@synopackageland/cli 0.4.1 → 0.5.0

package/templates/native-go/backend/internal/helper/jobcontract/registry.go

@@ -0,0 +1,85 @@
+package jobcontract
+
+import (
+	"io"
+	"regexp"
+	"slices"
+)
+
+// InertWorker is inventory only. It never resolves to a handler or executable.
+type InertWorker struct {
+	ID     string `json:"id"`
+	Digest string `json:"digest"`
+}
+
+type Registry struct {
+	RegistrySchema         int           `json:"registrySchema"`
+	ProductionAvailability string        `json:"productionAvailability"`
+	Inert                  []InertWorker `json:"inert"`
+	SDK                    []Worker      `json:"sdk"`
+}
+
+var registryID = regexp.MustCompile(`^[a-z][a-z0-9_]{0,31}$`)
+
+func ValidateRegistry(r Registry) SafeReason {
+	return validateRegistryBindings(r, CompiledBindings())
+}
+
+func validateRegistryBindings(r Registry, b WorkerSourceBindings) SafeReason {
+	if r.RegistrySchema != RegistrySchema || r.ProductionAvailability != ProductionAvailability {
+		return Incompatible
+	}
+	if r.Inert == nil || r.SDK == nil || len(r.SDK) == 0 {
+		return Invalid
+	}
+	if len(r.Inert)+len(r.SDK) > MaxWorkers {
+		return LimitExceeded
+	}
+	ids := map[string]bool{}
+	previous := ""
+	for _, w := range r.Inert {
+		if !registryID.MatchString(w.ID) || !digestPattern.MatchString(w.Digest) || w.ID <= previous {
+			return Invalid
+		}
+		ids[w.ID], previous = true, w.ID
+	}
+	previous = ""
+	for _, w := range r.SDK {
+		if !registryID.MatchString(w.ID) || ids[w.ID] || w.ID <= previous {
+			return Invalid
+		}
+		if why := ValidateWorker(w); why != "" {
+			return why
+		}
+		if !orderedSubset(w.Actions, []Action{List, Stat, Read, ReadStream}) || !orderedSubset(w.Modes, []Mode{Interactive, Background}) ||
+			!slices.Equal(w.Checkpoints, []string{"before-step", "before-chunk", "before-result"}) {
+			return Invalid
+		}
+		if w.HandlerBinding != b.HandlerBinding || w.InputSchemaDigest != b.InputSchemaDigest || w.OutputSchemaDigest != b.OutputSchemaDigest {
+			return Incompatible
+		}
+		ids[w.ID], previous = true, w.ID
+	}
+	return ""
+}
+
+func orderedSubset[T comparable](values, allowed []T) bool {
+	previous := -1
+	for _, value := range values {
+		index := slices.Index(allowed, value)
+		if index <= previous {
+			return false
+		}
+		previous = index
+	}
+	return true
+}
+
+func DecodeRegistry(r io.Reader) (Registry, SafeReason) {
+	return decodeValidated(r, MaxArtifactBytes, ValidateRegistry)
+}
+
+// The root compiled consumer supplies its source-embedded handler fingerprint.
+func DecodeRegistryWithBindings(r io.Reader, b WorkerSourceBindings) (Registry, SafeReason) {
+	return decodeValidated(r, MaxArtifactBytes, func(r Registry) SafeReason { return validateRegistryBindings(r, b) })
+}

