@synopackageland/cli 0.4.0 → 0.4.1

package/dist/templates/native-go/backend/internal/helper/read_transfer_test.go

@@ -0,0 +1,177 @@
+package helper
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"syscall"
+	"testing"
+	"time"
+)
+
+func TestReadStreamControlCeilings(t *testing.T) {
+	s, repo, _, _, g, _ := grantCohortFixture(t)
+	_ = s
+	repo.store.Grants[0].Actions = []Action{ActionReadStream}
+	r := grantControl(t, g, '1', '2', '3', MaxTransferBytes)
+	r.Op = ActionReadStream
+	b, _ := json.Marshal(r)
+	if _, c := DecodeDataRequest(bytes.NewReader(b)); c != "" {
+		t.Fatal(c)
+	}
+	r.Args = []byte(`{"segments":["fixture"],"maxBytes":67108865}`)
+	b, _ = json.Marshal(r)
+	if _, c := DecodeDataRequest(bytes.NewReader(b)); c != ErrLimit {
+		t.Fatal(c)
+	}
+	r.Op = ActionRead
+	b, _ = json.Marshal(r)
+	if _, c := DecodeDataRequest(bytes.NewReader(b)); c == "" {
+		t.Fatal("bounded mode accepted stream ceiling")
+	}
+}
+func TestReadStreamIdleAndTotalDeadline(t *testing.T) {
+	now := time.Now()
+	op := &cohortOperation{work: &readOnlyWork{Action: ActionReadStream}, admittedAt: now, lastActivity: now}
+	if op.expired(now.Add(StreamIdleTimeout - time.Nanosecond)) {
+		t.Fatal("early timeout")
+	}
+	if !op.expired(now.Add(StreamIdleTimeout)) {
+		t.Fatal("idle ignored")
+	}
+	op.lastActivity = now.Add(StreamTotalTimeout - time.Second)
+	if !op.expired(now.Add(StreamTotalTimeout)) {
+		t.Fatal("total ignored")
+	}
+}
+func TestReadStreamFreshGrantProofEveryChunk(t *testing.T) {
+	for _, kind := range []string{"valid", "acl", "groups", "epoch", "replay", "R", "busy"} {
+		t.Run(kind, func(t *testing.T) {
+			s, repo, c, carriers, g, _ := grantCohortFixture(t)
+			repo.store.Grants[0].Actions = []Action{ActionReadStream}
+			p := &metadataProcessStub{operationFixture: &operationFixture{}, result: &readOnlyResult{Bytes: 2 * MaxChunkBytes}, released: true}
+			c.startChild = func(NativeActor, operationBinding) (operationProcess, error) { return p, nil }
+			r := grantControl(t, g, '1', '2', '3', 2*MaxChunkBytes)
+			r.Op = ActionReadStream
+			if code := s.start(context.Background(), operationPeer{42, 0}, carriers, r); code != "" {
+				t.Fatal(code)
+			}
+			chunk := grantControl(t, g, '1', '4', '5', MaxChunkBytes)
+			chunk.Op = ActionReadStream
+			if code := s.chunk(context.Background(), operationPeer{42, 0}, carriers, chunk); code != "" {
+				t.Fatal(code)
+			}
+			p.pending = false
+			chunk.Nonce = grantRef('6')
+			chunk.Ticket = grantRef('7')
+			switch kind {
+			case "acl":
+				s.services.operations = grantOperationStub{code: ErrDenied}
+			case "groups":
+				c.operations[r.OperationID].actor.account.Groups = []uint32{999}
+			case "epoch":
+				chunk.Epoch = grantRef('f')
+			case "replay":
+				chunk.Nonce = grantRef('4')
+				chunk.Ticket = grantRef('5')
+			case "R":
+				repo.store.Grants[0].State = GrantRevoked
+				repo.store.Grants[0].Revision++
+				repo.store.Grants[0].RevokedAt = g.CreatedAt
+				repo.store.Grants[0].Reason = ErrRevoked
+			case "busy":
+				p.pending = true
+			}
+			code := s.chunk(context.Background(), operationPeer{42, 0}, carriers, chunk)
+			if kind == "valid" {
+				if code != "" || c.operations[r.OperationID].bytes != 2*MaxChunkBytes {
