@synopackageland/cli 0.5.3 → 0.6.1

package/templates/native-go/backend/internal/helper/server_linux.go

@@ -1,136 +0,0 @@
-//go:build !synopkgland_sdk_workers
-
-//line dsmapp/internal/helper/server_linux.go:1
-package helper
-
-import (
-	"crypto/rand"
-	"encoding/hex"
-	"encoding/json"
-	"io"
-	"net"
-	"os"
-	"os/user"
-	"path/filepath"
-	"strconv"
-	"time"
-)
-
-func serveLinux(c Client) error {
-	r, err := readRecord(c.StateDir, 0)
-	if err != nil || !r.Enabled || r.Inventory != c.Expected || r.Lifecycle == nil || r.Lifecycle.Phase != "running" {
-		return errTrust
-	}
-	// Only the supervisor writes process.json.
-	// The package group can connect; ordinary users reach only the authenticated
-	// CGI status route. SO_PEERCRED also checks the package's current numeric UID.
-	u, err := user.Lookup(c.Expected.Package)
-	if err != nil {
-		return err
-	}
-	uid, err := strconv.ParseUint(u.Uid, 10, 32)
-	if err != nil {
-		return err
-	}
-	group, err := user.LookupGroup(c.Expected.Package)
-	if err != nil {
-		return err
-	}
-	gid, err := strconv.Atoi(group.Gid)
-	if err != nil {
-		return err
-	}
-	socket := filepath.Join(c.RunDir, "helper.sock")
-	l, err := net.ListenUnix("unix", &net.UnixAddr{Name: socket, Net: "unix"})
-	if err != nil {
-		return err
-	}
-	l.SetUnlinkOnClose(false)
-	defer l.Close()
-	if err := os.Chown(socket, 0, gid); err != nil {
-		return err
-	}
-	if err := os.Chmod(socket, 0660); err != nil {
-		return err
-	}
-	// Bound concurrency and each frame. The authenticated package UID may only
-	// withdraw authority; activation remains an exact approved root task.
-	slots := make(chan struct{}, 8)
-	for {
-		conn, err := l.AcceptUnix()
-		if err != nil {
-			return err
-		}
-		select {
-		case slots <- struct{}{}:
-		default:
-			conn.Close()
-			continue
-		}
-		go func() {
-			defer func() { conn.Close(); <-slots }()
-			peer, err := peerUID(conn)
-			if err != nil || (peer != 0 && peer != uint32(uid)) {
-				return
-			}
-			conn.SetDeadline(time.Now().Add(time.Second))
-			var req Request
-			d := json.NewDecoder(io.LimitReader(conn, 4097))
-			d.DisallowUnknownFields()
-			if d.Decode(&req) != nil {
-				return
-			}
-			if req.Op == "revoke" {
-				err := packageRevoke(c, req)
-				res := Response{Inventory: c.Expected, Nonce: req.Nonce, OK: err == nil}
-				if err != nil {
-					res.Error = "revoke-refused"
-				}
-				json.NewEncoder(conn).Encode(res)
-				return
-			}
-			r, err := readRecord(c.StateDir, 0)
-			readiness := "fenced"
-			if err == nil && r.Enabled && r.Inventory == c.Expected && r.Lifecycle != nil && r.Lifecycle.Phase == "running" {
-				readiness = parentReadiness(c)
-			}
-			res := Respond(c.Expected, readiness != "ready", req)
-			if readiness != "ready" {
-				res.Error = readiness
-			}
-			json.NewEncoder(conn).Encode(res)
-		}()
-	}
-}
-
-// No lifecycle mutations: only the exact owned child can request admission.
