2bef715211
Source commit: 20b59dc46b72103c2f8a516c692b5cc3d54fab19 Public tree identity: sha256:aaa5ac7b58b2a0d23c6b11e5f76324bf3839ca1f62653a83deb736932adcfbd9
1080 lines
58 KiB
JavaScript
Executable file
1080 lines
58 KiB
JavaScript
Executable file
#!/usr/bin/env node
|
|
|
|
const assert = require("assert");
|
|
const fs = require("fs");
|
|
const path = require("path");
|
|
|
|
const repo = path.resolve(__dirname, "..");
|
|
|
|
function read(relativePath) {
|
|
return fs.readFileSync(path.join(repo, relativePath), "utf8");
|
|
}
|
|
|
|
function maybeRead(relativePath) {
|
|
const fullPath = path.join(repo, relativePath);
|
|
return fs.existsSync(fullPath) ? fs.readFileSync(fullPath, "utf8") : null;
|
|
}
|
|
|
|
function expect(source, name, pattern) {
|
|
if (process.env.DISASMER_ACCEPTANCE_CONTRACT_TRACE) {
|
|
process.stderr.write(`checking acceptance evidence: ${name}\n`);
|
|
}
|
|
assert.match(source, pattern, `missing acceptance evidence guard: ${name}`);
|
|
}
|
|
|
|
function expectGate(script, gateName) {
|
|
assert(
|
|
script.includes("node scripts/acceptance-evidence-contract-smoke.js"),
|
|
`${gateName} must run acceptance-evidence-contract-smoke.js`
|
|
);
|
|
}
|
|
|
|
const phase2 = read("acceptance_criteria_phase2.md");
|
|
const publicAcceptance = read("scripts/acceptance-public.sh");
|
|
const privateAcceptance = read("scripts/acceptance-private.sh");
|
|
const cliFirstAcceptance = read("scripts/acceptance-cli-first.sh");
|
|
const publicSplit = read("scripts/verify-public-split.sh");
|
|
const codeSizeGuard = read("scripts/code-size-guard.js");
|
|
const phase3Ledger = read("scripts/phase3-ledger.js");
|
|
const coreAuth = read("crates/disasmer-core/src/auth.rs");
|
|
const coreArtifact = read("crates/disasmer-core/src/artifact.rs");
|
|
const coreBundle = read("crates/disasmer-core/src/bundle.rs");
|
|
const coreCheckpoint = read("crates/disasmer-core/src/checkpoint.rs");
|
|
const coreExecution = read("crates/disasmer-core/src/execution.rs");
|
|
const coreProject = read("crates/disasmer-core/src/project.rs");
|
|
const coreWire = read("crates/disasmer-core/src/wire.rs");
|
|
const sdkLib = read("crates/disasmer-sdk/src/lib.rs");
|
|
const sdkTaskArgs = read("crates/disasmer-sdk/src/task_args.rs");
|
|
const coordinatorDurable = read("crates/disasmer-coordinator/src/durable.rs");
|
|
const coordinatorPostgres = read("crates/disasmer-coordinator/src/postgres_store.rs");
|
|
const coordinatorRuntimeDurable = read("crates/disasmer-coordinator/src/service/durable_runtime.rs");
|
|
const coordinatorSessions = read("crates/disasmer-coordinator/src/sessions.rs");
|
|
const coordinatorAgents = read("crates/disasmer-coordinator/src/agents.rs");
|
|
const coordinatorProtocol = `${read("crates/disasmer-coordinator/src/service/protocol.rs")}\n${read("crates/disasmer-coordinator/src/service/protocol/responses.rs")}\n${read("crates/disasmer-coordinator/src/service/wire_protocol.rs")}`;
|
|
const coordinatorService = `${read("crates/disasmer-coordinator/src/service.rs")}\n${read("crates/disasmer-coordinator/src/service/routing.rs")}`;
|
|
const coordinatorAdmin = read("crates/disasmer-coordinator/src/service/admin.rs");
|
|
const coordinatorArtifacts = read("crates/disasmer-coordinator/src/service/artifacts.rs");
|
|
const coordinatorQuota = read("crates/disasmer-coordinator/src/service/quota.rs");
|
|
const coordinatorAuthenticated = read("crates/disasmer-coordinator/src/service/authenticated.rs");
|
|
const coordinatorAuthorization = read("crates/disasmer-coordinator/src/service/authorization.rs");
|
|
const coordinatorTcp = read("crates/disasmer-coordinator/src/service/tcp.rs");
|
|
const coordinatorMain = read("crates/disasmer-coordinator/src/main.rs");
|
|
const coordinatorNodes = read("crates/disasmer-coordinator/src/service/nodes.rs");
|
|
const coordinatorSignedNodes = read("crates/disasmer-coordinator/src/service/signed_nodes.rs");
|
|
const coordinatorSignedNodeSurface = `${coordinatorService}\n${coordinatorSignedNodes}`;
|
|
const coordinatorProcesses = `${read("crates/disasmer-coordinator/src/service/process_launch.rs")}\n${read("crates/disasmer-coordinator/src/service/processes.rs")}`;
|
|
const coordinatorMainRuntime = read("crates/disasmer-coordinator/src/service/main_runtime.rs");
|
|
const coordinatorDebug = `${read("crates/disasmer-coordinator/src/service/debug_requests.rs")}\n${read("crates/disasmer-coordinator/src/service/debug.rs")}\n${read("crates/disasmer-coordinator/src/service/debug/validation.rs")}`;
|
|
const coordinatorLogs = read("crates/disasmer-coordinator/src/service/logs.rs");
|
|
const coordinatorServiceTests = read("crates/disasmer-coordinator/src/service/tests.rs");
|
|
const cliConfig = read("crates/disasmer-cli/src/config.rs");
|
|
const cliClient = read("crates/disasmer-cli/src/client.rs");
|
|
const cliAuth = read("crates/disasmer-cli/src/auth.rs");
|
|
const cliLogout = read("crates/disasmer-cli/src/logout.rs");
|
|
const cliAdmin = read("crates/disasmer-cli/src/admin.rs");
|
|
const cliNode = read("crates/disasmer-cli/src/node.rs");
|
|
const cliProject = read("crates/disasmer-cli/src/project.rs");
|
|
const cliRun = read("crates/disasmer-cli/src/run.rs");
|
|
const cliRunLocalServices = read("crates/disasmer-cli/src/run/local_services.rs");
|
|
const cliBundle = read("crates/disasmer-cli/src/bundle.rs");
|
|
const cliTests = read("crates/disasmer-cli/src/tests.rs");
|
|
const nodeLib = read("crates/disasmer-node/src/lib.rs");
|
|
const nodeDaemon = read("crates/disasmer-node/src/daemon.rs");
|
|
const nodeAssignmentRunner = `${read("crates/disasmer-node/src/assignment_runner.rs")}\n${read("crates/disasmer-node/src/assignment_runner/control_watcher.rs")}\n${read("crates/disasmer-node/src/assignment_runner/process_runner.rs")}\n${read("crates/disasmer-node/src/assignment_runner/validation.rs")}`;
|
|
const sharedWasmtimeRuntime = `${read("crates/disasmer-wasm-runtime/src/lib.rs")}\n${read("crates/disasmer-wasm-runtime/src/task_host_linker.rs")}`;
|
|
const nodeIdentity = read("crates/disasmer-node/src/node_identity.rs");
|
|
const nodeCoordinatorSession = read("crates/disasmer-node/src/coordinator_session.rs");
|
|
const nodeTaskArtifacts = read("crates/disasmer-node/src/task_artifacts.rs");
|
|
const nodeTaskReports = read("crates/disasmer-node/src/task_reports.rs");
|
|
const nodeDebugAgent = read("crates/disasmer-node/src/debug_agent.rs");
|
|
const hostedPolicyRoot = maybeRead("private/hosted-policy/src/lib.rs");
|
|
const hostedObservability = maybeRead("private/hosted-policy/src/observability.rs");
|
|
const hostedPolicy = hostedPolicyRoot
|
|
? `${hostedPolicyRoot}\n${hostedObservability || ""}`
|
|
: null;
|
|
const hostedPostgresSmoke = maybeRead(
|
|
"private/hosted-policy/src/bin/disasmer-postgres-durable-smoke.rs"
|
|
);
|
|
const dapAdapter = read("crates/disasmer-dap/src/adapter.rs");
|
|
const dapBreakpoints = read("crates/disasmer-dap/src/breakpoints.rs");
|
|
const dapRuntimeClient = `${read("crates/disasmer-dap/src/runtime_client.rs")}\n${read("crates/disasmer-dap/src/runtime_client/transport.rs")}\n${read("crates/disasmer-dap/src/runtime_client/debug_protocol.rs")}`;
|
|
const dapVirtualModel = read("crates/disasmer-dap/src/virtual_model.rs");
|
|
const dapTests = read("crates/disasmer-dap/src/tests.rs");
|
|
const nodeAttachSmoke = read("scripts/node-attach-smoke.js");
|
|
const schedulerPlacementSmoke = read("scripts/scheduler-placement-smoke.js");
|
|
const selfHostedCoordinatorSmokeSource = read("scripts/self-hosted-coordinator-smoke.js");
|
|
const cliLocalRunSmoke = read("scripts/cli-local-run-smoke.js");
|
|
const vscodeF5Smoke = read("scripts/vscode-f5-smoke.js");
|
|
const dapSmoke = read("scripts/dap-smoke.js");
|
|
