From 53415435e61e19b879fbaa8fe5249bd849e18f7b Mon Sep 17 00:00:00 2001
From: Hardonian <118695431+Hardonian@users.noreply.github.com>
Date: Fri, 29 May 2026 05:02:07 +0000
Subject: [PATCH 1/4] test: add comprehensive tests for stripAnsi

---
 src/lib/adapters/openshell/client.test.ts | 27 +++++++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/src/lib/adapters/openshell/client.test.ts b/src/lib/adapters/openshell/client.test.ts
index bd3101e616..82284fa440 100644
--- a/src/lib/adapters/openshell/client.test.ts
+++ b/src/lib/adapters/openshell/client.test.ts
@@ -49,8 +49,31 @@ function exitWithCode(code: number): never {
 }
 
 describe("openshell helpers", () => {
-  it("strips ANSI sequences", () => {
-    expect(stripAnsi("\u001b[32mConnected\u001b[0m")).toBe("Connected");
+  describe("stripAnsi", () => {
+    it("strips simple ANSI color codes", () => {
+      expect(stripAnsi("\u001b[32mConnected\u001b[0m")).toBe("Connected");
+    });
+
+    it("strips complex ANSI codes with semicolons", () => {
+      expect(stripAnsi("\x1b[38;5;206mMagenta text\x1b[0m")).toBe("Magenta text");
+      expect(stripAnsi("\u001b[1;31mBold red\u001b[0m")).toBe("Bold red");
+    });
+
+    it("strips multiple ANSI codes in a single string", () => {
+      expect(stripAnsi("\u001b[31mRed\u001b[0m and \u001b[32mGreen\u001b[0m")).toBe("Red and Green");
+    });
+
+    it("returns the original string if no ANSI codes are present", () => {
+      expect(stripAnsi("Plain text")).toBe("Plain text");
+    });
+
+    it("handles undefined and empty inputs", () => {
+      expect(stripAnsi()).toBe("");
+      expect(stripAnsi(undefined as any)).toBe("");
+      expect(stripAnsi("")).toBe("");
+    });
+
+
   });
 
   it("parses semantic versions from CLI output", () => {

From fc1b5c66864e206f69ef61db22c3bcd9f2565fce Mon Sep 17 00:00:00 2001
From: Hardonian <118695431+Hardonian@users.noreply.github.com>
Date: Fri, 29 May 2026 05:06:37 +0000
Subject: [PATCH 2/4] fix: replace rg with git ls-files to fix verify script in
 CI

---
 artifacts/governance/status-truth-map.json |   2 +-
 scripts/verify-status-truth.ts             | 125 ++++++++++++++-------
 2 files changed, 84 insertions(+), 43 deletions(-)

diff --git a/artifacts/governance/status-truth-map.json b/artifacts/governance/status-truth-map.json
index e89f879299..5be938b355 100644
--- a/artifacts/governance/status-truth-map.json
+++ b/artifacts/governance/status-truth-map.json
@@ -1,5 +1,5 @@
 {
-  "generatedAt": "2026-05-24T00:58:49.418Z",
+  "generatedAt": "2026-05-29T05:05:17.186Z",
   "schemaVersion": "1.0.0",
   "components": [
     {
diff --git a/scripts/verify-status-truth.ts b/scripts/verify-status-truth.ts
index 4354ef9f41..e20f9b79e3 100644
--- a/scripts/verify-status-truth.ts
+++ b/scripts/verify-status-truth.ts
@@ -1,10 +1,10 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { execSync } from 'node:child_process';
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { execSync } from "node:child_process";
 
-type State = 'implemented' | 'partial' | 'planned' | 'deprecated' | 'unknown';
+type State = "implemented" | "partial" | "planned" | "deprecated" | "unknown";
 
 type Component = {
   name: string;
@@ -19,83 +19,124 @@ type Component = {
 };
 
 const docs = {
-  current: readFileSync('docs/architecture/current-state.md', 'utf8'),
-  target: readFileSync('docs/architecture/target-state.md', 'utf8'),
+  current: readFileSync("docs/architecture/current-state.md", "utf8"),
+  target: readFileSync("docs/architecture/target-state.md", "utf8"),
 };
 