-func parentReadiness(c Client) string {
-	p, err := readProcess(c.RunDir, 0)
-	if err != nil || p.PID != os.Getppid() {
-		return "fenced"
-	}
-	actual, err := inspectSupervisor(p.PID, c.Expected)
-	if err != nil || actual != p {
-		return "fenced"
-	}
-	conn, err := net.DialTimeout("unix", filepath.Join(c.RunDir, "supervisor.sock"), 100*time.Millisecond)
-	if err != nil {
-		return "fenced"
-	}
-	defer conn.Close()
-	peer, err := peerCredentials(conn.(*net.UnixConn))
-	if err != nil || peer.Uid != 0 || int(peer.Pid) != p.PID {
-		return "fenced"
-	}
-	conn.SetDeadline(time.Now().Add(200 * time.Millisecond))
-	var nonce [32]byte
-	if _, err := rand.Read(nonce[:]); err != nil {
-		return "fenced"
-	}
-	req := supervisorRequest{Process: p, Op: "admit", Nonce: hex.EncodeToString(nonce[:])}
-	if json.NewEncoder(conn).Encode(req) != nil {
-		return "fenced"
-	}
-	res, err := decodeSupervisorReply(conn, c.Expected, req.Nonce)
-	return supervisorReadiness(res, err)
-}

package/templates/native-go/backend/internal/helper/stale_management_linux_test.go

@@ -1,126 +0,0 @@
-package helper
-
-import (
-	"context"
-	"encoding/json"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"syscall"
-	"testing"
-)
-
-func TestLinuxStaleManagementPackageUser(t *testing.T) {
-	if raw := os.Getenv("T0059_MANAGEMENT_CLIENT"); raw != "" {
-		var c Client
-		if json.Unmarshal([]byte(raw), &c) != nil {
-			t.Fatal("bad child config")
-		}
-		if os.Geteuid() == 0 {
-			t.Fatal("child remained root")
-		}
-		if b, err := os.ReadFile(filepath.Join(c.StateDir, "approval.json")); err != nil || len(b) == 0 {
-			t.Fatal("approval unreadable", err)
-		}
-		r, err := readRecord(c.StateDir, 0)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if _, err := os.ReadFile(filepath.Join(c.StateDir, "completion-"+r.Lifecycle.Epoch+".json")); !os.IsPermission(err) {
-			t.Fatal("private proof was readable", err)
-		}
-		s := c.Status(context.Background())
-		if s.Reason != "inventory-mismatch" {
-			t.Fatal(s)
-		}
-		err = c.CheckStopped(context.Background())
-		if (err == nil) != (os.Getenv("T0059_EXPECT_STOPPED") == "yes") {
-			t.Fatal("package user decision", err)
-		}
-		return
-	}
-	if os.Geteuid() != 0 {
-		t.Skip("requires disposable Linux root container")
-	}
-	c := stoppedStaleFixture(t)
-	// Publish fixture under directly traversable /tmp, retaining private proof modes.
-	state, err := os.MkdirTemp("/tmp", "t0059-state-")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer os.RemoveAll(state)
-	entries, err := os.ReadDir(c.StateDir)
-	if err != nil {
-		t.Fatal(err)
-	}
-	// Rename each file to preserve the lease's device/inode witness.
-	for _, entry := range entries {
-		if err := os.Rename(filepath.Join(c.StateDir, entry.Name()), filepath.Join(state, entry.Name())); err != nil {
-			t.Fatal(err)
-		}
-	}
-	c.StateDir = state
-	os.Chmod(c.StateDir, 0755)
-	os.Chmod(c.RunDir, 0755)
-	exe, err := os.Executable()
-	if err != nil {
-		t.Fatal(err)
-	}
-	bin, err := os.CreateTemp("/tmp", "t0059-test-")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer os.Remove(bin.Name())
-	data, err := os.ReadFile(exe)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err = bin.Write(data); err != nil {
-		t.Fatal(err)
-	}
-	bin.Chmod(0755)
-	bin.Close()
-	// Client.Peer is a function; use only the public filesystem client fields.
