@synopackageland/cli 0.4.0 → 0.5.0

package/templates/native-go/backend/internal/helper/sdk_job_test.go

@@ -0,0 +1,501 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"context"
+	"crypto/sha256"
+	"dsmapp/internal/helper/jobcontract"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+)
+
+type sdkJobTestJournal struct {
+	afterReserve                        func()
+	intents                             map[string]sdkJobIntent
+	receipts                            map[string]sdkJobReceipt
+	reserveCode, cancelCode, finishCode Code
+	cancels                             int
+}
+
+func (j *sdkJobTestJournal) Reserve(i sdkJobIntent) Code {
+	if j.afterReserve != nil {
+		j.afterReserve()
+	}
+	if j.reserveCode != "" {
+		return j.reserveCode
+	}
+	if _, ok := j.intents[i.Request.Control.Binding.Job.ID]; ok {
+		return ErrReplay
+	}
+	j.intents[i.Request.Control.Binding.Job.ID] = i
+	return ""
+}
+
+func TestSDKJobProofExpiryMustBeRecheckedAfterIntentDurability(t *testing.T) {
+	f := sdkJobFixture(t)
+	now := f.c.now()
+	f.validator.alter = func(p *sdkJobProof) { p.ExpiresAt = now.Add(time.Millisecond) }
+	f.journal.afterReserve = func() {
+		f.c.now = func() time.Time { return now.Add(10 * time.Millisecond) }
+		f.s.authority.now = f.c.now
+	}
+	if code := f.submit(); code != ErrExpired || len(f.children) != 0 {
+		t.Fatal("expired proof admitted after journal wait", code, len(f.children))
+	}
+}
+
+func TestSDKJobDisconnectCancelsEvenAfterSessionExpires(t *testing.T) {
+	f := sdkJobFixture(t)
+	if code := f.submit(); code != "" {
+		t.Fatal(code)
+	}
+	f.event(t, sdkJobEvent{Kind: "ready"})
+	f.native.sessionCode = ErrDenied
+	if code := f.o.disconnect(context.Background(), f.r.Control.Binding); code != "" {
+		t.Fatal(code)
+	}
+	r := f.o.jobs[f.r.Control.Binding.Job.ID].receipt
+	if !r.Job.CancelRequested || !r.Job.Drained || r.Job.State != jobcontract.Canceled || f.journal.cancels != 1 {
+		t.Fatal("disconnect required a new login or lacked durable Q", r)
+	}
+}
+
+func TestSDKJobIntentCannotBeReboundToAnotherExecution(t *testing.T) {
+	f := sdkJobFixture(t)
+	if code := f.submit(); code != "" {
+		t.Fatal(code)
+	}
+	f.r.Control.Binding.Job.ID = grantRef('7')
+	f.r.Control.Nonce = grantRef('8')
+	f.r.Control.Ticket = grantRef('9')
+	if code := f.submit(); code != ErrReplay || len(f.children) != 1 {
+		t.Fatal("same issued intent dispatched twice", code, len(f.children))
+	}
+}
+func (j *sdkJobTestJournal) Cancel(jobcontract.Binding) Code { j.cancels++; return j.cancelCode }
+func (j *sdkJobTestJournal) Finish(r sdkJobReceipt) Code {
+	if j.finishCode != "" {
+		return j.finishCode
+	}
+	j.receipts[r.Job.Binding.Job.ID] = r
+	return ""
+}
+
+type sdkJobTestValidator struct {
+	root  readOnlyRootWitness
+	code  Code
+	after func()
+	alter func(*sdkJobProof)
+}
+
+func (v *sdkJobTestValidator) ValidateJob(_ context.Context, a NativeActor, r sdkJobRequest, g Grant, _ sdkJobCheckpoint) (sdkJobProof, Code) {
