borgmcp-shared 0.4.0 → 0.4.3

package/README.md

@@ -88,8 +88,14 @@ Every JSON coordination request and successful JSON response is carried inside
 exceptions are the `204` liveness and acknowledgement responses. Payload codecs
 are exported separately so adapters can validate the envelope first and then
 validate the operation-specific payload without accepting ambiguous fields.
+Cube managers reassign a seat with `PATCH /api/cubes/:cubeId/drones/:droneId`
+and evict one with `DELETE` on the same path. Both operations use strict
+versioned request and success envelopes. An evicted seat's former bearer receives
+the terminal `410 DRONE_EVICTED` signal; revoked sessions return
+`401 SESSION_REVOKED`, while expired sessions return the only recoverable
+authentication outcome, `401 AUTH_EXPIRED`.
 See [docs/enrollment.md](docs/enrollment.md) for purpose-bound owner enrollment,
-ordinary ungranted enrollment, cube creation, pending-keychain, and retry contracts.
+ordinary ungranted enrollment, cube creation, pending enrollment, and retry contracts.
 
 ## Conformance
 
@@ -99,14 +105,19 @@ readonly data rather than Vitest-specific helpers, so they work with any test
 runner and in any JavaScript runtime. Cases cover HTTP and canonical errors,
 credential misuse, isolation and revocation, SSE framing/replay/cursor ordering,
 executable enrollment authority/retry/mismatch/redaction and cube-create
-idempotency, acks, claims, and decisions.
+idempotency, acks, claims, decisions, cube-scoped drone reassignment, role-class
+and single-seat invariants, eviction exclusion, and terminal bearer signaling.
+Manage-scoped cube, role, taxonomy, decision, and drone operations also share an
+authority matrix: managing parents may mutate; known same-cube read/write
+parents receive `403 ACCESS_DENIED`; drone sessions remain non-managing; and
+no-grant, foreign, or unknown cubes remain hidden behind `404 NOT_FOUND`.
 
 Implement `AdapterConformanceDriver` with raw responses from the target adapter,
 then call `runAdapterConformance`. The runner creates and decodes envelopes,
 drives state transitions, and decides pass/fail; adapters do not submit expected
-results. `runEquivalentAdapterConformance(cloud, local)` executes the identical
-sequence against both implementations and fails when either implementation or
-their normalized observable transcripts diverge.
+results. Each server or client adapter runs this single portable suite against
+its local/self-hosted implementation. The package does not define a second
+authority, migration target, or fallback implementation.
 
 The package's own suite covers built-in templates, role-section patching,
 broadcast high-water-mark ordering, drone-address formatting, and current public
@@ -126,17 +137,19 @@ the coordinated rollout order for introducing protocol changes.
 
 ## Distribution
 
-`borgmcp-shared@0.3.0` is the published v1 baseline on the registry (its latest
-release) and is immutable. This source now identifies the still-unpublished
-`0.4.0` candidate for the breaking clean-slate v2 contract — its package
-manifest, lockfile, exported identity, and the SBOM / packed-artifact verifiers
-all read `0.4.0`. This reviewed version bump grants no tag or publish authority
-and must not republish `0.3.0`; creating the annotated `v0.4.0` tag and the
-registry publication remain separate, independently gated steps. After that
-separately authorized registry release, consumers adopting this contract pin
-`borgmcp-shared@^0.4.0` and commit registry lockfiles. No registry token belongs
-in this repository, package metadata, lockfiles, or a committed `.npmrc`;
-publishing uses protected external credentials and provenance.
+`borgmcp-shared@0.4.0` is the published clean-slate v2 baseline and is
+immutable, but its artifact predates the local/self-hosted package cleanup. The
+immutable `v0.4.1` verification artifact exposed a platform-dependent SBOM audit
+and must never be published, moved, reused, rerun, or substituted.
+`borgmcp-shared@0.4.2` is published and immutable. This source now identifies
+the unpublished `0.4.3` session-lifecycle contract release: expired credentials
+return `AUTH_EXPIRED`, while explicitly revoked credentials return `SESSION_REVOKED`.
+This reviewed version bump grants no tag or publish authority; creating the
+annotated `v0.4.3` tag and publishing its exact reviewed artifact remain separate,
+independently gated steps. After that release, consumers pin exact
+`borgmcp-shared@0.4.3` and commit registry lockfiles. No registry token belongs in
+this repository, package metadata, lockfiles, or a committed `.npmrc`; publishing
+uses protected external credentials and provenance.
 
 The first client and server releases must consume the reviewed registry release,
 not a Git, tag, or local-path dependency. Public release requires the

package/SECURITY.md

@@ -6,10 +6,10 @@ Please report suspected vulnerabilities privately through GitHub Security
 Advisories for this repository. Open the repository's **Security** tab, select
 **Advisories**, and choose **Report a vulnerability**.
 
