@botiverse/k-carrier 0.1.0

package/harness/src/artifact/m6.ts

@@ -0,0 +1,274 @@
+/**
+ * M6 provenance acceptance checks (test-plan M6 rows: provenance journal
+ * forward-only; genesis machines are NOT_OBSERVED and never counted as
+ * "recorded"; an unreadable/corrupt journal is a THIRD state, never
+ * genesis; every reconcile that reaches the transaction records WHO drove
+ * it, write-ahead).
+ *
+ * These drive createUpgrader in-process (the library plane — the journal
+ * is exactly the kind of internal tooth the black-box plane cannot reach).
+ * Mutation journals/summaries live in m6Mutations.ts (line budget).
+ */
+import assert from "node:assert/strict";
+import * as path from "node:path";
+import { promises as fs } from "node:fs";
+import { type ToothContext } from "../teeth/registry.ts";
+import { createUpgrader, type CreateUpgraderOptions } from "../../../core/src/createUpgrader.ts";
+import type { ReleaseSource } from "../../../core/src/artifact/source.ts";
+import { staticManifestSource } from "../../../core/src/artifact/staticManifestSource.ts";
+import {
+  fileProvenanceJournal,
+  summarizeProvenance,
+  type ProvenanceJournal,
+  type ProvenanceEntry,
+} from "../../../core/src/provenance/journal.ts";
+import { systemClock } from "../../../core/src/clock.ts";
+import type { HostAdapter, ProcessEvidence, Slot } from "../../../core/src/lifecycle/hostAdapter.ts";
+import { serveRelease } from "./m1.ts";
+import type { FakeServer } from "../fake-server/server.ts";
+import {
+  reuseSeqJournal,
+  acceptingJournal,
+  keepTornJournal,
+  appendOnCorruptJournal,
+  emptyAsGenesisJournal,
+  mergeUnreadableSummary,
+  promoteOnlyJournal,
+} from "./m6Mutations.ts";
+
+export function stateDir(ctx: ToothContext): string {
+  return path.join(ctx.sandboxDir, "state");
+}
+
+function provenanceFile(ctx: ToothContext): string {
+  return path.join(stateDir(ctx), "provenance", "provenance.jsonl");
+}
+
+/** A host whose probe reports the experiment's (configured) version. */
+export function hostReporting(experimentVersion: string): HostAdapter {
+  let version = "1.0.0";
+  let startId = "init";
+  return {
+    async quiesce() {},
+    async stop() {},
+    async start(slot: Slot) {
+      version = slot === "experiment" ? experimentVersion : "1.0.0";
+      startId = `${slot}-${Math.random().toString(36).slice(2)}`;
+    },
+    async healthProbe(): Promise<ProcessEvidence> {
+      return { version, pid: process.pid, startId };
+    },
+    async resume() {},
+  };
+}
+
+export interface MakeUpgraderOpts {
+  policy?: "auto" | "confirm" | "notify-only";
+  installOwnership?: () => "self" | "managed-elsewhere";
+  notificationSink?: (event: { kind: string; detail: Record<string, string> }) => Promise<void>;
+  host?: HostAdapter;
+  source?: ReleaseSource;
+}
+
+export async function makeUpgrader(
+  ctx: ToothContext,
+  server: FakeServer,
+  journal: ProvenanceJournal | null,
+  opts: MakeUpgraderOpts = {},
+): Promise<ReturnType<typeof createUpgrader>> {
+  const base: Omit<CreateUpgraderOptions, "provenance"> = {
+    host: opts.host ?? hostReporting("2.0.0"),
+    source: opts.source ?? staticManifestSource({ baseUrl: server.url }),
+    policy: opts.policy ?? "auto",
+    notificationSink: (opts.notificationSink ?? (async () => {})) as CreateUpgraderOptions["notificationSink"],
+    stateDir: stateDir(ctx),
+    ...(opts.installOwnership === undefined ? {} : { installOwnership: opts.installOwnership }),
+  };
+  return createUpgrader(journal === null ? base : { ...base, provenance: journal });
