feat(audit): replace probe baseline workflow with live anonymized capture

src/audit/phase0LiveBaseline.test.ts

@@ -0,0 +1,79 @@
+import { describe, expect, it } from 'vitest';
+import type { AuditEvent } from './types.js';
+import { capturePhase0LiveBaselineEvents } from './phase0LiveBaseline.js';
+
+function event(
+  timestamp: number,
+  eventType: AuditEvent['event_type'],
+  payload: Record<string, unknown>,
+): AuditEvent {
+  return {
+    timestamp,
+    level: 'info',
+    event_type: eventType,
+    event: payload,
+  };
+}
+
+describe('capturePhase0LiveBaselineEvents', () => {
+  it('filters to phase-0 event types and applies channel/source/session filters', () => {
+    const events: AuditEvent[] = [
+      event(3, 'session.message', { session_id: 's0', channel: 'cron', sender: 'bot', source: 'channel' }),
+      event(2, 'reaction.skip', { session_id: 'probe-1', channel: 'cron', sender: 'bot', source: 'channel' }),
+      event(1, 'run.state', { session_id: 's1', channel: 'cron', sender: 'bot', source: 'channel', state: 'start' }),
+      event(4, 'run.state', { session_id: 's2', channel: 'telegram', sender: 'u1', source: 'channel', state: 'start' }),
+      event(5, 'run.cancel', { session_id: 's3', channel: 'cron', sender: 'bot', source: 'gateway', latency_ms: 120 }),
+    ];
+
+    const filtered = capturePhase0LiveBaselineEvents(events, {
+      channels: ['cron'],
+      sources: ['channel'],
+      excludeSessionSubstrings: ['probe'],
+      anonymizeIdentifiers: false,
+    });
+
+    expect(filtered).toHaveLength(1);
+    expect(filtered[0].event_type).toBe('run.state');
+    expect(filtered[0].timestamp).toBe(1);
+    expect(filtered[0].event.session_id).toBe('s1');
+  });
+
+  it('anonymizes session/sender/request/lane identifiers deterministically', () => {
+    const events: AuditEvent[] = [
+      event(1, 'run.state', {
+        session_id: 'gmail:user@example.com',
+        sender: 'user@example.com',
+        request_id: 'req-1',
+        lane_id: 'lane-1',
+        channel: 'gmail',
+        source: 'channel',
+        state: 'start',
+      }),
+      event(2, 'run.state', {
+        session_id: 'gmail:user@example.com',
+        sender: 'user@example.com',
+        request_id: 'req-2',
+        lane_id: 'lane-2',
+        channel: 'gmail',
+        source: 'channel',
+        state: 'complete',
+      }),
+    ];
+
+    const anonymized = capturePhase0LiveBaselineEvents(events, {
+      anonymizeIdentifiers: true,
+    });
+
+    const first = anonymized[0].event;
+    const second = anonymized[1].event;
+    expect(first.session_id).toMatch(/^session_[0-9a-f]{12}$/);
+    expect(first.sender).toMatch(/^sender_[0-9a-f]{12}$/);
+    expect(first.request_id).toMatch(/^request_[0-9a-f]{12}$/);
+    expect(first.lane_id).toMatch(/^lane_[0-9a-f]{12}$/);
+    expect(first.session_id).toBe(second.session_id);
+    expect(first.sender).toBe(second.sender);
+    expect(first.request_id).not.toBe(second.request_id);
+    expect(first.lane_id).not.toBe(second.lane_id);
+  });
+});
+