test(proxy): canonicalize three new revoking timestamp literals

agents/magica/work/queue-331/l3b-prepared-r4-manifest.json

@@ -0,0 +1,110 @@
+{
+  "status": "static canonical timestamp fixture-only correction under sage4552, no rerun",
+  "sourceCommit": "5868d77f18abeb01d2822cb475df48ce1336ae58",
+  "baseHEAD": "6f12b6df79ed97e658f0ff13db683e4d61dccc83",
+  "supersedes": "l3b-prepared-r3-manifest.json; unexpected4551 preserved",
+  "artifacts": [
+    {
+      "path": "agents/magica/work/queue-331/l3b-orphan-admission-r3-proposed.diff",
+      "sha256": "43c14cba2310fc31dbf988a2f67bdbe861cd90336779fc22176ff3571080e476",
+      "bytes": 1767
+    },
+    {
+      "path": "agents/magica/work/queue-331/l3b-r3-proposal.md",
+      "sha256": "703ae0dc9e8d9a56684cedb01fc32a15a06d1a486171f09da3d354dd6b450c03",
+      "bytes": 3944
+    },
+    {
+      "path": "agents/magica/work/queue-331/l3b-r3-state-table.md",
+      "sha256": "ffa5b79ce2ad6ad6b8648c7bc72c100a6d1203671c99827087e6811402913a23",
+      "bytes": 1164
+    },
+    {
+      "path": "agents/magica/work/queue-331/l3b-red-files.txt",
+      "sha256": "0bb07e74689c829155f269049ed510221e72607171a102cb0512fece732aa213",
+      "bytes": 51
+    },
+    {
+      "path": "agents/magica/work/queue-331/l3b-r3-expected-red.json",
+      "sha256": "bc3a1ad22de663616b16fc8f1fad7de701c440dcd3bd65271888eadcc5fbc666",
+      "bytes": 2541
+    },
+    {
+      "path": "agents/magica/work/queue-331/l3b-runtime-red-files.txt",
+      "sha256": "6ce41345d2fae1ce9de071c27252d2759266903db47968e896cd97bfa7a12302",
+      "bytes": 46
+    },
+    {
+      "path": "agents/magica/work/queue-331/l3b-runtime-expected-red.json",
+      "sha256": "c4ce71ae3e02b61306bdf009467481fe3a0fc615827a853d8fb5d3267fc579ce",
+      "bytes": 716
+    },
+    {
+      "path": "packages/bus/tests/model-lifecycle-fixtures.mjs",
+      "sha256": "3be2add875bec6c187d93528afede338a4e178566c61c30a1dfe74fa7ec0cfd6",
+      "bytes": 4113
+    },
+    {
+      "path": "packages/bus/tests/model-orphan-admission.test.mjs",
