@agenthippo-ai/agenthippo 1.110.11 → 1.110.19

package/out/test/data-plane.test.js

@@ -1,624 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Data-plane gateway integration tests (secure-obo-design §3, §5, §9)
- *
- *  Boots the real thing end to end: TurnRegistry + CredentialBroker + a real connector
- *  subprocess (stdio MCP over a private pipe) + the loopback streamable-HTTP gateway —
- *  then drives it with the MCP SDK client exactly like an engine would.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-require("mocha");
-const assert = __importStar(require("assert"));
-const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
-const index_js_1 = require("@modelcontextprotocol/sdk/client/index.js");
-const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/client/streamableHttp.js");
-const data_plane_1 = require("../cli/data-plane");
-const data_plane_2 = require("../cli/commands/data-plane");
-const identity_1 = require("../analytics/identity");
-// The fixture connector must live INSIDE the extension tree so its `import` of
-// @modelcontextprotocol/sdk resolves by walking up to extensions/agentide/node_modules.
-const FIXTURE_DIR = path.join(__dirname, 'data-plane-fixture');
-const CONNECTOR_PATH = path.join(FIXTURE_DIR, 'connector.mjs');
-const CONNECTOR_SOURCE = `
-import { Server } from '@modelcontextprotocol/sdk/server/index.js';
-import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
-
-const server = new Server({ name: 'test-connector', version: '0.0.1' }, { capabilities: { tools: {} } });
-server.setRequestHandler(ListToolsRequestSchema, async () => ({
-	tools: [{
-		name: 'whoami',
-		description: 'echo the broker-supplied turn context',
-		inputSchema: { type: 'object', properties: { probe: { type: 'string' } } },
-	}],
-}));
-server.setRequestHandler(CallToolRequestSchema, async (req) => {
-	const turn = (req.params._meta ?? {})['ai.agenthippo/turn'] ?? null;
-	const probe = (req.params.arguments ?? {}).probe ?? '';
-	return {
-		content: [{ type: 'text', text: JSON.stringify({
-			userId: turn ? turn.userId : null,
-			credential: turn ? turn.credential : null,
-			envContainsProbe: probe ? JSON.stringify(process.env).includes(probe) : false,
-		}) }],
-	};
-});
-await server.connect(new StdioServerTransport());
-`;
-function mcpClient(url, nonce) {
-    const transport = new streamableHttp_js_1.StreamableHTTPClientTransport(new URL(url), {
-        requestInit: { headers: { Authorization: `Bearer ${nonce}` } },
-    });
-    const client = new index_js_1.Client({ name: 'test-engine', version: '0.0.1' });
-    return { client, transport };
-}
-async function callWhoami(url, nonce, probe) {
-    const { client, transport } = mcpClient(url, nonce);
-    try {
-        await client.connect(transport);
-        const res = await client.callTool({ name: 'whoami', arguments: probe ? { probe } : {} });
-        const content = res.content[0];
-        return JSON.parse(content.text);
-    }
-    finally {
-        await client.close().catch(() => undefined);
-    }
-}
-suite('data-plane: gateway + registry + broker end to end', function () {
-    this.timeout(30_000);
-    let plane;
-    suiteSetup(async () => {
-        fs.mkdirSync(FIXTURE_DIR, { recursive: true });
-        fs.writeFileSync(CONNECTOR_PATH, CONNECTOR_SOURCE, 'utf8');
-        plane = await data_plane_1.DataPlane.start({ connectorPath: CONNECTOR_PATH, provider: 'passthrough' });
-    });
-    suiteTeardown(async () => {
-        await plane?.close();
-        fs.rmSync(FIXTURE_DIR, { recursive: true, force: true });
-    });
-    test('gateway binds loopback only', () => {
-        assert.ok(plane.url.startsWith('http://127.0.0.1:'), plane.url);
-    });
-    test('a live nonce lists and calls tools as the registered user, credential selected server-side', async () => {
-        const turn = plane.registerTurn({ userId: 'alice@corp.com', sessionKey: 's1', inboundToken: 'alice-obo-token' });
-        try {
-            const { client, transport } = mcpClient(plane.url, turn.nonce);
-            await client.connect(transport);
-            const tools = await client.listTools();