const artifactDownloadSmoke = read("scripts/artifact-download-smoke.js");
|
|
const artifactExportSmoke = read("scripts/artifact-export-smoke.js");
|
|
const realFlagshipHarness = read("scripts/real-flagship-harness.js");
|
|
const selfHostedCoordinatorSmoke = read("scripts/self-hosted-coordinator-smoke.js");
|
|
const wasmtimeAssignmentSmoke = read("scripts/wasmtime-assignment-smoke.js");
|
|
const publicLocalDemoMatrix = read("scripts/public-local-demo-matrix-smoke.js");
|
|
const hostedClientCompatSmoke = fs.existsSync(
|
|
path.join(repo, "private/hosted-policy/scripts/hosted-client-compat-smoke.js")
|
|
)
|
|
? read("private/hosted-policy/scripts/hosted-client-compat-smoke.js")
|
|
: null;
|
|
const publicDryrunServiceSmoke = fs.existsSync(
|
|
path.join(repo, "private/hosted-policy/scripts/public-release-dryrun-service-smoke.js")
|
|
)
|
|
? read("private/hosted-policy/scripts/public-release-dryrun-service-smoke.js")
|
|
: null;
|
|
const hostedService = maybeRead("private/hosted-policy/src/bin/disasmer-hosted-service.rs");
|
|
const hostedStartup = maybeRead(
|
|
"private/hosted-policy/src/bin/disasmer-hosted-service/startup.rs"
|
|
);
|
|
const hostedOperatorAuth = maybeRead(
|
|
"private/hosted-policy/src/bin/disasmer-hosted-service/operator_auth.rs"
|
|
);
|
|
const publicDryrunE2e = read("scripts/public-release-dryrun-e2e.js");
|
|
const finalDryrunEvidence = read("scripts/public-release-dryrun-final-evidence.js");
|
|
const mvpCompletionReview = maybeRead("MVP_COMPLETION_REVIEW.md");
|
|
const mvpCompletionReport = maybeRead("MVP_COMPLETION_REPORT.md");
|
|
|
|
if (mvpCompletionReview || mvpCompletionReport) {
|
|
assert(
|
|
mvpCompletionReview && mvpCompletionReport,
|
|
"MVP completion review and report must be present together"
|
|
);
|
|
const reviewedCriteria = [
|
|
...new Set(mvpCompletionReview.match(/AC-\d{2}\.\d{2}/g) || []),
|
|
];
|
|
const reportedRows = mvpCompletionReport
|
|
.split(/\r?\n/)
|
|
.map((line) => line.match(/^\| (AC-\d{2}\.\d{2}) \| ([^|]+) \|/))
|
|
.filter(Boolean);
|
|
const reportedCriteria = reportedRows.map((match) => match[1]);
|
|
assert.strictEqual(
|
|
reviewedCriteria.length,
|
|
108,
|
|
"MVP completion review criterion inventory changed unexpectedly"
|
|
);
|
|
assert.deepStrictEqual(
|
|
[...reportedCriteria].sort(),
|
|
[...reviewedCriteria].sort(),
|
|
"MVP completion report must contain exactly one table row for every reviewed criterion"
|
|
);
|
|
assert.strictEqual(
|
|
new Set(reportedCriteria).size,
|
|
reportedCriteria.length,
|
|
"MVP completion report contains duplicate criterion rows"
|
|
);
|
|
const allowedLevels = new Set([
|
|
"Specified",
|
|
"Contract-verified",
|
|
"Integration-verified",
|
|
"Live-verified",
|
|
"Open",
|
|
]);
|
|
for (const [, criterion, rawLevel] of reportedRows) {
|
|
assert(
|
|
allowedLevels.has(rawLevel.trim()),
|
|
`${criterion} uses an unknown verification level: ${rawLevel.trim()}`
|
|
);
|
|
}
|
|
const openCriteria = reportedRows
|
|
.filter(([, , rawLevel]) => rawLevel.trim() === "Open")
|
|
.map(([, criterion]) => criterion);
|
|
assert(
|
|
openCriteria.length === 0 ||
|
|
(openCriteria.length === 1 && openCriteria[0] === "AC-14.14"),
|
|
"the completion report may leave only immutable release provenance open"
|
|
);
|
|
for (let index = 1; index <= 13; index += 1) {
|
|
const criterion = `AC-14.${String(index).padStart(2, "0")}`;
|
|
const row = reportedRows.find(([, candidate]) => candidate === criterion);
|
|
assert.strictEqual(
|
|
row?.[2].trim(),
|
|
"Live-verified",
|
|
`${criterion} must retain strict hosted evidence`
|
|
);
|
|
}
|
|
for (const requiredSection of [
|
|
"## Verification snapshot",
|
|
"## Authoritative verification runs",
|
|
"## Exact verification commands",
|
|
"## Candidate provenance (not final immutable evidence)",
|
|
"## Change accounting and replaced shortcuts",
|
|
"## Clean filtered-tree quickstart transcript",
|
|
"## Strict hosted transcript",
|
|
"## Known Windows-only issues",
|
|
"## Acceptance-criterion audit",
|
|
"## Remaining release sequence",
|
|
]) {
|
|
assert(
|
|
mvpCompletionReport.includes(requiredSection),
|
|
`MVP completion report omitted required section: ${requiredSection}`
|
|
);
|
|
}
|
|
if (openCriteria.length === 1) {
|
|
expect(
|
|
mvpCompletionReport,
|
|
"completed strict transcript keeps dirty provenance explicit",
|
|
/harness verdict is `partial` only[\s\S]*`source_tree_clean`[\s\S]*configuration `clean` are false/
|
|
);
|
|
}
|
|
expect(
|
|
mvpCompletionReport,
|
|
"exact strict command requires hosted authority and VPS restart proof",
|
|
/DISASMER_STRICT_FULL_RELEASE=1[\s\S]*DISASMER_STRICT_VPS_RESTART=1[\s\S]*DISASMER_SECOND_TENANT_(?:SESSION|EVIDENCE)_FILE=[\s\S]*DISASMER_EXPIRED_USER_SESSION_FILE=/
|
|
);
|
|
}
|
|
|
|
expect(
|
|
phase2,
|
|
"phase 2 rejects type-only acceptance",
|
|
/- \[x\] \*\*Passed:\*\* A criterion cannot be accepted solely because a type, trait, schema, mock, or unit-level model exists\./
|
|
);
|
|
|
|
for (const [gateName, script] of [
|
|
["public acceptance", publicAcceptance],
|
|
["private acceptance", privateAcceptance],
|
|
["CLI-first acceptance", cliFirstAcceptance],
|
|
["public split", publicSplit],
|
|
]) {
|
|
expectGate(script, gateName);
|
|
}
|
|
|
|
expect(codeSizeGuard, "code-size guard enforces 1000-line production file limit", /maxProductionLines = 1000/);
|
|
expect(
|
|
codeSizeGuard,
|
|
"code-size guard excludes test-only Rust modules from business-logic threshold",
|
|
/isTestRustFile/
|
|
);
|
|
expect(
|
|
phase3Ledger,
|
|
"Phase 3 ledger defines the exact pre-final and final states",
|
|
/Phase 3 ledger must contain 191 criteria[\s\S]*Passed: 0, Partial: 181, Open: 10[\s\S]*P3-GATE-[\s\S]*Passed: 191, Partial: 0, Open: 0/
|
|
);
|
|
expect(
|
|
publicDryrunE2e,
|
|
"final public-release E2E requires the pre-final Phase 3 ledger",
|
|
/assertPreFinalLedger\(readPhase3Ledger\(repo\)\)/
|
|
);
|
|
expect(
|
|
finalDryrunEvidence,
|
|
"final evidence requires every Phase 3 criterion to be Passed",
|
|
/assertFinalLedger\(readPhase3Ledger\(repo\)\)/
|
|
);
|
|
expect(
|
|
dapVirtualModel,
|
|
"DAP launch state uses shared core identity and debug model types",
|
|
/use disasmer_core::\{[\s\S]*DebugRuntimeState[\s\S]*ProcessId[\s\S]*ProjectId[\s\S]*TaskDefinitionId[\s\S]*TaskInstanceId[\s\S]*TenantId[\s\S]*UserId[\s\S]*\}[\s\S]*pub\(crate\) tenant: TenantId[\s\S]*pub\(crate\) project_id: ProjectId[\s\S]*pub\(crate\) actor_user: UserId/
|
|
);
|
|
expect(
|
|
coreBundle,
|
|
"bundle debug metadata contains source probe records",
|
|
/pub struct BundleDebugMetadata[\s\S]*pub probes: Vec<BundleDebugProbe>[\s\S]*pub struct BundleDebugProbe[\s\S]*source_path[\s\S]*line_start[\s\S]*line_end[\s\S]*function[\s\S]*task: TaskDefinitionId[\s\S]*pub fn discover_source_debug_probes[\s\S]*disasmer_probe_task[\s\S]*namespace\.ident != "disasmer"[\s\S]*"main"[\s\S]*strip_suffix\("_main"\)[\s\S]*"task"/
|
|
);
|
|
assert.doesNotMatch(
|
|
coreBundle,
|
|
/debug_probe_task_for_function|"file_scope"/,
|
|
"bundle debug metadata must not guess runtime task ownership from function names or invent a file-scope probe"
|
|
);
|
|
expect(
|
|
`${cliBundle}\n${cliTests}`,
|
|
"CLI bundle inspection populates generated debug probes from selected source inputs",
|
|
/discover_debug_probes\(&project, &selected_inputs\)[\s\S]*metadata\.debug_metadata\.probes = debug_probes[\s\S]*discover_source_debug_probes\(&input\.path, &source\)[\s\S]*bundle_inspect_discovers_environments_selected_inputs_and_source_providers[\s\S]*debug_metadata[\s\S]*probes[\s\S]*compile_linux/
|
|
);
|
|
expect(
|
|
`${coreProject}\n${cliTests}`,
|
|
"project inspection derives real Disasmer entrypoints and never invents launch surfaces",
|
|
