test(idris2): port 7 TS test files to Idris2 (estate port 11/11 — FINAL) (#56)

## Summary

**Estate port 11/11 — final.** Converts the 7 TS test files in
\`tests/{unit,contract,aspect,property,smoke,e2e,bench}_test.ts\` to
Idris2 under the cladistic \`Test.Spec\` harness used by
[ipfs-overlay](https://github.com/hyperpolymath/ipfs-overlay),
[betlang](https://github.com/hyperpolymath/betlang),
[stapeln](https://github.com/hyperpolymath/stapeln),
[zerotier-k8s-link](https://github.com/hyperpolymath/zerotier-k8s-link),
[thunderbird-template-reloaded](https://github.com/hyperpolymath/thunderbird-template-reloaded),
etc.

Originally tagged for bucket-2 (per-repo strategy review) — collapsed to
bucket-1 (content-validation + pure-logic) after a single inspection.

## What ported

| Module | Tests | Shape |
|---|---:|---|
| UnitTest | 20 | content-validation + pure-logic helpers |
| ContractTest | 21 | content-validation |
| AspectTest | 28 | content-validation (iterated TS loops expanded) |
| PropertyTest | 16 | content-validation |
| SmokeTest | 46 | content-validation |
| E2ETest | 23 | content-validation |
| BenchTest | 11 | functional pre-conditions only (no timing) |
| **Total** | **165** | |

## Source bug fixed in this PR

\`tests/property_test.ts:163-167\` iterates over \`contractileFiles =
[Dustfile, Mustfile, Intentfile]\`. Only \`contractiles/dust/Dustfile\`
and \`contractiles/must/Mustfile\` existed;
**\`contractiles/lust/Intentfile\` was a missing scaffold companion** to
the Dust (recovery) and Must (invariants) legs. The TS test would have
failed against the prior repo state too.

Fix: created \`contractiles/lust/Intentfile\` with the intent-contract
template shape, mirroring the structure of its Mustfile sibling. **Same
scaffold gap was observed and fixed in thunderbird-template-reloaded
#63** — likely a template-leak from a shared scaffold generator.

## Test plan

- [x] Local: \`idris2 --build universal-chat-extractor-tests.ipkg\`
clean compile
- [x] Local: \`./build/exec/universal-chat-extractor-tests\` — **165 /
165 PASS**
- [ ] CI: dogfood-gate workflow picks up the new ipkg file

## Build gotchas pinned

- \`mod n 60\` on \`Nat\` requires an \`Integral Nat\` instance that
Prelude doesn't provide. Defined explicit \`modNat60\` that recurses by
subtraction.
- \`BenchTest\` needed \`import Data.Maybe\` for \`isJust\` (Prelude
doesn't re-export it in 0.8.0).

## Estate-rollout status

This PR completes **11/11 estate ports**. The bimodal rollout campaign
closes here.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

contractiles/lust/Intentfile

@@ -0,0 +1,29 @@
+# SPDX-License-Identifier: PLMP-1.0-or-later
+# Intentfile - declarative intent contract (template)
+# Sibling of contractiles/must/Mustfile (invariants) and
+# contractiles/dust/Dustfile (recovery). Captures the *desired*
+# end-state of the system separately from its invariants and
+# rollback hooks.
+
+version: 1
+
+metadata:
+  name: project-intent-contract
+  spec: v0.0.1
+  description: "Declarative end-state intent for the project."
+
+intents:
+  - name: dependencies-resolved
+    description: "All declared runtime dependencies must be locatable on PATH or via Guix."
+    desired: "deno --version && pkg-config --version"
+    rationale: "A missing dep at deploy time degrades to a non-recoverable error."
+
+  - name: scaffolding-complete
+    description: "Templating scaffold renders without unresolved placeholders."
+    desired: "grep -RE '\\{\\{\\s*[A-Z_]+\\s*\\}\\}' templates/ | wc -l | grep -q '^0$'"
+    rationale: "Unrendered placeholders ship broken templates to downstream users."
+
+  - name: license-headers-present
+    description: "Every source file carries an SPDX header."
+    desired: "scripts/check-spdx.sh"
+    rationale: "Estate-wide compliance posture (Hyperpolymath standard)."

