✔ real retrieve/store/copy reports and disk expiry preserve original acquisition (196.206875ms)
✔ zero retention never writes a managed asset to disk (55.690833ms)
✔ lost acknowledgement retries identical payload and event identity (84.557167ms)
✔ unresolved report deadline blocks dependent use and does not claim completion (88.750291ms)
✔ verified original on-time intake can resolve lost acknowledgement after deadline (133.924833ms)
✔ a truly late collector receipt remains late and cannot silently restore compliance (92.093458ms)
✔ wrong digest, reporter and unverified adapter responses never complete a report (112.092375ms)
✔ slow report transport cannot hold a managed file past its retention timer (116.668667ms)
✔ combined duties take the shortest retention and report deadline (102.535917ms)
✔ attribution output preserves all required distinct names and source links (36.430458ms)
✔ unsupported duties and irreversible or model uses are refused (41.141292ms)
✔ unoffered resources, expired use windows and backwards clocks refuse new operations (37.387792ms)
✔ graceful close deletes unexpired files; fresh session never silently resumes old cache (126.535709ms)
✔ unrelated files and a symlink storage root are not deleted (72.613542ms)
✔ a forged ownership-marker symlink cannot overwrite an unrelated file (40.147542ms)
✔ pending outbox survives reopen with identical bytes, IDs and original deadline (221.871042ms)
✔ verified outcomes survive reopen without inventing another delivery (150.170125ms)
✔ restart disposes of files without renewing retained-copy acquisition or expiry history (258.626542ms)
✔ a slow durable-intent write cannot authorize storage after retention expiry (71.975417ms)
✔ missing and late reporting remain blocking after restart (417.1485ms)
✔ corrupt and mismatched journal bindings fail closed without disposing pending evidence (230.999875ms)
✔ semantically mismatched reports and missing required deliveries reject even with recomputed journal checksum (193.985625ms)
✔ a journal with unsafe permissions or an absent journal is never silently reset (61.68325ms)
✔ actual process exit before acknowledgement preserves exact report and retries after restart (206.194209ms)
✔ collector commit followed by process exit and lost ack recovers the original timely outcome (201.685375ms)
✔ crash after disk write but before durable completion leaves uncertainty and never invents a completed report (224.270916ms)
✔ two overlapping stale-lock reclaimers cannot replace each other’s newly live owner (165.331958ms)
✔ an abandoned recovery guard is preserved for explicit recovery, never recursively reclaimed (48.570792ms)
✔ strict parser keeps exact JSON meaning and rejects ambiguous encodings (1.32125ms)
✔ ES256 verifies exact payload bytes, including significant whitespace (2.454958ms)
✔ JWS rejects attacker signatures, type confusion and unknown keys (1.849334ms)
✔ JWS rejects none, padding, unknown headers and DER instead of P1363 (0.342875ms)
✔ valid metadata requires separately provisioned pin, exact origin and live authority (1.645792ms)
✔ valid signed client report remains a declaration (1.788875ms)
✔ collector cannot change reported bytes or authenticated reporter association (1.370708ms)
✔ collector cannot promote client statements to origin/source assurance (0.911208ms)
✔ self-consistent attacker export cannot replace independent origin trust (0.675333ms)
✔ collector capability, revoked keys and origin references are enforced (0.350916ms)
✔ signed manifest binds selected representation bytes and media type (1.087959ms)
✔ operation counts resist distinct-event duplication, checkpoints and anonymous spoofing (2.078333ms)
✔ same operation with different resource or policy context stays conflicted (3.532708ms)
✔ offline preservation witness detects deletion and reordering of genuine signed records (23.151792ms)
ℹ tests 42
ℹ suites 0
ℹ pass 42
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 3833.069625
