✔ R4: the timer sweep after a hand edit ends only the lost user's run; its next call refuses thread-revoked (61.092039ms)
✔ R4: an expiry with no write and no request ends the run at the next timer sweep (50.161936ms)
✔ R4: a downgrade to viewer is a loss (42.053681ms)
✔ R4: another user's request after a hand edit ends the lost user's run, and its own run stays (50.19224ms)
✔ R4: a request reads the access file only when its stamp changed, once per change (48.078969ms)
✔ R4: access.reload ends the lost runs at once for the human; the tester, a reader, an agent and a user are refused (61.751037ms)
✔ R4: threadsState marks revoked: true on the lost user's thread only, a pending message included (42.6012ms)
✔ R4: threadsState after an expiry with no write and no sweep ends the claim before it marks the row revoked (44.094289ms)
✔ R4: a new run of a revoked thread refuses thread-revoked at bind and at claim; a rebind is allowed (37.538285ms)
✔ R4 runtime: a hand edit ends the run at the first timer period, intervalMs is checked, and close stops the timer (92.644673ms)
✔ REQ-LIMIT-4 3h copy migrates to 3i: every row keeps its seq, the sequence carries over, and only the account CHECK changes (167.730603ms)
✔ REQ-LIMIT-4 a 3h→3i step that fails partway leaves the store at 3h with every row, the sequence and the schema intact (211.127407ms)
✔ REQ-LIMIT-4 the 3h engine refuses a migrated store, migrating or not, and leaves it as it was (174.697539ms)
✔ parseAddress: one (1.927906ms)
✔ parseAddress: many (0.21134ms)
✔ parseAddress: repeat (0.420895ms)
✔ parseAddress: plain (0.133953ms)
✔ parseAddress: stop (0.157949ms)
✔ parseAddress: EOF tag (0.135556ms)
✔ parseAddress: EOF last tag (0.130704ms)
✔ parseAddress: leading whitespace (0.181556ms)
✔ parseAddress: tags only (0.176313ms)
✔ parseAddress: empty (0.274795ms)
✔ parseAddress: whitespace (0.133335ms)
✔ parseAddress: bare at (0.139629ms)
✔ parseAddress: punctuation is a name (0.108337ms)
✔ parseAddress rejects non-text without coercion (0.461274ms)
✔ the mounted address parser has no import dependency (0.347174ms)
✔ agents: a held role with nothing on the bus is idle; a role session gets the claim rows unchanged (43.119224ms)
✔ agents: working counts what the holder received and has not read; routed alone is not working (43.672101ms)
✔ agents: input needed is the role's open decisions routed to the human, gated first, then oldest (69.541393ms)
✔ agents: working wins over waiting, and Input needed still shows (34.275909ms)
✔ agents: a new holder doesn't inherit what the last one left unread; decisions stay with the role (35.772817ms)
✔ agents: state reads only its own business, even for a run name both use (40.089925ms)
✔ agents: a message the holder released unread is stranded; the next holder gets nothing and cannot read it (42.562781ms)
✔ agents: a message the holder read is not stranded; one the current holder has not read is not listed (40.854831ms)
✔ agents: stranded is oldest first and capped at 50 for a role (162.772894ms)
✔ agents: stranded is per role and per business (64.735541ms)
✔ agents: a message routed to a held role and not yet received is not stranded (24.809711ms)
✔ REQ-DEC an approval outlives its run and a broker restart; a new run of the instance consumes it once (65.647448ms)
✔ REQ-DEC another instance of the same definition cannot consume an approval, and its refusal consumes nothing (36.793497ms)
✔ REQ-DEC REQ-THREAD-1 a thread approval is consumed only by a run holding the same thread (51.367662ms)
✔ REQ-DEC a later run of the same instance supersedes an open decision; another instance cannot (46.362257ms)
✔ REQ-DEC REQ-THREAD-1 a thread decision is superseded only from the same thread (50.536894ms)
✔ REQ-DEC REQ-THREAD-1 a thread instance decision raised before row 121 is not consumed or superseded by any thread run (62.384878ms)
✔ launch identity is stamped, payload identity is refused and stale holder cannot send (40.880823ms)
✔ decision classes route from policy; gated resolution is human-only, choice and target must match (47.313315ms)
✔ claim exclusion, holder release, gated revoke and rerouting to a new holder are atomic (53.294023ms)
✔ launch events require a human CLI capability; generic emit cannot forge authority events (30.885376ms)
✔ within-role decisions close atomically and invalid options or blocking omissions refuse (33.684768ms)
✔ a recommendation that is not exactly one option key refuses invalid-recommendation after the options (52.501777ms)
✔ observer capabilities read human inbox but cannot mutate or forge launch identity (31.255597ms)
✔ task action subjects and linked decision trail are complete and ordered (51.077971ms)
✔ launch binding is durable and reconnecting requires the identical trusted record (25.606597ms)
✔ business isolation includes inherited object names and cross-business message references (39.442478ms)
✔ authority never transfers between action, target, unresolved or replaced role holder; a later run of the instance keeps it (48.222519ms)
✔ task projection uses schema current view, skipping earlier and equal-start polls (29.60303ms)
✔ revocation permanently bars the old run from reclaiming first, including after broker restart (39.997529ms)
✔ empty message references refuse before storage; refusal-evidence failure stays a typed error (26.723811ms)
✔ both arbiters require human resolution when their cross-role route is themselves (41.011475ms)
✔ the shipped coder role raises task.reassign as gated to the human; task.scope.change stays cross-role (37.453126ms)
✔ S1 adapter takes resolved limits and refs, rejects mismatched instance, never mutates input (2.5051ms)
✔ channel conversion preserves the four proof/transport byte baselines and modules cannot import a proof caller (1.508083ms)
✔ channel recovery still requires the same shim path and rejects an absent or forged proof (625.861545ms)
organization: {"event":"reload-needs-restart","business":"demo"}
organization: {"event":"reload-needs-restart","business":"demo"}
organization: {"event":"reload-needs-restart","business":"demo"}
organization: {"event":"reload-needs-restart","business":"demo"}
organization: {"event":"reload-needs-restart","business":"demo"}
organization: {"event":"reload-needs-restart","business":"demo"}
organization: {"event":"reload-needs-restart","business":"demo"}
organization: {"event":"reload-needs-restart","business":"demo"}
organization: {"event":"reload-needs-restart","business":"demo"}
✔ REQ-COS-1, REQ-ROLE-2: the chief of staff ends a run with a reason and no decision, and the reason is logged (64.012173ms)
✔ REQ-ROLE-2: a role without role.end still needs a resolved decision to revoke (58.208799ms)
✔ REQ-ROLE-2: storage accepts a revoke with a reason or a decision and aborts one with neither (43.114776ms)
✔ REQ-ROLE-2: the chief of staff may still cite a decision, and a decision alone is the old path (40.662298ms)
✔ REQ-ROLE-2: a role without role.end still ends a run through a resolved decision, which is recorded and has no reason (54.888412ms)
✔ REQ-ROLE-2: a reason is required, bounded, and never sent with a decision (55.881138ms)
✔ REQ-COS-1: the chief of staff cannot end its own run; its end of the assistant stops the assistant's thread run (53.338856ms)
✔ REQ-LIMIT-1, REQ-COS-1: organization.set from the chief of staff reaches the shared writer, named as the actor (44.28091ms)
✔ REQ-LIMIT-1, REQ-COS-1: a refused organization.set logs action.refused and no action.allowed, like a refused limits.set (51.943621ms)
✔ REQ-LIMIT-1: organization.set is refused for every caller whose role file lacks organization.change (58.999194ms)
✔ REQ-LIMIT-1: the chief of staff is logged as allowed, and organization.set takes only the human's keys (58.39674ms)
✔ REQ-COS-1: organization.revision answers the revision alone to the chief of staff and spends nothing (43.685163ms)
✔ REQ-COS-1, REQ-LIMIT-1: organization.revision is refused for every caller whose role file lacks organization.change (67.973383ms)
✔ REQ-ROLE-3, REQ-LIMIT-1: a chief-of-staff change is validated, written and logged like a human's; an invalid one is refused (172.065138ms)
✔ REQ-COS-1: the chief of staff reads the revision, changes the file with it, and reads again after a stale one is refused (163.319789ms)
✔ Q169: the chief of staff's change of the assistant is validated, written and logged; a stale or protection-stripping one is refused (162.309206ms)
✔ row 65, Q169: the chief's change of the assistant's route runs the routing checks, and a valid one saves as the chief (114.332389ms)
✔ REQ-ROLE-2, REQ-COS-1: the 3c→3d migration lets the chief of staff end a held role with a reason; neither is still refused (136.715069ms)
✔ row 194 T10: the chief's reason end of a kept instance refuses instance-kept, holds the claim and spends nothing (41.854925ms)
✔ row 194 T10 (Q2): a role.revoke citing a decision the human resolved still ends a kept run (41.586906ms)
✔ row 194 T10 (B7): the chief's organization.set of a kept instance's model refuses before the writer; the human's limits.set does not (40.186855ms)
✔ row 194 T13: organization.set and limits.set refuse the launch, retired, keep and noHire keys before the writer (49.898616ms)
✔ row 194 T18 (D2.4): from a chief session veto.set and instances.set refuse, and nothing reaches the writer (47.619863ms)
✔ row 194 T8: the chief hires with a reason and no decision, the writer gets the reason as context, and the log names it (41.886136ms)
✔ row 194 T11: on a bus with two businesses, the chief of one hires and fires only in its own (37.084285ms)
✔ row 194 T8: hire and fire need a reason of 1 to 500 characters and refuse a decision key (59.572626ms)
✔ row 194 T8 (sage-1471): only the chief hires or fires; every other role refuses role-not-chief, even one granted the actions (48.583691ms)
✔ row 194 T8 (sage-1471): a chief whose authority lacks role.hire or role.fire refuses decision-required before the writer (79.135415ms)
✔ row 194 T8a: a re-hire of a fired name goes to the writer like a hire, and the writer's refusals pass through by name (48.431056ms)
✔ row 194 T8b: a definition is hireable only when every action is on HIRE_ALLOWED, it is version 2, the chief lists it and noHire doesn't (1379.969554ms)
✔ row 194 T8b: a hire without the role files configured refuses not-configured (39.883449ms)
✔ row 194 T9: a fire revokes the claim, cancels open requests, asks the launcher to kill the runs, then delists and logs (52.64345ms)
✔ row 194 T9a (bus): a fire end's done writes lifecycle.end.killed and lifecycle.end.alive with run and pid, and an unknown stop's reason; a terminate's done or a bad stop refuses (50.506668ms)
✔ row 194 T9: fire refusals come before step A and leave the claim, the requests and the file alone (42.661238ms)
✔ row 194 T9c: a writer failure at B leaves the instance firing, and the repeat delists and logs once (48.902825ms)
✔ row 194 T9c: a failure at C leaves the fire unlogged and the instance firing, and the repeat logs it (51.94219ms)
✔ row 194 W-N1: a fire.done before a later fire.stopped of the same instance leaves it firing; another instance's done does not end it (41.749081ms)
✔ row 194 T10: a hire or fire of a kept name refuses instance-kept before the writer (38.181891ms)
✔ row 194 T10: a fire the writer's check refuses from the file stops nothing and leaves the instance launchable (48.033786ms)
✔ row 194 T18: hire and fire take only their own keys, and a refused call writes nothing (48.726916ms)
✔ row 194 T8, T9, T18: through the runtime the chief hires and fires with the real writer, the receipt carries the reason, and a refusal leaves the file alone (132.704197ms)
✔ row 194 W-N1: the launcher's take of a launch or regenerate of a firing instance closes it as instance-firing (45.421189ms)
✔ C2-06 held library lock gives the agent citation-unavailable and its retry reason (5240.021837ms)
✔ C2-06 malformed sync state is availability failure, never a fabricated invalid cite (56.631955ms)
✔ C2-06 no mirror or freshly initialized empty mirror still means no served citation (62.088593ms)
✔ C2-06 coder send_message guard covers every table refusal; inserts nothing (209.037723ms)
✔ C2-06 research send_message guard covers every table refusal; inserts nothing (197.136665ms)
✔ C2-06 stored check carries the file author trailer at an unrelated cited tip (114.758188ms)
✔ C2-06 supporting cite cannot state canon, including a folder also marked playground (83.423342ms)
✔ C2-06 supporting file stores supporting scope and its real agent trailer (96.328564ms)
✔ C2-06 check evidence and insert are atomic when storing evidence fails (88.128467ms)
✔ C2-06 live limits change both directions; unreadable file keeps checks and exact fixed texts (111.753135ms)
✔ C2-06 page store is session-local, caps 20 fetches and 200 KiB, drops at disconnect (193.24354ms)
✔ C2-06 transport passes safe capped guard reason; ordinary refusal envelope is byte-identical (105.280759ms)
✔ C2-06 non-library businesses retain role.claim shape and unguarded free sends (52.342414ms)
✔ C2-06 thread messages carry file/last evidence with one read per distinct path (177.44844ms)
✔ C2-06 guarded request snapshot cannot change between check and insert (47.783781ms)
✔ C2-06 library.limits.set is human-only and invalid settings leave file and receipts unchanged (81.349391ms)
✔ C2-06 runtime reads changed and unreadable reply limits without restarting (210.549583ms)
✔ comment cursors isolate businesses, move only forward and remain append-only (30.245001ms)
