mosaicstack/stack
25
0 Fork 1
Code Issues 404 Pull Requests 13 Packages Projects Releases 15 Wiki Activity
Files
dev-console
stack/agents/gander/work/queue-278/run3/whole/bus.log
T

4814 lines
201 KiB
Plaintext
Raw Permalink Blame History

TAP version 13
# Subtest: REQ-LIMIT-4 3h copy migrates to 3i: every row keeps its seq, the sequence carries over, and only the account CHECK changes
ok 1 - REQ-LIMIT-4 3h copy migrates to 3i: every row keeps its seq, the sequence carries over, and only the account CHECK changes
---
duration_ms: 153.399621
type: 'test'
...
# Subtest: REQ-LIMIT-4 a 3h→3i step that fails partway leaves the store at 3h with every row, the sequence and the schema intact
ok 2 - REQ-LIMIT-4 a 3h→3i step that fails partway leaves the store at 3h with every row, the sequence and the schema intact
---
duration_ms: 166.588016
type: 'test'
...
# Subtest: REQ-LIMIT-4 the 3h engine refuses a migrated store, migrating or not, and leaves it as it was
ok 3 - REQ-LIMIT-4 the 3h engine refuses a migrated store, migrating or not, and leaves it as it was
---
duration_ms: 190.052919
type: 'test'
...
# Subtest: agents: a held role with nothing on the bus is idle; a role session gets the claim rows unchanged
ok 4 - agents: a held role with nothing on the bus is idle; a role session gets the claim rows unchanged
---
duration_ms: 38.328983
type: 'test'
...
# Subtest: agents: working counts what the holder received and has not read; routed alone is not working
ok 5 - agents: working counts what the holder received and has not read; routed alone is not working
---
duration_ms: 38.298959
type: 'test'
...
# Subtest: agents: input needed is the role's open decisions routed to the human, gated first, then oldest
ok 6 - agents: input needed is the role's open decisions routed to the human, gated first, then oldest
---
duration_ms: 64.332838
type: 'test'
...
# Subtest: agents: working wins over waiting, and Input needed still shows
ok 7 - agents: working wins over waiting, and Input needed still shows
---
duration_ms: 29.817744
type: 'test'
...
# Subtest: agents: a new holder doesn't inherit what the last one left unread; decisions stay with the role
ok 8 - agents: a new holder doesn't inherit what the last one left unread; decisions stay with the role
---
duration_ms: 34.014277
type: 'test'
...
# Subtest: agents: state reads only its own business, even for a run name both use
ok 9 - agents: state reads only its own business, even for a run name both use
---
duration_ms: 35.372875
type: 'test'
...
# Subtest: agents: a message the holder released unread is stranded; the next holder gets nothing and cannot read it
ok 10 - agents: a message the holder released unread is stranded; the next holder gets nothing and cannot read it
---
duration_ms: 39.395357
type: 'test'
...
# Subtest: agents: a message the holder read is not stranded; one the current holder has not read is not listed
ok 11 - agents: a message the holder read is not stranded; one the current holder has not read is not listed
---
duration_ms: 35.575247
type: 'test'
...
# Subtest: agents: stranded is oldest first and capped at 50 for a role
ok 12 - agents: stranded is oldest first and capped at 50 for a role
---
duration_ms: 185.02087
type: 'test'
...
# Subtest: agents: stranded is per role and per business
ok 13 - agents: stranded is per role and per business
---
duration_ms: 67.824081
type: 'test'
...
# Subtest: agents: a message routed to a held role and not yet received is not stranded
ok 14 - agents: a message routed to a held role and not yet received is not stranded
---
duration_ms: 28.960763
type: 'test'
...
# Subtest: REQ-DEC an approval outlives its run and a broker restart; a new run of the instance consumes it once
ok 15 - REQ-DEC an approval outlives its run and a broker restart; a new run of the instance consumes it once
---
duration_ms: 64.323783
type: 'test'
...
# Subtest: REQ-DEC another instance of the same definition cannot consume an approval, and its refusal consumes nothing
ok 16 - REQ-DEC another instance of the same definition cannot consume an approval, and its refusal consumes nothing
---
duration_ms: 32.010444
type: 'test'
...
# Subtest: REQ-DEC REQ-THREAD-1 a thread approval is consumed only by a run holding the same thread
ok 17 - REQ-DEC REQ-THREAD-1 a thread approval is consumed only by a run holding the same thread
---
duration_ms: 42.383168
type: 'test'
...
# Subtest: REQ-DEC a later run of the same instance supersedes an open decision; another instance cannot
ok 18 - REQ-DEC a later run of the same instance supersedes an open decision; another instance cannot
---
duration_ms: 37.635573
type: 'test'
...
# Subtest: REQ-DEC REQ-THREAD-1 a thread decision is superseded only from the same thread
ok 19 - REQ-DEC REQ-THREAD-1 a thread decision is superseded only from the same thread
---
duration_ms: 43.539331
type: 'test'
...
# Subtest: REQ-DEC REQ-THREAD-1 a thread instance decision raised before row 121 is not consumed or superseded by any thread run
ok 20 - REQ-DEC REQ-THREAD-1 a thread instance decision raised before row 121 is not consumed or superseded by any thread run
---
duration_ms: 60.773923
type: 'test'
...
# Subtest: launch identity is stamped, payload identity is refused and stale holder cannot send
ok 21 - launch identity is stamped, payload identity is refused and stale holder cannot send
---
duration_ms: 44.178317
type: 'test'
...
# Subtest: decision classes route from policy; gated resolution is human-only, choice and target must match
ok 22 - decision classes route from policy; gated resolution is human-only, choice and target must match
---
duration_ms: 51.548961
type: 'test'
...
# Subtest: claim exclusion, holder release, gated revoke and rerouting to a new holder are atomic
ok 23 - claim exclusion, holder release, gated revoke and rerouting to a new holder are atomic
---
duration_ms: 48.940635
type: 'test'
...
# Subtest: launch events require a human CLI capability; generic emit cannot forge authority events
ok 24 - launch events require a human CLI capability; generic emit cannot forge authority events
---
duration_ms: 28.748729
type: 'test'
...
# Subtest: within-role decisions close atomically and invalid options or blocking omissions refuse
ok 25 - within-role decisions close atomically and invalid options or blocking omissions refuse
---
duration_ms: 35.365806
type: 'test'
...
# Subtest: a recommendation that is not exactly one option key refuses invalid-recommendation after the options
ok 26 - a recommendation that is not exactly one option key refuses invalid-recommendation after the options
---
duration_ms: 49.796225
type: 'test'
...
# Subtest: observer capabilities read human inbox but cannot mutate or forge launch identity
ok 27 - observer capabilities read human inbox but cannot mutate or forge launch identity
---
duration_ms: 31.206399
type: 'test'
...
# Subtest: task action subjects and linked decision trail are complete and ordered
ok 28 - task action subjects and linked decision trail are complete and ordered
---
duration_ms: 46.795382
type: 'test'
...
# Subtest: launch binding is durable and reconnecting requires the identical trusted record
ok 29 - launch binding is durable and reconnecting requires the identical trusted record
---
duration_ms: 31.333838
type: 'test'
...
# Subtest: business isolation includes inherited object names and cross-business message references
ok 30 - business isolation includes inherited object names and cross-business message references
---
duration_ms: 38.314239
type: 'test'
...
# Subtest: authority never transfers between action, target, unresolved or replaced role holder; a later run of the instance keeps it
ok 31 - authority never transfers between action, target, unresolved or replaced role holder; a later run of the instance keeps it
---
duration_ms: 55.286451
type: 'test'
...
# Subtest: task projection uses schema current view, skipping earlier and equal-start polls
ok 32 - task projection uses schema current view, skipping earlier and equal-start polls
---
duration_ms: 28.71652
type: 'test'
...
# Subtest: revocation permanently bars the old run from reclaiming first, including after broker restart
ok 33 - revocation permanently bars the old run from reclaiming first, including after broker restart
---
duration_ms: 42.897945
type: 'test'
...
# Subtest: empty message references refuse before storage; refusal-evidence failure stays a typed error
ok 34 - empty message references refuse before storage; refusal-evidence failure stays a typed error
---
duration_ms: 28.973406
type: 'test'
...
# Subtest: both arbiters require human resolution when their cross-role route is themselves
ok 35 - both arbiters require human resolution when their cross-role route is themselves
---
duration_ms: 43.927014
type: 'test'
...
# Subtest: the shipped coder role raises task.reassign as gated to the human; task.scope.change stays cross-role
ok 36 - the shipped coder role raises task.reassign as gated to the human; task.scope.change stays cross-role
---
duration_ms: 37.833632
type: 'test'
...
# Subtest: S1 adapter takes resolved limits and refs, rejects mismatched instance, never mutates input
ok 37 - S1 adapter takes resolved limits and refs, rejects mismatched instance, never mutates input
---
duration_ms: 3.782898
type: 'test'
...
# Subtest: channel conversion preserves the four proof/transport byte baselines and modules cannot import a proof caller
ok 38 - channel conversion preserves the four proof/transport byte baselines and modules cannot import a proof caller
---
duration_ms: 2.027632
type: 'test'
...
# Subtest: channel recovery still requires the same shim path and rejects an absent or forged proof
ok 39 - channel recovery still requires the same shim path and rejects an absent or forged proof
---
duration_ms: 579.159567
type: 'test'
...
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# Subtest: REQ-COS-1, REQ-ROLE-2: the chief of staff ends a run with a reason and no decision, and the reason is logged
ok 40 - REQ-COS-1, REQ-ROLE-2: the chief of staff ends a run with a reason and no decision, and the reason is logged
---
duration_ms: 52.712228
type: 'test'
...
# Subtest: REQ-ROLE-2: a role without role.end still needs a resolved decision to revoke
ok 41 - REQ-ROLE-2: a role without role.end still needs a resolved decision to revoke
---
duration_ms: 50.682127
type: 'test'
...
# Subtest: REQ-ROLE-2: storage accepts a revoke with a reason or a decision and aborts one with neither
ok 42 - REQ-ROLE-2: storage accepts a revoke with a reason or a decision and aborts one with neither
---
duration_ms: 39.219538
type: 'test'
...
# Subtest: REQ-ROLE-2: the chief of staff may still cite a decision, and a decision alone is the old path
ok 43 - REQ-ROLE-2: the chief of staff may still cite a decision, and a decision alone is the old path
---
duration_ms: 41.655663
type: 'test'
...
# Subtest: REQ-ROLE-2: a role without role.end still ends a run through a resolved decision, which is recorded and has no reason
ok 44 - REQ-ROLE-2: a role without role.end still ends a run through a resolved decision, which is recorded and has no reason
---
duration_ms: 47.856533
type: 'test'
...
# Subtest: REQ-ROLE-2: a reason is required, bounded, and never sent with a decision
ok 45 - REQ-ROLE-2: a reason is required, bounded, and never sent with a decision
---
duration_ms: 58.392587
type: 'test'
...
# Subtest: REQ-COS-1: the chief of staff cannot end its own run; its end of the assistant stops the assistant's thread run
ok 46 - REQ-COS-1: the chief of staff cannot end its own run; its end of the assistant stops the assistant's thread run
---
duration_ms: 63.496067
type: 'test'
...
# Subtest: REQ-LIMIT-1, REQ-COS-1: organization.set from the chief of staff reaches the shared writer, named as the actor
ok 47 - REQ-LIMIT-1, REQ-COS-1: organization.set from the chief of staff reaches the shared writer, named as the actor
---
duration_ms: 49.67953
type: 'test'
...
# Subtest: REQ-LIMIT-1, REQ-COS-1: a refused organization.set logs action.refused and no action.allowed, like a refused limits.set
ok 48 - REQ-LIMIT-1, REQ-COS-1: a refused organization.set logs action.refused and no action.allowed, like a refused limits.set
---
duration_ms: 54.230996
type: 'test'
...
# Subtest: REQ-LIMIT-1: organization.set is refused for every caller whose role file lacks organization.change
ok 49 - REQ-LIMIT-1: organization.set is refused for every caller whose role file lacks organization.change
---
duration_ms: 61.282139
type: 'test'
...
# Subtest: REQ-LIMIT-1: the chief of staff is logged as allowed, and organization.set takes only the human's keys
ok 50 - REQ-LIMIT-1: the chief of staff is logged as allowed, and organization.set takes only the human's keys
---
duration_ms: 59.676238
type: 'test'
...
# Subtest: REQ-COS-1: organization.revision answers the revision alone to the chief of staff and spends nothing
ok 51 - REQ-COS-1: organization.revision answers the revision alone to the chief of staff and spends nothing
---
duration_ms: 56.838069
type: 'test'
...
# Subtest: REQ-COS-1, REQ-LIMIT-1: organization.revision is refused for every caller whose role file lacks organization.change
ok 52 - REQ-COS-1, REQ-LIMIT-1: organization.revision is refused for every caller whose role file lacks organization.change
---
duration_ms: 67.837202
type: 'test'
...
# Subtest: REQ-ROLE-3, REQ-LIMIT-1: a chief-of-staff change is validated, written and logged like a human's; an invalid one is refused
ok 53 - REQ-ROLE-3, REQ-LIMIT-1: a chief-of-staff change is validated, written and logged like a human's; an invalid one is refused
---
duration_ms: 174.155374
type: 'test'
...
# Subtest: REQ-COS-1: the chief of staff reads the revision, changes the file with it, and reads again after a stale one is refused
ok 54 - REQ-COS-1: the chief of staff reads the revision, changes the file with it, and reads again after a stale one is refused
---
duration_ms: 156.573985
type: 'test'
...
# Subtest: Q169: the chief of staff's change of the assistant is validated, written and logged; a stale or protection-stripping one is refused
ok 55 - Q169: the chief of staff's change of the assistant is validated, written and logged; a stale or protection-stripping one is refused
---
duration_ms: 168.630014
type: 'test'
...
# Subtest: row 65, Q169: the chief's change of the assistant's route runs the routing checks, and a valid one saves as the chief
ok 56 - row 65, Q169: the chief's change of the assistant's route runs the routing checks, and a valid one saves as the chief
---
duration_ms: 108.334199
type: 'test'
...
# Subtest: REQ-ROLE-2, REQ-COS-1: the 3c→3d migration lets the chief of staff end a held role with a reason; neither is still refused
ok 57 - REQ-ROLE-2, REQ-COS-1: the 3c→3d migration lets the chief of staff end a held role with a reason; neither is still refused
---
duration_ms: 104.252122
type: 'test'
...
# Subtest: row 194 T10: the chief's reason end of a kept instance refuses instance-kept, holds the claim and spends nothing
ok 58 - row 194 T10: the chief's reason end of a kept instance refuses instance-kept, holds the claim and spends nothing
---
duration_ms: 37.70828
type: 'test'
...
# Subtest: row 194 T10 (Q2): a role.revoke citing a decision the human resolved still ends a kept run
ok 59 - row 194 T10 (Q2): a role.revoke citing a decision the human resolved still ends a kept run
---
duration_ms: 36.289861
type: 'test'
...
# Subtest: row 194 T10 (B7): the chief's organization.set of a kept instance's model refuses before the writer; the human's limits.set does not
ok 60 - row 194 T10 (B7): the chief's organization.set of a kept instance's model refuses before the writer; the human's limits.set does not
---
duration_ms: 36.505927
type: 'test'
...
# Subtest: row 194 T13: organization.set and limits.set refuse the launch, retired, keep and noHire keys before the writer
ok 61 - row 194 T13: organization.set and limits.set refuse the launch, retired, keep and noHire keys before the writer
---
duration_ms: 45.636548
type: 'test'
...
# Subtest: row 194 T18 (D2.4): from a chief session veto.set and instances.set refuse, and nothing reaches the writer
ok 62 - row 194 T18 (D2.4): from a chief session veto.set and instances.set refuse, and nothing reaches the writer
---
duration_ms: 44.789531
type: 'test'
...
# Subtest: row 194 T8: the chief hires with a reason and no decision, the writer gets the reason as context, and the log names it
ok 63 - row 194 T8: the chief hires with a reason and no decision, the writer gets the reason as context, and the log names it
---
duration_ms: 41.602554
type: 'test'
...
# Subtest: row 194 T11: on a bus with two businesses, the chief of one hires and fires only in its own
ok 64 - row 194 T11: on a bus with two businesses, the chief of one hires and fires only in its own
---
duration_ms: 30.970717
type: 'test'
...
# Subtest: row 194 T8: hire and fire need a reason of 1 to 500 characters and refuse a decision key
ok 65 - row 194 T8: hire and fire need a reason of 1 to 500 characters and refuse a decision key
---
duration_ms: 58.381287
type: 'test'
...
# Subtest: row 194 T8 (sage-1471): only the chief hires or fires; every other role refuses role-not-chief, even one granted the actions
ok 66 - row 194 T8 (sage-1471): only the chief hires or fires; every other role refuses role-not-chief, even one granted the actions
---
duration_ms: 47.791631
type: 'test'
...
# Subtest: row 194 T8 (sage-1471): a chief whose authority lacks role.hire or role.fire refuses decision-required before the writer
ok 67 - row 194 T8 (sage-1471): a chief whose authority lacks role.hire or role.fire refuses decision-required before the writer
---
duration_ms: 77.460617
type: 'test'
...
# Subtest: row 194 T8a: a re-hire of a fired name goes to the writer like a hire, and the writer's refusals pass through by name
ok 68 - row 194 T8a: a re-hire of a fired name goes to the writer like a hire, and the writer's refusals pass through by name
---
duration_ms: 46.856004
type: 'test'
...
# Subtest: row 194 T8b: a definition is hireable only when every action is on HIRE_ALLOWED, it is version 2, the chief lists it and noHire doesn't
ok 69 - row 194 T8b: a definition is hireable only when every action is on HIRE_ALLOWED, it is version 2, the chief lists it and noHire doesn't
---
duration_ms: 1206.114415
type: 'test'
...
# Subtest: row 194 T8b: a hire without the role files configured refuses not-configured
ok 70 - row 194 T8b: a hire without the role files configured refuses not-configured
---
duration_ms: 36.12309
type: 'test'
...
# Subtest: row 194 T9: a fire revokes the claim, cancels open requests, asks the launcher to kill the runs, then delists and logs
ok 71 - row 194 T9: a fire revokes the claim, cancels open requests, asks the launcher to kill the runs, then delists and logs
---
duration_ms: 42.777708
type: 'test'
...
# Subtest: row 194 T9a (bus): a fire end's done writes lifecycle.end.killed and lifecycle.end.alive with run and pid, and an unknown stop's reason; a terminate's done or a bad stop refuses
ok 72 - row 194 T9a (bus): a fire end's done writes lifecycle.end.killed and lifecycle.end.alive with run and pid, and an unknown stop's reason; a terminate's done or a bad stop refuses
---
duration_ms: 45.890031
type: 'test'
...
# Subtest: row 194 T9: fire refusals come before step A and leave the claim, the requests and the file alone
ok 73 - row 194 T9: fire refusals come before step A and leave the claim, the requests and the file alone
---
duration_ms: 38.752647
type: 'test'
...
# Subtest: row 194 T9c: a writer failure at B leaves the instance firing, and the repeat delists and logs once
ok 74 - row 194 T9c: a writer failure at B leaves the instance firing, and the repeat delists and logs once
---
duration_ms: 44.400074
type: 'test'
...
# Subtest: row 194 T9c: a failure at C leaves the fire unlogged and the instance firing, and the repeat logs it
ok 75 - row 194 T9c: a failure at C leaves the fire unlogged and the instance firing, and the repeat logs it
---
duration_ms: 54.150345
type: 'test'
...
# Subtest: row 194 W-N1: a fire.done before a later fire.stopped of the same instance leaves it firing; another instance's done does not end it
ok 76 - row 194 W-N1: a fire.done before a later fire.stopped of the same instance leaves it firing; another instance's done does not end it
---
duration_ms: 40.995862
type: 'test'
...
# Subtest: row 194 T10: a hire or fire of a kept name refuses instance-kept before the writer
ok 77 - row 194 T10: a hire or fire of a kept name refuses instance-kept before the writer
---
duration_ms: 32.434591
type: 'test'
...
# Subtest: row 194 T10: a fire the writer's check refuses from the file stops nothing and leaves the instance launchable
ok 78 - row 194 T10: a fire the writer's check refuses from the file stops nothing and leaves the instance launchable
---
duration_ms: 37.540831
type: 'test'
...
# Subtest: row 194 T18: hire and fire take only their own keys, and a refused call writes nothing
ok 79 - row 194 T18: hire and fire take only their own keys, and a refused call writes nothing
---
duration_ms: 46.622258
type: 'test'
...
# Subtest: row 194 T8, T9, T18: through the runtime the chief hires and fires with the real writer, the receipt carries the reason, and a refusal leaves the file alone
ok 80 - row 194 T8, T9, T18: through the runtime the chief hires and fires with the real writer, the receipt carries the reason, and a refusal leaves the file alone
---
duration_ms: 115.111474
type: 'test'
...
# Subtest: row 194 W-N1: the launcher's take of a launch or regenerate of a firing instance closes it as instance-firing
ok 81 - row 194 W-N1: the launcher's take of a launch or regenerate of a firing instance closes it as instance-firing
---
duration_ms: 47.373657
type: 'test'
...
# Subtest: comment cursors isolate businesses, move only forward and remain append-only
ok 82 - comment cursors isolate businesses, move only forward and remain append-only
---
duration_ms: 33.881101
type: 'test'
...
# Subtest: only trusted sync writes validated cursors; events and cursor share rollback
ok 83 - only trusted sync writes validated cursors; events and cursor share rollback
---
duration_ms: 23.714339
type: 'test'
...
# Subtest: explicit 3b copy migration preserves evidence and opens as 3g; normal startup never migrates
ok 84 - explicit 3b copy migration preserves evidence and opens as 3g; normal startup never migrates
---
duration_ms: 118.177772
type: 'test'
...
# Subtest: migration refuses active writers and drifted legacy schemas, with no partial upgrade
ok 85 - migration refuses active writers and drifted legacy schemas, with no partial upgrade
---
duration_ms: 156.921504
type: 'test'
...
# Subtest: named migration registry chains 3b through 3g to a fixture-only future version in order
ok 86 - named migration registry chains 3b through 3g to a fixture-only future version in order
---
duration_ms: 143.862122
type: 'test'
...
# Subtest: migration refuses mismatched source metadata without changing schema or evidence
ok 87 - migration refuses mismatched source metadata without changing schema or evidence
---
duration_ms: 78.543596
type: 'test'
...
# Subtest: offline command migrates only the supplied fixture root and reports usage errors
ok 88 - offline command migrates only the supplied fixture root and reports usage errors
---
duration_ms: 266.403824
type: 'test'
...
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# Subtest: M6: a creative raise refuses decision-not-allowed, cited or not, and no decision row appears; the assistant still raises
ok 89 - M6: a creative raise refuses decision-not-allowed, cited or not, and no decision row appears; the assistant still raises
---
duration_ms: 58.635759
type: 'test'
...
# Subtest: a creative instance sends only to the user and hears only from the user
ok 90 - a creative instance sends only to the user and hears only from the user
---
duration_ms: 73.669855
type: 'test'
...
# Subtest: M10 through the broker: the chief and the tester are refused on bean, the human's limits.set of its models key works
ok 91 - M10 through the broker: the chief and the tester are refused on bean, the human's limits.set of its models key works
---
duration_ms: 145.891929
type: 'test'
...
