borgmcp-shared 0.3.0 → 0.4.2

package/src/conformance/adapter.ts

@@ -1,6 +1,5 @@
 import {
   ErrorCode,
-  ProtocolContractError,
   compareLogCursor,
   createProtocolEnvelope,
   decodeCreateCubeResponseEnvelope,
@@ -8,16 +7,19 @@ import {
   decodeDecisionResultEnvelope,
   decodeDecisionsResultEnvelope,
   decodeEnrollmentExchangeResponseEnvelope,
+  decodeEvictDroneResultEnvelope,
+  decodeProtocolEnvelope,
   decodeProtocolErrorEnvelope,
-  decodeProtocolInfoEnvelope,
+  decodeProtocolTagPreflight,
   decodeReadLogResultEnvelope,
+  decodeReassignDroneResultEnvelope,
   decodeSseFrames,
-  negotiateProtocol,
+  PROTOCOL_LIMIT_CEILINGS,
+  PROTOCOL_HTTP_CONTRACT,
+  PROTOCOL_VERSION,
   utf8ByteLength,
-  type Capability,
   type CreateCubeResponse,
   type LogCursor,
-  type ProtocolInfo,
   type StreamEvent,
 } from '../protocol/index.js';
 import { ENROLLMENT_RETRY_CONFORMANCE } from './index.js';
@@ -35,6 +37,29 @@ export interface ConformanceCube {
   readonly id: string;
 }
 
+export interface ConformanceRole {
+  readonly id: string;
+}
+
+export interface ConformanceDrone {
+  readonly id: string;
+}
+
+export type ConformanceCubeAccess = 'read' | 'write' | 'manage';
+
+export interface ConformanceCubeManagementState {
+  readonly directive: string;
+  readonly taxonomy_marker: string | null;
+  readonly role_ids: readonly string[];
+  readonly active_decision_ids: readonly string[];
+  readonly drones: ReadonlyArray<{
+    readonly id: string;
+    readonly role_id: string;
+    readonly evicted: boolean;
+    readonly session_revoked: boolean;
+  }>;
+}
+
 export interface ConformanceAuthorityState {
   enrolled_clients: number;
   enrollment_claims: number;
@@ -57,6 +82,13 @@ export interface ConformanceCreatedCubeState {
 export interface ConformanceEnrollmentPrincipalState {
   response_client_matches: boolean;
   active_credential_bindings: number;
+  /**
+   * The principal's currently-bound credential still equals the one it enrolled
+   * with. Since the credential-free tag preflight cannot probe credentials, this
+   * out-of-band authority check is what proves a rejected mismatch retry did not
+   * overwrite the good credential.
+   */
+  bound_credential_matches_enrollment: boolean;
 }
 