+					t.Fatal(code)
+				}
+			} else if code == "" || c.operations[r.OperationID].bytes != MaxChunkBytes {
+				t.Fatal("invalid lease admitted", code)
+			}
+		})
+	}
+}
+
+func TestStreamTicketWindowDoesNotTruncateAtBoundedReadWindow(t *testing.T) {
+	s, repo, _, carriers, g, _ := grantCohortFixture(t)
+	repo.store.Grants[0].Actions = []Action{ActionReadStream}
+	a, code := s.authority.actor(context.Background(), carriers, nil)
+	if code != "" {
+		t.Fatal(code)
+	}
+	for i := 0; i < MaxTransferBytes/MaxChunkBytes+1; i++ {
+		r := grantControl(t, g, '1', '2', '3', MaxChunkBytes)
+		r.Op = ActionReadStream
+		r.Nonce = fmt.Sprintf("%064x", i+1)
+		r.Ticket = fmt.Sprintf("%064x", i+10000)
+		proof, code := (grantOperationStub{}).ValidateOperation(context.Background(), a, r, g)
+		if code != "" {
+			t.Fatal(code)
+		}
+		if code = s.ticketLocked(r, proof.Ticket, a); code != "" {
+			t.Fatal(i, code)
+		}
+		s.burnTicket(r)
+		if code = s.ticketLocked(r, proof.Ticket, a); code != ErrReplay {
+			t.Fatal(i, code)
+		}
+	}
+}
+
+type relayFailureFixture struct{ *operationFixture }
+
+func (p relayFailureFixture) idle() (bool, error) { return true, io.ErrClosedPipe }
+func TestCohortPollCancelsDisconnectedOutput(t *testing.T) {
+	c, _, _, a, b, _ := cohortFixture(t)
+	f := &operationFixture{childFixture: childFixture{exitOn: syscall.SIGKILL}}
+	op := &cohortOperation{binding: b, actor: a, process: relayFailureFixture{f}, admittedAt: c.now()}
+	c.operations[b.OperationID] = op
+	c.started = 1
+	if err := c.poll(); err != nil {
+		t.Fatal(err)
+	}
+	if !op.canceled || !f.stopped {
+		t.Fatal("disconnected client retained live transfer")
+	}
+	if err := c.poll(); err != nil {
+		t.Fatal(err)
+	}
+	if len(c.operations) != 0 || c.reaped != 1 {
+		t.Fatal("disconnect did not reach observed quiescence")
+	}
+}
+
+func TestTransferSubjectFreshnessIncludesSessionObservation(t *testing.T) {
+	p, s, _, carriers, now := nativeFixture()
+	s.value.CheckedAt = now.Add(-NativeProofFreshness / 2)
+	a, code := p.Resolve(context.Background(), carriers)
+	if code != "" {
+		t.Fatal(code)
+	}
+	if !a.account.CheckedAt.Equal(s.value.CheckedAt) {
+		t.Fatal("transfer extended older session proof", a.account.CheckedAt, s.value.CheckedAt)
+	}
+}
+
+func TestReadStreamServerIssuedWindowCompletesMaximumTransfer(t *testing.T) {
+	tickets, actor, request, _ := deliveryFixture(t)
+	request.Op = ActionReadStream
+	for i := 0; i < MaxTransferBytes/MaxChunkBytes+1; i++ {
+		request.Nonce = fmt.Sprintf("%064x", i+10000)
+		issued, code := tickets.issue(context.Background(), actor, request)
+		if code != "" {
+			t.Fatal(i, code)
+		}
+		if _, code = tickets.consume(context.Background(), actor, issued); code != "" {
+			t.Fatal(i, code)
+		}
+	}
+	request.Op = ActionRead
+	if _, code := tickets.issue(context.Background(), actor, request); code != "" {
+		t.Fatal("stream consumed independent bounded window", code)
+	}
+}

package/dist/templates/native-go/backend/internal/helper/readonly.go

@@ -0,0 +1,105 @@
+package helper
+
+import (
+	"context"
+	"strings"
+)
+
+// Fixed internal work, assembled only by the trusted supervisor. Never accept
+// RootPath or descriptors from package/browser RPC. Grant admission stays S3-owned.
