✔ direct publisher graph is signed evidence, never resource permission (12.56475ms)
✔ delegated publisher graph is signed evidence, never resource permission (3.68525ms)
✔ cross-origin graph requires separately observed authority for every ancestor (5.0695ms)
✔ bundle keys cannot create historical pins (0.98425ms)
✔ reject missing document (0.789333ms)
✔ reject duplicate document (0.652375ms)
✔ reject duplicate signed payload (0.648ms)
✔ reject duplicate logical root with changed member order (0.644167ms)
✔ reject wrong root asset (1.774375ms)
✔ reject wrong root version (1.616667ms)
✔ reject wrong representation (1.32275ms)
✔ reject wrong payload digest (1.50625ms)
✔ reject different immutable pin (0.419334ms)
✔ reject invalid independent pin bytes (0.319833ms)
✔ reject extra bundle field (0.257125ms)
✔ reject legacy bundle (0.271875ms)
✔ reject empty roots (0.27175ms)
✔ reject excess manifests (0.709041ms)
✔ reject correctly signed wrong endpoint (0.487209ms)
✔ reject correctly signed wrong issuer (0.848375ms)
✔ reject correctly signed unknown service (1.267042ms)
✔ reject correctly signed no delegated authority (1.01575ms)
✔ reject correctly signed outside asset scope (1.046292ms)
✔ reject correctly signed publication duration (0.4775ms)
✔ reject correctly signed publication payment (0.469917ms)
✔ reject correctly signed publication wrong key role (0.467625ms)
✔ reject correctly signed publication outside resource (0.992459ms)
✔ reject correctly signed future publication (0.499875ms)
✔ reject correctly signed wrong authority revision (0.456875ms)
✔ reject correctly signed unknown manifest field (0.848709ms)
✔ reject correctly signed negative size (0.46825ms)
✔ reject correctly signed duplicate representation (0.521292ms)
✔ reject correctly signed invalid language (0.490208ms)
✔ reject correctly signed uppercase charset (0.48ms)
✔ reject correctly signed self derivation (0.571458ms)
✔ signature tampering fails despite structurally valid payload (1.10275ms)
✔ exact signed bytes, not reserialized values, determine manifest digest (2.118709ms)
✔ retired and expired current authority preserve historical evidence, without current publication (3.294208ms)
✔ remembered compromised material rejects evidence after key removal or alias (1.607709ms)
✔ rebound key identity and service issuer are rejected (2.339333ms)
✔ current freshness and trusted history are checked again at the end (2.992125ms)
✔ complete derivation closure rejects missing, extra and substituted parents (4.317542ms)
✔ copy requires exact decoded bytes and metadata; transform remains only a claim (2.688583ms)
✔ future source and duplicate logical edges cannot be hidden in signatures (1.974917ms)
✔ eight levels accepted; ninth rejected, including a shared deep branch (13.626333ms)
✔ immutable version cannot be redefined by a second authorised signature (0.710459ms)
✔ all published representation edges are closed even if root selects another representation (1.17425ms)
✔ prohibited retrieval does not become access through an authorised publication (1.179291ms)
✔ full decoded and gzip bytes match locally but do not prove receipt, use, or derivation computation (2.426125ms)
✔ unknown encoded variant stays unknown while decoded bytes match (0.971042ms)
✔ malformed lexical JSON, including floats and duplicate members, is rejected (0.236709ms)
✔ real retrieve/store/copy reports and disk expiry preserve original acquisition (277.6435ms)
✔ zero retention never writes a managed asset to disk (98.853208ms)
✔ lost acknowledgement retries identical payload and event identity (155.637541ms)
✔ unresolved report deadline blocks dependent use and does not claim completion (155.924083ms)
✔ verified original on-time intake can resolve lost acknowledgement after deadline (236.380167ms)
✔ a truly late collector receipt remains late and cannot silently restore compliance (170.707458ms)
✔ wrong digest, reporter and unverified adapter responses never complete a report (215.585083ms)
