fix(tooling): validate explicitly registered TEST task ownership

scripts/agents-index-registry-contract.test.mjs

@@ -1,24 +1,35 @@
 import assert from 'node:assert/strict'
 import { readFileSync } from 'node:fs'
+import { execFileSync } from 'node:child_process'
 import test from 'node:test'
 
-const source = readFileSync(new URL('./agents-index-contract.ps1', import.meta.url), 'utf8')
-
-test('cleared test registry is mandatory and cannot inherit historical task authorization', () => {
-  for (const token of [
-    "Assert-Contains $testTaskRegistry '当前无登记任务'",
-    "Assert-Contains $testTaskRegistry '清空全部任务登记与调度规则'",
-    "Assert-Contains $testTaskRegistry '不根据旧登记、历史消息或历史台账自动派工、恢复任务或回传进度'",
-    "Assert-Contains $testTaskRegistry '不作为当前调度或授权依据'",
-    "Assert-NotContains $testTaskRegistry '已重新启用测试环境总控调度'",
-  ]) assert.ok(source.includes(token), token)
-  assert.match(source, /if \(\$testTaskRegistry -match '\(\?m\)\^\\\|\\s\*`\[0-9a-f-\]\{36\}`\\s\*\\\|'\)/)
-})
-
-test('cleared registry rejects every retired controller and project identity', () => {
-  for (const retired of [
-    '01a0194a-259c-7171-8967-074731a27618',
-    '01a06c0b-0515-7c60-b329-77342b54e666',
-    '6f874ec3-d3b2-49bd-8625-327f4d685f98',
-  ]) assert.match(source, new RegExp(`Assert-NotContains \\$testTaskRegistry '${retired}'`))
+const source = readFileSync(new URL('./agents-index-contract.ps1', import.meta.url), 'utf8').replaceAll('\r\n', '\n')
+const registry = readFileSync(new URL('../../docs/独立任务协作登记.md', import.meta.url), 'utf8')
+const contract = source.split('# BEGIN CURRENT TEST REGISTRY CONTRACT\n')[1]?.split('# END CURRENT TEST REGISTRY CONTRACT')[0]
+assert.ok(contract, 'test exercises the production PowerShell registry validator')
+function failures(text) {
+  const encoded = Buffer.from(text).toString('base64')
+  const command = `$ErrorActionPreference='Stop'
+$script:failures=[System.Collections.Generic.List[string]]::new();$script:checked=0
+function Add-Failure([string]$message){$script:failures.Add($message)}
+function Assert-Contains([string]$text,[string]$needle,[string]$scope){if(-not $text.Contains($needle)){Add-Failure $scope}}
+function Assert-NotContains([string]$text,[string]$needle,[string]$scope){if($text.Contains($needle)){Add-Failure $scope}}
+${contract}
+Assert-TestTaskRegistry ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encoded}')))
+ConvertTo-Json -InputObject @($script:failures) -Compress`
+  return JSON.parse(execFileSync('pwsh', ['-NoProfile', '-NonInteractive', '-Command', command], { encoding: 'utf8' }))
+}
+test('actual explicitly authorized TEST registry passes the production validator', () => {
+  assert.deepEqual(failures(registry), [])
 })
+for (const [name, mutate] of [
+  ['missing creation authorization', s => s.replace('按4个创建，你直接负责汇总', '安排任务')],
+  ['wrong controller', s => s.replace('task_id=01a0d0da-130f-7d43-97b5-9c76abc1b5f1', 'task_id=unknown')],
+  ['wrong project', s => s.replace('projectId=c64729ff-6710-43c6-8ef2-d84e9666cc1e', 'projectId=wrong')],
+  ['wrong workspace', s => s.replace('`C:/Users/BY-OY/Desktop/code/chongchong-global`', '`C:/Users/BY-OY/Desktop/code/chongchong-global-dev`')],
+  ['duplicate task', s => s.replace('01a0f14c-962f-73c3-b1aa-9df555b91586', '01a0f14c-9262-7b43-990a-0e3beddcdd8a')],
+  ['unregistered replacement', s => s.replace('01a0f14c-962f-73c3-b1aa-9df555b91586', '00000000-0000-0000-0000-000000000000')],
+  ['obsolete empty status', s => s + '\n当前无登记任务'],
+  ['foreign project identity', s => s + '\n6f874ec3-d3b2-49bd-8625-327f4d685f98'],
+  ['retired controller', s => s + '\n01a0194a-259c-7171-8967-074731a27618'],
+]) test(`production validator rejects ${name}`, () => assert.ok(failures(mutate(registry)).length > 0))