@wildo-ai/platform-infra-providers 1.1.2

package/src/rabbitmq-self/__tests__/rabbitmq-self.infra.module.test.ts

@@ -0,0 +1,499 @@
+/**
+ * Tests for `RabbitmqSelfInfraProviderModule` (Slice 2 of
+ * `infra-provider-planner.md`).
+ *
+ * Goals:
+ * - Pin the `plan()` shape so a future regression that drops e.g.
+ *   `RABBITMQ_ADMIN_USERNAME` from `secretEnvVars` fails loud.
+ * - Pin the orchestrator-pattern contract: `mintAppCredentials`
+ *   accepts the password via `secretInputs` and echoes it back —
+ *   proves the module is upsert-only, not generator.
+ * - Pin the username + permission-regex conventions against the
+ *   existing `wildo-application-lifecycle.service.ts:434, 552`
+ *   conventions so a future code change here surfaces as a regex
+ *   diff in this test, not as a silent broker-permission drift.
+ */
+
+import { describe, expect, it, vi } from 'vitest';
+import {
+  AppCredentialMintingContext,
+  IRabbitMQManagementClient,
+  InfraCapability,
+  InfraPlatformAdminConsumer,
+  InfraProvider,
+} from '@wildo-ai/platform-config-lib';
+import { ApplicationRuntimePrincipalKind, buildRuntimePrincipalQueueSegment } from '@wildo-ai/platform-config-lib';
+import { RabbitmqSelfInfraProviderModule } from '../rabbitmq-self.infra.module';
+
+function makeAdminClientStub(): IRabbitMQManagementClient & {
+  putUserSpy: ReturnType<typeof vi.fn>;
+  setPermissionsSpy: ReturnType<typeof vi.fn>;
+  setTopicPermissionsSpy: ReturnType<typeof vi.fn>;
+  deleteUserSpy: ReturnType<typeof vi.fn>;
+  ensureVhostSpy: ReturnType<typeof vi.fn>;
+} {
+  const putUserSpy = vi.fn().mockResolvedValue(undefined);
+  const setPermissionsSpy = vi.fn().mockResolvedValue(undefined);
+  const setTopicPermissionsSpy = vi.fn().mockResolvedValue(undefined);
+  const deleteUserSpy = vi.fn().mockResolvedValue(undefined);
+  const ensureVhostSpy = vi.fn().mockResolvedValue(undefined);
+  return {
+    putUser: putUserSpy,
+    setPermissions: setPermissionsSpy,
+    setTopicPermissions: setTopicPermissionsSpy,
+    deleteUser: deleteUserSpy,
+    ensureVhost: ensureVhostSpy,
+    putUserSpy,
+    setPermissionsSpy,
+    setTopicPermissionsSpy,
+    deleteUserSpy,
+    ensureVhostSpy,
+  };
+}
+
+describe('RabbitmqSelfInfraProviderModule.plan()', () => {
+  const contribution = RabbitmqSelfInfraProviderModule.plan({
+    environment: 'local',
+    runtime: 'docker-compose',
+    backingServiceKey: 'rabbitmq',
+    config: {},
+  });
+
+  it('declares the right provider + capability triple', () => {
+    expect(RabbitmqSelfInfraProviderModule.provider).toBe(InfraProvider.RABBITMQ_SELF);
+    expect(RabbitmqSelfInfraProviderModule.supportedCapabilities).toEqual([
+      InfraCapability.QUEUING_SYSTEM,
+    ]);
+  });
+
+  it('contributes the rabbitmq compose service + K8s manifest', () => {
+    expect(contribution.dockerComposeServices).toEqual(['rabbitmq']);
+    expect(contribution.k8sResources).toEqual([
+      'templates/infra/k8s/internal/rabbitmq/deployment.yaml.hbs',
+    ]);
+  });
+
+  it('declares platformAdmin (audience-1) for apps-manager + companion only', () => {
+    expect(contribution.platformAdmin?.envVars).toEqual({
+      RABBITMQ_HOST: 'rabbitmq',
+      RABBITMQ_PORT: '5672',
+      RABBITMQ_MANAGEMENT_PORT: '15672',
+    });
+    expect(contribution.platformAdmin?.secretEnvVars).toEqual([
+      'RABBITMQ_ADMIN_USERNAME',
+      'RABBITMQ_ADMIN_PASSWORD',
+    ]);
+    // Audience-1 only — `crontabs-batches-manager` is platform-service-
+    // scoped (audience-2 / LD-8 / Slice 2.5), NOT platform-admin.