+type readOnlyWork struct {
+	RootPath string   `json:"rootPath"`
+	Action   Action   `json:"action"`
+	Segments []string `json:"segments"`
+	MaxBytes uint64   `json:"maxBytes"`
+	Limit    uint32   `json:"limit"`
+}
+
+type readOnlyResult struct {
+	Mutation *MutationReceipt `json:"mutation,omitempty"`
+	Code     Code             `json:"code"`
+	Entry    *Entry           `json:"entry,omitempty"`
+	List     *ListResult      `json:"list,omitempty"`
+	Bytes    uint64           `json:"bytes"`
+}
+
+// Mandatory child-side native share/home and action ACL adapter. Unknown native
+// semantics MUST refuse; syscall success cannot substitute for DSM share gates.
+// fd is an actor-opened object, never a caller path or root-opened readable FD.
+// No adapter is installed in shipped binaries until separate DSM proof passes.
+type readOnlyACL interface {
+	Authorize(context.Context, Action, int) Code
+}
+
+func (w readOnlyWork) validate() Code {
+	if !strings.HasPrefix(w.RootPath, "/") || w.RootPath == "/" {
+		return ErrInvalid
+	}
+	if code := ValidateRelativeSegments(strings.Split(w.RootPath[1:], "/"), false); code != "" {
+		return code
+	}
+	if !w.Action.ReadOnly() {
+		return ErrUnsupported
+	}
+	if code := ValidateRelativeSegments(w.Segments, w.Action != ActionRead && w.Action != ActionReadStream); code != "" {
+		return code
+	}
+	switch w.Action {
+	case ActionRead, ActionReadStream:
+		if w.MaxBytes == 0 || w.MaxBytes > readDataCeiling(w.Action) || w.Limit != 0 {
+			return ErrLimit
+		}
+	case ActionList:
+		if w.Limit == 0 || w.Limit > MaxPageEntries || w.MaxBytes != 0 {
+			return ErrLimit
+		}
+	case ActionStat:
+		if w.Limit != 0 || w.MaxBytes != 0 {
+			return ErrInvalid
+		}
+	}
+	return ""
+}
+
+// Private child metadata; bulk data only traverses the inherited leased pipe.
+type readOnlyPacket struct {
+	Binding       operationBinding `json:"binding"`
+	Token         string           `json:"token"`
+	Result        *readOnlyResult  `json:"result,omitempty"`
+	MountFD       *uint32          `json:"mountFd,omitempty"`
+	ChunkSequence uint64           `json:"chunkSequence,omitempty"`
+	MountSequence uint64           `json:"mountSequence,omitempty"`
+}
+type readOnlyMountReply struct {
+	Token    string `json:"token"`
+	Sequence uint64 `json:"sequence"`
+	Mount    uint64 `json:"mount"`
+	Code     Code   `json:"code"`
+}
+type readOnlyPacketOutcome struct {
+	result        *readOnlyResult
+	err           error
+	mountSequence uint64
+}
+
+func (r readOnlyResult) validFor(w readOnlyWork) bool {
+	if r.Mutation != nil {
+		return false
+	}
+	if r.Code != "" {
+		return r.Code.Valid() && r.Bytes == 0 && r.Entry == nil && r.List == nil
+	}
+	switch w.Action {
+	case ActionRead, ActionReadStream:
+		return r.Bytes <= w.MaxBytes && r.Entry == nil && r.List == nil
+	case ActionStat:
+		return r.Bytes == 0 && r.Entry != nil && r.List == nil
+	case ActionList:
+		return r.Bytes == 0 && r.Entry == nil && r.List != nil && len(r.List.Entries) <= int(w.Limit) && r.List.Cursor == ""
+	}
+	return false
+}
+
+type operationReadOnlyFinish struct {
+	Token string `json:"token"`
+}

package/dist/templates/native-go/backend/internal/helper/readonly_admission.go

@@ -0,0 +1,85 @@
+package helper
+
+import (
+	"encoding/json"
+	"slices"
+)
+
+// Private epoch-live capability, supplied by the fixed S3 operation validator.
+// It is not serialized into grant storage or caller controls. On Linux the only
+// concrete production witness accepted by the child factory is an O_PATH pin.
