@uuaid/agent-commons 0.2.0-alpha.2 → 0.2.0-alpha.4

package/src/vendor/pillar/groups.mjs

@@ -0,0 +1,175 @@
+/**
+ * Group threads — the `pillar-group` v1 app convention (INTERACTION-CONVENTION.md
+ * "group chats"), as the mobile app and chat-web already speak it.
+ *
+ * There is still no group key and no wire change: a group message is one
+ * ordinary 1:1 envelope per member, and the group rides INSIDE each sealed
+ * payload as `_group`. What this adds over the old `{ name, members }` tag is
+ * what makes it a thread rather than a fan-out:
+ *
+ *   id      stable `grp-<16 hex>`, so every member files it under one group
+ *   msgId   `gm-…`, identical across the fan-out copies of one message
+ *   op      message | create | rename | add | leave (roster changes travel
+ *           as ordinary group messages)
+ *   keys    optional sealing hints, binding-checked on receipt, so members
+ *           can reply to the whole group without a prior contact exchange
+ *
+ * Every member keeps its own roster (mailbox `groups` table) and applies the
+ * same rules: only a current member may rename or add, nobody can remove
+ * anyone but themselves, and a group a non-contact drops you into is a
+ * pending invitation until you accept it.
+ */
+import { randomBytes } from "node:crypto";
+import { localIdFromKey } from "./identity/keychain.mjs";
+
+export const GROUP_TAG_KEY = "_group";
+export const GROUP_TAG_V = 1;
+export const GROUP_OPS = Object.freeze(["message", "create", "rename", "add", "leave"]);
+export const MAX_GROUP_MEMBERS = 256;
+export const MAX_GROUP_NAME = 100;
+
+const GROUP_ID_RE = /^grp-[a-z0-9][a-z0-9-]{3,63}$/i;
+const UUAID_RE = /^uuaid:[a-z0-9-]+:[a-z0-9-]+:[a-z0-9][a-z0-9-]*$/i;
+const PUBKEY_RE = /^[0-9a-f]{64}$/i;
+
+export function isGroupId(id) {
+  return typeof id === "string" && GROUP_ID_RE.test(id);
+}
+
+export function newGroupId() {
+  return `grp-${randomBytes(8).toString("hex")}`;
+}
+
+export function newGroupMsgId() {
+  return `gm-${Date.now().toString(36)}-${randomBytes(6).toString("hex")}`;
+}
+
+/** The key really owns the uuaid (the same check seal() makes). */
+export function keyBindsUuaid(uuaid, publicKeyHex) {
+  if (typeof uuaid !== "string" || typeof publicKeyHex !== "string" || !PUBKEY_RE.test(publicKeyHex)) return false;
+  try { return localIdFromKey(Buffer.from(publicKeyHex, "hex")) === uuaid.split(":")[3]; }
+  catch { return false; }
+}
+
+function djb2(s) {
+  let h = 5381;
+  for (let i = 0; i < s.length; i++) h = ((h << 5) + h + s.charCodeAt(i)) >>> 0;
+  return h;
+}
+
+/**
+ * A local id for an id-less tag (an older pillar that sent only
+ * `{ name, members }`). Same derivation as the mobile app, so the same
+ * conversation groups the same way there and here. Never an authority.
+ */
+export function deriveGroupId(name, members) {
+  const canon = `${String(name).trim().toLowerCase()}|${[...members].sort().join(",")}`;
+  const a = djb2(canon).toString(16).padStart(8, "0");
+  const b = djb2(canon.split("").reverse().join("")).toString(16).padStart(8, "0");
+  return `grp-ref-${a}${b}`;
+}
+
+/** Deduplicated, validated member list, order kept. */
+export function normalizeMembers(members) {
+  const out = [];
+  const seen = new Set();
+  for (const m of Array.isArray(members) ? members : []) {
+    if (typeof m !== "string" || !UUAID_RE.test(m) || seen.has(m)) continue;
+    seen.add(m);
+    out.push(m);
+    if (out.length >= MAX_GROUP_MEMBERS) break; // fan-out amplification guard
+  }
+  return out;
+}
+
+/** Parse a `_group` tag out of a decrypted payload; null when absent or unusable. */
+export function extractGroupTag(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return null;
+  const g = payload[GROUP_TAG_KEY];
+  if (!g || typeof g !== "object" || Array.isArray(g)) return null;
+  const name = typeof g.name === "string" ? g.name.trim().slice(0, MAX_GROUP_NAME) : "";
+  const members = normalizeMembers(g.members);
+  if (!members.length) return null;
+  const derivedId = !isGroupId(g.id);
+  const id = derivedId ? deriveGroupId(name || "group", members) : g.id;
