@projectsolo/solo-mission-mcp 0.21.13 → 0.22.0

package/src/solana/verify.test.ts

@@ -1,156 +1,683 @@
 /**
  * The verifier is the one thing standing between an agent and signing bytes it cannot read, so it
- * is tested against a REAL transaction built by the deployed program's own backend rather than a
- * synthetic one. A hand-built fixture would encode my assumptions about the layout twice and agree
- * with itself.
+ * is tested against REAL transactions built by the backend's own v2 builders rather than synthetic
+ * ones. A hand-built fixture would encode my assumptions about the layout twice and agree with
+ * itself.
  *
- * `fixtures/funding-transaction.json` is captured from a devnet funding run.
+ *   fixtures/funding-transaction-v2-lottery.json  — co-signed by the devnet Operator
+ *   fixtures/funding-transaction-v2-plain.json    — no co-signer
+ *   fixtures/config-account.json                  — the devnet Config those were built against
+ *   fixtures/solo_escrow.v2.idl-excerpt.json      — solo-escrow-solana u1.1.0's IDL, trimmed
+ *   fixtures/funding-transaction-v1.json          — a pre-upgrade transaction, which must be refused
+ *
+ * Adversarial variants are derived from the real transactions: same instruction, one thing changed.
  */
-import { describe, it, expect } from 'vitest'
+import { describe, it, expect, vi, afterEach } from 'vitest'
 import { readFileSync } from 'fs'
 import { join } from 'path'
+import { Keypair, PublicKey, SystemProgram, Transaction, TransactionInstruction } from '@solana/web3.js'
 import {
+  CREATE_TASK_V2_ACCOUNTS,
+  CREATE_TASK_V2_DATA_LENGTH,
+  DISCRIMINATORS,
+  decodeCreateTaskV2,
+  decodeEscrowConfig,
+  readEscrowConfig,
+  readMintDecimals,
   verifyFundingTransaction,
   type VerifyInput,
-  type ExpectedFunding,
-  type FundingAccounts,
 } from './verify'
+import { ESCROW_ERRORS, escrowErrorFromMessage } from './escrowErrors'
+import { parseWireTransaction } from './wire'
 import { toRawAmount } from '../tools/solana'
 
-const fx = JSON.parse(
-  readFileSync(join(__dirname, 'fixtures', 'funding-transaction.json'), 'utf8'),
-) as {
-  transaction_base64: string
-  declared: ExpectedFunding
-  accounts: FundingAccounts
-  program_id: string
-  sponsor: string
-  mint: string
-}
+const FIX = join(__dirname, 'fixtures')
+const load = (f: string) => JSON.parse(readFileSync(join(FIX, f), 'utf8'))
+const lottery = load('funding-transaction-v2-lottery.json')
+const plain = load('funding-transaction-v2-plain.json')
+const v1 = load('funding-transaction-v1.json')
+const idl = load('solo_escrow.v2.idl-excerpt.json')
+const configFx = load('config-account.json')
+const onchainConfig = decodeEscrowConfig(Buffer.from(configFx.data_base64, 'base64'), configFx.address)
+const PROGRAM_ID: string = lottery.program_id
+const OPERATOR = onchainConfig.operator
 
-const baseInput = (): VerifyInput => ({
-  transaction_base64: fx.transaction_base64,
-  declared: fx.declared,
-  accounts: fx.accounts,
+const inputFor = (fx: any): VerifyInput => ({
+  transaction_base64: fx.response.transaction_base64,
+  escrow_interface: fx.response.escrow_interface,
+  task_id: fx.response.task_id,
+  declared: structuredClone(fx.response.declared),
+  accounts: { ...fx.response.accounts },
+  message_sha256: fx.response.message_sha256,
   expected: {
-    budget_raw: String(fx.declared.budget),
-    base_pool_raw: String(fx.declared.base_pool),
-    lottery_winner_count: Number(fx.declared.lottery_winner_count),
-    lottery_prize_per_winner_raw: String(fx.declared.lottery_prize_per_winner),
-    qualify_deadline: Number(fx.declared.qualify_deadline),
-    settlement_deadline: Number(fx.declared.settlement_deadline),
+    budget_raw: fx.mission.budget_raw,
+    base_pool_raw: fx.response.declared.base_pool,
+    lottery_winner_count: fx.mission.lottery_winner_count ?? 0,
+    lottery_prize_per_winner_raw: fx.mission.lottery_prize_per_winner_raw ?? '0',
+    qualify_deadline: fx.mission.qualify_deadline,
+    settlement_deadline: fx.mission.settlement_deadline,
+    seed_commit: fx.mission.seed_commit,
+    max_fee_bps: fx.mission.solana_quoted_fee_bps,
     mint: fx.mint,
     sponsor: fx.sponsor,
+    sponsor_token_account: fx.response.accounts.sponsor_token_account,
   },
   expected_program_id: fx.program_id,
+  onchain_config: { ...onchainConfig },
 })
 