+    expect(contribution.platformAdmin?.consumers).toEqual([
+      InfraPlatformAdminConsumer.APPS_MANAGER,
+      InfraPlatformAdminConsumer.COMPANION,
+    ]);
+  });
+
+  it('declares appRuntime blob paths for the customer-app pod', () => {
+    expect(contribution.appRuntime?.perAppConfigBlobPaths).toEqual({
+      'database.rabbitmq.host': 'rabbitmq',
+      'database.rabbitmq.port': 5672,
+    });
+    expect(contribution.appRuntime?.perAppSecretBlobPaths).toEqual([
+      'database.rabbitmq.username',
+      'database.rabbitmq.password',
+    ]);
+  });
+});
+
+describe('RabbitmqSelfInfraProviderModule.mintAppCredentials()', () => {
+  const baseContext: AppCredentialMintingContext = {
+    appSlug: 'wonder-todos',
+    // The namespace = `<slug>-<envId>` per
+    // `buildApplicationNamespace`. The orchestrator computes it server-side
+    // and passes it; modules must use this for resources scoped by
+    // namespace (rabbit username, redis ACL keyPattern).
+    applicationNamespace: 'wonder-todos-local',
+    wildoApplicationId: '697702debf8daa1038db3936',
+    adminClient: undefined as unknown,
+    secretInputs: { 'database.rabbitmq.password': 'orchestrator-pw-9999' },
+  };
+
+  it('upserts user, permissions, and topic permissions with the right regex shape', async () => {
+    const admin = makeAdminClientStub();
+    const result = await RabbitmqSelfInfraProviderModule.mintAppCredentials!({
+      ...baseContext,
+      adminClient: admin,
+    });
+
+    // Username is the application NAMESPACE (`<slug>-<envId>`), not the
+    // raw slug — matches the legacy convention at
+    // wildo-application-lifecycle.service.ts (the namespace is what
+    // `buildApplicationNamespace` produces). Password echoed verbatim
+    // from `secretInputs` proves the module is upsert-only.
+    expect(admin.putUserSpy).toHaveBeenCalledWith('wonder-todos-local', 'orchestrator-pw-9999', []);
+
+    // Permissions — vhost is '/', regex is the per-app queue/reply pattern
+    // disambiguated by `wildoApplicationId`. `write` widens to allow
+    // amq.default + empty string per the legacy convention.
+    expect(admin.setPermissionsSpy).toHaveBeenCalledWith('/', 'wonder-todos-local', {
+      configure: '^wildo\\.(queue|reply)\\.697702debf8daa1038db3936\\..*',
+      write: '(^$|amq\\.default|^wildo\\.(queue|reply)\\.697702debf8daa1038db3936\\..*)',
+      read: '^wildo\\.(queue|reply)\\.697702debf8daa1038db3936\\..*',
+    });
+
+    // Topic permissions — same regex on amq.topic.
+    expect(admin.setTopicPermissionsSpy).toHaveBeenCalledWith('/', 'wonder-todos-local', {
+      exchange: 'amq.topic',
+      write: '^wildo\\.(queue|reply)\\.697702debf8daa1038db3936\\..*',
+      read: '^wildo\\.(queue|reply)\\.697702debf8daa1038db3936\\..*',
+    });
+
+    // Result: keyed by JSON paths into Wildo_Application_Secrets,
+    // password echoed verbatim (proves upsert-only).