✔ only trusted sync writes validated cursors; events and cursor share rollback (24.546978ms)
✔ explicit 3b copy migration preserves evidence and opens as 3g; normal startup never migrates (131.090602ms)
✔ migration refuses active writers and drifted legacy schemas, with no partial upgrade (185.604403ms)
✔ named migration registry chains 3b through 3g to a fixture-only future version in order (165.487084ms)
✔ migration refuses mismatched source metadata without changing schema or evidence (64.622694ms)
✔ offline command migrates only the supplied fixture root and reports usage errors (291.082456ms)
✔ N4: the console verbs are exactly the preview and the console resolve, and decision.resolve is not one (1.543158ms)
✔ bindConsole takes only the business human and a three-string owner subject (56.239856ms)
✔ J1, Q188: only a console cap reaches the console verbs, and a console cap reaches nothing else (76.694215ms)
✔ preview: the two real answers, a grant summary and the digest, for an open grant request only (53.605821ms)
✔ J1, J2: a decision that is not an eligible grant request refuses both console verbs (67.160154ms)
✔ N2, J13: a Console approve records via console and the owner, before the executor starts, and the grant runs once (134.810828ms)
✔ J15: a Console deny closes with the other key and starts nothing (147.863186ms)
✔ J2: approve and deny come from approvalChoice and the options, not a fixed yes and no (180.11074ms)
✔ J11: a stale digest or a key outside the two refuses decision-stale and writes nothing (66.854026ms)
✔ J14: a via console close with no matching human.input approves nothing (76.041062ms)
✔ recordEvent keeps human.input reserved, so no agent forges a console answer (55.839936ms)
✔ J7: a console proof over the socket binds a cap for its one call and the reply releases it (169.926018ms)
organization: {"event":"reload-needs-restart","business":"demo"}
organization: {"event":"reload-needs-restart","business":"demo"}
✔ M6: a creative raise refuses decision-not-allowed, cited or not, and no decision row appears; the assistant still raises (71.134726ms)
✔ a creative instance sends only to the user and hears only from the user (86.921699ms)
✔ M10 through the broker: the chief and the tester are refused on bean, the human's limits.set of its models key works (153.021248ms)
✔ row 256 T6 the human deletes a creative instance through the broker; the chief and the tester are refused at the verb (112.823312ms)
✔ X4: register adds a store reference to the running bus, and issue then writes the key (21.673383ms)
✔ X4: register runs the constructor's reference checks (1.289583ms)
✔ X4: register reads no file, so a key file left at the path stays unused, and a live token refuses (19.043786ms)
✔ X3, X4: unregister drops an entry with no token and refuses one with a live token (15.161383ms)
✔ X5: a claim holds the slot, so a second claim and a host.run refuse host-busy until release (9.965098ms)
✔ X5: a claim made while a host.run is in flight refuses host-busy (9.89483ms)
✔ X5: a stale release leaves a later claim in place (0.722475ms)
✔ X5: abortClaim aborts a live claim and says pending, and revoke's abort reaches a claim too (9.829506ms)
✔ credentials gives human and reader sessions service, account, role, date and state, and nothing else (35.502509ms)
✔ credentials refuses a role session and any argument (36.031453ms)
✔ credentials reads the status on each request, and a broker without one lists none (44.020543ms)
✔ the broker process answers credentials without a token, path or variable in its output, log or store (251.63066ms)
✔ T1: a store reference with no file yet starts, and the agent is not-issued until issue (8.316825ms)
✔ T1: a store path the reference does not own, or no store root, refuses the reference (1.126851ms)
✔ T1: a wrong mode on the store root, a business dir, an agent dir or the file refuses start (3.401646ms)
✔ T1: a missing store root refuses start; a missing {file} reference still refuses start (1.532254ms)
✔ T1: a store file that is a directory or a symlink refuses start (1.409141ms)
✔ T2: useFor keys from the session only (2.817372ms)
✔ T5: issue, rotate, revoke and delete are live with no restart, and revoke holds across one (7.689622ms)
✔ T5: a failed commit leaves the token on disk but not in memory, and a bad token or date writes nothing (3.052178ms)
✔ T5: revoke drops the token from memory before the unlink, so a failed unlink still leaves it revoked (2.777415ms)
✔ T5: revoke of a {file} reference forgets the token and never unlinks the file (1.247201ms)
✔ T5: delete refuses an agent dir holding anything but tokens (3.762016ms)
✔ D5: every credentials use( call site is on the allowlist (29.824846ms)
✔ row 199: the lifecycle verbs refuse every session but the human, and the tester revokes only (65.387037ms)
✔ T5: issue, rotate, revoke and delete are live, rewrite the business file and leave one receipt each, with no value anywhere (166.184988ms)
✔ only validated broker references load; returned data and exceptions cannot expose a known token (4.966114ms)
✔ bad file modes, symlinks, repository/data paths, malformed tokens and missing dates refuse (3.111717ms)
✔ expiry refuses use and env references never become client data (0.912278ms)
✔ S1 parsed service refs work, service mismatch refuses, Gitea rotation due is a warning state (2.167742ms)
✔ opaque tokens shorter than 16 characters refuse before use (0.475782ms)
✔ each C-suite role file carries the same two lists: human, chief-of-staff, pm, cto (1.803791ms)
✔ chief-executive-officer: messages to and from the user, chief of staff, pm and cto pass (90.286684ms)
✔ chief-executive-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored (73.377663ms)
✔ chief-executive-officer: another C-suite role isn't on the lists either (65.871001ms)
✔ chief-financial-officer: messages to and from the user, chief of staff, pm and cto pass (76.401904ms)
✔ chief-financial-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored (85.486935ms)
✔ chief-financial-officer: another C-suite role isn't on the lists either (64.122348ms)
✔ chief-information-officer: messages to and from the user, chief of staff, pm and cto pass (93.207846ms)
✔ chief-information-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored (90.754458ms)
✔ chief-information-officer: another C-suite role isn't on the lists either (61.802796ms)
✔ chief-information-security-officer: messages to and from the user, chief of staff, pm and cto pass (81.001252ms)
✔ chief-information-security-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored (76.57571ms)
✔ chief-information-security-officer: another C-suite role isn't on the lists either (66.799733ms)
✔ chief-marketing-officer: messages to and from the user, chief of staff, pm and cto pass (75.761716ms)
✔ chief-marketing-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored (68.191044ms)
✔ chief-marketing-officer: another C-suite role isn't on the lists either (67.221081ms)
limits: {"event":"limit-reached","business":"demo","check":"daily-quota","export":"mayLaunch","subject":{"instance":"coder","provider":"anthropic","model":"opus","account":"jason-max"},"path":["tokens","daily","jason-max"],"limit":0,"count":0,"unknownTurns":0}
usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"6374100e-000f-42ce-ae24-d5c63c5e4e0f","source":"@none","code":"baseline-unknown"}
limits: {"event":"limit-reached","business":"demo","check":"daily-quota","export":"mustStop","subject":{"instance":"coder","provider":"anthropic","model":"opus","account":"jason-max"},"path":["tokens","daily","jason-max"],"limit":0,"count":0,"unknownTurns":1}
usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"a2eda330-5b30-4f6d-a2cc-4343e3fcea6f","source":"@none","code":"baseline-unknown"}
✔ REQ-LIMIT-2 runtime: limits counts the daily quota, and mayLaunch refuses only the account at it (195.828659ms)
✔ REQ-LIMIT-4 runtime: a run bound with the account writes it on its usage records and stops at the quota (98.006957ms)
✔ REQ-LIMIT-4 runtime: a run bound without an account records null and the daily quota never stops it (80.750199ms)
✔ REQ-LIMIT-4 bindLaunch keeps the account off session.launched, refuses one that is not an identifier, and takes null as none (27.241665ms)
✔ a human resolve sends the raising role one message from the human, and its request is the answer (61.843884ms)
✔ a cross-role decision resolved by its arbiter comes from that role and run, with no request (52.298113ms)
✔ a human withdraw sends one message with the note (47.46996ms)
✔ a human seen before the close leaves the request on the close's answer, not the seen (48.9655ms)
✔ the raising run's withdraw, a supersede, a within-role raise and seen send nothing (58.330432ms)
✔ refused closes send nothing: invalid-choice, decision-closed, not-resolver (58.869663ms)
✔ a raising role nobody holds at the close gets the message on the next claim (60.13018ms)
✔ a human DECISION send keeps its own instruction as the request, not a close's answer (46.462257ms)
✔ a cross-role raise whose arbiter the raiser does not hear from is refused and stores nothing (62.269465ms)
✔ a gated raise by a role that does not hear from the human is refused and stores nothing (57.159528ms)
✔ a route the raiser hears from is allowed, checked from the route to the raiser (61.996568ms)
✔ a refused supersede withdraws nothing (56.84148ms)
✔ the assistant's within-role and gated raises still work (57.201613ms)
✔ roles lists open decisions routed to a role, and never the human inbox (53.218856ms)
✔ recent lists closed decisions of every route, newest close first, with how each closed (64.003908ms)
✔ recent gives the closing event as closed when the decision was seen first (56.056797ms)
✔ recent stops at RECENT rows (173.154281ms)
✔ every row is what trail already gives the same session for that id (83.210467ms)
✔ a role session can't list decisions, so it can't read another role's open decisions (70.225ms)
✔ decisions is a read: one business, strict arguments, nothing written (83.552383ms)
✔ endLaunch writes session.ended, releases the run claim and kills its capabilities (41.270227ms)
✔ endLaunch refuses an unknown run, a second end and a rebind of the ended run (27.378987ms)
✔ a restarted broker refuses to rebind an ended run; a refused rebind leaves the run unbound (35.121197ms)
✔ endLaunch leaves a claim another run took alone (28.523334ms)
✔ refuse records action.refused against the caller with the code only (25.053195ms)
✔ launches off refuses role.launch with launch-revoked until launches on (37.051359ms)
✔ broker process: launch ops authorize role.launch, record refusals and end runs (299.595161ms)
✔ row 281 T2: a fire with host grants on two hosts and a Gitea grant answers with a job, then revokes all three (454.430965ms)
✔ row 281 T3 (sage-2575): a delete with grants takes two requests: the first starts the job, the next completes (413.031737ms)
✔ row 281 T3b (Q2): a delete whose job refuses on host B; the retry refuses grant-revoke-failed and revokes only B and Gitea (370.942502ms)
✔ row 281 T3b: B cleared by hand with hosts.revoke; the next delete starts a job for Gitea and the leftover line only (379.094126ms)
✔ row 281 T3c (sage-2575 condition 4): a delete of an instance with no grant completes in one request (101.446475ms)
✔ row 281 T4: host B unreachable in a fire: the job refuses, A stays revoked, B and Gitea untouched; a repeat completes (347.437449ms)
✔ row 281 T4b (Q1): a line a manual hosts.revoke left on C is removed by the fire, with its close (160.921363ms)
✔ row 281 T4b (Q1): with C unreachable, the fire completes and names the line in grantsLeft (151.804046ms)
✔ row 281 T5: Gitea's admin token can't be checked: the job refuses with the Gitea grant intact (206.108683ms)
✔ row 281 T5b (N1): a failed token DELETE refuses gitea-left; the repeat retries only this agent's entries (556.304957ms)
✔ row 281 T6 (sage-2574): a host decision approved before the fire and run after it ends revoked, with nothing applied (112.984495ms)
✔ row 281 T6b (sage-2574): a Gitea decision approved before the fire and run after it ends revoked before any Gitea write (139.32212ms)
✔ row 281 T6c: a host executor in flight aborts and ends revoked; a Gitea executor in flight is awaited and leaves no token (356.130831ms)
✔ row 281 T6d (B1): undecided host and Gitea decisions are in the set, and approved after the fire both end revoked (149.425483ms)
✔ row 281 T6e (B1): a grant raise refuses instance-fired while firing and after the fire, goes through after a rehire, and refuses grant-revoke-running during a delete job (188.889977ms)
✔ row 281 T7: an instance with no grant fires as today, synchronously, with the same events (87.237795ms)
✔ row 281 T9 (B3): one step G per agent; the manual verbs refuse while it runs, and sweep names it running (389.100277ms)
✔ row 281 T10 (B2): the fire and the delete answer while their jobs are held, and the broker answers other verbs (352.705981ms)
✔ row 281 T11 (C1): a fire's job completes after the chief's run ends and processing halts (143.918013ms)
✔ row 281 T12 (C1, N7): a step B refusal in the job is fire.failed, and the repeat runs B and C synchronously (154.848526ms)
✔ row 281 T13 (N4): a restart records each held job interrupted once, with one message each; an ended job gets none (241.379185ms)
✔ row 281 T14 (N1, sage-2653): a host removed under an undecided decision stops the fire on host-unknown; the human's no closes it, and the repeat fire has no job (113.085746ms)