-If GitHub's private reporting interface is unavailable, email
-`queen@borgmcp.ai`. Do not include credentials, access tokens, customer data,
-or other secrets unless the maintainers explicitly request them through an
-encrypted channel.
+If GitHub's private reporting interface is unavailable, do not open a public
+issue containing vulnerability details. Wait until private repository reporting
+is available. Do not include credentials, access tokens, user data, or other
+secrets unless the maintainers explicitly request them through a secure channel.
 
 Do not disclose the issue publicly until the maintainers confirm that a fix is
 available and coordinated disclosure is appropriate.
@@ -18,7 +18,8 @@ available and coordinated disclosure is appropriate.
 
 Security reports may concern this package's published artifacts, protocol
 contracts, conformance data, dependency chain, or documentation. Vulnerabilities
-in hosted Borg MCP services can be reported through the same channels.
+in the client or self-hosted server belong in those repositories' private
+security-reporting channels.
 
 Only supported package versions receive security fixes. The latest published
 version is always supported; older versions may receive fixes when a safe

package/dist/conformance/adapter.d.ts

@@ -9,6 +9,25 @@ export interface ConformancePrincipal {
 export interface ConformanceCube {
     readonly id: string;
 }
+export interface ConformanceRole {
+    readonly id: string;
+}
+export interface ConformanceDrone {
+    readonly id: string;
+}
+export type ConformanceCubeAccess = 'read' | 'write' | 'manage';
+export interface ConformanceCubeManagementState {
+    readonly directive: string;
+    readonly taxonomy_marker: string | null;
+    readonly role_ids: readonly string[];
+    readonly active_decision_ids: readonly string[];
+    readonly drones: ReadonlyArray<{
+        readonly id: string;
+        readonly role_id: string;
+        readonly evicted: boolean;
+        readonly session_revoked: boolean;
+    }>;
+}
 export interface ConformanceAuthorityState {
     enrolled_clients: number;
     enrollment_claims: number;
@@ -42,7 +61,21 @@ export interface ConformanceAdmin {
     reset(): Promise<void>;
     createPrincipal(name: string): Promise<ConformancePrincipal>;
     createCube(name: string): Promise<ConformanceCube>;
-    grantCube(principal: ConformancePrincipal, cube: ConformanceCube): Promise<void>;
+    grantCube(principal: ConformancePrincipal, cube: ConformanceCube, access?: ConformanceCubeAccess): Promise<void>;
+    createRole(cube: ConformanceCube, input: {
+        readonly roleClass: 'queen' | 'worker';
+        readonly isHumanSeat: boolean;
+    }): Promise<ConformanceRole>;
+    createDrone(principal: ConformancePrincipal, cube: ConformanceCube, role: ConformanceRole): Promise<ConformanceDrone>;
+    issueManagedDroneSession(drone: ConformanceDrone): Promise<string>;
+    revokeManagedDroneSession(drone: ConformanceDrone): Promise<void>;
+    expireManagedDroneSession(drone: ConformanceDrone): Promise<void>;
+    inspectManagedDrone(drone: ConformanceDrone): Promise<{
+        readonly role_id: string;
+        readonly evicted: boolean;
+        readonly session_revoked: boolean;
+    }>;
+    inspectCubeManagementState(cube: ConformanceCube): Promise<ConformanceCubeManagementState>;
