@appforge-ci/core 0.2.3 → 0.3.1

package/dist/vpn-attestation.test.js

@@ -0,0 +1,613 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { createHash, createPrivateKey, createPublicKey } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { AUDIT_ENTRY_KINDS, auditCheckpointStatement, auditEntryHash, auditEntryPayloadSchema, auditGenesisHash, bytesToBase64, canonicalJson, createEd25519Signer, ed25519KeyId, ed25519SeedToPkcs8, sha256Hex, signAuditCheckpoint, verifyAuditChain, } from "./attestation.js";
+import { signAttestationDocument } from "./attestation-signing.js";
+import { ATTESTATION_LIMITS, ATTESTATION_MAX_DESTINATIONS, agentVpnEvidenceSchema, analyzeConnectionLog, attestationDocumentSha256, buildAttestationDocument, buildTunnelFacts, connectionLogKey, connectionRecordsDigest, expandLeasedPolicy, parseReleaseManifest, releaseManifestKey, renderEvidenceHtml, renderEvidencePage, summariseConnections, vpnPublicConfigDigest, } from "./vpn-attestation.js";
+import { SANDBOX_PROFILE_VERSION } from "./vpn-sandbox.js";
+const V = (await import(new URL("../../../scripts/appforge-verify.mjs", import.meta.url).href));
+const clone = (o) => JSON.parse(JSON.stringify(o));
+// ---------------------------------------------------------------- a throwaway signing key
+async function testKey(label) {
+    const pkcs8 = ed25519SeedToPkcs8(new Uint8Array(createHash("sha256").update(`vpn-attestation-test:${label}`).digest()));
+    const priv = createPrivateKey({ key: Buffer.from(pkcs8), format: "der", type: "pkcs8" });
+    const raw = new Uint8Array(createPublicKey(priv).export({ format: "der", type: "spki" }).subarray(-32));
+    const kid = await ed25519KeyId(raw);
+    const entry = { kid, alg: "Ed25519", publicKey: bytesToBase64(raw), notBefore: "2026-01-01T00:00:00Z", status: "active" };
+    return { signer: await createEd25519Signer(kid, pkcs8), entry, kid };
+}
+const KEY = await testKey("server");
+const KEYS = [KEY.entry];
+// ---------------------------------------------------------------- helper log fixtures
+const BUILD = "bld_0001";
+const ORG = "org_acme";
+function conn(bseq, over = {}) {
+    return JSON.stringify({
+        v: 1, type: "conn", seq: bseq + 100, bseq, ts: `2026-10-02T14:00:0${bseq % 10}.123Z`, buildId: BUILD, auth: "build", proto: "socks5",
+        host: "pub.dev", port: 443, decision: "allow", reason: "allowlist", route: "direct", connected: true, bytesUp: 100 * bseq, bytesDown: 1000 * bseq, durationMs: 10 + bseq, ...over,
+    });
+}
+const tallyLine = (over = {}) => JSON.stringify({ v: 1, type: "summary", ts: "2026-10-02T14:03:00.000Z", buildId: BUILD, reason: "unregistered", conns: 6, allowed: 4, denied: 2, connected: 4, failed: 0, bytesUp: 100 * (1 + 2 + 3 + 4), bytesDown: 1000 * (1 + 2 + 3 + 4), dropped: 0, forcedClosed: 0, stream: true, ...over });
+/** Six requests: four allowed (three to pub.dev through the direct route, one to the LAN through the tunnel) and two refused. */
+function goodLog() {
+    const lines = [
+        conn(1),
+        conn(2),
+        conn(3, { host: "10.20.0.5", port: 443, route: "tunnel", reason: "lan" }),
+        conn(4, { host: "pub.dev" }),
+        conn(5, { host: "127.0.0.1", port: 52730, decision: "deny", reason: "hard-deny", route: "none", class: "loopback", connected: false, bytesUp: 0, bytesDown: 0 }),
+        conn(6, { host: "169.254.169.254", port: 80, decision: "deny", reason: "hard-deny", route: "none", class: "link-local", connected: false, bytesUp: 0, bytesDown: 0 }),
+    ];
+    return lines.join("\n") + "\n" + tallyLine() + "\n";
+}
+// ---------------------------------------------------------------- connection log analysis
+test("analyzeConnectionLog: a clean log is complete, agrees with the helper's tally and matches the verifier's own recomputation", async () => {
+    const a = await analyzeConnectionLog(goodLog(), BUILD);
+    assert.equal(a.complete, true, a.incompleteReasons.join(","));
+    assert.equal(a.helperTallyAgrees, true);
+    assert.equal(a.logRecords, 6);
+    assert.deepEqual(a.totals, { allowed: 4, denied: 2, errors: 0, bytesUp: 100 * (1 + 2 + 3 + 4), bytesDown: 1000 * (1 + 2 + 3 + 4) });
+    assert.equal(a.connected, 4);
+    assert.equal(a.records[2].dest, "10.20.0.5:443");
+    assert.equal(a.records[4].class, "loopback");
+    // The verifier recomputes the per-destination summary and the digest from the records alone.
+    assert.deepEqual(V.summariseConnections(a.records), a.destinations);
+    assert.equal(V.sha256hex(a.records.map((r) => V.canonicalize(r)).join("\n") + "\n"), a.logSha256);
+    assert.equal(a.logSha256, await connectionRecordsDigest(a.records));
+});
+test("analyzeConnectionLog: every way a log can be short of complete is named, and none of them is silent", async () => {
+    const lines = goodLog().trimEnd().split("\n");
+    const recs = lines.slice(0, 6);
+    const tally = lines[6];
+    const run = (text) => analyzeConnectionLog(text, BUILD);
+    // A lost record: record number 3 never arrived, and the helper's own tally still says six.
+    let a = await run([recs[0], recs[1], ...recs.slice(3), tally].join("\n") + "\n");
+    assert.equal(a.complete, false);
+    assert.ok(a.incompleteReasons.includes("missing_records:1"), a.incompleteReasons.join());
+    assert.ok(a.incompleteReasons.includes("helper_summary_mismatch"));
+    assert.equal(a.helperTallyAgrees, false);
+    // The helper says it dropped one and the gap is exactly that one: incomplete, but consistent with the helper.
+    a = await run([recs[0], recs[1], ...recs.slice(3), JSON.stringify({ v: 1, type: "dropped", count: 1, firstSeq: 102, lastSeq: 102 }), tallyLine({ dropped: 1, conns: 6, allowed: 3, denied: 2, connected: 3, bytesUp: 100 * (1 + 2 + 4 + 5 + 6) + 300, bytesDown: 1000 * (1 + 2 + 4) + 3000 })].join("\n") + "\n");
+    assert.ok(a.incompleteReasons.includes("helper_dropped_records:1"), a.incompleteReasons.join());
+    assert.equal(a.droppedRecords, 1);
+    // No tally at all (the helper died before summarising).
