@agenthippo-ai/agenthippo 0.2.3-dataplane → 1.110.11

package/out/test/serve-cron-acceptance.test.js

@@ -0,0 +1,370 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Cron acceptance — PLAN/agent-identity.md §5, build record §10.4.
+ *
+ *  THE GOAL, stated as a claim an operator would hold us to:
+ *
+ *    "A nightly job runs unattended, indefinitely, reaching data as the deployment's own
+ *     identity — in one container, with its spend attributed to that identity, and it stops
+ *     the moment the control plane says so."
+ *
+ *  Every clause of that is a separate way the mechanism can be wrong, and the previous tests
+ *  covered the pieces in isolation: the limiter arithmetic in one, the key derivation in another,
+ *  the lease gate in a third. None of them ran the COMPOSITION, because the composition lived in a
+ *  closure reachable only through a live OpenClaw websocket.
+ *
+ *  So this drives `runBridgeTurn` — the exact function the bridge's messageHandler calls — with a
+ *  real TurnLimiter, a real TurnRegistry, a real credential scope and a real warrant minter. The
+ *  only fakes are the things outside the mechanism under test: the engine runner, and the clock of
+ *  "which night is it". No OpenClaw, no gateway socket, no cron daemon.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const serve_1 = require("../cli/commands/serve");
+const serve_hardening_1 = require("../cli/serve-hardening");
+const data_plane_1 = require("../cli/data-plane");
+const credential_context_1 = require("../cli/credential-context");
+const lease_1 = require("../pack/lease");
+const node_stream_1 = require("node:stream");
+const sandboxRunner_1 = require("../sandbox/sandboxRunner");
+const host_1 = require("../runner/host");
+const SERVICE_IDENTITY = 'svc:invoice-agent';
+/** Deliberately small, so "past the cap" is reachable in a test the way it is over a month. */
+const TURN_CAP = 3;
+/** One nightly cron firing: a bridge message with NO peer, which is what "no human" looks like. */
+function cronFiring() {
+    return { peerInfo: undefined, emitter: undefined, engineId: undefined };
+}
+function harness(over = {}) {
+    const runs = [];
+    const prepared = [];
+    const statePushes = [];
+    const registry = over.registry ?? new data_plane_1.TurnRegistry();
+    const releases = [];
+    const runner = {
+        run: async (req) => {
+            runs.push({
+                sessionId: req.sessionId,
+                sandboxKey: req.sandboxKey,
+                analyticsUserId: req.analyticsUserId,
+                gatewaySessionKey: req.gatewaySessionKey,
+                // Read the AMBIENT credential exactly as mintSandboxInferenceWarrant does
+                // (`currentCredential()?.userId ?? anon:<sandboxKey>`), so this observes the real
+                // attribution rather than asserting on a parameter we passed in ourselves.
+                credentialUserId: (0, credential_context_1.currentCredential)()?.userId,
+                turnEnv: req.turnEnv,
+            });
+            return { success: true };
+        },
+    };
+    const deps = {
+        engine: 'claude',
+        defaultModel: 'model-x',
+        runner,
+        permissions: { fileAccess: 'read-only' },
+        workspace: '/tmp/cron-acceptance',
+        turnGate: new serve_hardening_1.TurnGate(10, 10),
+        rateLimiter: new serve_hardening_1.RateLimiter(0),
+        turnLimiter: new serve_hardening_1.TurnLimiter(TURN_CAP),
+        warnGateReject: () => undefined,
+        prepareSession: async (k) => { prepared.push(k); },
+        sandboxScope: 'session',
+        onTurnComplete: (k) => { statePushes.push(k); },
+        logWarrantDenied: () => () => undefined,
+        registerTurn: async (reg) => {
+            const { nonce, release } = registry.register({
+                userId: reg.userId, sessionKey: reg.sessionKey, egressStoreKey: reg.egressStoreKey,
+            });
+            return {
+                nonce,
+                env: { AGENTHIPPO_TURN_NONCE: nonce },
