@mycadet/gateway 0.12.10 → 0.13.0

package/src/__tests__/contact-store-mirror-op-missing.test.ts

@@ -17,7 +17,6 @@ import {
   beforeAll,
   beforeEach,
   afterAll,
-  afterEach,
   mock,
 } from "bun:test";
 
@@ -48,25 +47,33 @@ mock.module("../ipc/assistant-client.js", () => ({
 
 // ── Imports ──────────────────────────────────────────────────────────────────
 
-import { ContactStore } from "../db/contact-store.js";
 import {
   initGatewayDb,
   getGatewayDb,
   resetGatewayDb,
 } from "../db/connection.js";
 import { contacts, contactChannels } from "../db/schema.js";
-import {
-  MIRROR_OP_MISSING_CHECK_NAME,
-  flushMirrorOpReporterForTesting,
-  resetMirrorOpReporterForTesting,
-  setMirrorOpReporterOverridesForTesting,
-} from "../contacts-mirror-op-reporter.js";
+import * as mirrorOpReporter from "../contacts-mirror-op-reporter.js";
 
 // ── Setup ────────────────────────────────────────────────────────────────────
 
-const errorLogs: [Record<string, unknown>, string][] = [];
-const warnLogs: unknown[] = [];
-let telemetryBodies: unknown[] = [];
+// The reporter's report fns carry the detail payload; capture them by
+// re-registering the reporter module with a recorder (its real sibling
+// exports — the unknown-method classifier — stay live for the store).
+const reportCalls: { op: string; detail: Record<string, unknown> }[] = [];
+
+mock.module("../contacts-mirror-op-reporter.js", () => ({
+  ...mirrorOpReporter,
+  reportMirrorOpMissing: (op: string, detail: Record<string, unknown>) => {
+    reportCalls.push({ op, detail });
+  },
+}));
+
+// The SUT must load AFTER the mock registrations above — a static import
+// would bind contact-store to the REAL ipc client + reporter before either
+// mock.module runs (bun mock.module is not retroactive for modules already
+// imported), and the escalations would never reach the recorder.
+const { ContactStore } = await import("../db/contact-store.js");
 
 beforeAll(async () => {
   await initGatewayDb();
@@ -88,30 +95,7 @@ beforeEach(() => {
     return {};
   });
 
-  errorLogs.length = 0;
-  warnLogs.length = 0;
-  telemetryBodies = [];
-  resetMirrorOpReporterForTesting();
-  setMirrorOpReporterOverridesForTesting({
-    fetchImpl: async (_url, init) => {
-      telemetryBodies.push(JSON.parse(String(init?.body)));
-      return new Response("{}");
-    },
-    mintToken: () => "svc-token",
-    baseUrl: "http://127.0.0.1:7821",
-    log: {
-      error: (detail, msg) => {
-        errorLogs.push([detail, msg]);
-      },
-      warn: (detail, msg) => {
-        warnLogs.push([detail, msg]);
-      },
-    },
-  });
-});
-
-afterEach(() => {
-  resetMirrorOpReporterForTesting();
+  reportCalls.length = 0;
 });
 
 afterAll(() => {
@@ -161,7 +145,7 @@ function unknownMethodError(method: string): Error {
 // ── Tests ────────────────────────────────────────────────────────────────────
 
 describe("mergeContacts — unknown mirror op escalation", () => {
-  test("unknown method → error log + telemetry; gateway merge still applied", async () => {
+  test("unknown method → fail-loud report; gateway merge still applied", async () => {
     seedContact("ct_keep");
     seedContact("ct_merge");
     seedChannel("ch_1", "ct_merge");
@@ -175,7 +159,6 @@ describe("mergeContacts — unknown mirror op escalation", () => {
       "ct_keep",
       "ct_merge",
     );
-    await flushMirrorOpReporterForTesting();
 
     // Gateway (source of truth) merge stands: donor gone, channel moved.
     expect(contact!.id).toBe("ct_keep");
@@ -196,26 +179,16 @@ describe("mergeContacts — unknown mirror op escalation", () => {
         .find((c) => c.id === "ch_1")?.contactId,
     ).toBe("ct_keep");
 
