test(layout): move server, storage, ci-workflows into tests/<domain>/ (#3497)

.github/scripts/pr-quality.test.cjs

@@ -644,7 +644,7 @@ describe("assessPrDescription with the readiness section", () => {
     "",
     "## Test plan",
     "",
-    "- Ran bun test tests/ci-workflows.test.ts",
+    "- Ran bun test tests/ci-workflows/ci-workflows.test.ts",
   ].join("\n");
 
   it("never counts the injected checklist as description substance", () => {
@@ -670,7 +670,7 @@ describe("collectPrQualityFailures", () => {
     "This change fixes the provider list spacing in the dashboard.",
     "",
     "## Test plan",
-    "- Ran bun test tests/ci-workflows.test.ts",
+    "- Ran bun test tests/ci-workflows/ci-workflows.test.ts",
   ].join("\n");
 
   it("reports wrong_base without requiring ancestry inputs", () => {
@@ -905,7 +905,7 @@ describe("collectPrQualityFailures", () => {
         "No gui changes in this PR; proxy routing only.",
         "",
         "## Test plan",
-        "- Ran bun test tests/ci-workflows.test.ts",
+        "- Ran bun test tests/ci-workflows/ci-workflows.test.ts",
       ].join("\n"),
       behindMain: 0,
       behindBase: 0,
@@ -925,7 +925,7 @@ describe("collectPrQualityFailures", () => {
         "This change adjusts gui/ spacing tokens used by the dashboard.",
         "",
         "## Test plan",
-        "- Ran bun test tests/ci-workflows.test.ts",
+        "- Ran bun test tests/ci-workflows/ci-workflows.test.ts",
       ].join("\n"),
       behindMain: 0,
       behindBase: 0,
@@ -945,7 +945,7 @@ describe("collectPrQualityFailures", () => {
         "This change adjusts gui/ spacing tokens used by the dashboard.",
         "",
         "## Test plan",
-        "- Ran bun test tests/ci-workflows.test.ts",
+        "- Ran bun test tests/ci-workflows/ci-workflows.test.ts",
       ].join("\n"),
       behindMain: 0,
       behindBase: 0,
@@ -968,7 +968,7 @@ describe("collectPrQualityFailures", () => {
         "This change adjusts gui/ spacing tokens used by the dashboard.",
         "",
         "## Test plan",
-        "- Ran bun test tests/ci-workflows.test.ts",
+        "- Ran bun test tests/ci-workflows/ci-workflows.test.ts",
       ].join("\n"),
       behindMain: 0,
       behindBase: 0,
@@ -993,7 +993,7 @@ describe("collectPrQualityFailures", () => {
         "![after](https://example.com/after.png)",
         "",
         "## Test plan",
-        "- Ran bun test tests/ci-workflows.test.ts",
+        "- Ran bun test tests/ci-workflows/ci-workflows.test.ts",
       ].join("\n"),
       behindMain: 0,
       behindBase: 0,
@@ -1017,7 +1017,7 @@ describe("collectPrQualityFailures", () => {
         "[shot]: https://example.com/after.png",
         "",
         "## Test plan",
-        "- Ran bun test tests/ci-workflows.test.ts",
+        "- Ran bun test tests/ci-workflows/ci-workflows.test.ts",
       ].join("\n"),
       behindMain: 0,
       behindBase: 0,
@@ -1041,7 +1041,7 @@ describe("collectPrQualityFailures", () => {
         "```",
         "",
         "## Test plan",
-        "- Ran bun test tests/ci-workflows.test.ts",
+        "- Ran bun test tests/ci-workflows/ci-workflows.test.ts",
       ].join("\n"),
       behindMain: 0,
       behindBase: 0,

.github/workflows/ci.yml

@@ -273,7 +273,7 @@ jobs:
           # between jobs, so leaving a usable token in .git/config is avoidable
           # residue. Matches the convention already used by the other workflows.
           persist-credentials: false
-          # tests/release-version-line.test.ts compares package.json against the
+          # tests/ci-workflows/release-version-line.test.ts compares package.json against the
           # newest release tag. actions/checkout fetches no tags by default, so
           # without this the check reads an empty tag set and passes on anything -
           # the exact regression it exists to catch would ride through CI green.
@@ -347,12 +347,12 @@ jobs:
       - name: Test storage policy API
         run: |
           bun test --isolate \
-            ./tests/api-storage-policy-already-running.test.ts \
-            ./tests/api-storage-policy-mutation-busy.test.ts \
-            ./tests/api-storage-policy-put-race.test.ts \
-            ./tests/api-storage-policy-run.test.ts \
-            ./tests/api-storage-policy.test.ts \
-            ./tests/api-storage.test.ts
+            ./tests/storage/api-storage-policy-already-running.test.ts \
+            ./tests/storage/api-storage-policy-mutation-busy.test.ts \
+            ./tests/storage/api-storage-policy-put-race.test.ts \
+            ./tests/storage/api-storage-policy-run.test.ts \
+            ./tests/storage/api-storage-policy.test.ts \
+            ./tests/storage/api-storage.test.ts
 
