Files

7503 lines
312 KiB
Plaintext
Raw Permalink Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
TAP version 13
# Subtest: REQ-LIMIT-4 3h copy migrates to 3i: every row keeps its seq, the sequence carries over, and only the account CHECK changes
ok 1 - REQ-LIMIT-4 3h copy migrates to 3i: every row keeps its seq, the sequence carries over, and only the account CHECK changes
---
duration_ms: 153.399621
type: 'test'
...
# Subtest: REQ-LIMIT-4 a 3h→3i step that fails partway leaves the store at 3h with every row, the sequence and the schema intact
ok 2 - REQ-LIMIT-4 a 3h→3i step that fails partway leaves the store at 3h with every row, the sequence and the schema intact
---
duration_ms: 166.588016
type: 'test'
...
# Subtest: REQ-LIMIT-4 the 3h engine refuses a migrated store, migrating or not, and leaves it as it was
ok 3 - REQ-LIMIT-4 the 3h engine refuses a migrated store, migrating or not, and leaves it as it was
---
duration_ms: 190.052919
type: 'test'
...
# Subtest: agents: a held role with nothing on the bus is idle; a role session gets the claim rows unchanged
ok 4 - agents: a held role with nothing on the bus is idle; a role session gets the claim rows unchanged
---
duration_ms: 38.328983
type: 'test'
...
# Subtest: agents: working counts what the holder received and has not read; routed alone is not working
ok 5 - agents: working counts what the holder received and has not read; routed alone is not working
---
duration_ms: 38.298959
type: 'test'
...
# Subtest: agents: input needed is the role's open decisions routed to the human, gated first, then oldest
ok 6 - agents: input needed is the role's open decisions routed to the human, gated first, then oldest
---
duration_ms: 64.332838
type: 'test'
...
# Subtest: agents: working wins over waiting, and Input needed still shows
ok 7 - agents: working wins over waiting, and Input needed still shows
---
duration_ms: 29.817744
type: 'test'
...
# Subtest: agents: a new holder doesn't inherit what the last one left unread; decisions stay with the role
ok 8 - agents: a new holder doesn't inherit what the last one left unread; decisions stay with the role
---
duration_ms: 34.014277
type: 'test'
...
# Subtest: agents: state reads only its own business, even for a run name both use
ok 9 - agents: state reads only its own business, even for a run name both use
---
duration_ms: 35.372875
type: 'test'
...
# Subtest: agents: a message the holder released unread is stranded; the next holder gets nothing and cannot read it
ok 10 - agents: a message the holder released unread is stranded; the next holder gets nothing and cannot read it
---
duration_ms: 39.395357
type: 'test'
...
# Subtest: agents: a message the holder read is not stranded; one the current holder has not read is not listed
ok 11 - agents: a message the holder read is not stranded; one the current holder has not read is not listed
---
duration_ms: 35.575247
type: 'test'
...
# Subtest: agents: stranded is oldest first and capped at 50 for a role
ok 12 - agents: stranded is oldest first and capped at 50 for a role
---
duration_ms: 185.02087
type: 'test'
...
# Subtest: agents: stranded is per role and per business
ok 13 - agents: stranded is per role and per business
---
duration_ms: 67.824081
type: 'test'
...
# Subtest: agents: a message routed to a held role and not yet received is not stranded
ok 14 - agents: a message routed to a held role and not yet received is not stranded
---
duration_ms: 28.960763
type: 'test'
...
# Subtest: REQ-DEC an approval outlives its run and a broker restart; a new run of the instance consumes it once
ok 15 - REQ-DEC an approval outlives its run and a broker restart; a new run of the instance consumes it once
---
duration_ms: 64.323783
type: 'test'
...
# Subtest: REQ-DEC another instance of the same definition cannot consume an approval, and its refusal consumes nothing
ok 16 - REQ-DEC another instance of the same definition cannot consume an approval, and its refusal consumes nothing
---
duration_ms: 32.010444
type: 'test'
...
# Subtest: REQ-DEC REQ-THREAD-1 a thread approval is consumed only by a run holding the same thread
ok 17 - REQ-DEC REQ-THREAD-1 a thread approval is consumed only by a run holding the same thread
---
duration_ms: 42.383168
type: 'test'
...
# Subtest: REQ-DEC a later run of the same instance supersedes an open decision; another instance cannot
ok 18 - REQ-DEC a later run of the same instance supersedes an open decision; another instance cannot
---
duration_ms: 37.635573
type: 'test'
...
# Subtest: REQ-DEC REQ-THREAD-1 a thread decision is superseded only from the same thread
ok 19 - REQ-DEC REQ-THREAD-1 a thread decision is superseded only from the same thread
---
duration_ms: 43.539331
type: 'test'
...
# Subtest: REQ-DEC REQ-THREAD-1 a thread instance decision raised before row 121 is not consumed or superseded by any thread run
ok 20 - REQ-DEC REQ-THREAD-1 a thread instance decision raised before row 121 is not consumed or superseded by any thread run
---
duration_ms: 60.773923
type: 'test'
...
# Subtest: launch identity is stamped, payload identity is refused and stale holder cannot send
ok 21 - launch identity is stamped, payload identity is refused and stale holder cannot send
---
duration_ms: 44.178317
type: 'test'
...
# Subtest: decision classes route from policy; gated resolution is human-only, choice and target must match
ok 22 - decision classes route from policy; gated resolution is human-only, choice and target must match
---
duration_ms: 51.548961
type: 'test'
...
# Subtest: claim exclusion, holder release, gated revoke and rerouting to a new holder are atomic
ok 23 - claim exclusion, holder release, gated revoke and rerouting to a new holder are atomic
---
duration_ms: 48.940635
type: 'test'
...
# Subtest: launch events require a human CLI capability; generic emit cannot forge authority events
ok 24 - launch events require a human CLI capability; generic emit cannot forge authority events
---
duration_ms: 28.748729
type: 'test'
...
# Subtest: within-role decisions close atomically and invalid options or blocking omissions refuse
ok 25 - within-role decisions close atomically and invalid options or blocking omissions refuse
---
duration_ms: 35.365806
type: 'test'
...
# Subtest: a recommendation that is not exactly one option key refuses invalid-recommendation after the options
ok 26 - a recommendation that is not exactly one option key refuses invalid-recommendation after the options
---
duration_ms: 49.796225
type: 'test'
...
# Subtest: observer capabilities read human inbox but cannot mutate or forge launch identity
ok 27 - observer capabilities read human inbox but cannot mutate or forge launch identity
---
duration_ms: 31.206399
type: 'test'
...
# Subtest: task action subjects and linked decision trail are complete and ordered
ok 28 - task action subjects and linked decision trail are complete and ordered
---
duration_ms: 46.795382
type: 'test'
...
# Subtest: launch binding is durable and reconnecting requires the identical trusted record
ok 29 - launch binding is durable and reconnecting requires the identical trusted record
---
duration_ms: 31.333838
type: 'test'
...
# Subtest: business isolation includes inherited object names and cross-business message references
ok 30 - business isolation includes inherited object names and cross-business message references
---
duration_ms: 38.314239
type: 'test'
...
# Subtest: authority never transfers between action, target, unresolved or replaced role holder; a later run of the instance keeps it
ok 31 - authority never transfers between action, target, unresolved or replaced role holder; a later run of the instance keeps it
---
duration_ms: 55.286451
type: 'test'
...
# Subtest: task projection uses schema current view, skipping earlier and equal-start polls
ok 32 - task projection uses schema current view, skipping earlier and equal-start polls
---
duration_ms: 28.71652
type: 'test'
...
# Subtest: revocation permanently bars the old run from reclaiming first, including after broker restart
ok 33 - revocation permanently bars the old run from reclaiming first, including after broker restart
---
duration_ms: 42.897945
type: 'test'
...
# Subtest: empty message references refuse before storage; refusal-evidence failure stays a typed error
ok 34 - empty message references refuse before storage; refusal-evidence failure stays a typed error
---
duration_ms: 28.973406
type: 'test'
...
# Subtest: both arbiters require human resolution when their cross-role route is themselves
ok 35 - both arbiters require human resolution when their cross-role route is themselves
---
duration_ms: 43.927014
type: 'test'
...
# Subtest: the shipped coder role raises task.reassign as gated to the human; task.scope.change stays cross-role
ok 36 - the shipped coder role raises task.reassign as gated to the human; task.scope.change stays cross-role
---
duration_ms: 37.833632
type: 'test'
...
# Subtest: S1 adapter takes resolved limits and refs, rejects mismatched instance, never mutates input
ok 37 - S1 adapter takes resolved limits and refs, rejects mismatched instance, never mutates input
---
duration_ms: 3.782898
type: 'test'
...
# Subtest: channel conversion preserves the four proof/transport byte baselines and modules cannot import a proof caller
ok 38 - channel conversion preserves the four proof/transport byte baselines and modules cannot import a proof caller
---
duration_ms: 2.027632
type: 'test'
...
# Subtest: channel recovery still requires the same shim path and rejects an absent or forged proof
ok 39 - channel recovery still requires the same shim path and rejects an absent or forged proof
---
duration_ms: 579.159567
type: 'test'
...
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# Subtest: REQ-COS-1, REQ-ROLE-2: the chief of staff ends a run with a reason and no decision, and the reason is logged
ok 40 - REQ-COS-1, REQ-ROLE-2: the chief of staff ends a run with a reason and no decision, and the reason is logged
---
duration_ms: 52.712228
type: 'test'
...
# Subtest: REQ-ROLE-2: a role without role.end still needs a resolved decision to revoke
ok 41 - REQ-ROLE-2: a role without role.end still needs a resolved decision to revoke
---
duration_ms: 50.682127
type: 'test'
...
# Subtest: REQ-ROLE-2: storage accepts a revoke with a reason or a decision and aborts one with neither
ok 42 - REQ-ROLE-2: storage accepts a revoke with a reason or a decision and aborts one with neither
---
duration_ms: 39.219538
type: 'test'
...
# Subtest: REQ-ROLE-2: the chief of staff may still cite a decision, and a decision alone is the old path
ok 43 - REQ-ROLE-2: the chief of staff may still cite a decision, and a decision alone is the old path
---
duration_ms: 41.655663
type: 'test'
...
# Subtest: REQ-ROLE-2: a role without role.end still ends a run through a resolved decision, which is recorded and has no reason
ok 44 - REQ-ROLE-2: a role without role.end still ends a run through a resolved decision, which is recorded and has no reason
---
duration_ms: 47.856533
type: 'test'
...
# Subtest: REQ-ROLE-2: a reason is required, bounded, and never sent with a decision
ok 45 - REQ-ROLE-2: a reason is required, bounded, and never sent with a decision
---
duration_ms: 58.392587
type: 'test'
...
# Subtest: REQ-COS-1: the chief of staff cannot end its own run; its end of the assistant stops the assistant's thread run
ok 46 - REQ-COS-1: the chief of staff cannot end its own run; its end of the assistant stops the assistant's thread run
---
duration_ms: 63.496067
type: 'test'
...
# Subtest: REQ-LIMIT-1, REQ-COS-1: organization.set from the chief of staff reaches the shared writer, named as the actor
ok 47 - REQ-LIMIT-1, REQ-COS-1: organization.set from the chief of staff reaches the shared writer, named as the actor
---
duration_ms: 49.67953
type: 'test'
...
# Subtest: REQ-LIMIT-1, REQ-COS-1: a refused organization.set logs action.refused and no action.allowed, like a refused limits.set
ok 48 - REQ-LIMIT-1, REQ-COS-1: a refused organization.set logs action.refused and no action.allowed, like a refused limits.set
---
duration_ms: 54.230996
type: 'test'
...
# Subtest: REQ-LIMIT-1: organization.set is refused for every caller whose role file lacks organization.change
ok 49 - REQ-LIMIT-1: organization.set is refused for every caller whose role file lacks organization.change
---
duration_ms: 61.282139
type: 'test'
...
# Subtest: REQ-LIMIT-1: the chief of staff is logged as allowed, and organization.set takes only the human's keys
ok 50 - REQ-LIMIT-1: the chief of staff is logged as allowed, and organization.set takes only the human's keys
---
duration_ms: 59.676238
type: 'test'
...
# Subtest: REQ-COS-1: organization.revision answers the revision alone to the chief of staff and spends nothing
ok 51 - REQ-COS-1: organization.revision answers the revision alone to the chief of staff and spends nothing
---
duration_ms: 56.838069
type: 'test'
...
# Subtest: REQ-COS-1, REQ-LIMIT-1: organization.revision is refused for every caller whose role file lacks organization.change
ok 52 - REQ-COS-1, REQ-LIMIT-1: organization.revision is refused for every caller whose role file lacks organization.change
---
duration_ms: 67.837202
type: 'test'
...
# Subtest: REQ-ROLE-3, REQ-LIMIT-1: a chief-of-staff change is validated, written and logged like a human's; an invalid one is refused
ok 53 - REQ-ROLE-3, REQ-LIMIT-1: a chief-of-staff change is validated, written and logged like a human's; an invalid one is refused
---
duration_ms: 174.155374
type: 'test'
...
# Subtest: REQ-COS-1: the chief of staff reads the revision, changes the file with it, and reads again after a stale one is refused
ok 54 - REQ-COS-1: the chief of staff reads the revision, changes the file with it, and reads again after a stale one is refused
---
duration_ms: 156.573985
type: 'test'
...
# Subtest: Q169: the chief of staff's change of the assistant is validated, written and logged; a stale or protection-stripping one is refused
ok 55 - Q169: the chief of staff's change of the assistant is validated, written and logged; a stale or protection-stripping one is refused
---
duration_ms: 168.630014
type: 'test'
...
# Subtest: row 65, Q169: the chief's change of the assistant's route runs the routing checks, and a valid one saves as the chief
ok 56 - row 65, Q169: the chief's change of the assistant's route runs the routing checks, and a valid one saves as the chief
---
duration_ms: 108.334199
type: 'test'
...
# Subtest: REQ-ROLE-2, REQ-COS-1: the 3c→3d migration lets the chief of staff end a held role with a reason; neither is still refused
ok 57 - REQ-ROLE-2, REQ-COS-1: the 3c→3d migration lets the chief of staff end a held role with a reason; neither is still refused
---
duration_ms: 104.252122
type: 'test'
...
# Subtest: row 194 T10: the chief's reason end of a kept instance refuses instance-kept, holds the claim and spends nothing
ok 58 - row 194 T10: the chief's reason end of a kept instance refuses instance-kept, holds the claim and spends nothing
---
duration_ms: 37.70828
type: 'test'
...
# Subtest: row 194 T10 (Q2): a role.revoke citing a decision the human resolved still ends a kept run
ok 59 - row 194 T10 (Q2): a role.revoke citing a decision the human resolved still ends a kept run
---
duration_ms: 36.289861
type: 'test'
...
# Subtest: row 194 T10 (B7): the chief's organization.set of a kept instance's model refuses before the writer; the human's limits.set does not
ok 60 - row 194 T10 (B7): the chief's organization.set of a kept instance's model refuses before the writer; the human's limits.set does not
---
duration_ms: 36.505927
type: 'test'
...
# Subtest: row 194 T13: organization.set and limits.set refuse the launch, retired, keep and noHire keys before the writer
ok 61 - row 194 T13: organization.set and limits.set refuse the launch, retired, keep and noHire keys before the writer
---
duration_ms: 45.636548
type: 'test'
...
# Subtest: row 194 T18 (D2.4): from a chief session veto.set and instances.set refuse, and nothing reaches the writer
ok 62 - row 194 T18 (D2.4): from a chief session veto.set and instances.set refuse, and nothing reaches the writer
---
duration_ms: 44.789531
type: 'test'
...
# Subtest: row 194 T8: the chief hires with a reason and no decision, the writer gets the reason as context, and the log names it
ok 63 - row 194 T8: the chief hires with a reason and no decision, the writer gets the reason as context, and the log names it
---
duration_ms: 41.602554
type: 'test'
...
# Subtest: row 194 T11: on a bus with two businesses, the chief of one hires and fires only in its own
ok 64 - row 194 T11: on a bus with two businesses, the chief of one hires and fires only in its own
---
duration_ms: 30.970717
type: 'test'
...
# Subtest: row 194 T8: hire and fire need a reason of 1 to 500 characters and refuse a decision key
ok 65 - row 194 T8: hire and fire need a reason of 1 to 500 characters and refuse a decision key
---
duration_ms: 58.381287
type: 'test'
...
# Subtest: row 194 T8 (sage-1471): only the chief hires or fires; every other role refuses role-not-chief, even one granted the actions
ok 66 - row 194 T8 (sage-1471): only the chief hires or fires; every other role refuses role-not-chief, even one granted the actions
---
duration_ms: 47.791631
type: 'test'
...
# Subtest: row 194 T8 (sage-1471): a chief whose authority lacks role.hire or role.fire refuses decision-required before the writer
ok 67 - row 194 T8 (sage-1471): a chief whose authority lacks role.hire or role.fire refuses decision-required before the writer
---
duration_ms: 77.460617
type: 'test'
...
# Subtest: row 194 T8a: a re-hire of a fired name goes to the writer like a hire, and the writer's refusals pass through by name
ok 68 - row 194 T8a: a re-hire of a fired name goes to the writer like a hire, and the writer's refusals pass through by name
---
duration_ms: 46.856004
type: 'test'
...
# Subtest: row 194 T8b: a definition is hireable only when every action is on HIRE_ALLOWED, it is version 2, the chief lists it and noHire doesn't
ok 69 - row 194 T8b: a definition is hireable only when every action is on HIRE_ALLOWED, it is version 2, the chief lists it and noHire doesn't
---
duration_ms: 1206.114415
type: 'test'
...
# Subtest: row 194 T8b: a hire without the role files configured refuses not-configured
ok 70 - row 194 T8b: a hire without the role files configured refuses not-configured
---
duration_ms: 36.12309
type: 'test'
...
# Subtest: row 194 T9: a fire revokes the claim, cancels open requests, asks the launcher to kill the runs, then delists and logs
ok 71 - row 194 T9: a fire revokes the claim, cancels open requests, asks the launcher to kill the runs, then delists and logs
---
duration_ms: 42.777708
type: 'test'
...
# Subtest: row 194 T9a (bus): a fire end's done writes lifecycle.end.killed and lifecycle.end.alive with run and pid, and an unknown stop's reason; a terminate's done or a bad stop refuses
ok 72 - row 194 T9a (bus): a fire end's done writes lifecycle.end.killed and lifecycle.end.alive with run and pid, and an unknown stop's reason; a terminate's done or a bad stop refuses
---
duration_ms: 45.890031
type: 'test'
...
# Subtest: row 194 T9: fire refusals come before step A and leave the claim, the requests and the file alone
ok 73 - row 194 T9: fire refusals come before step A and leave the claim, the requests and the file alone
---
duration_ms: 38.752647
type: 'test'
...
# Subtest: row 194 T9c: a writer failure at B leaves the instance firing, and the repeat delists and logs once
ok 74 - row 194 T9c: a writer failure at B leaves the instance firing, and the repeat delists and logs once
---
duration_ms: 44.400074
type: 'test'
...
# Subtest: row 194 T9c: a failure at C leaves the fire unlogged and the instance firing, and the repeat logs it
ok 75 - row 194 T9c: a failure at C leaves the fire unlogged and the instance firing, and the repeat logs it
---
duration_ms: 54.150345
type: 'test'
...
# Subtest: row 194 W-N1: a fire.done before a later fire.stopped of the same instance leaves it firing; another instance's done does not end it
ok 76 - row 194 W-N1: a fire.done before a later fire.stopped of the same instance leaves it firing; another instance's done does not end it
---
duration_ms: 40.995862
type: 'test'
...
# Subtest: row 194 T10: a hire or fire of a kept name refuses instance-kept before the writer
ok 77 - row 194 T10: a hire or fire of a kept name refuses instance-kept before the writer
---
duration_ms: 32.434591
type: 'test'
...
# Subtest: row 194 T10: a fire the writer's check refuses from the file stops nothing and leaves the instance launchable
ok 78 - row 194 T10: a fire the writer's check refuses from the file stops nothing and leaves the instance launchable
---
duration_ms: 37.540831
type: 'test'
...
# Subtest: row 194 T18: hire and fire take only their own keys, and a refused call writes nothing
ok 79 - row 194 T18: hire and fire take only their own keys, and a refused call writes nothing
---
duration_ms: 46.622258
type: 'test'
...
# Subtest: row 194 T8, T9, T18: through the runtime the chief hires and fires with the real writer, the receipt carries the reason, and a refusal leaves the file alone
ok 80 - row 194 T8, T9, T18: through the runtime the chief hires and fires with the real writer, the receipt carries the reason, and a refusal leaves the file alone
---
duration_ms: 115.111474
type: 'test'
...
# Subtest: row 194 W-N1: the launcher's take of a launch or regenerate of a firing instance closes it as instance-firing
ok 81 - row 194 W-N1: the launcher's take of a launch or regenerate of a firing instance closes it as instance-firing
---
duration_ms: 47.373657
type: 'test'
...
# Subtest: comment cursors isolate businesses, move only forward and remain append-only
ok 82 - comment cursors isolate businesses, move only forward and remain append-only
---
duration_ms: 33.881101
type: 'test'
...
# Subtest: only trusted sync writes validated cursors; events and cursor share rollback
ok 83 - only trusted sync writes validated cursors; events and cursor share rollback
---
duration_ms: 23.714339
type: 'test'
...
# Subtest: explicit 3b copy migration preserves evidence and opens as 3g; normal startup never migrates
ok 84 - explicit 3b copy migration preserves evidence and opens as 3g; normal startup never migrates
---
duration_ms: 118.177772
type: 'test'
...
# Subtest: migration refuses active writers and drifted legacy schemas, with no partial upgrade
ok 85 - migration refuses active writers and drifted legacy schemas, with no partial upgrade
---
duration_ms: 156.921504
type: 'test'
...
# Subtest: named migration registry chains 3b through 3g to a fixture-only future version in order
ok 86 - named migration registry chains 3b through 3g to a fixture-only future version in order
---
duration_ms: 143.862122
type: 'test'
...
# Subtest: migration refuses mismatched source metadata without changing schema or evidence
ok 87 - migration refuses mismatched source metadata without changing schema or evidence
---
duration_ms: 78.543596
type: 'test'
...
# Subtest: offline command migrates only the supplied fixture root and reports usage errors
ok 88 - offline command migrates only the supplied fixture root and reports usage errors
---
duration_ms: 266.403824
type: 'test'
...
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# Subtest: M6: a creative raise refuses decision-not-allowed, cited or not, and no decision row appears; the assistant still raises
ok 89 - M6: a creative raise refuses decision-not-allowed, cited or not, and no decision row appears; the assistant still raises
---
duration_ms: 58.635759
type: 'test'
...
# Subtest: a creative instance sends only to the user and hears only from the user
ok 90 - a creative instance sends only to the user and hears only from the user
---
duration_ms: 73.669855
type: 'test'
...
# Subtest: M10 through the broker: the chief and the tester are refused on bean, the human's limits.set of its models key works
ok 91 - M10 through the broker: the chief and the tester are refused on bean, the human's limits.set of its models key works
---
duration_ms: 145.891929
type: 'test'
...
# Subtest: row 256 T6 the human deletes a creative instance through the broker; the chief and the tester are refused at the verb
ok 92 - row 256 T6 the human deletes a creative instance through the broker; the chief and the tester are refused at the verb
---
duration_ms: 123.333811
type: 'test'
...
# Subtest: X4: register adds a store reference to the running bus, and issue then writes the key
ok 93 - X4: register adds a store reference to the running bus, and issue then writes the key
---
duration_ms: 27.132436
type: 'test'
...
# Subtest: X4: register runs the constructor's reference checks
ok 94 - X4: register runs the constructor's reference checks
---
duration_ms: 1.304309
type: 'test'
...
# Subtest: X4: register reads no file, so a key file left at the path stays unused, and a live token refuses
ok 95 - X4: register reads no file, so a key file left at the path stays unused, and a live token refuses
---
duration_ms: 16.761191
type: 'test'
...
# Subtest: X3, X4: unregister drops an entry with no token and refuses one with a live token
ok 96 - X3, X4: unregister drops an entry with no token and refuses one with a live token
---
duration_ms: 17.314933
type: 'test'
...
# Subtest: X5: a claim holds the slot, so a second claim and a host.run refuse host-busy until release
ok 97 - X5: a claim holds the slot, so a second claim and a host.run refuse host-busy until release
---
duration_ms: 9.540348
type: 'test'
...
# Subtest: X5: a claim made while a host.run is in flight refuses host-busy
ok 98 - X5: a claim made while a host.run is in flight refuses host-busy
---
duration_ms: 9.480625
type: 'test'
...
# Subtest: X5: a stale release leaves a later claim in place
ok 99 - X5: a stale release leaves a later claim in place
---
duration_ms: 0.634481
type: 'test'
...
# Subtest: X5: abortClaim aborts a live claim and says pending, and revoke's abort reaches a claim too
ok 100 - X5: abortClaim aborts a live claim and says pending, and revoke's abort reaches a claim too
---
duration_ms: 10.405744
type: 'test'
...
# Subtest: credentials gives human and reader sessions service, account, role, date and state, and nothing else
ok 101 - credentials gives human and reader sessions service, account, role, date and state, and nothing else
---
duration_ms: 31.093788
type: 'test'
...
# Subtest: credentials refuses a role session and any argument
ok 102 - credentials refuses a role session and any argument
---
duration_ms: 29.323192
type: 'test'
...
# Subtest: credentials reads the status on each request, and a broker without one lists none
ok 103 - credentials reads the status on each request, and a broker without one lists none
---
duration_ms: 40.713853
type: 'test'
...
# Subtest: the broker process answers credentials without a token, path or variable in its output, log or store
ok 104 - the broker process answers credentials without a token, path or variable in its output, log or store
---
duration_ms: 225.885569
type: 'test'
...
# Subtest: T1: a store reference with no file yet starts, and the agent is not-issued until issue
ok 105 - T1: a store reference with no file yet starts, and the agent is not-issued until issue
---
duration_ms: 8.513425
type: 'test'
...
# Subtest: T1: a store path the reference does not own, or no store root, refuses the reference
ok 106 - T1: a store path the reference does not own, or no store root, refuses the reference
---
duration_ms: 0.878608
type: 'test'
...
# Subtest: T1: a wrong mode on the store root, a business dir, an agent dir or the file refuses start
ok 107 - T1: a wrong mode on the store root, a business dir, an agent dir or the file refuses start
---
duration_ms: 5.15667
type: 'test'
...
# Subtest: T1: a missing store root refuses start; a missing {file} reference still refuses start
ok 108 - T1: a missing store root refuses start; a missing {file} reference still refuses start
---
duration_ms: 1.064331
type: 'test'
...
# Subtest: T1: a store file that is a directory or a symlink refuses start
ok 109 - T1: a store file that is a directory or a symlink refuses start
---
duration_ms: 1.293011
type: 'test'
...
# Subtest: T2: useFor keys from the session only
ok 110 - T2: useFor keys from the session only
---
duration_ms: 2.948905
type: 'test'
...
# Subtest: T5: issue, rotate, revoke and delete are live with no restart, and revoke holds across one
ok 111 - T5: issue, rotate, revoke and delete are live with no restart, and revoke holds across one
---
duration_ms: 7.737892
type: 'test'
...
# Subtest: T5: a failed commit leaves the token on disk but not in memory, and a bad token or date writes nothing
ok 112 - T5: a failed commit leaves the token on disk but not in memory, and a bad token or date writes nothing
---
duration_ms: 3.408542
type: 'test'
...
# Subtest: T5: revoke drops the token from memory before the unlink, so a failed unlink still leaves it revoked
ok 113 - T5: revoke drops the token from memory before the unlink, so a failed unlink still leaves it revoked
---
duration_ms: 3.27629
type: 'test'
...
# Subtest: T5: revoke of a {file} reference forgets the token and never unlinks the file
ok 114 - T5: revoke of a {file} reference forgets the token and never unlinks the file
---
duration_ms: 1.007153
type: 'test'
...
# Subtest: T5: delete refuses an agent dir holding anything but tokens
ok 115 - T5: delete refuses an agent dir holding anything but tokens
---
duration_ms: 2.729279
type: 'test'
...
# Subtest: D5: every credentials use( call site is on the allowlist
ok 116 - D5: every credentials use( call site is on the allowlist
---
duration_ms: 40.221728
type: 'test'
...
# Subtest: row 199: the lifecycle verbs refuse every session but the human, and the tester revokes only
ok 117 - row 199: the lifecycle verbs refuse every session but the human, and the tester revokes only
---
duration_ms: 63.387848
type: 'test'
...
# Subtest: T5: issue, rotate, revoke and delete are live, rewrite the business file and leave one receipt each, with no value anywhere
ok 118 - T5: issue, rotate, revoke and delete are live, rewrite the business file and leave one receipt each, with no value anywhere
---
duration_ms: 167.921762
type: 'test'
...
# Subtest: only validated broker references load; returned data and exceptions cannot expose a known token
ok 119 - only validated broker references load; returned data and exceptions cannot expose a known token
---
duration_ms: 3.53915
type: 'test'
...
# Subtest: bad file modes, symlinks, repository/data paths, malformed tokens and missing dates refuse
ok 120 - bad file modes, symlinks, repository/data paths, malformed tokens and missing dates refuse
---
duration_ms: 2.684388
type: 'test'
...
# Subtest: expiry refuses use and env references never become client data
ok 121 - expiry refuses use and env references never become client data
---
duration_ms: 0.872548
type: 'test'
...
# Subtest: S1 parsed service refs work, service mismatch refuses, Gitea rotation due is a warning state
ok 122 - S1 parsed service refs work, service mismatch refuses, Gitea rotation due is a warning state
---
duration_ms: 1.940839
type: 'test'
...
# Subtest: opaque tokens shorter than 16 characters refuse before use
ok 123 - opaque tokens shorter than 16 characters refuse before use
---
duration_ms: 0.445466
type: 'test'
...
# Subtest: each C-suite role file carries the same two lists: human, chief-of-staff, pm, cto
ok 124 - each C-suite role file carries the same two lists: human, chief-of-staff, pm, cto
---
duration_ms: 2.131128
type: 'test'
...
# Subtest: chief-executive-officer: messages to and from the user, chief of staff, pm and cto pass
ok 125 - chief-executive-officer: messages to and from the user, chief of staff, pm and cto pass
---
duration_ms: 87.580086
type: 'test'
...
# Subtest: chief-executive-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored
ok 126 - chief-executive-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored
---
duration_ms: 74.251697
type: 'test'
...
# Subtest: chief-executive-officer: another C-suite role isn't on the lists either
ok 127 - chief-executive-officer: another C-suite role isn't on the lists either
---
duration_ms: 66.018398
type: 'test'
...
# Subtest: chief-financial-officer: messages to and from the user, chief of staff, pm and cto pass
ok 128 - chief-financial-officer: messages to and from the user, chief of staff, pm and cto pass
---
duration_ms: 89.298756
type: 'test'
...
# Subtest: chief-financial-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored
ok 129 - chief-financial-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored
---
duration_ms: 88.665379
type: 'test'
...
# Subtest: chief-financial-officer: another C-suite role isn't on the lists either
ok 130 - chief-financial-officer: another C-suite role isn't on the lists either
---
duration_ms: 60.147288
type: 'test'
...
# Subtest: chief-information-officer: messages to and from the user, chief of staff, pm and cto pass
ok 131 - chief-information-officer: messages to and from the user, chief of staff, pm and cto pass
---
duration_ms: 82.905813
type: 'test'
...
# Subtest: chief-information-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored
ok 132 - chief-information-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored
---
duration_ms: 81.360533
type: 'test'
...
# Subtest: chief-information-officer: another C-suite role isn't on the lists either
ok 133 - chief-information-officer: another C-suite role isn't on the lists either
---
duration_ms: 78.548327
type: 'test'
...
# Subtest: chief-information-security-officer: messages to and from the user, chief of staff, pm and cto pass
ok 134 - chief-information-security-officer: messages to and from the user, chief of staff, pm and cto pass
---
duration_ms: 82.792194
type: 'test'
...
# Subtest: chief-information-security-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored
ok 135 - chief-information-security-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored
---
duration_ms: 78.50353
type: 'test'
...
# Subtest: chief-information-security-officer: another C-suite role isn't on the lists either
ok 136 - chief-information-security-officer: another C-suite role isn't on the lists either
---
duration_ms: 69.878212
type: 'test'
...
# Subtest: chief-marketing-officer: messages to and from the user, chief of staff, pm and cto pass
ok 137 - chief-marketing-officer: messages to and from the user, chief of staff, pm and cto pass
---
duration_ms: 71.911159
type: 'test'
...
# Subtest: chief-marketing-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored
ok 138 - chief-marketing-officer: a message to or from the coder, reviewer or assistant is refused and logged, and nothing is stored
---
duration_ms: 70.607138
type: 'test'
...
# Subtest: chief-marketing-officer: another C-suite role isn't on the lists either
ok 139 - chief-marketing-officer: another C-suite role isn't on the lists either
---
duration_ms: 66.253118
type: 'test'
...
# limits: {"event":"limit-reached","business":"demo","check":"daily-quota","export":"mayLaunch","subject":{"instance":"coder","provider":"anthropic","model":"opus","account":"jason-max"},"path":["tokens","daily","jason-max"],"limit":0,"count":0,"unknownTurns":0}
# usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"89a6ec2c-eeb9-4606-a109-24a8962f4d49","source":"@none","code":"baseline-unknown"}
# limits: {"event":"limit-reached","business":"demo","check":"daily-quota","export":"mustStop","subject":{"instance":"coder","provider":"anthropic","model":"opus","account":"jason-max"},"path":["tokens","daily","jason-max"],"limit":0,"count":0,"unknownTurns":1}
# usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"b9d09a24-3624-44e2-9f29-ef6143b36a67","source":"@none","code":"baseline-unknown"}
# Subtest: REQ-LIMIT-2 runtime: limits counts the daily quota, and mayLaunch refuses only the account at it
ok 140 - REQ-LIMIT-2 runtime: limits counts the daily quota, and mayLaunch refuses only the account at it
---
duration_ms: 206.272855
type: 'test'
...
# Subtest: REQ-LIMIT-4 runtime: a run bound with the account writes it on its usage records and stops at the quota
ok 141 - REQ-LIMIT-4 runtime: a run bound with the account writes it on its usage records and stops at the quota
---
duration_ms: 94.047764
type: 'test'
...
# Subtest: REQ-LIMIT-4 runtime: a run bound without an account records null and the daily quota never stops it
ok 142 - REQ-LIMIT-4 runtime: a run bound without an account records null and the daily quota never stops it
---
duration_ms: 84.728964
type: 'test'
...
# Subtest: REQ-LIMIT-4 bindLaunch keeps the account off session.launched, refuses one that is not an identifier, and takes null as none
ok 143 - REQ-LIMIT-4 bindLaunch keeps the account off session.launched, refuses one that is not an identifier, and takes null as none
---
duration_ms: 25.558362
type: 'test'
...
# Subtest: a human resolve sends the raising role one message from the human, and its request is the answer
ok 144 - a human resolve sends the raising role one message from the human, and its request is the answer
---
duration_ms: 55.596054
type: 'test'
...
# Subtest: a cross-role decision resolved by its arbiter comes from that role and run, with no request
ok 145 - a cross-role decision resolved by its arbiter comes from that role and run, with no request
---
duration_ms: 40.632611
type: 'test'
...
# Subtest: a human withdraw sends one message with the note
ok 146 - a human withdraw sends one message with the note
---
duration_ms: 42.473787
type: 'test'
...
# Subtest: a human seen before the close leaves the request on the close's answer, not the seen
ok 147 - a human seen before the close leaves the request on the close's answer, not the seen
---
duration_ms: 52.28658
type: 'test'
...
# Subtest: the raising run's withdraw, a supersede, a within-role raise and seen send nothing
ok 148 - the raising run's withdraw, a supersede, a within-role raise and seen send nothing
---
duration_ms: 60.98073
type: 'test'
...
# Subtest: refused closes send nothing: invalid-choice, decision-closed, not-resolver
ok 149 - refused closes send nothing: invalid-choice, decision-closed, not-resolver
---
duration_ms: 60.662489
type: 'test'
...
# Subtest: a raising role nobody holds at the close gets the message on the next claim
ok 150 - a raising role nobody holds at the close gets the message on the next claim
---
duration_ms: 49.971535
type: 'test'
...