✔ slow report transport cannot hold a managed file past its retention timer (234.843ms)
✔ combined duties take the shortest retention and report deadline (182.656666ms)
✔ attribution output preserves all required distinct names and source links (75.56875ms)
✔ unsupported duties and irreversible or model uses are refused (72.305208ms)
✔ unoffered resources, expired use windows and backwards clocks refuse new operations (63.458916ms)
✔ graceful close deletes unexpired files; fresh session never silently resumes old cache (220.850167ms)
✔ unrelated files and a symlink storage root are not deleted (72.4795ms)
✔ a forged ownership-marker symlink cannot overwrite an unrelated file (89.644541ms)
✔ pending outbox survives reopen with identical bytes, IDs and original deadline (254.207625ms)
✔ verified outcomes survive reopen without inventing another delivery (176.685375ms)
✔ restart disposes of files without renewing retained-copy acquisition or expiry history (359.242625ms)
✔ a slow durable-intent write cannot authorize storage after retention expiry (116.887875ms)
✔ missing and late reporting remain blocking after restart (463.945875ms)
✔ corrupt and mismatched journal bindings fail closed without disposing pending evidence (271.823417ms)
✔ semantically mismatched reports and missing required deliveries reject even with recomputed journal checksum (208.377834ms)
✔ a journal with unsafe permissions or an absent journal is never silently reset (105.306416ms)
✔ actual process exit before acknowledgement preserves exact report and retries after restart (215.499667ms)
✔ collector commit followed by process exit and lost ack recovers the original timely outcome (220.885583ms)
✔ crash after disk write but before durable completion leaves uncertainty and never invents a completed report (199.177958ms)
✔ two overlapping stale-lock reclaimers cannot replace each other’s newly live owner (206.565667ms)
✔ an abandoned recovery guard is preserved for explicit recovery, never recursively reclaimed (51.848125ms)
✔ valid native ES256 signature returns exact signed payload bytes (1.991625ms)
✔ reject changed signed binding: protocol_version (0.453708ms)
✔ reject changed signed binding: origin (0.246417ms)
✔ reject changed signed binding: service_id (0.206083ms)
✔ reject changed signed binding: issuer (0.220666ms)
✔ reject changed signed binding: delegation_id (0.174ms)
✔ reject signature made with unadvertised private key (0.184834ms)
✔ reject changed body with original signature (0.182917ms)
✔ reject wrong algorithm/type/key or self-supplied key header: alg (0.116083ms)
✔ reject wrong algorithm/type/key or self-supplied key header: typ (0.401167ms)
✔ reject wrong algorithm/type/key or self-supplied key header: kid (0.169959ms)
✔ reject wrong algorithm/type/key or self-supplied key header: jwk (0.719708ms)
✔ reject expired key (0.220041ms)
✔ reject future key (0.216ms)
✔ reject revoked key (0.191083ms)
✔ reject duplicate key identifiers (0.104791ms)
✔ reject wrong signing role (0.093541ms)
✔ reject service capability absent (0.075333ms)
✔ reject delegated capability absent (0.078167ms)
✔ reject private key material in advertised JWK (0.080583ms)
✔ reject signed duplicate JSON binding properties (0.292541ms)
✔ reject noncanonical base64url signature (0.122833ms)
✔ reject unsupported service signature type rather than falling back to receipt capability (0.10875ms)
✔ strict parser keeps exact JSON meaning and rejects ambiguous encodings (1.0935ms)
✔ ES256 verifies exact payload bytes, including significant whitespace (1.595083ms)
✔ JWS rejects attacker signatures, type confusion and unknown keys (0.82325ms)
✔ JWS rejects none, padding, unknown headers and DER instead of P1363 (0.256083ms)
✔ valid metadata requires separately provisioned pin, exact origin and live authority (1.309167ms)
✔ valid signed client report remains a declaration (0.944416ms)
✔ collector cannot change reported bytes or authenticated reporter association (2.565958ms)
