@desplega.ai/agent-swarm 2.5.4 → 2.7.0

package/src/tests/credential-check.test.ts

@@ -1,8 +1,9 @@
-import { describe, expect, mock, test } from "bun:test";
+import { afterEach, describe, expect, mock, test } from "bun:test";
 import { OPENAI_COMPATIBLE_PROVIDERS } from "@desplega/model-catalog";
 import {
   buildCredStatusReport,
   CREDENTIAL_PROVIDER_CHECKERS,
+  checkEachKey,
   checkOpenAICompatibleProvider,
   checkProviderCredentials,
   isBedrockMode,
@@ -27,6 +28,241 @@ function fsWith(present: Set<string>): { existsSync(p: string): boolean } {
 
 const noFiles = fsWith(new Set());
 
+describe("pool live test", () => {
+  const realFetch = globalThis.fetch;
+  afterEach(() => {
+    globalThis.fetch = realFetch;
+  });
+
+  test("all members pass in parallel with the maximum latency", async () => {
+    let release!: () => void;
+    const gate = new Promise<void>((resolve) => {
+      release = resolve;
+    });
+    const check = mock(async (key: string) => {
+      await gate;
+      return { ok: true, latency_ms: key === "fake-abcde" ? 30 : 10 };
+    });
+    const pending = checkEachKey("OPENAI_API_KEY", " fake-abcde, fake-fghij ", check);
+    expect(check).toHaveBeenCalledTimes(2);
+    release();
+    expect(await pending).toEqual({
+      ok: true,
+      latency_ms: 30,
+      keys: [
+        { keyType: "OPENAI_API_KEY", index: 0, suffix: "abcde", ok: true, latency_ms: 30 },
+        { keyType: "OPENAI_API_KEY", index: 1, suffix: "fghij", ok: true, latency_ms: 10 },
+      ],
+    });
+  });
+
+  test("one failed member preserves pool order and reports a warning", async () => {
+    const result = await checkEachKey(
+      "ANTHROPIC_API_KEY",
+      "fake-first,fake-abcde,fake-third",
+      async (key) =>
+        key === "fake-abcde"
+          ? { ok: false, error: "Unauthorized", httpStatus: 401, latency_ms: 20 }
+          : { ok: true, latency_ms: 10 },
+    );
+    expect(result).toMatchObject({
+      ok: true,
+      latency_ms: 20,
+      warning: "1 of 3 keys failed: key ending abcde (HTTP 401).",
+    });
+    expect(result.keys).toEqual([
+      { keyType: "ANTHROPIC_API_KEY", index: 0, suffix: "first", ok: true, latency_ms: 10 },
+      {
+        keyType: "ANTHROPIC_API_KEY",
+        index: 1,
+        suffix: "abcde",
+        ok: false,
+        error: "Unauthorized",
+        httpStatus: 401,
+        latency_ms: 20,
+      },
+      { keyType: "ANTHROPIC_API_KEY", index: 2, suffix: "third", ok: true, latency_ms: 10 },
+    ]);
+    expect(result.error).toBeUndefined();
+  });
+
+  test("several failed members use HTTP status or the member error", async () => {
+    const result = await checkEachKey(
+      "OPENAI_API_KEY",
+      "fake-abcde,fake-fghij,fake-third",
+      async (key) => {
+        if (key === "fake-abcde") {
+          return { ok: false, error: "Unauthorized", httpStatus: 401, latency_ms: 10 };
+        }
+        if (key === "fake-fghij") return { ok: false, error: "timeout", latency_ms: 30 };
+        return { ok: true, latency_ms: 20 };
+      },
+    );
+    expect(result.ok).toBe(true);
+    expect(result.warning).toBe(
+      "2 of 3 keys failed: key ending abcde (HTTP 401), key ending fghij (timeout).",
