@sixb/core 0.1.12 → 0.1.13

package/src/testing/index.ts

@@ -59,6 +59,10 @@ export {
   type ExecutionStorageContractSuiteOptions,
   runExecutionStorageContractSuite,
 } from "./execution-storage-contract"
+export {
+  type FileUploadSessionStorageContractSuiteOptions,
+  runFileUploadSessionStorageContractSuite,
+} from "./file-upload-session-storage-contract"
 export { runLakeChangesContractSuite } from "./lake-changes-contract"
 export {
   type LakeMergeStorageContractSuiteOptions,
@@ -151,3 +155,7 @@ export {
   createTestAutomaticWorkflowExecution,
   createTestWorkflowExecution,
 } from "./workflow-execution"
+export {
+  runWorkflowInterventionStorageContractSuite,
+  type WorkflowInterventionStorageContractSuiteOptions,
+} from "./workflow-intervention-storage-contract"

package/src/testing/materializer-storage-contract.ts

@@ -13,7 +13,11 @@ import {
 import type { TrustedPrimitiveRef } from "../execution"
 import { restoreTrustedPrimitiveExecutionScope } from "../execution/durable"
 import { createTestingScope } from "../execution/scopes"
-import type { OntologyMaterializer } from "../materializer"
+import type {
+  ExpectedLinkRevision,
+  ExpectedObjectRevision,
+  OntologyMaterializer,
+} from "../materializer"
 import {
   createLinkScopeFingerprint,
   createOntologyMaterializer,
@@ -747,6 +751,84 @@ export function runMaterializerStorageContractSuite<TStorage extends Storage>(
     }
   })
 
+  test(`${name} rejects stale object and link expectations as expectation conflicts`, async () => {
+    // Action runs report exactly this conflict kind as `action.read_conflict`. Throw a stale
+    // expectation as another kind from any provider and this fails for that provider.
+    const createdStorage = await provider.createStorage()
+    const storage = requireContractStorage(createdStorage)
+    const runtimeMaterializer = createOntologyMaterializer({
+      projectId: "materializer-storage-contract",
+      ontology,
+      projections,
+      storage,
+      dependencies: { clock: () => new Date("2026-02-01T12:00:00.000Z") },
+    }).withScope(runtimeScope())
+    const device = { objectTypeId: Device.id, primaryId: "device" }
+    const peerLink = {
+      source: device,
+      linkId: "peers",
+      target: { objectTypeId: Device.id, primaryId: "peer" },
+    }
+    const commitExpecting = (
+      requestId: string,
+      expected: {
+        readonly expectedObjects: readonly ExpectedObjectRevision[]
+        readonly expectedLinks: readonly ExpectedLinkRevision[]
+      }
+    ) =>
+      runtimeMaterializer.edits.commit({
+        mode: "atomic",
+        source: { kind: "runtime", requestId },
+        operations: [
+          {
+            id: "rename",
+            kind: "object.patch",
+            ref: device,
+            set: { name: requestId },
+            unset: [],
+            reset: [],
+          },
+        ],
+        ...expected,
+        expectedLinkScopes: [],
+      })
+
+    try {
+      await runtimeMaterializer.edits.commit({
+        mode: "atomic",
+        source: { kind: "runtime", requestId: "expectation-setup" },
+        operations: [
+          { id: "device", kind: "object.create", ref: device, properties: { name: "device" } },
+          {
+            id: "peer",
+            kind: "object.create",
+            ref: peerLink.target,
+            properties: { name: "peer" },
+          },
+          { id: "link", kind: "link.upsert", ref: peerLink },
+        ],
+        expectedObjects: [],
+        expectedLinks: [],
+        expectedLinkScopes: [],
+      })
+
+      await expect(
+        commitExpecting("stale-object", {
+          expectedObjects: [{ ref: device, exists: false }],
+          expectedLinks: [],
+        })
+      ).rejects.toMatchObject({ kind: "expectation" })
+      await expect(
+        commitExpecting("stale-link", {
+          expectedObjects: [],
+          expectedLinks: [{ ref: peerLink, exists: false }],
+        })
+      ).rejects.toMatchObject({ kind: "expectation" })
+    } finally {
+      await provider.cleanup?.(createdStorage)
+    }
+  })
+
   test(`${name} fences projected cardinality-many link scopes by fingerprint`, async () => {
     const createdStorage = await provider.createStorage()
     const storage = requireContractStorage(createdStorage)
@@ -886,9 +968,9 @@ export function runMaterializerStorageContractSuite<TStorage extends Storage>(
         expectedLinkScopes: [],
       })
 