-    // Escalated: one error log + one watchdog telemetry event.
-    expect(errorLogs.length).toBe(1);
-    expect(errorLogs[0][0]).toMatchObject({
-      op: "contacts_mirror_merge_contact",
-      keepId: "ct_keep",
-      mergeId: "ct_merge",
-    });
-    expect(telemetryBodies).toEqual([
+    // Escalated: exactly one fail-loud report with the op + detail.
+    expect(reportCalls).toEqual([
       {
-        check_name: MIRROR_OP_MISSING_CHECK_NAME,
-        detail: {
-          op: "contacts_mirror_merge_contact",
-          keepId: "ct_keep",
-          mergeId: "ct_merge",
-        },
+        op: "contacts_mirror_merge_contact",
+        detail: { keepId: "ct_keep", mergeId: "ct_merge" },
       },
     ]);
   });
 
-  test("other IPC failure → best-effort warn only, same gateway state", async () => {
+  test("other IPC failure → no report, same gateway state", async () => {
     seedContact("ct_keep");
     seedContact("ct_merge");
     seedChannel("ch_1", "ct_merge");
@@ -229,7 +202,6 @@ describe("mergeContacts — unknown mirror op escalation", () => {
       "ct_keep",
       "ct_merge",
     );
-    await flushMirrorOpReporterForTesting();
 
     expect(contact!.id).toBe("ct_keep");
     expect(mirrored).toBe(false);
@@ -241,14 +213,13 @@ describe("mergeContacts — unknown mirror op escalation", () => {
         .find((c) => c.id === "ct_merge"),
     ).toBeUndefined();
 
-    // No escalation: no reporter error log, no telemetry.
-    expect(errorLogs.length).toBe(0);
-    expect(telemetryBodies).toEqual([]);
+    // No escalation: the report never fires.
+    expect(reportCalls).toEqual([]);
   });
 });
 
 describe("upsertContact — unknown mirror op escalation", () => {
-  test("unknown method → error log + telemetry; gateway upsert still applied", async () => {
+  test("unknown method → fail-loud report; gateway upsert still applied", async () => {
     ipcThrowOn.set(
       "contacts_mirror_upsert_full",
       unknownMethodError("contacts_mirror_upsert_full"),
@@ -259,7 +230,6 @@ describe("upsertContact — unknown mirror op escalation", () => {
       displayName: "Alice",
       channels: [{ type: "slack", address: "U12345" }],
     });
-    await flushMirrorOpReporterForTesting();
 
     // Gateway write stands.
     expect(created).toBe(true);
@@ -272,20 +242,15 @@ describe("upsertContact — unknown mirror op escalation", () => {
     ).toBeDefined();
     expect(store.getChannelsForContact(contact.id)).toHaveLength(1);
 
-    expect(errorLogs.length).toBe(1);
-    expect(errorLogs[0][0]).toMatchObject({
-      op: "contacts_mirror_upsert_full",
-      contactId: contact.id,
-    });
-    expect(telemetryBodies).toEqual([
+    expect(reportCalls).toEqual([
       {
-        check_name: MIRROR_OP_MISSING_CHECK_NAME,
-        detail: { op: "contacts_mirror_upsert_full", contactId: contact.id },
+        op: "contacts_mirror_upsert_full",
+        detail: { contactId: contact.id },
       },
     ]);
   });
 
-  test("other IPC failure → best-effort warn only, same gateway state", async () => {
+  test("other IPC failure → no report, same gateway state", async () => {
     ipcThrowOn.set("contacts_mirror_upsert_full", new Error("socket closed"));
 
     const store = new ContactStore();
@@ -293,11 +258,9 @@ describe("upsertContact — unknown mirror op escalation", () => {
       displayName: "Bob",
       channels: [{ type: "slack", address: "U67890" }],
     });
-    await flushMirrorOpReporterForTesting();
 
     expect(created).toBe(true);
     expect(store.getChannelsForContact(contact.id)).toHaveLength(1);
-    expect(errorLogs.length).toBe(0);
-    expect(telemetryBodies).toEqual([]);
+    expect(reportCalls).toEqual([]);
   });
 });