# Subtest: row 256 T6 the human deletes a creative instance through the broker; the chief and the tester are refused at the verb
ok 92 - row 256 T6 the human deletes a creative instance through the broker; the chief and the tester are refused at the verb
---
duration_ms: 123.333811
type: 'test'
...
# Subtest: X4: register adds a store reference to the running bus, and issue then writes the key
ok 93 - X4: register adds a store reference to the running bus, and issue then writes the key
---
duration_ms: 27.132436
type: 'test'
...
# Subtest: X4: register runs the constructor's reference checks
ok 94 - X4: register runs the constructor's reference checks
---
duration_ms: 1.304309
type: 'test'
...
# Subtest: X4: register reads no file, so a key file left at the path stays unused, and a live token refuses
ok 95 - X4: register reads no file, so a key file left at the path stays unused, and a live token refuses
---
duration_ms: 16.761191
type: 'test'
...
# Subtest: X3, X4: unregister drops an entry with no token and refuses one with a live token
ok 96 - X3, X4: unregister drops an entry with no token and refuses one with a live token
---
duration_ms: 17.314933
type: 'test'
...
# Subtest: X5: a claim holds the slot, so a second claim and a host.run refuse host-busy until release
ok 97 - X5: a claim holds the slot, so a second claim and a host.run refuse host-busy until release
---
duration_ms: 9.540348
type: 'test'
...
# Subtest: X5: a claim made while a host.run is in flight refuses host-busy
ok 98 - X5: a claim made while a host.run is in flight refuses host-busy
---
duration_ms: 9.480625
type: 'test'
...
# Subtest: X5: a stale release leaves a later claim in place
ok 99 - X5: a stale release leaves a later claim in place
---
duration_ms: 0.634481
type: 'test'
...
# Subtest: X5: abortClaim aborts a live claim and says pending, and revoke's abort reaches a claim too
ok 100 - X5: abortClaim aborts a live claim and says pending, and revoke's abort reaches a claim too
---
duration_ms: 10.405744
type: 'test'
...
# Subtest: credentials gives human and reader sessions service, account, role, date and state, and nothing else
ok 101 - credentials gives human and reader sessions service, account, role, date and state, and nothing else
---
duration_ms: 31.093788
type: 'test'
...
# Subtest: credentials refuses a role session and any argument
ok 102 - credentials refuses a role session and any argument
---
duration_ms: 29.323192
type: 'test'
...
# Subtest: credentials reads the status on each request, and a broker without one lists none
ok 103 - credentials reads the status on each request, and a broker without one lists none
---
duration_ms: 40.713853
type: 'test'
...
# Subtest: the broker process answers credentials without a token, path or variable in its output, log or store
ok 104 - the broker process answers credentials without a token, path or variable in its output, log or store
---
duration_ms: 225.885569
type: 'test'
...
# Subtest: T1: a store reference with no file yet starts, and the agent is not-issued until issue
ok 105 - T1: a store reference with no file yet starts, and the agent is not-issued until issue
---
duration_ms: 8.513425
type: 'test'
...
# Subtest: T1: a store path the reference does not own, or no store root, refuses the reference
ok 106 - T1: a store path the reference does not own, or no store root, refuses the reference
---
duration_ms: 0.878608
type: 'test'
...
# Subtest: T1: a wrong mode on the store root, a business dir, an agent dir or the file refuses start
ok 107 - T1: a wrong mode on the store root, a business dir, an agent dir or the file refuses start
---
duration_ms: 5.15667
type: 'test'
...
# Subtest: T1: a missing store root refuses start; a missing {file} reference still refuses start
ok 108 - T1: a missing store root refuses start; a missing {file} reference still refuses start
---
duration_ms: 1.064331
type: 'test'
...
# Subtest: T1: a store file that is a directory or a symlink refuses start
ok 109 - T1: a store file that is a directory or a symlink refuses start
---
duration_ms: 1.293011
type: 'test'
...
# Subtest: T2: useFor keys from the session only
ok 110 - T2: useFor keys from the session only
---
duration_ms: 2.948905
type: 'test'
...
# Subtest: T5: issue, rotate, revoke and delete are live with no restart, and revoke holds across one
ok 111 - T5: issue, rotate, revoke and delete are live with no restart, and revoke holds across one
---
duration_ms: 7.737892
type: 'test'
...
# Subtest: T5: a failed commit leaves the token on disk but not in memory, and a bad token or date writes nothing
ok 112 - T5: a failed commit leaves the token on disk but not in memory, and a bad token or date writes nothing
---
duration_ms: 3.408542
type: 'test'
...
# Subtest: T5: revoke drops the token from memory before the unlink, so a failed unlink still leaves it revoked
ok 113 - T5: revoke drops the token from memory before the unlink, so a failed unlink still leaves it revoked
---
duration_ms: 3.27629
type: 'test'
...
# Subtest: T5: revoke of a {file} reference forgets the token and never unlinks the file
ok 114 - T5: revoke of a {file} reference forgets the token and never unlinks the file
---
duration_ms: 1.007153
type: 'test'
...
# Subtest: T5: delete refuses an agent dir holding anything but tokens
ok 115 - T5: delete refuses an agent dir holding anything but tokens
---
duration_ms: 2.729279
type: 'test'
...
# Subtest: D5: every credentials use( call site is on the allowlist
ok 116 - D5: every credentials use( call site is on the allowlist
---
duration_ms: 40.221728
type: 'test'
...
# Subtest: row 199: the lifecycle verbs refuse every session but the human, and the tester revokes only
ok 117 - row 199: the lifecycle verbs refuse every session but the human, and the tester revokes only
---
duration_ms: 63.387848
type: 'test'
...
# Subtest: T5: issue, rotate, revoke and delete are live, rewrite the business file and leave one receipt each, with no value anywhere
ok 118 - T5: issue, rotate, revoke and delete are live, rewrite the business file and leave one receipt each, with no value anywhere
---
duration_ms: 167.921762
type: 'test'
...
# Subtest: only validated broker references load; returned data and exceptions cannot expose a known token
ok 119 - only validated broker references load; returned data and exceptions cannot expose a known token
---
duration_ms: 3.53915
type: 'test'
...
# Subtest: bad file modes, symlinks, repository/data paths, malformed tokens and missing dates refuse
ok 120 - bad file modes, symlinks, repository/data paths, malformed tokens and missing dates refuse
---
duration_ms: 2.684388
type: 'test'
...
# Subtest: expiry refuses use and env references never become client data
ok 121 - expiry refuses use and env references never become client data
---
duration_ms: 0.872548
type: 'test'
...
# Subtest: S1 parsed service refs work, service mismatch refuses, Gitea rotation due is a warning state
ok 122 - S1 parsed service refs work, service mismatch refuses, Gitea rotation due is a warning state
---
duration_ms: 1.940839
type: 'test'
...
# Subtest: opaque tokens shorter than 16 characters refuse before use
ok 123 - opaque tokens shorter than 16 characters refuse before use
---
duration_ms: 0.445466
type: 'test'
...
# Subtest: each C-suite role file carries the same two lists: human, chief-of-staff, pm, cto
ok 124 - each C-suite role file carries the same two lists: human, chief-of-staff, pm, cto
---
duration_ms: 2.131128
type: 'test'
...
# Subtest: chief-executive-officer: messages to and from the user, chief of staff, pm and cto pass
ok 125 - chief-executive-officer: messages to and from the user, chief of staff, pm and cto pass
---
duration_ms: 87.580086
type: 'test'
...
# Subtest: chief-executive-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored
ok 126 - chief-executive-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored
---
duration_ms: 74.251697
type: 'test'
...
# Subtest: chief-executive-officer: another C-suite role isn't on the lists either
ok 127 - chief-executive-officer: another C-suite role isn't on the lists either
---
duration_ms: 66.018398
type: 'test'
...
# Subtest: chief-financial-officer: messages to and from the user, chief of staff, pm and cto pass
ok 128 - chief-financial-officer: messages to and from the user, chief of staff, pm and cto pass
---
duration_ms: 89.298756
type: 'test'
...
# Subtest: chief-financial-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored
ok 129 - chief-financial-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored
---
duration_ms: 88.665379
type: 'test'
...
# Subtest: chief-financial-officer: another C-suite role isn't on the lists either
ok 130 - chief-financial-officer: another C-suite role isn't on the lists either
---
duration_ms: 60.147288
type: 'test'
...
# Subtest: chief-information-officer: messages to and from the user, chief of staff, pm and cto pass
ok 131 - chief-information-officer: messages to and from the user, chief of staff, pm and cto pass
---
duration_ms: 82.905813
type: 'test'
...
# Subtest: chief-information-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored
ok 132 - chief-information-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored
---
duration_ms: 81.360533
type: 'test'
...
# Subtest: chief-information-officer: another C-suite role isn't on the lists either
ok 133 - chief-information-officer: another C-suite role isn't on the lists either
---
duration_ms: 78.548327
type: 'test'
...
# Subtest: chief-information-security-officer: messages to and from the user, chief of staff, pm and cto pass
ok 134 - chief-information-security-officer: messages to and from the user, chief of staff, pm and cto pass
---
duration_ms: 82.792194
type: 'test'
...
# Subtest: chief-information-security-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored
ok 135 - chief-information-security-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored
---
duration_ms: 78.50353
type: 'test'
...
# Subtest: chief-information-security-officer: another C-suite role isn't on the lists either
ok 136 - chief-information-security-officer: another C-suite role isn't on the lists either
---
duration_ms: 69.878212
type: 'test'
...
# Subtest: chief-marketing-officer: messages to and from the user, chief of staff, pm and cto pass
ok 137 - chief-marketing-officer: messages to and from the user, chief of staff, pm and cto pass
---
duration_ms: 71.911159
type: 'test'
...
# Subtest: chief-marketing-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored
ok 138 - chief-marketing-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored
---
duration_ms: 70.607138
type: 'test'
...
# Subtest: chief-marketing-officer: another C-suite role isn't on the lists either
ok 139 - chief-marketing-officer: another C-suite role isn't on the lists either
---
duration_ms: 66.253118
type: 'test'
...
# limits: {"event":"limit-reached","business":"demo","check":"daily-quota","export":"mayLaunch","subject":{"instance":"coder","provider":"anthropic","model":"opus","account":"jason-max"},"path":["tokens","daily","jason-max"],"limit":0,"count":0,"unknownTurns":0}
# usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"89a6ec2c-eeb9-4606-a109-24a8962f4d49","source":"@none","code":"baseline-unknown"}
# limits: {"event":"limit-reached","business":"demo","check":"daily-quota","export":"mustStop","subject":{"instance":"coder","provider":"anthropic","model":"opus","account":"jason-max"},"path":["tokens","daily","jason-max"],"limit":0,"count":0,"unknownTurns":1}
# usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"b9d09a24-3624-44e2-9f29-ef6143b36a67","source":"@none","code":"baseline-unknown"}
# Subtest: REQ-LIMIT-2 runtime: limits counts the daily quota, and mayLaunch refuses only the account at it
ok 140 - REQ-LIMIT-2 runtime: limits counts the daily quota, and mayLaunch refuses only the account at it
---
duration_ms: 206.272855
type: 'test'
...
# Subtest: REQ-LIMIT-4 runtime: a run bound with the account writes it on its usage records and stops at the quota
ok 141 - REQ-LIMIT-4 runtime: a run bound with the account writes it on its usage records and stops at the quota
---
duration_ms: 94.047764
type: 'test'
...
# Subtest: REQ-LIMIT-4 runtime: a run bound without an account records null and the daily quota never stops it
ok 142 - REQ-LIMIT-4 runtime: a run bound without an account records null and the daily quota never stops it
---
duration_ms: 84.728964
type: 'test'
...
# Subtest: REQ-LIMIT-4 bindLaunch keeps the account off session.launched, refuses one that is not an identifier, and takes null as none
ok 143 - REQ-LIMIT-4 bindLaunch keeps the account off session.launched, refuses one that is not an identifier, and takes null as none
---
duration_ms: 25.558362
type: 'test'
...
# Subtest: a human resolve sends the raising role one message from the human, and its request is the answer
ok 144 - a human resolve sends the raising role one message from the human, and its request is the answer
---
duration_ms: 55.596054
type: 'test'
...
# Subtest: a cross-role decision resolved by its arbiter comes from that role and run, with no request
ok 145 - a cross-role decision resolved by its arbiter comes from that role and run, with no request
---
duration_ms: 40.632611
type: 'test'
...
# Subtest: a human withdraw sends one message with the note
ok 146 - a human withdraw sends one message with the note
---
duration_ms: 42.473787
type: 'test'
...
# Subtest: a human seen before the close leaves the request on the close's answer, not the seen
ok 147 - a human seen before the close leaves the request on the close's answer, not the seen
---
duration_ms: 52.28658
type: 'test'
...
# Subtest: the raising run's withdraw, a supersede, a within-role raise and seen send nothing
ok 148 - the raising run's withdraw, a supersede, a within-role raise and seen send nothing
---
duration_ms: 60.98073
type: 'test'
...
# Subtest: refused closes send nothing: invalid-choice, decision-closed, not-resolver
ok 149 - refused closes send nothing: invalid-choice, decision-closed, not-resolver
---
duration_ms: 60.662489
type: 'test'
...
# Subtest: a raising role nobody holds at the close gets the message on the next claim
ok 150 - a raising role nobody holds at the close gets the message on the next claim
---
duration_ms: 49.971535
type: 'test'
...
# Subtest: a human DECISION send keeps its own instruction as the request, not a close's answer
ok 151 - a human DECISION send keeps its own instruction as the request, not a close's answer
---
duration_ms: 45.249477
type: 'test'
...
# Subtest: a cross-role raise whose arbiter the raiser does not hear from is refused and stores nothing
ok 152 - a cross-role raise whose arbiter the raiser does not hear from is refused and stores nothing
---
duration_ms: 54.978973
type: 'test'
...
# Subtest: a gated raise by a role that does not hear from the human is refused and stores nothing
ok 153 - a gated raise by a role that does not hear from the human is refused and stores nothing
---
duration_ms: 48.261512
type: 'test'
...
# Subtest: a route the raiser hears from is allowed, checked from the route to the raiser
ok 154 - a route the raiser hears from is allowed, checked from the route to the raiser
---
duration_ms: 61.248168
type: 'test'
...
# Subtest: a refused supersede withdraws nothing
ok 155 - a refused supersede withdraws nothing
---
duration_ms: 59.141768
type: 'test'
...
# Subtest: the assistant's within-role and gated raises still work
ok 156 - the assistant's within-role and gated raises still work
---
duration_ms: 62.488533
type: 'test'
...
# Subtest: roles lists open decisions routed to a role, and never the human inbox
ok 157 - roles lists open decisions routed to a role, and never the human inbox
---
duration_ms: 46.897416
type: 'test'
...
# Subtest: recent lists closed decisions of every route, newest close first, with how each closed
ok 158 - recent lists closed decisions of every route, newest close first, with how each closed
---
duration_ms: 52.999955
type: 'test'
...
# Subtest: recent gives the closing event as closed when the decision was seen first
ok 159 - recent gives the closing event as closed when the decision was seen first
---
duration_ms: 53.359045
type: 'test'
...
# Subtest: recent stops at RECENT rows
ok 160 - recent stops at RECENT rows
---
duration_ms: 167.967796
type: 'test'
...
# Subtest: every row is what trail already gives the same session for that id
ok 161 - every row is what trail already gives the same session for that id
---
duration_ms: 73.548319
type: 'test'
...
# Subtest: a role session can't list decisions, so it can't read another role's open decisions
ok 162 - a role session can't list decisions, so it can't read another role's open decisions
---
duration_ms: 71.376089
type: 'test'
...
# Subtest: decisions is a read: one business, strict arguments, nothing written
ok 163 - decisions is a read: one business, strict arguments, nothing written
---
duration_ms: 78.214897
type: 'test'
...
# Subtest: endLaunch writes session.ended, releases the run claim and kills its capabilities
ok 164 - endLaunch writes session.ended, releases the run claim and kills its capabilities
---
duration_ms: 41.143821
type: 'test'
...
# Subtest: endLaunch refuses an unknown run, a second end and a rebind of the ended run
ok 165 - endLaunch refuses an unknown run, a second end and a rebind of the ended run
---
duration_ms: 28.563474
type: 'test'
...
# Subtest: a restarted broker refuses to rebind an ended run; a refused rebind leaves the run unbound
ok 166 - a restarted broker refuses to rebind an ended run; a refused rebind leaves the run unbound
---
duration_ms: 31.89441
type: 'test'
...
# Subtest: endLaunch leaves a claim another run took alone
ok 167 - endLaunch leaves a claim another run took alone
---
duration_ms: 33.422092
type: 'test'
...
# Subtest: refuse records action.refused against the caller with the code only
ok 168 - refuse records action.refused against the caller with the code only
---
duration_ms: 25.889307
type: 'test'
...
# Subtest: launches off refuses role.launch with launch-revoked until launches on
ok 169 - launches off refuses role.launch with launch-revoked until launches on
---
duration_ms: 32.756534
type: 'test'
...
# Subtest: broker process: launch ops authorize role.launch, record refusals and end runs
ok 170 - broker process: launch ops authorize role.launch, record refusals and end runs
---
duration_ms: 285.015476
type: 'test'
...
# Subtest: X-G3: on scratch 1.27.1, a grant makes the user, mints, forks, checks reach, writes the file, and revoke deletes the token
ok 171 - X-G3: on scratch 1.27.1, a grant makes the user, mints, forks, checks reach, writes the file, and revoke deletes the token
---
duration_ms: 11980.994497
type: 'test'
...
# Subtest: versionAtLeast compares numbers and refuses a prerelease of 1.27.0
ok 172 - versionAtLeast compares numbers and refuses a prerelease of 1.27.0
---
duration_ms: 2.23461
type: 'test'
...
# Subtest: X-G1: a raise that fails a check refuses and stores nothing
ok 173 - X-G1: a raise that fails a check refuses and stores nothing
---
duration_ms: 110.628761
type: 'test'
...
# Subtest: X-G1: a creative role, a role without identity and a missing or due slot refuse at raise
ok 174 - X-G1: a creative role, a role without identity and a missing or due slot refuse at raise
---
duration_ms: 379.9152
type: 'test'
...
# Subtest: X-G2: admin set refuses each failed check and writes nothing, then writes the slot once
ok 175 - X-G2: admin set refuses each failed check and writes nothing, then writes the slot once
---
duration_ms: 302.642782
type: 'test'
...
# Subtest: X-G3 to X-G8: an approve makes the user, mints the token, forks, checks reach and writes the file, record and grant.applied
ok 176 - X-G3 to X-G8: an approve makes the user, mints the token, forks, checks reach and writes the file, record and grant.applied
---
duration_ms: 200.129256
type: 'test'
...
# Subtest: X-G4: a user this stack did not make, an admin, a disabled user and a remade user each refuse
ok 177 - X-G4: a user this stack did not make, an admin, a disabled user and a remade user each refuse
---
duration_ms: 450.024674
type: 'test'
...
# Subtest: X-G6 and X-G8: the user and mint steps are written before their calls, and each result after its call
ok 178 - X-G6 and X-G8: the user and mint steps are written before their calls, and each result after its call
---
duration_ms: 165.606059
type: 'test'
...
# Subtest: X-G4: a fork by the seat user of another repository than the project refuses fork-foreign
ok 179 - X-G4: a fork by the seat user of another repository than the project refuses fork-foreign
---
duration_ms: 161.83251
type: 'test'
...
# Subtest: X-G5: a failure after the mint deletes the token, unloads nothing it did not load and leaves no file
ok 180 - X-G5: a failure after the mint deletes the token, unloads nothing it did not load and leaves no file
---
duration_ms: 248.102631
type: 'test'
...
# Subtest: X-G5: a token delete that fails is left at Gitea, shown by status and taken by sweep
ok 181 - X-G5: a token delete that fails is left at Gitea, shown by status and taken by sweep
---
duration_ms: 183.617018
type: 'test'
...
# Subtest: X-G5: a mint that fails deletes by name, and a refusal at step 0 leaves the decision unspent
ok 182 - X-G5: a mint that fails deletes by name, and a refusal at step 0 leaves the decision unspent
---
duration_ms: 287.44018
type: 'test'
...
# Subtest: X-G5: an agent held for an unknown token is refused at step 0 with no Gitea call
ok 183 - X-G5: an agent held for an unknown token is refused at step 0 with no Gitea call
---
duration_ms: 93.73883
type: 'test'
...
# Subtest: X-G5 and X-G9 (step 7): a rotation whose old-token delete fails stays applied with the old id left
ok 184 - X-G5 and X-G9 (step 7): a rotation whose old-token delete fails stays applied with the old id left
---
duration_ms: 314.640033
type: 'test'
...
# Subtest: X-G10: in a rotation the store file holds the new token before the old one is deleted
ok 185 - X-G10: in a rotation the store file holds the new token before the old one is deleted
---
duration_ms: 241.279153
type: 'test'
...
# Subtest: X-G6: a rotation cut before the rename settles back at once, and the old token stays live
ok 186 - X-G6: a rotation cut before the rename settles back at once, and the old token stays live
---
duration_ms: 281.966917
type: 'test'
...
# Subtest: X-G6: a rotation whose step 8 write fails is settle-pending, and a restart settles it forward
ok 187 - X-G6: a rotation whose step 8 write fails is settle-pending, and a restart settles it forward
---
duration_ms: 436.598714
type: 'test'
...
# Subtest: X-G6: a restart settles an open rotation back when the file still holds the old token
ok 188 - X-G6: a restart settles an open rotation back when the file still holds the old token
---
duration_ms: 254.462195
type: 'test'
...
# Subtest: X-G6: a restart settles an open rotation forward when the file holds the new token
ok 189 - X-G6: a restart settles an open rotation forward when the file holds the new token
---
duration_ms: 236.777226
type: 'test'
...
# Subtest: X-G6: a 401 on the file token loses the grant: both tokens go, the record goes and memory unloads
ok 190 - X-G6: a 401 on the file token loses the grant: both tokens go, the record goes and memory unloads
---
duration_ms: 221.124125
type: 'test'
...
# Subtest: X-G6: a 403, 404, 500, a hang and a dropped socket each leave the rotation settle-pending with nothing deleted
ok 191 - X-G6: a 403, 404, 500, a hang and a dropped socket each leave the rotation settle-pending with nothing deleted
---
duration_ms: 1356.696759
type: 'test'
...
# Subtest: X-G6: a file token no grant minted is held; the next restart says so again; a revoke clears it and takes both ids
ok 192 - X-G6: a file token no grant minted is held; the next restart says so again; a revoke clears it and takes both ids
---
duration_ms: 172.360041
type: 'test'
...
# Subtest: N9: a revoke of an open rotation, then a restart: no settle, no Gitea call and no message
ok 193 - N9: a revoke of an open rotation, then a restart: no settle, no Gitea call and no message
---
duration_ms: 117.070696
type: 'test'
...
# Subtest: N9: a 404 on a delete by id counts as done
ok 194 - N9: a 404 on a delete by id counts as done
---
duration_ms: 112.776418
type: 'test'
...
# Subtest: X-G6: a restart undoes each step a killed child left, and spends an approved unspent decision
ok 195 - X-G6: a restart undoes each step a killed child left, and spends an approved unspent decision
---
duration_ms: 395.334169
type: 'test'
...
# Subtest: X-G6: a restart with no admin slot leaves the user an orphan and the token left
ok 196 - X-G6: a restart with no admin slot leaves the user an orphan and the token left
---
duration_ms: 49.644424
type: 'test'
...