/NoEntrypoints[\s\S]*discover_entrypoints[\s\S]*segments\.as_slice\(\) == \["disasmer", "main"\][\s\S]*entrypoint_name[\s\S]*project_without_declared_entrypoint_does_not_invent_product_surfaces[\s\S]*entrypoint == "build"[\s\S]*entrypoint == "release"/
|
|
);
|
|
expect(
|
|
sdkTaskArgs,
|
|
"SDK task boundary compile-fail examples reject host-only values",
|
|
/```compile_fail[\s\S]*borrowed\.as_str\(\)[\s\S]*```compile_fail[\s\S]*std::ptr::null[\s\S]*```compile_fail[\s\S]*std::fs::File[\s\S]*```compile_fail[\s\S]*Mutex::new/
|
|
);
|
|
expect(
|
|
dapVirtualModel,
|
|
"DAP state stores bundle debug probe metadata",
|
|
/debug_probes: Vec<BundleDebugProbe>[\s\S]*load_bundle_debug_probes\(&self\.project, &self\.source_path\)/
|
|
);
|
|
expect(
|
|
dapBreakpoints,
|
|
"DAP breakpoint resolver uses bundle debug probes",
|
|
/load_bundle_debug_probes[\s\S]*discover_source_debug_probes\(source_path, &source\)[\s\S]*resolve_breakpoints[\s\S]*debug_probe_for_line[\s\S]*Mapped to Disasmer debug probe[\s\S]*No Disasmer debug probe metadata covers this source line/
|
|
);
|
|
expect(
|
|
dapAdapter,
|
|
"DAP setBreakpoints calls probe-aware resolver",
|
|
/let requested_source_path = request[\s\S]*let requested_lines = request[\s\S]*resolve_breakpoints_for_source\([\s\S]*requested_source_path,[\s\S]*requested_lines[\s\S]*breakpoint\.to_dap\(\)/
|
|
);
|
|
expect(
|
|
`${dapTests}\n${dapSmoke}`,
|
|
"DAP tests and smoke cover probe-backed breakpoint mapping",
|
|
/breakpoint_resolution_uses_bundle_debug_probe_metadata[\s\S]*buildMainLine[\s\S]*setBreakpoints[\s\S]*breakpointResponse\.body\.breakpoints\[0\]\.verified, true/
|
|
);
|
|
expect(
|
|
dapRuntimeClient,
|
|
"DAP runtime client calls coordinator restart_task and parses boundary decision",
|
|
/pub\(crate\) fn restart_task\([\s\S]*state: &AdapterState,[\s\S]*task: &TaskInstanceId,[\s\S]*"type": "restart_task"[\s\S]*parse_task_restart_response[\s\S]*accepted[\s\S]*clean_boundary_available[\s\S]*requires_whole_process_restart/
|
|
);
|
|
expect(
|
|
dapRuntimeClient,
|
|
"local and live DAP launch share the real Wasm entrypoint path",
|
|
/run_local_services_runtime[\s\S]*launch_services_debug_entrypoint\(&listen, state, &repo\)[\s\S]*fn launch_services_debug_entrypoint[\s\S]*build_debug_bundle[\s\S]*"set_debug_breakpoints"[\s\S]*"kind": "coordinator_node_wasm"[\s\S]*"wasm_module_base64"[\s\S]*run_live_services_runtime[\s\S]*launch_services_debug_entrypoint\(&coordinator, state, &repo\)/
|
|
);
|
|
assert.doesNotMatch(
|
|
dapRuntimeClient,
|
|
/launch_live_placed_task|"command": "cargo"|"task": "compile-linux"/,
|
|
"live DAP must not launch a separate synthetic cargo task"
|
|
);
|
|
expect(
|
|
dapAdapter,
|
|
"DAP services restartFrame uses coordinator restart decision",
|
|
/state\.runtime_backend != RuntimeBackend::Simulated[\s\S]*restart_task_through_coordinator[\s\S]*restart_task\(state, &task\)[\s\S]*coordinator refused task restart[\s\S]*whole virtual-process restart required/
|
|
);
|
|
expect(
|
|
dapRuntimeClient,
|
|
"DAP failed-main restart explicitly replaces the existing virtual process",
|
|
/relaunch_services_main_runtime[\s\S]*restart_state\.restart_existing = true[\s\S]*launch_services_debug_entrypoint/
|
|
);
|
|
expect(
|
|
`${coordinatorProcesses}\n${coordinatorMainRuntime}`,
|
|
"process replacement retires the old main and rejects late incarnation commands",
|
|
/replacing_existing[\s\S]*interrupt_process[\s\S]*controls[\s\S]*remove[\s\S]*next_launch_id[\s\S]*is_current_scope[\s\S]*coordinator main process incarnation was replaced/
|
|
);
|
|
expect(
|
|
`${dapTests}\n${dapSmoke}`,
|
|
"DAP tests and smoke cover coordinator restart boundary refusal",
|
|
/task_restart_response_preserves_coordinator_boundary_decision[\s\S]*client\.send\("restartFrame"[\s\S]*restartFailure[\s\S]*checkpoint boundary\|still active/
|
|
);
|
|
expect(
|
|
dapSmoke,
|
|
"DAP restarts a terminal failed task and waits for its new acknowledged probe stop",
|
|
/failMainLine[\s\S]*restartClient\.send\("continue"[\s\S]*message\.event === "terminated"[\s\S]*send\("restartFrame"[\s\S]*response\(restartRequest, "restartFrame"\)[\s\S]*Restarted main from the rebuilt bundle[\s\S]*allThreadsStopped, true/
|
|
);
|
|
expect(
|
|
`${sharedWasmtimeRuntime}\n${nodeAssignmentRunner}\n${dapVirtualModel}\n${dapSmoke}`,
|
|
"DAP proves real dynamic child threads, arguments, handles, and probe-boundary all-stop",
|
|
/enter_quiescent_host_boundary[\s\S]*leave_quiescent_host_boundary[\s\S]*TaskHostOperation::DebugProbe[\s\S]*debug_handle_snapshot[\s\S]*task_handle_\{handle_id\}[\s\S]*runtime_task_args[\s\S]*insert_runtime_thread[\s\S]*taskTrapLine[\s\S]*childThread[\s\S]*arg_0[\s\S]*task_handle_[\s\S]*definition=task_trap instance=ti:.*:child:\\d\+ state=active/
|
|
);
|
|
expect(
|
|
`${dapAdapter}\n${dapRuntimeClient}\n${dapVirtualModel}\n${dapTests}`,
|
|
"DAP attach product mode reads coordinator debug/task state",
|
|
/attach_services_runtime[\s\S]*RuntimeBackend::LocalServices \| RuntimeBackend::LiveServices[\s\S]*apply_attach_record[\s\S]*"type": "debug_attach"[\s\S]*authorization[\s\S]*allowed[\s\S]*"type": "list_task_events"[\s\S]*coordinator_threads_from_events[\s\S]*attach_record_replaces_demo_threads_with_coordinator_task_events/
|
|
);
|
|
expect(
|
|
coordinatorProtocol,
|
|
"coordinator protocol exposes probe hits and acknowledged Debug Epoch state",
|
|
/SetDebugBreakpoints \{[\s\S]*InspectDebugBreakpoints \{[\s\S]*CreateDebugEpoch \{[\s\S]*ResumeDebugEpoch \{[\s\S]*InspectDebugEpoch \{[\s\S]*ReportDebugState \{[\s\S]*ReportDebugProbeHit \{[\s\S]*DebugEpochStatus \{/
|
|
);
|
|
expect(
|
|
`${coordinatorMain}\n${coordinatorRuntimeDurable}\n${coordinatorPostgres}\n${coordinatorServiceTests}\n${hostedStartup || ""}`,
|
|
"actual standalone and hosted services load and persist durable state through configured Postgres",
|
|
/DATABASE_URL[\s\S]*new_with_database_url[\s\S]*RuntimeDurableStore[\s\S]*PostgresDurableStore::connect[\s\S]*disasmer_cli_sessions[\s\S]*postgres_backed_runtime_service_survives_restart_without_live_process_state[\s\S]*new_with_admin_token_database_url_and_quota/
|
|
);
|
|
if (hostedPostgresSmoke) {
|
|
expect(
|
|
hostedPostgresSmoke,
|
|
"private Postgres restart evidence authenticates the same durable CLI session after reboot",
|
|
/issue_cli_session[\s\S]*try_persist[\s\S]*Coordinator::try_boot[\s\S]*authenticate_cli_session_at[\s\S]*durable_cli_session_present/
|
|
);
|
|
}
|
|
expect(
|
|
coordinatorService,
|
|
"coordinator stores transient Debug Epoch maps",
|
|
/debug_epochs: BTreeMap<ProcessControlKey, u64>[\s\S]*debug_epoch_runtime: BTreeMap<ProcessControlKey, debug::DebugEpochRuntime>[\s\S]*debug_breakpoints: BTreeMap<ProcessControlKey, debug::DebugBreakpointPlan>[\s\S]*debug_commands: BTreeMap<TaskControlKey, debug::DebugPendingCommand>/
|
|
);
|
|
expect(
|
|
coordinatorDebug,
|
|
"executing Wasm probe hits create a freeze Debug Epoch",
|
|
/handle_report_debug_probe_hit[\s\S]*wasm_debug_probe_hit[\s\S]*"freeze"[\s\S]*executing Wasm reached probe/
|
|
);
|
|
expect(
|
|
coordinatorDebug,
|
|
"coordinator exposes freeze, resume, poll, and signed state handlers",
|
|
/handle_create_debug_epoch[\s\S]*"freeze"[\s\S]*handle_resume_debug_epoch[\s\S]*"resume"[\s\S]*handle_poll_debug_command[\s\S]*handle_report_debug_state/
|
|
);
|
|
expect(
|
|
coordinatorDebug,
|
|
"coordinator derives all-stop and resumed state from participant acknowledgements",
|
|
/all_acknowledged[\s\S]*fully_frozen[\s\S]*DebugAcknowledgementState::Frozen[\s\S]*fully_resumed[\s\S]*DebugAcknowledgementState::Running/
|
|
);
|
|
expect(
|
|
`${dapAdapter}\n${dapRuntimeClient}\n${dapVirtualModel}\n${dapSmoke}`,
|
|
"DAP services mode waits for coordinator Debug Epoch acknowledgement",
|
|