     grantCreateCubeCapability(principal: ConformancePrincipal): Promise<void>;
     issueDroneSession(principal: ConformancePrincipal): Promise<string>;
     issueSingleUseInvitation(principal: ConformancePrincipal, purpose: 'owner' | 'client'): Promise<string>;
@@ -62,8 +95,14 @@ export interface ConformanceOperations {
     appendRaw(credential: string, cube: ConformanceCube, body: string): Promise<ConformanceHttpResponse>;
     read(credential: string, cube: ConformanceCube, request: unknown): Promise<ConformanceHttpResponse>;
     ack(credential: string, cube: ConformanceCube, request: unknown): Promise<ConformanceHttpResponse>;
+    updateCube(credential: string, cube: ConformanceCube, request: unknown): Promise<ConformanceHttpResponse>;
+    createRole(credential: string, cube: ConformanceCube, request: unknown): Promise<ConformanceHttpResponse>;
+    patchTaxonomy(credential: string, cube: ConformanceCube, request: unknown): Promise<ConformanceHttpResponse>;
     recordDecision(credential: string, cube: ConformanceCube, request: unknown): Promise<ConformanceHttpResponse>;
     listDecisions(credential: string, cube: ConformanceCube, request: unknown): Promise<ConformanceHttpResponse>;
+    listDrones(credential: string, cube: ConformanceCube): Promise<ConformanceHttpResponse>;
+    reassignDrone(credential: string, cube: ConformanceCube, drone: ConformanceDrone, request: unknown): Promise<ConformanceHttpResponse>;
+    evictDrone(credential: string, cube: ConformanceCube, drone: ConformanceDrone, request: unknown): Promise<ConformanceHttpResponse>;
     openStream(credential: string, cube: ConformanceCube, cursor: LogCursor | null): Promise<ConformanceStreamResponse>;
 }
 export interface ConformanceEnvironment {
@@ -106,6 +145,24 @@ export declare const ADAPTER_CONFORMANCE_FIXTURES: readonly [{
 }, {
     readonly id: "decisions.topic-supersession";
     readonly area: "decisions";
+}, {
+    readonly id: "security.drone-management-authorization";
+    readonly area: "security";
+}, {
+    readonly id: "security.manage-access-matrix";
+    readonly area: "security";
+}, {
+    readonly id: "drones.reassign-invariants";
+    readonly area: "drones";
+}, {
+    readonly id: "security.cross-cube-drone-management";
+    readonly area: "security";
+}, {
+    readonly id: "drones.evict-terminal-signal";
+    readonly area: "drones";
+}, {
+    readonly id: "security.drone-session-rejection-causes";
+    readonly area: "security";
 }, {
     readonly id: "security.active-stream-revocation";
     readonly area: "security";
@@ -125,16 +182,9 @@ export interface AdapterConformanceReport {
         observations: Record<string, unknown>;
     }>;
 }
-export interface EquivalentAdapterConformanceReport {
-    ok: boolean;
-    cloud: AdapterConformanceReport;
-    local: AdapterConformanceReport;
-    equivalent: boolean;
-}
 export interface AdapterConformanceOptions {
     streamDeadlineMs?: number;
     pendingProbeMs?: number;
 }
 export declare function runAdapterConformance(environment: ConformanceEnvironment, options?: AdapterConformanceOptions): Promise<AdapterConformanceReport>;
-export declare function runEquivalentAdapterConformance(cloud: ConformanceEnvironment, local: ConformanceEnvironment, options?: AdapterConformanceOptions): Promise<EquivalentAdapterConformanceReport>;
 //# sourceMappingURL=adapter.d.ts.map