+    a = await run(recs.join("\n") + "\n");
+    assert.deepEqual(a.incompleteReasons, ["helper_summary_missing"]);
+    assert.equal(a.helperTallyAgrees, null);
+    // Another build's record in this build's file, a duplicate, a malformed line and a torn last line.
+    a = await run([...recs, conn(2), conn(9, { buildId: "bld_other" }), "{not json", tally].join("\n") + "\n" + '{"v":1,"type":"conn"');
+    for (const reason of ["foreign_records:1", "duplicate_records:1", "malformed_lines:1", "torn_final_line"])
+        assert.ok(a.incompleteReasons.includes(reason), `${reason} in ${a.incompleteReasons.join()}`);
+    assert.equal(a.logRecords, 7, "the six records and the duplicate are counted; the foreign record and the malformed lines are not");
+    // A registration that ended some other way than the build's own unregister.
+    a = await run(recs.join("\n") + "\n" + tallyLine({ reason: "expired" }) + "\n");
+    assert.ok(a.incompleteReasons.includes("registration_ended:expired"));
+    // The helper's tally disagreeing with the file in any figure is named.
+    for (const [field, value] of [["allowed", 9], ["denied", 9], ["connected", 9], ["failed", 9], ["bytesUp", 1], ["bytesDown", 1], ["conns", 99]]) {
+        a = await run(recs.join("\n") + "\n" + tallyLine({ [field]: value }) + "\n");
+        assert.equal(a.helperTallyAgrees, false, `a wrong ${field} in the tally must be noticed`);
+    }
+});
+test("analyzeConnectionLog: a record with no usable number is a malformed line that is still a connection, and a malformed tally is malformed, not zeros (as the agent's aggregator treats both)", async () => {
+    const noNumber = JSON.stringify({ ...JSON.parse(conn(2)), bseq: "two" });
+    const text = [conn(1), noNumber, conn(3), tallyLine({ conns: 3, allowed: 3, denied: 0, connected: 3, bytesUp: 100 + 200 + 300, bytesDown: 1000 + 2000 + 3000 })].join("\n") + "\n";
+    const a = await analyzeConnectionLog(text, BUILD);
+    assert.equal(a.logRecords, 3, "the numberless record is counted");
+    assert.equal(a.records[1].bseq, 0);
+    assert.ok(a.incompleteReasons.includes("malformed_lines:1"), a.incompleteReasons.join());
+    assert.ok(a.incompleteReasons.includes("missing_records:1"), "number 2 never arrived as far as the numbering can tell");
+    assert.deepEqual(a.totals, { allowed: 3, denied: 0, errors: 0, bytesUp: 600, bytesDown: 6000 });
+    // A tally missing a field, with a wrong type, or naming no valid build is a malformed line; one for another build is foreign.
+    const good = JSON.parse(tallyLine());
+    const withTally = async (t) => analyzeConnectionLog([conn(1), JSON.stringify(t)].join("\n") + "\n", BUILD);
+    for (const [name, t] of [
+        ["a missing count", (({ conns: _c, ...rest }) => rest)(good)],
+        ["a count that is a string", { ...good, conns: "6" }],
+        ["a negative count", { ...good, dropped: -1 }],
+        ["a stream flag that is not a boolean", { ...good, stream: "yes" }],
+        ["no version", (({ v: _v, ...rest }) => rest)(good)],
+        ["no build id", (({ buildId: _b, ...rest }) => rest)(good)],
+        ["a build id that cannot be one", { ...good, buildId: "../x" }],
+    ]) {
+        const r = await withTally(t);
+        assert.ok(r.incompleteReasons.includes("malformed_lines:1"), `${name}: ${r.incompleteReasons.join()}`);
+        assert.ok(r.incompleteReasons.includes("helper_summary_missing"), name);
+        assert.equal(r.helperTallyAgrees, null, name);
+    }
+    const other = await withTally({ ...good, buildId: "bld_other" });
+    assert.ok(other.incompleteReasons.includes("foreign_records:1"));
+});
+test("analyzeConnectionLog: unattributed lines are counted apart, and hostile text cannot reach a signed document", async () => {
+    const hostile = "evil\u0000\u001b[2J‮.example\ud800";
+    const text = [
+        conn(1, { host: hostile }),
+        JSON.stringify({ v: 1, type: "conn", ts: "x", auth: "none", decision: "deny", reason: "auth-failed", suppressed: 4 }),
+        JSON.stringify({ v: 1, type: "conn", auth: "session", decision: "allow", reason: "allowlist", host: "pub.dev", port: 443 }),
+        conn(2, { host: "2001:db8::1", port: 8443 }),
+        conn(3, { route: "x y", reason: "<script>", proto: "z".repeat(99), port: 999999, bytesUp: -5, bytesDown: 1.5 }),
+        tallyLine({ conns: 3, allowed: 3, denied: 0, connected: 3, bytesUp: 100 + 200 + 300, bytesDown: 1000 + 2000 + 3000 }),
+    ].join("\n") + "\n";
+    const a = await analyzeConnectionLog(text, BUILD);
+    assert.equal(a.logRecords, 3);
+    assert.equal(a.authFailures, 5);
+    assert.equal(a.sessionCredentialRequests, 1);
+    assert.match(a.records[0].host, /^[\x20-\x7e]+$/, "printable ASCII only");
+    assert.equal(a.records[1].dest, "[2001:db8::1]:8443", "an IPv6 literal is bracketed");
+    assert.equal(a.records[2].route, "unknown");
+    assert.equal(a.records[2].reason, "unknown");
+    assert.equal(a.records[2].port, 0);
+    assert.equal(a.records[2].bytesUp, 0, "a negative count is not a count");
+    assert.equal(a.records[2].bytesDown, 0, "a float is not a count");
+    // Whatever came in, the records are canonical-JSON safe (a signed document can hold them).
+    for (const r of a.records)
+        canonicalJson(r);
+});
+test("summariseConnections sorts by code units, never by locale, and the verifier does the same", () => {
+    // In every ICU locale ':' collates before digits; in code units ':' (0x3a) is after '0' (0x30).
+    const recs = ["10.0.0.1:443", "10.0.0.10:443", "a.example:443", "B.example:443", "Z.example:443", "z.example:443"].map((dest) => ({ dest, route: "tunnel", decision: "allow", bytesUp: 1, bytesDown: 2 }));
+    const order = summariseConnections(recs).map((d) => d.dest);
+    assert.deepEqual(order, ["10.0.0.10:443", "10.0.0.1:443", "B.example:443", "Z.example:443", "a.example:443", "z.example:443"]);
+    assert.deepEqual(V.summariseConnections(recs).map((d) => d.dest), order);
+    assert.deepEqual(V.summariseConnections(recs), summariseConnections(recs));
+    // Totals add up per group, and the bytes of a record with none are zero.