# Subtest: a human DECISION send keeps its own instruction as the request, not a close's answer
ok 151 - a human DECISION send keeps its own instruction as the request, not a close's answer
---
duration_ms: 45.249477
type: 'test'
...
# Subtest: a cross-role raise whose arbiter the raiser does not hear from is refused and stores nothing
ok 152 - a cross-role raise whose arbiter the raiser does not hear from is refused and stores nothing
---
duration_ms: 54.978973
type: 'test'
...
# Subtest: a gated raise by a role that does not hear from the human is refused and stores nothing
ok 153 - a gated raise by a role that does not hear from the human is refused and stores nothing
---
duration_ms: 48.261512
type: 'test'
...
# Subtest: a route the raiser hears from is allowed, checked from the route to the raiser
ok 154 - a route the raiser hears from is allowed, checked from the route to the raiser
---
duration_ms: 61.248168
type: 'test'
...
# Subtest: a refused supersede withdraws nothing
ok 155 - a refused supersede withdraws nothing
---
duration_ms: 59.141768
type: 'test'
...
# Subtest: the assistant's within-role and gated raises still work
ok 156 - the assistant's within-role and gated raises still work
---
duration_ms: 62.488533
type: 'test'
...
# Subtest: roles lists open decisions routed to a role, and never the human inbox
ok 157 - roles lists open decisions routed to a role, and never the human inbox
---
duration_ms: 46.897416
type: 'test'
...
# Subtest: recent lists closed decisions of every route, newest close first, with how each closed
ok 158 - recent lists closed decisions of every route, newest close first, with how each closed
---
duration_ms: 52.999955
type: 'test'
...
# Subtest: recent gives the closing event as closed when the decision was seen first
ok 159 - recent gives the closing event as closed when the decision was seen first
---
duration_ms: 53.359045
type: 'test'
...
# Subtest: recent stops at RECENT rows
ok 160 - recent stops at RECENT rows
---
duration_ms: 167.967796
type: 'test'
...
# Subtest: every row is what trail already gives the same session for that id
ok 161 - every row is what trail already gives the same session for that id
---
duration_ms: 73.548319
type: 'test'
...
# Subtest: a role session can't list decisions, so it can't read another role's open decisions
ok 162 - a role session can't list decisions, so it can't read another role's open decisions
---
duration_ms: 71.376089
type: 'test'
...
# Subtest: decisions is a read: one business, strict arguments, nothing written
ok 163 - decisions is a read: one business, strict arguments, nothing written
---
duration_ms: 78.214897
type: 'test'
...
# Subtest: endLaunch writes session.ended, releases the run claim and kills its capabilities
ok 164 - endLaunch writes session.ended, releases the run claim and kills its capabilities
---
duration_ms: 41.143821
type: 'test'
...
# Subtest: endLaunch refuses an unknown run, a second end and a rebind of the ended run
ok 165 - endLaunch refuses an unknown run, a second end and a rebind of the ended run
---
duration_ms: 28.563474
type: 'test'
...
# Subtest: a restarted broker refuses to rebind an ended run; a refused rebind leaves the run unbound
ok 166 - a restarted broker refuses to rebind an ended run; a refused rebind leaves the run unbound
---
duration_ms: 31.89441
type: 'test'
...
# Subtest: endLaunch leaves a claim another run took alone
ok 167 - endLaunch leaves a claim another run took alone
---
duration_ms: 33.422092
type: 'test'
...
# Subtest: refuse records action.refused against the caller with the code only
ok 168 - refuse records action.refused against the caller with the code only
---
duration_ms: 25.889307
type: 'test'
...
# Subtest: launches off refuses role.launch with launch-revoked until launches on
ok 169 - launches off refuses role.launch with launch-revoked until launches on
---
duration_ms: 32.756534
type: 'test'
...
# Subtest: broker process: launch ops authorize role.launch, record refusals and end runs
ok 170 - broker process: launch ops authorize role.launch, record refusals and end runs
---
duration_ms: 285.015476
type: 'test'
...
# Subtest: X-G3: on scratch 1.27.1, a grant makes the user, mints, forks, checks reach, writes the file, and revoke deletes the token
ok 171 - X-G3: on scratch 1.27.1, a grant makes the user, mints, forks, checks reach, writes the file, and revoke deletes the token
---
duration_ms: 11980.994497
type: 'test'
...
# Subtest: versionAtLeast compares numbers and refuses a prerelease of 1.27.0
ok 172 - versionAtLeast compares numbers and refuses a prerelease of 1.27.0
---
duration_ms: 2.23461
type: 'test'
...
# Subtest: X-G1: a raise that fails a check refuses and stores nothing
ok 173 - X-G1: a raise that fails a check refuses and stores nothing
---
duration_ms: 110.628761
type: 'test'
...
# Subtest: X-G1: a creative role, a role without identity and a missing or due slot refuse at raise
ok 174 - X-G1: a creative role, a role without identity and a missing or due slot refuse at raise
---
duration_ms: 379.9152
type: 'test'
...
# Subtest: X-G2: admin set refuses each failed check and writes nothing, then writes the slot once
ok 175 - X-G2: admin set refuses each failed check and writes nothing, then writes the slot once
---
duration_ms: 302.642782
type: 'test'
...
# Subtest: X-G3 to X-G8: an approve makes the user, mints the token, forks, checks reach and writes the file, record and grant.applied
ok 176 - X-G3 to X-G8: an approve makes the user, mints the token, forks, checks reach and writes the file, record and grant.applied
---
duration_ms: 200.129256
type: 'test'
...
# Subtest: X-G4: a user this stack did not make, an admin, a disabled user and a remade user each refuse
ok 177 - X-G4: a user this stack did not make, an admin, a disabled user and a remade user each refuse
---
duration_ms: 450.024674
type: 'test'
...
# Subtest: X-G6 and X-G8: the user and mint steps are written before their calls, and each result after its call
ok 178 - X-G6 and X-G8: the user and mint steps are written before their calls, and each result after its call
---
duration_ms: 165.606059
type: 'test'
...
# Subtest: X-G4: a fork by the seat user of another repository than the project refuses fork-foreign
ok 179 - X-G4: a fork by the seat user of another repository than the project refuses fork-foreign
---
duration_ms: 161.83251
type: 'test'
...
# Subtest: X-G5: a failure after the mint deletes the token, unloads nothing it did not load and leaves no file
ok 180 - X-G5: a failure after the mint deletes the token, unloads nothing it did not load and leaves no file
---
duration_ms: 248.102631
type: 'test'
...
# Subtest: X-G5: a token delete that fails is left at Gitea, shown by status and taken by sweep
ok 181 - X-G5: a token delete that fails is left at Gitea, shown by status and taken by sweep
---
duration_ms: 183.617018
type: 'test'
...
# Subtest: X-G5: a mint that fails deletes by name, and a refusal at step 0 leaves the decision unspent
ok 182 - X-G5: a mint that fails deletes by name, and a refusal at step 0 leaves the decision unspent
---
duration_ms: 287.44018
type: 'test'
...
# Subtest: X-G5: an agent held for an unknown token is refused at step 0 with no Gitea call
ok 183 - X-G5: an agent held for an unknown token is refused at step 0 with no Gitea call
---
duration_ms: 93.73883
type: 'test'
...
# Subtest: X-G5 and X-G9 (step 7): a rotation whose old-token delete fails stays applied with the old id left
ok 184 - X-G5 and X-G9 (step 7): a rotation whose old-token delete fails stays applied with the old id left
---
duration_ms: 314.640033
type: 'test'
...
# Subtest: X-G10: in a rotation the store file holds the new token before the old one is deleted
ok 185 - X-G10: in a rotation the store file holds the new token before the old one is deleted
---
duration_ms: 241.279153
type: 'test'
...
# Subtest: X-G6: a rotation cut before the rename settles back at once, and the old token stays live
ok 186 - X-G6: a rotation cut before the rename settles back at once, and the old token stays live
---
duration_ms: 281.966917
type: 'test'
...
# Subtest: X-G6: a rotation whose step 8 write fails is settle-pending, and a restart settles it forward
ok 187 - X-G6: a rotation whose step 8 write fails is settle-pending, and a restart settles it forward
---
duration_ms: 436.598714
type: 'test'
...
# Subtest: X-G6: a restart settles an open rotation back when the file still holds the old token
ok 188 - X-G6: a restart settles an open rotation back when the file still holds the old token
---
duration_ms: 254.462195
type: 'test'
...
# Subtest: X-G6: a restart settles an open rotation forward when the file holds the new token
ok 189 - X-G6: a restart settles an open rotation forward when the file holds the new token
---
duration_ms: 236.777226
type: 'test'
...
# Subtest: X-G6: a 401 on the file token loses the grant: both tokens go, the record goes and memory unloads
ok 190 - X-G6: a 401 on the file token loses the grant: both tokens go, the record goes and memory unloads
---
duration_ms: 221.124125
type: 'test'
...
# Subtest: X-G6: a 403, 404, 500, a hang and a dropped socket each leave the rotation settle-pending with nothing deleted
ok 191 - X-G6: a 403, 404, 500, a hang and a dropped socket each leave the rotation settle-pending with nothing deleted
---
duration_ms: 1356.696759
type: 'test'
...
# Subtest: X-G6: a file token no grant minted is held; the next restart says so again; a revoke clears it and takes both ids
ok 192 - X-G6: a file token no grant minted is held; the next restart says so again; a revoke clears it and takes both ids
---
duration_ms: 172.360041
type: 'test'
...
# Subtest: N9: a revoke of an open rotation, then a restart: no settle, no Gitea call and no message
ok 193 - N9: a revoke of an open rotation, then a restart: no settle, no Gitea call and no message
---
duration_ms: 117.070696
type: 'test'
...
# Subtest: N9: a 404 on a delete by id counts as done
ok 194 - N9: a 404 on a delete by id counts as done
---
duration_ms: 112.776418
type: 'test'
...
# Subtest: X-G6: a restart undoes each step a killed child left, and spends an approved unspent decision
ok 195 - X-G6: a restart undoes each step a killed child left, and spends an approved unspent decision
---
duration_ms: 395.334169
type: 'test'
...
# Subtest: X-G6: a restart with no admin slot leaves the user an orphan and the token left
ok 196 - X-G6: a restart with no admin slot leaves the user an orphan and the token left
---
duration_ms: 49.644424
type: 'test'
...
# Subtest: X-G7: a change to the definition, identity, publish remotes or admin slot after the raise ends decision-mismatch
ok 197 - X-G7: a change to the definition, identity, publish remotes or admin slot after the raise ends decision-mismatch
---
duration_ms: 107.569903
type: 'test'
...
# Subtest: X-G7 and X-G9: an admin rotate voids open decisions, and rotate --finish deletes what was left
ok 198 - X-G7 and X-G9: an admin rotate voids open decisions, and rotate --finish deletes what was left
---
duration_ms: 114.077795
type: 'test'
...
# Subtest: X-G9: a rotate whose name is taken refuses and writes nothing; remove takes the slot away
ok 199 - X-G9: a rotate whose name is taken refuses and writes nothing; remove takes the slot away
---
duration_ms: 60.685806
type: 'test'
...
# Subtest: X-G9: a slot past its rotate-by date refuses a run at step 0, leaving the decision unspent
ok 200 - X-G9: a slot past its rotate-by date refuses a run at step 0, leaving the decision unspent
---
duration_ms: 48.421896
type: 'test'
...
# Subtest: X-G11: run refuses every caller but the human, an unapproved, a spent and a busy decision
ok 201 - X-G11: run refuses every caller but the human, an unapproved, a spent and a busy decision
---
duration_ms: 101.851082
type: 'test'
...
# Subtest: kill switch (plan :16): while halted the chief still reads grants.status, and an agent grants.revoke refuses
ok 202 - kill switch (plan :16): while halted the chief still reads grants.status, and an agent grants.revoke refuses
---
duration_ms: 105.865858
type: 'test'
...
# Subtest: X-G11: a revoke while the executor runs aborts it and the grant ends revoked
ok 203 - X-G11: a revoke while the executor runs aborts it and the grant ends revoked
---
duration_ms: 112.725766
type: 'test'
...
# Subtest: X-G11: a revoke unloads memory and removes the file before its Gitea delete
ok 204 - X-G11: a revoke unloads memory and removes the file before its Gitea delete
---
duration_ms: 131.212674
type: 'test'
...
# Subtest: X-G11: a revoke during a rotation step 7 ends it revoked, and step 8 writes no record back
ok 205 - X-G11: a revoke during a rotation step 7 ends it revoked, and step 8 writes no record back
---
duration_ms: 177.726875
type: 'test'
...
# Subtest: X-G11: a revoke while a sweep settles a rotation, forward or back, ends it revoked with no record
ok 206 - X-G11: a revoke while a sweep settles a rotation, forward or back, ends it revoked with no record
---
duration_ms: 335.375955
type: 'test'
...
# Subtest: X-G11: a revoke during a settle whoami that finds a foreign token ends it revoked, not held
ok 207 - X-G11: a revoke during a settle whoami that finds a foreign token ends it revoked, not held
---
duration_ms: 167.174846
type: 'test'
...
# Subtest: X-G11: a revoke during a settle whoami that gets a 401 ends it revoked, not lost
ok 208 - X-G11: a revoke during a settle whoami that gets a 401 ends it revoked, not lost
---
duration_ms: 155.618979
type: 'test'
...
# Subtest: X-G12: a token that reaches wider than its forks fails with the repository named
ok 209 - X-G12: a token that reaches wider than its forks fails with the repository named
---
duration_ms: 362.868605
type: 'test'
...
# Subtest: X-G12: reach is paged by X-Total-Count and a count that does not add up refuses
ok 210 - X-G12: reach is paged by X-Total-Count and a count that does not add up refuses
---
duration_ms: 215.871587
type: 'test'
...
# Subtest: X-G13: an agent cannot record a grant event, and the trigger refuses one from any writer but the grant writer
ok 211 - X-G13: an agent cannot record a grant event, and the trigger refuses one from any writer but the grant writer
---
duration_ms: 38.146662
type: 'test'
...
# Subtest: X-G14: credentials delete fires the user: tokens go, login is prohibited, and grant.revoke.closed records it
ok 212 - X-G14: credentials delete fires the user: tokens go, login is prohibited, and grant.revoke.closed records it
---
duration_ms: 246.407069
type: 'test'
...
# Subtest: X-G14: a fire whose token delete or login PATCH fails lands it in serviceLeft
ok 213 - X-G14: a fire whose token delete or login PATCH fails lands it in serviceLeft
---
duration_ms: 127.049298
type: 'test'
...
# Subtest: X-G14: a fire whose user is gone or remade skips the fire steps and says why
ok 214 - X-G14: a fire whose user is gone or remade skips the fire steps and says why
---
duration_ms: 224.811113
type: 'test'
...
# Subtest: X-G14: a sweep retries a fire only for the user it fired: a remade or gone user is skipped and named
ok 215 - X-G14: a sweep retries a fire only for the user it fired: a remade or gone user is skipped and named
---
duration_ms: 252.455114
type: 'test'
...
# Subtest: X-G14: a revoke Gitea cannot reach stays open, and a restart closes it
ok 216 - X-G14: a revoke Gitea cannot reach stays open, and a restart closes it
---
duration_ms: 151.994145
type: 'test'
...
# Subtest: X-G15: look-alike commit steps outside the grant writer are ignored at start, by revoke and by status
ok 217 - X-G15: look-alike commit steps outside the grant writer are ignored at start, by revoke and by status
---
duration_ms: 135.085662
type: 'test'
...
# Subtest: X-G15: a look-alike spend under another kind with the grant writer pair is not an open grant
ok 218 - X-G15: a look-alike spend under another kind with the grant writer pair is not an open grant
---
duration_ms: 43.609032
type: 'test'
...
# Subtest: status lists the slot, users, grants and nothing secret, and every grants verb needs service gitea
ok 219 - status lists the slot, users, grants and nothing secret, and every grants verb needs service gitea
---
duration_ms: 108.536447
type: 'test'
...
# Subtest: 3j copy migrates to 3k: every row kept, and sqlite_master gains only the two tables and their keys
ok 220 - 3j copy migrates to 3k: every row kept, and sqlite_master gains only the two tables and their keys
---
duration_ms: 143.603712
type: 'test'
...
# Subtest: a 3j→3k step that fails partway leaves the store at 3j with every row and the schema intact
ok 221 - a 3j→3k step that fails partway leaves the store at 3j with every row and the schema intact
---
duration_ms: 195.882352
type: 'test'
...
# Subtest: the 3j engine refuses a 3k store, migrating or not, and leaves it at 3k
ok 222 - the 3j engine refuses a 3k store, migrating or not, and leaves it at 3k
---
duration_ms: 157.21723
type: 'test'
...
# Subtest: gitea_users: one user per business and agent, an id above 0, a 16-hex nonce and a real decision
ok 223 - gitea_users: one user per business and agent, an id above 0, a 16-hex nonce and a real decision
---
duration_ms: 21.483423
type: 'test'
...
# Subtest: gitea_grants: one grant per agent, a projects array, a token id above 0, and only for a recorded user
ok 224 - gitea_grants: one grant per agent, a projects array, a token id above 0, and only for a recorded user
---
duration_ms: 23.423051
type: 'test'
...
# Subtest: G1, A1: only the chief raises a grant, and a refused raise stores nothing and runs no keyscan
ok 225 - G1, A1: only the chief raises a grant, and a refused raise stores nothing and runs no keyscan
---
duration_ms: 55.890444
type: 'test'
...
# Subtest: G1: grant goes only with credential.mint, row a takes only host-enroll, and E1 refuses each bad field
ok 226 - G1: grant goes only with credential.mint, row a takes only host-enroll, and E1 refuses each bad field
---
duration_ms: 96.8939
type: 'test'
...
# Subtest: G5, A5, A6: the scanned key set must equal the requested set, or host-key-mismatch and nothing stored
ok 227 - G5, A5, A6: the scanned key set must equal the requested set, or host-key-mismatch and nothing stored
---
duration_ms: 70.452114
type: 'test'
...
# Subtest: G4 (host-enroll block, M1): the broker appends the keys, fingerprints and sudo line, and the cap counts the block
ok 228 - G4 (host-enroll block, M1): the broker appends the keys, fingerprints and sudo line, and the cap counts the block
---
duration_ms: 54.773044
type: 'test'
...
# Subtest: G6, X1: the human's cli yes starts enrollment, which writes the record, the key file and the events in order
ok 229 - G6, X1: the human's cli yes starts enrollment, which writes the record, the key file and the events in order
---
duration_ms: 72.380455
type: 'test'
...
# Subtest: A2, A4: a credential.mint without grant, and a no, start nothing
ok 230 - A2, A4: a credential.mint without grant, and a no, start nothing
---
duration_ms: 252.584588
type: 'test'
...
# Subtest: A3, X1: a resolve by the tester or an agent starts nothing
ok 231 - A3, X1: a resolve by the tester or an agent starts nothing
---
duration_ms: 278.366785
type: 'test'
...
# Subtest: G6 (duckworth-0081 B3): a withdraw by the chief or the human, and an arbiter resolve, start nothing
ok 232 - G6 (duckworth-0081 B3): a withdraw by the chief or the human, and an arbiter resolve, start nothing
---
duration_ms: 251.466995
type: 'test'
...
# Subtest: G10 (duckworth-0081 B1): a second start for a spent decision refuses decision-consumed, and an unresolved or agent-resolved one not-authorized
ok 233 - G10 (duckworth-0081 B1): a second start for a spent decision refuses decision-consumed, and an unresolved or agent-resolved one not-authorized
---
duration_ms: 72.80512
type: 'test'
...
# Subtest: A8, S1: two approved enrollments for one host: the second ends host-enrolled and the pin stays
ok 234 - A8, S1: two approved enrollments for one host: the second ends host-enrolled and the pin stays
---
duration_ms: 95.55994
type: 'test'
...
# Subtest: A9: the hosts primary key refuses a second record for (business, host)
ok 235 - A9: the hosts primary key refuses a second record for (business, host)
---
duration_ms: 41.920743
type: 'test'
...
# Subtest: X3: a failure at step 2 deletes the record again and ends grant.failed, with no key file
ok 236 - X3: a failure at step 2 deletes the record again and ends grant.failed, with no key file
---
duration_ms: 64.1885
type: 'test'
...
# Subtest: A10, X3: at start a resolved, unspent enrollment is spent and ends interrupted, and never runs late
ok 237 - A10, X3: at start a resolved, unspent enrollment is spent and ends interrupted, and never runs late
---
duration_ms: 47.176098
type: 'test'
...
# Subtest: X3: at start an enrollment that stopped after its registry step loses its record and key file
ok 238 - X3: at start an enrollment that stopped after its registry step loses its record and key file
---
duration_ms: 63.716801
type: 'test'
...
# Subtest: G24 first sentence, M2, A12: tags are mosaic- and 32 hex, and differ by business, agent and host
ok 239 - G24 first sentence, M2, A12: tags are mosaic- and 32 hex, and differ by business, agent and host
---
duration_ms: 0.454843
type: 'test'
...
# Subtest: E4: hosts.check sets the record ready and records grant.host.checked; a non-zero list leaves it pending
ok 240 - E4: hosts.check sets the record ready and records grant.host.checked; a non-zero list leaves it pending
---
duration_ms: 71.870355
type: 'test'
...
# Subtest: G20 (duckworth-0081 B3): the human's hosts.check marks the host ready, and the reader refuses
ok 241 - G20 (duckworth-0081 B3): the human's hosts.check marks the host ready, and the reader refuses
---
duration_ms: 75.398341
type: 'test'
...
# Subtest: G18 (duckworth-0081 B2), broker half: a check refused host-key-mismatch leaves the host pending-install with no grant.host.checked
ok 242 - G18 (duckworth-0081 B2), broker half: a check refused host-key-mismatch leaves the host pending-install with no grant.host.checked
---
duration_ms: 60.741549
type: 'test'
...
# Subtest: E4: a check whose installer fingerprint differs from the record refuses host-changed
ok 243 - E4: a check whose installer fingerprint differs from the record refuses host-changed
---
duration_ms: 57.819647
type: 'test'
...
# Subtest: E4, G21: hosts.remove is the human's or the tester's, deletes the key and the record, and records grant.host.removed
ok 244 - E4, G21: hosts.remove is the human's or the tester's, deletes the key and the record, and records grant.host.removed
---
duration_ms: 65.798613
type: 'test'
...
# Subtest: G21, F1, F2, M4, A22: hosts.remove refuses host-line-left on a guarded hostLineLeft, and ignores look-alikes
ok 245 - G21, F1, F2, M4, A22: hosts.remove refuses host-line-left on a guarded hostLineLeft, and ignores look-alikes
---
duration_ms: 66.497946
type: 'test'
...
# Subtest: hosts.remove refuses host-in-use while a grant record names the host
ok 246 - hosts.remove refuses host-in-use while a grant record names the host
---
duration_ms: 62.188101
type: 'test'
...
# Subtest: the grant writer refuses a body outside section 7's shape
ok 247 - the grant writer refuses a body outside section 7's shape
---
duration_ms: 34.68249
type: 'test'
...
# Subtest: recordEvent refuses reserved-event for a grant.* action or operation
ok 248 - recordEvent refuses reserved-event for a grant.* action or operation
---
duration_ms: 35.844116
type: 'test'
...
# Subtest: row 280: an occupied TCP port is attempted, refused, and retried with our sshd
ok 249 - row 280: an occupied TCP port is attempted, refused, and retried with our sshd
---
duration_ms: 107.566439
type: 'test'
...
# Subtest: row 280: every injected picker sample is unprivileged and outside the ephemeral range
ok 250 - row 280: every injected picker sample is unprivileged and outside the ephemeral range
---
duration_ms: 0.540978
type: 'test'
...
# Subtest: G7: an Approve installs the tagged line, logs in with the new key, and writes the key file, record and grant.applied
ok 251 - G7: an Approve installs the tagged line, logs in with the new key, and writes the key file, record and grant.applied
---
duration_ms: 822.773358
type: 'test'
...
# Subtest: G7: a commands change on a live grant updates the record in one transaction and keeps the key and line
ok 252 - G7: a commands change on a live grant updates the record in one transaction and keeps the key and line
---
duration_ms: 614.004262
type: 'test'
...
# Subtest: G8: a failure at install or verify removes the line and leaves no record, key file or reference
ok 253 - G8: a failure at install or verify removes the line and leaves no record, key file or reference
---
duration_ms: 1752.033982
type: 'test'
...
# Subtest: G8: a failed remove adds hostLineLeft and tells the human to sweep
ok 254 - G8: a failed remove adds hostLineLeft and tells the human to sweep
---
duration_ms: 809.800716
type: 'test'
...
# Subtest: G8: a failure in step 5 before commit unlinks the key file, drops the reference and removes the line
ok 255 - G8: a failure in step 5 before commit unlinks the key file, drops the reference and removes the line
---
duration_ms: 739.561082
type: 'test'
...
# Subtest: G8: a store fault in the commit transaction ends host-failed with no record, key file, reference or line
ok 256 - G8: a store fault in the commit transaction ends host-failed with no record, key file, reference or line
---
duration_ms: 729.610494
type: 'test'
...
# Subtest: G8: a failed step 1 check spends the decision and runs nothing remote
ok 257 - G8: a failed step 1 check spends the decision and runs nothing remote
---
duration_ms: 87.550307
type: 'test'
...
# Subtest: G9: a registry, definition or commands change between raise and Approve ends decision-mismatch before any remote step
ok 258 - G9: a registry, definition or commands change between raise and Approve ends decision-mismatch before any remote step
---
duration_ms: 529.719172
type: 'test'
...
# Subtest: G9: an agent no longer a role or no longer declaring host ends with its code, spent
ok 259 - G9: an agent no longer a role or no longer declaring host ends with its code, spent
---
duration_ms: 67.130847
type: 'test'
...
# Subtest: G10: a second start refuses decision-consumed, and an unresolved or agent-resolved decision not-authorized, writing nothing
ok 260 - G10: a second start refuses decision-consumed, and an unresolved or agent-resolved decision not-authorized, writing nothing
---
duration_ms: 514.680491
type: 'test'
...
# Subtest: G15: no event, message or decision holds the private key
ok 261 - G15: no event, message or decision holds the private key
---
duration_ms: 507.032927
type: 'test'
...
# Subtest: G23: a revoke during install ends grant.failed revoked with no key file, no grant and no line
ok 262 - G23: a revoke during install ends grant.failed revoked with no key file, no grant and no line
---
duration_ms: 523.344859
type: 'test'
...
# Subtest: G23 (row 249): an add that writes after an abort's remove leaves hostLineLeft until the sweep
ok 263 - G23 (row 249): an add that writes after an abort's remove leaves hostLineLeft until the sweep
---
duration_ms: 852.989951
type: 'test'
...
# Subtest: G23 (row 249): an add that writes after a timed-out install's remove leaves hostLineLeft until the sweep
ok 264 - G23 (row 249): an add that writes after a timed-out install's remove leaves hostLineLeft until the sweep
---
duration_ms: 854.016433
type: 'test'
...
# Subtest: G23: a revoke recorded after the raise and before the start ends step 1 revoked, and a held slot ends host-busy
ok 265 - G23: a revoke recorded after the raise and before the start ends step 1 revoked, and a held slot ends host-busy
---
duration_ms: 503.953697
type: 'test'
...
# Subtest: G24: names at 64 characters with . and _ give distinct tags of the fixed length
ok 266 - G24: names at 64 characters with . and _ give distinct tags of the fixed length
---
duration_ms: 0.392938
type: 'test'
...
# Subtest: G11: a restart after install removes the line, then ends interrupted with the tag, holding the slot until then
ok 267 - G11: a restart after install removes the line, then ends interrupted with the tag, holding the slot until then
---
duration_ms: 217.824989
type: 'test'
...
# Subtest: G11: a restart after a new key's commit, with the key file written, ends with no key file, record, reference or line
ok 268 - G11: a restart after a new key's commit, with the key file written, ends with no key file, record, reference or line
---
duration_ms: 216.005234
type: 'test'
...
# Subtest: G11: a restart after a commands change's commit leaves the record as it was and asks nothing of the host
ok 269 - G11: a restart after a commands change's commit leaves the record as it was and asks nothing of the host
---
duration_ms: 510.005128
type: 'test'
...
# Subtest: G11 (B2): a restart before step 1, spent or not yet spent, ends interrupted and nothing runs later
ok 270 - G11 (B2): a restart before step 1, spent or not yet spent, ends interrupted and nothing runs later
---
duration_ms: 64.888365
type: 'test'
...
# Subtest: G11: a remote undo that fails ends interrupted with hostLineLeft and the sweep hint
ok 271 - G11: a remote undo that fails ends interrupted with hostLineLeft and the sweep hint
---
duration_ms: 265.197823
type: 'test'
...
# Subtest: G11: a restart leaves a finished grant alone, and the reconcile adds nothing for it
ok 272 - G11: a restart leaves a finished grant alone, and the reconcile adds nothing for it
---
duration_ms: 515.133503
type: 'test'
...
# Subtest: N1 (G27): the start sweep unlinks host.<id> files with no record in loaded businesses only, and refuses a store dir that is not private
ok 273 - N1 (G27): the start sweep unlinks host.<id> files with no record in loaded businesses only, and refuses a store dir that is not private
---
duration_ms: 6.614579
type: 'test'
...
# Subtest: G12: the human's hosts.revoke deletes the record, the key file, the reference and the line, with a closed marker
ok 274 - G12: the human's hosts.revoke deletes the record, the key file, the reference and the line, with a closed marker
---
duration_ms: 647.396292
type: 'test'
...
# Subtest: G12 (N4): a revoke with no record still removes the computed tag's line, with granted false; bad args refuse
ok 275 - G12 (N4): a revoke with no record still removes the computed tag's line, with granted false; bad args refuse
---
duration_ms: 224.453208
type: 'test'
...
# Subtest: G13: a revoke during install aborts the executor, which ends revoked, and the line goes
ok 276 - G13: a revoke during install aborts the executor, which ends revoked, and the line goes
---
duration_ms: 569.306219
type: 'test'
...
# Subtest: G26: the human, the assistant and the tester revoke; the chief and a pm refuse; sweep is the human's or the tester's
ok 277 - G26: the human, the assistant and the tester revoke; the chief and a pm refuse; sweep is the human's or the tester's
---
duration_ms: 512.040456
type: 'test'
...
# Subtest: G27: a restart after step 1 sweeps the key file and runs step 3 once the bus is up; status shows the revoke until then
ok 278 - G27: a restart after step 1 sweeps the key file and runs step 3 once the bus is up; status shows the revoke until then
---
duration_ms: 649.894395
type: 'test'
...
# Subtest: G27: after step 2 with the host down, the restart closes the marker with hostLineLeft; a marker without a revoke id is not reopened
ok 279 - G27: after step 2 with the host down, the restart closes the marker with hostLineLeft; a marker without a revoke id is not reopened
---
duration_ms: 962.351355
type: 'test'
...
# Subtest: G27: a key file a revoke could not unlink is reported left and goes at the next start
ok 280 - G27: a key file a revoke could not unlink is reported left and goes at the next start
---
duration_ms: 656.712961
type: 'test'
...
# Subtest: G28: a commands change, then a revoke, then a restart leave no record, key, reference or line
ok 281 - G28: a commands change, then a revoke, then a restart leave no record, key, reference or line
---
duration_ms: 702.32506
type: 'test'
...
# Subtest: G24 (B4): hosts.sweep removes only this business's recorded tags no live grant holds, and records what it left
ok 282 - G24 (B4): hosts.sweep removes only this business's recorded tags no live grant holds, and records what it left
---
duration_ms: 996.329202
type: 'test'
...
# Subtest: G12: the local steps finish before the host step, so a host that hangs leaves the agent no access
ok 283 - G12: the local steps finish before the host step, so a host that hangs leaves the agent no access
---
duration_ms: 690.233744
type: 'test'
...
# Subtest: G23 (X5): a revoke right after the spend reaches the executor's claim, so the grant ends revoked
ok 284 - G23 (X5): a revoke right after the spend reaches the executor's claim, so the grant ends revoked
---
duration_ms: 214.701651
type: 'test'
...
# Subtest: G23 (X5): a revoke that lands as verify returns ends revoked with no record, key file or line
ok 285 - G23 (X5): a revoke that lands as verify returns ends revoked with no record, key file or line
---
duration_ms: 647.616184
type: 'test'
...
# Subtest: G13: a revoke whose host remove fails still drops the record and key, and reports the line left for a sweep
ok 286 - G13: a revoke whose host remove fails still drops the record and key, and reports the line left for a sweep
---
duration_ms: 655.955839
type: 'test'
...
# Subtest: G22: enroll, check, grant, host.run, a commands change the next host.run uses, and a revoke that kills a run in flight
ok 287 - G22: enroll, check, grant, host.run, a commands change the next host.run uses, and a revoke that kills a run in flight
---
duration_ms: 1165.211787
type: 'test'
...
# Subtest: mos-1163: a grant whose agent became a creative role after the raise ends host-creative-role at step 1, spent, with nothing remote
ok 288 - mos-1163: a grant whose agent became a creative role after the raise ends host-creative-role at step 1, spent, with nothing remote
---
duration_ms: 61.61952
type: 'test'
...
# Subtest: sage-1908: once the agent of an applied grant is a creative role, host.run refuses host-creative-role, runs nothing remote and keeps the record
ok 289 - sage-1908: once the agent of an applied grant is a creative role, host.run refuses host-creative-role, runs nothing remote and keeps the record
---
duration_ms: 493.679582
type: 'test'
...
# Subtest: G1 (host): only the chief raises a host grant, a grant on any other action refuses, and nothing is stored
ok 290 - G1 (host): only the chief raises a host grant, a grant on any other action refuses, and nothing is stored
---
duration_ms: 59.754544
type: 'test'
...
# Subtest: G1, R4: the grant takes exactly method, agent, host, commands and rotateBy, and an unknown method refuses
ok 291 - G1, R4: the grant takes exactly method, agent, host, commands and rotateBy, and an unknown method refuses
---
duration_ms: 80.984473
type: 'test'
...
# Subtest: row 236 (\#1742): a gitea grant on a broker with no Gitea path refuses gitea-not-configured, and nothing is stored
ok 292 - row 236 (\#1742): a gitea grant on a broker with no Gitea path refuses gitea-not-configured, and nothing is stored
---
duration_ms: 44.637084
type: 'test'
...
# Subtest: G2: an agent whose definition lacks host refuses host-not-declared, and an unknown agent unknown-role
ok 293 - G2: an agent whose definition lacks host refuses host-not-declared, and an unknown agent unknown-role
---
duration_ms: 52.511999
type: 'test'
...
# Subtest: mos-1163: a grant whose agent is a creative role refuses host-creative-role, even when its definition declares host
ok 294 - mos-1163: a grant whose agent is a creative role refuses host-creative-role, even when its definition declares host
---
duration_ms: 37.316051
type: 'test'
...
# Subtest: G3: wildcard, shell, empty and other 210 D6 argv prefixes refuse invalid-request
ok 295 - G3: wildcard, shell, empty and other 210 D6 argv prefixes refuse invalid-request
---
duration_ms: 81.957029
type: 'test'
...
# Subtest: R4 rotateBy (sage-1782): a real calendar day after today UTC, or invalid-request
ok 296 - R4 rotateBy (sage-1782): a real calendar day after today UTC, or invalid-request
---
duration_ms: 66.627222
type: 'test'
...
# Subtest: G19: a grant naming a host that is pending-install refuses host-not-ready, and an unknown host host-unknown
ok 297 - G19: a grant naming a host that is pending-install refuses host-not-ready, and an unknown host host-unknown
---
duration_ms: 48.000553
type: 'test'
...
# Subtest: R4, G5: the raise routes to the human and its event body binds the eight fields with their hashes
ok 298 - R4, G5: the raise routes to the human and its event body binds the eight fields with their hashes
---
duration_ms: 40.615605
type: 'test'
...
# Subtest: G4 (host block): the broker appends the host, each prefix, the rotate date and new key or change
ok 299 - G4 (host block): the broker appends the host, each prefix, the rotate date and new key or change
---
duration_ms: 72.018281
type: 'test'
...
# Subtest: 3i copy migrates to 3j: every row kept, and sqlite_master gains only the two tables, their keys and the guard
ok 300 - 3i copy migrates to 3j: every row kept, and sqlite_master gains only the two tables, their keys and the guard
---
duration_ms: 174.094348
type: 'test'
...