-	raw, err := json.Marshal(struct {
-		Expected         Inventory
-		StateDir, RunDir string
-		Owner            uint32
-	}{c.Expected, c.StateDir, c.RunDir, c.Owner})
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, kind := range []string{"sealed", "residue", "foreign", "noncanonical", "lease-replaced"} {
-		t.Run(kind, func(t *testing.T) {
-			approval := filepath.Join(c.StateDir, "approval.json")
-			original, _ := os.ReadFile(approval)
-			r, _ := readRecord(c.StateDir, c.Owner)
-			switch kind {
-			case "residue":
-				os.WriteFile(filepath.Join(c.RunDir, "process.json"), []byte("private"), 0600)
-				defer os.Remove(filepath.Join(c.RunDir, "process.json"))
-			case "foreign":
-				r.Inventory.Package = "Foreign"
-				record(t, c, r)
-				defer os.WriteFile(approval, original, 0644)
-			case "noncanonical":
-				os.WriteFile(approval, append(original, '\n'), 0644)
-				defer os.WriteFile(approval, original, 0644)
-			case "lease-replaced":
-				p := leasePath(c, r.Lifecycle)
-				os.Rename(p, p+".old")
-				os.WriteFile(p, []byte(r.Lifecycle.Epoch), 0600)
-				defer os.Rename(p+".old", p)
-			}
-			want := "no"
-			if kind == "sealed" {
-				want = "yes"
-			}
-			cmd := exec.Command(bin.Name(), "-test.run=^TestLinuxStaleManagementPackageUser$", "-test.v")
-			cmd.Env = append(os.Environ(), "T0059_MANAGEMENT_CLIENT="+string(raw), "T0059_EXPECT_STOPPED="+want)
-			cmd.SysProcAttr = &syscall.SysProcAttr{Credential: &syscall.Credential{Uid: 65534, Gid: 65534}}
-			if out, err := cmd.CombinedOutput(); err != nil {
-				t.Fatalf("nonprivileged hook: %v\n%s", err, out)
-			}
-		})
-	}
-}

package/templates/native-go/backend/internal/helper/stale_management_test.go

@@ -1,122 +0,0 @@
-package helper
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-	"strings"
-	"syscall"
-	"testing"
-)
-
-func stoppedStaleFixture(t *testing.T) Client {
-	t.Helper()
-	c, _, _ := repairFixture(t)
-	if err := c.Control(context.Background(), "repair"); err != nil {
-		t.Fatal(err)
-	}
-	c.Expected.Version = "1.0.0-0002"
-	c.Expected.PayloadDigest = strings.Repeat("c", 64)
-	return c.Client
-}
-func TestStaleApprovalManagementQuiescence(t *testing.T) {
-	c := stoppedStaleFixture(t)
-	before, _ := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
-	s := c.Status(context.Background())
-	if s.State != "incompatible" || s.Reason != "inventory-mismatch" {
-		t.Fatal(s)
-	}
-	if err := c.CheckStopped(context.Background()); err != nil {
-		t.Fatal("sealed old approval vetoed normal management", err)
-	}
-	after, _ := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
-	if string(before) != string(after) {
-		t.Fatal("management mutated approval")
-	}
-}
-func TestStaleApprovalManagementRejectsUntrustedProof(t *testing.T) {
-	for _, kind := range []string{"foreign", "residual", "running", "fenced", "no-completion", "no-lease", "legacy", "completion-corrupt", "completion-mode", "completion-symlink", "lease-missing", "lease-replaced", "lease-busy", "lease-mode", "record-mode", "record-duplicate", "runtime-mode", "process.json", "helper.sock", "supervisor.sock"} {
-		t.Run(kind, func(t *testing.T) {
-			c := stoppedStaleFixture(t)
-			r, err := readRecord(c.StateDir, c.Owner)
-			if err != nil {
-				t.Fatal(err)
-			}
-			approval := filepath.Join(c.StateDir, "approval.json")
-			proof := filepath.Join(c.StateDir, "completion-"+r.Lifecycle.Epoch+".json")