tests/idris2/AspectTest.idr

@@ -0,0 +1,199 @@
+-- SPDX-License-Identifier: PMPL-1.0-or-later
+-- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+--
+-- Port of tests/aspect_test.ts to Idris2, estate-rollout port 11/11.
+-- 21 of 21 cross-cutting aspect tests ported. Each iterated check (BANNED_FILES,
+-- DOCS, the tests/ directory walk) becomes one Idris2 test case to preserve
+-- granular per-name reporting.
+--
+-- The TS regex for secret-leak detection in README is replaced by literal
+-- substring checks against `api_key=`, `password=`, `secret=`, `token=`
+-- (case-insensitive); the equivalence is exact within ASCII.
+
+module AspectTest
+
+import Test.Spec
+import Data.String
+import System.File
+
+%default covering
+
+readFileToString : String -> IO String
+readFileToString path = do
+  Right contents <- readFile path
+    | Left _ => pure ""
+  pure contents
+
+fileExists : String -> IO Bool
+fileExists path = do
+  Right _ <- readFile path
+    | Left _ => pure False
+  pure True
+
+toLowerC : Char -> Char
+toLowerC c =
+  if c >= 'A' && c <= 'Z'
+    then chr (ord c + 32)
+    else c
+
+asciiLower : String -> String
+asciiLower s = pack (map toLowerC (unpack s))
+
+||| True iff `content` (case-insensitively) contains any of the listed
+||| secret-leak patterns of the form `<name>=`.
+hasSecretLeak : String -> Bool
+hasSecretLeak content =
+  let lc = asciiLower content in
+  isInfixOf "api_key=" lc || isInfixOf "api_key =" lc ||
+  isInfixOf "password=" lc || isInfixOf "password =" lc ||
+  isInfixOf "secret=" lc || isInfixOf "secret =" lc ||
+  isInfixOf "token=" lc || isInfixOf "token =" lc
+
+public export
+allSuites : List TestCase
+allSuites =
+  [ -- ---------- Security policy ----------
+
+    test "aspect/security: SECURITY.md exists" $ do
+      ok <- fileExists "SECURITY.md"
+      assertTrue "SECURITY.md present" ok
+
+  , test "aspect/security: SECURITY.md mentions vulnerability reporting" $ do
+      content <- readFileToString "SECURITY.md"
+      let lc = asciiLower content
+      let hasDisclosure =
+            isInfixOf "vulnerabilit" lc || isInfixOf "disclosure" lc ||
+            isInfixOf "report" lc       || isInfixOf "security" lc
+      allPass
+        [ assertTrue "SECURITY.md present" (content /= "")
+        , assertTrue "SECURITY.md mentions security reporting" hasDisclosure
+        ]
+
+  , test "aspect/security: .well-known/security.txt exists" $ do
+      ok <- fileExists ".well-known/security.txt"
+      assertTrue ".well-known/security.txt present" ok
+
+  , test "aspect/security: no .env files in repo" $ do
+      ok <- fileExists ".env"
+      assertTrue ".env must not be committed" (not ok)
+
+  , test "aspect/security: no hardcoded secret patterns in README" $ do
+      content <- readFileToString "README.adoc"
+      allPass
+        [ assertTrue "README.adoc present" (content /= "")
+        , assertTrue "README.adoc has no hardcoded secrets"
+            (not (hasSecretLeak content))
+        ]
+
+    -- ---------- Code of conduct ----------
+
+  , test "aspect/community: CODE_OF_CONDUCT.md exists" $ do
+      ok <- fileExists "CODE_OF_CONDUCT.md"
+      assertTrue "CODE_OF_CONDUCT.md present" ok
+
+  , test "aspect/community: CODE_OF_CONDUCT.md has meaningful content" $ do
+      content <- readFileToString "CODE_OF_CONDUCT.md"
+      assertTrue "CODE_OF_CONDUCT.md > 100 chars" (length content > 100)
+
+    -- ---------- EditorConfig consistency ----------
+
+  , test "aspect/formatting: .editorconfig exists" $ do
+      ok <- fileExists ".editorconfig"
+      assertTrue ".editorconfig present" ok
+
+  , test "aspect/formatting: .editorconfig has root = true" $ do
+      content <- readFileToString ".editorconfig"
+      let lc = asciiLower content
+      allPass
+        [ assertTrue ".editorconfig present" (content /= "")
+        , assertTrue ".editorconfig declares root = true"
+            (isInfixOf "root = true" lc || isInfixOf "root=true" lc)
+        ]
+