✔ collector cannot promote client statements to origin/source assurance (1.025208ms)
✔ self-consistent attacker export cannot replace independent origin trust (0.478666ms)
✔ collector capability, revoked keys and origin references are enforced (0.705125ms)
✔ signed manifest binds selected representation bytes and media type (0.793125ms)
✔ operation counts resist distinct-event duplication, checkpoints and anonymous spoofing (2.628208ms)
✔ same operation with different resource or policy context stays conflicted (5.208667ms)
✔ offline preservation witness detects deletion and reordering of genuine signed records (28.890083ms)
✔ valid paid quote, separate mandate, pending receipt and independently verified confirmation (10.244458ms)
✔ reject quote: wrong sum (2.013334ms)
✔ reject quote: leading zero (0.648667ms)
✔ reject quote: numeric amount (0.551791ms)
✔ reject quote: duplicate item (0.75375ms)
✔ reject quote: unknown fee type (0.88575ms)
✔ reject quote: wrong payee (0.892583ms)
✔ reject quote: wrong payer (0.431792ms)
✔ reject quote: self-selected verifier (0.55425ms)
✔ reject quote: all-zero paid price (0.81525ms)
✔ reject quote: currency changed (1.275416ms)
✔ reject quote: offer substituted (0.495417ms)
✔ reject quote: quote interval shortened (0.383709ms)
✔ reject quote: unrecognised field (1.159875ms)
✔ explicit zero resource price with positive provider fee stays paid (0.551083ms)
✔ valid issuer signature cannot alter paid receipt state_at_issue (1.181ms)
✔ valid issuer signature cannot alter paid receipt payment_required (0.918375ms)
✔ valid issuer signature cannot alter paid receipt access_credential (0.615459ms)
✔ valid issuer signature cannot alter paid receipt acceptance_digest (1.280583ms)
✔ agent signature is not a payer mandate (0.725833ms)
✔ payer signature still binds exact mandate quote_digest (0.626667ms)
✔ payer signature still binds exact mandate payer_id (0.517125ms)
✔ payer signature still binds exact mandate provider_id (0.722458ms)
✔ payer signature still binds exact mandate total_minor (0.641875ms)
✔ payer signature still binds exact mandate agreement_id (0.452375ms)
✔ reject provider authority: withdrawn verifier (0.470042ms)
✔ reject provider authority: withdrawn verifier grant (0.269958ms)
✔ reject provider authority: scope excluded (0.277417ms)
✔ reject provider authority: grant unpaid (0.285208ms)
✔ reject provider authority: expired observation (0.265292ms)
✔ reject provider authority: redirected endpoint binding (0.234417ms)
✔ reject authenticated provider assertion: wrong amount (0.526917ms)
✔ reject authenticated provider assertion: wrong payer (0.661459ms)
✔ reject authenticated provider assertion: wrong quote (0.604791ms)
✔ reject authenticated provider assertion: wrong request (0.553333ms)
✔ reject authenticated provider assertion: wrong check (0.577083ms)
✔ reject authenticated provider assertion: unknown state (0.807542ms)
✔ reject authenticated provider assertion: no transaction reference (0.653541ms)
✔ reject authenticated provider assertion: future assertion (0.579375ms)
✔ reject authenticated provider assertion: old assertion (0.689666ms)
✔ provider quote/check must match independently accepted context, even when both response and check are changed (0.543667ms)
✔ signed provider response does not bootstrap a new public key (0.754958ms)
✔ reversal and historical confirmed retry never restore access across serialized restart (1.673792ms)
✔ late confirmation can record financial assertion but cannot extend expired access (0.526959ms)
✔ same check ID changing exact original payload is rejected, even with equivalent JSON values (1.132291ms)
✔ fresh check cannot roll back sequence or transaction identity (1.191583ms)
✔ original receipt remains verifiable after offer expiry; it is not new assent (0.629667ms)
✔ a new stale provider assertion is not accepted as a historical exact retry (0.530042ms)
✔ changed assent intent is rejected even when a service signs its exact changed digest (0.669083ms)