-            assert.deepStrictEqual(tools.tools.map((t) => t.name), ['whoami']);
-            await client.close();
-            const who = await callWhoami(plane.url, turn.nonce);
-            assert.strictEqual(who.userId, 'alice@corp.com');
-            assert.strictEqual(who.credential, 'alice-obo-token', 'the broker must hand the connector the turn user\'s credential');
-        }
-        finally {
-            turn.release();
-        }
-    });
-    test('the credential never enters the connector process env — it rides only the per-call pipe', async () => {
-        const turn = plane.registerTurn({ userId: 'alice@corp.com', sessionKey: 's1', inboundToken: 'alice-obo-token' });
-        try {
-            const who = await callWhoami(plane.url, turn.nonce, 'alice-obo-token');
-            assert.strictEqual(who.envContainsProbe, false, 'raw credential must not appear anywhere in the connector env');
-        }
-        finally {
-            turn.release();
-        }
-    });
-    test('two concurrent turns each resolve their OWN user + credential (the §9.1 concurrency property)', async () => {
-        const alice = plane.registerTurn({ userId: 'alice@corp.com', sessionKey: 'sa', inboundToken: 'tok-alice' });
-        const bob = plane.registerTurn({ userId: 'bob@corp.com', sessionKey: 'sb', inboundToken: 'tok-bob' });
-        try {
-            const [a, b] = await Promise.all([
-                callWhoami(plane.url, alice.nonce),
-                callWhoami(plane.url, bob.nonce),
-            ]);
-            assert.strictEqual(a.userId, 'alice@corp.com');
-            assert.strictEqual(a.credential, 'tok-alice');
-            assert.strictEqual(b.userId, 'bob@corp.com');
-            assert.strictEqual(b.credential, 'tok-bob');
-        }
-        finally {
-            alice.release();
-            bob.release();
-        }
-    });
-    test('missing / unknown nonce → 401, fail closed', async () => {
-        await assert.rejects(() => callWhoami(plane.url, 'not-a-real-nonce'), /401|Unauthorized/i);
-    });
-    test('a released (turn-ended) nonce → 401 — a stale engine fails closed (§3.2)', async () => {
-        const turn = plane.registerTurn({ userId: 'alice@corp.com', sessionKey: 's1', inboundToken: 't' });
-        const nonce = turn.nonce;
-        const who = await callWhoami(plane.url, nonce);
-        assert.strictEqual(who.userId, 'alice@corp.com');
-        turn.release();
-        await assert.rejects(() => callWhoami(plane.url, nonce), /401|Unauthorized/i);
-    });
-    test('an expired deadline → 401 even if release() was never called (stranded-nonce backstop)', async () => {
-        const { nonce } = plane.registry.register({
-            userId: 'alice@corp.com',
-            sessionKey: 's1',
-            inboundToken: 't',
-            deadline: Date.now() - 1,
-        });
-        await assert.rejects(() => callWhoami(plane.url, nonce), /401|Unauthorized/i);
-    });
-    test('passthrough provider with no inbound token → the TOOL CALL errors, fail closed, turn itself unaffected', async () => {
-        const turn = plane.registerTurn({ userId: 'peer:telegram:123', sessionKey: 's2' });
-        try {
-            const { client, transport } = mcpClient(plane.url, turn.nonce);
-            await client.connect(transport);
-            const res = await client.callTool({ name: 'whoami', arguments: {} });
-            assert.strictEqual(res.isError, true, 'no inbound credential must fail the call closed');
-            const text = res.content[0].text;
-            assert.match(text, /fail-closed/);
-            await client.close();
-        }
-        finally {
-            turn.release();
-        }
-    });
-    test('a token-less turn fails closed even RIGHT AFTER the same user ran a turn WITH a token (no cache bridging)', async () => {
-        // Passthrough gets the platform token on every legitimate request; a broker cache
-        // that outlives the turn would let broken forwarding silently reuse the previous
-        // token for the cache TTL — the exact silent-fallback failure the provider forbids.
