@a5c-ai/kradle 5.0.1-staging.3abdf9534c25

package/tests/jitsi-agent-bridge.test.js

@@ -0,0 +1,119 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { createAgentMuxClient, createJitsiAgentBridge, createResource } from '../src/index.js';
+
+function stack(spec = {}) {
+  return createResource('AgentStack', { name: 'standup-bot', namespace: 'kradle-org-default' }, {
+    organizationRef: 'default',
+    baseAgent: 'claude-code',
+    adapter: 'claude-code',
+    runtimeIdentity: { serviceAccountRef: 'kradle' },
+    ...spec,
+  });
+}
+
+test('Jitsi agent bridge gates capability and prepares meeting context', async () => {
+  const emitted = [];
+  const bridge = createJitsiAgentBridge({
+    meetingController: {
+      async getMeeting(ref) {
+        assert.equal(ref, 'daily');
+        return {
+          metadata: { name: 'daily' },
+          spec: { roomId: 'daily-default', ttlMinutes: 30 },
+          status: { phase: 'Active', roomUrl: 'https://meet.example/daily-default' },
+        };
+      },
+      generateParticipantJwt(roomId, participant, ttlMinutes) {
+        assert.equal(roomId, 'daily-default');
+        assert.equal(participant.id, 'dispatch-1');
+        assert.equal(ttlMinutes, 30);
+        return 'kradle-jitsi.jwt.sig';
+      },
+    },
+    eventBus: { emit: (event) => emitted.push(event) },
+    now: () => new Date('2026-05-30T12:00:00Z'),
+  });
+
+  assert.equal(bridge.hasMeetingCapability(stack()), false);
+  assert.equal(bridge.hasMeetingCapability(stack({ jitsiCapability: true })), true);
+
+  const run = { metadata: { name: 'dispatch-1' }, spec: {}, status: {} };
+  const context = await bridge.prepareMeetingContext(run, 'daily', stack({
+    jitsiCapability: true,
+    jitsiConfig: { participantName: 'Standup Bot', role: 'observer', capabilities: { chat: 'readwrite', audio: 'listen' } },
+  }));
+  assert.equal(context.roomUrl, 'https://meet.example/daily-default');
+  assert.equal(context.jwt, 'kradle-jitsi.jwt.sig');
+  assert.equal(context.role, 'observer');
+  assert.equal(run.spec.meetingRef, 'daily');
+  assert.equal(run.spec.meetingContext.roomId, 'daily-default');
+  assert.equal(run.spec.meetingContext.jwt, undefined);
+  assert.deepEqual(run.spec.meetingContext.tokenRef, { runtimeOnly: true });
+
+  await bridge.onAgentJoined('dispatch-1', 'daily');
+  await bridge.onAgentLeft('dispatch-1', 'daily', 'completed');
+  assert.deepEqual(emitted.map((event) => event.type), ['agent-joined-meeting', 'agent-left-meeting', 'participant-left']);
+});
+
+test('Jitsi agent bridge can resolve meetings from resources and keeps generated JWT runtime-only', async () => {
+  const bridge = createJitsiAgentBridge({ now: () => new Date('2026-05-30T12:00:00Z') });
+  const run = { metadata: { name: 'dispatch-1' }, spec: {}, status: {} };
+  const context = await bridge.prepareMeetingContext(run, 'daily', stack({
+    jitsiCapability: true,
+    jitsiConfig: { role: 'participant', capabilities: { chat: 'readwrite', audio: 'listen' } },
+  }), {
+    resources: {
+      JitsiMeeting: [
+        createResource('JitsiMeeting', { name: 'daily', namespace: 'kradle-org-default' }, {
+          organizationRef: 'default',
+          providerRef: 'jitsi-prod',
+          roomId: 'daily-default',
+          ttlMinutes: 30,
+        }, {
+          phase: 'Active',
+          roomUrl: 'https://meet.example/daily-default',
+        }),
+      ],
+    },
+  });
+
+  assert.match(context.jwt, /^kradle-jitsi\./);
+  assert.equal(run.spec.meetingContext.jwt, undefined);
+  assert.equal(run.spec.meetingContext.role, 'participant');
