stays proved prints AUR-429/AC-001/MUT-001 and fails;
- stripping the index links must flip it to BROWSERPROOF_UNREACHABLE_ROUTE.
Both breaks also prove the publisher invents nothing: a publisher that synthesised an index link or page content would keep the verdict green.
This is a plain (non-_test) source in package integration; the acceptance stages it into a private module next to a generated bridge _test file, mirroring AUR-424/AUR-425/AUR-428.
Package integration holds AUR-440's Integration-layer proof: the example workflow, the repository's root action.yml and go.mod agree with each other. The Unit layer proves the workflow document alone is sound; this layer proves the cross-artifact contract the user's copy depends on:
- the release checkout points at THIS repository (the owner/repo derived from go.mod's module path), by a publishable semver tag, so the review binary the job builds is the one this repository ships;
- the workflow never delegates to the root composite action: action.yml, parsed for real, is the documentation generator -- it declares no input that could name a pull request or ask for a review, so a step using it would produce a green check for a review that never ran;
- the Go toolchain the workflow installs can build this module: the setup-go version satisfies go.mod's `go` directive, and the build step compiles `./cmd/aurumcode` out of the release checkout's path;
- the secrets reach the binary only through the secrets context, and the publication authenticates with the Action's own token.
Scope per the card's Preconditions: the sandbox has no network, so this is STATIC verification via real YAML parses, never a live GitHub call. Publishing the `v1` tag itself is a human action documented in docs/specs/AUR-440.md.
Not named "_test.go" on purpose (same technique as every sibling card): tests/acceptance/AUR-440.sh stages a private copy and bridges this function into `go test`.
Selector naming note, the same technique tests/integration/AUR-445.go documents: a function named IntegrationAUR435 already exists in this package (tests/integration/AUR-435.go) and would collide, so this proof is IntegrationAUR442 even though the card text's TDD proof section names IntegrationAUR435 (a copy-paste artifact from the AUR-435 card this one was drafted against).
Package integration holds AUR-443's Integration-layer proof: the cleaned-up git-repository/ref-resolution error message is not just a hand-picked string match against the pure-Go backend -- it is the SAME text internal/analyzer's two independent backends (the pure-Go loose-object reader used when no `git` binary is on PATH, and the git-binary-shelling-out reader used when one is) produce for the exact same user mistake, proving cmd/aurumcode/main.go's cleanRefError normalizes both instead of only ever being exercised against one.
This mirrors internal/analyzer's own package doc (gitrepo.go: "Both paths return the same information through the same Repo methods") one level up: this card's promise is that the TWO backends now also agree on what an unresolvable ref is reported as.
Package integration holds AUR-444's Integration-layer proof: the cross-artifact contract between scripts/action-entrypoint.sh, Dockerfile and action.yml -- the three files the card's Outcome spans -- agree with each other, and none of the three falsehoods the card measured survives in the file that carried it.
Criterion (b): the Dockerfile actually compiles and copies cmd/aurumcode, AND the binary path it copies to is the exact path scripts/action-entrypoint.sh resolves AURUMCODE_CLI to by default. Checked jointly, not independently: independently, the image could ship /app/aurumcode while the script still invoked /app/cli and both checks would pass, which is the same class of defect this card exists to close only moved one file over.
Criterion (c): none of the three false claims the card's "Achado medido" names survives, checked as absence of the ORIGINAL exact wording (so a revert is caught) AND presence of a corrected replacement (so a fix that only deletes the comment, without saying anything true, is also caught). gomarkdoc is checked in both files it appeared in (Dockerfile and action.yml), not only the one the card cites a line number for.
Anchors are long, specific literal substrings on purpose -- the AUR-440 lesson (a bare 'v1' matches inside "bootstrap-readonly-v1") applies here exactly as much as it did there.
Criterion (a), against the REAL binary: AUR-444's read_paths now carries cmd/aurumcode's full compile closure, so this layer also builds cmd/aurumcode for real (`go build ./cmd/aurumcode`) and confronts the entrypoint's actual argv against that binary's own `review --help` output -- see aur444RequireRealBinaryAcceptsEntrypointFlags below. This is independent of, and does not replace, tests/unit/AUR-444.go's go/parser proof of the same criterion from source text.
Package integration holds AUR-445's Integration-layer proof: the true statements the Unit layer requires the root documentation to carry (tests/unit/AUR-445.go) actually have lastro in the source this repository ships, read directly -- never by grepping the documentation against itself.
- LICENSE exists and its first line is a real MIT grant.
- Both cmd/aurumcode and cmd/regenerate-docs are `package main`: the repository really does build two commands, not one.
- internal/documentation/extractors/go/extractor.go names no external tool: it never mentions "gomarkdoc" and never imports "os/exec".
- Every `aurumcode review` flag the corrected documentation names (--base, --fail-on, --modelo, --seguranca, --limite, --pr, --repo, --publicar, --na-linha) is actually registered in cmd/aurumcode/main.go.
The CHANGELOG.md claim that --seguranca's deterministic pass matches only 2 of the 8 catalog rules (internal/review/rules/security.yml) was verified by direct inspection during this card's build (see docs/specs/AUR-445.md); that file is intentionally NOT re-verified here, because it is outside this card's declared read_paths and the acceptance sandbox never materializes it -- an integration check against it would fail with a spurious entrypoint_missing instead of a real behavior result.
Scope, same as every sibling card in this office: the sandbox has no network and this card never executes `aurumcode` or `regenerate-docs`; every check here is a static read of source files already materialized by paths/read_paths.