/run_local_services_runtime[\s\S]*set_debug_breakpoints[\s\S]*wait_for_breakpoint_hit[\s\S]*wait_for_debug_epoch_state_at[\s\S]*all_participants_frozen[\s\S]*resume_debug_epoch\(state[\s\S]*wait_for_debug_epoch_resumed/
|
|
);
|
|
expect(
|
|
coordinatorServiceTests,
|
|
"coordinator test proves signed node freeze/resume debug commands",
|
|
/debug_epoch_commands_are_polled_by_signed_active_task_nodes[\s\S]*SetDebugBreakpoints[\s\S]*ReportDebugProbeHit[\s\S]*PollDebugCommand[\s\S]*ReportDebugState[\s\S]*fully_frozen[\s\S]*ResumeDebugEpoch[\s\S]*fully_resumed/
|
|
);
|
|
expect(
|
|
coreCheckpoint,
|
|
"core models the exact clean task entry and VFS boundary",
|
|
/CheckpointBoundary[\s\S]*serialized_args[\s\S]*environment_digest[\s\S]*vfs_epoch[\s\S]*task_abi/
|
|
);
|
|
expect(
|
|
coordinatorProcesses,
|
|
"coordinator captures that boundary before dispatch",
|
|
/capture_task_restart_checkpoint[\s\S]*required_artifacts[\s\S]*VfsManifest[\s\S]*task_restart_checkpoints\.insert[\s\S]*TaskRestartCheckpoint/
|
|
);
|
|
expect(
|
|
`${coordinatorDebug}\n${coordinatorServiceTests}\n${wasmtimeAssignmentSmoke}`,
|
|
"failed task restart uses the captured boundary and relaunches the real assignment",
|
|
/RestartPolicy\.decide[\s\S]*handle_launch_task_with_actor[\s\S]*selected task restarted as new instance[\s\S]*from clean VFS entry boundary[\s\S]*service_reports_task_restart_boundary_through_public_api[\s\S]*restarted_assignment[\s\S]*trapRestart[\s\S]*clean_boundary_available, true[\s\S]*restartedTrapNodeRun\.node_status, "failed"/
|
|
);
|
|
expect(
|
|
coordinatorProtocol,
|
|
"launch and assignment protocol carry the TaskSpec and exact Wasm module bytes",
|
|
/LaunchTask \{[\s\S]*task_spec: TaskSpec[\s\S]*wasm_module_base64: String[\s\S]*pub struct TaskAssignment \{[\s\S]*pub task_spec: TaskSpec[\s\S]*pub wasm_module_base64: String/
|
|
);
|
|
expect(
|
|
coordinatorProcesses,
|
|
"coordinator placement preserves the TaskSpec and Wasm module in the assignment",
|
|
/let assignment = TaskAssignment \{[\s\S]*task_spec: pending\.task_spec[\s\S]*wasm_module_base64: pending\.wasm_module_base64/
|
|
);
|
|
expect(
|
|
sharedWasmtimeRuntime,
|
|
"shared Wasmtime runtime verifies the module digest before compilation",
|
|
/fn verified_module_bytes[\s\S]*let actual = Digest::sha256\(bytes\)[\s\S]*if &actual != expected_bundle_digest[\s\S]*BundleDigestMismatch/
|
|
);
|
|
expect(
|
|
`${nodeAssignmentRunner}\n${nodeDaemon}`,
|
|
"node assignment runner requires the bundle digest and executes the versioned task export through the verified runtime",
|
|
/run_verified_wasmtime_assignment[\s\S]*bundle_digest\.as_ref\(\)[\s\S]*run_task_export_verified_with_task_host[\s\S]*daemon_wasm_task_assignment_uses_abi_version_and_verifies_bundle_digest/
|
|
);
|
|
expect(
|
|
nodeLib,
|
|
"node-facing runtime test rejects a digest mismatch before Wasm parsing",
|
|
/wasmtime_runtime_rejects_bundle_digest_mismatch_before_compilation[\s\S]*WasmTaskError::BundleDigestMismatch[\s\S]*failed to parse/
|
|
);
|
|
expect(
|
|
`${coreExecution}\n${coordinatorProtocol}\n${coordinatorProcesses}\n${coordinatorServiceTests}`,
|
|
"product-mode spawn uses one Wasm TaskSpec and signed parent-scoped child launch",
|
|
/pub enum TaskDispatch[\s\S]*CoordinatorNodeWasm[\s\S]*pub struct TaskSpec[\s\S]*product_mode_uses_remote_dispatch[\s\S]*LaunchChildTask \{[\s\S]*parent_task: String[\s\S]*TaskAssignment \{[\s\S]*task_spec: TaskSpec[\s\S]*handle_launch_child_task[\s\S]*TaskDispatch::CoordinatorNodeWasm[\s\S]*signed_active_wasm_task_can_spawn_and_join_child_in_its_process_only/
|
|
);
|
|
expect(
|
|
`${coreExecution}\n${coordinatorProtocol}\n${coordinatorLogs}\n${coordinatorService}\n${coordinatorServiceTests}`,
|
|
"join_task returns event-derived remote task results",
|
|
/pub struct TaskJoinResult[\s\S]*result: Option<TaskBoundaryValue>[\s\S]*remote_completion_observed[\s\S]*from_remote_completion[\s\S]*JoinTask \{[\s\S]*TaskJoined \{[\s\S]*handle_join_task[\s\S]*event\.result\.clone\(\)[\s\S]*waiting for signed node task_completed event[\s\S]*TaskJoinState::Pending[\s\S]*SmallJson/
|
|
);
|
|
expect(
|
|
`${coordinatorProtocol}\n${coordinatorService}\n${coordinatorProcesses}\n${coordinatorServiceTests}`,
|
|
"launch_task can explicitly wait for a later capable node",
|
|
/LaunchTask \{[\s\S]*wait_for_node: bool[\s\S]*TaskQueued \{[\s\S]*pending_task_launches: VecDeque<processes::PendingTaskLaunch>[\s\S]*Err\(err\) if wait_for_node[\s\S]*pending_task_launches[\s\S]*push_back[\s\S]*CoordinatorResponse::TaskQueued[\s\S]*assign_pending_task_to_node[\s\S]*DefaultScheduler\.place\(std::slice::from_ref\(&descriptor\)[\s\S]*coordinator_side_task_launch_can_wait_for_capable_worker[\s\S]*wait_for_node: true[\s\S]*late worker should receive pending assignment/
|
|
);
|
|
expect(
|
|
schedulerPlacementSmoke,
|
|
"scheduler smoke proves queued placement through process boundary and signed node poll",
|
|
/type: "start_process"[\s\S]*type: "launch_task"[\s\S]*task_definition: "prepare_source"[\s\S]*abi: "task_v1"[\s\S]*required_capabilities: \["SourceFilesystem", "SourceGit"\][\s\S]*wait_for_node: true[\s\S]*task_queued[\s\S]*gitCapabilities[\s\S]*type: "poll_task_assignment"[\s\S]*late capable node should receive queued assignment/
|
|
);
|
|
expect(
|
|
coreAuth,
|
|
"core agent workflow auth uses Ed25519 signatures over scoped request data",
|
|
/pub struct AgentSignedRequest[\s\S]*pub fn sign_agent_workflow_request[\s\S]*SigningKey::from_bytes[\s\S]*pub fn verify_agent_workflow_signature[\s\S]*VerifyingKey::from_bytes[\s\S]*agent_workflow_signature_message/
|
|
);
|
|
expect(
|
|
coreAuth,
|
|
"core node request auth uses Ed25519 signatures over scoped node request data",
|
|
/pub struct NodeSignedRequest[\s\S]*pub fn sign_node_request[\s\S]*SigningKey::from_bytes[\s\S]*pub fn verify_node_request_signature[\s\S]*VerifyingKey::from_bytes[\s\S]*node_request_signature_message/
|
|
);
|
|
expect(
|
|
coordinatorProtocol,
|
|
"coordinator protocol supports a versioned wire request envelope",
|
|
/pub enum CoordinatorWireRequest[\s\S]*Envelope\(CoordinatorRequestEnvelope\)[\s\S]*pub struct CoordinatorRequestEnvelope[\s\S]*protocol_version: u64[\s\S]*request_id: String[\s\S]*operation: String[\s\S]*authentication: Option<Value>[\s\S]*payload: CoordinatorRequest/
|
|
);
|
|
expect(
|
|
coordinatorProtocol,
|
|
"coordinator TCP protocol accepts only versioned wire requests",
|
|
/pub enum CoordinatorWireRequest\s*\{\s*Envelope\(CoordinatorRequestEnvelope\),?\s*\}/
|
|
);
|
|
expect(
|
|
coreWire,
|
|
"shared coordinator wire envelope includes protocol version, request id, operation, auth metadata, and payload",
|
|
/COORDINATOR_PROTOCOL_VERSION: u64 = 1[\s\S]*COORDINATOR_WIRE_REQUEST_TYPE[\s\S]*pub fn coordinator_wire_request[\s\S]*"protocol_version"[\s\S]*"request_id"[\s\S]*"operation"[\s\S]*"authentication"[\s\S]*"payload"/
|
|
);
|
|
expect(
|
|
coordinatorProtocol,
|
|
"coordinator validates wire envelope version and operation before dispatch",
|
|
/if self\.protocol_version != COORDINATOR_PROTOCOL_VERSION[\s\S]*request_id\.trim\(\)\.is_empty\(\)[\s\S]*operation .*does not match payload operation/
|
|
);
|
|
expect(
|
|
coordinatorTcp,
|
|
"coordinator TCP framing decodes versioned wire requests",
|
|
/decode_wire_request[\s\S]*serde_json::from_str::<super::CoordinatorWireRequest>[\s\S]*into_request\(\)/
|
|
);
|
|
expect(
|
|
coordinatorTcp,
|
|
"standalone Core coordinator TCP authority is strict by default",
|
|
/pub enum ClientAuthorityMode[\s\S]*Strict[\s\S]*LocalTrustedLoopback[\s\S]*pub fn serve_tcp[\s\S]*ClientAuthorityMode::Strict/
|
|
);
|
|
expect(
|
|
coordinatorTcp,
|
|
"local trusted request authority is explicitly restricted to loopback development",
|
|
/serve_tcp_local_trusted[\s\S]*local_addr\(\)\?[\s\S]*ip\(\)\.is_loopback\(\)[\s\S]*local trusted request mode is restricted to a loopback listener/