+});
+
+test('Jitsi agent bridge builds sidecar specs and Agent Mux injects them only for meeting runs', () => {
+  const bridge = createJitsiAgentBridge({
+    sidecarImage: 'ghcr.io/a5c-ai/jitsi-agent-sidecar:test',
+  });
+  const sidecar = bridge.buildSidecarSpec('https://meet.example/daily-default', 'kradle-jitsi.jwt.sig', 'Standup Bot', {
+    roomId: 'daily-default',
+    role: 'observer',
+    capabilities: { audio: 'listen', chat: 'readwrite' },
+  });
+  assert.equal(sidecar.name, 'jitsi-agent-sidecar');
+  assert.equal(sidecar.image, 'ghcr.io/a5c-ai/jitsi-agent-sidecar:test');
+  assert.equal(sidecar.env.find((entry) => entry.name === 'JITSI_ROOM_URL').value, 'https://meet.example/daily-default');
+  assert.equal(sidecar.env.find((entry) => entry.name === 'JITSI_CHAT_MODE').value, 'readwrite');
+
+  const client = createAgentMuxClient();
+  const plainJob = client.createAgentJob({ adapter: 'claude-code', org: 'default' }).jobManifest;
+  assert.equal(plainJob.spec.template.spec.containers.length, 1);
+
+  const meetingJob = client.createAgentJob({
+    adapter: 'claude-code',
+    org: 'default',
+    meetingContext: {
+      roomUrl: 'https://meet.example/daily-default',
+      jwt: 'kradle-jitsi.jwt.sig',
+      roomId: 'daily-default',
+      participantName: 'Standup Bot',
+      role: 'observer',
+      capabilities: { audio: 'listen', chat: 'readwrite' },
+    },
+  }).jobManifest;
+  assert.equal(meetingJob.spec.template.spec.containers.length, 2);
+  assert.ok(meetingJob.spec.template.spec.containers[0].env.some((entry) => entry.name === 'JITSI_MEETING_ACTIVE' && entry.value === 'true'));
+  assert.ok(meetingJob.spec.template.spec.volumes.some((volume) => volume.name === 'agent-socket'));
+});

package/tests/jitsi-helm-integration.test.js

@@ -0,0 +1,77 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import test from 'node:test';
+
+const chart = readFileSync(new URL('../../charts/Chart.yaml', import.meta.url), 'utf8');
+const values = readFileSync(new URL('../../charts/values.yaml', import.meta.url), 'utf8');
+const networkPolicy = readFileSync(new URL('../../charts/templates/networkpolicy.yaml', import.meta.url), 'utf8');
+const secrets = readFileSync(new URL('../../charts/templates/jitsi-secrets.yaml', import.meta.url), 'utf8');
+const jitsiCrds = readFileSync(new URL('../../charts/crds/jitsi-resources.yaml', import.meta.url), 'utf8');
+const agentCrds = readFileSync(new URL('../../charts/crds/agent-resources.yaml', import.meta.url), 'utf8');
+const aggregatedCrds = readFileSync(new URL('../../charts/crds/aggregated-resources.yaml', import.meta.url), 'utf8');
+const externalCrds = readFileSync(new URL('../../charts/crds/external-resources.yaml', import.meta.url), 'utf8');
+
+test('Kradle chart declares the Jitsi Meet subchart dependency behind jitsi.install', () => {
+  assert.match(chart, /name:\s+jitsi-meet/);
+  assert.match(chart, /repository:\s+https:\/\/jitsi-contrib\.github\.io\/jitsi-helm\//);
+  assert.match(chart, /condition:\s+jitsi\.install/);
+  assert.match(chart, /alias:\s+jitsi-subchart/);
+});
+
+test('values expose internal and external Jitsi deployment settings', () => {
+  for (const term of [
+    'jitsi:',
+    'install: false',
+    'external:',
+    'publicURL: https://meet.kradle.local',
+    'jwtAppSecret:',
+    'web:',
+    'prosody:',
+    'type: jwt',
+    'existingSecretName:',
+    'jicofo:',
+    'jvb:',
+    'useNodeIP: true',
+    'UDPPort: 10000',
+    'udpPort: 10000',
+    'jibri:',
+    'recordingStorageClass:',
+    'jitsi-subchart:',
