borgmcp-shared 0.6.3 → 0.7.0

package/src/conformance/adapter.ts

@@ -2,6 +2,7 @@ import {
   ErrorCode,
   compareLogCursor,
   createProtocolEnvelope,
+  decodeAssociateRepositoryCubeResponseEnvelope,
   decodeCreateCubeResponseEnvelope,
   decodeAppendLogResultEnvelope,
   decodeDecisionResultEnvelope,
@@ -14,6 +15,7 @@ import {
   decodeProtocolErrorEnvelope,
   decodeProtocolTagPreflight,
   decodeReadLogResultEnvelope,
+  decodeResolveRepositoryCubeResponseEnvelope,
   decodeReassignDroneResultEnvelope,
   decodeUpdateDroneRuntimeMetadataResponseEnvelope,
   decodeSseFrames,
@@ -24,6 +26,7 @@ import {
   type CreateCubeResponse,
   type CreateCubeRepository,
   type CubeTemplate,
+  type ResolvedRepositoryCube,
   type LogCursor,
   type StreamEvent,
   type DroneRuntimeMetadata,
@@ -127,6 +130,15 @@ export interface ConformanceCreatedCubeState {
   default_worker_role_matches: boolean;
 }
 
+export interface ConformanceRepositoryCubeFixture {
+  cube_id: string;
+  name: string;
+  template: CubeTemplate;
+  human_seat_role_id: string;
+  default_worker_role_id: string;
+  access: 'manage';
+}
+
 export interface ConformanceEnrollmentPrincipalState {
   response_client_matches: boolean;
   active_credential_bindings: number;
@@ -164,6 +176,7 @@ export interface ConformanceAdmin {
     cube: ConformanceCube,
     access?: ConformanceCubeAccess,
   ): Promise<void>;
+  revokeCubeGrant(principal: ConformancePrincipal, cube: ConformanceCube): Promise<void>;
   createRole(cube: ConformanceCube, input: {
     readonly roleClass: 'queen' | 'worker';
     readonly isHumanSeat: boolean;
@@ -192,6 +205,13 @@ export interface ConformanceAdmin {
     creator: ConformancePrincipal,
     response: CreateCubeResponse,
   ): Promise<ConformanceCreatedCubeState>;
+  prepareRepositoryCube(
+    cube: ConformanceCube,
+    input: {
+      name: string;
+      template: CubeTemplate;
+    },
+  ): Promise<ConformanceRepositoryCubeFixture>;
   inspectEnrollmentPrincipal(
     principal: ConformancePrincipal,
     responseClientId: string,
@@ -207,6 +227,8 @@ export interface ConformanceOperations {
   protocol(credential: string | null): Promise<ConformanceHttpResponse>;
   enroll(request: unknown): Promise<ConformanceHttpResponse>;
   createCube(credential: string | null, request: unknown): Promise<ConformanceHttpResponse>;
+  resolveRepositoryCube(credential: string | null, request: unknown): Promise<ConformanceHttpResponse>;
+  associateRepositoryCube(credential: string | null, request: unknown): Promise<ConformanceHttpResponse>;
   attach(credential: string, request: unknown): Promise<ConformanceHttpResponse>;
   selfMetadataUpdate(
     credential: string,
@@ -291,6 +313,7 @@ export const ADAPTER_CONFORMANCE_FIXTURES = [
   { id: 'http.unauthenticated-liveness', area: 'http' },
   { id: 'protocol.credential-free-preflight', area: 'protocol' },
   { id: 'enrollment.retry-authority', area: 'enrollment' },
+  { id: 'repository.explicit-association', area: 'repository' },
   { id: 'security.adapter-boundary-injection', area: 'security' },
   { id: 'security.oversize-request', area: 'security' },
   { id: 'security.cross-cube-isolation', area: 'security' },
@@ -981,6 +1004,244 @@ export async function runAdapterConformance(
     };
   });
 