Not named "_test.go" on purpose, same technique as tests/unit/AUR-445.go.
Selector naming note: see tests/unit/AUR-445.go's header. This file uses IntegrationAUR445 instead of the card text's IntegrationAUR428, which already exists in this package's tests/integration/AUR-428.go and would collide.
AUR-446 integration selector: the anchor checker from tests/unit/AUR-446.go proved correct on synthetic fixtures; this layer runs the SAME logic against the REAL corrected files on disk, and additionally corroborates the underlying facts those corrections state against the real sources this card's read_paths materializes (cmd/aurumcode, .github/workflows/examples/code-review.yml) -- not just that the prose says something, but that the thing it says is grounded.
docs/specs/AUR-428.md is checked like every other corrected spec below. It was originally out of scope (the card's paths duplicated docs/specs/AUR-446.md instead of listing AUR-428.md); the coordinator amended the frontmatter (see docs/specs/AUR-446.md, "Sexto achado"), so it is now a declared deliverable of this card like the other five.
Not named "_test.go" on purpose (same technique as every sibling card): tests/acceptance/AUR-446.sh stages a private copy and bridges this function into `go test`.
Package integration holds AUR-447's Integration-layer proof: Rust and C# are real entries in the same internal/pipeline extractor registry `--languages` already filters over (AUR-426), not extractors wired only for the unfiltered default path. A mixed Rust+C# source tree documents both languages unfiltered, and `--languages rust` / `--languages csharp` behave as a real allowlist over that same registry -- proving cmd/aurumcode/docs.go's registration reaches the real engine, the same way cmd/regenerate-docs's registration does.
Package integration holds AUR-448's Integration-layer proof, at the CLI boundary: the real aurumcode binary, built from source, shows the complete fixture shape (rule_id included, with a real catalog id as the example) when no provider is configured, and prints a discard-warning line on stderr -- never stdout -- exactly when the rule gate (AUR-434) discarded one or more findings, leaving stdout byte-identical to the published AUR-434/AUR-426 contract in every case.
This card's TDD proof section names the integration selector IntegrationAUR435; that collides with the function tests/integration/AUR-435.go already declares in this same package (a different card). See docs/specs/AUR-448.md's "A note on this card's own TDD-proof identifiers" for why this file declares IntegrationAUR448 instead, following every sibling card's own numeral-matches-file convention (IntegrationAUR434, IntegrationAUR443, ...).
Selector naming note, the same technique tests/integration/AUR-442.go and tests/integration/AUR-445.go document: a function named IntegrationAUR435 already exists in this package (tests/integration/AUR-435.go) and would collide, so this proof is IntegrationAUR449 even though the card text's TDD proof section names IntegrationAUR435 (a copy-paste artifact from the AUR-435 card this one was drafted against).
Selector naming note, the same technique tests/integration/AUR-442.go and tests/integration/AUR-449.go document: a function named IntegrationAUR435 already exists in this package (tests/integration/AUR-435.go) and would collide, so this proof is IntegrationAUR450 even though the card text's TDD proof section names IntegrationAUR435 (a copy-paste artifact from the AUR-435 card this one was drafted against).
Package integration holds AUR-455's Integration-layer proof: the claims tests/unit/AUR-455.go requires the documentation to carry have lastro in the actual source and fixtures this repository ships -- read directly, never by grepping the documentation against itself.
- `aurumcode review`'s flags this card's README now names (--base, --seguranca, --pr, --repo, --publicar, --na-linha) are really registered in cmd/aurumcode/main.go.
- The fixtures demo.sh depends on actually exist and have the shape demo.sh assumes: tests/fixtures/repos/git-demo/repo.git is a bare repository with at least the three commits demo.sh's `--base HEAD~1` needs, tests/fixtures/review/known-problem-response.json is present at the path demo.sh uses (the corrected path -- three directory levels above tests/fixtures/repos/git-demo/repo.git, not the two levels docs/specs/AUR-430.md's own broken example carries -- see docs/specs/AUR-455.md), and tests/fixtures/docs/goproject holds Go source demo.sh's step (a) can extract.
- Both cmd/aurumcode and cmd/regenerate-docs are still `package main`: the "two real binaries" claim in demo.sh's own build step has lastro.
Scope, same as every sibling card in this office: no network, no execution of `aurumcode`/`regenerate-docs`/demo.sh here -- this layer only reads source and fixture files already materialized by this card's declared paths/read_paths. Actually running demo.sh is tests/e2e/AUR-455.sh's job.
Selector naming note: see tests/unit/AUR-455.go's header. This file uses IntegrationAUR455 instead of the card text's IntegrationAUR445, which already exists in this package's tests/integration/AUR-445.go and would collide.
Package integration holds AUR-456's Integration-layer proof: the two claims the Unit layer takes on faith (tests/unit/AUR-456.go) actually have lastro in the source this repository ships, read directly -- never by re-deriving them from the deleted paths themselves, since those paths no longer exist to compare against.
- .aurumcode/prompts/documentation/welcome-page.md is not merely present (Unit layer): internal/documentation/welcome/generator.go's defaultPromptPath constant names that EXACT path, so the surviving file really is read by the generator, not a coincidentally-named leftover.
- The live rules catalog internal/review/rules/security.yml -- not .aurumcode/rules/security.yml, which this card deletes -- carries the singular id security/hardcoded-secret with a real pattern: key. This is the exact divergence the card's Achados section and MUT-001 name: the dead copy this card removes still spelled the id security/hardcoded-secrets (plural) with no pattern: at all. Checking the live file's fingerprint directly (not merely "the dead file is gone") is what makes MUT-001 fail for being STALE, not just PRESENT.