-			lease := leasePath(c, r.Lifecycle)
-			switch kind {
-			case "foreign":
-				c.Expected.Package = "Foreign"
-			case "residual":
-				r.Residual = true
-				record(t, c, r)
-			case "running", "fenced":
-				r.Lifecycle.Phase = kind
-				r.Lifecycle.Completion = ""
-				record(t, c, r)
-			case "no-completion":
-				r.Lifecycle.Completion = ""
-				record(t, c, r)
-			case "no-lease":
-				r.Lifecycle.Lease = nil
-				record(t, c, r)
-			case "legacy":
-				r.Schema = 0
-				r.Lifecycle = nil
-				record(t, c, r)
-			case "completion-corrupt":
-				os.WriteFile(proof, []byte(`{}`), 0600)
-			case "completion-mode":
-				os.Chmod(proof, 0644)
-			case "completion-symlink":
-				os.Rename(proof, proof+".old")
-				os.Symlink(proof+".old", proof)
-			case "lease-missing":
-				os.Remove(lease)
-			case "lease-replaced":
-				os.Rename(lease, lease+".old")
-				os.WriteFile(lease, []byte(r.Lifecycle.Epoch), 0600)
-			case "lease-busy":
-				f, e := acquireLifetime(c, r.Lifecycle)
-				if e != nil {
-					t.Fatal(e)
-				}
-				defer f.Close()
-			case "lease-mode":
-				os.Chmod(lease, 0644)
-			case "record-mode":
-				os.Chmod(approval, 0666)
-			case "record-duplicate":
-				b, _ := os.ReadFile(approval)
-				os.WriteFile(approval, append([]byte(`{"enabled":true,`), b[1:]...), 0644)
-			case "runtime-mode":
-				os.Chmod(c.RunDir, 0777)
-			default:
-				os.WriteFile(filepath.Join(c.RunDir, kind), []byte("residue"), 0600)
-			}
-			if c.CheckStopped(context.Background()) == nil {
-				t.Fatal("unsafe management admitted", kind)
-			}
-		})
-	}
-}
-
-// Ensure the test really exercises an OS lock, not a synthetic busy flag.
-func TestStaleLeaseLockIsKernelHeld(t *testing.T) {
-	c := stoppedStaleFixture(t)
-	r, _ := readRecord(c.StateDir, c.Owner)
-	f, err := acquireLifetime(c, r.Lifecycle)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer f.Close()
-	other, err := os.OpenFile(leasePath(c, r.Lifecycle), os.O_RDWR, 0)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer other.Close()
-	if syscall.Flock(int(other.Fd()), syscall.LOCK_EX|syscall.LOCK_NB) == nil {
-		t.Fatal("fixture lease not held")
-	}
-}

package/templates/native-go/backend/internal/helper/startup_diagnostic.go

@@ -1,68 +0,0 @@
-package helper
-
-import (
-	"encoding/json"
-	"io"
-	"os"
-	"path/filepath"
-	"syscall"
-)
-
-// StartupFailure contains only fixed branch names and protocol codes. It is
-// intentionally separate from State, which is exposed to every signed-in user.
-type StartupFailure struct {
-	Stage string `json:"stage"`
-	Code  Code   `json:"code"`
-}
-
-func startupStageValid(stage string) bool {
-	switch stage {
-	case "grants-open", "jobs-registry", "jobs-journal-load", "journal-decode", "jobs-owner", "background-index", "session-history", "startup-unknown":
-		return true
-	}
-	return false
-}
-
-func (g *admission) fenceStartup(stage string, code Code) {
-	if !startupStageValid(stage) {
-		stage = "startup-unknown"
-	}
-	if !code.Valid() {
-		code = ErrUnavailable
-	}
-	g.fenceObserver("grant-authority-unavailable", observerEvent{Detail: "grant-authority-unavailable", Stage: stage, Code: code})
-}
-
-// StartupDiagnostic is an explicit root-only diagnostic, also available after
-// runtime teardown. It never authorizes readiness or recovery. The CLI calls it
-// using LocalClient so the diagnostic must match this build and approval epoch.