+  ]) {
+    assert.ok(values.includes(term), `values.yaml should include ${term}`);
+  }
+  assert.match(values, /jitsi-subchart:[\s\S]*prosody:\n\s+<<: \*jitsiProsody[\s\S]*secretEnvs:\n\s+JWT_APP_SECRET: ""[\s\S]*jwt:\n\s+secret: ""\n\s+existingSecretName: ""/);
+});
+
+test('Jitsi CRDs are installed from a dedicated chart CRD file', () => {
+  const expectedKinds = ['JitsiMeetProvider', 'JitsiMeetingTemplate', 'JitsiMeeting', 'JitsiRecording'];
+  for (const kind of expectedKinds) {
+    assert.match(jitsiCrds, new RegExp(`kind:\\s+${kind}`));
+  }
+  assert.match(jitsiCrds, /required:\n\s+- organizationRef/);
+  assert.match(jitsiCrds, /name:\s+jitsimeetproviders\.kradle\.a5c\.ai/);
+  assert.match(jitsiCrds, /name:\s+jitsimeetings\.kradle\.a5c\.ai/);
+});
+
+test('Jitsi CRDs are not duplicated in non-Jitsi chart CRD bundles', () => {
+  for (const crdBundle of [agentCrds, aggregatedCrds, externalCrds]) {
+    assert.doesNotMatch(crdBundle, /name:\s+jitsi(?:meetproviders|meetingtemplates|meetings|recordings)\.kradle\.a5c\.ai/);
+  }
+});
+
+test('chart templates manage Jitsi secrets without committing literal credentials', () => {
+  assert.match(secrets, /jitsi-jwt/);
+  assert.match(secrets, /appSecret:\s+\{\{ \$jwtAppSecret \| quote \}\}/);
+  assert.match(secrets, /jitsi-webhook/);
+  assert.match(secrets, /webhookExistingSecret/);
+  assert.match(secrets, /webhookSecret:\s+\{\{ \.Values\.jitsi\.kradle\.webhookSecret \| quote \}\}/);
+});
+
+test('network policy opens JVB UDP media traffic only when Jitsi is installed', () => {
+  assert.match(networkPolicy, /if \.Values\.jitsi\.install/);
+  assert.match(networkPolicy, /jitsi-media/);
+  assert.match(networkPolicy, /component/);
+  assert.match(networkPolicy, /jvb/);
+  assert.match(networkPolicy, /protocol:\s+UDP/);
+  assert.match(networkPolicy, /port:\s+\{\{ \.Values\.jitsi\.jvb\.service\.udpPort \| default 10000 \}\}/);
+});

package/tests/jitsi-meeting-controller.test.js

@@ -0,0 +1,170 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { createJitsiMeetingController, createResource } from '../src/index.js';
+
+function meeting(overrides = {}) {
+  return createResource('JitsiMeeting', { name: 'daily', namespace: 'kradle-org-default' }, {
+    organizationRef: 'default',
+    providerRef: 'jitsi-prod',
+    roomId: 'daily-default',
+    displayName: 'Daily',
+    ttlMinutes: 30,
+    ...overrides.spec,
+  }, {
+    phase: 'Scheduled',
+    participants: { current: [], total: 0, peak: 0 },
+    recording: { active: false, recordingId: null },
+    ...overrides.status,
+  });
+}
+
+test('Jitsi meeting controller validates required meeting resources and JWT claims', () => {
+  const controller = createJitsiMeetingController({ jwtSecret: 'test-secret', now: () => new Date('2026-05-30T12:00:00Z') });
+  const valid = meeting();
+
+  assert.equal(controller.validate(valid), valid);
+  assert.throws(() => controller.validate(meeting({ spec: { roomId: '' } })), /JitsiMeeting spec.roomId is required/);
+
+  const jwt = controller.generateParticipantJwt('daily-default', {
+    id: 'agent-run-1',
+    name: 'Standup Bot',
+    type: 'agent',
+    role: 'observer',
+  }, 15);
+  const [header, encoded, signature] = jwt.split('.');
+  assert.ok(header);
+  assert.ok(signature);
+  const claims = JSON.parse(Buffer.from(encoded, 'base64url').toString('utf8'));
+  assert.equal(claims.aud, 'jitsi');
+  assert.equal(claims.iss, 'kradle');
+  assert.equal(claims.room, 'daily-default');
+  assert.equal(claims.context.user.id, 'agent-run-1');
