✔ real retrieve/store/copy reports and disk expiry preserve original acquisition (296.453541ms)
✔ zero retention never writes a managed asset to disk (109.528542ms)
✔ lost acknowledgement retries identical payload and event identity (202.512125ms)
✔ unresolved report deadline blocks dependent use and does not claim completion (207.253625ms)
✔ verified original on-time intake can resolve lost acknowledgement after deadline (264.382042ms)
✔ a truly late collector receipt remains late and cannot silently restore compliance (177.582959ms)
✔ wrong digest, reporter and unverified adapter responses never complete a report (204.4425ms)
✔ slow report transport cannot hold a managed file past its retention timer (257.251417ms)
✔ combined duties take the shortest retention and report deadline (190.454708ms)
✔ attribution output preserves all required distinct names and source links (92.8255ms)
✔ unsupported duties and irreversible or model uses are refused (69.939167ms)
✔ unoffered resources, expired use windows and backwards clocks refuse new operations (70.654291ms)
✔ graceful close deletes unexpired files; fresh session never silently resumes old cache (257.567167ms)
✔ unrelated files and a symlink storage root are not deleted (70.272125ms)
✔ a forged ownership-marker symlink cannot overwrite an unrelated file (63.900916ms)
✔ pending outbox survives reopen with identical bytes, IDs and original deadline (236.292167ms)
✔ verified outcomes survive reopen without inventing another delivery (184.656541ms)
✔ restart disposes of files without renewing retained-copy acquisition or expiry history (406.917709ms)
✔ a slow durable-intent write cannot authorize storage after retention expiry (115.657958ms)
✔ missing and late reporting remain blocking after restart (500.350209ms)
✔ corrupt and mismatched journal bindings fail closed without disposing pending evidence (305.080334ms)
✔ semantically mismatched reports and missing required deliveries reject even with recomputed journal checksum (251.978417ms)
✔ a journal with unsafe permissions or an absent journal is never silently reset (110.516ms)
✔ actual process exit before acknowledgement preserves exact report and retries after restart (253.0935ms)
✔ collector commit followed by process exit and lost ack recovers the original timely outcome (264.558625ms)
✔ crash after disk write but before durable completion leaves uncertainty and never invents a completed report (248.0655ms)
✔ two overlapping stale-lock reclaimers cannot replace each other’s newly live owner (223.330458ms)
✔ an abandoned recovery guard is preserved for explicit recovery, never recursively reclaimed (65.281125ms)
✔ valid native ES256 signature returns exact signed payload bytes (1.643125ms)
✔ reject changed signed binding: protocol_version (0.387875ms)
✔ reject changed signed binding: origin (0.232625ms)
✔ reject changed signed binding: service_id (0.18075ms)
✔ reject changed signed binding: issuer (0.187542ms)
✔ reject changed signed binding: delegation_id (0.150917ms)
✔ reject signature made with unadvertised private key (0.171375ms)
✔ reject changed body with original signature (0.186125ms)
✔ reject wrong algorithm/type/key or self-supplied key header: alg (0.108916ms)
✔ reject wrong algorithm/type/key or self-supplied key header: typ (0.123583ms)
✔ reject wrong algorithm/type/key or self-supplied key header: kid (0.089167ms)
✔ reject wrong algorithm/type/key or self-supplied key header: jwk (0.56275ms)
✔ reject expired key (0.18725ms)
✔ reject future key (0.139084ms)
✔ reject revoked key (0.136125ms)
✔ reject duplicate key identifiers (0.0925ms)
✔ reject wrong signing role (0.086125ms)
✔ reject service capability absent (0.074708ms)
✔ reject delegated capability absent (0.08775ms)
✔ reject private key material in advertised JWK (0.098875ms)
✔ reject signed duplicate JSON binding properties (0.219292ms)
✔ reject noncanonical base64url signature (0.0885ms)
✔ reject unsupported service signature type rather than falling back to receipt capability (0.089958ms)
✔ strict parser keeps exact JSON meaning and rejects ambiguous encodings (1.533083ms)
✔ ES256 verifies exact payload bytes, including significant whitespace (2.1975ms)
✔ JWS rejects attacker signatures, type confusion and unknown keys (1.8845ms)
✔ JWS rejects none, padding, unknown headers and DER instead of P1363 (0.338042ms)
✔ valid metadata requires separately provisioned pin, exact origin and live authority (1.183375ms)
✔ valid signed client report remains a declaration (0.846041ms)
✔ collector cannot change reported bytes or authenticated reporter association (1.035042ms)
✔ collector cannot promote client statements to origin/source assurance (0.865083ms)
✔ self-consistent attacker export cannot replace independent origin trust (0.463125ms)
✔ collector capability, revoked keys and origin references are enforced (0.789416ms)
✔ signed manifest binds selected representation bytes and media type (0.90175ms)
✔ operation counts resist distinct-event duplication, checkpoints and anonymous spoofing (1.62075ms)
✔ same operation with different resource or policy context stays conflicted (6.57525ms)
✔ offline preservation witness detects deletion and reordering of genuine signed records (30.127959ms)
✔ valid paid quote, separate mandate, pending receipt and independently verified confirmation (11.167291ms)
✔ reject quote: wrong sum (2.251ms)
✔ reject quote: leading zero (0.619292ms)
✔ reject quote: numeric amount (0.492375ms)
✔ reject quote: duplicate item (0.465666ms)