-      await expect(commitObservation("stale-many-scope-action", "must not commit")).rejects.toThrow(
-        "Expected link scope changed"
-      )
+      const stale = commitObservation("stale-many-scope-action", "must not commit")
+      await expect(stale).rejects.toThrow("Expected link scope changed")
+      await expect(stale).rejects.toMatchObject({ kind: "expectation" })
       expect(
         await storage.objects.getByPrimaryId({
           projectId: "materializer-storage-contract",

package/src/testing/object-query-contract.ts

@@ -10,10 +10,11 @@ import {
   normalizeObjectQuery,
   type ObjectQuery,
   ObjectQueryPlanningError,
+  type ObjectQueryPredicate,
   planObjectQuery,
   validateObjectQuery,
 } from "../objects/query"
-import { defineObjectType, link, OntologyRegistry, prop, stringEnum } from "../ontology"
+import { defineObjectType, link, OntologyRegistry, prop, ref, stringEnum } from "../ontology"
 import type { ObjectStorage, QueryObjectsResult } from "../storage/objects"
 import type { Storage } from "../storage/types"
 import {
@@ -133,8 +134,29 @@ const DefaultTextChild = defineObjectType({
   search: { defaultText: ["alias"] },
 })
 
+const Task = defineObjectType({
+  id: "ContractTask",
+  name: "Contract Task",
+  properties: [
+    prop("id", "string", {
+      required: true,
+      primary: true,
+      query: { searchable: true, sortable: true },
+    }),
+    prop("assignee", ref.user(), {
+      nullable: true,
+      query: { searchable: true, filterable: true, facet: true },
+    }),
+    prop(
+      "reviewers",
+      { type: "array", items: ref.user() },
+      { query: { searchable: true, filterable: true } }
+    ),
+  ],
+})
+
 export const objectQueryContractOntology = new OntologyRegistry({
-  sources: [Room, Device, Zone, Asset, LaptopAsset, DefaultTextBase, DefaultTextChild],
+  sources: [Room, Device, Zone, Asset, LaptopAsset, DefaultTextBase, DefaultTextChild, Task],
 })
 
 /**
@@ -151,6 +173,7 @@ export function runObjectQueryProviderContractSuite<TStorage extends Storage>(
 ): void {
   const withStorage = async (
     body: (context: {
+      readonly storage: TStorage
       readonly objects: TStorage["objects"]
       readonly fixture: MaterializerTestFixture
     }) => Promise<void>
@@ -158,6 +181,7 @@ export function runObjectQueryProviderContractSuite<TStorage extends Storage>(
     const storage = await options.createStorage()
     try {
       await body({
+        storage,
         objects: storage.objects,
         fixture: createMaterializerTestFixture({
           projectId,
@@ -835,6 +859,101 @@ export function runObjectQueryProviderContractSuite<TStorage extends Storage>(
       })
     })
 