+}
+
+// ---------------------------------------------------------------------------
+// m6.provenance-forward-only
+// ---------------------------------------------------------------------------
+
+export async function checkM6ProvenanceForwardOnly(
+  ctx: ToothContext,
+  opts: { acceptRewrite?: boolean; keepTorn?: boolean; reuseSeqs?: boolean; appendOnCorrupt?: boolean } = {},
+): Promise<void> {
+  const real = fileProvenanceJournal(path.join(stateDir(ctx), "provenance"), systemClock);
+  const journal = opts.acceptRewrite
+    ? acceptingJournal()
+    : opts.keepTorn
+      ? keepTornJournal(real, provenanceFile(ctx))
+      : opts.reuseSeqs
+        ? reuseSeqJournal()
+        : opts.appendOnCorrupt
+          ? appendOnCorruptJournal(provenanceFile(ctx), real)
+          : real;
+
+  const e1 = await journal.append({ who: "srv", carrier: "fleet", version: "2.0.0" });
+  const e2 = await journal.append({ who: "srv", carrier: "fleet", version: "2.0.0" });
+  assert.equal(e1.seq, 0, "first append is seq 0");
+  assert.equal(
+    e2.seq,
+    1,
+    "second append is seq 1 — appends are append-only, history cannot be collapsed (reuseSeqs => RED)",
+  );
+
+  // An overwrite of an existing entry is REFUSED (provenance is not
+  // rewritable — a rewrite would let a later actor re-write who did what).
+  await assert.rejects(
+    journal.append({ who: "srv", carrier: "fleet", version: "2.0.0" }, 0),
+    /PROVENANCE_SEQ_REWRITE/,
+    "an overwrite of an existing entry must be refused (acceptRewrite => RED)",
+  );
+
+  // A torn final line (crash mid-append) is dropped; earlier lines stand.
+  await fs.appendFile(provenanceFile(ctx), '{"seq":2,"who":', "utf8");
+  const read = await journal.read();
+  assert.equal(read.kind, "observed");
+  assert.deepEqual(
+    read.entries.map((e) => e.seq),
+    [0, 1],
+    "appends are forward-only: unique, in order, and a torn final line is dropped (keepTorn => RED)",
+  );
+
+  // A corrupt MIDDLE line makes the history unreadable — and appending to
+  // it is REFUSED (a truncated view must never re-issue a seq).
+  await fs.writeFile(
+    provenanceFile(ctx),
+    '{"seq":0,"who":"a","carrier":"c","when":1,"version":"2.0.0"}\n{"seq":1,"BROKEN\n{"seq":2,"who":"b","carrier":"c","when":2,"version":"2.0.0"}\n',
+    "utf8",
+  );
+  const afterCorrupt = await journal.read();
+  assert.equal(
+    afterCorrupt.kind,
+    "unreadable",
+    "a corrupt middle line makes the history unreadable, never a short observed one (appendOnCorrupt => RED)",
+  );
+  await assert.rejects(
+    journal.append({ who: "srv", carrier: "fleet", version: "2.0.0" }),
+    /PROVENANCE_HISTORY_UNREADABLE/,
+    "appending on an unreadable history must be refused — a guessed seq is how history becomes rewritable (appendOnCorrupt => RED)",
+  );
+}
+
+// ---------------------------------------------------------------------------
+// m6.provenance-genesis-not-observed
+// ---------------------------------------------------------------------------
+
+export async function checkM6ProvenanceGenesisNotObserved(
+  ctx: ToothContext,
+  opts: {
+    collapseGenesis?: boolean;
+    emptyIsGenesis?: boolean;
+    unreadableIsGenesis?: boolean;
+    mergeUnreadableIntoNotObserved?: boolean;
+  } = {},
+): Promise<void> {
+  const provDir = path.join(stateDir(ctx), "provenance");
+  const journal = fileProvenanceJournal(provDir, systemClock);
+
+  // A machine with NO journal file never had the machinery: GENESIS. Its
+  // value is NOT_OBSERVED, not "zero reconciles".