+    expect(result).not.toBeNull();
+    expect(result!.secretBlobValues).toEqual({
+      'database.rabbitmq.username': 'wonder-todos-local',
+      'database.rabbitmq.password': 'orchestrator-pw-9999',
+    });
+  });
+
+  it('throws when the orchestrator did not supply a password', async () => {
+    const admin = makeAdminClientStub();
+    await expect(
+      RabbitmqSelfInfraProviderModule.mintAppCredentials!({
+        ...baseContext,
+        adminClient: admin,
+        secretInputs: {}, // deliberately empty
+      }),
+    ).rejects.toThrow(/secretInputs is missing 'database\.rabbitmq\.password'/);
+    // Module never touched the broker on the missing-input branch.
+    expect(admin.putUserSpy).not.toHaveBeenCalled();
+  });
+
+  it('escapes regex metacharacters in wildoApplicationId (defensive)', async () => {
+    const admin = makeAdminClientStub();
+    await RabbitmqSelfInfraProviderModule.mintAppCredentials!({
+      ...baseContext,
+      adminClient: admin,
+      // Hypothetical id with regex specials. Today's ids are Mongo
+      // ObjectIds (hex-only, no specials) but the contract only commits
+      // to "stable opaque string", so we guard.
+      wildoApplicationId: 'a.b*c',
+    });
+    expect(admin.setPermissionsSpy.mock.calls[0]![2]).toEqual({
+      configure: '^wildo\\.(queue|reply)\\.a\\.b\\*c\\..*',
+      write: '(^$|amq\\.default|^wildo\\.(queue|reply)\\.a\\.b\\*c\\..*)',
+      read: '^wildo\\.(queue|reply)\\.a\\.b\\*c\\..*',
+    });
+  });
+
+  it('Slice 2.5c-3: provisions on the default vhost when applicationConfigInputs.vhost is unset', async () => {
+    const admin = makeAdminClientStub();
+    await RabbitmqSelfInfraProviderModule.mintAppCredentials!({
+      ...baseContext,
+      adminClient: admin,
+      // No `applicationConfigInputs` → fall back to `/`.
+    });
+    expect(admin.ensureVhostSpy).not.toHaveBeenCalled();
+    expect(admin.setPermissionsSpy.mock.calls[0]![0]).toBe('/');
+    expect(admin.setTopicPermissionsSpy.mock.calls[0]![0]).toBe('/');
+  });
+
+  it('Slice 2.5c-3: ensures + provisions on the per-app vhost when applicationConfigInputs.vhost is set', async () => {
+    const admin = makeAdminClientStub();
+    await RabbitmqSelfInfraProviderModule.mintAppCredentials!({
+      ...baseContext,
+      adminClient: admin,
+      applicationConfigInputs: { vhost: 'wonder-todos' },
+    });
+    // ensureVhost called BEFORE permissions are set on it.
+    expect(admin.ensureVhostSpy).toHaveBeenCalledWith('wonder-todos');
+    expect(admin.setPermissionsSpy.mock.calls[0]![0]).toBe('wonder-todos');
+    expect(admin.setTopicPermissionsSpy.mock.calls[0]![0]).toBe('wonder-todos');
+  });
+
+  it('Slice 2.5c-3: empty-string vhost falls back to default `/` (defensive — operators sometimes emit empty values)', async () => {
+    const admin = makeAdminClientStub();
+    await RabbitmqSelfInfraProviderModule.mintAppCredentials!({
+      ...baseContext,
+      adminClient: admin,
+      applicationConfigInputs: { vhost: '' },
+    });
+    expect(admin.ensureVhostSpy).not.toHaveBeenCalled();
+    expect(admin.setPermissionsSpy.mock.calls[0]![0]).toBe('/');
+  });
+
+  // Per-app-vhost cron delivery (`.claude/plans/crontab-publisher-vhost-gap.md`).