+  let keys;
+  if (g.keys && typeof g.keys === "object" && !Array.isArray(g.keys)) {
+    for (const [u, pk] of Object.entries(g.keys)) {
+      if (UUAID_RE.test(u) && typeof pk === "string" && PUBKEY_RE.test(pk)) (keys ??= {})[u] = pk.toLowerCase();
+    }
+  }
+  const msgId = typeof g.msgId === "string" && g.msgId.length > 0 && g.msgId.length <= 64 ? g.msgId : null;
+  const op = typeof g.op === "string" && GROUP_OPS.includes(g.op) ? g.op : "message";
+  return { v: typeof g.v === "number" ? g.v : GROUP_TAG_V, id, name: name || "Group", members, keys, msgId, op, derivedId };
+}
+
+/** The `_group` tag for an outbound payload. */
+export function buildGroupTag(group, { msgId, keys, op = "message" }) {
+  const tag = { v: GROUP_TAG_V, id: group.id, name: group.name, members: [...group.members], msgId };
+  if (keys && Object.keys(keys).length) tag.keys = keys;
+  if (op && op !== "message") tag.op = op;
+  return tag;
+}
+
+/**
+ * Fold an inbound tag into the local roster (mailbox `groups`). Returns the
+ * group as stored, or null when the tag changed nothing we keep.
+ *
+ *   unknown group -> join it; pending when the sender is not a contact. A
+ *                    wire id (not derived here) needs the SENDER on its own
+ *                    roster: the first tag seen for an id sets the roster, so
+ *                    a stranger must not be able to seed it, and after that
+ *                    the real members would be the strangers
+ *   known group   -> only a current MEMBER may change it: `leave` drops the
+ *                    sender, `create`/`rename` set the name, every op unions
+ *                    new members in; a re-`add` naming us clears our `left`
+ *   key hints     -> kept per group, only when the key derives its uuaid;
+ *                    they let us SEAL to a member, and never make anyone a
+ *                    trusted sender (the address book and trust.json do that)
+ */
+export function absorbGroupTag(mailbox, tag, { sender, self, text = "", fromContact = false }) {
+  const hints = {};
+  for (const [u, pk] of Object.entries(tag.keys ?? {})) {
+    if (u !== self && keyBindsUuaid(u, pk)) hints[u] = pk;
+  }
+  const existing = mailbox.getGroup(tag.id);
+  if (!existing) {
+    if (!tag.derivedId && !tag.members.includes(sender)) return null;
+    const members = tag.members.includes(self) ? tag.members : [...tag.members, self];
+    return mailbox.putGroup({
+      id: tag.id, name: tag.name, members, keys: hints, createdBy: sender, pending: !fromContact,
+    });
+  }
+  if (!existing.members.includes(sender)) return existing; // strangers cannot touch our roster
+  const keys = { ...hints, ...existing.keys }; // first key wins
+  if (tag.op === "leave") {
+    return mailbox.putGroup({ ...existing, keys, members: existing.members.filter((m) => m !== sender) });
+  }
+  const members = [...existing.members];
+  for (const m of tag.members) if (!members.includes(m) && members.length < MAX_GROUP_MEMBERS) members.push(m);
+  const addedUs = tag.op === "add" && String(text).split(",").map((x) => x.trim()).includes(self);
+  return mailbox.putGroup({
+    ...existing,
+    keys,
+    members,
+    name: tag.op === "rename" || tag.op === "create" ? tag.name : existing.name,
+    left: existing.left && !addedUs,
+  });
+}
+
+/**
+ * Resolve a group by exact id, else by unique case-insensitive name.
+ * Throws with the candidates listed when the name is ambiguous or unknown.
+ */
+export function findGroup(mailbox, ref) {
+  const byId = mailbox.getGroup(ref);
+  if (byId) return byId;
+  const all = mailbox.listGroups();
+  const hits = all.filter((g) => g.name.toLowerCase() === String(ref).toLowerCase());
+  if (hits.length === 1) return hits[0];
+  const e = new Error(hits.length
+    ? `group name "${ref}" is ambiguous: ${hits.map((g) => g.id).join(", ")} — use the id`
+    : `no group "${ref}" in this home${all.length ? ` (known: ${all.map((g) => `${g.name} ${g.id}`).join("; ")})` : ""} — list them with: pillar groups`);
+  e.code = hits.length ? "group-ambiguous" : "group-unknown";
+  throw e;
+}