+  const genesis = opts.collapseGenesis ? { kind: "observed" as const, entries: [] as ProvenanceEntry[] } : await journal.read();
+  assert.equal(
+    genesis.kind,
+    "genesis",
+    "a machine with no journal is genesis — NOT_OBSERVED, never an observed zero (collapseGenesis => RED)",
+  );
+
+  // An empty-but-present journal IS an observed machine: the machinery
+  // exists and has reconciled zero times. Distinct from genesis.
+  await fs.mkdir(provDir, { recursive: true });
+  await fs.writeFile(path.join(provDir, "provenance.jsonl"), "", "utf8");
+  const empty = opts.emptyIsGenesis ? await emptyAsGenesisJournal().read() : await journal.read();
+  assert.equal(
+    empty.kind,
+    "observed",
+    "an empty-but-present journal is observed-with-zero reconciles, distinct from genesis (emptyIsGenesis => RED)",
+  );
+
+  // A journal that exists but cannot be read (here: the file became a
+  // directory, EISDIR) is the THIRD state — NOT genesis, NOT observed.
+  await fs.rm(path.join(provDir, "provenance.jsonl"), { force: true });
+  await fs.mkdir(path.join(provDir, "provenance.jsonl"));
+  const unreadable = opts.unreadableIsGenesis ? { kind: "genesis" as const } : await journal.read();
+  assert.equal(
+    unreadable.kind,
+    "unreadable",
+    "an unreadable journal is its own state, never genesis — \"I cannot see the data\" is not \"there is no data\" (unreadableIsGenesis => RED)",
+  );
+
+  // Aggregation keeps the buckets separate: genesis → notObserved, never
+  // recorded; unreadable → unreadable, never recorded AND never notObserved.
+  const sum = opts.mergeUnreadableIntoNotObserved
+    ? mergeUnreadableSummary([genesis, empty, unreadable])
+    : summarizeProvenance([genesis, empty, unreadable]);
+  assert.equal(sum.notObserved, 1, "the genesis machine is counted in notObserved, never in recorded");
+  assert.equal(sum.recorded, 1, "only the observed machine is counted as recorded");
+  assert.equal(
+    sum.unreadable,
+    1,
+    "the unreadable machine is counted in unreadable — a separate bucket (mergeUnreadableIntoNotObserved => RED)",
+  );
+  assert.equal(sum.reconciles, 0, "zero reconciles stays zero");
+}
+
+// ---------------------------------------------------------------------------
+// m6.provenance-records-each-reconcile
+// ---------------------------------------------------------------------------
+
+export async function checkM6ProvenanceRecordsEachReconcile(
+  ctx: ToothContext,
+  opts: { journalOnPromoteOnly?: boolean; skipJournaling?: boolean } = {},
+): Promise<void> {
+  const real = fileProvenanceJournal(path.join(stateDir(ctx), "provenance"), systemClock);
+  const deferred = promoteOnlyJournal(real);
+  const journal = opts.journalOnPromoteOnly ? deferred : real;
+
+  const good = await serveRelease(ctx, { version: "2.0.0", behavior: "ok", name: "good" });
+  const bad = await serveRelease(ctx, { version: "3.0.0", behavior: "ok", name: "bad" });
+  try {
+    // Reconcile 1 (good source): promotes.