package/templates/native-go/backend/internal/helper/jobcontract/registry_test.go

@@ -0,0 +1,73 @@
+package jobcontract
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+)
+
+func sdkRegistryFixture() Registry {
+	b := CompiledBindings()
+	w := workerFixture()
+	w.ID = "scan"
+	w.HandlerBinding, w.InputSchemaDigest, w.OutputSchemaDigest = b.HandlerBinding, b.InputSchemaDigest, b.OutputSchemaDigest
+	return Registry{RegistrySchema: RegistrySchema, ProductionAvailability: ProductionAvailability, Inert: []InertWorker{{ID: "inert", Digest: strings.Repeat("a", 64)}}, SDK: []Worker{w}}
+}
+
+func TestCompiledRegistryBindsSourcesAndRejectsInertExecution(t *testing.T) {
+	r := sdkRegistryFixture()
+	raw, _ := json.Marshal(r)
+	if _, why := DecodeRegistry(strings.NewReader(string(raw))); why != "" {
+		t.Fatal(why)
+	}
+	for _, mutate := range []func(*Registry){
+		func(r *Registry) { r.SDK[0].HandlerBinding = strings.Repeat("b", 64) },
+		func(r *Registry) { r.SDK[0].InputSchemaDigest = strings.Repeat("b", 64) },
+		func(r *Registry) { r.SDK[0].OutputSchemaDigest = strings.Repeat("b", 64) },
+		func(r *Registry) { r.SDK[0].ID = "inert" },
+		func(r *Registry) { r.SDK[0].Kind = "developer-binary" },
+		func(r *Registry) { r.SDK[0].Limits.Steps = 17 },
+		func(r *Registry) { r.ProductionAvailability = "ready" },
+		func(r *Registry) { r.SDK = nil },
+		func(r *Registry) { r.SDK[0].Actions = []Action{Read, Stat} },
+		func(r *Registry) { r.SDK[0].Modes = []Mode{Background, Interactive} },
+		func(r *Registry) { r.SDK[0].Checkpoints = []string{"before-result", "before-step", "before-chunk"} },
+	} {
+		candidate := sdkRegistryFixture()
+		mutate(&candidate)
+		if ValidateRegistry(candidate) == "" {
+			t.Fatal("accepted changed compiled binding")
+		}
+	}
+	unsafe := strings.Replace(string(raw), `"kind":"sdk-read-plan"`, `"kind":"sdk-read-plan","executable":"/var/packages/Fixture/target/run"`, 1)
+	if _, why := DecodeRegistry(strings.NewReader(unsafe)); why == "" {
+		t.Fatal("accepted writable execution path")
+	}
+	for _, worker := range []Worker{r.SDK[0], {ID: "inert"}, {Kind: "/var/packages/Fixture/target/run"}} {
+		result := ExecuteSDKReadPlan(worker, Input{})
+		if result.SafeReason != Unavailable || result.CompletedSteps != 0 || result.Entries != 0 || result.BytesRead != 0 {
+			t.Fatalf("stub executed: %+v", result)
+		}
+	}
+}
+
+func TestFixedResultRejectsUnboundedOrSensitiveFields(t *testing.T) {
+	good := `{"resultSchema":1,"completedSteps":0,"entries":0,"bytesRead":0,"safeReason":"unavailable"}`
+	if _, why := DecodeResult(strings.NewReader(good)); why != "" {
+		t.Fatal(why)
+	}
+	for _, raw := range []string{
+		strings.Replace(good, `"entries":0`, `"entries":3201`, 1),
+		strings.Replace(good, `"bytesRead":0`, `"bytesRead":67108865`, 1),
+		strings.Replace(good, `"completedSteps":0`, `"completedSteps":17`, 1),
+		strings.Replace(good, `"unavailable"`, `"native error /private"`, 1),
+		strings.Replace(good, `"unavailable"`, `null`, 1),
+		strings.Replace(good, `"unavailable"`, `""`, 1),
+		strings.Replace(good, `"entries":0`, `"entries":0,"entries":0`, 1),
+		strings.Replace(good, `"entries":0`, `"entries":0,"path":"/private"`, 1),
+	} {
+		if _, why := DecodeResult(strings.NewReader(raw)); why == "" {
+			t.Fatalf("accepted %s", raw)
+		}
+	}
+}

