Initial curated chimera source from a8ae5b1db07fb49926c94585e2718e5130330974

test/server/ch-1306-ps5-fpkg-hardware-gate.test.js

@@ -0,0 +1,97 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { pathToFileURL } = require('node:url');
+const test = require('node:test');
+
+const scriptPath = path.resolve(__dirname, '../../scripts/autonomous/verify-ps5-fpkg-hardware-evidence.mjs');
+const scriptUrl = pathToFileURL(scriptPath).href;
+const repoRoot = path.resolve(__dirname, '../..');
+
+function productionFiles(entry) {
+  const absolute = path.join(repoRoot, entry);
+  if (!fs.existsSync(absolute)) return [];
+  if (fs.statSync(absolute).isFile()) return [absolute];
+  return fs.readdirSync(absolute, { withFileTypes: true }).flatMap(item => {
+    if (['node_modules', 'test', 'temp'].includes(item.name)) return [];
+    return productionFiles(path.relative(repoRoot, path.join(absolute, item.name)));
+  });
+}
+
+function validBundle() {
+  const capabilities = {
+    debugPackageRuntime: true, fpkgEnableActive: true, kernelPatchReady: true,
+    packageInstallerReady: true, launchServiceReady: true, processObservationReady: true,
+  };
+  return {
+    schema: 'chimera.ps5-fpkg-hardware-acceptance.v1',
+    titleId: 'PPSA17330',
+    source: { treeDigestAlgorithm: 'sha256-tree-v1', treeSha256: 'a'.repeat(64), immutable: true, zeroUnresolvedModules: true, staticLaunchReadiness: true },
+    builder: { product: 'LibProsperoPkg', version: '2.6.0', revision: '9084c0e88cd8d7cd9c0b353b8b6b89f7d1cc4275', bridgeAbi: 'chimera-prospero-bridge-v4', patched: false, bridgeSha256: 'b'.repeat(64) },
+    artifact: { extension: '.pkg', magic: '7f464948', container: 'FIH', debug: true, retail: false, sha256: 'c'.repeat(64), installedSha256: 'c'.repeat(64), structuralValidationAccepted: true },
+    controls: { sourceUnchanged: true, installRouteRecorded: true, runtimeRecorded: true, consoleConfigurationRecorded: true, simultaneousChangesExplained: true },
+    operation: {
+      status: 'launch_verified', titleId: 'PPSA17330', installed: true, launchVerified: true, productionRestorable: true,
+      packageIdentitySha256: 'd'.repeat(64), evidence: { source: 'post-install-console-scan', titleId: 'PPSA17330' },
+      launchEvidence: {
+        titleId: 'PPSA17330', packageIdentitySha256: 'd'.repeat(64), runtimeFingerprint: 'e'.repeat(64),
+        runtime: { capabilities }, request: { accepted: true }, observationCount: 2,
+        firstObservedAt: 1000, lastObservedAt: 12000,
+        process: { pid: 42, name: 'eboot.bin', titleId: 'PPSA17330' },
+        boundaries: { verifyImage: 'passed', pfsMount: 'passed', executable: 'reached', process: 'stable', basis: 'stable-exact-title-process' },
+      },
+    },
+  };
+}
+
+test('hardware evidence gate accepts only a complete launch_verified bundle', async () => {
+  const { validateHardwareEvidence } = await import(scriptUrl);
+  const report = validateHardwareEvidence(validBundle());
+  assert.equal(report.accepted, true);
+  assert.equal(report.checks.every(item => item.pass), true);
+  assert.equal(report.productionRestorable, true);
+});
+
+test('only launch_verified can make productionRestorable true in code and manifests', () => {
+  const files = ['main.js', 'preload.js', 'src', 'renderer']
+    .flatMap(productionFiles)
+    .filter(file => /\.(?:c?js|mjs)$/.test(file));
+  const assignments = files.flatMap(file => {
+    const source = fs.readFileSync(file, 'utf8');
+    return [...source.matchAll(/productionRestorable\s*:\s*true/g)].map(match => ({ file, source, index: match.index }));
+  });
+  assert.equal(assignments.length, 1, assignments.map(item => path.relative(repoRoot, item.file)).join(', '));
+  assert.equal(path.basename(assignments[0].file), 'ps5-native-package-install-service.js');
+  const qualifyingUpdate = assignments[0].source.slice(Math.max(0, assignments[0].index - 120), assignments[0].index + 80);
+  assert.match(qualifyingUpdate, /status:\s*'launch_verified'[\s\S]*launchVerified:\s*true[\s\S]*productionRestorable:\s*true/);
+
+  const schema = JSON.parse(fs.readFileSync(path.join(repoRoot, 'schemas/ps5-native-package-manifest.schema.json'), 'utf8'));
+  assert.deepEqual(schema.properties.launchVerified, { const: false });
+  assert.deepEqual(schema.properties.productionRestorable, { const: false });
+});
+
+test('hardware evidence gate rejects install-only and acknowledgement-only bundles', async () => {
+  const { validateHardwareEvidence } = await import(scriptUrl);
+  for (const mutate of [
+    bundle => { bundle.operation.status = 'installed_observed'; bundle.operation.launchVerified = false; bundle.operation.productionRestorable = false; },
+    bundle => { bundle.operation.launchEvidence.observationCount = 0; bundle.operation.launchEvidence.process = null; },
+    bundle => { bundle.artifact.installedSha256 = 'f'.repeat(64); },
+    bundle => { bundle.operation.launchEvidence.runtime.capabilities.fpkgEnableActive = false; },
+  ]) {
+    const bundle = validBundle(); mutate(bundle);
+    assert.equal(validateHardwareEvidence(bundle).accepted, false);
+  }
+});
+
+test('hardware evidence command is read-only and emits a machine-readable report', async t => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'chimera-hw-gate-')); t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  const bundlePath = path.join(root, 'evidence.json'); fs.writeFileSync(bundlePath, JSON.stringify(validBundle()));
+  const { spawnSync } = require('node:child_process');
+  const result = spawnSync(process.execPath, [scriptPath, bundlePath], { encoding: 'utf8' });
+  assert.equal(result.status, 0, result.stderr);
+  assert.equal(JSON.parse(result.stdout).accepted, true);
+  assert.equal(fs.readdirSync(root).length, 1);
+});