|
|
);
|
|
expect(
|
|
coordinatorTcp,
|
|
"strict Core Client authority rejects request-body identity",
|
|
/authorize_client_request[\s\S]*CoordinatorRequest::Authenticated[\s\S]*CoordinatorRequest::SignedNode[\s\S]*request-body identity fields are not authority/
|
|
);
|
|
expect(
|
|
`${coordinatorMain}\n${cliRun}\n${cliRunLocalServices}`,
|
|
"local trusted loopback authority requires an explicit development opt-in",
|
|
/--allow-local-trusted-loopback[\s\S]*serve_tcp_local_trusted[\s\S]*--allow-local-trusted-loopback/
|
|
);
|
|
expect(
|
|
dapRuntimeClient,
|
|
"DAP local-services coordinator explicitly opts into loopback development authority",
|
|
/run_local_services_runtime[\s\S]*"--listen"[\s\S]*"127\.0\.0\.1:0"[\s\S]*"--allow-local-trusted-loopback"/
|
|
);
|
|
expect(
|
|
`${cliClient}\n${nodeDaemon}\n${dapRuntimeClient}`,
|
|
"CLI, node, and DAP transports send versioned coordinator wire requests",
|
|
/JsonLineSession[\s\S]*coordinator_wire_request[\s\S]*CoordinatorSession[\s\S]*coordinator_wire_request[\s\S]*fn coordinator_request[\s\S]*coordinator_wire_request/
|
|
);
|
|
expect(
|
|
`${coordinatorServiceTests}\n${cliTests}`,
|
|
"focused tests prove versioned coordinator wire envelope behavior",
|
|
/service_stream_rejects_invalid_versioned_envelope_metadata[\s\S]*operation attach_node does not match payload operation ping[\s\S]*doctor_pings_configured_coordinator[\s\S]*"coordinator_request"[\s\S]*"protocol_version"/
|
|
);
|
|
expect(
|
|
coordinatorServiceTests,
|
|
"strict TCP test proves body-authority denial and CLI-session success",
|
|
/strict_service_stream_rejects_body_authority_and_accepts_cli_session[\s\S]*victim-tenant[\s\S]*request-body identity fields are not authority[\s\S]*strict-stream-session[\s\S]*vp-authenticated/
|
|
);
|
|
expect(
|
|
`${coordinatorProtocol}\n${coordinatorService}\n${coordinatorAuthenticated}`,
|
|
"authenticated scheduling derives scope from the CLI session",
|
|
/AuthenticatedCoordinatorRequest[\s\S]*ScheduleTask[\s\S]*AuthenticatedCoordinatorRequest::ScheduleTask[\s\S]*context\.tenant[\s\S]*context\.project/
|
|
);
|
|
expect(
|
|
`${coreArtifact}\n${coordinatorNodes}\n${artifactDownloadSmoke}`,
|
|
"signed node retention inventory removes garbage-collected artifact availability",
|
|
/reconcile_node_retention[\s\S]*retaining_nodes\.remove\(node\)[\s\S]*reconcile_node_retention\(&node, &artifact_locations\)[\s\S]*artifact_locations: \[\][\s\S]*const collectedLink[\s\S]*unavailable from current retention/
|
|
);
|
|
expect(
|
|
nodeTaskArtifacts,
|
|
"node artifact store reads retained chunks only after digest and size verification",
|
|
/NodeArtifactStore[\s\S]*read_verified_chunk[\s\S]*expected_digest[\s\S]*expected_size_bytes/
|
|
);
|
|
expect(
|
|
`${coordinatorProtocol}\n${coordinatorArtifacts}`,
|
|
"coordinator reverse-transfer protocol polls and verifies uploaded artifact chunks",
|
|
/PollArtifactTransfer[\s\S]*UploadArtifactTransferChunk[\s\S]*artifact reverse transfer chunk digest mismatch/
|
|
);
|
|
expect(
|
|
artifactDownloadSmoke,
|
|
"explicit artifact download waits for the retaining-node reverse stream",
|
|
/downloadRetainedBytes[\s\S]*retaining_node_reverse_stream_pending[\s\S]*retaining_node_reverse_stream/
|
|
);
|
|
expect(
|
|
artifactDownloadSmoke,
|
|
"downloaded retained bytes are checked against coordinator artifact size and digest",
|
|
/downloadRetainedBytes\([\s\S]*packageEvent\.artifact_size_bytes[\s\S]*createHash\("sha256"\)[\s\S]*downloaded\.content[\s\S]*downloadedDigest, packageEvent\.artifact_digest/
|
|
);
|
|
expect(
|
|
`${realFlagshipHarness}\n${artifactDownloadSmoke}\n${artifactExportSmoke}`,
|
|
"one real CLI flagship path runs Wasm children in rootless Podman and transfers retained bytes",
|
|
/ensureRootlessPodman[\s\S]*runFlagshipWorker[\s\S]*create_node_enrollment_grant[\s\S]*--enrollment-grant[\s\S]*"run", "build"[\s\S]*disasmer\+tcp:\/\/[\s\S]*worker_placement_requested[\s\S]*compile_linux[\s\S]*package_release[\s\S]*downloadRetainedBytes[\s\S]*launchFlagship[\s\S]*artifact_size_bytes/
|
|
);
|
|
expect(
|
|
coordinatorProtocol,
|
|
"node heartbeat carries signed enrolled-key proof",
|
|
/NodeHeartbeat \{[\s\S]*node: String[\s\S]*node_signature: Option<NodeSignedRequest>/
|
|
);
|
|
expect(
|
|
coordinatorProtocol,
|
|
"node-originated public requests can be wrapped in signed node envelope",
|
|
/SignedNode \{[\s\S]*node: String[\s\S]*node_signature: NodeSignedRequest[\s\S]*request: Box<CoordinatorRequest>/
|
|
);
|
|
expect(
|
|
coordinatorNodes,
|
|
"coordinator verifies signed node heartbeat freshness and rejects replay",
|
|
/handle_node_heartbeat[\s\S]*authenticate_node_request[\s\S]*requires a signed proof of enrolled private-key possession[\s\S]*issued_at_epoch_seconds[\s\S]*abs_diff\(now_epoch_seconds\)[\s\S]*node_replay_nonces\.contains_key[\s\S]*verify_node_request_signature/
|
|
);
|
|
expect(
|
|
coordinatorSignedNodeSurface,
|
|
"coordinator requires signed node envelope for node-originated requests",
|
|
/CoordinatorRequest::SignedNode[\s\S]*handle_signed_node_request[\s\S]*signed_node_request_kind[\s\S]*signed_node_request_node[\s\S]*reject_unsigned_node_request[\s\S]*node-originated request requires signed_node envelope proof/
|
|
);
|
|
expect(
|
|
cliNode,
|
|
"CLI node attach derives and uses a node private key",
|
|
/let node_private_key = node_private_key_for_attach[\s\S]*node_ed25519_public_key_from_private_key[\s\S]*sign_node_request[\s\S]*signed_node_request_json[\s\S]*fn node_private_key_for_attach[\s\S]*DISASMER_NODE_PRIVATE_KEY/
|
|
);
|
|
expect(
|
|
cliNode,
|
|
"CLI node attach persists fallback node credentials under project .disasmer",
|
|
/StoredNodeCredential[\s\S]*load_or_create_local_node_credential[\s\S]*"disasmer_node_credential"[\s\S]*local_node_credential_file[\s\S]*"\.disasmer"[\s\S]*"nodes"/
|
|
);
|
|
expect(
|
|
cliNode,
|
|
"CLI node attach wraps node-originated requests in signed_node envelope",
|
|
/fn signed_node_request_json[\s\S]*sign_node_request[\s\S]*"type": "signed_node"[\s\S]*"node_signature": node_signature[\s\S]*"request": request/
|
|
);
|
|
expect(
|
|
`${nodeDaemon}\n${nodeIdentity}`,
|
|
"node daemon derives and uses a node private key",
|
|
/let node_private_key = node_private_key_for_runtime[\s\S]*sign_node_request[\s\S]*signed_node_request_json[\s\S]*node_ed25519_public_key_from_private_key[\s\S]*fn node_private_key_for_runtime[\s\S]*DISASMER_NODE_PRIVATE_KEY/
|
|
);
|
|
expect(
|
|
nodeIdentity,
|
|
"node daemon persists fallback node credentials under project .disasmer",
|
|
/StoredNodeCredential[\s\S]*load_or_create_local_node_credential[\s\S]*"disasmer_node_credential"[\s\S]*local_node_credential_file[\s\S]*"\.disasmer"[\s\S]*"nodes"/
|
|
);
|
|
expect(
|
|
`${nodeDaemon}\n${nodeIdentity}`,
|
|
"node daemon wraps node-originated requests in signed_node envelope",
|
|
/fn signed_node_request_json[\s\S]*sign_node_request[\s\S]*"type": "signed_node"[\s\S]*"node_signature": node_signature[\s\S]*"request": request/
|
|
);
|
|
expect(
|
|
`${nodeIdentity}\n${nodeCoordinatorSession}\n${sharedWasmtimeRuntime}\n${nodeAssignmentRunner}\n${nodeTaskArtifacts}\n${nodeTaskReports}\n${nodeDebugAgent}`,
|
|
"node responsibilities are split into identity, coordinator session, versioned Wasm host capabilities, artifact/VFS, logs, and debug modules",
|
|
/struct StoredNodeCredential[\s\S]*struct CoordinatorSession[\s\S]*struct WasmtimeTaskRuntime[\s\S]*command_run_v1[\s\S]*run_verified_wasmtime_assignment[\s\S]*struct TaskArtifactStore[\s\S]*record_completed_task[\s\S]*poll_task_cancellation/
|
|
);
|
|
expect(
|
|
coordinatorAgents,
|
|
"coordinator agent authorization requires signed request freshness and registered public key verification",