+    const goodUpgrader = await makeUpgrader(ctx, good, opts.skipJournaling ? null : journal);
+    const r1 = await goodUpgrader.upgradeTo("2.0.0", {
+      consented: true,
+      provenance: { who: "fleet-control", carrier: "example-host" },
+    });
+    assert.equal(r1.result, "promoted", "the good reconcile must promote");
+    if (opts.journalOnPromoteOnly) await deferred.flush();
+
+    // Reconcile 2 (source moved on): a version the host's probe cannot
+    // vouch for — reaches the transaction, then auto-rolls back. Its entry
+    // must STILL be recorded (the append happened write-ahead, before the
+    // outcome existed).
+    const badUpgrader = await makeUpgrader(ctx, bad, opts.skipJournaling ? null : journal);
+    const r2 = await badUpgrader.upgradeTo("3.0.0", {
+      consented: true,
+      provenance: { who: "fleet-control", carrier: "example-host" },
+    });
+    assert.equal(r2.result, "rolled-back", "the bad reconcile must roll back");
+    if (opts.journalOnPromoteOnly) {
+      // mutation: journaling happened only after promote — the failed
+      // reconcile's entry was dropped, so the count assertion goes RED
+    }
+
+    const read = await journal.read();
+    assert.equal(read.kind, "observed");
+    assert.equal(
+      read.entries.length,
+      2,
+      "every reconcile that reaches the transaction is recorded, including the one that rolled back (journalOnPromoteOnly | skipJournaling => RED)",
+    );
+    assert.equal(read.entries[0]!.version, "2.0.0", "the recorded version is the one the good reconcile drove");
+    assert.equal(read.entries[1]!.version, "3.0.0", "the recorded version is the one the failed reconcile drove");
+    for (const e of read.entries) {
+      assert.equal(e.who, "fleet-control", "the recorded who is the driving identity");
+      assert.equal(e.carrier, "example-host", "the recorded carrier is the command channel");
+    }
+  } finally {
+    await good.stop();
+    await bad.stop();
+  }
+}

package/harness/src/artifact/m6Drive.ts

@@ -0,0 +1,296 @@
+/**
+ * M6 drive + policy-gate acceptance checks (test-plan M6 rows). Server-
+ * pushed commands pass the SAME gates as local ones, never a bypass. The
+ * rollback PAIR mutually controls: a pushed rollback of a promoted version
+ * holds under confirm; K's own in-transaction auto-rollback never asks for
+ * consent. The ownership gate is drawn on the ACTION'S NATURE: settling an
+ * in-flight transaction is always allowed; only NEW modification of a
+ * machine at rest managed elsewhere is refused.
+ */
+import assert from "node:assert/strict";
+import * as path from "node:path";
+import { promises as fs } from "node:fs";
+import { type ToothContext } from "../teeth/registry.ts";
+import { fileProvenanceJournal } from "../../../core/src/provenance/journal.ts";
+import { fileJournalStore, fileSlotStore } from "../../../core/src/txn/fileEffects.ts";
+import { systemClock } from "../../../core/src/clock.ts";
+import {
+  holdingRollback,
+  gatedAutoRollbackUpgrader,
+  versionRoutingSource,
+  wrongVersionSource,
+} from "./m6DriveMutations.ts";
+import { serveRelease } from "./m1.ts";
+import { stateDir, hostReporting, makeUpgrader } from "./m6.ts";
+
+const DRIVE = { who: "fleet-control", carrier: "example-host" };
+
+function provDir(ctx: ToothContext): string {
+  return path.join(stateDir(ctx), "provenance");
+}
+
+async function assertZeroDiskSideEffects(ctx: ToothContext): Promise<void> {
+  const dir = stateDir(ctx);
+  try {
+    await fs.access(dir);
+  } catch {
+    return;
+  }
+  for (const p of ["journal.jsonl", "slots", "incoming", path.join("provenance", "provenance.jsonl")]) {
+    await assert.rejects(fs.access(path.join(dir, p)), `${p} must not exist`);
+  }
+}
+
+// ---------------------------------------------------------------------------
+// m6.drive-stage-through-policy
+// ---------------------------------------------------------------------------
+
+export async function checkM6DriveStageThroughPolicy(
+  ctx: ToothContext,
+  opts: { stageWithoutConsent?: boolean; journalHeldStage?: boolean } = {},
+): Promise<void> {
+  const journal = fileProvenanceJournal(provDir(ctx), systemClock);
+  const server = await serveRelease(ctx, { version: "2.0.0", behavior: "ok", name: "target" });
+  try {
+    // mutation stageWithoutConsent: the drive path stages under confirm
+    // without consent (the wrong policy wiring) — the HOLD assertion reds.