-describe('accepts a genuine transaction', () => {
-  it('passes with no problems', async () => {
-    const r = await verifyFundingTransaction(baseInput())
+const raw = (fx: any) => Buffer.from(fx.response.transaction_base64, 'base64')
+
+/**
+ * Rebuilds a fixture's transaction with one thing changed, the way a backend would have to in
+ * order to get it past the verifier: same instruction unless told otherwise.
+ */
+function rebuild(
+  fx: any,
+  o: {
+    operatorSlot?: PublicKey | 'program'
+    coSigner?: Keypair
+    feePayer?: PublicKey
+    data?: Buffer
+    keys?: (keys: TransactionInstruction['keys']) => TransactionInstruction['keys']
+    extra?: TransactionInstruction
+  } = {},
+): string {
+  const t0 = Transaction.from(raw(fx))
+  const ix0 = t0.instructions[0]
+  let keys = ix0.keys.map((k) => ({ ...k }))
+  if (o.operatorSlot === 'program') {
+    keys[9] = { pubkey: new PublicKey(PROGRAM_ID), isSigner: false, isWritable: false }
+  } else if (o.operatorSlot) {
+    keys[9] = { pubkey: o.operatorSlot, isSigner: true, isWritable: false }
+  }
+  if (o.keys) keys = o.keys(keys)
+  const t = new Transaction({
+    feePayer: o.feePayer ?? new PublicKey(fx.sponsor),
+    recentBlockhash: t0.recentBlockhash!,
+  }).add(new TransactionInstruction({ programId: ix0.programId, keys, data: o.data ?? ix0.data }))
+  if (o.extra) t.add(o.extra)
+  if (o.coSigner) t.partialSign(o.coSigner)
+  return t.serialize({ requireAllSignatures: false, verifySignatures: false }).toString('base64')
+}
+
+const problemsOf = async (input: VerifyInput) => {
+  const r = await verifyFundingTransaction(input)
+  return { ...r, text: r.problems.join('\n') }
+}
+
+// A key standing in for the Operator where a test needs a co-signature it controls.
+const testOperator = Keypair.generate()
+const asTestOperator = (input: VerifyInput): VerifyInput => ({
+  ...input,
+  onchain_config: { ...onchainConfig, operator: testOperator.publicKey.toBase58() },
+  message_sha256: undefined,
+})
+
+describe('the v2 interface, byte-checked against the IDL', () => {
+  const ixByName = (n: string) => idl.instructions.find((i: any) => i.name === n)
+
+  it('uses the IDL discriminators', () => {
+    for (const name of ['create_task', 'cancel_task', 'emergency_refund', 'claim_refund'] as const) {
+      expect(DISCRIMINATORS[name]).toEqual(ixByName(name).discriminator)
+    }
+    expect(DISCRIMINATORS.Config).toEqual(idl.accounts.find((a: any) => a.name === 'Config').discriminator)
+  })
+
+  it('lists create_task accounts in IDL order, with the optional operator signer after system_program', () => {
+    const accounts = ixByName('create_task').accounts
+    expect(accounts.map((a: any) => a.name)).toEqual([...CREATE_TASK_V2_ACCOUNTS])
+    const op = accounts[CREATE_TASK_V2_ACCOUNTS.indexOf('operator')]
+    expect(op).toMatchObject({ name: 'operator', signer: true, optional: true })
+    expect(accounts[CREATE_TASK_V2_ACCOUNTS.indexOf('operator') - 1].name).toBe('system_program')
+  })
+
+  // Borsh, driven by the IDL's own argument list — an independent encoder for the byte comparison.
+  const SIZE: Record<string, number> = { u16: 2, u32: 4, u64: 8, i64: 8 }
+  const encodeFromIdl = (values: Record<string, string | number>) => {
+    const parts: Buffer[] = [Buffer.from(ixByName('create_task').discriminator)]
+    for (const arg of ixByName('create_task').args) {
+      const v = values[arg.name]
+      if (typeof arg.type === 'object') {
+        expect(arg.type).toEqual({ array: ['u8', 32] })
+        parts.push(Buffer.from(String(v).replace(/^0x/, ''), 'hex'))
+        continue
+      }
+      const b = Buffer.alloc(SIZE[arg.type])
+      if (arg.type === 'u16') b.writeUInt16LE(Number(v))
+      else if (arg.type === 'u32') b.writeUInt32LE(Number(v))
+      else if (arg.type === 'u64') b.writeBigUInt64LE(BigInt(v))
+      else if (arg.type === 'i64') b.writeBigInt64LE(BigInt(v))
+      else throw new Error(`unhandled IDL type ${arg.type}`)
+      parts.push(b)
+    }
+    return Buffer.concat(parts)
+  }
+
+  it('has max_fee_bps: u16 as the trailing create_task argument, 86 bytes in all', () => {
+    const args = ixByName('create_task').args
+    expect(args[args.length - 1]).toEqual({ name: 'max_fee_bps', type: 'u16' })
+    const len = 8 + args.reduce((n: number, a: any) => n + (typeof a.type === 'object' ? 32 : SIZE[a.type]), 0)
+    expect(len).toBe(CREATE_TASK_V2_DATA_LENGTH)
+    expect(CREATE_TASK_V2_DATA_LENGTH).toBe(86)
+  })
+
+  for (const [label, fx] of [['lottery', lottery], ['non-lottery', plain]] as const) {
+    it(`the backend's ${label} instruction data is exactly the IDL encoding of what it declared`, () => {
+      const data = parseWireTransaction(raw(fx)).instructions[0].data
+      expect(data.equals(encodeFromIdl(fx.response.declared))).toBe(true)