✔ reject quote: unknown fee type (0.428875ms)
✔ reject quote: wrong payee (1.406917ms)
✔ reject quote: wrong payer (0.539916ms)
✔ reject quote: self-selected verifier (0.823625ms)
✔ reject quote: all-zero paid price (0.565708ms)
✔ reject quote: currency changed (0.478792ms)
✔ reject quote: offer substituted (0.422125ms)
✔ reject quote: quote interval shortened (0.354208ms)
✔ reject quote: unrecognised field (1.920875ms)
✔ explicit zero resource price with positive provider fee stays paid (0.580875ms)
✔ valid issuer signature cannot alter paid receipt state_at_issue (0.780375ms)
✔ valid issuer signature cannot alter paid receipt payment_required (0.523958ms)
✔ valid issuer signature cannot alter paid receipt access_credential (0.512042ms)
✔ valid issuer signature cannot alter paid receipt acceptance_digest (0.8405ms)
✔ agent signature is not a payer mandate (0.461208ms)
✔ payer signature still binds exact mandate quote_digest (0.498ms)
✔ payer signature still binds exact mandate payer_id (0.42975ms)
✔ payer signature still binds exact mandate provider_id (0.377291ms)
✔ payer signature still binds exact mandate total_minor (0.364708ms)
✔ payer signature still binds exact mandate agreement_id (0.402542ms)
✔ reject provider authority: withdrawn verifier (0.4085ms)
✔ reject provider authority: withdrawn verifier grant (0.228833ms)
✔ reject provider authority: scope excluded (0.254875ms)
✔ reject provider authority: grant unpaid (0.285167ms)
✔ reject provider authority: expired observation (0.249458ms)
✔ reject provider authority: redirected endpoint binding (0.227875ms)
✔ reject authenticated provider assertion: wrong amount (1.346958ms)
✔ reject authenticated provider assertion: wrong payer (0.772042ms)
✔ reject authenticated provider assertion: wrong quote (0.672791ms)
✔ reject authenticated provider assertion: wrong request (0.583542ms)
✔ reject authenticated provider assertion: wrong check (0.580708ms)
✔ reject authenticated provider assertion: unknown state (0.603084ms)
✔ reject authenticated provider assertion: no transaction reference (0.430584ms)
✔ reject authenticated provider assertion: future assertion (0.478875ms)
✔ reject authenticated provider assertion: old assertion (0.603125ms)
✔ provider quote/check must match independently accepted context, even when both response and check are changed (0.421334ms)
✔ signed provider response does not bootstrap a new public key (0.757833ms)
✔ reversal and historical confirmed retry never restore access across serialized restart (1.743ms)
✔ late confirmation can record financial assertion but cannot extend expired access (0.708042ms)
✔ same check ID changing exact original payload is rejected, even with equivalent JSON values (1.168042ms)
✔ fresh check cannot roll back sequence or transaction identity (1.100625ms)
✔ original receipt remains verifiable after offer expiry; it is not new assent (0.568375ms)
✔ a new stale provider assertion is not accepted as a historical exact retry (0.486791ms)
✔ changed assent intent is rejected even when a service signs its exact changed digest (0.476209ms)
✔ real disk writes pair completed action with distinct continuing session and observed removal (329.643791ms)
✔ managed memory is owned copy, zeroed on release, caller remains separate custody (206.746625ms)
✔ disk and memory copy preserve original high-resolution acquisition and conservative deadline (455.737833ms)
✔ retention expiry removes actual bytes and never renews a copied deadline (278.822875ms)
✔ late wake emits current index only and missed earlier checkpoints block dependent use (312.910917ms)
✔ same-second checkpoint and cessation retain consistent wire bytes across restart (502.673917ms)
✔ lost acknowledgement retains original signed outbox and one exact payload on restart (338.032084ms)
✔ missing actual file is unresolved after restart, never reported as observed deletion (209.833792ms)
✔ changed context and live second owner cannot reuse private journal (130.156542ms)
✔ actual copies stop before exceeding the shared 64-write evidence lineage bound (4980.249834ms)
✔ unverified or wrong publisher-adapter result remains pending and cannot alter deadline (108.214833ms)
✔ real process death after managed file write leaves unresolved intent, no fabricated completed pair (125.204166ms)
✔ independent wire validator matches 11 shared positive/negative cases (1.63925ms)
✔ write plus checkpoints and cessation count one action (1.414583ms)
✔ exact retries do not inflate counts or reset earliest verified intake (0.573541ms)
✔ independent coverage includes known session missing its start report (2.291417ms)
✔ exact deadline is timely while one second later is late (4.066958ms)
✔ absent checkpoint becomes missing only after reporting deadline (0.451583ms)
✔ late wake leaves earlier missing indices and uses original deadline (0.544792ms)
✔ cessation at a checkpoint discharges that boundary only (0.415417ms)
✔ reject unresolved exact write and parent references (0.565291ms)
✔ reject altered authenticated namespace, exact bytes, and retention deadline (0.832083ms)
✔ reject duplicate checkpoint with a different event ID and reopening after cessation (0.680292ms)
✔ custody past expiry remains visible without claiming deletion (0.20625ms)
✔ reports received after as-of cannot hide present missing observations (0.266709ms)
✔ copy parent cannot renew original acquisition despite valid self-consistent child deadline (0.356584ms)
ℹ tests 140
ℹ suites 0
ℹ pass 140
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 8055.37575