+    const upgrader = await makeUpgrader(ctx, server, journal, { policy: opts.stageWithoutConsent ? "auto" : "confirm" });
+    const outcome = await upgrader.upgradeTo("2.0.0", { provenance: DRIVE });
+    assert.equal(
+      outcome.result,
+      "held",
+      "a drive stage under policy=confirm without consent is a HOLD, never a stage (stageWithoutConsent => RED)",
+    );
+    await assertZeroDiskSideEffects(ctx);
+    // mutation journalHeldStage: a held stage is recorded as a reconcile —
+    // the genesis assertion reds (a held stage never reached the txn).
+    const read = opts.journalHeldStage ? { kind: "observed" as const, entries: [] } : await journal.read();
+    assert.equal(
+      read.kind,
+      "genesis",
+      "a held drive stage is not a reconcile — the provenance journal stays untouched (journalHeldStage => RED)",
+    );
+  } finally {
+    await server.stop();
+  }
+}
+
+// ---------------------------------------------------------------------------
+// m6.drive-promote-through-policy
+// ---------------------------------------------------------------------------
+
+export async function checkM6DrivePromoteThroughPolicy(
+  ctx: ToothContext,
+  opts: { promoteWithoutConsent?: boolean; installOtherVersion?: boolean } = {},
+): Promise<void> {
+  const journal = fileProvenanceJournal(provDir(ctx), systemClock);
+  const server = await serveRelease(ctx, { version: "2.0.0", behavior: "ok", name: "target" });
+  const other = await serveRelease(ctx, { version: "3.0.0", behavior: "ok", name: "other" });
+  try {
+    // mutation promoteWithoutConsent: policy auto — the drive promotes
+    // without consent, and the HOLD assertion reds.
+    const upgrader = await makeUpgrader(ctx, server, journal, { policy: opts.promoteWithoutConsent ? "auto" : "confirm" });
+
+    const held = await upgrader.upgradeTo("2.0.0", { provenance: DRIVE });
+    assert.equal(
+      held.result,
+      "held",
+      "a drive promote under policy=confirm without consent is a HOLD (promoteWithoutConsent => RED)",
+    );
+
+    // mutation installOtherVersion: the source serves 3.0.0 for a 2.0.0
+    // request — consent binds a SPECIFIC version; the exactly-approved
+    // assertion reds.
+    const consentedUpgrader = opts.installOtherVersion
+      ? await makeUpgrader(ctx, other, journal, {
+          host: hostReporting("3.0.0"),
+          policy: "confirm",
+          source: wrongVersionSource(other),
+        })
+      : upgrader;
+    const outcome = await consentedUpgrader.upgradeTo("2.0.0", { consented: true, provenance: DRIVE });
+    assert.equal(outcome.result, "promoted", "with consent the drive promote installs");
+    assert.equal(
+      outcome.report?.version,
+      "2.0.0",
+      "the drive installs exactly the approved version — consent binds (installOtherVersion => RED)",
+    );
+
+    // the provenance records who drove it
+    const read = await journal.read();
+    assert.equal(read.kind, "observed");
+    if (read.kind !== "observed") return;
+    const e = read.entries.at(-1);
+    assert.equal(e?.who, "fleet-control", "the provenance records the driving identity");
+    assert.equal(e?.version, "2.0.0", "the provenance records the version that was installed");
+  } finally {
+    await server.stop();
+    await other.stop();
+  }
+}
+
+// ---------------------------------------------------------------------------
+// m6.drive-rollback-through-ownership
+// ---------------------------------------------------------------------------
+
+export async function checkM6DriveRollbackThroughOwnership(
+  ctx: ToothContext,
+  opts: { rollbackIgnoringOwnership?: boolean } = {},
+): Promise<void> {
+  const journal = fileProvenanceJournal(provDir(ctx), systemClock);
+  const server = await serveRelease(ctx, { version: "2.0.0", behavior: "ok", name: "target" });
+  const dir = stateDir(ctx);
+  try {
+    // Every TERMINAL state (idle/promoted/rolled-back) is at rest: the
+    // gate enumerates positively over phases, so the next terminal phase
+    // cannot silently become "in flight" (an exclusion list would touch a
+    // machine that is not ours). All three are asserted, not patched one.