package/src/vendor/pillar/identity/jcs.mjs

@@ -24,11 +24,10 @@ function _ser(v) {
   if (typeof v === "bigint") return v.toString();
   if (Array.isArray(v)) return "[" + v.map(_ser).join(",") + "]";
   if (typeof v === "object") {
-    // UTF-16 code unit sort — the RFC 8785 requirement.
-    const keys = Object.keys(v).sort((a, b) => {
-      const ab = Buffer.from(a, "utf16le"), bb = Buffer.from(b, "utf16le");
-      return Buffer.compare(ab, bb);
-    });
+    // RFC 8785 §3.2.3: keys sort by their UTF-16 code units, which is exactly
+    // JavaScript's default string order. (Comparing UTF-16LE *bytes* is not: it
+    // puts "Ā" (U+0100) before "a", and disagreed with @uuaid/pillar-client.)
+    const keys = Object.keys(v).sort(); // @rule jcs.code-unit-order
     return "{" + keys.map(k => JSON.stringify(k) + ":" + _ser(v[k])).join(",") + "}";
   }
   throw new Error("JCS: unsupported type " + typeof v);

package/src/vendor/pillar/identity/keychain.mjs

@@ -65,6 +65,54 @@ export function localIdFromKey(rawPub) {
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
 }
 
+/** Registry namespaces cannot be asserted by possession of a key alone. */
+export const SELF_CERTIFYING_NAMESPACES = Object.freeze(["foundation", "pillar", "agentnet"]);
+
+/**
+ * The namespace `pillar init` mints a NEW agent identity in when no --namespace is given.
+ * Expand before contract (owner order 2026-10-24; Uuaid-Codex review K1): 2.2.0 makes every
+ * verifier accept foundation, pillar and agentnet but still mints `foundation`, because a
+ * `pillar:` identity cannot read its inbox on a pre-2.2.0 carrier. 2.2.1 flips this to
+ * `pillar` once the carrier fleet, the main relay and the blob brokers run 2.2.x/1.2.0.
+ * Existing keychains keep the UUAID they were saved with. `Keychain.generate`'s own default
+ * stays `foundation` for library callers; CLI mint sites pass `mintNamespace(...)` instead.
+ */
+export const NEW_IDENTITY_NAMESPACE = "foundation";
+
+/**
+ * Carrier-infrastructure identities (pillar-seed, pillar-directory, pillar-escrow) stay in
+ * `foundation`: they are spoken to by third-party seeds and DHT peers on any version, and
+ * the owner's rule covers the identities people create, not the fleet's service keys
+ * (Uuaid-Codex review K2).
+ */
+export const SERVICE_IDENTITY_NAMESPACE = "foundation";
+
+/** The namespace to mint in: `requested` if it is self-certifying, else NEW_IDENTITY_NAMESPACE. Throws on any other namespace. */
+export function mintNamespace(requested) {
+  if (requested === undefined || requested === null) return NEW_IDENTITY_NAMESPACE;
+  if (typeof requested !== "string" || !SELF_CERTIFYING_NAMESPACES.includes(requested)) {
+    throw new Error(`namespace must be one of ${SELF_CERTIFYING_NAMESPACES.join(", ")} (a key alone cannot claim ${String(requested)})`);
+  }
+  return requested;
+}
+
+/** Rebuild the complete key-derived identity; minting still defaults to foundation. */
+export function keyDerivedUuaidFor(publicKeyHex, { namespace = "foundation", objectType = "agent" } = {}) {
+  if (!SELF_CERTIFYING_NAMESPACES.includes(namespace)
+    || typeof objectType !== "string" || !/^[a-z0-9-]+$/.test(objectType)
+    || typeof publicKeyHex !== "string" || !/^[0-9a-f]{64}$/i.test(publicKeyHex)) return null;
+  return `uuaid:${namespace}:${objectType}:${localIdFromKey(Buffer.from(publicKeyHex, "hex"))}`;
+}
+
+/** Compare the full identity, optionally constraining a path's existing object type. */
+export function keyDerivesUuaid(publicKeyHex, uuaid, objectType = null) {
+  if (typeof uuaid !== "string") return false;
+  const parts = uuaid.split(":");
+  if (parts.length !== 4 || parts[0] !== "uuaid" || (objectType !== null && parts[2] !== objectType)) return false;
+  const expected = keyDerivedUuaidFor(publicKeyHex, { namespace: parts[1], objectType: parts[2] });
+  return expected !== null && uuaid === expected;
+}
+
 export class Keychain {
   constructor(path) {
     this.path = path;
@@ -78,8 +126,9 @@ export class Keychain {
   /**
    * Generate a fresh identity.  Never overwrites.
    *
-   * uuaidNamespace: default "foundation" per IAASO-1001 today; will support
-   * federated forms once federation profile ratifies.
+   * uuaidNamespace: default "foundation" (the genesis namespace) for library
+   * callers. The Pillar CLIs pass mintNamespace(...) explicitly, so a new CLI
+   * identity is `pillar` unless the operator asks for agentnet or foundation.
    * objectType: default "agent"; overridable to "service" etc.
    * localId: default random UUIDv4-like; caller may supply.
    */