+  it('per-app vhost: grants the crontabs publisher publish-only access on the app vhost, scoped to the app queue namespace', async () => {
+    const admin = makeAdminClientStub();
+    await RabbitmqSelfInfraProviderModule.mintAppCredentials!({
+      ...baseContext,
+      adminClient: admin,
+      applicationConfigInputs: { vhost: 'wonder-todos' },
+    });
+    // A second setPermissions call grants the GLOBAL crontabs publisher user
+    // publish access on THIS app's vhost — a per-app vhost is a hard isolation
+    // boundary it otherwise cannot reach. Scoped to the app's queue namespace,
+    // publish-only: `configure` (passive checkQueue probe) + `write`
+    // (amq.default), NO `read` (never consumes).
+    expect(admin.setPermissionsSpy).toHaveBeenCalledWith('wonder-todos', 'platform_crontabs_batches_manager', {
+      configure: '^wildo\\.(queue|reply)\\.697702debf8daa1038db3936\\..*',
+      write: '(^$|amq\\.default|^wildo\\.(queue|reply)\\.697702debf8daa1038db3936\\..*)',
+      read: '',
+    });
+    // The publisher uses the default exchange, not amq.topic — no topic grant.
+    expect(admin.setTopicPermissionsSpy).not.toHaveBeenCalledWith(
+      'wonder-todos',
+      'platform_crontabs_batches_manager',
+      expect.anything(),
+    );
+  });
+
+  it('default vhost: NO extra crontabs grant (the publisher is already broadly granted on `/`)', async () => {
+    const admin = makeAdminClientStub();
+    await RabbitmqSelfInfraProviderModule.mintAppCredentials!({
+      ...baseContext,
+      adminClient: admin,
+      // default vhost `/`
+    });
+    expect(admin.setPermissionsSpy).not.toHaveBeenCalledWith(
+      '/',
+      'platform_crontabs_batches_manager',
+      expect.anything(),
+    );
+  });
+});
+
+describe('RabbitmqSelfInfraProviderModule per-principal broker users (Step 2 / D17)', () => {
+  const baseContext: AppCredentialMintingContext = {
+    appSlug: 'wonder-todos',
+    applicationNamespace: 'wonder-todos-local',
+    wildoApplicationId: '697702debf8daa1038db3936',
+    adminClient: undefined as unknown,
+    secretInputs: { 'database.rabbitmq.password': 'orchestrator-pw-9999' },
+  };
+  const MINION = { kind: ApplicationRuntimePrincipalKind.MINION, name: 'marketingScrapper' } as const;
+  const APP_REGEX = '^wildo\\.(queue|reply)\\.697702debf8daa1038db3936\\..*';
+  const CONSUME_REGEX = '^(wildo\\.queue\\.697702debf8daa1038db3936\\.minion-tick\\.marketingScrapper(\\..*)?'
+    + '|wildo\\.reply\\.697702debf8daa1038db3936\\.minion-marketingScrapper\\..*)$';
+
+  it('admits ONLY the minion\'s tick queue and its OWN reply queue', async () => {
+    // The three axes are not interchangeable. `read` governs CONSUMING, and
+    // narrowing it is the containment that matters — otherwise a minion can
+    // drain the backend's job queue or read RPC replies addressed to it.
+    // `configure` and `write` stay app-wide because a minion legitimately
+    // declares a delay queue and publishes jobs; `publish` calls `sendToQueue`
+    // without asserting, so it needs `write` and nothing more.
+    const admin = makeAdminClientStub();
+    await RabbitmqSelfInfraProviderModule.mintAppCredentials!({ ...baseContext, adminClient: admin, principal: MINION });
+
+    expect(admin.setPermissionsSpy).toHaveBeenCalledWith('/', 'wonder-todos-local-minion-marketingScrapper', {
+      configure: APP_REGEX,
+      write: `(^$|amq\\.default|${APP_REGEX})`,
+      // Narrowed again, now that reply-queue names carry the owning runtime.