package/src/__tests__/contacts-mirror-op-reporter.test.ts

@@ -1,121 +1,65 @@
 /**
  * Fail-loud mirror-op-missing reporter (contacts-mirror-op-reporter.ts):
  *
- *  - First report per op emits one error log and one telemetry relay POST with
- *    the `contacts_mirror_op_missing` check name and `{ op, ...detail }`.
+ *  - First report per op emits one error log carrying `{ op, ...detail }`.
  *  - Repeat reports for the same op inside the hourly window are dropped; a
  *    DIFFERENT op still reports (per-op rate limit).
- *  - Relay failures never throw out of the caller.
  *  - `isUnknownIpcMethodError` matches only the IPC server's unknown-method
  *    rejection shape.
  *
- * Logging is observed through the reporter's test-only `log` override —
- * bun's mock.module is process-global and would leak into other test files.
+ * Logs are observed by mocking the logger module (a side-effect boundary —
+ * the same convention as sleep-wake-detector.test.ts). Per-file CI truth:
+ * the mock is process-global, so this file pins nothing else.
  */
-import { beforeEach, afterEach, describe, expect, test } from "bun:test";
+import { beforeEach, describe, expect, mock, spyOn, test } from "bun:test";
 
-const errorLogs: unknown[] = [];
-const warnLogs: unknown[] = [];
+const errorLogs: [Record<string, unknown>, string][] = [];
+
+mock.module("../logger.js", () => ({
+  getLogger: () => ({
+    error: (detail: Record<string, unknown>, msg: string) => {
+      errorLogs.push([detail, msg]);
+    },
+    warn: () => {},
+  }),
+}));
 
 await import("./test-preload.js");
-const {
-  MIRROR_OP_MISSING_CHECK_NAME,
-  flushMirrorOpReporterForTesting,
-  isUnknownIpcMethodError,
-  reportMirrorOpMissing,
-  resetMirrorOpReporterForTesting,
-  setMirrorOpReporterOverridesForTesting,
-} = await import("../contacts-mirror-op-reporter.js");
+const { isUnknownIpcMethodError, reportMirrorOpMissing } =
+  await import("../contacts-mirror-op-reporter.js");
 
-type FetchCall = { url: string; init: RequestInit };
-let fetchCalls: FetchCall[] = [];
-let fetchResult: () => Promise<Response> = async () => new Response("{}");
+let fakeNow = 1_000_000_000_000;
 
 beforeEach(() => {
-  fetchCalls = [];
-  fetchResult = async () => new Response("{}");
   errorLogs.length = 0;
-  warnLogs.length = 0;
-  resetMirrorOpReporterForTesting();
-  setMirrorOpReporterOverridesForTesting({
-    fetchImpl: async (url, init) => {
-      fetchCalls.push({ url: String(url), init: init ?? {} });
-      return fetchResult();
-    },
-    mintToken: () => "svc-token",
-    baseUrl: "http://127.0.0.1:7821",
-    log: {
-      error: (detail, msg) => {
-        errorLogs.push([detail, msg]);
-      },
-      warn: (detail, msg) => {
-        warnLogs.push([detail, msg]);
-      },
-    },
-  });
-});
-
-afterEach(() => {
-  resetMirrorOpReporterForTesting();
+  fakeNow += 24 * 60 * 60 * 1000; // start each test outside prior windows
+  spyOn(Date, "now").mockImplementation(() => fakeNow);
 });
 