+	if v.after != nil {
+		v.after()
+	}
+	p := sdkJobProof{Intent: r.Control.Intent, Binding: r.Control.Binding, Principal: a.Principal(), SessionRef: a.SessionRef(), Nonce: r.Control.Nonce, Ticket: r.Control.Ticket, ExpiresAt: a.account.CheckedAt.Add(IntentTTL), CheckedAt: a.account.CheckedAt, Continuity: g.LastValidated, Continuous: true, Root: v.root}
+	if v.alter != nil {
+		v.alter(&p)
+	}
+	return p, v.code
+}
+
+type sdkJobTestProcess struct {
+	operationFixture
+	events  []sdkJobEvent
+	replies []sdkJobReply
+	ok      bool
+}
+
+func (p *sdkJobTestProcess) next() (sdkJobEvent, bool) {
+	if len(p.events) == 0 {
+		return sdkJobEvent{}, false
+	}
+	e := p.events[0]
+	p.events = p.events[1:]
+	return e, true
+}
+func (p *sdkJobTestProcess) reply(r sdkJobReply) error { p.replies = append(p.replies, r); return nil }
+func (p *sdkJobTestProcess) exitSuccess() bool         { return p.ok && p.reaped }
+
+type sdkJobTestFixture struct {
+	o         *sdkJobOwner
+	s         *supervisorGrants
+	c         *operationCohort
+	repo      *memoryGrantRepository
+	native    *relaxedFake
+	carriers  SessionCarriers
+	g         Grant
+	r         sdkJobRequest
+	registry  []byte
+	journal   *sdkJobTestJournal
+	validator *sdkJobTestValidator
+	children  []*sdkJobTestProcess
+}
+
+func sdkJobFixture(t *testing.T, modes ...jobcontract.Mode) *sdkJobTestFixture {
+	if len(modes) == 0 {
+		modes = []jobcontract.Mode{jobcontract.Interactive}
+	}
+	t.Helper()
+	a, repo, p, f, consent, _, carriers := relaxedFixture(t)
+	p = NewRelaxedNativeProvider(p.relaxed.adapters)
+	p.now = a.now
+	b := SDKWorkerBindings()
+	w := jobcontract.Worker{RegistrySchema: 2, ID: "scan", Revision: 1, Kind: "sdk-read-plan", HandlerBinding: b.HandlerBinding, InputSchemaDigest: b.InputSchemaDigest, OutputSchemaDigest: b.OutputSchemaDigest, Actions: []jobcontract.Action{jobcontract.List, jobcontract.Stat, jobcontract.Read, jobcontract.ReadStream}, Modes: modes, Checkpoints: []string{"before-step", "before-chunk", "before-result"}, Limits: jobcontract.HardLimits()}
+	registry, _ := json.Marshal(jobcontract.Registry{RegistrySchema: 2, ProductionAvailability: "unavailable", Inert: []jobcontract.InertWorker{}, SDK: []jobcontract.Worker{w}})
+	sum := sha256.Sum256(registry)
+	repo.policy.Inventory.RegistryDigest = hex.EncodeToString(sum[:])
+	repo.policy.CapabilityDigest = repo.policy.Inventory.RegistryDigest
+	gate := newAdmission(Binding{Boot: "boot", Install: "install"})
+	gate.observe(gate.binding, 1, true, a.now())
+	c := newOperationCohort(repo.policy.Inventory, repo.policy.Epoch, 42, gate, func() bool { return true })
+	c.now = a.now
+	s, code := newSupervisorGrants(repo, c, supervisorGrantServices{native: p, consent: consent})
+	if code != "" {
+		t.Fatal(code)
+	}
+	s.authority.now = a.now
+	g := relaxedConsent(t, s.authority, repo, p, consent, carriers, ScopePersonal)
+	// This fixture grants all fixed read-only actions, as a trusted consent would.