+  assert.equal(claims.context.user.name, 'Standup Bot');
+  assert.equal(claims.context.user.type, 'agent');
+  assert.equal(claims.context.user.role, 'observer');
+  assert.equal(claims.exp, Math.floor(new Date('2026-05-30T12:15:00Z').getTime() / 1000));
+});
+
+test('Jitsi meeting controller delegates room lifecycle, recording, stats, and emits events', async () => {
+  const persisted = [];
+  const emitted = [];
+  const providerCalls = [];
+  const resources = [meeting({ status: { phase: 'Active', roomUrl: 'https://meet.example/daily-default' } })];
+  const providers = [
+    createResource('JitsiMeetProvider', { name: 'jitsi-prod', namespace: 'kradle-org-default' }, {
+      organizationRef: 'default',
+      endpoint: 'https://meet.example',
+      authMode: 'jwt',
+      defaultRoomTTL: 90,
+      defaultRoomConfig: { lobby: true },
+    }),
+  ];
+  const templates = [
+    createResource('JitsiMeetingTemplate', { name: 'standup', namespace: 'kradle-org-default' }, {
+      organizationRef: 'default',
+      providerRef: 'jitsi-prod',
+      displayName: 'Standup',
+      ttlMinutes: 45,
+      roomConfig: { startWithAudioMuted: true },
+    }),
+  ];
+  const recordings = [];
+  const controller = createJitsiMeetingController({
+    jwtSecret: 'test-secret',
+    providerClient: {
+      async createRoom(spec) {
+        providerCalls.push(['createRoom', spec.roomId, spec.ttlMinutes, spec.roomConfig]);
+        return { roomUrl: `https://meet.example/${spec.roomId}` };
+      },
+      async endRoom(roomId) { providerCalls.push(['endRoom', roomId]); return { ended: true }; },
+      async getRoom(roomId) { providerCalls.push(['getRoom', roomId]); return { phase: 'Active', participantCount: 2 }; },
+      async getStats(roomId) { providerCalls.push(['getStats', roomId]); return { participantCount: 2, active: true }; },
+      async startRecording(roomId) { providerCalls.push(['startRecording', roomId]); return { recordingId: 'rec-1' }; },
+      async stopRecording(roomId) { providerCalls.push(['stopRecording', roomId]); return { recordingId: 'rec-1', duration: 120 }; },
+    },
+    resourceGateway: {
+      async list(kind) { assert.equal(kind, 'JitsiMeeting'); return { items: resources }; },
+      async apply(resource) {
+        persisted.push(resource);
+        if (resource.kind === 'JitsiRecording') recordings.push(resource);
+        return { resource };
+      },
+      async get(kind, name) {
+        if (kind === 'JitsiMeetProvider') return providers.find((resource) => resource.metadata.name === name);
+        if (kind === 'JitsiMeetingTemplate') return templates.find((resource) => resource.metadata.name === name);
+        if (kind === 'JitsiRecording') return recordings.find((resource) => resource.metadata.name === name);
+        assert.equal(kind, 'JitsiMeeting');
+        return resources.find((resource) => resource.metadata.name === name);
+      },
+    },
+    eventBus: { emit(event) { emitted.push(event); } },
+    now: () => new Date('2026-05-30T12:00:00Z'),
+  });
+
+  const created = await controller.createRoom({ organizationRef: 'default', providerRef: 'jitsi-prod', templateRef: 'standup', roomId: 'daily-default', displayName: 'Daily', roomConfig: { startWithVideoMuted: true } });
+  assert.equal(created.status.phase, 'Active');
+  assert.equal(created.status.roomUrl, 'https://meet.example/daily-default');
+  assert.equal(created.spec.ttlMinutes, 45);
+  assert.deepEqual(created.spec.roomConfig, { lobby: true, startWithAudioMuted: true, startWithVideoMuted: true });
+  assert.equal(emitted.at(-1).type, 'meeting-created');