   # Bun 1.3.14 has shown a Linux isolate wedge around startServer() plus the user
   # cost overlay reconciler. Keep api-usage in one fresh process so a runtime
@@ -384,7 +384,7 @@ jobs:
           bun run build
 
       - name: Test api usage API
-        run: bun test --isolate ./tests/api-usage.test.ts
+        run: bun test --isolate ./tests/server/api-usage.test.ts
 
   # Everything that is not the suite: type safety, privacy, lint, build, smoke.
   # One runner, once per push. Splitting these across the shards would repeat a
@@ -431,7 +431,7 @@ jobs:
         run: bun run privacy:scan
 
       # The ocx skill ships a capability -> route map generated from src/cli/capabilities.ts.
-      # `bun run test` already covers this via tests/skill-ocx.test.ts; this step exists so the
+      # `bun run test` already covers this via tests/ci-workflows/skill-ocx.test.ts; this step exists so the
       # failure names the fix instead of surfacing as a byte-comparison diff in a test log.
       - name: Check the generated ocx skill surface is current
         run: bun run skill:surface:check
@@ -471,7 +471,7 @@ jobs:
           # between jobs, so leaving a usable token in .git/config is avoidable
           # residue. Matches the convention already used by the other workflows.
           persist-credentials: false
-          # tests/release-version-line.test.ts compares package.json against the
+          # tests/ci-workflows/release-version-line.test.ts compares package.json against the
           # newest release tag. actions/checkout fetches no tags by default, so
           # without this the check reads an empty tag set and passes on anything -
           # the exact regression it exists to catch would ride through CI green.
@@ -564,7 +564,7 @@ jobs:
           # between jobs, so leaving a usable token in .git/config is avoidable
           # residue. Matches the convention already used by the other workflows.
           persist-credentials: false
-          # tests/release-version-line.test.ts compares package.json against the
+          # tests/ci-workflows/release-version-line.test.ts compares package.json against the
           # newest release tag. actions/checkout fetches no tags by default, so
           # without this the check reads an empty tag set and passes on anything -
           # the exact regression it exists to catch would ride through CI green.
@@ -709,7 +709,7 @@ jobs:
           # residue. Matches the convention already used by the other workflows.
           persist-credentials: false
           # Same reason as the Linux shards and the macOS control: this leg runs the
-          # whole suite, and tests/release-version-line.test.ts reads release tags.
+          # whole suite, and tests/ci-workflows/release-version-line.test.ts reads release tags.
           # Without tags the check sees an empty set and cannot fail.
           fetch-tags: true
 

.github/workflows/dev-version-bump.yml

@@ -2,7 +2,7 @@ name: Dev version bump
 
 # When a release publishes, open a pull request that moves `dev` past the published
 # version. Without this, `dev` keeps carrying a version that is at or behind a released
-# one, and `tests/release-version-line.test.ts` fails on `dev` and on every pull request
+# one, and `tests/ci-workflows/release-version-line.test.ts` fails on `dev` and on every pull request
 # opened against it - inherited red a contributor cannot fix from their own diff.
 #
 # That has been repaired by hand four times: 32529c2b2, e4a85d134, 076ad3036, befcac3e1.
@@ -98,7 +98,7 @@ jobs:
         # of the tag set, so it is settled here by the detector that already owns the
         # question. If this fails, no pull request is opened and the job goes red asking
         # for a human decision - which is the correct outcome, not a fallback.
-        run: bun test tests/release-version-line.test.ts
+        run: bun test tests/ci-workflows/release-version-line.test.ts
 
       - name: Open the bump pull request
         if: ${{ steps.decide.outputs.changed == 'true' }}
@@ -174,7 +174,7 @@ jobs:
           ## Summary
 
           \`${RELEASED_VERSION}\` published, so \`dev\` would otherwise keep a version at or
-          behind a released one and \`tests/release-version-line.test.ts\` would fail on
+          behind a released one and \`tests/ci-workflows/release-version-line.test.ts\` would fail on
           \`dev\` and on every pull request opened against it. This moves \`dev\` to
           \`${NEXT_VERSION}\`.
 
@@ -184,7 +184,7 @@ jobs:
 
           ## Verification
 
-          \`bun test tests/release-version-line.test.ts\` ran against this exact tree
+          \`bun test tests/ci-workflows/release-version-line.test.ts\` ran against this exact tree
           before the pull request was opened; the workflow refuses to open one if the
           chosen version collides with a published release.
 