# Subtest: X-G7: a change to the definition, identity, publish remotes or admin slot after the raise ends decision-mismatch
ok 197 - X-G7: a change to the definition, identity, publish remotes or admin slot after the raise ends decision-mismatch
---
duration_ms: 107.569903
type: 'test'
...
# Subtest: X-G7 and X-G9: an admin rotate voids open decisions, and rotate --finish deletes what was left
ok 198 - X-G7 and X-G9: an admin rotate voids open decisions, and rotate --finish deletes what was left
---
duration_ms: 114.077795
type: 'test'
...
# Subtest: X-G9: a rotate whose name is taken refuses and writes nothing; remove takes the slot away
ok 199 - X-G9: a rotate whose name is taken refuses and writes nothing; remove takes the slot away
---
duration_ms: 60.685806
type: 'test'
...
# Subtest: X-G9: a slot past its rotate-by date refuses a run at step 0, leaving the decision unspent
ok 200 - X-G9: a slot past its rotate-by date refuses a run at step 0, leaving the decision unspent
---
duration_ms: 48.421896
type: 'test'
...
# Subtest: X-G11: run refuses every caller but the human, an unapproved, a spent and a busy decision
ok 201 - X-G11: run refuses every caller but the human, an unapproved, a spent and a busy decision
---
duration_ms: 101.851082
type: 'test'
...
# Subtest: kill switch (plan :16): while halted the chief still reads grants.status, and an agent grants.revoke refuses
ok 202 - kill switch (plan :16): while halted the chief still reads grants.status, and an agent grants.revoke refuses
---
duration_ms: 105.865858
type: 'test'
...
# Subtest: X-G11: a revoke while the executor runs aborts it and the grant ends revoked
ok 203 - X-G11: a revoke while the executor runs aborts it and the grant ends revoked
---
duration_ms: 112.725766
type: 'test'
...
# Subtest: X-G11: a revoke unloads memory and removes the file before its Gitea delete
ok 204 - X-G11: a revoke unloads memory and removes the file before its Gitea delete
---
duration_ms: 131.212674
type: 'test'
...
# Subtest: X-G11: a revoke during a rotation step 7 ends it revoked, and step 8 writes no record back
ok 205 - X-G11: a revoke during a rotation step 7 ends it revoked, and step 8 writes no record back
---
duration_ms: 177.726875
type: 'test'
...
# Subtest: X-G11: a revoke while a sweep settles a rotation, forward or back, ends it revoked with no record
ok 206 - X-G11: a revoke while a sweep settles a rotation, forward or back, ends it revoked with no record
---
duration_ms: 335.375955
type: 'test'
...
# Subtest: X-G11: a revoke during a settle whoami that finds a foreign token ends it revoked, not held
ok 207 - X-G11: a revoke during a settle whoami that finds a foreign token ends it revoked, not held
---
duration_ms: 167.174846
type: 'test'
...
# Subtest: X-G11: a revoke during a settle whoami that gets a 401 ends it revoked, not lost
ok 208 - X-G11: a revoke during a settle whoami that gets a 401 ends it revoked, not lost
---
duration_ms: 155.618979
type: 'test'
...
# Subtest: X-G12: a token that reaches wider than its forks fails with the repository named
ok 209 - X-G12: a token that reaches wider than its forks fails with the repository named
---
duration_ms: 362.868605
type: 'test'
...
# Subtest: X-G12: reach is paged by X-Total-Count and a count that does not add up refuses
ok 210 - X-G12: reach is paged by X-Total-Count and a count that does not add up refuses
---
duration_ms: 215.871587
type: 'test'
...
# Subtest: X-G13: an agent cannot record a grant event, and the trigger refuses one from any writer but the grant writer
ok 211 - X-G13: an agent cannot record a grant event, and the trigger refuses one from any writer but the grant writer
---
duration_ms: 38.146662
type: 'test'
...
# Subtest: X-G14: credentials delete fires the user: tokens go, login is prohibited, and grant.revoke.closed records it
ok 212 - X-G14: credentials delete fires the user: tokens go, login is prohibited, and grant.revoke.closed records it
---
duration_ms: 246.407069
type: 'test'
...
# Subtest: X-G14: a fire whose token delete or login PATCH fails lands it in serviceLeft
ok 213 - X-G14: a fire whose token delete or login PATCH fails lands it in serviceLeft
---
duration_ms: 127.049298
type: 'test'
...
# Subtest: X-G14: a fire whose user is gone or remade skips the fire steps and says why
ok 214 - X-G14: a fire whose user is gone or remade skips the fire steps and says why
---
duration_ms: 224.811113
type: 'test'
...
# Subtest: X-G14: a sweep retries a fire only for the user it fired: a remade or gone user is skipped and named
ok 215 - X-G14: a sweep retries a fire only for the user it fired: a remade or gone user is skipped and named
---
duration_ms: 252.455114
type: 'test'
...
# Subtest: X-G14: a revoke Gitea cannot reach stays open, and a restart closes it
ok 216 - X-G14: a revoke Gitea cannot reach stays open, and a restart closes it
---
duration_ms: 151.994145
type: 'test'
...
# Subtest: X-G15: look-alike commit steps outside the grant writer are ignored at start, by revoke and by status
ok 217 - X-G15: look-alike commit steps outside the grant writer are ignored at start, by revoke and by status
---
duration_ms: 135.085662
type: 'test'
...
# Subtest: X-G15: a look-alike spend under another kind with the grant writer pair is not an open grant
ok 218 - X-G15: a look-alike spend under another kind with the grant writer pair is not an open grant
---
duration_ms: 43.609032
type: 'test'
...
# Subtest: status lists the slot, users, grants and nothing secret, and every grants verb needs service gitea
ok 219 - status lists the slot, users, grants and nothing secret, and every grants verb needs service gitea
---
duration_ms: 108.536447
type: 'test'
...
# Subtest: 3j copy migrates to 3k: every row kept, and sqlite_master gains only the two tables and their keys
ok 220 - 3j copy migrates to 3k: every row kept, and sqlite_master gains only the two tables and their keys
---
duration_ms: 143.603712
type: 'test'
...
# Subtest: a 3j→3k step that fails partway leaves the store at 3j with every row and the schema intact
ok 221 - a 3j→3k step that fails partway leaves the store at 3j with every row and the schema intact
---
duration_ms: 195.882352
type: 'test'
...
# Subtest: the 3j engine refuses a 3k store, migrating or not, and leaves it at 3k
ok 222 - the 3j engine refuses a 3k store, migrating or not, and leaves it at 3k
---
duration_ms: 157.21723
type: 'test'
...
# Subtest: gitea_users: one user per business and agent, an id above 0, a 16-hex nonce and a real decision
ok 223 - gitea_users: one user per business and agent, an id above 0, a 16-hex nonce and a real decision
---
duration_ms: 21.483423
type: 'test'
...
# Subtest: gitea_grants: one grant per agent, a projects array, a token id above 0, and only for a recorded user
ok 224 - gitea_grants: one grant per agent, a projects array, a token id above 0, and only for a recorded user
---
duration_ms: 23.423051
type: 'test'
...
# Subtest: G1, A1: only the chief raises a grant, and a refused raise stores nothing and runs no keyscan
ok 225 - G1, A1: only the chief raises a grant, and a refused raise stores nothing and runs no keyscan
---
duration_ms: 55.890444
type: 'test'
...
# Subtest: G1: grant goes only with credential.mint, row a takes only host-enroll, and E1 refuses each bad field
ok 226 - G1: grant goes only with credential.mint, row a takes only host-enroll, and E1 refuses each bad field
---
duration_ms: 96.8939
type: 'test'
...
# Subtest: G5, A5, A6: the scanned key set must equal the requested set, or host-key-mismatch and nothing stored
ok 227 - G5, A5, A6: the scanned key set must equal the requested set, or host-key-mismatch and nothing stored
---
duration_ms: 70.452114
type: 'test'
...
# Subtest: G4 (host-enroll block, M1): the broker appends the keys, fingerprints and sudo line, and the cap counts the block
ok 228 - G4 (host-enroll block, M1): the broker appends the keys, fingerprints and sudo line, and the cap counts the block
---
duration_ms: 54.773044
type: 'test'
...
# Subtest: G6, X1: the human's cli yes starts enrollment, which writes the record, the key file and the events in order
ok 229 - G6, X1: the human's cli yes starts enrollment, which writes the record, the key file and the events in order
---
duration_ms: 72.380455
type: 'test'
...
# Subtest: A2, A4: a credential.mint without grant, and a no, start nothing
ok 230 - A2, A4: a credential.mint without grant, and a no, start nothing
---
duration_ms: 252.584588
type: 'test'
...
# Subtest: A3, X1: a resolve by the tester or an agent starts nothing
ok 231 - A3, X1: a resolve by the tester or an agent starts nothing
---
duration_ms: 278.366785
type: 'test'
...
# Subtest: G6 (duckworth-0081 B3): a withdraw by the chief or the human, and an arbiter resolve, start nothing
ok 232 - G6 (duckworth-0081 B3): a withdraw by the chief or the human, and an arbiter resolve, start nothing
---
duration_ms: 251.466995
type: 'test'
...
# Subtest: G10 (duckworth-0081 B1): a second start for a spent decision refuses decision-consumed, and an unresolved or agent-resolved one not-authorized
ok 233 - G10 (duckworth-0081 B1): a second start for a spent decision refuses decision-consumed, and an unresolved or agent-resolved one not-authorized
---
duration_ms: 72.80512
type: 'test'
...
# Subtest: A8, S1: two approved enrollments for one host: the second ends host-enrolled and the pin stays
ok 234 - A8, S1: two approved enrollments for one host: the second ends host-enrolled and the pin stays
---
duration_ms: 95.55994
type: 'test'
...
# Subtest: A9: the hosts primary key refuses a second record for (business, host)
ok 235 - A9: the hosts primary key refuses a second record for (business, host)
---
duration_ms: 41.920743
type: 'test'
...
# Subtest: X3: a failure at step 2 deletes the record again and ends grant.failed, with no key file
ok 236 - X3: a failure at step 2 deletes the record again and ends grant.failed, with no key file
---
duration_ms: 64.1885
type: 'test'
...
# Subtest: A10, X3: at start a resolved, unspent enrollment is spent and ends interrupted, and never runs late
ok 237 - A10, X3: at start a resolved, unspent enrollment is spent and ends interrupted, and never runs late
---
duration_ms: 47.176098
type: 'test'
...
# Subtest: X3: at start an enrollment that stopped after its registry step loses its record and key file
ok 238 - X3: at start an enrollment that stopped after its registry step loses its record and key file
---
duration_ms: 63.716801
type: 'test'
...
# Subtest: G24 first sentence, M2, A12: tags are mosaic- and 32 hex, and differ by business, agent and host
ok 239 - G24 first sentence, M2, A12: tags are mosaic- and 32 hex, and differ by business, agent and host
---
duration_ms: 0.454843
type: 'test'
...
# Subtest: E4: hosts.check sets the record ready and records grant.host.checked; a non-zero list leaves it pending
ok 240 - E4: hosts.check sets the record ready and records grant.host.checked; a non-zero list leaves it pending
---
duration_ms: 71.870355
type: 'test'
...
# Subtest: G20 (duckworth-0081 B3): the human's hosts.check marks the host ready, and the reader refuses
ok 241 - G20 (duckworth-0081 B3): the human's hosts.check marks the host ready, and the reader refuses
---
duration_ms: 75.398341
type: 'test'
...
# Subtest: G18 (duckworth-0081 B2), broker half: a check refused host-key-mismatch leaves the host pending-install with no grant.host.checked
ok 242 - G18 (duckworth-0081 B2), broker half: a check refused host-key-mismatch leaves the host pending-install with no grant.host.checked
---
duration_ms: 60.741549
type: 'test'
...
# Subtest: E4: a check whose installer fingerprint differs from the record refuses host-changed
ok 243 - E4: a check whose installer fingerprint differs from the record refuses host-changed
---
duration_ms: 57.819647
type: 'test'
...
# Subtest: E4, G21: hosts.remove is the human's or the tester's, deletes the key and the record, and records grant.host.removed
ok 244 - E4, G21: hosts.remove is the human's or the tester's, deletes the key and the record, and records grant.host.removed
---
duration_ms: 65.798613
type: 'test'
...
# Subtest: G21, F1, F2, M4, A22: hosts.remove refuses host-line-left on a guarded hostLineLeft, and ignores look-alikes
ok 245 - G21, F1, F2, M4, A22: hosts.remove refuses host-line-left on a guarded hostLineLeft, and ignores look-alikes
---
duration_ms: 66.497946
type: 'test'
...
# Subtest: hosts.remove refuses host-in-use while a grant record names the host
ok 246 - hosts.remove refuses host-in-use while a grant record names the host
---
duration_ms: 62.188101
type: 'test'
...
# Subtest: the grant writer refuses a body outside section 7's shape
ok 247 - the grant writer refuses a body outside section 7's shape
---
duration_ms: 34.68249
type: 'test'
...
# Subtest: recordEvent refuses reserved-event for a grant.* action or operation
ok 248 - recordEvent refuses reserved-event for a grant.* action or operation
---
duration_ms: 35.844116
type: 'test'
...
# Subtest: row 280: an occupied TCP port is attempted, refused, and retried with our sshd
ok 249 - row 280: an occupied TCP port is attempted, refused, and retried with our sshd
---
duration_ms: 107.566439
type: 'test'
...
# Subtest: row 280: every injected picker sample is unprivileged and outside the ephemeral range
ok 250 - row 280: every injected picker sample is unprivileged and outside the ephemeral range
---
duration_ms: 0.540978
type: 'test'
...
# Subtest: G7: an Approve installs the tagged line, logs in with the new key, and writes the key file, record and grant.applied
ok 251 - G7: an Approve installs the tagged line, logs in with the new key, and writes the key file, record and grant.applied
---
duration_ms: 822.773358
type: 'test'
...
# Subtest: G7: a commands change on a live grant updates the record in one transaction and keeps the key and line
ok 252 - G7: a commands change on a live grant updates the record in one transaction and keeps the key and line
---
duration_ms: 614.004262
type: 'test'
...
# Subtest: G8: a failure at install or verify removes the line and leaves no record, key file or reference
ok 253 - G8: a failure at install or verify removes the line and leaves no record, key file or reference
---
duration_ms: 1752.033982
type: 'test'
...
# Subtest: G8: a failed remove adds hostLineLeft and tells the human to sweep
ok 254 - G8: a failed remove adds hostLineLeft and tells the human to sweep
---
duration_ms: 809.800716
type: 'test'
...
# Subtest: G8: a failure in step 5 before commit unlinks the key file, drops the reference and removes the line
ok 255 - G8: a failure in step 5 before commit unlinks the key file, drops the reference and removes the line
---
duration_ms: 739.561082
type: 'test'
...
# Subtest: G8: a store fault in the commit transaction ends host-failed with no record, key file, reference or line
ok 256 - G8: a store fault in the commit transaction ends host-failed with no record, key file, reference or line
---
duration_ms: 729.610494
type: 'test'
...
# Subtest: G8: a failed step 1 check spends the decision and runs nothing remote
ok 257 - G8: a failed step 1 check spends the decision and runs nothing remote
---
duration_ms: 87.550307
type: 'test'
...
# Subtest: G9: a registry, definition or commands change between raise and Approve ends decision-mismatch before any remote step
ok 258 - G9: a registry, definition or commands change between raise and Approve ends decision-mismatch before any remote step
---
duration_ms: 529.719172
type: 'test'
...
# Subtest: G9: an agent no longer a role or no longer declaring host ends with its code, spent
ok 259 - G9: an agent no longer a role or no longer declaring host ends with its code, spent
---
duration_ms: 67.130847
type: 'test'
...
# Subtest: G10: a second start refuses decision-consumed, and an unresolved or agent-resolved decision not-authorized, writing nothing
ok 260 - G10: a second start refuses decision-consumed, and an unresolved or agent-resolved decision not-authorized, writing nothing
---
duration_ms: 514.680491
type: 'test'
...
# Subtest: G15: no event, message or decision holds the private key
ok 261 - G15: no event, message or decision holds the private key
---
duration_ms: 507.032927
type: 'test'
...
# Subtest: G23: a revoke during install ends grant.failed revoked with no key file, no grant and no line
ok 262 - G23: a revoke during install ends grant.failed revoked with no key file, no grant and no line
---
duration_ms: 523.344859
type: 'test'
...
# Subtest: G23 (row 249): an add that writes after an abort's remove leaves hostLineLeft until the sweep
ok 263 - G23 (row 249): an add that writes after an abort's remove leaves hostLineLeft until the sweep
---
duration_ms: 852.989951
type: 'test'
...
# Subtest: G23 (row 249): an add that writes after a timed-out install's remove leaves hostLineLeft until the sweep
ok 264 - G23 (row 249): an add that writes after a timed-out install's remove leaves hostLineLeft until the sweep
---
duration_ms: 854.016433
type: 'test'
...
# Subtest: G23: a revoke recorded after the raise and before the start ends step 1 revoked, and a held slot ends host-busy
ok 265 - G23: a revoke recorded after the raise and before the start ends step 1 revoked, and a held slot ends host-busy
---
duration_ms: 503.953697
type: 'test'
...
# Subtest: G24: names at 64 characters with . and _ give distinct tags of the fixed length
ok 266 - G24: names at 64 characters with . and _ give distinct tags of the fixed length
---
duration_ms: 0.392938
type: 'test'
...
# Subtest: G11: a restart after install removes the line, then ends interrupted with the tag, holding the slot until then
ok 267 - G11: a restart after install removes the line, then ends interrupted with the tag, holding the slot until then
---
duration_ms: 217.824989
type: 'test'
...
# Subtest: G11: a restart after a new key's commit, with the key file written, ends with no key file, record, reference or line
ok 268 - G11: a restart after a new key's commit, with the key file written, ends with no key file, record, reference or line
---
duration_ms: 216.005234
type: 'test'
...
# Subtest: G11: a restart after a commands change's commit leaves the record as it was and asks nothing of the host
ok 269 - G11: a restart after a commands change's commit leaves the record as it was and asks nothing of the host
---
duration_ms: 510.005128
type: 'test'
...
# Subtest: G11 (B2): a restart before step 1, spent or not yet spent, ends interrupted and nothing runs later
ok 270 - G11 (B2): a restart before step 1, spent or not yet spent, ends interrupted and nothing runs later
---
duration_ms: 64.888365
type: 'test'
...
# Subtest: G11: a remote undo that fails ends interrupted with hostLineLeft and the sweep hint
ok 271 - G11: a remote undo that fails ends interrupted with hostLineLeft and the sweep hint
---
duration_ms: 265.197823
type: 'test'
...
# Subtest: G11: a restart leaves a finished grant alone, and the reconcile adds nothing for it
ok 272 - G11: a restart leaves a finished grant alone, and the reconcile adds nothing for it
---
duration_ms: 515.133503
type: 'test'
...
# Subtest: N1 (G27): the start sweep unlinks host.<id> files with no record in loaded businesses only, and refuses a store dir that is not private
ok 273 - N1 (G27): the start sweep unlinks host.<id> files with no record in loaded businesses only, and refuses a store dir that is not private
---
duration_ms: 6.614579
type: 'test'
...
# Subtest: G12: the human's hosts.revoke deletes the record, the key file, the reference and the line, with a closed marker
ok 274 - G12: the human's hosts.revoke deletes the record, the key file, the reference and the line, with a closed marker
---
duration_ms: 647.396292
type: 'test'
...
# Subtest: G12 (N4): a revoke with no record still removes the computed tag's line, with granted false; bad args refuse
ok 275 - G12 (N4): a revoke with no record still removes the computed tag's line, with granted false; bad args refuse
---
duration_ms: 224.453208
type: 'test'
...
# Subtest: G13: a revoke during install aborts the executor, which ends revoked, and the line goes
ok 276 - G13: a revoke during install aborts the executor, which ends revoked, and the line goes
---
duration_ms: 569.306219
type: 'test'
...
# Subtest: G26: the human, the assistant and the tester revoke; the chief and a pm refuse; sweep is the human's or the tester's
ok 277 - G26: the human, the assistant and the tester revoke; the chief and a pm refuse; sweep is the human's or the tester's
---
duration_ms: 512.040456
type: 'test'
...
# Subtest: G27: a restart after step 1 sweeps the key file and runs step 3 once the bus is up; status shows the revoke until then
ok 278 - G27: a restart after step 1 sweeps the key file and runs step 3 once the bus is up; status shows the revoke until then
---
duration_ms: 649.894395
type: 'test'
...
# Subtest: G27: after step 2 with the host down, the restart closes the marker with hostLineLeft; a marker without a revoke id is not reopened
ok 279 - G27: after step 2 with the host down, the restart closes the marker with hostLineLeft; a marker without a revoke id is not reopened
---
duration_ms: 962.351355
type: 'test'
...
# Subtest: G27: a key file a revoke could not unlink is reported left and goes at the next start
ok 280 - G27: a key file a revoke could not unlink is reported left and goes at the next start
---
duration_ms: 656.712961
type: 'test'
...
# Subtest: G28: a commands change, then a revoke, then a restart leave no record, key, reference or line
ok 281 - G28: a commands change, then a revoke, then a restart leave no record, key, reference or line
---
duration_ms: 702.32506
type: 'test'
...
# Subtest: G24 (B4): hosts.sweep removes only this business's recorded tags no live grant holds, and records what it left
ok 282 - G24 (B4): hosts.sweep removes only this business's recorded tags no live grant holds, and records what it left
---
duration_ms: 996.329202
type: 'test'
...
# Subtest: G12: the local steps finish before the host step, so a host that hangs leaves the agent no access
ok 283 - G12: the local steps finish before the host step, so a host that hangs leaves the agent no access
---
duration_ms: 690.233744
type: 'test'
...
# Subtest: G23 (X5): a revoke right after the spend reaches the executor's claim, so the grant ends revoked
ok 284 - G23 (X5): a revoke right after the spend reaches the executor's claim, so the grant ends revoked
---
duration_ms: 214.701651
type: 'test'
...
# Subtest: G23 (X5): a revoke that lands as verify returns ends revoked with no record, key file or line
ok 285 - G23 (X5): a revoke that lands as verify returns ends revoked with no record, key file or line
---
duration_ms: 647.616184
type: 'test'
...
# Subtest: G13: a revoke whose host remove fails still drops the record and key, and reports the line left for a sweep
ok 286 - G13: a revoke whose host remove fails still drops the record and key, and reports the line left for a sweep
---
duration_ms: 655.955839
type: 'test'
...
# Subtest: G22: enroll, check, grant, host.run, a commands change the next host.run uses, and a revoke that kills a run in flight
ok 287 - G22: enroll, check, grant, host.run, a commands change the next host.run uses, and a revoke that kills a run in flight
---
duration_ms: 1165.211787
type: 'test'
...
# Subtest: mos-1163: a grant whose agent became a creative role after the raise ends host-creative-role at step 1, spent, with nothing remote
ok 288 - mos-1163: a grant whose agent became a creative role after the raise ends host-creative-role at step 1, spent, with nothing remote
---
duration_ms: 61.61952
type: 'test'
...
# Subtest: sage-1908: once the agent of an applied grant is a creative role, host.run refuses host-creative-role, runs nothing remote and keeps the record
ok 289 - sage-1908: once the agent of an applied grant is a creative role, host.run refuses host-creative-role, runs nothing remote and keeps the record
---
duration_ms: 493.679582
type: 'test'
...
