fix(otdf-sdk-mgr): resolve tests repo from CWD in orchestrate run (DSPX-3302)

run_tests_cell previously hardcoded TESTS_REPO = ~/Documents/GitHub/opentdf/tests,
which caused [FAIL] tests: tests repo is on branch 'main', expected '<branch>'
when orchestrate was invoked from a tests worktree (the canonical checkout
typically stays on main while the user works from a worktree on the feature
branch). Now both run_tests_cell and the dry-run path resolve the repo via
git rev-parse --show-toplevel, so orchestrate works from any tests worktree
on the cell branch.

Wrong-branch errors are preserved with a clearer message pointing the user
to run from a tests worktree on the feature branch.

Tests added in test_orchestrate.py mock subprocess to cover both the success
path (CWD-resolved repo pushes + opens draft PR) and the wrong-branch error.

ruff format also normalized several pre-existing wrap points in
cli_orchestrate.py / tests/test_schema_sync.py to fit within line-length=100;
included here so the next commit isn't polluted by them.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: dmihalcik-virtru

otdf-sdk-mgr/src/otdf_sdk_mgr/cli_orchestrate.py

@@ -89,9 +89,7 @@ def load_spec(path: Path) -> FeatureSpec:
             raise ValueError(f"{path}: repos.{key}.depends_on must be a list")
         repo_path = entry.get("path")
         if key != "tests" and not isinstance(repo_path, str):
-            raise ValueError(
-                f"{path}: repos.{key}.path is required for non-tests cells"
-            )
+            raise ValueError(f"{path}: repos.{key}.path is required for non-tests cells")
         cells[key] = Cell(
             key=key,
             path=repo_path,
@@ -120,9 +118,7 @@ def load_spec(path: Path) -> FeatureSpec:
 # ------------------------------------------------------------------ topo sort
 
 
-def topological_waves(
-    cells: dict[str, Cell], *, skip: Iterable[str] = ()
-) -> list[list[Cell]]:
+def topological_waves(cells: dict[str, Cell], *, skip: Iterable[str] = ()) -> list[list[Cell]]:
     """Group cells into dependency waves; cells within a wave are independent.
 
     Skipped cells are treated as already-done (their dependents see them as
@@ -158,7 +154,6 @@ def topological_waves(
 
 OPENTDF_ROOT = Path.home() / "Documents/GitHub/opentdf"
 WORKTREES_ROOT = Path.home() / "Documents/GitHub/worktrees"
-TESTS_REPO = OPENTDF_ROOT / "tests"
 
 
 def worktree_for(spec: FeatureSpec, cell: Cell) -> Path:
@@ -370,10 +365,14 @@ def run_cell(
     transcript = transcripts_dir / f"{spec.jira or spec.name}-{cell.key}.jsonl"
 
     cmd = [
-        "claude", "-p",
-        "--model", model,
-        "--permission-mode", "acceptEdits",
-        "--output-format", "stream-json",
+        "claude",
+        "-p",
+        "--model",
+        model,
+        "--permission-mode",
+        "acceptEdits",
+        "--output-format",
+        "stream-json",
         "--verbose",
         build_prompt(spec, cell),
     ]
@@ -403,13 +402,27 @@ def run_cell(
 def run_tests_cell(spec: FeatureSpec, cell: Cell) -> CellResult:
     """Push the tests branch and open a draft PR without launching a subagent.
 
+    The tests repo is resolved from the orchestrator's CWD via
+    `git rev-parse --show-toplevel` — orchestrate is meant to run from a tests
+    worktree already on the feature branch, not from a hardcoded checkout.
+
     feature-design already wrote the tests-side artifacts; this step makes them
     visible to downstream CI by pushing the branch and opening a PR. Commits
     were made by the user (signed normally), so deferred signing doesn't apply.
     """
-    repo = TESTS_REPO
-    if not repo.is_dir():
-        return CellResult(cell, Path(), Path(), False, None, f"tests repo not found: {repo}")
+    try:
+        repo = Path(
+            subprocess.check_output(["git", "rev-parse", "--show-toplevel"], text=True).strip()
+        )
+    except subprocess.CalledProcessError as e:
+        return CellResult(
+            cell,
+            Path(),
+            Path(),
+            False,
+            None,
+            f"could not resolve current git repo (run from a tests worktree): {e}",
+        )
 