package/dist/conformance/adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../src/conformance/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAgBL,KAAK,kBAAkB,EACvB,KAAK,SAAS,EAEf,MAAM,sBAAsB,CAAC;AAG9B,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,OAAO,CAAC;IACrB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,uBAAuB,EAAE,OAAO,CAAC;IACjC,2BAA2B,EAAE,OAAO,CAAC;CACtC;AAED,MAAM,WAAW,mCAAmC;IAClD,uBAAuB,EAAE,OAAO,CAAC;IACjC,0BAA0B,EAAE,MAAM,CAAC;IAOnC,mCAAmC,EAAE,OAAO,CAAC;CAC9C;AAED,MAAM,WAAW,wBAAwB;IAEvC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,yBAA0B,SAAQ,uBAAuB;IAExE,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;CACtC;AAMD,MAAM,WAAW,gBAAgB;IAC/B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC7D,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACnD,SAAS,CAAC,SAAS,EAAE,oBAAoB,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjF,yBAAyB,CAAC,SAAS,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E,iBAAiB,CAAC,SAAS,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,wBAAwB,CAAC,SAAS,EAAE,oBAAoB,EAAE,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxG,qBAAqB,IAAI,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC5D,kBAAkB,CAChB,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,kBAAkB,GAC3B,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACxC,0BAA0B,CACxB,SAAS,EAAE,oBAAoB,EAC/B,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,mCAAmC,CAAC,CAAC;IAChD,eAAe,CAAC,SAAS,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,YAAY,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,mBAAmB,IAAI,wBAAwB,CAAC;CACjD;AAGD,MAAM,WAAW,qBAAqB;IACpC,MAAM,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC3C,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACtE,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC3D,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC1F,MAAM,CACJ,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAEpC,SAAS,CACP,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,IAAI,CACF,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,GAAG,CACD,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,cAAc,CACZ,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,aAAa,CACX,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,UAAU,CACR,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,SAAS,GAAG,IAAI,GACvB,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;CAC5C;AAED,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAc/B,CAAC;AAEX,MAAM,MAAM,2BAA2B,GACrC,CAAC,OAAO,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;AAEtD,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,2BAA2B,CAAC;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,wBAAwB,EAAE,CAAC;IAEpC,oBAAoB,EAAE,aAAa,CAAC;QAClC,EAAE,EAAE,2BAA2B,CAAC;QAChC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACvC,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,kCAAkC;IACjD,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,wBAAwB,CAAC;IAChC,KAAK,EAAE,wBAAwB,CAAC;IAChC,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,yBAAyB;IAExC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAwLD,wBAAsB,qBAAqB,CACzC,WAAW,EAAE,sBAAsB,EACnC,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,wBAAwB,CAAC,CA0nBnC;AAED,wBAAsB,+BAA+B,CACnD,KAAK,EAAE,sBAAsB,EAC7B,KAAK,EAAE,sBAAsB,EAC7B,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,kCAAkC,CAAC,CAY7C"}
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../src/conformance/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAoBL,KAAK,kBAAkB,EACvB,KAAK,SAAS,EAEf,MAAM,sBAAsB,CAAC;AAG9B,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEhE,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;QAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;KACnC,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,yBAAyB;IACxC,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,OAAO,CAAC;IACrB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,uBAAuB,EAAE,OAAO,CAAC;IACjC,2BAA2B,EAAE,OAAO,CAAC;CACtC;AAED,MAAM,WAAW,mCAAmC;IAClD,uBAAuB,EAAE,OAAO,CAAC;IACjC,0BAA0B,EAAE,MAAM,CAAC;IAOnC,mCAAmC,EAAE,OAAO,CAAC;CAC9C;AAED,MAAM,WAAW,wBAAwB;IAEvC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,yBAA0B,SAAQ,uBAAuB;IAExE,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;CACtC;AAMD,MAAM,WAAW,gBAAgB;IAC/B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC7D,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAEnD,SAAS,CACP,SAAS,EAAE,oBAAoB,EAC/B,IAAI,EAAE,eAAe,EACrB,MAAM,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,UAAU,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE;QACvC,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,QAAQ,CAAC;QACvC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;KAC/B,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7B,WAAW,CACT,SAAS,EAAE,oBAAoB,EAC/B,IAAI,EAAE,eAAe,EACrB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7B,wBAAwB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE,yBAAyB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,yBAAyB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC;QACpD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;KACnC,CAAC,CAAC;IAEH,0BAA0B,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC3F,yBAAyB,CAAC,SAAS,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E,iBAAiB,CAAC,SAAS,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,wBAAwB,CAAC,SAAS,EAAE,oBAAoB,EAAE,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxG,qBAAqB,IAAI,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC5D,kBAAkB,CAChB,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,kBAAkB,GAC3B,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACxC,0BAA0B,CACxB,SAAS,EAAE,oBAAoB,EAC/B,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,mCAAmC,CAAC,CAAC;IAChD,eAAe,CAAC,SAAS,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,YAAY,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,mBAAmB,IAAI,wBAAwB,CAAC;CACjD;AAGD,MAAM,WAAW,qBAAqB;IACpC,MAAM,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC3C,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACtE,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC3D,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC1F,MAAM,CACJ,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAEpC,SAAS,CACP,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,IAAI,CACF,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,GAAG,CACD,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,UAAU,CACR,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,UAAU,CACR,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,aAAa,CACX,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,cAAc,CACZ,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,aAAa,CACX,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,UAAU,CACR,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,aAAa,CACX,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,UAAU,CACR,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,UAAU,CACR,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,SAAS,GAAG,IAAI,GACvB,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;CAC5C;AAED,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoB/B,CAAC;AAEX,MAAM,MAAM,2BAA2B,GACrC,CAAC,OAAO,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;AAEtD,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,2BAA2B,CAAC;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,wBAAwB,EAAE,CAAC;IAEpC,oBAAoB,EAAE,aAAa,CAAC;QAClC,EAAE,EAAE,2BAA2B,CAAC;QAChC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACvC,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,yBAAyB;IAExC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAsMD,wBAAsB,qBAAqB,CACzC,WAAW,EAAE,sBAAsB,EACnC,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,wBAAwB,CAAC,CAgmCnC"}

