Merge pull request #119 from automatiabcn/fix/audit-r4-honest-stat-graph-query-tamper

fix(panel): repair broken NL→Cypher, dead tamper warning, fake agent stat

Author: enzoemir1

core/landing/__tests__/AuditR4HonestFixes.test.tsx

@@ -0,0 +1,113 @@
+import { describe, expect, it, vi, beforeEach, afterEach } from "vitest";
+import { configure, fireEvent, render, screen, waitFor } from "@testing-library/react";
+
+import GraphPage from "@/app/admin/graph/page";
+import DashboardPage from "@/app/admin/dashboard/page";
+import AgentsPage from "@/app/panel/agents/page";
+
+configure({ testIdAttribute: "data-test" });
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+  vi.restoreAllMocks();
+});
+
+// ── Finding #2: graph NL→Cypher sent the wrong request key ───────────────────
+// Frontend POSTed { question } but the backend NLQueryRequest requires `intent`,
+// so every "Cypher üret" click returned HTTP 422 and the feature never worked.
+describe("Graph NL→Cypher — request key matches backend contract", () => {
+  it("POSTs { intent } (not { question }) to /v1/graph/nl-query", async () => {
+    const cap: { body?: string } = {};
+    vi.stubGlobal(
+      "fetch",
+      vi.fn((url: string | URL | Request, init?: RequestInit) => {
+        const u = String(url);
+        if (u.includes("/v1/graph/nl-query")) {
+          cap.body = String(init?.body ?? "");
+          return Promise.resolve(
+            new Response(JSON.stringify({ cypher: "MATCH (n) RETURN n LIMIT 1" }), {
+              status: 200,
+            }),
+          );
+        }
+        // schema fetch on mount
+        return Promise.resolve(
+          new Response(JSON.stringify({ node_labels: [], relationship_types: [] }), {
+            status: 200,
+          }),
+        );
+      }),
+    );
+
+    render(<GraphPage />);
+    fireEvent.change(await screen.findByTestId("graph-nl-input"), {
+      target: { value: "Acme çalışanları" },
+    });
+    fireEvent.click(screen.getByTestId("graph-nl-run"));
+
+    await waitFor(() => expect(cap.body).toBeTruthy());
+    const parsed = JSON.parse(cap.body!);
+    expect(parsed.intent).toBe("Acme çalışanları");
+    expect(parsed.question).toBeUndefined();
+  });
+});
+
+// ── Finding #3: tamper warning was dead code ─────────────────────────────────
+// Backend emits audit_chain_integrity as the string "ok" | "tampered"; the panel
+// tested `=== false`, which a string can never satisfy, so the warning never fired.
+describe("Dashboard — audit chain tamper warning fires on a string status", () => {
+  function mockDashboard(integrity: "ok" | "tampered") {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(() =>
+        Promise.resolve(
+          new Response(
+            JSON.stringify({ vault: { total_entries: 5, audit_chain_integrity: integrity } }),
+            { status: 200 },
+          ),
+        ),
+      ),
+    );
+  }
+
+  it("shows the tamper warning when integrity is 'tampered'", async () => {
+    mockDashboard("tampered");
+    render(<DashboardPage />);
+    expect(await screen.findByText(/Zincir bütünlüğü bozuk/i)).toBeTruthy();
+  });
+
+  it("does NOT show the tamper warning when integrity is 'ok'", async () => {
+    mockDashboard("ok");
+    render(<DashboardPage />);
+    // Let the fetch resolve + state settle.
+    await screen.findByText(/Vault audit/i);
+    await new Promise((r) => setTimeout(r, 20));
+    expect(screen.queryByText(/Zincir bütünlüğü bozuk/i)).toBeNull();
+  });
+});
+
+// ── Finding #1: fabricated "100%" stat ───────────────────────────────────────
+// "Structured Output: 100%" sat in the same styled stat grid as real, fetched
+// counts, reading as a measured per-tenant compliance rate. It is a design
+// invariant, not a measurement — reframed so it no longer masquerades as live.
+describe("Agent Registry — structured-output stat is honest, not a fake metric", () => {
+  beforeEach(() => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(() =>
+        Promise.resolve(
+          new Response(
+            JSON.stringify({ total: 12, approval_gated: 4, categories: [] }),
+            { status: 200 },
+          ),
+        ),
+      ),
+    );
+  });
+
+  it("does not render a fabricated 100% measurement", async () => {
+    render(<AgentsPage />);
+    await screen.findByText(/Structured Output/i);
+    expect(screen.queryByText("100%")).toBeNull();
+  });
+});

core/landing/app/admin/dashboard/page.tsx

@@ -132,7 +132,10 @@ export default function AdminDashboardPage() {
   };
   const vault = (data?.vault ?? {}) as {
     total_entries?: number;
-    audit_chain_integrity?: boolean;
+    // Backend (vault/audit_chain.py) emits a STATUS string "ok" | "tampered",
+    // not a boolean — typing it as bool made the `=== false` tamper check below
+    // dead code, so the warning never surfaced on a genuinely tampered chain.
+    audit_chain_integrity?: "ok" | "tampered";
   };
 
   const betaCount = (beta.pending ?? 0) + (beta.approved ?? 0);
@@ -220,7 +223,7 @@ export default function AdminDashboardPage() {
               title="Vault audit"
               value={vault.total_entries ?? 0}
               description={
-                vault.audit_chain_integrity === false
+                vault.audit_chain_integrity === "tampered"
                   ? "⚠ Zincir bütünlüğü bozuk"
                   : "Audit zinciri kayıt sayısı"
               }

core/landing/app/admin/graph/page.tsx

@@ -106,7 +106,9 @@ async function nlToCypher(
       method: "POST",
       credentials: "include",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ question: nl }),
+      // Backend NLQueryRequest requires `intent` (not `question`); sending the
+      // wrong key returned 422 on every call and the feature never worked.
+      body: JSON.stringify({ intent: nl }),
     });
     if (!res.ok) {
       const text = await res.text();

core/landing/app/panel/agents/page.tsx

@@ -84,7 +84,7 @@ export default function AgentRegistryPage() {
           <div className="mb-8 grid grid-cols-1 gap-4 sm:grid-cols-2 lg:grid-cols-4">
             <Stat label="Kayıtlı Agent" value={String(data.total)} hint="5 kategori · 120 MCP tool" />
             <Stat label="Onay-Kapılı" value={String(data.approval_gated)} hint="orta+ risk → Approval" />
-            <Stat label="Structured Output" value="100%" hint="evidence_id + confidence" />
+            <Stat label="Structured Output" value="Zorunlu" hint="şema ile zorunlu · evidence_id + confidence" />
             <Stat label="Kategori" value={String(data.categories.length)} hint="discovery · intel · engage · ops" />
           </div>