+    );
+    expect(result.latency_ms).toBe(30);
+  });
+
+  test("all failed members produce an error", async () => {
+    const result = await checkEachKey("OPENAI_API_KEY", "fake-abcde,fake-fghij", async () => ({
+      ok: false,
+      error: "Unauthorized",
+      httpStatus: 401,
+      latency_ms: 10,
+    }));
+    expect(result).toMatchObject({
+      ok: false,
+      error: "All 2 keys failed: key ending abcde (HTTP 401), key ending fghij (HTTP 401).",
+      latency_ms: 10,
+    });
+    expect(result.keys).toHaveLength(2);
+    expect(result.warning).toBeUndefined();
+    expect(result.httpStatus).toBeUndefined();
+  });
+
+  test("one failed key preserves the member error and HTTP status", async () => {
+    const result = await checkEachKey("OPENAI_API_KEY", "fake-abcde", async () => ({
+      ok: false,
+      error: "HTTP 401: rejected",
+      httpStatus: 401,
+      latency_ms: 10,
+    }));
+    expect(result).toMatchObject({
+      ok: false,
+      error: "HTTP 401: rejected",
+      httpStatus: 401,
+      latency_ms: 10,
+    });
+    expect(result.keys).toHaveLength(1);
+  });
+
+  test("a thrown check becomes a scrubbed member failure", async () => {
+    const result = await checkEachKey("OPENAI_API_KEY", "fake-abcde,fake-fghij", async (key) => {
+      if (key === "fake-abcde") throw new Error("timeout");
+      return { ok: true, latency_ms: 0 };
+    });
+    expect(result.ok).toBe(true);
+    expect(result.warning).toBe("1 of 2 keys failed: key ending abcde (timeout).");
+    expect(result.keys?.[0]).toMatchObject({ ok: false, error: "timeout" });
+    expect(result.keys?.[0]?.latency_ms).toBeGreaterThanOrEqual(0);
+  });
+
+  test("a CODEX_OAUTH JSON blob remains one member", async () => {
+    const blob = '{"access":"fake-access","refresh":"fake-refresh","expires":123}';
+    const check = mock(async () => ({ ok: true, latency_ms: 0 }));
+    const result = await checkEachKey("CODEX_OAUTH", ` ${blob} `, check);
+    expect(check).toHaveBeenCalledTimes(1);
+    expect(check).toHaveBeenCalledWith(blob);
+    expect(result.keys).toHaveLength(1);
+    expect(result.keys?.[0]?.suffix).toBe(blob.slice(-5));
+  });
+
+  test("an empty split checks the trimmed input once", async () => {
+    const check = mock(async () => ({ ok: false, error: "Missing key", latency_ms: 0 }));
+    const result = await checkEachKey("OPENAI_API_KEY", " , , ", check);
+    expect(check).toHaveBeenCalledTimes(1);
+    expect(check).toHaveBeenCalledWith(", ,");
+    expect(result.error).toBe("Missing key");
+  });
+
+  test("all configured members skip the live test", async () => {
+    const result = await checkEachKey("ANTHROPIC_API_KEY", "fake-abcde,fake-fghij", async () => ({
+      ok: true,
+      skipped: true,
+      latency_ms: 10,
+    }));
+    expect(result).toEqual({ ok: true, skipped: true, latency_ms: 10 });
+  });
+
+  test("Claude API-key pools send a separate request for each member", async () => {
+    const fetchMock = mock(async (_url: string | URL | Request, init?: RequestInit) => {
+      const key = new Headers(init?.headers).get("x-api-key");
+      return new Response("{}", { status: key === "fake-good1" ? 200 : 401 });