+    for (const terminal of ["idle", "promoted", "rolled-back"] as const) {
+      await fs.rm(dir, { recursive: true, force: true });
+      await fs.mkdir(dir, { recursive: true });
+      if (terminal !== "idle") {
+        const store = fileJournalStore(dir);
+        await store.appendAndSync({ seq: 0, timestampMs: 1, intent: terminal, detail: {} });
+      }
+      // mutation rollbackIgnoringOwnership: ownership is self — the
+      // rollback proceeds, and the typed-held assertion reds.
+      const upgrader = await makeUpgrader(ctx, server, journal, {
+        installOwnership: opts.rollbackIgnoringOwnership ? () => "self" : () => "managed-elsewhere",
+      });
+      const outcome = await upgrader.rollback("user requested");
+      assert.ok(
+        typeof outcome === "object" && outcome.held.includes("managed"),
+        `a drive rollback on a managed-elsewhere machine at terminal '${terminal}' is a typed held, never a rollback of someone else's copy (rollbackIgnoringOwnership => RED)`,
+      );
+      const st = await upgrader.state();
+      assert.equal(st.experimentVersion, null, `terminal '${terminal}': nothing was rolled back`);
+      const intents = (await fileJournalStore(dir).readAll()).map((e) => e.intent);
+      assert.equal(intents.length, terminal === "idle" ? 0 : 1, `terminal '${terminal}': held appended nothing`);
+    }
+  } finally {
+    await server.stop();
+  }
+}
+
+// ---------------------------------------------------------------------------
+// m6.rollback-settles-inflight-ownership-flip
+// ---------------------------------------------------------------------------
+
+export async function checkM6RollbackSettlesInflightOwnershipFlip(
+  ctx: ToothContext,
+  opts: { holdInFlightRollback?: boolean } = {},
+): Promise<void> {
+  const journal = fileProvenanceJournal(provDir(ctx), systemClock);
+  const server = await serveRelease(ctx, { version: "2.0.0", behavior: "ok", name: "target" });
+  const dir = stateDir(ctx);
+  try {
+    // Simulate a crash mid-transaction: a staged intent is durable
+    // (write-ahead) and the experiment slot holds the staged bytes — K
+    // opened this transaction when ownership was self; ownership has since
+    // flipped. The machine MUST settle, never hold: a held here is a brick.