+    const merged = summariseConnections([...recs, ...recs.slice(0, 1)]);
+    assert.deepEqual(merged.find((d) => d.dest === "10.0.0.1:443"), { dest: "10.0.0.1:443", route: "tunnel", decision: "allow", conns: 2, bytesUp: 2, bytesDown: 4 });
+});
+test("a log with more distinct destinations than a document lists keeps the busiest, in the verifier's order, and says it omitted some", async () => {
+    const n = ATTESTATION_MAX_DESTINATIONS + 25;
+    const lines = Array.from({ length: n }, (_, i) => conn(i + 1, { host: `h${String(i).padStart(5, "0")}.example`, bytesUp: 1, bytesDown: 1 }));
+    lines.push(...Array.from({ length: 3 }, (_, k) => conn(n + k + 1, { host: "h00007.example", bytesUp: 1, bytesDown: 1 })));
+    const a = await analyzeConnectionLog(lines.join("\n") + "\n", BUILD);
+    assert.equal(a.destinations.length, ATTESTATION_MAX_DESTINATIONS);
+    assert.equal(a.destinationsOmitted, 25);
+    assert.ok(a.destinations.some((d) => d.dest === "h00007.example:443" && d.conns === 4), "the busiest destination is kept");
+    const sorted = [...a.destinations].sort((x, y) => (x.dest + x.route + x.decision < y.dest + y.route + y.decision ? -1 : 1));
+    assert.deepEqual(a.destinations, sorted);
+});
+test("the verifier's verdict on a bundle does not depend on the verifier's locale (a Swedish or Estonian collation puts letters in another order)", async () => {
+    // t, u and z sort differently under et_EE (z between s and t) than in code units; the document lists destinations in code-unit order.
+    const hosts = ["z.example", "t.example", "s.example", "u.example", "10.0.0.1", "10.0.0.10", "B.example", "a.example"];
+    const log = hosts.map((host, i) => conn(i + 1, { host })).join("\n") + "\n" + tallyLine({ conns: hosts.length, allowed: hosts.length, denied: 0, connected: hosts.length, bytesUp: hosts.reduce((n, _, i) => n + 100 * (i + 1), 0), bytesDown: hosts.reduce((n, _, i) => n + 1000 * (i + 1), 0) }) + "\n";
+    const analysis = await analyzeConnectionLog(log, BUILD);
+    assert.ok(analysis.complete, analysis.incompleteReasons.join());
+    const r = await issue({ log: analysis, evidence: sampleEvidence({ connectionLog: { uploaded: true, sha256: "55".repeat(32), bytes: 1000, lines: 9, complete: true, incompleteReasons: [], summary: { total: hosts.length, allowed: hosts.length, denied: 0, connected: hosts.length, failed: 0, bytesUp: analysis.totals.bytesUp, bytesDown: analysis.totals.bytesDown } } }) });
+    assert.equal(r.verdict.exit, 0, r.verdict.problems.join(";"));
+    const dir = mkdtempSync(join(tmpdir(), "appforge-locale-"));
+    try {
+        writeFileSync(join(dir, "bundle.json"), JSON.stringify(r.bundle));
+        writeFileSync(join(dir, "keys.json"), JSON.stringify(KEYS));
+        for (const locale of ["en_US.UTF-8", "et_EE.UTF-8", "sv_SE.UTF-8", "C"]) {
+            const res = spawnSync(process.execPath, [fileURLToPath(new URL("../../../scripts/appforge-verify.mjs", import.meta.url)), join(dir, "bundle.json"), "--keys", join(dir, "keys.json")], { encoding: "utf8", env: { ...process.env, LC_ALL: locale, LANG: locale } });
+            assert.equal(res.status, 0, `${locale}: ${res.stdout}`);
+        }
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+// ---------------------------------------------------------------- the agent's report
+test("the agent evidence schema clamps numbers and strips unknown fields instead of refusing evidence, and refuses what it cannot trust", () => {
+    const base = sampleEvidence();
+    const loose = clone(base);
+    loose.extraTopLevel = { anything: 1 };
+    loose.sandbox.selfTest.durationMs = 1234.7;
+    loose.sandbox.selfTest.results[0].title = "tab\u0000and‮bidi";
+    const parsed = agentVpnEvidenceSchema.parse(loose);
+    assert.equal("extraTopLevel" in parsed, false);
+    assert.equal(parsed.sandbox.selfTest.durationMs, 1235);
+    assert.match(parsed.sandbox.selfTest.results[0].title, /^[\x20-\x7e]+$/);
+    for (const [name, mutate] of [
+        ["a build id with a slash", (e) => { e.buildId = "../x"; }],
+        ["a policy hash that is not hex", (e) => { e.egress.policyHash = "nope"; }],
+        ["a helper arch that does not exist", (e) => { e.helper.arch = "riscv"; }],
+        ["a wrong version marker", (e) => { e.v = 2; }],
+        ["more than 300 self-test results", (e) => { e.sandbox.selfTest.results = Array.from({ length: 301 }, () => e.sandbox.selfTest.results[0]); }],
+        ["a status the matrix cannot produce", (e) => { e.sandbox.selfTest.results[0].status = "maybe"; }],
+    ]) {
+        const bad = clone(base);
+        mutate(bad);
+        assert.equal(agentVpnEvidenceSchema.safeParse(bad).success, false, name);
+    }
+});
+// ---------------------------------------------------------------- the document, through the real verifier
+const LAN_POLICY = await expandLeasedPolicy({ allow: [{ host: "pub.dev" }, { host: "*.googleapis.com", ports: [443] }] });
+const TUNNEL = await buildTunnelFacts({ tunnelId: "tun_1", tunnelName: "HQ", keyVersion: 2, gatewayEndpoint: "vpn.acme.example:51820", gatewayPublicKey: "A".repeat(43) + "=", tunnelCidr: "169.254.200.0/30", localAddress: "169.254.200.2", gatewayAddress: "169.254.200.1", lanCidrs: ["10.20.0.0/16"], dnsServer: "10.20.0.2", allowedDomains: ["corp.acme.example"], allowPrivateEndpoint: false, egress: { allow: [{ host: "pub.dev" }, { host: "*.googleapis.com", ports: [443] }] } }, "B".repeat(43) + "=");
+function sampleEvidence(over = {}) {
+    const results = [
+        ["net-direct-tcp", "network", "direct TCP connect to a public address", "blocked"],
+        ["net-udp", "network", "UDP to a public resolver", "blocked"],
+        ["files-agent-config", "files", "read the agent's config file", "blocked"],
+        ["proxy-loopback", "loopback", "reach the helper's loopback proxy port", "allowed"],
+    ].map(([id, area, title, expect]) => ({ id: id, area: area, title: title, tier: "core", expect: expect, status: "pass", detail: "denied inside, permitted outside" }));
+    results.push({ id: "mach-keychain", area: "mach", title: "the login keychain", tier: "core", expect: "blocked", status: "pass", detail: "denied inside, permitted outside" });
+    const extra = [
+        { id: "ssh-agent-socket", area: "unix", title: "the user's ssh-agent socket", tier: "optional", expect: "blocked", status: "na", detail: "no ssh-agent here" },
+        { id: "gap-same-user-procargs", area: "process", title: "argv/env of same-user processes", tier: "core", expect: "known_gap", status: "known_gap_open", detail: "documented gap" },