+                release: () => { releases.push(nonce); release(); },
+            };
+        },
+        serviceUserIfPermitted: async () => {
+            const identity = over.identity ?? SERVICE_IDENTITY;
+            const gate = (0, lease_1.resolveAllowServiceTurns)({
+                lease: over.leaseAllows,
+                managed: over.managed ?? true,
+            });
+            return gate.allowed ? identity : undefined;
+        },
+    };
+    return { deps, runs, prepared, statePushes, registry, releases };
+}
+suite('cron acceptance: an unattended job runs indefinitely, in one sandbox, as itself', function () {
+    this.timeout(20_000);
+    test(`${TURN_CAP + 2} consecutive nightly runs ALL succeed — past a cap that never resets`, async () => {
+        const h = harness({ leaseAllows: true });
+        const outcomes = [];
+        for (let night = 1; night <= TURN_CAP + 2; night++) {
+            const r = await (0, serve_1.runBridgeTurn)(h.deps, `nightly run ${night}`, cronFiring());
+            outcomes.push(r.success);
+        }
+        assert.deepStrictEqual(outcomes, [true, true, true, true, true], 'a false here is the nightly-job death: TurnLimiter is monotonic with no window, so a '
+            + 'stable session key would exhaust a LIFETIME budget one night at a time');
+        assert.strictEqual(h.runs.length, TURN_CAP + 2, 'every run must have reached the engine');
+    });
+    test('…in ONE sandbox, not one per night', async () => {
+        const h = harness({ leaseAllows: true });
+        for (let night = 1; night <= TURN_CAP + 2; night++) {
+            await (0, serve_1.runBridgeTurn)(h.deps, `night ${night}`, cronFiring());
+        }
+        const sandboxes = new Set(h.runs.map((r) => r.sandboxKey));
+        assert.strictEqual(sandboxes.size, 1, `expected one warm sandbox across all runs, got ${sandboxes.size}: ${[...sandboxes].join(', ')}`);
+        assert.strictEqual([...sandboxes][0], `gateway-${SERVICE_IDENTITY}`);
+        // …while the conversation itself is fresh each night. Both halves matter: a shared sandbox
+        // with a shared session key would re-introduce the limiter defect.
+        const sessions = new Set(h.runs.map((r) => r.sessionId));
+        assert.strictEqual(sessions.size, TURN_CAP + 2, 'each run needs its own session key');
+    });
+    test('…with no session state restored or accumulated per run', async () => {
+        const h = harness({ leaseAllows: true });
+        for (let night = 1; night <= 3; night++) {
+            await (0, serve_1.runBridgeTurn)(h.deps, `night ${night}`, cronFiring());
+        }
+        assert.deepStrictEqual(h.prepared, [], 'a never-reused key has no prior state to restore');
+        assert.deepStrictEqual(h.statePushes, [], 'and nothing will ever look it up again');
+    });
+    test('…reaching data as the service identity, with a live nonce for the turn only', async () => {
+        const registry = new data_plane_1.TurnRegistry();
+        const h = harness({ leaseAllows: true, registry });
+        await (0, serve_1.runBridgeTurn)(h.deps, 'nightly', cronFiring());
+        const nonce = h.runs[0].turnEnv?.AGENTHIPPO_TURN_NONCE;
+        assert.ok(nonce, 'the engine must receive a per-turn nonce');
+        // The turn is released in the handler's `finally`, so by now the capability must be dead.
+        assert.strictEqual(registry.resolve(nonce), undefined, 'the nonce must not outlive the run that minted it');
+        assert.strictEqual(h.releases.length, 1);
+    });
+    test('…with SPEND attributed to the service identity, never to anon:', async () => {
+        const h = harness({ leaseAllows: true });
+        await (0, serve_1.runBridgeTurn)(h.deps, 'nightly', cronFiring());
+        // This is what mintSandboxInferenceWarrant reads. Registering the turn without ALSO
+        // scoping the credential would give the bot data access while its spend escaped the
+        // per-user meter — the failure the design calls out as easy to miss and expensive.