+	for n := range repo.store.Grants {
+		repo.store.Grants[n].Actions = []Action{ActionList, ActionStat, ActionRead, ActionReadStream}
+	}
+	g.Actions = repo.store.Grants[0].Actions
+	in := jobcontract.Input{Steps: []jobcontract.Step{{Action: jobcontract.Stat, Segments: []string{"fixture"}}}}
+	digest, _ := jobcontract.InputDigest(in, w.InputSchemaDigest)
+	jb := jobcontract.Binding{Inventory: jobcontract.Inventory{Package: c.inventory.Package, Version: c.inventory.Version, Protocol: 2, PayloadDigest: c.inventory.PayloadDigest, RegistryDigest: c.inventory.RegistryDigest, DataAccess: "relaxed"}, JobSchema: 1, Epoch: c.epoch, Job: jobcontract.RevisionRef{ID: grantRef('1'), Revision: 1}, Worker: jobcontract.RevisionRef{ID: w.ID, Revision: 1}, ParentGrant: jobcontract.RevisionRef{ID: g.ID, Revision: g.Revision}, ApprovalBinding: repo.policy.ApprovalBinding, CapabilityDigest: repo.policy.CapabilityDigest, InputSchemaDigest: w.InputSchemaDigest, InputDigest: digest, Mode: jobcontract.Interactive}
+	x := &sdkJobTestFixture{s: s, c: c, repo: repo, native: f, carriers: carriers, g: g, registry: registry, r: sdkJobRequest{Control: jobcontract.Control{Op: "jobs.submit", Binding: jb, Intent: jobcontract.RevisionRef{ID: grantRef('2'), Revision: 1}, Nonce: grantRef('3'), Ticket: grantRef('4')}, Input: in}, journal: &sdkJobTestJournal{intents: map[string]sdkJobIntent{}, receipts: map[string]sdkJobReceipt{}}, validator: &sdkJobTestValidator{root: &sdkTestRoot{}}}
+	x.o, code = newSDKJobOwner(s, registry, sdkJobServices{Validator: x.validator, Journal: x.journal, Start: func(_ NativeActor, _ operationBinding, _ sdkJobPlan) (sdkJobProcess, error) {
+		if repo.inTransaction {
+			t.Fatal("bootstrap under grant transaction")
+		}
+		if !gate.mu.TryLock() {
+			t.Fatal("bootstrap under admission mutex")
+		}
+		gate.mu.Unlock()
+		child := &sdkJobTestProcess{operationFixture: operationFixture{childFixture: childFixture{exitOn: syscall.SIGTERM}}, ok: true}
+		x.children = append(x.children, child)
+		return child, nil
+	}})
+	if code != "" {
+		t.Fatal(code)
+	}
+	return x
+}
+
+type sdkTestRoot struct{}
+
+func (*sdkTestRoot) readOnlyRootPath() string                          { return "/fixture" }
+func (r *sdkTestRoot) sameReadOnlyRoot(other readOnlyRootWitness) bool { return r == other }
+func (f *sdkJobTestFixture) submit() Code {
+	return f.o.submit(context.Background(), operationPeer{42, 0}, f.carriers, f.r)
+}
+func (f *sdkJobTestFixture) event(t *testing.T, e sdkJobEvent) {
+	t.Helper()
+	f.children[0].events = append(f.children[0].events, e)
+	f.o.poll(context.Background())
+}
+func TestSDKJobRegistryAndProductionRefusal(t *testing.T) {
+	f := sdkJobFixture(t)
+	if _, c := newSDKJobOwner(f.s, nil, sdkJobServices{}); c != ErrUnavailable {
+		t.Fatal(c)
+	}
+	bad := append([]byte{}, f.registry...)