+        { id: "net-internet-1", area: "network", title: "real traffic to a public resolver", tier: "internet", expect: "blocked", status: "inconclusive", detail: "offline host" },
+    ];
+    return agentVpnEvidenceSchema.parse({
+        v: 1,
+        buildId: BUILD,
+        agent: { version: "0.3.1", os: "macOS 26.0", arch: "arm64" },
+        outcome: { status: "succeeded" },
+        helper: { version: "0.3.1", sha256: "11".repeat(32), arch: "arm64" },
+        egress: { mode: "strict", policyHash: LAN_POLICY.helperHash },
+        tunnel: { configDigest: TUNNEL.configDigest },
+        sandbox: {
+            profileVersion: SANDBOX_PROFILE_VERSION,
+            templateSha256: "22".repeat(32),
+            renderedSha256: "33".repeat(32),
+            paramsSha256: "44".repeat(32),
+            loopbackDenyPorts: [5900, 22],
+            orgId: ORG,
+            selfTest: { verdict: "pass", counts: { pass: 5, fail: 0, inconclusive: 1, na: 1, known_gap_open: 1, known_gap_closed: 0 }, startedAt: "2026-10-02T14:00:00.000Z", durationMs: 8000, results: [...results, ...extra] },
+            scope: "Seatbelt blocklist profile; known gaps: same-user procargs.",
+        },
+        connectionLog: { uploaded: true, sha256: "55".repeat(32), bytes: 1000, lines: 7, complete: true, incompleteReasons: [], summary: { total: 6, allowed: 4, denied: 2, connected: 4, failed: 0, bytesUp: 1000, bytesDown: 10000 } },
+        ...over,
+    });
+}
+function sampleFacts(over = {}) {
+    return {
+        orgId: ORG, appId: "app_1", buildId: BUILD, workflow: "vpn-compliance-check", branch: "main", commitSha: "0123456789abcdef0123456789abcdef01234567", tunnelId: "tun_1", vpnClass: 2,
+        build: { status: "succeeded", failureKind: null, queuedAt: "2026-10-02T13:59:00Z", startedAt: "2026-10-02T14:00:06Z", finishedAt: "2026-10-02T14:03:42Z" },
+        agent: { id: "agt_1", version: "0.3.1", os: "macOS 26.0" },
+        lease: { leasedAt: "2026-10-02T14:00:03Z", policy: LAN_POLICY.policy, policyHash: LAN_POLICY.helperHash, tunnel: TUNNEL },
+        events: [
+            { type: "lock_acquired", at: "2026-10-02T14:00:01Z" },
+            { type: "handshake_ok", at: "2026-10-02T14:00:05Z" },
+            { type: "tunnel_up", at: "2026-10-02T14:00:05Z" },
+            { type: "lock_released", at: "2026-10-02T14:03:45Z" },
+        ],
+        chain: { headSeq: 3, headHash: "00".repeat(32), firstEventSeq: 1 },
+        issuedAt: "2026-10-02T14:03:50Z",
+        manifests: { vpnRelease: null, agentRelease: null },
+        ...over,
+    };
+}
+/**
+ * What the server does in miniature: three earlier chain entries, the document built against that head, the registration
+ * entry, a signed checkpoint, the signed document; then the real verifier on the bundle.
+ */
+async function issue(opts = {}) {
+    const entries = [];
+    const append = async (kind, ref, at, data) => {
+        const prev = entries[entries.length - 1];
+        const seq = (prev?.seq ?? 0) + 1;
+        const prevHash = prev?.hash ?? (await auditGenesisHash(ORG));
+        const payload = auditEntryPayloadSchema.parse({ v: 1, seq, orgId: ORG, kind, ref, at, data });
+        entries.push({ seq, prevHash, hash: await auditEntryHash(prevHash, payload), kind, refId: ref, payload });
+    };
+    for (const [i, type] of ["lock_acquired", "handshake_ok", "tunnel_up"].entries()) {
+        await append("vpn_event", `evt_${i}`, "2026-10-02T14:00:05Z", { type, tunnelId: "tun_1", buildId: BUILD, agentId: "agt_1", detail: null });
+    }
+    const head = entries[entries.length - 1];
+    const evidence = opts.evidence === undefined ? sampleEvidence() : opts.evidence;
+    const log = opts.log === undefined ? await analyzeConnectionLog(goodLog(), BUILD) : opts.log;
+    const rawLog = opts.rawLog === undefined ? (log ? { sha256: "55".repeat(32), bytes: 1000 } : null) : opts.rawLog;
+    const built = await buildAttestationDocument({
+        facts: sampleFacts({ ...(opts.facts ?? {}), chain: { headSeq: head.seq, headHash: head.hash, firstEventSeq: 1 } }),
+        evidence,
+        log,
+        rawLog,
+        degradedReason: opts.degradedReason,
+    });
+    const signer = opts.signer === undefined ? KEY.signer : opts.signer;
+    assert.ok(signer, "these tests sign");
+    const sig = await signAttestationDocument(signer, built.doc);
+    await append("attestation", built.doc.id, built.doc.issuedAt, { buildId: BUILD, docSha256: await attestationDocumentSha256(built.doc), keyId: signer.keyId, completeness: built.completeness });
+    const reg = entries[entries.length - 1];
+    const cp = { orgId: ORG, seq: reg.seq, hash: reg.hash, issuedAt: built.doc.issuedAt, keyId: signer.keyId, signature: await signAuditCheckpoint(signer, auditCheckpointStatement({ orgId: ORG, seq: reg.seq, hash: reg.hash, issuedAt: built.doc.issuedAt })) };
+    const bundle = {
+        format: "appforge-evidence-bundle",
+        version: 1,
+        attestation: { doc: built.doc, signatures: [sig] },
+        auditChain: { orgId: ORG, anchor: null, entries, checkpoints: [cp] },
+        ...(log && rawLog ? { connectionLog: { encoding: "records", normalization: "appforge-conn-records-v1", records: log.records } } : {}),
+    };
+    opts.mutate?.(bundle);
+    return { built, bundle, verdict: V.verifyBundle(bundle, clone(KEYS), {}) };
+}
+test("a regulated build with complete, consistent evidence verifies authentic and complete (exit 0), and every derived number recomputes", async () => {
+    const r = await issue();
+    assert.deepEqual(r.verdict.problems, []);
+    assert.equal(r.verdict.exit, 0);
+    assert.ok(r.verdict.checks.every(([, ok]) => ok), JSON.stringify(r.verdict.checks.filter(([, ok]) => !ok)));
+    assert.equal(r.built.completeness, "full");
+    assert.equal(r.built.controlsVerdict, "all_enforced");
+    assert.equal(r.built.violations, 0);
+    const doc = r.built.doc;
+    assert.equal(doc.policy.egressPolicySha256, V.sha256hex(V.canonicalize(doc.policy.egressPolicy)));
+    assert.equal(doc.policy.helperPolicyHash, LAN_POLICY.helperHash);
+    assert.deepEqual(doc.controlTests.summary, V.summariseControls(doc.controlTests.results));
+    assert.equal(doc.controlTests.resultsSha256, V.sha256hex(V.canonicalize(doc.controlTests.results)));
+    // The counted results are the matrix's pass checks plus the server's comparisons; the rest is listed apart.