# Subtest: G1 (host): only the chief raises a host grant, a grant on any other action refuses, and nothing is stored
ok 290 - G1 (host): only the chief raises a host grant, a grant on any other action refuses, and nothing is stored
---
duration_ms: 59.754544
type: 'test'
...
# Subtest: G1, R4: the grant takes exactly method, agent, host, commands and rotateBy, and an unknown method refuses
ok 291 - G1, R4: the grant takes exactly method, agent, host, commands and rotateBy, and an unknown method refuses
---
duration_ms: 80.984473
type: 'test'
...
# Subtest: row 236 (\#1742): a gitea grant on a broker with no Gitea path refuses gitea-not-configured, and nothing is stored
ok 292 - row 236 (\#1742): a gitea grant on a broker with no Gitea path refuses gitea-not-configured, and nothing is stored
---
duration_ms: 44.637084
type: 'test'
...
# Subtest: G2: an agent whose definition lacks host refuses host-not-declared, and an unknown agent unknown-role
ok 293 - G2: an agent whose definition lacks host refuses host-not-declared, and an unknown agent unknown-role
---
duration_ms: 52.511999
type: 'test'
...
# Subtest: mos-1163: a grant whose agent is a creative role refuses host-creative-role, even when its definition declares host
ok 294 - mos-1163: a grant whose agent is a creative role refuses host-creative-role, even when its definition declares host
---
duration_ms: 37.316051
type: 'test'
...
# Subtest: G3: wildcard, shell, empty and other 210 D6 argv prefixes refuse invalid-request
ok 295 - G3: wildcard, shell, empty and other 210 D6 argv prefixes refuse invalid-request
---
duration_ms: 81.957029
type: 'test'
...
# Subtest: R4 rotateBy (sage-1782): a real calendar day after today UTC, or invalid-request
ok 296 - R4 rotateBy (sage-1782): a real calendar day after today UTC, or invalid-request
---
duration_ms: 66.627222
type: 'test'
...
# Subtest: G19: a grant naming a host that is pending-install refuses host-not-ready, and an unknown host host-unknown
ok 297 - G19: a grant naming a host that is pending-install refuses host-not-ready, and an unknown host host-unknown
---
duration_ms: 48.000553
type: 'test'
...
# Subtest: R4, G5: the raise routes to the human and its event body binds the eight fields with their hashes
ok 298 - R4, G5: the raise routes to the human and its event body binds the eight fields with their hashes
---
duration_ms: 40.615605
type: 'test'
...
# Subtest: G4 (host block): the broker appends the host, each prefix, the rotate date and new key or change
ok 299 - G4 (host block): the broker appends the host, each prefix, the rotate date and new key or change
---
duration_ms: 72.018281
type: 'test'
...
# Subtest: 3i copy migrates to 3j: every row kept, and sqlite_master gains only the two tables, their keys and the guard
ok 300 - 3i copy migrates to 3j: every row kept, and sqlite_master gains only the two tables, their keys and the guard
---
duration_ms: 174.094348
type: 'test'
...
# Subtest: a 3i→3j step that fails partway leaves the store at 3i with every row and the schema intact
ok 301 - a 3i→3j step that fails partway leaves the store at 3i with every row and the schema intact
---
duration_ms: 150.486189
type: 'test'
...
# Subtest: the 3i engine refuses a 3j store, migrating or not, and leaves it at 3j
ok 302 - the 3i engine refuses a 3j store, migrating or not, and leaves it at 3j
---
duration_ms: 150.96455
type: 'test'
...
# Subtest: A22b, sage-1703: a session-written grant.* row from before the step survives it, and the grant readers ignore it
ok 303 - A22b, sage-1703: a session-written grant.* row from before the step survives it, and the grant readers ignore it
---
duration_ms: 160.21291
type: 'test'
...
# Subtest: the guard: a grant.* action or operation on action.allowed needs the (NULL, grant) actor
ok 304 - the guard: a grant.* action or operation on action.allowed needs the (NULL, grant) actor
---
duration_ms: 29.770739
type: 'test'
...
# Subtest: hosts: one record per business and host, a ready host has its installer and check, grants need the host
ok 305 - hosts: one record per business and host, a ready host has its installer and check, grants need the host
---
duration_ms: 20.743685
type: 'test'
...
# Subtest: REQ-WAIT-1: the broker hard waits are exactly the list, and match the business vocabulary
ok 306 - REQ-WAIT-1: the broker hard waits are exactly the list, and match the business vocabulary
---
duration_ms: 2.22095
type: 'test'
...
# Subtest: REQ-WAIT-2: a business granting a hard wait at either class is refused; the actions that left are grantable
ok 307 - REQ-WAIT-2: a business granting a hard wait at either class is refused; the actions that left are grantable
---
duration_ms: 38.58539
type: 'test'
...
# Subtest: REQ-DEC-2: every hard wait goes to the human, cited or not, and the arbiter cannot resolve it
ok 308 - REQ-DEC-2: every hard wait goes to the human, cited or not, and the arbiter cannot resolve it
---
duration_ms: 844.96433
type: 'test'
...
# Subtest: REQ-DEC-2: a gated raise citing the current spec goes to the arbiter for its domain; uncited, to the human
ok 309 - REQ-DEC-2: a gated raise citing the current spec goes to the arbiter for its domain; uncited, to the human
---
duration_ms: 300.866206
type: 'test'
...
# Subtest: REQ-DEC-2: an arbiter-approved cited gated decision authorizes the raiser, and the human cannot resolve it
ok 310 - REQ-DEC-2: an arbiter-approved cited gated decision authorizes the raiser, and the human cannot resolve it
---
duration_ms: 89.395517
type: 'test'
...
# Subtest: REQ-DEC-2: a cited merge raised by merge-gate goes to the technical arbiter; a merge raised without the grant routes by citation
ok 311 - REQ-DEC-2: a cited merge raised by merge-gate goes to the technical arbiter; a merge raised without the grant routes by citation
---
duration_ms: 122.410366
type: 'test'
...
# Subtest: REQ-DEC-2: a stale or unconfirmed citation refuses without a decision; an arbiter raising its own goes to the human
ok 312 - REQ-DEC-2: a stale or unconfirmed citation refuses without a decision; an arbiter raising its own goes to the human
---
duration_ms: 195.393496
type: 'test'
...
# Subtest: Q169: the chief of staff's end of the assistant stops every thread run; its own run and another ender's are refused
ok 313 - Q169: the chief of staff's end of the assistant stops every thread run; its own run and another ender's are refused
---
duration_ms: 76.157781
type: 'test'
...
# Subtest: Q169: a revoke of the assistant the chief of staff raises goes to the human, cited or not, and no arbiter resolves it
ok 314 - Q169: a revoke of the assistant the chief of staff raises goes to the human, cited or not, and no arbiter resolves it
---
duration_ms: 189.061397
type: 'test'
...
# Subtest: Q169: another role's cited revoke of the assistant, resolved by an arbiter, is refused
ok 315 - Q169: another role's cited revoke of the assistant, resolved by an arbiter, is refused
---
duration_ms: 109.209635
type: 'test'
...
# Subtest: Q169: a revoke of the assistant citing a decision the human resolved stops its thread run
ok 316 - Q169: a revoke of the assistant citing a decision the human resolved stops its thread run
---
duration_ms: 94.35449
type: 'test'
...
# Subtest: Q169: a cited revoke of a role not in END_PROTECTED still goes to the arbiter, and executes
ok 317 - Q169: a cited revoke of a role not in END_PROTECTED still goes to the arbiter, and executes
---
duration_ms: 83.128517
type: 'test'
...
# Subtest: Q169: a role granted role.revoke at either class still sends a revoke of the assistant to the human
ok 318 - Q169: a role granted role.revoke at either class still sends a revoke of the assistant to the human
---
duration_ms: 134.352983
type: 'test'
...
# Subtest: row 280: an occupied TCP port is attempted, refused, and retried with our sshd
ok 319 - row 280: an occupied TCP port is attempted, refused, and retried with our sshd
---
duration_ms: 115.886814
type: 'test'
...
# Subtest: row 280: every injected picker sample is unprivileged and outside the ephemeral range
ok 320 - row 280: every injected picker sample is unprivileged and outside the ephemeral range
---
duration_ms: 0.672194
type: 'test'
...
# Subtest: the executor tests need sshd, ssh, ssh-agent, ssh-add, ssh-keygen and setpriv: a missing one fails, never skips
ok 321 - the executor tests need sshd, ssh, ssh-agent, ssh-add, ssh-keygen and setpriv: a missing one fails, never skips
---
duration_ms: 0.2249
type: 'test'
...
# Subtest: T3: organization.set, limits.set and instances.set refuse hosts, and the writer never runs
ok 322 - T3: organization.set, limits.set and instances.set refuse hosts, and the writer never runs
---
duration_ms: 40.441406
type: 'test'
...
# Subtest: T4: the value check takes one unencrypted ed25519 key and nothing else
ok 323 - T4: the value check takes one unencrypted ed25519 key and nothing else
---
duration_ms: 245.761582
type: 'test'
...
# Subtest: T5 to T8: registry, grant, argv shape and allowlist refusals
ok 324 - T5 to T8: registry, grant, argv shape and allowlist refusals
---
duration_ms: 647.83018
type: 'test'
...
# Subtest: T9: under 1.7 every call needs a decision bound to its host, argv and stdin, spent once
ok 325 - T9: under 1.7 every call needs a decision bound to its host, argv and stdin, spent once
---
duration_ms: 385.80998
type: 'test'
...
# Subtest: T10, T11: argv reaches sudo unchanged after sudo -n --
ok 326 - T10, T11: argv reaches sudo unchanged after sudo -n --
---
duration_ms: 319.11585
type: 'test'
...
# Subtest: T12, T13: exit code passes through, the timeout kills the group, output is capped
ok 327 - T12, T13: exit code passes through, the timeout kills the group, output is capped
---
duration_ms: 1727.115467
type: 'test'
...
# Subtest: T14: a host key not in the registry refuses and nothing runs
ok 328 - T14: a host key not in the registry refuses and nothing runs
---
duration_ms: 261.903107
type: 'test'
...
# Subtest: G18: hosts.check with a wrong pin refuses host-key-mismatch and runs nothing on the host
ok 329 - G18: hosts.check with a wrong pin refuses host-key-mismatch and runs nothing on the host
---
duration_ms: 381.809226
type: 'test'
...
# Subtest: N3: a remote exit 255 that prints the pin refusal text is the command result, and an ssh failure keeps its message
ok 330 - N3: a remote exit 255 that prints the pin refusal text is the command result, and an ssh failure keeps its message
---
duration_ms: 345.014375
type: 'test'
...
# Subtest: T15: ssh reads no config file and no user known_hosts
ok 331 - T15: ssh reads no config file and no user known_hosts
---
duration_ms: 330.368672
type: 'test'
...
# Subtest: T16, T17: key material in output or stdin refuses credential-leak, and no event holds it
ok 332 - T16, T17: key material in output or stdin refuses credential-leak, and no event holds it
---
duration_ms: 685.789529
type: 'test'
...
# Subtest: T18, T19, T20: one call at a time, no key in any argv or env, and nothing left after
ok 333 - T18, T19, T20: one call at a time, no key in any argv or env, and nothing left after
---
duration_ms: 4640.274507
type: 'test'
...
# Subtest: T21: revoke kills the call in flight, and the next call refuses
ok 334 - T21: revoke kills the call in flight, and the next call refuses
---
duration_ms: 280.221252
type: 'test'
...
# Subtest: T22: events carry host, address, user and argv in clear, and sizes and hashes only
ok 335 - T22: events carry host, address, user and argv in clear, and sizes and hashes only
---
duration_ms: 251.129268
type: 'test'
...
# Subtest: T24: no literal gitea and vikunja kind list outside vocabulary.mjs, and the credential use sites are known
ok 336 - T24: no literal gitea and vikunja kind list outside vocabulary.mjs, and the credential use sites are known
---
duration_ms: 15.805688
type: 'test'
...
# Subtest: T25: no role definition lists host.sudo while it is a hard wait
ok 337 - T25: no role definition lists host.sudo while it is a hard wait
---
duration_ms: 0.419907
type: 'test'
...
# Subtest: T27: the bus child dying takes ssh and ssh-agent with it
ok 338 - T27: the bus child dying takes ssh and ssh-agent with it
---
duration_ms: 307.031973
type: 'test'
...
# Subtest: T27: ssh-add -t drops the key from an agent the test keeps alive
ok 339 - T27: ssh-add -t drops the key from an agent the test keeps alive
---
duration_ms: 3547.493303
type: 'test'
...
# Subtest: N2: a hung ssh-add is killed at its limit or on abort, and nothing is left running
ok 340 - N2: a hung ssh-add is killed at its limit or on abort, and nothing is left running
---
duration_ms: 426.787367
type: 'test'
...
# Subtest: T27: the start sweep keeps a live bus dir and kills only a matching live process
ok 341 - T27: the start sweep keeps a live bus dir and kills only a matching live process
---
duration_ms: 26.763275
type: 'test'
...
# Subtest: T27: the bus start sweeps <configDir>/secrets/run before it listens, and a stray entry stops the start
ok 342 - T27: the bus start sweeps <configDir>/secrets/run before it listens, and a stray entry stops the start
---
duration_ms: 53.616343
type: 'test'
...
# Subtest: M3: host.run refuses host-not-granted unless the grant record has an approved, spent host grant
ok 343 - M3: host.run refuses host-not-granted unless the grant record has an approved, spent host grant
---
duration_ms: 129.616578
type: 'test'
...
# Subtest: M3: a host_grants record gives Credentials a store reference at start, and a restart reads its key
ok 344 - M3: a host_grants record gives Credentials a store reference at start, and a restart reads its key
---
duration_ms: 94.713201
type: 'test'
...
# Subtest: G16: the writer refuses each user, tag and key the design names, before any key file
ok 345 - G16: the writer refuses each user, tag and key the design names, before any key file
---
duration_ms: 3653.360819
type: 'test'
...
# Subtest: G16: from= comes from the host file, a privileged user skips the group and sudo checks, and the line is exact
ok 346 - G16: from= comes from the host file, a privileged user skips the group and sudo checks, and the line is exact
---
duration_ms: 876.152026
type: 'test'
...
# Subtest: G16: list shows tagged lines only, and add and remove never touch a line outside the tag pattern
ok 347 - G16: list shows tagged lines only, and add and remove never touch a line outside the tag pattern
---
duration_ms: 438.693762
type: 'test'
...
# Subtest: G25: the writer refuses a symlinked dir or user file, a group-writable dir and an odd tmp, and writes 0644
ok 348 - G25: the writer refuses a symlinked dir or user file, a group-writable dir and an odd tmp, and writes 0644
---
duration_ms: 497.11958
type: 'test'
...
# Subtest: G16: mosaic-keys passes the three requests to the writer through sudo and refuses anything else without it
ok 349 - G16: mosaic-keys passes the three requests to the writer through sudo and refuses anything else without it
---
duration_ms: 78.561652
type: 'test'
...
# Subtest: E3: the sudoers line and the sshd drop-in are the design lines and parse
ok 350 - E3: the sudoers line and the sshd drop-in are the design lines and parse
---
duration_ms: 16.620483
type: 'test'
...
# Subtest: human proof binds CLI entry, process start and nonce; agents and incomplete ancestry refuse
ok 351 - human proof binds CLI entry, process start and nonce; agents and incomplete ancestry refuse
---
duration_ms: 2.125912
type: 'test'
...
# Subtest: process reader gets own kernel identity without exposing environment values
ok 352 - process reader gets own kernel identity without exposing environment values
---
duration_ms: 0.689464
type: 'test'
...
# Subtest: EACCES ancestor environments skip only markers; commands and registered launches still refuse
ok 353 - EACCES ancestor environments skip only markers; commands and registered launches still refuse
---
duration_ms: 1.120299
type: 'test'
...
# Subtest: real pid 1 remains inspectable when its environment is protected
ok 354 - real pid 1 remains inspectable when its environment is protected
---
duration_ms: 0.319126
type: 'test'
...
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# Subtest: row 165: instances and instances.set refuse every non-human session but the tester, the chief of staff included, and pass the verified actor
ok 355 - row 165: instances and instances.set refuse every non-human session but the tester, the chief of staff included, and pass the verified actor
---
duration_ms: 61.304494
type: 'test'
...
# Subtest: row 165 runtime: an add and a change reach the organization file with the human as actor; each refusal keeps the bytes and logs nothing
ok 356 - row 165 runtime: an add and a change reach the organization file with the human as actor; each refusal keeps the bytes and logs nothing
---
duration_ms: 222.957116
type: 'test'
...
# Subtest: row 194 T12: agent and reader sessions refuse veto.set; the tester gets add and change but not delete or veto.set; the human passes the hook for each listed verb
ok 357 - row 194 T12: agent and reader sessions refuse veto.set; the tester gets add and change but not delete or veto.set; the human passes the hook for each listed verb
---
duration_ms: 47.6457
type: 'test'
...
# Subtest: system Python is a resolved root-owned ELF, never a shim or home interpreter
ok 358 - system Python is a resolved root-owned ELF, never a shim or home interpreter
---
duration_ms: 4.199899
type: 'test'
...
# Subtest: real system interpreter is available and safely inspected
ok 359 - real system interpreter is available and safely inspected
---
duration_ms: 31.696866
type: 'test'
...
# Subtest: restart receipt appends actual replacement identity and refuses unsafe files
ok 360 - restart receipt appends actual replacement identity and refuses unsafe files
---
duration_ms: 3.929849
type: 'test'
...
# Subtest: activation gate compares fresh startup receipt to the current interpreter identity
ok 361 - activation gate compares fresh startup receipt to the current interpreter identity
---
duration_ms: 2.456191
type: 'test'
...
# Subtest: non-regular startup receipt refuses promptly without waiting on a FIFO peer
ok 362 - non-regular startup receipt refuses promptly without waiting on a FIFO peer
---
duration_ms: 54.518182
type: 'test'
...
# Subtest: REQ-DEC-2: a merge-gate raise its arbiter resolved lands through the host op: checkLand answers the facts and a ticket, records nothing, and recordLand spends the decision once
ok 363 - REQ-DEC-2: a merge-gate raise its arbiter resolved lands through the host op: checkLand answers the facts and a ticket, records nothing, and recordLand spends the decision once
---
duration_ms: 68.954201
type: 'test'
...
# Subtest: checkLand refuses on the decision and the review
ok 364 - checkLand refuses on the decision and the review
---
duration_ms: 62.185426
type: 'test'
...
# Subtest: REQ-LAND-1: a gated merge decision refuses not-authorized, cited and approved by the arbiter or uncited and approved by the human
ok 365 - REQ-LAND-1: a gated merge decision refuses not-authorized, cited and approved by the arbiter or uncited and approved by the human
---
duration_ms: 178.343834
type: 'test'
...
# Subtest: REQ-LAND-1: a within-role merge grant refuses not-authorized at the land
ok 366 - REQ-LAND-1: a within-role merge grant refuses not-authorized at the land
---
duration_ms: 49.552735
type: 'test'
...
# Subtest: a cross-role merge that routes to the human, because merge-gate is its own arbiter, lands on the human's CLI answer
ok 367 - a cross-role merge that routes to the human, because merge-gate is its own arbiter, lands on the human's CLI answer
---
duration_ms: 44.91396
type: 'test'
...
# Subtest: a merge option with no first line refuses no-subject, as land-work does
ok 368 - a merge option with no first line refuses no-subject, as land-work does
---
duration_ms: 40.82108
type: 'test'
...
# Subtest: checkLand refuses with land-work's codes past the authority check, and a decision raised for refactor never lands
ok 369 - checkLand refuses with land-work's codes past the authority check, and a decision raised for refactor never lands
---
duration_ms: 101.238478
type: 'test'
...
# Subtest: a ticket outlives the run that asked, and recordLand checks the task again
ok 370 - a ticket outlives the run that asked, and recordLand checks the task again
---
duration_ms: 45.168182
type: 'test'
...
# Subtest: two tickets on one decision: the first recordLand lands, the second refuses decision-consumed and records nothing
ok 371 - two tickets on one decision: the first recordLand lands, the second refuses decision-consumed and records nothing
---
duration_ms: 46.668322
type: 'test'
...
# Subtest: landRefused files the code on the task, tells the role only with notify, and ends the ticket
ok 372 - landRefused files the code on the task, tells the role only with notify, and ends the ticket
---
duration_ms: 48.072584
type: 'test'
...
# Subtest: landHeld is true only for an approved, unspent cross-role merge decision this role raised for a task in this thread
ok 373 - landHeld is true only for an approved, unspent cross-role merge decision this role raised for a task in this thread
---
duration_ms: 49.583097
type: 'test'
...
# Subtest: landHolders lists a merge decision exactly while landHeld is true for its non-thread instance, in decision order
ok 374 - landHolders lists a merge decision exactly while landHeld is true for its non-thread instance, in decision order
---
duration_ms: 65.091128
type: 'test'
...
# Subtest: landHolders leaves out a thread instance's decision, even one raised before its role became one
ok 375 - landHolders leaves out a thread instance's decision, even one raised before its role became one
---
duration_ms: 40.279781
type: 'test'
...
# Subtest: landRelease releases the holding run by land-relaunch once it has asked message.receive and nothing delivered to it is unread, and waiting messages go to the next holder
ok 376 - landRelease releases the holding run by land-relaunch once it has asked message.receive and nothing delivered to it is unread, and waiting messages go to the next holder
---
duration_ms: 67.674582
type: 'test'
...
# Subtest: a landing run started after the resolution passes checkLand for its held decision before any message.receive, and lands it
ok 377 - a landing run started after the resolution passes checkLand for its held decision before any message.receive, and lands it
---
duration_ms: 50.869945
type: 'test'
...
# Subtest: the bus process answers landHolders and landRelease from their own lines, not as credentialStatus
ok 378 - the bus process answers landHolders and landRelease from their own lines, not as credentialStatus
---
duration_ms: 202.710435
type: 'test'
...
# Subtest: usage.begin with a decision id needs it held for the run's instance, usage.end needs the begin, and the limit checks see the landing turn
ok 379 - usage.begin with a decision id needs it held for the run's instance, usage.end needs the begin, and the limit checks see the landing turn
---
duration_ms: 63.365624
type: 'test'
...
# Subtest: no run may write the action.allowed for git.merge.protected itself
ok 380 - no run may write the action.allowed for git.merge.protected itself
---
duration_ms: 38.464073
type: 'test'
...
# Subtest: a message to a stopped role sends launch.by one notice, and the result says so
ok 381 - a message to a stopped role sends launch.by one notice, and the result says so
---
duration_ms: 44.16221
type: 'test'
...
# Subtest: a message to a role outside launch.instances says so in its result and in the notice
ok 382 - a message to a role outside launch.instances says so in its result and in the notice
---
duration_ms: 26.141604
type: 'test'
...
# Subtest: a message to a running role sends no notice and its result is unchanged
ok 383 - a message to a running role sends no notice and its result is unchanged
---
duration_ms: 22.729217
type: 'test'
...
# Subtest: a re-route at a claim, a release and claim, and a broker restart send no second notice
ok 384 - a re-route at a claim, a release and claim, and a broker restart send no second notice
---
duration_ms: 55.540907
type: 'test'
...
# Subtest: a run launched but not yet claimed counts as no holder
ok 385 - a run launched but not yet claimed counts as no holder
---
duration_ms: 32.079527
type: 'test'
...
# Subtest: no notice for a message to launch.by, from it, a refused one from a tester, to the human, or in a thread to a thread instance
ok 386 - no notice for a message to launch.by, from it, a refused one from a tester, to the human, or in a thread to a thread instance
---
duration_ms: 50.43606
type: 'test'
...
