test: executable invariant guards + JSON-LD golden snapshot#638
Merged
Conversation
Turns three of the repo's prose-and-agent-guarded invariants into deterministic regression tests (additive only, zero production code touched): - frontend after-midnight threshold: AFTER_MIDNIGHT_THRESHOLD_HOUR === 6, the derived MINUTES constant stays consistent, and bandUtils.js still imports the constant rather than re-encoding 6 (#550 bug class). - SQLite datetime format: toSqliteDateTime()'s output is space- separated with no T/Z/ms — the exact shape whose T-separator caused the SEC-F1 invite-expiry bypass. Tested through the real checkAuthRateLimit path since the helper isn't exported. - JSON-LD golden snapshot of /event/[slug]: a pinned, deterministic event (fixed created_at so offers.validFrom is reproducible) locks the crawler-facing MusicEvent + BreadcrumbList shape. Any future edit to that block — which churned across #615/#616/#634 this week — now surfaces as a reviewable snapshot diff; the location field Vera hand-caught can no longer silently regress. Intentional changes land via `vitest -u` + snapshot review, never blind. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
BreakableHoodie
added
priority:p3
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Pilot of the "AGENTS.md, but executable" idea: three of the repo's prod-breaking invariants are currently guarded only by prose (CLAUDE.md) + the agent pre-PR hook — both catch new violations in a diff, but neither is a deterministic regression guard. This adds cheap, permanent tests for them. Additive only — zero production code changed (verified:
git diffagainst tracked files is empty; all four files are new).What's guarded
frontend/src/utils/__tests__/invariants.test.jsAFTER_MIDNIGHT_THRESHOLD_HOUR === 6, derived MINUTES stays consistent,bandUtils.jsimports the constant (not a re-encoded6)functions/utils/__tests__/invariants.test.jstoSqliteDateTime()output is space-separated, noT/Z/msT-separator string-compare failure)functions/event/__tests__/slug.jsonld-golden.test.js(+.snap)/event/[slug]MusicEvent + BreadcrumbList JSON-LD shapeThe golden snapshot is the headline. That JSON-LD block churned across #615, #616, and the held #634 in a single week, and Vera hand-caught a missing Google-required
locationfield. The snapshot locks the exact rendered shape (deterministic:created_atpinned sooffers.validFromis reproducible; bands seeded out of sort order to prove the article-strip re-sort governsperformer). Any future edit to that block now surfaces as a reviewable snapshot diff — intentional changes land viavitest -u+ review, never blind.Notes from the build
toSqliteDateTime()isn't exported, so the test reaches it through the realcheckAuthRateLimitbinding path rather than reimplementing it. Faithful, but a direct unit test would be cleaner — filed as chore: export toSqliteDateTime() for direct unit testing #637 (export it).new URL(relative, import.meta.url)gotcha in the frontend test is worked around withfileURLToPath+node:path, documented inline for the next person.Security / correctness notes
None — test-only, additive. The snapshot reflects current
main(no subEvent yet; when #634 merges, its snapshot update is the intentional, reviewed diff).Verification
.snapcommitted, not gitignored; determinism verified across rerunsgit diffon pre-existing tracked files is empty (additive-only proof)Built by Sonny · Reviewed by Theo · 🤖 Claude Code