# Subtest: a 3i→3j step that fails partway leaves the store at 3i with every row and the schema intact
ok 301 - a 3i→3j step that fails partway leaves the store at 3i with every row and the schema intact
---
duration_ms: 150.486189
type: 'test'
...
# Subtest: the 3i engine refuses a 3j store, migrating or not, and leaves it at 3j
ok 302 - the 3i engine refuses a 3j store, migrating or not, and leaves it at 3j
---
duration_ms: 150.96455
type: 'test'
...
# Subtest: A22b, sage-1703: a session-written grant.* row from before the step survives it, and the grant readers ignore it
ok 303 - A22b, sage-1703: a session-written grant.* row from before the step survives it, and the grant readers ignore it
---
duration_ms: 160.21291
type: 'test'
...
# Subtest: the guard: a grant.* action or operation on action.allowed needs the (NULL, grant) actor
ok 304 - the guard: a grant.* action or operation on action.allowed needs the (NULL, grant) actor
---
duration_ms: 29.770739
type: 'test'
...
# Subtest: hosts: one record per business and host, a ready host has its installer and check, grants need the host
ok 305 - hosts: one record per business and host, a ready host has its installer and check, grants need the host
---
duration_ms: 20.743685
type: 'test'
...
# Subtest: REQ-WAIT-1: the broker hard waits are exactly the list, and match the business vocabulary
ok 306 - REQ-WAIT-1: the broker hard waits are exactly the list, and match the business vocabulary
---
duration_ms: 2.22095
type: 'test'
...
# Subtest: REQ-WAIT-2: a business granting a hard wait at either class is refused; the actions that left are grantable
ok 307 - REQ-WAIT-2: a business granting a hard wait at either class is refused; the actions that left are grantable
---
duration_ms: 38.58539
type: 'test'
...
# Subtest: REQ-DEC-2: every hard wait goes to the human, cited or not, and the arbiter cannot resolve it
ok 308 - REQ-DEC-2: every hard wait goes to the human, cited or not, and the arbiter cannot resolve it
---
duration_ms: 844.96433
type: 'test'
...
# Subtest: REQ-DEC-2: a gated raise citing the current spec goes to the arbiter for its domain; uncited, to the human
ok 309 - REQ-DEC-2: a gated raise citing the current spec goes to the arbiter for its domain; uncited, to the human
---
duration_ms: 300.866206
type: 'test'
...
# Subtest: REQ-DEC-2: an arbiter-approved cited gated decision authorizes the raiser, and the human cannot resolve it
ok 310 - REQ-DEC-2: an arbiter-approved cited gated decision authorizes the raiser, and the human cannot resolve it
---
duration_ms: 89.395517
type: 'test'
...
# Subtest: REQ-DEC-2: a cited merge raised by merge-gate goes to the technical arbiter; a merge raised without the grant routes by citation
ok 311 - REQ-DEC-2: a cited merge raised by merge-gate goes to the technical arbiter; a merge raised without the grant routes by citation
---
duration_ms: 122.410366
type: 'test'
...
# Subtest: REQ-DEC-2: a stale or unconfirmed citation refuses without a decision; an arbiter raising its own goes to the human
ok 312 - REQ-DEC-2: a stale or unconfirmed citation refuses without a decision; an arbiter raising its own goes to the human
---
duration_ms: 195.393496
type: 'test'
...
# Subtest: Q169: the chief of staff's end of the assistant stops every thread run; its own run and another ender's are refused
ok 313 - Q169: the chief of staff's end of the assistant stops every thread run; its own run and another ender's are refused
---
duration_ms: 76.157781
type: 'test'
...
# Subtest: Q169: a revoke of the assistant the chief of staff raises goes to the human, cited or not, and no arbiter resolves it
ok 314 - Q169: a revoke of the assistant the chief of staff raises goes to the human, cited or not, and no arbiter resolves it
---
duration_ms: 189.061397
type: 'test'
...
# Subtest: Q169: another role's cited revoke of the assistant, resolved by an arbiter, is refused
ok 315 - Q169: another role's cited revoke of the assistant, resolved by an arbiter, is refused
---
duration_ms: 109.209635
type: 'test'
...
# Subtest: Q169: a revoke of the assistant citing a decision the human resolved stops its thread run
ok 316 - Q169: a revoke of the assistant citing a decision the human resolved stops its thread run
---
duration_ms: 94.35449
type: 'test'
...
# Subtest: Q169: a cited revoke of a role not in END_PROTECTED still goes to the arbiter, and executes
ok 317 - Q169: a cited revoke of a role not in END_PROTECTED still goes to the arbiter, and executes
---
duration_ms: 83.128517
type: 'test'
...
# Subtest: Q169: a role granted role.revoke at either class still sends a revoke of the assistant to the human
ok 318 - Q169: a role granted role.revoke at either class still sends a revoke of the assistant to the human
---
duration_ms: 134.352983
type: 'test'
...
# Subtest: row 280: an occupied TCP port is attempted, refused, and retried with our sshd
ok 319 - row 280: an occupied TCP port is attempted, refused, and retried with our sshd
---
duration_ms: 115.886814
type: 'test'
...
# Subtest: row 280: every injected picker sample is unprivileged and outside the ephemeral range
ok 320 - row 280: every injected picker sample is unprivileged and outside the ephemeral range
---
duration_ms: 0.672194
type: 'test'
...
# Subtest: the executor tests need sshd, ssh, ssh-agent, ssh-add, ssh-keygen and setpriv: a missing one fails, never skips
ok 321 - the executor tests need sshd, ssh, ssh-agent, ssh-add, ssh-keygen and setpriv: a missing one fails, never skips
---
duration_ms: 0.2249
type: 'test'
...
# Subtest: T3: organization.set, limits.set and instances.set refuse hosts, and the writer never runs
ok 322 - T3: organization.set, limits.set and instances.set refuse hosts, and the writer never runs
---
duration_ms: 40.441406
type: 'test'
...
# Subtest: T4: the value check takes one unencrypted ed25519 key and nothing else
ok 323 - T4: the value check takes one unencrypted ed25519 key and nothing else
---
duration_ms: 245.761582
type: 'test'
...
# Subtest: T5 to T8: registry, grant, argv shape and allowlist refusals
ok 324 - T5 to T8: registry, grant, argv shape and allowlist refusals
---
duration_ms: 647.83018
type: 'test'
...
# Subtest: T9: under 1.7 every call needs a decision bound to its host, argv and stdin, spent once
ok 325 - T9: under 1.7 every call needs a decision bound to its host, argv and stdin, spent once
---
duration_ms: 385.80998
type: 'test'
...
# Subtest: T10, T11: argv reaches sudo unchanged after sudo -n --
ok 326 - T10, T11: argv reaches sudo unchanged after sudo -n --
---
duration_ms: 319.11585
type: 'test'
...
# Subtest: T12, T13: exit code passes through, the timeout kills the group, output is capped
ok 327 - T12, T13: exit code passes through, the timeout kills the group, output is capped
---
duration_ms: 1727.115467
type: 'test'
...
# Subtest: T14: a host key not in the registry refuses and nothing runs
ok 328 - T14: a host key not in the registry refuses and nothing runs
---
duration_ms: 261.903107
type: 'test'
...
# Subtest: G18: hosts.check with a wrong pin refuses host-key-mismatch and runs nothing on the host
ok 329 - G18: hosts.check with a wrong pin refuses host-key-mismatch and runs nothing on the host
---
duration_ms: 381.809226
type: 'test'
...
# Subtest: N3: a remote exit 255 that prints the pin refusal text is the command result, and an ssh failure keeps its message
ok 330 - N3: a remote exit 255 that prints the pin refusal text is the command result, and an ssh failure keeps its message
---
duration_ms: 345.014375
type: 'test'
...
# Subtest: T15: ssh reads no config file and no user known_hosts
ok 331 - T15: ssh reads no config file and no user known_hosts
---
duration_ms: 330.368672
type: 'test'
...
# Subtest: T16, T17: key material in output or stdin refuses credential-leak, and no event holds it
ok 332 - T16, T17: key material in output or stdin refuses credential-leak, and no event holds it
---
duration_ms: 685.789529
type: 'test'
...
# Subtest: T18, T19, T20: one call at a time, no key in any argv or env, and nothing left after
ok 333 - T18, T19, T20: one call at a time, no key in any argv or env, and nothing left after
---
duration_ms: 4640.274507
type: 'test'
...
# Subtest: T21: revoke kills the call in flight, and the next call refuses
ok 334 - T21: revoke kills the call in flight, and the next call refuses
---
duration_ms: 280.221252
type: 'test'
...
# Subtest: T22: events carry host, address, user and argv in clear, and sizes and hashes only
ok 335 - T22: events carry host, address, user and argv in clear, and sizes and hashes only
---
duration_ms: 251.129268
type: 'test'
...
# Subtest: T24: no literal gitea and vikunja kind list outside vocabulary.mjs, and the credential use sites are known
ok 336 - T24: no literal gitea and vikunja kind list outside vocabulary.mjs, and the credential use sites are known
---
duration_ms: 15.805688
type: 'test'
...
# Subtest: T25: no role definition lists host.sudo while it is a hard wait
ok 337 - T25: no role definition lists host.sudo while it is a hard wait
---
duration_ms: 0.419907
type: 'test'
...
# Subtest: T27: the bus child dying takes ssh and ssh-agent with it
ok 338 - T27: the bus child dying takes ssh and ssh-agent with it
---
duration_ms: 307.031973
type: 'test'
...
# Subtest: T27: ssh-add -t drops the key from an agent the test keeps alive
ok 339 - T27: ssh-add -t drops the key from an agent the test keeps alive
---
duration_ms: 3547.493303
type: 'test'
...
# Subtest: N2: a hung ssh-add is killed at its limit or on abort, and nothing is left running
ok 340 - N2: a hung ssh-add is killed at its limit or on abort, and nothing is left running
---
duration_ms: 426.787367
type: 'test'
...
# Subtest: T27: the start sweep keeps a live bus dir and kills only a matching live process
ok 341 - T27: the start sweep keeps a live bus dir and kills only a matching live process
---
duration_ms: 26.763275
type: 'test'
...
# Subtest: T27: the bus start sweeps <configDir>/secrets/run before it listens, and a stray entry stops the start
ok 342 - T27: the bus start sweeps <configDir>/secrets/run before it listens, and a stray entry stops the start
---
duration_ms: 53.616343
type: 'test'
...
# Subtest: M3: host.run refuses host-not-granted unless the grant record has an approved, spent host grant
ok 343 - M3: host.run refuses host-not-granted unless the grant record has an approved, spent host grant
---
duration_ms: 129.616578
type: 'test'
...
# Subtest: M3: a host_grants record gives Credentials a store reference at start, and a restart reads its key
ok 344 - M3: a host_grants record gives Credentials a store reference at start, and a restart reads its key
---
duration_ms: 94.713201
type: 'test'
...
# Subtest: G16: the writer refuses each user, tag and key the design names, before any key file
ok 345 - G16: the writer refuses each user, tag and key the design names, before any key file
---
duration_ms: 3653.360819
type: 'test'
...
# Subtest: G16: from= comes from the host file, a privileged user skips the group and sudo checks, and the line is exact
ok 346 - G16: from= comes from the host file, a privileged user skips the group and sudo checks, and the line is exact
---
duration_ms: 876.152026
type: 'test'
...
# Subtest: G16: list shows tagged lines only, and add and remove never touch a line outside the tag pattern
ok 347 - G16: list shows tagged lines only, and add and remove never touch a line outside the tag pattern
---
duration_ms: 438.693762
type: 'test'
...
# Subtest: G25: the writer refuses a symlinked dir or user file, a group-writable dir and an odd tmp, and writes 0644
ok 348 - G25: the writer refuses a symlinked dir or user file, a group-writable dir and an odd tmp, and writes 0644
---
duration_ms: 497.11958
type: 'test'
...
# Subtest: G16: mosaic-keys passes the three requests to the writer through sudo and refuses anything else without it
ok 349 - G16: mosaic-keys passes the three requests to the writer through sudo and refuses anything else without it
---
duration_ms: 78.561652
type: 'test'
...
# Subtest: E3: the sudoers line and the sshd drop-in are the design lines and parse
ok 350 - E3: the sudoers line and the sshd drop-in are the design lines and parse
---
duration_ms: 16.620483
type: 'test'
...
# Subtest: human proof binds CLI entry, process start and nonce; agents and incomplete ancestry refuse
ok 351 - human proof binds CLI entry, process start and nonce; agents and incomplete ancestry refuse
---
duration_ms: 2.125912
type: 'test'
...
# Subtest: process reader gets own kernel identity without exposing environment values
ok 352 - process reader gets own kernel identity without exposing environment values
---
duration_ms: 0.689464
type: 'test'
...
# Subtest: EACCES ancestor environments skip only markers; commands and registered launches still refuse
ok 353 - EACCES ancestor environments skip only markers; commands and registered launches still refuse
---
duration_ms: 1.120299
type: 'test'
...
# Subtest: real pid 1 remains inspectable when its environment is protected
ok 354 - real pid 1 remains inspectable when its environment is protected
---
duration_ms: 0.319126
type: 'test'
...
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# Subtest: row 165: instances and instances.set refuse every non-human session but the tester, the chief of staff included, and pass the verified actor
ok 355 - row 165: instances and instances.set refuse every non-human session but the tester, the chief of staff included, and pass the verified actor
---
duration_ms: 61.304494
type: 'test'
...
# Subtest: row 165 runtime: an add and a change reach the organization file with the human as actor; each refusal keeps the bytes and logs nothing
ok 356 - row 165 runtime: an add and a change reach the organization file with the human as actor; each refusal keeps the bytes and logs nothing
---
duration_ms: 222.957116
type: 'test'
...
# Subtest: row 194 T12: agent and reader sessions refuse veto.set; the tester gets add and change but not delete or veto.set; the human passes the hook for each listed verb
ok 357 - row 194 T12: agent and reader sessions refuse veto.set; the tester gets add and change but not delete or veto.set; the human passes the hook for each listed verb
---
duration_ms: 47.6457
type: 'test'
...
# Subtest: system Python is a resolved root-owned ELF, never a shim or home interpreter
ok 358 - system Python is a resolved root-owned ELF, never a shim or home interpreter
---
duration_ms: 4.199899
type: 'test'
...
# Subtest: real system interpreter is available and safely inspected
ok 359 - real system interpreter is available and safely inspected
---
duration_ms: 31.696866
type: 'test'
...
# Subtest: restart receipt appends actual replacement identity and refuses unsafe files
ok 360 - restart receipt appends actual replacement identity and refuses unsafe files
---
duration_ms: 3.929849
type: 'test'
...
# Subtest: activation gate compares fresh startup receipt to the current interpreter identity
ok 361 - activation gate compares fresh startup receipt to the current interpreter identity
---
duration_ms: 2.456191
type: 'test'
...
# Subtest: non-regular startup receipt refuses promptly without waiting on a FIFO peer
ok 362 - non-regular startup receipt refuses promptly without waiting on a FIFO peer
---
duration_ms: 54.518182
type: 'test'
...
# Subtest: REQ-DEC-2: a merge-gate raise its arbiter resolved lands through the host op: checkLand answers the facts and a ticket, records nothing, and recordLand spends the decision once
ok 363 - REQ-DEC-2: a merge-gate raise its arbiter resolved lands through the host op: checkLand answers the facts and a ticket, records nothing, and recordLand spends the decision once
---
duration_ms: 68.954201
type: 'test'
...
# Subtest: checkLand refuses on the decision and the review
ok 364 - checkLand refuses on the decision and the review
---
duration_ms: 62.185426
type: 'test'
...
# Subtest: REQ-LAND-1: a gated merge decision refuses not-authorized, cited and approved by the arbiter or uncited and approved by the human
ok 365 - REQ-LAND-1: a gated merge decision refuses not-authorized, cited and approved by the arbiter or uncited and approved by the human
---
duration_ms: 178.343834
type: 'test'
...
# Subtest: REQ-LAND-1: a within-role merge grant refuses not-authorized at the land
ok 366 - REQ-LAND-1: a within-role merge grant refuses not-authorized at the land
---
duration_ms: 49.552735
type: 'test'
...
# Subtest: a cross-role merge that routes to the human, because merge-gate is its own arbiter, lands on the human's CLI answer
ok 367 - a cross-role merge that routes to the human, because merge-gate is its own arbiter, lands on the human's CLI answer
---
duration_ms: 44.91396
type: 'test'
...
# Subtest: a merge option with no first line refuses no-subject, as land-work does
ok 368 - a merge option with no first line refuses no-subject, as land-work does
---
duration_ms: 40.82108
type: 'test'
...
# Subtest: checkLand refuses with land-work's codes past the authority check, and a decision raised for refactor never lands
ok 369 - checkLand refuses with land-work's codes past the authority check, and a decision raised for refactor never lands
---
duration_ms: 101.238478
type: 'test'
...
# Subtest: a ticket outlives the run that asked, and recordLand checks the task again
ok 370 - a ticket outlives the run that asked, and recordLand checks the task again
---
duration_ms: 45.168182
type: 'test'
...
# Subtest: two tickets on one decision: the first recordLand lands, the second refuses decision-consumed and records nothing
ok 371 - two tickets on one decision: the first recordLand lands, the second refuses decision-consumed and records nothing
---
duration_ms: 46.668322
type: 'test'
...
# Subtest: landRefused files the code on the task, tells the role only with notify, and ends the ticket
ok 372 - landRefused files the code on the task, tells the role only with notify, and ends the ticket
---
duration_ms: 48.072584
type: 'test'
...
# Subtest: landHeld is true only for an approved, unspent cross-role merge decision this role raised for a task in this thread
ok 373 - landHeld is true only for an approved, unspent cross-role merge decision this role raised for a task in this thread
---
duration_ms: 49.583097
type: 'test'
...
# Subtest: landHolders lists a merge decision exactly while landHeld is true for its non-thread instance, in decision order
ok 374 - landHolders lists a merge decision exactly while landHeld is true for its non-thread instance, in decision order
---
duration_ms: 65.091128
type: 'test'
...
# Subtest: landHolders leaves out a thread instance's decision, even one raised before its role became one
ok 375 - landHolders leaves out a thread instance's decision, even one raised before its role became one
---
duration_ms: 40.279781
type: 'test'
...
# Subtest: landRelease releases the holding run by land-relaunch once it has asked message.receive and nothing delivered to it is unread, and waiting messages go to the next holder
ok 376 - landRelease releases the holding run by land-relaunch once it has asked message.receive and nothing delivered to it is unread, and waiting messages go to the next holder
---
duration_ms: 67.674582
type: 'test'
...
# Subtest: a landing run started after the resolution passes checkLand for its held decision before any message.receive, and lands it
ok 377 - a landing run started after the resolution passes checkLand for its held decision before any message.receive, and lands it
---
duration_ms: 50.869945
type: 'test'
...
# Subtest: the bus process answers landHolders and landRelease from their own lines, not as credentialStatus
ok 378 - the bus process answers landHolders and landRelease from their own lines, not as credentialStatus
---
duration_ms: 202.710435
type: 'test'
...
# Subtest: usage.begin with a decision id needs it held for the run's instance, usage.end needs the begin, and the limit checks see the landing turn
ok 379 - usage.begin with a decision id needs it held for the run's instance, usage.end needs the begin, and the limit checks see the landing turn
---
duration_ms: 63.365624
type: 'test'
...
# Subtest: no run may write the action.allowed for git.merge.protected itself
ok 380 - no run may write the action.allowed for git.merge.protected itself
---
duration_ms: 38.464073
type: 'test'
...
# Subtest: a message to a stopped role sends launch.by one notice, and the result says so
ok 381 - a message to a stopped role sends launch.by one notice, and the result says so
---
duration_ms: 44.16221
type: 'test'
...
# Subtest: a message to a role outside launch.instances says so in its result and in the notice
ok 382 - a message to a role outside launch.instances says so in its result and in the notice
---
duration_ms: 26.141604
type: 'test'
...
# Subtest: a message to a running role sends no notice and its result is unchanged
ok 383 - a message to a running role sends no notice and its result is unchanged
---
duration_ms: 22.729217
type: 'test'
...
# Subtest: a re-route at a claim, a release and claim, and a broker restart send no second notice
ok 384 - a re-route at a claim, a release and claim, and a broker restart send no second notice
---
duration_ms: 55.540907
type: 'test'
...
# Subtest: a run launched but not yet claimed counts as no holder
ok 385 - a run launched but not yet claimed counts as no holder
---
duration_ms: 32.079527
type: 'test'
...
# Subtest: no notice for a message to launch.by, from it, a refused one from a tester, to the human, or in a thread to a thread instance
ok 386 - no notice for a message to launch.by, from it, a refused one from a tester, to the human, or in a thread to a thread instance
---
duration_ms: 50.43606
type: 'test'
...
# Subtest: a business with no launch block tells nobody and says there is no launcher
ok 387 - a business with no launch block tells nobody and says there is no launcher
---
duration_ms: 20.407878
type: 'test'
...
# Subtest: the notice sender stays internal: no role is named _bus and no caller can send as it or to it
ok 388 - the notice sender stays internal: no role is named _bus and no caller can send as it or to it
---
duration_ms: 59.297894
type: 'test'
...
# Subtest: C2-03a library.sync: every agent, the tester and a reader are refused before the adapter runs
ok 389 - C2-03a library.sync: every agent, the tester and a reader are refused before the adapter runs
---
duration_ms: 42.609181
type: 'test'
...
# Subtest: C2-03a library.sync: the human fetches, accept passes through, and a held sync is a recorded refusal
ok 390 - C2-03a library.sync: the human fetches, accept passes through, and a held sync is a recorded refusal
---
duration_ms: 32.300925
type: 'test'
...
# Subtest: C2-03a library.sync: a LibraryError keeps its code and a host without sync is not configured
ok 391 - C2-03a library.sync: a LibraryError keeps its code and a host without sync is not configured
---
duration_ms: 42.824375
type: 'test'
...
# Subtest: C2-03a runtime: a librarySync from a boot config, with no function, is refused
ok 392 - C2-03a runtime: a librarySync from a boot config, with no function, is refused
---
duration_ms: 2.134385
type: 'test'
...
# Subtest: C2-03a runtime: the timer syncs each entry with a user at start and on each tick, logs codes only, and stops on close
ok 393 - C2-03a runtime: the timer syncs each entry with a user at start and on each tick, logs codes only, and stops on close
---
duration_ms: 782.444273
type: 'test'
...
# Subtest: row 254 human-cli: library.sync outlasts the 5 s client default, and library.status does not
ok 394 - row 254 human-cli: library.sync outlasts the 5 s client default, and library.status does not
---
duration_ms: 6122.825748
type: 'test'
...
# Subtest: C2-04 M4: both verbs reject every agent before arguments or adapter access
ok 395 - C2-04 M4: both verbs reject every agent before arguments or adapter access
---
duration_ms: 56.547028
type: 'test'
...
# Subtest: C2-04 bus: human reads validate keys and return adapter results without path leakage
ok 396 - C2-04 bus: human reads validate keys and return adapter results without path leakage
---
duration_ms: 25.139733
type: 'test'
...
# Subtest: C2-04 socket: each async library verb resolves its result rather than serializing {}
ok 397 - C2-04 socket: each async library verb resolves its result rather than serializing {}
---
duration_ms: 114.550386
type: 'test'
...
# Subtest: C2-04 runtime: protectedRoots skips library but retains real code-root credential protection
ok 398 - C2-04 runtime: protectedRoots skips library but retains real code-root credential protection
---
duration_ms: 170.009801
type: 'test'
...
# Subtest: C2-04 runtime: unsafe existing mirror refuses boot and never publishes a socket
ok 399 - C2-04 runtime: unsafe existing mirror refuses boot and never publishes a socket
---
duration_ms: 44.366469
type: 'test'
...
# Subtest: C2-04 runtime: real library adapters reach the socket and lock waits leave other bus reads responsive
ok 400 - C2-04 runtime: real library adapters reach the socket and lock waits leave other bus reads responsive
---
duration_ms: 361.962851
type: 'test'
...
# organization: {"event":"reload-needs-restart","business":"demo"}
# Subtest: T20 fire: a revoke that fails stops the fire with the file unchanged; one that succeeds revokes, keeps the directory and names the services outside the store
ok 401 - T20 fire: a revoke that fails stops the fire with the file unchanged; one that succeeds revokes, keeps the directory and names the services outside the store
---
duration_ms: 145.496638
type: 'test'
...
# Subtest: T20 fire: an instance already delisted still has its tokens revoked and the file is left alone
ok 402 - T20 fire: an instance already delisted still has its tokens revoked and the file is left alone
---
duration_ms: 83.104567
type: 'test'
...
# Subtest: T20 fire: with no entry in the running bus, a token on disk refuses and an empty store goes on
ok 403 - T20 fire: with no entry in the running bus, a token on disk refuses and an empty store goes on
---
duration_ms: 91.060964
type: 'test'
...
# Subtest: T20 delete: a revoke that fails keeps the file; one that succeeds clears the store, deletes, and names the tracker bot
ok 404 - T20 delete: a revoke that fails keeps the file; one that succeeds clears the store, deletes, and names the tracker bot
---
duration_ms: 123.156803
type: 'test'
...
# Subtest: T20 delete: with no entry in the running bus, a token file is cleared and the delete goes on; a file reference refuses
ok 405 - T20 delete: with no entry in the running bus, a token file is cleared and the delete goes on; a file reference refuses
---
duration_ms: 100.918263
type: 'test'
...
# Subtest: T21 delete: a write between the raise and the take makes the delete refuse revision-conflict before it revokes anything
ok 406 - T21 delete: a write between the raise and the take makes the delete refuse revision-conflict before it revokes anything
---
duration_ms: 94.816576
type: 'test'
...
# Subtest: row 194 T12: agent and reader sessions refuse the lifecycle verbs before any effect; the tester gets launch, end and the request read, never regenerate
ok 407 - row 194 T12: agent and reader sessions refuse the lifecycle verbs before any effect; the tester gets launch, end and the request read, never regenerate
---
duration_ms: 64.798326
type: 'test'
...
# Subtest: row 194 V2 and V4 at the verb: the request is open, by the human, with a human.input; thread, retired, unknown and revoked refuse with no event
ok 408 - row 194 V2 and V4 at the verb: the request is open, by the human, with a human.input; thread, retired, unknown and revoked refuse with no event
---
duration_ms: 36.516394
type: 'test'
...
# Subtest: row 194 D1.1 take: a request is taken once, closes once, and lifecycleRequests lists only what is not closed
ok 409 - row 194 D1.1 take: a request is taken once, closes once, and lifecycleRequests lists only what is not closed
---
duration_ms: 29.643771
type: 'test'
...
# Subtest: row 194 D1.1 take: a launch.revoke after the request closes it launch-revoked, and a request past 60 s closes request-expired
ok 410 - row 194 D1.1 take: a launch.revoke after the request closes it launch-revoked, and a request past 60 s closes request-expired
---
duration_ms: 31.529179
type: 'test'
...
# Subtest: row 194 T15 (bus): while halted, launch and regenerate refuse processing-halted at the verb and at the take, hire and fire refuse, terminate goes; an unreadable switch refuses with its code
ok 411 - row 194 T15 (bus): while halted, launch and regenerate refuse processing-halted at the verb and at the take, hire and fire refuse, terminate goes; an unreadable switch refuses with its code
---
duration_ms: 48.858005
type: 'test'
...
# Subtest: row 194 T12a: the tester launches and ends on its own business with actor tester; bus.tester off in the file refuses the call and the take tester-off
ok 412 - row 194 T12a: the tester launches and ends on its own business with actor tester; bus.tester off in the file refuses the call and the take tester-off
---
duration_ms: 37.805596
type: 'test'
...
# Subtest: row 194 V3 terminate: claims revoked, open requests cancelled, bound runs named, taken requests listed; nothing at all answers not-held
ok 413 - row 194 V3 terminate: claims revoked, open requests cancelled, bound runs named, taken requests listed; nothing at all answers not-held
---
duration_ms: 44.495686
type: 'test'
...
# Subtest: row 194 V3 terminate of a thread instance: the human ends every thread, the tester only its own
ok 414 - row 194 V3 terminate of a thread instance: the human ends every thread, the tester only its own
---
duration_ms: 31.398156
type: 'test'
...
# Subtest: row 194 T6 V5 order at the verb: the writer's named refusals, then instance-running, instance-starting, the last-listed refusal and the revision
ok 415 - row 194 T6 V5 order at the verb: the writer's named refusals, then instance-running, instance-starting, the last-listed refusal and the revision
---
duration_ms: 54.972785
type: 'test'
...
# Subtest: row 194 V5: an open launch past its 60 s is not starting, as it can only close request-expired
ok 416 - row 194 V5: an open launch past its 60 s is not starting, as it can only close request-expired
---
duration_ms: 21.727339
type: 'test'
...
# Subtest: row 194 V5 after the take: lifecycleDelete re-checks running and starting, then commits through the writer with the human as actor
ok 417 - row 194 V5 after the take: lifecycleDelete re-checks running and starting, then commits through the writer with the human as actor
---
duration_ms: 36.831365
type: 'test'
...
# Subtest: row 194 V5 retry: a retired name deletes again only after workspace-rename-failed, and that request commits nothing
ok 418 - row 194 V5 retry: a retired name deletes again only after workspace-rename-failed, and that request commits nothing
---
duration_ms: 39.342044
type: 'test'
...
# Subtest: row 194 V5 runtime: a delete request, the take and lifecycleDelete commit the file with retired, log the human and reload so the name no longer binds
ok 419 - row 194 V5 runtime: a delete request, the take and lifecycleDelete commit the file with retired, log the human and reload so the name no longer binds
---
duration_ms: 223.568536
type: 'test'
...
# Subtest: REQ-LIMIT-3 limitLeaves finds every limit object and skips the agent numbers
ok 420 - REQ-LIMIT-3 limitLeaves finds every limit object and skips the agent numbers
---
duration_ms: 2.174089
type: 'test'
...
# Subtest: REQ-LIMIT-3 limitLeaves takes token limits at schema depth only, whatever their names
ok 421 - REQ-LIMIT-3 limitLeaves takes token limits at schema depth only, whatever their names
---
duration_ms: 0.270787
type: 'test'
...
# Subtest: REQ-LIMIT-3 with no check switched on a launch is allowed, a turn never stops, and every limit is not enforced
ok 422 - REQ-LIMIT-3 with no check switched on a launch is allowed, a turn never stops, and every limit is not enforced
---
duration_ms: 20.594671
type: 'test'
...
# Subtest: REQ-LIMIT-3 a fixture check that refuses refuses the launch and stops the turn, logged with the limit and the count
ok 423 - REQ-LIMIT-3 a fixture check that refuses refuses the launch and stops the turn, logged with the limit and the count
---
duration_ms: 20.439381
type: 'test'
...
# Subtest: REQ-LIMIT-3 a report that omits a limit shows it not enforced; a counted entry and a reason come through
ok 424 - REQ-LIMIT-3 a report that omits a limit shows it not enforced; a counted entry and a reason come through
---
duration_ms: 22.029312
type: 'test'
...
# Subtest: REQ-LIMIT-4 each check gets the business, a copy of the limits, the subject, the records and the time
ok 425 - REQ-LIMIT-4 each check gets the business, a copy of the limits, the subject, the records and the time
---
duration_ms: 25.473583
type: 'test'
...
# Subtest: REQ-LIMIT-4 fail closed: a throw refuses, stops and fails the report, naming the check and the code
ok 426 - REQ-LIMIT-4 fail closed: a throw refuses, stops and fails the report, naming the check and the code
---
duration_ms: 19.749846
type: 'test'
...
# Subtest: REQ-LIMIT-4 fail closed: a malformed answer, a promise, a rejected promise, a non-boolean or a bad hit is malformed-answer
ok 427 - REQ-LIMIT-4 fail closed: a malformed answer, a promise, a rejected promise, a non-boolean or a bad hit is malformed-answer
---
duration_ms: 24.410019
type: 'test'
...
# Subtest: REQ-LIMIT-4 fail closed: a check switched on but not loaded refuses, stops and fails every limit as not-loaded
ok 428 - REQ-LIMIT-4 fail closed: a check switched on but not loaded refuses, stops and fails every limit as not-loaded
---
duration_ms: 19.914086
type: 'test'
...
# Subtest: REQ-LIMIT-4 state(), never-loaded case: before any load the report shows not enforced, or not-loaded for a switched-on check
ok 429 - REQ-LIMIT-4 state(), never-loaded case: before any load the report shows not enforced, or not-loaded for a switched-on check
---
duration_ms: 18.427008
type: 'test'
...
# Subtest: REQ-LIMIT-4 state(), first-load-refused case: a check refused on its first load is not-loaded in mayLaunch, mustStop and report
ok 430 - REQ-LIMIT-4 state(), first-load-refused case: a check refused on its first load is not-loaded in mayLaunch, mustStop and report
---
duration_ms: 19.620038
type: 'test'
...
# Subtest: REQ-LIMIT-4 fail closed: an unreadable organization file refuses and stops with check null; the report throws
ok 431 - REQ-LIMIT-4 fail closed: an unreadable organization file refuses and stops with check null; the report throws
---
duration_ms: 17.668723
type: 'test'
...
# Subtest: REQ-LIMIT-4 fail closed: unreadable records refuse and stop with check null and fail the report
ok 432 - REQ-LIMIT-4 fail closed: unreadable records refuse and stop with check null and fail the report
---
duration_ms: 0.780791
type: 'test'
...
# Subtest: REQ-LIMIT-3 the shipped token-limit, through the real loader, counts known records only since the limit was set
ok 433 - REQ-LIMIT-3 the shipped token-limit, through the real loader, counts known records only since the limit was set
---
duration_ms: 28.985615
type: 'test'
...
# Subtest: REQ-LIMIT-3 a token limit for a provider named limit is counted and refuses, beside an agent limit of the same name
ok 434 - REQ-LIMIT-3 a token limit for a provider named limit is counted and refuses, beside an agent limit of the same name
---
duration_ms: 17.954522
type: 'test'
...
# Subtest: REQ-LIMIT-3 core reaches limit checks only through the plug-in loader
ok 435 - REQ-LIMIT-3 core reaches limit checks only through the plug-in loader
---
duration_ms: 1.466844
type: 'test'
...
# Subtest: REQ-LIMIT-4 a role run at its limit stops at the end of its turn: RESULT and read land first, the claim is revoked by limit-check
ok 436 - REQ-LIMIT-4 a role run at its limit stops at the end of its turn: RESULT and read land first, the claim is revoked by limit-check
---
duration_ms: 56.315705
type: 'test'
...
# Subtest: REQ-LIMIT-4 the stop also lands on state; a run with no stop ends without a limit
ok 437 - REQ-LIMIT-4 the stop also lands on state; a run with no stop ends without a limit
---
duration_ms: 56.699112
type: 'test'
...
# Subtest: REQ-LIMIT-4 fail closed: a mustStop throw or a malformed answer stops the run, naming the bus and the code
ok 438 - REQ-LIMIT-4 fail closed: a mustStop throw or a malformed answer stops the run, naming the bus and the code
---
duration_ms: 137.829947
type: 'test'
...
# Subtest: REQ-LIMIT-4 a thread run at its limit is released with the reason, and its end record names the limit
ok 439 - REQ-LIMIT-4 a thread run at its limit is released with the reason, and its end record names the limit
---
duration_ms: 37.484633
type: 'test'
...
# Subtest: REQ-LIMIT-4 a broker with no limit checks configured never stops a run
ok 440 - REQ-LIMIT-4 a broker with no limit checks configured never stops a run
---
duration_ms: 29.557721
type: 'test'
...
# limits: {"event":"limit-reached","business":"demo","check":"token-limit","export":"mayLaunch","subject":{"instance":"coder","provider":"zai","model":"glm-5.3-flash","account":null},"path":["tokens","instances","coder"],"limit":0,"count":0,"unknownTurns":0}
# organization: {"event":"reload-needs-restart","business":"demo"}
# usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"04b4e96c-641c-4c7f-a9f7-083bb8dc445b","source":"@none","code":"baseline-unknown"}
# limits: {"event":"limit-reached","business":"demo","check":"token-limit","export":"mustStop","subject":{"instance":"coder","provider":"zai","model":"glm-5.3-flash","account":null},"path":["tokens","instances","coder"],"limit":0,"count":0,"unknownTurns":1}
# usage: {"event":"usage-unknown","business":"demo","run":"run1","instance":"coder","turn":"dd02c49f-4ff7-4389-a528-cfb0adcd6a48","source":"@none","code":"baseline-unknown"}
# Subtest: REQ-LIMIT-3 REQ-LIMIT-4 runtime: limits carries the token count, mayLaunch refuses at the limit, a reset moves since
# organization: {"event":"reload-needs-restart","business":"demo"}
ok 441 - REQ-LIMIT-3 REQ-LIMIT-4 runtime: limits carries the token count, mayLaunch refuses at the limit, a reset moves since
---
duration_ms: 221.692675
type: 'test'
...