+      const decoded = decodeCreateTaskV2(data)
+      expect(decoded).toEqual({
+        budget: fx.response.declared.budget,
+        base_pool: fx.response.declared.base_pool,
+        lottery_winner_count: fx.response.declared.lottery_winner_count,
+        lottery_prize_per_winner: fx.response.declared.lottery_prize_per_winner,
+        qualify_deadline: fx.response.declared.qualify_deadline,
+        settlement_deadline: fx.response.declared.settlement_deadline,
+        seed_commit: fx.response.declared.seed_commit,
+        max_fee_bps: fx.response.declared.max_fee_bps,
+      })
+    })
+  }
+
+  it('decodes Config at the offsets the IDL field order gives, and the snapshot names the fixture co-signer', () => {
+    const fields = idl.types.find((t: any) => t.name === 'Config').type.fields.map((f: any) => f.name)
+    expect(fields.slice(0, 8)).toEqual([
+      'admin', 'operator', 'guardian', 'treasury', 'fee_bps', 'min_review_window', 'paused', 'task_counter',
+    ])
+    // 8 + 4×32 = 136 (fee_bps), +2 = 138 (min_review_window), +8 = 146 (paused), +1 = 147 (task_counter).
+    const data = Buffer.from(configFx.data_base64, 'base64')
+    expect(onchainConfig.operator).toBe(new PublicKey(data.subarray(40, 72)).toBase58())
+    expect(onchainConfig.fee_bps).toBe(data.readUInt16LE(136))
+    expect(onchainConfig.task_counter).toBe(data.readBigUInt64LE(147).toString())
+    const tx = parseWireTransaction(raw(lottery))
+    expect(tx.accountKeys[tx.instructions[0].accountIndexes[9]]).toBe(OPERATOR)
+  })
+
+  it('refuses to decode a Config without the Config discriminator', () => {
+    const data = Buffer.from(configFx.data_base64, 'base64')
+    data[0] ^= 0xff
+    expect(() => decodeEscrowConfig(data, configFx.address)).toThrow(/discriminator/)
+  })
+
+  it('confirms the refund instructions kept the layout refund_solana_mission verifies', () => {
+    // No arguments (so the data is the bare 8-byte discriminator), the sponsor as the only signer,
+    // and the sponsor token account as the destination — identical to v1.
+    for (const name of ['cancel_task', 'emergency_refund', 'claim_refund']) {
+      const i = ixByName(name)
+      expect(i.args).toEqual([])
+      expect(i.accounts.map((a: any) => a.name)).toEqual([
+        'sponsor', 'config', 'task', 'vault', 'sponsor_token_account', 'token_program', 'event_authority', 'program',
+      ])
+      expect(i.accounts.filter((a: any) => a.signer).map((a: any) => a.name)).toEqual(['sponsor'])
+    }
+  })
+
+  it('names program errors by the IDL codes', () => {
+    for (const [code, info] of Object.entries(ESCROW_ERRORS)) {
+      expect(idl.errors.find((e: any) => e.code === Number(code))?.name).toBe(info.name)
+    }
+    expect(escrowErrorFromMessage('Error processing Instruction 0: custom program error: 0x17ed')?.name).toBe('TooLateToCancel')
+    expect(escrowErrorFromMessage('Program log: AnchorError ... Error Number: 6132.')?.name).toBe('FeeAboveSponsorMax')
+    expect(escrowErrorFromMessage('custom program error: 0x17ec')?.name).toBe('LotteryRequiresOperator')
+    expect(escrowErrorFromMessage('nothing to see')).toBeNull()
+  })
+})
+
+describe('readEscrowConfig', () => {
+  afterEach(() => vi.unstubAllGlobals())
+  const ok = (owner = configFx.owner) => ({
+    status: 200,
+    json: async () => ({ result: { value: { owner, data: [configFx.data_base64, 'base64'] } } }),
+  })
+
+  it('reads Config at the PDA derived from the pinned program id', async () => {
+    const fetchMock = vi.fn(async () => ok())
+    vi.stubGlobal('fetch', fetchMock)
+    const cfg = await readEscrowConfig('https://rpc.example', PROGRAM_ID)
+    expect(cfg.operator).toBe(OPERATOR)
+    expect(cfg.address).toBe(configFx.address)
+    expect(JSON.parse((fetchMock.mock.calls[0] as any)[1].body).params[0]).toBe(configFx.address)
+  })
+
+  it('retries a rate-limited RPC, then succeeds', async () => {
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce({ status: 429, json: async () => ({}) })
+      .mockResolvedValueOnce({ status: 200, json: async () => ({ error: { message: 'Connection rate limits exceeded' } }) })
+      .mockResolvedValueOnce(ok())
+    vi.stubGlobal('fetch', fetchMock)
+    expect((await readEscrowConfig('https://rpc.example', PROGRAM_ID, { backoffMs: 0 })).operator).toBe(OPERATOR)
+    expect(fetchMock).toHaveBeenCalledTimes(3)
+  })
+
+  it('gives up after the last attempt', async () => {
+    vi.stubGlobal('fetch', vi.fn(async () => ({ status: 429, json: async () => ({}) })))
+    await expect(readEscrowConfig('https://rpc.example', PROGRAM_ID, { backoffMs: 0 })).rejects.toThrow(/HTTP 429/)
+  })
+
+  it('refuses a Config account not owned by the program', async () => {
+    vi.stubGlobal('fetch', vi.fn(async () => ok('11111111111111111111111111111111')))
+    await expect(readEscrowConfig('https://rpc.example', PROGRAM_ID)).rejects.toThrow(/not the program/)