+      read: CONSUME_REGEX,
+    });
+  });
+
+  it('EXECUTES the consume regex against every queue the runtime actually meets', () => {
+    // Executed, not string-compared: the anchored `$` is what stops a SIBLING
+    // whose name merely starts with this one's from matching, and only running
+    // it proves that.
+    //
+    // The reply cases are the ones that matter most — they are what the first
+    // attempt at this narrowing got wrong, by reasoning about the tick consumer
+    // alone and never asking what else the RUNTIME consumes.
+    const re = new RegExp(CONSUME_REGEX.replace(/\\\\/g, '\\'));
+    const APP = '697702debf8daa1038db3936';
+
+    // allowed: its own tick queue, and its own reply queue
+    expect(re.test(`wildo.queue.${APP}.minion-tick.marketingScrapper`)).toBe(true);
+    expect(re.test(`wildo.reply.${APP}.minion-marketingScrapper.local-abc123`)).toBe(true);
+
+    // refused: the BACKEND's replies (historical segment-less layout)
+    expect(re.test(`wildo.reply.${APP}.local-abc123`)).toBe(false);
+    // refused: a sibling minion's replies and ticks
+    expect(re.test(`wildo.reply.${APP}.minion-other.local-abc123`)).toBe(false);
+    expect(re.test(`wildo.queue.${APP}.minion-tick.other`)).toBe(false);
+    // refused: the backend's job queue
+    expect(re.test(`wildo.queue.${APP}.jobs`)).toBe(false);
+    // refused: a name-PREFIX sibling, on both axes
+    expect(re.test(`wildo.queue.${APP}.minion-tick.marketingScrapperEvil`)).toBe(false);
+    expect(re.test(`wildo.reply.${APP}.minion-marketingScrapperEvil.local-abc123`)).toBe(false);
+  });
+
+  it('leaves the application backend completely unchanged', async () => {
+    const admin = makeAdminClientStub();
+    await RabbitmqSelfInfraProviderModule.mintAppCredentials!({ ...baseContext, adminClient: admin });
+    expect(admin.putUserSpy).toHaveBeenCalledWith('wonder-todos-local', 'orchestrator-pw-9999', []);
+    expect(admin.setPermissionsSpy).toHaveBeenCalledWith('/', 'wonder-todos-local', expect.objectContaining({ read: APP_REGEX }));
+  });
+
+  it('REVOKES the principal\'s own broker user, never the backend\'s', async () => {
+    // Same trap already caught on the Redis side: a revoke deriving the
+    // username differently deletes the BACKEND's user while believing it is
+    // removing a minion's.
+    const admin = makeAdminClientStub();
+    await RabbitmqSelfInfraProviderModule.revokeAppCredentials!({ ...baseContext, adminClient: admin, principal: MINION });
+    expect(admin.deleteUserSpy).toHaveBeenCalledWith('wonder-todos-local-minion-marketingScrapper');
+    expect(admin.deleteUserSpy).not.toHaveBeenCalledWith('wonder-todos-local');
+  });
+});
+
+describe('RabbitmqSelfInfraProviderModule.mintPlatformServiceCredentials() — Slice 2.5 / LD-8', () => {
+  it('upserts a SCOPED user with the service-namespaced regex (default policy)', async () => {
+    const admin = makeAdminClientStub();
+    const result = await RabbitmqSelfInfraProviderModule.mintPlatformServiceCredentials!({
+      serviceName: 'platform_apps_manager',
+      adminClient: admin,
+      secretInputs: { password: 'svc-pw-1234' },
+    });
+
+    expect(admin.putUserSpy).toHaveBeenCalledWith('platform_apps_manager', 'svc-pw-1234', []);
+    expect(admin.setPermissionsSpy).toHaveBeenCalledWith('/', 'platform_apps_manager', {
+      configure: '^wildo\\.platform\\.apps_manager\\..*',
+      write: '(^$|amq\\.default|^wildo\\.platform\\.apps_manager\\..*)',
+      read: '^wildo\\.platform\\.apps_manager\\..*',
+    });
+    expect(admin.setTopicPermissionsSpy).toHaveBeenCalledWith('/', 'platform_apps_manager', {
+      exchange: 'amq.topic',
+      // Same dot-escaped regex as setPermissions — Slice 2.5 unifies
+      // the two-caller divergence on this variant.