# Subtest: REQ-LIMIT-3 runtime: with no limit check switched on, the limit shows not enforced and every launch is allowed
ok 442 - REQ-LIMIT-3 runtime: with no limit check switched on, the limit shows not enforced and every launch is allowed
---
duration_ms: 61.508202
type: 'test'
...
# Subtest: REQ-LIMIT-4 runtime: the broker asks the shipped token-limit after a turn, and the run at its limit stops on its next receive
ok 443 - REQ-LIMIT-4 runtime: the broker asks the shipped token-limit after a turn, and the run at its limit stops on its next receive
---
duration_ms: 82.139758
type: 'test'
...
# Subtest: REQ-LIMIT-4 runtime: with no usage source a turn is unknown, counts zero and stops nothing under a limit of 1
ok 444 - REQ-LIMIT-4 runtime: with no usage source a turn is unknown, counts zero and stops nothing under a limit of 1
---
duration_ms: 84.791086
type: 'test'
...
# Subtest: REQ-LIMIT-3 runtime: switching a limit check on with plugins.set loads it without a launch or a turn
ok 445 - REQ-LIMIT-3 runtime: switching a limit check on with plugins.set loads it without a launch or a turn
---
duration_ms: 105.641652
type: 'test'
...
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# Subtest: limits binds actor from human proof and rejects role, reader, a tester set and forged actor
ok 446 - limits binds actor from human proof and rejects role, reader, a tester set and forged actor
---
duration_ms: 37.449016
type: 'test'
...
# Subtest: runtime wires verified human settings to the actual shared file writer and actor receipt
ok 447 - runtime wires verified human settings to the actual shared file writer and actor receipt
---
duration_ms: 169.037706
type: 'test'
...
# Subtest: uncertain organization receipts leave bus startup and reads alone but refuse writes until reconciled
ok 448 - uncertain organization receipts leave bus startup and reads alone but refuse writes until reconciled
---
duration_ms: 101.414241
type: 'test'
...
# Subtest: within-role sends cite an open gated launch decision without spending it or naming it in grants
ok 449 - within-role sends cite an open gated launch decision without spending it or naming it in grants
---
duration_ms: 49.375512
type: 'test'
...
# Subtest: missing and foreign-business citations refuse and roll back message and grant
ok 450 - missing and foreign-business citations refuse and roll back message and grant
---
duration_ms: 43.5933
type: 'test'
...
# Subtest: cross-role sends still need a matching resolved decision and consume it once
ok 451 - cross-role sends still need a matching resolved decision and consume it once
---
duration_ms: 46.569666
type: 'test'
...
# Subtest: trail on a hidden message id answers exactly as on an unknown id, for the owner, a reader and the tester
ok 452 - trail on a hidden message id answers exactly as on an unknown id, for the owner, a reader and the tester
---
duration_ms: 41.449346
type: 'test'
...
# Subtest: replies on a hidden message id answers exactly as on an unknown id, for the owner, a reader and the tester
ok 453 - replies on a hidden message id answers exactly as on an unknown id, for the owner, a reader and the tester
---
duration_ms: 49.120657
type: 'test'
...
# Subtest: trail on a decision keeps the decision and drops the user thread messages, their deliveries and their events
ok 454 - trail on a decision keeps the decision and drops the user thread messages, their deliveries and their events
---
duration_ms: 53.023638
type: 'test'
...
# Subtest: replies leaves out other users thread messages and still fills a page
ok 455 - replies leaves out other users thread messages and still fills a page
---
duration_ms: 296.390202
type: 'test'
...
# Subtest: messages in the business human and tester threads are not hidden (row 177 unchanged)
ok 456 - messages in the business human and tester threads are not hidden (row 177 unchanged)
---
duration_ms: 53.347775
type: 'test'
...
# Subtest: governance pin: the owner sees decisions, inbox entries, claims, tasks and project files, but not the user messages
ok 457 - governance pin: the owner sees decisions, inbox entries, claims, tasks and project files, but not the user messages
---
duration_ms: 163.144105
type: 'test'
...
# Subtest: messages pages all human messages newest first without writes; read state is history
ok 458 - messages pages all human messages newest first without writes; read state is history
---
duration_ms: 513.069068
type: 'test'
...
# Subtest: messages refuses role callers, invalid paging and cursors outside this human feed
ok 459 - messages refuses role callers, invalid paging and cursors outside this human feed
---
duration_ms: 43.722327
type: 'test'
...
# Subtest: views messages passes only its paging arguments through
ok 460 - views messages passes only its paging arguments through
---
duration_ms: 0.542522
type: 'test'
...
# Subtest: messages isolates businesses even with a valid foreign cursor
ok 461 - messages isolates businesses even with a valid foreign cursor
---
duration_ms: 39.653736
type: 'test'
...
# Subtest: the assistant sends to the user and to the chief of staff only
ok 462 - the assistant sends to the user and to the chief of staff only
---
duration_ms: 53.48415
type: 'test'
...
# Subtest: an assistant send to any other role, or to the tester, is refused and logged
ok 463 - an assistant send to any other role, or to the tester, is refused and logged
---
duration_ms: 58.142337
type: 'test'
...
# Subtest: only the user and the chief of staff may send to the assistant; the tester is refused by default
ok 464 - only the user and the chief of staff may send to the assistant; the tester is refused by default
---
duration_ms: 49.614921
type: 'test'
...
# Subtest: REQ-ASSIST-2 REQ-THREAD-1 thread.send to an instance that does not hear from the user is refused and stores nothing
ok 465 - REQ-ASSIST-2 REQ-THREAD-1 thread.send to an instance that does not hear from the user is refused and stores nothing
---
duration_ms: 40.30046
type: 'test'
...
# Subtest: a sender-side list alone refuses a send to a role that has no list
ok 466 - a sender-side list alone refuses a send to a role that has no list
---
duration_ms: 50.726462
type: 'test'
...
# Subtest: a target-side list alone refuses a send from a role that has no list
ok 467 - a target-side list alone refuses a send from a role that has no list
---
duration_ms: 50.312543
type: 'test'
...
# Subtest: the sender list is checked before the target list
ok 468 - the sender list is checked before the target list
---
duration_ms: 45.297392
type: 'test'
...
# Subtest: roles without the field behave exactly as before
ok 469 - roles without the field behave exactly as before
---
duration_ms: 66.430859
type: 'test'
...
# Subtest: a business with no role definitions at all is unlimited
ok 470 - a business with no role definitions at all is unlimited
---
duration_ms: 50.025996
type: 'test'
...
# Subtest: a malformed messaging field refuses at boot
ok 471 - a malformed messaging field refuses at boot
---
duration_ms: 20.205079
type: 'test'
...
# Subtest: the assistant's review.request to a reviewer is refused and logged, even with an approved decision
ok 472 - the assistant's review.request to a reviewer is refused and logged, even with an approved decision
---
duration_ms: 58.487007
type: 'test'
...
# Subtest: a review.verdict to the assistant from a role outside its receiveFrom is refused and logged
ok 473 - a review.verdict to the assistant from a role outside its receiveFrom is refused and logged
---
duration_ms: 71.041294
type: 'test'
...
# Subtest: review requests and verdicts between roles without the field are unchanged
ok 474 - review requests and verdicts between roles without the field are unchanged
---
duration_ms: 42.716246
type: 'test'
...
# Subtest: 3f copy migrates to 3g preserving every old column/row, with an empty instance_names and null to_name
ok 475 - 3f copy migrates to 3g preserving every old column/row, with an empty instance_names and null to_name
---
duration_ms: 131.665468
type: 'test'
...
# Subtest: REQ-MSG-2: the chief of staff names an instance under its within-role grant, and the write is logged
ok 476 - REQ-MSG-2: the chief of staff names an instance under its within-role grant, and the write is logged
---
duration_ms: 36.290096
type: 'test'
...
# Subtest: REQ-MSG-2: the human names an instance through the CLI
ok 477 - REQ-MSG-2: the human names an instance through the CLI
---
duration_ms: 30.810381
type: 'test'
...
# Subtest: REQ-MSG-2: a role without the grant, or holding it cross-role, is refused not-authorized
ok 478 - REQ-MSG-2: a role without the grant, or holding it cross-role, is refused not-authorized
---
duration_ms: 35.896139
type: 'test'
...
# Subtest: REQ-MSG-2: a name is unique in the business and is never an instance key or a role name
ok 479 - REQ-MSG-2: a name is unique in the business and is never an instance key or a role name
---
duration_ms: 50.650594
type: 'test'
...
# Subtest: REQ-MSG-2: a send by name reaches the instance and records both; a send by instance key is unchanged
ok 480 - REQ-MSG-2: a send by name reaches the instance and records both; a send by instance key is unchanged
---
duration_ms: 46.023843
type: 'test'
...
# Subtest: REQ-MSG-2: an instance key beats a name that equals it, as when a later instance takes the key
ok 481 - REQ-MSG-2: an instance key beats a name that equals it, as when a later instance takes the key
---
duration_ms: 32.660145
type: 'test'
...
# Subtest: REQ-MSG-2: a role name beats a name that equals it, as when a later definition takes the word (sage-0590)
ok 482 - REQ-MSG-2: a role name beats a name that equals it, as when a later definition takes the word (sage-0590)
---
duration_ms: 37.842742
type: 'test'
...
# Subtest: proof receives actual peer, cap traffic never invokes helper and transient cap disconnects
ok 483 - proof receives actual peer, cap traffic never invokes helper and transient cap disconnects
---
duration_ms: 7.351235
type: 'test'
...
# Subtest: proof helper error and disconnect during verification never dispatch or bind
ok 484 - proof helper error and disconnect during verification never dispatch or bind
---
duration_ms: 1.765169
type: 'test'
...
# Subtest: Client receives explicit proof refusal codes without dispatch, not outcome-unknown
ok 485 - Client receives explicit proof refusal codes without dispatch, not outcome-unknown
---
duration_ms: 60.523607
type: 'test'
...
# Subtest: asynchronous proof calls release their transient session on success, failure and timeout
ok 486 - asynchronous proof calls release their transient session on success, failure and timeout
---
duration_ms: 29.906813
type: 'test'
...
# Subtest: T2 eight proof callers and a racing copier bind the exact accepted socket, which survives helper exit
ok 487 - T2 eight proof callers and a racing copier bind the exact accepted socket, which survives helper exit
---
duration_ms: 389.90548
type: 'test'
...
# Subtest: helper output and failures fail closed including unsafe gid
ok 488 - helper output and failures fail closed including unsafe gid
---
duration_ms: 2.387558
type: 'test'
...
# Subtest: helper timeout, capacity and shutdown refuse without leaving children
ok 489 - helper timeout, capacity and shutdown refuse without leaving children
---
duration_ms: 26.524429
type: 'test'
...
# Subtest: missing or non-regular peer helper refuses at construction before opening the bus
ok 490 - missing or non-regular peer helper refuses at construction before opening the bus
---
duration_ms: 0.566735
type: 'test'
...
# Subtest: shutdown waits for killed helper close before returning
ok 491 - shutdown waits for killed helper close before returning
---
duration_ms: 5.183133
type: 'test'
...
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# Subtest: plugins and plugins.set refuse every non-human session and a forged actor, and pass only the patch with the verified actor
ok 492 - plugins and plugins.set refuse every non-human session and a forged actor, and pass only the patch with the verified actor
---
duration_ms: 34.890711
type: 'test'
...
# Subtest: runtime: the switch changes the organization file, the receipt carries the actor, and a bad shape, an unknown module and a stale revision are refused with nothing written
ok 493 - runtime: the switch changes the organization file, the receipt carries the actor, and a bad shape, an unknown module and a stale revision are refused with nothing written
---
duration_ms: 183.707608
type: 'test'
...
# Subtest: vikunja:19/309 through the broker, a patch switches the kinds it names and keeps the rest; null removes one kind and is trailed
ok 494 - vikunja:19/309 through the broker, a patch switches the kinds it names and keeps the rest; null removes one kind and is trailed
---
duration_ms: 89.111314
type: 'test'
...
# Subtest: principal binds kernel peer PID and uid, maps owner, and never takes identity or role from body
ok 495 - principal binds kernel peer PID and uid, maps owner, and never takes identity or role from body
---
duration_ms: 4.02686
type: 'test'
...
# Subtest: user requires its own nonce and full walk plus immediate same-tree Console parent
ok 496 - user requires its own nonce and full walk plus immediate same-tree Console parent
---
duration_ms: 0.914112
type: 'test'
...
# Subtest: tester deliberately admits agent parents but rejects managed runs and another nonce
ok 497 - tester deliberately admits agent parents but rejects managed runs and another nonce
---
duration_ms: 0.46954
type: 'test'
...
# Subtest: human leaf identity is reread after walking the parents
ok 498 - human leaf identity is reread after walking the parents
---
duration_ms: 0.256106
type: 'test'
...
# Subtest: broker process binds trusted launches, offers reader capabilities, refuses human mutation, closes cleanly
ok 499 - broker process binds trusted launches, offers reader capabilities, refuses human mutation, closes cleanly
---
duration_ms: 273.782106
type: 'test'
...
# Subtest: startup token refusal returns safe code without value or partial listening broker
ok 500 - startup token refusal returns safe code without value or partial listening broker
---
duration_ms: 167.424582
type: 'test'
...
# Subtest: loaded fixture token is absent from socket replies and SQLite, including refusal evidence
ok 501 - loaded fixture token is absent from socket replies and SQLite, including refusal evidence
---
duration_ms: 207.433572
type: 'test'
...
# Subtest: killed broker leaves an explicit stale lock; another process cannot silently reclaim it
ok 502 - killed broker leaves an explicit stale lock; another process cannot silently reclaim it
---
duration_ms: 294.20113
type: 'test'
...
# Subtest: trusted host registers later launches; socket clients never have a registration verb
ok 503 - trusted host registers later launches; socket clients never have a registration verb
---
duration_ms: 230.039395
type: 'test'
...
# Subtest: REQ-LIMIT-4 the broker process answers the launcher's mayLaunch op with the limits' awaited decision
ok 504 - REQ-LIMIT-4 the broker process answers the launcher's mayLaunch op with the limits' awaited decision
---
duration_ms: 278.878969
type: 'test'
...
# Subtest: runtime excludes declared project roots even when host supplies no repoRoots
ok 505 - runtime excludes declared project roots even when host supplies no repoRoots
---
duration_ms: 181.71244
type: 'test'
...
# Subtest: a refused launch binding leaves the broker and existing capabilities alive; bad protocol stops it
ok 506 - a refused launch binding leaves the broker and existing capabilities alive; bad protocol stops it
---
duration_ms: 244.940854
type: 'test'
...
# Subtest: real runtime injects the coordinator, stops its workload and mirrors stable stop events across restart
ok 507 - real runtime injects the coordinator, stops its workload and mirrors stable stop events across restart
---
duration_ms: 256.979757
type: 'test'
...
# Subtest: invalid state still starts the control bus and human halt then resume repairs it
ok 508 - invalid state still starts the control bus and human halt then resume repairs it
---
duration_ms: 106.794611
type: 'test'
...
# Subtest: processing halt and resume extend only the socket timeout while ordinary status retains the explicit timeout
ok 509 - processing halt and resume extend only the socket timeout while ordinary status retains the explicit timeout
---
duration_ms: 194.822399
type: 'test'
...
# Subtest: a root halt aborts the active search-source signal before the normal web deadline
ok 510 - a root halt aborts the active search-source signal before the normal web deadline
---
duration_ms: 35.717022
type: 'test'
...
# Subtest: processing.halt refuses agent reader and tester before any transition
ok 511 - processing.halt refuses agent reader and tester before any transition
---
duration_ms: 49.462231
type: 'test'
...
# Subtest: processing.resume refuses agent reader and tester before any transition
ok 512 - processing.resume refuses agent reader and tester before any transition
---
duration_ms: 29.187931
type: 'test'
...
# Subtest: human halt and clear each have one event with verified actor; launch.restore cannot clear
ok 513 - human halt and clear each have one event with verified actor; launch.restore cannot clear
---
duration_ms: 27.188441
type: 'test'
...
# Subtest: all ordinary work verbs refuse before dispatch while pure reads remain available
ok 514 - all ordinary work verbs refuse before dispatch while pure reads remain available
---
duration_ms: 50.479729
type: 'test'
...
# Subtest: task web authorization and bind paths refuse before external work
ok 515 - task web authorization and bind paths refuse before external work
---
duration_ms: 28.397637
type: 'test'
...
# Subtest: recordEvent cannot forge processing.halt
ok 516 - recordEvent cannot forge processing.halt
---
duration_ms: 24.482395
type: 'test'
...
# Subtest: recordEvent cannot forge processing.resume
ok 517 - recordEvent cannot forge processing.resume
---
duration_ms: 22.27995
type: 'test'
...
# Subtest: recordEvent cannot forge processing.stop
ok 518 - recordEvent cannot forge processing.stop
---
duration_ms: 20.552638
type: 'test'
...
# Subtest: recordTask poll cannot forge a processing action through its kinds filter
ok 519 - recordTask poll cannot forge a processing action through its kinds filter
---
duration_ms: 21.165108
type: 'test'
...
# Subtest: recordTask self cannot forge a processing action through its kinds filter
ok 520 - recordTask self cannot forge a processing action through its kinds filter
---
duration_ms: 19.666371
type: 'test'
...
# Subtest: spec read remains a read but cannot release new write work after an await
ok 521 - spec read remains a read but cannot release new write work after an await
---
duration_ms: 24.452703
type: 'test'
...
# Subtest: the real socket awaits halt and resume beyond the ordinary idle deadline
ok 522 - the real socket awaits halt and resume beyond the ordinary idle deadline
---
duration_ms: 69.419959
type: 'test'
...
# Subtest: a malformed processing reader never silently admits agent work
ok 523 - a malformed processing reader never silently admits agent work
---
duration_ms: 27.00085
type: 'test'
...
# Subtest: halt refuses the newly landed host executor path before credentials or effects
ok 524 - halt refuses the newly landed host executor path before credentials or effects
---
duration_ms: 27.042946
type: 'test'
...
# Subtest: D1: committed write with a failed receipt refuses outcome-unknown without action.allowed
ok 525 - D1: committed write with a failed receipt refuses outcome-unknown without action.allowed
---
duration_ms: 39.079912
type: 'test'
...
# Subtest: D2: spec.read refuses without content if its role is released during the read
ok 526 - D2: spec.read refuses without content if its role is released during the read
---
duration_ms: 22.814609
type: 'test'
...
# Subtest: D3: spec.read secret check refuses flagged content without content
ok 527 - D3: spec.read secret check refuses flagged content without content
---
duration_ms: 23.53092
type: 'test'
...
# Subtest: D3: spec.read secret check refuses flagged subject without content
ok 528 - D3: spec.read secret check refuses flagged subject without content
---
duration_ms: 22.863633
type: 'test'
...
# Subtest: a human lists, opens and saves; the save is one commit by the business human
ok 529 - a human lists, opens and saves; the save is one commit by the business human
---
duration_ms: 182.289872
type: 'test'
...
# Subtest: an agent and a reader refuse every file verb and nothing is written
ok 530 - an agent and a reader refuse every file verb and nothing is written
---
duration_ms: 67.054315
type: 'test'
...
# Subtest: a stale base refuses stale-base and writes nothing
ok 531 - a stale base refuses stale-base and writes nothing
---
duration_ms: 116.01289
type: 'test'
...
# Subtest: paths outside the spec and docs refuse, as do unknown projects, missing files and odd arguments
ok 532 - paths outside the spec and docs refuse, as do unknown projects, missing files and odd arguments
---
duration_ms: 92.538744
type: 'test'
...
# Subtest: without a project adapter the file verbs refuse project-not-configured
ok 533 - without a project adapter the file verbs refuse project-not-configured
---
duration_ms: 42.79031
type: 'test'
...
# Subtest: on the socket a save may carry 1 MiB of text; every other request keeps the 64 KiB limit
ok 534 - on the socket a save may carry 1 MiB of text; every other request keeps the 64 KiB limit
---
duration_ms: 549.403224
type: 'test'
...
# Subtest: a request that names the save verb first and another verb last is refused at 64 KiB
ok 535 - a request that names the save verb first and another verb last is refused at 64 KiB
---
duration_ms: 115.448471
type: 'test'
...
# Subtest: two saves racing for one repository make one commit
ok 536 - two saves racing for one repository make one commit
---
duration_ms: 330.154634
type: 'test'
...
# Subtest: Broker keeps the sandbox client import closure: only the listed imports, no lazy project import
ok 537 - Broker keeps the sandbox client import closure: only the listed imports, no lazy project import
---
duration_ms: 2.394224
type: 'test'
...
# Subtest: without a trusted project adapter all three async paths refuse project-not-configured
ok 538 - without a trusted project adapter all three async paths refuse project-not-configured
---
duration_ms: 63.816923
type: 'test'
...
# Subtest: real startBroker injects the project adapter for socket reads and bound-author record writes
ok 539 - real startBroker injects the project adapter for socket reads and bound-author record writes
---
duration_ms: 308.147554
type: 'test'
...
# Subtest: a raise with no recorded push refuses no-push; a raise binds the latest push and shows it
ok 540 - a raise with no recorded push refuses no-push; a raise binds the latest push and shows it
---
duration_ms: 45.075365
type: 'test'
...
# Subtest: happy path: the fork is the upstream repo under the agent's own user, the destination is host-built
ok 541 - happy path: the fork is the upstream repo under the agent's own user, the destination is host-built
---
duration_ms: 42.876543
type: 'test'
...
# Subtest: a hard wait: no decision refuses, and a decision for another task refuses
ok 542 - a hard wait: no decision refuses, and a decision for another task refuses
---
duration_ms: 42.81544
type: 'test'
...
# Subtest: r4 B4: approve while the latest push is A, push B, publish refuses decision-mismatch
ok 543 - r4 B4: approve while the latest push is A, push B, publish refuses decision-mismatch
---
duration_ms: 71.630024
type: 'test'
...
# Subtest: grant and fork refusals
ok 544 - grant and fork refusals
---
duration_ms: 66.849148
type: 'test'
...
# Subtest: remote-not-fork, compared without case, and remote-host-mismatch, at push
ok 545 - remote-not-fork, compared without case, and remote-host-mismatch, at push
---
duration_ms: 143.676939
type: 'test'
...
# Subtest: two agents granted one project each get their own fork
ok 546 - two agents granted one project each get their own fork
---
duration_ms: 66.169476
type: 'test'
...
# Subtest: the request cannot name the fork, the user or the destination
ok 547 - the request cannot name the fork, the user or the destination
---
duration_ms: 33.535375
type: 'test'
...
# Subtest: one decision, one open publish: a second ticket refuses publish-busy, whatever its branch
ok 548 - one decision, one open publish: a second ticket refuses publish-busy, whatever its branch
---
duration_ms: 84.021754
type: 'test'
...
# Subtest: publishRefused files the code on the task's trail and drops the ticket
ok 549 - publishRefused files the code on the task's trail and drops the ticket
---
duration_ms: 43.464733
type: 'test'
...
# Subtest: git.push.remote is in neither ROUTED list and no shipped role grants it
ok 550 - git.push.remote is in neither ROUTED list and no shipped role grants it
---
duration_ms: 1.195228
type: 'test'
...
# Subtest: runtime: withGitea keys from the open ticket only, and the store root is the organization dir
ok 551 - runtime: withGitea keys from the open ticket only, and the store root is the organization dir
---
duration_ms: 181.525738
type: 'test'
...
# Subtest: the bus process answers the publish ops from their own lines, not launch-op-refused
ok 552 - the bus process answers the publish ops from their own lines, not launch-op-refused
---
duration_ms: 317.013878
type: 'test'
...
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# Subtest: T14 a create goes live with no restart: the new instance binds at once and the answer says restart false
ok 553 - T14 a create goes live with no restart: the new instance binds at once and the answer says restart false
---
duration_ms: 104.697186
type: 'test'
...
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# Subtest: T14 every committed verb reloads once, limits.set, routes.set, plugins.set and veto.set included, and a refused one does not
ok 554 - T14 every committed verb reloads once, limits.set, routes.set, plugins.set and veto.set included, and a refused one does not
---
duration_ms: 148.261569
type: 'test'
...
# Subtest: T14 a definition change on a running instance refuses instance-running; a vars change still goes live
ok 555 - T14 a definition change on a running instance refuses instance-running; a vars change still goes live
---
duration_ms: 98.298756
type: 'test'
...
# Subtest: T14 a file whose credential references differ from the boot copy is not reloaded and the write answers restart true
ok 556 - T14 a file whose credential references differ from the boot copy is not reloaded and the write answers restart true
---
duration_ms: 74.703241
type: 'test'
...
# Subtest: T14 a date-only change to a credential reference still reloads: row 199 issue rewrites the date outside the reload
ok 557 - T14 a date-only change to a credential reference still reloads: row 199 issue rewrites the date outside the reload
---
duration_ms: 84.564623
type: 'test'
...
# Subtest: T19 a credentialed create answers restart true; issue works only after a restart, and a later vars change goes live
ok 558 - T19 a credentialed create answers restart true; issue works only after a restart, and a later vars change goes live
---
duration_ms: 206.981124
type: 'test'
...
# Subtest: T14 after a refused reload veto.set, instance.hire and instance.fire answer restart true, and a fire of a name kept since refuses before step A
ok 559 - T14 after a refused reload veto.set, instance.hire and instance.fire answer restart true, and a fire of a name kept since refuses before step A
---
duration_ms: 299.885359
type: 'test'
...
# Subtest: T14 a file whose project root differs from the boot copy is not reloaded, because the Credentials store protects the boot roots
ok 560 - T14 a file whose project root differs from the boot copy is not reloaded, because the Credentials store protects the boot roots
---
duration_ms: 83.375717
type: 'test'
...
# organization: {"event":"reload-needs-restart","business":"demo"}
# Subtest: T14 a file whose library mapping differs from the boot copy is not reloaded, because the mirror is ensured at start
ok 561 - T14 a file whose library mapping differs from the boot copy is not reloaded, because the mirror is ensured at start
---
duration_ms: 370.960873
type: 'test'
...
# Subtest: T14 reloadBusiness refuses an unknown business, a changed human and a document the boot check refuses
ok 562 - T14 reloadBusiness refuses an unknown business, a changed human and a document the boot check refuses
---
duration_ms: 18.79635
type: 'test'
...
# Subtest: a reply is listed for human and reader sessions, and its delivery rows are unchanged
ok 563 - a reply is listed for human and reader sessions, and its delivery rows are unchanged
---
duration_ms: 53.997256
type: 'test'
...
# Subtest: the reply still reaches the human message.receive (mosaic talk) after the Console showed it
ok 564 - the reply still reaches the human message.receive (mosaic talk) after the Console showed it
---
duration_ms: 30.60827
type: 'test'
...
# Subtest: a message with no reply gives an empty list
ok 565 - a message with no reply gives an empty list
---
duration_ms: 26.07506
type: 'test'
...
# Subtest: replies come oldest first and stop at REPLIES
ok 566 - replies come oldest first and stop at REPLIES
---
duration_ms: 121.067948
type: 'test'
...
# Subtest: an id that names no message in the business refuses message-not-found, and the refusal is recorded
ok 567 - an id that names no message in the business refuses message-not-found, and the refusal is recorded
---
duration_ms: 43.001269
type: 'test'
...
# Subtest: strict arguments; a role session gets human-required
ok 568 - strict arguments; a role session gets human-required
---
duration_ms: 50.466469
type: 'test'
...
# Subtest: views passes replies through as one call with the id
ok 569 - views passes replies through as one call with the id
---
duration_ms: 0.268245
type: 'test'
...
# Subtest: requirements returns the committed list to a holding role session, and no one else
ok 570 - requirements returns the committed list to a holding role session, and no one else
---
duration_ms: 40.750088
type: 'test'
...
# Subtest: the PM's prd.approve with no task, when no id fits, reaches the human's Inbox
ok 571 - the PM's prd.approve with no task, when no id fits, reaches the human's Inbox
---
duration_ms: 27.009196
type: 'test'
...
# Subtest: the PM's non-blocking role.revoke with no task reaches the human's Inbox
ok 572 - the PM's non-blocking role.revoke with no task reaches the human's Inbox
---
duration_ms: 27.661153
type: 'test'
...
# Subtest: a push is recorded as the action.allowed for git.push.working on the task, and only the host records one
ok 573 - a push is recorded as the action.allowed for git.push.working on the task, and only the host records one
---
duration_ms: 46.431961
type: 'test'
...
# Subtest: review.request names the latest pushed commit and sends the reviewer a REVIEW-REQUEST
ok 574 - review.request names the latest pushed commit and sends the reviewer a REVIEW-REQUEST
---
duration_ms: 35.193111
type: 'test'
...
# Subtest: review.request says which run holds the reviewer role, or null, and a null request waits for a claim
ok 575 - review.request says which run holds the reviewer role, or null, and a null request waits for a claim
---
duration_ms: 42.50481
type: 'test'
...
# Subtest: review.request refuses a commit that isn't the latest push, a non-reviewer and a role without the action
ok 576 - review.request refuses a commit that isn't the latest push, a non-reviewer and a role without the action
---
duration_ms: 57.398586
type: 'test'
...
# Subtest: reviewFetch answers only the addressed reviewer, for the request it cites
ok 577 - reviewFetch answers only the addressed reviewer, for the request it cites
---
duration_ms: 46.93177
type: 'test'
...
# Subtest: review.verdict answers one request once, to the role that asked
ok 578 - review.verdict answers one request once, to the role that asked
---
duration_ms: 49.416025
type: 'test'
...
# Subtest: task.close on a pushed task needs an approve verdict for the latest push
ok 579 - task.close on a pushed task needs an approve verdict for the latest push
---
duration_ms: 76.500015
type: 'test'
...
# Subtest: a refusal the host decided is filed on the task it names, and only a task ref counts
ok 580 - a refusal the host decided is filed on the task it names, and only a task ref counts
---
duration_ms: 43.491164
type: 'test'
...
# organization: {"event":"reload-needs-restart","business":"demo"}
# Subtest: row 65: routes and routes.set refuse every non-human session, the chief of staff included, the tester may read and set, and each passes the verified actor
ok 581 - row 65: routes and routes.set refuse every non-human session, the chief of staff included, the tester may read and set, and each passes the verified actor
---
duration_ms: 48.539774
type: 'test'
...
# Subtest: row 65: a new launch binds only on a switched-on harness with a module name, and a run an earlier broker bound binds again after its harness is switched off
ok 582 - row 65: a new launch binds only on a switched-on harness with a module name, and a run an earlier broker bound binds again after its harness is switched off
---
duration_ms: 38.772968
type: 'test'
...
# Subtest: row 65 runtime: harnessLevels answers each module in the tree, and null for a name with no module
ok 583 - row 65 runtime: harnessLevels answers each module in the tree, and null for a name with no module
---
duration_ms: 61.348468
type: 'test'
...
# Subtest: row 65 runtime: routes and routes.set reach the organization file with the human as actor, a new bind reads plugins.harness, and each refusal keeps the bytes and logs nothing
ok 584 - row 65 runtime: routes and routes.set reach the organization file with the human as actor, a new bind reads plugins.harness, and each refusal keeps the bytes and logs nothing
---
duration_ms: 154.379512
type: 'test'
...
# Subtest: v3b prototype refusals, views and append-only mutations
ok 585 - v3b prototype refusals, views and append-only mutations
---
duration_ms: 119.738319
type: 'test'
...
# Subtest: gated approval authorizes once, survives store reopen, and fresh approval works
ok 586 - gated approval authorizes once, survives store reopen, and fresh approval works
---
duration_ms: 54.297284
type: 'test'
...
# Subtest: another run of the same instance consumes an approval once; a failed check leaves it usable
ok 587 - another run of the same instance consumes an approval once; a failed check leaves it usable
---
duration_ms: 42.139099
type: 'test'
...
# Subtest: two scheduled callers have exactly one grant and one consumed refusal
ok 588 - two scheduled callers have exactly one grant and one consumed refusal
---
duration_ms: 30.765904
type: 'test'
...
# Subtest: failed commit rolls consumption back; cross-role consumes and within-role stays reusable
ok 589 - failed commit rolls consumption back; cross-role consumes and within-role stays reusable
---
duration_ms: 64.157354
type: 'test'
...
# Subtest: class drift gated to cross-role refuses before consumption
ok 590 - class drift gated to cross-role refuses before consumption
---
duration_ms: 43.578431
type: 'test'
...
# Subtest: class drift cross-role to gated refuses before consumption
ok 591 - class drift cross-role to gated refuses before consumption
---
duration_ms: 53.343032
type: 'test'
...
# Subtest: class drift gated to within-role refuses before consumption
ok 592 - class drift gated to within-role refuses before consumption
---
duration_ms: 65.265886
type: 'test'
...
# Subtest: class drift cross-role to within-role refuses before consumption
ok 593 - class drift cross-role to within-role refuses before consumption
---
duration_ms: 66.368016
type: 'test'
...
# Subtest: class drift within-role to gated refuses before consumption
ok 594 - class drift within-role to gated refuses before consumption
---
duration_ms: 57.312098
type: 'test'
...
# Subtest: class drift within-role to cross-role refuses before consumption
ok 595 - class drift within-role to cross-role refuses before consumption
---
duration_ms: 38.692423
type: 'test'
...
# Subtest: message.send consumes approval and prevents a later send or authorize
ok 596 - message.send consumes approval and prevents a later send or authorize
---
duration_ms: 48.666536
type: 'test'
...
# Subtest: role.revoke consumes approval and prevents a later revoke or authorize
ok 597 - role.revoke consumes approval and prevents a later revoke or authorize
---
duration_ms: 57.670754
type: 'test'
...
# Subtest: 3e copy migrates through 3f to 3g preserving every old column/row and adding null spec citations
ok 598 - 3e copy migrates through 3f to 3g preserving every old column/row and adding null spec citations
---
duration_ms: 165.320084
type: 'test'
...
# Subtest: a human spec save sends one notice to each pm and cto, naming the commit, and each commit sends its own
ok 599 - a human spec save sends one notice to each pm and cto, naming the commit, and each commit sends its own
---
duration_ms: 360.405575
type: 'test'
...
# Subtest: no notice for a docs save, an agent record commit, a git commit outside the Console, or a refused save
ok 600 - no notice for a docs save, an agent record commit, a git commit outside the Console, or a refused save
---
duration_ms: 294.124743
type: 'test'
...
# Subtest: a notice to a role no run holds waits for a claim, and launches nobody and tells nobody
ok 601 - a notice to a role no run holds waits for a claim, and launches nobody and tells nobody
---
duration_ms: 118.346803
type: 'test'
...
# Subtest: a business without a pm or a cto saves the spec and sends nothing
ok 602 - a business without a pm or a cto saves the spec and sends nothing
---
duration_ms: 117.306577
type: 'test'
...
# Subtest: a notice that cannot be stored answers outcome-unknown, and the commit stands
ok 603 - a notice that cannot be stored answers outcome-unknown, and the commit stands
---
duration_ms: 124.613627
type: 'test'
...
# Subtest: a BLOCK reaches the chief of staff, the chief relays it to the assistant in the user's thread, and the commit stands
ok 604 - a BLOCK reaches the chief of staff, the chief relays it to the assistant in the user's thread, and the commit stands
---
duration_ms: 129.393467
type: 'test'
...
# Subtest: with no thread a BLOCK still reaches the chief of staff, and the relay to the assistant is refused
ok 605 - with no thread a BLOCK still reaches the chief of staff, and the relay to the assistant is refused
---
duration_ms: 114.18315
type: 'test'
...
# Subtest: within the notice's project the relay lands in the user's most recently opened thread
ok 606 - within the notice's project the relay lands in the user's most recently opened thread
---
duration_ms: 132.964805
type: 'test'
...
# Subtest: a more recently opened thread in another project does not take the relay
ok 607 - a more recently opened thread in another project does not take the relay
---
duration_ms: 127.008391
type: 'test'
...
# Subtest: a BLOCK is refused from anyone but a pm or cto, to anyone but the chief of staff, and outside a reply to its own notice
ok 608 - a BLOCK is refused from anyone but a pm or cto, to anyone but the chief of staff, and outside a reply to its own notice
---
duration_ms: 144.995875
type: 'test'
...