+type readOnlyRootWitness interface {
+	readOnlyRootPath() string
+	sameReadOnlyRoot(readOnlyRootWitness) bool
+}
+type readOnlyMetadataProcess interface {
+	readOnlyMetadata() (*readOnlyResult, bool, error)
+	releaseReadOnlyMetadata() error
+	readOnlyLeaseReady(uint32) Code
+}
+
+func readOnlyRequestWork(r DataRequest, root readOnlyRootWitness) (*readOnlyWork, Code) {
+	w := &readOnlyWork{Action: r.Op}
+	if root != nil {
+		w.RootPath = root.readOnlyRootPath()
+	}
+	switch r.Op {
+	case ActionRead, ActionReadStream:
+		var a ReadArgs
+		if code := decodeDataObject(bytesReader(r.Args), &a, MaxControlBytes); code != "" {
+			return nil, code
+		}
+		w.Segments = slices.Clone(a.Segments)
+		w.MaxBytes = a.MaxBytes
+	case ActionStat:
+		var a StatArgs
+		if code := decodeDataObject(bytesReader(r.Args), &a, MaxControlBytes); code != "" {
+			return nil, code
+		}
+		w.Segments = slices.Clone(a.Segments)
+	case ActionList:
+		var a ListArgs
+		if code := decodeDataObject(bytesReader(r.Args), &a, MaxControlBytes); code != "" {
+			return nil, code
+		}
+		if a.Cursor != "" {
+			return nil, ErrUnsupported
+		}
+		w.Segments = slices.Clone(a.Segments)
+		w.Limit = a.Limit
+	default:
+		return nil, ErrUnsupported
+	}
+	// Unit-test S3 synthetic factories have no root. The actual Linux factory
+	// always refuses nil; production has no native/ACL adapter installed.
+	if root != nil {
+		if code := w.validate(); code != "" {
+			return nil, code
+		}
+	}
+	return w, ""
+}
+func sameReadOnlyRequest(op *cohortOperation, w *readOnlyWork, root readOnlyRootWitness, metadata bool) bool {
+	if op.work == nil || op.work.Action != w.Action || !slices.Equal(op.work.Segments, w.Segments) || op.work.Limit != w.Limit {
+		return false
+	}
+	if op.root == nil {
+		if root != nil {
+			return false
+		}
+	} else if root == nil || !op.root.sameReadOnlyRoot(root) {
+		return false
+	}
+	return !metadata || op.work.MaxBytes == w.MaxBytes
+}
+func cloneReadOnlyResult(r *readOnlyResult) *readOnlyResult {
+	b, err := json.Marshal(r)
+	if err != nil {
+		return nil
+	}
+	var result readOnlyResult
+	if json.Unmarshal(b, &result) != nil {
+		return nil
+	}
+	return &result
+}

package/dist/templates/native-go/backend/internal/helper/readonly_cohort_linux_test.go

@@ -0,0 +1,253 @@
+package helper
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func readOnlyVMFixture(t *testing.T) LinuxProcesses {
+	t.Helper()
+	source := os.Getenv("M2_S5_FIXTURE")
+	if source == "" {
+		t.Skip("NIC-free root VM fixture")
+	}
+	digest, err := executableDigest(source)
+	if err != nil {
+		t.Fatal(err)
+	}
+	i := Inventory{Package: "root", Version: "1.0.0-0001", Protocol: 2, PayloadDigest: digest, RegistryDigest: strings.Repeat("b", 64)}
+	c := NewClient(i)
+	for _, dir := range []string{c.StateDir, c.RunDir} {
+		if err := os.Mkdir(dir, 0700); err != nil {
+			t.Fatal(err)
+		}
+		t.Cleanup(func() { os.RemoveAll(dir) })
+	}
+	binary := c.StateDir + "/payload-" + digest
+	b, err := os.ReadFile(source)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(binary, b, 0700); err != nil {
+		t.Fatal(err)
+	}
+	root := "/tmp/m2-s5-operations"
+	if err := os.Mkdir(root, 0755); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { os.RemoveAll(root) })
+	os.WriteFile(root+"/group", bytes.Repeat([]byte("group-only;"), 20000), 0640)
+	os.Chown(root+"/group", 0, 105)
+	os.WriteFile(root+"/denied", []byte("denied-canary"), 0600)
+	vmUnit(t, "start")
+	return LinuxProcesses{Client: c, Binary: binary}