 export interface ConformanceReplayBarrier {
@@ -78,7 +110,31 @@ export interface ConformanceAdmin {
   reset(): Promise<void>;
   createPrincipal(name: string): Promise<ConformancePrincipal>;
   createCube(name: string): Promise<ConformanceCube>;
-  grantCube(principal: ConformancePrincipal, cube: ConformanceCube): Promise<void>;
+  /** Grants the requested cube authority; omitted access defaults to manage. */
+  grantCube(
+    principal: ConformancePrincipal,
+    cube: ConformanceCube,
+    access?: ConformanceCubeAccess,
+  ): Promise<void>;
+  createRole(cube: ConformanceCube, input: {
+    readonly roleClass: 'queen' | 'worker';
+    readonly isHumanSeat: boolean;
+  }): Promise<ConformanceRole>;
+  createDrone(
+    principal: ConformancePrincipal,
+    cube: ConformanceCube,
+    role: ConformanceRole,
+  ): Promise<ConformanceDrone>;
+  issueManagedDroneSession(drone: ConformanceDrone): Promise<string>;
+  revokeManagedDroneSession(drone: ConformanceDrone): Promise<void>;
+  expireManagedDroneSession(drone: ConformanceDrone): Promise<void>;
+  inspectManagedDrone(drone: ConformanceDrone): Promise<{
+    readonly role_id: string;
+    readonly evicted: boolean;
+    readonly session_revoked: boolean;
+  }>;
+  /** Observes every cube field mutated by a represented manage-scoped operation. */
+  inspectCubeManagementState(cube: ConformanceCube): Promise<ConformanceCubeManagementState>;
   grantCreateCubeCapability(principal: ConformancePrincipal): Promise<void>;
   issueDroneSession(principal: ConformancePrincipal): Promise<string>;
   issueSingleUseInvitation(principal: ConformancePrincipal, purpose: 'owner' | 'client'): Promise<string>;
@@ -123,6 +179,21 @@ export interface ConformanceOperations {
     cube: ConformanceCube,
     request: unknown,
   ): Promise<ConformanceHttpResponse>;
+  updateCube(
+    credential: string,
+    cube: ConformanceCube,
+    request: unknown,
+  ): Promise<ConformanceHttpResponse>;
+  createRole(
+    credential: string,
+    cube: ConformanceCube,
+    request: unknown,
+  ): Promise<ConformanceHttpResponse>;
+  patchTaxonomy(
+    credential: string,
+    cube: ConformanceCube,
+    request: unknown,
+  ): Promise<ConformanceHttpResponse>;
   recordDecision(
     credential: string,
     cube: ConformanceCube,
@@ -133,6 +204,22 @@ export interface ConformanceOperations {
     cube: ConformanceCube,
     request: unknown,
   ): Promise<ConformanceHttpResponse>;
+  listDrones(
+    credential: string,
+    cube: ConformanceCube,
+  ): Promise<ConformanceHttpResponse>;
+  reassignDrone(
+    credential: string,
+    cube: ConformanceCube,
+    drone: ConformanceDrone,
+    request: unknown,
+  ): Promise<ConformanceHttpResponse>;
+  evictDrone(
+    credential: string,
+    cube: ConformanceCube,
+    drone: ConformanceDrone,
+    request: unknown,
+  ): Promise<ConformanceHttpResponse>;
   openStream(
     credential: string,
     cube: ConformanceCube,
@@ -147,7 +234,8 @@ export interface ConformanceEnvironment {
 
 export const ADAPTER_CONFORMANCE_FIXTURES = [
   { id: 'http.unauthenticated-liveness', area: 'http' },
-  { id: 'protocol.enrollment-auth', area: 'protocol' },
+  { id: 'protocol.credential-free-preflight', area: 'protocol' },
+  { id: 'enrollment.retry-authority', area: 'enrollment' },
   { id: 'security.adapter-boundary-injection', area: 'security' },
   { id: 'security.oversize-request', area: 'security' },
   { id: 'security.cross-cube-isolation', area: 'security' },
@@ -157,7 +245,12 @@ export const ADAPTER_CONFORMANCE_FIXTURES = [
   { id: 'acks.idempotent', area: 'acks' },
   { id: 'claims.durable-noncursor', area: 'claims' },
   { id: 'decisions.topic-supersession', area: 'decisions' },
-  { id: 'capabilities.unsupported-fails-closed', area: 'capabilities' },
+  { id: 'security.drone-management-authorization', area: 'security' },
+  { id: 'security.manage-access-matrix', area: 'security' },
+  { id: 'drones.reassign-invariants', area: 'drones' },
+  { id: 'security.cross-cube-drone-management', area: 'security' },
+  { id: 'drones.evict-terminal-signal', area: 'drones' },
+  { id: 'security.drone-session-rejection-causes', area: 'security' },
   { id: 'security.active-stream-revocation', area: 'security' },
 ] as const;
 
@@ -181,13 +274,6 @@ export interface AdapterConformanceReport {
   }>;
 }
 
-export interface EquivalentAdapterConformanceReport {
-  ok: boolean;
-  cloud: AdapterConformanceReport;
-  local: AdapterConformanceReport;
-  equivalent: boolean;
-}
-
 export interface AdapterConformanceOptions {
   /** Maximum wait for a replay, live delivery, or revocation close. */
   streamDeadlineMs?: number;
@@ -333,6 +419,20 @@ function same(left: unknown, right: unknown): boolean {
   return JSON.stringify(left) === JSON.stringify(right);
 }
 