-        const withToken = plane.registerTurn({ userId: 'u@corp.com', sessionKey: 's3', inboundToken: 'tok-1' });
-        try {
-            const ok = await callWhoami(plane.url, withToken.nonce);
-            assert.strictEqual(ok.credential, 'tok-1');
-        }
-        finally {
-            withToken.release();
-        }
-        const withoutToken = plane.registerTurn({ userId: 'u@corp.com', sessionKey: 's3' });
-        try {
-            const { client, transport } = mcpClient(plane.url, withoutToken.nonce);
-            await client.connect(transport);
-            const res = await client.callTool({ name: 'whoami', arguments: {} });
-            assert.strictEqual(res.isError, true, 'the cached tok-1 must not serve a token-less turn');
-            await client.close();
-        }
-        finally {
-            withoutToken.release();
-        }
-    });
-});
-suite('data-plane: TurnRegistry unit properties', () => {
-    test('raw nonces are never map keys — lookups go through sha256', () => {
-        const reg = new data_plane_1.TurnRegistry();
-        const { nonce } = reg.register({ userId: 'u', sessionKey: 's' });
-        assert.ok(reg.resolve(nonce));
-        // resolve by the HASH must fail — only the raw nonce authenticates.
-        assert.strictEqual(reg.resolve((0, data_plane_1.hashNonce)(nonce)), undefined);
-    });
-    test('release is idempotent and deletes exactly its own entry', () => {
-        const reg = new data_plane_1.TurnRegistry();
-        const a = reg.register({ userId: 'a', sessionKey: 's' });
-        const b = reg.register({ userId: 'b', sessionKey: 's' });
-        a.release();
-        a.release();
-        assert.strictEqual(reg.resolve(a.nonce), undefined);
-        assert.strictEqual(reg.resolve(b.nonce)?.userId, 'b');
-        b.release();
-        assert.strictEqual(reg.size, 0);
-    });
-    test('expired entries are pruned on register', () => {
-        const reg = new data_plane_1.TurnRegistry();
-        reg.register({ userId: 'a', sessionKey: 's', deadline: Date.now() - 1 });
-        assert.strictEqual(reg.size, 1);
-        reg.register({ userId: 'b', sessionKey: 's' });
-        assert.strictEqual(reg.size, 1, 'the expired entry must have been pruned');
-    });
-});
-suite('data-plane: sidecar EDGE registration (P1 fix — no forging authority in the agent container)', function () {
-    this.timeout(30_000);
-    const EDGE_TOKEN = 'edge-only-secret';
-    let sidecar;
-    let controlBase;
-    suiteSetup(async () => {
-        fs.mkdirSync(FIXTURE_DIR, { recursive: true });
-        fs.writeFileSync(CONNECTOR_PATH, CONNECTOR_SOURCE, 'utf8');
-        sidecar = await (0, data_plane_1.startDataPlaneSidecar)({
-            config: { connectorPath: CONNECTOR_PATH, provider: 'identity' },
-            registerToken: EDGE_TOKEN,
-            gatewayPort: 0,
-            controlPort: 0,
-            bindHost: '127.0.0.1',
-        });
-        controlBase = `http://127.0.0.1:${sidecar.controlPort}`;
-    });
-    suiteTeardown(async () => {
-        await sidecar?.close();
-        fs.rmSync(FIXTURE_DIR, { recursive: true, force: true });
-    });
-    async function edgeRegister(user, token = EDGE_TOKEN) {
-        // Shaped like Caddy forward_auth: GET, no body, verified identity in X-Agent-User.
