pwn 0.5.783 → 0.5.785

data/spec/fixtures/yubikey/apdu_frames.json

@@ -0,0 +1,162 @@
+{
+  "reference": "Yubico yubikey-manager 5.9.1 smartcard formatters; generated offline with synthetic bytes, not a hardware capture",
+  "source": "https://github.com/Yubico/yubikey-manager/blob/5.9.1/yubikit/core/smartcard/__init__.py",
+  "vectors": [
+    {
+      "name": "short-0-0",
+      "options": {
+        "cla": 0,
+        "ins": 202,
+        "p1": 1,
+        "p2": 2,
+        "data_hex": "",
+        "le": null,
+        "extended": false
+      },
+      "expected_hex": "00ca010200"
+    },
+    {
+      "name": "short-0-1",
+      "options": {
+        "cla": 0,
+        "ins": 202,
+        "p1": 1,
+        "p2": 2,
+        "data_hex": "",
+        "le": 1,
+        "extended": false
+      },
+      "expected_hex": "00ca010201"
+    },
+    {
+      "name": "short-1-0",
+      "options": {
+        "cla": 0,
+        "ins": 202,
+        "p1": 1,
+        "p2": 2,
+        "data_hex": "00",
+        "le": null,
+        "extended": false
+      },
+      "expected_hex": "00ca01020100"
+    },
+    {
+      "name": "short-16-16",
+      "options": {
+        "cla": 0,
+        "ins": 202,
+        "p1": 1,
+        "p2": 2,
+        "data_hex": "000102030405060708090a0b0c0d0e0f",
+        "le": 16,
+        "extended": false
+      },
+      "expected_hex": "00ca010210000102030405060708090a0b0c0d0e0f10"
+    },
+    {
+      "name": "short-255-0",
+      "options": {
+        "cla": 0,
+        "ins": 202,
+        "p1": 1,
+        "p2": 2,
+        "data_hex": "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfe",
+        "le": null,
+        "extended": false
+      },
+      "expected_hex": "00ca0102ff000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfe"
+    },
+    {
+      "name": "short-255-255",
+      "options": {
+        "cla": 0,
+        "ins": 202,
+        "p1": 1,
+        "p2": 2,
+        "data_hex": "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfe",
+        "le": 255,
+        "extended": false
+      },
+      "expected_hex": "00ca0102ff000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff"
+    },
+    {
+      "name": "extended-0-0",
+      "options": {
+        "cla": 0,
+        "ins": 202,
+        "p1": 1,
+        "p2": 2,
+        "data_hex": "",
+        "le": null,
+        "extended": true
+      },
+      "expected_hex": "00ca0102"
+    },
+    {
+      "name": "extended-0-256",
+      "options": {
+        "cla": 0,
+        "ins": 202,
+        "p1": 1,
+        "p2": 2,
+        "data_hex": "",
+        "le": 256,
+        "extended": true
+      },
+      "expected_hex": "00ca0102000100"
+    },
+    {
+      "name": "extended-1-0",
+      "options": {
+        "cla": 0,
+        "ins": 202,
+        "p1": 1,
+        "p2": 2,
+        "data_hex": "00",
+        "le": null,
+        "extended": true
+      },
+      "expected_hex": "00ca010200000100"
+    },
+    {
+      "name": "extended-255-256",
+      "options": {
+        "cla": 0,
+        "ins": 202,
+        "p1": 1,
+        "p2": 2,
+        "data_hex": "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfe",
+        "le": 256,
+        "extended": true
+      },
+      "expected_hex": "00ca01020000ff000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfe0100"
+    },
+    {
+      "name": "extended-256-0",
+      "options": {
+        "cla": 0,
+        "ins": 202,
+        "p1": 1,
+        "p2": 2,
+        "data_hex": "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff",
+        "le": null,
+        "extended": true
+      },
+      "expected_hex": "00ca0102000100000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff"
+    },
+    {
+      "name": "extended-512-1024",
+      "options": {
+        "cla": 0,
+        "ins": 202,
+        "p1": 1,
+        "p2": 2,
+        "data_hex": "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff",