+    });
+    globalThis.fetch = fetchMock as typeof fetch;
+    const result = await validateProviderCredentials("claude", {
+      ANTHROPIC_API_KEY: "fake-good1,fake-bad01",
+    });
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    expect(
+      fetchMock.mock.calls.map(([, init]) => new Headers(init?.headers).get("x-api-key")),
+    ).toEqual(["fake-good1", "fake-bad01"]);
+    expect(result.ok).toBe(true);
+    expect(result.warning).toBe("1 of 2 keys failed: key ending bad01 (HTTP 401).");
+    expect(result.keys?.[1]?.httpStatus).toBe(401);
+  });
+
+  test("Claude subscription pools check the OAuth profile for each member", async () => {
+    const fetchMock = mock(async (_url: string | URL | Request, _init?: RequestInit) => {
+      return new Response("{}", { status: 200 });
+    });
+    globalThis.fetch = fetchMock as typeof fetch;
+    const result = await validateProviderCredentials("claude", {
+      CLAUDE_CODE_OAUTH_TOKEN: "fake-token-a,fake-token-b",
+    });
+    expect(result.ok).toBe(true);
+    expect(result.keys).toHaveLength(2);
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    for (const [url, init] of fetchMock.mock.calls) {
+      expect(String(url)).toBe("https://api.anthropic.com/api/oauth/profile");
+      expect(init?.method).toBe("GET");
+    }
+    expect(
+      fetchMock.mock.calls.map(([, init]) => new Headers(init?.headers).get("Authorization")),
+    ).toEqual(["Bearer fake-token-a", "Bearer fake-token-b"]);
+  });
+
+  test("buildCredStatusReport copies the warning and per-key results", async () => {
+    globalThis.fetch = (async (_url: string | URL | Request, init?: RequestInit) => {
+      const key = new Headers(init?.headers).get("x-api-key");
+      return new Response("{}", { status: key === "fake-good1" ? 200 : 401 });
+    }) as typeof fetch;
+    const report = await buildCredStatusReport(
+      "claude",
+      { ANTHROPIC_API_KEY: "fake-good1,fake-bad01" },
+      {},
+      "boot",
+    );
+    expect(report.liveTest?.warning).toBe("1 of 2 keys failed: key ending bad01 (HTTP 401).");
+    expect(report.liveTest?.keys).toEqual([
+      {
+        keyType: "ANTHROPIC_API_KEY",
+        index: 0,
+        suffix: "good1",
+        ok: true,
+        latency_ms: expect.any(Number),
+      },
+      {
+        keyType: "ANTHROPIC_API_KEY",
+        index: 1,
+        suffix: "bad01",
+        ok: false,
+        error: "HTTP 401: {}",
+        httpStatus: 401,
+        latency_ms: expect.any(Number),
+      },
+    ]);
+    expect(AgentCredStatusSchema.parse(report).liveTest).toEqual(report.liveTest);
+    const success = await buildCredStatusReport(
+      "claude",
+      { ANTHROPIC_API_KEY: "fake-good1" },
+      {},
+      "boot",
+    );
+    expect(success.liveTest).not.toHaveProperty("warning");
+    const presenceOnly = await buildCredStatusReport(
+      "acp",
+      { ACP_COMMAND: "fake-command" },
+      {},
+      "boot",
+    );
+    expect(presenceOnly.liveTest).not.toHaveProperty("warning");
+    expect(presenceOnly.liveTest).not.toHaveProperty("keys");
+  });
+});
+
 // ─── claude ──────────────────────────────────────────────────────────────────
 