+  await record('repository.explicit-association', async () => {
+    const repository = {
+      kind: 'origin' as const,
+      value: 'https://github.com/Byte-Ventures/legacy-repository',
+    };
+    const prepared = await environment.admin.prepareRepositoryCube(cubeA, {
+      name: 'Legacy Repository Cube',
+      template: 'software-dev',
+    });
+    const resolveRequest = {
+      working_repo_name: 'legacy-repository',
+      repository,
+    };
+    const beforeNone = await environment.admin.observeAuthorityState();
+    const noneResponse = await environment.operations.resolveRepositoryCube(
+      credentialA,
+      createProtocolEnvelope('repository-resolve-none', resolveRequest),
+    );
+    expectStatus(noneResponse, 200, 'Unassociated repository resolution');
+    invariant(
+      same(decodeResolveRepositoryCubeResponseEnvelope(noneResponse.body).payload, { result: 'none' }),
+      'Unassociated repository did not return explicit none.',
+    );
+    assertStateDelta(beforeNone, await environment.admin.observeAuthorityState(), {}, 'Repository resolution');
+
+    const associationRequest = { cube_id: cubeA.id, ...resolveRequest };
+    const beforeDenied = await environment.admin.observeAuthorityState();
+    expectSecretFreeError(
+      await environment.operations.associateRepositoryCube(
+        credentialB,
+        createProtocolEnvelope('repository-associate-denied', associationRequest),
+      ),
+      403,
+      ErrorCode.ACCESS_DENIED,
+      'Inaccessible repository cube association',
+      [associationRequest.cube_id, repository.value],
+    );
+    assertStateDelta(beforeDenied, await environment.admin.observeAuthorityState(), {}, 'Denied repository association');
+
+    const beforeAssociation = await environment.admin.observeAuthorityState();
+    const associatedResponse = await environment.operations.associateRepositoryCube(
+      credentialA,
+      createProtocolEnvelope('repository-associate', associationRequest),
+    );
+    expectStatus(associatedResponse, 200, 'Explicit repository cube association');
+    const associated = decodeAssociateRepositoryCubeResponseEnvelope(associatedResponse.body).payload;
+    const authoritative = {
+      result: 'resolved' as const,
+      cube_id: prepared.cube_id,
+      name: prepared.name,
+      working_repo_name: resolveRequest.working_repo_name,
+      repository,
+      template: prepared.template,
+      human_seat_role_id: prepared.human_seat_role_id,
+      default_worker_role_id: prepared.default_worker_role_id,
+      access: prepared.access,
+    };
+    invariant(same(associated, authoritative), 'Repository association did not return authoritative stored fields.');
+    assertStateDelta(
+      beforeAssociation,
+      await environment.admin.observeAuthorityState(),
+      { repository_associations: 1 },
+      'Explicit repository association',
+    );
+
+    const beforeResolve = await environment.admin.observeAuthorityState();
+    const resolvedResponse = await environment.operations.resolveRepositoryCube(
+      credentialA,
+      createProtocolEnvelope('repository-resolve', {
+        ...resolveRequest,
+        working_repo_name: 'ignored-new-display',
+      }),
+    );
+    expectStatus(resolvedResponse, 200, 'Associated repository resolution');
+    invariant(
+      same(decodeResolveRepositoryCubeResponseEnvelope(resolvedResponse.body).payload, authoritative),