|
|
/authorize_agent_project_run[\s\S]*AgentSignedRequest[\s\S]*issued_at_epoch_seconds[\s\S]*abs_diff\(now_epoch_seconds\)[\s\S]*verify_agent_workflow_signature/
|
|
);
|
|
expect(
|
|
coordinatorProtocol,
|
|
"agent workflow requests carry signed request proof",
|
|
/LaunchTask \{[\s\S]*agent_public_key_fingerprint: Option<Digest>[\s\S]*agent_signature: Option<AgentSignedRequest>[\s\S]*StartProcess \{[\s\S]*agent_public_key_fingerprint: Option<Digest>[\s\S]*agent_signature: Option<AgentSignedRequest>/
|
|
);
|
|
expect(
|
|
coordinatorProcesses,
|
|
"coordinator rejects fingerprint-only agent workflow dispatch and tracks nonce replay",
|
|
/requires a signed request proving private-key possession[\s\S]*agent_replay_nonces\.contains[\s\S]*agent signed request nonce has already been used[\s\S]*authorize_agent_project_run/
|
|
);
|
|
expect(
|
|
cliRun,
|
|
"CLI signs agent workflow requests when private key identity is used",
|
|
/DISASMER_AGENT_PRIVATE_KEY[\s\S]*"agent_signature"[\s\S]*fn agent_signature_for_request[\s\S]*sign_agent_workflow_request/
|
|
);
|
|
expect(
|
|
coordinatorDurable,
|
|
"durable state records scoped CLI session credentials",
|
|
/pub struct CliSessionRecord[\s\S]*pub session_digest: Digest[\s\S]*pub tenant: TenantId[\s\S]*pub project: ProjectId[\s\S]*pub user: UserId[\s\S]*pub revoked: bool[\s\S]*pub cli_sessions: BTreeMap<Digest, CliSessionRecord>/
|
|
);
|
|
expect(
|
|
coordinatorSessions,
|
|
"coordinator issues and authenticates CLI sessions by digest",
|
|
/pub fn issue_cli_session[\s\S]*Digest::sha256\(session_secret\)[\s\S]*pub fn authenticate_cli_session[\s\S]*cli_sessions[\s\S]*AuthContext/
|
|
);
|
|
expect(
|
|
coordinatorSessions,
|
|
"coordinator rejects expired and revoked CLI sessions",
|
|
/expires_at_epoch_seconds[\s\S]*expires_at <= now_epoch_seconds[\s\S]*CLI session credential has expired[\s\S]*pub fn revoke_cli_session[\s\S]*record\.revoked = true/
|
|
);
|
|
expect(
|
|
coordinatorProtocol,
|
|
"coordinator has authenticated request envelope without trusted actor fields",
|
|
/Authenticated \{[\s\S]*session_secret: String[\s\S]*request: AuthenticatedCoordinatorRequest[\s\S]*pub enum AuthenticatedCoordinatorRequest[\s\S]*AuthStatus[\s\S]*ListProjects/
|
|
);
|
|
expect(
|
|
coordinatorProtocol,
|
|
"authenticated request protocol covers node enrollment, descriptor listing, and revocation",
|
|
/AuthenticatedCoordinatorRequest[\s\S]*CreateNodeEnrollmentGrant \{[\s\S]*ListNodeDescriptors[\s\S]*RevokeNodeCredential \{[\s\S]*node: String/
|
|
);
|
|
expect(
|
|
coordinatorProtocol,
|
|
"authenticated request protocol covers user process, task, debug, and artifact operations",
|
|
/AuthenticatedCoordinatorRequest[\s\S]*StartProcess \{[\s\S]*CancelProcess \{[\s\S]*RestartTask \{[\s\S]*DebugAttach \{[\s\S]*ListTaskEvents \{[\s\S]*CreateArtifactDownloadLink \{[\s\S]*OpenArtifactDownloadStream \{[\s\S]*RevokeArtifactDownloadLink \{[\s\S]*ExportArtifactToNode \{/
|
|
);
|
|
expect(
|
|
coordinatorProtocol,
|
|
"authenticated request protocol can revoke the current CLI session",
|
|
/AuthenticatedCoordinatorRequest[\s\S]*RevokeCliSession[\s\S]*CliSessionRevoked/
|
|
);
|
|
expect(
|
|
coordinatorProtocol,
|
|
"admin protocol requests carry nonce-bound proof fields instead of bearer tokens",
|
|
/AdminStatus \{[\s\S]*actor_user: String[\s\S]*admin_proof: Digest[\s\S]*admin_nonce: String[\s\S]*issued_at_epoch_seconds: u64[\s\S]*SuspendTenant \{[\s\S]*target_tenant: String[\s\S]*admin_proof: Digest/
|
|
);
|
|
expect(
|
|
coordinatorService,
|
|
"coordinator derives authenticated public request context from session secret",
|
|
/CoordinatorRequest::Authenticated[\s\S]*handle_authenticated_request[\s\S]*authenticate_cli_session\(&session_secret\)[\s\S]*AuthenticatedCoordinatorRequest::AuthStatus/
|
|
);
|
|
expect(
|
|
coordinatorAuthorization,
|
|
"coordinator has centralized authorization helper for authenticated public user requests",
|
|
/pub\(super\) enum PublicUserOperation[\s\S]*AuthStatus[\s\S]*StartProcess[\s\S]*DebugAttach[\s\S]*ExportArtifactToNode[\s\S]*pub\(super\) fn authorize_authenticated_user_operation[\s\S]*authenticated .* request requires a user CLI session/
|
|
);
|
|
expect(
|
|
coordinatorService,
|
|
"authenticated public dispatcher calls centralized authorization before handling",
|
|
/let context = self\.coordinator\.authenticate_cli_session\(&session_secret\)\?;[\s\S]*authorize_authenticated_user_operation\(&context, &request\)\?;[\s\S]*match request/
|
|
);
|
|
expect(
|
|
coordinatorAuthorization,
|
|
"coordinator tests prove centralized authenticated public authorization rejection",
|
|
/authenticated_public_authorization_requires_user_context_and_names_operation[\s\S]*authenticated debug_attach request requires a user CLI session/
|
|
);
|
|
expect(
|
|
`${coordinatorService}\n${coordinatorAuthenticated}\n${coordinatorDebug}`,
|
|
"coordinator routes user process/task/debug/artifact authenticated requests through session-derived context",
|
|
/AuthenticatedCoordinatorRequest::StartProcess[\s\S]*handle_start_process\([\s\S]*context\.tenant[\s\S]*Some\(actor\.as_str\(\)\.to_owned\(\)\)[\s\S]*AuthenticatedCoordinatorRequest::CancelProcess[\s\S]*handle_cancel_process[\s\S]*AuthenticatedCoordinatorRequest::RestartTask[\s\S]*handle_restart_task[\s\S]*AuthenticatedCoordinatorRequest::DebugAttach[\s\S]*handle_authenticated_debug_request[\s\S]*AuthenticatedCoordinatorRequest::ListTaskEvents[\s\S]*handle_list_task_events[\s\S]*AuthenticatedCoordinatorRequest::CreateArtifactDownloadLink[\s\S]*handle_create_artifact_download_link[\s\S]*AuthenticatedCoordinatorRequest::ExportArtifactToNode[\s\S]*handle_export_artifact_to_node[\s\S]*handle_debug_attach/
|
|
);
|
|
expect(
|
|
`${coreAuth}\n${coordinatorService}\n${coordinatorAdmin}\n${coordinatorServiceTests}`,
|
|
"coordinator verifies scoped self-hosted admin proof freshness and replay resistance",
|
|
/admin_request_proof_from_token_digest[\s\S]*new_with_admin_token[\s\S]*admin_token_digest[\s\S]*verify_admin_request[\s\S]*ADMIN_REQUEST_MAX_CLOCK_SKEW_SECONDS[\s\S]*admin request proof is invalid[\s\S]*admin_replay_nonces\.contains_key[\s\S]*nonce was already used[\s\S]*MAX_REPLAY_NONCES_PER_AUTHORITY[\s\S]*admin_replay_nonces[\s\S]*\.insert[\s\S]*replayed_admin_status/
|
|
);
|
|
expect(
|
|
`${coordinatorService}\n${coordinatorQuota}`,
|
|
"coordinator keeps quota state and pre-work charging behind a focused quota module",
|
|
/mod quota;[\s\S]*quota: quota::CoordinatorQuota[\s\S]*pub\(super\) struct CoordinatorQuota[\s\S]*can_charge_workflow_spawn[\s\S]*charge_workflow_spawn[\s\S]*charge_rendezvous_attempt[\s\S]*can_charge_download[\s\S]*charge_debug_read/
|
|
);
|
|
expect(
|
|
coordinatorService,
|
|
"coordinator revokes authenticated CLI sessions through session-derived context",
|
|
/AuthenticatedCoordinatorRequest::RevokeCliSession[\s\S]*revoke_cli_session\(&session_secret\)[\s\S]*CoordinatorResponse::CliSessionRevoked/
|
|
);
|
|
expect(
|
|
cliConfig,
|
|
"stored CLI session can carry scoped coordinator credential without provider token fields",
|
|
/pub\(crate\) session_secret: Option<String>/
|
|
);
|
|
expect(
|
|
cliAuth,
|
|
"auth status uses authenticated envelope when a CLI session secret exists",
|
|
/let request = match authenticated_or_local_trusted_request\([\s\S]*coordinator,[\s\S]*stored_session,[\s\S]*"type": "auth_status"/
|
|
);
|
|
expect(
|
|
cliClient,
|
|
"stored Client credentials are bound to their issuing coordinator endpoint",
|
|
/stored_session_for_coordinator[\s\S]*control_endpoint_identity\(&session\.coordinator\)[\s\S]*control_endpoint_identity\(coordinator\)/
|
|
);
|
|
expect(
|
|
cliLogout,
|
|
"logout revokes stored CLI sessions through authenticated envelope before local removal",