+      "sha256": "c5e5c1239bee252dca7ab0089105f0f3719824dcbae3013d82b4a5ba74aa1e6f",
+      "bytes": 5740
+    },
+    {
+      "path": "packages/bus/tests/model-orphan-hire.test.mjs",
+      "sha256": "d2070945a6603cff4b7dfe98cc9026c9fc28419b2605a4ff904da48406b317ae",
+      "bytes": 5522
+    },
+    {
+      "path": "agents/magica/work/queue-331/l3b-r4-fixture-only.diff",
+      "sha256": "0a4225cfed66476a213fe4a8d39195a034625e802c525acdbcfe5008936dd117",
+      "bytes": 4145
+    }
+  ],
+  "unchangedProducts": [
+    {
+      "path": "packages/bus/src/broker.mjs",
+      "sha256": "7ae9c3cef21024bebf32bd0c8af861a64d39b0137e8ba5899612004dd898b33c",
+      "bytes": 407085
+    },
+    {
+      "path": "packages/bus/src/runtime.mjs",
+      "sha256": "c5fe19296aa37632517593226f2e6644ecac2be9c3bbf9cc1ac90742fd505dcb",
+      "bytes": 53435
+    },
+    {
+      "path": "packages/bus/src/process.mjs",
+      "sha256": "ed13afdce6359df31d35a79496ebb4afdefef82030a8326a76b2a25b37e98d9d",
+      "bytes": 7150
+    },
+    {
+      "path": "packages/cli/src/launcher.mjs",
+      "sha256": "28bd9bd37b6e71b1cdd8bbd7e6c94e47e5b08db9d6c07da90e7bead2ca2c45e4",
+      "bytes": 68551
+    },
+    {
+      "path": "packages/bus/src/model-keys.mjs",
+      "sha256": "bf96f9413537d75991464df1b6893c999c01599976eb48eb2032e33e9aade92a",
+      "bytes": 14105
+    },
+    {
+      "path": "packages/cli/src/model-stall.mjs",
+      "sha256": "3df9770e8aae51357986a16473c96d2a3879bcd436153fa25c70f71b0ab181d7",
+      "bytes": 1012
+    },
+    {
+      "path": "packages/harness/src/first-output.mjs",
+      "sha256": "1ef13e5bd2ea9b166b505c46821f1649444b8fab9882531975858ce20a79f341",
+      "bytes": 473
+    },
+    {
+      "path": "packages/harness/src/runner.mjs",
+      "sha256": "9c0a0482c877dd5eae1e2691f20d30e37a289d68cb7d4998b0418c44055ae6d1",
+      "bytes": 31478
+    },
+    {
+      "path": "packages/seat/src/sandbox.mjs",
+      "sha256": "a203f7bb2735e4abeb0758c7719022545696b35f00d7943144b73aa892091807",
+      "bytes": 10764
+    }
+  ]
+}

