@aria_asi/cli 0.2.39 → 0.2.41

package/scripts/self-test-governed-surface-runner.mjs

@@ -0,0 +1,198 @@
+import { mkdir, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import {
+  DEFAULT_SANDBOX_NAMESPACE,
+  DEFAULT_SANDBOX_ROOT,
+  GOVERNED_SURFACES,
+  GovernedSurfaceRunner,
+  governedFileSha256,
+} from '../dist/aria-connector/src/governed-surface-runner.js';
+
+const sessionId = `surface-runner-smoke-${process.pid}`;
+const scratchRoot = path.join(DEFAULT_SANDBOX_ROOT, 'connector-production-smoke');
+const governanceLedgerRoot = path.join(scratchRoot, 'ledgers');
+
+function row(name, pass, evidence = {}) {
+  return { name, pass: pass === true, evidence };
+}
+
+async function writeBaseline(name) {
+  await mkdir(scratchRoot, { recursive: true });
+  const target = path.join(scratchRoot, `${name}.txt`);
+  await writeFile(target, 'baseline\n', 'utf8');
+  return target;
+}
+
+async function deniedWriteSmoke() {
+  const runner = new GovernedSurfaceRunner({ sessionId, governanceLedgerRoot });
+  const target = await writeBaseline('denied-write');
+  const before = await governedFileSha256(target);
+  const verdict = await runner.run({
+    surfaceId: 'codex',
+    action: 'write',
+    target: { path: target },
+    sandbox: { namespace: DEFAULT_SANDBOX_NAMESPACE },
+    reason: 'connector governed runner denied-write smoke',
+  }, async () => {
+    await writeFile(target, 'executed\n', 'utf8');
+    return { wrote: true };
+  });
+  const after = await governedFileSha256(target);
+  return row('denied_write_requires_verified_receipt', verdict.blocked && !verdict.executed && before === after, {
+    blocked: verdict.blocked,
+    executed: verdict.executed,
+    before,
+    after,
+    reason: verdict.reason,
+  });
+}
+
+async function runtimeUnavailableSmoke() {
+  const runner = new GovernedSurfaceRunner({
+    runtimeUrl: 'http://127.0.0.1:1',
+    sessionId,
+    governanceLedgerRoot,
+  });
+  const target = await writeBaseline('runtime-unavailable');
+  const before = await governedFileSha256(target);
+  const verdict = await runner.run({
+    surfaceId: 'codex',
+    action: 'write',
+    target: { path: target },
+    sandbox: { namespace: DEFAULT_SANDBOX_NAMESPACE },
+    reason: 'connector governed runner unavailable-runtime smoke',
+    verify: { verified: true, receipt: 'connector-smoke-receipt' },
+    runtimeTimeoutMs: 300,
+  }, async () => {
+    await writeFile(target, 'executed\n', 'utf8');
+    return { wrote: true };
+  });
+  const after = await governedFileSha256(target);
+  return row('verified_write_blocks_when_runtime_unavailable', verdict.blocked && !verdict.executed && before === after, {
+    blocked: verdict.blocked,
+    executed: verdict.executed,
+    before,
+    after,
+    reason: verdict.reason,
+  });
+}
+
+async function namespaceSmoke() {
+  const runner = new GovernedSurfaceRunner({ sessionId, governanceLedgerRoot });
+  const target = await writeBaseline('namespace-denied');
+  const before = await governedFileSha256(target);
+  const verdict = await runner.run({
+    surfaceId: 'shell',
+    action: 'write',
+    target: { path: target },
+    sandbox: { namespace: 'aria' },
+    reason: 'connector governed runner namespace smoke',
+    verify: { verified: true, receipt: 'connector-smoke-receipt' },
+  }, async () => {
+    await writeFile(target, 'executed\n', 'utf8');
+    return { wrote: true };
+  });
+  const after = await governedFileSha256(target);
+  return row('non_sandbox_namespace_denied', verdict.blocked && !verdict.executed && before === after, {