+
+  const active = await controller.listActiveMeetings('default');
+  assert.equal(active.length, 1);
+
+  const reconciled = await controller.reconcile(resources[0]);
+  assert.equal(reconciled.status.participants.total, 2);
+
+  assert.deepEqual(await controller.getMeetingStats('daily-default'), { participantCount: 2, active: true });
+  assert.equal((await controller.startRecording('daily')).status.recording.recordingId, 'rec-1');
+  assert.equal(recordings.at(-1).status.phase, 'Recording');
+  assert.equal(emitted.at(-1).type, 'recording-started');
+  assert.equal((await controller.stopRecording('daily')).status.recording.active, false);
+  assert.equal(recordings.at(-1).status.phase, 'Completed');
+  assert.equal(recordings.at(-1).status.duration, 120);
+  assert.equal((await controller.endRoom('daily-default')).status.phase, 'Ended');
+  assert.deepEqual(providerCalls.map(([name]) => name), ['createRoom', 'getRoom', 'getStats', 'startRecording', 'stopRecording', 'endRoom']);
+  assert.ok(persisted.length >= 4);
+});
+
+test('Jitsi meeting controller auto-dispatches template agents when autoJoin is enabled', async () => {
+  const calls = [];
+  const activeMeeting = meeting({
+    spec: {
+      templateRef: 'standup-template',
+    },
+    status: { phase: 'Active', roomUrl: 'https://meet.example/daily-default' },
+  });
+  const controller = createJitsiMeetingController({
+    resourceGateway: {
+      async list() { return { items: [activeMeeting] }; },
+      async get() { return activeMeeting; },
+    },
+    dispatchController: {
+      async createManualDispatch(input) {
+        calls.push(input);
+        return { error: false, run: { metadata: { name: `run-${calls.length}` } } };
+      },
+    },
+  });
+
+  const results = await controller.dispatchAutoJoinAgents('daily', {
+    resources: {
+      JitsiMeetingTemplate: [
+        createResource('JitsiMeetingTemplate', { name: 'standup-template', namespace: 'kradle-org-default' }, {
+          organizationRef: 'default',
+          providerRef: 'jitsi-prod',
+          displayName: 'Standup',
+          agentConfig: { autoJoin: true },
+          participants: { autoInvite: [{ type: 'agentStack', ref: 'standup-bot' }] },
+        }),
+      ],
+    },
+    repository: 'repo',
+    ref: 'main',
+  });
+
+  assert.equal(results.length, 1);
+  assert.equal(calls[0].agentStack, 'standup-bot');
+  assert.equal(calls[0].meetingRef, 'daily');
+  assert.equal(calls[0].taskKind, 'meeting');
+});

package/tests/jitsi-resource-model.test.js

@@ -0,0 +1,73 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { createResource, listResourceDefinitions, resourceSchemaForKind, storageClassForKind, validateResource } from '../src/index.js';
+
+const JITSI_KINDS = {
+  JitsiMeetProvider: {
+    storage: 'etcd',
+    context: 'external-backends',
+    plural: 'jitsimeetproviders',
+    requiredSpec: ['organizationRef', 'endpoint', 'authMode'],
+    validSpec: { organizationRef: 'default', endpoint: 'https://meet.kradle.local', authMode: 'jwt' },
+  },
+  JitsiMeetingTemplate: {
+    storage: 'etcd',
+    context: 'agents',
+    plural: 'jitsimeetingtemplates',
+    requiredSpec: ['organizationRef', 'providerRef', 'displayName'],
+    validSpec: { organizationRef: 'default', providerRef: 'jitsi-prod', displayName: 'Daily Standup' },
+  },
+  JitsiMeeting: {
+    storage: 'postgres',
+    context: 'agents',
+    plural: 'jitsimeetings',
+    requiredSpec: ['organizationRef', 'providerRef', 'roomId'],
