jason.woltje
6bad02612a
Unclaimed files left in the canonical checkout. Inventory: canonical-cleanup-inventory.md (commit-as-evidence groups). detect-secrets scan clean on 2026-11-02: hits are sha256 pins, git object ids, test sentinels already in tracked tests and unit-file lines.
78 lines
5.4 KiB
Plaintext
78 lines
5.4 KiB
Plaintext
✔ pure resolution selects current default or explicit enrolled account (1.987398ms)
|
||
✔ scope is explicit, bounded and never inferred (1.582017ms)
|
||
✔ fork pin is preserved against default change, override, missing account and revocation (0.73804ms)
|
||
✔ unenrolled account/provider, missing harness, model expansion and native model ceiling refuse (0.745685ms)
|
||
✔ only explicit synthetic credential forms and internal fixture stores admitted (5.412974ms)
|
||
✔ two concurrent workspaces of the same agent publish distinct complete private generations (66.025124ms)
|
||
✔ same execution ID is exclusively claimed and cannot overwrite a published generation (38.306352ms)
|
||
✔ failed generation after-auth preserves prior files, records failure and refuses blind same-ID retry (48.742617ms)
|
||
✔ failed generation before-publish preserves prior files, records failure and refuses blind same-ID retry (58.444371ms)
|
||
✔ credential lock contention refuses without duplicate side effects (11.681411ms)
|
||
✔ symlinked pre-existing final target is refused and never followed (27.275356ms)
|
||
✔ invalid registry cannot resolve; no fallback to supplied partial entries (0.27979ms)
|
||
✔ post-publication failure records uncertainty, preserves complete generation and prevents replay (27.463811ms)
|
||
✔ expired credentials refresh under transaction and subsequent generation reuses rotation (86.159863ms)
|
||
✔ refresh failure retains prior generation and store state (66.038009ms)
|
||
✔ refresh timeout retains prior generation and store state (144.579937ms)
|
||
✔ refresh malformed retains prior generation and store state (66.132984ms)
|
||
✔ concurrent refresh on same account refuses contention while unrelated account proceeds (274.596676ms)
|
||
✔ invalid refresh options refuse before burning claim (91.991592ms)
|
||
✔ fixed fake process rotates both OAuth fields without mutating caller input (27.382776ms)
|
||
✔ concurrent isolated processes preserve separate provider credentials (26.707576ms)
|
||
✔ fake failure is refused with fixed diagnostics (22.95574ms)
|
||
✔ fake malformed is refused with fixed diagnostics (24.494723ms)
|
||
✔ fake timeout is refused with fixed diagnostics (102.444662ms)
|
||
✔ fake unchanged is refused with fixed diagnostics (27.577402ms)
|
||
✔ caller executable/environment injection is rejected before spawning (0.305279ms)
|
||
✔ valid fixture tree validates and lists without secrets (64.232476ms)
|
||
✔ unknown-field refuses (0.366545ms)
|
||
✔ invalid-id refuses uppercase and traversal shapes (0.26421ms)
|
||
✔ plain-http baseUrl requires allowInsecureTransport (0.28655ms)
|
||
✔ native provider rejects allowInsecureTransport (0.124557ms)
|
||
✔ unsupported credential type and kind refuse (0.144136ms)
|
||
✔ account provider-path mismatch refuses (0.149146ms)
|
||
✔ profile account refs must be provider/account shaped (0.232955ms)
|
||
✔ seat selection accepts fork pin field, validates account refs (0.216553ms)
|
||
✔ harness manifest id must equal executable (gate 1) (0.254042ms)
|
||
✔ CLI validate: duplicate provider id across files refuses (29.080245ms)
|
||
✔ CLI validate: missing referenced provider/account refuse (30.088584ms)
|
||
✔ CLI validate: broken JSON refuses without secret echo (32.076619ms)
|
||
✔ CLI usage errors exit 2 (48.968232ms)
|
||
✔ credential.json sibling presence does not break validation and is never read (62.188264ms)
|
||
✔ D1 missing, empty and structurally empty roots refuse, no list projection (152.475953ms)
|
||
✔ D1 required directory auth cannot be absent (50.904555ms)
|
||
✔ D1 required directory auth/providers cannot be absent (60.738858ms)
|
||
✔ D1 required directory auth/accounts cannot be absent (58.773355ms)
|
||
✔ D1 required directory auth/settings cannot be absent (58.512939ms)
|
||
✔ D1 required directory harnesses cannot be absent (60.997663ms)
|
||
✔ D1 root file and unreadable metadata refuse (108.085458ms)
|
||
✔ D2 no symlink traversal at auth/providers/openai-codex.json (51.162594ms)
|
||
✔ D2 no symlink traversal at auth/accounts/openai-codex/homelab-openai (64.623473ms)
|
||
✔ D2 no symlink traversal at auth/providers (51.809106ms)
|
||
✔ D2 no symlink traversal at auth (55.531121ms)
|
||
✔ D2 root and ancestor symlinks and lexical traversal refuse (460.68409ms)
|
||
✔ private filesystem modes enforced for root (53.772249ms)
|
||
✔ private filesystem modes enforced for auth (51.288549ms)
|
||
✔ private filesystem modes enforced for auth/providers/openai-codex.json (55.443686ms)
|
||
✔ private filesystem modes enforced for auth/accounts/openai-codex/homelab-openai/account.json (66.000842ms)
|
||
✔ D3 numeric version 1 only across all record kinds (1.199913ms)
|
||
✔ D4 nested unknown keys and missing per-kind required fields refuse (66.277868ms)
|
||
✔ D5 unenrolled default refuses even when account exists (63.767636ms)
|
||
✔ D6 provider/account credential type must match (59.802585ms)
|
||
✔ D7 every harness endpoint enforces HTTP opt-in and shape (0.470203ms)
|
||
✔ D8 URLs reject embedded credentials and unsupported protocols without echo (171.33272ms)
|
||
✔ D9 malformed JSON diagnostics contain no content excerpt (66.719682ms)
|
||
✔ D10 missing metadata is missing-path, not invalid-json (62.497545ms)
|
||
✔ D10 library returns no partial entries on any invalid record (82.301536ms)
|
||
✔ null/scalar/array metadata refuses without stack or echo (213.629479ms)
|
||
✔ credential sibling is never opened, even when an unreadable symlink (36.715126ms)
|
||
✔ oversized metadata refuses before parsing (55.455687ms)
|
||
ℹ tests 69
|
||
ℹ suites 0
|
||
ℹ pass 69
|
||
ℹ fail 0
|
||
ℹ cancelled 0
|
||
ℹ skipped 0
|
||
ℹ todo 0
|
||
ℹ duration_ms 2394.478054
|