✔ config directory and file path follow MOSAIC_CONFIG (2.848351ms)
✔ the fixture business validates and comes back frozen (38.438289ms)
✔ two instances may share a definition (4.985988ms)
✔ top-level refusals (15.573259ms)
✔ arbiters and projects (14.939897ms)
✔ role instances (9.446596ms)
✔ Vikunja bots (12.111196ms)
✔ a role without Vikunja takes no tracker block (5.556326ms)
✔ credential references match the definition's services (18.578185ms)
✔ launch (40.298298ms)
✔ loadBusiness: file checks (17.280922ms)
✔ loadBusiness: not a regular file (151.91495ms)
✔ loading writes nothing (4.18165ms)
✔ names that are Object.prototype properties don't count as declared (9.614905ms)
✔ the shipped example refuses as written and validates once filled in (1.581714ms)
✔ usage errors exit 4 (685.533424ms)
✔ validate: a good business exits 0 and prints instance digests (100.237294ms)
✔ validate: project files (510.346462ms)
✔ validate: missing files and a broken system config (408.670972ms)
✔ validate: credential reference problems exit 2 and name each one (108.704355ms)
✔ validate: a token file inside the repository is refused (108.455448ms)
✔ validate: role definitions come from MOSAIC_ROLES_DIR (317.775665ms)
✔ resolve: prints one instance's record (323.99734ms)
✔ resolve: refusals (597.461021ms)
✔ parse: exactly one of file or env, plus the service's date (4.801613ms)
✔ check: a good file has no problems (14.046213ms)
✔ check never opens the file: a write-only token passes (0.660342ms)
✔ check: file problems (1.637196ms)
✔ check: token files can't live in the repository or dataRoot, even through a linked directory (6.311826ms)
✔ check: dates and environment references (0.767415ms)
✔ path and load (30.032437ms)
✔ refusals (14.888956ms)
✔ systemVars flattens the validated config (3.618812ms)
✔ precedence: system, business, project, project role, agent (8.824697ms)
✔ limits narrow the definition and never widen it (4.797614ms)
✔ role.launch stays within-role only for the instance the launch block names (15.636871ms)
✔ limits.authority without role.launch leaves the launcher with no launch block (6.532983ms)
✔ limits.authority narrows cross-role actions too (3.042241ms)
✔ classify (3.151387ms)
✔ the record carries what the broker and launcher need (2.556793ms)
✔ digest: key order doesn't matter, any value change does (67.721665ms)
✔ refusals (42.31728ms)
✔ the four shipped version 2 roles load (5.044342ms)
✔ shipped role scopes match addendum B section 2 and the SR runbook (2.371647ms)
✔ shipped authority follows the note's table (0.895367ms)
✔ version 1 files keep loading with no authority (3.271035ms)
✔ the conductor policy isn't a role (0.459604ms)
✔ a missing role file is exit 4, a symbolic link too (0.9243ms)
✔ version 2 refusals (2.45245ms)
✔ authority: closed vocabulary, no gated-only action, no overlap (4.053667ms)
✔ credentials: Gitea scopes (4.751198ms)
✔ credentials: Vikunja scopes are a group-to-verbs map from the grantable list (2.514347ms)
✔ credentials: services (1.082643ms)
✔ contract: a non-empty regular Markdown file beside the role file (1.531355ms)
✔ every key names known layers and a merge rule (2.114061ms)
✔ unknown keys and wrong layers refuse (1.394641ms)
✔ types (3.523914ms)
✔ merge: defaults, then the most specific layer wins (0.571531ms)
✔ merge: limits only narrow, and provenance lists each source (0.556813ms)
✔ merge doesn't change its inputs (0.682966ms)
ℹ tests 60
ℹ suites 0
ℹ pass 60
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 3285.96556