+	bad[len(bad)-2] = 'x'
+	if _, c := newSDKJobOwner(f.s, bad, sdkJobServices{}); c == "" {
+		t.Fatal("invalid registry accepted")
+	}
+	if r := jobcontract.ExecuteSDKReadPlan(jobcontract.Worker{}, f.r.Input); r.SafeReason != jobcontract.Unavailable {
+		t.Fatal("production dispatched", r)
+	}
+}
+func TestSDKJobCheckpointResultRequiresReapAndDurableReceipt(t *testing.T) {
+	f := sdkJobFixture(t)
+	if c := f.submit(); c != "" {
+		t.Fatal(c)
+	}
+	id := f.r.Control.Binding.Job.ID
+	if f.o.jobs[id].receipt.Job.State != jobcontract.Pending {
+		t.Fatal("running before credentials")
+	}
+	f.event(t, sdkJobEvent{Kind: "ready"})
+	f.event(t, sdkJobEvent{Kind: "checkpoint", Checkpoint: sdkJobCheckpoint{Phase: "before-step"}})
+	f.event(t, sdkJobEvent{Kind: "step-result", Result: &jobcontract.Result{ResultSchema: 1, CompletedSteps: 1, Entries: 1}})
+	f.event(t, sdkJobEvent{Kind: "checkpoint", Checkpoint: sdkJobCheckpoint{Phase: "before-result", Step: 1}})
+	f.event(t, sdkJobEvent{Kind: "result", Result: &jobcontract.Result{ResultSchema: 1, CompletedSteps: 1, Entries: 1}})
+	if f.o.jobs[id].receipt.Job.State == jobcontract.Succeeded || len(f.journal.receipts) != 0 {
+		t.Fatal("result or 100% became Q")
+	}
+	f.children[0].reaped = true
+	f.o.poll(context.Background())
+	r := f.journal.receipts[id]
+	if r.Job.State != jobcontract.Succeeded || !r.Job.Drained || r.Result == nil || r.Result.Entries != 1 {
+		t.Fatal(r)
+	}
+	if len(f.c.operations) != 0 || f.c.started != 1 || f.c.reaped != 1 {
+		t.Fatal("slot not shared/reaped")
+	}
+	if c := f.submit(); c != ErrReplay {
+		t.Fatal(c)
+	}
+}
+func TestSDKJobRejectsUntrustedAdmissionBeforeSpawn(t *testing.T) {
+	for _, kind := range []string{"peer", "mode", "input", "worker", "approval", "ticket", "intent", "session", "root", "fence", "journal"} {
+		t.Run(kind, func(t *testing.T) {
+			f := sdkJobFixture(t)
+			peer := operationPeer{42, 0}
+			switch kind {
+			case "peer":
+				peer.PID++
+			case "mode":
+				f.r.Control.Binding.Mode = jobcontract.Background
+			case "input":
+				f.r.Input.Steps[0].Segments[0] = "other"
+			case "worker":
+				f.r.Control.Binding.Worker.Revision++
+			case "approval":
+				f.r.Control.Binding.ApprovalBinding = grantRef('b')
+			case "ticket":
+				f.validator.alter = func(p *sdkJobProof) { p.Ticket = grantRef('b') }
+			case "intent":
+				f.validator.alter = func(p *sdkJobProof) { p.Intent.Revision++ }
+			case "session":
+				f.validator.alter = func(p *sdkJobProof) { p.SessionRef = grantRef('b') }
+			case "root":
+				f.validator.root = nil
+			case "fence":
+				f.validator.after = func() { f.c.gate.fence("fixture") }
+			case "journal":
+				f.journal.reserveCode = ErrCommitUncertain
+			}
+			if c := f.o.submit(context.Background(), peer, f.carriers, f.r); c == "" || len(f.children) != 0 {
+				t.Fatal(kind, c)
+			}
+		})
+	}
+}
+func TestSDKJobCancelDoesNotInventQuiescence(t *testing.T) {