-        return fetch(`${controlBase}/edge/turn`, {
-            headers: { Authorization: `Bearer ${token}`, 'X-Agent-User': user },
-        });
-    }
-    test('the edge mints a nonce for the verified user; the nonce works at the gateway as that user', async () => {
-        const res = await edgeRegister('alice@corp.com');
-        assert.strictEqual(res.status, 200);
-        const nonce = res.headers.get(data_plane_1.TURN_NONCE_HEADER);
-        assert.ok(nonce, 'nonce must ride the response header for Caddy copy_headers');
-        const who = await callWhoami(sidecar.gatewayUrl, nonce);
-        assert.strictEqual(who.userId, 'alice@corp.com');
-    });
-    test('edge registration without the edge token → 401 (the engine can route here but cannot forge)', async () => {
-        const res = await edgeRegister('victim@corp.com', 'stolen-or-missing');
-        assert.strictEqual(res.status, 401);
-    });
-    test('edge registration without a verified identity header → 400, fail closed', async () => {
-        const res = await fetch(`${controlBase}/edge/turn`, { headers: { Authorization: `Bearer ${EDGE_TOKEN}` } });
-        assert.strictEqual(res.status, 400);
-    });
-    test('serve releases an adopted turn via the gateway using ONLY the nonce; the nonce then fails closed', async () => {
-        const res = await edgeRegister('bob@corp.com');
-        const nonce = res.headers.get(data_plane_1.TURN_NONCE_HEADER);
-        const edge = new data_plane_1.EdgeDataPlane({ gatewayUrl: sidecar.gatewayUrl });
-        const turn = edge.adoptTurn(nonce);
-        assert.strictEqual(turn.env.AGENTHIPPO_TURN_NONCE, nonce);
-        assert.strictEqual(turn.env.AGENTHIPPO_DATA_MCP_URL, sidecar.gatewayUrl);
-        const who = await callWhoami(sidecar.gatewayUrl, nonce);
-        assert.strictEqual(who.userId, 'bob@corp.com');
-        await turn.release();
-        await assert.rejects(() => callWhoami(sidecar.gatewayUrl, nonce), /401|Unauthorized/i);
-    });
-    /**
-     * PR-F1 / agent-identity.md §8.5 G1.
-     *
-     * The edge forwarded `X-Agent-User` and nothing else, and `/edge/turn` registered with no
-     * inboundToken — so edge mode silently supported the `identity` provider ALONE. A
-     * `passthrough` deployment (Databricks-style OBO) booted clean and then failed closed on
-     * every single tool call, and an RFC 8693 `exchange` provider had no subject_token at all.
-     */
-    test('release with a bogus nonce is a harmless no-op (204) and touches no other turn', async () => {
-        const res = await edgeRegister('carol@corp.com');
-        const nonce = res.headers.get(data_plane_1.TURN_NONCE_HEADER);
-        const del = await fetch(new URL('/turn', sidecar.gatewayUrl), {
-            method: 'DELETE',
-            headers: { Authorization: 'Bearer not-a-real-nonce' },
-        });
-        assert.strictEqual(del.status, 204);
-        const who = await callWhoami(sidecar.gatewayUrl, nonce);
-        assert.strictEqual(who.userId, 'carol@corp.com', 'an unrelated release must not end a live turn');
-    });
-});
-/**
- * PLAN/agent-identity.md §8.5 G1 (build record §10.5).
- *
- * The edge forwarded `X-Agent-User` (an identifier) and nothing else, and `/edge/turn` registered
- * with no inboundToken. So edge mode silently supported the `identity` provider ALONE: a
- * `passthrough` deployment (Databricks-style OBO) booted clean and then failed closed on every
- * single tool call, and an RFC 8693 `exchange` provider had no `subject_token` to exchange at all.
- *
- * This suite runs a PASSTHROUGH sidecar behind the edge — the combination that could not work.