+        assert.strictEqual(h.runs[0].credentialUserId, SERVICE_IDENTITY);
+    });
+    test('…and named in analytics, so the two attribution channels agree', async () => {
+        const h = harness({ leaseAllows: true });
+        await (0, serve_1.runBridgeTurn)(h.deps, 'nightly', cronFiring());
+        assert.strictEqual(h.runs[0].analyticsUserId, SERVICE_IDENTITY);
+        assert.strictEqual(h.runs[0].analyticsUserId, h.runs[0].credentialUserId, 'Spotlight and the warrant must name the same principal');
+    });
+    test('…replying to the same channel every night, though the session moves', async () => {
+        const h = harness({ leaseAllows: true });
+        const firing = { ...cronFiring(), gatewaySessionKey: 'slack-C0FEED' };
+        await (0, serve_1.runBridgeTurn)(h.deps, 'night 1', firing);
+        await (0, serve_1.runBridgeTurn)(h.deps, 'night 2', firing);
+        assert.deepStrictEqual(h.runs.map((r) => r.gatewaySessionKey), ['slack-C0FEED', 'slack-C0FEED'], 'the egress broker resolves reply destinations from this key');
+        assert.notStrictEqual(h.runs[0].sessionId, h.runs[1].sessionId);
+    });
+    test('…and stopping the moment the control plane revokes it — mid-schedule, no restart', async () => {
+        let allowed = true;
+        const h = harness({ leaseAllows: true });
+        // Re-point the gate at a value the "control plane" can flip between polls.
+        h.deps.serviceUserIfPermitted = async () => ((0, lease_1.resolveAllowServiceTurns)({ lease: allowed, managed: true }).allowed ? SERVICE_IDENTITY : undefined);
+        await (0, serve_1.runBridgeTurn)(h.deps, 'night 1', cronFiring());
+        assert.strictEqual(h.runs.length, 1);
+        allowed = false; // operator clicks "stop allowing unattended runs"
+        await (0, serve_1.runBridgeTurn)(h.deps, 'night 2', cronFiring());
+        assert.strictEqual(h.runs.length, 2, 'the turn still runs — revoking the identity is not a kill switch');
+        assert.strictEqual(h.runs[1].credentialUserId, undefined, 'but it runs as NOBODY: no identity, so no data authority');
+        assert.strictEqual(h.runs[1].turnEnv, undefined, 'and no nonce is minted, so the data gateway fails it closed');
+    });
+});
+suite('cron acceptance: the gates are real, and human traffic is untouched', function () {
+    this.timeout(20_000);
+    test('managed deployment, lease silent ⇒ the job gets no identity and no nonce', async () => {
+        const h = harness({ leaseAllows: undefined, managed: true });
+        await (0, serve_1.runBridgeTurn)(h.deps, 'nightly', cronFiring());
+        assert.strictEqual(h.runs[0].credentialUserId, undefined);
+        assert.strictEqual(h.runs[0].turnEnv, undefined, 'absent means deny — a plane that never learned the field must not authorise the fleet');
+    });
+    test('unmanaged deployment ⇒ the env var is the only gate, and it suffices', async () => {
+        const h = harness({ leaseAllows: undefined, managed: false });
+        await (0, serve_1.runBridgeTurn)(h.deps, 'nightly', cronFiring());
+        assert.strictEqual(h.runs[0].credentialUserId, SERVICE_IDENTITY);
+    });
+    test('no AGENTHIPPO_SERVICE_USER ⇒ today\'s behaviour exactly: no identity, no data', async () => {
+        const h = harness({ leaseAllows: true });
+        h.deps.serviceUserIfPermitted = undefined; // as when the env var is unset
+        await (0, serve_1.runBridgeTurn)(h.deps, 'nightly', cronFiring());
+        assert.strictEqual(h.runs[0].credentialUserId, undefined);
+        assert.strictEqual(h.runs[0].turnEnv, undefined);
+    });
+    test('a HUMAN turn never takes the service branch, even with everything enabled', async () => {
+        const h = harness({ leaseAllows: true });
+        const alice = { ...cronFiring(), peerInfo: { channel: 'slack', senderId: 'U-ALICE' } };
+        await (0, serve_1.runBridgeTurn)(h.deps, 'hello', alice);
+        await (0, serve_1.runBridgeTurn)(h.deps, 'again', alice);
+        assert.notStrictEqual(h.runs[0].credentialUserId, SERVICE_IDENTITY, 'a real sender must never be promoted to the service identity');
+        assert.strictEqual(h.runs[0].sessionId, h.runs[1].sessionId, 'a human keeps ONE durable session across turns — the fresh-key branch is service-only');
+        assert.strictEqual(h.prepared.length, 2, 'and their state is restored each turn, as before');
+    });
+    test('a human hitting the per-session cap is still refused — the fix did not disable the cap', async () => {
+        const h = harness({ leaseAllows: true });
+        const alice = { ...cronFiring(), peerInfo: { channel: 'slack', senderId: 'U-ALICE' } };
+        const outcomes = [];
+        for (let i = 0; i < TURN_CAP + 2; i++) {
+            outcomes.push((await (0, serve_1.runBridgeTurn)(h.deps, `msg ${i}`, alice)).success);
+        }
+        assert.deepStrictEqual(outcomes, [true, true, true, false, false], 'the durable human path must keep enforcing maxTurnsPerSession');
+    });
+});
+/**
+ * "…in ONE container" — observed, not inferred.
