✔ real retrieve/store/copy reports and disk expiry preserve original acquisition (287.531042ms)
✔ zero retention never writes a managed asset to disk (97.703375ms)
✔ lost acknowledgement retries identical payload and event identity (173.459833ms)
✔ unresolved report deadline blocks dependent use and does not claim completion (186.062834ms)
✔ verified original on-time intake can resolve lost acknowledgement after deadline (235.730625ms)
✔ a truly late collector receipt remains late and cannot silently restore compliance (161.234292ms)
✔ wrong digest, reporter and unverified adapter responses never complete a report (185.533458ms)
✔ slow report transport cannot hold a managed file past its retention timer (202.340333ms)
✔ combined duties take the shortest retention and report deadline (177.954708ms)
✔ attribution output preserves all required distinct names and source links (110.51375ms)
✔ unsupported duties and irreversible or model uses are refused (79.366125ms)
✔ unoffered resources, expired use windows and backwards clocks refuse new operations (72.912833ms)
✔ graceful close deletes unexpired files; fresh session never silently resumes old cache (259.130291ms)
✔ unrelated files and a symlink storage root are not deleted (69.241541ms)
✔ a forged ownership-marker symlink cannot overwrite an unrelated file (84.56575ms)
✔ pending outbox survives reopen with identical bytes, IDs and original deadline (228.851792ms)
✔ verified outcomes survive reopen without inventing another delivery (213.961667ms)
✔ restart disposes of files without renewing retained-copy acquisition or expiry history (299.332333ms)
✔ a slow durable-intent write cannot authorize storage after retention expiry (115.997083ms)
✔ missing and late reporting remain blocking after restart (473.576416ms)
✔ corrupt and mismatched journal bindings fail closed without disposing pending evidence (262.662042ms)
✔ semantically mismatched reports and missing required deliveries reject even with recomputed journal checksum (231.113042ms)
✔ a journal with unsafe permissions or an absent journal is never silently reset (84.907458ms)
✔ actual process exit before acknowledgement preserves exact report and retries after restart (223.760584ms)
✔ collector commit followed by process exit and lost ack recovers the original timely outcome (206.000291ms)
✔ crash after disk write but before durable completion leaves uncertainty and never invents a completed report (232.714875ms)
✔ two overlapping stale-lock reclaimers cannot replace each other’s newly live owner (203.211625ms)
✔ an abandoned recovery guard is preserved for explicit recovery, never recursively reclaimed (61.591375ms)
✔ valid native ES256 signature returns exact signed payload bytes (1.701417ms)
✔ reject changed signed binding: protocol_version (0.398541ms)
✔ reject changed signed binding: origin (0.22675ms)
✔ reject changed signed binding: service_id (0.184ms)
✔ reject changed signed binding: issuer (0.182542ms)
✔ reject changed signed binding: delegation_id (0.173542ms)
✔ reject signature made with unadvertised private key (0.187375ms)
✔ reject changed body with original signature (0.176458ms)
✔ reject wrong algorithm/type/key or self-supplied key header: alg (0.115833ms)
✔ reject wrong algorithm/type/key or self-supplied key header: typ (0.131542ms)
✔ reject wrong algorithm/type/key or self-supplied key header: kid (0.098625ms)
✔ reject wrong algorithm/type/key or self-supplied key header: jwk (0.442334ms)
✔ reject expired key (0.225416ms)
✔ reject future key (0.120917ms)
✔ reject revoked key (0.147542ms)
✔ reject duplicate key identifiers (0.096208ms)
✔ reject wrong signing role (0.084625ms)
✔ reject service capability absent (0.072792ms)
✔ reject delegated capability absent (0.07725ms)
✔ reject private key material in advertised JWK (0.074ms)
✔ reject signed duplicate JSON binding properties (0.211708ms)
✔ reject noncanonical base64url signature (0.079708ms)
✔ reject unsupported service signature type rather than falling back to receipt capability (0.067833ms)
✔ strict parser keeps exact JSON meaning and rejects ambiguous encodings (1.039833ms)
✔ ES256 verifies exact payload bytes, including significant whitespace (1.389792ms)
✔ JWS rejects attacker signatures, type confusion and unknown keys (0.937125ms)
✔ JWS rejects none, padding, unknown headers and DER instead of P1363 (0.259209ms)
✔ valid metadata requires separately provisioned pin, exact origin and live authority (0.99825ms)
✔ valid signed client report remains a declaration (0.790583ms)
✔ collector cannot change reported bytes or authenticated reporter association (4.7955ms)
✔ collector cannot promote client statements to origin/source assurance (0.879625ms)
✔ self-consistent attacker export cannot replace independent origin trust (0.4785ms)
✔ collector capability, revoked keys and origin references are enforced (0.772042ms)
✔ signed manifest binds selected representation bytes and media type (0.93325ms)
✔ operation counts resist distinct-event duplication, checkpoints and anonymous spoofing (1.750042ms)
✔ same operation with different resource or policy context stays conflicted (3.651333ms)
✔ offline preservation witness detects deletion and reordering of genuine signed records (25.443041ms)
✔ real disk writes pair completed action with distinct continuing session and observed removal (295.473667ms)
✔ managed memory is owned copy, zeroed on release, caller remains separate custody (189.800209ms)
✔ disk and memory copy preserve original high-resolution acquisition and conservative deadline (408.278ms)
✔ retention expiry removes actual bytes and never renews a copied deadline (268.126667ms)
✔ late wake emits current index only and missed earlier checkpoints block dependent use (268.424666ms)
✔ same-second checkpoint and cessation retain consistent wire bytes across restart (467.645792ms)
✔ lost acknowledgement retains original signed outbox and one exact payload on restart (331.947458ms)
✔ missing actual file is unresolved after restart, never reported as observed deletion (207.93975ms)
✔ changed context and live second owner cannot reuse private journal (127.250875ms)
✔ actual copies stop before exceeding the shared 64-write evidence lineage bound (4266.00825ms)
✔ unverified or wrong publisher-adapter result remains pending and cannot alter deadline (96.039333ms)
✔ real process death after managed file write leaves unresolved intent, no fabricated completed pair (98.9345ms)
✔ independent wire validator matches 11 shared positive/negative cases (1.370916ms)
✔ write plus checkpoints and cessation count one action (1.521708ms)
✔ exact retries do not inflate counts or reset earliest verified intake (0.682834ms)
✔ independent coverage includes known session missing its start report (0.321917ms)
✔ exact deadline is timely while one second later is late (4.803583ms)
✔ absent checkpoint becomes missing only after reporting deadline (0.465166ms)
✔ late wake leaves earlier missing indices and uses original deadline (0.547167ms)
✔ cessation at a checkpoint discharges that boundary only (0.394709ms)
✔ reject unresolved exact write and parent references (0.529125ms)
✔ reject altered authenticated namespace, exact bytes, and retention deadline (0.756959ms)
✔ reject duplicate checkpoint with a different event ID and reopening after cessation (0.59475ms)
✔ custody past expiry remains visible without claiming deletion (0.189625ms)
✔ reports received after as-of cannot hide present missing observations (0.241791ms)
✔ copy parent cannot renew original acquisition despite valid self-consistent child deadline (0.332834ms)
ℹ tests 91
ℹ suites 0
ℹ pass 91
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 7086.315917