.github/workflows/react-doctor.yml

@@ -4,7 +4,7 @@
 # Gating and least-privilege: findings fail the job (`blocking: warning`).
 # Write-scoped outputs (sticky PR comments, inline review comments, commit
 # statuses) stay disabled so the workflow needs no write permissions. Do not
-# re-add write scopes without revisiting tests/ci-workflows.test.ts, which
+# re-add write scopes without revisiting tests/ci-workflows/ci-workflows.test.ts, which
 # pins this contract.
 #
 # Docs: https://www.react.doctor/docs/ci-and-prs/github-actions-setup

.github/workflows/release.yml

@@ -59,7 +59,7 @@ jobs:
   # still bumps it, which is the point.
   #
   # It is declared FIRST in this file, ahead of the jobs it depends on, because
-  # tests/ci-workflows.test.ts splits the workflow on `- name:` and reads each `run:`
+  # tests/ci-workflows/ci-workflows.test.ts splits the workflow on `- name:` and reads each `run:`
   # block to the start of the next one when it checks that dispatch inputs never
   # interpolate into shell source. A job declared between two steps lands inside that
   # window and reads as shell. Job order in YAML carries no execution meaning - `needs`

.gitignore

@@ -40,7 +40,7 @@ devlog/**/security-advisory-draft*
 # Local agent/session artifacts
 # These are per-machine agent state (goalplans, ledgers, evidence scratch).
 # They are never part of the product and must not be committed, not even with
-# `git add -f` — see tests/repo-hygiene.test.ts, which fails if any path here
+# `git add -f` — see tests/ci-workflows/repo-hygiene.test.ts, which fails if any path here
 # becomes tracked again.
 .codexclaw/
 **/.codexclaw/
@@ -57,11 +57,12 @@ devlog/**/security-advisory-draft*
 # blocks the release preflight's clean-tree check for work that has nothing to do
 # with it, so ignore both shapes.
 tests/.tmp-*
+tests/**/.tmp-*
 .claude/
 
 # Retired Go native-runtime experiment. `go/` is not part of the build, the
 # typecheck, or the test path, and nothing in `src/` imports it. A single file
 # from it (go/internal/cli/config_parity.go) has now been committed by a broad
 # `git add` three separate times and reached `dev` once — see
-# tests/repo-hygiene.test.ts, which fails if any path here becomes tracked again.
+# tests/ci-workflows/repo-hygiene.test.ts, which fails if any path here becomes tracked again.
 go/

AGENTS.md

@@ -17,7 +17,7 @@ Bun-native TypeScript with no separate server compile step.
   `scripts/test-layout/layout.json`; a domain's files move together with
   `scripts/test-layout/move.ts` and `layout.migrated` records which domains
   have moved, so until a domain is listed there its files are still at the
-  root. `tests/test-layout.test.ts` enforces the map. Shared helpers in
+  root. `tests/ci-workflows/test-layout.test.ts` enforces the map. Shared helpers in
   `tests/helpers/`, fixtures in `tests/fixtures/`, broader scenarios in
   `tests/e2e-style/`. Source-oracle tests resolve the repository through
   `tests/helpers/repo-root.ts`, never `import.meta.dir + "/.."`. A new test
@@ -103,7 +103,7 @@ contributor who ignores it entirely still passes every gate. `privacy:scan` does
 read it — that is deliberate, and it is what makes a public devlog safe rather
 than merely visible.
 
-Two mechanical guards in `tests/repo-hygiene.test.ts` back this up: no `160000`
+Two mechanical guards in `tests/ci-workflows/repo-hygiene.test.ts` back this up: no `160000`
 gitlink may be tracked anywhere, and neither the vendored reference clones nor
 the security triage excised before publication may reappear in the index. Both
 were driven red once to prove they are not vacuous. The gitlink assertion exists
@@ -161,8 +161,8 @@ What matters for development work: the enforcement is code, not prose —
 [`src/cli/agent-driven.ts`](./src/cli/agent-driven.ts),
 [`src/cli/star-prompt.ts`](./src/cli/star-prompt.ts), and
 [`src/server/management/sidebar-routes.ts`](./src/server/management/sidebar-routes.ts),
-covered by `tests/startup-prompt.test.ts`, `tests/cli/agent-driven.test.ts`, and
-`tests/sidebar-routes.test.ts`. If you add another action that spends the user's
+covered by `tests/server/startup-prompt.test.ts`, `tests/cli/agent-driven.test.ts`, and
+`tests/server/sidebar-routes.test.ts`. If you add another action that spends the user's
 identity, credits, or reputation, gate it the same way rather than relying on a
 prompt an agent can answer, and document it in `AGENTS_INSTALL.md`.
 