+ *
+ * The suite above asserts the sandbox KEY is stable across runs. That is strong evidence but it is
+ * still inference: `sandboxKey` is what the sandbox runner keys on, so a stable key SHOULD mean one
+ * sandbox — unless the runner churns for a reason the key cannot see.
+ *
+ * These drive `runBridgeTurn` into a REAL `createSandboxRunner`, and count `driver.create` calls.
+ * That is the actual question ("how many sandboxes came into existence?") rather than a proxy for
+ * it, and it exercises the whole chain: bridge turn → session-key derivation → runner → driver.
+ *
+ * Tier 0 (process). Tier 2 (container) needs Linux — see the note at the end of this file.
+ */
+suite('cron acceptance: one sandbox across the whole schedule (observed)', function () {
+    this.timeout(20_000);
+    const RUNTIME = { logger: { info() { }, warn() { }, error() { }, debug() { } } };
+    /** Records every sandbox the runner actually builds, keyed as the driver saw it. */
+    function countingDriver() {
+        const created = [];
+        const destroyed = [];
+        let seq = 0;
+        const driver = {
+            kind: 'process', tier: 0,
+            async create(spec) {
+                const id = `sandbox-${++seq}`;
+                created.push(spec.sandboxKey);
+                const toRunner = new node_stream_1.PassThrough();
+                const toServe = new node_stream_1.PassThrough();
+                (0, host_1.startRunnerHost)({
+                    engine: {
+                        id: 'e', displayName: 'E',
+                        async stream(message, _o, emitter) {
+                            await emitter.text(`ECHO:${message}`);
+                        },
+                        onMaintenance() { }, dispose() { },
+                    },
+                    runtime: RUNTIME, input: toRunner,
+                    output: { write: (c) => toServe.write(c) },
+                    maintenanceIntervalMs: 60_000,
+                });
+                return {
+                    id, tier: 0, endpoint: 'stdio',
+                    connect: () => ({
+                        input: toServe,
+                        output: { write: (c) => toRunner.write(c) },
+                        closed: new Promise(() => undefined),
+                    }),
+                };
+            },
+            async revoke() { },
+            async destroy(handle) { destroyed.push(handle.id); },
+        };
+        return { driver, created, destroyed };
+    }
+    function sandboxHarness(scope = 'session') {
+        const { driver, created } = countingDriver();
+        const runner = (0, sandboxRunner_1.createSandboxRunner)({
+            driver, image: `img@sha256:${'a'.repeat(64)}`, tier: 0, routes: [], runtime: RUNTIME,
+        });
+        const base = harness({ leaseAllows: true });
+        base.deps.runner = runner;
+        base.deps.sandboxScope = scope;
+        return { deps: base.deps, runner, created };
+    }
+    test('THE CLAIM: five nightly runs build ONE sandbox, and reuse it', async () => {
+        const h = sandboxHarness();
+        for (let night = 1; night <= 5; night++) {
+            const r = await (0, serve_1.runBridgeTurn)(h.deps, `night ${night}`, cronFiring());
+            assert.strictEqual(r.success, true, `night ${night} must succeed`);
+        }
+        assert.strictEqual(h.created.length, 1, `the driver built ${h.created.length} sandboxes across 5 runs; the schedule must reuse one`);
+        assert.strictEqual(h.created[0], `gateway-${SERVICE_IDENTITY}`);
+        const live = h.runner.sandboxes();
+        assert.strictEqual(live.length, 1, 'exactly one live sandbox');
+        assert.strictEqual(live[0].sessionKeys.length, 5, 'all five conversations ran on it — fresh session, warm sandbox');
+    });
+    test('and the kill switch still has ONE handle for the whole schedule', async () => {
+        const h = sandboxHarness();
+        await (0, serve_1.runBridgeTurn)(h.deps, 'night 1', cronFiring());
+        await (0, serve_1.runBridgeTurn)(h.deps, 'night 2', cronFiring());
+        // An operator kills the bot by its stable key, not by guessing last night's session id.