+}
+func readOnlyVMRef(t *testing.T) string {
+	t.Helper()
+	var b [32]byte
+	if _, e := rand.Read(b[:]); e != nil {
+		t.Fatal(e)
+	}
+	return hex.EncodeToString(b[:])
+}
+func readOnlyVMRequest(t *testing.T, g Grant, act Action, args any) DataRequest {
+	b, _ := json.Marshal(args)
+	return DataRequest{Inventory: g.Inventory, Epoch: g.LastValidated.Epoch, Op: act, GrantID: g.ID, GrantRevision: g.Revision, OperationID: readOnlyVMRef(t), Nonce: readOnlyVMRef(t), Ticket: readOnlyVMRef(t), Args: b}
+}
+func grantVMMetadata(t *testing.T, p LinuxProcesses, r DataRequest) *readOnlyResult {
+	t.Helper()
+	ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
+	defer cancel()
+	var value *readOnlyResult
+	if err := waitHealthy(ctx, func(context.Context) bool {
+		r.Nonce = readOnlyVMRef(t)
+		r.Ticket = readOnlyVMRef(t)
+		res := grantVMCall(t, p, "operation.result", r)
+		if res.Code == ErrBusy {
+			return false
+		}
+		if res.Code != "" || res.Files == nil {
+			t.Fatalf("metadata refused: %+v", res)
+		}
+		value = res.Files
+		return true
+	}); err != nil {
+		t.Fatal(err)
+	}
+	return value
+}
+func readOnlyVMCreate(t *testing.T, p LinuxProcesses) Grant {
+	t.Helper()
+	res := grantVMCall(t, p, "prepare", grantPrepareArgs{grantRef('c'), ScopePersonal, []Action{ActionRead, ActionStat, ActionList}})
+	if res.Code != "" || res.Intent == nil {
+		t.Fatal(res)
+	}
+	b, e := os.ReadFile(filepath.Join(p.StateDir, "grants.json"))
+	if e != nil {
+		t.Fatal(e)
+	}
+	store, code := DecodeGrantStore(bytes.NewReader(b))
+	if code != "" {
+		t.Fatal(code)
+	}
+	res = grantVMCall(t, p, "confirm", grantConfirmArgs{res.Intent.ID, res.Intent.SummaryDigest, store.Revision})
+	if res.Code != "" || res.Grant == nil {
+		t.Fatal(res)
+	}
+	return *res.Grant
+}
+func TestLinuxReadOnlyProtocol2ChildrenRelayAndReap(t *testing.T) {
+	p := readOnlyVMFixture(t)
+	proc := startVMHelper(t, p)
+	g := readOnlyVMCreate(t, p)
+	for _, kind := range []string{"stat", "list", "read", "deny"} {
+		os.Remove(p.RunDir + "/fixture-readonly-bytes")
+		act := ActionRead
+		var args any = ReadArgs{Segments: []string{"group"}, MaxBytes: MaxBoundedBytes}
+		switch kind {
+		case "stat":
+			act = ActionStat
+			args = StatArgs{Segments: []string{"group"}}
+		case "list":
+			act = ActionList
+			args = ListArgs{Segments: []string{}, Limit: 20}
+		case "deny":
+			args = ReadArgs{Segments: []string{"denied"}, MaxBytes: MaxBoundedBytes}
+		}
+		r := readOnlyVMRequest(t, g, act, args)
+		if res := grantVMCall(t, p, "operation.start", r); res.Code != "" {
+			t.Fatal(res)
+		}
+		result := grantVMMetadata(t, p, r)
+		for sent := uint64(0); sent < result.Bytes; {
+			n := result.Bytes - sent
+			if n > MaxChunkBytes {
+				n = MaxChunkBytes
+			}
+			chunk := r
+			chunk.Nonce = readOnlyVMRef(t)
+			chunk.Ticket = readOnlyVMRef(t)
+			chunk.Args, _ = json.Marshal(ReadArgs{Segments: []string{"group"}, MaxBytes: n})
+			res := grantVMCall(t, p, "operation.chunk", chunk)
+			if res.Code == ErrBusy {
+				time.Sleep(10 * time.Millisecond)
+				continue
+			}
+			if res.Code != "" {
+				t.Fatal(res)
+			}
+			sent += n
+		}
+		ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
+		if waitHealthy(ctx, func(context.Context) bool {
+			_, err := os.Stat(p.RunDir + "/fixture-readonly-bytes")
+			return err == nil && len(processChildren(proc.PID)) == 1
+		}) != nil {
+			cancel()
+			t.Fatal(kind, "operation did not reap")
+		}
+		cancel()
+		data, err := os.ReadFile(p.RunDir + "/fixture-readonly-bytes")