 describe("checkClaudeCredentials", () => {
@@ -1087,10 +1323,12 @@ describe("NaN and Helmcode live probes", () => {
 // ─── Migration 055: report composition + opt-out ────────────────────────────
 
 describe("isCredCheckDisabled", () => {
-  test("true only when CRED_CHECK_DISABLE === '1'", () => {
+  test("true when CRED_CHECK_DISABLE is '1' or 'true' (case-insensitive)", () => {
     expect(isCredCheckDisabled({})).toBe(false);
     expect(isCredCheckDisabled({ CRED_CHECK_DISABLE: "0" })).toBe(false);
-    expect(isCredCheckDisabled({ CRED_CHECK_DISABLE: "true" })).toBe(false);
+    expect(isCredCheckDisabled({ CRED_CHECK_DISABLE: "false" })).toBe(false);
+    expect(isCredCheckDisabled({ CRED_CHECK_DISABLE: "true" })).toBe(true);
+    expect(isCredCheckDisabled({ CRED_CHECK_DISABLE: "TRUE" })).toBe(true);
     expect(isCredCheckDisabled({ CRED_CHECK_DISABLE: "1" })).toBe(true);
   });
 });
@@ -1174,7 +1412,10 @@ describe("buildCredStatusReport", () => {
           expect(failure.liveTest?.ok).toBe(false);
           expect(failure.liveTest?.error).toContain("HTTP 401");
           expect(fetchMock).toHaveBeenCalledTimes(2);
-          expect(String(fetchMock.mock.calls[0]?.[0])).toMatch(/\/models$/);
+          // OpenRouter's /models is public, so its key is checked on /key.
+          expect(String(fetchMock.mock.calls[0]?.[0])).toMatch(
+            key === "OPENROUTER_API_KEY" ? /\/key$/ : /\/models$/,
+          );
         } finally {
           globalThis.fetch = realFetch;
         }
@@ -1437,3 +1678,52 @@ describe("runBedrockSdkProbeAndEnumerate — intersection logic", () => {
     mock.restore();
   });
 });
+
+describe("OpenRouter and DeepSeek live checks", () => {
+  const realFetch = globalThis.fetch;
+  afterEach(() => {
+    globalThis.fetch = realFetch;
+  });
+
+  /** Answers by path; records every URL. */
+  function stubByPath(statusFor: (url: string) => number) {
+    const urls: string[] = [];
+    globalThis.fetch = (async (input: string | URL | Request) => {
+      const url = input instanceof Request ? input.url : String(input);
+      urls.push(url);
+      return new Response("{}", { status: statusFor(url) });
+    }) as typeof fetch;
+    return urls;
+  }
+
+  test("OpenRouter checks the key on /key, not the public /models", async () => {
+    const urls = stubByPath((url) => (url.endsWith("/key") ? 401 : 200));
+    const result = await validateProviderCredentials("pi", { OPENROUTER_API_KEY: "or-bad" });
+    expect(result).toMatchObject({ ok: false, httpStatus: 401 });
+    expect(urls).toEqual(["https://openrouter.ai/api/v1/key"]);
+  });
+
+  test("a base URL without /key falls back to /models", async () => {
+    const urls = stubByPath((url) => (url.endsWith("/key") ? 404 : 200));
+    const result = await validateProviderCredentials("pi", { OPENROUTER_API_KEY: "or-key" });
+    expect(result.ok).toBe(true);
+    expect(urls).toEqual([
+      "https://openrouter.ai/api/v1/key",
+      "https://openrouter.ai/api/v1/models",
+    ]);
+  });
+
+  test("dsh checks DEEPSEEK_API_KEY on DeepSeek /models, else OpenRouter", async () => {
+    const urls = stubByPath(() => 401);
+    const deepseek = await validateProviderCredentials("dsh", {
+      DEEPSEEK_API_KEY: "ds-bad",
+      OPENROUTER_API_KEY: "or-key",
+    });
+    expect(deepseek).toMatchObject({ ok: false, httpStatus: 401 });
+    expect(urls).toEqual(["https://api.deepseek.com/models"]);
+
+    const openrouter = await validateProviderCredentials("dsh", { OPENROUTER_API_KEY: "or-key" });
+    expect(openrouter).toMatchObject({ ok: false, httpStatus: 401 });
+    expect(urls.at(-1)).toBe("https://openrouter.ai/api/v1/key");
+  });
+});

package/src/tests/credential-refresh.test.ts

@@ -2,9 +2,14 @@ import { afterEach, beforeEach, describe, expect, mock, spyOn, test } from "bun:
 import {
   CREDENTIAL_RETRY_INTERVAL_MS,
   type CredentialRefreshState,
+  credentialFingerprint,
+  KEY_RECHECK_INTERVAL_MS,
+  recheckableFailures,
   refreshCredentialStatus,
+  reportKeyValidation,
 } from "../commands/credential-refresh";
 import * as credentials from "../commands/provider-credentials";
+import { fetchResolvedEnv } from "../commands/runner";
 import type { AgentCredStatus } from "../types";
 
 const api = { apiUrl: "http://unused.test", apiKey: "test", agentId: crypto.randomUUID() };
@@ -27,7 +32,14 @@ describe("runner credential refresh", () => {
   let send: ReturnType<typeof spyOn<typeof credentials, "sendCredStatusReport">>;
 