+  })
+
+  it('does not retry an RPC error that is not a rate limit', async () => {
+    const fetchMock = vi.fn(async () => ({ status: 200, json: async () => ({ error: { message: 'Invalid param' } }) }))
+    vi.stubGlobal('fetch', fetchMock)
+    await expect(readEscrowConfig('https://rpc.example', PROGRAM_ID, { backoffMs: 0 })).rejects.toThrow(/Invalid param/)
+    expect(fetchMock).toHaveBeenCalledTimes(1)
+  })
+})
+
+describe('readMintDecimals', () => {
+  afterEach(() => vi.unstubAllGlobals())
+  const mint = (owner: string, decimals: number, initialized = 1, len = 82) => {
+    const b = Buffer.alloc(len)
+    b[44] = decimals
+    b[45] = initialized
+    return { status: 200, json: async () => ({ result: { value: { owner, data: [b.toString('base64'), 'base64'] } } }) }
+  }
+  const TOKEN = 'TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA'
+
+  it('reads decimals from an initialized SPL Token mint', async () => {
+    vi.stubGlobal('fetch', vi.fn(async () => mint(TOKEN, 6)))
+    expect(await readMintDecimals('https://rpc.example', lottery.mint)).toBe(6)
+  })
+
+  it('refuses an account that is not an SPL Token mint', async () => {
+    vi.stubGlobal('fetch', vi.fn(async () => mint('11111111111111111111111111111111', 6)))
+    await expect(readMintDecimals('https://rpc.example', lottery.mint)).rejects.toThrow(/not the SPL Token program/)
+    vi.stubGlobal('fetch', vi.fn(async () => mint(TOKEN, 6, 0)))
+    await expect(readMintDecimals('https://rpc.example', lottery.mint)).rejects.toThrow(/not an initialized/)
+    vi.stubGlobal('fetch', vi.fn(async () => mint(TOKEN, 6, 1, 165)))
+    await expect(readMintDecimals('https://rpc.example', lottery.mint)).rejects.toThrow(/not an initialized/)
+  })
+})
+
+describe('accepts genuine v2 transactions', () => {
+  it('accepts the backend-built lottery transaction with a valid Operator co-signature', async () => {
+    const r = await problemsOf(inputFor(lottery))
+    expect(r.problems).toEqual([])
+    expect(r.ok).toBe(true)
+    expect(r.summary).toMatchObject({
+      lottery: true,
+      operator: OPERATOR,
+      operator_signature: 'valid',
+      max_fee_bps: 0,
+      signers: [lottery.sponsor, OPERATOR],
+      fee_payer: lottery.sponsor,
+      message_sha256: lottery.response.message_sha256,
+    })
+  })
+
+  it('accepts the backend-built non-lottery transaction, with the program id in the operator slot', async () => {
+    const r = await problemsOf(inputFor(plain))
+    expect(r.problems).toEqual([])
+    expect(r.summary).toMatchObject({ lottery: false, operator_signature: 'not_required', signers: [plain.sponsor] })
+  })
+
+  it('accepts a non-lottery transaction without reading Config', async () => {
+    const input = inputFor(plain)
+    input.onchain_config = null
+    input.onchain_config_error = 'RPC down'
+    expect((await problemsOf(input)).problems).toEqual([])
+  })
+
+  it('accepts any valid co-signature by the key Config names as Operator', async () => {
+    const input = asTestOperator(inputFor(lottery))
+    input.transaction_base64 = rebuild(lottery, { operatorSlot: testOperator.publicKey, coSigner: testOperator })
+    const r = await problemsOf(input)
     expect(r.problems).toEqual([])
+    expect(r.summary.operator_signature).toBe('valid')
+  })
+
+  it('warns, without refusing, when the live fee is above the ceiling or the program is paused', async () => {
+    const input = inputFor(plain)
+    input.onchain_config = { ...onchainConfig, fee_bps: 50, paused: true }
+    const r = await problemsOf(input)
     expect(r.ok).toBe(true)
+    expect(r.warnings.join(' ')).toMatch(/FeeAboveSponsorMax/)
+    expect(r.warnings.join(' ')).toMatch(/paused/)
+  })
+})
+
+describe('lottery co-signature refusals', () => {
+  it('refuses a lottery transaction whose Operator signature is missing', async () => {
+    const bytes = raw(lottery)
+    const tx = parseWireTransaction(bytes)
+    const opIndex = tx.accountKeys.indexOf(OPERATOR)
+    bytes.fill(0, tx.signatureOffset + 64 * opIndex, tx.signatureOffset + 64 * (opIndex + 1))
+    const input = inputFor(lottery)
+    input.transaction_base64 = bytes.toString('base64')
+    const r = await problemsOf(input)
+    expect(r.ok).toBe(false)
+    expect(r.summary.operator_signature).toBe('missing')
+    expect(r.text).toMatch(/co-signature is missing/)
+  })
+
+  it('refuses a lottery transaction with no co-signer at all (program id in the operator slot)', async () => {
+    const input = inputFor(lottery)
+    input.transaction_base64 = rebuild(lottery, { operatorSlot: 'program' })
+    input.message_sha256 = undefined
+    const r = await problemsOf(input)
+    expect(r.ok).toBe(false)
+    expect(r.text).toMatch(/Config\.operator/)
+    expect(r.text).toMatch(/not a signer/)
   })
 
