✔ real retrieve/store/copy reports and disk expiry preserve original acquisition (156.282875ms)
✔ zero retention never writes a managed asset to disk (49.225417ms)
✔ lost acknowledgement retries identical payload and event identity (80.91175ms)
✔ unresolved report deadline blocks dependent use and does not claim completion (83.06325ms)
✔ verified original on-time intake can resolve lost acknowledgement after deadline (143.360625ms)
✔ a truly late collector receipt remains late and cannot silently restore compliance (79.347625ms)
✔ wrong digest, reporter and unverified adapter responses never complete a report (96.256375ms)
✔ slow report transport cannot hold a managed file past its retention timer (113.822458ms)
✔ combined duties take the shortest retention and report deadline (93.964708ms)
✔ attribution output preserves all required distinct names and source links (32.75175ms)
✔ unsupported duties and irreversible or model uses are refused (32.02425ms)
✔ unoffered resources, expired use windows and backwards clocks refuse new operations (39.584417ms)
✔ graceful close deletes unexpired files; fresh session never silently resumes old cache (116.129375ms)
✔ unrelated files and a symlink storage root are not deleted (42.979959ms)
✔ a forged ownership-marker symlink cannot overwrite an unrelated file (40.857ms)
✔ pending outbox survives reopen with identical bytes, IDs and original deadline (149.096583ms)
✔ verified outcomes survive reopen without inventing another delivery (127.014125ms)
✔ restart disposes of files without renewing retained-copy acquisition or expiry history (182.691875ms)
✔ a slow durable-intent write cannot authorize storage after retention expiry (58.313375ms)
✔ missing and late reporting remain blocking after restart (230.305042ms)
✔ corrupt and mismatched journal bindings fail closed without disposing pending evidence (166.046125ms)
✔ semantically mismatched reports and missing required deliveries reject even with recomputed journal checksum (112.198875ms)
✔ a journal with unsafe permissions or an absent journal is never silently reset (42.429083ms)
✔ actual process exit before acknowledgement preserves exact report and retries after restart (119.546791ms)
✔ collector commit followed by process exit and lost ack recovers the original timely outcome (128.634125ms)
✔ crash after disk write but before durable completion leaves uncertainty and never invents a completed report (135.80675ms)
✔ two overlapping stale-lock reclaimers cannot replace each other’s newly live owner (123.171834ms)
✔ an abandoned recovery guard is preserved for explicit recovery, never recursively reclaimed (35.154667ms)
✔ valid native ES256 signature returns exact signed payload bytes (1.653125ms)
✔ reject changed signed binding: protocol_version (0.394875ms)
✔ reject changed signed binding: origin (0.217292ms)
✔ reject changed signed binding: service_id (0.181834ms)
✔ reject changed signed binding: issuer (0.199792ms)
✔ reject changed signed binding: delegation_id (0.174041ms)
✔ reject signature made with unadvertised private key (0.165125ms)
✔ reject changed body with original signature (0.178042ms)
✔ reject wrong algorithm/type/key or self-supplied key header: alg (0.108417ms)
✔ reject wrong algorithm/type/key or self-supplied key header: typ (0.137875ms)
✔ reject wrong algorithm/type/key or self-supplied key header: kid (0.08725ms)
✔ reject wrong algorithm/type/key or self-supplied key header: jwk (0.106625ms)
✔ reject expired key (0.110583ms)
✔ reject future key (0.087375ms)
✔ reject revoked key (0.086583ms)
✔ reject duplicate key identifiers (0.073375ms)
✔ reject wrong signing role (0.084417ms)
✔ reject service capability absent (0.065125ms)
✔ reject delegated capability absent (0.068291ms)
✔ reject private key material in advertised JWK (0.064166ms)
✔ reject signed duplicate JSON binding properties (0.198875ms)
✔ reject noncanonical base64url signature (0.073166ms)
✔ reject unsupported service signature type rather than falling back to receipt capability (0.060333ms)
✔ strict parser keeps exact JSON meaning and rejects ambiguous encodings (1.050958ms)
✔ ES256 verifies exact payload bytes, including significant whitespace (1.3785ms)
✔ JWS rejects attacker signatures, type confusion and unknown keys (0.794875ms)
✔ JWS rejects none, padding, unknown headers and DER instead of P1363 (0.295708ms)
✔ valid metadata requires separately provisioned pin, exact origin and live authority (1.194208ms)
✔ valid signed client report remains a declaration (0.85925ms)
✔ collector cannot change reported bytes or authenticated reporter association (1.045583ms)
✔ collector cannot promote client statements to origin/source assurance (1.193458ms)
✔ self-consistent attacker export cannot replace independent origin trust (0.523042ms)
✔ collector capability, revoked keys and origin references are enforced (0.690541ms)
✔ signed manifest binds selected representation bytes and media type (0.785541ms)
✔ operation counts resist distinct-event duplication, checkpoints and anonymous spoofing (1.538125ms)
✔ same operation with different resource or policy context stays conflicted (2.950833ms)
✔ offline preservation witness detects deletion and reordering of genuine signed records (11.765959ms)
ℹ tests 65
ℹ suites 0
ℹ pass 65
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 2860.648625