 describe("reportMirrorOpMissing", () => {
-  test("first report logs an error and relays one watchdog event", async () => {
-    reportMirrorOpMissing("contacts_mirror_merge_contact", {
-      keepId: "ct_keep",
-      mergeId: "ct_merge",
-    });
-    await flushMirrorOpReporterForTesting();
-
-    expect(errorLogs.length).toBe(1);
-    expect(fetchCalls.length).toBe(1);
-    expect(fetchCalls[0].url).toBe(
-      "http://127.0.0.1:7821/v1/internal/telemetry/watchdog",
-    );
-    const headers = fetchCalls[0].init.headers as Record<string, string>;
-    expect(headers.Authorization).toBe("Bearer svc-token");
-    expect(JSON.parse(String(fetchCalls[0].init.body))).toEqual({
-      check_name: MIRROR_OP_MISSING_CHECK_NAME,
-      detail: {
-        op: "contacts_mirror_merge_contact",
+  test("first report logs one error with the op + detail", () => {
+    expect(() =>
+      reportMirrorOpMissing("contacts_mirror_merge_contact", {
         keepId: "ct_keep",
         mergeId: "ct_merge",
-      },
+      }),
+    ).not.toThrow();
+
+    expect(errorLogs.length).toBe(1);
+    expect(errorLogs[0]![0]).toMatchObject({
+      op: "contacts_mirror_merge_contact",
+      keepId: "ct_keep",
+      mergeId: "ct_merge",
     });
+    expect(errorLogs[0]![1]).toContain("divergence until the daemon updates");
   });
 
-  test("repeat reports for the same op are dropped; a different op still fires", async () => {
+  test("repeat reports for the same op are dropped; a different op still fires", () => {
     reportMirrorOpMissing("contacts_mirror_merge_contact", { keepId: "a" });
     reportMirrorOpMissing("contacts_mirror_merge_contact", { keepId: "b" });
     reportMirrorOpMissing("contacts_mirror_upsert_full", { contactId: "c" });
-    await flushMirrorOpReporterForTesting();
 
     expect(errorLogs.length).toBe(2);
-    expect(fetchCalls.length).toBe(2);
-  });
-
-  test("a rejected relay never throws out of the caller", async () => {
-    fetchResult = async () => {
-      throw new Error("daemon unreachable");
-    };
-
-    expect(() =>
-      reportMirrorOpMissing("contacts_mirror_upsert_full", { contactId: "x" }),
-    ).not.toThrow();
-    await flushMirrorOpReporterForTesting();
-
-    expect(errorLogs.length).toBe(1);
-    expect(warnLogs.length).toBe(1);
-  });
-
-  test("a non-ok relay response is swallowed with a warning", async () => {
-    fetchResult = async () => new Response("nope", { status: 500 });
-
-    reportMirrorOpMissing("contacts_mirror_upsert_full", { contactId: "x" });
-    await flushMirrorOpReporterForTesting();
-
-    expect(fetchCalls.length).toBe(1);
-    expect(warnLogs.length).toBe(1);
   });
 });
 

package/src/__tests__/credential-requests.test.ts

@@ -121,7 +121,7 @@ describe("credential-request mint (IPC)", () => {
   test("makes public ingress live on the successful mint path", async () => {
     const ensurePublicIngressLive = mock(async () => {});
     const result = await createCredentialRequest(
-      fakeGatewayConfig("https://tunnel-dev.mycadet.ai"),
+      fakeGatewayConfig("https://dev-tunnel.mycadet.ai"),
       fakeConfigFile(undefined),
       { service: "github", field: "api_token" },
       {
@@ -152,7 +152,7 @@ describe("credential-request mint (IPC)", () => {
   test("does not read the cloud assistant id when the config URL resolves", async () => {
     const getCloudAssistantId = mock(async () => "assistant-123");
     const result = await createCredentialRequest(
-      fakeGatewayConfig("https://tunnel-dev.mycadet.ai"),
+      fakeGatewayConfig("https://dev-tunnel.mycadet.ai"),
       fakeConfigFile("https://assistant.example.com"),
       { service: "github", field: "api_token" },
       { getCloudAssistantId },
@@ -165,7 +165,7 @@ describe("credential-request mint (IPC)", () => {
     // ingress.publicBaseUrl is Tunnel-managed and cleared on tunnel flaps, so
     // the mint must still resolve a URL from tunnelBaseUrl + the assistant id.
     const result = await createCredentialRequest(
-      fakeGatewayConfig("https://tunnel-dev.mycadet.ai"),
+      fakeGatewayConfig("https://dev-tunnel.mycadet.ai"),
       fakeConfigFile(undefined),
       { service: "github", field: "api_token" },
       { getCloudAssistantId: async () => "assistant-123" },
@@ -173,7 +173,7 @@ describe("credential-request mint (IPC)", () => {
 
