Initial curated chimera source from a8ae5b1db07fb49926c94585e2718e5130330974

test/server/ch-1401-ps5-fpkg-semantic-reader-source.test.js

@@ -0,0 +1,45 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const test = require('node:test');
+
+const ROOT = path.resolve(__dirname, '../..');
+const SOURCE = path.join(ROOT, 'tools', 'ps5-kstuff-diagnostics', 'semantic-reader.c');
+
+test('A6 semantic reader scrubs the full snapshot before persistence', () => {
+  const source = fs.readFileSync(SOURCE, 'utf8');
+  const copy = source.indexOf('*metrics = snapshot.metrics;');
+  const scrub = source.indexOf('volatile_scrub(&snapshot, sizeof(snapshot));', copy);
+  const write = source.indexOf('write_metrics(&metrics, sample)');
+  assert.ok(copy >= 0 && scrub > copy && write > scrub);
+  assert.match(source, /volatile unsigned char\* bytes/);
+});
+
+test('A6 semantic reader persists only the strict allowlisted schema', () => {
+  const source = fs.readFileSync(SOURCE, 'utf8');
+  for (const line of [
+    'schema=chimera.p15-a6-semantic-metrics.v1',
+    'status=attached',
+    'core mailbox_fpkg=',
+    'syscall[nmount] armed=',
+    'fakekeys reg=',
+    'crypto req=',
+    'fpkg verify=',
+    'fpkg_rejects xts_non_fake=',
+  ]) assert.ok(source.includes(line), `missing allowlisted line: ${line}`);
+  for (const forbidden of [
+    'kstuff_debug.log', 'word_log', 'msg_log', 'ioctl_com_table',
+    'key_data', 'mailbox-capture', 'log-word', 'decrypt_regs',
+  ]) assert.doesNotMatch(source, new RegExp(forbidden, 'i'));
+});
+
+test('A6 semantic reader uses an atomic dedicated output file and static failures', () => {
+  const source = fs.readFileSync(SOURCE, 'utf8');
+  assert.match(source, /chimera_kstuff_a6_semantic\.log\.tmp/);
+  assert.match(source, /rename\(OUTPUT_TEMP_PATH, OUTPUT_PATH\)/);
+  assert.match(source, /write_static_status\("not-loaded"\)/);
+  assert.match(source, /write_static_status\("snapshot-error"\)/);
+  assert.doesNotMatch(source, /\bprintf\s*\(/);
+});