+        "le": 1024,
+        "extended": true
+      },
+      "expected_hex": "00ca0102000200000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff0400"
+    }
+  ]
+}

data/spec/integration/authentication_helper_oath_spec.rb

@@ -0,0 +1,117 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'tty-prompt'
+
+RSpec.describe 'AuthenticationHelper native OATH integration' do
+  let(:account) { '-例:tester@example.invalid .+  ' }
+  let(:serial) { '00123456' }
+  let(:connection) { double('offline APDU connection', descriptor: { protocol: :apdu }, close: :closed) }
+  let(:yubikey) { { account: account, confirm: true, serial: serial, connection: connection, timeout: 5 }.freeze }
+  let(:select_apdu) { ['00a4040007a0000005272101'].pack('H*') }
+  let(:list_apdu) { ['00a1000000'].pack('H*') }
+  let(:calculate_apdu) do
+    body = [0x71, account.bytesize].pack('CC') + account.b + [0x74, 8].pack('CC') + [1].pack('Q>')
+    [0, 0xa2, 0, 1, body.bytesize].pack('C*') + body
+  end
+
+  before do
+    @ready = false
+    @frames = []
+    allow(Time).to receive(:now).and_return(Time.at(59))
+    allow(TTY::Prompt).to receive(:new).and_raise('unexpected interactive prompt')
+    expect(PWN::Plugins::YubiKey::Transport).not_to receive(:open)
+    expect(connection).not_to receive(:close)
+    allow(connection).to receive(:exchange) do |request|
+      expect(@ready).to be(true)
+      expect(request[:protocol]).to eq(:apdu)
+      @frames << request[:data]
+      case request[:data]
+      when select_apdu
+        [0x79, 3, 5, 7, 1, 0x71, 8].pack('C*') + 'fixture!'.b + "\x90\0".b
+      when list_apdu
+        [0x72, account.bytesize + 1, 0x21].pack('C*') + account.b + "\x90\0".b
+      when calculate_apdu
+        [0x76, 5, 8, 12_345].pack('CCCN') + "\x90\0".b
+      else
+        raise 'Unexpected APDU in offline OATH fixture'
+      end
+    end
+  end
+
+  it 'runs the real helper, root facade, OATH.code and Protocol against a fake APDU transport' do
+    @ready = true
+    options = { yubikey: yubikey }.freeze
+    expect do
+      expect(PWN::Plugins::AuthenticationHelper.mfa(options)).to eq('00012345')
+    end.not_to output.to_stdout
+    expect(@frames).to eq([select_apdu, list_apdu, calculate_apdu])
+    expect(options[:yubikey]).to equal(yubikey)
+  end
+
+  [nil, false, 'true'].each do |confirm|
+    it "rejects unconfirmed OATH #{confirm.inspect} before any APDU or prompt" do
+      expect do
+        PWN::Plugins::AuthenticationHelper.mfa(yubikey: yubikey.merge(confirm: confirm).freeze)
+      end.to raise_error(ArgumentError, /confirm: true/)
+      expect(@frames).to be_empty
+    end
+  end
+
+  it 'propagates exact-account errors without calculation, credential repair or manual fallback' do
+    @ready = true
+    expect do
+      PWN::Plugins::AuthenticationHelper.mfa(yubikey: yubikey.merge(account: 'missing@example.invalid'))
+    end.to raise_error(PWN::Plugins::YubiKey::ResponseError, /exact account/)
+    expect(@frames).to eq([select_apdu, list_apdu])
+  end
+
+  context 'through the real GitHub login and helper' do
+    let(:browser) { double('offline browser') }
+    let(:browser_obj) { { browser: browser } }
+    let(:credential_field) { double('offline credential field', set: nil, present?: true) }
+    let(:otp_field) { double('offline OATH field', present?: true, exist?: true) }
+    let(:submit) { double('offline submit', exist?: true) }
+    let(:login_opts) { { browser_obj: browser_obj, username: 'tester@example.invalid', password: 'fake-password', mfa: false, yubikey: yubikey } }
+
+    before do
+      @authenticated = false
+      @otp_written = false
+      allow(PWN::WWW::GitHub).to receive(:sleep)
+      allow(browser).to receive(:goto)
+      allow(browser).to receive(:url) { @authenticated ? 'https://github.com/' : 'https://github.com/sessions/two-factor' }
+      allow(browser).to receive(:text_field).and_return(credential_field)