+    validSpec: { organizationRef: 'default', providerRef: 'jitsi-prod', roomId: 'standup-20260530-default' },
+  },
+  JitsiRecording: {
+    storage: 'postgres',
+    context: 'agents',
+    plural: 'jitsirecordings',
+    requiredSpec: ['organizationRef', 'meetingRef', 'providerRef'],
+    validSpec: { organizationRef: 'default', meetingRef: 'standup-2026-05-30', providerRef: 'jitsi-prod' },
+  },
+};
+
+test('Jitsi resource kinds are registered with #624 frozen storage contracts', () => {
+  const definitions = listResourceDefinitions();
+  for (const [kind, expected] of Object.entries(JITSI_KINDS)) {
+    const definition = definitions.find((entry) => entry.kind === kind);
+    assert.ok(definition, `${kind} must be present in listResourceDefinitions`);
+    assert.equal(definition.storage, expected.storage);
+    assert.equal(definition.context, expected.context);
+    assert.equal(definition.plural, expected.plural);
+    assert.deepEqual(definition.requiredSpec, expected.requiredSpec);
+    assert.equal(storageClassForKind(kind), expected.storage);
+  }
+});
+
+test('Jitsi resource schemas expose documented required spec fields', () => {
+  for (const [kind, expected] of Object.entries(JITSI_KINDS)) {
+    const schema = resourceSchemaForKind(kind);
+    assert.equal(schema.kind, kind);
+    assert.equal(schema.plural, expected.plural);
+    assert.equal(schema.storage, expected.storage);
+    assert.deepEqual(schema.required.spec, expected.requiredSpec);
+  }
+});
+
+test('Jitsi resources validate required org-scoped specs', () => {
+  for (const [kind, expected] of Object.entries(JITSI_KINDS)) {
+    const resource = createResource(kind, { name: kind.toLowerCase(), namespace: 'kradle-org-default' }, expected.validSpec);
+    assert.equal(resource.kind, kind);
+    assert.equal(validateResource(resource), resource);
+
+    for (const field of expected.requiredSpec) {
+      const invalid = createResource(kind, { name: `${kind.toLowerCase()}-missing-${field}` }, {
+        ...expected.validSpec,
+        [field]: '',
+      });
+      assert.throws(() => validateResource(invalid), new RegExp(`${kind} spec.${field} is required`));
+    }
+  }
+});

package/tests/jitsi-sync-controller.test.js

@@ -0,0 +1,112 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { createJitsiSyncController } from '../src/index.js';
+
+test('Jitsi sync controller normalizes room, participant, and recording events', async () => {
+  const persisted = [];
+  const emitted = [];
+  const controller = createJitsiSyncController({
+    persistFn: async (resource) => persisted.push(resource),
+    eventBus: { emit: (event) => emitted.push(event) },
+    now: () => new Date('2026-05-30T12:00:00Z'),
+  });
+
+  const normalized = controller.normalizeEvent({
+    type: 'participant_joined',
+    room: 'daily-default',
+    participant: { id: 'alice', name: 'Alice', type: 'user' },
+    providerRef: 'jitsi-prod',
+    timestamp: '2026-05-30T12:01:00Z',
+  });
+  assert.equal(normalized.eventType, 'participant-joined');
+  assert.equal(normalized.roomId, 'daily-default');
+  assert.equal(normalized.participant.id, 'alice');
+
+  const active = await controller.syncRoom('daily-default', {
+    eventType: 'room-created',
+    organizationRef: 'default',
+    providerRef: 'jitsi-prod',
+    roomUrl: 'https://meet.example/daily-default',
+    displayName: 'Daily',
+  });
+  assert.equal(active.kind, 'JitsiMeeting');
+  assert.equal(active.status.phase, 'Active');
+  assert.equal(emitted.at(-1).type, 'meeting-created');
+
+  await controller.syncParticipant('daily-default', {
+    eventType: 'participant-joined',