   beforeEach(() => {
-    state = { harnessProvider: "claude", ready: true, lastRefreshAt: 0, inFlight: false };
+    state = {
+      harnessProvider: "claude",
+      ready: true,
+      lastRefreshAt: 0,
+      inFlight: false,
+      fingerprint: credentialFingerprint({}),
+      rejectedKeys: 0,
+    };
     build = spyOn(credentials, "buildCredStatusReport").mockResolvedValue(ready);
     send = spyOn(credentials, "sendCredStatusReport").mockResolvedValue(undefined);
   });
@@ -43,6 +55,136 @@ describe("runner credential refresh", () => {
     expect(state.ready).toBe(true);
   });
 
+  test("a changed credential fingerprint refreshes a ready worker immediately", async () => {
+    const env = { ANTHROPIC_API_KEY: "test-pool-a,test-pool-b" };
+    await refreshCredentialStatus(api, state, "claude", env, 1);
+    expect(build).toHaveBeenCalledWith("claude", env, {}, "post_task");
+    expect(state.fingerprint).toBe(credentialFingerprint(env));
+    await refreshCredentialStatus(api, state, "claude", env, 2);
+    expect(build).toHaveBeenCalledTimes(1);
+    await refreshCredentialStatus(api, state, "claude", {}, 3);
+    expect(build).toHaveBeenCalledTimes(2);
+  });
+
+  test("an unchanged fingerprint does not refresh a ready worker", async () => {
+    await refreshCredentialStatus(api, state, "claude", {}, KEY_RECHECK_INTERVAL_MS);
+    expect(build).not.toHaveBeenCalled();
+  });
+
+  test("fingerprints ignore environment order and unrelated values", () => {
+    expect(credentialFingerprint({ ANTHROPIC_API_KEY: "test-a", PATH: "a" })).toBe(
+      credentialFingerprint({ PATH: "b", ANTHROPIC_API_KEY: "test-a" }),
+    );
+    for (const key of ["ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_BASE_URL", "OPENAI_API_KEY"]) {
+      expect(credentialFingerprint({ [key]: "changed" })).not.toBe(credentialFingerprint({}));
+    }
+  });
+
+  test("resolved credential env preserves the full pool before selection", async () => {
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = (async (url) => {
+      if (String(url).includes("/api/config/resolved")) {
+        return Response.json({
+          configs: [{ key: "ANTHROPIC_API_KEY", value: "test-aaa11,test-bbb22" }],
+        });
+      }
+      return Response.json({ availableIndices: [1], rejectedIndices: [0] });
+    }) as typeof fetch;
+    try {
+      const result = await fetchResolvedEnv(api.apiUrl, api.apiKey, api.agentId, {
+        HARNESS_PROVIDER: "claude",
+      });
+      expect(result.credentialEnv.ANTHROPIC_API_KEY).toBe("test-aaa11,test-bbb22");
+      expect(result.env.ANTHROPIC_API_KEY).toBe("test-bbb22");
+      expect(result.credentialEnv).not.toBe(result.env);
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  });
+
+  test("rejected keys refresh after ten minutes, even when the worker is ready", async () => {
+    state.rejectedKeys = 1;
+    await refreshCredentialStatus(api, state, "claude", {}, KEY_RECHECK_INTERVAL_MS - 1);
+    expect(build).not.toHaveBeenCalled();
+    await refreshCredentialStatus(api, state, "claude", {}, KEY_RECHECK_INTERVAL_MS);
+    expect(build).toHaveBeenCalledTimes(1);
+    expect(state.rejectedKeys).toBe(0);
+  });
+
+  test("a failed live test without per-key results remains eligible for recheck", async () => {
+    build.mockResolvedValueOnce({
+      ...ready,
+      liveTest: { ok: false, error: "timeout", latency_ms: 1 },
+    });
+    await refreshCredentialStatus(api, state, "pi", {}, 1);
+    expect(state.rejectedKeys).toBe(1);
+  });
+
+  test("refresh reports per-key results once per credential type", async () => {
+    const keys = [
+      {
+        keyType: "ANTHROPIC_API_KEY",
+        index: 0,
+        suffix: "aaa11",