+	for _, kind := range []string{"D-state", "relay", "ECHILD"} {
+		t.Run(kind, func(t *testing.T) {
+			f := sdkJobFixture(t)
+			if c := f.submit(); c != "" {
+				t.Fatal(c)
+			}
+			p := f.children[0]
+			switch kind {
+			case "D-state":
+				p.exitOn = 0
+			case "relay":
+				p.stuck = true
+				p.pending = true
+			case "ECHILD":
+				p.err = syscall.ECHILD
+			}
+			ctx, cancel := context.WithTimeout(context.Background(), 10*time.Millisecond)
+			defer cancel()
+			if c := f.o.cancel(ctx, operationPeer{42, 0}, f.carriers, f.r.Control.Binding); c != ErrCleanupRequired {
+				t.Fatal(c)
+			}
+			r := f.o.jobs[f.r.Control.Binding.Job.ID].receipt
+			if r.Job.Drained || len(f.c.operations) != 1 || len(f.journal.receipts) != 0 {
+				t.Fatal("false Q", r)
+			}
+			if f.c.gate.allow(f.c.now()) {
+				t.Fatal("unknown cleanup admitted new cohort work")
+			}
+			if kind == "ECHILD" && len(p.signals) > 0 {
+				t.Fatal("foreign PID signalled")
+			}
+		})
+	}
+}
+func TestSDKJobSharedUIDSlotsAndBusyBootstrap(t *testing.T) {
+	f := sdkJobFixture(t)
+	for n := 0; n < 2; n++ {
+		id := fmt.Sprintf("%064x", 90+n)
+		a := relaxedActor(t, f.s.services.native, f.carriers)
+		a.account.Principal.SubjectRef = strings.Repeat(fmt.Sprint(n+1), 64)
+		f.c.operations[id] = &cohortOperation{actor: a}
+	}
+	if c := f.submit(); c != ErrBusy || len(f.children) != 0 {
+		t.Fatal("UID cap bypassed by subject/session", c)
+	}
+	clear(f.c.operations)
+	if c := f.submit(); c != "" {
+		t.Fatal(c)
+	}
+	if f.c.started != 1 || len(f.c.operations) != 1 {
+		t.Fatal("bootstrap did not retain reservation")
+	}
+	if !f.c.gate.mu.TryLock() {
+		t.Fatal("bootstrap blocks observer")
+	}
+	f.c.gate.mu.Unlock()
+}
+
+func sdkCompletePlan(t *testing.T, f *sdkJobTestFixture) {
+	t.Helper()
+	f.event(t, sdkJobEvent{Kind: "ready"})
+	f.event(t, sdkJobEvent{Kind: "checkpoint", Checkpoint: sdkJobCheckpoint{Phase: "before-step"}})
+	f.event(t, sdkJobEvent{Kind: "step-result", Result: &jobcontract.Result{ResultSchema: 1, CompletedSteps: 1, Entries: 1}})
+	f.event(t, sdkJobEvent{Kind: "checkpoint", Checkpoint: sdkJobCheckpoint{Phase: "before-result", Step: 1}})
+	f.event(t, sdkJobEvent{Kind: "result", Result: &jobcontract.Result{ResultSchema: 1, CompletedSteps: 1, Entries: 1}})
+}
+func TestSDKJobFinishCancelOrderingAndUncertainJournal(t *testing.T) {
+	for _, kind := range []string{"finish-first", "cancel-first", "cancel-fsync", "finish-fsync"} {
+		t.Run(kind, func(t *testing.T) {
+			f := sdkJobFixture(t)
+			if c := f.submit(); c != "" {
+				t.Fatal(c)
+			}
+			if kind == "cancel-fsync" {
+				f.journal.cancelCode = ErrCommitUncertain
+			}
+			if kind == "finish-fsync" {
+				f.journal.finishCode = ErrCommitUncertain
+			}
+			sdkCompletePlan(t, f)
+			id := f.r.Control.Binding.Job.ID
+			if kind == "finish-first" || kind == "finish-fsync" {
+				f.children[0].reaped = true