+function listedDroneIds(response: ConformanceHttpResponse): string[] {
+  return decodeProtocolEnvelope(response.body, (payload) => {
+    invariant(typeof payload === 'object' && payload !== null, 'Roster payload is not an object.');
+    const drones = (payload as { drones?: unknown }).drones;
+    invariant(Array.isArray(drones), 'Roster payload omitted drones.');
+    return drones.map((drone) => {
+      invariant(typeof drone === 'object' && drone !== null, 'Roster contains an invalid drone.');
+      const id = (drone as { id?: unknown }).id;
+      invariant(typeof id === 'string', 'Roster drone omitted its id.');
+      return id;
+    });
+  }).payload;
+}
+
 function assertStateDelta(
   before: ConformanceAuthorityState,
   after: ConformanceAuthorityState,
@@ -410,8 +510,6 @@ export async function runAdapterConformance(
 
   let credentialA = '';
   let credentialB = '';
-  let protocolBody: unknown;
-  let protocolInfo: ProtocolInfo | null = null;
   await record('http.unauthenticated-liveness', async () => {
     const response = await environment.operations.health();
     expectStatus(response, 204, 'Unauthenticated liveness');
@@ -419,9 +517,23 @@ export async function runAdapterConformance(
     return { status: 204, bodyless: true };
   });
 
-  await record('protocol.enrollment-auth', async () => {
-    expectError(await environment.operations.protocol(null), 401, ErrorCode.AUTH_MISSING, 'Unauthenticated protocol request');
+  await record('protocol.credential-free-preflight', async () => {
+    // The tag preflight is credential-free (no bearer) and mutation-free: a
+    // client verifies pinned TLS and the exact tag before it creates or sends any
+    // credential. The server must answer 200 with ONLY the exact tag.
+    const before = await environment.admin.observeAuthorityState();
+    const response = await environment.operations.protocol(null);
+    expectStatus(response, 200, 'Credential-free protocol-tag preflight');
+    const preflight = decodeProtocolTagPreflight(response.body);
+    invariant(
+      Object.keys(preflight).length === 1 && preflight.protocol_version === PROTOCOL_VERSION,
+      'Protocol-tag preflight exposed more than the exact tag.',
+    );
+    assertStateDelta(before, await environment.admin.observeAuthorityState(), {}, 'Protocol-tag preflight');
+    return { authenticated: false, mutation_free: true, protocol_version: preflight.protocol_version };
+  });
 
+  await record('enrollment.retry-authority', async () => {
     const retryVectorErrors: string[] = [];
     for (const [index, vector] of ENROLLMENT_RETRY_CONFORMANCE.entries()) {
       for (const purpose of ['client', 'owner'] as const) {
@@ -474,23 +586,11 @@ export async function runAdapterConformance(
             );
           }
           assertStateDelta(beforeRetry, await environment.admin.observeAuthorityState(), {}, `${purpose} ${vector.name} retry`);
-          expectStatus(
-            await environment.operations.protocol(vector.initial.client_credential),
-            200,
-            `${purpose} ${vector.name} original credential continuity`,
-          );
-          if (vector.retry.client_credential !== vector.initial.client_credential) {
-            expectError(
-              await environment.operations.protocol(vector.retry.client_credential),
-              401,
-              ErrorCode.AUTH_INVALID,
-              `${purpose} ${vector.name} mismatched credential rejection`,
-            );
-          }
           invariant(
             same(await environment.admin.inspectEnrollmentPrincipal(principal, initial.client_id), {
               response_client_matches: true,
               active_credential_bindings: 1,
+              bound_credential_matches_enrollment: true,
             }),
             `${purpose} ${vector.name} changed enrollment binding ownership.`,
           );
@@ -710,37 +810,23 @@ export async function runAdapterConformance(
       ErrorCode.AUTH_INVALID,
       'Enrollment retry mismatch',
     );
-    const protocolResponse = await environment.operations.protocol(credentialA);
-    expectStatus(protocolResponse, 200, 'Authenticated protocol request');
-    protocolBody = protocolResponse.body;
-    protocolInfo = negotiateProtocol(decodeProtocolInfoEnvelope(protocolBody).payload, [
-      'log.cursor',
-      'stream.sse',
-      'stream.replay',
-      'acks',
-      'claims',
-      'decisions',
-    ]);
     return {
-      unauthenticated: ErrorCode.AUTH_MISSING,
       enrollment_status: 201,
       exact_retry_status: 201,
       mismatched_retry: ErrorCode.AUTH_INVALID,
       response_secret_free: true,
-      protocol_version: protocolInfo.protocol_version,
     };
   });
 
