Window values are net canonical-state change, not gross event counts. Unlike outputs are never summed into a productivity score.
+ ${outcomeEvidence}
Engineering activity non-KPI
diff --git a/tests/vsm-oss-metrics-sync.test.cjs b/tests/vsm-oss-metrics-sync.test.cjs
index 6d0955e..43c2454 100644
--- a/tests/vsm-oss-metrics-sync.test.cjs
+++ b/tests/vsm-oss-metrics-sync.test.cjs
@@ -41,8 +41,35 @@ test('VSM Index renders organization-owned VSM OSS activity without calculating
'opensiro/vsm-harness-skills',
'opensiro/vsm-harness-index',
'opensiro/awesome-vsm-harness',
- 'opensiro/vsm-oss-organization'
+ 'opensiro/vsm-oss-organization',
+ 'opensiro/upstream'
];
+ const upstream = repo('verified_external_outcomes', 2, {
+ '24h': { status: 'source_unavailable_at_baseline', value: null },
+ '7d': { status: 'source_unavailable_at_baseline', value: null },
+ '30d': { status: 'source_unavailable_at_baseline', value: null }
+ });
+ Object.assign(upstream.metrics.verified_external_outcomes, {
+ claim_status: 'verified_merged_changes_only_not_deployed_benefit',
+ completion_gate_evaluated: true,
+ observed_at: '2026-11-11T22:10:01+00:00',
+ owner_source_sha256: 'a'.repeat(64),
+ portfolio_cohort_sha256: 'b'.repeat(64),
+ accepted: [
+ { intervention_id: 'improvement:agent-fleet',
+ external_pr_url: 'https://github.com/chankov/agent-fleet/pull/43',
+ merge_commit_sha: 'c'.repeat(40),
+ native_receipt: 'https://github.com/opensiro/upstream/actions/runs/40093167700',
+ acceptance_basis: 'DETERMINISTIC_VERIFIED_MERGE',
+ decision: 'ACCEPTED_MERGED_CHANGE_ONLY', benefit_claim: 'NOT_MEASURED' },
+ { intervention_id: 'improvement:citadel',
+ external_pr_url: 'https://github.com/SethGammon/Citadel/pull/366',
+ merge_commit_sha: 'd'.repeat(40),
+ native_receipt: 'https://github.com/opensiro/upstream/actions/runs/40039135313',
+ acceptance_basis: 'DETERMINISTIC_VERIFIED_MERGE',
+ decision: 'ACCEPTED_MERGED_CHANGE_ONLY', benefit_claim: 'NOT_MEASURED' }
+ ]
+ });
put(source, JSON.stringify({
schema_version: 2,
collected_at: '2026-09-22T19:00:00Z',
@@ -68,7 +95,8 @@ test('VSM Index renders organization-owned VSM OSS activity without calculating
'24h': { status: 'unclaimed_semantic_evidence', value: null },
'7d': { status: 'unclaimed_semantic_evidence', value: null },
'30d': { status: 'unclaimed_semantic_evidence', value: null }
- }, [65, 295, 295])
+ }, [65, 295, 295]),
+ [scope[5]]: upstream
}
}, null, 2));
@@ -81,6 +109,11 @@ test('VSM Index renders organization-owned VSM OSS activity without calculating
assert.match(page, /vsm-harness-index<\/span>included_assessments<\/small><\/th>| 193<\/td> | \+15<\/td> | \+112<\/td> | \+193<\/td>/);
assert.match(page, /awesome-vsm-harness[\s\S]*? | 0<\/td> | −6<\/td> | \+5<\/td>/);
assert.match(page, /current_formal_construction_milestone[\s\S]*?evidence-gated/);
+ assert.match(page, /href="https:\/\/github.com\/chankov\/agent-fleet\/pull\/43"/);
+ assert.match(page, /href="https:\/\/github.com\/SethGammon\/Citadel\/pull\/366"/);
+ assert.match(page, /2 source-verified merged changes/);
+ assert.match(page, /not deployment or measured user benefit/);
+ assert.match(page, /blob\/main\/docs\/METRICS.md/);
assert.match(page, /Engineering activity non-KPI<\/span>/);
assert.match(page, /commits \/ 24h/);
assert.match(page, /Commit volume is audit\/activity telemetry only/);
@@ -106,3 +139,52 @@ test('renderer rejects snapshots that promote engineering activity to KPI', () =
fs.rmSync(dir, { recursive: true, force: true });
}
});
+
+test('rendered merged-change evidence rejects benefit inflation or mutable receipts', () => {
+ const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'opensiro-upstream-evidence-'));
+ const script = path.join(dir, 'scripts', 'sync-vsm-oss-metrics.cjs');
+ const source = path.join(dir, 'snapshot.json');
+ put(script, fs.readFileSync(path.join(root, 'scripts', 'sync-vsm-oss-metrics.cjs'), 'utf8'));
+ put(path.join(dir, 'vsm-index.html'), '');
+ const row = repo('verified_external_outcomes', 1, {
+ '24h': { status: 'source_unavailable_at_baseline', value: null },
+ '7d': { status: 'source_unavailable_at_baseline', value: null },
+ '30d': { status: 'source_unavailable_at_baseline', value: null }
+ });
+ const claim = row.metrics.verified_external_outcomes;
+ Object.assign(claim, {
+ claim_status: 'verified_merged_changes_only_not_deployed_benefit',
+ completion_gate_evaluated: true, observed_at: '2026-11-11T22:10:01+00:00',
+ owner_source_sha256: 'a'.repeat(64), portfolio_cohort_sha256: 'b'.repeat(64),
+ accepted: [{ intervention_id: 'case:a',
+ external_pr_url: 'https://github.com/chankov/agent-fleet/pull/43',
+ merge_commit_sha: 'c'.repeat(40),
+ native_receipt: 'https://github.com/opensiro/upstream/actions/runs/40093167700',
+ decision: 'ACCEPTED_MERGED_CHANGE_ONLY',
+ acceptance_basis: 'DETERMINISTIC_VERIFIED_MERGE', benefit_claim: 'NOT_MEASURED' }]
+ });
+ const snapshot = { scope: ['opensiro/upstream'],
+ repositories: { 'opensiro/upstream': row },
+ publication: { window_change_semantics: 'net canonical state change, not gross event count',
+ engineering_activity_is_productivity_kpi: false } };
+ const run = () => spawnSync(process.execPath, [script, '--source', source], { cwd: dir, encoding: 'utf8' });
+ try {
+ put(source, JSON.stringify(snapshot));
+ assert.equal(run().status, 0);
+ claim.accepted[0].benefit_claim = 'DEPLOYED';
+ put(source, JSON.stringify(snapshot));
+ assert.notEqual(run().status, 0);
+ assert.match(run().stderr, /Invalid or duplicated Upstream merged-change evidence/);
+ claim.accepted[0].benefit_claim = 'NOT_MEASURED';
+ claim.accepted[0].native_receipt = 'https://github.com/opensiro/upstream/blob/main/test';
+ put(source, JSON.stringify(snapshot));
+ assert.notEqual(run().status, 0);
+ claim.value = null; claim.accepted = [];
+ put(source, JSON.stringify(snapshot));
+ assert.equal(run().status, 0);
+ assert.doesNotMatch(fs.readFileSync(path.join(dir, 'vsm-index.html'), 'utf8'),
+ /source-verified merged changes/);
+ } finally {
+ fs.rmSync(dir, { recursive: true, force: true });
+ }
+});
|