The CHANGELOG-style false-capability claims in _api/index.md (review_pipeline.go/docs_pipeline.go/qa_pipeline.go under internal/pipeline/) are not re-verified here: internal/pipeline is outside this card's declared read_paths, and _api/ itself is deleted by this same card, so by GREEN there is nothing left to cross-check -- the absence proof in tests/unit/AUR-456.go already covers it. That inventory was taken once, by direct inspection, during this card's build; see docs/specs/AUR-456.md.
Scope, same as every sibling card in this office: the sandbox has no network and this card never executes `aurumcode` or `regenerate-docs`; every check here is a static read of source files already materialized by paths/read_paths.
Not named "_test.go" on purpose, same technique as tests/unit/AUR-456.go.
Selector naming note: see tests/unit/AUR-456.go's header. This file uses IntegrationAUR456 instead of the card text's IntegrationAUR445, which already exists in this package's tests/integration/AUR-445.go and would collide.
Package integration holds AUR-457's Integration-layer proof.
Where the Unit layer reads sources, this layer exercises the delivered acceptance script end to end and checks its exit-code contract -- the part of the finding that only shows up when the script actually runs. It is the layer that would catch an acceptance which "passes" without asserting: a script that always exits 0 fails the typed-error cases here.
Declared-selector note: the card declares `IntegrationAUR446`, a template typo -- that symbol already exists at tests/integration/AUR-446.go:121 in this same package, so redeclaring it would not compile. Delivered as IntegrationAUR457 and recorded as a declared gap in docs/specs/AUR-457.md.
AUR-458 integration selector. DISTINCT ASSERTION: the COMPOSITION of the two passes when the model half fails -- that the deterministic security pass still delivers its findings on stdout, and that the run never prints the clean-review sentence it has not earned. It asserts stdout content, which tests/unit/AUR-458.go deliberately does not, and it does not touch the --fail-on gate, which tests/e2e/AUR-458.sh owns.
Package integration holds AUR-459's Integration-layer proof, at the seam the unit program cannot see: internal/prompt's parser feeding internal/review's rule gate through the real GenerateReview path, with a deterministic offline provider (review.FakeProvider) standing in for the model.
The unit program (tests/unit/AUR-459.go) asserts on the parser alone: a line_comments-only response becomes an issue with its fields mapped. This program asserts what only the composition can show -- that a converted finding survives the AUR-434 rule gate and comes back carrying the catalog citation, that one without a rule_id is discarded WITH the AUR-448 warning populated instead of silence, and that the parser's own discard warning is not clobbered by the gate's, which writes to the same metadata map right after. None of these three facts is observable from the parser in isolation.
AUR-460 integration selector. DISTINCT ASSERTION: the COMPOSITION of internal/review.Reviewer, internal/llm.Orchestrator and the real internal/llm/provider/litellm.Provider against a gateway fixture that reproduces the measured defect -- it 400s on ANY request that carries an explicit "temperature" key, exactly like the gpt-5.6-luna/sol/terra family the 2026-08-14 live-gateway test hit. tests/unit/AUR-460.go already proves the raw JSON never carries the key in isolation; this program proves that guarantee survives the whole review pipeline -- diff analysis, prompt building, the orchestrator's budget/fallback wrapping, and result parsing -- and that GenerateReview still returns real findings end to end. tests/e2e/AUR-460.sh proves the same thing one layer further out, through the compiled CLI binary as a subprocess.
Package integration holds AUR-461's Integration-layer proof, at the seam the unit program cannot see: the list internal/prompt renders into the review prompt and the set internal/review's AUR-434 rule gate accepts are the same set, observed through the real GenerateReview path with a deterministic offline provider (review.FakeProvider) standing in for the model.
tests/unit/AUR-461.go asserts the rendered list against the loader directly. That is a comparison of two data structures. This program asserts the composed behaviour instead: a model that obeys the prompt -- citing an id copied verbatim from the list it was given -- has EVERY finding survive the gate and reach the caller, and a model that invents a plausible id (security/shell-injection, the exact id the 2026-08-14 measurement lost a real command injection under) still has it discarded and announced. Neither fact is observable from the prompt alone.
IntegrationAUR462 builds the real aurumcode binary and proves AUR-462's outcome at the CLI boundary, distinct from tests/unit/AUR-462.go's package-boundary proof over synthetic types.Diff values.
The sealed acceptance profile (bootstrap-readonly-v1) carries bash and a Go toolchain but no `git` binary (measured: `oci-run --card AUR-462` exited 79, `missing_git`). Building the Node fixture at run time with `git init`/`git commit`, this program's first cut, is therefore unprovable in the only environment that gates this card. So the fixture is committed instead: tests/fixtures/review/vuln/node-xss-command-injection/repo.git, a bare, loose-object repository built by tests/fixtures/repos/git-demo/build-fixture.sh -- the same git-less, deterministic builder that produced every sibling fixture (tests/fixtures/review/vuln/repo.git, .../hardcoded-secret/repo.git, tests/fixtures/repos/git-demo/repo.git) this card's own AC-003 already regresses against, and whose own doc header names exactly this constraint as the reason it never calls `git`. This program only reads it, exactly like tests/integration/AUR-442.go reads its own fixture: no git binary anywhere in this file, at build time or run time.
`--base HEAD~1` is diffed exactly as a user would. No LLM provider is configured for these runs (LLM_API_KEY, LLM_BASE_URL, AURUMCODE_LLM_FIXTURE are all stripped from the child environment): the engine's own AUR-449 behavior then runs `--seguranca` alone, which is deterministic and needs no model, so this program depends on nothing outside the process it starts and the committed fixture bytes.