   await record('security.adapter-boundary-injection', async () => {
-    invariant(protocolInfo, 'Protocol fixture did not produce request limits.');
     const injectedMessage = "'); DROP TABLE log_entries; --\r\ndata: forged-sse-frame";
     const injectedBody = JSON.stringify(
       createProtocolEnvelope('inject-b1', { message: injectedMessage }),
     );
     invariant(
-      utf8ByteLength(injectedBody) <= protocolInfo.limits.max_request_bytes &&
-        utf8ByteLength(injectedMessage) <= protocolInfo.limits.max_log_message_bytes,
-      'Injection fixture exceeded an advertised request limit.',
+      utf8ByteLength(injectedBody) <= PROTOCOL_LIMIT_CEILINGS.max_request_bytes &&
+        utf8ByteLength(injectedMessage) <= PROTOCOL_LIMIT_CEILINGS.max_log_message_bytes,
+      'Injection fixture exceeded the shared request-limit ceiling.',
     );
     const injected = await environment.operations.appendRaw(
       credentialB,
@@ -800,15 +886,14 @@ export async function runAdapterConformance(
   });
 
   await record('security.oversize-request', async () => {
-    invariant(protocolInfo, 'Protocol fixture did not produce request limits.');
     const baseBody = JSON.stringify(
       createProtocolEnvelope('oversize-a1', { message: 'must-not-persist' }),
     );
     const oversizedBody = baseBody + ' '.repeat(
-      Math.max(0, protocolInfo.limits.max_request_bytes - utf8ByteLength(baseBody) + 1),
+      Math.max(0, PROTOCOL_LIMIT_CEILINGS.max_request_bytes - utf8ByteLength(baseBody) + 1),
     );
     invariant(
-      utf8ByteLength(oversizedBody) > protocolInfo.limits.max_request_bytes,
+      utf8ByteLength(oversizedBody) > PROTOCOL_LIMIT_CEILINGS.max_request_bytes,
       'Oversize fixture did not exceed max_request_bytes.',
     );
     const response = await environment.operations.appendRaw(credentialA, cubeA, oversizedBody);
@@ -995,20 +1080,489 @@ export async function runAdapterConformance(
     return { active_count: 1, active_decision: 'second', supersedes_first: true };
   });
 
