Initial curated chimera source from a8ae5b1db07fb49926c94585e2718e5130330974

test/server/ch-1201-etahen-link-contract.test.js

@@ -0,0 +1,57 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const {
+  createRuntimeIdentity,
+  matchCompatibility,
+  capabilityState,
+  validateJob,
+  reconcileRuntimeLoss,
+  newRuntimeEpoch,
+} = require('../../src/services/etahen-link-contract');
+
+const HASH = 'a'.repeat(64);
+const identity = createRuntimeIdentity({ version: '2.5B', binarySha256: HASH, firmware: '8.20', runtimeEpoch: 'epoch_12345678' });
+
+test('unknown etaHEN build exposes only safe baseline capabilities', () => {
+  const match = matchCompatibility(identity, []);
+  assert.equal(match.level, 'detected-unverified');
+  assert.ok(match.capabilities.includes('console.inventory.read'));
+  assert.ok(!match.capabilities.includes('package.install.etahen-dpi-v1'));
+});
+
+test('verified profile requires exact version, firmware and binary hash', () => {
+  const profile = { id: 'etahen-2.5b-820', etahenVersion: '2.5B', binarySha256: HASH, firmwares: ['8.20'], capabilities: ['console.inventory.read', 'package.install.etahen-dpi-v1'] };
+  assert.equal(matchCompatibility(identity, [profile]).level, 'verified');
+  assert.equal(matchCompatibility({ ...identity, binarySha256: 'b'.repeat(64) }, [profile]).level, 'detected-unverified');
+});
+
+test('availability, authorization and health remain independent', () => {
+  const compatibility = { level: 'verified', capabilities: ['package.install.etahen-dpi-v1'] };
+  assert.deepEqual(capabilityState('package.install.etahen-dpi-v1', { compatibility, authorized: [], healthy: ['package.install.etahen-dpi-v1'] }), {
+    name: 'package.install.etahen-dpi-v1', risk: 'mutating', available: true, authorized: false, healthy: true, compatibility: 'verified',
+  });
+});
+
+test('mutating job needs a healthy capability and fresh runtime-bound confirmation', () => {
+  const capabilities = [capabilityState('package.install.etahen-dpi-v1', {
+    compatibility: { level: 'verified', capabilities: ['package.install.etahen-dpi-v1'] },
+    authorized: ['package.install.etahen-dpi-v1'], healthy: ['package.install.etahen-dpi-v1'],
+  })];
+  assert.throws(() => validateJob({ jobId: 'job_12345678', type: 'package.install', runtimeEpoch: identity.runtimeEpoch, input: {} }, { runtimeEpoch: identity.runtimeEpoch, capabilities }), /authorization/i);
+  assert.equal(validateJob({ jobId: 'job_12345678', type: 'package.install', runtimeEpoch: identity.runtimeEpoch, confirmationEpoch: identity.runtimeEpoch, input: { artifactId: 'artifact_1' } }, { runtimeEpoch: identity.runtimeEpoch, capabilities }).risk, 'mutating');
+});
+
+test('raw command, path, URL and ELF fields are rejected recursively', () => {
+  const capabilities = [capabilityState('console.inventory.read', { compatibility: { level: 'verified', capabilities: ['console.inventory.read'] }, healthy: ['console.inventory.read'] })];
+  for (const input of [{ command: 'raw' }, { nested: { path: '/data' } }, { url: 'http://host' }, { elf: 'payload' }]) {
+    assert.throws(() => validateJob({ jobId: 'job_12345678', type: 'inventory.scan', runtimeEpoch: identity.runtimeEpoch, input }, { runtimeEpoch: identity.runtimeEpoch, capabilities }), /Forbidden/);
+  }
+});
+
+test('runtime loss invalidates confirmation and makes active mutations outcome-unknown', () => {
+  assert.deepEqual(reconcileRuntimeLoss({ id: 'j1', status: 'applying', confirmationEpoch: identity.runtimeEpoch }), { id: 'j1', status: 'outcome_unknown', confirmationEpoch: null });
+  assert.deepEqual(reconcileRuntimeLoss({ id: 'j2', status: 'confirmed', confirmationEpoch: identity.runtimeEpoch }), { id: 'j2', status: 'paused', confirmationEpoch: null });
+  assert.match(newRuntimeEpoch('fixed-seed'), /^[a-f0-9]{32}$/);
+});