+    const store = fileJournalStore(dir);
+    await store.appendAndSync({ seq: 0, timestampMs: 1, intent: "staged", detail: { version: "2.0.0" } });
+    const dummy = path.join(ctx.sandboxDir, "dummy.bin");
+    await fs.writeFile(dummy, "staged-bytes");
+    await fileSlotStore(dir).stageExperiment({ version: "2.0.0", bytesRef: dummy });
+
+    const upgrader = await makeUpgrader(ctx, server, journal, {
+      installOwnership: () => "managed-elsewhere",
+    });
+    const outcome = opts.holdInFlightRollback
+      ? await holdingRollback(await upgrader).rollback("settle")
+      : await (await upgrader).rollback("settle");
+    assert.equal(
+      outcome,
+      "rolled-back",
+      "an in-flight transaction settles even when ownership flipped — a held mid-transaction is a brick (holdInFlightRollback => RED)",
+    );
+    const st = await upgrader.state();
+    assert.equal(st.experimentVersion, null, "the machine converges to a safe phase");
+    const intents = (await store.readAll()).map((e) => e.intent);
+    assert.equal(intents.at(-1), "rolled-back", "the transaction is settled, journal resolved");
+  } finally {
+    await server.stop();
+  }
+}
+// ---------------------------------------------------------------------------
+// m6.push-rollback-through-policy
+// ---------------------------------------------------------------------------
+
+export async function checkM6PushRollbackThroughPolicy(
+  ctx: ToothContext,
+  opts: { bypassPushRollbackPolicy?: boolean } = {},
+): Promise<void> {
+  const journal = fileProvenanceJournal(provDir(ctx), systemClock);
+  const server = await serveRelease(ctx, { version: "1.0.0", behavior: "ok", name: "seed" });
+  const target = await serveRelease(ctx, { version: "2.0.0", behavior: "ok", name: "target" });
+  try {
+    // Promote 2.0.0 with consent: 2.0.0 is now the RUNNING version. The
+    // source routes by version so the later push-rollback to 1.0.0 is
+    // served by the seed.
+    const routed = versionRoutingSource({ "1.0.0": server, "2.0.0": target });
+    const upgrader = await makeUpgrader(ctx, target, journal, { policy: "confirm", source: routed });
+    const promote = await upgrader.upgradeTo("2.0.0", { consented: true, provenance: DRIVE });
+    assert.equal(promote.result, "promoted", "the consented promote lands");
+    // mutation bypassPushRollbackPolicy: policy auto — the push-rollback
+    // path skips the confirm gate, and the HOLD assertion reds.
+    const downgradeUpgrader = opts.bypassPushRollbackPolicy
+      ? await makeUpgrader(ctx, target, journal, { policy: "auto", source: routed })
+      : upgrader;
+    // A server-pushed rollback of an ALREADY-PROMOTED version is a NEW
+    // change to a running system — same nature as an upgrade: under
+    // policy=confirm it must HOLD until consent. "Safe direction" is byte
+    // safety, NOT authority: a bypassable push-rollback is the downgrade
+    // attack by another name.
+    const outcome = await downgradeUpgrader.upgradeTo("1.0.0", { provenance: DRIVE });
+    assert.equal(
+      outcome.result,
+      "held",
+      "a pushed rollback of a promoted version under confirm without consent is a HOLD (bypassPushRollbackPolicy => RED)",
+    );
+    const st = await upgrader.state();
+    assert.equal(st.stableVersion, "2.0.0", "the running version was not rolled back without consent");
+  } finally {
+    await server.stop();
+    await target.stop();
+  }
+}
+
+// ---------------------------------------------------------------------------
+// m6.auto-rollback-needs-no-consent
+// ---------------------------------------------------------------------------
+
+export async function checkM6AutoRollbackNeedsNoConsent(
+  ctx: ToothContext,
+  opts: { gateAutoRollback?: boolean } = {},
+): Promise<void> {
+  const journal = fileProvenanceJournal(provDir(ctx), systemClock);
+  const target = await serveRelease(ctx, { version: "3.0.0", behavior: "ok", name: "bad" });
+  const events: Array<{ kind: string; detail: Record<string, string> }> = [];
+  const sink = async (e: { kind: string; detail: Record<string, string> }): Promise<void> => {
+    events.push(e);
+  };
+  try {
+    // The upgrade itself is consented; the bad successor cannot start, so
+    // the ENGINE auto-rolls back. That rollback is part of the already-
+    // consented upgrade — the fulfillment of "you'll always get back" —
+    // and must NEVER ask for consent, even under policy=confirm.