+      'Associated repository did not return stored authoritative display.',
+    );
+    assertStateDelta(beforeResolve, await environment.admin.observeAuthorityState(), {}, 'Associated repository resolution');
+
+    const beforeRetry = await environment.admin.observeAuthorityState();
+    const retryResponse = await environment.operations.associateRepositoryCube(
+      credentialA,
+      createProtocolEnvelope('repository-associate-retry', associationRequest),
+    );
+    expectStatus(retryResponse, 200, 'Exact repository association retry');
+    invariant(
+      same(decodeAssociateRepositoryCubeResponseEnvelope(retryResponse.body).payload, authoritative),
+      'Exact repository association retry changed authoritative fields.',
+    );
+    assertStateDelta(beforeRetry, await environment.admin.observeAuthorityState(), {}, 'Repository association retry');
+
+    const cubeC = await environment.admin.createCube('cube-c');
+    await environment.admin.grantCube(principalA, cubeC);
+    await environment.admin.prepareRepositoryCube(cubeC, {
+      name: 'Other Legacy Cube',
+      template: 'starter',
+    });
+    const beforeRepositoryConflict = await environment.admin.observeAuthorityState();
+    expectSecretFreeError(
+      await environment.operations.associateRepositoryCube(
+        credentialA,
+        createProtocolEnvelope('repository-associate-repository-conflict', {
+          ...associationRequest,
+          cube_id: cubeC.id,
+        }),
+      ),
+      409,
+      ErrorCode.REPOSITORY_ALREADY_ASSOCIATED,
+      'Repository-to-other-cube conflict',
+      [cubeA.id, cubeC.id, repository.value],
+    );
+    assertStateDelta(
+      beforeRepositoryConflict,
+      await environment.admin.observeAuthorityState(),
+      {},
+      'Repository-to-other-cube conflict',
+    );
+
+    const beforeCubeConflict = await environment.admin.observeAuthorityState();
+    expectSecretFreeError(
+      await environment.operations.associateRepositoryCube(
+        credentialA,
+        createProtocolEnvelope('repository-associate-cube-conflict', {
+          cube_id: cubeA.id,
+          working_repo_name: 'other-repository',
+          repository: {
+            kind: 'origin',
+            value: 'https://github.com/Byte-Ventures/other-repository',
+          },
+        }),
+      ),
+      409,
+      ErrorCode.CUBE_ALREADY_ASSOCIATED,
+      'Cube-to-other-repository conflict',
+      [cubeA.id, repository.value, 'https://github.com/Byte-Ventures/other-repository'],
+    );
+    assertStateDelta(
+      beforeCubeConflict,
+      await environment.admin.observeAuthorityState(),
+      {},
+      'Cube-to-other-repository conflict',
+    );
+
+    const preparedB = await environment.admin.prepareRepositoryCube(cubeB, {
+      name: 'Other Client Legacy Cube',
+      template: 'starter',
+    });
+    const beforeCrossClientResolve = await environment.admin.observeAuthorityState();
+    const crossClientResolve = await environment.operations.resolveRepositoryCube(
+      credentialB,
+      createProtocolEnvelope('repository-resolve-cross-client', resolveRequest),
+    );
+    expectStatus(crossClientResolve, 200, 'Cross-client repository resolution');
+    invariant(
+      same(decodeResolveRepositoryCubeResponseEnvelope(crossClientResolve.body).payload, { result: 'none' }),