-const rawFiles = execSync('rg --files src test docs .github/workflows scripts').toString('utf8').trim();
-const files = rawFiles ? rawFiles.split('\n') : [];
+let rawFiles = "";
+try {
+  rawFiles = execSync("git ls-files src test docs .github/workflows scripts")
+    .toString("utf8")
+    .trim();
+} catch (e) {
+  // fallback if git is not available or path is wrong
+  try {
+    rawFiles = execSync("find src test docs .github/workflows scripts -type f")
+      .toString("utf8")
+      .trim();
+  } catch (e2) {}
+}
+const files = rawFiles ? rawFiles.split("\n") : [];
 const hasFile = (pattern: RegExp) => files.some((f) => pattern.test(f));
 
 const components: Component[] = [
   {
-    name: 'control-plane',
-    state: hasFile(/src\/lib\/control-plane\/control-plane\.test\.ts$/) ? 'implemented' : 'partial',
-    implementationEvidence: ['src/lib/control-plane/orchestration.ts', 'src/lib/control-plane/scheduler.ts'],
-    testEvidence: ['src/lib/control-plane/control-plane.test.ts', 'src/lib/control-plane/runtime-seams.test.ts'],
-    docsEvidence: ['docs/architecture/current-state.md', 'docs/architecture/target-state.md'],
-    ciEvidence: ['.github/workflows/ci.yml'],
-    exportEvidence: ['src/lib/control-plane/evidence-export.ts'],
+    name: "control-plane",
+    state: hasFile(/src\/lib\/control-plane\/control-plane\.test\.ts$/) ? "implemented" : "partial",
+    implementationEvidence: [
+      "src/lib/control-plane/orchestration.ts",
+      "src/lib/control-plane/scheduler.ts",
+    ],
+    testEvidence: [
+      "src/lib/control-plane/control-plane.test.ts",
+      "src/lib/control-plane/runtime-seams.test.ts",
+    ],
+    docsEvidence: ["docs/architecture/current-state.md", "docs/architecture/target-state.md"],
+    ciEvidence: [".github/workflows/ci.yml"],
+    exportEvidence: ["src/lib/control-plane/evidence-export.ts"],
     driftFindings: [],
-    reasoning: 'Control-plane modules and tests exist and are wired into verification scripts.',
+    reasoning: "Control-plane modules and tests exist and are wired into verification scripts.",
   },
   {
-    name: 'policy-egress-enforcement',
-    state: hasFile(/test\/ssrf-parity\.test\.ts$/) ? 'implemented' : 'partial',
-    implementationEvidence: ['src/lib/policies.ts', 'src/lib/private-networks.ts'],
-    testEvidence: ['test/ssrf-parity.test.ts', 'test/config-set-nested-ssrf.test.ts'],
-    docsEvidence: ['docs/verification/release-readiness.md'],
-    ciEvidence: ['.github/workflows/ci.yml'],
+    name: "policy-egress-enforcement",
+    state: hasFile(/test\/ssrf-parity\.test\.ts$/) ? "implemented" : "partial",
+    implementationEvidence: ["src/lib/policies.ts", "src/lib/private-networks.ts"],
+    testEvidence: ["test/ssrf-parity.test.ts", "test/config-set-nested-ssrf.test.ts"],
+    docsEvidence: ["docs/verification/release-readiness.md"],
+    ciEvidence: [".github/workflows/ci.yml"],
     exportEvidence: [],
     driftFindings: [],
-    reasoning: 'SSRF/policy tests and policy modules exist in repository truth paths.',
+    reasoning: "SSRF/policy tests and policy modules exist in repository truth paths.",
   },
   {
-    name: 'proofpack-replay-governance',
-    state: hasFile(/scripts\/verify-proofpack\.ts$/) && hasFile(/scripts\/verify-replay\.ts$/) ? 'implemented' : 'partial',
-    implementationEvidence: ['src/lib/control-plane/proofpack-ledger.ts', 'src/lib/control-plane/replay.ts'],
-    testEvidence: ['src/lib/control-plane/proofpack-ledger.test.ts'],
-    docsEvidence: ['docs/verification/release-readiness.md'],
-    ciEvidence: ['.github/workflows/ci.yml'],
-    exportEvidence: ['scripts/verify-proofpack.ts', 'scripts/verify-replay.ts'],
+    name: "proofpack-replay-governance",
+    state:
+      hasFile(/scripts\/verify-proofpack\.ts$/) && hasFile(/scripts\/verify-replay\.ts$/)
+        ? "implemented"
+        : "partial",
+    implementationEvidence: [
+      "src/lib/control-plane/proofpack-ledger.ts",
+      "src/lib/control-plane/replay.ts",
+    ],
+    testEvidence: ["src/lib/control-plane/proofpack-ledger.test.ts"],
+    docsEvidence: ["docs/verification/release-readiness.md"],
+    ciEvidence: [".github/workflows/ci.yml"],
+    exportEvidence: ["scripts/verify-proofpack.ts", "scripts/verify-replay.ts"],
     driftFindings: [],
-    reasoning: 'Proofpack and replay verification surfaces are present and script-addressable.',
+    reasoning: "Proofpack and replay verification surfaces are present and script-addressable.",
   },
 ];
 