# Subtest: a business with no launch block tells nobody and says there is no launcher
ok 387 - a business with no launch block tells nobody and says there is no launcher
---
duration_ms: 20.407878
type: 'test'
...
# Subtest: the notice sender stays internal: no role is named _bus and no caller can send as it or to it
ok 388 - the notice sender stays internal: no role is named _bus and no caller can send as it or to it
---
duration_ms: 59.297894
type: 'test'
...
# Subtest: C2-03a library.sync: every agent, the tester and a reader are refused before the adapter runs
ok 389 - C2-03a library.sync: every agent, the tester and a reader are refused before the adapter runs
---
duration_ms: 42.609181
type: 'test'
...
# Subtest: C2-03a library.sync: the human fetches, accept passes through, and a held sync is a recorded refusal
ok 390 - C2-03a library.sync: the human fetches, accept passes through, and a held sync is a recorded refusal
---
duration_ms: 32.300925
type: 'test'
...
# Subtest: C2-03a library.sync: a LibraryError keeps its code and a host without sync is not configured
ok 391 - C2-03a library.sync: a LibraryError keeps its code and a host without sync is not configured
---
duration_ms: 42.824375
type: 'test'
...
# Subtest: C2-03a runtime: a librarySync from a boot config, with no function, is refused
ok 392 - C2-03a runtime: a librarySync from a boot config, with no function, is refused
---
duration_ms: 2.134385
type: 'test'
...
# Subtest: C2-03a runtime: the timer syncs each entry with a user at start and on each tick, logs codes only, and stops on close
ok 393 - C2-03a runtime: the timer syncs each entry with a user at start and on each tick, logs codes only, and stops on close
---
duration_ms: 782.444273
type: 'test'
...
# Subtest: row 254 human-cli: library.sync outlasts the 5 s client default, and library.status does not
ok 394 - row 254 human-cli: library.sync outlasts the 5 s client default, and library.status does not
---
duration_ms: 6122.825748
type: 'test'
...
# Subtest: C2-04 M4: both verbs reject every agent before arguments or adapter access
ok 395 - C2-04 M4: both verbs reject every agent before arguments or adapter access
---
duration_ms: 56.547028
type: 'test'
...
# Subtest: C2-04 bus: human reads validate keys and return adapter results without path leakage
ok 396 - C2-04 bus: human reads validate keys and return adapter results without path leakage
---
duration_ms: 25.139733
type: 'test'
...
# Subtest: C2-04 socket: each async library verb resolves its result rather than serializing {}
ok 397 - C2-04 socket: each async library verb resolves its result rather than serializing {}
---
duration_ms: 114.550386
type: 'test'
...
# Subtest: C2-04 runtime: protectedRoots skips library but retains real code-root credential protection
ok 398 - C2-04 runtime: protectedRoots skips library but retains real code-root credential protection
---
duration_ms: 170.009801
type: 'test'
...
# Subtest: C2-04 runtime: unsafe existing mirror refuses boot and never publishes a socket
ok 399 - C2-04 runtime: unsafe existing mirror refuses boot and never publishes a socket
---
duration_ms: 44.366469
type: 'test'
...
# Subtest: C2-04 runtime: real library adapters reach the socket and lock waits leave other bus reads responsive
ok 400 - C2-04 runtime: real library adapters reach the socket and lock waits leave other bus reads responsive
---
duration_ms: 361.962851
type: 'test'
...
# organization: {"event":"reload-needs-restart","business":"demo"}
# Subtest: T20 fire: a revoke that fails stops the fire with the file unchanged; one that succeeds revokes, keeps the directory and names the services outside the store
ok 401 - T20 fire: a revoke that fails stops the fire with the file unchanged; one that succeeds revokes, keeps the directory and names the services outside the store
---
duration_ms: 145.496638
type: 'test'
...
# Subtest: T20 fire: an instance already delisted still has its tokens revoked and the file is left alone
ok 402 - T20 fire: an instance already delisted still has its tokens revoked and the file is left alone
---
duration_ms: 83.104567
type: 'test'
...
# Subtest: T20 fire: with no entry in the running bus, a token on disk refuses and an empty store goes on
ok 403 - T20 fire: with no entry in the running bus, a token on disk refuses and an empty store goes on
---
duration_ms: 91.060964
type: 'test'
...
# Subtest: T20 delete: a revoke that fails keeps the file; one that succeeds clears the store, deletes, and names the tracker bot
ok 404 - T20 delete: a revoke that fails keeps the file; one that succeeds clears the store, deletes, and names the tracker bot
---
duration_ms: 123.156803
type: 'test'
...
# Subtest: T20 delete: with no entry in the running bus, a token file is cleared and the delete goes on; a file reference refuses
ok 405 - T20 delete: with no entry in the running bus, a token file is cleared and the delete goes on; a file reference refuses
---
duration_ms: 100.918263
type: 'test'
...
# Subtest: T21 delete: a write between the raise and the take makes the delete refuse revision-conflict before it revokes anything
ok 406 - T21 delete: a write between the raise and the take makes the delete refuse revision-conflict before it revokes anything
---
duration_ms: 94.816576
type: 'test'
...
# Subtest: row 194 T12: agent and reader sessions refuse the lifecycle verbs before any effect; the tester gets launch, end and the request read, never regenerate
ok 407 - row 194 T12: agent and reader sessions refuse the lifecycle verbs before any effect; the tester gets launch, end and the request read, never regenerate
---
duration_ms: 64.798326
type: 'test'
...
# Subtest: row 194 V2 and V4 at the verb: the request is open, by the human, with a human.input; thread, retired, unknown and revoked refuse with no event
ok 408 - row 194 V2 and V4 at the verb: the request is open, by the human, with a human.input; thread, retired, unknown and revoked refuse with no event
---
duration_ms: 36.516394
type: 'test'
...
# Subtest: row 194 D1.1 take: a request is taken once, closes once, and lifecycleRequests lists only what is not closed
ok 409 - row 194 D1.1 take: a request is taken once, closes once, and lifecycleRequests lists only what is not closed
---
duration_ms: 29.643771
type: 'test'
...
# Subtest: row 194 D1.1 take: a launch.revoke after the request closes it launch-revoked, and a request past 60 s closes request-expired
ok 410 - row 194 D1.1 take: a launch.revoke after the request closes it launch-revoked, and a request past 60 s closes request-expired
---
duration_ms: 31.529179
type: 'test'
...
# Subtest: row 194 T15 (bus): while halted, launch and regenerate refuse processing-halted at the verb and at the take, hire and fire refuse, terminate goes; an unreadable switch refuses with its code
ok 411 - row 194 T15 (bus): while halted, launch and regenerate refuse processing-halted at the verb and at the take, hire and fire refuse, terminate goes; an unreadable switch refuses with its code
---
duration_ms: 48.858005
type: 'test'
...
# Subtest: row 194 T12a: the tester launches and ends on its own business with actor tester; bus.tester off in the file refuses the call and the take tester-off
ok 412 - row 194 T12a: the tester launches and ends on its own business with actor tester; bus.tester off in the file refuses the call and the take tester-off
---
duration_ms: 37.805596
type: 'test'
...
# Subtest: row 194 V3 terminate: claims revoked, open requests cancelled, bound runs named, taken requests listed; nothing at all answers not-held
ok 413 - row 194 V3 terminate: claims revoked, open requests cancelled, bound runs named, taken requests listed; nothing at all answers not-held
---
duration_ms: 44.495686
type: 'test'
...
# Subtest: row 194 V3 terminate of a thread instance: the human ends every thread, the tester only its own
ok 414 - row 194 V3 terminate of a thread instance: the human ends every thread, the tester only its own
---
duration_ms: 31.398156
type: 'test'
...
# Subtest: row 194 T6 V5 order at the verb: the writer's named refusals, then instance-running, instance-starting, the last-listed refusal and the revision
ok 415 - row 194 T6 V5 order at the verb: the writer's named refusals, then instance-running, instance-starting, the last-listed refusal and the revision
---
duration_ms: 54.972785
type: 'test'
...
# Subtest: row 194 V5: an open launch past its 60 s is not starting, as it can only close request-expired
ok 416 - row 194 V5: an open launch past its 60 s is not starting, as it can only close request-expired
---
duration_ms: 21.727339
type: 'test'
...
# Subtest: row 194 V5 after the take: lifecycleDelete re-checks running and starting, then commits through the writer with the human as actor
ok 417 - row 194 V5 after the take: lifecycleDelete re-checks running and starting, then commits through the writer with the human as actor
---
duration_ms: 36.831365
type: 'test'
...
# Subtest: row 194 V5 retry: a retired name deletes again only after workspace-rename-failed, and that request commits nothing
ok 418 - row 194 V5 retry: a retired name deletes again only after workspace-rename-failed, and that request commits nothing
---
duration_ms: 39.342044
type: 'test'
...
# Subtest: row 194 V5 runtime: a delete request, the take and lifecycleDelete commit the file with retired, log the human and reload so the name no longer binds
ok 419 - row 194 V5 runtime: a delete request, the take and lifecycleDelete commit the file with retired, log the human and reload so the name no longer binds
---
duration_ms: 223.568536
type: 'test'
...
# Subtest: REQ-LIMIT-3 limitLeaves finds every limit object and skips the agent numbers
ok 420 - REQ-LIMIT-3 limitLeaves finds every limit object and skips the agent numbers
---
duration_ms: 2.174089
type: 'test'
...
# Subtest: REQ-LIMIT-3 limitLeaves takes token limits at schema depth only, whatever their names
ok 421 - REQ-LIMIT-3 limitLeaves takes token limits at schema depth only, whatever their names
---
duration_ms: 0.270787
type: 'test'
...
# Subtest: REQ-LIMIT-3 with no check switched on a launch is allowed, a turn never stops, and every limit is not enforced
ok 422 - REQ-LIMIT-3 with no check switched on a launch is allowed, a turn never stops, and every limit is not enforced
---
duration_ms: 20.594671
type: 'test'
...
# Subtest: REQ-LIMIT-3 a fixture check that refuses refuses the launch and stops the turn, logged with the limit and the count
ok 423 - REQ-LIMIT-3 a fixture check that refuses refuses the launch and stops the turn, logged with the limit and the count
---
duration_ms: 20.439381
type: 'test'
...
# Subtest: REQ-LIMIT-3 a report that omits a limit shows it not enforced; a counted entry and a reason come through
ok 424 - REQ-LIMIT-3 a report that omits a limit shows it not enforced; a counted entry and a reason come through
---
duration_ms: 22.029312
type: 'test'
...
# Subtest: REQ-LIMIT-4 each check gets the business, a copy of the limits, the subject, the records and the time
ok 425 - REQ-LIMIT-4 each check gets the business, a copy of the limits, the subject, the records and the time
---
duration_ms: 25.473583
type: 'test'
...
# Subtest: REQ-LIMIT-4 fail closed: a throw refuses, stops and fails the report, naming the check and the code
ok 426 - REQ-LIMIT-4 fail closed: a throw refuses, stops and fails the report, naming the check and the code
---
duration_ms: 19.749846
type: 'test'
...
# Subtest: REQ-LIMIT-4 fail closed: a malformed answer, a promise, a rejected promise, a non-boolean or a bad hit is malformed-answer
ok 427 - REQ-LIMIT-4 fail closed: a malformed answer, a promise, a rejected promise, a non-boolean or a bad hit is malformed-answer
---
duration_ms: 24.410019
type: 'test'
...
# Subtest: REQ-LIMIT-4 fail closed: a check switched on but not loaded refuses, stops and fails every limit as not-loaded
ok 428 - REQ-LIMIT-4 fail closed: a check switched on but not loaded refuses, stops and fails every limit as not-loaded
---
duration_ms: 19.914086
type: 'test'
...
# Subtest: REQ-LIMIT-4 state(), never-loaded case: before any load the report shows not enforced, or not-loaded for a switched-on check
ok 429 - REQ-LIMIT-4 state(), never-loaded case: before any load the report shows not enforced, or not-loaded for a switched-on check
---
duration_ms: 18.427008
type: 'test'
...
# Subtest: REQ-LIMIT-4 state(), first-load-refused case: a check refused on its first load is not-loaded in mayLaunch, mustStop and report
ok 430 - REQ-LIMIT-4 state(), first-load-refused case: a check refused on its first load is not-loaded in mayLaunch, mustStop and report
---
duration_ms: 19.620038
type: 'test'
...
# Subtest: REQ-LIMIT-4 fail closed: an unreadable organization file refuses and stops with check null; the report throws
ok 431 - REQ-LIMIT-4 fail closed: an unreadable organization file refuses and stops with check null; the report throws
---
duration_ms: 17.668723
type: 'test'
...
# Subtest: REQ-LIMIT-4 fail closed: unreadable records refuse and stop with check null and fail the report
ok 432 - REQ-LIMIT-4 fail closed: unreadable records refuse and stop with check null and fail the report
---
duration_ms: 0.780791
type: 'test'
...
# Subtest: REQ-LIMIT-3 the shipped token-limit, through the real loader, counts known records only since the limit was set
ok 433 - REQ-LIMIT-3 the shipped token-limit, through the real loader, counts known records only since the limit was set
---
duration_ms: 28.985615
type: 'test'
...
# Subtest: REQ-LIMIT-3 a token limit for a provider named limit is counted and refuses, beside an agent limit of the same name
ok 434 - REQ-LIMIT-3 a token limit for a provider named limit is counted and refuses, beside an agent limit of the same name
---
duration_ms: 17.954522
type: 'test'
...
# Subtest: REQ-LIMIT-3 core reaches limit checks only through the plug-in loader
ok 435 - REQ-LIMIT-3 core reaches limit checks only through the plug-in loader
---
duration_ms: 1.466844
type: 'test'
...
# Subtest: REQ-LIMIT-4 a role run at its limit stops at the end of its turn: RESULT and read land first, the claim is revoked by limit-check
ok 436 - REQ-LIMIT-4 a role run at its limit stops at the end of its turn: RESULT and read land first, the claim is revoked by limit-check
---
duration_ms: 56.315705
type: 'test'
...
# Subtest: REQ-LIMIT-4 the stop also lands on state; a run with no stop ends without a limit
ok 437 - REQ-LIMIT-4 the stop also lands on state; a run with no stop ends without a limit
---
duration_ms: 56.699112
type: 'test'
...
# Subtest: REQ-LIMIT-4 fail closed: a mustStop throw or a malformed answer stops the run, naming the bus and the code
ok 438 - REQ-LIMIT-4 fail closed: a mustStop throw or a malformed answer stops the run, naming the bus and the code
---
duration_ms: 137.829947
type: 'test'
...
# Subtest: REQ-LIMIT-4 a thread run at its limit is released with the reason, and its end record names the limit
ok 439 - REQ-LIMIT-4 a thread run at its limit is released with the reason, and its end record names the limit
---
duration_ms: 37.484633
type: 'test'
...
# Subtest: REQ-LIMIT-4 a broker with no limit checks configured never stops a run
ok 440 - REQ-LIMIT-4 a broker with no limit checks configured never stops a run
---
duration_ms: 29.557721
type: 'test'
...
# limits: {"event":"limit-reached","business":"demo","check":"token-limit","export":"mayLaunch","subject":{"instance":"coder","provider":"zai","model":"glm-5.3-flash","account":null},"path":["tokens","instances","coder"],"limit":0,"count":0,"unknownTurns":0}
# organization: {"event":"reload-needs-restart","business":"demo"}
# usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"04b4e96c-641c-4c7f-a9f7-083bb8dc445b","source":"@none","code":"baseline-unknown"}
# limits: {"event":"limit-reached","business":"demo","check":"token-limit","export":"mustStop","subject":{"instance":"coder","provider":"zai","model":"glm-5.3-flash","account":null},"path":["tokens","instances","coder"],"limit":0,"count":0,"unknownTurns":1}
# usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"dd02c49f-4ff7-4389-a528-cfb0adcd6a48","source":"@none","code":"baseline-unknown"}
# Subtest: REQ-LIMIT-3 REQ-LIMIT-4 runtime: limits carries the token count, mayLaunch refuses at the limit, a reset moves since
# organization: {"event":"reload-needs-restart","business":"demo"}
ok 441 - REQ-LIMIT-3 REQ-LIMIT-4 runtime: limits carries the token count, mayLaunch refuses at the limit, a reset moves since
---
duration_ms: 221.692675
type: 'test'
...
# Subtest: REQ-LIMIT-3 runtime: with no limit check switched on, the limit shows not enforced and every launch is allowed
ok 442 - REQ-LIMIT-3 runtime: with no limit check switched on, the limit shows not enforced and every launch is allowed
---
duration_ms: 61.508202
type: 'test'
...
# Subtest: REQ-LIMIT-4 runtime: the broker asks the shipped token-limit after a turn, and the run at its limit stops on its next receive
ok 443 - REQ-LIMIT-4 runtime: the broker asks the shipped token-limit after a turn, and the run at its limit stops on its next receive
---
duration_ms: 82.139758
type: 'test'
...
# Subtest: REQ-LIMIT-4 runtime: with no usage source a turn is unknown, counts zero and stops nothing under a limit of 1
ok 444 - REQ-LIMIT-4 runtime: with no usage source a turn is unknown, counts zero and stops nothing under a limit of 1
---
duration_ms: 84.791086
type: 'test'
...
# Subtest: REQ-LIMIT-3 runtime: switching a limit check on with plugins.set loads it without a launch or a turn
ok 445 - REQ-LIMIT-3 runtime: switching a limit check on with plugins.set loads it without a launch or a turn
---
duration_ms: 105.641652
type: 'test'
...
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# Subtest: limits binds actor from human proof and rejects role, reader, a tester set and forged actor
ok 446 - limits binds actor from human proof and rejects role, reader, a tester set and forged actor
---
duration_ms: 37.449016
type: 'test'
...
# Subtest: runtime wires verified human settings to the actual shared file writer and actor receipt
ok 447 - runtime wires verified human settings to the actual shared file writer and actor receipt
---
duration_ms: 169.037706
type: 'test'
...
# Subtest: uncertain organization receipts leave bus startup and reads alone but refuse writes until reconciled
ok 448 - uncertain organization receipts leave bus startup and reads alone but refuse writes until reconciled
---
duration_ms: 101.414241
type: 'test'
...
# Subtest: within-role sends cite an open gated launch decision without spending it or naming it in grants
ok 449 - within-role sends cite an open gated launch decision without spending it or naming it in grants
---
duration_ms: 49.375512
type: 'test'
...
# Subtest: missing and foreign-business citations refuse and roll back message and grant
ok 450 - missing and foreign-business citations refuse and roll back message and grant
---
duration_ms: 43.5933
type: 'test'
...
# Subtest: cross-role sends still need a matching resolved decision and consume it once
ok 451 - cross-role sends still need a matching resolved decision and consume it once
---
duration_ms: 46.569666
type: 'test'
...
# Subtest: trail on a hidden message id answers exactly as on an unknown id, for the owner, a reader and the tester
ok 452 - trail on a hidden message id answers exactly as on an unknown id, for the owner, a reader and the tester
---
duration_ms: 41.449346
type: 'test'
...
# Subtest: replies on a hidden message id answers exactly as on an unknown id, for the owner, a reader and the tester
ok 453 - replies on a hidden message id answers exactly as on an unknown id, for the owner, a reader and the tester
---
duration_ms: 49.120657
type: 'test'
...
# Subtest: trail on a decision keeps the decision and drops the user thread messages, their deliveries and their events
ok 454 - trail on a decision keeps the decision and drops the user thread messages, their deliveries and their events
---
duration_ms: 53.023638
type: 'test'
...
# Subtest: replies leaves out other users thread messages and still fills a page
ok 455 - replies leaves out other users thread messages and still fills a page
---
duration_ms: 296.390202
type: 'test'
...
# Subtest: messages in the business human and tester threads are not hidden (row 177 unchanged)
ok 456 - messages in the business human and tester threads are not hidden (row 177 unchanged)
---
duration_ms: 53.347775
type: 'test'
...
# Subtest: governance pin: the owner sees decisions, inbox entries, claims, tasks and project files, but not the user messages
ok 457 - governance pin: the owner sees decisions, inbox entries, claims, tasks and project files, but not the user messages
---
duration_ms: 163.144105
type: 'test'
...
# Subtest: messages pages all human messages newest first without writes; read state is history
ok 458 - messages pages all human messages newest first without writes; read state is history
---
duration_ms: 513.069068
type: 'test'
...
# Subtest: messages refuses role callers, invalid paging and cursors outside this human feed
ok 459 - messages refuses role callers, invalid paging and cursors outside this human feed
---
duration_ms: 43.722327
type: 'test'
...
# Subtest: views messages passes only its paging arguments through
ok 460 - views messages passes only its paging arguments through
---
duration_ms: 0.542522
type: 'test'
...
# Subtest: messages isolates businesses even with a valid foreign cursor
ok 461 - messages isolates businesses even with a valid foreign cursor
---
duration_ms: 39.653736
type: 'test'
...
# Subtest: the assistant sends to the user and to the chief of staff only
ok 462 - the assistant sends to the user and to the chief of staff only
---
duration_ms: 53.48415
type: 'test'
...
# Subtest: an assistant send to any other role, or to the tester, is refused and logged
ok 463 - an assistant send to any other role, or to the tester, is refused and logged
---
duration_ms: 58.142337
type: 'test'
...
# Subtest: only the user and the chief of staff may send to the assistant; the tester is refused by default
ok 464 - only the user and the chief of staff may send to the assistant; the tester is refused by default
---
duration_ms: 49.614921
type: 'test'
...
# Subtest: REQ-ASSIST-2 REQ-THREAD-1 thread.send to an instance that does not hear from the user is refused and stores nothing
ok 465 - REQ-ASSIST-2 REQ-THREAD-1 thread.send to an instance that does not hear from the user is refused and stores nothing
---
duration_ms: 40.30046
type: 'test'
...
# Subtest: a sender-side list alone refuses a send to a role that has no list
ok 466 - a sender-side list alone refuses a send to a role that has no list
---
duration_ms: 50.726462
type: 'test'
...
# Subtest: a target-side list alone refuses a send from a role that has no list
ok 467 - a target-side list alone refuses a send from a role that has no list
---
duration_ms: 50.312543
type: 'test'
...
# Subtest: the sender list is checked before the target list
ok 468 - the sender list is checked before the target list
---
duration_ms: 45.297392
type: 'test'
...
# Subtest: roles without the field behave exactly as before
ok 469 - roles without the field behave exactly as before
---
duration_ms: 66.430859
type: 'test'
...
# Subtest: a business with no role definitions at all is unlimited
ok 470 - a business with no role definitions at all is unlimited
---
duration_ms: 50.025996
type: 'test'
...
# Subtest: a malformed messaging field refuses at boot
ok 471 - a malformed messaging field refuses at boot
---
duration_ms: 20.205079
type: 'test'
...
# Subtest: the assistant's review.request to a reviewer is refused and logged, even with an approved decision
ok 472 - the assistant's review.request to a reviewer is refused and logged, even with an approved decision
---
duration_ms: 58.487007
type: 'test'
...
# Subtest: a review.verdict to the assistant from a role outside its receiveFrom is refused and logged
ok 473 - a review.verdict to the assistant from a role outside its receiveFrom is refused and logged
---
duration_ms: 71.041294
type: 'test'
...
# Subtest: review requests and verdicts between roles without the field are unchanged
ok 474 - review requests and verdicts between roles without the field are unchanged
---
duration_ms: 42.716246
type: 'test'
...