+      allow(credential_field).to receive(:wait_until).and_return(credential_field)
+      allow(browser).to receive(:text_field).with(name: 'app_otp').and_return(otp_field)
+      allow(otp_field).to receive(:wait_until) do
+        expect(@frames).to be_empty
+        @ready = true
+        otp_field
+      end
+      allow(browser).to receive(:input).with(name: 'commit').and_return(submit)
+      allow(submit).to receive(:click!) { @authenticated = true if @otp_written }
+    end
+
+    it 'types actual native OATH digits only after the authenticator field is ready' do
+      expect(otp_field).to receive(:set).with('00012345') { @otp_written = true }
+      expect(PWN::WWW::GitHub.login(login_opts)).to equal(browser_obj)
+      expect(@frames).to eq([select_apdu, list_apdu, calculate_apdu])
+    end
+
+    it 'does not touch a token for an already authenticated redirect' do
+      @authenticated = true
+      expect(otp_field).not_to receive(:set)
+      expect(PWN::WWW::GitHub.login(login_opts)).to equal(browser_obj)
+      expect(@frames).to be_empty
+    end
+
+    it 'rejects absent consent before asking for a password or navigating' do
+      expect(PWN::Plugins::AuthenticationHelper).not_to receive(:mask_password)
+      expect(browser).not_to receive(:goto)
+      expect do
+        PWN::WWW::GitHub.login(login_opts.except(:password).merge(yubikey: yubikey.except(:confirm)))
+      end.to raise_error(ArgumentError, /confirm: true/)
+      expect(@frames).to be_empty
+    end
+  end
+end

data/spec/integration/build_gate_spec.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'open3'
+require 'tmpdir'
+
+RSpec.describe 'build gate diagnostics' do
+  it 'reports the RSpec child signal rather than only a generic command failure' do
+    Dir.mktmpdir('pwn-rake-signal-') do |home|
+      spec = File.join(home, 'terminated_spec.rb')
+      File.write(spec, "RSpec.describe('fixture') { it('terminates') { Process.kill('KILL', Process.pid) } }\n")
+      output, status = Open3.capture2e({ 'HOME' => home, 'SPEC' => spec, 'SPEC_OPTS' => nil }, 'bundle', 'exec', 'rake', 'spec')
+      expect(status.success?).to be(false)
+      expect(output).to match(/RSpec child failed: (signal=KILL|exit=137)/)
+    end
+  end
+
+  it 'retains the first failure details even if a later example terminates RSpec' do
+    Dir.mktmpdir('pwn-rake-failure-') do |home|
+      spec = File.join(home, 'terminated_spec.rb')
+      File.write(spec, "RSpec.describe('fixture') { it('fails first') { expect(1).to eq(2) }; it('terminates') { Process.kill('KILL', Process.pid) } }\n")
+      output, status = Open3.capture2e({ 'HOME' => home, 'SPEC' => spec, 'SPEC_OPTS' => nil }, 'bundle', 'exec', 'rake', 'spec')
+      expect(status.success?).to be(false)
+      expect(output).to include('fixture fails first', 'expected: 2', 'got: 1')
+    end
+  end
+
+  it 'keeps a bounded log and preserves successful exit after large output' do
+    Dir.mktmpdir('pwn-build-bound-') do |home|
+      script = File.expand_path('../../scripts/build_gate.rb', __dir__)
+      output, status = Open3.capture2e({ 'HOME' => home }, RbConfig.ruby, script, RbConfig.ruby, '-e', 'puts "x" * 2_000_000; puts "finished fixture"')
+      expect(status.success?).to be(true)
+      expect(output).to include('finished fixture')
+      log = File.join(home, '.pwn', 'logs', 'build-gate.log')
+      expect(File.size(log)).to be <= 1_048_576
+      expect(File.read(log)).to include('finished fixture', 'exit=0')
+    end
+  end
+
+  it 'records a directly signalled gate without inventing a summary' do
+    Dir.mktmpdir('pwn-build-signal-') do |home|
+      script = File.expand_path('../../scripts/build_gate.rb', __dir__)
+      output, status = Open3.capture2e({ 'HOME' => home }, RbConfig.ruby, script, RbConfig.ruby, '-e', 'Process.kill("TERM", Process.pid)')
+      expect(status.exitstatus).to eq(143)
+      expect(output).to include('signal=TERM')