+    blocked: verdict.blocked,
+    executed: verdict.executed,
+    before,
+    after,
+    reason: verdict.reason,
+  });
+}
+
+async function outputSmoke() {
+  const runner = new GovernedSurfaceRunner({ sessionId, governanceLedgerRoot });
+  const started = Date.now();
+  const verdict = await runner.validateOutput({
+    text: 'This is complete without proof and includes an unsupported completion claim.',
+    surfaceId: 'codex',
+    sessionId,
+    timeoutMs: 3000,
+  });
+  const elapsedMs = Date.now() - started;
+  return row('output_validation_bounded_block', !verdict.passed && verdict.severity === 'block' && elapsedMs < 4000, {
+    passed: verdict.passed,
+    severity: verdict.severity,
+    elapsedMs,
+    violations: verdict.violations,
+  });
+}
+
+async function receiptSmoke() {
+  const runner = new GovernedSurfaceRunner({
+    runtimeUrl: 'http://127.0.0.1:1',
+    sessionId,
+    governanceLedgerRoot,
+  });
+  const receipt = await runner.recordGovernanceOutcome({
+    surfaceId: 'codex',
+    verdict: 'pass',
+    summary: 'connector governed surface runner receipt smoke',
+    evidence: { smoke: 'receipt_increment' },
+    sessionId,
+  });
+  return row('governance_receipt_increment', receipt.ok && receipt.delta >= 1, {
+    before: receipt.before,
+    after: receipt.after,
+    delta: receipt.delta,
+    ledger: receipt.ledger,
+  });
+}
+
+async function surfaceContractSmoke() {
+  const runner = new GovernedSurfaceRunner({ sessionId, governanceLedgerRoot });
+  const results = [];
+  for (const surfaceId of GOVERNED_SURFACES) {
+    const target = await writeBaseline(`surface-${String(surfaceId).replace(/[^a-zA-Z0-9_-]/g, '_')}`);
+    const before = await governedFileSha256(target);
+    const verdict = await runner.run({
+      surfaceId,
+      action: 'write',
+      target: { path: target },
+      sandbox: { namespace: DEFAULT_SANDBOX_NAMESPACE },
+      reason: 'connector governed runner all-surface smoke',
+    }, async () => {
+      await writeFile(target, 'executed\n', 'utf8');
+      return { wrote: true };
+    });
+    const after = await governedFileSha256(target);
+    results.push({
+      surfaceId,
+      pass: verdict.blocked && !verdict.executed && before === after,
+      blocked: verdict.blocked,
+      executed: verdict.executed,
+    });
+  }
+  return row('all_surface_denied_write_contract', results.length === 7 && results.every((item) => item.pass), {
+    surfaceCount: results.length,
+    passCount: results.filter((item) => item.pass).length,
+    surfaces: results,
+  });
+}
+
+async function run() {
+  const rows = [
+    await deniedWriteSmoke(),
+    await runtimeUnavailableSmoke(),
+    await namespaceSmoke(),
+    await outputSmoke(),
+    await receiptSmoke(),
+    await surfaceContractSmoke(),
+  ];
+  const summary = {
+    ok: rows.every((item) => item.pass),
+    total: rows.length,
+    passed: rows.filter((item) => item.pass).length,
+    failed: rows.filter((item) => !item.pass).length,
+    rows,
+  };
+  console.log(JSON.stringify(summary, null, 2));
+  process.exit(summary.ok ? 0 : 1);
+}
+
+run().catch((error) => {
+  console.error(JSON.stringify({ ok: false, error: error.stack || error.message }, null, 2));
+  process.exit(1);
+});

package/scripts/self-test-harness-gates.mjs

@@ -1,13 +1,22 @@
 #!/usr/bin/env node
 
 import assert from 'node:assert/strict';
-import { spawnSync } from 'node:child_process';
 import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { pathToFileURL } from 'node:url';
 