     if (!result.ok) throw new Error(`mint failed: ${result.error}`);
     expect(result.url).toBe(
-      `https://tunnel-dev.mycadet.ai/assistant-123/assistant/credentials/enter#token=${encodeURIComponent(result.token)}`,
+      `https://dev-tunnel.mycadet.ai/assistant-123/assistant/credentials/enter#token=${encodeURIComponent(result.token)}`,
     );
   });
 

package/src/__tests__/devices-mine.test.ts

@@ -0,0 +1,187 @@
+/**
+ * Tests for GET /v1/devices/mine — the caller's own paired-device row. The
+ * bearer IS the credential (browser-reachable by design), and the response
+ * mirrors the /v1/devices projection for the caller's device so a
+ * `devices/mine` answer matches that device's row in the host-side
+ * `cadet devices` list field for field — including the cross-status
+ * max(lastUsedAt) that keeps activity history across token rotation.
+ */
+import { describe, test, expect, mock, beforeEach, afterEach } from "bun:test";
+import { randomUUID } from "node:crypto";
+import { mkdtempSync, mkdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { eq } from "drizzle-orm";
+
+import { initSigningKey } from "../auth/token-service.js";
+
+initSigningKey(Buffer.from("test-signing-key-at-least-32-bytes-long-xx"));
+
+// The pair guardian-lookup reads the gateway DB; the assistant DB proxy is
+// mocked so any incidental assistant access stays inert in tests.
+mock.module("../db/assistant-db-proxy.js", () => ({
+  assistantDbQuery: mock(),
+  assistantDbRun: mock(),
+  assistantDbExec: mock(),
+}));
+
+const { initGatewayDb, resetGatewayDb, getGatewayDb } = await import(
+  "../db/connection.js"
+);
+const { actorTokenRecords, contacts, contactChannels } = await import(
+  "../db/schema.js"
+);
+const { hashToken, mintAndRecordBrowserTokenPair } = await import(
+  "../auth/guardian-bootstrap.js"
+);
+const { handleGetMyDevice } = await import("../http/routes/devices-mine.js");
+
+const GUARDIAN_ID = "guardian-001";
+
+let testRoot: string;
+
+function mineRequest(bearer: string | null): Request {
+  const headers = new Headers({ host: "localhost:7830" });
+  if (bearer) {
+    headers.set("authorization", `Bearer ${bearer}`);
+  }
+  return new Request("http://localhost:7830/v1/devices/mine", {
+    method: "GET",
+    headers,
+  });
+}
+
+function rowForToken(token: string) {
+  return getGatewayDb()
+    .select()
+    .from(actorTokenRecords)
+    .where(eq(actorTokenRecords.tokenHash, hashToken(token)))
+    .get();
+}
+
+beforeEach(async () => {
+  testRoot = mkdtempSync(join(tmpdir(), "devices-mine-test-"));
+  const securityDir = join(testRoot, "protected");
+  mkdirSync(securityDir, { recursive: true });
+  process.env.GATEWAY_SECURITY_DIR = securityDir;
+  await initGatewayDb();
+
+  // The route answers for any actor-token row; the guardian contact seed
+  // mirrors the devices.test.ts fixture shape.
+  const now = Date.now();
+  getGatewayDb()
+    .insert(contacts)
+    .values({
+      id: GUARDIAN_ID,
+      displayName: "Guardian",
+      role: "guardian",
+      principalId: GUARDIAN_ID,
+      createdAt: now,
+      updatedAt: now,
+    })
+    .run();
+  getGatewayDb()
+    .insert(contactChannels)
+    .values({
+      id: `ch-${GUARDIAN_ID}`,
+      contactId: GUARDIAN_ID,
+      type: "cadet",
+      address: "guardian-cadet",
+      isPrimary: false,
+      createdAt: now,
+      updatedAt: now,