-  await record('capabilities.unsupported-fails-closed', async () => {
-    invariant(protocolBody, 'Protocol fixture did not produce an envelope.');
-    let code: ErrorCode | null = null;
-    try {
-      negotiateProtocol(
-        decodeProtocolInfoEnvelope(protocolBody).payload,
-        ['future.required' as Capability],
+  let workerRoleA!: ConformanceRole;
+  let workerRoleB!: ConformanceRole;
+  let managedWorker!: ConformanceDrone;
+  let readCredential = '';
+  let writeCredential = '';
+  let workerSession = '';
+  await record('security.drone-management-authorization', async () => {
+    workerRoleA = await environment.admin.createRole(cubeA, {
+      roleClass: 'worker', isHumanSeat: false,
+    });
+    managedWorker = await environment.admin.createDrone(principalA, cubeA, workerRoleA);
+    const deniedCredentials: Array<{ access: 'read' | 'write'; credential: string }> = [];
+    for (const [index, access] of ['read', 'write'].entries()) {
+      const principalName = access === 'read' ? 'Coordinator' : 'write-principal';
+      const principal = await environment.admin.createPrincipal(principalName);
+      await environment.admin.grantCube(principal, cubeA, access as 'read' | 'write');
+      const invitation = await environment.admin.issueSingleUseInvitation(principal, 'client');
+      const credential = `${(access === 'read' ? 'R' : 'W').repeat(42)}Q`;
+      if (access === 'read') readCredential = credential;
+      else writeCredential = credential;
+      const enrollment = await environment.operations.enroll(createProtocolEnvelope(
+        `${access}-principal-enroll`,
+        {
+          invitation,
+          retry_key: `00000000-0000-4000-8000-${String(301 + index).padStart(12, '0')}`,
+          client_credential: credential,
+          client_name: principalName,
+        },
+      ));
+      expectStatus(enrollment, 201, `${access} principal enrollment`);
+      deniedCredentials.push({ access: access as 'read' | 'write', credential });
+    }
+    for (const { access, credential } of deniedCredentials) {
+      expectError(
+        await environment.operations.reassignDrone(
+          credential,
+          cubeA,
+          managedWorker,
+          createProtocolEnvelope(`${access}-reassign-denied`, { role_id: workerRoleA.id }),
+        ),
+        403,
+        ErrorCode.ACCESS_DENIED,
+        `${access} principal reassignment`,
+      );
+      expectError(
+        await environment.operations.evictDrone(
+          credential,
+          cubeA,
+          managedWorker,
+          createProtocolEnvelope(`${access}-evict-denied`, {}),
+        ),
+        403,
+        ErrorCode.ACCESS_DENIED,
+        `${access} principal eviction`,
+      );
+    }
+    return { read_status: 403, write_status: 403, manage_required: true };
+  });
+
+  await record('security.manage-access-matrix', async () => {
+    const noGrantPrincipal = await environment.admin.createPrincipal('Coordinator role without cube grant');
+    const noGrantInvitation = await environment.admin.issueSingleUseInvitation(noGrantPrincipal, 'client');
+    const noGrantCredential = `${'N'.repeat(42)}Q`;
+    expectStatus(await environment.operations.enroll(createProtocolEnvelope(
+      'no-grant-principal-enroll',
+      {
+        invitation: noGrantInvitation,
+        retry_key: '00000000-0000-4000-8000-000000000303',
+        client_credential: noGrantCredential,
+        client_name: 'Coordinator',
+      },
+    )), 201, 'No-grant principal enrollment');
+
+    const droneCredential = await environment.admin.issueManagedDroneSession(managedWorker);
+    const matrixTargetRole = await environment.admin.createRole(cubeA, {
+      roleClass: 'worker', isHumanSeat: false,
+    });
+    const evictionTarget = await environment.admin.createDrone(principalA, cubeA, workerRoleA);
+    await environment.admin.issueManagedDroneSession(evictionTarget);
+    const unknownCube = { id: '00000000-0000-4000-8000-000000000399' };
+    const snapshot = async (): Promise<unknown> => ({
+      cubeA: await environment.admin.inspectCubeManagementState(cubeA),
+      cubeB: await environment.admin.inspectCubeManagementState(cubeB),
+    });
+    const operations: ReadonlyArray<{
+      name: string;
+      successStatus: number;
+      invoke: (credential: string, cube: ConformanceCube) => Promise<ConformanceHttpResponse>;
+    }> = [
+      {
+        name: 'cube-update',
+        successStatus: 200,
+        invoke: (credential, cube) => environment.operations.updateCube(
+          credential,
+          cube,
+          createProtocolEnvelope('matrix-cube-update', { cube_directive: 'matrix-directive' }),
+        ),
+      },
+      {
+        name: 'role-create',
+        successStatus: 201,
+        invoke: (credential, cube) => environment.operations.createRole(
+          credential,
+          cube,
