From 714ac9d101baf082b4c9b50bdd5c2647ef76d60a Mon Sep 17 00:00:00 2001
From: Sebastian Otaegui <feniix@gmail.com>
Date: Mon, 13 Jul 2026 11:47:19 -0300
Subject: [PATCH] test(agent-journal): pin historical evaluation evidence

Freeze the V1-V3 plans, contracts, manifests, and results by safe
path-and-SHA-256 metadata so later evaluation work fails on drift.

RED: npx vitest run packages/pi-agent-journal/__tests__/evaluation-program-guard.test.ts
Failure: ENOENT for the absent historical guard.
---
 .../agent-work-journal-historical-guard.json  | 17 ++++++
 .../evaluation-program-guard.test.ts          | 53 +++++++++++++++++++
 2 files changed, 70 insertions(+)
 create mode 100644 docs/evaluations/agent-work-journal-historical-guard.json
 create mode 100644 packages/pi-agent-journal/__tests__/evaluation-program-guard.test.ts

diff --git a/docs/evaluations/agent-work-journal-historical-guard.json b/docs/evaluations/agent-work-journal-historical-guard.json
new file mode 100644
index 0000000..5a7c7dd
--- /dev/null
+++ b/docs/evaluations/agent-work-journal-historical-guard.json
@@ -0,0 +1,17 @@
+{
+  "schemaVersion": 1,
+  "algorithm": "sha256",
+  "evidence": {
+    "docs/evaluations/agent-work-journal-v1-results.json": "ff6f8b1389e0667ca410fd6d544247901ebc2955aaa1a6fa1a47404d00e0315b",
+    "docs/evaluations/agent-work-journal-v1.md": "cb4e88d65ecba49bd12669c03c8a865641b1538516dca1e056258ebbca0bdbe1",
+    "docs/evaluations/agent-work-journal-v2-infrastructure-manifest.json": "bad596b7909c3b85aa6cafec7dd893516384eb1f157e44fe33e709c22a1e4e34",
+    "docs/evaluations/agent-work-journal-v2-results.json": "1f0aafc726bab5c6482a56cc187d588c51d7081c3e2dfef7af3ad42cc23e0f7c",
+    "docs/evaluations/agent-work-journal-v2.md": "939f479276af7038b2d1512d71d0bdd822b7ed7b56f95cd4632cb089603c63f2",
+    "docs/evaluations/agent-work-journal-v3-infrastructure-manifest.json": "5d328c49382539ff117f1de8dcf6ed99139a1a5f200394be65c2b3de91649ac7",
+    "docs/evaluations/agent-work-journal-v3-results.json": "afd5f5326de22b6322f02c50ec9706f7c61a28941018138eb4623de73815a340",
+    "docs/evaluations/agent-work-journal-v3.md": "16a0857a1e3832d95c8c2b1209d7fa9c966610f8d2209e87b7acc2e192636146",
+    "docs/plans/2026-07-12-001-feat-agent-work-journal-plan.md": "d74dee96690d5f125ee53001b182100209587c4e207173272c86d604e5206748",
+    "docs/plans/2026-07-12-002-feat-agent-work-journal-v2-redesign-plan.md": "c67417dca8747a1310f6419ef2f51b4a6173985d1390c8415fe5c25d07fda141",
+    "docs/plans/2026-07-13-001-feat-agent-work-journal-v3-evaluation-plan.md": "dd620a2ec67d0246b0eb62fc92055a439c40a7b883bcbfbe6a957ecb0fa424f8"
+  }
+}
diff --git a/packages/pi-agent-journal/__tests__/evaluation-program-guard.test.ts b/packages/pi-agent-journal/__tests__/evaluation-program-guard.test.ts
new file mode 100644
index 0000000..a047682
--- /dev/null
+++ b/packages/pi-agent-journal/__tests__/evaluation-program-guard.test.ts
@@ -0,0 +1,53 @@
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { describe, expect, it } from "vitest";
+
+const guardPath = "docs/evaluations/agent-work-journal-historical-guard.json";
+const expectedEvidence = {
+  "docs/evaluations/agent-work-journal-v1-results.json":
+    "ff6f8b1389e0667ca410fd6d544247901ebc2955aaa1a6fa1a47404d00e0315b",
+  "docs/evaluations/agent-work-journal-v1.md": "cb4e88d65ecba49bd12669c03c8a865641b1538516dca1e056258ebbca0bdbe1",
+  "docs/evaluations/agent-work-journal-v2-infrastructure-manifest.json":
+    "bad596b7909c3b85aa6cafec7dd893516384eb1f157e44fe33e709c22a1e4e34",
+  "docs/evaluations/agent-work-journal-v2-results.json":
+    "1f0aafc726bab5c6482a56cc187d588c51d7081c3e2dfef7af3ad42cc23e0f7c",
+  "docs/evaluations/agent-work-journal-v2.md": "939f479276af7038b2d1512d71d0bdd822b7ed7b56f95cd4632cb089603c63f2",
+  "docs/evaluations/agent-work-journal-v3-infrastructure-manifest.json":
+    "5d328c49382539ff117f1de8dcf6ed99139a1a5f200394be65c2b3de91649ac7",
+  "docs/evaluations/agent-work-journal-v3-results.json":
+    "afd5f5326de22b6322f02c50ec9706f7c61a28941018138eb4623de73815a340",
+  "docs/evaluations/agent-work-journal-v3.md": "16a0857a1e3832d95c8c2b1209d7fa9c966610f8d2209e87b7acc2e192636146",
+  "docs/plans/2026-07-12-001-feat-agent-work-journal-plan.md":
+    "d74dee96690d5f125ee53001b182100209587c4e207173272c86d604e5206748",
+  "docs/plans/2026-07-12-002-feat-agent-work-journal-v2-redesign-plan.md":
+    "c67417dca8747a1310f6419ef2f51b4a6173985d1390c8415fe5c25d07fda141",
+  "docs/plans/2026-07-13-001-feat-agent-work-journal-v3-evaluation-plan.md":
+    "dd620a2ec67d0246b0eb62fc92055a439c40a7b883bcbfbe6a957ecb0fa424f8",
+};
+
+const guard = JSON.parse(readFileSync(guardPath, "utf8"));
+
+describe("Agent Journal historical evidence guard", () => {
+  it("pins every V1, V2, and V3 plan, contract, manifest, and result by SHA-256", () => {
+    expect(guard).toEqual({
+      schemaVersion: 1,
+      algorithm: "sha256",
+      evidence: expectedEvidence,
+    });
+
+    for (const [path, expectedDigest] of Object.entries(expectedEvidence)) {
+      expect(createHash("sha256").update(readFileSync(path)).digest("hex"), path).toBe(expectedDigest);
+    }
+  });
+
+  it("contains only safe relative paths and opaque digests", () => {
+    expect(Object.keys(guard)).toEqual(["schemaVersion", "algorithm", "evidence"]);
+    for (const [path, digest] of Object.entries(guard.evidence as Record<string, string>)) {
+      expect(path).toMatch(/^(docs\/evaluations|docs\/plans)\//);
+      expect(path).not.toMatch(/^\/|^[A-Za-z]:[\\/]|\.\./);
+      expect(digest).toMatch(/^[a-f0-9]{64}$/);
+    }
+
+    expect(JSON.stringify(guard)).not.toMatch(/prompt|trace|credential|toolPayload|modelMessage|reasoning/i);
+  });
+});