+    })
+    .run();
+});
+
+afterEach(() => {
+  resetGatewayDb();
+  delete process.env.GATEWAY_SECURITY_DIR;
+  rmSync(testRoot, { recursive: true, force: true });
+});
+
+describe("GET /v1/devices/mine", () => {
+  test("returns the caller's own device row", async () => {
+    const pair = mintAndRecordBrowserTokenPair({
+      guardianPrincipalId: GUARDIAN_ID,
+      platform: "web",
+      browserRefreshCookiePath: "/",
+      identity: { pairingUserAgent: "Mozilla/5.0 TestBrowser" },
+    });
+
+    const response = await handleGetMyDevice(mineRequest(pair.accessToken));
+    expect(response.status).toBe(200);
+
+    const body = (await response.json()) as { device: Record<string, unknown> };
+    const stored = rowForToken(pair.accessToken);
+    expect(stored).toBeTruthy();
+    expect(body.device.hashedDeviceId).toBe(stored!.hashedDeviceId);
+    expect(body.device.platform).toBe("web");
+    expect(body.device.pairingUserAgent).toBe("Mozilla/5.0 TestBrowser");
+    expect(body.device.issuedAt).toBe(stored!.issuedAt);
+  });
+
+  test("lastUsedAt is the cross-status max for the device", async () => {
+    const pair = mintAndRecordBrowserTokenPair({
+      guardianPrincipalId: GUARDIAN_ID,
+      platform: "web",
+      browserRefreshCookiePath: "/",
+    });
+    const stored = rowForToken(pair.accessToken);
+    expect(stored).toBeTruthy();
+
+    // A rotation revokes the old row and mints an unstamped replacement,
+    // so the newest activity stamp can live on the revoked row — the same
+    // rule the /v1/devices list applies.
+    const now = Date.now();
+    getGatewayDb()
+      .insert(actorTokenRecords)
+      .values({
+        id: randomUUID(),
+        tokenHash: hashToken(`rotated-${stored!.hashedDeviceId}`),
+        guardianPrincipalId: GUARDIAN_ID,
+        hashedDeviceId: stored!.hashedDeviceId,
+        platform: "web",
+        status: "revoked",
+        issuedAt: now - 86_400_000,
+        expiresAt: now + 86_400_000,
+        lastUsedAt: now - 60_000,
+        createdAt: now,
+        updatedAt: now,
+      })
+      .run();
+
+    const response = await handleGetMyDevice(mineRequest(pair.accessToken));
+    expect(response.status).toBe(200);
+    const body = (await response.json()) as { device: { lastUsedAt: number | null } };
+    expect(body.device.lastUsedAt).toBe(now - 60_000);
+  });
+
+  test("an unknown bearer answers 404, not an error", async () => {
+    const response = await handleGetMyDevice(
+      mineRequest("not-a-token-anyone-minted"),
+    );
+    expect(response.status).toBe(404);
+  });
+
+  test("a cloud-hosted assistant answers 404 before any row lookup", async () => {
+    process.env.DISABLE_HTTP_AUTH = "true";
+    process.env.IS_CLOUD = "true";
+    try {
+      const response = await handleGetMyDevice(mineRequest(null));
+      expect(response.status).toBe(404);
+      const body = (await response.json()) as { error: { code: string } };
+      expect(body.error.code).toBe("NOT_AVAILABLE_ON_CLOUD");
+    } finally {
+      delete process.env.DISABLE_HTTP_AUTH;
+      delete process.env.IS_CLOUD;
+    }
+  });
+
+  test("non-GET answers method not allowed", async () => {
+    const response = await handleGetMyDevice(
+      new Request("http://localhost:7830/v1/devices/mine", { method: "POST" }),
+    );
+    expect(response.status).toBe(405);
+  });
+});

