Initial curated chimera source from a8ae5b1db07fb49926c94585e2718e5130330974

test/server/ch-1401-ps5-fpkg-kstuff-runtime-identity.test.js

@@ -0,0 +1,161 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const test = require('node:test');
+const { P15_R4_KSTUFF_RUNTIME, classifyPs5FpkgKstuffRuntimeIdentity, classifyPs5FpkgKstuffRuntimeObservation } = require('../../src/services/ps5-fpkg-kstuff-runtime-identity');
+
+const HASHES = Object.freeze({ loader: '1'.repeat(64), payload: '2'.repeat(64), reader: '3'.repeat(64), manifest: '4'.repeat(64) });
+const REVISION = '3b2ab4a16ba43c8ab38daf7ec83cc297014e0e47';
+
+function identity(semanticOnly = true) {
+  return {
+    expected: {
+      product: 'EchoStretch/kstuff-lite', version: '1.10', revision: REVISION, firmware: '9.60',
+      loaderSha256: HASHES.loader, payloadSha256: HASHES.payload, readerSha256: HASHES.reader,
+      autoloadManifestSha256: HASHES.manifest, observabilityProfile: 'chimera-p15-fpkg-observe-v1', semanticOnly,
+    },
+    observed: {
+      loaderSha256: HASHES.loader, payloadSha256: HASHES.payload, readerSha256: HASHES.reader,
+      processInventoryComplete: true,
+      processes: [{ pid: 93, name: 'kstuff.elf' }],
+      loadTransition: {
+        autoloadManifestSha256: HASHES.manifest, loaderExecuted: true,
+        payloadProcessObserved: true, readerExecutedAfterPayload: true,
+      },
+    },
+  };
+}
+
+test('exact semantic-only runtime with one complete process observation is trace eligible', () => {
+  const result = classifyPs5FpkgKstuffRuntimeIdentity(identity());
+  assert.equal(result.status, 'exact');
+  assert.equal(result.traceEligible, true);
+  assert.equal(result.productionRestorable, false);
+});
+
+test('exact raw capture remains trace-ineligible', () => {
+  const result = classifyPs5FpkgKstuffRuntimeIdentity(identity(false));
+  assert.equal(result.status, 'exact');
+  assert.equal(result.traceEligible, false);
+  assert.equal(result.ineligibleReason, 'observability-profile-exceeds-semantic-boundary');
+});
+
+test('matching files without a proven active load transition remain unproven', () => {
+  const input = identity();
+  input.observed.loadTransition.loaderExecuted = false;
+  const result = classifyPs5FpkgKstuffRuntimeIdentity(input);
+  assert.equal(result.status, 'unproven');
+  assert.equal(result.traceEligible, false);
+});
+
+test('active loader or embedded-payload mismatch is explicit and fail-closed', () => {
+  const input = identity();
+  input.observed.payloadSha256 = '5'.repeat(64);
+  const result = classifyPs5FpkgKstuffRuntimeIdentity(input);
+  assert.equal(result.status, 'mismatch');
+  assert.equal(result.traceEligible, false);
+});
+
+test('duplicate live kstuff processes are ambiguous even with matching artifact evidence', () => {
+  const input = identity();
+  input.observed.processes = [{ pid: 93, name: 'kstuff.elf' }, { pid: 105, name: 'kstuff.elf' }];
+  const result = classifyPs5FpkgKstuffRuntimeIdentity(input);
+  assert.equal(result.status, 'ambiguous');
+  assert.equal(result.traceEligible, false);
+  assert.deepEqual(result.observed.processes.map(process => process.pid), [93, 105]);
+});
+
+test('one bounded live kstuff process preserves exact attestation', () => {
+  const input = identity();
+  input.observed.processes = [{ pid: 93, name: 'kstuff.elf' }];
+  assert.equal(classifyPs5FpkgKstuffRuntimeIdentity(input).status, 'exact');
+});
+
+test('missing process inventory is unproven and is not represented as a proven empty inventory', () => {
+  const input = identity();
+  input.observed.processInventoryComplete = false;
+  input.observed.processes = [];
+  const result = classifyPs5FpkgKstuffRuntimeIdentity(input);
+  assert.equal(result.status, 'unproven');
+  assert.equal(result.observed.processInventoryComplete, false);
+  assert.deepEqual(result.observed.processes, []);
+  assert.equal(result.traceEligible, false);
+});
+
+test('R4 binds the current reviewed A7 autoload runtime identity', () => {
+  assert.deepEqual(P15_R4_KSTUFF_RUNTIME, {