+				f.o.poll(context.Background())
+			}
+			code := f.o.cancel(context.Background(), operationPeer{42, 0}, f.carriers, f.r.Control.Binding)
+			f.o.poll(context.Background())
+			r := f.o.jobs[id].receipt
+			switch kind {
+			case "finish-first":
+				if code != ErrStale || f.journal.cancels != 0 || r.Job.State != jobcontract.Succeeded {
+					t.Fatal(code, r)
+				}
+			case "cancel-first":
+				if code != "" || r.Job.State != jobcontract.Canceled || !r.Job.Drained || r.Result != nil {
+					t.Fatal(code, r)
+				}
+			default:
+				if r.Job.State != jobcontract.CleanupRequired || r.Job.Drained || r.Result != nil || len(f.journal.receipts) != 0 {
+					t.Fatal("uncertain durability promoted to terminal", code, r)
+				}
+				if f.c.gate.allow(f.c.now()) {
+					t.Fatal("uncertain journal admitted new cohort work")
+				}
+			}
+		})
+	}
+}
+func TestSDKJobCheckpointProgressAndResultCannotForgeSuccess(t *testing.T) {
+	for _, kind := range []string{"missing-step", "missing-result-check", "early-result", "extra-result-field", "bad-progress", "repeat-progress", "wrong-total", "read-without-lease"} {
+		t.Run(kind, func(t *testing.T) {
+			f := sdkJobFixture(t)
+			if c := f.submit(); c != "" {
+				t.Fatal(c)
+			}
+			f.event(t, sdkJobEvent{Kind: "ready"})
+			switch kind {
+			case "missing-step":
+				f.event(t, sdkJobEvent{Kind: "step-result", Result: &jobcontract.Result{ResultSchema: 1, CompletedSteps: 1, Entries: 1}})
+			case "missing-result-check", "early-result":
+				f.event(t, sdkJobEvent{Kind: "result", Result: &jobcontract.Result{ResultSchema: 1}})
+			case "extra-result-field":
+				f.event(t, sdkJobEvent{Kind: "progress", Progress: &jobcontract.Progress{Sequence: 1, Phase: "starting"}, Result: &jobcontract.Result{ResultSchema: 1}})
+			case "bad-progress":
+				f.event(t, sdkJobEvent{Kind: "progress", Progress: &jobcontract.Progress{Sequence: 1, Phase: "/private/name"}})
+			case "repeat-progress":
+				e := sdkJobEvent{Kind: "progress", Progress: &jobcontract.Progress{Sequence: 1, Phase: "reading"}}
+				f.event(t, e)
+				f.event(t, e)
+			case "wrong-total":
+				n := uint64(100)
+				f.event(t, sdkJobEvent{Kind: "progress", Progress: &jobcontract.Progress{Sequence: 1, Phase: "reading", TotalUnits: &n}})
+			case "read-without-lease":
+				f.event(t, sdkJobEvent{Kind: "checkpoint", Checkpoint: sdkJobCheckpoint{Phase: "before-step"}})
+				f.event(t, sdkJobEvent{Kind: "step-result", Result: &jobcontract.Result{ResultSchema: 1, CompletedSteps: 1, Entries: 1, BytesRead: 1}})
+			}
+			j := f.o.jobs[f.r.Control.Binding.Job.ID]
+			if j.failure == "" || !f.children[0].stopped {
+				t.Fatal("malicious packet accepted", j.receipt)
+			}
+			if j.receipt.Job.State == jobcontract.Succeeded || j.receipt.Result != nil {
+				t.Fatal("unsafe output")
+			}
+		})
+	}
+}
+func TestSDKJobProgressBudgetDoesNotRefreshLease(t *testing.T) {