It also proves AC-003 (regression) against the project's own already committed, already read-only fixture (tests/fixtures/review/vuln/repo.git, AUR-435's Python SQL-injection fixture): the finding it already produced continues to be produced, unchanged.
Package integration holds AUR-463's Integration-layer proof: extension parity (AC-002). A directory holding .js, .jsx, .mjs and .cjs files each with a real exported, documented symbol produces one page per file, and a file with no exported symbol produces no empty page, all from a single NativeExtractor.Extract call over the whole directory (not one file at a time, the way tests/unit/AUR-463.go exercises it).
Not named "_test.go" on purpose; see tests/unit/AUR-463.go's package doc for why. tests/acceptance/AUR-463.sh writes a bridge _test.go file that calls IntegrationAUR463.
Package integration holds AUR-464's Integration-layer proof: the Bash and PowerShell extractors' real Extract() entrypoint -- walking a source directory, writing real files to disk -- feeds pages into internal/documentation/normalizer (this card's third owned package) without either package reintroducing the fixed "## Documentation" placeholder or losing a symbol heading along the way.
This file is not named "_test.go" on purpose, mirroring every sibling card in this office: tests/acceptance/AUR-464.sh stages a private writable copy of the module and writes a tiny bridge "_test.go" file that calls IntegrationAUR464, so the assertions below run inside the sandboxed acceptance instead of an unrelated top-level `go test ./...`.
Package integration holds AUR-465's Integration-layer proof: the sanitizers tests/unit/AUR-465.go checks in isolation actually run inside welcome.Generator.Generate() -- the real entry point cmd/regenerate-docs calls -- and the AC-002 asset check composes correctly with a real _config.yml and a real filesystem, the way the site scaffold and the welcome package's output meet in the published tree. The Unit layer never calls Generate(); this layer never calls the sanitizers directly. If the wiring between them broke -- Generate() stopped calling the sanitizers, or the asset check resolved paths against the wrong root -- this layer is what would catch it while the Unit layer stayed green.
Not named "_test.go" on purpose, mirroring every sibling card in this office: tests/acceptance/AUR-465.sh stages a private copy of the module and bridges IntegrationAUR465 into a real `go test`.
IntegrationAUR466 builds the real aurumcode binary and proves AUR-466's outcome at the CLI boundary, distinct from tests/unit/AUR-466.go's package-boundary proof over synthetic types.Diff values.
The sealed acceptance profile (bootstrap-readonly-v1) carries bash and a Go toolchain but no `git` binary. So the fixture is committed instead: tests/fixtures/review/vuln/node-placeholder-vs-secret/repo.git, a bare, loose-object repository built by tests/fixtures/repos/git-demo/build-fixture.sh -- the same git-less, deterministic builder that produced every sibling fixture (tests/fixtures/review/vuln/repo.git, .../hardcoded-secret/repo.git, .../node-xss-command-injection/repo.git) this card's own AC-003 regresses against. This program only reads it: no git binary anywhere in this file, at build time or run time.
`--base HEAD~1` is diffed exactly as a user would. No LLM provider is configured for these runs (LLM_API_KEY, LLM_BASE_URL, AURUMCODE_LLM_FIXTURE are all stripped from the child environment): the engine's own AUR-449 behavior then runs `--seguranca` alone.
Package integration holds AUR-472's Integration-layer proof: the fix tests/unit/AUR-472.go checks in isolation is actually wired into welcome.Generator.Generate() -- the real entry point cmd/regenerate-docs calls -- so an LLM response echoing an unpublished-but-semver-shaped action ref (the measured defect) never survives into published content. The Unit layer never calls Generate(); this layer never calls SanitizeActionRefTags directly.
Not named "_test.go" on purpose, mirroring every sibling card in this office: tests/acceptance/AUR-472.sh stages a private copy of the module and bridges IntegrationAUR472 into a real `go test`.
Package integration holds AUR-474's Integration-layer proof: the Bash extractor's real Extract() entrypoint -- walking a source directory, writing real files to disk -- recognizes a one-line function declaration (`name() { ... }`) as a real symbol end to end, and the same AC-002 false-positive shapes produce zero symbols through that same real path.
This file is not named "_test.go" on purpose, mirroring every sibling card in this office: tests/acceptance/AUR-474.sh stages a private writable copy of the module and writes a tiny bridge "_test.go" file that calls IntegrationAUR474, so the assertions below run inside the sandboxed acceptance instead of an unrelated top-level `go test ./...`.
