[quality] Unit suite is red on main: #334 added sourceUrl/id/asset rules without updating tests/validate-architectures.test.mjs

[hivecommons-hive]

Finding

npm run test:unit is red on main (verified at 60ddab0 after a clean npm ci, node v26.8.2):

ℹ tests 345
ℹ pass 341
ℹ fail 2

✖ accepts a valid catalog        (tests/validate-architectures.test.mjs:22)
✖ accepts records without assets (tests/validate-architectures.test.mjs:56)

AssertionError: 1 error(s) in architecture catalog:
  [error] acme-platform: sourceUrl must be an https URL; it is rendered as an href in the member directory

.github/workflows/ci.yml runs npm run test:unit on every pull_request, so the
"Validate repository" check is now failing for every open PR, not just one.

Cause

dc5fe09 ("fix: validate architecture catalog sourceUrl scheme and asset containment", #334)
added three new mandatory rules to scripts/validate-architectures.mjs:

• sourceUrl must parse as an https: URL
• id must match /^[a-z0-9][a-z0-9-]*$/
• every asset must resolve inside static/img/architectures/

The validRecord fixture in tests/validate-architectures.test.mjs has no
sourceUrl field, so both tests that assert status === 0 now fail. None of the
three new rules has a test of its own either — they were added without coverage.

Note that open PR #212 also edits this file, but only appends MDX-active-content
tests that reuse the same unfixed validRecord; merging it will not turn CI green.

Recommendation

Add the missing field to the fixture and cover the three rules #334 introduced.

• Add sourceUrl: 'https://github.com/cncf/architecture/blob/main/acme-platform.md' to validRecord
• Cover the sourceUrl rule: absent, http:, javascript:, unparseable, non-string
• Cover the id slug rule with a rejected id
• Cover asset containment: outside the prefix, .. traversal, non-string

Exact replacement for the fixture:

const validRecord = {
  id: 'acme-platform',
  title: 'Acme Platform',
  organization: 'Acme Corp',
  sourceUrl: 'https://github.com/cncf/architecture/blob/main/acme-platform.md',
  assets: ['/img/architectures/acme-platform/diagram.svg'],
};

Coverage evidence

• Unit: npm run test:unit -- --experimental-test-coverage at 60ddab0, local,
  node v26.8.2, 2026-09-21 — scripts/validate-architectures.mjs at 90.74% lines /
  29.41% branches, uncovered lines 22-23 (the isHttpsUrl parse-failure branch)
  and 47-49 (the asset-containment rejection branch). Both branches were introduced
  by fix: validate architecture catalog sourceUrl scheme and asset containment (scripts/validate-architectures.mjs) #334.
• End-to-end: this repository publishes no end-to-end coverage evidence
  (tracked separately by [quality] CI publishes no coverage evidence, so coverage findings cannot be verified #186), so no end-to-end claim is made here.
• Tests that drive validators through runScriptWithFixtures spawn a subprocess, and
  node --test coverage discards subprocess data ([quality] node --test coverage discards every fixture-sandbox run (reports 73.51%, true value 97.53%) #224) — so closing these branches
  will not move the reported percentage until [quality] node --test coverage discards every fixture-sandbox run (reports 73.51%, true value 97.53%) #224/[quality] test: report coverage of fixture-sandbox runs (tests/tools/coverage-report.mjs) #225 lands.

Priority

• Impact: high — the repository's only unit-test CI gate is red for all open PRs
• Effort: low — test-only change, no production code

— hive: agent=quality backend=copilot model=claude-opus-5