     try:
         current = subprocess.check_output(
@@ -420,9 +433,13 @@ def run_tests_cell(spec: FeatureSpec, cell: Cell) -> CellResult:
 
     if current != cell.branch:
         return CellResult(
-            cell, Path(), Path(), False, None,
-            f"tests repo is on branch '{current}', expected '{cell.branch}' — "
-            "did feature-design run on this branch?",
+            cell,
+            Path(),
+            Path(),
+            False,
+            None,
+            f"current repo {repo} is on branch '{current}', expected '{cell.branch}' — "
+            "run orchestrate from a tests worktree on the feature branch.",
         )
 
     try:
@@ -478,12 +495,8 @@ def run(
         list[str] | None,
         typer.Option("--only", help="Only run these cell keys (repeatable)."),
     ] = None,
-    timeout_s: Annotated[
-        int, typer.Option("--timeout", help="Per-cell timeout (seconds).")
-    ] = 1800,
-    model: Annotated[
-        str, typer.Option("--model", help="Sub-agent model alias.")
-    ] = "sonnet",
+    timeout_s: Annotated[int, typer.Option("--timeout", help="Per-cell timeout (seconds).")] = 1800,
+    model: Annotated[str, typer.Option("--model", help="Sub-agent model alias.")] = "sonnet",
     force: Annotated[
         bool,
         typer.Option("--force", help="Re-run cells even if they already have open PRs."),
@@ -523,11 +536,21 @@ def run(
 
     if dry_run:
         typer.echo(f"Feature: {spec.name} ({spec.jira or 'no Jira'}) — {spec.title}")
+        try:
+            tests_repo: Path | None = Path(
+                subprocess.check_output(["git", "rev-parse", "--show-toplevel"], text=True).strip()
+            )
+        except subprocess.CalledProcessError:
+            tests_repo = None
         for i, wave in enumerate(waves, 1):
             typer.echo(f"  Wave {i}:")
             for cell in wave:
                 if cell.key == "tests":
-                    existing = check_existing_pr(TESTS_REPO, cell.branch)
+                    existing = (
+                        check_existing_pr(tests_repo, cell.branch)
+                        if tests_repo is not None
+                        else None
+                    )
                     pr_note = f" [PR EXISTS: {existing}]" if existing else ""
                     typer.echo(
                         f"    - {cell.key}: path=(tests repo) branch={cell.branch}"
@@ -560,7 +583,8 @@ def _dispatch(c: Cell) -> CellResult:
             if c.key == "tests":
                 return run_tests_cell(spec, c)
             return run_cell(
-                spec, c,
+                spec,
+                c,
                 transcripts_dir=transcripts_dir,
                 timeout_s=timeout_s,
                 model=model,