- */
-suite('data-plane: sidecar EDGE + passthrough (PR-F1 — the edge must forward the assertion)', function () {
-    this.timeout(30_000);
-    const EDGE_TOKEN = 'edge-assertion-token';
-    let sidecar;
-    let controlBase;
-    suiteSetup(async () => {
-        fs.mkdirSync(FIXTURE_DIR, { recursive: true });
-        fs.writeFileSync(CONNECTOR_PATH, CONNECTOR_SOURCE, 'utf8');
-        sidecar = await (0, data_plane_1.startDataPlaneSidecar)({
-            config: { connectorPath: CONNECTOR_PATH, provider: 'passthrough' },
-            registerToken: EDGE_TOKEN,
-            gatewayPort: 0,
-            controlPort: 0,
-            bindHost: '127.0.0.1',
-        });
-        controlBase = `http://127.0.0.1:${sidecar.controlPort}`;
-    });
-    suiteTeardown(async () => {
-        await sidecar?.close();
-        fs.rmSync(FIXTURE_DIR, { recursive: true, force: true });
-    });
-    const register = (user, assertion) => fetch(`${controlBase}/edge/turn`, {
-        headers: {
-            Authorization: `Bearer ${EDGE_TOKEN}`,
-            'X-Agent-User': user,
-            ...(assertion ? { [data_plane_1.ASSERTION_HEADER]: assertion } : {}),
-        },
-    });
-    test('with the assertion forwarded, a passthrough turn reaches the backend as that user', async () => {
-        const res = await register('alice@corp.com', 'Bearer alice-platform-token');
-        assert.strictEqual(res.status, 200);
-        const who = await callWhoami(sidecar.gatewayUrl, res.headers.get(data_plane_1.TURN_NONCE_HEADER));
-        assert.strictEqual(who.userId, 'alice@corp.com');
-        assert.strictEqual(who.credential, 'alice-platform-token', 'the assertion becomes the turn inboundToken, and passthrough hands it to the connector');
-    });
-    test('a bare "Bearer " prefix is stripped — the connector gets the token, not the scheme', async () => {
-        const res = await register('bob@corp.com', 'Bearer   bob-token');
-        const who = await callWhoami(sidecar.gatewayUrl, res.headers.get(data_plane_1.TURN_NONCE_HEADER));
-        assert.strictEqual(who.credential, 'bob-token');
-    });
-    test('an assertion sent WITHOUT the scheme prefix is taken verbatim', async () => {
-        const res = await register('carol@corp.com', 'carol-raw-token');
-        const who = await callWhoami(sidecar.gatewayUrl, res.headers.get(data_plane_1.TURN_NONCE_HEADER));
-        assert.strictEqual(who.credential, 'carol-raw-token');
-    });
-    test('WITHOUT the assertion the turn still registers, but every call fails closed — the pre-PR-F1 behaviour', async () => {
-        const res = await register('dave@corp.com');
-        assert.strictEqual(res.status, 200, 'registration itself must not depend on the assertion');
-        const { client, transport } = mcpClient(sidecar.gatewayUrl, res.headers.get(data_plane_1.TURN_NONCE_HEADER));
-        await client.connect(transport);
-        const out = await client.callTool({ name: 'whoami', arguments: {} });
-        await client.close();
-        assert.strictEqual(out.isError, true);
-        assert.match(out.content[0].text, /fail-closed/, 'no inbound credential must never fall back to a shared one');
-    });
-});
-/**
- * PLAN/agent-identity.md §10.1 — the audit writer.
- *
- * The sidecar accepted an optional `audit` and `dataPlaneSidecarCommand` never passed one. Because
- * every emit site is `opts.audit?.(…)`, the entire data-plane trust-boundary record was silently
- * discarded in sidecar and edge mode — the two shapes the blueprints deploy. The compliance claim
- * ("which user touched which rows") had no writer exactly where it was being made.
- *
- * These tests pin both halves: the sink the command builds actually writes, and the sidecar
- * actually emits through it on the authorize / deny / reject paths.
- */
-suite('data-plane: sidecar audit sink (PR-0 — the record must have a writer)', function () {
-    this.timeout(30_000);
-    const TOKEN = 'audit-suite-token';
-    const AUDIT_ROOT = path.join(FIXTURE_DIR, 'audit-state');
-    let sidecar;
-    let controlBase;
-    let auditDir;
-    const rows = () => {
-        if (!fs.existsSync(auditDir)) {
-            return [];
-        }
-        return fs.readdirSync(auditDir)
-            .filter((f) => f.endsWith('.jsonl'))
-            .flatMap((f) => fs.readFileSync(path.join(auditDir, f), 'utf8')
-            .split('\n').filter(Boolean).map((l) => JSON.parse(l)));
-    };
-    // The writer is fire-and-forget (`void writer.append(...)`) so the audit write must never
-    // delay a tool call. Poll briefly rather than sleeping a fixed amount.
-    const waitForEvent = async (eventType, 
-    // Without a predicate this matches the FIRST row of the type, which may be one an earlier
-    // test wrote — and then the row under test may not have landed yet. Pass a predicate
-    // whenever a specific row is meant.
