@githolon/testing 0.4.0 → 0.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/testing",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "type": "module",
   "description": "@githolon/testing — law TDD for Nomos domains: boot the REAL engine plane in-process (the exact machinery every cloud DO, heavy container and web client runs), dispatch directives, assert rows, assert TYPED REFUSALS, fork for what-ifs — fully offline inside vitest.",
   "license": "SEE LICENSE IN LICENSE.md",

package/vendor/engine/engine.mjs

@@ -53,7 +53,7 @@ function seedManifests(m, strings) {
   m.set("identity-manifests.json", new File(enc.encode(strings.identity)));
 }
 
-export const installPayload = (hash, usda, installedBy) => ({ domainHash: hash, packageUsda: usda, installedBy, authorityScope: "workspace/root", dependencies: [], finalizers: [] });
+export const installPayload = (hash, usda, installedBy, dispositions) => ({ domainHash: hash, packageUsda: usda, installedBy, authorityScope: "workspace/root", dependencies: [], finalizers: [], ...(dispositions ? { dispositions } : {}) });
 
 /**
  * Boot the resident wasm + /work tree. `wasmModule` is a PRECOMPILED WebAssembly.Module
@@ -1149,6 +1149,22 @@ export function unmount(eng, ws) {
 
 function writeWork(eng, name, bytes) { eng.preopen.dir.contents.set(name, new File(bytes)); }
 
+/** THE EVOLVE DRY-RUN (managed_rollout.md slice 1 — "would this upgrade admit?"):
+ * the evolve gate's pure judgment over the mounted workspace's folded state and a
+ * CANDIDATE package, without installing. Returns {admits} or {admits:false,
+ * domain, detail} — byte-identical to the refusal the real install would meet. */
+export function evolveDryRun(eng, ws, usda, domainHash, dispositions = null) {
+  return JSON.parse(call(eng.ex, "evolve_dryrun", { repoArg: repoArgOf(ws), branch: BRANCH, bundle: usda, hash: domainHash, ...(dispositions ? { dispositions } : {}) }, eng.STDERR));
+}
+
+/** THE FRONT-DOOR MINT (engine plane): reserve a kernel-minted typed id
+ * (`<TypeTag>_<uuidv7>`) via the wasm `mint` arm — the same mint the web client
+ * and the generated clients call. The minted id rides IN the payload, so replay
+ * reads the captured id and never re-mints (determinism via capture). */
+export function mintId(eng, typeTag) {
+  return JSON.parse(call(eng.ex, "mint", { typeTag, nowMillis: Date.now() }, eng.STDERR)).id;
+}
+
 export function author(eng, ws, domain, directiveId, payload, controllerHash, opts = {}) {
   const seq = eng.seq++;
   // rngDraws: the captured-entropy budget this intent's plan may consume (each minted id
@@ -1238,7 +1254,7 @@ async function mainIntentIds(eng, ws) {
  * engine has no durable store), obvious attacks drop. Admitted intents merge to main,
  * durably push, the branch is consumed.
  */
-export async function admitAll(eng, ws, ledger, { refuseDomains = [], shardRouting = null } = {}) {
+export async function admitAll(eng, ws, ledger, { refuseDomains = [], receiptFence = null, shardRouting = null } = {}) {
   const refuse = new Set(refuseDomains);
   const routes = shardRouting ? directiveRoutes(eng) : null;
   const gitdir = gitdirOf(ws);
@@ -1305,6 +1321,20 @@ export async function admitAll(eng, ws, ledger, { refuseDomains = [], shardRouti
             deadLetters.push({ intentId, oid: oid.slice(0, 10), session: cid, error, blob, domain: dom, directiveId: dirId });
             continue;
           }
+          // THE RECEIPT FENCE (capability_marketplace.md slice 1.5 — the ratified
+          // authz condition): a capability RECEIPT (complete/fail/block/deadLetter)
+          // is an EXECUTOR/OWNER write — the open session lane never folds one, so
+          // a hostile peer cannot terminally close orders it didn't fulfill, and a
+          // forged "result" never reaches any watcher. PARKED, not dropped: an
+          // honest-but-misconfigured self-hosted executor sees its receipt in the
+          // DLQ, and the OWNER-GATED retry is the owner-sanctioned unjam (the
+          // lawful lane for a credential-holding self-hoster is /author).
+          if (receiptFence && dirId && Array.isArray(receiptFence[dom]) && receiptFence[dom].includes(dirId)) {
+            const error = `'${dom}/${dirId}' is a capability RECEIPT — receipts are executor/owner writes, never open-session writes. Author it via POST /v1/workspaces/${ws}/author (owner Bearer), or — if this parked receipt is sanctioned — the owner unjams it: POST /v1/workspaces/${ws}/dead-letters/retry`;
+            rejected.push({ oid: oid.slice(0, 10), error, deadLettered: true });
+            deadLetters.push({ intentId, oid: oid.slice(0, 10), session: cid, error, blob, domain: dom, directiveId: dirId });
+            continue;
+          }
           // THE WRONG-HOME GATE (sharding slice 2): a routed directive's home must be
           // assigned to THIS workspace by the coordinator's law-state shard map.
           // Misrouted → the typed `wrong-home` refusal naming the correct workspace
@@ -1517,8 +1547,12 @@ export async function boot(eng, ws, ledger) {
 }
 
 /** Install a tenant package under the nomos controller (validation is the HOST's job). */
-export async function deploy(eng, ws, ledger, usda, domainHash) {
-  const result = author(eng, ws, "nomos", "installDomain", installPayload(domainHash, usda, eng.installedBy), eng.hashes.nomos);
+export async function deploy(eng, ws, ledger, usda, domainHash, dispositions) {
+  // THE EVOLVE-GATE ANSWER LANE (#58): `dispositions` ({retired, retyped, rebinds,
+  // ackBy}) ride the committed installDomain payload — IN-HISTORY facts the one gate
+  // adjudicates the stable-id diff against. Absent for the common (non-destructive)
+  // upgrade; the gate's typed refusal names the remedy when one is needed.
+  const result = author(eng, ws, "nomos", "installDomain", installPayload(domainHash, usda, eng.installedBy, dispositions), eng.hashes.nomos);
   // THE SHARD-IDENTITY ENSURE (#41 — slice 3a): a taxonomy-bearing law carries the
   // homing invariant, which judges against the workspace's OWN declared identity
   // (`NomosShardIdentity`, law-state in the shard's own chain). The worker is the