+    const ids = doc.controlTests.results.map((x) => x.id);
+    for (const id of ["net-direct-tcp", "net-udp", "files-agent-config", "proxy-loopback", "mach-keychain", "egress-mode", "policy-hash", "tunnel-config", "sandbox-profile-version", "sandbox-org", "log-digest", "log-totals"])
+        assert.ok(ids.includes(id), `result ${id} in ${ids.join()}`);
+    assert.deepEqual(doc.controlTests.knownGaps.map((g) => g.id), ["gap-same-user-procargs"]);
+    assert.deepEqual(doc.controlTests.notCounted.map((g) => g.id), ["net-internet-1", "ssh-agent-socket"]);
+    assert.ok(!ids.includes("gap-same-user-procargs"), "a documented gap is never presented as a PASS");
+    // What was not checked against a release is said so, and is not a violation.
+    assert.deepEqual(doc.crossChecks.filter((c) => c.status === "not_checked").map((c) => c.id), ["helper-release", "sandbox-template"]);
+    assert.equal(doc.result.controlsVerdict, "all_enforced");
+    assert.equal(doc.scope.limits.length, ATTESTATION_LIMITS.length);
+    canonicalJson(doc);
+});
+test("the cross-checks against a published release manifest: a match passes, a mismatch is a recorded violation (exit 2), a missing manifest is 'not checked'", async () => {
+    const manifestFor = (helperSha, templateSha) => ({
+        vpnRelease: { v: 1, prefix: "vpn-releases", version: "0.3.1", publishedAt: "2026-10-01T00:00:00Z", artifacts: [{ name: "appforge-vpn-darwin-arm64", sha256: helperSha, bytes: 5_000_000 }, { name: "appforge-vpn-darwin-amd64", sha256: "99".repeat(32), bytes: 5_000_000 }] },
+        agentRelease: { v: 1, prefix: "agent-releases", version: "0.3.1", publishedAt: "2026-10-01T00:00:00Z", artifacts: [{ name: "agent.mjs", sha256: "77".repeat(32), bytes: 1_000_000 }], meta: { sandboxTemplateSha256: templateSha } },
+    });
+    let r = await issue({ facts: { manifests: manifestFor("11".repeat(32), "22".repeat(32)) } });
+    assert.equal(r.verdict.exit, 0, r.verdict.problems.join(";"));
+    assert.deepEqual(r.built.doc.crossChecks.filter((c) => c.status === "not_checked"), []);
+    r = await issue({ facts: { manifests: manifestFor("ee".repeat(32), "22".repeat(32)) } });
+    assert.equal(r.verdict.exit, 2, "an authentic document that records a violation");
+    assert.equal(r.built.controlsVerdict, "violations_detected");
+    assert.deepEqual(r.built.doc.controlTests.results.filter((x) => x.verdict === "fail").map((x) => x.id), ["helper-release"]);
+    r = await issue({ facts: { manifests: manifestFor("11".repeat(32), "ee".repeat(32)) } });
+    assert.equal(r.verdict.exit, 2);
+    assert.deepEqual(r.built.doc.controlTests.results.filter((x) => x.verdict === "fail").map((x) => x.id), ["sandbox-template"]);
+    // A manifest for another version proves nothing about this one.
+    const wrongVersion = manifestFor("ee".repeat(32), "ee".repeat(32));
+    wrongVersion.vpnRelease.version = "0.2.9";
+    wrongVersion.agentRelease.version = "0.2.9";
+    r = await issue({ facts: { manifests: wrongVersion } });
+    assert.equal(r.verdict.exit, 0);
+    assert.equal(r.built.doc.crossChecks.filter((c) => c.status === "not_checked").length, 2);
+});
+test("every disagreement between what the agent claims and what the server knows becomes a failing control test, never a silent pass", async () => {
+    const cases = [
+        ["a policy hash the helper echoed that is not the leased policy's", (e) => { e.egress.policyHash = "ab".repeat(32); }, "policy-hash"],
+        ["a helper in standard mode on a strict build", (e) => { e.egress.mode = "standard"; }, "egress-mode"],
+        ["a tunnel configuration digest the server did not send", (e) => { e.tunnel.configDigest = "cd".repeat(32); }, "tunnel-config"],
+        ["a sandbox profile generation the server did not ask for", (e) => { e.sandbox.profileVersion = SANDBOX_PROFILE_VERSION + 1; }, "sandbox-profile-version"],
+        ["a sandbox prepared for another organisation", (e) => { e.sandbox.orgId = "org_other"; }, "sandbox-org"],
+        ["a sandbox self-test that did not pass", (e) => { e.sandbox.selfTest.verdict = "fail"; e.sandbox.selfTest.results[0].status = "fail"; }, "sandbox-selftest"],
+        ["a raw log digest that is not the object the server holds", (e) => { e.connectionLog.sha256 = "ee".repeat(32); }, "log-digest"],
+        ["connection totals that differ from the server's recomputation", (e) => { e.connectionLog.summary.denied = 99; }, "log-totals"],
+    ];
+    for (const [name, mutate, id] of cases) {
+        const e = sampleEvidence();
+        mutate(e);
+        const r = await issue({ evidence: e });
+        assert.equal(r.verdict.exit, 2, `${name}: ${r.verdict.problems.join(";")}`);
+        assert.equal(r.built.controlsVerdict, "violations_detected", name);
+        assert.ok(r.built.doc.controlTests.results.some((x) => x.id === id && x.verdict === "fail"), `${name}: a failing result ${id} in ${r.built.doc.controlTests.results.map((x) => `${x.id}:${x.verdict}`).join()}`);
+        assert.ok(r.built.violations >= 1, name);
+        assert.equal(r.built.doc.result.violations, r.built.violations);
+    }
+    // A regulated build that reports no sandbox evidence at all is itself a violation.