✔ row 239 T4: a refusal after the writer's revoke is named -revoked, in the job's fire.failed and notice, a synchronous fire and a delete (168.52773ms)
✔ row 239 T4b: an unmarked step B refusal keeps its code, and the notice says nothing of the tokens (120.541973ms)
✔ X-G3: on scratch 1.27.1, a grant makes the user, mints, forks, checks reach, writes the file, and revoke deletes the token (12452.363493ms)
✔ versionAtLeast compares numbers and refuses a prerelease of 1.27.0 (2.334499ms)
✔ X-G1: a raise that fails a check refuses and stores nothing (122.188429ms)
✔ X-G1: a creative role, a role without identity and a missing or due slot refuse at raise (373.068767ms)
✔ X-G1: the chief of staff refuses at raise, whatever its definition, identity and publish declare (76.103109ms)
✔ X-G2: admin set refuses each failed check and writes nothing, then writes the slot once (270.035777ms)
✔ X-G3 to X-G8: an approve makes the user, mints the token, forks, checks reach and writes the file, record and grant.applied (157.098933ms)
✔ X-G4: a user this stack did not make, an admin, a disabled user and a remade user each refuse (496.717845ms)
✔ X-G6 and X-G8: the user and mint steps are written before their calls, and each result after its call (178.9991ms)
✔ X-G4: a fork by the seat user of another repository than the project refuses fork-foreign (151.684442ms)
✔ X-G5: a failure after the mint deletes the token, unloads nothing it did not load and leaves no file (249.244144ms)
✔ X-G5: a token delete that fails is left at Gitea, shown by status and taken by sweep (207.848606ms)
✔ X-G5: a mint that fails deletes by name, and a refusal at step 0 leaves the decision unspent (254.191246ms)
✔ X-G5: an agent held for an unknown token is refused at step 0 with no Gitea call (137.10146ms)
✔ X-G5 and X-G9 (step 7): a rotation whose old-token delete fails stays applied with the old id left (286.494712ms)
✔ X-G10: in a rotation the store file holds the new token before the old one is deleted (259.844699ms)
✔ X-G6: a rotation cut before the rename settles back at once, and the old token stays live (252.50276ms)
✔ X-G6: a rotation whose step 8 write fails is settle-pending, and a restart settles it forward (294.005408ms)
✔ X-G6: a restart settles an open rotation back when the file still holds the old token (236.308353ms)
✔ X-G6: a restart settles an open rotation forward when the file holds the new token (208.90576ms)
✔ X-G6: a 401 on the file token loses the grant: both tokens go, the record goes and memory unloads (256.628803ms)
✔ X-G6: a 403, 404, 500, a hang and a dropped socket each leave the rotation settle-pending with nothing deleted (1531.691052ms)
✔ X-G6: a file token no grant minted is held; the next restart says so again; a revoke clears it and takes both ids (289.91152ms)
✔ N9: a revoke of an open rotation, then a restart: no settle, no Gitea call and no message (268.74801ms)
✔ N9: a 404 on a delete by id counts as done (253.642079ms)
✔ X-G6: a restart undoes each step a killed child left, and spends an approved unspent decision (738.359044ms)
✔ X-G6: a restart with no admin slot leaves the user an orphan and the token left (104.771783ms)
✔ X-G7: a change to the definition, identity, publish remotes or admin slot after the raise ends decision-mismatch (196.171155ms)
✔ X-G7 and X-G9: an admin rotate voids open decisions, and rotate --finish deletes what was left (162.159893ms)
✔ X-G9: a rotate whose name is taken refuses and writes nothing; remove takes the slot away (87.888992ms)
✔ X-G9: a slot past its rotate-by date refuses a run at step 0, leaving the decision unspent (63.188931ms)
✔ X-G11: run refuses every caller but the human, an unapproved, a spent and a busy decision (122.636789ms)
✔ kill switch (plan :16): while halted the chief still reads grants.status, and an agent grants.revoke refuses (117.564427ms)
✔ X-G11: a revoke while the executor runs aborts it and the grant ends revoked (137.081177ms)
✔ X-G11: a revoke unloads memory and removes the file before its Gitea delete (139.797859ms)
✔ X-G11: a revoke during a rotation step 7 ends it revoked, and step 8 writes no record back (214.213625ms)
✔ X-G11: a revoke while a sweep settles a rotation, forward or back, ends it revoked with no record (354.101102ms)
✔ X-G11: a revoke during a settle whoami that finds a foreign token ends it revoked, not held (186.438441ms)
✔ X-G11: a revoke during a settle whoami that gets a 401 ends it revoked, not lost (186.89778ms)
✔ X-G12: a token that reaches wider than its forks fails with the repository named (405.713054ms)
✔ X-G12: reach is paged by X-Total-Count and a count that does not add up refuses (249.949159ms)
✔ X-G13: an agent cannot record a grant event, and the trigger refuses one from any writer but the grant writer (42.22545ms)
✔ X-G14: credentials delete fires the user: tokens go, login is prohibited, and grant.revoke.closed records it (283.095811ms)
✔ X-G14: a fire whose token delete or login PATCH fails lands it in serviceLeft (151.427831ms)
✔ X-G14: a fire whose user is gone or remade skips the fire steps and says why (310.751903ms)
✔ X-G14: a sweep retries a fire only for the user it fired: a remade or gone user is skipped and named (355.779008ms)
✔ X-G14: a revoke Gitea cannot reach stays open, and a restart closes it (145.526619ms)
✔ row 281 T8: a tester grants.revoke refuses tester-dev-only once bus.tester is off; the human revoke keeps its records and starts no job (136.094338ms)
✔ X-G15: look-alike commit steps outside the grant writer are ignored at start, by revoke and by status (134.976582ms)
✔ X-G15: a look-alike spend under another kind with the grant writer pair is not an open grant (46.023351ms)
✔ status lists the slot, users, grants and nothing secret, and every grants verb needs service gitea (111.794544ms)
✔ 3j copy migrates to 3k: every row kept, and sqlite_master gains only the two tables and their keys (178.416674ms)
✔ a 3j→3k step that fails partway leaves the store at 3j with every row and the schema intact (200.008494ms)
✔ the 3j engine refuses a migrated store, migrating or not, and leaves it as it was (187.344293ms)
✔ gitea_users: one user per business and agent, an id above 0, a 16-hex nonce and a real decision (21.789129ms)
✔ gitea_grants: one grant per agent, a projects array, a token id above 0, and only for a recorded user (25.098818ms)
✔ G1, A1: only the chief raises a grant, and a refused raise stores nothing and runs no keyscan (71.939626ms)
✔ G1: grant goes only with credential.mint, row a takes only host-enroll, and E1 refuses each bad field (94.566154ms)
✔ G5, A5, A6: the scanned key set must equal the requested set, or host-key-mismatch and nothing stored (65.611039ms)
✔ G4 (host-enroll block, M1): the broker appends the keys, fingerprints and sudo line, and the cap counts the block (50.76328ms)
✔ G6, X1: the human's cli yes starts enrollment, which writes the record, the key file and the events in order (78.452306ms)
✔ A2, A4: a credential.mint without grant, and a no, start nothing (258.14952ms)
✔ A3, X1: a resolve by the tester or an agent starts nothing (248.847937ms)
✔ G6 (duckworth-0081 B3): a withdraw by the chief or the human, and an arbiter resolve, start nothing (256.393514ms)
✔ G10 (duckworth-0081 B1): a second start for a spent decision refuses decision-consumed, and an unresolved or agent-resolved one not-authorized (82.332152ms)
✔ A8, S1: two approved enrollments for one host: the second ends host-enrolled and the pin stays (96.515493ms)
✔ A9: the hosts primary key refuses a second record for (business, host) (43.37007ms)
✔ X3: a failure at step 2 deletes the record again and ends grant.failed, with no key file (78.409815ms)
✔ A10, X3: at start a resolved, unspent enrollment is spent and ends interrupted, and never runs late (48.306877ms)
✔ X3: at start an enrollment that stopped after its registry step loses its record and key file (70.772692ms)
✔ G24 first sentence, M2, A12: tags are mosaic- and 32 hex, and differ by business, agent and host (0.51845ms)
✔ E4: hosts.check sets the record ready and records grant.host.checked; a non-zero list leaves it pending (75.883063ms)
✔ G20 (duckworth-0081 B3): the human's hosts.check marks the host ready, and the reader refuses (65.786619ms)
✔ G18 (duckworth-0081 B2), broker half: a check refused host-key-mismatch leaves the host pending-install with no grant.host.checked (69.082841ms)
✔ E4: a check whose installer fingerprint differs from the record refuses host-changed (66.846363ms)
✔ E4, G21: hosts.remove is the human's or the tester's, deletes the key and the record, and records grant.host.removed (78.412314ms)
✔ G21, F1, F2, M4, A22: hosts.remove refuses host-line-left on a guarded hostLineLeft, and ignores look-alikes (76.55109ms)
✔ hosts.remove refuses host-in-use while a grant record names the host (70.303534ms)
✔ the grant writer refuses a body outside section 7's shape (40.287111ms)
✔ recordEvent refuses reserved-event for a grant.* action or operation (39.410299ms)
✔ row 280: an occupied TCP port is attempted, refused, and retried with our sshd (103.037469ms)
✔ row 280: every injected picker sample is unprivileged and outside the ephemeral range (0.766808ms)
✔ G7: an Approve installs the tagged line, logs in with the new key, and writes the key file, record and grant.applied (801.240018ms)
✔ G7: a commands change on a live grant updates the record in one transaction and keeps the key and line (625.385599ms)
✔ G8: a failure at install or verify removes the line and leaves no record, key file or reference (1746.50004ms)
✔ G8: a failed remove adds hostLineLeft and tells the human to sweep (736.056975ms)
✔ G8: a failure in step 5 before commit unlinks the key file, drops the reference and removes the line (730.29745ms)
✔ G8: a store fault in the commit transaction ends host-failed with no record, key file, reference or line (786.341211ms)
✔ G8: a failed step 1 check spends the decision and runs nothing remote (112.623013ms)
✔ G9: a registry, definition or commands change between raise and Approve ends decision-mismatch before any remote step (615.929354ms)
✔ G9: an agent no longer a role or no longer declaring host ends with its code, spent (129.825025ms)
✔ G10: a second start refuses decision-consumed, and an unresolved or agent-resolved decision not-authorized, writing nothing (609.251001ms)
✔ G15: no event, message or decision holds the private key (577.334362ms)
✔ G23: a revoke during install ends grant.failed revoked with no key file, no grant and no line (570.693535ms)
✔ G23 (row 249): an add that writes after an abort's remove leaves hostLineLeft until the sweep (884.641151ms)
✔ G23 (row 249): an add that writes after a timed-out install's remove leaves hostLineLeft until the sweep (850.450191ms)
✔ G23: a revoke recorded after the raise and before the start ends step 1 revoked, and a held slot ends host-busy (499.161027ms)
✔ G24: names at 64 characters with . and _ give distinct tags of the fixed length (0.417533ms)
✔ G11: a restart after install removes the line, then ends interrupted with the tag, holding the slot until then (226.019606ms)
✔ G11: a restart after a new key's commit, with the key file written, ends with no key file, record, reference or line (219.026704ms)
✔ G11: a restart after a commands change's commit leaves the record as it was and asks nothing of the host (536.852844ms)
✔ G11 (B2): a restart before step 1, spent or not yet spent, ends interrupted and nothing runs later (70.782742ms)
✔ G11: a remote undo that fails ends interrupted with hostLineLeft and the sweep hint (282.807195ms)
✔ G11: a restart leaves a finished grant alone, and the reconcile adds nothing for it (515.368607ms)
✔ N1 (G27): the start sweep unlinks host.<id> files with no record in loaded businesses only, and refuses a store dir that is not private (6.444404ms)
✔ G12: the human's hosts.revoke deletes the record, the key file, the reference and the line, with a closed marker (675.992361ms)
✔ G12 (N4): a revoke with no record still removes the computed tag's line, with granted false; bad args refuse (228.488828ms)
✔ G13: a revoke during install aborts the executor, which ends revoked, and the line goes (578.318086ms)
✔ G26: the human, the assistant and the tester revoke; the chief and a pm refuse; sweep is the human's or the tester's (512.883072ms)
✔ row 281 T8: a tester hosts.revoke refuses tester-dev-only once bus.tester is off, and a human revoke writes no job records (679.766661ms)
✔ G27: a restart after step 1 sweeps the key file and runs step 3 once the bus is up; status shows the revoke until then (688.859664ms)
✔ G27: after step 2 with the host down, the restart closes the marker with hostLineLeft; a marker without a revoke id is not reopened (970.392053ms)
✔ G27: a key file a revoke could not unlink is reported left and goes at the next start (665.906027ms)
✔ G28: a commands change, then a revoke, then a restart leave no record, key, reference or line (711.254762ms)
✔ G24 (B4): hosts.sweep removes only this business's recorded tags no live grant holds, and records what it left (948.288159ms)
✔ G12: the local steps finish before the host step, so a host that hangs leaves the agent no access (704.200702ms)
✔ G23 (X5): a revoke right after the spend reaches the executor's claim, so the grant ends revoked (212.651091ms)
✔ G23 (X5): a revoke that lands as verify returns ends revoked with no record, key file or line (654.590562ms)
✔ G13: a revoke whose host remove fails still drops the record and key, and reports the line left for a sweep (684.556349ms)