# Subtest: a role cannot forge a spec notice: its text opens neither a BLOCK nor the assistant's thread
ok 609 - a role cannot forge a spec notice: its text opens neither a BLOCK nor the assistant's thread
---
duration_ms: 130.070061
type: 'test'
...
# Subtest: the bus receives nothing: a reply to a notice addressed to _bus is refused
ok 610 - the bus receives nothing: a reply to a notice addressed to _bus is refused
---
duration_ms: 116.941532
type: 'test'
...
# Subtest: real socket awaits spec reads, record writes and cited raises; other requests still return normally
ok 611 - real socket awaits spec reads, record writes and cited raises; other requests still return normally
---
duration_ms: 330.396566
type: 'test'
...
# Subtest: real socket preserves asynchronous refusal codes and disconnects its transient proof
ok 612 - real socket preserves asynchronous refusal codes and disconnects its transient proof
---
duration_ms: 129.912429
type: 'test'
...
# Subtest: two real socket writes to one repository yield one commit and one project-busy refusal
ok 613 - two real socket writes to one repository yield one commit and one project-busy refusal
---
duration_ms: 127.477087
type: 'test'
...
# Subtest: client disconnect during await tolerates late reply
ok 614 - client disconnect during await tolerates late reply
---
duration_ms: 100.638063
type: 'test'
...
# Subtest: client disconnect during await tolerates late refusal
ok 615 - client disconnect during await tolerates late refusal
---
duration_ms: 79.215511
type: 'test'
...
# Subtest: N-a: slow admitted record.write returns its committed result after the idle deadline
ok 616 - N-a: slow admitted record.write returns its committed result after the idle deadline
---
duration_ms: 257.493452
type: 'test'
...
# Subtest: current citation is recorded; docs commits do not stale it and a new spec never reopens settlement
ok 617 - current citation is recorded; docs commits do not stale it and a new spec never reopens settlement
---
duration_ms: 234.871636
type: 'test'
...
# Subtest: stale, unconfirmed, missing and partial spec citations refuse without inserting a decision
ok 618 - stale, unconfirmed, missing and partial spec citations refuse without inserting a decision
---
duration_ms: 213.355582
type: 'test'
...
# Subtest: uncited raises retain their synchronous path and spec read is available to any held role in its business
ok 619 - uncited raises retain their synchronous path and spec read is available to any held role in its business
---
duration_ms: 81.732357
type: 'test'
...
# Subtest: record writes bind the session author, require authority and refuse spec and impersonation paths
ok 620 - record writes bind the session author, require authority and refuse spec and impersonation paths
---
duration_ms: 86.641424
type: 'test'
...
# Subtest: REQ-COS-1: the pm asks the chief of staff for roles and counts; the chief receives a STAFF-REQUEST and answers it
ok 621 - REQ-COS-1: the pm asks the chief of staff for roles and counts; the chief receives a STAFF-REQUEST and answers it
---
duration_ms: 67.34326
type: 'test'
...
# Subtest: REQ-COS-1: only the pm can send a staff request; every other session is refused and the chief of staff hears nothing
ok 622 - REQ-COS-1: only the pm can send a staff request; every other session is refused and the chief of staff hears nothing
---
duration_ms: 55.228016
type: 'test'
...
# Subtest: REQ-COS-1: a pm without message.send is refused like any other gated action
ok 623 - REQ-COS-1: a pm without message.send is refused like any other gated action
---
duration_ms: 33.618311
type: 'test'
...
# Subtest: REQ-COS-1: the request goes to the business launcher, and only when that is a chief of staff
ok 624 - REQ-COS-1: the request goes to the business launcher, and only when that is a chief of staff
---
duration_ms: 75.019881
type: 'test'
...
# Subtest: REQ-COS-1: the sender is judged by definition: an instance `lead` of the pm definition can ask, an instance `pm` of the coder definition can't
ok 625 - REQ-COS-1: the sender is judged by definition: an instance `lead` of the pm definition can ask, an instance `pm` of the coder definition can't
---
duration_ms: 79.191514
type: 'test'
...
# Subtest: REQ-COS-1: the launcher is judged by definition: an instance `boss` of the chief-of-staff definition receives, a `chief` of the coder definition gives no-chief-of-staff
ok 626 - REQ-COS-1: the launcher is judged by definition: an instance `boss` of the chief-of-staff definition receives, a `chief` of the coder definition gives no-chief-of-staff
---
duration_ms: 78.657879
type: 'test'
...
# Subtest: REQ-COS-1: a refused staff request leaves no staff.request action.allowed event
ok 627 - REQ-COS-1: a refused staff request leaves no staff.request action.allowed event
---
duration_ms: 35.373746
type: 'test'
...
# Subtest: REQ-ASSIST-2: the role definitions' messaging lists hold for a staff request, sender and recipient
ok 628 - REQ-ASSIST-2: the role definitions' messaging lists hold for a staff request, sender and recipient
---
duration_ms: 95.666936
type: 'test'
...
# Subtest: a staff request names a task, 1 to 10 distinct roles and counts of 1 to 20; nothing else is accepted
ok 629 - a staff request names a task, 1 to 10 distinct roles and counts of 1 to 20; nothing else is accepted
---
duration_ms: 61.202777
type: 'test'
...
# Subtest: REQ-COS-1: a staff request grants nothing: the pm still can't launch and the chief of staff launches as before
ok 630 - REQ-COS-1: a staff request grants nothing: the pm still can't launch and the chief of staff launches as before
---
duration_ms: 44.036805
type: 'test'
...
# Subtest: a business that never switched launches reads allowed with no time and no event
ok 631 - a business that never switched launches reads allowed with no time and no event
---
duration_ms: 45.428845
type: 'test'
...
# Subtest: launches revoked and then restored read allowed, with the restore time and event id
ok 632 - launches revoked and then restored read allowed, with the restore time and event id
---
duration_ms: 36.498723
type: 'test'
...
# Subtest: a task closed on the tracker leaves the open list, and total counts the open ones
ok 633 - a task closed on the tracker leaves the open list, and total counts the open ones
---
duration_ms: 31.930828
type: 'test'
...
# Subtest: a tombstone is not open
ok 634 - a tombstone is not open
---
duration_ms: 25.715305
type: 'test'
...
# Subtest: the open list stops at the cap and says so; total still counts every open task
ok 635 - the open list stops at the cap and says so; total still counts every open task
---
duration_ms: 26.844809
type: 'test'
...
# Subtest: a role and a reader session read state; arguments, and an unbound cap, refuse
ok 636 - a role and a reader session read state; arguments, and an unbound cap, refuse
---
duration_ms: 27.331203
type: 'test'
...
# Subtest: a human session reads the same state, with the same cap
ok 637 - a human session reads the same state, with the same cap
---
duration_ms: 28.318056
type: 'test'
...
# Subtest: reading state writes nothing: every table keeps its row count
ok 638 - reading state writes nothing: every table keeps its row count
---
duration_ms: 25.292472
type: 'test'
...
# Subtest: creates private WAL store and excludes a second writer until explicit close
ok 639 - creates private WAL store and excludes a second writer until explicit close
---
duration_ms: 28.368058
type: 'test'
...
# Subtest: rollback is atomic and schema metadata is checked against trusted DDL, not just itself
ok 640 - rollback is atomic and schema metadata is checked against trusted DDL, not just itself
---
duration_ms: 33.228376
type: 'test'
...
# Subtest: existing empty database and symlink runtime directory refuse, never initialize over damage
ok 641 - existing empty database and symlink runtime directory refuse, never initialize over damage
---
duration_ms: 25.747045
type: 'test'
...
# Subtest: crash during a transaction recovers no partial event after explicit fixture-only lock removal
ok 642 - crash during a transaction recovers no partial event after explicit fixture-only lock removal
---
duration_ms: 98.020486
type: 'test'
...
# Subtest: writer refuses mixed at/read_at forms atomically, even through trusted SQL helpers
ok 643 - writer refuses mixed at/read_at forms atomically, even through trusted SQL helpers
---
duration_ms: 17.797082
type: 'test'
...
# Subtest: async transactions refuse before invoking their function
ok 644 - async transactions refuse before invoking their function
---
duration_ms: 14.311315
type: 'test'
...
# Subtest: usage_records refuses non-canonical timestamps atomically
ok 645 - usage_records refuses non-canonical timestamps atomically
---
duration_ms: 14.863107
type: 'test'
...
# Subtest: the session default fits under the reply cap and pages to the end with next
ok 646 - the session default fits under the reply cap and pages to the end with next
---
duration_ms: 216.133893
type: 'test'
...
# Subtest: the short form: no description, assignees by role, every listed key
ok 647 - the short form: no description, assignees by role, every listed key
---
duration_ms: 125.597815
type: 'test'
...
# Subtest: each filter, alone and together, and total counts every match
ok 648 - each filter, alone and together, and total counts every match
---
duration_ms: 226.458632
type: 'test'
...
# Subtest: task_ref reads one task in full, as the whole board has it
ok 649 - task_ref reads one task in full, as the whole board has it
---
duration_ms: 168.688268
type: 'test'
...
# Subtest: no arguments is the read the Console and mosaic make, unchanged
ok 650 - no arguments is the read the Console and mosaic make, unchanged
---
duration_ms: 128.743807
type: 'test'
...
# Subtest: an unknown argument or a bad value refuses invalid-request
ok 651 - an unknown argument or a bad value refuses invalid-request
---
duration_ms: 471.282792
type: 'test'
...
# Subtest: tasks rows carry priority and requirement for every session that reads tasks
ok 652 - tasks rows carry priority and requirement for every session that reads tasks
---
duration_ms: 70.336993
type: 'test'
...
# Subtest: the read model rebuilds from the ledger: a reopened bus and each trail give the same values
ok 653 - the read model rebuilds from the ledger: a reopened bus and each trail give the same values
---
duration_ms: 66.260168
type: 'test'
...
# Subtest: an empty business and one with snapshots but no task.created read cleanly
ok 654 - an empty business and one with snapshots but no task.created read cleanly
---
duration_ms: 16.485124
type: 'test'
...
# Subtest: recordTask keeps sync reads and a role write apart
ok 655 - recordTask keeps sync reads and a role write apart
---
duration_ms: 36.508827
type: 'test'
...
# Subtest: read_at must be one canonical UTC format, so the projection compares strings safely
ok 656 - read_at must be one canonical UTC format, so the projection compares strings safely
---
duration_ms: 17.149518
type: 'test'
...
# Subtest: a bad entry refuses the whole record
ok 657 - a bad entry refuses the whole record
---
duration_ms: 20.410159
type: 'test'
...
# Subtest: taskView reads the projection for one business
ok 658 - taskView reads the projection for one business
---
duration_ms: 20.2729
type: 'test'
...
# Subtest: requestTask hands only a holder and a task verb to the handler, and records refusals
ok 659 - requestTask hands only a holder and a task verb to the handler, and records refusals
---
duration_ms: 37.519851
type: 'test'
...
# Subtest: the server sends task verbs to the adapter with its own timeout; other verbs stay synchronous
ok 660 - the server sends task verbs to the adapter with its own timeout; other verbs stay synchronous
---
duration_ms: 310.072339
type: 'test'
...
# Subtest: without an adapter the server refuses every task verb
ok 661 - without an adapter the server refuses every task verb
---
duration_ms: 69.563693
type: 'test'
...
# Subtest: the runtime refuses an invalid adapter and closes a valid one
ok 662 - the runtime refuses an invalid adapter and closes a valid one
---
duration_ms: 88.614232
type: 'test'
...
# Subtest: the process loads the S3 adapter from plain-data trackers
ok 663 - the process loads the S3 adapter from plain-data trackers
---
duration_ms: 385.893317
type: 'test'
...
# Subtest: row 177 T1: a tester thread is owned by tester, and neither side reaches or lists the other
ok 664 - row 177 T1: a tester thread is owned by tester, and neither side reaches or lists the other
---
duration_ms: 45.079443
type: 'test'
...
# Subtest: row 177 T2: the tester thread.send is from tester-cli with no human.input; its open is by tester
ok 665 - row 177 T2: the tester thread.send is from tester-cli with no human.input; its open is by tester
---
duration_ms: 26.93061
type: 'test'
...
# Subtest: row 177 T3: the lists read the tester as the human in its own thread, and nowhere else
ok 666 - row 177 T3: the lists read the tester as the human in its own thread, and nowhere else
---
duration_ms: 21.253953
type: 'test'
...
# Subtest: row 177 T3: an assistant that would not hear the human refuses the tester too
ok 667 - row 177 T3: an assistant that would not hear the human refuses the tester too
---
duration_ms: 25.897934
type: 'test'
...
# Subtest: row 177 T4: the tester thread run answers the tester, never the human
ok 668 - row 177 T4: the tester thread run answers the tester, never the human
---
duration_ms: 44.445047
type: 'test'
...
# Subtest: row 177 T5: each stop revokes only its own threads, recorded by its own actor
ok 669 - row 177 T5: each stop revokes only its own threads, recorded by its own actor
---
duration_ms: 34.104028
type: 'test'
...
# Subtest: row 177 T5: the human stop never ends a tester run
ok 670 - row 177 T5: the human stop never ends a tester run
---
duration_ms: 25.595243
type: 'test'
...
# Subtest: row 177 T6: a business whose human is tester refuses invalid-business
ok 671 - row 177 T6: a business whose human is tester refuses invalid-business
---
duration_ms: 17.318266
type: 'test'
...
# Subtest: row 177 T7: the human trail shows a tester thread message as the tester
ok 672 - row 177 T7: the human trail shows a tester thread message as the tester
---
duration_ms: 33.459798
type: 'test'
...
# Subtest: row 177 T8: a tester-thread run never raises a decision to the human; a human-thread run still does
ok 673 - row 177 T8: a tester-thread run never raises a decision to the human; a human-thread run still does
---
duration_ms: 34.281094
type: 'test'
...
# Subtest: row 177 T8: a tester-thread raise routed to the arbiter stays allowed
ok 674 - row 177 T8: a tester-thread raise routed to the arbiter stays allowed
---
duration_ms: 27.424248
type: 'test'
...
# Subtest: row 182 T9: a tester reply into the human's thread refuses thread-not-owned and stores nothing
ok 675 - row 182 T9: a tester reply into the human's thread refuses thread-not-owned and stores nothing
---
duration_ms: 30.420409
type: 'test'
...
# Subtest: row 182 T9: a tester reply into its own thread lands there
ok 676 - row 182 T9: a tester reply into its own thread lands there
---
duration_ms: 30.102183
type: 'test'
...
# Subtest: row 182 T9: the chief's reply up a chain into a tester's thread lands there
ok 677 - row 182 T9: the chief's reply up a chain into a tester's thread lands there
---
duration_ms: 34.028175
type: 'test'
...
# Subtest: row 182 T9: a tester reply to a spec notice refuses thread-not-owned; the chief's relay still lands
ok 678 - row 182 T9: a tester reply to a spec notice refuses thread-not-owned; the chief's relay still lands
---
duration_ms: 35.926656
type: 'test'
...
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# organization: {"event":"reload-needs-restart","business":"demo"}
# Subtest: row 175: TESTER_VERBS and the organization branch tester set are pinned
ok 679 - row 175: TESTER_VERBS and the organization branch tester set are pinned
---
duration_ms: 2.144034
type: 'test'
...
# Subtest: row 175: each of the six reads as the tester deep-equals the human read
ok 680 - row 175: each of the six reads as the tester deep-equals the human read
---
duration_ms: 97.085337
type: 'test'
...
# Subtest: row 175: W1-W3 as the tester land with receipt actor tester; the human still logs the human
ok 681 - row 175: W1-W3 as the tester land with receipt actor tester; the human still logs the human
---
duration_ms: 123.874464
type: 'test'
...
# Subtest: row 175: W2 as the tester refuses credentials, protected definitions, human, tester and bus.tester, and changes nothing
ok 682 - row 175: W2 as the tester refuses credentials, protected definitions, human, tester and bus.tester, and changes nothing
---
duration_ms: 97.880882
type: 'test'
...
# Subtest: row 175: the human-only actions refuse a tester tester-refused, and the file and store stay as they were
ok 683 - row 175: the human-only actions refuse a tester tester-refused, and the file and store stay as they were
---
duration_ms: 98.31888
type: 'test'
...
# Subtest: row 175: W4 as the tester writes by tester and keeps every name check
ok 684 - row 175: W4 as the tester writes by tester and keeps every name check
---
duration_ms: 29.379918
type: 'test'
...
# Subtest: row 175: W6 as the tester records created_by tester; the human records the human
ok 685 - row 175: W6 as the tester records created_by tester; the human records the human
---
duration_ms: 23.537658
type: 'test'
...
# Subtest: row 175: with bus.tester unset or not exactly true no tester binds, so no read or write runs
ok 686 - row 175: with bus.tester unset or not exactly true no tester binds, so no read or write runs
---
duration_ms: 78.406021
type: 'test'
...
# Subtest: the tester binds only when the business sets bus.tester to exactly true
ok 687 - the tester binds only when the business sets bus.tester to exactly true
---
duration_ms: 124.071912
type: 'test'
...
# Subtest: a business may not name a role tester, so the tester address is never a role
ok 688 - a business may not name a role tester, so the tester address is never a role
---
duration_ms: 39.59495
type: 'test'
...
# Subtest: every verb outside the tester list refuses tester-refused and is recorded against the tester
ok 689 - every verb outside the tester list refuses tester-refused and is recorded against the tester
---
duration_ms: 74.087545
type: 'test'
...
# Subtest: a tester message is from tester, needs no prefix, and writes no human.input or authority
ok 690 - a tester message is from tester, needs no prefix, and writes no human.input or authority
---
duration_ms: 30.173716
type: 'test'
...
# Subtest: a tester message to a role no run holds refuses tester-target-not-running and stores nothing
ok 691 - a tester message to a role no run holds refuses tester-target-not-running and stores nothing
---
duration_ms: 21.104206
type: 'test'
...
# Subtest: a tester message is refused while the run is only launched, and routes once it claims
ok 692 - a tester message is refused while the run is only launched, and routes once it claims
---
duration_ms: 27.426324
type: 'test'
...
# Subtest: a human message to a role no run holds still waits and tells launch.by
ok 693 - a human message to a role no run holds still waits and tells launch.by
---
duration_ms: 22.008078
type: 'test'
...
# Subtest: a role answers a tester only in reply to a tester message, and the answer never reaches the human
ok 694 - a role answers a tester only in reply to a tester message, and the answer never reaches the human
---
duration_ms: 41.756656
type: 'test'
...
# Subtest: the tester reads the human views a reader reads
ok 695 - the tester reads the human views a reader reads
---
duration_ms: 43.056681
type: 'test'
...
# Subtest: tester proof binds its own CLI, start time and nonce, refuses a managed run and allows an agent
ok 696 - tester proof binds its own CLI, start time and nonce, refuses a managed run and allows an agent
---
duration_ms: 2.103042
type: 'test'
...
# Subtest: neither CLI's nonce proves the other: each proof is bound to its own CLI and nonce variable
ok 697 - neither CLI's nonce proves the other: each proof is bound to its own CLI and nonce variable
---
duration_ms: 0.650748
type: 'test'
...
# Subtest: testerNonce reads only the tester's variable and gives null on any read error
ok 698 - testerNonce reads only the tester's variable and gives null on any read error
---
duration_ms: 0.348283
type: 'test'
...
# Subtest: an envelope carries exactly one of cap, human and tester; no tester authenticator refuses
ok 699 - an envelope carries exactly one of cap, human and tester; no tester authenticator refuses
---
duration_ms: 166.841566
type: 'test'
...
# Subtest: tester-cli.mjs binds through the runtime when the switch is on, and refuses off or under a run marker
ok 700 - tester-cli.mjs binds through the runtime when the switch is on, and refuses off or under a run marker
---
duration_ms: 1201.414945
type: 'test'
...
# Subtest: T1: the human and the reader see a held thread claim; agents still lists the role only
ok 701 - T1: the human and the reader see a held thread claim; agents still lists the role only
---
duration_ms: 36.347433
type: 'test'
...
# Subtest: T2: a released or revoked thread claim is not listed, though its thread has an earlier claim row
ok 702 - T2: a released or revoked thread claim is not listed, though its thread has an earlier claim row
---
duration_ms: 33.20519
type: 'test'
...
# Subtest: T3: a role session refuses human-required and the tester refuses tester-refused
ok 703 - T3: a role session refuses human-required and the tester refuses tester-refused
---
duration_ms: 30.252974
type: 'test'
...
# Subtest: T4: agents answers each session the same before and after a thread run claims
ok 704 - T4: agents answers each session the same before and after a thread run claims
---
duration_ms: 32.660197
type: 'test'
...
# Subtest: T5: the result carries neither the thread name a user wrote nor a message body
ok 705 - T5: the result carries neither the thread name a user wrote nor a message body
---
duration_ms: 33.202642
type: 'test'
...
# Subtest: REQ-THREAD-1 REQ-ORG-2: the 3d→3e migration adds the thread tables and leaves messages from before threads as written
ok 706 - REQ-THREAD-1 REQ-ORG-2: the 3d→3e migration adds the thread tables and leaves messages from before threads as written
---
duration_ms: 137.285633
type: 'test'
...
# Subtest: REQ-THREAD-1: a 3d bus with a changed schema is refused and keeps its version and tables
ok 707 - REQ-THREAD-1: a 3d bus with a changed schema is refused and keeps its version and tables
---
duration_ms: 75.063073
type: 'test'
...
# Subtest: REQ-THREAD-1: the offline command prints the kept-message counts before the ready line
ok 708 - REQ-THREAD-1: the offline command prints the kept-message counts before the ready line
---
duration_ms: 167.625965
type: 'test'
...
# Subtest: REQ-ROLE-2 REQ-THREAD-1: one holder per thread, through the broker and the trigger
ok 709 - REQ-ROLE-2 REQ-THREAD-1: one holder per thread, through the broker and the trigger
---
duration_ms: 59.127486
type: 'test'
...
# Subtest: REQ-ROLE-2 REQ-THREAD-1: the 3e triggers refuse writes that skip the broker
ok 710 - REQ-ROLE-2 REQ-THREAD-1: the 3e triggers refuse writes that skip the broker
---
duration_ms: 94.703109
type: 'test'
...
# Subtest: REQ-MSG-1: a message to or from the assistant names its thread, or is refused
ok 711 - REQ-MSG-1: a message to or from the assistant names its thread, or is refused
---
duration_ms: 53.892481
type: 'test'
...
# Subtest: REQ-MSG-1: the chief of staff's reply comes back to the thread that sent the work
ok 712 - REQ-MSG-1: the chief of staff's reply comes back to the thread that sent the work
---
duration_ms: 881.872135
type: 'test'
...
# Subtest: REQ-MSG-1: a reply can't carry one thread instance's thread to another thread instance
ok 713 - REQ-MSG-1: a reply can't carry one thread instance's thread to another thread instance
---
duration_ms: 20.607335
type: 'test'
...
# Subtest: REQ-THREAD-1 REQ-USER-2: one thread's messages never reach another thread's holder
ok 714 - REQ-THREAD-1 REQ-USER-2: one thread's messages never reach another thread's holder
---
duration_ms: 31.028798
type: 'test'
...
# Subtest: REQ-LAUNCH-1: a message to a thread with no holder waits, and the next holder gets it
ok 715 - REQ-LAUNCH-1: a message to a thread with no holder waits, and the next holder gets it
---
duration_ms: 31.964838
type: 'test'
...
# Subtest: REQ-THREAD-2 REQ-LAUNCH-1: threadIdle releases only a thread with nothing waiting, and only for its holder
ok 716 - REQ-THREAD-2 REQ-LAUNCH-1: threadIdle releases only a thread with nothing waiting, and only for its holder
---
duration_ms: 35.487966
type: 'test'
...
# Subtest: REQ-THREAD-2 REQ-LAUNCH-1: a message delivered to a run that ended unread doesn't hold up the next holder
ok 717 - REQ-THREAD-2 REQ-LAUNCH-1: a message delivered to a run that ended unread doesn't hold up the next holder
---
duration_ms: 27.086575
type: 'test'
...
# Subtest: REQ-ROLE-2 REQ-THREAD-1 Q169: a role.revoke the human approved ends every thread run of the assistant
ok 718 - REQ-ROLE-2 REQ-THREAD-1 Q169: a role.revoke the human approved ends every thread run of the assistant
---
duration_ms: 27.444419
type: 'test'
...
# Subtest: Q169 REQ-USER-2: assistant.stop ends the human's own assistant thread runs, and only the human's
ok 719 - Q169 REQ-USER-2: assistant.stop ends the human's own assistant thread runs, and only the human's
---
duration_ms: 39.038683
type: 'test'
...
# Subtest: REQ-USER-2: the human verbs refuse another owner's thread
ok 720 - REQ-USER-2: the human verbs refuse another owner's thread
---
duration_ms: 25.128256
type: 'test'
...
# Subtest: REQ-THREAD-1: thread.create refuses when the business has no thread instance or more than one
ok 721 - REQ-THREAD-1: thread.create refuses when the business has no thread instance or more than one
---
duration_ms: 23.201845
type: 'test'
...
# Subtest: REQ-ORG-2: projects and threads are named once, and the repo names a business project
ok 722 - REQ-ORG-2: projects and threads are named once, and the repo names a business project
---
duration_ms: 25.666906
type: 'test'
...
# Subtest: REQ-THREAD-2: thread.messages returns the thread's history in pages and writes nothing
ok 723 - REQ-THREAD-2: thread.messages returns the thread's history in pages and writes nothing
---
duration_ms: 84.642652
type: 'test'
...
# Subtest: project.create refuses a repository name without its matching repo before any write
ok 724 - project.create refuses a repository name without its matching repo before any write
---
duration_ms: 14.832633
type: 'test'
...
# Subtest: project.create keeps unrelated names with and without a repository
ok 725 - project.create keeps unrelated names with and without a repository
---
duration_ms: 11.217054
type: 'test'
...
# Subtest: socket capability stamps launch identity; shared views use wire, no SQL client
ok 726 - socket capability stamps launch identity; shared views use wire, no SQL client
---
duration_ms: 62.129061
type: 'test'
...
# Subtest: two wire claims serialize; a lost reply never automatically retries
ok 727 - two wire claims serialize; a lost reply never automatically retries
---
duration_ms: 62.546459
type: 'test'
...
# Subtest: malformed, oversized and identity-forging envelopes refuse without echoing input
ok 728 - malformed, oversized and identity-forging envelopes refuse without echoing input
---
duration_ms: 44.953674
type: 'test'
...
# Subtest: client preserves UTF-8 when a response divides a multibyte character
ok 729 - client preserves UTF-8 when a response divides a multibyte character
---
duration_ms: 12.508813
type: 'test'
...
# Subtest: committed mutation followed by dropped reply reports unknown and is never retried
ok 730 - committed mutation followed by dropped reply reports unknown and is never retried
---
duration_ms: 55.351073
type: 'test'
...
# Subtest: REQ-LIMIT-4 usage protocol binds run identity, requires a delivered turn and isolates businesses
ok 731 - REQ-LIMIT-4 usage protocol binds run identity, requires a delivered turn and isolates businesses
---
duration_ms: 42.99871
type: 'test'
...
# Subtest: REQ-LIMIT-4 3g copy migrates through 3h and 3i to 3j preserving every old column, row and sequence; new usage table is empty
ok 732 - REQ-LIMIT-4 3g copy migrates through 3h and 3i to 3j preserving every old column, row and sequence; new usage table is empty
---
duration_ms: 131.28735
type: 'test'
...
# Subtest: REQ-PLUG-1 runtime reaches transcript only through loader, over the real bus socket
ok 733 - REQ-PLUG-1 runtime reaches transcript only through loader, over the real bus socket
---
duration_ms: 88.141852
type: 'test'
...
# Subtest: REQ-LIMIT-4 loader source records new turn kinds, excludes history and retries exactly once
ok 734 - REQ-LIMIT-4 loader source records new turn kinds, excludes history and retries exactly once
---
duration_ms: 25.948095
type: 'test'
...
# Subtest: REQ-LIMIT-4 cut: unknown is durable and logged next to every total
ok 735 - REQ-LIMIT-4 cut: unknown is durable and logged next to every total
---
duration_ms: 17.513089
type: 'test'
...
# Subtest: REQ-LIMIT-4 disabled: unknown is durable and logged next to every total
ok 736 - REQ-LIMIT-4 disabled: unknown is durable and logged next to every total
---
duration_ms: 16.375968
type: 'test'
...
# Subtest: REQ-LIMIT-4 missing-begin: unknown is durable and logged next to every total
ok 737 - REQ-LIMIT-4 missing-begin: unknown is durable and logged next to every total
---
duration_ms: 15.651888
type: 'test'
...
# Subtest: REQ-LIMIT-4 no-new-usage: unknown is durable and logged next to every total
ok 738 - REQ-LIMIT-4 no-new-usage: unknown is durable and logged next to every total
---
duration_ms: 17.08514
type: 'test'
...
# Subtest: REQ-LIMIT-4 rewrite: unknown is durable and logged next to every total
ok 739 - REQ-LIMIT-4 rewrite: unknown is durable and logged next to every total
---
duration_ms: 15.590164
type: 'test'
...
# Subtest: REQ-LIMIT-4 unfinished turn remains visibly unknown after accounting restarts
ok 740 - REQ-LIMIT-4 unfinished turn remains visibly unknown after accounting restarts
---
duration_ms: 16.484306
type: 'test'
...
# Subtest: usage records are append-only
ok 741 - usage records are append-only
---
duration_ms: 16.866062
type: 'test'
...
# Subtest: REQ-LIMIT-4 parse failure logs its safe code, never transcript content
ok 742 - REQ-LIMIT-4 parse failure logs its safe code, never transcript content
---
duration_ms: 16.973561
type: 'test'
...
# Subtest: REQ-LIMIT-4 resumed run baselines history and exact totals do not overflow
ok 743 - REQ-LIMIT-4 resumed run baselines history and exact totals do not overflow
---
duration_ms: 18.050729
type: 'test'
...
# Subtest: REQ-PLUG-1 core has no transcript import and disabled sources do not read any transcript
ok 744 - REQ-PLUG-1 core has no transcript import and disabled sources do not read any transcript
---
duration_ms: 14.49657
type: 'test'
...
# Subtest: REQ-LIMIT-4 a resumed thread bills only new assistant messages to its next run
ok 745 - REQ-LIMIT-4 a resumed thread bills only new assistant messages to its next run
---
duration_ms: 18.060214
type: 'test'
...
# Subtest: REQ-LIMIT-4 every enabled source is called; failure is unknown and a partial total stays labelled
ok 746 - REQ-LIMIT-4 every enabled source is called; failure is unknown and a partial total stays labelled
---
duration_ms: 25.802413
type: 'test'
...
# Subtest: REQ-LIMIT-4 a turn whose reported sum exceeds safe precision is unknown, not rounded
ok 747 - REQ-LIMIT-4 a turn whose reported sum exceeds safe precision is unknown, not rounded
---
duration_ms: 19.372789
type: 'test'
...
# Subtest: row 65 a run bound without a transcript directory records no-transcript
ok 748 - row 65 a run bound without a transcript directory records no-transcript
---
duration_ms: 18.455975
type: 'test'
...
# Subtest: R3: bindUser binds a granted user and refuses one with no live collaborator grant
ok 749 - R3: bindUser binds a granted user and refuses one with no live collaborator grant
---
duration_ms: 21.299741
type: 'test'
...
# Subtest: R3: a user named like the business human, the tester or a principal word is refused, whatever the grants say
ok 750 - R3: a user named like the business human, the tester or a principal word is refused, whatever the grants say
---
duration_ms: 17.606551
type: 'test'
...
# Subtest: R3: each collaborator verb is allowed to a granted user
ok 751 - R3: each collaborator verb is allowed to a granted user
---
duration_ms: 30.534806
type: 'test'
...
# Subtest: R3: every verb off the collaborator list refuses a user access-refused before its own checks
ok 752 - R3: every verb off the collaborator list refuses a user access-refused before its own checks
---
duration_ms: 171.887216
type: 'test'
...
# Subtest: R3: task, web and host verbs refuse a user access-refused
ok 753 - R3: task, web and host verbs refuse a user access-refused
---
duration_ms: 41.635002
type: 'test'
...
# Subtest: R3 leak: project.list shows granted projects only
ok 754 - R3 leak: project.list shows granted projects only
---
duration_ms: 19.911103
type: 'test'
...
# Subtest: R3 leak: thread.create needs the project and the thread instance granted, and an ungranted id reads as one that does not exist
ok 755 - R3 leak: thread.create needs the project and the thread instance granted, and an ungranted id reads as one that does not exist
---
duration_ms: 23.330289
type: 'test'
...
# Subtest: R3 leak: thread.list shows the user its own threads that are still granted, never others
ok 756 - R3 leak: thread.list shows the user its own threads that are still granted, never others
---
duration_ms: 51.337321
type: 'test'
...
# Subtest: R3 leak: names shows granted instances only
ok 757 - R3 leak: names shows granted instances only
---
duration_ms: 19.793481
type: 'test'
...
# Subtest: R3: thread.send is from user:<id> and writes no human.input
ok 758 - R3: thread.send is from user:<id> and writes no human.input
---
duration_ms: 20.082209
type: 'test'
...
# Subtest: R3: a reply-chain message.send into another user thread is refused
ok 759 - R3: a reply-chain message.send into another user thread is refused
---
duration_ms: 22.280934
type: 'test'
...
# Subtest: R3: the run reply to a user message reaches that user thread.messages, with no waiting and no notice
ok 760 - R3: the run reply to a user message reaches that user thread.messages, with no waiting and no notice
---
duration_ms: 22.924321
type: 'test'
...
# Subtest: R3: a reply to: user without a matching in_reply_to is refused user-reply-required
ok 761 - R3: a reply to: user without a matching in_reply_to is refused user-reply-required
---
duration_ms: 31.343645
type: 'test'
...
# Subtest: R3: a non-thread run, the human and the tester cannot send to: user
ok 762 - R3: a non-thread run, the human and the tester cannot send to: user
---
duration_ms: 21.630526
type: 'test'
...
# Subtest: R3: a user thread run cannot message the owner, while its uncited gated raise reaches only the owner inbox, B9
ok 763 - R3: a user thread run cannot message the owner, while its uncited gated raise reaches only the owner inbox, B9
---
duration_ms: 25.227248
type: 'test'
...
# Subtest: R3: a removed or expired grant refuses the next request access-revoked, and the file is read per request
ok 764 - R3: a removed or expired grant refuses the next request access-revoked, and the file is read per request
---
duration_ms: 18.855926
type: 'test'
...
# Subtest: R3: a user refusal is recorded as action.refused by user:<id>
ok 765 - R3: a user refusal is recorded as action.refused by user:<id>
---
duration_ms: 14.449211
type: 'test'
...
# Subtest: R3: a business with a role keyed user refuses invalid-business
ok 766 - R3: a business with a role keyed user refuses invalid-business
---
duration_ms: 10.119851
type: 'test'
...
# Subtest: R3: name.set refuses the name user
ok 767 - R3: name.set refuses the name user
---
duration_ms: 12.865439
type: 'test'
...
# Subtest: R3 r4: while halted, a granted user's thread.send refuses processing-halted and thread.messages still answers
ok 768 - R3 r4: while halted, a granted user's thread.send refuses processing-halted and thread.messages still answers
---
duration_ms: 15.433554
type: 'test'
...
# Subtest: R3 r4: the chief's hire refuses an instance named user with the code it gives human and tester
ok 769 - R3 r4: the chief's hire refuses an instance named user with the code it gives human and tester
---
duration_ms: 17.248021
type: 'test'
...
# Subtest: R3 r4: a non-function access throws before the store is read
ok 770 - R3 r4: a non-function access throws before the store is read
---
duration_ms: 0.163981
type: 'test'
...
# Subtest: web.search: a granted role gets labelled results, and the call is trailed with role, run, verb and query
ok 771 - web.search: a granted role gets labelled results, and the call is trailed with role, run, verb and query
---
duration_ms: 31.469544
type: 'test'
...
# Subtest: web.fetch: a granted role gets the page as labelled text, and the call is trailed with the url
ok 772 - web.fetch: a granted role gets the page as labelled text, and the call is trailed with the url
---
duration_ms: 35.666553
type: 'test'
...
# Subtest: a role without the grant is refused, the refusal is logged with the verb, and nothing is fetched
ok 773 - a role without the grant is refused, the refusal is logged with the verb, and nothing is fetched
---
duration_ms: 36.517906
type: 'test'
...