+    const none = await issue({ evidence: sampleEvidence({ sandbox: null }) });
+    assert.equal(none.verdict.exit, 2);
+    assert.ok(none.built.doc.controlTests.results.some((x) => x.id === "sandbox-evidence" && x.verdict === "fail"));
+});
+test("a regulated build whose sandbox self-test counted no checks is not 'all enforced': nothing evidences isolation", async () => {
+    const empty = sampleEvidence();
+    empty.sandbox.selfTest.results = [];
+    const r = await issue({ evidence: empty });
+    assert.equal(r.built.controlsVerdict, "not_evaluated");
+    assert.ok(r.built.gaps.some((g) => /no checks the matrix counts/.test(g)));
+    assert.equal(r.built.completeness, "partial");
+    assert.equal(r.verdict.exit, 3);
+});
+test("a strict-egress build without a sandbox is checked on the network policy only, and the document does not claim isolation", async () => {
+    const r = await issue({ facts: { vpnClass: 1 }, evidence: sampleEvidence({ sandbox: null }) });
+    assert.equal(r.verdict.exit, 0, r.verdict.problems.join(";"));
+    assert.equal(r.built.controlsVerdict, "network_policy_checked");
+    assert.equal(r.built.doc.policy.enforcement, null);
+    assert.match(r.built.doc.scope.statement, /isolation of the build host is NOT claimed/);
+    const html = await renderEvidencePage(r.bundle);
+    assert.doesNotMatch(html, /All network and isolation controls were enforced/);
+});
+test("evidence that is present but incomplete is 'partial' and exits 3, with the reasons in the document", async () => {
+    // The helper's ring dropped a record.
+    const lines = goodLog().trimEnd().split("\n");
+    const dropped = await analyzeConnectionLog([lines[0], lines[1], ...lines.slice(3, 6), JSON.stringify({ v: 1, type: "dropped", count: 1, firstSeq: 102, lastSeq: 102 }), tallyLine({ dropped: 1, allowed: 3, connected: 3, bytesUp: 100 * (1 + 2 + 4) + 0, bytesDown: 1000 * (1 + 2 + 4) })].join("\n") + "\n", BUILD);
+    assert.equal(dropped.complete, false);
+    let r = await issue({ log: dropped, evidence: sampleEvidence({ connectionLog: { uploaded: true, sha256: "55".repeat(32), bytes: 1000, lines: 7, complete: false, incompleteReasons: ["helper_dropped_records:1"], summary: null } }) });
+    assert.equal(r.built.completeness, "partial");
+    assert.equal(r.verdict.exit, 3, r.verdict.problems.join(";"));
+    assert.ok(r.built.gaps.some((g) => /connection log is incomplete/.test(g)));
+    assert.equal(r.built.doc.connections.logCompleteness, "incomplete");
+    // No raw log at all (too large, or the upload failed).
+    r = await issue({ log: null, rawLog: null, evidence: sampleEvidence({ connectionLog: { uploaded: false, omitted: "too_large", sha256: "55".repeat(32), bytes: 99_000_000, lines: 300000, complete: true, incompleteReasons: [], summary: null } }) });
+    assert.equal(r.built.completeness, "partial");
+    assert.equal(r.verdict.exit, 3);
+    assert.equal(r.built.doc.connections.logCompleteness, "not_available");
+    assert.ok(r.built.gaps.some((g) => /connection log is not available \(too_large\)/.test(g)));
+    // The bundle then simply has no raw records: the verifier says so and still checks the rest.
+    assert.ok(r.verdict.notes.some((n) => /raw connection log not included/.test(n)));
+});
+test("a document issued with no agent report is degraded: server-observed facts only, exit 3, and it claims no connection data and no control verdict", async () => {
+    const r = await issue({ evidence: null, log: null, rawLog: null, degradedReason: "the agent did not report evidence within 30 minutes of the build ending" });
+    assert.equal(r.built.completeness, "server_observed_only");
+    assert.equal(r.built.controlsVerdict, "not_evaluated");
+    assert.equal(r.verdict.exit, 3, r.verdict.problems.join(";"));
+    assert.equal(r.built.doc.controlTests, undefined);
+    assert.equal(r.built.doc.helper.reportedBy, "none");
+    assert.deepEqual(r.built.doc.connections.destinations, []);
+    assert.match(String(r.built.doc.connections.note), /never reported/);
+    assert.deepEqual(r.built.gaps, ["the agent did not report evidence within 30 minutes of the build ending"]);
+    // What the server did observe is there.
+    assert.equal(r.built.doc.timing.lockAcquiredAt, "2026-10-02T14:00:01Z");
+    assert.equal(r.built.doc.timing.lockReleasedAt, "2026-10-02T14:03:45Z");
+    assert.equal(r.built.doc.result.agentReportedStatus, null);
+    assert.equal(r.built.doc.policy.egressPolicySha256, V.sha256hex(V.canonicalize(LAN_POLICY.policy)));
+    assert.match((await renderEvidencePage(r.bundle)), /No control-test verdict is recorded/);
+});
+test("without a lease-time record the document says so instead of inventing the policy", async () => {
+    const r = await issue({ facts: { lease: null } });
+    assert.equal(r.built.doc.policy.egressPolicy, undefined);
+    assert.equal(r.built.doc.policy.egressPolicySha256, undefined);
+    assert.equal(r.built.doc.tunnel, null);
+    assert.equal(r.built.completeness, "partial");
+    assert.ok(r.built.gaps.some((g) => /no lease-time record/.test(g)));
+    assert.equal(r.verdict.exit, 3);
+});
+test("a stored lease record whose policy does not hash to its recorded hash is reported, not trusted", async () => {
+    const bad = { ...sampleFacts().lease, policyHash: "ab".repeat(32) };
+    const r = await issue({ facts: { lease: bad } });
+    assert.ok(r.built.gaps.some((g) => /internally inconsistent/.test(g)));
+});
+test("agent hygiene evidence rides along as the opaque object it is: numbers canonical JSON cannot carry are rounded (and say so), only an oversize or too-deep one is left out with a gap", async () => {
+    const ok = await issue({ evidence: sampleEvidence({ hygiene: { sweptJobDirs: 3, strays: [], note: "x" } }) });
+    assert.deepEqual(ok.built.doc.isolation.hygiene, { note: "x", strays: [], sweptJobDirs: 3 });
+    assert.equal(ok.built.doc.isolation.hygieneNote, undefined);
+    assert.equal(ok.verdict.exit, 0);
+    // Floats are rounded, a lone surrogate replaced, a non-finite number becomes null: kept, with a note, still verifiable.