package/src/vendor/pillar/net/carrier-client.mjs

@@ -20,6 +20,21 @@ function byTier(tiers) {
   return (a, b) => seedTier(tiers[a] ?? "probation").listRank - seedTier(tiers[b] ?? "probation").listRank;
 }
 
+/**
+ * The carrier's signed acceptance receipt (uuaid.carrier-receipt.v1), kept as
+ * the carrier sent it, plus this client's own clock when the answer arrived
+ * (design §12 rule 3: record received-at beside the carrier's acceptedAt,
+ * which is only the carrier's claim). NOT verified here: verify against the
+ * pinned key for this carrier and the exact envelope posted. {} when the
+ * carrier sent no receipt (an older or keyless carrier): that never fails a
+ * delivery, the outcome is simply unreceipted.
+ */
+function keptReceipt(body) {
+  const r = body?.receipt;
+  if (!r || typeof r !== "object" || Array.isArray(r) || typeof body.receiptSig !== "string") return {};
+  return { receipt: r, receiptSig: body.receiptSig, receivedAt: new Date().toISOString() }; // @rule client.keeps-receipt
+}
+
 export class CarrierClient {
   /**
    * @param {{keychain: import('../identity/keychain.mjs').Keychain, carriers: string[]}} opts
@@ -66,8 +81,13 @@ export class CarrierClient {
    * Resolves once every carrier has answered.  Succeeds if at least one
    * accepted; throws if every carrier rejects.  Returns the receipt from the
    * most PROVEN accepting carrier as the primary ({ carrier, seq, sha,
-   * duplicate }) plus `all` with every carrier's outcome ({ carrier, ok,
-   * seq?, sha?, duplicate?, error?, status?, reason?, fix? }).
+   * duplicate, receipt?, receiptSig?, receivedAt? }) plus `all` with every
+   * carrier's outcome ({ carrier, ok, seq?, sha?, duplicate?, receipt?,
+   * receiptSig?, receivedAt?, error?, status?, reason?, fix? }).
+   *
+   * `receipt` / `receiptSig` are present only when that carrier signed one
+   * (uuaid.carrier-receipt.v1); they are unverified carrier output, and
+   * `receivedAt` is this client's clock, not the carrier's.
    *
    * When every carrier refuses, the thrown error carries `code` (the most
    * proven carrier's `reason`, else carrier-unreachable / carrier-bad-response),
@@ -105,7 +125,7 @@ export class CarrierClient {
         let body = {};
         try { body = raw ? JSON.parse(raw) : {}; } catch (_error) {}
         if (res.status === 202 && body.accepted) {
-          return { carrier: base, ok: true, seq: body.seq, sha: body.sha, duplicate: !!body.duplicate };
+          return { carrier: base, ok: true, seq: body.seq, sha: body.sha, duplicate: !!body.duplicate, ...keptReceipt(body) };
         }
         const reason = typeof body.reason === "string" && body.reason ? body.reason
           : typeof body.error === "string" && body.error ? body.error : null;
@@ -132,15 +152,15 @@ export class CarrierClient {
       throw e;
     }
     const ranked = accepted.slice().sort((a, b) => byTier(this.carrierTiers)(a.carrier, b.carrier));
-    const { carrier, seq, sha, duplicate } = ranked[0];
-    return { carrier, seq, sha, duplicate, all };
+    const { carrier, seq, sha, duplicate, receipt, receiptSig, receivedAt } = ranked[0];
+    return { carrier, seq, sha, duplicate, ...(receipt ? { receipt, receiptSig, receivedAt } : {}), all };
   }
 