package/dist/conformance/adapter.js

@@ -1,4 +1,4 @@
-import { ErrorCode, compareLogCursor, createProtocolEnvelope, decodeCreateCubeResponseEnvelope, decodeAppendLogResultEnvelope, decodeDecisionResultEnvelope, decodeDecisionsResultEnvelope, decodeEnrollmentExchangeResponseEnvelope, decodeProtocolErrorEnvelope, decodeProtocolTagPreflight, decodeReadLogResultEnvelope, decodeSseFrames, PROTOCOL_LIMIT_CEILINGS, PROTOCOL_VERSION, utf8ByteLength, } from '../protocol/index.js';
+import { ErrorCode, compareLogCursor, createProtocolEnvelope, decodeCreateCubeResponseEnvelope, decodeAppendLogResultEnvelope, decodeDecisionResultEnvelope, decodeDecisionsResultEnvelope, decodeEnrollmentExchangeResponseEnvelope, decodeEvictDroneResultEnvelope, decodeProtocolEnvelope, decodeProtocolErrorEnvelope, decodeProtocolTagPreflight, decodeReadLogResultEnvelope, decodeReassignDroneResultEnvelope, decodeSseFrames, PROTOCOL_LIMIT_CEILINGS, PROTOCOL_HTTP_CONTRACT, PROTOCOL_VERSION, utf8ByteLength, } from '../protocol/index.js';
 import { ENROLLMENT_RETRY_CONFORMANCE } from './index.js';
 export const ADAPTER_CONFORMANCE_FIXTURES = [
     { id: 'http.unauthenticated-liveness', area: 'http' },
@@ -13,6 +13,12 @@ export const ADAPTER_CONFORMANCE_FIXTURES = [
     { id: 'acks.idempotent', area: 'acks' },
     { id: 'claims.durable-noncursor', area: 'claims' },
     { id: 'decisions.topic-supersession', area: 'decisions' },
+    { id: 'security.drone-management-authorization', area: 'security' },
+    { id: 'security.manage-access-matrix', area: 'security' },
+    { id: 'drones.reassign-invariants', area: 'drones' },
+    { id: 'security.cross-cube-drone-management', area: 'security' },
+    { id: 'drones.evict-terminal-signal', area: 'drones' },
+    { id: 'security.drone-session-rejection-causes', area: 'security' },
     { id: 'security.active-stream-revocation', area: 'security' },
 ];
 const DEFAULT_STREAM_DEADLINE_MS = 5_000;
@@ -117,6 +123,19 @@ function logEvent(event, description) {
 function same(left, right) {
     return JSON.stringify(left) === JSON.stringify(right);
 }
+function listedDroneIds(response) {
+    return decodeProtocolEnvelope(response.body, (payload) => {
+        invariant(typeof payload === 'object' && payload !== null, 'Roster payload is not an object.');
+        const drones = payload.drones;
+        invariant(Array.isArray(drones), 'Roster payload omitted drones.');
+        return drones.map((drone) => {
+            invariant(typeof drone === 'object' && drone !== null, 'Roster contains an invalid drone.');
+            const id = drone.id;
+            invariant(typeof id === 'string', 'Roster drone omitted its id.');
+            return id;
+        });
+    }).payload;
+}
 function assertStateDelta(before, after, expected, description) {
     for (const key of Object.keys(before)) {
         invariant(after[key] - before[key] === (expected[key] ?? 0), `${description} changed ${key} by ${after[key] - before[key]}; expected ${expected[key] ?? 0}.`);
@@ -529,6 +548,246 @@ export async function runAdapterConformance(environment, options = {}) {
         invariant(second.supersedes === first.id, 'Superseding decision did not reference its predecessor.');
         return { active_count: 1, active_decision: 'second', supersedes_first: true };
     });
+    let workerRoleA;
+    let workerRoleB;
+    let managedWorker;
+    let readCredential = '';
+    let writeCredential = '';
+    let workerSession = '';
+    await record('security.drone-management-authorization', async () => {
+        workerRoleA = await environment.admin.createRole(cubeA, {
+            roleClass: 'worker', isHumanSeat: false,
+        });
+        managedWorker = await environment.admin.createDrone(principalA, cubeA, workerRoleA);
+        const deniedCredentials = [];
+        for (const [index, access] of ['read', 'write'].entries()) {
+            const principalName = access === 'read' ? 'Coordinator' : 'write-principal';
+            const principal = await environment.admin.createPrincipal(principalName);
+            await environment.admin.grantCube(principal, cubeA, access);
+            const invitation = await environment.admin.issueSingleUseInvitation(principal, 'client');
+            const credential = `${(access === 'read' ? 'R' : 'W').repeat(42)}Q`;
+            if (access === 'read')
+                readCredential = credential;
+            else
+                writeCredential = credential;
+            const enrollment = await environment.operations.enroll(createProtocolEnvelope(`${access}-principal-enroll`, {
+                invitation,
+                retry_key: `00000000-0000-4000-8000-${String(301 + index).padStart(12, '0')}`,
+                client_credential: credential,
+                client_name: principalName,
+            }));
+            expectStatus(enrollment, 201, `${access} principal enrollment`);
+            deniedCredentials.push({ access: access, credential });
+        }
+        for (const { access, credential } of deniedCredentials) {
+            expectError(await environment.operations.reassignDrone(credential, cubeA, managedWorker, createProtocolEnvelope(`${access}-reassign-denied`, { role_id: workerRoleA.id })), 403, ErrorCode.ACCESS_DENIED, `${access} principal reassignment`);