+    const floaty = await issue({ evidence: sampleEvidence({ hygiene: { ratio: 0.5, seconds: 12.4, nested: { list: [1.6, "a\ud800b"] } } }) });
+    assert.deepEqual(floaty.built.doc.isolation.hygiene, { nested: { list: [2, "a\ufffdb"] }, ratio: 1, seconds: 12 });
+    assert.match(floaty.built.doc.isolation.hygieneNote, /not integers/);
+    assert.equal(floaty.built.completeness, "full", "a normalised hygiene object is still evidence, not a gap");
+    assert.equal(floaty.verdict.exit, 0, floaty.verdict.problems.join(";"));
+    // Too large, or nested beyond what is carried: left out, with a gap and a partial document.
+    const huge = await issue({ evidence: sampleEvidence({ hygiene: { blob: "x".repeat(20_000) } }) });
+    assert.equal(huge.built.doc.isolation.hygiene, undefined);
+    assert.ok(huge.built.gaps.some((g) => /too large or too deeply nested/.test(g)));
+    assert.equal(huge.built.completeness, "partial");
+    let deep = 1;
+    for (let i = 0; i < 12; i++)
+        deep = { d: deep };
+    const nested = await issue({ evidence: sampleEvidence({ hygiene: deep }) });
+    assert.equal(nested.built.doc.isolation.hygiene, undefined);
+    assert.equal(nested.built.completeness, "partial");
+});
+// ---------------------------------------------------------------- tampering is still caught for documents this code writes
+test("the verifier rejects every tampering of an authentic document built here (it is the same evidence format the server writes)", async () => {
+    const good = await issue();
+    assert.equal(good.verdict.exit, 0);
+    const verify = (b) => V.verifyBundle(clone(b), clone(KEYS), {});
+    let b = clone(good.bundle);
+    b.attestation.doc.result.controlsVerdict = "all_enforced";
+    b.attestation.doc.controlTests.results.find((r) => r.id === "policy-hash").reason = "edited";
+    assert.equal(verify(b).exit, 1, "an edited result");
+    b = clone(good.bundle);
+    b.connectionLog.records[0].bytesUp += 1;
+    assert.equal(verify(b).exit, 1, "an edited raw record");
+    b = clone(good.bundle);
+    b.attestation.doc.connections.destinations.pop();
+    assert.equal(verify(b).exit, 1, "an edited summary");
+    b = clone(good.bundle);
+    b.auditChain.checkpoints = [];
+    assert.equal(verify(b).exit, 1, "no checkpoint");
+    b = clone(good.bundle);
+    b.attestation.doc.subject.buildId = "bld_other";
+    assert.equal(verify(b).exit, 1, "a replayed document");
+    // An unsigned document has no bundle the verifier accepts.
+    b = clone(good.bundle);
+    b.attestation.signatures = [];
+    assert.equal(verify(b).exit, 1, "unsigned");
+});
+// ---------------------------------------------------------------- the printable page
+test("the printable page is a byte-for-byte twin of the verifier's renderer, and --render-check proves it", async () => {
+    const variants = [
+        await issue(),
+        await issue({ evidence: Object.assign(sampleEvidence(), { egress: { mode: "strict", policyHash: "ab".repeat(32) } }) }),
+        await issue({ evidence: null, log: null, rawLog: null, degradedReason: "no report" }),
+        await issue({ facts: { vpnClass: 1 }, evidence: sampleEvidence({ sandbox: null }) }),
+        // Hostile text everywhere an attacker-influenced string can reach a page.
+        await issue({ facts: { workflow: "</script><script>alert(1)</script>", branch: "a&b<c>\"d'", commitSha: null, tunnelId: null } }),
+    ];
+    for (const [i, v] of variants.entries()) {
+        const html = await renderEvidencePage(v.bundle);
+        const expected = V.renderEvidenceHtml(JSON.parse(JSON.stringify(v.bundle)), { docSha256: V.sha256hex(V.canonicalize(v.bundle.attestation.doc)) });
+        assert.equal(html, expected, `variant ${i}: the page must equal the verifier's own rendering`);
+        assert.deepEqual(V.renderCheck(html), [], `variant ${i}`);
+        assert.equal(V.detectInput(html).kind, "html");
+        assert.deepEqual(V.detectInput(html).bundle, JSON.parse(JSON.stringify(v.bundle)));
+        assert.equal(V.verifyBundle(V.detectInput(html).bundle, clone(KEYS), {}).exit, v.verdict.exit, `variant ${i}: the embedded JSON verifies as the bundle does`);
+    }
+    assert.doesNotMatch(await renderEvidencePage(variants[4].bundle), /<script>alert/);
+    // Editing the visible text is invisible to the JSON but not to --render-check.
+    const html = await renderEvidencePage(variants[0].bundle);
+    assert.notEqual(V.renderCheck(html.replace("All network and isolation controls were enforced", "TRUST US")).length, 0);
+});
+test("the page is rendered from a JSON round trip of the bundle, so a value JSON cannot carry cannot make it diverge from the verifier's re-render", async () => {
+    const v = await issue();
+    const bundle = clone(v.bundle);
+    // Integer-like keys are ordered first by JS however they were inserted; the page must still survive them.
+    bundle.attestation.doc.result = { z: 1, "2": "two", a: 3, "1": "one", ...bundle.attestation.doc.result };
+    assert.deepEqual(V.renderCheck(await renderEvidencePage(bundle)), []);
+    // A value JSON turns into something else (undefined is dropped, a non-finite number becomes null): the page shows what the embedded JSON says.
+    const odd = clone(v.bundle);
+    odd.attestation.doc.auditChain.headSeq = Number.NaN;
+    const html = await renderEvidencePage(odd);
+    assert.deepEqual(V.renderCheck(html), []);
+    assert.match(html, /seq n\/a, hash/, "NaN is shown as the embedded JSON has it (null), not as 'NaN'");
+    // Called on the raw in-memory bundle, the twin would print the NaN: renderEvidencePage exists to avoid that.