+        await h.runner.destroySession(`gateway-${SERVICE_IDENTITY}`);
+        assert.strictEqual(h.runner.sandboxes().length, 0, 'one destroy must end the whole schedule, not one night of it');
+    });
+    test('CONTRAST: without the stable key, five runs would build five sandboxes', async () => {
+        // The same driver, driven with a fresh key per run — what a naive "fresh session per run"
+        // fix produces. This is the cost the sandboxKey/sessionKey split exists to avoid, and it is
+        // executed rather than described so the number is real.
+        const { driver, created } = countingDriver();
+        const runner = (0, sandboxRunner_1.createSandboxRunner)({
+            driver, image: `img@sha256:${'a'.repeat(64)}`, tier: 0, routes: [], runtime: RUNTIME,
+        });
+        for (let night = 1; night <= 5; night++) {
+            await runner.run({
+                engineId: 'e', modelId: 'm', message: `night ${night}`, workspaceRoot: '/w',
+                sessionId: `gateway-svc--run-${night}`, sandboxKey: `gateway-svc--run-${night}`,
+            });
+        }
+        assert.strictEqual(created.length, 5, 'five cold starts — the outcome the split avoids');
+        assert.strictEqual(runner.sandboxes().length, 5, 'and five live sandboxes to account for');
+    });
+    test('human traffic keeps one sandbox per conversation, as before', async () => {
+        const h = sandboxHarness();
+        const alice = { ...cronFiring(), peerInfo: { channel: 'slack', senderId: 'U-ALICE' } };
+        await (0, serve_1.runBridgeTurn)(h.deps, 'hi', alice);
+        await (0, serve_1.runBridgeTurn)(h.deps, 'again', alice);
+        assert.strictEqual(h.created.length, 1, 'a durable human session reuses its sandbox');
+        const bob = { ...cronFiring(), peerInfo: { channel: 'slack', senderId: 'U-BOB' } };
+        await (0, serve_1.runBridgeTurn)(h.deps, 'hi', bob);
+        assert.strictEqual(h.created.length, 2, 'and a different person never cohabits');
+    });
+});
+/*
+ * NOT COVERED HERE, deliberately:
+ *
+ *   tier 2 (container) — needs Linux; this host is arm64 macOS and the runtime images are amd64.
+ *                        The runner logic above is tier-independent (it keys on sandboxKey before
+ *                        the driver is consulted), so the arithmetic holds, but `docker ps`
+ *                        showing one container is a Linux-host check.
+ *   the gateway socket  — these call runBridgeTurn directly; a bridge that never routes messages
+ *                        to it would still pass.
+ *   the cron daemon     — "night N" is a loop, not a scheduler.
+ */

package/out/test/serve-gateway-turn.test.js

@@ -265,3 +265,125 @@ suite('runGatewayTurn: trackSession=false skips the TurnLimiter for one-off keys
         assert.strictEqual(ran, false);
     });
 });
+suite('resolveGatewaySessionKey: sandbox scope agrees with the HTTP path', () => {
+    test('session scope leaves the sandbox key equal to the session key', () => {
+        const r = (0, serve_1.resolveGatewaySessionKey)({ sessionId: 'chat-42' }, 'alice', 'session');
+        assert.strictEqual(r.sandboxKey, r.sessionKey);
+    });
+    /**
+     * The two resolvers must derive the SAME sandbox key for one person. If they disagreed, a user
+     * reaching this serve over HTTP and over a channel would get two sandboxes under user scope —
+     * neither the old behaviour nor the new one.