+    const upgrader = await makeUpgrader(ctx, target, journal, { policy: "confirm", notificationSink: sink });
+    const executor = opts.gateAutoRollback ? gatedAutoRollbackUpgrader(upgrader, sink) : upgrader;
+    const outcome = await executor.upgradeTo("3.0.0", { consented: true, provenance: DRIVE });
+    assert.equal(
+      outcome.result,
+      "rolled-back",
+      "the in-transaction auto-rollback must happen — it fulfills 'you'll always get back' (gateAutoRollback => RED)",
+    );
+    assert.ok(
+      !events.some((e) => e.kind === "confirm-request"),
+      "the auto-rollback must never ask for consent — it is part of the already-consented upgrade (gateAutoRollback => RED)",
+    );
+    const st = await upgrader.state();
+    assert.equal(st.stableVersion, "0.0.0", "the machine is back at the old version, nothing promoted");
+  } finally {
+    await target.stop();
+  }
+}
+

package/harness/src/artifact/m6DriveMutations.ts

@@ -0,0 +1,70 @@
+/**
+ * M6 drive mutation wrappers — the wrong behaviors each negative control
+ * must catch (a gate that bricks a machine mid-transaction; an auto-
+ * rollback gated on consent). Kept separate from m6Drive.ts for the line
+ * budget.
+ */
+import type { Upgrader } from "../../../core/src/upgrader.ts";
+import type { makeUpgrader } from "./m6.ts";
+import { staticManifestSource } from "../../../core/src/artifact/staticManifestSource.ts";
+import type { ReleaseSource } from "../../../core/src/artifact/source.ts";
+import type { FakeServer } from "../fake-server/server.ts";
+
+type UpgraderInstance = Awaited<ReturnType<typeof makeUpgrader>>;
+
+/** Mutation: the gate holds a machine mid-transaction (the brick). */
+export function holdingRollback(inner: UpgraderInstance): Upgrader {
+  return {
+    ...inner,
+    async rollback() {
+      return { held: "this install is managed by another manager; it does not roll itself back" };
+    },
+  };
+}
+
+/** Mutation: the in-transaction auto-rollback is gated on confirm — the
+ * wrong behavior the controlling twin guards against. */
+export function gatedAutoRollbackUpgrader(
+  inner: UpgraderInstance,
+  sink: (e: { kind: string; detail: Record<string, string> }) => Promise<void>,
+): Upgrader {
+  return {
+    ...inner,
+    async upgradeTo(version, opts2) {
+      const r = await inner.upgradeTo(version, opts2);
+      if (r.result === "rolled-back") {
+        await sink({ kind: "confirm-request", detail: { version } });
+        return { result: "held", reason: "auto-rollback requires consent", report: null };
+      }
+      return r;
+    },
+  };
+}
+
+/** A source that routes each requested version to the server serving it
+ * (a FakeServer serves ONE manifest; a multi-version source needs routing). */
+export function versionRoutingSource(routes: Record<string, FakeServer>): ReleaseSource {
+  return {
+    async checkForUpdate() {
+      return null;
+    },
+    async fetchRelease(version, ctx) {
+      const server = routes[version];
+      if (!server) throw new Error(`no routed server serves ${version}`);
+      return staticManifestSource({ baseUrl: server.url }).fetchRelease(version, ctx);
+    },
+  };
+}
+
+/** Mutation source: serves 3.0.0 for ANY request — the wrong source that
+ * would install a different version than the one approved. */
+export function wrongVersionSource(server: FakeServer): ReleaseSource {
+  return {
+    async checkForUpdate() {
+      return null;
+    },
+    async fetchRelease(_version, ctx) {
+      return staticManifestSource({ baseUrl: server.url }).fetchRelease("3.0.0", ctx);
+    },
+  };
+}