+          createProtocolEnvelope('matrix-role-create', { name: 'Matrix Role' }),
+        ),
+      },
+      {
+        name: 'taxonomy-patch',
+        successStatus: 200,
+        invoke: (credential, cube) => environment.operations.patchTaxonomy(
+          credential,
+          cube,
+          createProtocolEnvelope('matrix-taxonomy-patch', { marker: 'matrix-taxonomy' }),
+        ),
+      },
+      {
+        name: 'decision-record',
+        successStatus: 201,
+        invoke: (credential, cube) => environment.operations.recordDecision(
+          credential,
+          cube,
+          createProtocolEnvelope('matrix-decision-record', {
+            topic: 'matrix-authority', decision: 'manage only',
+          }),
+        ),
+      },
+      {
+        name: 'drone-reassign',
+        successStatus: 200,
+        invoke: (credential, cube) => environment.operations.reassignDrone(
+          credential,
+          cube,
+          managedWorker,
+          createProtocolEnvelope('matrix-drone-reassign', { role_id: matrixTargetRole.id }),
+        ),
+      },
+      {
+        name: 'drone-evict',
+        successStatus: 200,
+        invoke: (credential, cube) => environment.operations.evictDrone(
+          credential,
+          cube,
+          evictionTarget,
+          createProtocolEnvelope('matrix-drone-evict', {}),
+        ),
+      },
+    ];
+
+    for (const operation of operations) {
+      for (const [kind, credential] of [
+        ['read', readCredential],
+        ['write', writeCredential],
+        ['drone-session', droneCredential],
+      ] as const) {
+        const before = await snapshot();
+        expectError(
+          await operation.invoke(credential, cubeA),
+          403,
+          ErrorCode.ACCESS_DENIED,
+          `${operation.name} by ${kind} principal`,
+        );
+        invariant(same(await snapshot(), before), `${operation.name} mutated state after ${kind} denial.`);
+      }
+      for (const [kind, credential, cube] of [
+        ['no-grant', noGrantCredential, cubeA],
+        ['foreign-principal', credentialB, cubeA],
+        ['foreign-cube', credentialA, cubeB],
+        ['unknown-cube', credentialA, unknownCube],
+      ] as const) {
+        const before = await snapshot();
+        expectError(
+          await operation.invoke(credential, cube),
+          404,
+          ErrorCode.NOT_FOUND,
+          `${operation.name} against ${kind}`,
+        );
+        invariant(same(await snapshot(), before), `${operation.name} mutated state after ${kind} denial.`);
+      }
+      const beforeSuccess = await environment.admin.inspectCubeManagementState(cubeA);
+      const success = await operation.invoke(credentialA, cubeA);
+      expectStatus(success, operation.successStatus, `${operation.name} by managing principal`);
+      invariant(
+        !same(await environment.admin.inspectCubeManagementState(cubeA), beforeSuccess),
+        `${operation.name} managing success did not mutate its declared state.`,
+      );
+    }
+    return {
+      operation_count: operations.length,
+      manage_success: true,
+      read_write_status: 403,
+      drone_session_status: 403,
+      hidden_status: 404,
+      denied_mutations: 0,
+      role_labels_authoritative: false,
+    };
+  });
+
+  await record('drones.reassign-invariants', async () => {
+    workerRoleB = await environment.admin.createRole(cubeA, {
+      roleClass: 'worker', isHumanSeat: false,
+    });
+    const humanSourceRole = await environment.admin.createRole(cubeA, {
+      roleClass: 'worker', isHumanSeat: true,
+    });
+    const queenRole = await environment.admin.createRole(cubeA, {
+      roleClass: 'queen', isHumanSeat: false,
+    });
+    const occupiedHumanRole = await environment.admin.createRole(cubeA, {
+      roleClass: 'worker', isHumanSeat: true,
+    });
+    const humanSource = await environment.admin.createDrone(principalA, cubeA, humanSourceRole);
+    await environment.admin.createDrone(principalA, cubeA, occupiedHumanRole);
+    const contender = await environment.admin.createDrone(principalA, cubeA, workerRoleA);
+    workerSession = await environment.admin.issueManagedDroneSession(managedWorker);
+
+    const reassigned = await environment.operations.reassignDrone(
+      credentialA,
+      cubeA,
+      managedWorker,
+      createProtocolEnvelope('reassign-worker', { role_id: workerRoleB.id }),
+    );
+    expectStatus(reassigned, 200, 'Worker reassignment');
+    const reassignedDrone = decodeReassignDroneResultEnvelope(reassigned.body).payload.drone;
+    invariant(
+      reassignedDrone.id === managedWorker.id && reassignedDrone.role_id === workerRoleB.id,
+      'Reassignment response did not identify the persisted target role.',
+    );
+
+    expectError(
+      await environment.operations.reassignDrone(
+        workerSession,