# Subtest: a broker with no web service refuses a granted role
ok 774 - a broker with no web service refuses a granted role
---
duration_ms: 23.680164
type: 'test'
...
# Subtest: bad requests are refused: unknown verb, extra or missing argument, not a string, a human or reader session
ok 775 - bad requests are refused: unknown verb, extra or missing argument, not a string, a human or reader session
---
duration_ms: 28.615869
type: 'test'
...
# Subtest: a session that is not the role holder is refused
ok 776 - a session that is not the role holder is refused
---
duration_ms: 19.255566
type: 'test'
...
# Subtest: web.mjs's fences hold on the broker side: refusals are normal results with the fixed reason
ok 777 - web.mjs's fences hold on the broker side: refusals are normal results with the fixed reason
---
duration_ms: 57.028804
type: 'test'
...
# Subtest: web.search with no search source configured is a refused result, not an error
ok 778 - web.search with no search source configured is a refused result, not an error
---
duration_ms: 23.426818
type: 'test'
...
# Subtest: a search source that fails with its own refusal, or that throws, is handled
ok 779 - a search source that fails with its own refusal, or that throws, is handled
---
duration_ms: 23.387002
type: 'test'
...
# Subtest: a slow search source ends in a refusal at the deadline
ok 780 - a slow search source ends in a refusal at the deadline
---
duration_ms: 67.070742
type: 'test'
...
# Subtest: a secret in the arguments is refused before anything is trailed or fetched
ok 781 - a secret in the arguments is refused before anything is trailed or fetched
---
duration_ms: 15.103294
type: 'test'
...
# Subtest: over the socket: the server routes web verbs to the service; other roles are refused; no service is web-not-configured
ok 782 - over the socket: the server routes web verbs to the service; other roles are refused; no service is web-not-configured
---
duration_ms: 78.913595
type: 'test'
...
# Subtest: busBusiness: the web grant comes from "web" in the resolved tool limit
ok 783 - busBusiness: the web grant comes from "web" in the resolved tool limit
---
duration_ms: 0.273633
type: 'test'
...
# Subtest: webServices: the business's search-source plug-in and web.searxng var make web.search work; without either it is refused as not configured
ok 784 - webServices: the business's search-source plug-in and web.searxng var make web.search work; without either it is refused as not configured
---
duration_ms: 49.008563
type: 'test'
...
# Subtest: an ungranted call is refused at once: no admission, no wait, nothing touched
ok 785 - an ungranted call is refused at once: no admission, no wait, nothing touched
---
duration_ms: 17.762782
type: 'test'
...
# Subtest: over the socket an ungranted caller is dropped by the server timeout and a granted one gets the longer wait
ok 786 - over the socket an ungranted caller is dropped by the server timeout and a granted one gets the longer wait
---
duration_ms: 342.258448
type: 'test'
...
# Subtest: a search that never answers is aborted at the deadline, the module sees the signal, and the call is trailed as refused (timeout)
ok 787 - a search that never answers is aborted at the deadline, the module sees the signal, and the call is trailed as refused (timeout)
---
duration_ms: 75.493925
type: 'test'
...
# Subtest: a fetch that stalls is cut off at the deadline: the request is destroyed, not left running
ok 788 - a fetch that stalls is cut off at the deadline: the request is destroyed, not left running
---
duration_ms: 95.236936
type: 'test'
...
# Subtest: one query limit: over SEARCH_MAX_QUERY_CHARS or empty is refused with the same reason before any backend, and the tool schema carries the same number
ok 789 - one query limit: over SEARCH_MAX_QUERY_CHARS or empty is refused with the same reason before any backend, and the tool schema carries the same number
---
duration_ms: 16.619853
type: 'test'
...
# Subtest: merge-gate's technical raise is cross-role, goes to the cto, and only merge-gate can use the approval
ok 790 - merge-gate's technical raise is cross-role, goes to the cto, and only merge-gate can use the approval
---
duration_ms: 65.295624
type: 'test'
...
# Subtest: merge-gate has no message.send, and without a domain its raise goes to the delivery arbiter
ok 791 - merge-gate has no message.send, and without a domain its raise goes to the delivery arbiter
---
duration_ms: 41.291632
type: 'test'
...
# Subtest: the cto must be able to message merge-gate, or the technical raise is refused (row 133)
ok 792 - the cto must be able to message merge-gate, or the technical raise is refused (row 133)
---
duration_ms: 33.040989
type: 'test'
...
# Subtest: security-reviewer answers a review with its verdict alone; it holds no message.send
ok 793 - security-reviewer answers a review with its verdict alone; it holds no message.send
---
duration_ms: 38.034798
type: 'test'
...
1..793
# tests 793
# suites 0
# pass 793
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 22393.77421
TAP version 13
# Subtest: row 194 T16 Settings Agents: unavailable read-only, launch follows its request, confirms, reason and refusal
ok 1 - row 194 T16 Settings Agents: unavailable read-only, launch follows its request, confirms, reason and refusal
---
duration_ms: 16825.779907
type: 'test'
...
# Subtest: row 256 T7 T8 the human page offers Delete on a creative instance, the tester page never does
ok 2 - row 256 T7 T8 the human page offers Delete on a creative instance, the tester page never does
---
duration_ms: 3110.656264
type: 'test'
...
# Subtest: row 194 T16: each agent action makes one call with only its keys, logs the user and answers the request
ok 3 - row 194 T16: each agent action makes one call with only its keys, logs the user and answers the request
---
duration_ms: 41.599414
type: 'test'
...
# Subtest: row 194 T16: the boundary refuses before any bus call
ok 4 - row 194 T16: the boundary refuses before any bus call
---
duration_ms: 19.704289
type: 'test'
...
# Subtest: row 194 T16: read-only when send is off or no writer is wired; no route has a --send exception
ok 5 - row 194 T16: read-only when send is off or no writer is wired; no route has a --send exception
---
duration_ms: 9.352812
type: 'test'
...
# Subtest: row 194 T16: a bus refusal names its reason and nothing changed; an unknown outcome or a bad shape is never retried
ok 6 - row 194 T16: a bus refusal names its reason and nothing changed; an unknown outcome or a bad shape is never retried
---
duration_ms: 8.758379
type: 'test'
...
# Subtest: row 194 T16: the request read takes one id, adds the refusal reason and refuses an unexpected shape
ok 7 - row 194 T16: the request read takes one id, adds the refusal reason and refuses an unexpected shape
---
duration_ms: 16.566143
type: 'test'
...
# Subtest: row 194 T16: delete joins add and change on /api/instances with only revision, instance and op
ok 8 - row 194 T16: delete joins add and change on /api/instances with only revision, instance and op
---
duration_ms: 8.700785
type: 'test'
...
# Subtest: row 194 T16 D4.1: the tester listener launches, terminates and reads requests; regenerate, veto and delete are refused with no call
ok 9 - row 194 T16 D4.1: the tester listener launches, terminates and reads requests; regenerate, veto and delete are refused with no call
---
duration_ms: 8.636354
type: 'test'
...
# Subtest: row 194 N5: agents.js is served as JavaScript and index.html loads it once
ok 10 - row 194 N5: agents.js is served as JavaScript and index.html loads it once
---
duration_ms: 2.616972
type: 'test'
...
# Subtest: Q169 the signed-in human names a seat and stops the assistant, one bus call each, logged with the user
ok 11 - Q169 the signed-in human names a seat and stops the assistant, one bus call each, logged with the user
---
duration_ms: 32.250512
type: 'test'
...
# Subtest: Q169 the name and stop routes need send on, the public name, the user, the exact Origin and same-origin Fetch Metadata
ok 12 - Q169 the name and stop routes need send on, the public name, the user, the exact Origin and same-origin Fetch Metadata
---
duration_ms: 21.479813
type: 'test'
...
# Subtest: Q169 the name and stop routes take JSON within 4 KiB and only their own keys, all text
ok 13 - Q169 the name and stop routes take JSON within 4 KiB and only their own keys, all text
---
duration_ms: 14.489906
type: 'test'
...
# Subtest: Row 167 a null body on the name and stop routes is 400 invalid-request with no write, and the next request is answered
ok 14 - Row 167 a null body on the name and stop routes is 400 invalid-request with no write, and the next request is answered
---
duration_ms: 7.332805
type: 'test'
...
# Subtest: Q169 a bus refusal says nothing changed; a lost or odd answer says the change may have been made
ok 15 - Q169 a bus refusal says nothing changed; a lost or odd answer says the change may have been made
---
duration_ms: 16.68355
type: 'test'
...
# Subtest: Q169 the names read is a bus read like the others
ok 16 - Q169 the names read is a bus read like the others
---
duration_ms: 8.234301
type: 'test'
...
# Subtest: the Board: held roles with no machine sessions, a claim with no address, the toggle kept across a reload, and Message addressed to the role
ok 17 - the Board: held roles with no machine sessions, a claim with no address, the toggle kept across a reload, and Message addressed to the role
---
duration_ms: 6014.457228
type: 'test'
...
# Subtest: a Seen click while a Board read is in flight waits for that read, then posts
ok 18 - a Seen click while a Board read is in flight waits for that read, then posts
---
duration_ms: 3482.052126
type: 'test'
...
# Subtest: a redirect answer on a Board read, a bus read, a conversation read, a board POST, a module read and a send signs the page out: one line, nothing stale, no further reads
ok 19 - a redirect answer on a Board read, a bus read, a conversation read, a board POST, a module read and a send signs the page out: one line, nothing stale, no further reads
---
duration_ms: 9730.013408
type: 'test'
...
# Subtest: browser edge states: loading, empty, malformed, stale, hostile/long values, in-flight reply and appearance fallback
ok 20 - browser edge states: loading, empty, malformed, stale, hostile/long values, in-flight reply and appearance fallback
---
duration_ms: 4231.209571
type: 'test'
...
# Rendered contrast: {"failures":[],"count":330,"lowest":4.504658476260286}
# Subtest: served Console browser: real board fixtures, keyboard, drafts, receipts, themes, 320px and failures
ok 21 - served Console browser: real board fixtures, keyboard, drafts, receipts, themes, 320px and failures
---
duration_ms: 5306.564204
type: 'test'
...
# Subtest: the README says a refused field table names the file or the key at fault, never a path
ok 22 - the README says a refused field table names the file or the key at fault, never a path
---
duration_ms: 1.358203
type: 'test'
...
# Subtest: S5 pages in a browser: real broker rows, inert text, Copy, routes, failures, layout and no writes
ok 23 - S5 pages in a browser: real broker rows, inert text, Copy, routes, failures, layout and no writes
---
duration_ms: 13164.560293
type: 'test'
...
# Subtest: bus routes serve the four reads from the reader view, unescaped JSON for the page to escape
ok 24 - bus routes serve the four reads from the reader view, unescaped JSON for the page to escape
---
duration_ms: 290.654441
type: 'test'
...
# Subtest: decisions route serves the roles and recent lists from the reader view
ok 25 - decisions route serves the roles and recent lists from the reader view
---
duration_ms: 1291.210589
type: 'test'
...
# Subtest: credentials route serves the broker credential status from the reader view
ok 26 - credentials route serves the broker credential status from the reader view
---
duration_ms: 289.220014
type: 'test'
...
# Subtest: replies route serves the replies to one message from the reader view
ok 27 - replies route serves the replies to one message from the reader view
---
duration_ms: 591.380183
type: 'test'
...
# Subtest: bus routes are GET-only, have no write verb, and keep the same-origin checks
ok 28 - bus routes are GET-only, have no write verb, and keep the same-origin checks
---
duration_ms: 321.181207
type: 'test'
...
# Subtest: bus refusals map to statuses and never carry a path or a stack
ok 29 - bus refusals map to statuses and never carry a path or a stack
---
duration_ms: 119.566898
type: 'test'
...
# Subtest: humanCall speaks the human transport protocol without blocking the server
ok 30 - humanCall speaks the human transport protocol without blocking the server
---
duration_ms: 2927.54606
type: 'test'
...
# Subtest: busReader takes --business, else the live bus host, else refuses
ok 31 - busReader takes --business, else the live bus host, else refuses
---
duration_ms: 816.56261
type: 'test'
...
# Subtest: humanCall kills a transport that runs past its timeout
ok 32 - humanCall kills a transport that runs past its timeout
---
duration_ms: 536.114127
type: 'test'
...
# Subtest: serve refuses a --business value that is not a business id
ok 33 - serve refuses a --business value that is not a business id
---
duration_ms: 1278.046336
type: 'test'
...
# Subtest: WebUI channel off returns 503 and named recovery for every chat route without a chat operation
ok 34 - WebUI channel off returns 503 and named recovery for every chat route without a chat operation
---
duration_ms: 65.07934
type: 'test'
...
# Subtest: WebUI only selection keeps web chat enabled while retaining the old read envelope
ok 35 - WebUI only selection keeps web chat enabled while retaining the old read envelope
---
duration_ms: 9.502027
type: 'test'
...
# Subtest: WebUI channel-disabled recovery text is fixed and never echoes transport text
ok 36 - WebUI channel-disabled recovery text is fixed and never echoes transport text
---
duration_ms: 4.675641
type: 'test'
...
# Subtest: chat browser: list/create named projects and threads, hostile labels inert and no implicit writes
ok 37 - chat browser: list/create named projects and threads, hostile labels inert and no implicit writes
---
duration_ms: 3286.99683
type: 'test'
...
# Subtest: chat browser: thread drafts, receipts and cursor history stay isolated; refresh never writes
ok 38 - chat browser: thread drafts, receipts and cursor history stay isolated; refresh never writes
---
duration_ms: 4472.276765
type: 'test'
...
# Subtest: chat browser: uncertain writes retain draft, ownership refusal clears it, read-only cannot send
ok 39 - chat browser: uncertain writes retain draft, ownership refusal clears it, read-only cannot send
---
duration_ms: 2672.355196
type: 'test'
...
# Subtest: chat browser: a late read from A cannot paint B; sign-out clears private state and stops reads
ok 40 - chat browser: a late read from A cannot paint B; sign-out clears private state and stops reads
---
duration_ms: 2908.550019
type: 'test'
...
# Subtest: chat browser: page forward and deduplicate replies; pending and byte-limit submissions do not duplicate
ok 41 - chat browser: page forward and deduplicate replies; pending and byte-limit submissions do not duplicate
---
duration_ms: 2068.807173
type: 'test'
...
# Subtest: chat browser: scrolled history stays put, New messages and an own send return to the tail
ok 42 - chat browser: scrolled history stays put, New messages and an own send return to the tail
---
duration_ms: 2193.772325
type: 'test'
...
# Subtest: chat browser: automatic polling follows a reply without a POST or a lost draft
ok 43 - chat browser: automatic polling follows a reply without a POST or a lost draft
---
duration_ms: 12254.780898
type: 'test'
...
# Subtest: chat browser: display stays bounded while every forward page remains reachable
ok 44 - chat browser: display stays bounded while every forward page remains reachable
---
duration_ms: 2309.239752
type: 'test'
...
# Subtest: chat browser: a confirmed visible message replaces its pending receipt; malformed receipts stay unknown
ok 45 - chat browser: a confirmed visible message replaces its pending receipt; malformed receipts stay unknown
---
duration_ms: 1300.302968
type: 'test'
...
# Subtest: chat browser: a refusal elsewhere forgets private chat drafts
ok 46 - chat browser: a refusal elsewhere forgets private chat drafts
---
duration_ms: 1313.91473
type: 'test'
...
# Subtest: chat browser: a late project creation receipt cannot navigate away from another thread
ok 47 - chat browser: a late project creation receipt cannot navigate away from another thread
---
duration_ms: 1304.620845
type: 'test'
...
# Subtest: chat reads map only fixed verbs, strict forward paging and pure GET
ok 48 - chat reads map only fixed verbs, strict forward paging and pure GET
---
duration_ms: 48.932476
type: 'test'
...
# Subtest: chat refuses malformed and repeated query/id values before transport
ok 49 - chat refuses malformed and repeated query/id values before transport
---
duration_ms: 10.967317
type: 'test'
...
# Subtest: chat project.create: one verified write, fixed identity/class and private log
ok 50 - chat project.create: one verified write, fixed identity/class and private log
---
duration_ms: 5.952153
type: 'test'
...
# Subtest: chat project.create: each existing Console write fence makes zero bus calls
ok 51 - chat project.create: each existing Console write fence makes zero bus calls
---
duration_ms: 19.854551
type: 'test'
...
# Subtest: chat project.create: refusal or lost/malformed receipt never retries or invents success
ok 52 - chat project.create: refusal or lost/malformed receipt never retries or invents success
---
duration_ms: 10.902302
type: 'test'
...
# Subtest: chat thread.create: one verified write, fixed identity/class and private log
ok 53 - chat thread.create: one verified write, fixed identity/class and private log
---
duration_ms: 3.725414
type: 'test'
...
# Subtest: chat thread.create: each existing Console write fence makes zero bus calls
ok 54 - chat thread.create: each existing Console write fence makes zero bus calls
---
duration_ms: 11.666739
type: 'test'
...
# Subtest: chat thread.create: refusal or lost/malformed receipt never retries or invents success
ok 55 - chat thread.create: refusal or lost/malformed receipt never retries or invents success
---
duration_ms: 8.558719
type: 'test'
...
# Subtest: chat thread.send: one verified write, fixed identity/class and private log
ok 56 - chat thread.send: one verified write, fixed identity/class and private log
---
duration_ms: 2.526724
type: 'test'
...
# Subtest: chat thread.send: each existing Console write fence makes zero bus calls
ok 57 - chat thread.send: each existing Console write fence makes zero bus calls
---
duration_ms: 10.828742
type: 'test'
...
# Subtest: chat thread.send: refusal or lost/malformed receipt never retries or invents success
ok 58 - chat thread.send: refusal or lost/malformed receipt never retries or invents success
---
duration_ms: 7.848306
type: 'test'
...
# Subtest: chat thread.open: one verified write, fixed identity/class and private log
ok 59 - chat thread.open: one verified write, fixed identity/class and private log
---
duration_ms: 3.522122
type: 'test'
...
# Subtest: chat thread.open: each existing Console write fence makes zero bus calls
ok 60 - chat thread.open: each existing Console write fence makes zero bus calls
---
duration_ms: 13.055208
type: 'test'
...
# Subtest: chat thread.open: refusal or lost/malformed receipt never retries or invents success
ok 61 - chat thread.open: refusal or lost/malformed receipt never retries or invents success
---
duration_ms: 8.667838
type: 'test'
...
# Subtest: chat createThread receipt requires an instance even when its id is valid
ok 62 - chat createThread receipt requires an instance even when its id is valid
---
duration_ms: 5.483188
type: 'test'
...
# Subtest: chat write receipts expose only the fields belonging to their operation
ok 63 - chat write receipts expose only the fields belonging to their operation
---
duration_ms: 54.648946
type: 'test'
...
# Subtest: chat validates names, body, project and strict empty open payload
ok 64 - chat validates names, body, project and strict empty open payload
---
duration_ms: 14.738586
type: 'test'
...
# Subtest: chat read failures redact ownership and refuse invalid transport arrays
ok 65 - chat read failures redact ownership and refuse invalid transport arrays
---
duration_ms: 8.759728
type: 'test'
...
# Subtest: REQ-USER-2 real broker: owned catalog, create/name/filter, isolated history and 403/404 without mutations
ok 66 - REQ-USER-2 real broker: owned catalog, create/name/filter, isolated history and 403/404 without mutations
---
duration_ms: 2530.098409
type: 'test'
...
# Subtest: chat repeats every POST boundary even when called behind an admitted request
ok 67 - chat repeats every POST boundary even when called behind an admitted request
---
duration_ms: 12.159552
type: 'test'
...
# Subtest: configured Console process injects chat through its existing human transport
ok 68 - configured Console process injects chat through its existing human transport
---
duration_ms: 1262.988416
type: 'test'
...
# Subtest: chat assets, GET purity, method and unknown-route refusals are explicit
ok 69 - chat assets, GET purity, method and unknown-route refusals are explicit
---
duration_ms: 110.948564
type: 'test'
...
# Subtest: the chat seam names the transport it is given: the human one and the tester one both pass, anything else is a TypeError
ok 70 - the chat seam names the transport it is given: the human one and the tester one both pass, anything else is a TypeError
---
duration_ms: 3.851161
type: 'test'
...
# Subtest: conversation view: full history, collapsed tools, hidden thinking, inert hostile content, malformed and reconcile markers
ok 71 - conversation view: full history, collapsed tools, hidden thinking, inert hostile content, malformed and reconcile markers
---
duration_ms: 4495.722544
type: 'test'
...
# Subtest: conversation view: a fork keeps the open branch, says so, and opens the new one on request
ok 72 - conversation view: a fork keeps the open branch, says so, and opens the new one on request
---
duration_ms: 4562.035912
type: 'test'
...
# Subtest: conversation view: a newer session with no readable history keeps the marker
ok 73 - conversation view: a newer session with no readable history keeps the marker
---
duration_ms: 2829.90361
type: 'test'
...
# Subtest: conversation view: seats without history say so and offer no reply
ok 74 - conversation view: seats without history say so and offer no reply
---
duration_ms: 2367.505899
type: 'test'
...
# Subtest: Discord row through real board/WebUI: independent brake/liveness, no Reply, literal content
ok 75 - Discord row through real board/WebUI: independent brake/liveness, no Reply, literal content
---
duration_ms: 3575.803817
type: 'test'
...
# Subtest: the editor: the list, hostile markdown that runs nothing, the draft, and each save receipt
ok 76 - the editor: the list, hostile markdown that runs nothing, the draft, and each save receipt
---
duration_ms: 5825.168883
type: 'test'
...
# Subtest: the Console's CSP stands and the editor runs under it; hostile markdown on the load path runs and loads nothing
ok 77 - the Console's CSP stands and the editor runs under it; hostile markdown on the load path runs and loads nothing
---
duration_ms: 3397.30491
type: 'test'
...
# Subtest: hostile content pasted into the editor runs and loads nothing, and a bad link target is refused in the link bar
ok 78 - hostile content pasted into the editor runs and loads nothing, and a bad link target is refused in the link bar
---
duration_ms: 5067.717894
type: 'test'
...
# Subtest: a pasted image span is kept only for a target the link gate accepts, and a save writes only those
ok 79 - a pasted image span is kept only for a target the link gate accepts, and a save writes only those
---
duration_ms: 2554.932351
type: 'test'
...
# Subtest: a switch of view reads nothing; a reload, and a trip away and back, each read the file exactly once
ok 80 - a switch of view reads nothing; a reload, and a trip away and back, each read the file exactly once
---
duration_ms: 4865.90479
type: 'test'
...
# Subtest: an edit rewrites only the block touched; a save sends the rest byte for byte; the Source view carries the draft
ok 81 - an edit rewrites only the block touched; a save sends the rest byte for byte; the Source view carries the draft
---
duration_ms: 2730.958694
type: 'test'
...
# Subtest: a file the editor cannot write back byte for byte opens as Source, says so, cannot save, and the Visual button works once it can
ok 82 - a file the editor cannot write back byte for byte opens as Source, says so, cannot save, and the Visual button works once it can
---
duration_ms: 3825.165846
type: 'test'
...
# Subtest: a link title pasted with line breaks in it is written on one line, so no HTML block comes of it
ok 83 - a link title pasted with line breaks in it is written on one line, so no HTML block comes of it
---
duration_ms: 2226.847542
type: 'test'
...
# Subtest: an image alt pasted with line breaks in it is written on one line, so no HTML block comes of it
ok 84 - an image alt pasted with line breaks in it is written on one line, so no HTML block comes of it
---
duration_ms: 1315.338418
type: 'test'
...
# Subtest: an image title pasted with line breaks in it is written on one line, so no HTML block comes of it
ok 85 - an image title pasted with line breaks in it is written on one line, so no HTML block comes of it
---
duration_ms: 1343.596146
type: 'test'
...
# Subtest: a code block info string pasted with line breaks in it is written on one line, so no HTML block comes of it
ok 86 - a code block info string pasted with line breaks in it is written on one line, so no HTML block comes of it
---
duration_ms: 1793.646763
type: 'test'
...
# Subtest: a link title holding a quote after a backslash then a tag is written with the backslash escaped, so the title stays closed
ok 87 - a link title holding a quote after a backslash then a tag is written with the backslash escaped, so the title stays closed
---
duration_ms: 2489.158195
type: 'test'
...
# Subtest: an image title holding a quote after a backslash then a tag is written with the backslash escaped, so the title stays closed
ok 88 - an image title holding a quote after a backslash then a tag is written with the backslash escaped, so the title stays closed
---
duration_ms: 1433.839906
type: 'test'
...
# Subtest: a link title holding a trailing backslash is written with the backslash escaped, so the title stays closed
ok 89 - a link title holding a trailing backslash is written with the backslash escaped, so the title stays closed
---
duration_ms: 1240.060538
type: 'test'
...
# Subtest: an image title holding a trailing backslash is written with the backslash escaped, so the title stays closed
ok 90 - an image title holding a trailing backslash is written with the backslash escaped, so the title stays closed
---
duration_ms: 1170.241672
type: 'test'
...
# Subtest: a code block info string with a backtick, pasted, is dropped on Save, so the fence stays closed
ok 91 - a code block info string with a backtick, pasted, is dropped on Save, so the fence stays closed
---
duration_ms: 1047.27508
type: 'test'
...
# Subtest: a code block info string with a backtick, as a tilde fence can have, is kept as source, not rewritten without it
ok 92 - a code block info string with a backtick, as a tilde fence can have, is kept as source, not rewritten without it
---
duration_ms: 922.376493
type: 'test'
...
# Subtest: the imported source is the tagged upstream source plus the recorded local changes, and nothing else
ok 93 - the imported source is the tagged upstream source plus the recorded local changes, and nothing else
---
duration_ms: 1090.797548
type: 'test'
...
# Subtest: every package names its origin and license, and NOTICE lists each
ok 94 - every package names its origin and license, and NOTICE lists each
---
duration_ms: 0.931491
type: 'test'
...
# Subtest: the build reads only imported source and the editor's own files; the bundle is the recorded build
ok 95 - the build reads only imported source and the editor's own files; the bundle is the recorded build
---
duration_ms: 114.765545
type: 'test'
...
# Subtest: MOSAIC_REQUIRE_EDITOR_BUILD: a missing or wrong esbuild skips without it and fails with it; a wrong binary always fails
ok 96 - MOSAIC_REQUIRE_EDITOR_BUILD: a missing or wrong esbuild skips without it and fails with it; a wrong binary always fails
---
duration_ms: 53.065433
type: 'test'
...
# Subtest: the toolchain check, run as a program, exits non-zero without esbuild when the build is required
ok 97 - the toolchain check, run as a program, exits non-zero without esbuild when the build is required
---
duration_ms: 985.606976
type: 'test'
...
# Subtest: rebuilding from the source gives the same bytes (needs the pinned esbuild; MOSAIC_REQUIRE_EDITOR_BUILD=1 makes its absence a failure)
ok 98 - rebuilding from the source gives the same bytes (needs the pinned esbuild; MOSAIC_REQUIRE_EDITOR_BUILD=1 makes its absence a failure) # SKIP esbuild 0.28.1 is installed at /mnt/storage/src/mosaic-stack/node_modules/esbuild; the editor rebuild needs exactly 0.28.2 (npm ci --ignore-scripts in packages/webui) (set MOSAIC_REQUIRE_EDITOR_BUILD=1 to fail instead of skip)
---
duration_ms: 15.413152
type: 'test'
...
# Subtest: the editor routes serve the built files with their types and no cache
ok 99 - the editor routes serve the built files with their types and no cache
---
duration_ms: 675.927704
type: 'test'
...
# Subtest: open and save with no edit writes the same bytes: the goals review and a doc with every element
ok 100 - open and save with no edit writes the same bytes: the goals review and a doc with every element
---
duration_ms: 155.523008
type: 'test'
...
# Subtest: open and save with no edit writes the same bytes: every repository doc under docs/ and spec/
ok 101 - open and save with no edit writes the same bytes: every repository doc under docs/ and spec/
---
duration_ms: 9083.964272
type: 'test'
...
# Subtest: the editor source builds markup only with DOM calls, and the bundle has no eval
ok 102 - the editor source builds markup only with DOM calls, and the bundle has no eval
---
duration_ms: 6.234235
type: 'test'
...
# Subtest: the link gate and the image rule are the preview's
ok 103 - the link gate and the image rule are the preview's
---
duration_ms: 1.620104
type: 'test'
...
# Subtest: return flow through the conversation view: send, tool call, delayed result, peer message, exact long answers, relaunch
ok 104 - return flow through the conversation view: send, tool call, delayed result, peer message, exact long answers, relaunch
---
duration_ms: 55046.214407
type: 'test'
...
# Subtest: row 165 Settings: role instances read, add with a restart named, change without one, a refusal keeps the draft
ok 105 - row 165 Settings: role instances read, add with a restart named, change without one, a refusal keeps the draft
---
duration_ms: 7155.595511
type: 'test'
...
# Subtest: row 165 Console: the signed-in human adds an instance through a real broker; validate exits 0, the log names the human and no restart is needed (row 194)
ok 106 - row 165 Console: the signed-in human adds an instance through a real broker; validate exits 0, the log names the human and no restart is needed (row 194)
---
duration_ms: 1266.244572
type: 'test'
...
# Subtest: row 165 Console: the instance write needs send on, the public name, the user, the exact Origin and same-origin Fetch Metadata
ok 107 - row 165 Console: the instance write needs send on, the public name, the user, the exact Origin and same-origin Fetch Metadata
---
duration_ms: 48.847554
type: 'test'
...
# Subtest: row 165 Console: the instance write takes JSON within 16 KiB and only its own keys; holder, credentials and an actor are refused
ok 108 - row 165 Console: the instance write takes JSON within 16 KiB and only its own keys; holder, credentials and an actor are refused
---
duration_ms: 34.243683
type: 'test'
...
# Subtest: row 165 Console: a bus refusal says nothing changed; a lost or odd answer says the change may have been made
ok 109 - row 165 Console: a bus refusal says nothing changed; a lost or odd answer says the change may have been made
---
duration_ms: 33.433841
type: 'test'
...
# Subtest: row 165 Console: the instances read takes no arguments, needs a bus and refuses an answer without a revision
ok 110 - row 165 Console: the instances read takes no arguments, needs a bus and refuses an answer without a revision
---
duration_ms: 14.181038
type: 'test'
...
# Subtest: C2-04 CLI: both listener callback pairs dispatch library verbs with their own transport
ok 111 - C2-04 CLI: both listener callback pairs dispatch library verbs with their own transport
---
duration_ms: 605.674335
type: 'test'
...
# Subtest: row 254: each library sync code maps to its status
ok 112 - row 254: each library sync code maps to its status
---
duration_ms: 1.952653
type: 'test'
...
# Subtest: REQ-LIMIT-3 REQ-LIMIT-4 Settings shows token limits counted, not enforced and check failed; Reset posts one path; a save keeps the token limits
ok 113 - REQ-LIMIT-3 REQ-LIMIT-4 Settings shows token limits counted, not enforced and check failed; Reset posts one path; a save keeps the token limits
---
duration_ms: 5560.624516
type: 'test'
...
# Subtest: Row 167 with an assistant draft open, a token limit reset gives the assistant submit its revision
ok 114 - Row 167 with an assistant draft open, a token limit reset gives the assistant submit its revision
---
duration_ms: 3225.064914
type: 'test'
...
# Subtest: REQ-LIMIT-3 limits read returns only the token rows; no query or write is accepted
ok 115 - REQ-LIMIT-3 limits read returns only the token rows; no query or write is accepted
---
duration_ms: 116.174709
type: 'test'
...
# Subtest: REQ-LIMIT-3 a limits answer without a token list is refused, not shown as no limits
ok 116 - REQ-LIMIT-3 a limits answer without a token list is refused, not shown as no limits
---
duration_ms: 38.028943
type: 'test'
...
# 2026-10-22T12:28:38.501Z settings user="jason" changed
# Subtest: REQ-LIMIT-3 a Settings reset reaches the human write with its paths; a reset alone is enough
ok 117 - REQ-LIMIT-3 a Settings reset reaches the human write with its paths; a reset alone is enough
---
duration_ms: 50.970009
type: 'test'
...
# Subtest: REQ-LIMIT-3 the Console reader asks the bus limits verb with no arguments
ok 118 - REQ-LIMIT-3 the Console reader asks the bus limits verb with no arguments
---
duration_ms: 1.515701
type: 'test'
...
# Subtest: the preview source names none of the four string-to-markup sinks
ok 119 - the preview source names none of the four string-to-markup sinks
---
duration_ms: 1.863572
type: 'test'
...
# Subtest: headings, paragraphs, emphasis and inline code render
ok 120 - headings, paragraphs, emphasis and inline code render
---
duration_ms: 9.159652
type: 'test'
...
# Subtest: lists, block quotes and code blocks render
ok 121 - lists, block quotes and code blocks render
---
duration_ms: 3.319838
type: 'test'
...
# Subtest: a link is made for http, https and relative targets, with rel and the target shown
ok 122 - a link is made for http, https and relative targets, with rel and the target shown
---
duration_ms: 2.461052
type: 'test'
...
# Subtest: a link with any other scheme, or an evasion of the scheme, stays source text
ok 123 - a link with any other scheme, or an evasion of the scheme, stays source text
---
duration_ms: 2.06075
type: 'test'
...
# Subtest: an image shows alt text and URL, is never an img element and never loads
ok 124 - an image shows alt text and URL, is never an img element and never loads
---
duration_ms: 0.359232
type: 'test'
...
# Subtest: raw HTML, entities and unsupported blocks show as source text, never as elements
ok 125 - raw HTML, entities and unsupported blocks show as source text, never as elements
---
duration_ms: 0.914473
type: 'test'
...
# Subtest: markup inside code and inside link text stays text
ok 126 - markup inside code and inside link text stays text
---
duration_ms: 2.119849
type: 'test'
...
# Subtest: hostile and pathological input stays within its look-ahead budget and under the nesting cap
ok 127 - hostile and pathological input stays within its look-ahead budget and under the nesting cap
---
duration_ms: 192.949114
type: 'test'
...
# Subtest: trailing blanks and closing hashes are cut by a walk from the end, not a regex that retries inside a blank run
ok 128 - trailing blanks and closing hashes are cut by a walk from the end, not a regex that retries inside a blank run
---
duration_ms: 132.996343
type: 'test'
...
# Subtest: a link opener with no closer searches at most SPAN characters ahead
ok 129 - a link opener with no closer searches at most SPAN characters ahead
---
duration_ms: 610.593262
type: 'test'
...
# Subtest: the look-ahead work of one render is a fixed multiple of the text, whatever the opener
ok 130 - the look-ahead work of one render is a fixed multiple of the text, whatever the opener
---
duration_ms: 2546.098073
type: 'test'
...
# Subtest: past the budget an opener is source text, through the path all other text takes
ok 131 - past the budget an opener is source text, through the path all other text takes
---
duration_ms: 34.113809
type: 'test'
...
# Subtest: a normal 200 KiB document renders exactly as it did without a budget, and spends little of it
ok 132 - a normal 200 KiB document renders exactly as it did without a budget, and spends little of it
---
duration_ms: 47.552459
type: 'test'
...
# Subtest: a line separator inside a heading, a list item or a fence line does not end the marker line
ok 133 - a line separator inside a heading, a list item or a fence line does not end the marker line
---
duration_ms: 1.216031
type: 'test'
...
# Subtest: a thematic-break line is a paragraph, every other marker line opens a list
ok 134 - a thematic-break line is a paragraph, every other marker line opens a list
---
duration_ms: 0.659296
type: 'test'
...
# Subtest: every short line over space, tab, - * _ and a letter is a break exactly when the old regex said so
ok 135 - every short line over space, tab, - * _ and a letter is a break exactly when the old regex said so
---
duration_ms: 120.758142
type: 'test'
...
# Subtest: one line of marks does not throw, at 4 MiB, whatever the mark or the spacing
ok 136 - one line of marks does not throw, at 4 MiB, whatever the mark or the spacing
---
duration_ms: 18419.228336
type: 'test'
...
# Subtest: CRLF and tabs are read like LF and spaces; empty input renders nothing
ok 137 - CRLF and tabs are read like LF and spaces; empty input renders nothing
---
duration_ms: 0.474864
type: 'test'
...