+    test("matches user references on type and id, and groups facets by user", async () => {
+      await withStorage(async ({ storage: complete, objects: storage, fixture }) => {
+        const auth = complete.auth
+        if (!auth) throw new Error("The object query contract requires auth storage.")
+        for (const id of ["usr_alice", "usr_bob", "usr_carol"]) {
+          await auth.users.create({ projectId, id, email: `${id}@example.com` })
+        }
+        const alice = { type: "user", id: "usr_alice" }
+        const bob = { type: "user", id: "usr_bob" }
+        const carol = { type: "user", id: "usr_carol" }
+        await fixture.seed({
+          objects: [
+            objectSeed(Task.id, "t1", { assignee: alice, reviewers: [bob] }),
+            objectSeed(Task.id, "t2", { assignee: alice, reviewers: [bob, carol] }),
+            objectSeed(Task.id, "t3", { assignee: alice, reviewers: [] }),
+            objectSeed(Task.id, "t4", { assignee: bob, reviewers: [alice] }),
+            objectSeed(Task.id, "t5", { assignee: bob, reviewers: [carol] }),
+            objectSeed(Task.id, "t6", { assignee: null, reviewers: [] }),
+            objectSeed(Task.id, "t7", { reviewers: [] }),
+          ],
+        })
+
+        const ids = async (predicate: ObjectQueryPredicate) => {
+          const result = await executeObjectQuery(
+            {
+              projectId,
+              query: {
+                kind: "sort",
+                fields: [{ kind: "property", propertyId: "id" }],
+                input: {
+                  kind: "filter",
+                  predicate,
+                  input: { kind: "start", objectTypeId: Task.id },
+                },
+              },
+            },
+            { ontology: objectQueryContractOntology, storage }
+          )
+          expect(result.plan.mode).toBe("pushdown")
+          return result.objects.map((object) => object.primaryId)
+        }
+
+        expect(await ids({ op: "eq", propertyId: "assignee", value: alice })).toEqual([
+          "t1",
+          "t2",
+          "t3",
+        ])
+        // Field order is not part of the value.
+        expect(
+          await ids({ op: "eq", propertyId: "assignee", value: { id: "usr_alice", type: "user" } })
+        ).toEqual(["t1", "t2", "t3"])
+        expect(await ids({ op: "neq", propertyId: "assignee", value: alice })).toEqual([
+          "t4",
+          "t5",
+          "t6",
+          "t7",
+        ])
+        expect(await ids({ op: "in", propertyId: "assignee", values: [bob, null] })).toEqual([
+          "t4",
+          "t5",
+          "t6",
+        ])
+        expect(await ids({ op: "exists", propertyId: "assignee", value: false })).toEqual(["t7"])
+        expect(await ids({ op: "contains", propertyId: "reviewers", value: bob })).toEqual([
+          "t1",
+          "t2",
+        ])
+        expect(await ids({ op: "contains", propertyId: "reviewers", value: carol })).toEqual([
+          "t2",
+          "t5",
+        ])
+        expect(await ids({ op: "contains", propertyId: "reviewers", value: alice })).toEqual(["t4"])
+
+        const facets = await facetObjects(
+          {
+            projectId,
+            query: { kind: "start", objectTypeId: Task.id },
+            facets: [{ propertyId: "assignee", limit: 10 }],
+          },
+          { ontology: objectQueryContractOntology, storage }
+        )
+        expect(facets.plan.mode).toBe("pushdown")
+        expect(facets.facets).toEqual([
+          {
+            propertyId: "assignee",
+            buckets: [
+              { value: alice, count: 3 },
+              { value: bob, count: 2 },
+              { value: null, count: 1 },
+            ],
+          },
+        ])
+      })
+    })
+
     test("counts matching objects by facetable properties without returning rows", async () => {
       await withStorage(async ({ objects: storage, fixture }) => {
         await seedObjectQueryContractData(fixture)

package/src/testing/ontology-contract-fixture.ts

@@ -1,3 +1,4 @@
+import type { AuthorizablePrincipal } from "../execution/types"
 import { createEventId } from "../materialization/identity"
 import type {
   MaterializationPlanHeader,
@@ -29,6 +30,11 @@ const emptyChunk = {
   outbox: [],
 } as const
 