# Subtest: 3f copy migrates to 3g preserving every old column/row, with an empty instance_names and null to_name
ok 475 - 3f copy migrates to 3g preserving every old column/row, with an empty instance_names and null to_name
---
duration_ms: 131.665468
type: 'test'
...
# Subtest: REQ-MSG-2: the chief of staff names an instance under its within-role grant, and the write is logged
ok 476 - REQ-MSG-2: the chief of staff names an instance under its within-role grant, and the write is logged
---
duration_ms: 36.290096
type: 'test'
...
# Subtest: REQ-MSG-2: the human names an instance through the CLI
ok 477 - REQ-MSG-2: the human names an instance through the CLI
---
duration_ms: 30.810381
type: 'test'
...
# Subtest: REQ-MSG-2: a role without the grant, or holding it cross-role, is refused not-authorized
ok 478 - REQ-MSG-2: a role without the grant, or holding it cross-role, is refused not-authorized
---
duration_ms: 35.896139
type: 'test'
...
# Subtest: REQ-MSG-2: a name is unique in the business and is never an instance key or a role name
ok 479 - REQ-MSG-2: a name is unique in the business and is never an instance key or a role name
---
duration_ms: 50.650594
type: 'test'
...
# Subtest: REQ-MSG-2: a send by name reaches the instance and records both; a send by instance key is unchanged
ok 480 - REQ-MSG-2: a send by name reaches the instance and records both; a send by instance key is unchanged
---
duration_ms: 46.023843
type: 'test'
...
# Subtest: REQ-MSG-2: an instance key beats a name that equals it, as when a later instance takes the key
ok 481 - REQ-MSG-2: an instance key beats a name that equals it, as when a later instance takes the key
---
duration_ms: 32.660145
type: 'test'
...
# Subtest: REQ-MSG-2: a role name beats a name that equals it, as when a later definition takes the word (sage-0590)
ok 482 - REQ-MSG-2: a role name beats a name that equals it, as when a later definition takes the word (sage-0590)
---
duration_ms: 37.842742
type: 'test'
...
# Subtest: proof receives actual peer, cap traffic never invokes helper and transient cap disconnects
ok 483 - proof receives actual peer, cap traffic never invokes helper and transient cap disconnects
---
duration_ms: 7.351235
type: 'test'
...
# Subtest: proof helper error and disconnect during verification never dispatch or bind
ok 484 - proof helper error and disconnect during verification never dispatch or bind
---
duration_ms: 1.765169
type: 'test'
...
# Subtest: Client receives explicit proof refusal codes without dispatch, not outcome-unknown
ok 485 - Client receives explicit proof refusal codes without dispatch, not outcome-unknown
---
duration_ms: 60.523607
type: 'test'
...
# Subtest: asynchronous proof calls release their transient session on success, failure and timeout
ok 486 - asynchronous proof calls release their transient session on success, failure and timeout
---
duration_ms: 29.906813
type: 'test'
...
# Subtest: T2 eight proof callers and a racing copier bind the exact accepted socket, which survives helper exit
ok 487 - T2 eight proof callers and a racing copier bind the exact accepted socket, which survives helper exit
---
duration_ms: 389.90548
type: 'test'
...
# Subtest: helper output and failures fail closed including unsafe gid
ok 488 - helper output and failures fail closed including unsafe gid
---
duration_ms: 2.387558
type: 'test'
...
# Subtest: helper timeout, capacity and shutdown refuse without leaving children
ok 489 - helper timeout, capacity and shutdown refuse without leaving children
---
duration_ms: 26.524429
type: 'test'
...
# Subtest: missing or non-regular peer helper refuses at construction before opening the bus
ok 490 - missing or non-regular peer helper refuses at construction before opening the bus
---
duration_ms: 0.566735
type: 'test'
...
# Subtest: shutdown waits for killed helper close before returning
ok 491 - shutdown waits for killed helper close before returning
---
duration_ms: 5.183133
type: 'test'
...
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# Subtest: plugins and plugins.set refuse every non-human session and a forged actor, and pass only the patch with the verified actor
ok 492 - plugins and plugins.set refuse every non-human session and a forged actor, and pass only the patch with the verified actor
---
duration_ms: 34.890711
type: 'test'
...
# Subtest: runtime: the switch changes the organization file, the receipt carries the actor, and a bad shape, an unknown module and a stale revision are refused with nothing written
ok 493 - runtime: the switch changes the organization file, the receipt carries the actor, and a bad shape, an unknown module and a stale revision are refused with nothing written
---
duration_ms: 183.707608
type: 'test'
...
# Subtest: vikunja:19/309 through the broker, a patch switches the kinds it names and keeps the rest; null removes one kind and is trailed
ok 494 - vikunja:19/309 through the broker, a patch switches the kinds it names and keeps the rest; null removes one kind and is trailed
---
duration_ms: 89.111314
type: 'test'
...
# Subtest: principal binds kernel peer PID and uid, maps owner, and never takes identity or role from body
ok 495 - principal binds kernel peer PID and uid, maps owner, and never takes identity or role from body
---
duration_ms: 4.02686
type: 'test'
...
# Subtest: user requires its own nonce and full walk plus immediate same-tree Console parent
ok 496 - user requires its own nonce and full walk plus immediate same-tree Console parent
---
duration_ms: 0.914112
type: 'test'
...
# Subtest: tester deliberately admits agent parents but rejects managed runs and another nonce
ok 497 - tester deliberately admits agent parents but rejects managed runs and another nonce
---
duration_ms: 0.46954
type: 'test'
...
# Subtest: human leaf identity is reread after walking the parents
ok 498 - human leaf identity is reread after walking the parents
---
duration_ms: 0.256106
type: 'test'
...
# Subtest: broker process binds trusted launches, offers reader capabilities, refuses human mutation, closes cleanly
ok 499 - broker process binds trusted launches, offers reader capabilities, refuses human mutation, closes cleanly
---
duration_ms: 273.782106
type: 'test'
...
# Subtest: startup token refusal returns safe code without value or partial listening broker
ok 500 - startup token refusal returns safe code without value or partial listening broker
---
duration_ms: 167.424582
type: 'test'
...
# Subtest: loaded fixture token is absent from socket replies and SQLite, including refusal evidence
ok 501 - loaded fixture token is absent from socket replies and SQLite, including refusal evidence
---
duration_ms: 207.433572
type: 'test'
...
# Subtest: killed broker leaves an explicit stale lock; another process cannot silently reclaim it
ok 502 - killed broker leaves an explicit stale lock; another process cannot silently reclaim it
---
duration_ms: 294.20113
type: 'test'
...
# Subtest: trusted host registers later launches; socket clients never have a registration verb
ok 503 - trusted host registers later launches; socket clients never have a registration verb
---
duration_ms: 230.039395
type: 'test'
...
# Subtest: REQ-LIMIT-4 the broker process answers the launcher's mayLaunch op with the limits' awaited decision
ok 504 - REQ-LIMIT-4 the broker process answers the launcher's mayLaunch op with the limits' awaited decision
---
duration_ms: 278.878969
type: 'test'
...
# Subtest: runtime excludes declared project roots even when host supplies no repoRoots
ok 505 - runtime excludes declared project roots even when host supplies no repoRoots
---
duration_ms: 181.71244
type: 'test'
...
# Subtest: a refused launch binding leaves the broker and existing capabilities alive; bad protocol stops it
ok 506 - a refused launch binding leaves the broker and existing capabilities alive; bad protocol stops it
---
duration_ms: 244.940854
type: 'test'
...
# Subtest: real runtime injects the coordinator, stops its workload and mirrors stable stop events across restart
ok 507 - real runtime injects the coordinator, stops its workload and mirrors stable stop events across restart
---
duration_ms: 256.979757
type: 'test'
...
# Subtest: invalid state still starts the control bus and human halt then resume repairs it
ok 508 - invalid state still starts the control bus and human halt then resume repairs it
---
duration_ms: 106.794611
type: 'test'
...
# Subtest: processing halt and resume extend only the socket timeout while ordinary status retains the explicit timeout
ok 509 - processing halt and resume extend only the socket timeout while ordinary status retains the explicit timeout
---
duration_ms: 194.822399
type: 'test'
...
# Subtest: a root halt aborts the active search-source signal before the normal web deadline
ok 510 - a root halt aborts the active search-source signal before the normal web deadline
---
duration_ms: 35.717022
type: 'test'
...
# Subtest: processing.halt refuses agent reader and tester before any transition
ok 511 - processing.halt refuses agent reader and tester before any transition
---
duration_ms: 49.462231
type: 'test'
...
# Subtest: processing.resume refuses agent reader and tester before any transition
ok 512 - processing.resume refuses agent reader and tester before any transition
---
duration_ms: 29.187931
type: 'test'
...
# Subtest: human halt and clear each have one event with verified actor; launch.restore cannot clear
ok 513 - human halt and clear each have one event with verified actor; launch.restore cannot clear
---
duration_ms: 27.188441
type: 'test'
...
# Subtest: all ordinary work verbs refuse before dispatch while pure reads remain available
ok 514 - all ordinary work verbs refuse before dispatch while pure reads remain available
---
duration_ms: 50.479729
type: 'test'
...
# Subtest: task web authorization and bind paths refuse before external work
ok 515 - task web authorization and bind paths refuse before external work
---
duration_ms: 28.397637
type: 'test'
...
# Subtest: recordEvent cannot forge processing.halt
ok 516 - recordEvent cannot forge processing.halt
---
duration_ms: 24.482395
type: 'test'
...
# Subtest: recordEvent cannot forge processing.resume
ok 517 - recordEvent cannot forge processing.resume
---
duration_ms: 22.27995
type: 'test'
...
# Subtest: recordEvent cannot forge processing.stop
ok 518 - recordEvent cannot forge processing.stop
---
duration_ms: 20.552638
type: 'test'
...
# Subtest: recordTask poll cannot forge a processing action through its kinds filter
ok 519 - recordTask poll cannot forge a processing action through its kinds filter
---
duration_ms: 21.165108
type: 'test'
...
# Subtest: recordTask self cannot forge a processing action through its kinds filter
ok 520 - recordTask self cannot forge a processing action through its kinds filter
---
duration_ms: 19.666371
type: 'test'
...
# Subtest: spec read remains a read but cannot release new write work after an await
ok 521 - spec read remains a read but cannot release new write work after an await
---
duration_ms: 24.452703
type: 'test'
...
# Subtest: the real socket awaits halt and resume beyond the ordinary idle deadline
ok 522 - the real socket awaits halt and resume beyond the ordinary idle deadline
---
duration_ms: 69.419959
type: 'test'
...
# Subtest: a malformed processing reader never silently admits agent work
ok 523 - a malformed processing reader never silently admits agent work
---
duration_ms: 27.00085
type: 'test'
...
# Subtest: halt refuses the newly landed host executor path before credentials or effects
ok 524 - halt refuses the newly landed host executor path before credentials or effects
---
duration_ms: 27.042946
type: 'test'
...
# Subtest: D1: committed write with a failed receipt refuses outcome-unknown without action.allowed
ok 525 - D1: committed write with a failed receipt refuses outcome-unknown without action.allowed
---
duration_ms: 39.079912
type: 'test'
...
# Subtest: D2: spec.read refuses without content if its role is released during the read
ok 526 - D2: spec.read refuses without content if its role is released during the read
---
duration_ms: 22.814609
type: 'test'
...
# Subtest: D3: spec.read secret check refuses flagged content without content
ok 527 - D3: spec.read secret check refuses flagged content without content
---
duration_ms: 23.53092
type: 'test'
...
# Subtest: D3: spec.read secret check refuses flagged subject without content
ok 528 - D3: spec.read secret check refuses flagged subject without content
---
duration_ms: 22.863633
type: 'test'
...
# Subtest: a human lists, opens and saves; the save is one commit by the business human
ok 529 - a human lists, opens and saves; the save is one commit by the business human
---
duration_ms: 182.289872
type: 'test'
...
# Subtest: an agent and a reader refuse every file verb and nothing is written
ok 530 - an agent and a reader refuse every file verb and nothing is written
---
duration_ms: 67.054315
type: 'test'
...
# Subtest: a stale base refuses stale-base and writes nothing
ok 531 - a stale base refuses stale-base and writes nothing
---
duration_ms: 116.01289
type: 'test'
...
# Subtest: paths outside the spec and docs refuse, as do unknown projects, missing files and odd arguments
ok 532 - paths outside the spec and docs refuse, as do unknown projects, missing files and odd arguments
---
duration_ms: 92.538744
type: 'test'
...
# Subtest: without a project adapter the file verbs refuse project-not-configured
ok 533 - without a project adapter the file verbs refuse project-not-configured
---
duration_ms: 42.79031
type: 'test'
...
# Subtest: on the socket a save may carry 1 MiB of text; every other request keeps the 64 KiB limit
ok 534 - on the socket a save may carry 1 MiB of text; every other request keeps the 64 KiB limit
---
duration_ms: 549.403224
type: 'test'
...
# Subtest: a request that names the save verb first and another verb last is refused at 64 KiB
ok 535 - a request that names the save verb first and another verb last is refused at 64 KiB
---
duration_ms: 115.448471
type: 'test'
...
# Subtest: two saves racing for one repository make one commit
ok 536 - two saves racing for one repository make one commit
---
duration_ms: 330.154634
type: 'test'
...
# Subtest: Broker keeps the sandbox client import closure: only the listed imports, no lazy project import
ok 537 - Broker keeps the sandbox client import closure: only the listed imports, no lazy project import
---
duration_ms: 2.394224
type: 'test'
...
# Subtest: without a trusted project adapter all three async paths refuse project-not-configured
ok 538 - without a trusted project adapter all three async paths refuse project-not-configured
---
duration_ms: 63.816923
type: 'test'
...
# Subtest: real startBroker injects the project adapter for socket reads and bound-author record writes
ok 539 - real startBroker injects the project adapter for socket reads and bound-author record writes
---
duration_ms: 308.147554
type: 'test'
...
# Subtest: a raise with no recorded push refuses no-push; a raise binds the latest push and shows it
ok 540 - a raise with no recorded push refuses no-push; a raise binds the latest push and shows it
---
duration_ms: 45.075365
type: 'test'
...
# Subtest: happy path: the fork is the upstream repo under the agent's own user, the destination is host-built
ok 541 - happy path: the fork is the upstream repo under the agent's own user, the destination is host-built
---
duration_ms: 42.876543
type: 'test'
...
# Subtest: a hard wait: no decision refuses, and a decision for another task refuses
ok 542 - a hard wait: no decision refuses, and a decision for another task refuses
---
duration_ms: 42.81544
type: 'test'
...
# Subtest: r4 B4: approve while the latest push is A, push B, publish refuses decision-mismatch
ok 543 - r4 B4: approve while the latest push is A, push B, publish refuses decision-mismatch
---
duration_ms: 71.630024
type: 'test'
...
# Subtest: grant and fork refusals
ok 544 - grant and fork refusals
---
duration_ms: 66.849148
type: 'test'
...
# Subtest: remote-not-fork, compared without case, and remote-host-mismatch, at push
ok 545 - remote-not-fork, compared without case, and remote-host-mismatch, at push
---
duration_ms: 143.676939
type: 'test'
...
# Subtest: two agents granted one project each get their own fork
ok 546 - two agents granted one project each get their own fork
---
duration_ms: 66.169476
type: 'test'
...
# Subtest: the request cannot name the fork, the user or the destination
ok 547 - the request cannot name the fork, the user or the destination
---
duration_ms: 33.535375
type: 'test'
...
# Subtest: one decision, one open publish: a second ticket refuses publish-busy, whatever its branch
ok 548 - one decision, one open publish: a second ticket refuses publish-busy, whatever its branch
---
duration_ms: 84.021754
type: 'test'
...
# Subtest: publishRefused files the code on the task's trail and drops the ticket
ok 549 - publishRefused files the code on the task's trail and drops the ticket
---
duration_ms: 43.464733
type: 'test'
...
# Subtest: git.push.remote is in neither ROUTED list and no shipped role grants it
ok 550 - git.push.remote is in neither ROUTED list and no shipped role grants it
---
duration_ms: 1.195228
type: 'test'
...
# Subtest: runtime: withGitea keys from the open ticket only, and the store root is the organization dir
ok 551 - runtime: withGitea keys from the open ticket only, and the store root is the organization dir
---
duration_ms: 181.525738
type: 'test'
...
# Subtest: the bus process answers the publish ops from their own lines, not launch-op-refused
ok 552 - the bus process answers the publish ops from their own lines, not launch-op-refused
---
duration_ms: 317.013878
type: 'test'
...
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# Subtest: T14 a create goes live with no restart: the new instance binds at once and the answer says restart false
ok 553 - T14 a create goes live with no restart: the new instance binds at once and the answer says restart false
---
duration_ms: 104.697186
type: 'test'
...
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# Subtest: T14 every committed verb reloads once, limits.set, routes.set, plugins.set and veto.set included, and a refused one does not
ok 554 - T14 every committed verb reloads once, limits.set, routes.set, plugins.set and veto.set included, and a refused one does not
---
duration_ms: 148.261569
type: 'test'
...
# Subtest: T14 a definition change on a running instance refuses instance-running; a vars change still goes live
ok 555 - T14 a definition change on a running instance refuses instance-running; a vars change still goes live
---
duration_ms: 98.298756
type: 'test'
...
# Subtest: T14 a file whose credential references differ from the boot copy is not reloaded and the write answers restart true
ok 556 - T14 a file whose credential references differ from the boot copy is not reloaded and the write answers restart true
---
duration_ms: 74.703241
type: 'test'
...
# Subtest: T14 a date-only change to a credential reference still reloads: row 199 issue rewrites the date outside the reload
ok 557 - T14 a date-only change to a credential reference still reloads: row 199 issue rewrites the date outside the reload
---
duration_ms: 84.564623
type: 'test'
...
# Subtest: T19 a credentialed create answers restart true; issue works only after a restart, and a later vars change goes live
ok 558 - T19 a credentialed create answers restart true; issue works only after a restart, and a later vars change goes live
---
duration_ms: 206.981124
type: 'test'
...
# Subtest: T14 after a refused reload veto.set, instance.hire and instance.fire answer restart true, and a fire of a name kept since refuses before step A
ok 559 - T14 after a refused reload veto.set, instance.hire and instance.fire answer restart true, and a fire of a name kept since refuses before step A
---
duration_ms: 299.885359
type: 'test'
...
# Subtest: T14 a file whose project root differs from the boot copy is not reloaded, because the Credentials store protects the boot roots
ok 560 - T14 a file whose project root differs from the boot copy is not reloaded, because the Credentials store protects the boot roots
---
duration_ms: 83.375717
type: 'test'
...
# organization: {"event":"reload-needs-restart","business":"demo"}
# Subtest: T14 a file whose library mapping differs from the boot copy is not reloaded, because the mirror is ensured at start
ok 561 - T14 a file whose library mapping differs from the boot copy is not reloaded, because the mirror is ensured at start
---
duration_ms: 370.960873
type: 'test'
...
# Subtest: T14 reloadBusiness refuses an unknown business, a changed human and a document the boot check refuses
ok 562 - T14 reloadBusiness refuses an unknown business, a changed human and a document the boot check refuses
---
duration_ms: 18.79635
type: 'test'
...
# Subtest: a reply is listed for human and reader sessions, and its delivery rows are unchanged
ok 563 - a reply is listed for human and reader sessions, and its delivery rows are unchanged
---
duration_ms: 53.997256
type: 'test'
...
# Subtest: the reply still reaches the human message.receive (mosaic talk) after the Console showed it
ok 564 - the reply still reaches the human message.receive (mosaic talk) after the Console showed it
---
duration_ms: 30.60827
type: 'test'
...
# Subtest: a message with no reply gives an empty list
ok 565 - a message with no reply gives an empty list
---
duration_ms: 26.07506
type: 'test'
...
# Subtest: replies come oldest first and stop at REPLIES
ok 566 - replies come oldest first and stop at REPLIES
---
duration_ms: 121.067948
type: 'test'
...
# Subtest: an id that names no message in the business refuses message-not-found, and the refusal is recorded
ok 567 - an id that names no message in the business refuses message-not-found, and the refusal is recorded
---
duration_ms: 43.001269
type: 'test'
...
# Subtest: strict arguments; a role session gets human-required
ok 568 - strict arguments; a role session gets human-required
---
duration_ms: 50.466469
type: 'test'
...
# Subtest: views passes replies through as one call with the id
ok 569 - views passes replies through as one call with the id
---
duration_ms: 0.268245
type: 'test'
...
# Subtest: requirements returns the committed list to a holding role session, and no one else
ok 570 - requirements returns the committed list to a holding role session, and no one else
---
duration_ms: 40.750088
type: 'test'
...
# Subtest: the PM's prd.approve with no task, when no id fits, reaches the human's Inbox
ok 571 - the PM's prd.approve with no task, when no id fits, reaches the human's Inbox
---
duration_ms: 27.009196
type: 'test'
...
# Subtest: the PM's non-blocking role.revoke with no task reaches the human's Inbox
ok 572 - the PM's non-blocking role.revoke with no task reaches the human's Inbox
---
duration_ms: 27.661153
type: 'test'
...
# Subtest: a push is recorded as the action.allowed for git.push.working on the task, and only the host records one
ok 573 - a push is recorded as the action.allowed for git.push.working on the task, and only the host records one
---
duration_ms: 46.431961
type: 'test'
...
# Subtest: review.request names the latest pushed commit and sends the reviewer a REVIEW-REQUEST
ok 574 - review.request names the latest pushed commit and sends the reviewer a REVIEW-REQUEST
---
duration_ms: 35.193111
type: 'test'
...
# Subtest: review.request says which run holds the reviewer role, or null, and a null request waits for a claim
ok 575 - review.request says which run holds the reviewer role, or null, and a null request waits for a claim
---
duration_ms: 42.50481
type: 'test'
...
# Subtest: review.request refuses a commit that isn't the latest push, a non-reviewer and a role without the action
ok 576 - review.request refuses a commit that isn't the latest push, a non-reviewer and a role without the action
---
duration_ms: 57.398586
type: 'test'
...
# Subtest: reviewFetch answers only the addressed reviewer, for the request it cites
ok 577 - reviewFetch answers only the addressed reviewer, for the request it cites
---
duration_ms: 46.93177
type: 'test'
...
# Subtest: review.verdict answers one request once, to the role that asked
ok 578 - review.verdict answers one request once, to the role that asked
---
duration_ms: 49.416025
type: 'test'
...
# Subtest: task.close on a pushed task needs an approve verdict for the latest push
ok 579 - task.close on a pushed task needs an approve verdict for the latest push
---
duration_ms: 76.500015
type: 'test'
...
# Subtest: a refusal the host decided is filed on the task it names, and only a task ref counts
ok 580 - a refusal the host decided is filed on the task it names, and only a task ref counts
---
duration_ms: 43.491164
type: 'test'
...
# organization: {"event":"reload-needs-restart","business":"demo"}
# Subtest: row 65: routes and routes.set refuse every non-human session, the chief of staff included, the tester may read and set, and each passes the verified actor
ok 581 - row 65: routes and routes.set refuse every non-human session, the chief of staff included, the tester may read and set, and each passes the verified actor
---
duration_ms: 48.539774
type: 'test'
...
# Subtest: row 65: a new launch binds only on a switched-on harness with a module name, and a run an earlier broker bound binds again after its harness is switched off
ok 582 - row 65: a new launch binds only on a switched-on harness with a module name, and a run an earlier broker bound binds again after its harness is switched off
---
duration_ms: 38.772968
type: 'test'
...