+      write: '^wildo\\.platform\\.apps_manager\\..*',
+      read: '^wildo\\.platform\\.apps_manager\\..*',
+    });
+    expect(result).not.toBeNull();
+    expect(result!.username).toBe('platform_apps_manager');
+  });
+
+  it('uses the broader regex for platform_crontabs_batches_manager (special case)', async () => {
+    const admin = makeAdminClientStub();
+    await RabbitmqSelfInfraProviderModule.mintPlatformServiceCredentials!({
+      serviceName: 'platform_crontabs_batches_manager',
+      adminClient: admin,
+      secretInputs: { password: 'cron-pw-1234' },
+    });
+
+    // Crontab override — covers all per-app queue/reply names so it
+    // can fan out scheduled jobs onto every app's queues.
+    expect(admin.setPermissionsSpy).toHaveBeenCalledWith('/', 'platform_crontabs_batches_manager', {
+      configure: '^wildo\\.(queue|reply|platform)\\..*',
+      write: '(^$|amq\\.default|^wildo\\.(queue|reply|platform)\\..*)',
+      read: '^wildo\\.(queue|reply|platform)\\..*',
+    });
+  });
+
+  it('uses the service-namespaced regex for platform_file_generator (default policy)', async () => {
+    const admin = makeAdminClientStub();
+    await RabbitmqSelfInfraProviderModule.mintPlatformServiceCredentials!({
+      serviceName: 'platform_file_generator',
+      adminClient: admin,
+      secretInputs: { password: 'fg-pw-1234' },
+    });
+
+    expect(admin.setPermissionsSpy).toHaveBeenCalledWith('/', 'platform_file_generator', {
+      configure: '^wildo\\.platform\\.file_generator\\..*',
+      write: '(^$|amq\\.default|^wildo\\.platform\\.file_generator\\..*)',
+      read: '^wildo\\.platform\\.file_generator\\..*',
+    });
+  });
+
+  it('throws when the orchestrator did not supply a password', async () => {
+    const admin = makeAdminClientStub();
+    await expect(
+      RabbitmqSelfInfraProviderModule.mintPlatformServiceCredentials!({
+        serviceName: 'platform_apps_manager',
+        adminClient: admin,
+        secretInputs: {},
+      }),
+    ).rejects.toThrow(/secretInputs is missing 'password'/);
+    expect(admin.putUserSpy).not.toHaveBeenCalled();
+  });
+});
+
+describe('RabbitmqSelfInfraProviderModule.revokeAppCredentials()', () => {
+  it('deletes the per-app user (no caller wires this in Slice 2 — F6 plan review)', async () => {
+    const admin = makeAdminClientStub();
+    await RabbitmqSelfInfraProviderModule.revokeAppCredentials!({
+      appSlug: 'wonder-todos',
+      applicationNamespace: 'wonder-todos-local',
+      wildoApplicationId: '697702debf8daa1038db3936',
+      adminClient: admin,
+      secretInputs: {},
+    });
+    expect(admin.deleteUserSpy).toHaveBeenCalledWith('wonder-todos-local');
+  });
+});
+
+
+/**
+ * The reply-queue segment must be derived from ONE source (2026-08-12).