+/** The request executor `ensureContractExecution` records for a contract commit. */
+export function contractExecutor(id: string) {
+  return { type: "request" as const, requestId: `contract-request:${id}` }
+}
+
 export function contractEditHeader(id: string): MaterializationPlanHeader {
   return {
     commit: {
@@ -38,6 +44,7 @@ export function contractEditHeader(id: string): MaterializationPlanHeader {
       requestHash: `hash:${id}`,
       executionId: `contract-execution:${id}`,
       origin: { kind: "runtime", requestId: id },
+      executor: contractExecutor(id),
       ontologyRevision: "ontology-contract-revision",
       intent: { kind: "edit", mode: "atomic", operationCount: 0 },
       committedAt: CONTRACT_COMMITTED_AT,
@@ -90,9 +97,15 @@ export async function commitExactObject(
     readonly primaryId?: string
     readonly omitFinalize?: boolean
     readonly throwAfterFinalize?: boolean
+    /** Must name an existing auth principal: SQL providers reference it from the execution. */
+    readonly requestedBy?: AuthorizablePrincipal
   } = {}
 ): Promise<{ readonly eventId: string }> {
-  const header = contractEditHeader(id)
+  const defaultHeader = contractEditHeader(id)
+  const header: MaterializationPlanHeader =
+    options.requestedBy === undefined
+      ? defaultHeader
+      : { ...defaultHeader, commit: { ...defaultHeader.commit, requestedBy: options.requestedBy } }
   const ref = { objectTypeId: "ContractDevice", primaryId: options.primaryId ?? id }
   const row = {
     ref,
@@ -109,6 +122,8 @@ export async function commitExactObject(
     occurredAt: header.commit.committedAt,
     correlationId: `contract-correlation:${id}`,
     origin: header.commit.origin,
+    ...(header.commit.requestedBy === undefined ? {} : { requestedBy: header.commit.requestedBy }),
+    executor: header.commit.executor,
     commitId: id,
     type: "object.created" as const,
     topic: "objects" as const,
@@ -214,12 +229,17 @@ export async function ensureContractExecution(
   ) {
     return
   }
+  const { requestedBy } = header.commit
   await storage.executions.create({
     id: header.commit.executionId,
     projectId: header.commit.projectId,
-    executor: { type: "request", requestId: `contract-request:${header.commit.id}` },
+    ...(requestedBy === undefined ? {} : { requestedBy }),
+    executor: contractExecutor(header.commit.id),
     source: { type: "http", requestId: `contract-request:${header.commit.id}` },
     correlationId: `contract-correlation:${header.commit.id}`,
-    authorizationRef: { type: "disabled" },
+    authorizationRef:
+      requestedBy === undefined
+        ? { type: "disabled" }
+        : { type: "principal", principal: requestedBy },
   })
 }

package/src/testing/ontology-storage-contract.ts

@@ -16,6 +16,7 @@ import {
   commitExactObject,
   contractEditHeader,
   contractEditResult,
+  contractExecutor,
   ensureContractExecution,
   type OntologyContractStorage,
 } from "./ontology-contract-fixture"
@@ -148,6 +149,51 @@ export function runOntologyStorageContractSuite<TStorage extends OntologyStorage
       })
     })
 