# Subtest: row 65 runtime: harnessLevels answers each module in the tree, and null for a name with no module
ok 583 - row 65 runtime: harnessLevels answers each module in the tree, and null for a name with no module
---
duration_ms: 61.348468
type: 'test'
...
# Subtest: row 65 runtime: routes and routes.set reach the organization file with the human as actor, a new bind reads plugins.harness, and each refusal keeps the bytes and logs nothing
ok 584 - row 65 runtime: routes and routes.set reach the organization file with the human as actor, a new bind reads plugins.harness, and each refusal keeps the bytes and logs nothing
---
duration_ms: 154.379512
type: 'test'
...
# Subtest: v3b prototype refusals, views and append-only mutations
ok 585 - v3b prototype refusals, views and append-only mutations
---
duration_ms: 119.738319
type: 'test'
...
# Subtest: gated approval authorizes once, survives store reopen, and fresh approval works
ok 586 - gated approval authorizes once, survives store reopen, and fresh approval works
---
duration_ms: 54.297284
type: 'test'
...
# Subtest: another run of the same instance consumes an approval once; a failed check leaves it usable
ok 587 - another run of the same instance consumes an approval once; a failed check leaves it usable
---
duration_ms: 42.139099
type: 'test'
...
# Subtest: two scheduled callers have exactly one grant and one consumed refusal
ok 588 - two scheduled callers have exactly one grant and one consumed refusal
---
duration_ms: 30.765904
type: 'test'
...
# Subtest: failed commit rolls consumption back; cross-role consumes and within-role stays reusable
ok 589 - failed commit rolls consumption back; cross-role consumes and within-role stays reusable
---
duration_ms: 64.157354
type: 'test'
...
# Subtest: class drift gated to cross-role refuses before consumption
ok 590 - class drift gated to cross-role refuses before consumption
---
duration_ms: 43.578431
type: 'test'
...
# Subtest: class drift cross-role to gated refuses before consumption
ok 591 - class drift cross-role to gated refuses before consumption
---
duration_ms: 53.343032
type: 'test'
...
# Subtest: class drift gated to within-role refuses before consumption
ok 592 - class drift gated to within-role refuses before consumption
---
duration_ms: 65.265886
type: 'test'
...
# Subtest: class drift cross-role to within-role refuses before consumption
ok 593 - class drift cross-role to within-role refuses before consumption
---
duration_ms: 66.368016
type: 'test'
...
# Subtest: class drift within-role to gated refuses before consumption
ok 594 - class drift within-role to gated refuses before consumption
---
duration_ms: 57.312098
type: 'test'
...
# Subtest: class drift within-role to cross-role refuses before consumption
ok 595 - class drift within-role to cross-role refuses before consumption
---
duration_ms: 38.692423
type: 'test'
...
# Subtest: message.send consumes approval and prevents a later send or authorize
ok 596 - message.send consumes approval and prevents a later send or authorize
---
duration_ms: 48.666536
type: 'test'
...
# Subtest: role.revoke consumes approval and prevents a later revoke or authorize
ok 597 - role.revoke consumes approval and prevents a later revoke or authorize
---
duration_ms: 57.670754
type: 'test'
...
# Subtest: 3e copy migrates through 3f to 3g preserving every old column/row and adding null spec citations
ok 598 - 3e copy migrates through 3f to 3g preserving every old column/row and adding null spec citations
---
duration_ms: 165.320084
type: 'test'
...
# Subtest: a human spec save sends one notice to each pm and cto, naming the commit, and each commit sends its own
ok 599 - a human spec save sends one notice to each pm and cto, naming the commit, and each commit sends its own
---
duration_ms: 360.405575
type: 'test'
...
# Subtest: no notice for a docs save, an agent record commit, a git commit outside the Console, or a refused save
ok 600 - no notice for a docs save, an agent record commit, a git commit outside the Console, or a refused save
---
duration_ms: 294.124743
type: 'test'
...
# Subtest: a notice to a role no run holds waits for a claim, and launches nobody and tells nobody
ok 601 - a notice to a role no run holds waits for a claim, and launches nobody and tells nobody
---
duration_ms: 118.346803
type: 'test'
...
# Subtest: a business without a pm or a cto saves the spec and sends nothing
ok 602 - a business without a pm or a cto saves the spec and sends nothing
---
duration_ms: 117.306577
type: 'test'
...
# Subtest: a notice that cannot be stored answers outcome-unknown, and the commit stands
ok 603 - a notice that cannot be stored answers outcome-unknown, and the commit stands
---
duration_ms: 124.613627
type: 'test'
...
# Subtest: a BLOCK reaches the chief of staff, the chief relays it to the assistant in the user's thread, and the commit stands
ok 604 - a BLOCK reaches the chief of staff, the chief relays it to the assistant in the user's thread, and the commit stands
---
duration_ms: 129.393467
type: 'test'
...
# Subtest: with no thread a BLOCK still reaches the chief of staff, and the relay to the assistant is refused
ok 605 - with no thread a BLOCK still reaches the chief of staff, and the relay to the assistant is refused
---
duration_ms: 114.18315
type: 'test'
...
# Subtest: within the notice's project the relay lands in the user's most recently opened thread
ok 606 - within the notice's project the relay lands in the user's most recently opened thread
---
duration_ms: 132.964805
type: 'test'
...
# Subtest: a more recently opened thread in another project does not take the relay
ok 607 - a more recently opened thread in another project does not take the relay
---
duration_ms: 127.008391
type: 'test'
...
# Subtest: a BLOCK is refused from anyone but a pm or cto, to anyone but the chief of staff, and outside a reply to its own notice
ok 608 - a BLOCK is refused from anyone but a pm or cto, to anyone but the chief of staff, and outside a reply to its own notice
---
duration_ms: 144.995875
type: 'test'
...
# Subtest: a role cannot forge a spec notice: its text opens neither a BLOCK nor the assistant's thread
ok 609 - a role cannot forge a spec notice: its text opens neither a BLOCK nor the assistant's thread
---
duration_ms: 130.070061
type: 'test'
...
# Subtest: the bus receives nothing: a reply to a notice addressed to _bus is refused
ok 610 - the bus receives nothing: a reply to a notice addressed to _bus is refused
---
duration_ms: 116.941532
type: 'test'
...
# Subtest: real socket awaits spec reads, record writes and cited raises; other requests still return normally
ok 611 - real socket awaits spec reads, record writes and cited raises; other requests still return normally
---
duration_ms: 330.396566
type: 'test'
...
# Subtest: real socket preserves asynchronous refusal codes and disconnects its transient proof
ok 612 - real socket preserves asynchronous refusal codes and disconnects its transient proof
---
duration_ms: 129.912429
type: 'test'
...
# Subtest: two real socket writes to one repository yield one commit and one project-busy refusal
ok 613 - two real socket writes to one repository yield one commit and one project-busy refusal
---
duration_ms: 127.477087
type: 'test'
...
# Subtest: client disconnect during await tolerates late reply
ok 614 - client disconnect during await tolerates late reply
---
duration_ms: 100.638063
type: 'test'
...
# Subtest: client disconnect during await tolerates late refusal
ok 615 - client disconnect during await tolerates late refusal
---
duration_ms: 79.215511
type: 'test'
...
# Subtest: N-a: slow admitted record.write returns its committed result after the idle deadline
ok 616 - N-a: slow admitted record.write returns its committed result after the idle deadline
---
duration_ms: 257.493452
type: 'test'
...
# Subtest: current citation is recorded; docs commits do not stale it and a new spec never reopens settlement
ok 617 - current citation is recorded; docs commits do not stale it and a new spec never reopens settlement
---
duration_ms: 234.871636
type: 'test'
...
# Subtest: stale, unconfirmed, missing and partial spec citations refuse without inserting a decision
ok 618 - stale, unconfirmed, missing and partial spec citations refuse without inserting a decision
---
duration_ms: 213.355582
type: 'test'
...
# Subtest: uncited raises retain their synchronous path and spec read is available to any held role in its business
ok 619 - uncited raises retain their synchronous path and spec read is available to any held role in its business
---
duration_ms: 81.732357
type: 'test'
...
# Subtest: record writes bind the session author, require authority and refuse spec and impersonation paths
ok 620 - record writes bind the session author, require authority and refuse spec and impersonation paths
---
duration_ms: 86.641424
type: 'test'
...
# Subtest: REQ-COS-1: the pm asks the chief of staff for roles and counts; the chief receives a STAFF-REQUEST and answers it
ok 621 - REQ-COS-1: the pm asks the chief of staff for roles and counts; the chief receives a STAFF-REQUEST and answers it
---
duration_ms: 67.34326
type: 'test'
...
# Subtest: REQ-COS-1: only the pm can send a staff request; every other session is refused and the chief of staff hears nothing
ok 622 - REQ-COS-1: only the pm can send a staff request; every other session is refused and the chief of staff hears nothing
---
duration_ms: 55.228016
type: 'test'
...
# Subtest: REQ-COS-1: a pm without message.send is refused like any other gated action
ok 623 - REQ-COS-1: a pm without message.send is refused like any other gated action
---
duration_ms: 33.618311
type: 'test'
...
# Subtest: REQ-COS-1: the request goes to the business launcher, and only when that is a chief of staff
ok 624 - REQ-COS-1: the request goes to the business launcher, and only when that is a chief of staff
---
duration_ms: 75.019881
type: 'test'
...
# Subtest: REQ-COS-1: the sender is judged by definition: an instance `lead` of the pm definition can ask, an instance `pm` of the coder definition can't
ok 625 - REQ-COS-1: the sender is judged by definition: an instance `lead` of the pm definition can ask, an instance `pm` of the coder definition can't
---
duration_ms: 79.191514
type: 'test'
...
# Subtest: REQ-COS-1: the launcher is judged by definition: an instance `boss` of the chief-of-staff definition receives, a `chief` of the coder definition gives no-chief-of-staff
ok 626 - REQ-COS-1: the launcher is judged by definition: an instance `boss` of the chief-of-staff definition receives, a `chief` of the coder definition gives no-chief-of-staff
---
duration_ms: 78.657879
type: 'test'
...
# Subtest: REQ-COS-1: a refused staff request leaves no staff.request action.allowed event
ok 627 - REQ-COS-1: a refused staff request leaves no staff.request action.allowed event
---
duration_ms: 35.373746
type: 'test'
...
# Subtest: REQ-ASSIST-2: the role definitions' messaging lists hold for a staff request, sender and recipient
ok 628 - REQ-ASSIST-2: the role definitions' messaging lists hold for a staff request, sender and recipient
---
duration_ms: 95.666936
type: 'test'
...
# Subtest: a staff request names a task, 1 to 10 distinct roles and counts of 1 to 20; nothing else is accepted
ok 629 - a staff request names a task, 1 to 10 distinct roles and counts of 1 to 20; nothing else is accepted
---
duration_ms: 61.202777
type: 'test'
...
# Subtest: REQ-COS-1: a staff request grants nothing: the pm still can't launch and the chief of staff launches as before
ok 630 - REQ-COS-1: a staff request grants nothing: the pm still can't launch and the chief of staff launches as before
---
duration_ms: 44.036805
type: 'test'
...
# Subtest: a business that never switched launches reads allowed with no time and no event
ok 631 - a business that never switched launches reads allowed with no time and no event
---
duration_ms: 45.428845
type: 'test'
...
# Subtest: launches revoked and then restored read allowed, with the restore time and event id
ok 632 - launches revoked and then restored read allowed, with the restore time and event id
---
duration_ms: 36.498723
type: 'test'
...
# Subtest: a task closed on the tracker leaves the open list, and total counts the open ones
ok 633 - a task closed on the tracker leaves the open list, and total counts the open ones
---
duration_ms: 31.930828
type: 'test'
...
# Subtest: a tombstone is not open
ok 634 - a tombstone is not open
---
duration_ms: 25.715305
type: 'test'
...
# Subtest: the open list stops at the cap and says so; total still counts every open task
ok 635 - the open list stops at the cap and says so; total still counts every open task
---
duration_ms: 26.844809
type: 'test'
...
# Subtest: a role and a reader session read state; arguments, and an unbound cap, refuse
ok 636 - a role and a reader session read state; arguments, and an unbound cap, refuse
---
duration_ms: 27.331203
type: 'test'
...
# Subtest: a human session reads the same state, with the same cap
ok 637 - a human session reads the same state, with the same cap
---
duration_ms: 28.318056
type: 'test'
...
# Subtest: reading state writes nothing: every table keeps its row count
ok 638 - reading state writes nothing: every table keeps its row count
---
duration_ms: 25.292472
type: 'test'
...
# Subtest: creates private WAL store and excludes a second writer until explicit close
ok 639 - creates private WAL store and excludes a second writer until explicit close
---
duration_ms: 28.368058
type: 'test'
...
# Subtest: rollback is atomic and schema metadata is checked against trusted DDL, not just itself
ok 640 - rollback is atomic and schema metadata is checked against trusted DDL, not just itself
---
duration_ms: 33.228376
type: 'test'
...
# Subtest: existing empty database and symlink runtime directory refuse, never initialize over damage
ok 641 - existing empty database and symlink runtime directory refuse, never initialize over damage
---
duration_ms: 25.747045
type: 'test'
...
# Subtest: crash during a transaction recovers no partial event after explicit fixture-only lock removal
ok 642 - crash during a transaction recovers no partial event after explicit fixture-only lock removal
---
duration_ms: 98.020486
type: 'test'
...
# Subtest: writer refuses mixed at/read_at forms atomically, even through trusted SQL helpers
ok 643 - writer refuses mixed at/read_at forms atomically, even through trusted SQL helpers
---
duration_ms: 17.797082
type: 'test'
...
# Subtest: async transactions refuse before invoking their function
ok 644 - async transactions refuse before invoking their function
---
duration_ms: 14.311315
type: 'test'
...
# Subtest: usage_records refuses non-canonical timestamps atomically
ok 645 - usage_records refuses non-canonical timestamps atomically
---
duration_ms: 14.863107
type: 'test'
...
# Subtest: the session default fits under the reply cap and pages to the end with next
ok 646 - the session default fits under the reply cap and pages to the end with next
---
duration_ms: 216.133893
type: 'test'
...
# Subtest: the short form: no description, assignees by role, every listed key
ok 647 - the short form: no description, assignees by role, every listed key
---
duration_ms: 125.597815
type: 'test'
...
# Subtest: each filter, alone and together, and total counts every match
ok 648 - each filter, alone and together, and total counts every match
---
duration_ms: 226.458632
type: 'test'
...
# Subtest: task_ref reads one task in full, as the whole board has it
ok 649 - task_ref reads one task in full, as the whole board has it
---
duration_ms: 168.688268
type: 'test'
...
# Subtest: no arguments is the read the Console and mosaic make, unchanged
ok 650 - no arguments is the read the Console and mosaic make, unchanged
---
duration_ms: 128.743807
type: 'test'
...
# Subtest: an unknown argument or a bad value refuses invalid-request
ok 651 - an unknown argument or a bad value refuses invalid-request
---
duration_ms: 471.282792
type: 'test'
...
# Subtest: tasks rows carry priority and requirement for every session that reads tasks
ok 652 - tasks rows carry priority and requirement for every session that reads tasks
---
duration_ms: 70.336993
type: 'test'
...
# Subtest: the read model rebuilds from the ledger: a reopened bus and each trail give the same values
ok 653 - the read model rebuilds from the ledger: a reopened bus and each trail give the same values
---
duration_ms: 66.260168
type: 'test'
...
# Subtest: an empty business and one with snapshots but no task.created read cleanly
ok 654 - an empty business and one with snapshots but no task.created read cleanly
---
duration_ms: 16.485124
type: 'test'
...
# Subtest: recordTask keeps sync reads and a role write apart
ok 655 - recordTask keeps sync reads and a role write apart
---
duration_ms: 36.508827
type: 'test'
...
# Subtest: read_at must be one canonical UTC format, so the projection compares strings safely
ok 656 - read_at must be one canonical UTC format, so the projection compares strings safely
---
duration_ms: 17.149518
type: 'test'
...
# Subtest: a bad entry refuses the whole record
ok 657 - a bad entry refuses the whole record
---
duration_ms: 20.410159
type: 'test'
...
# Subtest: taskView reads the projection for one business
ok 658 - taskView reads the projection for one business
---
duration_ms: 20.2729
type: 'test'
...
# Subtest: requestTask hands only a holder and a task verb to the handler, and records refusals
ok 659 - requestTask hands only a holder and a task verb to the handler, and records refusals
---
duration_ms: 37.519851
type: 'test'
...
# Subtest: the server sends task verbs to the adapter with its own timeout; other verbs stay synchronous
ok 660 - the server sends task verbs to the adapter with its own timeout; other verbs stay synchronous
---
duration_ms: 310.072339
type: 'test'
...
# Subtest: without an adapter the server refuses every task verb
ok 661 - without an adapter the server refuses every task verb
---
duration_ms: 69.563693
type: 'test'
...
# Subtest: the runtime refuses an invalid adapter and closes a valid one
ok 662 - the runtime refuses an invalid adapter and closes a valid one
---
duration_ms: 88.614232
type: 'test'
...
# Subtest: the process loads the S3 adapter from plain-data trackers
ok 663 - the process loads the S3 adapter from plain-data trackers
---
duration_ms: 385.893317
type: 'test'
...
# Subtest: row 177 T1: a tester thread is owned by tester, and neither side reaches or lists the other
ok 664 - row 177 T1: a tester thread is owned by tester, and neither side reaches or lists the other
---
duration_ms: 45.079443
type: 'test'
...
# Subtest: row 177 T2: the tester thread.send is from tester-cli with no human.input; its open is by tester
ok 665 - row 177 T2: the tester thread.send is from tester-cli with no human.input; its open is by tester
---
duration_ms: 26.93061
type: 'test'
...
# Subtest: row 177 T3: the lists read the tester as the human in its own thread, and nowhere else
ok 666 - row 177 T3: the lists read the tester as the human in its own thread, and nowhere else
---
duration_ms: 21.253953
type: 'test'
...
# Subtest: row 177 T3: an assistant that would not hear the human refuses the tester too
ok 667 - row 177 T3: an assistant that would not hear the human refuses the tester too
---
duration_ms: 25.897934
type: 'test'
...
# Subtest: row 177 T4: the tester thread run answers the tester, never the human
ok 668 - row 177 T4: the tester thread run answers the tester, never the human
---
duration_ms: 44.445047
type: 'test'
...
# Subtest: row 177 T5: each stop revokes only its own threads, recorded by its own actor
ok 669 - row 177 T5: each stop revokes only its own threads, recorded by its own actor
---
duration_ms: 34.104028
type: 'test'
...
# Subtest: row 177 T5: the human stop never ends a tester run
ok 670 - row 177 T5: the human stop never ends a tester run
---
duration_ms: 25.595243
type: 'test'
...
# Subtest: row 177 T6: a business whose human is tester refuses invalid-business
ok 671 - row 177 T6: a business whose human is tester refuses invalid-business
---
duration_ms: 17.318266
type: 'test'
...
# Subtest: row 177 T7: the human trail shows a tester thread message as the tester
ok 672 - row 177 T7: the human trail shows a tester thread message as the tester
---
duration_ms: 33.459798
type: 'test'
...
# Subtest: row 177 T8: a tester-thread run never raises a decision to the human; a human-thread run still does
ok 673 - row 177 T8: a tester-thread run never raises a decision to the human; a human-thread run still does
---
duration_ms: 34.281094
type: 'test'
...
# Subtest: row 177 T8: a tester-thread raise routed to the arbiter stays allowed
ok 674 - row 177 T8: a tester-thread raise routed to the arbiter stays allowed
---
duration_ms: 27.424248
type: 'test'
...
# Subtest: row 182 T9: a tester reply into the human's thread refuses thread-not-owned and stores nothing
ok 675 - row 182 T9: a tester reply into the human's thread refuses thread-not-owned and stores nothing
---
duration_ms: 30.420409
type: 'test'
...
# Subtest: row 182 T9: a tester reply into its own thread lands there
ok 676 - row 182 T9: a tester reply into its own thread lands there
---
duration_ms: 30.102183
type: 'test'
...
# Subtest: row 182 T9: the chief's reply up a chain into a tester's thread lands there
ok 677 - row 182 T9: the chief's reply up a chain into a tester's thread lands there
---
duration_ms: 34.028175
type: 'test'
...
# Subtest: row 182 T9: a tester reply to a spec notice refuses thread-not-owned; the chief's relay still lands
ok 678 - row 182 T9: a tester reply to a spec notice refuses thread-not-owned; the chief's relay still lands
---
duration_ms: 35.926656
type: 'test'
...
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# Subtest: row 175: TESTER_VERBS and the organization branch tester set are pinned
ok 679 - row 175: TESTER_VERBS and the organization branch tester set are pinned
---
duration_ms: 2.144034
type: 'test'
...
# Subtest: row 175: each of the six reads as the tester deep-equals the human read
ok 680 - row 175: each of the six reads as the tester deep-equals the human read
---
duration_ms: 97.085337
type: 'test'
...
# Subtest: row 175: W1-W3 as the tester land with receipt actor tester; the human still logs the human
ok 681 - row 175: W1-W3 as the tester land with receipt actor tester; the human still logs the human
---
duration_ms: 123.874464
type: 'test'
...
# Subtest: row 175: W2 as the tester refuses credentials, protected definitions, human, tester and bus.tester, and changes nothing
ok 682 - row 175: W2 as the tester refuses credentials, protected definitions, human, tester and bus.tester, and changes nothing
---
duration_ms: 97.880882
type: 'test'
...
# Subtest: row 175: the human-only actions refuse a tester tester-refused, and the file and store stay as they were
ok 683 - row 175: the human-only actions refuse a tester tester-refused, and the file and store stay as they were
---
duration_ms: 98.31888
type: 'test'
...
# Subtest: row 175: W4 as the tester writes by tester and keeps every name check
ok 684 - row 175: W4 as the tester writes by tester and keeps every name check
---
duration_ms: 29.379918
type: 'test'
...
# Subtest: row 175: W6 as the tester records created_by tester; the human records the human
ok 685 - row 175: W6 as the tester records created_by tester; the human records the human
---
duration_ms: 23.537658
type: 'test'
...
# Subtest: row 175: with bus.tester unset or not exactly true no tester binds, so no read or write runs
ok 686 - row 175: with bus.tester unset or not exactly true no tester binds, so no read or write runs
---
duration_ms: 78.406021
type: 'test'
...
# Subtest: the tester binds only when the business sets bus.tester to exactly true
ok 687 - the tester binds only when the business sets bus.tester to exactly true
---
duration_ms: 124.071912
type: 'test'
...
# Subtest: a business may not name a role tester, so the tester address is never a role
ok 688 - a business may not name a role tester, so the tester address is never a role
---
duration_ms: 39.59495
type: 'test'
...
# Subtest: every verb outside the tester list refuses tester-refused and is recorded against the tester
ok 689 - every verb outside the tester list refuses tester-refused and is recorded against the tester
---
duration_ms: 74.087545
type: 'test'
...
# Subtest: a tester message is from tester, needs no prefix, and writes no human.input or authority
ok 690 - a tester message is from tester, needs no prefix, and writes no human.input or authority
---
duration_ms: 30.173716
type: 'test'
...
# Subtest: a tester message to a role no run holds refuses tester-target-not-running and stores nothing
ok 691 - a tester message to a role no run holds refuses tester-target-not-running and stores nothing
---
duration_ms: 21.104206
type: 'test'
...