+        ok: false,
+        httpStatus: 401,
+        latency_ms: 1,
+      },
+      { keyType: "ANTHROPIC_API_KEY", index: 1, suffix: "bbb22", ok: true, latency_ms: 1 },
+      { keyType: "OPENAI_API_KEY", index: 0, suffix: "ccc33", ok: true, latency_ms: 1 },
+    ];
+    build.mockResolvedValueOnce({ ...ready, liveTest: { ok: false, latency_ms: 1, keys } });
+    const requests: Array<{ url: string; init?: RequestInit }> = [];
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = (async (url, init) => {
+      requests.push({ url: String(url), init });
+      return Response.json({ success: true });
+    }) as typeof fetch;
+    try {
+      await refreshCredentialStatus(api, state, "pi", {}, 1);
+      expect(state.rejectedKeys).toBe(1);
+      expect(requests).toHaveLength(2);
+      expect(requests[0]!.url).toBe(`${api.apiUrl}/api/keys/report-validation`);
+      expect(requests[0]!.init?.headers).toMatchObject({
+        Authorization: `Bearer ${api.apiKey}`,
+        "X-Agent-ID": api.agentId,
+      });
+      expect(JSON.parse(String(requests[0]!.init?.body))).toEqual({
+        keyType: "ANTHROPIC_API_KEY",
+        keys: [
+          { keyIndex: 0, keySuffix: "aaa11", ok: false, httpStatus: 401 },
+          { keyIndex: 1, keySuffix: "bbb22", ok: true },
+        ],
+      });
+      expect(JSON.parse(String(requests[1]!.init?.body))).toEqual({
+        keyType: "OPENAI_API_KEY",
+        keys: [{ keyIndex: 0, keySuffix: "ccc33", ok: true }],
+      });
+      expect(requests[0]!.init?.signal).toBeInstanceOf(AbortSignal);
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  });
+
+  test("validation reporting contains HTTP and network failures", async () => {
+    const originalFetch = globalThis.fetch;
+    const warn = spyOn(console, "warn").mockImplementation(() => {});
+    const fetchMock = mock<typeof fetch>()
+      .mockResolvedValueOnce(new Response(null, { status: 503 }))
+      .mockRejectedValueOnce(new Error("network unavailable"));
+    globalThis.fetch = fetchMock as typeof fetch;
+    try {
+      await reportKeyValidation(api, [
+        { keyType: "ANTHROPIC_API_KEY", index: 0, suffix: "aaa11", ok: true, latency_ms: 1 },
+        { keyType: "OPENAI_API_KEY", index: 0, suffix: "bbb22", ok: true, latency_ms: 1 },
+      ]);
+      expect(fetchMock).toHaveBeenCalledTimes(2);
+      expect(warn).toHaveBeenCalledTimes(2);
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  });
+
   test("a failed readiness write is throttled and retried even when the snapshot is ready", async () => {
     send.mockRejectedValueOnce(new Error("HTTP 503"));
     await expect(refreshCredentialStatus(api, state, "pi", {}, 1)).rejects.toThrow("HTTP 503");
@@ -113,3 +255,32 @@ describe("runner credential refresh", () => {
     expect(build).toHaveBeenCalledTimes(1);
   });
 });
+
+describe("recheckableFailures", () => {
+  const key = (keyType: string, ok: boolean) => ({
+    keyType,
+    index: 0,
+    suffix: "abcde",
+    ok,
+    latency_ms: 1,
+  });
+
+  test("a Claude subscription token never joins the periodic recheck", () => {
+    const liveTest = {
+      ok: false,
+      error: "rejected",
+      latency_ms: 1,
+      testedAt: 1,
+      keys: [key("CLAUDE_CODE_OAUTH_TOKEN", false), key("ANTHROPIC_API_KEY", false)],
+    };
+    expect(recheckableFailures(liveTest)).toBe(1);
+    expect(
+      recheckableFailures({ ...liveTest, keys: [key("CLAUDE_CODE_OAUTH_TOKEN", false)] }),
+    ).toBe(0);
+  });
+
+  test("a failed test without per-key results counts once", () => {
+    expect(recheckableFailures({ ok: false, error: "x", latency_ms: 1, testedAt: 1 })).toBe(1);
+    expect(recheckableFailures(null)).toBe(0);
+  });
+});