+        cubeA,
+        managedWorker,
+        createProtocolEnvelope('reassign-drone-session-denied', { role_id: workerRoleA.id }),
+      ),
+      403,
+      ErrorCode.ACCESS_DENIED,
+      'Drone-session reassignment',
+    );
+    expectError(
+      await environment.operations.reassignDrone(
+        credentialA,
+        cubeA,
+        managedWorker,
+        createProtocolEnvelope('reassign-queen-denied', { role_id: queenRole.id }),
+      ),
+      403,
+      ErrorCode.ACCESS_DENIED,
+      'Worker-to-queen reassignment',
+    );
+    const promoted = await environment.operations.reassignDrone(
+      credentialA,
+      cubeA,
+      humanSource,
+      createProtocolEnvelope('reassign-queen-allowed', { role_id: queenRole.id }),
+    );
+    expectStatus(promoted, 200, 'Human-seat-to-queen reassignment');
+    invariant(
+      decodeReassignDroneResultEnvelope(promoted.body).payload.drone.role_id === queenRole.id,
+      'Human-seat-to-queen reassignment did not persist.',
+    );
+    expectError(
+      await environment.operations.reassignDrone(
+        credentialA,
+        cubeA,
+        contender,
+        createProtocolEnvelope('reassign-occupied-denied', { role_id: occupiedHumanRole.id }),
+      ),
+      409,
+      ErrorCode.ROLE_IN_USE,
+      'Occupied human-seat reassignment',
+    );
+    return {
+      worker_reassigned: true,
+      drone_session_denied: true,
+      queen_requires_human_seat: true,
+      occupied_human_seat_denied: true,
+    };
+  });
+
+  await record('security.cross-cube-drone-management', async () => {
+    const foreignRole = await environment.admin.createRole(cubeB, {
+      roleClass: 'worker', isHumanSeat: false,
+    });
+    const foreignDrone = await environment.admin.createDrone(principalB, cubeB, foreignRole);
+    expectError(
+      await environment.operations.reassignDrone(
+        credentialA,
+        cubeB,
+        foreignDrone,
+        createProtocolEnvelope('cross-cube-reassign', { role_id: foreignRole.id }),
+      ),
+      404,
+      ErrorCode.NOT_FOUND,
+      'Cross-cube reassignment',
+    );
+    expectError(
+      await environment.operations.evictDrone(
+        credentialA,
+        cubeB,
+        foreignDrone,
+        createProtocolEnvelope('cross-cube-evict', {}),
+      ),
+      404,
+      ErrorCode.NOT_FOUND,
+      'Cross-cube eviction',
+    );
+    expectError(
+      await environment.operations.reassignDrone(
+        credentialA,
+        cubeA,
+        foreignDrone,
+        createProtocolEnvelope('foreign-drone-local-route', { role_id: workerRoleA.id }),
+      ),
+      404,
+      ErrorCode.NOT_FOUND,
+      'Foreign drone reassignment through authorized cube route',
+    );
+    expectError(
+      await environment.operations.evictDrone(
+        credentialA,
+        cubeA,
+        foreignDrone,
+        createProtocolEnvelope('foreign-drone-local-evict', {}),
+      ),
+      404,
+      ErrorCode.NOT_FOUND,
+      'Foreign drone eviction through authorized cube route',
+    );
+    expectError(
+      await environment.operations.reassignDrone(
+        credentialA,
+        cubeA,
+        managedWorker,
+        createProtocolEnvelope('foreign-role-local-drone', { role_id: foreignRole.id }),
+      ),
+      404,
+      ErrorCode.NOT_FOUND,
+      'Foreign role reassignment through authorized cube route',
+    );
+    await environment.admin.grantCube(principalA, cubeB, 'read');
+    const foreignDroneBefore = await environment.admin.inspectManagedDrone(foreignDrone);
+    expectError(
+      await environment.operations.reassignDrone(
+        workerSession,
+        cubeB,
+        foreignDrone,
+        createProtocolEnvelope('bound-drone-cross-cube-reassign', { role_id: foreignRole.id }),
+      ),
+      404,
+      ErrorCode.NOT_FOUND,
+      'Bound drone cross-cube reassignment',
+    );
+    invariant(
+      same(await environment.admin.inspectManagedDrone(foreignDrone), foreignDroneBefore),
+      'Bound drone cross-cube reassignment mutated the foreign target.',
+    );
+    expectError(
+      await environment.operations.evictDrone(
+        workerSession,
+        cubeB,
+        foreignDrone,
+        createProtocolEnvelope('bound-drone-cross-cube-evict', {}),
+      ),
+      404,
+      ErrorCode.NOT_FOUND,
+      'Bound drone cross-cube eviction',
+    );
+    invariant(
+      same(await environment.admin.inspectManagedDrone(foreignDrone), foreignDroneBefore),
+      'Bound drone cross-cube eviction mutated the foreign target.',
+    );
+    return {
+      unauthorized_cube_status: 404,
+      foreign_drone_status: 404,
+      foreign_role_status: 404,
+      bound_drone_cross_cube_status: 404,
+      code: ErrorCode.NOT_FOUND,
+    };
+  });
+
+  await record('drones.evict-terminal-signal', async () => {