+      expect(File.read(File.join(home, '.pwn', 'logs', 'build-gate.log'))).to include('signal=TERM')
+    end
+  end
+
+  it 'finishes recording when both terminal streams disconnect' do
+    Dir.mktmpdir('pwn-build-disconnect-') do |home|
+      script = File.expand_path('../../scripts/build_gate.rb', __dir__)
+      reader, writer = IO.pipe
+      reader.close
+      pid = Process.spawn({ 'HOME' => home }, RbConfig.ruby, script, RbConfig.ruby, '-e', 'warn "Failures: disconnected fixture"; exit 23', out: writer, err: writer)
+      writer.close
+      expect(Process.wait2(pid).last.exitstatus).to eq(23)
+      expect(File.read(File.join(home, '.pwn', 'logs', 'build-gate.log'))).to include('Failures: disconnected fixture', 'exit=23')
+    end
+  end
+
+  it 'preserves merged failure output and the gate exit status outside the terminal stream' do
+    Dir.mktmpdir('pwn-build-gate-') do |home|
+      script = File.expand_path('../../scripts/build_gate.rb', __dir__)
+      output, status = Open3.capture2e({ 'HOME' => home }, RbConfig.ruby, script, RbConfig.ruby, '-e', '$stdout.sync = true; puts "F.F"; warn "Failures: fixture assertion"; exit 23')
+      expect(status.exitstatus).to eq(23)
+      expect(output).to include('Failures: fixture assertion', 'exit=23', 'Build gate log:')
+      log = File.join(home, '.pwn', 'logs', 'build-gate.log')
+      expect(File.read(log)).to include('F.F', 'Failures: fixture assertion', 'exit=23')
+      expect(File.stat(log).mode & 0o777).to eq(0o600)
+    end
+  end
+end

data/spec/integration/controller_spill_spec.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'open3'
+require 'tmpdir'
+require 'fileutils'
+require 'json'
+
+RSpec.describe 'controller spill boundary through actual Dispatch' do
+  %w[checkpoint transcript].each do |mode|
+    it "does not create source files when a worker redirects the parent #{mode} spill path" do
+      Dir.mktmpdir('spill-boundary-') do |root|
+        source = File.join(root, 'source')
+        home = File.join(root, 'home')
+        work = File.join(root, 'work')
+        FileUtils.mkdir_p([source, home, work])
+        fixture = File.expand_path('../support/harness/controller_spill.rb', __dir__)
+        stdout, stderr, status = Open3.capture3({ 'HOME' => home }, RbConfig.ruby, '-I', File.expand_path('../../lib', __dir__), fixture, source, work, mode, chdir: work)
+        expect(status.success?).to be(true), stderr
+        row = JSON.parse(stdout)
+        expect(row['changed']).to be(false), row.inspect
+        expect(row['dispatch_success']).to be(false)
+        expect(row['dispatch_error']).to include('Permission denied')
+      end
+    end
+  end
+
+  %w[ordinary aliased].each do |mode|
+    it "denies the #{mode} controller-state inventory while preserving workspace output" do
+      Dir.mktmpdir('controller-inventory-') do |root|
+        source = File.join(root, 'source')
+        home = File.join(root, 'home')
+        work = File.join(root, 'work')
+        FileUtils.mkdir_p([source, home, work])
+        fixture = File.expand_path('../support/harness/controller_state.rb', __dir__)
+        stdout, stderr, status = Open3.capture3({ 'HOME' => home }, RbConfig.ruby, '-I', File.expand_path('../../lib', __dir__), fixture, source, work, mode, chdir: work)
+        expect(status.success?).to be(true), stderr
+        row = JSON.parse(stdout)
+        expect(row.dig('result', 'success')).to be(true), row.inspect
+        attempts = row.dig('result', 'result')
+        expect(attempts.length).to eq(29)
+        expect(attempts.values.uniq).to eq(['denied']), attempts.inspect
+        expect(row['source_unchanged']).to be(true)
+        expect(row['output']).to eq('output remains writable')
+      end
+    end
+  end
+end

data/spec/integration/harness_process_spec.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require_relative '../support/harness/package_acceptance'
+require_relative '../support/harness/cli_faults'
+
+RSpec.describe 'harness process lifecycle' do
