Janady13/missionmatch / internal/integration/graph_loop_integration_test.go

1//go:build integration 2 3package integration 4 5import ( 6 "context" 7 "strconv" 8 "strings" 9 "testing" 10 "time" 11 12 "github.com/google/uuid" 13 "github.com/jackc/pgx/v5" 14 15 "github.com/missionworkforce/missionmatch/internal/modules/ai" 16 "github.com/missionworkforce/missionmatch/internal/platform/audit" 17) 18 19// seedRequirementForCapture creates a requirement at a given agency and required level for one org, linked to 20// a tenant opportunity whose federal_ref points at a global opportunity_records row carrying the naics, so the 21// G6 segment resolver binds BOTH the agency (from customer_agency) and the naics (from the linked 22// opportunity record). It uses the migrator so the seed crosses tenants for the RLS posture, and returns the 23// requirement id. The opportunity record carries the naics only; the market award structure is seeded 24// separately under the same agency. 25func seedRequirementForCapture(t *testing.T, org uuid.UUID, agency, level, naics, run string) uuid.UUID { 26 t.Helper() 27 ctx := context.Background() 28 29 // The global opportunity_records row that carries the naics, linked from the tenant opportunity by 30 // federal_ref = source_record_id. It is the only honest place the segment naics comes from. 31 federalRef := "G6-OPPREC-" + run 32 if _, err := migrator.Exec(ctx, 33 `INSERT INTO opportunity_records 34 (source_name, source_record_id, dedupe_key, record_kind, title, agency, naics, fetched_at) 35 VALUES ('SAM.gov', $1, $2, 'active_solicitation', 'Capture loop opportunity', $3, $4, now()) 36 ON CONFLICT (source_name, source_record_id) DO NOTHING`, 37 federalRef, "G6-DEDUPE-"+run, agency, naics); err != nil { 38 t.Fatalf("seed opportunity record: %v", err) 39 } 40 41 // The tenant opportunity, linked to the global record by federal_ref, carrying the customer agency. 42 var oppID uuid.UUID 43 if err := migrator.QueryRow(ctx, 44 `INSERT INTO opportunities (organization_id, name, customer_agency, federal_ref) 45 VALUES ($1, 'Capture loop opportunity', $2, $3) RETURNING id`, 46 org, agency, federalRef).Scan(&oppID); err != nil { 47 t.Fatalf("seed opportunity: %v", err) 48 } 49 50 // The requirement, linked to the opportunity (composite FK) and carrying the customer agency and level. 51 var reqID uuid.UUID 52 if err := migrator.QueryRow(ctx, 53 `INSERT INTO requirements (organization_id, opportunity_id, title, customer_agency, required_level, required_poly) 54 VALUES ($1, $2, 'Capture loop requirement', $3, $4, 'none') RETURNING id`, 55 org, oppID, agency, level).Scan(&reqID); err != nil { 56 t.Fatalf("seed requirement: %v", err) 57 } 58 return reqID 59} 60 61// TestG6CapturePictureClosesTheLoop is the live keystone proof of G6: it composes the SUPPRESSED bench legs 62// (the structural gap and clearance coverage), the PUBLIC market context (the recompete clock and incumbent 63// field for the requirement's agency and naics), and the price to win honest floor into one integrated 64// capture answer for a requirement, all on the graph route, auth gated, suppressed, and counts only audited, 65// and it NEVER computes a match score. It seeds a bench that exercises both sides of the structural gap (at 66// least k meet AND at least k do not, so a published answer is readable) and a market segment with award 67// structure under the requirement's agency. 68func TestG6CapturePictureClosesTheLoop(t *testing.T) { 69 org := seedOrg(t) 70 k := ai.ConfiguredSuppressionThreshold() 71 run := uuid.NewString()[:8] 72 agency := "DEPT OF THE AIR FORCE " + run // unique per run so the market segment is isolated 73 naics := "541512" 74 75 req := seedRequirementForCapture(t, org, agency, "secret", naics, run) 76 77 // A mandatory required skill so the structural gap's skill arm is meaningful: a meets candidate holds it, 78 // a does not meet candidate fails on clearance. 79 skill := seedSkillByName(t, "CaptureSkill-"+run) 80 seedRequiredSkill(t, org, req, skill, true) 81 82 // MEETS: k candidates hold the required clearance (secret, rank at or above the required secret) AND the 83 // required skill, so they meet the structural coverage test. DOES NOT MEET: k candidates hold none (rank 84 // below secret), so they fail the clearance arm. Both buckets are at or above k, so the gap publishes real 85 // counts and the clearance coverage publishes the secret and none levels. 86 for i := 0; i < k; i++ { 87 c := seedCandidate(t, org, "secret", "active", true) 88 seedCandidateSkill(t, org, c.ID, skill) 89 } 90 for i := 0; i < k; i++ { 91 seedCandidate(t, org, "none", "active", true) 92 } 93 94 // The market segment: an award ending inside the recompete window under the requirement's agency and naics, 95 // so the public recompete clock and the incumbent and competitor field both have structure to report. 