|
|
/revoke_stored_cli_session_if_possible[\s\S]*"type": "authenticated"[\s\S]*"type": "revoke_cli_session"[\s\S]*"cli_session_revoked"/
|
|
);
|
|
expect(
|
|
cliAdmin,
|
|
"admin CLI derives nonce-bound proofs and does not send its bearer token",
|
|
/admin_request_proof[\s\S]*command_nonce\("admin-status"\)[\s\S]*"admin_proof": admin_proof[\s\S]*"admin_nonce": admin_nonce[\s\S]*"issued_at_epoch_seconds": issued_at_epoch_seconds[\s\S]*fn admin_token_for_request[\s\S]*DISASMER_ADMIN_TOKEN[\s\S]*--admin-token/
|
|
);
|
|
expect(
|
|
cliTests,
|
|
"CLI test proves auth status envelope omits trusted actor body field",
|
|
/assert!\(line\.contains\(r#""type":"authenticated""#\)\)[\s\S]*assert!\(line\.contains\(r#""session_secret":"disasmer-cli-session-secret""#\)\)[\s\S]*assert!\(!line\.contains\(r#""actor_user":"user-session""#\)\)/
|
|
);
|
|
expect(
|
|
cliProject,
|
|
"project commands use authenticated envelope for signed-in CLI sessions",
|
|
/authenticated_or_local_trusted_request[\s\S]*"type": "create_project"[\s\S]*authenticated_or_local_trusted_request[\s\S]*"type": "list_projects"[\s\S]*authenticated_or_local_trusted_request[\s\S]*"type": "select_project"/
|
|
);
|
|
expect(
|
|
cliNode,
|
|
"node commands use authenticated envelope for signed-in CLI sessions",
|
|
/node_enroll_report[\s\S]*authenticated_or_local_trusted_request[\s\S]*"type": "create_node_enrollment_grant"[\s\S]*node_descriptors_report[\s\S]*authenticated_or_local_trusted_request[\s\S]*"type": "list_node_descriptors"[\s\S]*node_revoke_report[\s\S]*authenticated_or_local_trusted_request[\s\S]*"type": "revoke_node_credential"/
|
|
);
|
|
expect(
|
|
cliProject,
|
|
"project command reports use stored CLI session scope when a session secret exists",
|
|
/fn session_or_effective_scope_value[\s\S]*session\.session_secret\.is_some\(\)[\s\S]*session_value\(session\)/
|
|
);
|
|
expect(
|
|
cliTests,
|
|
"CLI test proves project list envelope omits trusted actor body field",
|
|
/project_list_uses_authenticated_envelope_with_stored_cli_session[\s\S]*assert!\(line\.contains\(r#""type":"authenticated""#\)\)[\s\S]*assert!\(line\.contains\(r#""session_secret":"project-list-session-secret""#\)\)[\s\S]*assert!\(!line\.contains\(r#""actor_user":"user-session""#\)\)/
|
|
);
|
|
expect(
|
|
cliTests,
|
|
"CLI test proves node command envelopes omit trusted actor body fields",
|
|
/node_commands_use_authenticated_envelope_with_stored_cli_session[\s\S]*"create_node_enrollment_grant"[\s\S]*"list_node_descriptors"[\s\S]*"revoke_node_credential"[\s\S]*assert!\(!line\.contains\(r#""actor_user":"ignored-user""#\)\)[\s\S]*assert!\(!line\.contains\(r#""tenant":"ignored-tenant""#\)\)[\s\S]*assert!\(!line\.contains\(r#""project":"ignored-project""#\)\)/
|
|
);
|
|
expect(
|
|
`${cliTests}\n${coordinatorServiceTests}`,
|
|
"CLI and coordinator tests prove user control/artifact/debug requests use session-derived authenticated scope",
|
|
/user_control_commands_use_authenticated_envelope_with_stored_cli_session[\s\S]*"list_task_events"[\s\S]*"start_process"[\s\S]*"cancel_process"[\s\S]*"restart_task"[\s\S]*"create_artifact_download_link"[\s\S]*"debug_attach"[\s\S]*assert!\(!line\.contains\("ignored-tenant"\)\)[\s\S]*authenticated_envelope_derives_user_scope_from_cli_session[\s\S]*AuthenticatedCoordinatorRequest::StartProcess[\s\S]*AuthenticatedCoordinatorRequest::ListTaskEvents[\s\S]*AuthenticatedCoordinatorRequest::CreateArtifactDownloadLink[\s\S]*AuthenticatedCoordinatorRequest::CancelProcess[\s\S]*AuthenticatedCoordinatorRequest::DebugAttach/
|
|
);
|
|
expect(
|
|
cliTests,
|
|
"CLI tests prove admin coordinator requests require a token but send only a scoped proof",
|
|
/admin_status_and_suspend_use_public_coordinator_api[\s\S]*!line\.contains\(r#""admin_token""#[\s\S]*admin_request_proof[\s\S]*admin_commands_require_explicit_admin_token_for_coordinator_requests[\s\S]*--admin-token/
|
|
);
|
|
expect(
|
|
cliTests,
|
|
"CLI tests prove expired/revoked sessions ask for login and logout revokes server session",
|
|
/auth_status_reports_expired_or_revoked_cli_session_as_login_required[\s\S]*machine_error"\]\["category"\][\s\S]*"authentication"[\s\S]*logout_revokes_stored_cli_session_on_coordinator_before_local_removal[\s\S]*"revoke_cli_session"/
|
|
);
|
|
expect(
|
|
cliTests,
|
|
"CLI test proves signed agent workflow requests are sent",
|
|
/run_with_agent_public_key_sends_attributable_workflow_actor[\s\S]*"agent_signature"[\s\S]*"signature":"ed25519:/
|
|
);
|
|
expect(
|
|
coordinatorServiceTests,
|
|
"coordinator test proves signed agent workflow and fingerprint-only rejection",
|
|
/service_runs_agent_workflows_with_scoped_key_attribution[\s\S]*fingerprint_only[\s\S]*signed request[\s\S]*wrong_fingerprint[\s\S]*nonce/
|
|
);
|
|
expect(
|
|
coordinatorServiceTests,
|
|
"coordinator test proves authenticated node operations derive scope from CLI session",
|
|
/authenticated_envelope_derives_user_scope_from_cli_session[\s\S]*AuthenticatedCoordinatorRequest::ListNodeDescriptors[\s\S]*AuthenticatedCoordinatorRequest::RevokeNodeCredential[\s\S]*tenant-a[\s\S]*project-a[\s\S]*user-a/
|
|
);
|
|
expect(
|
|
coordinatorServiceTests,
|
|
"coordinator test proves admin operations fail closed without configured or valid proof",
|
|
/service_reports_and_enforces_public_admin_tenant_suspension[\s\S]*new_with_admin_token[\s\S]*admin credential is not configured[\s\S]*admin request proof is invalid/
|
|
);
|
|
if (hostedService && hostedStartup && hostedOperatorAuth) {
|
|
expect(
|
|
`${hostedService}\n${hostedStartup}\n${hostedOperatorAuth}`,
|
|
"hosted client path rejects operator operations while private Operator requests require replay-resistant proofs",
|
|
/HOSTED_OPERATOR_TOKEN_ENV[\s\S]*HostedOperatorAuth[\s\S]*hosted operator operation requires an authenticated hosted_operator_request envelope[\s\S]*CoordinatorService::new_with_admin_token[\s\S]*replay_nonces[\s\S]*verify_request[\s\S]*hosted_operator_request_proof_from_token_digest/
|
|
);
|
|
}
|
|
expect(
|
|
coordinatorServiceTests,
|
|
"coordinator test proves node heartbeat requires signed enrolled key and rejects replay",
|
|
/service_requires_signed_node_heartbeat_from_enrolled_key[\s\S]*signed proof[\s\S]*wrong_signature[\s\S]*fresh-node-heartbeat[\s\S]*nonce/
|
|
);
|
|
expect(
|
|
coordinatorServiceTests,
|
|
"coordinator test proves raw node-originated requests require signed envelope",
|
|
/service_rejects_raw_node_originated_requests_without_signed_envelope[\s\S]*ReportNodeCapabilities[\s\S]*signed_node envelope proof/
|
|
);
|
|
expect(
|
|
nodeAttachSmoke,
|
|
"node attach smoke signs direct public coordinator heartbeat",
|
|
/DISASMER_NODE_PRIVATE_KEY[\s\S]*node_signature: signedNodeHeartbeat/
|
|
);
|
|
expect(
|
|
selfHostedCoordinatorSmokeSource,
|
|
"self-hosted coordinator smoke signs public node heartbeat",
|
|
/public_key: identity\.publicKey[\s\S]*node_signature: signedNodeHeartbeat/
|
|
);
|
|
expect(
|
|
selfHostedCoordinatorSmokeSource,
|
|
"self-hosted coordinator smoke proves strict authenticated Client authority",
|
|
/DISASMER_SELF_HOSTED_SESSION_SECRET[\s\S]*client_authority, "strict"[\s\S]*forgedBodyAuthority[\s\S]*wrongSession[\s\S]*connect-self-hosted[\s\S]*session-secret-stdin[\s\S]*used_cli_session_credential[\s\S]*authenticated\(\{[\s\S]*type: "schedule_task"/
|
|
);
|
|
expect(
|
|
wasmtimeAssignmentSmoke,
|
|
"real SDK and Wasmtime smoke runs through strict authenticated Client authority",
|
|
/DISASMER_SELF_HOSTED_SESSION_SECRET[\s\S]*client_authority, "strict"[\s\S]*DISASMER_SDK_SESSION_SECRET[\s\S]*authenticated\(\{[\s\S]*type: "launch_task"[\s\S]*type: "join_task"/
|
|
);
|
|
if (publicDryrunServiceSmoke) {
|
|
expect(
|
|
publicDryrunServiceSmoke,
|
|