# Subtest: messages HTTP read pages and preserves metadata; bad arguments refuse before a read; other reads unchanged
ok 138 - messages HTTP read pages and preserves metadata; bad arguments refuse before a read; other reads unchanged
---
duration_ms: 392.693442
type: 'test'
...
# Subtest: Console Messages lists late unsolicited messages on polling with sender class time read state and trail; nav count includes beyond the page; reads never deliver
ok 139 - Console Messages lists late unsolicited messages on polling with sender class time read state and trail; nav count includes beyond the page; reads never deliver
---
duration_ms: 4436.727954
type: 'test'
...
# Subtest: Messages nav count polls on Tasks and Board and clears on a Board refusal; messages 403 refuses local pages
ok 140 - Messages nav count polls on Tasks and Board and clears on a Board refusal; messages 403 refuses local pages
---
duration_ms: 4725.850324
type: 'test'
...
# Subtest: copy writes the Console paths at the full id, read-only, and leaves an existing copy alone
ok 141 - copy writes the Console paths at the full id, read-only, and leaves an existing copy alone
---
duration_ms: 5415.810022
type: 'test'
...
# Subtest: copy refuses a commit off refactor, an unknown one, a worktree and a bad copies directory
ok 142 - copy refuses a commit off refactor, an unknown one, a worktree and a bad copies directory
---
duration_ms: 5694.379211
type: 'test'
...
# Subtest: copy writes nothing when an archived path is missing at the commit
ok 143 - copy writes nothing when an archived path is missing at the commit
---
duration_ms: 2197.679468
type: 'test'
...
# Subtest: a copy that loses the rename race leaves no read-only temp directory behind
ok 144 - a copy that loses the rename race leaves no read-only temp directory behind
---
duration_ms: 1994.423464
type: 'test'
...
# Subtest: a copy whose rename fails with no target refuses, writes no copy and leaves no temp directory
ok 145 - a copy whose rename fails with no target refuses, writes no copy and leaves no temp directory
---
duration_ms: 2632.269586
type: 'test'
...
# Subtest: a copy that meets a target holding files says exists: and moves nothing into it
ok 146 - a copy that meets a target holding files says exists: and moves nothing into it
---
duration_ms: 1504.778197
type: 'test'
...
# Subtest: a copy that meets an empty target directory replaces it by rename, not by moving into it
ok 147 - a copy that meets an empty target directory replaces it by rename, not by moving into it
---
duration_ms: 1541.800782
type: 'test'
...
# Subtest: serve runs from a copy: /healthz 200, the config check, roles and RELEASE from the copy, the queue from --checkout
ok 148 - serve runs from a copy: /healthz 200, the config check, roles and RELEASE from the copy, the queue from --checkout
---
duration_ms: 4114.882782
type: 'test'
...
# Subtest: serve refuses a --checkout that is not an absolute directory path
ok 149 - serve refuses a --checkout that is not an absolute directory path
---
duration_ms: 797.42372
type: 'test'
...
# Subtest: consoleReads runs the queue read under queueRoot and reads RELEASE under root
ok 150 - consoleReads runs the queue read under queueRoot and reads RELEASE under root
---
duration_ms: 145.726498
type: 'test'
...
# Subtest: preview options are all three or none, and each is checked
ok 151 - preview options are all three or none, and each is checked
---
duration_ms: 13.626529
type: 'test'
...
# Subtest: the CLI refuses a partial or invalid preview flag set at start
ok 152 - the CLI refuses a partial or invalid preview flag set at start
---
duration_ms: 2650.881635
type: 'test'
...
# Subtest: the CLI with all three flags serves the preview mode
ok 153 - the CLI with all three flags serves the preview mode
---
duration_ms: 459.622292
type: 'test'
...
# Subtest: a request for the public name needs the header equal to the user id, else 401 and nothing read
ok 154 - a request for the public name needs the header equal to the user id, else 401 and nothing read
---
duration_ms: 148.958723
type: 'test'
...
# Subtest: the header name matches without regard to case, and the value compare is exact
ok 155 - the header name matches without regard to case, and the value compare is exact
---
duration_ms: 12.082745
type: 'test'
...
# Subtest: the public name with the header reads the bus views, and the Host and Origin are checked first
ok 156 - the public name with the header reads the bus views, and the Host and Origin are checked first
---
duration_ms: 138.759031
type: 'test'
...
# Subtest: in preview mode every write answers 403 read-only, from the public name and loopback, and reaches nothing
ok 157 - in preview mode every write answers 403 read-only, from the public name and loopback, and reaches nothing
---
duration_ms: 107.633792
type: 'test'
...
# Subtest: loopback requests are unchanged in preview mode, and the bus views work with the board down
ok 158 - loopback requests are unchanged in preview mode, and the bus views work with the board down
---
duration_ms: 34.925117
type: 'test'
...
# Subtest: a proxy that rewrites Host to the loopback port gets 403 on its first request, whatever the user
ok 159 - a proxy that rewrites Host to the loopback port gets 403 on its first request, whatever the user
---
duration_ms: 31.805397
type: 'test'
...
# Subtest: a repeated Host is 400 before any other check, in preview mode and without it
ok 160 - a repeated Host is 400 before any other check, in preview mode and without it
---
duration_ms: 50.934313
type: 'test'
...
# Subtest: without the preview flags the public name is refused and writes still reach the board
ok 161 - without the preview flags the public name is refused and writes still reach the board
---
duration_ms: 20.577718
type: 'test'
...
# Subtest: processing browser: keyboard Stop, confirmed Resume, unknown outcome and persistent banner
ok 162 - processing browser: keyboard Stop, confirmed Resume, unknown outcome and persistent banner
---
duration_ms: 2917.45253
type: 'test'
...
# Subtest: processing browser: Q175 read-only interim keeps both writes disabled and names CLI recovery at 320px
ok 163 - processing browser: Q175 read-only interim keeps both writes disabled and names CLI recovery at 320px
---
duration_ms: 2439.098214
type: 'test'
...
# Subtest: processing browser: sign-out from config redirect blocks later refresh and writes
ok 164 - processing browser: sign-out from config redirect blocks later refresh and writes
---
duration_ms: 2191.345026
type: 'test'
...
# Subtest: processing browser: sign-out from state redirect blocks later refresh and writes
ok 165 - processing browser: sign-out from state redirect blocks later refresh and writes
---
duration_ms: 2179.903365
type: 'test'
...
# Subtest: processing browser: sign-out from write redirect blocks later refresh and writes
ok 166 - processing browser: sign-out from write redirect blocks later refresh and writes
---
duration_ms: 2498.260819
type: 'test'
...
# Subtest: processing browser: sign-out from config sign-in required blocks later refresh and writes
ok 167 - processing browser: sign-out from config sign-in required blocks later refresh and writes
---
duration_ms: 1645.749342
type: 'test'
...
# Subtest: processing browser: sign-out from state sign-in required blocks later refresh and writes
ok 168 - processing browser: sign-out from state sign-in required blocks later refresh and writes
---
duration_ms: 2167.298573
type: 'test'
...
# Subtest: processing browser: sign-out from write sign-in required blocks later refresh and writes
ok 169 - processing browser: sign-out from write sign-in required blocks later refresh and writes
---
duration_ms: 1494.997186
type: 'test'
...
# ROW191_LAYOUT {"width":400,"height":1000,"controls":97,"tree":324.0625,"main":1450.703125,"top":181.5,"bottom":217.5,"barBottom":129,"projectsTop":352.59375,"order":"0","visible":true}
# ROW191_LAYOUT {"width":1440,"height":1000,"controls":127,"tree":914,"main":914,"top":135.5,"bottom":171.5,"barBottom":53,"projectsTop":636.59375,"order":"0","visible":true}
# ROW191_LAYOUT {"width":1440,"height":420,"controls":127,"tree":334,"main":907.734375,"top":135.5,"bottom":171.5,"barBottom":53,"projectsTop":636.59375,"order":"0","visible":true}
# ROW191_LAYOUT {"width":800,"height":420,"controls":127,"tree":334,"main":1131.65625,"top":135.5,"bottom":171.5,"barBottom":53,"projectsTop":618.59375,"order":"0","visible":true}
# Subtest: processing browser: static nav controls keep Stop visible, ordered and keyboard reachable
ok 170 - processing browser: static nav controls keep Stop visible, ordered and keyboard reachable
---
duration_ms: 1410.892515
type: 'test'
...
# Subtest: interim read-only controls show CLI recovery, disable both writes and retain a halted banner across views
ok 171 - interim read-only controls show CLI recovery, disable both writes and retain a halted banner across views
---
duration_ms: 16.411242
type: 'test'
...
# Subtest: Stop sends one empty halt and Resume confirms before sending the displayed generation
ok 172 - Stop sends one empty halt and Resume confirms before sending the displayed generation
---
duration_ms: 24.777634
type: 'test'
...
# Subtest: a cancelled resume never calls the writer
ok 173 - a cancelled resume never calls the writer
---
duration_ms: 2.547016
type: 'test'
...
# Subtest: unknown writes are not retried or displayed as success and partial stops remain explicit
ok 174 - unknown writes are not retried or displayed as success and partial stops remain explicit
---
duration_ms: 5.439303
type: 'test'
...
# Subtest: the persistent shell loads the control outside route-specific content with accessible status and native buttons
ok 175 - the persistent shell loads the control outside route-specific content with accessible status and native buttons
---
duration_ms: 1.212928
type: 'test'
...
# Subtest: read-only Console can read processing state but neither human control writes without --send
ok 176 - read-only Console can read processing state but neither human control writes without --send
---
duration_ms: 64.585936
type: 'test'
...
# Subtest: Console halt and generation-bound resume use only the management writer and keep partial stops honest
ok 177 - Console halt and generation-bound resume use only the management writer and keep partial stops honest
---
duration_ms: 14.266525
type: 'test'
...
# Subtest: processing write fences refuse cross-site, wrong origin, unnamed host, duplicate identity and bad payload before writer
ok 178 - processing write fences refuse cross-site, wrong origin, unnamed host, duplicate identity and bad payload before writer
---
duration_ms: 17.915031
type: 'test'
...
# Subtest: tester cannot invoke either control writer and failures never echo backend text
ok 179 - tester cannot invoke either control writer and failures never echo backend text
---
duration_ms: 10.493149
type: 'test'
...
# Subtest: processing writes use the existing SSO signer and still require --send and same-origin
ok 180 - processing writes use the existing SSO signer and still require --send and same-origin
---
duration_ms: 12.380186
type: 'test'
...
# Subtest: processing handler independently refuses wrong origin and cross-site before its writer
ok 181 - processing handler independently refuses wrong origin and cross-site before its writer
---
duration_ms: 2.147213
type: 'test'
...
# Subtest: a signed-in same-origin save reaches exactly one human operation and returns the new commit
ok 182 - a signed-in same-origin save reaches exactly one human operation and returns the new commit
---
duration_ms: 78.701454
type: 'test'
...
# Subtest: a save needs send, the named Host, the user, the exact Origin and same-origin Fetch Metadata
ok 183 - a save needs send, the named Host, the user, the exact Origin and same-origin Fetch Metadata
---
duration_ms: 85.870874
type: 'test'
...
# Subtest: a save validates JSON, strict keys, text values and the 1 MiB body before the bus is asked
ok 184 - a save validates JSON, strict keys, text values and the 1 MiB body before the bus is asked
---
duration_ms: 53.698853
type: 'test'
...
# Subtest: a body that is JSON but not an object is refused 400, not thrown on
ok 185 - a body that is JSON but not an object is refused 400, not thrown on
---
duration_ms: 11.864887
type: 'test'
...
# Subtest: the 1 MiB limit is this route only; Settings and messages keep 16 KiB
ok 186 - the 1 MiB limit is this route only; Settings and messages keep 16 KiB
---
duration_ms: 12.785108
type: 'test'
...
# Subtest: a bus refusal is reported as not saved with its own status; stale-base tells the user to reload
ok 187 - a bus refusal is reported as not saved with its own status; stale-base tells the user to reload
---
duration_ms: 12.111962
type: 'test'
...
# Subtest: a save whose answer is lost or unusable is reported unknown and is never retried
ok 188 - a save whose answer is lost or unusable is reported unknown and is never retried
---
duration_ms: 7.650168
type: 'test'
...
# Subtest: the file list and one file read take strict queries and arrive in the expected shape
ok 189 - the file list and one file read take strict queries and arrive in the expected shape
---
duration_ms: 11.100191
type: 'test'
...
# Subtest: reads work without --send; an unusable bus answer is a bad response, a refusal keeps its status
ok 190 - reads work without --send; an unusable bus answer is a bad response, a refusal keeps its status
---
duration_ms: 5.820788
type: 'test'
...
# Subtest: /api/config says edit only where a save can pass
ok 191 - /api/config says edit only where a save can pass
---
duration_ms: 3.935212
type: 'test'
...
# Subtest: a repository-name project refusal is an HTTP conflict
ok 192 - a repository-name project refusal is an HTTP conflict
---
duration_ms: 1.905386
type: 'test'
...
# Subtest: proof startup refuses partial flags non-preview and invalid fixture file metadata or bytes
ok 193 - proof startup refuses partial flags non-preview and invalid fixture file metadata or bytes
---
duration_ms: 4143.036234
type: 'test'
...
# Subtest: serve argv carries only fixture proof path and header; startup explicitly reports proof on or off
ok 194 - serve argv carries only fixture proof path and header; startup explicitly reports proof on or off
---
duration_ms: 815.920861
type: 'test'
...
# Subtest: CLI applies proof on the main listener and rejects that header on its tester listener
ok 195 - CLI applies proof on the main listener and rejects that header on its tester listener
---
duration_ms: 982.606392
type: 'test'
...
# Subtest: proxy proof admits named reads and sends, reads its fixture once, and never exposes the value
ok 196 - proxy proof admits named reads and sends, reads its fixture once, and never exposes the value
---
duration_ms: 91.408229
type: 'test'
...
# Subtest: proxy proof refuses missing wrong short or repeated proof before auth and before any read
ok 197 - proxy proof refuses missing wrong short or repeated proof before auth and before any read
---
duration_ms: 29.517712
type: 'test'
...
# Subtest: proxy proof header is refused on other Hosts and on the tester listener
ok 198 - proxy proof header is refused on other Hosts and on the tester listener
---
duration_ms: 17.550134
type: 'test'
...
# Subtest: proof options reject unsafe or colliding header names without disclosing file contents
ok 199 - proof options reject unsafe or colliding header names without disclosing file contents
---
duration_ms: 24.742431
type: 'test'
...
# Subtest: redactor: config, dataRoot, any absolute path, Discord ids and the JSON parser quote
ok 200 - redactor: config, dataRoot, any absolute path, Discord ids and the JSON parser quote
---
duration_ms: 2.865703
type: 'test'
...
# Subtest: credential state from the date alone, as the bus states it
ok 201 - credential state from the date alone, as the bus states it
---
duration_ms: 0.344835
type: 'test'
...
# Subtest: queue: rows, one row, ids and methods, notes; no path or id from a row
ok 202 - queue: rows, one row, ids and methods, notes; no path or id from a row
---
duration_ms: 1735.952511
type: 'test'
...
# Subtest: queue: a refused read fails closed with the store's text, redacted
ok 203 - queue: a refused read fails closed with the store's text, redacted
---
duration_ms: 840.098416
type: 'test'
...
# Subtest: queue: a store that fails to load, or a child that dies, gives a fixed message with no path or stack
ok 204 - queue: a store that fails to load, or a child that dies, gives a fixed message with no path or stack
---
duration_ms: 2050.373527
type: 'test'
...
# Subtest: business: names, vars on the allowlist, authority, credential metadata only
ok 205 - business: names, vars on the allowlist, authority, credential metadata only
---
duration_ms: 49.010305
type: 'test'
...
# Subtest: business: missing or invalid file refuses with the module's text, redacted
ok 206 - business: missing or invalid file refuses with the module's text, redacted
---
duration_ms: 28.807781
type: 'test'
...
# Subtest: business without --business: the live bus host, else no-bus-host; no system config: not-configured
ok 207 - business without --business: the live bus host, else no-bus-host; no system config: not-configured
---
duration_ms: 35.236885
type: 'test'
...
# Subtest: settings: release, board, loopback address, notifier binding name only
ok 208 - settings: release, board, loopback address, notifier binding name only
---
duration_ms: 640.366166
type: 'test'
...
# Subtest: task fields: the committed table with no reads configured, GET only; a bad table refuses with no path
ok 209 - task fields: the committed table with no reads configured, GET only; a bad table refuses with no path
---
duration_ms: 57.663406
type: 'test'
...
# Subtest: bus-status: a refused boot shows reason, file and last good load; a live host or an ok boot clears it
ok 210 - bus-status: a refused boot shows reason, file and last good load; a live host or an ok boot clears it
---
duration_ms: 25.652526
type: 'test'
...
# Subtest: both presentations replace old activity with relaunch notice, label retained history, then resume after new activity
ok 211 - both presentations replace old activity with relaunch notice, label retained history, then resume after new activity
---
duration_ms: 2814.083157
type: 'test'
...
# Subtest: reported return flow and relative Age: reply sent from the inspector, then the new answer appears there without manual refresh
ok 212 - reported return flow and relative Age: reply sent from the inspector, then the new answer appears there without manual refresh
---
duration_ms: 22412.079673
type: 'test'
...
# organization: {"event":"reload-needs-restart","business":"acme"}
# organization: {"event":"reload-needs-restart","business":"acme"}
# Subtest: row 65 Settings: the routing table lists every instance, saves a harness, model, thinking and fallback to the file, and keeps the draft on each refusal
ok 213 - row 65 Settings: the routing table lists every instance, saves a harness, model, thinking and fallback to the file, and keeps the draft on each refusal
---
duration_ms: 6169.331937
type: 'test'
...
# organization: {"event":"reload-needs-restart","business":"acme"}
# Subtest: row 65 Console: the signed-in human saves a route through a real broker; each refusal says nothing changed and leaves the file and the log
ok 214 - row 65 Console: the signed-in human saves a route through a real broker; each refusal says nothing changed and leaves the file and the log
---
duration_ms: 669.839117
type: 'test'
...
# Subtest: row 65 Console: the routes write needs send on, a writer, the public name, the user, the exact Origin and same-origin Fetch Metadata
ok 215 - row 65 Console: the routes write needs send on, a writer, the public name, the user, the exact Origin and same-origin Fetch Metadata
---
duration_ms: 56.018319
type: 'test'
...
# Subtest: row 65 Console: the routes write takes JSON within 16 KiB with a revision and routes only; an actor is refused and routes are never logged
ok 216 - row 65 Console: the routes write takes JSON within 16 KiB with a revision and routes only; an actor is refused and routes are never logged
---
duration_ms: 43.040547
type: 'test'
...
# Subtest: row 65 Console: a bus refusal maps to its status and says nothing changed; a lost or odd answer says the change may have been made
ok 217 - row 65 Console: a bus refusal maps to its status and says nothing changed; a lost or odd answer says the change may have been made
---
duration_ms: 55.970807
type: 'test'
...
# Subtest: row 65 Console: the routes read takes no arguments, needs a bus and refuses an odd answer
ok 218 - row 65 Console: the routes read takes no arguments, needs a bus and refuses an odd answer
---
duration_ms: 13.203374
type: 'test'
...
# Subtest: the send box: held roles, the draft and caret across a refresh, each receipt, one POST per Send, and the trail link; the board Reply on a 4xx and a 5xx
ok 219 - the send box: held roles, the draft and caret across a refresh, each receipt, one POST per Send, and the trail link; the board Reply on a 4xx and a 5xx
---
duration_ms: 6342.51552
type: 'test'
...
# Subtest: a sent receipt lists its replies as the page refreshes, oldest first and capped, and marks none delivered or read
ok 220 - a sent receipt lists its replies as the page refreshes, oldest first and capped, and marks none delivered or read
---
duration_ms: 12768.333626
type: 'test'
...
# Subtest: startServer takes send only as a function and only with the preview mode
ok 221 - startServer takes send only as a function and only with the preview mode
---
duration_ms: 10.108449
type: 'test'
...
# Subtest: the CLI refuses --send without the preview flags, and without a configured bus
ok 222 - the CLI refuses --send without the preview flags, and without a configured bus
---
duration_ms: 1475.960714
type: 'test'
...
# Subtest: the CLI with --send and a configured bus sends through the human transport and logs one line
ok 223 - the CLI with --send and a configured bus sends through the human transport and logs one line
---
duration_ms: 430.024794
type: 'test'
...
# Subtest: without --send the route is read-only like every other write, and config says no send
ok 224 - without --send the route is read-only like every other write, and config says no send
---
duration_ms: 21.618393
type: 'test'
...
# Subtest: with --send every other write is still 403 read-only, and nothing reaches the board or bus
ok 225 - with --send every other write is still 403 read-only, and nothing reaches the board or bus
---
duration_ms: 16.786159
type: 'test'
...
# Subtest: config says send only on the public name with --send on
ok 226 - config says send only on the public name with --send on
---
duration_ms: 6.910306
type: 'test'
...
# Subtest: a send without the signed-in user is 401 and is neither sent nor logged, loopback included
ok 227 - a send without the signed-in user is 401 and is neither sent nor logged, loopback included
---
duration_ms: 30.537693
type: 'test'
...
# Subtest: each request check refuses before anything is sent, and logs the refusal without the body
ok 228 - each request check refuses before anything is sent, and logs the refusal without the body
---
duration_ms: 23.547585
type: 'test'
...
# Subtest: a send passes exactly to, body and in_reply_to, answers the id, and logs it
ok 229 - a send passes exactly to, body and in_reply_to, answers the id, and logs it
---
duration_ms: 20.063674
type: 'test'
...
# Subtest: a crafted role name cannot forge a log line
ok 230 - a crafted role name cannot forge a log line
---
duration_ms: 4.343733
type: 'test'
...
# Subtest: a bus refusal is not sent, with its status; an outcome the bus could not confirm is unknown and never retried
ok 231 - a bus refusal is not sent, with its status; an outcome the bus could not confirm is unknown and never retried
---
duration_ms: 17.859888
type: 'test'
...
# Subtest: through the human transport the request is exactly the business, message.send and the keys
ok 232 - through the human transport the request is exactly the business, message.send and the keys
---
duration_ms: 255.681169
type: 'test'
...
# Subtest: against a real broker: the message is written once as a human send, and its refusals map
ok 233 - against a real broker: the message is written once as a human send, and its refusals map
---
duration_ms: 197.056216
type: 'test'
...
# Subtest: loopback host and board origin fail closed
ok 234 - loopback host and board origin fail closed
---
duration_ms: 10.82895
type: 'test'
...
# Subtest: real board fixture passes through WebUI; assets and isolated seen/reply work
ok 235 - real board fixture passes through WebUI; assets and isolated seen/reply work
---
duration_ms: 173.436804
type: 'test'
...
# Subtest: proxy preserves exact request bytes, status and receipt, rejects forms and malformed JSON, never follows redirect
ok 236 - proxy preserves exact request bytes, status and receipt, rejects forms and malformed JSON, never follows redirect
---
duration_ms: 125.497299
type: 'test'
...
# Subtest: unreachable board reports URL; CLI rejects unsupported options
ok 237 - unreachable board reports URL; CLI rejects unsupported options
---
duration_ms: 1342.740876
type: 'test'
...
# Subtest: tester service render carries the tester port alongside existing flags
ok 238 - tester service render carries the tester port alongside existing flags
---
duration_ms: 356.324464
type: 'test'
...
# Subtest: tester service refuses forwarded 7332 even with another main port
ok 239 - tester service refuses forwarded 7332 even with another main port
---
duration_ms: 238.11093
type: 'test'
...
# Subtest: tester service invalid ports refuse render and install with exit 4 and leave the unit alone
ok 240 - tester service invalid ports refuse render and install with exit 4 and leave the unit alone
---
duration_ms: 3197.582654
type: 'test'
...
# Subtest: tester service counts the digits as written before it strips leading zeros
ok 241 - tester service counts the digits as written before it strips leading zeros
---
duration_ms: 281.19094
type: 'test'
...
# Subtest: tester service install and status show the tester port without changing send reporting
ok 242 - tester service install and status show the tester port without changing send reporting
---
duration_ms: 1166.286982
type: 'test'
...
# Subtest: render prints the unit without the preview flags
ok 243 - render prints the unit without the preview flags
---
duration_ms: 137.518992
type: 'test'
...
# Subtest: render carries every serve flag, the preview set included
ok 244 - render carries every serve flag, the preview set included
---
duration_ms: 174.678397
type: 'test'
...
# Subtest: a partial preview set is refused
ok 245 - a partial preview set is refused
---
duration_ms: 651.610847
type: 'test'
...
# Subtest: a value the unit cannot carry is refused, for every flag
ok 246 - a value the unit cannot carry is refused, for every flag
---
duration_ms: 6106.703599
type: 'test'
...
# Subtest: the rendered unit names none of the human proof agent markers and sets no agent variable
ok 247 - the rendered unit names none of the human proof agent markers and sets no agent variable
---
duration_ms: 655.857113
type: 'test'
...
# Subtest: install into --dir with --no-reload writes the file whole, then reports unchanged
ok 248 - install into --dir with --no-reload writes the file whole, then reports unchanged
---
duration_ms: 1046.487993
type: 'test'
...
# Subtest: install without --no-reload runs daemon-reload and nothing that starts the unit
ok 249 - install without --no-reload runs daemon-reload and nothing that starts the unit
---
duration_ms: 188.855801
type: 'test'
...
# Subtest: uninstall refuses while the unit is running, with or without --no-reload, and removes it once it is not
ok 250 - uninstall refuses while the unit is running, with or without --no-reload, and removes it once it is not
---
duration_ms: 1545.181682
type: 'test'
...
# Subtest: status prints the unit state and GET /healthz on the installed port
ok 251 - status prints the unit state and GET /healthz on the installed port
---
duration_ms: 832.048582
type: 'test'
...
# Subtest: usage: an unknown verb or flag, and start or enable, exit 4
ok 252 - usage: an unknown verb or flag, and start or enable, exit 4
---
duration_ms: 1479.043026
type: 'test'
...
# Subtest: without --send, render is the template with its placeholders filled, byte for byte
ok 253 - without --send, render is the template with its placeholders filled, byte for byte
---
duration_ms: 587.461549
type: 'test'
...
# Subtest: render --send with the preview set ends ExecStart with --send and changes nothing else
ok 254 - render --send with the preview set ends ExecStart with --send and changes nothing else
---
duration_ms: 428.935532
type: 'test'
...
# Subtest: --send without the whole preview set is refused and writes nothing
ok 255 - --send without the whole preview set is refused and writes nothing
---
duration_ms: 1096.873081
type: 'test'
...
# Subtest: install --send into --dir with --no-reload writes the sending unit, and status says whether it sends
ok 256 - install --send into --dir with --no-reload writes the sending unit, and status says whether it sends
---
duration_ms: 413.539456
type: 'test'
...
# Subtest: uninstall and status take no --send
ok 257 - uninstall and status take no --send
---
duration_ms: 132.811402
type: 'test'
...
# Subtest: install refuses while the unit is running, in any state but inactive or failed, and changes nothing
ok 258 - install refuses while the unit is running, in any state but inactive or failed, and changes nothing
---
duration_ms: 561.91711
type: 'test'
...
# Subtest: when the state read fails, install and uninstall refuse with one line and change nothing
ok 259 - when the state read fails, install and uninstall refuse with one line and change nothing
---
duration_ms: 189.07203
type: 'test'
...
# Subtest: install needs --copy naming a copy that exists, and refuses outside the canonical checkout without --allow-worktree
ok 260 - install needs --copy naming a copy that exists, and refuses outside the canonical checkout without --allow-worktree
---
duration_ms: 294.942381
type: 'test'
...
# Subtest: install refuses unless the bus unit runs from the same copy, naming both paths, and changes nothing
ok 261 - install refuses unless the bus unit runs from the same copy, naming both paths, and changes nothing
---
duration_ms: 601.221938
type: 'test'
...
# Subtest: render --copy runs the copy and reads the queue in the checkout; without --copy the unit is unchanged
ok 262 - render --copy runs the copy and reads the queue in the checkout; without --copy the unit is unchanged
---
duration_ms: 90.775009
type: 'test'
...
# Subtest: the uid header takes only an Authentik uid; the username header still takes a username
ok 263 - the uid header takes only an Authentik uid; the username header still takes a username
---
duration_ms: 1723.779444
type: 'test'
...
# Subtest: a preview value cannot start with - or .
ok 264 - a preview value cannot start with - or .
---
duration_ms: 178.938232
type: 'test'
...
# Subtest: status names the copy and whether refactor has moved past it, and says when the unit runs from no copy
ok 265 - status names the copy and whether refactor has moved past it, and says when the unit runs from no copy
---
duration_ms: 508.192318
type: 'test'
...
# Subtest: proxy proof render carries both flags but never opens the fixture file
ok 266 - proxy proof render carries both flags but never opens the fixture file
---
duration_ms: 34.266111
type: 'test'
...
# Subtest: proxy proof render refuses incomplete non-preview missing unsafe-mode and repo/copy paths
ok 267 - proxy proof render refuses incomplete non-preview missing unsafe-mode and repo/copy paths
---
duration_ms: 361.158837
type: 'test'
...
# Subtest: proxy proof status retains send and tester reporting with both proof flags
ok 268 - proxy proof status retains send and tester reporting with both proof flags
---
duration_ms: 132.744104
type: 'test'
...
# Subtest: row196 socket flag renders only for supporting targets and refuses mixed transports
ok 269 - row196 socket flag renders only for supporting targets and refuses mixed transports
---
duration_ms: 88.206633
type: 'test'
...
# Subtest: Settings form shows every scope and held role; gated save, exact payload, retained draft and no automatic retry
ok 270 - Settings form shows every scope and held role; gated save, exact payload, retained draft and no automatic retry
---
duration_ms: 3790.488022
type: 'test'
...
# Subtest: Q169 Assistant section: gated, changed fields only, name and stop posts, retained draft and no automatic retry
ok 271 - Q169 Assistant section: gated, changed fields only, name and stop posts, retained draft and no automatic retry
---
duration_ms: 3933.278017
type: 'test'
...
# Subtest: Row 167 a refused names read gives the refused usage page; another names failure keeps the Assistant section
ok 272 - Row 167 a refused names read gives the refused usage page; another names failure keeps the Assistant section
---
duration_ms: 1822.509149
type: 'test'
...
# Subtest: Row 167 with a limits draft open, an assistant save gives the limits submit its revision and the typed limit stays
ok 273 - Row 167 with a limits draft open, an assistant save gives the limits submit its revision and the typed limit stays
---
duration_ms: 2448.594745
type: 'test'
...
# Subtest: Row 167 with an assistant draft open, a launch save gives the assistant submit its revision, and reload reads the current one
ok 274 - Row 167 with an assistant draft open, a launch save gives the assistant submit its revision, and reload reads the current one
---
duration_ms: 2498.615959
type: 'test'
...
# 2026-10-22T12:28:50.542Z settings user="jason" changed
# Subtest: REQ-WEB-1 signed-in same-origin Settings write reaches exactly one human operation
ok 275 - REQ-WEB-1 signed-in same-origin Settings write reaches exactly one human operation
---
duration_ms: 62.210427
type: 'test'
...
# Subtest: REQ-WEB-1 Settings writes require enabled send, named Host, identity, exact Origin and same-origin Fetch Metadata
ok 276 - REQ-WEB-1 Settings writes require enabled send, named Host, identity, exact Origin and same-origin Fetch Metadata
---
duration_ms: 16.43299
type: 'test'
...
# Subtest: REQ-WEB-1 Settings validates JSON, size, revision and strict writable keys before broker call
ok 277 - REQ-WEB-1 Settings validates JSON, size, revision and strict writable keys before broker call
---
duration_ms: 30.994536
type: 'test'
...
# Subtest: Q169 a Console change of the assistant reaches the human operation unchanged, and the log names the signed-in user
ok 278 - Q169 a Console change of the assistant reaches the human operation unchanged, and the log names the signed-in user
---
duration_ms: 13.606659
type: 'test'
...
# Subtest: tokens.css and icons.svg are byte copies of docs/design
ok 279 - tokens.css and icons.svg are byte copies of docs/design
---
duration_ms: 1.451302
type: 'test'
...
# Subtest: JetBrains Mono files match the digests in their sources file, with the OFL text
ok 280 - JetBrains Mono files match the digests in their sources file, with the OFL text
---
duration_ms: 6.640221
type: 'test'
...
# Subtest: shipped strings are unchanged, and the web keeps its write boundary
ok 281 - shipped strings are unchanged, and the web keeps its write boundary
---
duration_ms: 9.013139
type: 'test'
...
# ROW191_LAYOUT {"width":1440,"height":1000,"controls":212.5,"tree":914,"main":914}
# Subtest: shell in a browser: System default, seeded states, 400px, focus and the Ctrl+K palette
ok 282 - shell in a browser: System default, seeded states, 400px, focus and the Ctrl+K palette
---
duration_ms: 9859.912916
type: 'test'
...
# Subtest: five states on Board, Inbox, Tasks, Agents and Trail
ok 283 - five states on Board, Inbox, Tasks, Agents and Trail
---
duration_ms: 5657.394809
type: 'test'
...
# Subtest: a 401 sign-in required on each fetch path signs the page out with a sign-in link and stops the refresh; another 401 stays an error
ok 284 - a 401 sign-in required on each fetch path signs the page out with a sign-in link and stops the refresh; another 401 stays an error
---
duration_ms: 9173.958882
type: 'test'
...
# Subtest: the Sign out form shows only when /api/config says sso, and posts to /auth/logout
ok 285 - the Sign out form shows only when /api/config says sso, and posts to /auth/logout
---
duration_ms: 3315.890121
type: 'test'
...
# Subtest: positive: an RS256 provider signs in and sends one message, and the session reads
ok 286 - positive: an RS256 provider signs in and sends one message, and the session reads
---
duration_ms: 303.142331
type: 'test'
...
# Subtest: positive: an ES256 provider signs in and sends
ok 287 - positive: an ES256 provider signs in and sends
---
duration_ms: 106.402935
type: 'test'
...
# Subtest: positive: two providers each sign in their own subjects, and one provider's subject is unknown to the other
ok 288 - positive: two providers each sign in their own subjects, and one provider's subject is unknown to the other
---
duration_ms: 295.474137
type: 'test'
...
# Subtest: 1: a forged x-authentik header without a cookie is 401 on the API and a sign-in redirect on a page
ok 289 - 1: a forged x-authentik header without a cookie is 401 on the API and a sign-in redirect on a page
---
duration_ms: 207.239329
type: 'test'
...
# Subtest: 2: an HS256 ID token keyed with the client secret and a real RSA kid is refused
ok 290 - 2: an HS256 ID token keyed with the client secret and a real RSA kid is refused
---
duration_ms: 113.174264
type: 'test'
...
# Subtest: 3: a wrong aud, and an aud list holding another client with no azp, are refused
ok 291 - 3: a wrong aud, and an aud list holding another client with no azp, are refused
---
duration_ms: 66.898367
type: 'test'
...
# Subtest: 4: a token that expired 10 minutes ago is refused
ok 292 - 4: a token that expired 10 minutes ago is refused
---
duration_ms: 99.308723
type: 'test'
...
# Subtest: 5: another issuer, and the issuer without its trailing slash, are refused
ok 293 - 5: another issuer, and the issuer without its trailing slash, are refused
---
duration_ms: 86.524659
type: 'test'
...
# Subtest: 6: a nonce mismatch and a missing nonce are refused
ok 294 - 6: a nonce mismatch and a missing nonce are refused
---
duration_ms: 129.568314
type: 'test'
...
# Subtest: 7: state mismatch, no login cookie, a replay, an expired record and two login cookies are refused
ok 295 - 7: state mismatch, no login cookie, a replay, an expired record and two login cookies are refused
---
duration_ms: 161.513723
type: 'test'
...
# Subtest: 8: the token request carries the PKCE verifier, and the OP refuses a wrong one
ok 296 - 8: the token request carries the PKCE verifier, and the OP refuses a wrong one
---
duration_ms: 453.03594
type: 'test'
...
# Subtest: 9: alg none, a changed payload under a real kid, and an unknown kid even after the refetch are refused
ok 297 - 9: alg none, a changed payload under a real kid, and an unknown kid even after the refetch are refused
---
duration_ms: 355.078689
type: 'test'
...
# Subtest: 10: a valid token for a subject not configured is 403 with one subject-unknown line
ok 298 - 10: a valid token for a subject not configured is 403 with one subject-unknown line
---
duration_ms: 72.451067
type: 'test'
...
