v24.21.0
✔ launch identity is stamped, payload identity is refused and stale holder cannot send (245.06358ms)
✔ decision classes route from policy; gated resolution is human-only, choice and target must match (1142.141856ms)
✔ claim exclusion, holder release, gated revoke and rerouting to a new holder are atomic (2394.791078ms)
✔ launch events require a human CLI capability; generic emit cannot forge authority events (1075.893721ms)
✔ within-role decisions close atomically and invalid options or blocking omissions refuse (871.842456ms)
✔ observer capabilities read human inbox but cannot mutate or forge launch identity (513.357109ms)
✔ task action subjects and linked decision trail are complete and ordered (1120.610371ms)
✔ launch binding is durable and reconnecting requires the identical trusted record (707.229775ms)
✔ business isolation includes inherited object names and cross-business message references (713.088638ms)
✔ authority never transfers between action, run, target, unresolved or replaced role holder (966.612104ms)
✔ task projection uses schema current view, skipping earlier and equal-start polls (449.349586ms)
✔ S1 adapter takes resolved limits and refs, rejects mismatched instance, never mutates input (5.421455ms)
✔ only validated broker references load; returned data and exceptions cannot expose a known token (12.385838ms)
✔ bad file modes, symlinks, repository/data paths, malformed tokens and missing dates refuse (4.761414ms)
✔ expiry refuses use and env references never become client data (1.151008ms)
✔ S1 parsed service refs work, service mismatch refuses, Gitea rotation due is a warning state (2.879108ms)
✔ human proof binds CLI entry, process start and nonce; agents and incomplete ancestry refuse (3.611938ms)
✔ process reader gets own kernel identity without exposing environment values (0.778583ms)
✔ broker process binds trusted launches, offers reader capabilities, refuses human mutation, closes cleanly (259.158665ms)
✔ startup token refusal returns safe code without value or partial listening broker (51.170183ms)
✔ loaded fixture token is absent from socket replies and SQLite, including refusal evidence (857.29398ms)
✔ killed broker leaves an explicit stale lock; another process cannot silently reclaim it (940.56401ms)
✔ trusted host registers later launches; socket clients never have a registration verb (1251.441474ms)
✔ runtime excludes declared project roots even when host supplies no repoRoots (64.802777ms)
✔ v3b prototype refusals, views and append-only mutations (5692.249049ms)
✔ creates private WAL store and excludes a second writer until explicit close (173.827041ms)
✔ rollback is atomic and schema metadata is checked against trusted DDL, not just itself (449.7513ms)
✔ existing empty database and symlink runtime directory refuse, never initialize over damage (1532.33713ms)
✔ crash during a transaction recovers no partial event after explicit fixture-only lock removal (1265.555561ms)
✔ writer refuses mixed at/read_at forms atomically, even through trusted SQL helpers (664.51824ms)
✔ async transactions refuse before invoking their function (502.005626ms)
✔ socket capability stamps launch identity; shared views use wire, no SQL client (216.996179ms)
✔ two wire claims serialize; a lost reply never automatically retries (455.787446ms)
✔ malformed, oversized and identity-forging envelopes refuse without echoing input (966.353921ms)
✔ client preserves UTF-8 when a response divides a multibyte character (33.714587ms)
✔ committed mutation followed by dropped reply reports unknown and is never retried (1509.265511ms)
ℹ tests 36
ℹ suites 0
ℹ pass 36
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 10356.911701