"public release dryrun public coordinator heartbeat is signed",
|
|
/identity = nodeIdentity\("public-release-service-smoke", node\)[\s\S]*public_key: identity\.publicKey[\s\S]*node_signature: signedNodeHeartbeat/
|
|
);
|
|
}
|
|
if (hostedPolicy) {
|
|
expect(
|
|
hostedPolicy,
|
|
"hosted identity broker mints a non-provider CLI session secret and records only its digest in the login summary",
|
|
/generate_opaque_token\("cli_session"\)[\s\S]*cli_session_secret_digest: Digest::sha256\(&cli_session_secret\)[\s\S]*cli_session_secret/
|
|
);
|
|
}
|
|
if (hostedService) {
|
|
expect(
|
|
hostedService,
|
|
"hosted service delegates CLI session authority and project creation to the public coordinator",
|
|
/identity_broker\.complete_trusted_oidc_browser_login[\s\S]*core_coordinator[\s\S]*issue_cli_session[\s\S]*CoordinatorRequest::Authenticated[\s\S]*CreateProject/
|
|
);
|
|
}
|
|
|
|
for (const [gateName, script] of [
|
|
["public acceptance", publicAcceptance],
|
|
["private acceptance", privateAcceptance],
|
|
["CLI-first acceptance", cliFirstAcceptance],
|
|
["public split", publicSplit],
|
|
]) {
|
|
assert(
|
|
script.includes("node scripts/code-size-guard.js"),
|
|
`${gateName} must run code-size-guard.js`
|
|
);
|
|
}
|
|
|
|
expect(publicAcceptance, "public gate includes unit coverage", /cargo test --workspace/);
|
|
expect(publicAcceptance, "public gate includes binary build coverage", /cargo build --workspace --bins/);
|
|
expect(privateAcceptance, "private gate includes hosted unit coverage", /cargo test --manifest-path private\/hosted-policy\/Cargo\.toml/);
|
|
expect(publicSplit, "public split includes copied-tree unit coverage", /cargo test --workspace --manifest-path "\$tmp_dir\/Cargo\.toml"/);
|
|
expect(publicSplit, "public split includes copied-tree binary build coverage", /cargo build --workspace --bins --manifest-path "\$tmp_dir\/Cargo\.toml"/);
|
|
|
|
for (const [gateName, script] of [
|
|
["public acceptance", publicAcceptance],
|
|
["public split", publicSplit],
|
|
]) {
|
|
for (const smoke of [
|
|
"scripts/wasmtime-assignment-smoke.js",
|
|
"scripts/node-attach-smoke.js",
|
|
"scripts/cli-local-run-smoke.js",
|
|
"scripts/vscode-f5-smoke.js",
|
|
"scripts/dap-smoke.js",
|
|
"scripts/artifact-download-smoke.js",
|
|
"scripts/artifact-export-smoke.js",
|
|
"scripts/public-local-demo-matrix-smoke.js",
|
|
]) {
|
|
assert(script.includes(`node ${smoke}`), `${gateName} must run boundary smoke ${smoke}`);
|
|
}
|
|
}
|
|
|
|
for (const smoke of [
|
|
"private/hosted-policy/scripts/hosted-deployment-smoke.js",
|
|
"private/hosted-policy/scripts/hosted-client-compat-smoke.js",
|
|
"private/hosted-policy/scripts/postgres-durable-smoke.js",
|
|
]) {
|
|
assert(
|
|
privateAcceptance.includes(`node ${smoke}`),
|
|
`private acceptance must run hosted boundary smoke ${smoke}`
|
|
);
|
|
}
|
|
assert(
|
|
privateAcceptance.includes("node scripts/self-hosted-coordinator-smoke.js"),
|
|
"private acceptance must run standalone Core coordinator smoke"
|
|
);
|
|
|
|
for (const [name, source, patterns] of [
|
|
[
|
|
"real coordinator Wasm assignment",
|
|
wasmtimeAssignmentSmoke,
|
|
[/cp\.spawn/, /disasmer-coordinator/, /type: "create_node_enrollment_grant"/, /disasmer-node/],
|
|
],
|
|
[
|
|
"node attach",
|
|
nodeAttachSmoke,
|
|
[/cp\.spawn/, /"node"[\s\S]*"attach"/, /used_enrollment_exchange/, /signedNodeHeartbeat/],
|
|
],
|
|
[
|
|
"CLI local run",
|
|
cliLocalRunSmoke,
|
|
[/cp\.spawn/, /disasmer[\s\S]*run/, /cli_process_started_node_process[\s\S]*true/],
|
|
],
|
|
[
|
|
"VS Code F5",
|
|
vscodeF5Smoke,
|
|
[
|
|
/runtimeBackend[\s\S]*local-services/,
|
|
/buildMainLine[\s\S]*setBreakpoints[\s\S]*verified, true/,
|
|
/allThreadsStopped, true/,
|
|
/coordinator_task_events[\s\S]*value === 0/,
|
|
/Source Locals/,
|
|
/Task Args and Handles/,
|
|
/unavailable-local-diagnostic/,
|
|
/command_status[\s\S]*frozen through local services at executing Wasm probe/,
|
|
/state[\s\S]*Frozen/,
|
|
/command_spec/,
|
|
/stdout_tail/,
|
|
/stderr_tail/,
|
|
],
|
|
],
|
|
[
|
|
"DAP",
|
|
dapSmoke,
|
|
[
|
|
/runtimeBackend: "local-services"/,
|
|
/buildMainLine[\s\S]*setBreakpoints[\s\S]*verified, true/,
|
|
/allThreadsStopped, true[\s\S]*confirmed by every active participant/,
|
|
/threads[\s\S]*build virtual process/,
|
|
/build_main::wasm/,
|
|
/Source Locals/,
|
|
/Wasm Frame Locals/,
|
|
/unavailable-local-diagnostic/,
|
|
/runtime-boundary-diagnostic/,
|
|
/command_status[\s\S]*frozen through local services at executing Wasm probe/,
|
|
/taskTrapLine[\s\S]*childThread[\s\S]*arg_0[\s\S]*task_handle_/,
|
|
/source stepping is not yet available/,
|
|
/checkpoint boundary|still active/,
|
|
],
|
|
],
|
|
[
|
|
"artifact download",
|
|
artifactDownloadSmoke,
|
|
[/create_artifact_download_link/, /open_artifact_download_stream/, /crossTenantOpen/],
|
|
],
|
|
[
|
|
"artifact export",
|
|
artifactExportSmoke,
|
|
[/export_artifact_to_node/, /node-export-receiver/, /coordinator_bulk_relay_allowed[\s\S]*false/],
|
|
],
|
|
[
|
|
"standalone Core coordinator",
|
|
selfHostedCoordinatorSmoke,
|
|
[/disasmer-coordinator/, /standalone-core-coordinator/, /core-coordinator-compat\.json/],
|
|
],
|
|
[
|
|
"public local demo matrix",
|
|
publicLocalDemoMatrix,
|
|
[/scripts\/cli-install-smoke\.js/, /scripts\/node-attach-smoke\.js/, /scripts\/vscode-f5-smoke\.js/],
|
|
],
|
|
]) {
|
|
for (const pattern of patterns) {
|
|
expect(source, name, pattern);
|
|
}
|
|
}
|
|
|
|
if (hostedClientCompatSmoke) {
|
|
for (const pattern of [
|
|
/disasmer-hosted-service/,
|
|
/completeHostedBrowserLogin/,
|
|
/DISASMER_BROWSER_OPEN_COMMAND/,
|
|
/"disasmer-cli"[\s\S]*"node"[\s\S]*"attach"/,
|
|
/node_enrollment_exchanged/,
|
|
/DISASMER_HOSTED_CLI_SESSION_TTL_SECONDS/,
|
|
/expired; run disasmer login --browser again/,
|
|
/crossTenantTaskEventsDenied[\s\S]*list_task_events[\s\S]*vp-victim/,
|
|
/hosted-client-compat\.json/,
|
|
]) {
|
|
expect(hostedClientCompatSmoke, "hosted Client compatibility", pattern);
|
|
}
|
|
}
|
|
|
|
for (const pattern of [
|
|
/DISASMER_PUBLIC_RELEASE_DRYRUN_E2E/,
|
|
/downloadReleaseAssets/,
|
|
/verifyChecksums/,
|
|
/git"[\s\S]*"clone"/,
|
|
/defaultLoginPlan\.coordinator/,
|
|
/DISASMER_PUBLIC_RELEASE_DRYRUN_BROWSER_OPEN_COMMAND/,
|
|
/DISASMER_BROWSER_OPEN_COMMAND: browserOpenCommand/,
|
|
/node_enrollment_exchanged/,
|
|
/disasmerNode/,
|
|
/launch_task/,
|
|
/worker_assignment_poll_verified/,
|
|
/validateStandaloneCoreCoordinator/,
|
|
/core_coordinator_validated/,
|
|
/standalone-core-coordinator/,
|
|
/DISASMER_SELF_HOSTED_SESSION_SECRET/,
|
|
/client_authority, "strict"/,
|
|
/forged_body_authority_denied/,
|
|
/wrong_session_denied/,
|
|
/preTaskMainLine/,
|
|
/compileLinuxLine/,
|
|
/task_recorded/,
|
|
/list_task_events/,
|
|
/create_artifact_download_link/,
|
|
/vscode-f5-smoke\.js/,
|
|
/downloaded_release_assets: true/,
|
|
/vscode_debugger_verified: true/,
|
|
/artifact_download_or_export_verified: true/,
|
|
/public-release-dryrun-e2e\.json/,
|
|
]) {
|
|
expect(publicDryrunE2e, "public release e2e evidence", pattern);
|
|
}
|
|
|
|
for (const pattern of [
|
|
/public-release-dryrun-forgejo-release\.json/,
|
|
/deployment-manifest\.json/,
|
|
/public-release-dryrun-service\.json/,
|
|
/hosted-client-compat\.json/,
|
|
/core-coordinator-compat\.json/,
|
|
/public-release-dryrun-e2e\.json/,
|
|
/coordinator_validation/,
|
|
/core_coordinator_client_authority/,
|
|
/core_coordinator_forged_body_authority_denied/,
|
|
/downloaded_release_assets/,
|
|
/vscode_debugger_verified/,
|
|
/artifact_download_or_export_verified/,
|
|
/public-release-dryrun-final\.json/,
|
|
]) {
|
|
expect(finalDryrunEvidence, "public release final evidence", pattern);
|
|
}
|
|
|
|
console.log("Acceptance evidence contract smoke passed");
|