package/templates/native-go/backend/internal/helper/jobcontract/result.go

@@ -0,0 +1,53 @@
+package jobcontract
+
+import "io"
+
+const ResultSchema = 1
+
+// Result is a bounded receipt shape, not file output or proof of completion/Q.
+// No paths, metadata, native errors, credentials or file bytes may be returned.
+type Result struct {
+	ResultSchema   int        `json:"resultSchema"`
+	CompletedSteps uint64     `json:"completedSteps"`
+	Entries        uint64     `json:"entries"`
+	BytesRead      uint64     `json:"bytesRead"`
+	SafeReason     SafeReason `json:"safeReason,omitempty"`
+}
+
+func ValidateResult(r Result) SafeReason {
+	if r.ResultSchema != ResultSchema {
+		return Incompatible
+	}
+	if r.CompletedSteps > MaxSteps || r.Entries > MaxSteps*200 || r.BytesRead > 64<<20 {
+		return LimitExceeded
+	}
+	if !optionalReason(r.SafeReason) {
+		return Invalid
+	}
+	return ""
+}
+
+func DecodeResult(r io.Reader) (Result, SafeReason) {
+	// A missing reason is allowed; an explicit empty/null reason is not a code.
+	var wire struct {
+		ResultSchema   int         `json:"resultSchema"`
+		CompletedSteps uint64      `json:"completedSteps"`
+		Entries        uint64      `json:"entries"`
+		BytesRead      uint64      `json:"bytesRead"`
+		SafeReason     *SafeReason `json:"safeReason,omitempty"`
+	}
+	if why := decodeObject(r, &wire, MaxProgressBytes); why != "" {
+		return Result{}, why
+	}
+	result := Result{ResultSchema: wire.ResultSchema, CompletedSteps: wire.CompletedSteps, Entries: wire.Entries, BytesRead: wire.BytesRead}
+	if wire.SafeReason != nil {
+		if !wire.SafeReason.Valid() {
+			return Result{}, Invalid
+		}
+		result.SafeReason = *wire.SafeReason
+	}
+	if why := ValidateResult(result); why != "" {
+		return Result{}, why
+	}
+	return result, ""
+}

package/templates/native-go/backend/internal/helper/jobcontract/stub.go

@@ -0,0 +1,8 @@
+package jobcontract
+
+// ExecuteSDKReadPlan is the S1 compiled stub, not an execution adapter.
+// It unconditionally refuses, including malformed plans and inert worker IDs.
+// S2 must replace it with the approved cohort/checkpoint implementation.
+func ExecuteSDKReadPlan(_ Worker, _ Input) Result {
+	return Result{ResultSchema: ResultSchema, SafeReason: Unavailable}
+}

package/templates/native-go/backend/internal/helper/jobcontract/testdata/input-digests.json

@@ -0,0 +1,127 @@
+[
+  {
+    "name": "unicode-read",
+    "input": {
+      "steps": [
+        {
+          "action": "nas.files.read",
+          "segments": [
+            "\u5831\u544a<&\ud83d\ude00"
+          ],
+          "maxBytes": 12
+        }
+      ]
+    },
+    "schemaDigest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "digest": "7e811bf2b8253e47a4b85b596c7b7224fa358470868c0fbe02b4bd05c2bf9b8e"
+  },
+  {
+    "name": "mixed-plan",
+    "input": {
+      "steps": [
+        {
+          "action": "nas.files.list",
+          "segments": [],
+          "limit": 200
+        },
+        {
+          "action": "nas.files.stat",
+          "segments": [
+            "%2f",
+            "\u00e9"
+          ]
+        },
+        {
+          "action": "nas.files.read",
+          "segments": [
+            "notes"
+          ],
+          "maxBytes": 1048576
+        },
+        {
+          "action": "nas.files.read-stream",
+          "segments": [
+            "stream"
+          ],
+          "maxBytes": 65011712
+        }
+      ]
+    },
+    "schemaDigest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "digest": "6230da3ce0b45dbec301014a03f021b113aa2a0c2c7ca656903db33e88d121eb"
+  },
+  {
+    "name": "decomposed-unicode",
+    "input": {
+      "steps": [
+        {
+          "action": "nas.files.stat",
+          "segments": [
+            "e\u0301",
+            "\u2028"
+          ]
+        }
+      ]
+    },
+    "schemaDigest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "digest": "8249aa88af2417df097ea5d1ae1d0c257adeb83d691b9fe9c8bd6800d82958f1"
+  },
+  {
+    "name": "schema-binding",
+    "input": {
+      "steps": [
+        {
+          "action": "nas.files.read",
+          "segments": [
+            "\u5831\u544a<&\ud83d\ude00"
+          ],
+          "maxBytes": 12
+        }
+      ]
+    },
+    "schemaDigest": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+    "digest": "f8da2c09bd61b87f5d85aafe4d5891253ee27c50998ad88c6475d74078aa68ee"
+  },
+  {
+    "name": "ordered-plan",
+    "input": {
+      "steps": [
+        {
+          "action": "nas.files.stat",
+          "segments": [
+            "b"
+          ]
+        },
+        {
+          "action": "nas.files.stat",
+          "segments": [
+            "a"
+          ]
+        }
+      ]
+    },
+    "schemaDigest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "digest": "77f6ce37813d28b0d575a1bfd1e1502770e803d051914ba62c4a567ee1eb9026"
+  },
+  {
+    "name": "reversed-plan",
+    "input": {
+      "steps": [
+        {
+          "action": "nas.files.stat",
+          "segments": [
+            "a"
+          ]
+        },
+        {
+          "action": "nas.files.stat",
+          "segments": [
+            "b"
+          ]
+        }
+      ]
+    },
+    "schemaDigest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "digest": "93b555a999876d884fa166c1bfb19704554e218bc13ad2cd30be7bbc9069b976"
+  }
+]