+    product: 'EchoStretch/kstuff-lite',
+    version: '1.10',
+    revision: REVISION,
+    firmware: '9.60',
+    loaderSha256: '31716863903a887b51785d3dfd2f6ac3980cae1fa2ea0dff73c98d701ae8c5cf',
+    payloadSha256: 'ef0705222975cba8f6f953810a014eba29c48c2f6e61147082327e40fce69b86',
+    readerSha256: '64ee055db7044407baeba45b5ce6213fbebd451d9346e27e50a12ee3dd45f0a6',
+    autoloadManifestSha256: 'f9f5670aaffb9b8dcf457abcfd28ba2fa614c7deca89855dbc7597ff7695481a',
+    observabilityProfile: 'chimera-p15-a7-route-selection-v1',
+    semanticOnly: true,
+  });
+});
+
+test('production observation cannot promote unbound syslog claims into execution attestation', () => {
+  const input = {
+    inventoryComplete: true,
+    kstuffProcesses: [{ pid: 71, name: 'kstuff.elf' }],
+    syslog: { text: Object.entries(P15_R4_KSTUFF_RUNTIME)
+      .filter(([key]) => key.endsWith('Sha256')).map(([key, value]) => `${key}=${value}`)
+      .concat('loaderExecuted=true', 'readerExecutedAfterPayload=true').join('\n') },
+  };
+  const result = classifyPs5FpkgKstuffRuntimeObservation(input);
+  assert.equal(result.status, 'unproven');
+  assert.equal(result.traceEligible, false);
+  assert.equal(result.observed.loaderSha256, null);
+  assert.equal(result.observed.payloadSha256, null);
+  assert.equal(result.observed.readerSha256, null);
+  assert.equal(result.observed.loadTransition.autoloadManifestSha256, null);
+  assert.equal(result.observed.loadTransition.loaderExecuted, false);
+  assert.equal(result.observed.loadTransition.readerExecutedAfterPayload, false);
+  assert.equal(result.observed.loadTransition.payloadProcessObserved, true);
+  assert.equal(result.evidenceContract.status, 'unavailable');
+  assert.equal(result.evidenceContract.reason, 'kstuff_current_boot_execution_receipt_unavailable');
+  assert.equal(result.evidenceContract.cleanRuntimeRequired, false);
+});
+
+test('process ambiguity and absent execution producer are reported independently', () => {
+  const result = classifyPs5FpkgKstuffRuntimeObservation({
+    inventoryComplete: true,
+    kstuffProcesses: [{ pid: 71, name: 'kstuff.elf' }, { pid: 83, name: 'kstuff.elf' }],
+  });
+  assert.equal(result.status, 'ambiguous');
+  assert.equal(result.evidenceContract.cleanRuntimeRequired, true);
+  assert.equal(result.evidenceContract.status, 'unavailable');
+  assert.equal(result.traceEligible, false);
+  assert.deepEqual(result.observed.processes.map(process => process.pid), [71, 83]);
+  assert.equal(Object.isFrozen(result.evidenceContract), true);
+});
+
+test('unavailable inventory remains distinct from a clean single-process runtime', () => {
+  const result = classifyPs5FpkgKstuffRuntimeObservation();
+  assert.equal(result.status, 'unproven');
+  assert.equal(result.observed.processInventoryComplete, false);
+  assert.deepEqual(result.observed.processes, []);
+  assert.equal(result.evidenceContract.cleanRuntimeRequired, false);
+  assert.equal(result.evidenceContract.status, 'unavailable');
+});
+
+test('a completeness flag without an actual process array is unavailable, not an empty complete inventory', () => {
+  for (const kstuffProcesses of [undefined, null, {}, 'kstuff.elf']) {
+    const result = classifyPs5FpkgKstuffRuntimeObservation({ inventoryComplete: true, kstuffProcesses });
+    assert.equal(result.observed.processInventoryComplete, false);
+    assert.deepEqual(result.observed.processes, []);
+    assert.equal(result.observed.loadTransition.payloadProcessObserved, false);
+    assert.equal(result.traceEligible, false);
+  }
+});
+
+test('an explicitly complete empty process array remains distinguishable from missing inventory', () => {
+  const result = classifyPs5FpkgKstuffRuntimeObservation({ inventoryComplete: true, kstuffProcesses: [] });
+  assert.equal(result.observed.processInventoryComplete, true);
+  assert.equal(result.observed.loadTransition.payloadProcessObserved, false);
+  assert.equal(result.status, 'unproven');
+  assert.equal(result.traceEligible, false);
+});