   /**
    * Fetch envelopes addressed to us with seq > since from a specific carrier.
    * Signed request; carrier verifies our key before serving.
    */
-  async fetchInbox(base, { since = 0, waitS = 0, timeoutMs = 40000 } = {}) {
+  async fetchInbox(base, { since = 0, waitS = 0, timeoutMs = 40000, signal = null } = {}) {
     const path = `GET /v1/inbox/${this.uuaid}?since=${since}`;
     const ts = String(Date.now());
     const sig = this.keychain.sign(Buffer.from(`${path}\n${ts}`, "utf-8")).toString("hex");
@@ -150,7 +170,9 @@ export class CarrierClient {
         "x-pillar-ts": ts,
         "x-pillar-sig": sig,
       },
-      signal: AbortSignal.timeout(timeoutMs),
+      // `signal` lets a caller cancel a long-poll early (peekCarrierInbox stops
+      // the other carriers once one has mail).
+      signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(timeoutMs)]) : AbortSignal.timeout(timeoutMs),
     });
     if (res.status !== 200) {
       const body = await res.json().catch(() => ({}));

package/src/vendor/pillar/net/refusals.mjs

@@ -34,6 +34,7 @@ export const REFUSAL_FIXES = Object.freeze({
   "bad-signature": "sign again with this identity's own key over the exact bytes; the signature does not verify",
   "weak-publicKey": "use a real Ed25519 identity key; this key is a small-order or non-canonical point that can sign anything, so no signature under it counts",
   "delegation-invalid": "mint a fresh delegation from the principal, then resend",
+  "envelope-id-conflict": "seal a new envelope with a fresh id; this carrier already holds a different envelope under this id",
   // Carrier, envelope shape and crypto (envelope.mjs open()): one fix for all
   "not-object": RESEAL,
   "bad-version": RESEAL,
@@ -69,8 +70,9 @@ export const REFUSAL_FIXES = Object.freeze({
   "carrier-unreachable": "check the carrier URLs and your network, then retry",
   "carrier-bad-response": "retry, or use another carrier; the carrier or its proxy answered without a reason",
   "over-tier-limit": "send the payload as a blob (pillar-blob send, or Pillar.sendBlob)",
-  "blob-key-unproven": "use a uuaid:foundation:agent UUAID derived from this key (pillar init), or get a registry badge that names this key",
-  "sender-key-not-active": "ask the sender to send from a uuaid:foundation:agent UUAID derived from its own key, or to get a registry badge naming its key",
+  "blob-key-unproven": "use a self-certifying agent UUAID derived from this key (pillar init), or get a registry badge that names this key",
+  "sender-key-not-active": "ask the sender to send from a self-certifying agent UUAID derived from its own key, or to get a registry badge naming its key",
+  "group-v2-use-v2-send": "send to this pillar-group/2 group with pillar group send <group>; v1 group sends (send-group, sendGroup) do not reach it",
 });
 