package/templates/native-go/backend/internal/helper/jobcontract/types.go

@@ -0,0 +1,234 @@
+// Package jobcontract defines M3 S0 shapes only. It has no routes, storage,
+// scheduler, process execution, identity provider, or production assembly.
+package jobcontract
+
+const (
+	DataProtocol             = 2
+	JobSchema                = 1
+	RegistrySchema           = 2
+	BackgroundSchema         = 2 // future record discriminator, NOT a GrantStore migration
+	ProductionAvailability   = "unavailable"
+	MaxSafeInteger           = 1<<53 - 1 // exact in both Go and TypeScript JSON
+	MaxControlBytes          = 16 << 10
+	MaxInputBytes            = 8 << 10
+	MaxSteps                 = 16
+	MaxWorkers               = 16
+	MaxInertWorkerBytes      = 1 << 20
+	MaxChildren              = 4
+	MaxUIDChildren           = 2
+	MaxBackgroundChildren    = 2
+	MaxUIDBackgroundChildren = 1
+	MaxPending               = 16
+	MaxUIDPending            = 2
+	MaxRetryAfterMS          = 1000
+	MaxAuthorityRecords      = 256 // grants + background records, including tombstones
+	MaxSnapshotBytes         = 1 << 20
+	MaxExecutionKeys         = 256 // lifetime, retained; no eviction
+	MaxArtifactBytes         = 16 << 10
+	MaxMutationControls      = 256 // per epoch, shared across both modes
+	MaxProgressBytes         = 1024
+	MaxProgressPerSecond     = 1
+	MaxProgressPackets       = 128
+	MaxProgressRing          = 32
+	MaxStatusBytes           = 16 << 10
+	MaxStatusJobs            = 10
+	MaxStatusConcurrent      = 8
+	MaxUIDStatusPerSecond    = 2
+	IntentTTLMS              = 30_000
+	DefaultBackgroundTTLMS   = 86_400_000
+	MaxBackgroundTTLMS       = 604_800_000
+	NativeProofFreshnessMS   = 2000
+	DrainMS                  = 2000
+	TerminateGraceMS         = 1000
+)
+
+type Mode string
+
+const (
+	Interactive Mode = "interactive"
+	Background  Mode = "background"
+)
+
+type Action string
+
+const (
+	List       Action = "nas.files.list"
+	Stat       Action = "nas.files.stat"
+	Read       Action = "nas.files.read"
+	ReadStream Action = "nas.files.read-stream"
+)
+
+type State string
+
+const (
+	Pending         State = "pending"
+	Running         State = "running"
+	CancelRequested State = "cancel-requested"
+	Draining        State = "draining"
+	Succeeded       State = "succeeded"
+	Failed          State = "failed"
+	Canceled        State = "canceled"
+	Interrupted     State = "interrupted"
+	CleanupRequired State = "cleanup-required"
+)
+
+// SafeReason is a closed code, never native errors, stderr, paths or text.
+type SafeReason string
+
+const (
+	Invalid               SafeReason = "invalid-request"
+	Incompatible          SafeReason = "incompatible"
+	Unsupported           SafeReason = "unsupported"
+	Replay                SafeReason = "replay"
+	Stale                 SafeReason = "stale"
+	Expired               SafeReason = "expired"
+	Denied                SafeReason = "denied"
+	Unavailable           SafeReason = "unavailable"
+	Suspended             SafeReason = "suspended"
+	Revoked               SafeReason = "revoked"
+	Fenced                SafeReason = "fenced"
+	Busy                  SafeReason = "busy"
+	LimitExceeded         SafeReason = "limit-exceeded"
+	ReasonCanceled        SafeReason = "canceled"
+	Timeout               SafeReason = "timeout"
+	Partial               SafeReason = "partial"
+	CommitUncertain       SafeReason = "commit-uncertain"
+	ReasonCleanupRequired SafeReason = "cleanup-required"
+	Internal              SafeReason = "internal"
+)
+
+type Inventory struct {
+	Package        string `json:"package"`
+	Version        string `json:"version"`
+	Protocol       int    `json:"protocol"`
+	PayloadDigest  string `json:"payloadDigest"`
+	RegistryDigest string `json:"registryDigest"`
+	DataAccess     string `json:"dataAccess"` // M3 requires explicit S1R relaxed
+}
+
+// All limits are positive and may only be lowered, never raised by a manifest.
+type Limits struct {
+	InputBytes        uint64 `json:"inputBytes"`
+	Steps             uint64 `json:"steps"`
+	TotalMS           uint64 `json:"totalMs"`
+	IdleMS            uint64 `json:"idleMs"`
+	MetadataMS        uint64 `json:"metadataMs"`
+	BoundedMS         uint64 `json:"boundedMs"`
+	BoundedBytes      uint64 `json:"boundedBytes"`
+	StreamBytes       uint64 `json:"streamBytes"`
+	ChunkBytes        uint64 `json:"chunkBytes"`
+	OutstandingLeases uint64 `json:"outstandingLeases"`
+}
+
+type Worker struct {
+	RegistrySchema     int      `json:"registrySchema"`
+	ID                 string   `json:"workerId"`
+	Revision           uint64   `json:"workerRevision"`
+	Kind               string   `json:"kind"`           // sdk-read-plan only; no arbitrary handler injection