agents/magica/work/queue-331/l3b-r4-fixture-only.diff

@@ -0,0 +1,28 @@
+--- a/packages/bus/tests/model-orphan-admission.test.mjs
++++ b/packages/bus/tests/model-orphan-admission.test.mjs
+@@ -6,7 +6,7 @@
+ import { lifecycleFixture } from './model-lifecycle-fixtures.mjs';
+ async function orphan(t,{revoking=false,withRetiring=false,currentPresent=false}={}){
+  const f=await lifecycleFixture(t),old=f.create(['demo/orphan']);await old.manager.reconcile();let answer=await old.manager.ensure('demo/orphan');if(withRetiring)answer=await old.manager.rotate('demo/orphan');const prior=old.credentials.modelRecord('demo/orphan');
+- if(revoking){const r=old.credentials.modelRecord('demo/orphan');old.credentials.writeModel('demo/orphan',{...r,state:'revoking',revokingAt:'2026-10-25T00:00:00Z'});}
++ if(revoking){const r=old.credentials.modelRecord('demo/orphan');old.credentials.writeModel('demo/orphan',{...r,state:'revoking',revokingAt:'2026-10-25T00:00:00.000Z'});}
+  old.credentials.close();f.assertHistoryGuard();const fresh=f.create();await fresh.manager.reconcile();assert.equal(f.state.keys.includes(answer.key),false,'boot removed unregistered remote orphan');if(currentPresent)f.state.keys.push(answer.key);
+  const file=join(f.storeRoot,'demo','orphan','model'),before=fs.readFileSync(file);f.state.calls=[];return {...f,...fresh,answer,file,before,prior};
+ }
+@@ -45,4 +45,4 @@
+  assert.equal(f.state.calls.filter(c=>c==='GET').length,verb==='ensure'&&present?1:2,'fresh serialized list required even for cached reuse');f.valueFree();
+ });
+ for(const verb of ['ensure','rotate'])test(`L3b ${verb} without prior record creates no retiring entries`,async t=>{const f=await lifecycleFixture(t),c=f.create();await c.manager.reconcile();const proxy=await c.manager[verb]('demo/coder');assert.equal(c.credentials.modelRecord('demo/coder').retiring.length,0);assert.equal(f.state.keys.includes(proxy.key),true);f.valueFree();});
+-for(const verb of ['ensure','rotate'])test(`L3b ${verb} known revoking record refuses without management call`,async t=>{const f=await lifecycleFixture(t),c=f.create();await c.manager.reconcile();await c.manager.ensure('demo/coder');const r=c.credentials.modelRecord('demo/coder');c.credentials.writeModel('demo/coder',{...r,state:'revoking',revokingAt:'2026-10-25T00:00:00Z'});f.state.calls=[];await assert.rejects(c.manager[verb]('demo/coder'),e=>e.code==='proxy-key-revoking');assert.deepEqual(f.state.calls,[]);f.valueFree();});
++for(const verb of ['ensure','rotate'])test(`L3b ${verb} known revoking record refuses without management call`,async t=>{const f=await lifecycleFixture(t),c=f.create();await c.manager.reconcile();await c.manager.ensure('demo/coder');const r=c.credentials.modelRecord('demo/coder');c.credentials.writeModel('demo/coder',{...r,state:'revoking',revokingAt:'2026-10-25T00:00:00.000Z'});f.state.calls=[];await assert.rejects(c.manager[verb]('demo/coder'),e=>e.code==='proxy-key-revoking');assert.deepEqual(f.state.calls,[]);f.valueFree();});
+--- a/packages/bus/tests/model-orphan-hire.test.mjs
++++ b/packages/bus/tests/model-orphan-hire.test.mjs
+@@ -12,7 +12,7 @@
+ import { lifecycleFixture } from './model-lifecycle-fixtures.mjs';
+ async function hireFixture(t,{revoking=false}={}){
+  const f=await lifecycleFixture(t),old=f.create(['demo/orphan']);await old.manager.reconcile();const issued=await old.manager.ensure('demo/orphan');
+- if(revoking){const r=old.credentials.modelRecord('demo/orphan');old.credentials.writeModel('demo/orphan',{...r,state:'revoking',revokingAt:'2026-10-25T00:00:00Z'});}old.credentials.close();
++ if(revoking){const r=old.credentials.modelRecord('demo/orphan');old.credentials.writeModel('demo/orphan',{...r,state:'revoking',revokingAt:'2026-10-25T00:00:00.000Z'});}old.credentials.close();
+  const rolesDir=rolesCopy(f.root),system=systemFor(f.root),doc=businessDoc(f.root,'demo');
+  // Scratch aide: shipped chief hireable:[] and review.verdict is outside HIRE_ALLOWED.
+  fs.writeFileSync(join(rolesDir,'aide.md'),'# Aide\n');writeJson(join(rolesDir,'aide.json'),{roleVersion:2,name:'aide',title:'Aide',contract:'aide.md',tools:['read'],network:'api-only',authority:{withinRole:['message.send'],crossRole:[]},credentials:[]});