-func (c Client) StartupDiagnostic() (StartupFailure, error) {
-	var out StartupFailure
-	if os.Geteuid() != 0 || c.Owner != 0 {
-		return out, errTrust
-	}
-	r, err := readRecord(c.StateDir, 0)
-	if err != nil || r.Inventory != c.Expected || r.Lifecycle == nil || r.Lifecycle.Reason != "grant-authority-unavailable" {
-		return out, errTrust
-	}
-	f, err := os.OpenFile(filepath.Join(c.StateDir, "observer-diagnostic.json"), os.O_RDONLY|syscall.O_NOFOLLOW, 0)
-	if err != nil {
-		return out, errTrust
-	}
-	defer f.Close()
-	st, err := f.Stat()
-	if err != nil {
-		return out, errTrust
-	}
-	owner, ok := st.Sys().(*syscall.Stat_t)
-	if !ok || owner.Uid != 0 || !st.Mode().IsRegular() || st.Mode().Perm() != 0600 || st.Size() > observerDiagnosticLimit {
-		return out, errTrust
-	}
-	var d observerDiagnostic
-	decoder := json.NewDecoder(io.LimitReader(f, observerDiagnosticLimit+1))
-	decoder.DisallowUnknownFields()
-	if decoder.Decode(&d) != nil || decoder.Decode(&struct{}{}) != io.EOF || d.Schema != 1 || d.Epoch != r.Lifecycle.Epoch || d.Reason != r.Lifecycle.Reason || d.Fence.Kind != "fence" || !startupStageValid(d.Fence.Stage) || !d.Fence.Code.Valid() {
-		return out, errTrust
-	}
-	return StartupFailure{Stage: d.Fence.Stage, Code: d.Fence.Code}, nil
-}

package/templates/native-go/backend/internal/helper/startup_diagnostic_linux_test.go

@@ -1,126 +0,0 @@
-//go:build linux && synopkgland_sdk_workers
-
-package helper
-
-import (
-	"encoding/json"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"syscall"
-	"testing"
-)
-
-func TestLinuxStartupJournalFailureStages(t *testing.T) {
-	for _, tc := range []struct {
-		name, contents, stage string
-		code                  Code
-	}{
-		{"malformed-json", "{", "journal-decode", ErrInvalid},
-		{"unsafe-name", "{}", "jobs-journal-load", ErrCleanupRequired},
-		{"unsupported-schema", `{"schema":99}`, "journal-decode", ErrIncompatible},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			dir, inv, _ := rootGrantFixture(t)
-			r := openRootGrantRepository(t, dir, inv)
-			name := "job-intent-" + grantRef('a') + ".json"
-			if tc.name == "unsupported-schema" {
-				raw, err := json.Marshal(sdkJournalRecord{Schema: 99, Intent: sdkJournalIntentFixture(t), State: "pending"})
-				if err != nil {
-					t.Fatal(err)
-				}
-				tc.contents = string(raw)
-			}
-			if tc.name == "unsafe-name" {
-				name = "job-intent-unsafe.json"
-			}
-			if err := os.WriteFile(filepath.Join(dir, name), []byte(tc.contents), 0600); err != nil {
-				t.Fatal(err)
-			}
-			_, code, stage := newSDKFileJobJournalDiagnostic(r)
-			if code != tc.code || stage != tc.stage {
-				t.Fatalf("got %s/%s want %s/%s", stage, code, tc.stage, tc.code)
-			}
-			// The real assembly must propagate the low-level decoder stage.