 const repoRoot = join(import.meta.dirname, '..', '..', '..');
+const previousAriaHome = process.env.ARIA_HOME;
+const isolatedAriaHome = mkdtempSync(join(tmpdir(), 'aria-harness-gates-'));
+process.env.ARIA_HOME = isolatedAriaHome;
+
+process.on('exit', () => {
+  if (previousAriaHome === undefined) delete process.env.ARIA_HOME;
+  else process.env.ARIA_HOME = previousAriaHome;
+  rmSync(isolatedAriaHome, { recursive: true, force: true });
+});
+
 const gateModule = await import(pathToFileURL(join(repoRoot, 'ops/claude-hooks/lib/skill-autoload-gate.mjs')));
 
 async function captureStderr(fn) {
@@ -195,7 +204,7 @@ try {
   const message = String(error?.message || error);
   assert.doesNotMatch(message, /ARIA LOCAL OUTPUT BLOCK/, 'malformed handoff must not brick the whole screen');
 }
-const recoveryPath = join(process.env.HOME || tmpdir(), '.aria', 'governance-recovery-current.json');
+const recoveryPath = join(isolatedAriaHome, '.aria', 'governance-recovery-current.json');
 assert.equal(existsSync(recoveryPath), true, 'malformed handoff must persist recovery context');
 const recoveryState = JSON.parse(readFileSync(recoveryPath, 'utf8'));
 assert.equal(recoveryState.governanceMode, 'recovery-required', 'malformed handoff must require recovery');
@@ -231,17 +240,11 @@ for (const gatePath of [
   join(repoRoot, 'scripts/aria-governance-gate.mjs'),
   join(repoRoot, 'harness/packages/harness-http-client/scripts/aria-governance-gate.mjs'),
 ]) {
-  const child = spawnSync(process.execPath, [gatePath], {
-    input: `${postCompactPayload}\n`,
-    encoding: 'utf8',
-  });
-  assert.equal(child.status, 0, `post-compact governance allow failed for ${gatePath}: ${child.stdout}${child.stderr}`);
-  const result = JSON.parse(child.stdout);
-  assert.equal(result.decision, 'allow', `post-compact governance must allow for ${gatePath}`);
+  const gate = await import(pathToFileURL(gatePath));
+  assert.equal(typeof gate.evaluateGovernanceGate, 'function', `evaluateGovernanceGate export missing for ${gatePath}`);
+  const result = gate.evaluateGovernanceGate(JSON.parse(postCompactPayload));
+  assert.equal(result.decision, 'allow', `post-compact governance must allow for ${gatePath}: ${JSON.stringify(result)}`);
   assert.equal(result.postCompactContinuation?.active, true, `post-compact marker missing for ${gatePath}`);
 }
 
-const temp = mkdtempSync(join(tmpdir(), 'aria-harness-gates-'));
-rmSync(temp, { recursive: true, force: true });
-
 console.log('harness gate self-test passed');

package/scripts/self-test-harness-ticker-sidecar.mjs

@@ -0,0 +1,153 @@
+#!/usr/bin/env node
+import assert from 'node:assert/strict';
+import { existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { spawn, spawnSync } from 'node:child_process';
+
+const repoRoot = resolve(import.meta.dirname, '..', '..', '..');
+const sidecarPath = resolve(repoRoot, 'packages', 'aria-connector', 'hooks', 'codex-native', 'aria-harness-ticker-sidecar.mjs');
+const hookPath = resolve(repoRoot, 'packages', 'aria-connector', 'hooks', 'codex-native', 'aria-live-ticker.mjs');
+const home = join(tmpdir(), `aria-harness-ticker-sidecar-${process.pid}`);
+const stateDir = join(home, '.aria', 'runtime', 'state');
+const codexTmp = join(home, '.codex', 'tmp', 'aria-hook-turn-state');
+
+function writeJsonl(name, rows) {
+  mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+  writeFileSync(join(stateDir, name), rows.map((row) => JSON.stringify(row)).join('\n') + '\n', { mode: 0o600 });
+}
+
+function writeHomeJsonl(name, rows) {