-  it('reports what it actually saw, for logging even on success', async () => {
-    const r = await verifyFundingTransaction(baseInput())
-    expect(r.summary.program_id).toBe(fx.program_id)
-    expect(r.summary.instruction_count).toBe(1)
-    expect(r.summary.signers).toEqual([fx.sponsor])
+  it('refuses a co-signature by a key that is not the on-chain Config.operator', async () => {
+    const input = inputFor(lottery)
+    input.transaction_base64 = rebuild(lottery, { operatorSlot: testOperator.publicKey, coSigner: testOperator })
+    input.message_sha256 = undefined
+    const r = await problemsOf(input)
+    expect(r.ok).toBe(false)
+    expect(r.text).toMatch(new RegExp(`on-chain Config\\.operator is ${OPERATOR}`))
+  })
+
+  it('refuses the real co-signature when Config names a different Operator', async () => {
+    const input = inputFor(lottery)
+    input.onchain_config = { ...onchainConfig, operator: testOperator.publicKey.toBase58() }
+    const r = await problemsOf(input)
+    expect(r.ok).toBe(false)
+    expect(r.text).toMatch(/Config\.operator/)
+  })
+
+  it('refuses a lottery when Config cannot be read, rather than trusting the co-signer', async () => {
+    const input = inputFor(lottery)
+    input.onchain_config = null
+    input.onchain_config_error = 'fetch failed'
+    const r = await problemsOf(input)
+    expect(r.ok).toBe(false)
+    expect(r.text).toMatch(/could not be read \(fetch failed\)/)
+  })
+
+  it('refuses a message altered after co-signing, even when the description was altered to match', async () => {
+    // A consistent lie: the budget in the bytes, the declared budget and the agent's expectation
+    // all say 20000. Only the Operator's signature over the original bytes catches it.
+    const bytes = raw(lottery)
+    const tx = parseWireTransaction(bytes)
+    const dataAt = bytes.length - tx.instructions[0].data.length
+    bytes.writeBigUInt64LE(20_000n, dataAt + 8)
+    const input = inputFor(lottery)
+    input.transaction_base64 = bytes.toString('base64')
+    input.declared.budget = '20000'
+    input.expected.budget_raw = '20000'
+    input.message_sha256 = undefined
+    const r = await problemsOf(input)
+    expect(r.ok).toBe(false)
+    expect(r.problems).toEqual([expect.stringMatching(/Operator signature does not verify over this message/)])
+    expect(r.summary.operator_signature).toBe('invalid')
+  })
+
+  it('refuses a message whose hash is not the one the backend recorded', async () => {
+    const bytes = raw(lottery)
+    const tx = parseWireTransaction(bytes)
+    // One byte of the recent blockhash: harmless-looking, and it breaks the co-signature too.
+    bytes[tx.signatureOffset + 64 * tx.signatures.length + 3 + 1 + 32 * tx.accountKeys.length] ^= 1
+    const input = inputFor(lottery)
+    input.transaction_base64 = bytes.toString('base64')
+    const r = await problemsOf(input)
+    expect(r.text).toMatch(/message_sha256/)
+    expect(r.text).toMatch(/does not verify/)
+  })
+
+  it('refuses a lottery where the Operator, not the sponsor, pays the fee', async () => {
+    const input = asTestOperator(inputFor(lottery))
+    input.transaction_base64 = rebuild(lottery, {
+      operatorSlot: testOperator.publicKey,
+      coSigner: testOperator,
+      feePayer: testOperator.publicKey,
+    })
+    const r = await problemsOf(input)
+    expect(r.ok).toBe(false)
+    expect(r.text).toMatch(/fee payer is \w+ \(the Operator\), expected the sponsor/)
+    expect(r.summary.operator_signature).toBe('valid') // a valid co-signature does not excuse it
+  })
+
+  it('refuses a lottery the mission never asked for (non-lottery expected)', async () => {
+    const input = inputFor(lottery)
+    input.expected.lottery_winner_count = 0
+    input.expected.lottery_prize_per_winner_raw = '0'
+    const r = await problemsOf(input)
+    expect(r.ok).toBe(false)
+    expect(r.text).toMatch(/lottery_winner_count/)
+    expect(r.text).toMatch(/operator slot holds/)
+  })
+})
+
+describe('non-lottery refusals', () => {
+  it('refuses a stray Operator in a non-lottery transaction, even unsigned', async () => {
+    const input = inputFor(plain)
+    input.transaction_base64 = rebuild(plain, { operatorSlot: new PublicKey(OPERATOR) })
+    const r = await problemsOf(input)
+    expect(r.ok).toBe(false)
+    expect(r.text).toMatch(/must pass the program id/)
+    expect(r.text).toMatch(/only signer/)
+  })
+
+  it('refuses a stray co-signed Operator in a non-lottery transaction', async () => {
+    const input = inputFor(plain)
+    input.transaction_base64 = rebuild(plain, { operatorSlot: testOperator.publicKey, coSigner: testOperator })
+    const r = await problemsOf(input)
+    expect(r.ok).toBe(false)
+    expect(r.text).toMatch(/must pass the program id/)
+  })
+
+  it('refuses a lottery the backend quietly turned into a non-lottery', async () => {
+    const input = inputFor(plain)
+    input.expected.lottery_winner_count = 1
+    const r = await problemsOf(input)
+    expect(r.ok).toBe(false)
+    expect(r.text).toMatch(/lottery_winner_count/)
+  })
+})
+
+describe('max_fee_bps must equal the quote', () => {
+  it('refuses when the quote differs from what is encoded', async () => {
+    const input = inputFor(plain)
+    input.expected.max_fee_bps = 25
+    const r = await problemsOf(input)
+    expect(r.ok).toBe(false)
+    expect(r.text).toMatch(/max_fee_bps is 0, expected the quoted fee rate 25/)
+  })
+
+  it('refuses a raised ceiling even when the response declares it', async () => {
+    const data = Buffer.from(parseWireTransaction(raw(plain)).instructions[0].data)
+    data.writeUInt16LE(1000, 84)
+    const input = inputFor(plain)
+    input.transaction_base64 = rebuild(plain, { data })
+    input.declared.max_fee_bps = 1000
+    const r = await problemsOf(input)
+    expect(r.ok).toBe(false)
+    expect(r.text).toMatch(/encodes max_fee_bps=1000, not the quoted fee rate 0/)
+  })
+
+  it('refuses a raised ceiling on a co-signed lottery — a valid co-signature does not make it acceptable', async () => {
+    const data = Buffer.from(parseWireTransaction(raw(lottery)).instructions[0].data)
+    data.writeUInt16LE(1000, 84)
+    const input = asTestOperator(inputFor(lottery))
+    input.transaction_base64 = rebuild(lottery, { operatorSlot: testOperator.publicKey, coSigner: testOperator, data })
+    input.declared.max_fee_bps = 1000
+    const r = await problemsOf(input)
+    expect(r.ok).toBe(false)
+    expect(r.summary.operator_signature).toBe('valid')
+    expect(r.text).toMatch(/max_fee_bps/)
+  })
+
+  it('refuses a declared ceiling that disagrees with the bytes', async () => {
+    const input = inputFor(plain)
+    input.declared.max_fee_bps = 7
+    input.expected.max_fee_bps = 7
+    const r = await problemsOf(input)
+    expect(r.ok).toBe(false)
+    expect(r.text).toMatch(/described one thing and built another/)
+  })
+
+  it('refuses when there is no quote to compare against', async () => {
+    const input = inputFor(plain)
+    input.expected.max_fee_bps = undefined
+    expect((await problemsOf(input)).text).toMatch(/no quoted fee rate/)
+  })
+
+  it('refuses a response that does not declare max_fee_bps', async () => {
+    const input = inputFor(plain)
+    delete input.declared.max_fee_bps
+    expect((await problemsOf(input)).text).toMatch(/does not declare max_fee_bps/)
   })
 })
 