-			old := sdkCompiledRegistry
-			sdkCompiledRegistry = []byte(`{}`)
-			defer func() { sdkCompiledRegistry = old }()
-			r.Close()
-			r = openRootGrantRepository(t, dir, inv)
-			_, code, stage = openSDKJobs(Client{Expected: inv}, "", nil, r)
-			if code != tc.code || stage != tc.stage {
-				t.Fatalf("assembly lost stage: %s/%s", stage, code)
-			}
-		})
-	}
-}
-
-func TestLinuxStartupDiagnosticPrivateReadback(t *testing.T) {
-	dir, inv, r := rootGrantFixture(t)
-	c := Client{Expected: inv, StateDir: dir}
-	g := newAdmission(r.Lifecycle.Binding)
-	g.fenceStartup("journal-decode", ErrInvalid)
-	persistObserverDiagnostic(c, r.Lifecycle.Epoch, g)
-	if err := fenceRecord(c, r.Lifecycle.Epoch, g.reason()); err != nil {
-		t.Fatal(err)
-	}
-	got, err := c.StartupDiagnostic()
-	if err != nil || got.Stage != "journal-decode" || got.Code != ErrInvalid {
-		t.Fatalf("private read: %+v %v", got, err)
-	}
-	raw, _ := json.Marshal(got)
-	if string(raw) != `{"stage":"journal-decode","code":"invalid-request"}` {
-		t.Fatalf("unexpected export: %s", raw)
-	}
-	for _, change := range []string{"epoch", "code", "stage", "permissions", "symlink", "oversize"} {
-		t.Run(change, func(t *testing.T) {
-			path := filepath.Join(dir, "observer-diagnostic.json")
-			os.Remove(path)
-			d := g.observerDiagnostic(r.Lifecycle.Epoch)
-			switch change {
-			case "epoch":
-				d.Epoch = grantRef('f')
-			case "code":
-				d.Fence.Code = "secret"
-			case "stage":
-				d.Fence.Stage = "/private/path"
-			}
-			if err := writeProtected(dir, "observer-diagnostic.json", d); err != nil {
-				t.Fatal(err)
-			}
-			switch change {
-			case "permissions":
-				os.Chmod(path, 0644)
-			case "symlink":
-				os.Rename(path, path+".target")
-				os.Symlink(path+".target", path)
-			case "oversize":
-				os.WriteFile(path, make([]byte, observerDiagnosticLimit+1), 0600)
-			}
-			if _, err := c.StartupDiagnostic(); err == nil {
-				t.Fatal("untrusted diagnostic accepted")
-			}
-		})
-	}
-}
-
-func TestLinuxStartupDiagnosticRejectsNonroot(t *testing.T) {
-	if os.Getenv("T0092_DIAGNOSTIC_CHILD") == "1" {
-		if os.Geteuid() == 0 {
-			t.Fatal("credential drop failed")
-		}
-		if _, err := (Client{Owner: 0}).StartupDiagnostic(); err == nil {
-			t.Fatal("nonroot accepted")
-		}
-		return
-	}
-	if os.Geteuid() != 0 {
-		t.Skip("requires disposable Linux root VM")
-	}
-	cmd := exec.Command(os.Args[0], "-test.run=^TestLinuxStartupDiagnosticRejectsNonroot$")
-	cmd.Env = append(os.Environ(), "T0092_DIAGNOSTIC_CHILD=1")
-	cmd.SysProcAttr = &syscall.SysProcAttr{Credential: &syscall.Credential{Uid: 65534, Gid: 65534}}
-	if output, err := cmd.CombinedOutput(); err != nil {
-		t.Fatalf("nonroot diagnostic test failed: %s %v", output, err)
-	}
-}

package/templates/native-go/backend/internal/helper/startup_diagnostic_test.go

@@ -1,117 +0,0 @@
-package helper
-
-import (
-	"context"
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-)
-
-func TestStartupDiagnosticStructure(t *testing.T) {
-	event := observerEvent{Stage: "journal-decode", Code: ErrInvalid}
-	raw, err := json.Marshal(event)
-	if err != nil || !strings.Contains(string(raw), `"stage":"journal-decode"`) || !strings.Contains(string(raw), `"code":"invalid-request"`) {
-		t.Fatalf("missing structured failure: %s %v", raw, err)
-	}
-	raw, err = json.Marshal(observerEvent{})
-	if err != nil || strings.Contains(string(raw), `"stage"`) || strings.Contains(string(raw), `"code"`) {
-		t.Fatalf("changed legacy event: %s %v", raw, err)
-	}
-}
-
-func TestStartupFenceFirstCausePrivacyAndPersistence(t *testing.T) {
