v24.21.0
✔ launch identity is stamped, payload identity is refused and stale holder cannot send (177.995558ms)
✔ decision classes route from policy; gated resolution is human-only, choice and target must match (226.379303ms)
✔ claim exclusion, holder release, gated revoke and rerouting to a new holder are atomic (264.656306ms)
✔ launch events require a human CLI capability; generic emit cannot forge authority events (173.936466ms)
✔ within-role decisions close atomically and invalid options or blocking omissions refuse (155.77841ms)
✔ observer capabilities read human inbox but cannot mutate or forge launch identity (167.571228ms)
✔ task action subjects and linked decision trail are complete and ordered (180.969194ms)
✔ launch binding is durable and reconnecting requires the identical trusted record (117.652825ms)
✔ business isolation includes inherited object names and cross-business message references (182.988785ms)
✔ authority never transfers between action, run, target, unresolved or replaced role holder (236.202894ms)
✔ task projection uses schema current view, skipping earlier and equal-start polls (129.943441ms)
✔ revocation permanently bars the old run from reclaiming first, including after broker restart (180.080272ms)
✔ empty message references refuse before storage; refusal-evidence failure stays a typed error (108.282332ms)
✔ both arbiters require human resolution when their cross-role route is themselves (191.103379ms)
✔ S1 adapter takes resolved limits and refs, rejects mismatched instance, never mutates input (2.901125ms)
✔ only validated broker references load; returned data and exceptions cannot expose a known token (24.21701ms)
✔ bad file modes, symlinks, repository/data paths, malformed tokens and missing dates refuse (11.61988ms)
✔ expiry refuses use and env references never become client data (0.869794ms)
✔ S1 parsed service refs work, service mismatch refuses, Gitea rotation due is a warning state (1.627046ms)
✔ opaque tokens shorter than 16 characters refuse before use (0.342368ms)
✔ human proof binds CLI entry, process start and nonce; agents and incomplete ancestry refuse (4.057288ms)
✔ process reader gets own kernel identity without exposing environment values (1.932984ms)
✔ EACCES ancestor environments skip only markers; commands and registered launches still refuse (1.454891ms)
✔ real pid 1 remains inspectable when its environment is protected (0.53668ms)
✔ within-role sends cite an open gated launch decision without spending it or naming it in grants (210.931132ms)
✔ missing and foreign-business citations refuse and roll back message and grant (165.573886ms)
✔ cross-role sends still need a matching resolved decision and consume it once (243.861362ms)
✔ broker process binds trusted launches, offers reader capabilities, refuses human mutation, closes cleanly (230.652875ms)
✔ startup token refusal returns safe code without value or partial listening broker (39.139736ms)
✔ loaded fixture token is absent from socket replies and SQLite, including refusal evidence (183.304182ms)
✔ killed broker leaves an explicit stale lock; another process cannot silently reclaim it (174.404037ms)
✔ trusted host registers later launches; socket clients never have a registration verb (194.739448ms)
✔ runtime excludes declared project roots even when host supplies no repoRoots (38.165033ms)
✔ a refused launch binding leaves the broker and existing capabilities alive; bad protocol stops it (157.757851ms)
✔ v3b prototype refusals, views and append-only mutations (999.7647ms)
✔ gated approval authorizes once, survives store reopen, and fresh approval works (255.746449ms)
✔ another run cannot consume an approval; a failed check leaves it usable (201.630399ms)
✔ two scheduled callers have exactly one grant and one consumed refusal (157.451638ms)
✔ failed commit rolls consumption back; cross-role consumes and within-role stays reusable (312.538007ms)
✔ class drift gated to cross-role refuses before consumption (205.950574ms)
✔ class drift cross-role to gated refuses before consumption (221.072715ms)
✔ class drift gated to within-role refuses before consumption (198.148507ms)
✔ class drift cross-role to within-role refuses before consumption (214.761828ms)
✔ class drift within-role to gated refuses before consumption (183.546474ms)
✔ class drift within-role to cross-role refuses before consumption (177.062436ms)
✔ message.send consumes approval and prevents a later send or authorize (169.702317ms)
✔ role.revoke consumes approval and prevents a later revoke or authorize (210.23678ms)
✔ creates private WAL store and excludes a second writer until explicit close (135.028493ms)
✔ rollback is atomic and schema metadata is checked against trusted DDL, not just itself (157.928989ms)
✔ existing empty database and symlink runtime directory refuse, never initialize over damage (172.711454ms)
✔ crash during a transaction recovers no partial event after explicit fixture-only lock removal (166.363463ms)