 for (const component of components) {
-  for (const path of [...component.implementationEvidence, ...component.testEvidence, ...component.docsEvidence]) {
+  for (const path of [
+    ...component.implementationEvidence,
+    ...component.testEvidence,
+    ...component.docsEvidence,
+  ]) {
     if (!files.includes(path)) {
       component.driftFindings.push(`Missing evidence file: ${path}`);
-      component.state = component.state === 'implemented' ? 'partial' : component.state;
+      component.state = component.state === "implemented" ? "partial" : component.state;
     }
   }
 }
 
 const staleClaims: string[] = [];
 if (/does not yet implement a dedicated deterministic control plane/i.test(docs.current)) {
-  staleClaims.push('current-state.md still claims deterministic control plane is not implemented.');
+  staleClaims.push("current-state.md still claims deterministic control plane is not implemented.");
 }
-if (/target state/i.test(docs.target) && /planned/i.test(docs.target) && components.some((c) => c.state === 'implemented')) {
-  staleClaims.push('target-state.md contains planned-only claims for implemented capabilities.');
+if (
+  /target state/i.test(docs.target) &&
+  /planned/i.test(docs.target) &&
+  components.some((c) => c.state === "implemented")
+) {
+  staleClaims.push("target-state.md contains planned-only claims for implemented capabilities.");
 }
 
 const conflicting = components.filter(
-  (c) => c.state === 'implemented' && (c.testEvidence.length === 0 || c.implementationEvidence.length === 0),
+  (c) =>
+    c.state === "implemented" &&
+    (c.testEvidence.length === 0 || c.implementationEvidence.length === 0),
 );
 
 const payload = {
   generatedAt: new Date().toISOString(),
-  schemaVersion: '1.0.0',
+  schemaVersion: "1.0.0",
   components,
   staleClaims,
 };
 
-mkdirSync('artifacts/governance', { recursive: true });
-writeFileSync('artifacts/governance/status-truth-map.json', `${JSON.stringify(payload, null, 2)}\n`);
+mkdirSync("artifacts/governance", { recursive: true });
+writeFileSync(
+  "artifacts/governance/status-truth-map.json",
+  `${JSON.stringify(payload, null, 2)}\n`,
+);
 
-if (staleClaims.length > 0 || conflicting.length > 0 || components.some((c) => c.driftFindings.length > 0)) {
-  console.error('verify:status-truth FAILED');
+if (
+  staleClaims.length > 0 ||
+  conflicting.length > 0 ||
+  components.some((c) => c.driftFindings.length > 0)
+) {
+  console.error("verify:status-truth FAILED");
   for (const message of staleClaims) console.error(`- ${message}`);
   for (const c of components.filter((x) => x.driftFindings.length > 0)) {
     for (const finding of c.driftFindings) console.error(`- ${c.name}: ${finding}`);
@@ -103,4 +144,4 @@ if (staleClaims.length > 0 || conflicting.length > 0 || components.some((c) => c
   process.exit(1);
 }
 
-console.log('verify:status-truth PASS');
+console.log("verify:status-truth PASS");

From 66d20984759b8d09825989bcc7cceb0f678d28ed Mon Sep 17 00:00:00 2001
From: Hardonian <118695431+Hardonian@users.noreply.github.com>
Date: Fri, 29 May 2026 05:09:40 +0000
Subject: [PATCH 3/4] =?UTF-8?q?test:=20=F0=9F=A7=AA=20add=20comprehensive?=
 =?UTF-8?q?=20tests=20for=20stripAnsi?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit


From 0c4f83b305846b00341f606895c9f1ac8110592e Mon Sep 17 00:00:00 2001
From: Hardonian <118695431+Hardonian@users.noreply.github.com>
Date: Fri, 29 May 2026 05:10:19 +0000
Subject: [PATCH 4/4] test: add comprehensive tests for stripAnsi