+ *
+ * Before this, the broker permission hand-wrote `minion-<name>` while the minion's
+ * own AMQP adapter sanitised its runtime key, coupled only by a comment saying the
+ * two "mirror" each other. They agreed for `marketingScrapper` and would have
+ * diverged for any name carrying a character sanitisation rewrites — at which point
+ * the minion consumes a reply queue its permission does not match, gets
+ * `403 ACCESS_REFUSED`, and the error names a permission rather than the mismatch.
+ *
+ * These pins are written so a regression to a hand-written segment reddens even
+ * though the common case still passes.
+ */
+describe('RabbitmqSelfInfraProviderModule — reply segment derives from the shared builder', () => {
+  const APP_ID = '697702debf8daa1038db3936';
+
+  /**
+   * Drive the REAL mint path and return the granted `read` pattern. Reaching the
+   * permission through `mintAppCredentials` rather than a test-only export is what
+   * keeps this a test of shipped behaviour.
+   */
+  const readPatternForMinion = async (minionName: string): Promise<RegExp> => {
+    const admin = makeAdminClientStub();
+    await RabbitmqSelfInfraProviderModule.mintAppCredentials!({
+      appSlug: 'wonder-todos',
+      applicationNamespace: 'wonder-todos-local',
+      wildoApplicationId: APP_ID,
+      principal: { kind: ApplicationRuntimePrincipalKind.MINION, name: minionName } as never,
+      adminClient: admin,
+      secretInputs: { 'database.rabbitmq.password': 'pw' },
+    } as never);
+    const permissions = admin.setPermissionsSpy.mock.calls[0]![2];
+    return new RegExp(permissions.read);
+  };
+
+  it('matches a reply queue named with the segment the ADAPTER would emit', async () => {
+    // The adapter builds its queue name as `wildo.reply.<appId>.<segment>.<podId>`
+    // with the segment from `buildRuntimePrincipalQueueSegment`. Constructing the
+    // name the same way is what makes this a coupling test rather than a
+    // restatement of the regex.
+    const segment = buildRuntimePrincipalQueueSegment(ApplicationRuntimePrincipalKind.MINION, 'marketingScrapper');
+    const pattern = await readPatternForMinion('marketingScrapper');
+    expect(pattern.test(`wildo.reply.${APP_ID}.${segment}.pod-7`)).toBe(true);
+  });
+
+  it('⚠️ matches for a name that SANITISATION REWRITES — the latent bug', async () => {
+    // `marketing.scrapper` sanitises to `marketing-scrapper` on the adapter side.
+    // The old hand-written permission escaped the RAW name, producing
+    // `minion-marketing\.scrapper`, which that queue name never matches. This is
+    // the case that was broken and silent.
+    const name = 'marketing.scrapper';
+    const segment = buildRuntimePrincipalQueueSegment(ApplicationRuntimePrincipalKind.MINION, name);
+    expect(segment).toBe('minion-marketing-scrapper');
+    const pattern = await readPatternForMinion(name);
+    expect(pattern.test(`wildo.reply.${APP_ID}.${segment}.pod-7`)).toBe(true);
+  });
+
+  it('still refuses the APPLICATION BACKEND\'s segment-less replies', async () => {
+    // The backend keeps the historical layout, and that is the whole reason a
+    // minion permission cannot reach its replies. If the builder ever returned a
+    // segment for the backend, this reddens.
+    expect(buildRuntimePrincipalQueueSegment(ApplicationRuntimePrincipalKind.APPLICATION_BACKEND, 'anything'))
+      .toBeUndefined();
+    const pattern = await readPatternForMinion('marketingScrapper');
+    expect(pattern.test(`wildo.reply.${APP_ID}.pod-7`)).toBe(false);
+  });
+
+  it('still refuses a SIBLING minion\'s replies', async () => {
+    const sibling = buildRuntimePrincipalQueueSegment(ApplicationRuntimePrincipalKind.MINION, 'otherMinion');
+    const pattern = await readPatternForMinion('marketingScrapper');
+    expect(pattern.test(`wildo.reply.${APP_ID}.${sibling}.pod-7`)).toBe(false);
+  });
+});