+  mkdirSync(join(home, '.aria'), { recursive: true, mode: 0o700 });
+  writeFileSync(join(home, '.aria', name), rows.map((row) => JSON.stringify(row)).join('\n') + '\n', { mode: 0o600 });
+}
+
+function run(args, extraEnv = {}) {
+  return spawnSync(process.execPath, [sidecarPath, ...args], {
+    env: {
+      ...process.env,
+      HOME: home,
+      ARIA_HARNESS_TICKER_INTERVAL_MS: '250',
+      ...extraEnv,
+    },
+    encoding: 'utf8',
+    maxBuffer: 1024 * 1024,
+  });
+}
+
+function assertOk(child, label) {
+  assert.equal(child.status, 0, `${label} exits 0: stdout=${child.stdout} stderr=${child.stderr}`);
+}
+
+try {
+  rmSync(home, { recursive: true, force: true });
+  mkdirSync(codexTmp, { recursive: true, mode: 0o700 });
+  const now = new Date().toISOString();
+  writeJsonl('gated-ledger.jsonl', [
+    { at: now, phase: 'pre_tool', gates: [{ passed: true }, { passed: false }] },
+  ]);
+  writeHomeJsonl('first-class-coach-events.jsonl', [
+    { at: now, decision: 'repair_once', metadata: { forcedSkillLoad: { skillExecutionReceipt: { firedSkillIds: ['a', 'b', 'c'] } } } },
+  ]);
+  writeJsonl('hive-file-touches.jsonl', [
+    { at: now, kind: 'file_touch', path: '/tmp/a' },
+  ]);
+  writeJsonl('hive-learning-ledger.jsonl', [
+    { schema: 'aria.hive_learning.v1', at: now, row_type: 'reflection_hypothesis', trust_state: 'llm_interpreted', status: 'hypothesis' },
+    { schema: 'aria.hive_learning.v1', at: now, row_type: 'promotion_decision', trust_state: 'promoted_rule', status: 'accepted' },
+  ]);
+  const learningPath = join(stateDir, 'hive-learning-ledger.jsonl');
+  writeFileSync(join(codexTmp, 'harness-live-ticker-cache.json'), JSON.stringify({
+    version: 1,
+    files: {
+      learning: {
+        offset: statSync(learningPath).size,
+        mtimeMs: 1,
+        path: learningPath,
+      },
+    },
+    counts: {
+      gates: 0,
+      repairs: 0,
+      blocks: 0,
+      skills: 0,
+      saves: 0,
+    },
+    latest: null,
+  }, null, 2) + '\n', { mode: 0o600 });
+
+  const once = run(['--once']);
+  assertOk(once, '--once');
+  const oncePayload = JSON.parse(once.stdout);
+  assert.equal(oncePayload.ok, true);
+  assert.equal(oncePayload.counts.gates, 3);
+  assert.equal(oncePayload.counts.blocks, 1);
+  assert.equal(oncePayload.counts.repairs, 1);
+  assert.equal(oncePayload.counts.skills, 3);
+  assert.equal(oncePayload.counts.learnings, 2);
+  assert.ok(oncePayload.counts.saves >= 2, `expected at least two durable saves, got ${oncePayload.counts.saves}`);
+  assert.match(oncePayload.line, /\bLessons 2\b/);
+  assert.equal(existsSync(join(stateDir, 'harness-live-ticker-state.json')), true);
+
+  const render = run(['--render']);
+  assertOk(render, '--render');
+  assert.match(render.stdout, /^Aria Harness /);
+  assert.match(render.stdout, /\bLessons 2\b/);
+
+  const json = run(['--render-json']);
+  assertOk(json, '--render-json');
+  assert.equal(JSON.parse(json.stdout).schema, 'aria.harness_live_ticker_state.v1');
+
+  const title = run(['--render-title']);
+  assertOk(title, '--render-title');
+  assert.match(title.stdout, /^\u001b\]0;Aria /);
+
+  const tmux = run(['--render-tmux']);
+  assertOk(tmux, '--render-tmux');
+  assert.match(tmux.stdout, /^Aria /);
+
+  const hook = spawnSync(process.execPath, [hookPath], {
+    env: {
+      ...process.env,
+      HOME: home,
+      ARIA_HOOK_EVENT_JSON: JSON.stringify({ prompt: 'ticker hook sidecar read', thread_id: 'ticker-sidecar', turn_id: '1' }),
+      ARIA_CODEX_TICKER_STDERR: '0',
+    },
+    encoding: 'utf8',
+    maxBuffer: 1024 * 1024,