+      'Another client repository binding was exposed by resolution.',
+    );
+    assertStateDelta(
+      beforeCrossClientResolve,
+      await environment.admin.observeAuthorityState(),
+      {},
+      'Cross-client repository resolution',
+    );
+    const beforeCrossClientAssociation = await environment.admin.observeAuthorityState();
+    const crossClientAssociation = await environment.operations.associateRepositoryCube(
+      credentialB,
+      createProtocolEnvelope('repository-associate-cross-client', {
+        ...associationRequest,
+        cube_id: cubeB.id,
+      }),
+    );
+    expectStatus(crossClientAssociation, 200, 'Cross-client repository association');
+    const crossClientAssociated = decodeAssociateRepositoryCubeResponseEnvelope(
+      crossClientAssociation.body,
+    ).payload;
+    invariant(
+      crossClientAssociated.cube_id === preparedB.cube_id &&
+        crossClientAssociated.repository.value === repository.value,
+      'Another client binding changed cross-client association identity.',
+    );
+    assertStateDelta(
+      beforeCrossClientAssociation,
+      await environment.admin.observeAuthorityState(),
+      { repository_associations: 1 },
+      'Cross-client repository association',
+    );
+
+    await environment.admin.revokeCubeGrant(principalA, cubeA);
+    const beforeHiddenResolve = await environment.admin.observeAuthorityState();
+    const hiddenResolve = await environment.operations.resolveRepositoryCube(
+      credentialA,
+      createProtocolEnvelope('repository-resolve-inaccessible-binding', resolveRequest),
+    );
+    expectStatus(hiddenResolve, 200, 'Inaccessible repository binding resolution');
+    invariant(
+      same(decodeResolveRepositoryCubeResponseEnvelope(hiddenResolve.body).payload, { result: 'none' }),
+      'Inaccessible repository binding was exposed by read-only resolution.',
+    );
+    assertStateDelta(
+      beforeHiddenResolve,
+      await environment.admin.observeAuthorityState(),
+      {},
+      'Inaccessible repository binding resolution',
+    );
+    const beforeHiddenAssociation = await environment.admin.observeAuthorityState();
+    expectSecretFreeError(
+      await environment.operations.associateRepositoryCube(
+        credentialA,
+        createProtocolEnvelope('repository-associate-inaccessible-binding', {
+          ...associationRequest,
+          cube_id: cubeC.id,
+        }),
+      ),
+      403,
+      ErrorCode.ACCESS_DENIED,
+      'Inaccessible existing repository binding',
+      [cubeA.id, cubeC.id, repository.value],
+    );
+    assertStateDelta(
+      beforeHiddenAssociation,
+      await environment.admin.observeAuthorityState(),
+      {},
+      'Inaccessible existing repository binding',
+    );
+    await environment.admin.grantCube(principalA, cubeA);
+    return {
+      none: true,
+      resolved: true,
+      idempotent: true,
+      repository_conflict: ErrorCode.REPOSITORY_ALREADY_ASSOCIATED,
+      cube_conflict: ErrorCode.CUBE_ALREADY_ASSOCIATED,
+      inaccessible: ErrorCode.ACCESS_DENIED,
+      inaccessible_binding_hidden: true,
+      cross_client_binding_hidden: true,
+    };
+  });
+
   await record('security.adapter-boundary-injection', async () => {
     const injectedMessage = "'); DROP TABLE log_entries; --\r\ndata: forged-sse-frame";
     const injectedBody = JSON.stringify(