+    const evictedDrone = await environment.admin.createDrone(principalA, cubeA, workerRoleA);
+    const evictedCredential = await environment.admin.issueManagedDroneSession(evictedDrone);
+    expectStatus(
+      await environment.operations.read(
+        evictedCredential,
+        cubeA,
+        createProtocolEnvelope('evict-probe-before', { cursor: null, limit: 1 }),
+      ),
+      200,
+      'Pre-eviction seat probe',
+    );
+    const before = await environment.operations.listDrones(credentialA, cubeA);
+    expectStatus(before, 200, 'Pre-eviction roster');
+    invariant(listedDroneIds(before).includes(evictedDrone.id), 'Active drone was absent from roster.');
+
+    const evicted = await environment.operations.evictDrone(
+      credentialA,
+      cubeA,
+      evictedDrone,
+      createProtocolEnvelope('evict-managed-drone', {}),
+    );
+    expectStatus(evicted, 200, 'Drone eviction');
+    invariant(
+      same(decodeEvictDroneResultEnvelope(evicted.body).payload, {
+        drone_id: evictedDrone.id,
+        evicted: true,
+      }),
+      'Eviction response did not identify the terminal seat.',
+    );
+    invariant(
+      same(await environment.admin.inspectManagedDrone(evictedDrone), {
+        role_id: workerRoleA.id,
+        evicted: true,
+        session_revoked: true,
+      }),
+      'Eviction did not atomically mark the drone evicted and revoke its session.',
+    );
+    const after = await environment.operations.listDrones(credentialA, cubeA);
+    expectStatus(after, 200, 'Post-eviction roster');
+    invariant(!listedDroneIds(after).includes(evictedDrone.id), 'Evicted drone remained in roster.');
+    expectError(
+      await environment.operations.append(
+        credentialA,
+        cubeA,
+        createProtocolEnvelope('evict-direct-target', {
+          message: 'must-not-fan-out',
+          visibility: 'direct',
+          recipientDroneIds: [evictedDrone.id],
+        }),
+      ),
+      404,
+      ErrorCode.NOT_FOUND,
+      'Evicted direct recipient',
+    );
+    expectError(
+      await environment.operations.read(
+        evictedCredential,
+        cubeA,
+        createProtocolEnvelope('evict-probe-after', { cursor: null, limit: 1 }),
+      ),
+      PROTOCOL_HTTP_CONTRACT.drone_evicted_status,
+      ErrorCode.DRONE_EVICTED,
+      'Evicted seat probe',
+    );
+    return {
+      eviction_status: 200,
+      roster_visible: false,
+      fanout_reachable: false,
+      old_bearer_status: 410,
+      old_bearer_code: ErrorCode.DRONE_EVICTED,
+    };
+  });
+
+  await record('security.drone-session-rejection-causes', async () => {
+    const revokedDrone = await environment.admin.createDrone(principalA, cubeA, workerRoleA);
+    const expiredDrone = await environment.admin.createDrone(principalA, cubeA, workerRoleA);
+    const revokedCredential = await environment.admin.issueManagedDroneSession(revokedDrone);
+    const expiredCredential = await environment.admin.issueManagedDroneSession(expiredDrone);
+    await environment.admin.revokeManagedDroneSession(revokedDrone);
+    await environment.admin.expireManagedDroneSession(expiredDrone);
+    for (const [label, credential] of [
+      ['revoked', revokedCredential],
+      ['expired', expiredCredential],
+    ] as const) {
+      expectError(
+        await environment.operations.read(
+          credential,
+          cubeA,
+          createProtocolEnvelope(`${label}-seat-probe`, { cursor: null, limit: 1 }),
+        ),
+        401,
+        ErrorCode.SESSION_REVOKED,
+        `${label} seat probe`,
       );
-    } catch (error) {
-      if (error instanceof ProtocolContractError) code = error.code;
-      else throw error;
     }
-    invariant(code === ErrorCode.UNSUPPORTED_CAPABILITY, 'Unsupported capability did not fail closed client-side.');
-    return { code };
+    return {
+      revoked_status: 401,
+      expired_status: 401,
+      code: ErrorCode.SESSION_REVOKED,
+    };
   });
 
   await record('security.active-stream-revocation', async () => {
@@ -1046,21 +1600,3 @@ export async function runAdapterConformance(
   const normalizedTranscript = results.map(({ id, observations }) => ({ id, observations }));
   return { ok: results.every((result) => result.ok), results, normalizedTranscript };
 }
-
-export async function runEquivalentAdapterConformance(
-  cloud: ConformanceEnvironment,
-  local: ConformanceEnvironment,
-  options: AdapterConformanceOptions = {},
-): Promise<EquivalentAdapterConformanceReport> {
-  const [cloudReport, localReport] = await Promise.all([
-    runAdapterConformance(cloud, options),
-    runAdapterConformance(local, options),
-  ]);
-  const equivalent = same(cloudReport.normalizedTranscript, localReport.normalizedTranscript);
-  return {
-    ok: cloudReport.ok && localReport.ok && equivalent,
-    cloud: cloudReport,
-    local: localReport,
-    equivalent,
-  };
-}