+  });
+  assertOk(hook, 'live ticker hook');
+  const hookPayload = JSON.parse(hook.stdout);
+  assert.match(hookPayload.hookSpecificOutput.additionalContext, /\bLessons 2\b/);
+
+  const daemon = spawn(process.execPath, [sidecarPath, '--daemon'], {
+    env: {
+      ...process.env,
+      HOME: home,
+      ARIA_HARNESS_TICKER_INTERVAL_MS: '250',
+    },
+    detached: true,
+    stdio: 'ignore',
+  });
+  await new Promise((resolvePromise) => setTimeout(resolvePromise, 500));
+  process.kill(-daemon.pid, 'SIGTERM');
+  const state = JSON.parse(readFileSync(join(stateDir, 'harness-live-ticker-state.json'), 'utf8'));
+  assert.equal(state.schema, 'aria.harness_live_ticker_state.v1');
+  assert.ok(state.seq >= oncePayload.seq);
+
+  console.log(JSON.stringify({
+    ok: true,
+    checked: [
+      'sidecar state file',
+      'learning counter from Hive learning ledger',
+      'generic text renderer',
+      'terminal title renderer',
+      'tmux renderer',
+      'Codex hook reads sidecar state',
+      'daemon refresh loop',
+    ],
+    line: oncePayload.line,
+  }, null, 2));
+} finally {
+  rmSync(home, { recursive: true, force: true });
+}

package/scripts/self-test-hive-org-kernel.mjs

@@ -0,0 +1,233 @@
+#!/usr/bin/env node
+import assert from 'node:assert/strict';
+
+const baseUrl = (process.env.ARIA_RUNTIME_URL || 'http://127.0.0.1:4319').replace(/\/+$/, '');
+
+async function request(path, { method = 'GET', body } = {}) {
+  const response = await fetch(`${baseUrl}${path}`, {
+    method,
+    headers: body ? { 'content-type': 'application/json', 'x-aria-surface': 'hive-org-kernel-canary' } : { 'x-aria-surface': 'hive-org-kernel-canary' },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+  const text = await response.text();
+  let json;
+  try {
+    json = text ? JSON.parse(text) : {};
+  } catch (error) {
+    throw new Error(`${method} ${path} returned non-JSON ${response.status}: ${text.slice(0, 500)}`);
+  }
+  return { response, json };
+}
+
+function assertOk(result, label) {
+  assert.equal(result.json.ok, true, `${label} ok`);
+  assert.ok(result.response.status >= 200 && result.response.status < 300, `${label} status`);
+  return result.json;
+}
+
+const runId = `hive-org-kernel-${Date.now().toString(36)}`;
+const projectId = `proj-${runId}`;
+const workUnitId = `wu-${runId}`;
+const channelId = `chan-${runId}`;
+const intentId = `intent-${runId}`;
+const requestId = `req-${runId}`;
+const path = `packages/aria-connector/runtime-src/service.mjs`;
+
+const health = assertOk(await request('/health'), 'health');
+assert.equal(health.runtime, 'aria-mounted-runtime', 'runtime identity');
+
+const rendered = assertOk(await request('/api/hive/message-render', {
+  method: 'POST',
+  body: {
+    summary: 'Hive Org Kernel canary update',
+    status: 'active',
+    next_action: 'Verify work-unit, intent, channel, lease, and conflict routes.',
+    evidence_refs: ['ev_health', 'ev_routes'],
+    payload: { local_path: '/home/hamzaibrahim1/secret/example', token: 'sk-proj-exampletoken1234567890' },
+  },
+}), 'message render');
+assert.match(rendered.public, /Hive Org Kernel canary update/, 'public message summary');
+assert.doesNotMatch(rendered.public, /\/home\/hamzaibrahim1/, 'public redacts local path');
+
+const workUnit = assertOk(await request('/api/hive/work-unit', {
+  method: 'POST',
+  body: {
+    project_id: projectId,
+    work_unit_id: workUnitId,
+    session_id: `codex-${runId}`,
+    channel_id: channelId,
+    status: 'active',
+    summary: 'Canary work unit',