+     */
+    test('user scope: HTTP and gateway put one person in one sandbox', () => {
+        const gateway = (0, serve_1.resolveGatewaySessionKey)({ sessionId: 'chat-42' }, 'alice', 'user');
+        const http = (0, serve_hardening_1.resolveServeSessionKey)('chat-42', 'alice', 'user', {});
+        assert.strictEqual(gateway.sandboxKey, http.sandboxKey);
+        assert.strictEqual(gateway.sandboxKey, `u${(0, serve_hardening_1.userNamespaceHash)('alice')}`);
+    });
+    test('user scope: a sender with no session id lands in the same sandbox as one with', () => {
+        const withId = (0, serve_1.resolveGatewaySessionKey)({ sessionId: 'chat-42' }, 'slack:U0B6', 'user');
+        const withoutId = (0, serve_1.resolveGatewaySessionKey)({}, 'slack:U0B6', 'user');
+        assert.strictEqual(withId.sandboxKey, withoutId.sandboxKey);
+        assert.notStrictEqual(withId.sessionKey, withoutId.sessionKey, 'still two conversations');
+    });
+    test('an unidentified sender keeps its own sandbox under either scope', () => {
+        const a = (0, serve_1.resolveGatewaySessionKey)({}, undefined, 'user');
+        const b = (0, serve_1.resolveGatewaySessionKey)({}, undefined, 'user');
+        assert.strictEqual(a.sandboxKey, a.sessionKey);
+        assert.notStrictEqual(a.sandboxKey, b.sandboxKey);
+        assert.strictEqual(a.durable, false);
+    });
+});
+/**
+ * PLAN/agent-identity.md §5.3–§5.4 — service turns (build record §10.4).
+ *
+ * The defect these pin is not hypothetical: `TurnLimiter` is a monotonic per-session counter with
+ * no window, no reset and no decay, and `resolveGatewaySessionKey` returns a STABLE key for any
+ * identified sender. Composed, a nightly cron job burns one turn per night from a counter that
+ * never resets and, on night `maxTurnsPerSession + 1`, is rejected with `turn_limit` forever —
+ * recovering only on a serve restart. A job that dies after N nights, where N is a cap nobody
+ * associates with cron.
+ */
+suite('resolveGatewaySessionKey: service turns (PR-3 — fresh conversation, warm sandbox)', () => {
+    const SVC = 'svc:invoice-agent';
+    test('THE REGRESSION: N runs past the cap are all admitted, because the key is fresh per run', async () => {
+        const cap = 3;
+        const limiter = new serve_hardening_1.TurnLimiter(cap);
+        const admitted = [];
+        for (let run = 0; run < cap + 2; run++) {
+            const keys = (0, serve_1.resolveGatewaySessionKey)({}, SVC, 'session', true);
+            assert.strictEqual(keys.durable, false, 'a service run must not take the durable branch');
+            // trackSession mirrors `durable` at the call site, so this is what the bridge does.
