Appearance
Testing
Executable verification tiers for repository changes; final publication, deployment, and controlled-host evidence remain release operations.
| Tier | Command or source | Use |
|---|---|---|
| Required local chain | npm run verify | Ordered deterministic repository gates |
| Focused checks | Root and workspace npm scripts | Fast feedback in the affected blast radius |
| CI matrix | .github/workflows/ci.yml | Maintained Linux, macOS, Windows, browser, consumer, package, and API checks |
| Controlled host | npm run test:e2e:performance plus focused Node gates | Attributable hard-performance evidence |
| Manual live harnesses | Four opt-in TypeScript scripts | Provider behavior with local credentials and retention controls |
Ordered verify chain
npm run verify executes these eighteen gates in order. Run a focused owner gate while iterating, then use the full chain when the change or release stage requires it.
| Order | Command | Contract |
|---|---|---|
| 1 | npm run check:toolchain | Exact release Node and npm |
| 2 | npm run check:verification-map | Requirement-to-evidence structure |
| 3 | npm run check:workflow-policy | CI, release, dependency, and Action policy |
| 4 | npm run test:session-start-hook | Optional hook behavior and safety |
| 5 | npm run test:clean | Bounded cleanup behavior |
| 6 | npm run test:pwa | PWA build and worker contracts |
| 7 | npm run test:static | Static artifact unit contracts |
| 8 | npm run test:static:integration | Combined static integration |
| 9 | npm run test:canvas-creation-contract | Command-driven creation contract |
| 10 | npm run lint | JavaScript and TypeScript lint |
| 11 | npm run lint:md | Repository Markdown profiles |
| 12 | npm run test:markdownlint | Custom Markdown rule tests |
| 13 | npm run check:docs | User, library, contributor, and link checks |
| 14 | npm run typecheck | Workspace type contracts |
| 15 | npm run build | Ordered production builds |
| 16 | npm test | Workspace test suites |
| 17 | npm run test:release-version | Atomic release version checks |
| 18 | npm run test:release-closure | Release-closure invariants |
GraphIR 2 release dependency
The release branch pins published @graph-ir/core@0.2.1 exactly in all four direct manifests and the lockfile. This is the registry-backed GraphIR 2 contract used by build, test, package, and consumer evidence. Do not substitute a no-save dependency, local path, sibling checkout, or unpublished archive. Slice 80 retains final provenance/equivalence and release-identity verification.
Focused and release-adjacent gates
| Command | Use |
|---|---|
npm run test:e2e | Chromium end-to-end behavior after a production build |
npm run test:e2e:performance | Controlled-host drag and zoom budgets |
npm run test:coverage:gate | Enforced viz, MCP, and editor coverage floors |
npm run audit:fragments | Non-blocking source and dependency fragment candidates |
npm run smoke:consumer | Packed blank-consumer runtime and type behavior |
npm run api-compat | API baseline tests, package builds, and exported-surface checks |
npm run smoke:native | Packed native grammar build and load |
Package-level test scripts are appropriate while resolving a focused finding. Run broader gates when changes cross workspace or product boundaries.
CI jobs
CI runs on push and pull requests. Its current jobs are:
| Job | Responsibility |
|---|---|
static-delivery | Static unit and integration checks |
verify | Full chain, coverage, audit, package, consumer, and docs checks |
api-compat | Public API baseline and package compatibility |
minimum-runtime-consumer | Node.js 24.19.0 consumers of Node 26 artifacts |
react-18-consumer | React 18 peer compatibility |
react-19-consumer | React 19 peer compatibility |
e2e | Built Chromium end-to-end behavior |
native-smoke | Linux x64, macOS arm64, and Windows x64 native packages |
windows-verify-and-package-smoke | Windows full chain and consumer smoke |
Performance evidence
Hard performance gates run once with zero retries on the attributable controlled host. GitHub-hosted shared runners are non-authoritative for hard timing; their results are functional evidence only. Use the retained performance budgets for fixtures, limits, and the current evidence boundary.
LLM harness boundary
Deterministic unit and corpus tests use synthetic fixtures and fake provider behavior. They require no network or key. The manual surfaces below are outside CI and npm run verify and require explicit authorization before any live provider call.
The no-key behavior is verified without invoking a provider or running an application build: npm test -w @coral-viz/diagram-editor -- --run test/llm/accuracy-harness.test.ts -t 'no configured API key'.
| Script | Credential names | Output and retention |
|---|---|---|
accuracy-harness.ts | ANTHROPIC_API_KEY, OPENAI_API_KEY, GOOGLE_API_KEY, MISTRAL_API_KEY | Timestamped scorecards and candidates under gitignored accuracy-harness-output/; delete after review |
test-live.ts | LLM_API_KEY | Results to stdout only |
test-e2e.ts | LLM_API_KEY | Results to stdout only |
test-mermaid-adjust.ts | LLM_API_KEY | Fixed prompt, converted source, and result to stdout only |
Live or user-derived prompts, responses, scorecards, terminal captures, and keys stay local and are never committed. There is no production telemetry from these contributor harnesses.