+    expected_predicate: 'all Hive org routes return ok true or conflict 409 for overlapping lease',
+    evidence_refs: ['ev_health'],
+    file_claims: [{ path, intent: 'canary-noop' }],
+  },
+}), 'work unit');
+assert.equal(workUnit.record.record_id, workUnitId, 'work unit id');
+assert.equal(workUnit.record.body.expected_predicate, 'all Hive org routes return ok true or conflict 409 for overlapping lease');
+
+const workUnitRevision = assertOk(await request('/api/hive/work-unit', {
+  method: 'POST',
+  body: {
+    project_id: projectId,
+    work_unit_id: workUnitId,
+    session_id: `codex-${runId}`,
+    channel_id: channelId,
+    status: 'verified',
+    summary: 'Canary work unit projection update',
+    expected_predicate: 'projection revision increments on repeated record_id writes',
+    evidence_refs: ['ev_projection'],
+  },
+}), 'work unit projection update');
+assert.equal(workUnitRevision.record.record_id, workUnitId, 'projection update id');
+
+const presence = assertOk(await request('/api/hive/presence', {
+  method: 'POST',
+  body: {
+    project_id: projectId,
+    session_id: `codex-${runId}`,
+    work_unit_id: workUnitId,
+    channel_id: channelId,
+    status: 'working',
+    summary: 'Codex canary active',
+  },
+}), 'presence');
+assert.equal(presence.record.session_id, `codex-${runId}`, 'presence session');
+assert.equal(presence.record.body.routing_lane, 'execution_cli', 'codex routes to execution lane');
+
+const atlasPresence = assertOk(await request('/api/hive/presence', {
+  method: 'POST',
+  body: {
+    project_id: projectId,
+    session_id: `atlas-${runId}`,
+    member_type: 'atlas',
+    work_unit_id: workUnitId,
+    channel_id: channelId,
+    status: 'watching',
+    summary: 'Atlas substrate member active',
+  },
+}), 'atlas presence');
+assert.equal(atlasPresence.record.body.routing_lane, 'substrate_intelligence', 'atlas routing lane');
+
+const sentinelPresence = assertOk(await request('/api/hive/presence', {
+  method: 'POST',
+  body: {
+    project_id: projectId,
+    session_id: `sentinel-${runId}`,
+    member_type: 'sentinel',
+    work_unit_id: workUnitId,
+    channel_id: channelId,
+    status: 'watching',
+    summary: 'Sentinel resilience member active',
+  },
+}), 'sentinel presence');
+assert.equal(sentinelPresence.record.body.routing_lane, 'security_resilience', 'sentinel routing lane');
+
+const intent = assertOk(await request('/api/hive/intent', {
+  method: 'POST',
+  body: {
+    project_id: projectId,
+    intent_id: intentId,
+    session_id: `codex-${runId}`,
+    work_unit_id: workUnitId,
+    channel_id: channelId,
+    status: 'declared',
+    summary: 'Declare route intent before work',
+    expected_predicate: 'GET /api/hive/intent returns this intent',
+    file_claims: [{ path, intent: 'read' }],
+  },
+}), 'intent');
+assert.equal(intent.record.record_id, intentId, 'intent id');
+
+const channel = assertOk(await request('/api/hive/channel', {
+  method: 'POST',
+  body: {
+    project_id: projectId,
+    channel_id: channelId,
+    session_id: `codex-${runId}`,
+    status: 'open',
+    summary: 'Canary project channel',
+    visibility: 'owner-visible',
+  },
+}), 'channel');
+assert.equal(channel.record.channel_id, channelId, 'channel id');
+
+const coordination = assertOk(await request('/api/hive/coordination/request', {
+  method: 'POST',
+  body: {
+    project_id: projectId,
+    request_id: requestId,
+    session_id: `codex-${runId}`,
+    work_unit_id: workUnitId,
+    channel_id: channelId,