+            const r = await (0, serve_1.runGatewayTurn)(baseParams({
+                turnLimiter: limiter,
+                sessionKey: keys.sessionKey,
+                trackSession: keys.durable,
+                run: async () => ({ success: true }),
+            }));
+            admitted.push(r.success);
+        }
+        assert.deepStrictEqual(admitted, [true, true, true, true, true], 'every run must be admitted; a false here is the nightly-job death returning');
+    });
+    test('contrast: the SAME identity on the durable path dies on run cap+1 — this is what was shipping', async () => {
+        const limiter = new serve_hardening_1.TurnLimiter(3);
+        const durable = (0, serve_1.resolveGatewaySessionKey)({}, SVC, 'session', false);
+        assert.strictEqual(durable.durable, true);
+        const admitted = [];
+        for (let run = 0; run < 5; run++) {
+            const r = await (0, serve_1.runGatewayTurn)(baseParams({
+                turnLimiter: limiter,
+                sessionKey: durable.sessionKey,
+                trackSession: durable.durable,
+                emitter: fakeEmitter(),
+                run: async () => ({ success: true }),
+            }));
+            admitted.push(r.success);
+        }
+        assert.deepStrictEqual(admitted, [true, true, true, false, false], 'demonstrating the defect the fresh key exists to avoid');
+    });
+    test('sessionKey is fresh per run but sandboxKey is STABLE — one warm container, not one per night', () => {
+        const a = (0, serve_1.resolveGatewaySessionKey)({}, SVC, 'session', true);
+        const b = (0, serve_1.resolveGatewaySessionKey)({}, SVC, 'session', true);
+        assert.notStrictEqual(a.sessionKey, b.sessionKey, 'a reused session key re-introduces the limiter defect');
+        assert.strictEqual(a.sandboxKey, b.sandboxKey, 'a fresh sandbox key per run means a new container every night: cold start, a new governor '
+            + 'entry per run, and maxSessionSeconds that never accumulates');
+        assert.strictEqual(a.sandboxKey, `gateway-${SVC}`);
+    });
+    test('the stable sandbox key is also the one handle caps and the kill switch act on', () => {
+        // Both scopes must agree, or a kill aimed at the bot would miss under one of them.
+        assert.strictEqual((0, serve_1.resolveGatewaySessionKey)({}, SVC, 'session', true).sandboxKey, (0, serve_1.resolveGatewaySessionKey)({}, SVC, 'user', true).sandboxKey);
+    });
+    test('outboundKey is preserved, so a cron job that messages Slack keeps replying', () => {
+        const withChannel = (0, serve_1.resolveGatewaySessionKey)({ gatewaySessionKey: 'slack-C123' }, SVC, 'session', true);
+        assert.strictEqual(withChannel.outboundKey, 'slack-C123');
+        // Across runs the reply destination must not move, even though the session key does.
+        const next = (0, serve_1.resolveGatewaySessionKey)({ gatewaySessionKey: 'slack-C123' }, SVC, 'session', true);
+        assert.strictEqual(next.outboundKey, withChannel.outboundKey);
+        assert.notStrictEqual(next.sessionKey, withChannel.sessionKey);
+    });
+    test('with no channel key the outbound key still resolves to something stable', () => {
+        const r = (0, serve_1.resolveGatewaySessionKey)({}, SVC, 'session', true);
+        assert.strictEqual(r.outboundKey, `gateway-${SVC}`);
+    });
+    test('the flag is explicit — an identity that merely LOOKS like a service id takes the human path', () => {
+        // Behaviour is never derived from the shape of an identity string: §5.2 deliberately allows
+        // identities with no recognisable prefix (a SPIFFE ID, an Entra GUID), so prefix-sniffing
+        // would be both wrong and unfixable.
+        const sniffable = (0, serve_1.resolveGatewaySessionKey)({}, SVC, 'session', false);
+        assert.strictEqual(sniffable.durable, true, 'the svc: prefix alone must not change behaviour');
+        assert.strictEqual(sniffable.sessionKey, `gateway-${SVC}`);
+    });
+    test('human traffic is untouched by the new parameter', () => {
+        const before = (0, serve_1.resolveGatewaySessionKey)({ sessionId: 'chat-42' }, 'alice', 'session');
+        const after = (0, serve_1.resolveGatewaySessionKey)({ sessionId: 'chat-42' }, 'alice', 'session', false);
+        assert.deepStrictEqual(before, after);
+    });
+    test('an unidentified sender cannot reach the service branch even if the flag is set', () => {
+        // Defence against a future caller that passes the flag without an identity: the anonymous
+        // one-off path is still the right answer, not a `gateway-undefined` bucket.
+        const r = (0, serve_1.resolveGatewaySessionKey)({}, undefined, 'session', true);
+        assert.strictEqual(r.durable, false);
+        assert.match(r.sessionKey, /^gateway-anon-/);
+    });
+});