 describe('refuses when the agent expected something else', () => {
   it('catches an altered budget', async () => {
-    const input = baseInput()
+    const input = inputFor(plain)
     input.expected.budget_raw = '999999999'
-    const r = await verifyFundingTransaction(input)
+    const r = await problemsOf(input)
     expect(r.ok).toBe(false)
-    expect(r.problems.join(' ')).toMatch(/budget/)
+    expect(r.text).toMatch(/budget/)
   })
 
   it('catches a substituted mint', async () => {
-    const input = baseInput()
+    const input = inputFor(plain)
     input.expected.mint = '4zMMC9srt5Ri5X14GAgXhaHii3GnPAEERYPJgZJDncDU'
-    const r = await verifyFundingTransaction(input)
+    const r = await problemsOf(input)
     expect(r.ok).toBe(false)
-    expect(r.problems.join(' ')).toMatch(/mint/)
+    expect(r.text).toMatch(/mint/)
   })
 
   it('catches a different program, even when every parameter matches', async () => {
-    const input = baseInput()
+    const input = inputFor(plain)
     input.expected_program_id = 'TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA'
-    const r = await verifyFundingTransaction(input)
+    const r = await problemsOf(input)
     expect(r.ok).toBe(false)
-    expect(r.problems.join(' ')).toMatch(/program/)
+    expect(r.text).toMatch(/program/)
   })
 