✔ G22: enroll, check, grant, host.run, a commands change the next host.run uses, and a revoke that kills a run in flight (1207.601796ms)
✔ mos-1163: a grant whose agent became a creative role after the raise ends host-creative-role at step 1, spent, with nothing remote (65.388099ms)
✔ sage-1908: once the agent of an applied grant is a creative role, host.run refuses host-creative-role, runs nothing remote and keeps the record (514.278937ms)
✔ G1 (host): only the chief raises a host grant, a grant on any other action refuses, and nothing is stored (58.665112ms)
✔ G1, R4: the grant takes exactly method, agent, host, commands and rotateBy, and an unknown method refuses (71.166275ms)
✔ row 236 (#1742): a gitea grant on a broker with no Gitea path refuses gitea-not-configured, and nothing is stored (44.406518ms)
✔ G2: an agent whose definition lacks host refuses host-not-declared, and an unknown agent unknown-role (46.513809ms)
✔ mos-1163: a grant whose agent is a creative role refuses host-creative-role, even when its definition declares host (42.862286ms)
✔ G3: wildcard, shell, empty and other 210 D6 argv prefixes refuse invalid-request (82.83108ms)
✔ R4 rotateBy (sage-1782): a real calendar day after today UTC, or invalid-request (59.691276ms)
✔ G19: a grant naming a host that is pending-install refuses host-not-ready, and an unknown host host-unknown (56.949102ms)
✔ R4, G5: the raise routes to the human and its event body binds the eight fields with their hashes (42.090932ms)
✔ G4 (host block): the broker appends the host, each prefix, the rotate date and new key or change (67.658435ms)
✔ 3i copy migrates to 3j: every row kept, and sqlite_master gains only the two tables, their keys and the guard (172.078032ms)
✔ a 3i→3j step that fails partway leaves the store at 3i with every row and the schema intact (177.541082ms)
✔ the 3i engine refuses a migrated store, migrating or not, and leaves it as it was (153.467574ms)
✔ A22b, sage-1703: a session-written grant.* row from before the step survives it, and the grant readers ignore it (127.853024ms)
✔ the guard: a grant.* action or operation on action.allowed needs the (NULL, grant) actor (26.43247ms)
✔ hosts: one record per business and host, a ready host has its installer and check, grants need the host (24.108591ms)
organization: {"event":"reload-needs-restart","business":"demo"}
✔ row 298 runtime: human scope approval writes the file and organization history at the supplied revision (130.661065ms)
✔ row 298 (Q3): only the human at the cli reads or sets the scope; agents, the tester, a reader and the Console refuse (131.761754ms)
✔ row 298 (Q1): organization.set and limits.set refuse a grantScope key, and nothing is written (97.265251ms)
✔ row 298 (Q3): the human verb writes the scope and a grant.scope record with the human proof and both sha256 (87.74689ms)
✔ row 298 (Q4): an in-scope Gitea grant is issued with no inbox item, logged with 236 records, and revocable (252.13646ms)
✔ row 298: an out-of-scope Gitea grant waits for the human, whose Approve still issues it (192.625248ms)
✔ row 298: with no scope, a bad scope or an unreadable file, an in-scope-looking grant waits (268.648282ms)
✔ row 298 (Q6): a chief-of-staff instance that is not launch.by never raises in scope (87.907536ms)
✔ row 298 (Q5): a scope narrowed between the raise and the spend ends the grant scope-changed (124.247748ms)
✔ row 298 (Q2): an in-scope host grant is spent with no Approve; ls never covers lsblk, nor a scope command extra arguments (114.445813ms)
✔ row 298 (Q5): a host scope narrowed before the spend ends scope-changed (100.744691ms)
✔ row 298 Q4: missing scope evidence or a bad scope digest cannot authorize execution (166.993751ms)
✔ row 298 T4/T8: an in-scope host grant issues, records and revokes through the existing executor (112.43411ms)
✔ row 298 T6: host enrollment stays open for human Approve even with both methods in scope (85.849879ms)
✔ row 298: scope without an organization revision never closes automatically (78.132416ms)
✔ REQ-WAIT-1: the broker hard waits are exactly the list, and match the business vocabulary (2.179673ms)
✔ REQ-WAIT-2: a business granting a hard wait at either class is refused; the actions that left are grantable (35.2942ms)
✔ REQ-DEC-2: every hard wait goes to the human, cited or not, and the arbiter cannot resolve it (805.450166ms)
✔ REQ-DEC-2: a gated raise citing the current spec goes to the arbiter for its domain; uncited, to the human (326.481578ms)
✔ REQ-DEC-2: an arbiter-approved cited gated decision authorizes the raiser, and the human cannot resolve it (84.929777ms)
✔ REQ-DEC-2: a cited merge raised by merge-gate goes to the technical arbiter; a merge raised without the grant routes by citation (122.514159ms)
✔ REQ-DEC-2: a stale or unconfirmed citation refuses without a decision; an arbiter raising its own goes to the human (199.304915ms)
✔ Q169: the chief of staff's end of the assistant stops every thread run; its own run and another ender's are refused (92.099253ms)
✔ Q169: a revoke of the assistant the chief of staff raises goes to the human, cited or not, and no arbiter resolves it (223.549035ms)
✔ Q169: another role's cited revoke of the assistant, resolved by an arbiter, is refused (159.774507ms)
✔ Q169: a revoke of the assistant citing a decision the human resolved stops its thread run (100.555347ms)
✔ Q169: a cited revoke of a role not in END_PROTECTED still goes to the arbiter, and executes (83.063797ms)
✔ Q169: a role granted role.revoke at either class still sends a revoke of the assistant to the human (128.028052ms)
✔ row 280: an occupied TCP port is attempted, refused, and retried with our sshd (101.552376ms)
✔ row 280: every injected picker sample is unprivileged and outside the ephemeral range (0.538847ms)
✔ the executor tests need sshd, ssh, ssh-agent, ssh-add, ssh-keygen and setpriv: a missing one fails, never skips (0.194215ms)
✔ T3: organization.set, limits.set and instances.set refuse hosts, and the writer never runs (37.259071ms)
✔ T4: the value check takes one unencrypted ed25519 key and nothing else (229.423133ms)
✔ T5 to T8: registry, grant, argv shape and allowlist refusals (657.83753ms)
✔ T9: under 1.7 every call needs a decision bound to its host, argv and stdin, spent once (383.385021ms)
✔ T10, T11: argv reaches sudo unchanged after sudo -n -- (375.150267ms)
✔ T12, T13: exit code passes through, the timeout kills the group, output is capped (1638.980328ms)
✔ T14: a host key not in the registry refuses and nothing runs (257.362468ms)
✔ G18: hosts.check with a wrong pin refuses host-key-mismatch and runs nothing on the host (399.784497ms)
✔ N3: a remote exit 255 that prints the pin refusal text is the command result, and an ssh failure keeps its message (404.044248ms)
✔ T15: ssh reads no config file and no user known_hosts (332.062362ms)
✔ T16, T17: key material in output or stdin refuses credential-leak, and no event holds it (783.551184ms)
✔ T18, T19, T20: one call at a time, no key in any argv or env, and nothing left after (4753.247801ms)
✔ T21: revoke kills the call in flight, and the next call refuses (293.550829ms)
✔ T22: events carry host, address, user and argv in clear, and sizes and hashes only (263.923055ms)
✔ T24: no literal gitea and vikunja kind list outside vocabulary.mjs, and the credential use sites are known (16.693533ms)
✔ T25: no role definition lists host.sudo while it is a hard wait (0.493927ms)
✔ T27: the bus child dying takes ssh and ssh-agent with it (312.726447ms)
✔ T27: ssh-add -t drops the key from an agent the test keeps alive (3554.570679ms)
✔ N2: a hung ssh-add is killed at its limit or on abort, and nothing is left running (427.466709ms)
✔ T27: the start sweep keeps a live bus dir and kills only a matching live process (27.198151ms)
✔ T27: the bus start sweeps <configDir>/secrets/run before it listens, and a stray entry stops the start (63.590962ms)
✔ M3: host.run refuses host-not-granted unless the grant record has an approved, spent host grant (143.761299ms)
✔ M3: a host_grants record gives Credentials a store reference at start, and a restart reads its key (98.543369ms)
✔ G16: the writer refuses each user, tag and key the design names, before any key file (3532.564322ms)
✔ G16: from= comes from the host file, a privileged user skips the group and sudo checks, and the line is exact (938.600927ms)
✔ G16: list shows tagged lines only, and add and remove never touch a line outside the tag pattern (480.829955ms)
✔ G25: the writer refuses a symlinked dir or user file, a group-writable dir and an odd tmp, and writes 0644 (631.117497ms)
✔ G16: mosaic-keys passes the three requests to the writer through sudo and refuses anything else without it (132.754273ms)
✔ E3: the sudoers line and the sshd drop-in are the design lines and parse (22.298093ms)
✔ human proof binds CLI entry, process start and nonce; agents and incomplete ancestry refuse (1.77314ms)
✔ process reader gets own kernel identity without exposing environment values (0.54449ms)
✔ EACCES ancestor environments skip only markers; commands and registered launches still refuse (0.657392ms)
✔ real pid 1 remains inspectable when its environment is protected (0.289688ms)
organization: {"event":"reload-needs-restart","business":"demo"}
organization: {"event":"reload-needs-restart","business":"demo"}
✔ row 165: instances and instances.set refuse every non-human session but the tester, the chief of staff included, and pass the verified actor (57.279688ms)
✔ row 165 runtime: an add and a change reach the organization file with the human as actor; each refusal keeps the bytes and logs nothing (220.342842ms)
✔ row 194 T12: agent and reader sessions refuse veto.set; the tester gets add and change but not delete or veto.set; the human passes the hook for each listed verb (42.979727ms)
✔ system Python is a resolved root-owned ELF, never a shim or home interpreter (3.201451ms)
✔ real system interpreter is available and safely inspected (28.149957ms)
✔ restart receipt appends actual replacement identity and refuses unsafe files (3.428684ms)
✔ activation gate compares fresh startup receipt to the current interpreter identity (2.158965ms)
✔ non-regular startup receipt refuses promptly without waiting on a FIFO peer (45.027728ms)
✔ REQ-DEC-2: a merge-gate raise its arbiter resolved lands through the host op: checkLand answers the facts and a ticket, records nothing, and recordLand spends the decision once (65.368333ms)
✔ checkLand refuses on the decision and the review (60.417042ms)
✔ REQ-LAND-1: a gated merge decision refuses not-authorized, cited and approved by the arbiter or uncited and approved by the human (144.562734ms)
✔ REQ-LAND-1: a within-role merge grant refuses not-authorized at the land (48.879073ms)
✔ a cross-role merge that routes to the human, because merge-gate is its own arbiter, lands on the human's CLI answer (45.690138ms)
✔ a merge option with no first line refuses no-subject, as land-work does (47.968617ms)
✔ checkLand refuses with land-work's codes past the authority check, and a decision raised for refactor never lands (113.534915ms)
✔ a ticket outlives the run that asked, and recordLand checks the task again (54.350077ms)
✔ two tickets on one decision: the first recordLand lands, the second refuses decision-consumed and records nothing (54.511326ms)
✔ landRefused files the code on the task, tells the role only with notify, and ends the ticket (50.852828ms)
✔ landHeld is true only for an approved, unspent cross-role merge decision this role raised for a task in this thread (54.564989ms)
✔ landHolders lists a merge decision exactly while landHeld is true for its non-thread instance, in decision order (69.37092ms)
✔ landHolders leaves out a thread instance's decision, even one raised before its role became one (42.800443ms)
✔ landRelease releases the holding run by land-relaunch once it has asked message.receive and nothing delivered to it is unread, and waiting messages go to the next holder (64.349816ms)
✔ a landing run started after the resolution passes checkLand for its held decision before any message.receive, and lands it (50.080276ms)
✔ the bus process answers landHolders and landRelease from their own lines, not as credentialStatus (241.597091ms)
✔ usage.begin with a decision id needs it held for the run's instance, usage.end needs the begin, and the limit checks see the landing turn (59.268618ms)
✔ no run may write the action.allowed for git.merge.protected itself (31.78045ms)
✔ a message to a stopped role sends launch.by one notice, and the result says so (45.549035ms)
✔ a message to a role outside launch.instances says so in its result and in the notice (31.13885ms)
✔ a message to a running role sends no notice and its result is unchanged (23.616399ms)
✔ a re-route at a claim, a release and claim, and a broker restart send no second notice (41.283047ms)
✔ a run launched but not yet claimed counts as no holder (24.188292ms)
✔ no notice for a message to launch.by, from it, a refused one from a tester, to the human, or in a thread to a thread instance (46.85126ms)
✔ a business with no launch block tells nobody and says there is no launcher (22.430489ms)
✔ the notice sender stays internal: no role is named _bus and no caller can send as it or to it (59.624354ms)
✔ row 302 a run threadIdle released answers launcher-released on receive, state, read and send, logs each, and claims nothing again (74.188776ms)
✔ row 302 with a run launcher-released, a run that lost its claim another way still answers not-holder (56.23636ms)