Index ¶
- func IntegrationAUR005(t *testing.T)
- func IntegrationAUR006(t *testing.T)
- func IntegrationAUR308(t *testing.T)
- func IntegrationAUR402(t *testing.T)
- func IntegrationAUR403(t *testing.T)
- func IntegrationAUR404(t *testing.T)
- func IntegrationAUR405(t *testing.T)
- func IntegrationAUR406(t *testing.T)
- func IntegrationAUR407(t *testing.T)
- func IntegrationAUR408(t *testing.T)
- func IntegrationAUR409(t *testing.T)
- func IntegrationAUR410(t *testing.T)
- func IntegrationAUR411(t *testing.T)
- func IntegrationAUR422(t *testing.T)
- func IntegrationAUR424(t *testing.T)
- func IntegrationAUR425(t *testing.T)
- func IntegrationAUR426(t *testing.T)
- func IntegrationAUR427(t *testing.T)
- func IntegrationAUR428(t *testing.T)
- func IntegrationAUR429(t *testing.T)
- func IntegrationAUR430(t *testing.T)
- func IntegrationAUR431(t *testing.T)
- func IntegrationAUR432(t *testing.T)
- func IntegrationAUR433(t *testing.T)
- func IntegrationAUR434(t *testing.T)
- func IntegrationAUR435(t *testing.T)
- func IntegrationAUR436(t *testing.T)
- func IntegrationAUR437(t *testing.T)
- func IntegrationAUR438(t *testing.T)
- func IntegrationAUR439(t *testing.T)
- func IntegrationAUR440(t *testing.T)
- func IntegrationAUR441(t *testing.T)
- func IntegrationAUR442(t *testing.T)
- func IntegrationAUR443(t *testing.T)
- func IntegrationAUR444(t *testing.T)
- func IntegrationAUR445(t *testing.T)
- func IntegrationAUR446(t *testing.T)
- func IntegrationAUR447(t *testing.T)
- func IntegrationAUR448(t *testing.T)
- func IntegrationAUR449(t *testing.T)
- func IntegrationAUR450(t *testing.T)
- func IntegrationAUR451(t *testing.T)
- func IntegrationAUR452(t *testing.T)
- func IntegrationAUR455(t *testing.T)
- func IntegrationAUR456(t *testing.T)
- func IntegrationAUR457(t *testing.T)
- func IntegrationAUR458(t *testing.T)
- func IntegrationAUR459(t *testing.T)
- func IntegrationAUR460(t *testing.T)
- func IntegrationAUR461(t *testing.T)
- func IntegrationAUR462(t *testing.T)
- func IntegrationAUR463(t *testing.T)
- func IntegrationAUR464(t *testing.T)
- func IntegrationAUR465(t *testing.T)
- func IntegrationAUR466(t *testing.T)
- func IntegrationAUR467(t *testing.T)
- func IntegrationAUR472(t *testing.T)
- func IntegrationAUR474(t *testing.T)
- func IntegrationAUR475(t *testing.T)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func IntegrationAUR005 ¶
IntegrationAUR005 is the card's declared integration selector. It executes every sealed vector through the production parser and verifier.
func IntegrationAUR006 ¶
IntegrationAUR006 checks the profile against the checked-in image lock and keeps the validation boundary independent from an OCI engine.
func IntegrationAUR308 ¶
func IntegrationAUR402 ¶
func IntegrationAUR403 ¶
func IntegrationAUR404 ¶
IntegrationAUR404 crosses the registry entry with the bytes it claims to bind: schema digest, lock digest and image-set digest must all be re-derivable from the documents on disk. A registry that advertises a digest it cannot reproduce fails here before any consumer can act on the plan.
func IntegrationAUR405 ¶
IntegrationAUR405 crosses the registry entry with the bytes it claims to bind: schema digest, lock digest and image-set digest must all be re-derivable from the documents on disk, and the profile document must point at the same lock the registry points at. A registry that advertises a digest it cannot reproduce fails here before any consumer can act on the plan.
func IntegrationAUR406 ¶
IntegrationAUR406 crosses the registry entry with the bytes it claims to bind: schema digest, lock digest and image-set digest must all be re-derivable from the documents on disk, and the profile document must point at the same lock the registry points at. A registry that advertises a digest it cannot reproduce fails here before any consumer can act on the plan.
func IntegrationAUR407 ¶
IntegrationAUR407 crosses the registry entry with the bytes it claims to bind: schema digest, lock digest and image-set digest must all be re-derivable from the documents on disk, and the profile document must point at the same lock the registry points at. A registry that advertises a digest it cannot reproduce fails here before any consumer can open the state store.
func IntegrationAUR408 ¶
IntegrationAUR408 crosses the registry entry with the bytes it claims to bind: schema digest, lock digest and image-set digest must all be re-derivable from the documents on disk, and the profile document must point at the same lock the registry points at. A registry that advertises a digest it cannot reproduce fails here before any consumer can render a document.
func IntegrationAUR409 ¶
IntegrationAUR409 crosses the registry entry with the bytes it claims to bind: schema digest, lock digest and image-set digest must all be re-derivable from the documents on disk, and the profile document must point at the same lock the registry points at. A registry that advertises a digest it cannot reproduce fails here before any consumer can resolve a repository.
func IntegrationAUR410 ¶
IntegrationAUR410 crosses the registry entry with the bytes it claims to bind: schema digest, lock digest and image-set digest must all be re-derivable from the documents on disk, and the profile document must point at the same lock the registry points at. It then crosses the two halves of the orchestrator/probe separation that live in different parts of the document — the declared roots, the environment spelling of those roots and the probe's writable set — because a plan whose halves disagree has a boundary only on paper.
func IntegrationAUR411 ¶
IntegrationAUR411 crosses the registry entry with the bytes it claims to bind: schema digest, lock digest and image-set digest must all be re-derivable from the documents on disk, and the profile document must point at the same lock the registry points at. It then crosses the two halves of the polyglot plan that live in different parts of the document — the declared partitions, the published language list and the environment spelling of the bounded cache directories — because a plan whose halves disagree has isolation only on paper.
func IntegrationAUR422 ¶
func IntegrationAUR424 ¶
IntegrationAUR424 is AUR-424's Integration-layer selector.
func IntegrationAUR425 ¶
IntegrationAUR425 is AC-001 across the config/pipeline boundary.
func IntegrationAUR426 ¶
IntegrationAUR426 proves, through the real binary, that `--languages` reaches the real internal/pipeline extractor registry: unfiltered and filtered to "go" both document the Go file (the filter is not a silent no-op that always processes everything); filtered to "python" alone documents nothing and fails loudly, naming the real reason (`internal/pipeline`'s own "required tool not in PATH" report -- not a message this card invented); and the unfiltered run over the mixed tree reports the honest partial outcome instead of collapsing it into either an all-clean success or a total failure.
func IntegrationAUR427 ¶
IntegrationAUR427 is AUR-427's Integration-layer selector.
func IntegrationAUR428 ¶
IntegrationAUR428 is AUR-428's Integration-layer selector.