-  it('catches a sponsor who is not the signer', async () => {
-    const input = baseInput()
+  it('catches a sponsor who is not the signer or fee payer', async () => {
+    const input = inputFor(plain)
     input.expected.sponsor = '4vJ9JU1bJJE96FWSJKvHsmmFADCg4gpZQff4P3bkLKi'
-    const r = await verifyFundingTransaction(input)
+    const r = await problemsOf(input)
     expect(r.ok).toBe(false)
-    expect(r.problems.join(' ')).toMatch(/signer|fee payer/i)
+    expect(r.text).toMatch(/fee payer/)
+    expect(r.text).toMatch(/only signer/)
+  })
+
+  it('catches a different seed commitment than the mission recorded', async () => {
+    const input = inputFor(lottery)
+    input.expected.seed_commit = '0x' + 'ab'.repeat(32)
+    expect((await problemsOf(input)).text).toMatch(/seed_commit/)
   })
 
   it('reports every problem, not just the first', async () => {
-    // An agent debugging this wants the whole list, not one at a time.
-    const input = baseInput()
+    const input = inputFor(plain)
     input.expected.budget_raw = '1'
     input.expected.mint = '4zMMC9srt5Ri5X14GAgXhaHii3GnPAEERYPJgZJDncDU'
-    const r = await verifyFundingTransaction(input)
+    const r = await problemsOf(input)
     expect(r.problems.length).toBeGreaterThan(1)
   })
 })
 
 describe('refuses when the backend quoted one thing and built another', () => {
   it('catches a declared budget that disagrees with the encoded bytes', async () => {
-    // The strongest check: everything else compares the backend's JSON against the agent's
-    // expectations, which a lying backend controls both halves of. This compares the JSON against
-    // the instruction data actually being signed.
-    const input = baseInput()
-    input.declared = { ...fx.declared, budget: '1' }
+    const input = inputFor(plain)
+    input.declared.budget = '1'
     input.expected.budget_raw = '1'
-    const r = await verifyFundingTransaction(input)
+    const r = await problemsOf(input)
     expect(r.ok).toBe(false)
-    expect(r.problems.join(' ')).toMatch(/described one thing and built another/)
+    expect(r.text).toMatch(/described one thing and built another/)
   })
 