-    where = () => true, timeoutMs = 5_000) => {
-        const deadline = Date.now() + timeoutMs;
-        for (;;) {
-            const hit = rows().find((r) => r.event_type === eventType && where(r.payload));
-            if (hit) {
-                return hit;
-            }
-            if (Date.now() > deadline) {
-                assert.fail(`no matching "${eventType}" event within ${timeoutMs}ms; saw: ${JSON.stringify(rows().map((r) => r.event_type))}`);
-            }
-            await new Promise((r) => setTimeout(r, 50));
-        }
-    };
-    suiteSetup(async () => {
-        fs.mkdirSync(FIXTURE_DIR, { recursive: true });
-        fs.writeFileSync(CONNECTOR_PATH, CONNECTOR_SOURCE, 'utf8');
-        const sink = await (0, data_plane_2.createDataPlaneAuditSink)(AUDIT_ROOT);
-        assert.strictEqual(sink.ok, true, sink.error);
-        assert.strictEqual(sink.ephemeral, false, 'an explicit state dir is durable');
-        auditDir = sink.auditDir;
-        sidecar = await (0, data_plane_1.startDataPlaneSidecar)({
-            config: { connectorPath: CONNECTOR_PATH, provider: 'identity' },
-            registerToken: TOKEN,
-            gatewayPort: 0,
-            controlPort: 0,
-            bindHost: '127.0.0.1',
-            audit: sink.audit,
-        });
-        controlBase = `http://127.0.0.1:${sidecar.controlPort}`;
-    });
-    suiteTeardown(async () => {
-        await sidecar?.close();
-        fs.rmSync(FIXTURE_DIR, { recursive: true, force: true });
-    });
-    test('an authorized tool call is recorded with the tool and the verified principal', async () => {
-        const res = await fetch(`${controlBase}/edge/turn`, {
-            headers: { Authorization: `Bearer ${TOKEN}`, 'X-Agent-User': 'dana@corp.com' },
-        });
-        const nonce = res.headers.get(data_plane_1.TURN_NONCE_HEADER);
-        const who = await callWhoami(sidecar.gatewayUrl, nonce);
-        assert.strictEqual(who.userId, 'dana@corp.com');
-        const ev = await waitForEvent('tool_authorize');
-        const payload = ev.payload;
-        assert.strictEqual(payload.tool, 'whoami');
-        assert.strictEqual(payload.userId, (0, identity_1.hashIdentity)('dana@corp.com'));
-        assert.strictEqual(payload.provider, 'identity');
-    });
-    test('an edge registration is recorded', async () => {
-        const ev = await waitForEvent('sidecar_edge_register');
-        assert.strictEqual(ev.payload.userId, (0, identity_1.hashIdentity)('dana@corp.com'));
-    });
-    /**
-     * These records ship wholesale to the evidence server, so whatever lands here leaves the
-     * machine. The tool-event lane already pseudonymises (ObservableStreamEmitter → hashIdentity);
-     * the data-plane lane must not be the one that exports raw addresses. In EDGE mode the sidecar
-     * registers with `sessionKey: userId`, so without this the evidence FILE is `alice@corp.com.jsonl`.