+    test("round-trips commit and event attribution exactly", async () => {
+      await withStorage(async (storage) => {
+        // The requester is a real principal: SQL executions reference it by foreign key.
+        if (!storage.auth) throw new Error("The attribution contract requires auth storage.")
+        await storage.auth.users.create({
+          projectId: "contract-project",
+          id: "contract-requester",
+          email: "requester@example.com",
+        })
+        const requestedBy = { type: "user", id: "contract-requester" } as const
+        await commitExactObject(storage, "attributed", { requestedBy })
+        await commitExactObject(storage, "unattributed", { primaryId: "unattributed-device" })
+
+        const attributed = await storage.ontology.commits.getById({
+          projectId: "contract-project",
+          id: "attributed",
+        })
+        expect(attributed?.requestedBy).toEqual(requestedBy)
+        expect(attributed?.executor).toEqual(contractExecutor("attributed"))
+        expect(attributed).not.toHaveProperty("actor")
+        const unattributed = await storage.ontology.commits.getById({
+          projectId: "contract-project",
+          id: "unattributed",
+        })
+        expect(unattributed).not.toHaveProperty("requestedBy")
+        expect(unattributed?.executor).toEqual(contractExecutor("unattributed"))
+
+        const claimed = await storage.ontology.outbox.claim({
+          projectId: "contract-project",
+          now: "2027-01-01T00:00:00.000Z",
+          limit: 10,
+          leaseId: "attribution-check",
+          leaseExpiresAt: "2027-01-01T01:00:00.000Z",
+        })
+        const envelopes = new Map(claimed.map((record) => [record.envelope.commitId, record]))
+        expect(envelopes.get("attributed")?.envelope).toMatchObject({
+          requestedBy,
+          executor: contractExecutor("attributed"),
+        })
+        const unattributedEnvelope = envelopes.get("unattributed")?.envelope
+        expect(unattributedEnvelope?.executor).toEqual(contractExecutor("unattributed"))
+        expect(unattributedEnvelope).not.toHaveProperty("requestedBy")
+      })
+    })
+
     test("rejects an ontology commit whose execution does not exist", async () => {
       await withStorage(async (storage) => {
         const header = contractEditHeader("missing-execution")
@@ -883,6 +929,12 @@ async function activateEmptyCandidate(
         datasetId: candidate.identity.datasetVersion.datasetId,
         datasetVersionId: candidate.identity.datasetVersion.versionId,
       },
+      executor: {
+        type: "primitive",
+        kind: "projection",
+        id: candidate.source.projectionId,
+        runId: candidate.execution.projectionRunId,
+      },
       ontologyRevision: candidate.identity.ontologyRevision,
       projectionRevision: candidate.identity.projectionRevision,
       ownershipHash: candidate.identity.ownershipHash,
@@ -971,6 +1023,12 @@ function telemetryHeader(
           batchOrdinal: 0,
         },
       },
+      executor: {
+        type: "primitive",
+        kind: "projection",
+        id: identity.projectionId,
+        runId: projectionRunId,
+      },
       ontologyRevision: identity.ontologyRevision,
       projectionRevision: identity.projectionRevision,
       ownershipHash: identity.ownershipHash,

package/src/testing/sandboxes-contract.ts

@@ -129,6 +129,33 @@ export function runSandboxesContractSuite(
     })
 
     describe("working directory", () => {
+      // Regression check: remove the provider's cwd resolution, leaving only
+      // `options.cwd ?? this.workingDirectory`; these relative file reads must fail.
+      test.each([
+        [".", "root"],
+        ["nested", "child"],
+        ["./nested/..", "root"],
+      ])("resolves relative cwd %s against the workspace", async (cwd, expected) => {
+        const sandbox = await factory.create()
+        try {
+          await sandbox.writeFiles([
+            { path: "cwd-probe.txt", contents: "root" },
+            { path: "nested/cwd-probe.txt", contents: "child" },
+          ])
+
+          const result = await sandbox.runCommand("cat", ["cwd-probe.txt"], { cwd })
+          expect(result.exitCode).toBe(0)
+          expect(result.stdout).toBe(expected)
+
+          // A per-call override must not change the next command's default directory.
+          const next = await sandbox.runCommand("cat", ["cwd-probe.txt"])
+          expect(next.exitCode).toBe(0)
+          expect(next.stdout).toBe("root")
+        } finally {
+          await sandbox.destroy()
+        }
+      })
+
       test("pwd reflects the configured workingDirectory", async () => {
         const sandbox = await factory.create()
         try {