package/src/tests/db-retention.test.ts

@@ -19,8 +19,13 @@ import {
 const TEST_DB_PATH = "./test-db-retention.sqlite";
 const NOW = new Date("2026-08-23T12:00:00.000Z");
 const RETENTION_KEYS = DB_RETENTION_TABLES.map((table) => table.envKey);
-/** Time-horizon tables. Count-based context_versions has its own suite. */
-const AGE_TABLES = DB_RETENTION_TABLES.filter((table) => table.policy === "age");
+/**
+ * Plain time-horizon tables. Count-based context_versions and status-filtered
+ * script_runs have their own suites.
+ */
+const AGE_TABLES = DB_RETENTION_TABLES.filter(
+  (table) => table.policy === "age" && !("terminalStatuses" in table),
+);
 type AgeTable = (typeof AGE_TABLES)[number];
 const TUNING_KEYS = [
   "DB_RETENTION_TICK_BUDGET_MS",
@@ -135,12 +140,13 @@ afterEach(async () => {
 });
 
 describe("DB retention", () => {
-  test("keeps the closed allowlist limited to the four approved tables", () => {
+  test("keeps the closed allowlist limited to the five approved tables", () => {
     expect(DB_RETENTION_TABLES.map((table) => table.table)).toEqual([
       "session_logs",
       "agent_log",
       "events",
       "context_versions",
+      "script_runs",
     ]);
   });
 

package/src/tests/db-task-read-contract.test.ts

@@ -529,6 +529,7 @@ value:recordKeyAuthFailure
 value:recordKeyRateLimitWindows
 value:recordKeySeatMismatch
 value:recordKeyUsage
+value:recordKeyValidation
 value:recordSlackMessage
 value:recordTaskProviderIfUnset
 value:recordTaskPullRequestAttachments

package/src/tests/db-task-write-contract.test.ts

@@ -552,6 +552,7 @@ value:recordKeyAuthFailure
 value:recordKeyRateLimitWindows
 value:recordKeySeatMismatch
 value:recordKeyUsage
+value:recordKeyValidation
 value:recordSlackMessage
 value:recordTaskProviderIfUnset
 value:recordTaskPullRequestAttachments
@@ -684,7 +685,6 @@ STEERING_MESSAGE_SELECT
 UNATTRIBUTED_USER_ID
 VERSIONABLE_FIELDS
 WEEK_SECONDS
-WORKFLOW_RUN_SUMMARY_COLUMNS
 abandonSlackOutcomeDelivery
 acceptTask
 assertSkillFileLimits
@@ -1097,8 +1097,6 @@ rowToUser
 rowToUserFavorite
 rowToWaitState
 rowToWorkflow
-rowToWorkflowRun
-rowToWorkflowRunStep
 rowToWorkflowSummary
 rowToWorkflowVersion
 scriptRunUpdateSets

package/src/tests/docs-index-footprint.test.js

@@ -78,7 +78,7 @@ describe("docs API index footprint", () => {
     expect(tasks).toContain('"path":"/api/task-templates","method":"get"');
   });
 
-  test("OpenAPI and generated pages keep all 449 operations", async () => {
+  test("OpenAPI and generated pages keep all 456 operations", async () => {
     const spec = await Bun.file(resolve(repoRoot, "openapi.json")).json();
     const operationKeys = [];
     const tags = new Set();
@@ -103,8 +103,8 @@ describe("docs API index footprint", () => {
     expect(spec.paths["/api/agents/{id}/runtime"]?.get).toBeDefined();
 
     const generatedKeys = await generatedOperationKeys();
-    expect(operationKeys).toHaveLength(449);
-    expect(generatedKeys).toHaveLength(449);
+    expect(operationKeys).toHaveLength(456);
+    expect(generatedKeys).toHaveLength(456);
     expect(new Set(generatedKeys)).toEqual(new Set(operationKeys));
   });