+            expectError(await environment.operations.evictDrone(credential, cubeA, managedWorker, createProtocolEnvelope(`${access}-evict-denied`, {})), 403, ErrorCode.ACCESS_DENIED, `${access} principal eviction`);
+        }
+        return { read_status: 403, write_status: 403, manage_required: true };
+    });
+    await record('security.manage-access-matrix', async () => {
+        const noGrantPrincipal = await environment.admin.createPrincipal('Coordinator role without cube grant');
+        const noGrantInvitation = await environment.admin.issueSingleUseInvitation(noGrantPrincipal, 'client');
+        const noGrantCredential = `${'N'.repeat(42)}Q`;
+        expectStatus(await environment.operations.enroll(createProtocolEnvelope('no-grant-principal-enroll', {
+            invitation: noGrantInvitation,
+            retry_key: '00000000-0000-4000-8000-000000000303',
+            client_credential: noGrantCredential,
+            client_name: 'Coordinator',
+        })), 201, 'No-grant principal enrollment');
+        const droneCredential = await environment.admin.issueManagedDroneSession(managedWorker);
+        const matrixTargetRole = await environment.admin.createRole(cubeA, {
+            roleClass: 'worker', isHumanSeat: false,
+        });
+        const evictionTarget = await environment.admin.createDrone(principalA, cubeA, workerRoleA);
+        await environment.admin.issueManagedDroneSession(evictionTarget);
+        const unknownCube = { id: '00000000-0000-4000-8000-000000000399' };
+        const snapshot = async () => ({
+            cubeA: await environment.admin.inspectCubeManagementState(cubeA),
+            cubeB: await environment.admin.inspectCubeManagementState(cubeB),
+        });
+        const operations = [
+            {
+                name: 'cube-update',
+                successStatus: 200,
+                invoke: (credential, cube) => environment.operations.updateCube(credential, cube, createProtocolEnvelope('matrix-cube-update', { cube_directive: 'matrix-directive' })),
+            },
+            {
+                name: 'role-create',
+                successStatus: 201,
+                invoke: (credential, cube) => environment.operations.createRole(credential, cube, createProtocolEnvelope('matrix-role-create', { name: 'Matrix Role' })),
+            },
+            {
+                name: 'taxonomy-patch',
+                successStatus: 200,
+                invoke: (credential, cube) => environment.operations.patchTaxonomy(credential, cube, createProtocolEnvelope('matrix-taxonomy-patch', { marker: 'matrix-taxonomy' })),
+            },
+            {
+                name: 'decision-record',
+                successStatus: 201,
+                invoke: (credential, cube) => environment.operations.recordDecision(credential, cube, createProtocolEnvelope('matrix-decision-record', {
+                    topic: 'matrix-authority', decision: 'manage only',
+                })),
+            },
+            {
+                name: 'drone-reassign',
+                successStatus: 200,
+                invoke: (credential, cube) => environment.operations.reassignDrone(credential, cube, managedWorker, createProtocolEnvelope('matrix-drone-reassign', { role_id: matrixTargetRole.id })),
+            },
+            {
+                name: 'drone-evict',
+                successStatus: 200,
+                invoke: (credential, cube) => environment.operations.evictDrone(credential, cube, evictionTarget, createProtocolEnvelope('matrix-drone-evict', {})),
+            },
+        ];
+        for (const operation of operations) {
+            for (const [kind, credential] of [
+                ['read', readCredential],
+                ['write', writeCredential],
+                ['drone-session', droneCredential],
+            ]) {
+                const before = await snapshot();
+                expectError(await operation.invoke(credential, cubeA), 403, ErrorCode.ACCESS_DENIED, `${operation.name} by ${kind} principal`);
+                invariant(same(await snapshot(), before), `${operation.name} mutated state after ${kind} denial.`);
+            }
+            for (const [kind, credential, cube] of [
+                ['no-grant', noGrantCredential, cubeA],
+                ['foreign-principal', credentialB, cubeA],
+                ['foreign-cube', credentialA, cubeB],
+                ['unknown-cube', credentialA, unknownCube],
+            ]) {
+                const before = await snapshot();
+                expectError(await operation.invoke(credential, cube), 404, ErrorCode.NOT_FOUND, `${operation.name} against ${kind}`);
+                invariant(same(await snapshot(), before), `${operation.name} mutated state after ${kind} denial.`);
+            }
+            const beforeSuccess = await environment.admin.inspectCubeManagementState(cubeA);
+            const success = await operation.invoke(credentialA, cubeA);
+            expectStatus(success, operation.successStatus, `${operation.name} by managing principal`);
+            invariant(!same(await environment.admin.inspectCubeManagementState(cubeA), beforeSuccess), `${operation.name} managing success did not mutate its declared state.`);
+        }
+        return {
+            operation_count: operations.length,