+    assert.match(renderEvidenceHtml(odd, { docSha256: "0".repeat(64) }), /seq NaN, hash/);
+});
+// ---------------------------------------------------------------- chain kinds, tunnel facts, manifests, keys
+test("the chain's known kinds are the verifier's, and an unknown kind still fails verification", async () => {
+    assert.deepEqual([...AUDIT_ENTRY_KINDS].sort(), ["attestation", "gap", "vpn_event"]);
+    const data = {
+        vpn_event: { type: "tunnel_up", tunnelId: null, buildId: null, agentId: null, detail: null },
+        attestation: { buildId: BUILD, docSha256: "ab".repeat(32), keyId: null, completeness: "full" },
+        gap: { buildId: BUILD, reason: "agent_did_not_report", detail: "x" },
+    };
+    const chain = [];
+    for (const kind of AUDIT_ENTRY_KINDS) {
+        const seq = chain.length + 1;
+        const prevHash = chain[chain.length - 1]?.hash ?? (await auditGenesisHash(ORG));
+        const payload = auditEntryPayloadSchema.parse({ v: 1, seq, orgId: ORG, kind, ref: `r${seq}`, at: "2026-10-02T14:00:00Z", data: data[kind] });
+        chain.push({ seq, prevHash, hash: await auditEntryHash(prevHash, payload), payload });
+    }
+    assert.equal((await verifyAuditChain({ orgId: ORG, entries: chain })).ok, true);
+    // The verifier accepts each kind core knows (structure only: nothing is signed here, so it is incomplete, not failed) ...
+    const lines = [{ type: "header", format: "appforge-audit-export", version: 1, orgId: ORG }, ...chain.map((c, i) => ({ type: "entry", ...c, kind: c.payload.kind, refId: `r${i + 1}` })), { type: "trailer", next: null, entries: chain.length, headSeq: chain.length, headHash: chain[chain.length - 1].hash }];
+    const res = V.verifyExport(lines.map((l) => JSON.stringify(l)).join("\n") + "\n", clone(KEYS), {});
+    assert.deepEqual(res.problems, []);
+    assert.equal(res.exit, 3);
+    // ... and rejects one neither knows, on both sides.
+    const prevHash = chain[chain.length - 1].hash;
+    const alien = { v: 1, seq: 4, orgId: ORG, kind: "mystery", ref: "x", at: "2026-10-02T14:00:00Z", data: {} };
+    assert.equal((await verifyAuditChain({ orgId: ORG, entries: [...chain, { seq: 4, prevHash, hash: await auditEntryHash(prevHash, alien), payload: alien }] })).ok, false);
+    assert.throws(() => auditEntryPayloadSchema.parse(alien));
+    // A malformed attestation entry is refused by core's schema (the verifier checks the fields it relies on).
+    assert.throws(() => auditEntryPayloadSchema.parse({ ...alien, kind: "attestation", data: { buildId: BUILD } }));
+    assert.throws(() => auditEntryPayloadSchema.parse({ ...alien, kind: "attestation", data: { buildId: BUILD, docSha256: "short", keyId: null, completeness: "full" } }));
+});
+test("the key-free tunnel digest is stable, order-sensitive where it should be, and changes with every configuration field", async () => {
+    const base = { tunnelId: "tun_1", keyVersion: 2, gatewayEndpoint: "vpn.acme.example:51820", gatewayPublicKey: "A".repeat(43) + "=", tunnelCidr: "169.254.200.0/30", localAddress: "169.254.200.2", gatewayAddress: "169.254.200.1", lanCidrs: ["10.20.0.0/16"], dnsServer: "10.20.0.2", allowedDomains: ["corp.acme.example"], allowPrivateEndpoint: false };
+    const d0 = await vpnPublicConfigDigest(base);
+    assert.match(d0, /^[0-9a-f]{64}$/);
+    assert.equal(d0, await vpnPublicConfigDigest({ ...base }));
+    assert.equal(d0, await vpnPublicConfigDigest({ ...base, allowPrivateEndpoint: undefined }), "an absent lab-mode flag is false");
+    for (const [k, v] of Object.entries({ keyVersion: 3, gatewayEndpoint: "x:1", gatewayPublicKey: "B".repeat(43) + "=", tunnelCidr: "169.254.201.0/30", dnsServer: null, lanCidrs: ["10.21.0.0/16"], allowedDomains: [], allowPrivateEndpoint: true, tunnelId: "tun_2", egress: { allow: [{ host: "pub.dev" }] } })) {
+        assert.notEqual(await vpnPublicConfigDigest({ ...base, [k]: v }), d0, `a change of ${k} must change the digest`);
+    }
+    // A secret in the job is not part of it (it cannot be: the input type has no key fields).
+    const withKeys = { ...base, privateKey: "SECRET", presharedKey: "SECRET2" };
+    assert.equal(await vpnPublicConfigDigest(withKeys), d0);
+    const facts = await buildTunnelFacts({ ...base, tunnelName: "HQ" }, "B".repeat(43) + "=");
+    assert.equal(facts.configDigest, d0);
+    assert.match(facts.appforgePublicKeyFp ?? "", /^[0-9a-f]{32}$/);
+    assert.equal((await buildTunnelFacts(base, null)).appforgePublicKeyFp, null);
+    assert.ok(!JSON.stringify(facts).includes("SECRET"));
+});
+test("release manifests and object keys are validated, and an unsafe id never reaches a key", () => {
+    const good = { v: 1, prefix: "vpn-releases", version: "0.3.1", publishedAt: "2026-10-01T00:00:00Z", artifacts: [{ name: "appforge-vpn-darwin-arm64", sha256: "ab".repeat(32), bytes: 10 }] };
+    assert.deepEqual(parseReleaseManifest(JSON.stringify(good))?.artifacts[0]?.name, "appforge-vpn-darwin-arm64");
+    for (const bad of ["", "{", "[]", JSON.stringify({ ...good, v: 2 }), JSON.stringify({ ...good, artifacts: [{ name: "x", sha256: "short", bytes: 1 }] })])
+        assert.equal(parseReleaseManifest(bad), null, bad);
+    assert.equal(releaseManifestKey("vpn-releases", "0.3.1"), "vpn-releases/0.3.1/manifest.json");
+    assert.throws(() => releaseManifestKey("vpn-releases", "../x"));
+    assert.equal(connectionLogKey("org_1", "bld-1"), "evidence/org_1/bld-1/conn.jsonl");
+    for (const [o, b] of [["org/../x", "b"], ["o", "../b"], ["", "b"], ["o", ""], ["o", "b/c"]])
+        assert.throws(() => connectionLogKey(o, b));
+});
+test("sha256 of a canonical document is what the chain registers", async () => {
+    const r = await issue();
+    const reg = r.bundle.auditChain.entries[r.bundle.auditChain.entries.length - 1].payload;
+    assert.equal(reg.data.docSha256, await attestationDocumentSha256(r.bundle.attestation.doc));
+    assert.equal(reg.data.docSha256, await sha256Hex(canonicalJson(r.bundle.attestation.doc)));
+    assert.equal(reg.data.docSha256, V.sha256hex(V.canonicalize(r.bundle.attestation.doc)));
+});
+//# sourceMappingURL=vpn-attestation.test.js.map