✔ row 302 a run landRelease released answers launcher-released, and claims nothing again (60.771505ms)
✔ C2-03b T6: the slot before any chief evidence, then the listed chief's live grant (44.890575ms)
✔ C2-03b T7: a chief revoked through grants.revoke or fired through instance.fire refuses, and the fallback stays ended (341.210241ms)
✔ C2-03b T7 choice checks: delisted, a fire under way and held each refuse; a rehire lists the chief again (60.948218ms)
✔ C2-03b T8: a chief grant on another project ends the fallback, and two listed chiefs refuse library-fetch-no-grant (55.548923ms)
✔ C2-03b departure (sage-2928): with no chief entry, any Gitea grant evidence refuses (29.746186ms)
✔ C2-03b T9 runtime: the chief's store file and user, then a real revoke that runs no git with the slot at 0000 (1536.679221ms)
✔ C2-03a library.sync: every agent, the tester and a reader are refused before the adapter runs (37.582795ms)
✔ C2-03a library.sync: the human fetches, accept passes through, and a held sync is a recorded refusal (31.247651ms)
✔ C2-03a library.sync: a LibraryError keeps its code and a host without sync is not configured (44.081812ms)
✔ C2-03a runtime: a librarySync from a boot config, with no function, is refused (1.670728ms)
✔ C2-03a runtime: the timer syncs each entry with a user at start and on each tick, logs codes only, and stops on close (779.840284ms)
✔ row 254 human-cli: library.sync outlasts the 5 s client default, and library.status does not (6164.312763ms)
✔ C2-04 M4: both verbs reject every agent before arguments or adapter access (65.972186ms)
✔ C2-04 bus: human reads validate keys and return adapter results without path leakage (25.785379ms)
✔ C2-04 socket: each async library verb resolves its result rather than serializing {} (119.623272ms)
✔ C2-04 runtime: protectedRoots skips library but retains real code-root credential protection (173.712045ms)
✔ C2-04 runtime: unsafe existing mirror refuses boot and never publishes a socket (44.995214ms)
✔ C2-04 runtime: real library adapters reach the socket and lock waits leave other bus reads responsive (373.770059ms)
organization: {"event":"reload-needs-restart","business":"demo"}
✔ T20 fire: a revoke that fails stops the fire with the file unchanged; one that succeeds revokes, keeps the directory and names the services outside the store (198.959204ms)
✔ T20 fire: an instance already delisted still has its tokens revoked and the file is left alone (96.511621ms)
✔ T20 fire: with no entry in the running bus, a token on disk refuses and an empty store goes on (95.036233ms)
✔ T20 delete: a revoke that fails keeps the file; one that succeeds clears the store, deletes, and names the tracker bot (115.84903ms)
✔ T20 delete: with no entry in the running bus, a token file is cleared and the delete goes on; a file reference refuses (101.050886ms)
✔ T21 delete: a write between the raise and the take makes the delete refuse revision-conflict before it revokes anything (102.738336ms)
✔ row 281 T1 fire: a host.<id> or granted gitea file in the store refuses step B credential-revoke-failed, file unchanged (102.512806ms)
✔ row 281 T1 start: a host grant record whose key file is gone starts and reads not-issued (93.72515ms)
✔ row 194 T12: agent and reader sessions refuse the lifecycle verbs before any effect; the tester gets launch, end and the request read, never regenerate (67.109689ms)
✔ row 194 V2 and V4 at the verb: the request is open, by the human, with a human.input; thread, retired, unknown and revoked refuse with no event (40.589079ms)
✔ row 194 D1.1 take: a request is taken once, closes once, and lifecycleRequests lists only what is not closed (49.086951ms)
✔ row 194 D1.1 take: a launch.revoke after the request closes it launch-revoked, and a request past 60 s closes request-expired (68.921382ms)
✔ row 194 T15 (bus): while halted, launch and regenerate refuse processing-halted at the verb and at the take, hire and fire refuse, terminate goes; an unreadable switch refuses with its code (53.488034ms)
✔ row 194 T12a: the tester launches and ends on its own business with actor tester; bus.tester off in the file refuses the call and the take tester-off (42.676643ms)
✔ row 194 V3 terminate: claims revoked, open requests cancelled, bound runs named, taken requests listed; nothing at all answers not-held (51.053234ms)
✔ row 194 V3 terminate of a thread instance: the human ends every thread, the tester only its own (37.126222ms)
✔ row 194 T6 V5 order at the verb: the writer's named refusals, then instance-running, instance-starting, the last-listed refusal and the revision (54.811742ms)
✔ row 194 V5: an open launch past its 60 s is not starting, as it can only close request-expired (23.77849ms)
✔ row 194 V5 after the take: lifecycleDelete re-checks running and starting, then commits through the writer with the human as actor (38.914095ms)
✔ row 194 V5 retry: a retired name deletes again only after workspace-rename-failed, and that request commits nothing (35.721007ms)
✔ row 194 V5 runtime: a delete request, the take and lifecycleDelete commit the file with retired, log the human and reload so the name no longer binds (228.960281ms)
✔ REQ-LIMIT-3 limitLeaves finds every limit object and skips the agent numbers (1.954578ms)
✔ REQ-LIMIT-3 limitLeaves takes token limits at schema depth only, whatever their names (0.395992ms)
✔ REQ-LIMIT-3 with no check switched on a launch is allowed, a turn never stops, and every limit is not enforced (25.822781ms)
✔ REQ-LIMIT-3 a fixture check that refuses refuses the launch and stops the turn, logged with the limit and the count (31.771558ms)
✔ REQ-LIMIT-3 a report that omits a limit shows it not enforced; a counted entry and a reason come through (39.175146ms)
✔ REQ-LIMIT-4 each check gets the business, a copy of the limits, the subject, the records and the time (39.434401ms)
✔ REQ-LIMIT-4 fail closed: a throw refuses, stops and fails the report, naming the check and the code (25.372895ms)
✔ REQ-LIMIT-4 fail closed: a malformed answer, a promise, a rejected promise, a non-boolean or a bad hit is malformed-answer (26.563466ms)
✔ REQ-LIMIT-4 fail closed: a check switched on but not loaded refuses, stops and fails every limit as not-loaded (21.111372ms)
✔ REQ-LIMIT-4 state(), never-loaded case: before any load the report shows not enforced, or not-loaded for a switched-on check (24.082065ms)
✔ REQ-LIMIT-4 state(), first-load-refused case: a check refused on its first load is not-loaded in mayLaunch, mustStop and report (19.961681ms)
✔ REQ-LIMIT-4 fail closed: an unreadable organization file refuses and stops with check null; the report throws (17.354702ms)
✔ REQ-LIMIT-4 fail closed: unreadable records refuse and stop with check null and fail the report (0.961522ms)
✔ REQ-LIMIT-3 the shipped token-limit, through the real loader, counts known records only since the limit was set (29.699607ms)
✔ REQ-LIMIT-3 a token limit for a provider named limit is counted and refuses, beside an agent limit of the same name (15.757724ms)
✔ REQ-LIMIT-3 core reaches limit checks only through the plug-in loader (1.795835ms)
✔ REQ-LIMIT-4 a role run at its limit stops at the end of its turn: RESULT and read land first, the claim is revoked by limit-check (91.564384ms)
✔ REQ-LIMIT-4 the stop also lands on state; a run with no stop ends without a limit (62.324174ms)
✔ REQ-LIMIT-4 fail closed: a mustStop throw or a malformed answer stops the run, naming the bus and the code (145.373835ms)
✔ REQ-LIMIT-4 a thread run at its limit is released with the reason, and its end record names the limit (39.85132ms)
✔ REQ-LIMIT-4 a broker with no limit checks configured never stops a run (29.223124ms)
limits: {"event":"limit-reached","business":"demo","check":"token-limit","export":"mayLaunch","subject":{"instance":"coder","provider":"zai","model":"glm-5.3-flash","account":null},"path":["tokens","instances","coder"],"limit":0,"count":0,"unknownTurns":0}
organization: {"event":"reload-needs-restart","business":"demo"}
usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"a7280cde-db2e-4cbb-a6a6-3b62f8799bff","source":"@none","code":"baseline-unknown"}
limits: {"event":"limit-reached","business":"demo","check":"token-limit","export":"mustStop","subject":{"instance":"coder","provider":"zai","model":"glm-5.3-flash","account":null},"path":["tokens","instances","coder"],"limit":0,"count":0,"unknownTurns":1}
usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"c0378c45-79b9-4cce-be00-a92f2920e1c4","source":"@none","code":"baseline-unknown"}
organization: {"event":"reload-needs-restart","business":"demo"}
✔ REQ-LIMIT-3 REQ-LIMIT-4 runtime: limits carries the token count, mayLaunch refuses at the limit, a reset moves since (253.510086ms)
✔ REQ-LIMIT-3 runtime: with no limit check switched on, the limit shows not enforced and every launch is allowed (63.96299ms)
✔ REQ-LIMIT-4 runtime: the broker asks the shipped token-limit after a turn, and the run at its limit stops on its next receive (86.719892ms)
✔ REQ-LIMIT-4 runtime: with no usage source a turn is unknown, counts zero and stops nothing under a limit of 1 (75.763833ms)
✔ REQ-LIMIT-3 runtime: switching a limit check on with plugins.set loads it without a launch or a turn (95.019092ms)
organization: {"event":"reload-needs-restart","business":"demo"}
organization: {"event":"reload-needs-restart","business":"demo"}
✔ limits binds actor from human proof and rejects role, reader, a tester set and forged actor (33.493354ms)
✔ runtime wires verified human settings to the actual shared file writer and actor receipt (171.294465ms)
✔ uncertain organization receipts leave bus startup and reads alone but refuse writes until reconciled (94.437112ms)
✔ within-role sends cite an open gated launch decision without spending it or naming it in grants (45.466514ms)
✔ missing and foreign-business citations refuse and roll back message and grant (34.238488ms)
✔ cross-role sends still need a matching resolved decision and consume it once (42.672019ms)
✔ trail on a hidden message id answers exactly as on an unknown id, for the owner, a reader and the tester (40.131114ms)
✔ replies on a hidden message id answers exactly as on an unknown id, for the owner, a reader and the tester (42.194274ms)
✔ trail on a decision keeps the decision and drops the user thread messages, their deliveries and their events (50.18441ms)
✔ replies leaves out other users thread messages and still fills a page (298.436437ms)
✔ messages in the business human and tester threads are not hidden (row 177 unchanged) (64.526596ms)
✔ governance pin: the owner sees decisions, inbox entries, claims, tasks and project files, but not the user messages (189.815326ms)
✔ messages pages all human messages newest first without writes; read state is history (512.726537ms)
✔ messages refuses role callers, invalid paging and cursors outside this human feed (56.683778ms)
✔ views messages passes only its paging arguments through (0.399474ms)
✔ messages isolates businesses even with a valid foreign cursor (30.265362ms)
✔ the assistant sends to the user and to the chief of staff only (56.709434ms)
✔ an assistant send to any other role, or to the tester, is refused and logged (52.179559ms)
✔ only the user and the chief of staff may send to the assistant; the tester is refused by default (55.105153ms)
✔ REQ-ASSIST-2 REQ-THREAD-1 thread.send to an instance that does not hear from the user is refused and stores nothing (44.737428ms)
✔ a sender-side list alone refuses a send to a role that has no list (50.755893ms)
✔ a target-side list alone refuses a send from a role that has no list (50.589699ms)
✔ the sender list is checked before the target list (44.087009ms)
✔ roles without the field behave exactly as before (64.161874ms)
✔ a business with no role definitions at all is unlimited (57.349475ms)
✔ a malformed messaging field refuses at boot (37.050264ms)
✔ the assistant's review.request to a reviewer is refused and logged, even with an approved decision (56.904225ms)
✔ a review.verdict to the assistant from a role outside its receiveFrom is refused and logged (59.939812ms)
✔ review requests and verdicts between roles without the field are unchanged (49.323968ms)
✔ 3f copy migrates to 3g preserving every old column/row, with an empty instance_names and null to_name (136.628447ms)
✔ REQ-MSG-2: the chief of staff names an instance under its within-role grant, and the write is logged (39.937969ms)
✔ REQ-MSG-2: the human names an instance through the CLI (27.668591ms)
✔ REQ-MSG-2: a role without the grant, or holding it cross-role, is refused not-authorized (34.581563ms)
✔ REQ-MSG-2: a name is unique in the business and is never an instance key or a role name (54.655636ms)
✔ REQ-MSG-2: a send by name reaches the instance and records both; a send by instance key is unchanged (42.696512ms)
✔ REQ-MSG-2: an instance key beats a name that equals it, as when a later instance takes the key (30.283783ms)
✔ REQ-MSG-2: a role name beats a name that equals it, as when a later definition takes the word (sage-0590) (36.907446ms)
✔ proof receives actual peer, cap traffic never invokes helper and transient cap disconnects (9.493006ms)
✔ proof helper error and disconnect during verification never dispatch or bind (2.238368ms)
✔ Client receives explicit proof refusal codes without dispatch, not outcome-unknown (65.51644ms)
✔ asynchronous proof calls release their transient session on success, failure and timeout (29.460626ms)
✔ T2 eight proof callers and a racing copier bind the exact accepted socket, which survives helper exit (368.517687ms)