+            manage_success: true,
+            read_write_status: 403,
+            drone_session_status: 403,
+            hidden_status: 404,
+            denied_mutations: 0,
+            role_labels_authoritative: false,
+        };
+    });
+    await record('drones.reassign-invariants', async () => {
+        workerRoleB = await environment.admin.createRole(cubeA, {
+            roleClass: 'worker', isHumanSeat: false,
+        });
+        const humanSourceRole = await environment.admin.createRole(cubeA, {
+            roleClass: 'worker', isHumanSeat: true,
+        });
+        const queenRole = await environment.admin.createRole(cubeA, {
+            roleClass: 'queen', isHumanSeat: false,
+        });
+        const occupiedHumanRole = await environment.admin.createRole(cubeA, {
+            roleClass: 'worker', isHumanSeat: true,
+        });
+        const humanSource = await environment.admin.createDrone(principalA, cubeA, humanSourceRole);
+        await environment.admin.createDrone(principalA, cubeA, occupiedHumanRole);
+        const contender = await environment.admin.createDrone(principalA, cubeA, workerRoleA);
+        workerSession = await environment.admin.issueManagedDroneSession(managedWorker);
+        const reassigned = await environment.operations.reassignDrone(credentialA, cubeA, managedWorker, createProtocolEnvelope('reassign-worker', { role_id: workerRoleB.id }));
+        expectStatus(reassigned, 200, 'Worker reassignment');
+        const reassignedDrone = decodeReassignDroneResultEnvelope(reassigned.body).payload.drone;
+        invariant(reassignedDrone.id === managedWorker.id && reassignedDrone.role_id === workerRoleB.id, 'Reassignment response did not identify the persisted target role.');
+        expectError(await environment.operations.reassignDrone(workerSession, cubeA, managedWorker, createProtocolEnvelope('reassign-drone-session-denied', { role_id: workerRoleA.id })), 403, ErrorCode.ACCESS_DENIED, 'Drone-session reassignment');
+        expectError(await environment.operations.reassignDrone(credentialA, cubeA, managedWorker, createProtocolEnvelope('reassign-queen-denied', { role_id: queenRole.id })), 403, ErrorCode.ACCESS_DENIED, 'Worker-to-queen reassignment');
+        const promoted = await environment.operations.reassignDrone(credentialA, cubeA, humanSource, createProtocolEnvelope('reassign-queen-allowed', { role_id: queenRole.id }));
+        expectStatus(promoted, 200, 'Human-seat-to-queen reassignment');
+        invariant(decodeReassignDroneResultEnvelope(promoted.body).payload.drone.role_id === queenRole.id, 'Human-seat-to-queen reassignment did not persist.');
+        expectError(await environment.operations.reassignDrone(credentialA, cubeA, contender, createProtocolEnvelope('reassign-occupied-denied', { role_id: occupiedHumanRole.id })), 409, ErrorCode.ROLE_IN_USE, 'Occupied human-seat reassignment');
+        return {
+            worker_reassigned: true,
+            drone_session_denied: true,
+            queen_requires_human_seat: true,
+            occupied_human_seat_denied: true,
+        };
+    });
+    await record('security.cross-cube-drone-management', async () => {
+        const foreignRole = await environment.admin.createRole(cubeB, {
+            roleClass: 'worker', isHumanSeat: false,
+        });
+        const foreignDrone = await environment.admin.createDrone(principalB, cubeB, foreignRole);
+        expectError(await environment.operations.reassignDrone(credentialA, cubeB, foreignDrone, createProtocolEnvelope('cross-cube-reassign', { role_id: foreignRole.id })), 404, ErrorCode.NOT_FOUND, 'Cross-cube reassignment');
+        expectError(await environment.operations.evictDrone(credentialA, cubeB, foreignDrone, createProtocolEnvelope('cross-cube-evict', {})), 404, ErrorCode.NOT_FOUND, 'Cross-cube eviction');
+        expectError(await environment.operations.reassignDrone(credentialA, cubeA, foreignDrone, createProtocolEnvelope('foreign-drone-local-route', { role_id: workerRoleA.id })), 404, ErrorCode.NOT_FOUND, 'Foreign drone reassignment through authorized cube route');
+        expectError(await environment.operations.evictDrone(credentialA, cubeA, foreignDrone, createProtocolEnvelope('foreign-drone-local-evict', {})), 404, ErrorCode.NOT_FOUND, 'Foreign drone eviction through authorized cube route');
+        expectError(await environment.operations.reassignDrone(credentialA, cubeA, managedWorker, createProtocolEnvelope('foreign-role-local-drone', { role_id: foreignRole.id })), 404, ErrorCode.NOT_FOUND, 'Foreign role reassignment through authorized cube route');
+        await environment.admin.grantCube(principalA, cubeB, 'read');
+        const foreignDroneBefore = await environment.admin.inspectManagedDrone(foreignDrone);
+        expectError(await environment.operations.reassignDrone(workerSession, cubeB, foreignDrone, createProtocolEnvelope('bound-drone-cross-cube-reassign', { role_id: foreignRole.id })), 404, ErrorCode.NOT_FOUND, 'Bound drone cross-cube reassignment');
+        invariant(same(await environment.admin.inspectManagedDrone(foreignDrone), foreignDroneBefore), 'Bound drone cross-cube reassignment mutated the foreign target.');
+        expectError(await environment.operations.evictDrone(workerSession, cubeB, foreignDrone, createProtocolEnvelope('bound-drone-cross-cube-evict', {})), 404, ErrorCode.NOT_FOUND, 'Bound drone cross-cube eviction');