+  it 'preserves actual exit and stderr when startup fails before readiness' do
+    Dir.mktmpdir('pwn-harness-process-') do |root|
+      ready = File.join(root, 'ready')
+      command = [RbConfig.ruby, '-e', "warn 'unsupported architecture fixture'; exit 78"]
+      result = HarnessEvaluation.capture({ 'HOME' => root }, command, root, 1, ready_path: ready, startup_seconds: 2)
+      expect(result).to include(exit_status: 78, stderr: "unsupported architecture fixture\n", resource_cap: false, ready_observed: false, timeout_phase: nil)
+    end
+  end
+
+  it 'distinguishes a bounded boot timeout from an execution timeout' do
+    Dir.mktmpdir('pwn-harness-process-') do |root|
+      result = HarnessEvaluation.capture({ 'HOME' => root }, [RbConfig.ruby, '-e', 'sleep 60'], root, 1,
+                                         ready_path: File.join(root, 'ready'), startup_seconds: 0.05)
+      expect(result).to include(resource_cap: true, ready_observed: false, timeout_phase: 'startup', exit_status: nil, signal: Signal.list.fetch('KILL'))
+    end
+  end
+
+  it 'reports the real child failure when its fingerprint is missing, without inventing one' do
+    Dir.mktmpdir('pwn-harness-process-') do |root|
+      process = HarnessEvaluation.capture({ 'HOME' => root }, [RbConfig.ruby, '-e', "warn 'namespace unavailable'; exit 78"], root, 2)
+      File.write(File.join(root, 'initial-process.json'), JSON.generate(process))
+      row = { id: 'checkpoint-restart', artifact_root: root }
+      expect { HarnessPackageAcceptance.validate_fingerprints!([row], '/isolated/gems/pwn') }
+        .to raise_error(RuntimeError) { |error| expect(error.message).to include('checkpoint-restart', 'fingerprint', '"exit_status":78', 'namespace unavailable') }
+      expect(File.exist?(File.join(root, 'fingerprint.json'))).to be(false)
+    end
+  end
+
+  it 'records observed loaded components before an abrupt fixture exit bypasses at_exit' do
+    Dir.mktmpdir('pwn-harness-process-') do |root|
+      fixture = File.join(root, 'provider.json')
+      fingerprint = File.join(root, 'fingerprint.json')
+      File.write(fixture, JSON.generate(responses: []))
+      env = { 'HOME' => root, 'GEM_HOME' => Gem.dir, 'GEM_PATH' => Gem.path.join(File::PATH_SEPARATOR),
+              'PWN_HARNESS_FIXTURE' => fixture, 'PWN_HARNESS_EVENTS' => File.join(root, 'events.jsonl'), 'PWN_HARNESS_FINGERPRINT' => fingerprint }
+      command = [RbConfig.ruby, '-I', File.join(HarnessEvaluation::ROOT, 'lib'), '-r',
+                 File.join(HarnessEvaluation::ROOT, 'spec/support/harness/fake_provider.rb'), '-e', 'exit!(73)']
+      result = HarnessEvaluation.agent_capture(env, command, root, 5)
+      expect(result).to include(exit_status: 73, ready_observed: true)
+      expect(File.file?(fingerprint)).to be(true), result.inspect
+      expect(JSON.parse(File.read(fingerprint)).fetch('components')).not_to be_empty
+    end
+  end
+
+  it 'loads checkpoint controls across the real namespace exec boundary' do
+    Dir.mktmpdir('pwn-harness-process-') do |root|
+      fixture = File.join(root, 'provider.json')
+      runtime = File.join(root, 'runtime')
+      File.write(fixture, JSON.generate(responses: [{ fault: 'crash' }]))
+      env = { 'HOME' => root, 'PATH' => HarnessEvaluation.isolated_path, 'GEM_HOME' => Gem.dir, 'GEM_PATH' => Gem.path.join(File::PATH_SEPARATOR),
+              'PWN_HARNESS_FIXTURE' => fixture, 'PWN_HARNESS_EVENTS' => File.join(root, 'events.jsonl'),
+              'PWN_HARNESS_FINGERPRINT' => File.join(root, 'fingerprint.json'), 'PWN_HARNESS_RUNTIME' => runtime }
+      command = [RbConfig.ruby, '-I', File.join(HarnessEvaluation::ROOT, 'lib'), '-r',
+                 File.join(HarnessEvaluation::ROOT, 'spec/support/harness/fault_preload.rb'), '-e',
+                 'PWN::AI::Agent::MissionNamespace.force_exec = true; load ARGV.shift', File.join(HarnessEvaluation::ROOT, 'bin/pwn-ai'), '--ai', 'Offline checkpoint fixture']