-     */
-    test('no raw address reaches the record — not in a payload, not in a filename', () => {
-        const files = fs.readdirSync(auditDir);
-        assert.ok(files.length > 0, 'the suite must have produced evidence by now');
-        for (const f of files) {
-            assert.ok(!f.includes('@'), `evidence filename must not carry an address: ${f}`);
-        }
-        const serialized = JSON.stringify(rows());
-        const anon = (0, identity_1.hashIdentity)('dana@corp.com');
-        assert.ok(anon, 'hashIdentity must yield a pseudonym for a non-empty address');
-        assert.ok(!serialized.includes('dana@corp.com'), 'a raw address must never reach the record');
-        assert.ok(serialized.includes(anon), 'the salted hash is the join key and must be present');
-    });
-    test('a rejected registration is recorded — the reject path is the one an auditor asks about', async () => {
-        const res = await fetch(`${controlBase}/edge/turn`, {
-            headers: { Authorization: 'Bearer wrong-token', 'X-Agent-User': 'mallory@corp.com' },
-        });
-        assert.strictEqual(res.status, 401);
-        const ev = await waitForEvent('sidecar_register_reject');
-        assert.strictEqual(ev.payload.reason, 'bad_token');
-    });
-    test('an unknown nonce at the gateway is recorded, and never logs the raw nonce', async () => {
-        await assert.rejects(() => callWhoami(sidecar.gatewayUrl, 'forged-nonce-value'), /401|Unauthorized/i);
-        const ev = await waitForEvent('nonce_reject');
-        const payload = ev.payload;
-        assert.strictEqual(payload.reason, 'unknown_or_expired');
-        assert.ok(payload.nonce_sha256_prefix, 'a hash prefix must be present');
-        const serialized = JSON.stringify(rows());
-        assert.ok(!serialized.includes('forged-nonce-value'), 'a raw nonce must never reach the audit record');
-    });
-    test('the assertion is fingerprinted in the record, never carried raw', async () => {
-        const secret = 'super-secret-user-assertion-value';
-        await fetch(`${controlBase}/edge/turn`, {
-            headers: { Authorization: `Bearer ${TOKEN}`, 'X-Agent-User': 'erin@corp.com', [data_plane_1.ASSERTION_HEADER]: `Bearer ${secret}` },
-        });
-        const ev = await waitForEvent('sidecar_edge_register', (p) => p.userId === (0, identity_1.hashIdentity)('erin@corp.com'));
-        assert.match(String(ev.payload.assertion), /^sha256:[0-9a-f]{12}$/, 'a hash prefix must prove which assertion the turn used');
-        assert.ok(!JSON.stringify(rows()).includes(secret), 'a user assertion is a bearer credential and must never reach the record');
-    });
-    test('an unwritable audit root reports ok:false rather than throwing, so the caller sets the policy', async () => {
-        // A path whose parent is a FILE — mkdir -p cannot succeed.
-        const blocker = path.join(FIXTURE_DIR, 'not-a-dir');
-        fs.writeFileSync(blocker, 'x', 'utf8');
-        const sink = await (0, data_plane_2.createDataPlaneAuditSink)(path.join(blocker, 'nested'));
-        assert.strictEqual(sink.ok, false);
-        assert.ok(sink.error, 'the failure reason must be reportable to the operator');
-    });
-});
-/**
- * PLAN/agent-identity.md §10.6 — the audit stamp and the agent field.
- *
- * Design §1's third failure was "the auditor's second question is unanswerable" — *why could the
- * invoice agent reach the HR schema at all*. PR-0 gave the record a writer, which made "which user
- * touched which rows" answerable. It did not make "via which agent" answerable: rows carried
- * `{tool, userId, provider}` and nothing about the pack. The agent was only ever IMPLIED, by which
- * deployment happened to write the file — and that implication is exactly what breaks when two
- * serves share one connector (§4.4).
- */
-suite('data-plane: every audit row names the AGENT, not just the user', function () {
-    this.timeout(30_000);
-    const TOKEN = 'agent-stamp-token';
-    const AUDIT_ROOT = path.join(FIXTURE_DIR, 'agent-stamp-state');
-    const LOADED = { pack: 'invoice-agent', version: '1.4.0' };
-    let sidecar;
-    let controlBase;
-    let auditDir;
-    const rows = () => (fs.existsSync(auditDir) ? fs.readdirSync(auditDir) : [])
-        .filter((f) => f.endsWith('.jsonl'))
-        .flatMap((f) => fs.readFileSync(path.join(auditDir, f), 'utf8')
-        .split('\n').filter(Boolean).map((l) => JSON.parse(l)));
-    const waitFor = async (pred) => {
-        const deadline = Date.now() + 5_000;
-        for (;;) {