+		if err != nil {
+			t.Fatal(err)
+		}
+		switch kind {
+		case "stat":
+			if result.Code != "" || result.Entry == nil || result.Entry.Bytes != 220000 || len(data) != 0 {
+				t.Fatal(result)
+			}
+		case "list":
+			if result.Code != "" || result.List == nil || len(result.List.Entries) != 1 || result.List.Entries[0].Name != "group" || len(data) != 0 {
+				t.Fatal(result)
+			}
+		case "read":
+			expected, _ := os.ReadFile("/tmp/m2-s5-operations/group")
+			if result.Code != "" || !bytes.Equal(data, expected) {
+				t.Fatal(result, len(data))
+			}
+		case "deny":
+			if result.Code != ErrDenied || len(data) != 0 || result.Entry != nil || result.List != nil {
+				t.Fatal("denied metadata escaped", result)
+			}
+		}
+	}
+	vmUnit(t, "stop")
+	ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
+	defer cancel()
+	if waitHealthy(ctx, func(context.Context) bool {
+		r, e := readRecord(p.StateDir, 0)
+		return e == nil && r.Lifecycle.Phase == "stopped"
+	}) != nil {
+		t.Fatal("autonomous completion missing")
+	}
+	record, _ := readRecord(p.StateDir, 0)
+	proof, err := completionRecord(p.Client, record)
+	if err != nil || proof.Cohort == nil || proof.Cohort.Started != 4 || proof.Cohort.Reaped != 4 || !proof.Cohort.RelaysStopped {
+		t.Fatal(proof, err)
+	}
+}
+func TestLinuxReadOnlyBlockedRelayRevokeUsesExistingS3Quiescence(t *testing.T) {
+	p := readOnlyVMFixture(t)
+	proc := startVMHelper(t, p)
+	g := readOnlyVMCreate(t, p)
+	os.WriteFile(p.RunDir+"/fixture-readonly-block-output", nil, 0600)
+	r := readOnlyVMRequest(t, g, ActionRead, ReadArgs{Segments: []string{"group"}, MaxBytes: MaxBoundedBytes})
+	if res := grantVMCall(t, p, "operation.start", r); res.Code != "" {
+		t.Fatal(res)
+	}
+	result := grantVMMetadata(t, p, r)
+	if result.Code != "" || result.Bytes == 0 {
+		t.Fatal(result)
+	}
+	chunk := r
+	chunk.Nonce = readOnlyVMRef(t)
+	chunk.Ticket = readOnlyVMRef(t)
+	chunk.Args, _ = json.Marshal(ReadArgs{Segments: []string{"group"}, MaxBytes: MaxChunkBytes})
+	if res := grantVMCall(t, p, "operation.chunk", chunk); res.Code != "" {
+		t.Fatal(res)
+	}
+	children := processChildren(proc.PID)
+	if len(children) != 2 {
+		t.Fatal("missing owned child", children)
+	}
+	b, _ := os.ReadFile(p.StateDir + "/grants.json")
+	store, code := DecodeGrantStore(bytes.NewReader(b))
+	if code != "" {
+		t.Fatal(code)
+	}
+	res := grantVMCall(t, p, "revoke", grantRevokeArgs{g.ID, g.Revision, store.Revision})
+	if res.Code != "" || res.Revoke == nil || !res.Revoke.Revoked || !res.Revoke.Drained {
+		t.Fatal(res)
+	}
+	b, err := os.ReadFile(p.StateDir + "/grant-q-" + g.ID + ".json")
+	var q GrantQuiescence
+	if err != nil || json.Unmarshal(b, &q) != nil || !completeQuiescence(q) || q.Cohort == nil || q.Cohort.Started != 1 || q.Cohort.Reaped != 1 || q.Cohort.AdmittedBytes != MaxChunkBytes {
+		t.Fatal(q, err)
+	}
+	if len(processChildren(proc.PID)) != 1 {
+		t.Fatal("Q before reap")
+	}
+	if res := grantVMCall(t, p, "operation.result", r); res.Code == "" || res.Files != nil {
+		t.Fatal("metadata after R", res)
+	}
+	if res := grantVMCall(t, p, "operation.chunk", chunk); res.Code == "" {
+		t.Fatal("lease after R", res)
+	}
+	if err := (Controller{Client: p.Client, Processes: p, Observe: observeLinux}).Control(context.Background(), "teardown"); err != nil {
+		t.Fatal(err)
+	}
+	for _, pid := range children {
+		if _, e := os.Stat(fmt.Sprintf("/proc/%d", pid)); !os.IsNotExist(e) {
+			t.Fatal("child survived teardown", pid)
+		}
+	}
+}