+      result = HarnessEvaluation.agent_capture(env, command, root, 10)
+      expect(result).to include(exit_status: 73)
+      expect(File.file?(File.join(runtime, 'identity.json'))).to be(true), result.inspect
+    end
+  end
+
+  it 'does not resume a checkpoint that never started after a real child failure' do
+    Dir.mktmpdir('pwn-harness-process-') do |root|
+      failure = { exit_status: 78, resource_cap: false, ready_observed: false, stdout: '', stderr: 'namespace unavailable' }
+      allow(HarnessCLIFaults).to receive(:invoke).and_return(failure)
+      report = HarnessCLIFaults.run(output: root)
+      expect(HarnessCLIFaults).to have_received(:invoke).exactly(5).times
+      expect(report.fetch(:results)).to all(include(outcome: 'FAIL', exit_status: 78))
+    end
+  end
+
+  it 'redacts child diagnostics before reporting a missing fingerprint' do
+    Dir.mktmpdir('pwn-harness-process-') do |root|
+      row = { id: 'failed-boot', artifact_root: root, exit_status: 78, stderr: 'password=offline-secret' }
+      expect { HarnessPackageAcceptance.validate_fingerprints!([row], '/isolated/gems/pwn') }.to raise_error(RuntimeError) do |error|
+        expect(error.message).to include('REDACTED', '78')
+        expect(error.message).not_to include('offline-secret')
+      end
+    end
+  end
+
+  it 'requires fresh readiness on restart rather than accepting the previous process marker' do
+    Dir.mktmpdir('pwn-harness-process-') do |root|
+      File.write(File.join(root, 'harness-ready'), 'previous invocation')
+      command = [RbConfig.ruby, '-e', "sleep 0.2; puts 'booted'; STDOUT.flush; File.write(ENV.fetch('PWN_HARNESS_READY'), 'ready'); sleep 60"]
+      result = HarnessEvaluation.agent_capture({ 'HOME' => root }, command, root, 0.05)
+      expect(result).to include(resource_cap: true, ready_observed: true, stdout: "booted\n", timeout_phase: 'execution')
+    end
+  end
+end

data/spec/integration/mission_cancel_spec.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'open3'
+require 'tmpdir'
+require 'fileutils'
+require 'json'
+
+RSpec.describe 'mission cancellation through real subprocesses' do
+  def mission_fixture(name, *args)
+    Dir.mktmpdir('mission-cancel-') do |root|
+      home = File.join(root, 'home')
+      work = File.join(root, 'work')
+      FileUtils.mkdir_p([home, work])
+      fixture = File.expand_path("../support/harness/#{name}.rb", __dir__)
+      stdout, stderr, status = Open3.capture3({ 'HOME' => home }, RbConfig.ruby, '-I', File.expand_path('../../lib', __dir__), fixture, work, *args, chdir: work)
+      expect(status.success?).to be(true), stderr
+      JSON.parse(stdout)
+    end
+  end
+
+  it 'cancels the legacy interactive entrypoint through a native terminal and accepts its next mission' do
+    require 'pty'
+    require 'timeout'
+    Dir.mktmpdir('mission-legacy-') do |root|
+      FileUtils.mkdir_p(File.join(root, 'home'))
+      fixture = File.expand_path('../support/harness/mission_legacy.rb', __dir__)
+      PTY.spawn({ 'HOME' => File.join(root, 'home') }, RbConfig.ruby, '-I', File.expand_path('../../lib', __dir__), fixture, root, chdir: root) do |reader, writer, pid|
+        Timeout.timeout(15) { sleep 0.01 until File.exist?(File.join(root, 'ready')) }
+        writer.write("\x03")
+        output = +''
+        Timeout.timeout(15) do
+          loop { output << reader.readpartial(4096) }
+        rescue EOFError, Errno::EIO
+          nil
+        end
+        _child, status = Process.wait2(pid)
+        expect(status.success?).to be(true), output
+        row = output.lines.find { |line| line.start_with?('{') }
+        expect(JSON.parse(row)).to include('ready' => true, 'late' => false, 'second' => true, 'tty' => true)
+      ensure
+        begin
+          Process.kill('KILL', pid)
+          Process.wait(pid)
+        rescue Errno::ESRCH, Errno::ECHILD
+          nil
+        end
+      end
+    end