RED before the fix: the example pinned a 40-hex local commit SHA and no LICENSE existed at the repository root -- both fail below with the AUR-428/AC-001/behavior-missing label. A MUT-001 mutation that points the workflow at a repository other than this one, at a non-semver reference, or at inputs action.yml does not declare, fails with AUR-428/AC-001/ MUT-001: the manifest validation refuses a reference that cannot exist as the published contract.
func IntegrationAUR429 ¶
IntegrationAUR429 is AC-001 across the generator/publisher/verifier chain.
func IntegrationAUR430 ¶
IntegrationAUR430 builds the real cmd/aurumcode binary and runs it, as a user would, against the tests/fixtures/repos/git-demo bare repository -- no cloning, no working-tree checkout, no `git` binary: OpenRepo detects a bare repository directly (see internal/analyzer/gitrepo.go), so the fixture's repo.git directory is used as the reviewed repository's cwd as-is. The LLM call is pinned to a deterministic offline fixture via AURUMCODE_LLM_FIXTURE (see review.FakeProvider and docs/specs/AUR-430.md).
func IntegrationAUR431 ¶
IntegrationAUR431 exercises the --fail-on CI gate exactly as a pipeline would: build the real cmd/aurumcode binary, run it against the tests/fixtures/repos/git-demo bare repository with a deterministic offline model response (AURUMCODE_LLM_FIXTURE, see review.FakeProvider), and assert on nothing but the observable contract -- exit codes and output. See docs/specs/AUR-431.md.
func IntegrationAUR432 ¶
IntegrationAUR432 proves AUR-432's outcome through the real binary: the planted synthetic secrets of tests/fixtures/repos/git-demo never reach the provider (observed via the offline provider's prompt capture and via the raw bytes a local loopback endpoint receives), never reach stdout or stderr even when the model echoes them back, and the endpoint note never reveals a password carried in LLM_BASE_URL userinfo.
func IntegrationAUR433 ¶
IntegrationAUR433 exercises --limite end to end against a real local HTTP endpoint (the same wire shape internal/llm/provider/litellm speaks, no external network involved): it counts the literal number of completion requests the endpoint receives, and proves that number is exactly zero for a run whose estimate exceeds --limite (MUT-001's core requirement, stated as a real, numeric call counter rather than the offline fixture's capture-file proxy tests/unit/AUR-433.go and the acceptance script use), and exactly one for a run comfortably under it.
func IntegrationAUR434 ¶
IntegrationAUR434 builds the real aurumcode binary and proves AUR-434's outcome at the CLI boundary: every printed problem cites the sustaining rule from the embedded project review standard, an ungrounded finding never reaches stdout, and the output is deterministic across runs.
func IntegrationAUR435 ¶
IntegrationAUR435 builds the real aurumcode binary and proves AUR-435's outcome at the CLI boundary: `review --base HEAD~1 --seguranca` runs a security pass that reports the planted synthetic SQL injection in a section separate from the quality findings, citing the security-category rule and the project security standard; without the flag stdout is byte-identical to the published AUR-430 contract; and the gate composed with --fail-on fails closed on the security finding.
func IntegrationAUR436 ¶
IntegrationAUR436 exercises --modelo end to end against a real local HTTP endpoint: build the real cmd/aurumcode binary, point LLM_BASE_URL at an httptest server on loopback, and assert that the model named by --modelo is the model sent on the wire; that --modelo overrides LLM_MODEL; that without --modelo the pre-existing selection is untouched; and that an unreachable local endpoint yields the clear unavailability error, never an empty review with exit 0.
func IntegrationAUR437 ¶
IntegrationAUR437 is the integration selector declared by the card.
func IntegrationAUR438 ¶
IntegrationAUR438 exercises the full PR review path end to end against a real HTTP fake GitHub on loopback: build the real cmd/aurumcode binary, run it with a write-permission token and assert the exact publish transcript (one inline review comment anchored at file+line, one general issue comment for the out-of-range finding), repeat it and assert byte- identical stdout and an identical publish sequence, then run it again with a read-only token and assert zero POSTs reached the server.
func IntegrationAUR439 ¶
IntegrationAUR439 exercises the full --check path end to end against a real HTTP fake GitHub on loopback: build the real cmd/aurumcode binary, prove a grave finding publishes a "failure" status with an exit that never reads as success, a clean finding publishes "success", zero findings still publish "success" ("No issues found." plus a cleared check), --check needs a commit SHA on its own even when nothing is inline-eligible, a read-only token is refused before any POST (including to the statuses endpoint), and repeating the grave run reproduces the exact same status.
func IntegrationAUR440 ¶
IntegrationAUR440 is AUR-440's Integration-layer selector.