+        invariant(same(await environment.admin.inspectManagedDrone(foreignDrone), foreignDroneBefore), 'Bound drone cross-cube eviction mutated the foreign target.');
+        return {
+            unauthorized_cube_status: 404,
+            foreign_drone_status: 404,
+            foreign_role_status: 404,
+            bound_drone_cross_cube_status: 404,
+            code: ErrorCode.NOT_FOUND,
+        };
+    });
+    await record('drones.evict-terminal-signal', async () => {
+        const evictedDrone = await environment.admin.createDrone(principalA, cubeA, workerRoleA);
+        const evictedCredential = await environment.admin.issueManagedDroneSession(evictedDrone);
+        expectStatus(await environment.operations.read(evictedCredential, cubeA, createProtocolEnvelope('evict-probe-before', { cursor: null, limit: 1 })), 200, 'Pre-eviction seat probe');
+        const before = await environment.operations.listDrones(credentialA, cubeA);
+        expectStatus(before, 200, 'Pre-eviction roster');
+        invariant(listedDroneIds(before).includes(evictedDrone.id), 'Active drone was absent from roster.');
+        const evicted = await environment.operations.evictDrone(credentialA, cubeA, evictedDrone, createProtocolEnvelope('evict-managed-drone', {}));
+        expectStatus(evicted, 200, 'Drone eviction');
+        invariant(same(decodeEvictDroneResultEnvelope(evicted.body).payload, {
+            drone_id: evictedDrone.id,
+            evicted: true,
+        }), 'Eviction response did not identify the terminal seat.');
+        invariant(same(await environment.admin.inspectManagedDrone(evictedDrone), {
+            role_id: workerRoleA.id,
+            evicted: true,
+            session_revoked: true,
+        }), 'Eviction did not atomically mark the drone evicted and revoke its session.');
+        const after = await environment.operations.listDrones(credentialA, cubeA);
+        expectStatus(after, 200, 'Post-eviction roster');
+        invariant(!listedDroneIds(after).includes(evictedDrone.id), 'Evicted drone remained in roster.');
+        expectError(await environment.operations.append(credentialA, cubeA, createProtocolEnvelope('evict-direct-target', {
+            message: 'must-not-fan-out',
+            visibility: 'direct',
+            recipientDroneIds: [evictedDrone.id],
+        })), 404, ErrorCode.NOT_FOUND, 'Evicted direct recipient');
+        expectError(await environment.operations.read(evictedCredential, cubeA, createProtocolEnvelope('evict-probe-after', { cursor: null, limit: 1 })), PROTOCOL_HTTP_CONTRACT.drone_evicted_status, ErrorCode.DRONE_EVICTED, 'Evicted seat probe');
+        return {
+            eviction_status: 200,
+            roster_visible: false,
+            fanout_reachable: false,
+            old_bearer_status: 410,
+            old_bearer_code: ErrorCode.DRONE_EVICTED,
+        };
+    });
+    await record('security.drone-session-rejection-causes', async () => {
+        const revokedDrone = await environment.admin.createDrone(principalA, cubeA, workerRoleA);
+        const expiredDrone = await environment.admin.createDrone(principalA, cubeA, workerRoleA);
+        const revokedCredential = await environment.admin.issueManagedDroneSession(revokedDrone);
+        const expiredCredential = await environment.admin.issueManagedDroneSession(expiredDrone);
+        await environment.admin.revokeManagedDroneSession(revokedDrone);
+        await environment.admin.expireManagedDroneSession(expiredDrone);
+        for (const [label, credential, code] of [
+            ['revoked', revokedCredential, ErrorCode.SESSION_REVOKED],
+            ['expired', expiredCredential, ErrorCode.AUTH_EXPIRED],
+        ]) {
+            expectError(await environment.operations.read(credential, cubeA, createProtocolEnvelope(`${label}-seat-probe`, { cursor: null, limit: 1 })), 401, code, `${label} seat probe`);
+        }
+        return {
+            revoked_status: 401,
+            expired_status: 401,
+            revoked_code: ErrorCode.SESSION_REVOKED,
+            expired_code: ErrorCode.AUTH_EXPIRED,
+        };
+    });
     await record('security.active-stream-revocation', async () => {
         invariant(liveCursor, 'Stream fixture did not produce a live cursor.');
         const opened = await environment.operations.openStream(credentialA, cubeA, liveCursor);
@@ -562,17 +821,4 @@ export async function runAdapterConformance(environment, options = {}) {
     const normalizedTranscript = results.map(({ id, observations }) => ({ id, observations }));
     return { ok: results.every((result) => result.ok), results, normalizedTranscript };
 }
-export async function runEquivalentAdapterConformance(cloud, local, options = {}) {
-    const [cloudReport, localReport] = await Promise.all([
-        runAdapterConformance(cloud, options),
-        runAdapterConformance(local, options),
-    ]);
-    const equivalent = same(cloudReport.normalizedTranscript, localReport.normalizedTranscript);
-    return {
-        ok: cloudReport.ok && localReport.ok && equivalent,
-        cloud: cloudReport,
-        local: localReport,
-        equivalent,
-    };
-}
 //# sourceMappingURL=adapter.js.map