 /**

package/test/channels.test.mjs

@@ -1,268 +0,0 @@
-import test from "node:test";
-import assert from "node:assert/strict";
-import {
-  classifyThread,
-  assertChannelSendAdmission,
-  assertChannelReceiveAdmission,
-  assertForwardingPermission,
-  validateTenantBinding,
-  CANONICAL_CHANNEL_REGEX,
-  RESERVED_CHANNEL_PREFIX
-} from "../src/channels.mjs";
-
-test("Channel classifier: C2 Input / Mode Decision Table (two-pole)", () => {
-  const canonicalUris = [
-    "channel://commons/dm/agent-session-123",
-    "channel://zilligon/community/welcome",
-    "channel://local/topic/node-events",
-    "channel://commons/session/delib-456"
-  ];
-
-  // 1. Canonical structured channels succeed across all policy modes
-  for (const uri of canonicalUris) {
-    for (const channelsEnabled of [false, true, undefined]) {
-      const result = classifyThread(uri, { channelsEnabled });
-      assert.equal(result.ok, true, `Expected ${uri} to succeed with channelsEnabled=${channelsEnabled}`);
-      assert.equal(result.classification, "structured");
-      assert.equal(result.channelUri, uri);
-      assert.ok(result.parsed.provider);
-      assert.ok(result.parsed.channelType);
-      assert.ok(result.parsed.channelId);
-    }
-  }
-
-  // 2. Non-canonical channel-like spellings fail closed with INVALID_CHANNEL_URI
-  const nonCanonicalUris = [
-    "CHANNEL://commons/dm/agent-123", // Uppercase scheme (must NOT fall back to legacy bypass)
-    "channel:/commons/dm/123",        // Missing slash
-    "channel://commons",              // Missing segments
-    "channel://commons/dm",           // Only two segments
-    "channel://comm@ns/dm/123",       // Disallowed characters
-    "Channel://local/topic/test",     // Mixed case scheme
-    "CHANNEL://LOCAL/TOPIC/TEST"      // All uppercase
-  ];
-
-  for (const badUri of nonCanonicalUris) {
-    for (const channelsEnabled of [false, true, undefined]) {
-      const result = classifyThread(badUri, { channelsEnabled });
-      // Control pole: Must fail closed with INVALID_CHANNEL_URI
-      assert.equal(
-        result.ok,
-        false,
-        `Expected non-canonical ${badUri} to fail with channelsEnabled=${channelsEnabled}`
-      );
-      assert.equal(result.classification, "reserved-malformed");
-      assert.equal(result.error, "INVALID_CHANNEL_URI");
-
-      // Mutant pole check: verify that a naive startsWith("channel://") would have incorrectly bypassed
-      const naivePrefixMatches = badUri.startsWith("channel://");
-      const reservedPrefixMatches = RESERVED_CHANNEL_PREFIX.test(badUri);
-      assert.equal(
-        reservedPrefixMatches,
-        true,
-        `Reserved regex must catch channel-like spelling ${badUri}`
-      );
-    }
-  }
-
-  // 3. Ordinary legacy strings under default / disabled mode: ALLOWED
-  const legacyStrings = ["commons", "app-topic", "default-thread", "session-789"];
-  for (const legacy of legacyStrings) {
-    for (const channelsEnabled of [false, undefined]) {
-      const result = classifyThread(legacy, { channelsEnabled });
-      assert.equal(result.ok, true);
-      assert.equal(result.classification, "legacy-allowed");
-      assert.equal(result.thread, legacy);
-    }
-  }
-
-  // 4. Ordinary legacy strings under channelsEnabled === true: DENIED
-  for (const legacy of legacyStrings) {
-    const result = classifyThread(legacy, { channelsEnabled: true });
-    // Control pole: Denied with STRUCTURED_CHANNELS_REQUIRED
-    assert.equal(result.ok, false);
-    assert.equal(result.classification, "legacy-denied");
-    assert.equal(result.error, "STRUCTURED_CHANNELS_REQUIRED");
-  }
-
-  // 5. Invalid thread inputs
-  assert.equal(classifyThread("").error, "INVALID_THREAD_LENGTH");
-  assert.equal(classifyThread("a".repeat(121)).error, "INVALID_THREAD_LENGTH");
-  assert.equal(classifyThread(null).error, "INVALID_THREAD_LENGTH");
-  assert.equal(classifyThread(undefined).error, "INVALID_THREAD_LENGTH");
-});
-
-test("Bidirectional channel admission: outbound send assertions (two-pole)", () => {
-  const channelUri = "channel://commons/dm/thread-1";
-  const policy = {
-    channels: {
-      [channelUri]: {
-        visibility: "private",
-        members: ["agent-alice", "agent-bob"]
-      }
-    }
-  };
-
-  // Control pole: sender and all recipients admitted
-  assert.doesNotThrow(() => {
-    assertChannelSendAdmission(channelUri, "agent-alice", ["agent-bob"], policy);
-  });
-
-  // Mutant pole 1: unauthorized sender fails closed
-  assert.throws(
-    () => assertChannelSendAdmission(channelUri, "agent-eve", ["agent-bob"], policy),
-    (err) => err.code === "UNAUTHORIZED_CHANNEL_SENDER"
-  );
-
-  // Mutant pole 2: unauthorized recipient fails closed
-  assert.throws(
-    () => assertChannelSendAdmission(channelUri, "agent-alice", ["agent-eve"], policy),
-    (err) => err.code === "UNAUTHORIZED_CHANNEL_RECIPIENT"
-  );
-
-  // Mutant pole 3: unconfigured channel fails closed
-  assert.throws(