+    participant: { id: 'alice', name: 'Alice', type: 'user', audioMuted: false },
+    organizationRef: 'default',
+  });
+  const joinedAgain = await controller.syncParticipant('daily-default', {
+    eventType: 'participant-joined',
+    participant: { id: 'alice', name: 'Alice Updated', type: 'user' },
+    organizationRef: 'default',
+  });
+  assert.equal(joinedAgain.status.participants.current.length, 1, 'participant join must be idempotent by id');
+  assert.equal(joinedAgain.status.participants.total, 1);
+  assert.equal(joinedAgain.status.participants.peak, 1);
+  assert.equal(emitted.at(-1).type, 'participant-joined');
+
+  const left = await controller.syncParticipant('daily-default', {
+    eventType: 'participant-left',
+    participant: { id: 'alice', type: 'user' },
+    organizationRef: 'default',
+  });
+  assert.equal(left.status.participants.current.length, 0);
+  assert.equal(left.status.participants.total, 1);
+  assert.equal(left.status.participants.peak, 1);
+  assert.equal(emitted.at(-1).type, 'participant-left');
+
+  const recording = await controller.syncRecording('daily-default', {
+    eventType: 'recording-started',
+    recordingId: 'rec-1',
+    organizationRef: 'default',
+    providerRef: 'jitsi-prod',
+    meetingRef: 'daily-default',
+  });
+  assert.equal(recording.kind, 'JitsiRecording');
+  assert.equal(recording.status.phase, 'Recording');
+  assert.equal(emitted.at(-1).type, 'recording-started');
+
+  const stopped = await controller.syncRecording('daily-default', {
+    eventType: 'recording-stopped',
+    recordingId: 'rec-1',
+    duration: 120,
+    organizationRef: 'default',
+  });
+  assert.equal(stopped.status.phase, 'Completed');
+  assert.equal(stopped.status.duration, 120);
+
+  const ended = await controller.syncRoom('daily-default', { eventType: 'room-destroyed', organizationRef: 'default' });
+  assert.equal(ended.status.phase, 'Ended');
+  const duplicate = await controller.syncParticipant('daily-default', {
+    eventType: 'participant-joined',
+    deliveryId: 'delivery-1',
+    participant: { id: 'bob', name: 'Bob', type: 'user' },
+    organizationRef: 'default',
+  });
+  const duplicateAgain = await controller.syncParticipant('daily-default', {
+    eventType: 'participant-joined',
+    deliveryId: 'delivery-1',
+    participant: { id: 'charlie', name: 'Charlie', type: 'user' },
+    organizationRef: 'default',
+  });
+  assert.deepEqual(duplicateAgain.status.participants.current, duplicate.status.participants.current);
+  assert.ok(persisted.some((resource) => resource.kind === 'JitsiMeeting'));
+  assert.ok(persisted.some((resource) => resource.kind === 'JitsiRecording'));
+});
+
+test('Jitsi sync controller maintains monotonic org-scoped provider watermarks', async () => {
+  const persisted = [];
+  const controller = createJitsiSyncController({ persistFn: (resource) => persisted.push(resource) });
+
+  await controller.updateWatermark('jitsi-prod', '2026-05-30T12:00:00Z', { organizationRef: 'default' });
+  await controller.updateWatermark('jitsi-prod', '2026-05-30T11:00:00Z', { organizationRef: 'default' });
+  await controller.updateWatermark('jitsi-prod', '2026-05-30T12:05:00Z', { organizationRef: 'default' });
+
+  assert.equal(controller.getWatermark('jitsi-prod'), '2026-05-30T12:05:00Z');
+  assert.equal(persisted.filter((resource) => resource.kind === 'ExternalSyncState').length, 2);
+  assert.equal(persisted.at(-1).metadata.namespace, 'kradle-org-default');
+  assert.equal(persisted.at(-1).spec.organizationRef, 'default');
+});