96 insideWindow := time.Now().UTC().AddDate(0, 6, 0) 97 recent := time.Now().UTC().AddDate(0, -3, 0) 98 seedMarketAward(t, "G6-INC-"+run, "PIID-G6-IN", agency, naics, "UEIINCUMBENT6", "Capture Incumbent LLC", "6000000.00", insideWindow, false) 99 seedMarketAward(t, "G6-CF-"+run, "PIID-G6-CF", agency, naics, "UEICHALLENG62", "Capture Challenger LLC", "2000000.00", recent, false) 100 101 orch := ai.NewOrchestrator(appDB, nil, audit.New(appDB)) 102 resp, err := orch.Answer(ctxOrg(org), "", ai.IntentCapturePictureForRequirement, []any{req.String()}) 103 if err != nil { 104 t.Fatalf("capture picture answer: %v", err) 105 } 106 107 // (a) The answer carries the graph route and is not refused for an authenticated tenant. 108 if resp.Refused { 109 t.Fatalf("an authenticated capture question must not be refused, got %+v", resp) 110 } 111 if resp.Route != ai.RouteGraph { 112 t.Errorf("the capture composition must dispatch to the graph route, got %q", resp.Route) 113 } 114 115 // (b) The bench fit reports suppression safe counts: both gap buckets are at or above k, so the real meets 116 // and does not meet counts publish (the exact seeded k for each). 117 if !strings.Contains(resp.Answer, "meets="+strconv.Itoa(k)) { 118 t.Errorf("the bench fit must publish the exact meets count when both sides are at or above k, got %q", resp.Answer) 119 } 120 if !strings.Contains(resp.Answer, "does_not_meet="+strconv.Itoa(k)) { 121 t.Errorf("the bench fit must publish the exact does not meet count when both sides are at or above k, got %q", resp.Answer) 122 } 123 // The clearance coverage publishes the secret and none levels (each at or above k), suppressed safe. 124 if !strings.Contains(resp.Answer, "secret=") || !strings.Contains(resp.Answer, "none=") { 125 t.Errorf("the clearance coverage must report the held levels, got %q", resp.Answer) 126 } 127 128 // (c) The market context names the seeded agency in the recompete or incumbent line. 129 if !strings.Contains(resp.Answer, agency) { 130 t.Errorf("the market context must name the seeded agency, got %q", resp.Answer) 131 } 132 if !strings.Contains(resp.Answer, "recompete clock") { 133 t.Errorf("the market context must carry the recompete clock line for the agency, got %q", resp.Answer) 134 } 135 136 // (d) The price to win honest floor is present and no rate is fabricated. 137 if !strings.Contains(resp.Answer, "labor rate data not yet ingested") { 138 t.Errorf("the answer must state the price to win honest floor, got %q", resp.Answer) 139 } 140 141 // The frozen engine path is never invoked. The bench fit carries the honest disclaimer "not a match 142 // score" (so that bare phrase is expected and required); a real leak is an engine score VALUE, a 143 // total_score or a band value, which must never appear. 144 if !strings.Contains(strings.ToLower(resp.Answer), "not a match score") { 145 t.Errorf("the bench fit must carry the honest not a match score disclaimer, got %q", resp.Answer) 146 } 147 for _, scoreWord := range []string{"total_score", "band="} { 148 if strings.Contains(strings.ToLower(resp.Answer), scoreWord) { 149 t.Errorf("the capture answer must report no engine score, leaked %q in %q", scoreWord, resp.Answer) 150 } 151 } 152 153 // (f) The counts only audit holds no candidate id, no raw sub k count, and no requirement id. 154 var payloads []string 155 if err := appDB.RunInTenantTx(ctxOrg(org), func(ctx context.Context, tx pgx.Tx) error { 156 rows, qerr := tx.Query(ctx, 157 "SELECT new_values::text FROM audit_logs WHERE organization_id=$1 AND action='aedt.ai.capture_answered'", org) 158 if qerr != nil { 159 return qerr 160 } 161 defer rows.Close() 162 for rows.Next() { 163 var p string 164 if serr := rows.Scan(&p); serr != nil { 165 return serr 166 } 167 payloads = append(payloads, p) 168 } 169 return rows.Err() 170 }); err != nil { 171 t.Fatalf("read capture audit: %v", err) 172 } 173 if len(payloads) == 0 { 174 t.Fatal("a capture answer must emit an aedt.ai.capture_answered audit event") 175 } 176 for _, p := range payloads { 177 if !strings.Contains(p, "capture_picture_for_requirement") || !strings.Contains(p, "segment_bound") { 178 t.Errorf("the capture audit must record the intent and whether the segment bound, got %q", p) 179 } 180 // NO requirement id, NO candidate id, NO raw count in the audit payload. 