✔ helper output and failures fail closed including unsafe gid (2.568561ms)
✔ helper timeout, capacity and shutdown refuse without leaving children (25.799208ms)
✔ missing or non-regular peer helper refuses at construction before opening the bus (0.473946ms)
✔ shutdown waits for killed helper close before returning (6.382669ms)
organization: {"event":"reload-needs-restart","business":"demo"}
organization: {"event":"reload-needs-restart","business":"demo"}
organization: {"event":"reload-needs-restart","business":"demo"}
organization: {"event":"reload-needs-restart","business":"demo"}
✔ plugins and plugins.set refuse every non-human session and a forged actor, and pass only the patch with the verified actor (34.173889ms)
✔ runtime: the switch changes the organization file, the receipt carries the actor, and a bad shape, an unknown module and a stale revision are refused with nothing written (206.86798ms)
✔ vikunja:19/309 through the broker, a patch switches the kinds it names and keeps the rest; null removes one kind and is trailed (85.70421ms)
✔ principal binds kernel peer PID and uid, maps owner, and never takes identity or role from body (2.94788ms)
✔ user requires its own nonce and full walk plus immediate same-tree Console parent (0.896227ms)
✔ tester deliberately admits agent parents but rejects managed runs and another nonce (0.500305ms)
✔ human leaf identity is reread after walking the parents (0.199276ms)
✔ console requires its own wrapper, nonce and serve parent, and a configured owner from the spawn env (1.617863ms)
✔ broker process binds trusted launches, offers reader capabilities, refuses human mutation, closes cleanly (280.13042ms)
✔ startup token refusal returns safe code without value or partial listening broker (163.501853ms)
✔ loaded fixture token is absent from socket replies and SQLite, including refusal evidence (255.509272ms)
✔ killed broker leaves an explicit stale lock; another process cannot silently reclaim it (397.674298ms)
✔ trusted host registers later launches; socket clients never have a registration verb (253.185233ms)
✔ REQ-LIMIT-4 the broker process answers the launcher's mayLaunch op with the limits' awaited decision (246.695823ms)
✔ runtime excludes declared project roots even when host supplies no repoRoots (183.222051ms)
✔ a refused launch binding leaves the broker and existing capabilities alive; bad protocol stops it (231.694453ms)
✔ real runtime injects the coordinator, stops its workload and mirrors stable stop events across restart (230.728196ms)
✔ invalid state still starts the control bus and human halt then resume repairs it (111.739954ms)
✔ processing halt and resume extend only the socket timeout while ordinary status retains the explicit timeout (187.003731ms)
✔ a root halt aborts the active search-source signal before the normal web deadline (36.950761ms)
✔ processing.halt refuses agent reader and tester before any transition (32.005295ms)
✔ processing.resume refuses agent reader and tester before any transition (21.502891ms)
✔ human halt and clear each have one event with verified actor; launch.restore cannot clear (28.192446ms)
✔ all ordinary work verbs refuse before dispatch while pure reads remain available (54.561836ms)
✔ task web authorization and bind paths refuse before external work (28.998779ms)
✔ recordEvent cannot forge processing.halt (23.589861ms)
✔ recordEvent cannot forge processing.resume (26.066387ms)
✔ recordEvent cannot forge processing.stop (21.378783ms)
✔ recordTask poll cannot forge a processing action through its kinds filter (25.104927ms)
✔ recordTask self cannot forge a processing action through its kinds filter (21.568304ms)
✔ spec read remains a read but cannot release new write work after an await (28.546147ms)
✔ the real socket awaits halt and resume beyond the ordinary idle deadline (75.45774ms)
✔ a malformed processing reader never silently admits agent work (32.091525ms)
✔ halt refuses the newly landed host executor path before credentials or effects (30.895743ms)
✔ D1: committed write with a failed receipt refuses outcome-unknown without action.allowed (34.050268ms)
✔ D2: spec.read refuses without content if its role is released during the read (24.917091ms)
✔ D3: spec.read secret check refuses flagged content without content (21.235859ms)
✔ D3: spec.read secret check refuses flagged subject without content (23.425863ms)
✔ a human lists, opens and saves; the save is one commit by the business human (209.987312ms)
✔ an agent and a reader refuse every file verb and nothing is written (75.598354ms)
✔ a stale base refuses stale-base and writes nothing (139.462243ms)
✔ paths outside the spec and docs refuse, as do unknown projects, missing files and odd arguments (113.119523ms)
✔ without a project adapter the file verbs refuse project-not-configured (54.212604ms)
✔ on the socket a save may carry 1 MiB of text; every other request keeps the 64 KiB limit (422.423594ms)
✔ a request that names the save verb first and another verb last is refused at 64 KiB (111.088697ms)
✔ two saves racing for one repository make one commit (303.482316ms)
✔ Broker keeps the sandbox client import closure: only the listed imports, no lazy project import (3.09652ms)
✔ without a trusted project adapter all three async paths refuse project-not-configured (78.27682ms)
✔ real startBroker injects the project adapter for socket reads and bound-author record writes (359.679888ms)
✔ a raise with no recorded push refuses no-push; a raise binds the latest push and shows it (55.289805ms)
✔ happy path: the fork is the upstream repo under the agent's own user, the destination is host-built (44.100661ms)
✔ a hard wait: no decision refuses, and a decision for another task refuses (40.309173ms)
✔ r4 B4: approve while the latest push is A, push B, publish refuses decision-mismatch (94.313189ms)
✔ grant and fork refusals (81.360645ms)
✔ remote-not-fork, compared without case, and remote-host-mismatch, at push (153.542604ms)
✔ two agents granted one project each get their own fork (76.515696ms)
✔ the request cannot name the fork, the user or the destination (37.271692ms)
✔ one decision, one open publish: a second ticket refuses publish-busy, whatever its branch (93.503181ms)
✔ publishRefused files the code on the task's trail and drops the ticket (45.08796ms)
✔ git.push.remote is in neither ROUTED list and no shipped role grants it (1.625657ms)
✔ runtime: withGitea keys from the open ticket only, and the store root is the organization dir (176.619236ms)
✔ the bus process answers the publish ops from their own lines, not launch-op-refused (250.926498ms)
organization: {"event":"reload-needs-restart","business":"demo"}
organization: {"event":"reload-needs-restart","business":"demo"}
✔ T14 a create goes live with no restart: the new instance binds at once and the answer says restart false (122.00229ms)
organization: {"event":"reload-needs-restart","business":"demo"}
organization: {"event":"reload-needs-restart","business":"demo"}
organization: {"event":"reload-needs-restart","business":"demo"}
organization: {"event":"reload-needs-restart","business":"demo"}
organization: {"event":"reload-needs-restart","business":"demo"}
organization: {"event":"reload-needs-restart","business":"demo"}
✔ T14 every committed verb reloads once, limits.set, routes.set, plugins.set and veto.set included, and a refused one does not (161.646944ms)
✔ T14 a definition change on a running instance refuses instance-running; a vars change still goes live (113.5146ms)
✔ T14 a file whose credential references differ from the boot copy is not reloaded and the write answers restart true (75.819675ms)
✔ T14 a date-only change to a credential reference still reloads: row 199 issue rewrites the date outside the reload (80.090126ms)
✔ T19 a credentialed create answers restart true; issue works only after a restart, and a later vars change goes live (182.375078ms)
✔ T14 after a refused reload veto.set, instance.hire and instance.fire answer restart true, and a fire of a name kept since refuses before step A (202.53913ms)
✔ T14 a file whose project root differs from the boot copy is not reloaded, because the Credentials store protects the boot roots (78.747428ms)
organization: {"event":"reload-needs-restart","business":"demo"}
✔ T14 a file whose library mapping differs from the boot copy is not reloaded, because the mirror is ensured at start (330.133856ms)
✔ T14 reloadBusiness refuses an unknown business, a changed human and a document the boot check refuses (19.820547ms)
✔ a reply is listed for human and reader sessions, and its delivery rows are unchanged (61.964872ms)
✔ the reply still reaches the human message.receive (mosaic talk) after the Console showed it (38.909471ms)
✔ a message with no reply gives an empty list (30.440273ms)
✔ replies come oldest first and stop at REPLIES (147.62208ms)
✔ an id that names no message in the business refuses message-not-found, and the refusal is recorded (44.842307ms)
✔ strict arguments; a role session gets human-required (60.384133ms)
✔ views passes replies through as one call with the id (0.487332ms)
✔ requirements returns the committed list to a holding role session, and no one else (41.769748ms)
✔ the PM's prd.approve with no task, when no id fits, reaches the human's Inbox (28.975533ms)
✔ the PM's non-blocking role.revoke with no task reaches the human's Inbox (30.43662ms)
✔ a push is recorded as the action.allowed for git.push.working on the task, and only the host records one (53.151552ms)
✔ review.request names the latest pushed commit and sends the reviewer a REVIEW-REQUEST (42.686936ms)
✔ review.request says which run holds the reviewer role, or null, and a null request waits for a claim (44.307074ms)
✔ review.request refuses a commit that isn't the latest push, a non-reviewer and a role without the action (64.196824ms)
✔ reviewFetch answers only the addressed reviewer, for the request it cites (41.707376ms)
✔ review.verdict answers one request once, to the role that asked (52.719487ms)
✔ task.close on a pushed task needs an approve verdict for the latest push (77.012044ms)
✔ a refusal the host decided is filed on the task it names, and only a task ref counts (47.536662ms)
✔ row 306 T1: a run the timer sweep ended answers thread-revoked on every claim-needing call, logged, and its claim still refuses run-revoked (59.678691ms)
✔ row 306 T1: a user's request and access.reload end the run the same way, and it answers thread-revoked (80.302391ms)
✔ row 306 T2: after the sweep, a run the human stopped and a run the limit stop ended still answer not-holder (63.119559ms)
✔ room.open sorts all threaded instances, creates defaults, and reuses caller-owned threads (41.273842ms)
✔ room.open preflights instance collisions atomically (29.149847ms)
✔ room.open preflights owner collisions atomically (33.467975ms)
✔ room verbs require the human, and none is a tester verb (44.253595ms)
✔ room verbs refuse missing projects and zero member businesses (65.59823ms)
✔ send/read refuse a missing canonical member without effects (34.241089ms)
✔ send/read refuse a foreign-owner canonical member without effects (29.22367ms)
✔ send/read refuse a wrong-instance canonical member without effects (34.482931ms)
✔ room.send targets a key, broadcasts without tags, and preserves original text and ordinary route/input rows (39.256612ms)
✔ current display names and repeated tags resolve once; a replaced display name is unknown (41.852123ms)
✔ a legacy name colliding with another member key is ambiguous; its own key resolves once (39.144283ms)
✔ unknown or non-member addressees and tags-only bodies leave no message effects (40.765914ms)
✔ messaging denial on the last target rolls back the entire broadcast; allowed subset still works (29.776492ms)
✔ a clearing last member fences the whole send; another active target still accepts (36.914559ms)
✔ room.read groups one send, pages by the last grouped id, and rejects foreign or absent cursors (57.735724ms)
✔ room.read keeps identical sends at the same timestamp separate and includes every session (55.180886ms)
✔ room.read defaults and caps the number of merged entries, not recipient rows (872.995623ms)
✔ room.read includes an agent reply with its thread and instance without merging it with human rows (46.875025ms)
organization: {"event":"reload-needs-restart","business":"demo"}
✔ row 65: routes and routes.set refuse every non-human session, the chief of staff included, the tester may read and set, and each passes the verified actor (55.336678ms)
✔ row 65: a new launch binds only on a switched-on harness with a module name, and a run an earlier broker bound binds again after its harness is switched off (49.391144ms)
✔ row 65 runtime: harnessLevels answers each module in the tree, and null for a name with no module (77.245254ms)
✔ row 65 runtime: routes and routes.set reach the organization file with the human as actor, a new bind reads plugins.harness, and each refusal keeps the bytes and logs nothing (150.418363ms)
✔ v3b prototype refusals, views and append-only mutations (152.923052ms)
✔ T4 D7: a clear of a held default session fences it, drains at the next receive, retires at the exit proof and moves the default (83.238207ms)
✔ T4 D7: an unheld session drains at accept, its proof is run null, and a non-default clear leaves the default (36.614674ms)
✔ T4 D7: a run that ends before its next receive drains at its end, with its generation (33.620508ms)
✔ T4 D7: a run whose turn is running (delivered, unread) stays clearing; uncertain is recorded once and nothing more (49.343907ms)
