command: ["node", "--test", "/home/jwoltje/.t3/worktrees/mosaic-stack/magica-row329/packages/bus/tests/gitea-grant.test.mjs"]
TMPDIR: /mnt/storage/scratch/tmp/oEntjx
launch nice: 19
✔ versionAtLeast compares numbers and refuses a prerelease of 1.27.0 (1.337509ms)
✔ X-G1: a raise that fails a check refuses and stores nothing (69.474121ms)
✔ X-G1: a creative role, a role without identity and a missing or due slot refuse at raise (219.306031ms)
✔ X-G1: the chief of staff refuses at raise, whatever its definition, identity and publish declare (47.225004ms)
✔ X-G2: admin set refuses each failed check and writes nothing, then writes the slot once (186.081005ms)
✔ X-G3 to X-G8: an approve makes the user, mints the token, forks, checks reach and writes the file, record and grant.applied (110.539296ms)
✔ X-G4: a user this stack did not make, an admin, a disabled user and a remade user each refuse (371.186116ms)
✔ X-G6 and X-G8: the user and mint steps are written before their calls, and each result after its call (109.564615ms)
✔ X-G4: a fork by the seat user of another repository than the project refuses fork-foreign (112.369931ms)
✔ X-G5: a failure after the mint deletes the token, unloads nothing it did not load and leaves no file (180.184063ms)
✔ X-G5: a token delete that fails is left at Gitea, shown by status and taken by sweep (143.352539ms)
✔ X-G5: a mint that fails deletes by name, and a refusal at step 0 leaves the decision unspent (194.638622ms)
✔ X-G5: an agent held for an unknown token is refused at step 0 with no Gitea call (76.106793ms)
✔ X-G5 and X-G9 (step 7): a rotation whose old-token delete fails stays applied with the old id left (215.848938ms)
✔ X-G10: in a rotation the store file holds the new token before the old one is deleted (177.375994ms)
✔ X-G6: a rotation cut before the rename settles back at once, and the old token stays live (181.893895ms)
✔ X-G6: a rotation whose step 8 write fails is settle-pending, and a restart settles it forward (221.633802ms)
✔ X-G6: a restart settles an open rotation back when the file still holds the old token (167.487154ms)
✔ X-G6: a restart settles an open rotation forward when the file holds the new token (149.45971ms)
✔ X-G6: a 401 on the file token loses the grant: both tokens go, the record goes and memory unloads (155.66033ms)
✔ X-G6: a 403, 404, 500, a hang and a dropped socket each leave the rotation settle-pending with nothing deleted (1110.210113ms)
✔ X-G6: a file token no grant minted is held; the next restart says so again; a revoke clears it and takes both ids (268.295466ms)
✔ N9: a revoke of an open rotation, then a restart: no settle, no Gitea call and no message (178.405385ms)
✔ N9: a 404 on a delete by id counts as done (146.429096ms)
✔ X-G6: a restart undoes each step a killed child left, and spends an approved unspent decision (524.171778ms)
✔ X-G6: a restart with no admin slot leaves the user an orphan and the token left (67.758264ms)
✔ X-G7: a change to the definition, identity, publish remotes or admin slot after the raise ends decision-mismatch (153.837914ms)
✔ X-G7 and X-G9: an admin rotate voids open decisions, and rotate --finish deletes what was left (134.830812ms)
✔ X-G9: a rotate whose name is taken refuses and writes nothing; remove takes the slot away (90.744501ms)
✔ X-G9: a slot past its rotate-by date refuses a run at step 0, leaving the decision unspent (61.202231ms)
✔ X-G11: run refuses every caller but the human, an unapproved, a spent and a busy decision (135.168498ms)
✔ kill switch (plan :16): while halted the chief still reads grants.status, and an agent grants.revoke refuses (126.150239ms)
✔ X-G11: a revoke while the executor runs aborts it and the grant ends revoked (149.826928ms)
✔ X-G11: a revoke unloads memory and removes the file before its Gitea delete (168.804063ms)
✔ X-G11: a revoke during a rotation step 7 ends it revoked, and step 8 writes no record back (208.918918ms)
✔ X-G11: a revoke while a sweep settles a rotation, forward or back, ends it revoked with no record (442.725196ms)
✔ X-G11: a revoke during a settle whoami that finds a foreign token ends it revoked, not held (206.420198ms)
✔ X-G11: a revoke during a settle whoami that gets a 401 ends it revoked, not lost (195.229789ms)
✔ X-G12: a token that reaches wider than its forks fails with the repository named (466.288235ms)
✔ X-G12: reach is paged by X-Total-Count and a count that does not add up refuses (295.755156ms)
✔ X-G13: an agent cannot record a grant event, and the trigger refuses one from any writer but the grant writer (45.365905ms)
✔ X-G14: credentials delete fires the user: tokens go, login is prohibited, and grant.revoke.closed records it (304.97995ms)
✔ X-G14: a fire whose token delete or login PATCH fails lands it in serviceLeft (153.818958ms)
✔ X-G14: a fire whose user is gone or remade skips the fire steps and says why (319.729996ms)
✔ X-G14: a sweep retries a fire only for the user it fired: a remade or gone user is skipped and named (393.442793ms)
✔ X-G14: a revoke Gitea cannot reach stays open, and a restart closes it (187.553966ms)
✔ row 281 T8: a tester grants.revoke refuses tester-dev-only once bus.tester is off; the human revoke keeps its records and starts no job (143.475225ms)
✔ X-G15: look-alike commit steps outside the grant writer are ignored at start, by revoke and by status (142.663429ms)
✔ X-G15: a look-alike spend under another kind with the grant writer pair is not an open grant (56.780544ms)
✔ status lists the slot, users, grants and nothing secret, and every grants verb needs service gitea (123.456643ms)
✔ C2-21 L1/L2/L9: research gets write on her repository with declared scopes through raise and yes (139.889708ms)
✔ C2-21 L1/L2/L9: chief-of-staff gets read on her repository with declared scopes through raise and yes (140.222692ms)
✔ C2-21 L1/L2/L9: coder gets read on her repository with declared scopes through raise and yes (144.290003ms)
✔ C2-21 L7/L7b: research refuses non-library targets lib (53.068544ms)
✔ C2-21 L7/L7b: research refuses non-library targets app,lib (49.545745ms)
✔ C2-21 L7/L7b: chief-of-staff refuses non-library targets lib (47.459267ms)
✔ C2-21 L7/L7b: chief-of-staff refuses non-library targets app,lib (45.800088ms)
✔ C2-21 L4: read widened to write refuses gitea-reach-wider and deletes the minted token (113.47042ms)
✔ C2-21 L4: admin privilege refuses gitea-reach-wider and deletes the minted token (115.701394ms)
✔ C2-21 L4: missing pull refuses gitea-reach-wider and deletes the minted token (111.393534ms)
✔ C2-21 L4: missing permission object refuses gitea-reach-wider and deletes the minted token (112.867072ms)
✔ C2-21 L4: library fork refuses gitea-reach-wider and deletes the minted token (112.69746ms)
✔ C2-21 L8: untargeted library collaborator reach is disclosed and accepted publish-wide (114.413065ms)
✔ C2-21 L10: project kind or library level changing after raise refuses decision-mismatch (162.249108ms)
✔ C2-21 L4: creative write requires push true but ignores unrelated permission keys (226.653935ms)
✔ C2-21: a library grant with no declared scopes refuses gitea-not-declared at raise (51.582376ms)
ℹ tests 66
ℹ suites 0
ℹ pass 66
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 11944.93231