+	HandlerBinding     string   `json:"handlerBinding"` // compiled payload binding
+	InputSchemaDigest  string   `json:"inputSchemaDigest"`
+	OutputSchemaDigest string   `json:"outputSchemaDigest"`
+	Actions            []Action `json:"actions"`
+	Modes              []Mode   `json:"modes"`
+	Checkpoints        []string `json:"checkpoints"`
+	Limits             Limits   `json:"limits"`
+}
+
+// Fixed, ordered, nonrecursive plan. Optional fields are action-specific;
+// absence differs from zero/null. There are no cursor/offset/argv/env fields.
+type Step struct {
+	Action   Action   `json:"action"`
+	Segments []string `json:"segments"`
+	Limit    *uint64  `json:"limit,omitempty"`
+	MaxBytes *uint64  `json:"maxBytes,omitempty"`
+}
+type Input struct {
+	Steps []Step `json:"steps"`
+}
+type RevisionRef struct {
+	ID       string `json:"id"`
+	Revision uint64 `json:"revision"`
+}
+
+// Binding is public control metadata, not an identity or bearer capability.
+// SessionRef and the root-derived actor exist only in PrivateBinding.
+type Binding struct {
+	Inventory         Inventory    `json:"inventory"`
+	JobSchema         int          `json:"jobSchema"`
+	Epoch             string       `json:"epoch"`
+	Job               RevisionRef  `json:"job"`
+	Worker            RevisionRef  `json:"worker"`
+	ParentGrant       RevisionRef  `json:"parentGrant"`
+	ApprovalBinding   string       `json:"approvalBinding"`
+	CapabilityDigest  string       `json:"capabilityDigest"`
+	InputSchemaDigest string       `json:"inputSchemaDigest"`
+	InputDigest       string       `json:"inputDigest"`
+	Mode              Mode         `json:"mode"`
+	Delegation        *RevisionRef `json:"delegation,omitempty"`
+}
+
+// Principal follows S1R. UID+exact username are continuity, not incarnation.
+// Private records never accept a caller claim as proof or expose this in status.
+type Principal struct {
+	IdentityBasis string `json:"identityBasis"` // uid-username
+	UID           uint32 `json:"uid"`
+	Username      string `json:"username"`
+}
+type PrivateBinding struct {
+	Binding    Binding   `json:"binding"`
+	Actor      Principal `json:"actor"`
+	SessionRef string    `json:"sessionRef,omitempty"` // interactive only
+}
+
+type Intent struct {
+	JobSchema     int            `json:"jobSchema"`
+	ID            string         `json:"intentId"`
+	Revision      uint64         `json:"intentRevision"`
+	Binding       PrivateBinding `json:"binding"`
+	Input         Input          `json:"input"`
+	SummaryDigest string         `json:"summaryDigest"`
+	CreatedAt     uint64         `json:"createdAt"`
+	ExpiresAt     uint64         `json:"expiresAt"`
+}
+
+type BackgroundRecord struct {
+	BackgroundSchema int            `json:"backgroundSchema"`
+	Binding          PrivateBinding `json:"binding"`
+	Issuer           Principal      `json:"issuer"` // actor's own consent, not shared-grant issuer
+	CreatedAt        uint64         `json:"createdAt"`
+	ExpiresAt        uint64         `json:"expiresAt"`
+	NotBefore        uint64         `json:"notBefore"`
+	State            string         `json:"state"` // active/consumed/expired/revoked/suspended
+	Reason           SafeReason     `json:"reason,omitempty"`
+	ExecutionKey     string         `json:"executionKey,omitempty"` // consumed stays burned
+}
+
+type Progress struct {
+	Sequence       uint64  `json:"sequence"`
+	Phase          string  `json:"phase"` // starting/metadata/reading/finishing
+	CompletedUnits uint64  `json:"completedUnits"`
+	TotalUnits     *uint64 `json:"totalUnits,omitempty"` // absent means indeterminate
+	BytesRead      uint64  `json:"bytesRead"`
+	BytesWritten   uint64  `json:"bytesWritten"`
+}
+type Job struct {
+	Binding         Binding    `json:"binding"`
+	State           State      `json:"state"`
+	Reason          SafeReason `json:"safeReason,omitempty"`
+	Progress        Progress   `json:"progress"`
+	AcceptedAt      uint64     `json:"acceptedAt"`
+	StartedAt       *uint64    `json:"startedAt,omitempty"`
+	FinishedAt      *uint64    `json:"finishedAt,omitempty"`
+	CancelRequested bool       `json:"cancelRequested"`
+	Drained         bool       `json:"drained"` // assertion only; parser cannot establish Q
+	EffectsUnknown  bool       `json:"effectsUnknown"`
+}
+
+// Proposed opcodes are DTOs only. No production dispatcher registers them.
+type Control struct {
+	Op      string      `json:"op"` // jobs.submit/jobs.cancel/background.revoke
+	Binding Binding     `json:"binding"`
+	Intent  RevisionRef `json:"intent"`
+	Nonce   string      `json:"nonce"`
+	Ticket  string      `json:"ticket"`
+}