package/src/testing/workflow-intervention-storage-contract.ts

@@ -0,0 +1,203 @@
+import { describe, expect, test } from "bun:test"
+import type { Principal } from "../auth"
+import {
+  type CreateWorkflowInterventionInput,
+  WorkflowInterventionError,
+  type WorkflowInterventionStorage,
+} from "../storage/workflow-interventions"
+
+export interface WorkflowInterventionStorageContractSuiteOptions<
+  TStorage extends WorkflowInterventionStorage = WorkflowInterventionStorage,
+> {
+  readonly createStorage: () => TStorage | Promise<TStorage>
+  readonly cleanup?: (storage: TStorage) => void | Promise<void>
+}
+
+const projectId = "workflow-intervention-contract"
+
+/** Provider-neutral lifecycle, paging, and principal-attribution contract for interventions. */
+export function runWorkflowInterventionStorageContractSuite<
+  TStorage extends WorkflowInterventionStorage,
+>(label: string, options: WorkflowInterventionStorageContractSuiteOptions<TStorage>): void {
+  const withStorage = async (run: (storage: TStorage) => Promise<void>): Promise<void> => {
+    const storage = await options.createStorage()
+    try {
+      await run(storage)
+    } finally {
+      await options.cleanup?.(storage)
+    }
+  }
+
+  describe(label, () => {
+    test("creates pending interventions and supports filtered paging", async () => {
+      await withStorage(async (storage) => {
+        await storage.create(interventionInput({ id: "intervention-1", requestedAt: at("10:00") }))
+        await storage.create(
+          interventionInput({
+            id: "intervention-2",
+            workflowRunId: "run-2",
+            requestedAt: at("11:00"),
+          })
+        )
+        await storage.submit({ projectId, id: "intervention-2", response: { decision: "approve" } })
+        await storage.create(
+          interventionInput({
+            projectId: "other-project",
+            id: "other-project",
+            requestedAt: at("12:00"),
+          })
+        )
+
+        const stored = await storage.getById({ projectId, id: "intervention-1" })
+        const page = await storage.list({
+          projectId,
+          statuses: ["pending"],
+          workflowId: "review-workflow",
+          interventionId: "review-draft-document",
+          requestedAfter: at("09:00"),
+          order: "asc",
+          limit: 1,
+        })
+
+        expect(stored).toMatchObject({
+          id: "intervention-1",
+          status: "pending",
+          input: { draftId: "draft-1" },
+          defaultResponse: { decision: "approve" },
+        })
+        expect(stored?.requestedAt.toISOString()).toBe(at("10:00").toISOString())
+        expect(page.total).toBe(1)
+        expect(page.hasMore).toBe(false)
+        expect(page.interventions.map((intervention) => intervention.id)).toEqual([
+          "intervention-1",
+        ])
+        await expect(storage.list({ projectId, statuses: [] })).resolves.toEqual({
+          interventions: [],
+          hasMore: false,
+          total: 0,
+        })
+      })
+    })
+
+    test("submits, cancels, expires, and rejects invalid transitions", async () => {
+      await withStorage(async (storage) => {
+        await storage.create(interventionInput({ id: "submit-me" }))
+        const submitted = await storage.submit({
+          projectId,
+          id: "submit-me",
+          submittedAt: at("12:00"),
+          submittedBy: { type: "user", id: "usr_1" },
+          response: { decision: "approve", reviewerNote: "Looks good." },
+        })
+
+        await storage.create(interventionInput({ id: "cancel-me" }))
+        const cancelled = await storage.cancel({
+          projectId,
+          id: "cancel-me",
+          cancelledAt: at("12:30"),
+          cancelledBy: { type: "system", id: "workflow-timeout" },
+        })
+
+        await storage.create(interventionInput({ id: "expire-me" }))
+        const expired = await storage.expire({ projectId, id: "expire-me", expiredAt: at("13:00") })