packages/bus/tests/model-orphan-admission.test.mjs

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 import { lifecycleFixture } from './model-lifecycle-fixtures.mjs';
 async function orphan(t,{revoking=false,withRetiring=false,currentPresent=false}={}){
  const f=await lifecycleFixture(t),old=f.create(['demo/orphan']);await old.manager.reconcile();let answer=await old.manager.ensure('demo/orphan');if(withRetiring)answer=await old.manager.rotate('demo/orphan');const prior=old.credentials.modelRecord('demo/orphan');
- if(revoking){const r=old.credentials.modelRecord('demo/orphan');old.credentials.writeModel('demo/orphan',{...r,state:'revoking',revokingAt:'2026-10-25T00:00:00Z'});}
+ if(revoking){const r=old.credentials.modelRecord('demo/orphan');old.credentials.writeModel('demo/orphan',{...r,state:'revoking',revokingAt:'2026-10-25T00:00:00.000Z'});}
  old.credentials.close();f.assertHistoryGuard();const fresh=f.create();await fresh.manager.reconcile();assert.equal(f.state.keys.includes(answer.key),false,'boot removed unregistered remote orphan');if(currentPresent)f.state.keys.push(answer.key);
  const file=join(f.storeRoot,'demo','orphan','model'),before=fs.readFileSync(file);f.state.calls=[];return {...f,...fresh,answer,file,before,prior};
 }
@@ -45,4 +45,4 @@ for(const verb of ['ensure','rotate'])for(const present of [true,false])test(`L3
  assert.equal(f.state.calls.filter(c=>c==='GET').length,verb==='ensure'&&present?1:2,'fresh serialized list required even for cached reuse');f.valueFree();
 });
 for(const verb of ['ensure','rotate'])test(`L3b ${verb} without prior record creates no retiring entries`,async t=>{const f=await lifecycleFixture(t),c=f.create();await c.manager.reconcile();const proxy=await c.manager[verb]('demo/coder');assert.equal(c.credentials.modelRecord('demo/coder').retiring.length,0);assert.equal(f.state.keys.includes(proxy.key),true);f.valueFree();});
-for(const verb of ['ensure','rotate'])test(`L3b ${verb} known revoking record refuses without management call`,async t=>{const f=await lifecycleFixture(t),c=f.create();await c.manager.reconcile();await c.manager.ensure('demo/coder');const r=c.credentials.modelRecord('demo/coder');c.credentials.writeModel('demo/coder',{...r,state:'revoking',revokingAt:'2026-10-25T00:00:00Z'});f.state.calls=[];await assert.rejects(c.manager[verb]('demo/coder'),e=>e.code==='proxy-key-revoking');assert.deepEqual(f.state.calls,[]);f.valueFree();});
+for(const verb of ['ensure','rotate'])test(`L3b ${verb} known revoking record refuses without management call`,async t=>{const f=await lifecycleFixture(t),c=f.create();await c.manager.reconcile();await c.manager.ensure('demo/coder');const r=c.credentials.modelRecord('demo/coder');c.credentials.writeModel('demo/coder',{...r,state:'revoking',revokingAt:'2026-10-25T00:00:00.000Z'});f.state.calls=[];await assert.rejects(c.manager[verb]('demo/coder'),e=>e.code==='proxy-key-revoking');assert.deepEqual(f.state.calls,[]);f.valueFree();});

packages/bus/tests/model-orphan-hire.test.mjs

@@ -12,7 +12,7 @@ import { businessDoc, rolesCopy, systemFor, writeJson } from '../../business/tes
 import { lifecycleFixture } from './model-lifecycle-fixtures.mjs';
 async function hireFixture(t,{revoking=false}={}){
  const f=await lifecycleFixture(t),old=f.create(['demo/orphan']);await old.manager.reconcile();const issued=await old.manager.ensure('demo/orphan');
- if(revoking){const r=old.credentials.modelRecord('demo/orphan');old.credentials.writeModel('demo/orphan',{...r,state:'revoking',revokingAt:'2026-10-25T00:00:00Z'});}old.credentials.close();
+ if(revoking){const r=old.credentials.modelRecord('demo/orphan');old.credentials.writeModel('demo/orphan',{...r,state:'revoking',revokingAt:'2026-10-25T00:00:00.000Z'});}old.credentials.close();
  const rolesDir=rolesCopy(f.root),system=systemFor(f.root),doc=businessDoc(f.root,'demo');
  // Scratch aide: shipped chief hireable:[] and review.verdict is outside HIRE_ALLOWED.
  fs.writeFileSync(join(rolesDir,'aide.md'),'# Aide\n');writeJson(join(rolesDir,'aide.json'),{roleVersion:2,name:'aide',title:'Aide',contract:'aide.md',tools:['read'],network:'api-only',authority:{withinRole:['message.send'],crossRole:[]},credentials:[]});