package/templates/native-go/backend/internal/helper/jobcontract/types_test.go

@@ -0,0 +1,29 @@
+package jobcontract
+
+import "testing"
+
+func TestContractVersionsAndCeilings(t *testing.T) {
+	if DataProtocol != 2 || JobSchema != 1 || RegistrySchema != 2 || BackgroundSchema != 2 {
+		t.Fatal("independent contract versions changed")
+	}
+	if ProductionAvailability != "unavailable" || MaxControlBytes != 16384 || MaxInputBytes != 8192 || MaxSteps != 16 {
+		t.Fatal("S0 must stay unavailable and bounded")
+	}
+	if MaxChildren != 4 || MaxUIDChildren != 2 || MaxBackgroundChildren != 2 || MaxUIDBackgroundChildren != 1 || MaxPending != 16 || MaxUIDPending != 2 {
+		t.Fatal("shared reservations must retain interactive capacity")
+	}
+	if MaxAuthorityRecords != 256 || MaxSnapshotBytes != 1<<20 || MaxExecutionKeys != 256 || MaxMutationControls != 256 {
+		t.Fatal("retained tombstone/replay ceilings changed")
+	}
+	if DefaultBackgroundTTLMS != 86400000 || MaxBackgroundTTLMS != 604800000 || IntentTTLMS != 30000 {
+		t.Fatal("intent TTL must not become delegation TTL")
+	}
+	if MaxProgressBytes != 1024 || MaxProgressPackets != 128 || MaxProgressRing != 32 || MaxStatusJobs != 10 || MaxStatusConcurrent != 8 || MaxUIDStatusPerSecond != 2 {
+		t.Fatal("status/progress ceilings changed")
+	}
+	var _ Worker
+	var _ Intent
+	var _ Job
+	var _ BackgroundRecord
+	var _ Control
+}