+	f := sdkJobFixture(t)
+	if c := f.submit(); c != "" {
+		t.Fatal(c)
+	}
+	f.event(t, sdkJobEvent{Kind: "ready"})
+	j := f.o.jobs[f.r.Control.Binding.Job.ID]
+	start := j.lastCheckpoint
+	for n := uint64(1); n <= 200; n++ {
+		f.event(t, sdkJobEvent{Kind: "progress", Progress: &jobcontract.Progress{Sequence: n, Phase: "reading"}})
+	}
+	if len(j.progress) != 1 || j.progressPackets != 128 || j.lastCheckpoint != start || j.receipt.Job.State != jobcontract.Running {
+		t.Fatal("progress bypassed budget or became completion", len(j.progress), j.receipt)
+	}
+}
+func TestSDKJobWholePlanReadBudgetAndImmutableInput(t *testing.T) {
+	f := sdkJobFixture(t)
+	n := uint64(3)
+	f.r.Input = jobcontract.Input{Steps: []jobcontract.Step{{Action: jobcontract.ReadStream, Segments: []string{"fixture"}, MaxBytes: &n}, {Action: jobcontract.Stat, Segments: []string{"fixture"}}}}
+	f.r.Control.Binding.InputDigest, _ = jobcontract.InputDigest(f.r.Input, f.r.Control.Binding.InputSchemaDigest)
+	if c := f.submit(); c != "" {
+		t.Fatal(c)
+	}
+	f.r.Input.Steps[0].Segments[0] = "outside"
+	n = 100
+	j := f.o.jobs[f.r.Control.Binding.Job.ID]
+	if j.request.Input.Steps[0].Segments[0] != "fixture" || *j.request.Input.Steps[0].MaxBytes != 3 {
+		t.Fatal("input alias changed admitted job")
+	}
+	f.event(t, sdkJobEvent{Kind: "ready"})
+	f.event(t, sdkJobEvent{Kind: "checkpoint", Checkpoint: sdkJobCheckpoint{Phase: "before-step"}})
+	f.event(t, sdkJobEvent{Kind: "checkpoint", Checkpoint: sdkJobCheckpoint{Phase: "before-chunk", Bytes: 3}})
+	if j.admitted != 3 || j.op.bytes != 3 {
+		t.Fatal("chunk not counted in common cohort")
+	}
+	f.event(t, sdkJobEvent{Kind: "checkpoint", Checkpoint: sdkJobCheckpoint{Phase: "before-chunk", Bytes: 1}})
+	if j.failure != ErrLimit {
+		t.Fatal("step byte ceiling reset", j.failure)
+	}
+}
+func TestSDKJobSessionGroupChangeAndObserverFence(t *testing.T) {
+	for _, kind := range []string{"logout", "groups", "fence", "grant-revoked"} {
+		t.Run(kind, func(t *testing.T) {
+			f := sdkJobFixture(t)
+			if c := f.submit(); c != "" {
+				t.Fatal(c)
+			}
+			f.event(t, sdkJobEvent{Kind: "ready"})
+			switch kind {
+			case "logout":
+				f.native.sessionCode = ErrDenied
+			case "groups":
+				f.native.groups.Groups = []uint32{200}
+			case "fence":
+				f.c.gate.fence("unit-stopped")
+			case "grant-revoked":
+				f.repo.store.Grants[0].State = GrantRevoked
+				f.repo.store.Grants[0].Reason = ErrRevoked
+				f.repo.store.Grants[0].Revision++
+				f.repo.store.Grants[0].RevokedAt = f.g.CreatedAt
+			}
+			f.event(t, sdkJobEvent{Kind: "checkpoint", Checkpoint: sdkJobCheckpoint{Phase: "before-step"}})
+			j := f.o.jobs[f.r.Control.Binding.Job.ID]
+			if j.failure == "" || !f.children[0].stopped {
+				t.Fatal("stale authority ran")
+			}
+			if kind == "fence" && len(f.children[0].signals) != 0 {
+				t.Fatal("signal preceded supervisor durable fence")
+			}
+		})
+	}
+}