test: initial coverage — normalizer, governance, intent (closes #68, #66)

[jpleva91]

Summary

• Adds 25 tests across the three most security-critical packages — closes test: zero test coverage across all packages — critical gap for a governance runtime #68 (zero test coverage)
• Fixes dead code in flattenParams() — closes bug: dead code in flattenParams() overwrites result before using it (intent/parser.go) #66
• Tests pass: go test ./internal/normalizer/ ./internal/governance/ ./internal/intent/ (25/25)

What's covered

internal/normalizer

• classifyShellRisk — word-boundary regression guard (lock in the PR fix(normalizer): word-boundary check in classifyShellRisk — closes #63 #88 fix)
  • "catalog_tool" must return RiskMutating, not RiskReadOnly
  • "finder.sh" must return RiskMutating, not RiskReadOnly
• Destructive command detection (rm, git push, chmod, etc.)
• Default-mutating fallback
• classifyTool — all 7 tool name cases
• Normalize — struct field correctness
• Fingerprint — determinism, hex format, 16-char length

internal/governance

• Engine.Evaluate — enforce mode denies, monitor mode allows on same match
• args_contain matching — git push denied, git pull allowed
• monitor action policies always allow (even in enforce mode)
• Default-allow when no policy matches
• GetTimeout — policy-specified timeout vs 300s default
• NewEngine — missing file error, invalid YAML error, default monitor mode

internal/intent

• All 4 Parse extraction strategies: JSON block, XML tag, function_call, bare JSON
• Plain prose returns nil
• Tool aliases (Bash → run_shell, Read → read_file, etc.)
• Param aliases (file_path → path, text → content)
• Unknown tools return nil (no guessing)
• flattenParams numeric/bool conversion

Bug fix: #66 — dead code in flattenParams

Removed 7-line unreachable block (complex string manipulation) that was
immediately overwritten by fmt.Sprintf("%g", val). No behavior change.

🤖 Generated with Claude Code