@githolon/testing 0.35.0 → 0.37.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/testing",
-  "version": "0.35.0",
+  "version": "0.37.0",
   "type": "module",
   "description": "@githolon/testing — law TDD for Nomos domains: boot the REAL engine plane in-process (the exact machinery every cloud DO, heavy container and web client runs), dispatch directives, assert rows, assert TYPED REFUSALS, fork for what-ifs — fully offline inside vitest.",
   "license": "SEE LICENSE IN LICENSE.md",

package/vendor/engine/engine.mjs

@@ -1465,6 +1465,9 @@ export function author(eng, ws, domain, directiveId, payload, controllerHash, op
     const served = attestedRead(eng, need.from, {
       queryId: need.queryId, paramsJson: JSON.stringify(need.args), attestorSecret: secret,
       nowMs: opts.attestNowMs ?? Date.now(),
+      // K3 (§1.5.3): colocated custody is in-memory — always ask for the carried enrollment
+      // proof; the kernel produces-or-omits under its own bounds (the adapter decides nothing).
+      includeRosterProof: true,
     });
     if (!served || served.ok !== true) break; // the kernel's original instruction stands for the caller
     envelope.attestations = [...(envelope.attestations ?? []), { queryId: need.queryId, result: served.rows, attestation: served.attestation }];
@@ -1908,10 +1911,10 @@ export const attestationSign = (eng, { secret, asserterWorkspace, object, relati
 // secret (the `attestationSign` pattern — never persisted). The adapter/host transports the secret and
 // relays the returned `{rows, attestation, leafCount}` OPAQUE — it never constructs, inspects, or
 // modifies the envelope (the bailiff line). `nowMs` = the source clock at serve, injected by the caller.
-export const attestedRead = (eng, ws, { queryId, paramsJson, attestorSecret, nowMs }) =>
+export const attestedRead = (eng, ws, { queryId, paramsJson, attestorSecret, nowMs, includeRosterProof }) =>
   JSON.parse(call(eng.ex, "query", {
     repoArg: repoArgOf(ws), workspace: ws, branch: BRANCH,
-    queryBytes: b64Json({ op: "attestedRead", queryId, paramsJson: paramsJson || "{}", attestorSecret, nowMs: nowMs ?? Date.now(), sourceWorkspace: ws }),
+    queryBytes: b64Json({ op: "attestedRead", queryId, paramsJson: paramsJson || "{}", attestorSecret, nowMs: nowMs ?? Date.now(), sourceWorkspace: ws, ...(includeRosterProof ? { includeRosterProof: true } : {}) }),
   }, eng.STDERR));
 
 // THE KERNEL-INSTRUCTED MISSING-EVIDENCE PARSE (stage 2 §4.1): the one gate's typed
@@ -2816,3 +2819,48 @@ export function warmEngine(eng) {
   // not a top-level adapter verb. Still post-ack (the adapter calls warmEngine off the write critical path).
   return JSON.parse(call(eng.ex, "query", { repoArg: "/work", workspace: "root", queryBytes: b64Json({ op: "warm" }), branch: BRANCH }, eng.STDERR));
 }
+
+/**
+ * ATTESTED READS §5.2 (stage 3) — THE BATCH-SEAL DRIVER. The adapter's ONLY roles here are
+ * SCHEDULING (when to ask) and TRANSPORT (carrying the kernel's own snapshot back as an offer)
+ * — the debounced-admission-alarm precedent: the kernel decides WHAT a seal is (the
+ * `attestationOpenBatch` snapshot + `shouldSeal` verdict + the gate's Merkle-root demand);
+ * this function decides nothing. Call it on a timer / after serves / on unmount
+ * (`{unmounting: true}` forces pending batches to seal — a batch never dies silently).
+ * A failed seal offer LEAVES the accumulator intact (retry next tick, never a silent drop);
+ * only an ADMITTED seal clears the sealed snapshot (`attestationBatchClear`).
+ *
+ * `domain` names the installed law that exports `recordAttestationBatch` (the framework
+ * directive rides the composing law); `controllerHash` is that law's content hash. The offer
+ * is authored AS `workspace:read-attestor` (the enrolled signer — §1.2's "one key, two
+ * duties"); on a warranted workspace pass `opts.authorOpts` with the signing material.
+ */
+export function sealAttestationBatches(eng, ws, domain, controllerHash, opts = {}) {
+  const snap = JSON.parse(call(eng.ex, "query", {
+    repoArg: repoArgOf(ws), workspace: ws, branch: BRANCH,
+    queryBytes: b64Json({ op: "attestationOpenBatch", repoArg: repoArgOf(ws), nowMs: opts.nowMs ?? Date.now(), unmounting: !!opts.unmounting }),
+  }, eng.STDERR));
+  const outcomes = [];
+  for (const b of snap.batches ?? []) {
+    if (b.leafCount === 0) continue;
+    if (!(b.shouldSeal || opts.force)) continue;
+    const payload = {
+      batchId: b.batchId, batchRoot: b.batchRoot, leafCount: b.leafCount, leaves: b.leaves,
+      firstAt: b.firstAt, lastAt: b.lastAt, headAtSeal: b.headAtSeal,
+      foldRootAtSeal: b.foldRootAtSeal, signerKeyHash: b.signerKeyHash,
+    };
+    const r = author(eng, ws, domain, "recordAttestationBatch", payload, controllerHash, {
+      actor: "workspace:read-attestor", ...(opts.authorOpts ?? {}),
+    });
+    if (!r.ok) {
+      outcomes.push({ batchId: b.batchId, ok: false, error: r.error }); // retained — retries next call
+      continue;
+    }
+    JSON.parse(call(eng.ex, "query", {
+      repoArg: repoArgOf(ws), workspace: ws, branch: BRANCH,
+      queryBytes: b64Json({ op: "attestationBatchClear", batchId: b.batchId, leafCount: b.leafCount }),
+    }, eng.STDERR));
+    outcomes.push({ batchId: b.batchId, ok: true, leafCount: b.leafCount, intent: r.intentOut });
+  }
+  return outcomes;
+}