✔ real disk writes pair completed action with distinct continuing session and observed removal (296.986583ms)
✔ managed memory is owned copy, zeroed on release, caller remains separate custody (183.39875ms)
✔ disk and memory copy preserve original high-resolution acquisition and conservative deadline (387.042542ms)
✔ retention expiry removes actual bytes and never renews a copied deadline (273.854833ms)
✔ late wake emits current index only and missed earlier checkpoints block dependent use (317.306334ms)
✔ same-second checkpoint and cessation retain consistent wire bytes across restart (458.011666ms)
✔ lost acknowledgement retains original signed outbox and one exact payload on restart (280.417166ms)
✔ missing actual file is unresolved after restart, never reported as observed deletion (232.006625ms)
✔ changed context and live second owner cannot reuse private journal (126.930625ms)
✔ actual copies stop before exceeding the shared 64-write evidence lineage bound (4296.825ms)
✔ unverified or wrong publisher-adapter result remains pending and cannot alter deadline (93.929041ms)
✔ real process death after managed file write leaves unresolved intent, no fabricated completed pair (108.96025ms)
✔ disk: expiry during durable intent cancels before custody and survives restart (retention) (87.759625ms)
✔ disk: expiry during durable intent cancels before custody and survives restart (use) (93.055709ms)
✔ disk: report deadline crossing intent blocks a copy without resetting the parent (150.219291ms)
✔ disk: final guard excludes only its own intent, not an unrelated uncertain copy (174.690958ms)
✔ memory: expiry during durable intent cancels before custody and survives restart (retention) (95.721584ms)
✔ memory: expiry during durable intent cancels before custody and survives restart (use) (99.788292ms)
✔ memory: report deadline crossing intent blocks a copy without resetting the parent (147.347167ms)
✔ memory: final guard excludes only its own intent, not an unrelated uncertain copy (180.066583ms)
✔ disk: final guard runs after file open before the first byte (retention) (102.324208ms)
✔ disk: final guard runs after file open before the first byte (use) (101.550625ms)
✔ disk: final guard runs after file open before the first byte (report) (153.350375ms)
✔ safe cancelled acquisition does not block a separately permitted new acquisition or fabricate events (135.965792ms)
✔ cancellation persistence failure remains uncertain and restart never invents completion (79.103958ms)
✔ a conflicting existing pathname is preserved and never labelled safely cancelled (62.992875ms)
✔ actual process death after expiry denial before cancellation commit recovers unresolved intent only (116.455708ms)
✔ independent wire validator matches 11 shared positive/negative cases (1.3355ms)
✔ write plus checkpoints and cessation count one action (1.473583ms)
✔ exact retries do not inflate counts or reset earliest verified intake (0.582833ms)
✔ independent coverage includes known session missing its start report (2.129708ms)
✔ exact deadline is timely while one second later is late (2.083875ms)
✔ absent checkpoint becomes missing only after reporting deadline (0.413709ms)
✔ late wake leaves earlier missing indices and uses original deadline (0.385125ms)
✔ cessation at a checkpoint discharges that boundary only (0.502542ms)
✔ reject unresolved exact write and parent references (0.843667ms)
✔ reject altered authenticated namespace, exact bytes, and retention deadline (1.958583ms)
✔ reject duplicate checkpoint with a different event ID and reopening after cessation (1.129083ms)
✔ custody past expiry remains visible without claiming deletion (0.536917ms)
✔ reports received after as-of cannot hide present missing observations (0.837709ms)
✔ copy parent cannot renew original acquisition despite valid self-consistent child deadline (0.399709ms)
ℹ tests 206
ℹ suites 0
ℹ pass 206
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 8910.60875