package/src/__tests__/edge-auth.test.ts

@@ -64,8 +64,7 @@ mock.module("../auth/token-exchange.js", () => ({
 }));
 
 const { AuthRateLimiter } = await import("../auth-rate-limiter.js");
-const { createAuthMiddleware, loopbackFallbackCountTracker } =
-  await import("../http/middleware/auth.js");
+const { createAuthMiddleware } = await import("../http/middleware/auth.js");
 const { initGatewayDb, resetGatewayDb, getGatewayDb } =
   await import("../db/connection.js");
 const { actorTokenRecords } = await import("../db/schema.js");
@@ -96,7 +95,6 @@ beforeEach(() => {
   mockReadCredential = mock(async () => undefined);
   mockPlatformUserIdUnreachable = false;
   mockValidateEdgeToken = mock(() => ({ ok: false, reason: "noop" }));
-  loopbackFallbackCountTracker.reset();
 });
 
 afterEach(() => {
@@ -238,21 +236,6 @@ describe("requireEdgeAuth — JWT mode", () => {
     );
     expect(res?.status).toBe(401);
     expect(mockValidateEdgeToken).not.toHaveBeenCalled();
-    expect(loopbackFallbackCountTracker.snapshot()).toEqual([]);
-  });
-
-  test("a loopback fallback is counted by (guard, path, failureKind)", async () => {
-    const { requireEdgeAuth } = makeMiddleware();
-    await requireEdgeAuth(makeReq(), makeLoopbackServer());
-    await requireEdgeAuth(makeReq(), makeLoopbackServer());
-    expect(loopbackFallbackCountTracker.snapshot()).toEqual([
-      {
-        guard: "edge",
-        path: "/v1/something",
-        failureKind: "missing_authorization",
-        count: 2,
-      },
-    ]);
   });
 
   test("null on valid bearer token", async () => {
@@ -389,7 +372,6 @@ describe("requireEdgeAuthWithScope — JWT mode", () => {
     );
     expect(res?.status).toBe(401);
     expect(mockValidateEdgeToken).not.toHaveBeenCalled();
-    expect(loopbackFallbackCountTracker.snapshot()).toEqual([]);
   });
 
   test("403 when token's scope_profile lacks the required scope", async () => {
@@ -512,7 +494,6 @@ describe("edge auth refuses a single-route grant", () => {
       makeLoopbackServer(),
     );
     expect(res?.status).toBe(401);
-    expect(loopbackFallbackCountTracker.snapshot()).toEqual([]);
   });
 
   test("requireEdgeAuthWithScope 401s the grant before the scope check", async () => {

package/src/__tests__/edge-guardian-auth.test.ts

@@ -53,8 +53,7 @@ mock.module("../auth/token-exchange.js", () => ({
 }));
 
 const { AuthRateLimiter } = await import("../auth-rate-limiter.js");
-const { createAuthMiddleware, loopbackFallbackCountTracker } =
-  await import("../http/middleware/auth.js");
+const { createAuthMiddleware } = await import("../http/middleware/auth.js");
 
 const PLATFORM_USER_ID = "user-abc-123";
 const GUARDIAN_PRINCIPAL = "actor-guardian-xyz";
@@ -82,7 +81,6 @@ beforeEach(() => {
   mockPlatformUserIdUnreachable = false;
   mockFindCadetGuardian = mock(async () => null);
   mockValidateEdgeToken = mock(() => ({ ok: false, reason: "noop" }));
-  loopbackFallbackCountTracker.reset();
 });
 
 afterEach(() => {
@@ -210,7 +208,6 @@ describe("requireEdgeGuardianAuth — actor principal mode", () => {
     expect(res?.status).toBe(401);
     expect(mockValidateEdgeToken).not.toHaveBeenCalled();
     expect(mockFindCadetGuardian).not.toHaveBeenCalled();
-    expect(loopbackFallbackCountTracker.snapshot()).toEqual([]);
   });
 
   test("invalid bearer token falls back to loopback", async () => {
@@ -224,19 +221,6 @@ describe("requireEdgeGuardianAuth — actor principal mode", () => {
     expect(mockFindCadetGuardian).not.toHaveBeenCalled();
   });
 
-  test("a guardian loopback fallback is counted under the edge-guardian guard", async () => {
-    const { requireEdgeGuardianAuth } = makeMiddleware();
-    await requireEdgeGuardianAuth(makeReq(), makeLoopbackServer());
-    expect(loopbackFallbackCountTracker.snapshot()).toEqual([
-      {
-        guard: "edge-guardian",
-        path: "/v1/contact-channels/abc/verify",
-        failureKind: "missing_authorization",
-        count: 1,
-      },
-    ]);
-  });
-
   test("returns 503 when findCadetGuardian throws (transient assistant DB outage)", async () => {
     mockValidateEdgeToken = mock(() => ({
       ok: true,