+
+        expect(submitted).toMatchObject({
+          status: "submitted",
+          response: { decision: "approve", reviewerNote: "Looks good." },
+          submittedBy: { type: "user", id: "usr_1" },
+        })
+        expect(submitted.submittedAt?.toISOString()).toBe(at("12:00").toISOString())
+        expect(cancelled).toMatchObject({
+          status: "cancelled",
+          cancelledBy: { type: "system", id: "workflow-timeout" },
+        })
+        expect(cancelled.cancelledAt?.toISOString()).toBe(at("12:30").toISOString())
+        expect(expired.status).toBe("expired")
+        expect(expired.expiredAt?.toISOString()).toBe(at("13:00").toISOString())
+
+        await expect(storage.cancel({ projectId, id: "submit-me" })).rejects.toBeInstanceOf(
+          WorkflowInterventionError
+        )
+        await expect(
+          storage.submit({ projectId, id: "missing", response: {} })
+        ).rejects.toBeInstanceOf(WorkflowInterventionError)
+        await expect(storage.create(interventionInput({ id: "submit-me" }))).rejects.toBeInstanceOf(
+          WorkflowInterventionError
+        )
+        await expect(
+          storage.create(interventionInput({ id: "bad-index", nodeIndex: -1 }))
+        ).rejects.toBeInstanceOf(WorkflowInterventionError)
+      })
+    })
+
+    test("persists submitting and cancelling principals as { type, id }", async () => {
+      await withStorage(async (storage) => {
+        const principals: readonly Principal[] = [
+          { type: "user", id: "usr_1" },
+          { type: "serviceAccount", id: "sa_1" },
+          { type: "system", id: "system" },
+        ]
+        for (const [index, principal] of principals.entries()) {
+          await storage.create(
+            interventionInput({ id: `submit-${principal.type}`, requestedAt: at(`10:0${index}`) })
+          )
+          await storage.submit({
+            projectId,
+            id: `submit-${principal.type}`,
+            response: {},
+            submittedBy: principal,
+          })
+          await storage.create(interventionInput({ id: `cancel-${principal.type}` }))
+          await storage.cancel({
+            projectId,
+            id: `cancel-${principal.type}`,
+            cancelledBy: principal,
+          })
+        }
+        await storage.create(interventionInput({ id: "anonymous" }))
+        await storage.submit({ projectId, id: "anonymous", response: {} })
+
+        for (const principal of principals) {
+          const submitted = await storage.getById({ projectId, id: `submit-${principal.type}` })
+          const cancelled = await storage.getById({ projectId, id: `cancel-${principal.type}` })
+          expect(submitted?.submittedBy).toStrictEqual(principal)
+          expect(cancelled?.cancelledBy).toStrictEqual(principal)
+        }
+        const anonymous = await storage.getById({ projectId, id: "anonymous" })
+        expect(anonymous?.submittedBy).toBeUndefined()
+        expect(anonymous?.cancelledBy).toBeUndefined()
+
+        const listed = await storage.list({ projectId, statuses: ["submitted"], order: "asc" })
+        expect(
+          listed.interventions.flatMap((intervention) =>
+            intervention.submittedBy ? [intervention.submittedBy] : []
+          )
+        ).toStrictEqual([...principals])
+      })
+    })
+  })
+}
+
+function interventionInput(
+  overrides: Partial<CreateWorkflowInterventionInput> = {}
+): CreateWorkflowInterventionInput {
+  return {
+    id: "intervention-1",
+    projectId,
+    workflowId: "review-workflow",
+    workflowRunId: "run-1",
+    nodeRunId: "node-1",
+    nodeIndex: 0,
+    nodeId: "review-draft-document",
+    nodeKey: "reviewDraftDocument",
+    interventionId: "review-draft-document",
+    input: { draftId: "draft-1" },
+    defaultResponse: { decision: "approve" },
+    requestedAt: at("10:00"),
+    ...overrides,
+  }
+}
+
+function at(time: string): Date {
+  return new Date(`2026-05-08T${time}:00.000Z`)
+}