test(idris2): port 6 TS test files to Idris2 (estate port 9/11)

[hyperpolymath]

Summary

Estate port 9/11 — converts the 6 TS test files in `tests/{unit,contract,aspect,property,smoke,e2e}/` to Idris2 under the cladistic `Test.Spec` harness used by ipfs-overlay, betlang, stapeln, etc.

Originally tagged for bucket-2 (per-repo strategy review) in the estate bimodal rollout — collapsed to bucket-1 (content-validation + pure-logic) after a single inspection pass. Tests are pure file-read + substring/regex assertions; nothing touches ZeroTier API or kubectl at runtime.

What ported

Module	Tests	Shape
UnitConfigStructureTest	13	content-validation
ContractNetworkContractsTest	18	content-validation
AspectSecurityTest	14	content-validation
PropertyNetworkPropertyTest	12	pure-logic + content-validation
SmokeInfraTest	10	content-validation
E2ENetworkTest	12	content-validation
Total	79

The PropertyNetworkPropertyTest module includes inline pure-Idris2 ports of the regex-driven predicates from `tests/property/network_property_test.ts`: `isLowercaseHyphen`, `isZTNetworkId`, `parseIPv4`, `ipv4ToNat`, `isCidr`, `stripSuffix`. Each predicate is exposed and unit-tested so a regression in the predicate itself is caught alongside a regression in the file contents.

Test plan

• Local: `idris2 --build zerotier-k8s-link-tests.ipkg` clean compile
• Local: `./build/exec/zerotier-k8s-link-tests` — 79 / 79 PASS
• CI: dogfood-gate workflow picks up the new ipkg file

Build gotchas pinned during the port

• `let foo s = ...` inside do-blocks doesn't parse in idris2 0.8.0; use `let foo : T -> U; foo = \s => ...` instead.
• Tuple patterns with nested cons (e.g. `(addr, '/' :: prefix)`) at top-level definition heads don't parse; lift to separate predicate.
• Local `isLower` collides with Prelude's `Data.Char.isLower` — rename to `isLowerC` to disambiguate.

Source bugs found

None. All 31 file paths referenced across the 6 TS test files resolve on disk.

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 14 issues detected

Severity	Count
🔴 Critical	7
🟠 High	3
🟡 Medium	4

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/zerotier-k8s-link/zerotier-k8s-link/tests/unit/config_structure_test.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/zerotier-k8s-link/zerotier-k8s-link/tests/aspect/security_aspect_test.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/zerotier-k8s-link/zerotier-k8s-link/tests/e2e/network_e2e_test.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/zerotier-k8s-link/zerotier-k8s-link/tests/contract/network_contracts_test.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/zerotier-k8s-link/zerotier-k8s-link/tests/bench/config_bench.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/zerotier-k8s-link/zerotier-k8s-link/tests/property/network_property_test.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/zerotier-k8s-link/zerotier-k8s-link/tests/smoke/infra_smoke_test.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence