@githolon/testing 0.19.0 → 0.21.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/testing",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "type": "module",
   "description": "@githolon/testing — law TDD for Nomos domains: boot the REAL engine plane in-process (the exact machinery every cloud DO, heavy container and web client runs), dispatch directives, assert rows, assert TYPED REFUSALS, fork for what-ifs — fully offline inside vitest.",
   "license": "SEE LICENSE IN LICENSE.md",

package/vendor/engine/engine.mjs

@@ -995,8 +995,7 @@ export async function replicateIntents(eng, ws, ledger, intents, { push = true }
  * main once. This is still untrusted work: owner-only/control-plane/receipt
  * writes are refused or dead-lettered exactly like session refs.
  */
-export async function admitIntentOffers(eng, ws, ledger, offers, { refuseDomains = [], receiptFence = null, shardRouting = null, clientBase = null, defer = false } = {}) {
-  const refuse = new Set(refuseDomains);
+export async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence = null, shardRouting = null, clientBase = null, defer = false } = {}) {
   const main = await mainIntentIds(eng, ws);
   const sessions = new Map();
   const deadLetters = [];
@@ -1048,14 +1047,13 @@ export async function admitIntentOffers(eng, ws, ledger, offers, { refuseDomains
       const dirId = typeof doc?.payload?.directiveId === "string" ? doc.payload.directiveId : null;
       const oid = String(offer?.oid || intentId || "").slice(0, 10);
       // THE GATE DECIDES (offer-kernel doctrine — OFFER_KERNEL_ARCHITECTURE.dot): the adapter does NOT
-      // pre-filter control-plane (`nomos`/`bootstrap`) intents by domain string — that was the adapter
-      // "choosing admission", which the doctrine forbids. An install/governance offer rides the SAME lane;
-      // the kernel gate refuses an author who lacks the declared relation (installDomain.requiresRelationGate
-      // = {relation:"installDomain", object:"workspace:self"}), so an unauthorized control-plane write is a
-      // TYPED GATE refusal, not a adapter verdict. Only `!dom` (malformed) and the explicit per-workspace
-      // `refuse` fence (root's `workspaces` governance lane) stay — those are structural, not authority.
-      if (!dom || refuse.has(dom)) {
-        rec.rejected.push({ oid, error: `${dom ? `'${dom}' is adapter-fenced on this workspace` : "non-authored intent"} — governance enters its own admin lane` });
+      // pre-filter ANY intent by domain string. An install/governance offer rides the SAME lane; the kernel
+      // gate refuses an author who lacks the declared relation, so an unauthorized control-plane write is a
+      // TYPED GATE refusal, never an adapter verdict. host does no authority — the kernel gates the control
+      // plane (open until the warrant-flip arms signature verification on root/co2). Only `!dom` (malformed
+      // bytes — structural, not authority) stays.
+      if (!dom) {
+        rec.rejected.push({ oid, error: "non-authored intent — governance enters its own admin lane" });
         continue;
       }
       if (receiptFence && dirId && Array.isArray(receiptFence[dom]) && receiptFence[dom].includes(dirId)) {
@@ -1137,7 +1135,11 @@ export async function admitIntentOffers(eng, ws, ledger, offers, { refuseDomains
     } catch { /* fall back to the client's own GET /pack */ }
   }
   log("admit-intent-offers", { ws, sessions: sessions.size, admitted: admittedTotal, rejected: [...sessions.values()].reduce((n, s) => n + s.rejected.length, 0), resultPack: resultPackB64 ? "inline" : "none" });
-  return { sessions: [...sessions.values()].map((s) => ({ ...s, ...(s.skipped.length ? {} : { skipped: undefined }) })), main: head, deadLetters, timings, ...(summary ? { summary } : {}), ...(born.length ? { born } : {}), ...(resultPackB64 ? { resultPackB64, resultBase: clientBase } : {}), ...(deferDurability && admittedTotal && head ? { deferred: true, head } : {}) };
+  // G3 COLD-STORAGE: a `.births()` offer in this batch produced child custody in this engine's FS (the sibling
+  // repos). Pack each born child's full chain BEFORE returning so the bytes ride out for the worker to persist
+  // to the child's own Artifacts repo (the host names nothing — it shuttles kernel-produced bytes keyed by ws).
+  const bornPacked = born.length ? packBornChildren(eng, born) : born;
+  return { sessions: [...sessions.values()].map((s) => ({ ...s, ...(s.skipped.length ? {} : { skipped: undefined }) })), main: head, deadLetters, timings, ...(summary ? { summary } : {}), ...(bornPacked.length ? { born: bornPacked } : {}), ...(resultPackB64 ? { resultPackB64, resultBase: clientBase } : {}), ...(deferDurability && admittedTotal && head ? { deferred: true, head } : {}) };
 }
 
 /**
@@ -1175,9 +1177,12 @@ export async function authorOn(eng, ws, ledger, domain, directiveId, payload, la
   }
   if (res && res.ok === false) return { ok: false, error: String(res.error || "the law refused this intent").slice(0, 500) };
   await commitAndPush(eng, ws, ledger);
-  // KEEP `born`: a `.births()` directive authored here ran the G3 birth offer-effect; surface the child
-  // heads so the container author case → worker out.born relays them (the host persists the child custody).
-  return { ok: true, head: res.head, ...(res.born ? { born: res.born } : {}) };
+  // G3 COLD-STORAGE: a `.births()` directive authored here ran the kernel birth offer-effect, which wrote each
+  // child's custody to a sibling repo in this engine's FS. Pack each born child's full chain so the container
+  // author case → worker relays the bytes and the worker persists them to the child's OWN Artifacts repo. The
+  // PARENT's main was already pushed above; the child custody is a SEPARATE store the host must ship.
+  const bornPacked = Array.isArray(res.born) && res.born.length ? packBornChildren(eng, res.born) : res.born;
+  return { ok: true, head: res.head, ...(bornPacked ? { born: bornPacked } : {}) };
 }
 
 /**
@@ -1899,6 +1904,63 @@ export function servePack(eng, ws, base = "") {
   if (!r || r.ok !== true || typeof r.packB64 !== "string") throw new Error("servePack: kernel produced no pack");
   return { packB64: r.packB64, bytes: r.bytes };
 }
+
+// ── G3 COLD-STORAGE: SURFACE THE BORN CHILD'S CUSTODY BYTES (the host-bailiff persist lane) ──────────────
+// The kernel's birth offer-effect (`run_birth_effect`) wrote each born child's whole genesis→head custody to
+// a SIBLING repo IN THIS ENGINE'S FS — `sibling_repo_arg(parent_repo_arg, child)` == `/work/ws/<child>` ==
+// `repoArgOf(child)` (the kernel names no DO/container topology; it writes a path the host already keys by ws
+// name). That custody lives ONLY in the engine FS until the HOST ships it to the child's OWN custody store.
+// So pack each born child's FULL chain (base="" ⇒ genesis→head) straight from its sibling repo and carry the
+// bytes OUT on the born entry; the worker (which holds the Artifacts binding) creates the child repo + pushes
+// the pack to refs/heads/main. Host-pure: the adapter NAMES no domain, DECIDES nothing — it shuttles the
+// kernel-produced child custody keyed by the kernel-returned `{workspace, head}`. A child whose pack can't be
+// produced keeps its entry WITHOUT packB64 (+ logs) so the worker SURFACES the failure (the physical birth is
+// never silently dropped). Returns the born array with packB64 added where it could be packed.
+export function packBornChildren(eng, born) {
+  if (!Array.isArray(born) || !born.length) return born;
+  return born.map((b) => {
+    const child = b && typeof b.workspace === "string" ? b.workspace : null;
+    const head = b && typeof b.head === "string" ? b.head : null;
+    if (!child || !/^[0-9a-f]{40}$/i.test(head || "")) {
+      log("born-pack-skipped", { workspace: child, head, reason: "malformed born entry" });
+      return b;
+    }
+    try {
+      // base="" ⇒ the FULL pack of everything reachable from the child's head (genesis→head). The kernel
+      // resolves the child's main itself from the sibling repo at repoArgOf(child).
+      const pack = packDelta(eng, child, "", head);
+      if (!pack || !pack.length) {
+        log("born-pack-empty", { workspace: child, head });
+        return b;
+      }
+      return { ...b, packB64: b64Bytes(pack), packBytes: pack.length };
+    } catch (e) {
+      log("born-pack-failed", { workspace: child, head, error: String(e).slice(0, 200) });
+      return b;
+    }
+  });
+}
+
+// ── INGEST A CUSTODY PACK AS A WORKSPACE'S OWN STORE (the host-side twin of the worker's pushPack persist) ──
+// Stage a FRESH bare repo for `ws` in THIS engine's FS, ingest the kernel-built `packBytes` (apply_pack — the
+// inbound twin of pack_delta; objects land PACKED), then point refs/heads/main + HEAD at `head`. This is what
+// a peer/edge does on receiving a workspace's pack over the wire: it holds ONLY the pack, no parent FS. The
+// cross-workspace birth proof uses it to mount a born child from an INDEPENDENT custody store (not the parent
+// engine FS) — proving the host-bailiff persist is what makes the child servable on its own. `packBytes` is a
+// Uint8Array (the bytes packBornChildren / the worker's b64-decoded packB64 carry).
+export async function ingestPackAsCustody(eng, ws, packBytes, head) {
+  if (!packBytes || !packBytes.length) throw new Error(`ingestPackAsCustody: empty pack for '${ws}'`);
+  if (!/^[0-9a-f]{40}$/i.test(head || "")) throw new Error(`ingestPackAsCustody: bad head '${head}' for '${ws}'`);
+  unmount(eng, ws);
+  stageWorkspaceDir(eng, ws);
+  const gitdir = gitdirOf(ws);
+  await custodySkeleton(eng, gitdir);
+  applyPackInto(eng, ws, packBytes);            // kernel apply_pack — ingests the genesis→head objects
+  kgit.writeRef(eng, gitdir, "refs/heads/main", head);
+  kgit.writeRef(eng, gitdir, "HEAD", "ref: refs/heads/main");
+  eng.mounted.set(ws, { restored: true, remoteMain: head, restoreError: null });
+  return { ok: true, head: kgit.resolveRef(eng, gitdir, "refs/heads/main") };
+}
 export const nomosActive = (eng, ws) => qById(eng, ws, `domain-installation:${eng.hashes.nomos}`).length > 0;
 // E2E crypto linkage probe (the encryption arc): run the wrap→unwrap + field seal→open
 // INSIDE the deployable wasm. Pure — no workspace, no chain. Returns {wrapHandoff, fieldAead}.
@@ -1967,8 +2029,7 @@ async function mainIntentIds(eng, ws) {
  * engine has no durable store), obvious attacks drop. Admitted intents merge to main,
  * durably push, the branch is consumed.
  */
-export async function admitAll(eng, ws, ledger, { refuseDomains = [], receiptFence = null, shardRouting = null, defer = false } = {}) {
-  const refuse = new Set(refuseDomains);
+export async function admitAll(eng, ws, ledger, { receiptFence = null, shardRouting = null, defer = false } = {}) {
   const routes = shardRouting ? directiveRoutes(eng) : null;
   const gitdir = gitdirOf(ws);
   // FRESH HEADER COPY PER GIT OP. isomorphic-git's `discover` MUTATES the headers object it's given
@@ -2082,12 +2143,13 @@ export async function admitAll(eng, ws, ledger, { refuseDomains = [], receiptFen
           const blob = bytesFromB64(c.intentB64);
           let dom = null, intentId = null, dirId = null;
           try { const doc = JSON.parse(dec.decode(blob)); intentId = typeof doc.id === "string" ? doc.id : null; dom = doc && doc.payload && typeof doc.payload.domain === "string" ? doc.payload.domain : null; dirId = doc && doc.payload && typeof doc.payload.directiveId === "string" ? doc.payload.directiveId : null; } catch {}
-          // THE GATE DECIDES (offer-kernel doctrine): no adapter domain-string filter for control-plane —
-          // an install/governance offer rides the SAME lane and the kernel gate refuses an author lacking
-          // the declared relation (a TYPED gate refusal, not a adapter verdict). Only `!dom` (malformed) and
-          // the explicit `refuse` fence (root's `workspaces` governance lane) stay — structural, not authority.
-          if (!dom || refuse.has(dom)) {
-            rejected.push({ oid: oid.slice(0, 10), error: `${dom ? `'${dom}' is adapter-fenced on this workspace` : "non-authored intent"} — governance enters its own admin lane` });
+          // THE GATE DECIDES (offer-kernel doctrine): no adapter domain-string filter for ANY intent — an
+          // install/governance offer rides the SAME lane and the kernel gate refuses an author lacking the
+          // declared relation (a TYPED gate refusal, never an adapter verdict). host does no authority — the
+          // kernel gates the control plane (open until the warrant-flip arms signature verification on
+          // root/co2). Only `!dom` (malformed bytes — structural, not authority) stays.
+          if (!dom) {
+            rejected.push({ oid: oid.slice(0, 10), error: "non-authored intent — governance enters its own admin lane" });
             continue;
           }
           // THE RECEIPT FENCE (capability_marketplace.md slice 1.5 — the ratified
@@ -2579,12 +2641,16 @@ export async function boot(eng, ws, ledger) {
 }
 
 /** Install a tenant package under the nomos controller (validation is the ADAPTER's job). */
-export async function deploy(eng, ws, ledger, usda, domainHash, dispositions) {
+export async function deploy(eng, ws, ledger, usda, domainHash, dispositions, opts = {}) {
   // THE EVOLVE-GATE ANSWER LANE (#58): `dispositions` ({retired, retyped, rebinds,
   // ackBy}) ride the committed installDomain payload — IN-HISTORY facts the one gate
   // adjudicates the stable-id diff against. Absent for the common (non-destructive)
   // upgrade; the gate's typed refusal names the remedy when one is needed.
-  const result = author(eng, ws, "nomos", "installDomain", installPayload(domainHash, usda, eng.installedBy, dispositions), eng.hashes.nomos);
+  // THE DEPLOYER's attested identity (actor + raw token) rides the install author exactly as the `offer`
+  // verb threads it — the kernel judges whether this principal holds the `installDomain` relation. Empty
+  // actor (the default) preserves the genesis-virgin / broadly-held-relation install path (backward-compat);
+  // a present actor lets an AUTHORIZED non-virgin evolve admit instead of being refused for want of authority.
+  const result = author(eng, ws, "nomos", "installDomain", installPayload(domainHash, usda, eng.installedBy, dispositions), eng.hashes.nomos, { actor: opts.actor ?? "", ...(opts.authToken ? { authToken: opts.authToken } : {}) });
   // ATOMICITY: VALIDATE the post-install projection BEFORE committing to custody. The install's
   // read manifest is re-derived on this read; if it cannot fold (e.g. a divergent read-projection
   // declaration the kernel refuses), this THROWS — and because we have NOT yet pushed, custody