181 if strings.Contains(p, req.String()) { 182 t.Errorf("the capture audit must hold no requirement id, leaked it in %q", p) 183 } 184 for _, leak := range []string{"candidate", "requirement_id", "answer"} { 185 if strings.Contains(p, leak) { 186 t.Errorf("the capture audit must hold no candidate id, requirement id, or answer text, leaked %q in %q", leak, p) 187 } 188 } 189 } 190} 191 192// TestG6CaptureRefusesWithoutTenantContext proves the auth gate on the composed capture intent: with NO 193// authenticated tenant context it refuses (route graph, no answer) rather than running a person touching read, 194// instead of relying only on the RLS empty result fail safe. 195func TestG6CaptureRefusesWithoutTenantContext(t *testing.T) { 196 orch := ai.NewOrchestrator(appDB, nil, audit.New(appDB)) 197 resp, err := orch.Answer(context.Background(), "", ai.IntentCapturePictureForRequirement, []any{uuid.NewString()}) 198 if err != nil { 199 t.Fatalf("an unauthenticated capture question must refuse cleanly, got error %v", err) 200 } 201 if !resp.Refused { 202 t.Fatalf("an unauthenticated capture question must be refused, got %+v", resp) 203 } 204 if resp.Route != ai.RouteGraph { 205 t.Errorf("the refusal must carry route graph, got %q", resp.Route) 206 } 207 if resp.Answer != "" { 208 t.Errorf("a refusal must ship no answer, got %q", resp.Answer) 209 } 210} 211 212// TestG6CaptureRejectsRawIntentPath proves the defense in depth guard: the generic ExecuteIntent (the raw path 213// that returns database rows verbatim) hard rejects the composed capture intent because it is a bench intent, 214// so the composition is the only way to run it and an unsuppressed bench count can never be served on the raw 215// path even if a future caller tried it. 216func TestG6CaptureRejectsRawIntentPath(t *testing.T) { 217 intent, ok := ai.IntentByName(ai.IntentCapturePictureForRequirement) 218 if !ok { 219 t.Fatalf("the capture intent %q must be registered", ai.IntentCapturePictureForRequirement) 220 } 221 _, err := ai.ExecuteIntent(ctxOrg(seedOrg(t)), appDB, intent, []any{uuid.NewString()}) 222 if err == nil { 223 t.Fatalf("ExecuteIntent must reject the capture intent on the raw path, got nil error") 224 } 225 if !strings.Contains(err.Error(), "suppressing executor") { 226 t.Errorf("the raw path rejection of the capture intent must name the suppressing executor, got %v", err) 227 } 228} 229 230// TestG6CaptureUnbindableSegmentStatesTheFloor proves the honest floor: a requirement with no customer agency 231// and no linked opportunity resolves no market segment, so the composition states that plainly and calls no 232// market executor with empty args, while the bench legs and the price floor still answer. The audit records 233// segment_bound false. 234func TestG6CaptureUnbindableSegmentStatesTheFloor(t *testing.T) { 235 org := seedOrg(t) 236 k := ai.ConfiguredSuppressionThreshold() 237 238 // A requirement with no customer agency and no opportunity link: the segment cannot bind. 239 req := seedRequirementWithLevel(t, org, "secret") 240 241 // A small bench so the legs run; both gap buckets may suppress, which is fine, the floor still answers. 242 for i := 0; i < k; i++ { 243 seedCandidate(t, org, "secret", "active", true) 244 } 245 246 orch := ai.NewOrchestrator(appDB, nil, audit.New(appDB)) 247 resp, err := orch.Answer(ctxOrg(org), "", ai.IntentCapturePictureForRequirement, []any{req.String()}) 248 if err != nil { 249 t.Fatalf("capture picture answer: %v", err) 250 } 251 if resp.Refused || resp.Route != ai.RouteGraph { 252 t.Fatalf("a bound tenant capture question must answer on the graph route, got %+v", resp) 253 } 254 if !strings.Contains(resp.Answer, "market segment could not be bound") { 255 t.Errorf("an unbindable segment must state the honest floor plainly, got %q", resp.Answer) 256 } 257 if !strings.Contains(resp.Answer, "labor rate data not yet ingested") { 258 t.Errorf("the price to win honest floor must still be present, got %q", resp.Answer) 259 } 260 261 // The audit records segment_bound false for the unbindable segment. 262 var sawFalse bool 263 if err := appDB.RunInTenantTx(ctxOrg(org), func(ctx context.Context, tx pgx.Tx) error { 264 rows, qerr := tx.Query(ctx, 265 "SELECT new_values::text FROM audit_logs WHERE organization_id=$1 AND action='aedt.ai.capture_answered'", org) 266 if qerr != nil { 267 return qerr 268 } 269 defer rows.Close() 270 for rows.Next() { 271 var p string 272 if serr := rows.Scan(&p); serr != nil { 273 return serr 274 } 275 // Postgres renders jsonb to text with a space after the colon, so match that form. 276 if strings.Contains(p, "\"segment_bound\": false") { 277 sawFalse = true 278 } 279 } 280 return rows.Err() 281 }); err != nil { 282 t.Fatalf("read capture audit: %v", err) 283 } 284 if !sawFalse { 285 t.Error("the capture audit must record segment_bound false for an unbindable segment") 286 } 287} 288