✔ T4 D7 B1: undelivered inputs are cancelled with receipts at accept, never delivered to the successor, and a routed reply is cancelled at arrival (56.453243ms)
✔ T4 D7: repeat, conflict, a second op, a stale revision, confirm and a halt (54.252388ms)
✔ T4 Q4: the successor takes <old>-N, the next N free, and a bound name stays taken (45.0306ms)
✔ T4 D8: the successor start is held, refused or started, each report on its own counter (39.898731ms)
✔ T4 D7 N4: a halt at retirement waits and writes nothing; retirement goes once processing resumes (31.458334ms)
✔ T4 sage-2828: a cancel before retirement makes the session active again, keeps the claim and the cancelled messages, and never makes the successor (46.972462ms)
✔ T4 sage-2828 sage-2830: a cancel after retirement ends the startup only, and a later thread-only send makes the successor pending as new input (37.899796ms)
✔ T4 N4: a user's thread whose grant is gone by retirement ends the clear failed, writes no successor, and leaves the session as it was (39.38009ms)
✔ T4 N4: a user's thread whose grant is live at retirement retires the session and makes its successor (38.681082ms)
✔ T4 sage-2828: a cancel after the successor started refuses session-clear-complete (35.715251ms)
✔ T4 B2: a run bound to a clearing session refuses its claim, and claims again once the clear is cancelled (40.357106ms)
✔ T4 mos-1325: the tester clears its own thread; its clear, cancel and operation on a human-owned thread refuse thread-not-owned and write nothing (42.765156ms)
✔ T4 schema: session_ops and message_cancels are append-only, and a second open clear of a session is refused below the broker (33.812708ms)
✔ T4 schema: a 3m store migrates to 3n, session_ops and message_cancels are new and empty, and every other row stays as it was (177.537707ms)
✔ T4 schema: the 3m engine refuses a 3n store, migrating or not, and leaves it as it was (337.809368ms)
✔ session.list rows carry the reader count for each session, with its store identity (36.008287ms)
✔ a legacy session is asked for with legacy true (26.605086ms)
✔ without a reader the count is unknown, never 0; a reader that throws is store-unreadable (50.694574ms)
✔ compactions must be a function (13.519419ms)
✔ T1 REQ-ROLE-2: two sessions of one thread keep their own history, delivery and replies (81.891275ms)
✔ T2 REQ-ROLE-2: one holder per session, generations count its claims, and a sibling session's message never reaches the other holder (69.537836ms)
✔ T2 sage-2257: a released or revoked run's retired generation refuses its approval, delivery and read, and writes nothing (85.904084ms)
✔ session.create is idempotent on its op, refuses a reused op or a taken name, and reaches only the owner's threads (53.240227ms)
✔ the 3l triggers keep sessions in their thread and session ids apart from thread ids (125.346677ms)
✔ T7: a 3k store migrates to 3l, each thread's default session has the thread's id, and old rows keep their seqs (184.354218ms)
✔ T7 D9: the 3k engine refuses a 3l store, migrating or not, and leaves it as it was (291.048207ms)
✔ gated approval authorizes once, survives store reopen, and fresh approval works (51.094272ms)
✔ another run of the same instance consumes an approval once; a failed check leaves it usable (35.948394ms)
✔ two scheduled callers have exactly one grant and one consumed refusal (27.968266ms)
✔ failed commit rolls consumption back; cross-role consumes and within-role stays reusable (56.513209ms)
✔ class drift gated to cross-role refuses before consumption (40.754492ms)
✔ class drift cross-role to gated refuses before consumption (44.379136ms)
✔ class drift gated to within-role refuses before consumption (39.989966ms)
✔ class drift cross-role to within-role refuses before consumption (39.371084ms)
✔ class drift within-role to gated refuses before consumption (38.964327ms)
✔ class drift within-role to cross-role refuses before consumption (37.998042ms)
✔ message.send consumes approval and prevents a later send or authorize (43.335608ms)
✔ role.revoke consumes approval and prevents a later revoke or authorize (47.632083ms)
✔ 3e copy migrates through 3f to 3g preserving every old column/row and adding null spec citations (150.248803ms)
✔ a human spec save sends one notice to each pm and cto, naming the commit, and each commit sends its own (226.218496ms)
✔ no notice for a docs save, an agent record commit, a git commit outside the Console, or a refused save (274.097324ms)
✔ a notice to a role no run holds waits for a claim, and launches nobody and tells nobody (143.575705ms)
✔ a business without a pm or a cto saves the spec and sends nothing (128.622692ms)
✔ a notice that cannot be stored answers outcome-unknown, and the commit stands (165.078126ms)
✔ a BLOCK reaches the chief of staff, the chief relays it to the assistant in the user's thread, and the commit stands (145.918662ms)
✔ with no thread a BLOCK still reaches the chief of staff, and the relay to the assistant is refused (125.622964ms)
✔ within the notice's project the relay lands in the user's most recently opened thread (129.169624ms)
✔ a more recently opened thread in another project does not take the relay (139.897948ms)
✔ a BLOCK is refused from anyone but a pm or cto, to anyone but the chief of staff, and outside a reply to its own notice (156.763218ms)
✔ a role cannot forge a spec notice: its text opens neither a BLOCK nor the assistant's thread (139.769423ms)
✔ the bus receives nothing: a reply to a notice addressed to _bus is refused (149.75195ms)
✔ real socket awaits spec reads, record writes and cited raises; other requests still return normally (202.549203ms)
✔ real socket preserves asynchronous refusal codes and disconnects its transient proof (115.728887ms)
✔ two real socket writes to one repository yield one commit and one project-busy refusal (111.85762ms)
✔ client disconnect during await tolerates late reply (138.302453ms)
✔ client disconnect during await tolerates late refusal (88.056007ms)
✔ N-a: slow admitted record.write returns its committed result after the idle deadline (276.213678ms)
✔ current citation is recorded; docs commits do not stale it and a new spec never reopens settlement (184.375884ms)
✔ stale, unconfirmed, missing and partial spec citations refuse without inserting a decision (183.121777ms)
✔ uncited raises retain their synchronous path and spec read is available to any held role in its business (96.929069ms)
✔ record writes bind the session author, require authority and refuse spec and impersonation paths (118.640344ms)
✔ REQ-COS-1: the pm asks the chief of staff for roles and counts; the chief receives a STAFF-REQUEST and answers it (49.873204ms)
✔ REQ-COS-1: only the pm can send a staff request; every other session is refused and the chief of staff hears nothing (53.539372ms)
✔ REQ-COS-1: a pm without message.send is refused like any other gated action (27.295647ms)
✔ REQ-COS-1: the request goes to the business launcher, and only when that is a chief of staff (74.448608ms)
✔ REQ-COS-1: the sender is judged by definition: an instance `lead` of the pm definition can ask, an instance `pm` of the coder definition can't (69.632747ms)
✔ REQ-COS-1: the launcher is judged by definition: an instance `boss` of the chief-of-staff definition receives, a `chief` of the coder definition gives no-chief-of-staff (63.393332ms)
✔ REQ-COS-1: a refused staff request leaves no staff.request action.allowed event (35.685049ms)
✔ REQ-ASSIST-2: the role definitions' messaging lists hold for a staff request, sender and recipient (113.29438ms)
✔ a staff request names a task, 1 to 10 distinct roles and counts of 1 to 20; nothing else is accepted (79.817956ms)
✔ REQ-COS-1: a staff request grants nothing: the pm still can't launch and the chief of staff launches as before (43.396194ms)
✔ a business that never switched launches reads allowed with no time and no event (33.251136ms)
✔ launches revoked and then restored read allowed, with the restore time and event id (33.201173ms)
✔ a task closed on the tracker leaves the open list, and total counts the open ones (30.446492ms)
✔ a tombstone is not open (24.38225ms)
✔ the open list stops at the cap and says so; total still counts every open task (34.06552ms)
✔ a role and a reader session read state; arguments, and an unbound cap, refuse (27.451241ms)
✔ a human session reads the same state, with the same cap (28.740016ms)
✔ reading state writes nothing: every table keeps its row count (29.518747ms)
✔ creates private WAL store and excludes a second writer until explicit close (24.086422ms)
✔ rollback is atomic and schema metadata is checked against trusted DDL, not just itself (25.919667ms)
✔ existing empty database and symlink runtime directory refuse, never initialize over damage (23.472757ms)
✔ crash during a transaction recovers no partial event after explicit fixture-only lock removal (122.310244ms)
✔ writer refuses mixed at/read_at forms atomically, even through trusted SQL helpers (24.356949ms)
✔ async transactions refuse before invoking their function (15.330794ms)
✔ usage_records refuses non-canonical timestamps atomically (16.674746ms)
✔ the session default fits under the reply cap and pages to the end with next (242.622546ms)
✔ the short form: no description, assignees by role, every listed key (169.645611ms)
✔ each filter, alone and together, and total counts every match (255.426199ms)
✔ task_ref reads one task in full, as the whole board has it (156.067789ms)
✔ no arguments is the read the Console and mosaic make, unchanged (138.532067ms)
✔ an unknown argument or a bad value refuses invalid-request (565.972934ms)
✔ tasks rows carry priority and requirement for every session that reads tasks (73.314137ms)
✔ the read model rebuilds from the ledger: a reopened bus and each trail give the same values (82.371135ms)
✔ an empty business and one with snapshots but no task.created read cleanly (25.974293ms)
✔ recordTask keeps sync reads and a role write apart (38.952528ms)
✔ read_at must be one canonical UTC format, so the projection compares strings safely (18.002796ms)
✔ a bad entry refuses the whole record (17.326798ms)
✔ taskView reads the projection for one business (21.096507ms)
✔ requestTask hands only a holder and a task verb to the handler, and records refusals (43.714017ms)
✔ the server sends task verbs to the adapter with its own timeout; other verbs stay synchronous (322.058956ms)
✔ without an adapter the server refuses every task verb (68.839402ms)
✔ the runtime refuses an invalid adapter and closes a valid one (100.014728ms)
✔ the process loads the S3 adapter from plain-data trackers (432.738ms)
✔ row 177 T1: a tester thread is owned by tester, and neither side reaches or lists the other (56.678333ms)
✔ row 177 T2: the tester thread.send is from tester-cli with no human.input; its open is by tester (34.576625ms)
✔ row 177 T3: the lists read the tester as the human in its own thread, and nowhere else (25.448426ms)
✔ row 177 T3: an assistant that would not hear the human refuses the tester too (23.825613ms)
✔ row 177 T4: the tester thread run answers the tester, never the human (54.185696ms)
✔ row 177 T5: each stop revokes only its own threads, recorded by its own actor (44.928856ms)
✔ row 177 T5: the human stop never ends a tester run (27.962113ms)
✔ row 177 T6: a business whose human is tester refuses invalid-business (20.631794ms)
✔ row 177 T7: the human trail shows a tester thread message as the tester (33.983751ms)
✔ row 177 T8: a tester-thread run never raises a decision to the human; a human-thread run still does (37.669429ms)
✔ row 177 T8: a tester-thread raise routed to the arbiter stays allowed (32.200425ms)
✔ row 182 T9: a tester reply into the human's thread refuses thread-not-owned and stores nothing (32.872038ms)
✔ row 182 T9: a tester reply into its own thread lands there (31.449154ms)
✔ row 182 T9: the chief's reply up a chain into a tester's thread lands there (41.356456ms)
✔ row 182 T9: a tester reply to a spec notice refuses thread-not-owned; the chief's relay still lands (36.399723ms)
organization: {"event":"reload-needs-restart","business":"demo"}
organization: {"event":"reload-needs-restart","business":"demo"}
organization: {"event":"reload-needs-restart","business":"demo"}
organization: {"event":"reload-needs-restart","business":"demo"}
organization: {"event":"reload-needs-restart","business":"demo"}
✔ row 175: TESTER_VERBS and the organization branch tester set are pinned (1.401281ms)
✔ row 175: each of the six reads as the tester deep-equals the human read (111.875902ms)
✔ row 175: W1-W3 as the tester land with receipt actor tester; the human still logs the human (124.928584ms)
✔ row 175: W2 as the tester refuses credentials, protected definitions, human, tester and bus.tester, and changes nothing (99.343077ms)
✔ row 175: the human-only actions refuse a tester tester-refused, and the file and store stay as they were (96.371745ms)
✔ row 175: W4 as the tester writes by tester and keeps every name check (30.418912ms)
✔ row 175: W6 as the tester records created_by tester; the human records the human (23.928919ms)
✔ row 175: with bus.tester unset or not exactly true no tester binds, so no read or write runs (92.734074ms)
✔ the tester binds only when the business sets bus.tester to exactly true (140.056477ms)
✔ a business may not name a role tester, so the tester address is never a role (43.342379ms)
✔ every verb outside the tester list refuses tester-refused and is recorded against the tester (76.53948ms)
✔ a tester message is from tester, needs no prefix, and writes no human.input or authority (30.513147ms)