-	for _, tc := range []struct {
-		stage     string
-		code      Code
-		wantStage string
-		wantCode  Code
-	}{
-		{"grants-open", ErrBusy, "grants-open", ErrBusy},
-		{"jobs-journal-load", ErrUnavailable, "jobs-journal-load", ErrUnavailable},
-		{"journal-decode", ErrInvalid, "journal-decode", ErrInvalid},
-		{"background-index", ErrCleanupRequired, "background-index", ErrCleanupRequired},
-		{"session-history", ErrStale, "session-history", ErrStale},
-		{"/sensitive/path", Code("secret credential"), "startup-unknown", ErrUnavailable},
-	} {
-		t.Run(tc.wantStage, func(t *testing.T) {
-			c := fixture(t)
-			g := newAdmission(testBinding())
-			g.fenceStartup(tc.stage, tc.code)
-			g.fenceStartup("grants-open", ErrDenied)
-			for n := 0; n < observerEventLimit+10; n++ {
-				g.recordObserver(observerEvent{Kind: "query-ok"})
-			}
-			d := g.observerDiagnostic(strings.Repeat("e", 64))
-			if d.Reason != "grant-authority-unavailable" || d.Fence.Stage != tc.wantStage || d.Fence.Code != tc.wantCode || g.allow(time.Now()) {
-				t.Fatalf("failure lost: %+v", d)
-			}
-			persistObserverDiagnostic(c, d.Epoch, g)
-			raw, err := os.ReadFile(filepath.Join(c.StateDir, "observer-diagnostic.json"))
-			if err != nil {
-				t.Fatal(err)
-			}
-			var saved observerDiagnostic
-			if json.Unmarshal(raw, &saved) != nil || saved.Fence.Stage != tc.wantStage || saved.Fence.Code != tc.wantCode || strings.Contains(string(raw), "sensitive") || strings.Contains(string(raw), "secret") {
-				t.Fatal("unsafe or missing saved failure")
-			}
-			public, _ := json.Marshal(c.Status(context.Background()))
-			if strings.Contains(string(public), `"stage"`) || strings.Contains(string(public), `"code"`) {
-				t.Fatal("public state leaked startup detail")
-			}
-		})
-	}
-	g := newAdmission(testBinding())
-	g.fence("admin-stop")
-	g.fenceStartup("journal-decode", ErrInvalid)
-	if d := g.observerDiagnostic(""); d.Reason != "admin-stop" || d.Fence.Stage != "" {
-		t.Fatal("overwrote earlier fence")
-	}
-}
-
-func TestStartupDiagnosticRequiresRoot(t *testing.T) {
-	c := fixture(t)
-	c.Owner = uint32(os.Geteuid())
-	if os.Geteuid() != 0 {
-		if _, err := c.StartupDiagnostic(); err == nil {
-			t.Fatal("nonroot diagnostic accepted")
-		}
-	}
-}
-
-func TestStartupDiagnosticWriteFailureKeepsFenceAndCompletion(t *testing.T) {
-	c := fixture(t)
-	binding := testBinding()
-	l, err := newLifecycle(binding)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err = writeProtected(c.StateDir, "approval.json", Record{Schema: 2, Inventory: c.Expected, Enabled: true, Lifecycle: l}); err != nil {
-		t.Fatal(err)
-	}
-	if err = os.Mkdir(filepath.Join(c.StateDir, "observer-diagnostic.json"), 0700); err != nil {
-		t.Fatal(err)
-	}
-	g := newAdmission(binding)
-	g.fenceStartup("journal-decode", ErrInvalid)
-	persistObserverDiagnostic(c, l.Epoch, g)
-	if g.readiness(time.Now()) != "fenced" || g.reason() != "grant-authority-unavailable" {
-		t.Fatal("diagnostic error changed admission")
-	}
-	if err = fenceRecord(c, l.Epoch, g.reason()); err != nil {
-		t.Fatal(err)
-	}
-	process := Process{Inventory: c.Expected, Mode: "supervised", Boot: binding.Boot, PID: 42, Start: "123", Inode: 9}
-	if err = completeRecord(c, l.Epoch, process); err != nil {
-		t.Fatal(err)
-	}
-	r, err := readRecord(c.StateDir, c.Owner)
-	if err != nil || r.Lifecycle.Phase != "stopped" || r.Lifecycle.Reason != "grant-authority-unavailable" {
-		t.Fatal("startup completion failed")
-	}
-	if _, err = completionRecord(c, r); err != nil {
-		t.Fatal(err)
-	}
-}