+    status: 'open',
+    summary: 'Request sibling coordination',
+    target_session_id: `claude-${runId}`,
+  },
+}), 'coordination request');
+assert.equal(coordination.record.record_id, requestId, 'coordination id');
+
+const lease = assertOk(await request('/api/hive/file-lease', {
+  method: 'POST',
+  body: {
+    project_id: projectId,
+    lease_id: `lease-${runId}-a`,
+    session_id: `codex-${runId}`,
+    work_unit_id: workUnitId,
+    status: 'active',
+    target_path: path,
+    expires_at: new Date(Date.now() + 60_000).toISOString(),
+    summary: 'Canary active lease',
+  },
+}), 'file lease');
+assert.equal(lease.record.status, 'active', 'lease active');
+assert.equal(lease.record.body.target_path, path, 'lease target path');
+
+const conflict = await request('/api/hive/file-lease', {
+  method: 'POST',
+  body: {
+    project_id: projectId,
+    lease_id: `lease-${runId}-b`,
+    session_id: `claude-${runId}`,
+    work_unit_id: workUnitId,
+    status: 'active',
+    target_path: path,
+    expires_at: new Date(Date.now() + 60_000).toISOString(),
+    summary: 'Conflicting canary lease',
+  },
+});
+assert.equal(conflict.response.status, 409, 'conflict status');
+assert.equal(conflict.json.conflict, true, 'conflict body');
+assert.ok(Array.isArray(conflict.json.blocking_leases) && conflict.json.blocking_leases.length >= 1, 'conflict lists blocking lease');
+
+const readWorkUnits = assertOk(await request(`/api/hive/work-unit?project_id=${encodeURIComponent(projectId)}`), 'read work units');
+assert.ok(readWorkUnits.records.some((record) => record.record_id === workUnitId), 'read work unit record');
+const projectedWorkUnit = readWorkUnits.records.find((record) => record.record_id === workUnitId);
+assert.equal(projectedWorkUnit.status, 'verified', 'projected work unit status');
+assert.ok(Number(projectedWorkUnit.revision || 0) >= 2, 'projected work unit revision increments');
+
+const readLeases = assertOk(await request(`/api/hive/file-lease?project_id=${encodeURIComponent(projectId)}&include_events=true`), 'read leases');
+assert.ok(readLeases.records.some((record) => record.record_id === `lease-${runId}-a`), 'read active lease');
+assert.ok(readLeases.records.some((record) => record.record_id === `lease-${runId}-b` && record.status === 'conflict'), 'read conflict lease projection');
+assert.ok(Array.isArray(readLeases.events) && readLeases.events.length >= 2, 'read lease events');
+
+const readAtlasPresence = assertOk(await request(`/api/hive/presence?project_id=${encodeURIComponent(projectId)}&member_type=atlas`), 'read atlas presence');
+assert.equal(readAtlasPresence.records.length, 1, 'atlas member query count');
+assert.equal(readAtlasPresence.records[0].routing_lane, 'substrate_intelligence', 'atlas member projected routing lane');
+
+const readSentinelPresence = assertOk(await request(`/api/hive/presence?project_id=${encodeURIComponent(projectId)}&member_type=sentinel`), 'read sentinel presence');
+assert.equal(readSentinelPresence.records.length, 1, 'sentinel member query count');
+assert.equal(readSentinelPresence.records[0].routing_lane, 'security_resilience', 'sentinel member projected routing lane');
+
+console.log(JSON.stringify({
+  ok: true,
+  runId,
+  projectId,
+  workUnitId,
+  routeCount: 8,
+  projectedRevision: projectedWorkUnit.revision,
+  atlasRoutingLane: readAtlasPresence.records[0].routing_lane,
+  sentinelRoutingLane: readSentinelPresence.records[0].routing_lane,
+  conflictStatus: conflict.response.status,
+  storage: readLeases.storage,
+}, null, 2));