-    () => assertChannelSendAdmission("channel://commons/dm/unconfigured", "agent-alice", ["agent-bob"], policy),
-    (err) => err.code === "UNCONFIGURED_CHANNEL"
-  );
-});
-
-test("Bidirectional channel admission: inbound receive assertions (two-pole)", () => {
-  const channelUri = "channel://commons/dm/thread-1";
-  const policy = {
-    channels: {
-      [channelUri]: {
-        visibility: "private",
-        members: ["agent-alice", "agent-bob"]
-      }
-    }
-  };
-
-  // Control pole: decrypted sender and local receiver admitted
-  assert.doesNotThrow(() => {
-    assertChannelReceiveAdmission(channelUri, "agent-alice", "agent-bob", policy);
-  });
-
-  // Mutant pole 1: unauthorized sender fails closed
-  assert.throws(
-    () => assertChannelReceiveAdmission(channelUri, "agent-eve", "agent-bob", policy),
-    (err) => err.code === "UNAUTHORIZED_CHANNEL_SENDER"
-  );
-
-  // Mutant pole 2: unauthorized receiver fails closed
-  assert.throws(
-    () => assertChannelReceiveAdmission(channelUri, "agent-alice", "agent-eve", policy),
-    (err) => err.code === "UNAUTHORIZED_CHANNEL_RECEIVER"
-  );
-
-  // Mutant pole 3: unconfigured inbound channel fails closed with UNCONFIGURED_CHANNEL
-  assert.throws(
-    () => assertChannelReceiveAdmission("channel://commons/dm/unconfigured", "agent-alice", "agent-bob", policy),
-    (err) => err.code === "UNCONFIGURED_CHANNEL"
-  );
-});
-
-test("Cross-channel forwarding assertions (two-pole)", () => {
-  const sourceChannel = "channel://commons/dm/source-1";
-  const targetChannel = "channel://zilligon/community/announcements";
-
-  const policy = {
-    agents: {
-      "agent-forwarder": { capabilities: ["commons:message", "commons:forward"] },
-      "agent-regular": { capabilities: ["commons:message"] }
-    },
-    channels: {
-      [targetChannel]: {
-        visibility: "public",
-        allowForwarding: true
-      },
-      "channel://commons/dm/strict-target": {
-        visibility: "private",
-        allowForwarding: false
-      }
-    }
-  };
-
-  // Control pole: authorized forwarder and target permits forwarding
-  assert.doesNotThrow(() => {
-    assertForwardingPermission(sourceChannel, targetChannel, "agent-forwarder", policy);
-  });
-
-  // Mutant pole 1: sender lacks commons:forward capability
-  assert.throws(
-    () => assertForwardingPermission(sourceChannel, targetChannel, "agent-regular", policy),
-    (err) => err.code === "CROSS_CHANNEL_FORWARDING_DENIED"
-  );
-
-  // Mutant pole 2: target channel disallows forwarding
-  assert.throws(
-    () => assertForwardingPermission(sourceChannel, "channel://commons/dm/strict-target", "agent-forwarder", policy),
-    (err) => err.code === "CROSS_CHANNEL_FORWARDING_DENIED"
-  );
-});
-
-test("Tenant namespace binding assertions (two-pole)", () => {
-  const boundTenantProfile = {
-    id: "sha256-bound-profile-digest",
-    scope: "tenant"
-  };
-  const unboundTenantProfile = {
-    id: "sha256-unbound-tenant-profile",
-    scope: "tenant"
-  };
-  const unboundLocalProfile = {
-    id: "sha256-unbound-local-profile",
-    scope: "local"
-  };
-
-  const policy = {
-    tenantProfiles: {
-      [boundTenantProfile.id]: "tenant-acme"
-    },
-    agents: {
-      "agent-acme-1": { tenantId: "tenant-acme" },
-      "agent-acme-2": { tenantId: "tenant-acme" },
-      "agent-corp-x": { tenantId: "tenant-corp" }
-    }
-  };
-
-  // Control pole 1: matching tenant passes
-  assert.doesNotThrow(() => {
-    validateTenantBinding("agent-acme-1", "agent-acme-2", boundTenantProfile, policy);
-  });
-
-  // Mutant pole 1: sender tenant mismatch fails closed
-  assert.throws(
-    () => validateTenantBinding("agent-corp-x", "agent-acme-2", boundTenantProfile, policy),
-    (err) => err.code === "TENANT_NAMESPACE_MISMATCH"
-  );
-
-  // Mutant pole 2: recipient tenant mismatch fails closed
-  assert.throws(
-    () => validateTenantBinding("agent-acme-1", "agent-corp-x", boundTenantProfile, policy),
-    (err) => err.code === "TENANT_NAMESPACE_MISMATCH"
-  );
-
-  // Control pole 2: unbound tenant profile MUST fail closed with UNBOUND_PROFILE_TENANT (R4)
-  assert.throws(
-    () => validateTenantBinding("agent-acme-1", "agent-acme-2", unboundTenantProfile, policy),
-    (err) => err.code === "UNBOUND_PROFILE_TENANT"
-  );
-
-  // Control pole 3: unbound local profile passes unconstrained without tenant binding requirement
-  assert.doesNotThrow(() => {
-    validateTenantBinding("agent-acme-1", "agent-corp-x", unboundLocalProfile, policy);
-  });
-
-  // Mutant pole: unbound bare digest string fails closed with UNBOUND_PROFILE_TENANT (R4)
-  assert.throws(
-    () => validateTenantBinding("agent-acme-1", "agent-corp-x", "sha256-unbound-digest", policy),
-    (err) => err.code === "UNBOUND_PROFILE_TENANT"
-  );
-
-  // Mutant pole: unbound scope-less ProfileRef fails closed with UNBOUND_PROFILE_TENANT (R4)
-  assert.throws(
-    () => validateTenantBinding("agent-acme-1", "agent-corp-x", { id: "profile-no-scope" }, policy),
-    (err) => err.code === "UNBOUND_PROFILE_TENANT"
-  );
-});