+  end
+
+  it 'reaps provider execution before accepting the next console mission' do
+    expect(mission_fixture('mission_console')).to include('ready' => true, 'late' => false, 'second' => true, 'fenced' => true)
+  end
+
+  it 'hard cancels local command descendants before the next mission' do
+    expect(mission_fixture('mission_console', 'command')).to include('ready' => true, 'late' => false, 'second' => true, 'fenced' => true)
+  end
+
+  it 'keeps detached tool jobs alive until their enclosing mission exits' do
+    expect(mission_fixture('mission_job_lifetime')).to include('survived_tool' => true)
+  end
+
+  it 'hard cancels independent swarm provider and tool descendants' do
+    expect(mission_fixture('mission_swarm')).to include('ready' => true, 'late' => false)
+  end
+
+  it 'fails closed and reaps startup when namespace creation is denied' do
+    expect(mission_fixture('mission_unsupported')).to include('blocked' => true, 'actionable' => true, 'reaped' => true)
+  end
+
+  it 'owns double-forked jobs on normal exit without killing unrelated processes' do
+    expect(mission_fixture('mission_normal_exit')).to include('reaped' => true, 'late' => false, 'unrelated' => true)
+  end
+
+  it 'stops and reaps a setsid descendant before cancellation returns' do
+    expect(mission_fixture('mission_dispatch')).to include('cancelled' => true, 'descendant_started' => true, 'reaped' => true, 'post_cancel_write' => false)
+  end
+end

data/spec/integration/mission_curses_pty_spec.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'pty'
+require 'io/console'
+require 'timeout'
+
+RSpec.describe 'native curses mission cancellation' do
+  %w[ordinary command].each do |mode|
+    it "handles terminal CTRL+C during #{mode} execution and accepts the next mission without late writes" do
+      Dir.mktmpdir('mission-curses-') do |root|
+        home = File.join(root, 'home')
+        work = File.join(root, 'work')
+        FileUtils.mkdir_p([home, work])
+        fixture = File.expand_path('../support/harness/mission_curses_pty.rb', __dir__)
+        PTY.spawn({ 'HOME' => home, 'TERM' => 'xterm-256color' }, RbConfig.ruby, '-I', File.expand_path('../../lib', __dir__), fixture, work, mode, chdir: work) do |reader, writer, pid|
+          writer.winsize = [32, 120]
+          output = +''
+          pump = Thread.new do
+            loop { output << reader.readpartial(4096) }
+          rescue EOFError, Errno::EIO
+            nil
+          end
+          %w[idle ready cancelled second].zip([mode == 'command' ? "/mcp fixture\r" : "first\r", "\x03", "second\r", "back\r"]).each do |marker, keys|
+            Timeout.timeout(20) { sleep 0.01 until File.exist?(File.join(work, marker)) }
+            writer.write(keys)
+          end
+          Timeout.timeout(20) { pump.join }
+          _child, status = Process.wait2(pid)
+          expect(status.success?).to be(true), output
+          expect(JSON.parse(output[/\{"ready":.*\}/])).to include('ready' => true, 'late' => false, 'second' => true, 'tty' => true)
+        ensure
+          begin
+            Process.kill('KILL', pid)
+            Process.wait(pid)
+          rescue Errno::ESRCH, Errno::ECHILD
+            nil
+          end
+          pump&.join(1)
+        end
+      end
+    end
+  end
+end

data/spec/integration/persistence_roundtrip_spec.rb

@@ -58,13 +58,7 @@ RSpec.describe 'PWN persistence stores — write → reload → delete round-tri
       expect(PWN::Cron.list.keys).not_to include(job[:id])
 
       seeded = PWN::Cron.install_defaults
-      expect(seeded.map { |j| j[:name] }).to include(
-        'curriculum_practice_nightly',
-        'curriculum_train_weekly',
-        'curriculum_offline_judge',
-        'learning_consolidate_nightly',
-        'pwn_stores_lean_nightly'
-      )
+      expect(seeded.map { |j| j[:name] }).to eq(['session_cleanup'])
       expect(PWN::Cron.install_defaults).to eq([]) # idempotent
     end
   end