✔ a tester message to a role no run holds refuses tester-target-not-running and stores nothing (23.377695ms)
✔ a tester message is refused while the run is only launched, and routes once it claims (32.700743ms)
✔ a human message to a role no run holds still waits and tells launch.by (25.198847ms)
✔ a role answers a tester only in reply to a tester message, and the answer never reaches the human (48.824714ms)
✔ the tester reads the human views a reader reads (46.720868ms)
✔ tester proof binds its own CLI, start time and nonce, refuses a managed run and allows an agent (1.799816ms)
✔ neither CLI's nonce proves the other: each proof is bound to its own CLI and nonce variable (0.499692ms)
✔ testerNonce reads only the tester's variable and gives null on any read error (0.245532ms)
✔ an envelope carries exactly one of cap, human and tester; no tester authenticator refuses (160.509126ms)
✔ tester-cli.mjs binds through the runtime when the switch is on, and refuses off or under a run marker (1320.081561ms)
✔ T1: the human and the reader see a held thread claim; agents still lists the role only (45.676029ms)
✔ T2: a released or revoked thread claim is not listed, though its thread has an earlier claim row (37.945201ms)
✔ T3: a role session refuses human-required and the tester refuses tester-refused (33.738737ms)
✔ T4: agents answers each session the same before and after a thread run claims (39.290101ms)
✔ T5: the result carries neither the thread name a user wrote nor a message body (38.534561ms)
✔ T6: two held sessions of one thread list as two rows, each its session's latest claim (37.518748ms)
✔ REQ-THREAD-1 REQ-ORG-2: the 3d→3e migration adds the thread tables and leaves messages from before threads as written (167.159014ms)
✔ REQ-THREAD-1: a 3d bus with a changed schema is refused and keeps its version and tables (78.995016ms)
✔ REQ-THREAD-1: the offline command prints the kept-message counts before the ready line (190.357216ms)
✔ a share lets the sharee read the thread and nothing else: every write verb stays the owner's (mutants 7, 9) (63.461578ms)
✔ the business human shares too, and a `*` share reaches every covered principal but the tester (46.488774ms)
✔ mutant 2: a share never widens a grant; when the sharee's grant stops covering the thread, its reads end (49.52515ms)
✔ mutant 3: a thread whose user owner has lost coverage is hidden from its sharees, the owner's board included (58.453052ms)
✔ mutant 4: a share's state is its latest row, so an unshare ends it and a share after it starts it again (49.184941ms)
✔ mutant 8: a user target needs a live grant of any level covering the thread, else share-not-covered (37.016197ms)
✔ a viewer reads a thread shared with it, and share, unshare and shares refuse a viewer access-refused (design 4.3) (41.872181ms)
✔ a share target is `user:<id>`, the business human or `*`, and never the sharer (74.687679ms)
✔ a user whose collaborator grant no longer covers its own thread can't share, unshare or list its shares (40.519075ms)
✔ the tester and a reader session never share: each verb refuses and writes nothing (65.041437ms)
✔ the owner's trail and replies show a user's message only while that user's thread is shared with the owner (53.139803ms)
✔ a share covers every session of the thread (41.093505ms)
✔ a sharee can't list the thread's sessions: session.list stays owner-only (Q7, sage-2818 Q1) (38.717665ms)
✔ only a human principal matches a share: an agent bound to the thread and the tester match none (sage-2818 Q2) (60.638451ms)
✔ a 3l store migrates to 3m: thread_shares is new and empty, and every other row stays as it was (163.01965ms)
✔ the 3l engine refuses a 3m store, migrating or not, and leaves it as it was (276.724843ms)
✔ REQ-ROLE-2 REQ-THREAD-1: one holder per thread, through the broker and the trigger (59.832116ms)
✔ REQ-ROLE-2 REQ-THREAD-1: the 3e triggers refuse writes that skip the broker (119.130138ms)
✔ REQ-MSG-1: a message to or from the assistant names its thread, or is refused (55.875148ms)
✔ REQ-MSG-1: the chief of staff's reply comes back to the thread that sent the work (973.829755ms)
✔ REQ-MSG-1: a reply can't carry one thread instance's thread to another thread instance (29.876315ms)
✔ REQ-THREAD-1 REQ-USER-2: one thread's messages never reach another thread's holder (36.447135ms)
✔ REQ-LAUNCH-1: a message to a thread with no holder waits, and the next holder gets it (37.677543ms)
✔ REQ-THREAD-2 REQ-LAUNCH-1: threadIdle releases only a thread with nothing waiting, and only for its holder (37.160469ms)
✔ REQ-THREAD-2 REQ-LAUNCH-1: a message delivered to a run that ended unread doesn't hold up the next holder (34.708647ms)
✔ REQ-ROLE-2 REQ-THREAD-1 Q169: a role.revoke the human approved ends every thread run of the assistant (31.052823ms)
✔ Q169 REQ-USER-2: assistant.stop ends the human's own assistant thread runs, and only the human's (45.612358ms)
✔ REQ-USER-2: the human verbs refuse another owner's thread (32.621789ms)
✔ REQ-THREAD-1: thread.create refuses when the business has no thread instance or more than one (27.336932ms)
✔ REQ-ORG-2: projects and threads are named once, and the repo names a business project (31.075453ms)
✔ REQ-THREAD-2: thread.messages returns the thread's history in pages and writes nothing (99.694989ms)
✔ project.create refuses a repository name without its matching repo before any write (19.059715ms)
✔ project.create keeps unrelated names with and without a repository (12.358023ms)
✔ C2-09a: explicit creative instances bind independent threads, default sessions and holders (56.592866ms)
✔ C2-09a: explicit missing, non-thread and malformed selectors create no thread or session (23.681277ms)
✔ C2-09a: creative bindLaunch without a thread refuses thread-required (11.957974ms)
✔ socket capability stamps launch identity; shared views use wire, no SQL client (72.332664ms)
✔ two wire claims serialize; a lost reply never automatically retries (63.511482ms)
✔ malformed, oversized and identity-forging envelopes refuse without echoing input (50.171723ms)
✔ client preserves UTF-8 when a response divides a multibyte character (12.502041ms)
✔ committed mutation followed by dropped reply reports unknown and is never retried (60.217488ms)
✔ REQ-LIMIT-4 usage protocol binds run identity, requires a delivered turn and isolates businesses (47.943191ms)
✔ REQ-LIMIT-4 3g copy migrates through 3h, 3i, 3j and 3k to 3l preserving every old column, row and sequence; new usage table is empty (153.757276ms)
✔ REQ-PLUG-1 runtime reaches transcript only through loader, over the real bus socket (94.721033ms)
✔ REQ-LIMIT-4 loader source records new turn kinds, excludes history and retries exactly once (28.462793ms)
✔ REQ-LIMIT-4 cut: unknown is durable and logged next to every total (19.225525ms)
✔ REQ-LIMIT-4 disabled: unknown is durable and logged next to every total (17.602712ms)
✔ REQ-LIMIT-4 missing-begin: unknown is durable and logged next to every total (15.99562ms)
✔ REQ-LIMIT-4 no-new-usage: unknown is durable and logged next to every total (19.292046ms)
✔ REQ-LIMIT-4 rewrite: unknown is durable and logged next to every total (16.13632ms)
✔ REQ-LIMIT-4 unfinished turn remains visibly unknown after accounting restarts (17.903559ms)
✔ usage records are append-only (16.629524ms)
✔ REQ-LIMIT-4 parse failure logs its safe code, never transcript content (18.318402ms)
✔ REQ-LIMIT-4 resumed run baselines history and exact totals do not overflow (24.626321ms)
✔ REQ-PLUG-1 core has no transcript import and disabled sources do not read any transcript (17.524458ms)
✔ REQ-LIMIT-4 a resumed thread bills only new assistant messages to its next run (21.821484ms)
✔ REQ-LIMIT-4 every enabled source is called; failure is unknown and a partial total stays labelled (29.382601ms)
✔ REQ-LIMIT-4 a turn whose reported sum exceeds safe precision is unknown, not rounded (18.855133ms)
✔ row 65 a run bound without a transcript directory records no-transcript (19.274685ms)
✔ R3: bindUser binds a granted user and refuses one with no live grant (25.882217ms)
✔ R3: a user named like the business human, the tester or a principal word is refused, whatever the grants say (17.090043ms)
✔ R3: each collaborator verb is allowed to a granted user (36.848594ms)
✔ R3: every verb off the collaborator list refuses a user access-refused before its own checks (207.342803ms)
✔ R3: task, web and host verbs refuse a user access-refused (40.965807ms)
✔ R3 leak: project.list shows granted projects only (22.346032ms)
✔ R3 leak: thread.create needs the project and the thread instance granted, and an ungranted id reads as one that does not exist (29.561778ms)
✔ R3 leak: thread.list shows the user its own threads that are still granted, never others (58.72999ms)
✔ R3 leak: names shows granted instances only (23.600803ms)
✔ R3: thread.send is from user:<id> and writes no human.input (23.180116ms)
✔ R3: a reply-chain message.send into another user thread is refused (27.889194ms)
✔ R3: the run reply to a user message reaches that user thread.messages, with no waiting and no notice (32.441348ms)
✔ R3: a reply to: user without a matching in_reply_to is refused user-reply-required (43.758033ms)
✔ R3: a non-thread run, the human and the tester cannot send to: user (22.523947ms)
✔ R3: a user thread run cannot message the owner, while its uncited gated raise reaches only the owner inbox, B9 (25.369547ms)
✔ R3: a removed or expired grant refuses the next request access-revoked, and the file is read per request (26.99555ms)
✔ R3: a user refusal is recorded as action.refused by user:<id> (17.70489ms)
✔ R3: a business with a role keyed user refuses invalid-business (12.711513ms)
✔ R3: name.set refuses the name user (14.378475ms)
✔ R3 r4: while halted, a granted user's thread.send refuses processing-halted and thread.messages still answers (17.8948ms)
✔ R3 r4: the chief's hire refuses an instance named user with the code it gives human and tester (18.400226ms)
✔ R3 r4: a non-function access throws before the store is read (0.154048ms)
✔ C2-09a: naming an instance cannot bypass its collaborator grant or disclose an ungranted project (24.173303ms)
✔ 264e deferred B6: a reply cannot cite the same user in a sibling session (25.666994ms)
✔ 275: VIEWER_VERBS is the ruled read list, inside USER_VERBS (1.623864ms)
✔ 275: a viewer binds, and each viewer verb answers with what its grant covers (49.322912ms)
✔ 275: a viewer is refused thread.create, thread.open and thread.send access-refused, and nothing is stored (40.997813ms)
✔ 275: every verb off the user list refuses a viewer access-refused before its own checks (175.467056ms)
✔ 275: mixed grants, collaborator on one project and viewer on another, take the level per project (37.60222ms)
✔ 275: board reads refuse users and viewers access-refused (125.60679ms)
✔ governance pin, user side: decisions, inbox entries, claims, tasks and project files are the owner's, the user reads its messages (60.269784ms)
✔ web.search: a granted role gets labelled results, and the call is trailed with role, run, verb and query (38.059024ms)
✔ web.fetch: a granted role gets the page as labelled text, and the call is trailed with the url (32.952056ms)
✔ a role without the grant is refused, the refusal is logged with the verb, and nothing is fetched (28.398417ms)
✔ a broker with no web service refuses a granted role (23.581764ms)
✔ bad requests are refused: unknown verb, extra or missing argument, not a string, a human or reader session (29.668429ms)
✔ a session that is not the role holder is refused (20.094699ms)
✔ web.mjs's fences hold on the broker side: refusals are normal results with the fixed reason (64.853961ms)
✔ web.search with no search source configured is a refused result, not an error (25.200517ms)
✔ a search source that fails with its own refusal, or that throws, is handled (28.483428ms)
✔ a slow search source ends in a refusal at the deadline (68.586923ms)
✔ a secret in the arguments is refused before anything is trailed or fetched (16.811892ms)
✔ over the socket: the server routes web verbs to the service; other roles are refused; no service is web-not-configured (81.956952ms)
✔ busBusiness: the web grant comes from "web" in the resolved tool limit (0.302851ms)
✔ webServices: the business's search-source plug-in and web.searxng var make web.search work; without either it is refused as not configured (55.155653ms)
✔ an ungranted call is refused at once: no admission, no wait, nothing touched (20.76165ms)
✔ over the socket an ungranted caller is dropped by the server timeout and a granted one gets the longer wait (342.459672ms)
✔ a search that never answers is aborted at the deadline, the module sees the signal, and the call is trailed as refused (timeout) (76.436526ms)
✔ a fetch that stalls is cut off at the deadline: the request is destroyed, not left running (97.102064ms)
✔ one query limit: over SEARCH_MAX_QUERY_CHARS or empty is refused with the same reason before any backend, and the tool schema carries the same number (21.063637ms)
✔ merge-gate's technical raise is cross-role, goes to the cto, and only merge-gate can use the approval (56.075533ms)
✔ merge-gate has no message.send, and without a domain its raise goes to the delivery arbiter (39.566932ms)
✔ the cto must be able to message merge-gate, or the technical raise is refused (row 133) (37.987976ms)
✔ security-reviewer answers a review with its verdict alone; it holds no message.send (44.817774ms)
ℹ tests 981
ℹ suites 0
ℹ pass 981
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 24127.472157