RED before the fix: the example was still the documentation gate -- it delegated to the root composite action by a local 40-hex SHA, which fails below both as a composite delegation and as an unpublishable reference. A MUT-001 mutation that removes the publishing job's pull-requests: write permission fails in the Unit layer and the E2E with the AUR-440/AC-001/ MUT-001 label; this layer keeps the cross-artifact contract pinned.
func IntegrationAUR441 ¶
IntegrationAUR441 builds the real aurumcode binary and proves AUR-441's outcome at the CLI boundary: a second `review --base HEAD~1` invocation against an unchanged repository does not resend any file to the model (observed through AURUMCODE_PROMPT_CAPTURE -- absent entirely on a full cache hit, since GenerateReview, and so FakeProvider.Complete, is never called), reports how many files were reused on stderr, and produces byte-identical stdout to the first run. It also proves the cache never serves a stale answer across a changed model identity (a different AURUMCODE_LLM_FIXTURE), and that the pre-existing "nothing changed" (--base HEAD) contract is unaffected.
func IntegrationAUR442 ¶
IntegrationAUR442 builds the real aurumcode binary and proves AUR-442's outcome at the CLI boundary:
- A dedicated fixture (tests/fixtures/review/vuln/hardcoded-secret, new under this card, sibling to and never touching AUR-435's own tests/fixtures/review/vuln/repo.git) proves the restored security/hardcoded-secret matcher fires on both shapes it covers -- a quoted Python assignment and an unquoted env-style line -- and not on the deliberately planted benign line beside each.
- tests/fixtures/repos/git-demo -- the project's own demo fixture, whose sole purpose is to plant a plaintext secret -- now reports that secret instead of "No security findings.": the exact defect this card's dogfooding measured (see docs/specs/AUR-442.md).
- Without --seguranca, stdout stays byte-identical to the published AUR-430 contract; the secret canary never reaches a sink; the run is deterministic.
Known, expected consequence (not a defect of this card, not owned by its `paths`): tests/acceptance/AUR-435.sh's nominal_case ("absence-not-reported") and tests/integration/AUR-435.go's IntegrationAUR435 ("expected an honest empty security section on git-demo") both hardcode that git-demo's --seguranca run prints "No security findings." That assertion encoded the very defect this card fixes -- AUR-435 shipped before hardcoded-secret had a matcher, when git-demo genuinely matched nothing -- and neither file is in AUR-442's `paths`, so this card cannot update them. AUR-435's own MUT-001 mutation_case (which runs against the unrelated tests/fixtures/review/vuln/repo.git, not git-demo) is unaffected and stays green. A follow-up card should re-baseline AUR-435's two git-demo assertions now that the fixture's plaintext secret is, correctly, found.
func IntegrationAUR443 ¶
IntegrationAUR443 proves, through the real binary, that internal/analyzer's two ref-resolution backends now report the identical clean message for the same unresolvable ref, and that a real git binary (when present on PATH) is not required to reach that clean message -- only internal/analyzer's pure-Go path, the one bootstrap-readonly-v1 exercises, has to.
func IntegrationAUR444 ¶
IntegrationAUR444 is AUR-444's Integration-layer proof (selector name inherited verbatim from the card's own TDD proof section; see tests/unit/AUR-444.go's header for why it is kept as declared).
func IntegrationAUR445 ¶
IntegrationAUR445 is AUR-445's Integration-layer selector.
func IntegrationAUR446 ¶
IntegrationAUR446 checks every corrected spec (this card's own declared deliverables, so their absence is behavior-missing, never infrastructure) and corroborates the underlying facts against real read_paths sources.
func IntegrationAUR447 ¶
IntegrationAUR447 proves, through the real binary, that Rust and C# are real entries in the same registry `--languages` filters: unfiltered documents both; `--languages rust` documents only Rust; `--languages csharp` documents only C#. Each assertion reads the real generated markdown, never only the process exit code, so a filter that silently did nothing (or an extractor wired only for the unfiltered path) would be caught here.
func IntegrationAUR448 ¶
IntegrationAUR448 builds the real aurumcode binary and proves this card's outcome at the CLI boundary.
func IntegrationAUR449 ¶
IntegrationAUR449 builds the real aurumcode binary and proves AUR-449's outcome end to end, against tests/fixtures/repos/git-demo (the project's own demo fixture, which plants three synthetic secrets AUR-442 already taught the security pass to find):
- With no LLM provider configured at all, `--seguranca` alone now runs the deterministic security pass and reports its findings with exit 0, instead of refusing with "no LLM provider configured" -- because the pass is a regex matcher over the diff's added lines and calls no model. The skip is explained on stderr, never silent, and the run is deterministic.
- Composed with --fail-on: the matched secrets (severity error) still close the gate even though no quality review ran.
- With a provider configured (the offline fixture), `--seguranca`'s output is exactly what AUR-442 already proved: unaffected by this card.
- --seguranca combined with an explicit --modelo that cannot be served still fails loudly (AUR-436's reportModelUnavailable) -- an explicit model choice is never silently downgraded into the skip.
- Without --seguranca, the pre-existing no-provider refusal (AUR-430's contract) is untouched, byte for byte.
- The secret canary never reaches a sink on the skip path.
See docs/specs/AUR-449.md.
func IntegrationAUR450 ¶
IntegrationAUR450 builds the real aurumcode binary and proves AUR-450's outcome end to end, against tests/fixtures/repos/git-demo (the project's own demo fixture, which plants three synthetic secrets AUR-442 already taught the security pass to find):
- `--seguranca` prints, on stderr, how many and which security-category rules of the embedded catalog it actually applied against how many the category declares in total.
- The same note, byte-identical, appears when the pass finds nothing (an empty diff) -- the exact case the card's Outcome names: "No security findings." must never be misread as full coverage.
- The note is deterministic across reruns.