otdf-sdk-mgr/tests/test_orchestrate.py

@@ -7,12 +7,13 @@
 
 from __future__ import annotations
 
+import subprocess
 from pathlib import Path
 
 import pytest
+from otdf_sdk_mgr import cli_orchestrate
 from otdf_sdk_mgr.cli_orchestrate import (
     Cell,
-    FeatureSpec,
     load_spec,
     topological_waves,
     worktree_for,
@@ -184,3 +185,89 @@ def test_worktree_for_falls_back_to_name_when_no_jira(tmp_path: Path) -> None:
     spec = load_spec(_write_spec(tmp_path, body))
     wt = worktree_for(spec, spec.cells["platform-proto"])
     assert wt.name == "ad_hoc-platform-proto"
+
+
+# ------------------------------------------------------------ run_tests_cell
+#
+# These tests mock subprocess to verify that run_tests_cell resolves the tests
+# repo from the current working directory (via `git rev-parse --show-toplevel`)
+# rather than from a hardcoded path. The orchestrator is invoked from a tests
+# worktree on the feature branch, not from the canonical tests checkout.
+
+
+def test_run_tests_cell_resolves_repo_from_cwd(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    fake_repo = tmp_path / "worktrees" / "TEST-1-tests" / "tests"
+    fake_repo.mkdir(parents=True)
+
+    check_output_calls: list[list[str]] = []
+    check_call_calls: list[list[str]] = []
+    run_calls: list[list[str]] = []
+
+    def fake_check_output(args: list[str], text: bool = False, **kwargs: object) -> str:
+        check_output_calls.append(list(args))
+        if list(args[:3]) == ["git", "rev-parse", "--show-toplevel"]:
+            return f"{fake_repo}\n"
+        if "branch" in args and "--show-current" in args:
+            return "TEST-1-tdd\n"
+        if args[0] == "gh" and "pr" in args and "create" in args:
+            return "Draft PR created: https://github.com/org/repo/pull/42\n"
+        raise AssertionError(f"unexpected check_output args: {args}")
+
+    def fake_check_call(args: list[str], **kwargs: object) -> int:
+        check_call_calls.append(list(args))
+        return 0
+
+    def fake_run(args: list[str], **kwargs: object) -> subprocess.CompletedProcess[str]:
+        run_calls.append(list(args))
+        # gh pr list — return no existing PR.
+        return subprocess.CompletedProcess(args, 0, stdout="", stderr="")
+
+    monkeypatch.setattr(cli_orchestrate.subprocess, "check_output", fake_check_output)
+    monkeypatch.setattr(cli_orchestrate.subprocess, "check_call", fake_check_call)
+    monkeypatch.setattr(cli_orchestrate.subprocess, "run", fake_run)
+
+    spec = load_spec(_write_spec(tmp_path, _minimal_spec_yaml()))
+    result = cli_orchestrate.run_tests_cell(spec, spec.cells["tests"])
+
+    assert result.success is True, f"expected success, got error={result.error}"
+    assert result.pr_url == "https://github.com/org/repo/pull/42"
+
+    # All git/gh interactions must target the CWD-resolved repo, not TESTS_REPO.
+    fake_repo_str = str(fake_repo)
+    branch_check = ["git", "-C", fake_repo_str, "branch", "--show-current"]
+    push = ["git", "-C", fake_repo_str, "push", "-u", "origin", "TEST-1-tdd"]
+    assert branch_check in check_output_calls
+    assert push in check_call_calls
+    # gh subprocess.run / check_output calls run with cwd=fake_repo (not asserted
+    # explicitly — fake_run/fake_check_output don't capture cwd — but the
+    # branch check + push above prove the resolved path flows through).
+
+
+def test_run_tests_cell_errors_on_wrong_branch(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    fake_repo = tmp_path / "opentdf" / "tests"
+    fake_repo.mkdir(parents=True)
+
+    def fake_check_output(args: list[str], text: bool = False, **kwargs: object) -> str:
+        if list(args[:3]) == ["git", "rev-parse", "--show-toplevel"]:
+            return f"{fake_repo}\n"
+        if "branch" in args and "--show-current" in args:
+            return "main\n"
+        raise AssertionError(f"unexpected check_output args: {args}")
+
+    def fail_call(args: list[str], **kwargs: object) -> int:
+        raise AssertionError(f"push must not happen on wrong branch: {args}")
+
+    monkeypatch.setattr(cli_orchestrate.subprocess, "check_output", fake_check_output)
+    monkeypatch.setattr(cli_orchestrate.subprocess, "check_call", fail_call)
+
+    spec = load_spec(_write_spec(tmp_path, _minimal_spec_yaml()))
+    result = cli_orchestrate.run_tests_cell(spec, spec.cells["tests"])
+
+    assert result.success is False
+    assert result.error is not None
+    assert "TEST-1-tdd" in result.error
+    assert "main" in result.error