# Subtest: a tester message is refused while the run is only launched, and routes once it claims
ok 692 - a tester message is refused while the run is only launched, and routes once it claims
---
duration_ms: 27.426324
type: 'test'
...
# Subtest: a human message to a role no run holds still waits and tells launch.by
ok 693 - a human message to a role no run holds still waits and tells launch.by
---
duration_ms: 22.008078
type: 'test'
...
# Subtest: a role answers a tester only in reply to a tester message, and the answer never reaches the human
ok 694 - a role answers a tester only in reply to a tester message, and the answer never reaches the human
---
duration_ms: 41.756656
type: 'test'
...
# Subtest: the tester reads the human views a reader reads
ok 695 - the tester reads the human views a reader reads
---
duration_ms: 43.056681
type: 'test'
...
# Subtest: tester proof binds its own CLI, start time and nonce, refuses a managed run and allows an agent
ok 696 - tester proof binds its own CLI, start time and nonce, refuses a managed run and allows an agent
---
duration_ms: 2.103042
type: 'test'
...
# Subtest: neither CLI's nonce proves the other: each proof is bound to its own CLI and nonce variable
ok 697 - neither CLI's nonce proves the other: each proof is bound to its own CLI and nonce variable
---
duration_ms: 0.650748
type: 'test'
...
# Subtest: testerNonce reads only the tester's variable and gives null on any read error
ok 698 - testerNonce reads only the tester's variable and gives null on any read error
---
duration_ms: 0.348283
type: 'test'
...
# Subtest: an envelope carries exactly one of cap, human and tester; no tester authenticator refuses
ok 699 - an envelope carries exactly one of cap, human and tester; no tester authenticator refuses
---
duration_ms: 166.841566
type: 'test'
...
# Subtest: tester-cli.mjs binds through the runtime when the switch is on, and refuses off or under a run marker
ok 700 - tester-cli.mjs binds through the runtime when the switch is on, and refuses off or under a run marker
---
duration_ms: 1201.414945
type: 'test'
...
# Subtest: T1: the human and the reader see a held thread claim; agents still lists the role only
ok 701 - T1: the human and the reader see a held thread claim; agents still lists the role only
---
duration_ms: 36.347433
type: 'test'
...
# Subtest: T2: a released or revoked thread claim is not listed, though its thread has an earlier claim row
ok 702 - T2: a released or revoked thread claim is not listed, though its thread has an earlier claim row
---
duration_ms: 33.20519
type: 'test'
...
# Subtest: T3: a role session refuses human-required and the tester refuses tester-refused
ok 703 - T3: a role session refuses human-required and the tester refuses tester-refused
---
duration_ms: 30.252974
type: 'test'
...
# Subtest: T4: agents answers each session the same before and after a thread run claims
ok 704 - T4: agents answers each session the same before and after a thread run claims
---
duration_ms: 32.660197
type: 'test'
...
# Subtest: T5: the result carries neither the thread name a user wrote nor a message body
ok 705 - T5: the result carries neither the thread name a user wrote nor a message body
---
duration_ms: 33.202642
type: 'test'
...
# Subtest: REQ-THREAD-1 REQ-ORG-2: the 3d→3e migration adds the thread tables and leaves messages from before threads as written
ok 706 - REQ-THREAD-1 REQ-ORG-2: the 3d→3e migration adds the thread tables and leaves messages from before threads as written
---
duration_ms: 137.285633
type: 'test'
...
# Subtest: REQ-THREAD-1: a 3d bus with a changed schema is refused and keeps its version and tables
ok 707 - REQ-THREAD-1: a 3d bus with a changed schema is refused and keeps its version and tables
---
duration_ms: 75.063073
type: 'test'
...
# Subtest: REQ-THREAD-1: the offline command prints the kept-message counts before the ready line
ok 708 - REQ-THREAD-1: the offline command prints the kept-message counts before the ready line
---
duration_ms: 167.625965
type: 'test'
...
# Subtest: REQ-ROLE-2 REQ-THREAD-1: one holder per thread, through the broker and the trigger
ok 709 - REQ-ROLE-2 REQ-THREAD-1: one holder per thread, through the broker and the trigger
---
duration_ms: 59.127486
type: 'test'
...
# Subtest: REQ-ROLE-2 REQ-THREAD-1: the 3e triggers refuse writes that skip the broker
ok 710 - REQ-ROLE-2 REQ-THREAD-1: the 3e triggers refuse writes that skip the broker
---
duration_ms: 94.703109
type: 'test'
...
# Subtest: REQ-MSG-1: a message to or from the assistant names its thread, or is refused
ok 711 - REQ-MSG-1: a message to or from the assistant names its thread, or is refused
---
duration_ms: 53.892481
type: 'test'
...
# Subtest: REQ-MSG-1: the chief of staff's reply comes back to the thread that sent the work
ok 712 - REQ-MSG-1: the chief of staff's reply comes back to the thread that sent the work
---
duration_ms: 881.872135
type: 'test'
...
# Subtest: REQ-MSG-1: a reply can't carry one thread instance's thread to another thread instance
ok 713 - REQ-MSG-1: a reply can't carry one thread instance's thread to another thread instance
---
duration_ms: 20.607335
type: 'test'
...
# Subtest: REQ-THREAD-1 REQ-USER-2: one thread's messages never reach another thread's holder
ok 714 - REQ-THREAD-1 REQ-USER-2: one thread's messages never reach another thread's holder
---
duration_ms: 31.028798
type: 'test'
...
# Subtest: REQ-LAUNCH-1: a message to a thread with no holder waits, and the next holder gets it
ok 715 - REQ-LAUNCH-1: a message to a thread with no holder waits, and the next holder gets it
---
duration_ms: 31.964838
type: 'test'
...
# Subtest: REQ-THREAD-2 REQ-LAUNCH-1: threadIdle releases only a thread with nothing waiting, and only for its holder
ok 716 - REQ-THREAD-2 REQ-LAUNCH-1: threadIdle releases only a thread with nothing waiting, and only for its holder
---
duration_ms: 35.487966
type: 'test'
...
# Subtest: REQ-THREAD-2 REQ-LAUNCH-1: a message delivered to a run that ended unread doesn't hold up the next holder
ok 717 - REQ-THREAD-2 REQ-LAUNCH-1: a message delivered to a run that ended unread doesn't hold up the next holder
---
duration_ms: 27.086575
type: 'test'
...
# Subtest: REQ-ROLE-2 REQ-THREAD-1 Q169: a role.revoke the human approved ends every thread run of the assistant
ok 718 - REQ-ROLE-2 REQ-THREAD-1 Q169: a role.revoke the human approved ends every thread run of the assistant
---
duration_ms: 27.444419
type: 'test'
...
# Subtest: Q169 REQ-USER-2: assistant.stop ends the human's own assistant thread runs, and only the human's
ok 719 - Q169 REQ-USER-2: assistant.stop ends the human's own assistant thread runs, and only the human's
---
duration_ms: 39.038683
type: 'test'
...
# Subtest: REQ-USER-2: the human verbs refuse another owner's thread
ok 720 - REQ-USER-2: the human verbs refuse another owner's thread
---
duration_ms: 25.128256
type: 'test'
...
# Subtest: REQ-THREAD-1: thread.create refuses when the business has no thread instance or more than one
ok 721 - REQ-THREAD-1: thread.create refuses when the business has no thread instance or more than one
---
duration_ms: 23.201845
type: 'test'
...
# Subtest: REQ-ORG-2: projects and threads are named once, and the repo names a business project
ok 722 - REQ-ORG-2: projects and threads are named once, and the repo names a business project
---
duration_ms: 25.666906
type: 'test'
...
# Subtest: REQ-THREAD-2: thread.messages returns the thread's history in pages and writes nothing
ok 723 - REQ-THREAD-2: thread.messages returns the thread's history in pages and writes nothing
---
duration_ms: 84.642652
type: 'test'
...
# Subtest: project.create refuses a repository name without its matching repo before any write
ok 724 - project.create refuses a repository name without its matching repo before any write
---
duration_ms: 14.832633
type: 'test'
...
# Subtest: project.create keeps unrelated names with and without a repository
ok 725 - project.create keeps unrelated names with and without a repository
---
duration_ms: 11.217054
type: 'test'
...
# Subtest: socket capability stamps launch identity; shared views use wire, no SQL client
ok 726 - socket capability stamps launch identity; shared views use wire, no SQL client
---
duration_ms: 62.129061
type: 'test'
...
# Subtest: two wire claims serialize; a lost reply never automatically retries
ok 727 - two wire claims serialize; a lost reply never automatically retries
---
duration_ms: 62.546459
type: 'test'
...
# Subtest: malformed, oversized and identity-forging envelopes refuse without echoing input
ok 728 - malformed, oversized and identity-forging envelopes refuse without echoing input
---
duration_ms: 44.953674
type: 'test'
...
# Subtest: client preserves UTF-8 when a response divides a multibyte character
ok 729 - client preserves UTF-8 when a response divides a multibyte character
---
duration_ms: 12.508813
type: 'test'
...
# Subtest: committed mutation followed by dropped reply reports unknown and is never retried
ok 730 - committed mutation followed by dropped reply reports unknown and is never retried
---
duration_ms: 55.351073
type: 'test'
...
# Subtest: REQ-LIMIT-4 usage protocol binds run identity, requires a delivered turn and isolates businesses
ok 731 - REQ-LIMIT-4 usage protocol binds run identity, requires a delivered turn and isolates businesses
---
duration_ms: 42.99871
type: 'test'
...
# Subtest: REQ-LIMIT-4 3g copy migrates through 3h and 3i to 3j preserving every old column, row and sequence; new usage table is empty
ok 732 - REQ-LIMIT-4 3g copy migrates through 3h and 3i to 3j preserving every old column, row and sequence; new usage table is empty
---
duration_ms: 131.28735
type: 'test'
...
# Subtest: REQ-PLUG-1 runtime reaches transcript only through loader, over the real bus socket
ok 733 - REQ-PLUG-1 runtime reaches transcript only through loader, over the real bus socket
---
duration_ms: 88.141852
type: 'test'
...
# Subtest: REQ-LIMIT-4 loader source records new turn kinds, excludes history and retries exactly once
ok 734 - REQ-LIMIT-4 loader source records new turn kinds, excludes history and retries exactly once
---
duration_ms: 25.948095
type: 'test'
...
# Subtest: REQ-LIMIT-4 cut: unknown is durable and logged next to every total
ok 735 - REQ-LIMIT-4 cut: unknown is durable and logged next to every total
---
duration_ms: 17.513089
type: 'test'
...
# Subtest: REQ-LIMIT-4 disabled: unknown is durable and logged next to every total
ok 736 - REQ-LIMIT-4 disabled: unknown is durable and logged next to every total
---
duration_ms: 16.375968
type: 'test'
...
# Subtest: REQ-LIMIT-4 missing-begin: unknown is durable and logged next to every total
ok 737 - REQ-LIMIT-4 missing-begin: unknown is durable and logged next to every total
---
duration_ms: 15.651888
type: 'test'
...
# Subtest: REQ-LIMIT-4 no-new-usage: unknown is durable and logged next to every total
ok 738 - REQ-LIMIT-4 no-new-usage: unknown is durable and logged next to every total
---
duration_ms: 17.08514
type: 'test'
...
# Subtest: REQ-LIMIT-4 rewrite: unknown is durable and logged next to every total
ok 739 - REQ-LIMIT-4 rewrite: unknown is durable and logged next to every total
---
duration_ms: 15.590164
type: 'test'
...
# Subtest: REQ-LIMIT-4 unfinished turn remains visibly unknown after accounting restarts
ok 740 - REQ-LIMIT-4 unfinished turn remains visibly unknown after accounting restarts
---
duration_ms: 16.484306
type: 'test'
...
# Subtest: usage records are append-only
ok 741 - usage records are append-only
---
duration_ms: 16.866062
type: 'test'
...
# Subtest: REQ-LIMIT-4 parse failure logs its safe code, never transcript content
ok 742 - REQ-LIMIT-4 parse failure logs its safe code, never transcript content
---
duration_ms: 16.973561
type: 'test'
...
# Subtest: REQ-LIMIT-4 resumed run baselines history and exact totals do not overflow
ok 743 - REQ-LIMIT-4 resumed run baselines history and exact totals do not overflow
---
duration_ms: 18.050729
type: 'test'
...
# Subtest: REQ-PLUG-1 core has no transcript import and disabled sources do not read any transcript
ok 744 - REQ-PLUG-1 core has no transcript import and disabled sources do not read any transcript
---
duration_ms: 14.49657
type: 'test'
...
# Subtest: REQ-LIMIT-4 a resumed thread bills only new assistant messages to its next run
ok 745 - REQ-LIMIT-4 a resumed thread bills only new assistant messages to its next run
---
duration_ms: 18.060214
type: 'test'
...
# Subtest: REQ-LIMIT-4 every enabled source is called; failure is unknown and a partial total stays labelled
ok 746 - REQ-LIMIT-4 every enabled source is called; failure is unknown and a partial total stays labelled
---
duration_ms: 25.802413
type: 'test'
...
# Subtest: REQ-LIMIT-4 a turn whose reported sum exceeds safe precision is unknown, not rounded
ok 747 - REQ-LIMIT-4 a turn whose reported sum exceeds safe precision is unknown, not rounded
---
duration_ms: 19.372789
type: 'test'
...
# Subtest: row 65 a run bound without a transcript directory records no-transcript
ok 748 - row 65 a run bound without a transcript directory records no-transcript
---
duration_ms: 18.455975
type: 'test'
...
# Subtest: R3: bindUser binds a granted user and refuses one with no live collaborator grant
ok 749 - R3: bindUser binds a granted user and refuses one with no live collaborator grant
---
duration_ms: 21.299741
type: 'test'
...
# Subtest: R3: a user named like the business human, the tester or a principal word is refused, whatever the grants say
ok 750 - R3: a user named like the business human, the tester or a principal word is refused, whatever the grants say
---
duration_ms: 17.606551
type: 'test'
...
# Subtest: R3: each collaborator verb is allowed to a granted user
ok 751 - R3: each collaborator verb is allowed to a granted user
---
duration_ms: 30.534806
type: 'test'
...
# Subtest: R3: every verb off the collaborator list refuses a user access-refused before its own checks
ok 752 - R3: every verb off the collaborator list refuses a user access-refused before its own checks
---
duration_ms: 171.887216
type: 'test'
...
# Subtest: R3: task, web and host verbs refuse a user access-refused
ok 753 - R3: task, web and host verbs refuse a user access-refused
---
duration_ms: 41.635002
type: 'test'
...
# Subtest: R3 leak: project.list shows granted projects only
ok 754 - R3 leak: project.list shows granted projects only
---
duration_ms: 19.911103
type: 'test'
...
# Subtest: R3 leak: thread.create needs the project and the thread instance granted, and an ungranted id reads as one that does not exist
ok 755 - R3 leak: thread.create needs the project and the thread instance granted, and an ungranted id reads as one that does not exist
---
duration_ms: 23.330289
type: 'test'
...
# Subtest: R3 leak: thread.list shows the user its own threads that are still granted, never others
ok 756 - R3 leak: thread.list shows the user its own threads that are still granted, never others
---
duration_ms: 51.337321
type: 'test'
...
# Subtest: R3 leak: names shows granted instances only
ok 757 - R3 leak: names shows granted instances only
---
duration_ms: 19.793481
type: 'test'
...
# Subtest: R3: thread.send is from user:<id> and writes no human.input
ok 758 - R3: thread.send is from user:<id> and writes no human.input
---
duration_ms: 20.082209
type: 'test'
...
# Subtest: R3: a reply-chain message.send into another user thread is refused
ok 759 - R3: a reply-chain message.send into another user thread is refused
---
duration_ms: 22.280934
type: 'test'
...
# Subtest: R3: the run reply to a user message reaches that user thread.messages, with no waiting and no notice
ok 760 - R3: the run reply to a user message reaches that user thread.messages, with no waiting and no notice
---
duration_ms: 22.924321
type: 'test'
...
# Subtest: R3: a reply to: user without a matching in_reply_to is refused user-reply-required
ok 761 - R3: a reply to: user without a matching in_reply_to is refused user-reply-required
---
duration_ms: 31.343645
type: 'test'
...
# Subtest: R3: a non-thread run, the human and the tester cannot send to: user
ok 762 - R3: a non-thread run, the human and the tester cannot send to: user
---
duration_ms: 21.630526
type: 'test'
...
# Subtest: R3: a user thread run cannot message the owner, while its uncited gated raise reaches only the owner inbox, B9
ok 763 - R3: a user thread run cannot message the owner, while its uncited gated raise reaches only the owner inbox, B9
---
duration_ms: 25.227248
type: 'test'
...
# Subtest: R3: a removed or expired grant refuses the next request access-revoked, and the file is read per request
ok 764 - R3: a removed or expired grant refuses the next request access-revoked, and the file is read per request
---
duration_ms: 18.855926
type: 'test'
...
# Subtest: R3: a user refusal is recorded as action.refused by user:<id>
ok 765 - R3: a user refusal is recorded as action.refused by user:<id>
---
duration_ms: 14.449211
type: 'test'
...
# Subtest: R3: a business with a role keyed user refuses invalid-business
ok 766 - R3: a business with a role keyed user refuses invalid-business
---
duration_ms: 10.119851
type: 'test'
...
# Subtest: R3: name.set refuses the name user
ok 767 - R3: name.set refuses the name user
---
duration_ms: 12.865439
type: 'test'
...
# Subtest: R3 r4: while halted, a granted user's thread.send refuses processing-halted and thread.messages still answers
ok 768 - R3 r4: while halted, a granted user's thread.send refuses processing-halted and thread.messages still answers
---
duration_ms: 15.433554
type: 'test'
...
# Subtest: R3 r4: the chief's hire refuses an instance named user with the code it gives human and tester
ok 769 - R3 r4: the chief's hire refuses an instance named user with the code it gives human and tester
---
duration_ms: 17.248021
type: 'test'
...
# Subtest: R3 r4: a non-function access throws before the store is read
ok 770 - R3 r4: a non-function access throws before the store is read
---
duration_ms: 0.163981
type: 'test'
...
# Subtest: web.search: a granted role gets labelled results, and the call is trailed with role, run, verb and query
ok 771 - web.search: a granted role gets labelled results, and the call is trailed with role, run, verb and query
---
duration_ms: 31.469544
type: 'test'
...
# Subtest: web.fetch: a granted role gets the page as labelled text, and the call is trailed with the url
ok 772 - web.fetch: a granted role gets the page as labelled text, and the call is trailed with the url
---
duration_ms: 35.666553
type: 'test'
...
# Subtest: a role without the grant is refused, the refusal is logged with the verb, and nothing is fetched
ok 773 - a role without the grant is refused, the refusal is logged with the verb, and nothing is fetched
---
duration_ms: 36.517906
type: 'test'
...
# Subtest: a broker with no web service refuses a granted role
ok 774 - a broker with no web service refuses a granted role
---
duration_ms: 23.680164
type: 'test'
...
# Subtest: bad requests are refused: unknown verb, extra or missing argument, not a string, a human or reader session
ok 775 - bad requests are refused: unknown verb, extra or missing argument, not a string, a human or reader session
---
duration_ms: 28.615869
type: 'test'
...
# Subtest: a session that is not the role holder is refused
ok 776 - a session that is not the role holder is refused
---
duration_ms: 19.255566
type: 'test'
...
# Subtest: web.mjs's fences hold on the broker side: refusals are normal results with the fixed reason
ok 777 - web.mjs's fences hold on the broker side: refusals are normal results with the fixed reason
---
duration_ms: 57.028804
type: 'test'
...
# Subtest: web.search with no search source configured is a refused result, not an error
ok 778 - web.search with no search source configured is a refused result, not an error
---
duration_ms: 23.426818
type: 'test'
...
# Subtest: a search source that fails with its own refusal, or that throws, is handled
ok 779 - a search source that fails with its own refusal, or that throws, is handled
---
duration_ms: 23.387002
type: 'test'
...
# Subtest: a slow search source ends in a refusal at the deadline
ok 780 - a slow search source ends in a refusal at the deadline
---
duration_ms: 67.070742
type: 'test'
...
# Subtest: a secret in the arguments is refused before anything is trailed or fetched
ok 781 - a secret in the arguments is refused before anything is trailed or fetched
---
duration_ms: 15.103294
type: 'test'
...
# Subtest: over the socket: the server routes web verbs to the service; other roles are refused; no service is web-not-configured
ok 782 - over the socket: the server routes web verbs to the service; other roles are refused; no service is web-not-configured
---
duration_ms: 78.913595
type: 'test'
...
# Subtest: busBusiness: the web grant comes from "web" in the resolved tool limit
ok 783 - busBusiness: the web grant comes from "web" in the resolved tool limit
---
duration_ms: 0.273633
type: 'test'
...
# Subtest: webServices: the business's search-source plug-in and web.searxng var make web.search work; without either it is refused as not configured
ok 784 - webServices: the business's search-source plug-in and web.searxng var make web.search work; without either it is refused as not configured
---
duration_ms: 49.008563
type: 'test'
...
# Subtest: an ungranted call is refused at once: no admission, no wait, nothing touched
ok 785 - an ungranted call is refused at once: no admission, no wait, nothing touched
---
duration_ms: 17.762782
type: 'test'
...
# Subtest: over the socket an ungranted caller is dropped by the server timeout and a granted one gets the longer wait
ok 786 - over the socket an ungranted caller is dropped by the server timeout and a granted one gets the longer wait
---
duration_ms: 342.258448
type: 'test'
...
# Subtest: a search that never answers is aborted at the deadline, the module sees the signal, and the call is trailed as refused (timeout)
ok 787 - a search that never answers is aborted at the deadline, the module sees the signal, and the call is trailed as refused (timeout)
---
duration_ms: 75.493925
type: 'test'
...
# Subtest: a fetch that stalls is cut off at the deadline: the request is destroyed, not left running
ok 788 - a fetch that stalls is cut off at the deadline: the request is destroyed, not left running
---
duration_ms: 95.236936
type: 'test'
...
# Subtest: one query limit: over SEARCH_MAX_QUERY_CHARS or empty is refused with the same reason before any backend, and the tool schema carries the same number
ok 789 - one query limit: over SEARCH_MAX_QUERY_CHARS or empty is refused with the same reason before any backend, and the tool schema carries the same number
---
duration_ms: 16.619853
type: 'test'
...
# Subtest: merge-gate's technical raise is cross-role, goes to the cto, and only merge-gate can use the approval
ok 790 - merge-gate's technical raise is cross-role, goes to the cto, and only merge-gate can use the approval
---
duration_ms: 65.295624
type: 'test'
...
# Subtest: merge-gate has no message.send, and without a domain its raise goes to the delivery arbiter
ok 791 - merge-gate has no message.send, and without a domain its raise goes to the delivery arbiter
---
duration_ms: 41.291632
type: 'test'
...
# Subtest: the cto must be able to message merge-gate, or the technical raise is refused (row 133)
ok 792 - the cto must be able to message merge-gate, or the technical raise is refused (row 133)
---
duration_ms: 33.040989
type: 'test'
...
# Subtest: security-reviewer answers a review with its verdict alone; it holds no message.send
ok 793 - security-reviewer answers a review with its verdict alone; it holds no message.send
---
duration_ms: 38.034798
type: 'test'
...
1..793
# tests 793
# suites 0
# pass 793
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 22393.77421
Reference in new issue View Git Blame Copy Permalink