package/test/cohort.test.mjs

@@ -1,36 +0,0 @@
-import test from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, rmSync, readFileSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { initializeCohort, cohortStatus, FOUNDING_ROSTER } from "../src/cohort.mjs";
-
-test("Seven nodes persist distinct identity and scoped policy without remote enrollment",()=>{
-  const root=mkdtempSync(join(tmpdir(),"commons-cohort-")),home=join(root,"nodes");
-  try{
-    const manifest=initializeCohort({home,target:"zilligon.com"});
-    assert.equal(manifest.members.length,7);
-    assert.equal(new Set(manifest.members.map(m=>m.uuaid)).size,7);
-    assert.equal(manifest.registration,"not-performed");
-    assert.equal(manifest.certified,false);
-    const next=cohortStatus(home);
-    assert.deepEqual(next.members.map(m=>m.uuaid),manifest.members.map(m=>m.uuaid));
-    assert(next.members.every(m=>m.status.auditVerified));
-    const config=JSON.parse(readFileSync(join(home,"security","config.json"),"utf8"));
-    assert.equal(Object.keys(config.policy.agents).length,7);
-    const security=manifest.members.find(m=>m.id==="security");
-    assert(!config.policy.agents[security.uuaid].capabilities.includes("commons:evolve"));
-    assert(Object.values(config.policy.agents).every(a=>!a.capabilities.includes("commons:recover")));
-    assert.throws(()=>initializeCohort({home}),/not overwritten/);
-  }finally{rmSync(root,{recursive:true,force:true})}
-});
-test("Cohort manifest cannot redirect identity loading to arbitrary paths",()=>{
-  const root=mkdtempSync(join(tmpdir(),"commons-cohort-")),home=join(root,"nodes");
-  try{
-    const m=initializeCohort({home});
-    m.members[0].home=root;
-    writeFileSync(join(home,"cohort.json"),JSON.stringify(m));
-    assert.throws(()=>cohortStatus(home),/Unsafe/);
-    assert.equal(FOUNDING_ROSTER.length,7);
-  }finally{rmSync(root,{recursive:true,force:true})}
-});