# Subtest: 11: start refusals: HS or none algs, reserved names, HS-only discovery, an empty JWKS, no S256, an issuer mismatch, a short RSA key
ok 299 - 11: start refusals: HS or none algs, reserved names, HS-only discovery, an empty JWKS, no S256, an issuer mismatch, a short RSA key
---
duration_ms: 440.06305
type: 'test'
...
# Subtest: 11: slot files: a symlink, mode 0644, mode 0640 and a file under the repository are refused, and no message holds the value
ok 300 - 11: slot files: a symlink, mode 0644, mode 0640 and a file under the repository are refused, and no message holds the value
---
duration_ms: 9.58868
type: 'test'
...
# Subtest: 11: the CLI refuses --sso with the old flags and without console.sso, and starts with a good one
ok 301 - 11: the CLI refuses --sso with the old flags and without console.sso, and starts with a good one
---
duration_ms: 3235.329726
type: 'test'
...
# Subtest: 12: under --sso the tester listener refuses each kind of sign-in, has no /auth, and startServer refuses tester with sso
ok 302 - 12: under --sso the tester listener refuses each kind of sign-in, has no /auth, and startServer refuses tester with sso
---
duration_ms: 241.023479
type: 'test'
...
# Subtest: 13: idle and absolute expiry, logout then reuse, a cross-origin logout, and background reads that don't keep a session
ok 303 - 13: idle and absolute expiry, logout then reuse, a cross-origin logout, and background reads that don't keep a session
---
duration_ms: 148.287478
type: 'test'
...
# Subtest: 13: the CSP lets the Sign out form reach the provider's end-session origin, and only under --sso
ok 304 - 13: the CSP lets the Sign out form reach the provider's end-session origin, and only under --sso
---
duration_ms: 184.52126
type: 'test'
...
# Subtest: 14: open redirects land on /, and a path on the Console lands there
ok 305 - 14: open redirects land on /, and a path on the Console lands there
---
duration_ms: 197.512172
type: 'test'
...
# Subtest: 15: a callback for A carrying B's code and iss, and a provider= query, is refused
ok 306 - 15: a callback for A carrying B's code and iss, and a provider= query, is refused
---
duration_ms: 155.923212
type: 'test'
...
# Subtest: 16: a provider with RS256 and ES256 takes either, and refuses PS256 with a usable PS256 key in the JWKS
ok 307 - 16: a provider with RS256 and ES256 takes either, and refuses PS256 with a usable PS256 key in the JWKS
---
duration_ms: 254.363199
type: 'test'
...
# Subtest: 17: 33 started logins leave 32 records, and the first one's callback finds none
ok 308 - 17: 33 started logins leave 32 records, and the first one's callback finds none
---
duration_ms: 150.309377
type: 'test'
...
# Subtest: 18: after a key rotation a sign-in works through one refetch, and the removed kid is refused
ok 309 - 18: after a key rotation a sign-in works through one refetch, and the removed kid is refused
---
duration_ms: 138.422254
type: 'test'
...
# Subtest: 20 and 21: the store holds no raw session id, and the cookie strings are exact
ok 310 - 20 and 21: the store holds no raw session id, and the cookie strings are exact
---
duration_ms: 60.697746
type: 'test'
...
# Subtest: 22: a loopback Host is 403 on a page, a read and a write; /healthz on loopback is 200; a redirect_uri never comes from the Host
ok 311 - 22: a loopback Host is 403 on a page, a read and a write; /healthz on loopback is 200; a redirect_uri never comes from the Host
---
duration_ms: 63.069565
type: 'test'
...
# Subtest: 23: a provider down at start leaves the Console up and 503, and the retry makes sign-in work
ok 312 - 23: a provider down at start leaves the Console up and 503, and the retry makes sign-in work
---
duration_ms: 232.785579
type: 'test'
...
# Subtest: 19: no captured log line holds a token, code, state, nonce, verifier, client secret or session id
ok 313 - 19: no captured log line holds a token, code, state, nonce, verifier, client secret or session id
---
duration_ms: 8.465927
type: 'test'
...
# Subtest: tester Console banner exposes only instance route and name editors and saves a route as tester
ok 314 - tester Console banner exposes only instance route and name editors and saves a route as tester
---
duration_ms: 2366.470358
type: 'test'
...
# Subtest: row 177: the tester Console chat composer is enabled and a send shows in its own thread
ok 315 - row 177: the tester Console chat composer is enabled and a send shows in its own thread
---
duration_ms: 2027.850266
type: 'test'
...
# Subtest: tester-port validates range tunnel main port and requires configured bus before listening
ok 316 - tester-port validates range tunnel main port and requires configured bus before listening
---
duration_ms: 2293.954154
type: 'test'
...
# Subtest: CLI tester listener binds a private Unix socket and spawns TESTER_CLI for every Console bus read
ok 317 - CLI tester listener binds a private Unix socket and spawns TESTER_CLI for every Console bus read
---
duration_ms: 8619.594056
type: 'test'
...
# Subtest: main listener refuses x-mosaic-tester before any board or bus read for every Host
ok 318 - main listener refuses x-mosaic-tester before any board or bus read for every Host
---
duration_ms: 63.771184
type: 'test'
...
# Subtest: tester listener rejects preview binding and requires its fixed logical Host and no proxy auth header
ok 319 - tester listener rejects preview binding and requires its fixed logical Host and no proxy auth header
---
duration_ms: 505.14732
type: 'test'
...
# Subtest: tester listener writes only instances routes and names with tester receipts and actor
ok 320 - tester listener writes only instances routes and names with tester receipts and actor
---
duration_ms: 356.703003
type: 'test'
...
# Subtest: tester listener refuses every human-only write with no bus call
ok 321 - tester listener refuses every human-only write with no bus call
---
duration_ms: 257.782074
type: 'test'
...
# Subtest: tester-off and tester-required reads return HTTP 403
ok 322 - tester-off and tester-required reads return HTTP 403
---
duration_ms: 304.512396
type: 'test'
...
# Subtest: tester credentials routes and committed project reads keep secrets and paths bounded
ok 323 - tester credentials routes and committed project reads keep secrets and paths bounded
---
duration_ms: 606.799235
type: 'test'
...
# Subtest: row 177 W1: the tester chat makes, sends to, opens and reads its own thread as tester
ok 324 - row 177 W1: the tester chat makes, sends to, opens and reads its own thread as tester
---
duration_ms: 72.843406
type: 'test'
...
# Subtest: row 177 W2: tester chat writes refuse a missing or foreign Origin, cross-site, text/plain and the proxy header with no bus call
ok 325 - row 177 W2: tester chat writes refuse a missing or foreign Origin, cross-site, text/plain and the proxy header with no bus call
---
duration_ms: 40.639991
type: 'test'
...
# Subtest: row 177 W3: the human thread through the tester chat is thread-not-owned, and bus.tester off answers tester-off
ok 326 - row 177 W3: the human thread through the tester chat is thread-not-owned, and bus.tester off answers tester-off
---
duration_ms: 70.682405
type: 'test'
...
# Subtest: row 177 W4: the main listener refuses x-mosaic-tester on chat reads and writes before the chat
ok 327 - row 177 W4: the main listener refuses x-mosaic-tester on chat reads and writes before the chat
---
duration_ms: 4.235065
type: 'test'
...
# Subtest: private tester HTTP serves on 0600 socket in 0700 parent and fixed origin
ok 328 - private tester HTTP serves on 0600 socket in 0700 parent and fixed origin
---
duration_ms: 129.687156
type: 'test'
...
# Subtest: private tester refuses symlink, unsafe parent and long path without repairs
ok 329 - private tester refuses symlink, unsafe parent and long path without repairs
---
duration_ms: 1.770267
type: 'test'
...
# Subtest: tester cleanup must leave a replacement inode untouched
ok 330 - tester cleanup must leave a replacement inode untouched
---
duration_ms: 2.841342
type: 'test'
...
# Subtest: row278 browser lists held claims and release preserves role rows and totals
ok 331 - row278 browser lists held claims and release preserves role rows and totals
---
duration_ms: 2602.89348
type: 'test'
...
# Subtest: row278 browser claims 403 stays local and role section remains byte-equal
ok 332 - row278 browser claims 403 stays local and role section remains byte-equal
---
duration_ms: 2278.340703
type: 'test'
...
# Subtest: row278 browser renders only four escaped claim fields and never instance or other extras
ok 333 - row278 browser renders only four escaped claim fields and never instance or other extras
---
duration_ms: 1252.5653
type: 'test'
...
# Subtest: row278 browser sign-out removes claims and prevents reuse of cached answers
ok 334 - row278 browser sign-out removes claims and prevents reuse of cached answers
---
duration_ms: 1260.716768
type: 'test'
...
# Subtest: row278 tester browser keeps role rows without requesting the owner claims section
ok 335 - row278 tester browser keeps role rows without requesting the owner claims section
---
duration_ms: 1104.29009
type: 'test'
...
# Subtest: row278 browser discards a late claims answer after sign-out
ok 336 - row278 browser discards a late claims answer after sign-out
---
duration_ms: 1033.352353
type: 'test'
...
# Subtest: row278 HTTP read returns held claims without send and refuses arguments before the bus
ok 337 - row278 HTTP read returns held claims without send and refuses arguments before the bus
---
duration_ms: 105.899141
type: 'test'
...
# Subtest: row278 HTTP read preserves bus refusal and rejects a malformed result
ok 338 - row278 HTTP read preserves bus refusal and rejects a malformed result
---
duration_ms: 23.435854
type: 'test'
...
# Subtest: row278 tester socket refuses thread claims explicitly with zero bus calls
ok 339 - row278 tester socket refuses thread claims explicitly with zero bus calls
---
duration_ms: 11.87759
type: 'test'
...
# Subtest: row278 Console adapter calls argument-free thread.claims through the normal transport
ok 340 - row278 Console adapter calls argument-free thread.claims through the normal transport
---
duration_ms: 427.023927
type: 'test'
...
# Subtest: REQ-LIMIT-4 Settings shows all token kinds and unknown turns beside every total, as a read-only separate section
ok 341 - REQ-LIMIT-4 Settings shows all token kinds and unknown turns beside every total, as a read-only separate section
---
duration_ms: 2546.813378
type: 'test'
...
# Subtest: REQ-WEB-1 usage read keeps unknown counts and each token kind; no query or write is accepted
ok 342 - REQ-WEB-1 usage read keeps unknown counts and each token kind; no query or write is accepted
---
duration_ms: 64.701157
type: 'test'
...
# Subtest: REQ-WEB-1 malformed usage is refused instead of shown as zero
ok 343 - REQ-WEB-1 malformed usage is refused instead of shown as zero
---
duration_ms: 14.915663
type: 'test'
...
# Subtest: Queue, Business and Settings in their five states, with no move button
ok 344 - Queue, Business and Settings in their five states, with no move button
---
duration_ms: 6707.65216
type: 'test'
...
# Subtest: seeded secrets, Discord ids and paths reach no response and no page; business refusals in the module's words
ok 345 - seeded secrets, Discord ids and paths reach no response and no page; business refusals in the module's words
---
duration_ms: 2202.359422
type: 'test'
...
# Subtest: the server log names no config path when the system config refuses
ok 346 - the server log names no config path when the system config refuses
---
duration_ms: 370.050683
type: 'test'
...
1..346
# tests 346
# suites 0
# pass 345
# fail 0
# cancelled 0
# skipped 1
# todo 0
# duration_ms 56882.921033
OK status with missing harness credential exits 3 and still lists accounts
OK status reports harness credential (read-only) + mosaic accounts
OK api key material never reaches output
OK oauth token material never reaches output
OK unparseable credential file exits 2
OK symlinked credential file exits 4
OK env-side credential names reported
OK env var values never reach output
OK accounts without an accounts dir reports none and creates nothing
OK accounts lists files and marks the active one
OK loose account perms flagged in listing
OK agent --auth with missing account file refuses (exit 4)
OK agent --auth with non-0600 account file refuses
OK agent --auth with invalid account name refuses
OK auth.sh without valid config refuses
selftest: 15 passed, 0 failed
On branch gander/row278-b
Your branch is up to date with 'origin/gander/row278-b'.
nothing to commit, working tree clean
OK dry-run: allowed change, exit 0, nothing committed (exit 0)
OK dry-run committed nothing
OK apply: allowed change exits 0 (exit 0)
OK apply: attribution in commit subject
OK apply: target tree clean after commit
OK disallowed path refused (exit 1)
OK disallowed path: target untouched
OK syntax gate refused broken .mjs (exit 1)
OK syntax gate: target untouched
OK suite failure refused (exit 1)
OK suite failure: target reverted to clean
OK disabled policy refused (exit 2)
OK disabled policy: target untouched
OK failed run refused (exit 1)
OK failed run: target untouched
OK missing run exits 4 (exit 4)
OK invalid policy exits 2 (exit 2)
selftest: 17 passed, 0 failed
OK absent adapter defaults to pi
OK adapter mock validates (exit 0)
OK unsupported adapter exits 2 (exit 2)
OK env exports adapter
OK bootstrap creates default when absent (exit 0)
OK bootstrap wrote config file
OK bootstrap is idempotent on existing config (exit 0)
OK bootstrap did not rewrite existing config
OK validate missing config exits 3 (exit 3)
OK malformed JSON exits 2 (exit 2)
OK unsupported configVersion exits 2 (exit 2)
OK unknown top-level key exits 2 (exit 2)
OK unknown execution key exits 2 (exit 2)
OK unsupported backend exits 2 (exit 2)
OK unsupported environment exits 2 (exit 2)
OK relative dataRoot exits 2 (exit 2)
OK non-canonical dataRoot exits 2 (exit 2)
OK filesystem root dataRoot exits 2 (exit 2)
OK home directory dataRoot exits 2 (exit 2)
OK dataRoot containing config dir exits 2 (exit 2)
OK control character in provider exits 2 (exit 2)
OK symlinked config file exits 2 (exit 2)
OK env exports resolve correctly
OK valid console.sso loads and is in the output
OK console.sso HS256 alg exits 2 naming the path (exit 2)
OK console.sso alg none exits 2 naming the path (exit 2)
OK console.sso missing slot field exits 2 naming the path (exit 2)
OK console.sso slot name outside the pattern exits 2 naming the path (exit 2)
OK unknown key under console exits 2 naming the path (exit 2)
OK config without console loads with unchanged output
OK failed validation modified nothing
selftest: 31 passed, 0 failed
toolchain: node v26.8.1
OK syntax: packages/discord/src/approvals.mjs
OK syntax: packages/discord/src/authorize.mjs
OK syntax: packages/discord/src/binding.mjs
OK syntax: packages/discord/src/cli.mjs
OK syntax: packages/discord/src/connector.mjs
OK syntax: packages/discord/src/context.mjs
OK syntax: packages/discord/src/engine-pi.mjs
OK syntax: packages/discord/src/errors.mjs
OK syntax: packages/discord/src/gateway.mjs
OK syntax: packages/discord/src/git.mjs
OK syntax: packages/discord/src/journal.mjs
OK syntax: packages/discord/src/notify.mjs
OK syntax: packages/discord/src/processing.mjs
OK syntax: packages/discord/src/rest.mjs
OK syntax: packages/discord/src/setspark.mjs
OK syntax: packages/discord/src/tools.mjs
OK syntax: packages/discord/src/web.mjs
OK syntax: packages/discord/bin/git-credential.mjs
OK syntax: packages/discord/extension/tools.mjs
OK syntax: packages/discord/tests/approvals.test.mjs
OK syntax: packages/discord/tests/authorize.test.mjs
OK syntax: packages/discord/tests/binding.test.mjs
OK syntax: packages/discord/tests/connector.test.mjs
OK syntax: packages/discord/tests/context.test.mjs
OK syntax: packages/discord/tests/copy-service.test.mjs
OK syntax: packages/discord/tests/engine.test.mjs
OK syntax: packages/discord/tests/fake-pi.mjs
OK syntax: packages/discord/tests/gateway.test.mjs
OK syntax: packages/discord/tests/git.test.mjs
OK syntax: packages/discord/tests/helpers.mjs
OK syntax: packages/discord/tests/journal.test.mjs
OK syntax: packages/discord/tests/notify.test.mjs
OK syntax: packages/discord/tests/offline-check.test.mjs
OK syntax: packages/discord/tests/processing-stop.test.mjs
OK syntax: packages/discord/tests/processing.test.mjs
OK syntax: packages/discord/tests/recover.test.mjs
OK syntax: packages/discord/tests/rest.test.mjs
OK syntax: packages/discord/tests/setspark.test.mjs
OK syntax: packages/discord/tests/tools.test.mjs
OK syntax: packages/discord/tests/web.test.mjs
OK syntax: packages/discord/fixtures/claim-worker.mjs
OK syntax: packages/discord/fixtures/legacy-owner-worker.mjs
OK syntax: scripts/discord.sh
OK syntax: scripts/discord-service.sh
OK packages/discord declares no dependencies
OK no bot-token-shaped string in packages/discord
OK fixture binding uses placeholder ids only
OK fixture binding validates
OK real pi with the extension exposes exactly list_dir, read_file, search and no built-in tool
OK real pi with a writable root exposes exactly the three reads plus write_file and edit_file, and writes nothing at start
OK real pi with a web key exposes the three reads plus web_fetch and web_search, and no write tool without a writable root
OK real pi with a git root exposes the reads, writes and the four git verbs, commits nothing at start, and never shows the token
OK real pi with protocol vault adds reserve_id to the git verbs
OK real pi with a setspark key exposes the reads and the eight record verbs, no counters, and never shows the key
OK real pi refuses a git key on a read-only root (fail closed)
OK real pi with the pilot flags (--no-tools) exposes no tool at all
OK real pi exits non-zero without MOSAIC_DISCORD_TOOLS: no session, no tools (fail closed)
OK a failing nested test fails the run under a parent runner's NODE_TEST_CONTEXT
OK node --test packages/discord/tests/ (ℹ pass 192)
OK scripts/discord.sh --help exits 0
OK scripts/discord.sh check without a binding exits 4
OK scripts/discord.sh recover without a binding exits 4
OK scripts/discord.sh reload without a binding exits 4
OK scripts/discord-service.sh without a command exits 4
OK service unit renders with the repository path, a supervised run as the main process, exit 3 never retried, and reload as SIGHUP
OK service install writes the rendered unit (0644) and leaves no temp file
OK service install a second time reports unchanged
OK systemd-analyze verify accepts the rendered unit
OK service uninstall removes the unit file
OK service install with an unknown flag exits 4
OK service install with USER unset finishes and names the account for lingering
OK pinned render runs copy CLI with copy cwd/repo and no checkout executable
OK pinned install writes the rendered unit in a temporary unit directory
OK pinned install refuses short prerequisite and writes no unit
OK pinned install refuses missing prerequisite and writes no unit
OK pinned install refuses cli prerequisite and writes no unit
OK pinned install refuses pi prerequisite and writes no unit
OK status names the copy from fake systemctl effective cwd
OK checkout install explicitly recommends --copy
OK wrapper check --offline passes local fixture and makes no network call
OK wrapper run --offline refuses usage
discord suite: 81 passed, 0 failed
OK initial ordinary-file install
OK installed tree matches canonical source
OK installed tree has no symlinks
OK check detects installation drift
OK sync refuses to overwrite installation drift
OK check detects an extra destination file
OK check detects an extra destination directory
OK check rejects a destination symlink
OK sync accepts a canonical source update
OK updated installation matches canonical source
scripts/test-extension-package.sh: line 14: 134460 Killed "$@" > /dev/null 2>&1
OK forced interruption kills the replacing process
OK next invocation recovers old consistent installation
OK interrupted replacement rolled back
OK sync succeeds after interruption recovery
OK unlocked stale lock file does not block
OK active lock refuses a concurrent sync
OK source symlink fails closed
OK nested second entrypoint fails closed
extension package selftest: 18 passed, 0 failed
toolchain: node v26.8.1, python 3.12.8, jsonschema 4.26.0
OK syntax: scripts/foundation-inspect.mjs
OK syntax: scripts/foundation/strict-json.mjs
OK syntax: scripts/foundation/canonical.mjs
OK syntax: scripts/foundation/resolve.mjs
OK syntax: scripts/foundation/validate-record.mjs
OK syntax: scripts/foundation/fixtures/build-fixtures.mjs
OK syntax: scripts/foundation/canonical.test.mjs
OK syntax: scripts/foundation/cli.test.mjs
OK syntax: scripts/foundation/fixtures.test.mjs
OK syntax: scripts/foundation/resolve.test.mjs
OK syntax: scripts/foundation/strict-json.test.mjs
OK syntax: scripts/foundation/verify-schema.py (ast only; no bytecode written)
OK fixture generator runs
OK checked-in fixtures/bundles equal a fresh generation
OK checked-in fixtures/raw equal a fresh generation
OK checked-in fixtures/index.json equal a fresh generation
OK checked-in demo bundles equal a fresh generation
OK a failing nested test fails the run under a parent runner's NODE_TEST_CONTEXT
OK node --test scripts/foundation/ (ℹ pass 80)
OK differential schema oracle: PASS: differential schema oracle (finite corpus; compatibility evidence, not equivalence proof)
platform witness: strftime('%Y') for year 999 -> '999' (pinned checker refuses years 0001..0999)
node v26.8.1; corpus 1568 records (38 pinned fixtures, 478 unique bundle records, 1052 typeCase/mutation/lexical cases)
schema column: agree-valid 540, agree-invalid 991, DISAGREEMENTS 0; strict-only (parser-bound) cases: 27; unsupported-kind records not schema-assessed by the inspector: 10
profile column (schema-valid records only): profile-valid 510, profile-invalid 30
profile refusals asserted: 30 schema-agreed-valid records refused only by the strict typed-string profile (rule profile-pattern-mismatch), 12 declared by name; 73 named probes verified against declared schema/profile columns
OK oracle: zero schema-column disagreements with the pinned checker
OK oracle: strict-only profile refusals are counted and asserted
OK demo: permitted read preview exits 0 (exit 0)
OK demo: permitted file.change preview exits 0 (exit 0)
OK demo: assignment.change proposal is unresolved (exit 3) (exit 3)
OK demo: revoked registration is refused (exit 3) (exit 3)
OK demo: message is not authority (exit 3) (exit 3)
OK usage: no arguments exits 2 (exit 2)
OK io: missing file exits 4 (exit 4)
OK io: directory exits 4 (exit 4)
OK io: symlink exits 4 (O_NOFOLLOW) (exit 4)
OK bound: oversize fixture exits 2 (exit 2)
OK profile: one final LF in a typed selection id is refused before admission (exit 2) (exit 2)
OK profile: two final LFs fail the schema pattern itself (exit 2) (exit 2)
OK profile: escaped newlines in free-form text stay allowed (exit 0) (exit 0)
OK profile refusal is invalid-request/profile-pattern-mismatch with selection and operation withheld, value not echoed
OK text output starts with the disclaimer
OK json output is valid JSON with result allowed and exactly the charter §7 fields
OK json golden matches byte-for-byte
OK sandboxed bundle run (env -i, PATH=/nonexistent) produced the unresolved proposal
OK sandbox inventory (path/type/size/mode/uid/gid/inode/mtime/sha256) unchanged by runs
OK canary never printed (bundle run and credential-file run)
OK a non-bundle JSON file is refused at the shape gate, not read into output
OK no field of the non-bundle file is echoed
selftest: 44 passed, 0 failed
OK args: exit 2, target-branch
OK args: exit 2, target-branch
OK args: exit 4
OK args: exit 4
OK args: exit 4
OK --base next refuses before the config is read (got 2)
OK a missing system config exits 3 (got 3)
OK nobus: exit 3
OK schema-table: exit 2, bus-schema
OK schema-meta: exit 2, bus-schema
OK openBus opens the database read-only
OK other-business: exit 2, decision-not-found
OK no-raise: exit 2, decision-not-found
OK not-a-merge: exit 2, not-a-merge
OK open: exit 2, not-resolved
OK withdrawn: exit 2, not-resolved
OK by-agent: exit 2, not-human
OK via-webui: exit 2, not-human
OK no-answer: exit 2, not-human
OK answer-role: exit 2, not-human
OK answer-run: exit 2, not-human
OK answer-choice: exit 2, not-human
OK two-answers: exit 2, not-human
OK arbiter-cross: exit 2, not-human
OK arbiter-cited: exit 2, not-human
OK chose-no: exit 2, not-merge-option
OK two-refs: exit 2, work-ref
OK bad-ref: exit 2, work-ref
OK task-ref-disagrees: exit 2, work-ref
OK raise-task-disagrees: exit 2, work-ref
OK target-main: exit 2, target-branch
OK superseded-question: exit 2, superseded
OK superseded-task: exit 2, superseded
OK superseded-by: exit 2, superseded
OK no-verdict: exit 2, no-verdict
OK changes-later: exit 2, not-approved
OK short-commit: exit 2, not-approved
OK wrong-task-body: exit 2, not-approved
OK args: exit 2, decision-not-found
OK earlier-merge: exit 0
OK ref-moved: exit 2, ref-moved
OK root-top: exit 2, root-file
OK root-newdir: exit 2, root-file
OK root-src: exit 2, root-file
OK unrelated: exit 2, base-conflict
OK empty: exit 2, base-conflict
OK an empty reviewed diff says so
OK dirty-changed: exit 2, checkout-dirty
OK dirty-staged: exit 2, checkout-dirty
OK dirty-untracked: exit 2, checkout-dirty
OK conflict: exit 2, base-conflict
OK a refusal after the worktree is added leaves no worktree or scratch
OK cleanup looks for the worktree's Docker network
OK dirty-during: exit 2, checkout-dirty
OK a reviewed path dirtied during the gate moves no ref
OK drift: exit 2, patch-drift
OK patch-drift leaves no worktree or scratch
OK gate-pkg: exit 2, gate-failed
OK gate-failed names the failing step's log, and it exists
OK gate-failed leaves no worktree or scratch
OK gate-script: exit 2, gate-failed
OK a failing scripts/test-*.sh fails the gate
OK a failed gate moves no ref
OK nomods: exit 4
OK a target without node_modules leaves no worktree or scratch
OK moved: exit 2, base-moved
OK base-moved keeps the base where it moved to
OK dry: exit 0
OK --dry-run writes no ref
OK --dry-run prints the commit with --subject and --attribution
OK --dry-run runs the gate
OK --dry-run leaves no worktree or scratch
OK land: exit 0
OK the landing is one commit on the old base
OK its diff is the reviewed diff by patch-id
OK its tree is the dry run's
OK the message has the option's subject, the citations and the attribution last
OK it prints the line for the PM
OK the checked-out base has the reviewed paths and keeps the unrelated edit
OK only refs/heads/refactor exists in the target
OK the work ref is unchanged
OK the bus database is unchanged
OK the gate ran each package suite but queue, and each scripts/test-*.sh
OK the landing leaves no worktree or scratch
OK the target's node_modules is still there, with its contents
OK the worktree's Docker network is removed
---
land-work selftests: 86 passed, 0 failed
toolchain: node v26.8.1, git version 2.55.0
OK syntax: packages/queue/src/cli.mjs
OK syntax: packages/queue/src/errors.mjs
OK syntax: packages/queue/src/io.mjs
OK syntax: packages/queue/src/lock.mjs
OK syntax: packages/queue/src/queue.mjs
OK syntax: packages/queue/src/review.mjs
OK syntax: packages/queue/src/store.mjs
OK syntax: packages/queue/tests/commit.test.mjs
OK syntax: packages/queue/tests/data.test.mjs
OK syntax: packages/queue/tests/dispatch.test.mjs
OK syntax: packages/queue/tests/gate-owner.test.mjs
OK syntax: packages/queue/tests/helpers.mjs
OK syntax: packages/queue/tests/lock.test.mjs
OK syntax: packages/queue/tests/migration.test.mjs
OK syntax: packages/queue/tests/review.test.mjs
OK syntax: packages/queue/tests/store.test.mjs
OK syntax: packages/queue/tests/write.test.mjs
OK syntax: packages/queue/tests/fixtures/fake-gitea.mjs
OK syntax: packages/queue/tests/fixtures/kill-at.mjs
OK syntax: packages/queue/tests/fixtures/lock-child.mjs
OK syntax: packages/queue/tests/fixtures/mosaic-pre-a2.sh
OK syntax: scripts/queue-commit.sh
OK syntax: scripts/git-hooks/pre-commit
OK syntax: scripts/mosaic
OK queue-commit.sh, the guard and scripts/mosaic are executable
OK packages/queue declares no dependencies
ℹ tests 156
ℹ pass 156
ℹ fail 0
OK node --test packages/queue/tests/
OK scripts/mosaic queue help
skip queue verify and render --check: this checkout (/home/jwoltje/.t3/worktrees/mosaic-stack/gander-row196) is not the queue's canonical root (/mnt/storage/src/mosaic-stack)
queue suite: 28 passed, 0 failed
OK valid RELEASE resolves (exit 0)
OK invalid RELEASE exits 1 (exit 1)
OK missing RELEASE exits 1 (exit 1)
OK valid RELEASE leaves image tag consistent with version
OK status safe on empty state (exit 0)
OK status created no pointer
OK fault-injected activation refuses (exit 1)
OK refused activation wrote no pointer
OK refusal logged exactly once with valid fields
OK healthy activation succeeds (exit 0)
OK pointer written with valid fields
OK repeat activation succeeds (log grows) (exit 0)
OK log is append-only across activations
OK rollback without previous refuses (exit 1)
selftest: 14 passed, 0 failed
OK valid task validates (exit 0)
OK unknown task key exits 2 (exit 2)
OK unsupported taskVersion exits 2 (exit 2)
OK invalid task id exits 2 (exit 2)
OK empty prompt exits 2 (exit 2)
OK NUL in expectExact exits 2 (exit 2)
OK out-of-range timeout exits 2 (exit 2)
OK missing mission file exits 4 (exit 4)
OK task with valid mission validates (exit 0)
OK invalid mission exits 2 (exit 2)
OK validate missing task exits 4 (exit 4)
OK validation does not modify the task file
OK prune dry-run exits 0 (exit 0)
OK dry-run deleted nothing
OK prune --keep=2 --yes removes oldest (exit 0)
OK kept exactly 2 newest runs
OK newest run kept, oldest pruned
OK append-only receipt written (3 entries)
OK sessions/workspaces untouched by prune
OK prune with invalid keep exits 4 (exit 4)
OK mock adapter: gate passes on matching mock response (exit 0)
OK mock adapter: expect-mismatch recorded (exit 1)
OK mismatch reason recorded
OK unknown adapter fails closed (exit 1)
OK mission task runs via mock adapter (exit 0)
OK mission section injected into generated prompt
OK retry of mission run succeeds (exit 0)
OK retriedFrom lineage recorded
OK mission section present after retry (relative path resolved)
OK retry of missing run exits 4 (exit 4)
OK skill install bundled ms-tools (exit 0)
OK installed to skills-available
OK double install refuses (exit 1)
OK activate enables skill (exit 0)
OK enabled dir populated
OK uninstall while enabled refuses (exit 1)
OK deactivate moves back to available (exit 0)
OK uninstall removes from available (exit 0)
OK seat with enabled skill launches
OK skill path delivered to adapter
OK shipped researcher contract resolves (ceiling + network)
OK resolve-role refuses a non-role document (conductor policy) (exit 2)
OK resolve-role refuses name/filename mismatch (exit 2)
OK resolve-role refuses unknown network declaration (exit 2)
OK resolve-role refuses duplicate role tool (exit 2)
OK resolve-role refuses unsupported tool (exit 2)
OK resolve-role refuses missing contract file (exit 4)
OK version 1 role prints no contract line
OK shipped version 2 roles resolve with their contracts (pm, cto, coder, reviewer)
OK resolve-role accepts a minimal version 2 role (exit 0)
OK resolve-role refuses an action outside the vocabulary (exit 2)
OK resolve-role refuses a gated-only action in a role file (exit 2)
OK resolve-role refuses a Vikunja verb no role may hold (exit 2)
OK resolve-role refuses a version 2 role whose contract is missing (exit 2)
OK resolve-role refuses a contract that is a symbolic link (exit 2)
OK seat launches under role ceiling
OK role ceiling narrows seat tools (read,write,bash -> read,bash)
OK narrowing recorded loudly
OK missing role contract refuses launch (exit 2)
OK missing-contract refusal names the role
OK empty ceiling intersection -> tool-free seat
OK tool-free outcome recorded loudly
OK overridden agents dir without seat definition refuses (exit 4)
OK seat-resolution refusal names the seat
OK policy: mission only -> mission tools
OK policy: task only -> task tools
OK policy: both -> intersection (task narrowed)
OK policy: empty intersection -> tool-free
OK invalid mission capabilities rejected (exit 2)
mosaic-task: unsupported mission tool: "sudo" (supported: read, write, edit, bash, grep, find, ls)
OK task run with user layer present (exit 0)
OK user context dispatched into generated prompt
OK workspace+tools task runs via mock (exit 0)
OK workspace path + tools delivered to adapter
OK persistent workspace created on host
OK plain task still runs (no workspace/tools) (exit 0)
OK workspace var present but empty when absent
OK tools empty when absent
OK unknown tool exits 2 (exit 2)
OK workspace traversal exits 2 (exit 2)
OK hello task succeeds with exact marker
OK result.json written in run dir
OK result.json contents are correct
OK wrong expectExact fails with exit 1 (reason: expect-mismatch)
OK each run gets a distinct run dir (no clobber)
OK list shows both runs
skip live provider cases (row 244: no provider call in the gate)
OK onboard without name exits 4 (non-interactive) (exit 4)
OK onboard --name renders profile (exit 0)
OK profile written
OK canon structure: required filled, optional placeholdered
OK canon sections present
skip live provider cases (row 244: no provider call in the gate)
OK no agent identity on headless run
selftest: 91 passed, 0 failed
{
"grant": "sage-2648",
"stage": "whole",
"steps": [
{
"code": 0,
"timeout": false,
"seconds": 22.463,
"log": "agents/gander/work/queue-278/run3/whole/bus.log",
"name": "bus",
"expected_red": false,
"counts": {
"tests": 793,
"pass": 793,
"fail": 0,
"skipped": 0
}
},
{
"code": 0,
"timeout": false,
"seconds": 56.982,
"log": "agents/gander/work/queue-278/run3/whole/webui.log",
"name": "webui",
"expected_red": false,
"counts": {
"tests": 346,
"pass": 345,
"fail": 0,
"skipped": 1
}
},
{
"code": 0,
"timeout": false,
"seconds": 0.816,
"log": "agents/gander/work/queue-278/run3/whole/test-auth.log",
"name": "test-auth",
"expected_red": false,
"counts": {}
},
{
"code": 0,
"timeout": false,
"seconds": 6.078,
"log": "agents/gander/work/queue-278/run3/whole/test-conductor.log",
"name": "test-conductor",
"expected_red": false,
"counts": {}
},
{
"code": 0,
"timeout": false,
"seconds": 1.868,
"log": "agents/gander/work/queue-278/run3/whole/test-config.log",
"name": "test-config",
"expected_red": false,
"counts": {}
},
{
"code": 0,
"timeout": false,
"seconds": 7.431,
"log": "agents/gander/work/queue-278/run3/whole/test-discord.log",
"name": "test-discord",
"expected_red": false,
"counts": {}
},
{
"code": 0,
"timeout": false,
"seconds": 1.366,
"log": "agents/gander/work/queue-278/run3/whole/test-extension-package.log",
"name": "test-extension-package",
"expected_red": false,
"counts": {}
},
{
"code": 0,
"timeout": false,
"seconds": 39.901,
"log": "agents/gander/work/queue-278/run3/whole/test-foundation.log",
"name": "test-foundation",
"expected_red": false,
"counts": {}
},
{
"code": 0,
"timeout": false,
"seconds": 11.338,
"log": "agents/gander/work/queue-278/run3/whole/test-land-work.log",
"name": "test-land-work",
"expected_red": false,
"counts": {}
},
{
"code": 0,
"timeout": false,
"seconds": 21.158,
"log": "agents/gander/work/queue-278/run3/whole/test-queue.log",
"name": "test-queue",
"expected_red": false,
"counts": {}
},
{
"code": 0,
"timeout": false,
"seconds": 2.67,
"log": "agents/gander/work/queue-278/run3/whole/test-release.log",
"name": "test-release",
"expected_red": false,
"counts": {}
},
{
"code": 0,
"timeout": false,
"seconds": 13.843,
"log": "agents/gander/work/queue-278/run3/whole/test-task.log",
"name": "test-task",
"expected_red": false,
"counts": {}
}
]
}