- With a provider configured, the AUR-442/AUR-449 stdout contract is completely unaffected -- the note lands on stderr only.
- --fail-on still closes the gate exactly as before.
- An explicit --modelo that cannot be served still fails loudly, before any --seguranca output (coverage note included) ever prints.
- Without --seguranca, no coverage note appears anywhere.
- The secret canary never reaches a sink alongside the new note.
See docs/specs/AUR-450.md.
func IntegrationAUR451 ¶
IntegrationAUR451 exercises the AC-001 command end to end against a real HTTP fake GitHub on loopback: build the real cmd/aurumcode binary, prove the security finding publishes and closes the --fail-on gate, prove a quality finding on the same line still publishes alongside it, prove --limite refuses with zero POSTs, and prove the pre-AUR-451 `--pr` contract (no new flags) still posts nothing beyond what AUR-438 already published.
func IntegrationAUR452 ¶ added in v1.0.2
func IntegrationAUR455 ¶
IntegrationAUR455 is AUR-455's Integration-layer selector.
func IntegrationAUR456 ¶
IntegrationAUR456 is AUR-456's Integration-layer selector.
func IntegrationAUR457 ¶ added in v1.0.2
func IntegrationAUR458 ¶ added in v1.0.2
IntegrationAUR458 proves the card's requisito explícito: a provider that FAILS must not take the deterministic security pass down with it. Before this card the security section vanished entirely whenever the model half broke -- the user lost real, already-computed security findings because an unrelated network call failed.
func IntegrationAUR459 ¶ added in v1.0.2
IntegrationAUR459 is this card's integration selector.
func IntegrationAUR460 ¶ added in v1.0.2
IntegrationAUR460 proves the review pipeline reaches a gateway-served model family the pre-fix fixed Temperature default made unreachable, and still returns the real finding the model reported.
func IntegrationAUR461 ¶ added in v1.0.2
IntegrationAUR461 is this card's integration selector.
func IntegrationAUR462 ¶ added in v1.0.2
func IntegrationAUR463 ¶ added in v1.0.2
IntegrationAUR463 is the Integration-layer proof.
func IntegrationAUR464 ¶ added in v1.0.2
IntegrationAUR464 is AUR-464's Integration-layer selector. It proves:
- Extract() itself -- not just the internal scanner -- walks a directory of real scripts and writes one real page per script to disk, each with symbol-named headings.
- Across every generated page, "## Documentation" never appears and no heading repeats WITHIN a page (AC-001 holds file-by-file, not just for a single hand-picked fixture).
- Running this card's own normalizer.Normalizer over the generated pages (front matter injection) does not disturb the body headings: the two owned packages compose without the front-matter pass re-introducing a placeholder or corrupting a symbol heading.
func IntegrationAUR465 ¶ added in v1.0.2
IntegrationAUR465 is AUR-465's Integration-layer selector.
func IntegrationAUR466 ¶ added in v1.0.2
func IntegrationAUR467 ¶ added in v1.0.2
IntegrationAUR467 is this card's integration selector. Where tests/unit/AUR-467.go proves the AC-001/002/003 mechanics and reconstructs the measured cause on a minimal diff, this program exercises the same PromptBuilder boundary against a diff shaped closer to the 2026-08-14 measurement's scale and mix -- several prose file types, a wider spread of code languages, and a no-prose control diff -- with assertions distinct from the unit selector.
func IntegrationAUR472 ¶ added in v1.0.2
IntegrationAUR472 is AUR-472's Integration-layer selector.
func IntegrationAUR474 ¶ added in v1.0.2
IntegrationAUR474 is AUR-474's Integration-layer selector.
func IntegrationAUR475 ¶ added in v1.0.2
IntegrationAUR475 is this card's integration selector. Where tests/unit/AUR-475.go proves the AC-001/002/003 mechanics through PromptBuilder.BuildPrompt, this program exercises the exported budgeting primitives (NewTokenBudget, BuildContextSegments, TrimToFit) directly -- the same boundary AUR-467's measurement reconstruction used -- with assertions distinct from the unit selector: order-independence across several interleaved sizes, that an included segment's token count is never altered (proof against silent truncation at the primitive level), and Meta arithmetic consistency across a spread of budgets.
Types ¶
This section is empty.
Source Files
¶
- AUR-005.go
- AUR-006.go
- AUR-308.go
- AUR-402.go
- AUR-403.go
- AUR-404.go
- AUR-405.go
- AUR-406.go
- AUR-407.go
- AUR-408.go
- AUR-409.go
- AUR-410.go
- AUR-411.go
- AUR-422.go
- AUR-424.go
- AUR-425.go
- AUR-426.go
- AUR-427.go
- AUR-428.go
- AUR-429.go
- AUR-430.go
- AUR-431.go
- AUR-432.go
- AUR-433.go
- AUR-434.go
- AUR-435.go
- AUR-436.go
- AUR-437.go
- AUR-438.go
- AUR-439.go
- AUR-440.go
- AUR-441.go
- AUR-442.go
- AUR-443.go
- AUR-444.go
- AUR-445.go
- AUR-446.go
- AUR-447.go
- AUR-448.go
- AUR-449.go
- AUR-450.go
- AUR-451.go
- AUR-452.go
- AUR-455.go
- AUR-456.go
- AUR-457.go
- AUR-458.go
- AUR-459.go
- AUR-460.go
- AUR-461.go
- AUR-462.go
- AUR-463.go
- AUR-464.go
- AUR-465.go
- AUR-466.go
- AUR-467.go
- AUR-472.go
- AUR-474.go
- AUR-475.go