-            const hit = rows().find(pred);
-            if (hit) {
-                return hit;
-            }
-            if (Date.now() > deadline) {
-                assert.fail(`no matching row; saw ${JSON.stringify(rows().map((r) => r.event_type))}`);
-            }
-            await new Promise((r) => setTimeout(r, 50));
-        }
-    };
-    suiteSetup(async () => {
-        fs.mkdirSync(FIXTURE_DIR, { recursive: true });
-        fs.writeFileSync(CONNECTOR_PATH, CONNECTOR_SOURCE, 'utf8');
-        const sink = await (0, data_plane_2.createDataPlaneAuditSink)(AUDIT_ROOT, LOADED);
-        auditDir = sink.auditDir;
-        sidecar = await (0, data_plane_1.startDataPlaneSidecar)({
-            config: { connectorPath: CONNECTOR_PATH, provider: 'identity' },
-            registerToken: TOKEN, gatewayPort: 0, controlPort: 0, bindHost: '127.0.0.1',
-            audit: sink.audit, agent: LOADED,
-        });
-        controlBase = `http://127.0.0.1:${sidecar.controlPort}`;
-    });
-    suiteTeardown(async () => {
-        await sidecar?.close();
-        fs.rmSync(FIXTURE_DIR, { recursive: true, force: true });
-    });
-    test('a tool call records WHICH AGENT served it — the auditor\'s second question', async () => {
-        const res = await fetch(`${controlBase}/edge/turn`, {
-            headers: { Authorization: `Bearer ${TOKEN}`, 'X-Agent-User': 'alice@corp.com' },
-        });
-        await callWhoami(sidecar.gatewayUrl, res.headers.get(data_plane_1.TURN_NONCE_HEADER));
-        const ev = await waitFor((r) => r.event_type === 'tool_authorize');
-        assert.deepStrictEqual(ev.payload.agent, { ...LOADED, digest: null }, 'without this the row says which USER touched the rows and nothing about the agent');
-    });
-    test('the sidecar claims no digest it has not verified', async () => {
-        const ev = await waitFor((r) => r.event_type === 'tool_authorize');
-        assert.strictEqual(ev.payload.agent.digest, null, 'pack-loader does not verify signatures in the sidecar; a digest here would dress an '
-            + 'unverified read as an attestation');
-    });
-    test('PR-8: a registration records the agent it CLAIMS, marked as asserted', async () => {
-        await fetch(`${controlBase}/turns`, {
-            method: 'POST',
-            headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
-            body: JSON.stringify({ userId: 'bob@corp.com', sessionKey: 's-claim', agent: { pack: 'invoice-agent' } }),
-        });
-        const ev = await waitFor((r) => r.event_type === 'sidecar_register' && r.payload.claimedAgent === 'invoice-agent');
-        assert.strictEqual(ev.payload.binding, 'asserted', 'the register token is shared, so the claim is only as good as whoever holds it — '
-            + 'evidence must never present it as verified');
-        assert.strictEqual(ev.payload.agentMismatch, undefined);
-    });
-    test('PR-8 / §4.4: a DIFFERENT agent on the same connector is flagged, not silently accepted', async () => {
-        // The invariant E2 rests on: one connector, one agent. It is unenforceable over a shared
-        // bearer, so the deliverable is that it becomes VISIBLE the moment it is violated.
-        const res = await fetch(`${controlBase}/turns`, {
-            method: 'POST',
-            headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
-            body: JSON.stringify({ userId: 'mallory@corp.com', sessionKey: 's-other', agent: { pack: 'hr-agent' } }),
-        });
-        assert.strictEqual(res.status, 200, 'it must still register — refusing on an unverifiable claim would let anyone with the '
-            + 'token deny service by lying about the pack');
-        const ev = await waitFor((r) => r.event_type === 'sidecar_register' && r.payload.claimedAgent === 'hr-agent');
-        assert.strictEqual(ev.payload.agentMismatch, true);
-        assert.strictEqual(ev.payload.loadedAgent, 'invoice-agent');
-    });
-    test('a registration with no agent claim still works — the field is optional', async () => {
-        const res = await fetch(`${controlBase}/turns`, {
-            method: 'POST',
-            headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
-            body: JSON.stringify({ userId: 'carol@corp.com', sessionKey: 's-none' }),
-        });
-        assert.strictEqual(res.status, 200);
-        const ev = await waitFor((r) => r.event_type === 'sidecar_register' && r.payload.claimedAgent === 'none');
-        assert.strictEqual(ev.payload.agentMismatch, undefined, 'absent is not a mismatch');
-    });
-});