+  , test "aspect/formatting: .editorconfig defines indent_style" $ do
+      content <- readFileToString ".editorconfig"
+      assertTrue "indent_style present" (isInfixOf "indent_style" content)
+
+    -- ---------- No banned file patterns ----------
+    -- TS iterates over a list; we expand to one test per name for clearer reports.
+
+  , test "aspect/policy: banned file must not exist - package.json" $ do
+      ok <- fileExists "package.json"
+      assertTrue "package.json must not exist" (not ok)
+
+  , test "aspect/policy: banned file must not exist - package-lock.json" $ do
+      ok <- fileExists "package-lock.json"
+      assertTrue "package-lock.json must not exist" (not ok)
+
+  , test "aspect/policy: banned file must not exist - yarn.lock" $ do
+      ok <- fileExists "yarn.lock"
+      assertTrue "yarn.lock must not exist" (not ok)
+
+  , test "aspect/policy: banned file must not exist - bun.lockb" $ do
+      ok <- fileExists "bun.lockb"
+      assertTrue "bun.lockb must not exist" (not ok)
+
+  , test "aspect/policy: banned file must not exist - node_modules" $ do
+      ok <- fileExists "node_modules"
+      assertTrue "node_modules must not exist" (not ok)
+
+  , test "aspect/policy: banned file must not exist - .npmrc" $ do
+      ok <- fileExists ".npmrc"
+      assertTrue ".npmrc must not exist" (not ok)
+
+  , test "aspect/policy: banned file must not exist - Dockerfile" $ do
+      ok <- fileExists "Dockerfile"
+      assertTrue "Dockerfile must not exist (use Containerfile)" (not ok)
+
+    -- ---------- No tsconfig.json ----------
+
+  , test "aspect/language: no tsconfig.json (TS only via Deno, not tsc)" $ do
+      ok <- fileExists "tsconfig.json"
+      assertTrue "tsconfig.json must not exist" (not ok)
+
+    -- ---------- Documentation completeness ----------
+
+  , test "aspect/docs: documentation file is non-empty - README.adoc" $ do
+      content <- readFileToString "README.adoc"
+      assertTrue "README.adoc > 50 chars" (length content > 50)
+
+  , test "aspect/docs: documentation file is non-empty - EXPLAINME.adoc" $ do
+      content <- readFileToString "EXPLAINME.adoc"
+      assertTrue "EXPLAINME.adoc > 50 chars" (length content > 50)
+
+  , test "aspect/docs: documentation file is non-empty - CONTRIBUTING.md" $ do
+      content <- readFileToString "CONTRIBUTING.md"
+      assertTrue "CONTRIBUTING.md > 50 chars" (length content > 50)
+
+  , test "aspect/docs: documentation file is non-empty - ROADMAP.adoc" $ do
+      content <- readFileToString "ROADMAP.adoc"
+      assertTrue "ROADMAP.adoc > 50 chars" (length content > 50)
+
+    -- ---------- All non-bench test files use Deno.test ----------
+    -- The TS walks the tests/ dir; we enumerate explicitly. bench_test.ts is
+    -- excluded per the TS predicate.
+
+  , test "aspect/tests: tests/unit_test.ts uses Deno.test" $ do
+      content <- readFileToString "tests/unit_test.ts"
+      assertTrue "Deno.test( present" (isInfixOf "Deno.test(" content)
+
+  , test "aspect/tests: tests/contract_test.ts uses Deno.test" $ do
+      content <- readFileToString "tests/contract_test.ts"
+      assertTrue "Deno.test( present" (isInfixOf "Deno.test(" content)
+
+  , test "aspect/tests: tests/aspect_test.ts uses Deno.test" $ do
+      content <- readFileToString "tests/aspect_test.ts"
+      assertTrue "Deno.test( present" (isInfixOf "Deno.test(" content)
+
+  , test "aspect/tests: tests/property_test.ts uses Deno.test" $ do
+      content <- readFileToString "tests/property_test.ts"
+      assertTrue "Deno.test( present" (isInfixOf "Deno.test(" content)
+
+  , test "aspect/tests: tests/smoke_test.ts uses Deno.test" $ do
+      content <- readFileToString "tests/smoke_test.ts"
+      assertTrue "Deno.test( present" (isInfixOf "Deno.test(" content)
+
+  , test "aspect/tests: tests/e2e_test.ts uses Deno.test" $ do
+      content <- readFileToString "tests/e2e_test.ts"
+      assertTrue "Deno.test( present" (isInfixOf "Deno.test(" content)
+  ]