@@ -197,7 +197,7 @@ bun run skill:surface        # regenerate after adding a capability
 bun run skill:surface:check  # what CI asserts
 ```
 
-`tests/skill-ocx.test.ts` fails if the committed map drifts from `src/cli/capabilities.ts`, and
+`tests/ci-workflows/skill-ocx.test.ts` fails if the committed map drifts from `src/cli/capabilities.ts`, and
 also if the hand-written pages name a command the registry does not have. That second check is not
 hypothetical: it caught a documented `ocx request-history` that never existed.
 

AGENTS_INSTALL.md

@@ -69,8 +69,8 @@ agent-driven callers regardless:
 - [`src/server/management/sidebar-routes.ts`](./src/server/management/sidebar-routes.ts)
   — the `403 agent_consent_required` refusal.
 
-Regression coverage: `tests/startup-prompt.test.ts`,
-`tests/cli/agent-driven.test.ts`, `tests/sidebar-routes.test.ts`.
+Regression coverage: `tests/server/startup-prompt.test.ts`,
+`tests/cli/agent-driven.test.ts`, `tests/server/sidebar-routes.test.ts`.
 
 If a future action spends the user's identity, credits, or reputation, gate it
 the same way rather than relying on a prompt an agent can answer, and document

MAINTAINERS.md

@@ -75,7 +75,7 @@ when a maintainer steps down.
 - Promotion from `dev` to `main` and npm releases is maintainer-controlled.
 - **Closing out a release includes moving `dev`'s version line forward.** A published
   release leaves `dev` carrying a version at or behind it, and
-  `tests/release-version-line.test.ts` then fails on `dev` and on every pull request
+  `tests/ci-workflows/release-version-line.test.ts` then fails on `dev` and on every pull request
   opened against it — red that contributors inherit and cannot fix from their own diff.
   This was repaired by hand four times (`32529c2b2`, `e4a85d134`, `076ad3036`,
   `befcac3e1`) before it was automated.

docs/superpowers/plans/2026-07-26-oauth-reliability-integrity.md

@@ -609,7 +609,7 @@ EOF
 **Files:**
 - Test: `tests/codex-integration/codex-metadata-integrity.test.ts` (new)
 - Modify only if a real gap is found: `src/codex/auth-context.ts`, `src/adapters/openai-responses.ts`
-- Confirm existing: `tests/server-xai-oauth-401-replay.test.ts`, `tests/server-kiro-oauth-401-replay.test.ts`, `tests/codex-integration/codex-routing.test.ts` (policy A)
+- Confirm existing: `tests/server/server-xai-oauth-401-replay.test.ts`, `tests/server/server-kiro-oauth-401-replay.test.ts`, `tests/codex-integration/codex-routing.test.ts` (policy A)
 
 **Interfaces:**
 - Consumes: `headersForCodexAuthContext`, `FORWARD_HEADERS`
@@ -655,7 +655,7 @@ If fabrication or account-id mismatch is found, fix the minimal header path. Do
 - [ ] **Step 4: Run related suite**
 
 ```bash
-bun test tests/codex-integration/codex-metadata-integrity.test.ts tests/codex-integration/codex-auth-context.test.ts tests/codex-integration/codex-routing.test.ts tests/session-affinity.test.ts tests/server-xai-oauth-401-replay.test.ts tests/server-kiro-oauth-401-replay.test.ts
+bun test tests/codex-integration/codex-metadata-integrity.test.ts tests/codex-integration/codex-auth-context.test.ts tests/codex-integration/codex-routing.test.ts tests/server/session-affinity.test.ts tests/server/server-xai-oauth-401-replay.test.ts tests/server/server-kiro-oauth-401-replay.test.ts
 ```
 
 Expected: PASS
@@ -714,7 +714,7 @@ EOF
 
 ```bash
 bun test tests/lib/privacy-mask-account.test.ts tests/oauth/oauth-log.test.ts tests/oauth/oauth-refresh-generic-lock.test.ts tests/oauth/oauth-health.test.ts tests/cli/cli-status-oauth-health.test.ts tests/service/doctor-oauth.test.ts tests/oauth/oauth-accounts-api.test.ts tests/codex-integration/codex-metadata-integrity.test.ts
-bun test tests/oauth/oauth-refresh.test.ts tests/providers/xai/xai-refresh-lock.test.ts tests/codex-integration/codex-routing.test.ts tests/session-affinity.test.ts tests/codex-integration/codex-auth-context.test.ts
+bun test tests/oauth/oauth-refresh.test.ts tests/providers/xai/xai-refresh-lock.test.ts tests/codex-integration/codex-routing.test.ts tests/server/session-affinity.test.ts tests/codex-integration/codex-auth-context.test.ts
 bun run test
 bun run typecheck
 bun run lint:gui