✔ writer refuses mixed at/read_at forms atomically, even through trusted SQL helpers (107.218464ms)
✔ async transactions refuse before invoking their function (107.062057ms)
✔ recordTask keeps sync reads and a role write apart (197.403236ms)
✔ read_at must be one canonical UTC format, so the projection compares strings safely (89.063123ms)
✔ a bad entry refuses the whole record (110.50118ms)
✔ taskView reads the projection for one business (124.982524ms)
✔ requestTask hands only a holder and a task verb to the handler, and records refusals (240.14733ms)
✔ the server sends task verbs to the adapter with its own timeout; other verbs stay synchronous (403.174034ms)
✔ without an adapter the server refuses every task verb (194.58278ms)
✔ the runtime refuses an invalid adapter and closes a valid one (210.094013ms)
✔ the process loads the S3 adapter from plain-data trackers (251.572161ms)
✔ socket capability stamps launch identity; shared views use wire, no SQL client (161.598888ms)
✔ two wire claims serialize; a lost reply never automatically retries (161.348123ms)
✔ malformed, oversized and identity-forging envelopes refuse without echoing input (110.578016ms)
✔ client preserves UTF-8 when a response divides a multibyte character (13.803031ms)
✔ committed mutation followed by dropped reply reports unknown and is never retried (140.825499ms)
✔ the boot config is checked before anything starts (131.635722ms)
✔ a business with no tracker entry refuses task verbs (130.438873ms)
✔ credential.expiring and .expired are recorded once per instance (243.626085ms)
✔ a token file that changes on disk records credential.changed (115.477902ms)
✔ autostart polls, reconciles and retries a startup the tracker was down for (142.618869ms)
✔ a refusal a restart must clear is not retried by the poll (101.884484ms)
✔ a poll that fires while two are queued is dropped (103.399807ms)
✔ close waits for a running verb and refuses one that has not started (202.47576ms)
✔ the bundled Vikunja is the pinned upstream image the runbook names (1.622513ms)
✔ every published port is on 127.0.0.1, and no secret is in the file (0.584512ms)
✔ the fake answers each route with the statuses and shapes Vikunja v2.7.0 sent (419.775759ms)
✔ the recorded task bodies pass the checks S3 applies to every read (1.236979ms)
✔ the client works against the fake over real HTTP with the platform fetch (228.634561ms)
✔ a correct install starts, and the first reconcile records tasks that already exist (159.589711ms)
✔ verbs refuse while a business is starting and after startup refused it (136.700055ms)
✔ startup refuses a token that can do more than its role needs (435.328987ms)
✔ startup refuses an unsupported version and flags an untested one (299.577898ms)
✔ startup refuses a board that the runbook did not install (360.356472ms)
✔ startup refuses a project the sync bot cannot read (103.639411ms)
✔ startup refuses a configured label the pm bot cannot see (86.468568ms)
✔ startup refuses an expired credential and a missing sync credential (197.947641ms)
✔ an unreachable tracker refuses with tracker-unavailable (89.357586ms)
✔ an edit in the UI is recorded once, with the fields that changed (236.98378ms)
✔ a move between open buckets is seen on the board, though updated does not change (200.469822ms)
✔ a person's comment is counted and a bot's is not (273.225862ms)
✔ the hourly reconcile catches a comment through comment_count (221.516299ms)
✔ a task closed in the UI leaves the open view with its done bucket (396.680361ms)
✔ a task that leaves the board is recorded as deleted, moved or out of reach (263.024955ms)
✔ a poll that read before a verb wrote does not overwrite the verb (166.731917ms)
✔ a tracker fault during a tick is reported and the next tick catches up (168.501175ms)
✔ a malformed answer refuses the tick with tracker-shape (125.934132ms)
✔ no token value reaches the database, the log or a refusal (249.734475ms)
✔ task.create needs a recorded human request and a requirement id (217.071845ms)
✔ only labels named in the business file can be written (254.896184ms)
✔ task.schedule sets and clears a due date and relations (282.467596ms)
✔ assign and reassign move the role bots and record task.assigned (305.563947ms)
✔ task.update.assigned is for the assignee and records task.state (312.128897ms)
✔ a wrong expected digest records task.conflict and writes nothing (193.094654ms)
✔ a cross-role verb needs a resolved decision, used once (240.495473ms)
✔ task.close needs a verdict; after it every verb refuses with task-done (232.734889ms)
✔ a lost answer is settled by a re-read and never retried (230.812095ms)
✔ a create whose answer is lost is reported uncertain, and the poll finds the task (188.427104ms)
✔ a task the sync bot cannot read refuses and records nothing (138.146555ms)
✔ verbs and polls for one business run one at a time (283.40276ms)
ℹ tests 111
ℹ suites 0
ℹ pass 111
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 3072.92625