   it('catches a declared deadline that disagrees with the bytes', async () => {
-    const input = baseInput()
-    input.declared = { ...fx.declared, settlement_deadline: '1' }
+    const input = inputFor(plain)
+    input.declared.settlement_deadline = '1'
     input.expected.settlement_deadline = 1
-    const r = await verifyFundingTransaction(input)
+    const r = await problemsOf(input)
     expect(r.ok).toBe(false)
-    expect(r.problems.join(' ')).toMatch(/described one thing and built another/)
+    expect(r.text).toMatch(/described one thing and built another/)
+  })
+
+  it('catches operator_cosigned disagreeing with the kind of task', async () => {
+    const input = inputFor(plain)
+    input.declared.operator_cosigned = true
+    expect((await problemsOf(input)).text).toMatch(/operator_cosigned=true/)
   })
 })
 
 describe('structural refusals', () => {
-  it('catches a vault equal to the sponsor token account', async () => {
-    // Would mean the budget never leaves the sponsor's control — funded on paper, not escrowed.
-    const input = baseInput()
-    input.accounts = { ...fx.accounts, vault: fx.accounts.sponsor_token_account }
-    const r = await verifyFundingTransaction(input)
+  it('refuses a deployment or response that is not on the v2 interface', async () => {
+    const input = inputFor(plain)
+    input.escrow_interface = 'v1'
+    expect((await problemsOf(input)).text).toMatch(/escrow_interface "v1"/)
+    input.escrow_interface = undefined
+    expect((await problemsOf(input)).text).toMatch(/escrow_interface undefined/)
+  })
+
+  it('refuses a v1 create_task (84 bytes, no max_fee_bps)', async () => {
+    const input = inputFor(plain)
+    input.transaction_base64 = v1.transaction_base64
+    const r = await problemsOf(input)
+    expect(r.ok).toBe(false)
+    expect(r.text).toMatch(/84 bytes is the v1 layout/)
+  })
+
+  it('refuses an extra instruction', async () => {
+    const input = inputFor(plain)
+    input.transaction_base64 = rebuild(plain, {
+      extra: SystemProgram.transfer({
+        fromPubkey: new PublicKey(plain.sponsor),
+        toPubkey: new PublicKey(OPERATOR),
+        lamports: 1,
+      }),
+    })
+    expect((await problemsOf(input)).text).toMatch(/exactly 1 instruction, found 2/)
+  })
+
+  it('refuses a vault in the instruction that is not the task vault PDA', async () => {
+    const input = inputFor(plain)
+    input.transaction_base64 = rebuild(plain, {
+      keys: (keys) => keys.map((k, i) => (i === 5 ? { ...keys[6] } : k)),
+    })
+    expect((await problemsOf(input)).text).toMatch(/account #5 \(vault\)/)
+  })
+
+  it('catches a quoted vault equal to the sponsor token account', async () => {
+    const input = inputFor(plain)
+    input.accounts.vault = input.accounts.sponsor_token_account
+    const r = await problemsOf(input)
     expect(r.ok).toBe(false)
-    expect(r.problems.join(' ')).toMatch(/not be escrowed/)
+    expect(r.text).toMatch(/not be escrowed/)
   })
 
-  it('catches a vault that is not a program-derived address', async () => {
-    // An on-curve "vault" is a wallet somebody holds the key to.
-    const input = baseInput()
-    input.accounts = { ...fx.accounts, vault: fx.sponsor }
-    const r = await verifyFundingTransaction(input)
+  it('catches a quoted vault that is not a program-derived address', async () => {
+    const input = inputFor(plain)
+    input.accounts.vault = plain.sponsor
+    const r = await problemsOf(input)
     expect(r.ok).toBe(false)
-    expect(r.problems.join(' ')).toMatch(/program-derived|holds its key/)
+    expect(r.text).toMatch(/program-derived address/)
+  })
+
+  it('catches a task id that does not match the task account', async () => {
+    const input = inputFor(plain)
+    input.task_id = String(BigInt(input.task_id) + 1n)
+    expect((await problemsOf(input)).text).toMatch(/account #4 \(task\)/)
+  })
+
+  it('catches a sponsor token account other than the one the agent sent', async () => {
+    const input = inputFor(plain)
+    input.expected.sponsor_token_account = plain.sponsor
+    expect((await problemsOf(input)).text).toMatch(/sponsor_token_account/)
   })
 
   it('catches a malformed seed commit', async () => {
-    const input = baseInput()
-    input.declared = { ...fx.declared, seed_commit: 'nope' }
-    const r = await verifyFundingTransaction(input)
+    const input = inputFor(plain)
+    input.declared.seed_commit = 'nope'
+    const r = await problemsOf(input)
     expect(r.ok).toBe(false)
-    expect(r.problems.join(' ')).toMatch(/seed_commit/)
+    expect(r.text).toMatch(/seed_commit/)
+  })
+
+  it('refuses bytes that do not decode', async () => {
+    const input = inputFor(plain)
+    input.transaction_base64 = Buffer.from('not a transaction').toString('base64')
+    expect((await problemsOf(input)).text).toMatch(/does not decode/)
   })
 })