package/src/conformance/index.ts

@@ -1,9 +1,12 @@
 import type { BroadcastHwm } from '../log-stream-hwm.js';
 import type {
   AttachResponse,
+  AssociateRepositoryCubeRequest,
   CreateCubeRequest,
   EnrollmentExchangeRequest,
+  ResolveRepositoryCubeRequest,
 } from '../protocol/contract.js';
+import type { EnrichedStreamEntry } from '../protocol/types.js';
 
 export * from './adapter.js';
 
@@ -65,6 +68,138 @@ export const DRONE_ADDRESS_CONFORMANCE: readonly ConformanceVector<string, strin
   },
 ];
 
+const APPEND_LOG_ENTRY: EnrichedStreamEntry = {
+  id: '00000000-0000-4000-8000-000000000201',
+  cube_id: '00000000-0000-4000-8000-000000000202',
+  drone_id: '00000000-0000-4000-8000-000000000203',
+  message: 'REVIEW-READY: example',
+  visibility: 'direct',
+  created_at: '2026-01-01T00:00:00.000Z',
+  drone_label: 'one-of-one-builder',
+  role_name: 'Builder',
+  recipient_drone_ids: ['00000000-0000-4000-8000-000000000204'],
+};
+
+const APPEND_LOG_ROUTING = {
+  class: 'review',
+  recipients: ['one-of-one-reviewer'],
+  fellOpen: false,
+  message: 'Routing applied.',
+} as const;
+
+export interface AppendLogResultConformanceVector {
+  name: string;
+  response: unknown;
+  accepts: boolean;
+}
+
+/** Runtime response vectors keep the append-log decoder aligned with its public type. */
+export const APPEND_LOG_RESULT_CONFORMANCE: readonly AppendLogResultConformanceVector[] = [
+  {
+    name: 'accepts a response without optional routing metadata',
+    response: { entry: APPEND_LOG_ENTRY },
+    accepts: true,
+  },
+  {
+    name: 'accepts exact routing metadata and unreachable recipients',
+    response: {
+      entry: APPEND_LOG_ENTRY,
+      routing: APPEND_LOG_ROUTING,
+      unreachableRecipients: [{ id: 'missing-reviewer', label: 'Missing Reviewer' }],
+    },
+    accepts: true,
+  },
+  {
+    name: 'accepts a null routing echo and an empty unreachable-recipient list',
+    response: { entry: APPEND_LOG_ENTRY, routing: null, unreachableRecipients: [] },
+    accepts: true,
+  },
+  {
+    name: 'rejects unknown top-level response fields',
+    response: { entry: APPEND_LOG_ENTRY, routing: APPEND_LOG_ROUTING, extra: true },
+    accepts: false,
+  },
+  {
+    name: 'rejects a non-object routing echo',
+    response: { entry: APPEND_LOG_ENTRY, routing: 'review' },
+    accepts: false,
+  },
+  {
+    name: 'rejects missing routing fields',
+    response: { entry: APPEND_LOG_ENTRY, routing: { class: 'review' } },
+    accepts: false,
+  },
+  {
+    name: 'rejects unknown routing fields',
+    response: { entry: APPEND_LOG_ENTRY, routing: { ...APPEND_LOG_ROUTING, extra: true } },
+    accepts: false,
+  },
+  {
+    name: 'rejects an invalid routing class',
+    response: { entry: APPEND_LOG_ENTRY, routing: { ...APPEND_LOG_ROUTING, class: 7 } },
+    accepts: false,
+  },
+  {
+    name: 'rejects an invalid routing recipient collection',
+    response: { entry: APPEND_LOG_ENTRY, routing: { ...APPEND_LOG_ROUTING, recipients: 'reviewer' } },
+    accepts: false,
+  },
+  {
+    name: 'rejects invalid routing recipient members',
+    response: { entry: APPEND_LOG_ENTRY, routing: { ...APPEND_LOG_ROUTING, recipients: [7] } },
+    accepts: false,
+  },
+  {
+    name: 'rejects an invalid routing fell-open flag',
+    response: { entry: APPEND_LOG_ENTRY, routing: { ...APPEND_LOG_ROUTING, fellOpen: 'false' } },
+    accepts: false,
+  },
+  {
+    name: 'rejects an invalid routing message',
+    response: { entry: APPEND_LOG_ENTRY, routing: { ...APPEND_LOG_ROUTING, message: 7 } },
+    accepts: false,
+  },
+  {
+    name: 'rejects a non-array unreachable-recipient list',
+    response: { entry: APPEND_LOG_ENTRY, unreachableRecipients: {} },
+    accepts: false,
+  },
+  {
+    name: 'rejects a non-object unreachable recipient',
+    response: { entry: APPEND_LOG_ENTRY, unreachableRecipients: ['missing-reviewer'] },
+    accepts: false,
+  },
+  {
+    name: 'rejects missing unreachable-recipient fields',
+    response: { entry: APPEND_LOG_ENTRY, unreachableRecipients: [{ id: 'missing-reviewer' }] },
+    accepts: false,
+  },
+  {
+    name: 'rejects unknown unreachable-recipient fields',
+    response: {
+      entry: APPEND_LOG_ENTRY,
+      unreachableRecipients: [{ id: 'missing-reviewer', label: 'Missing Reviewer', extra: true }],
+    },
+    accepts: false,
+  },
+  {
+    name: 'rejects an invalid unreachable-recipient id',
+    response: {
+      entry: APPEND_LOG_ENTRY,
+      unreachableRecipients: [{ id: 7, label: 'Missing Reviewer' }],
+    },
+    accepts: false,
+  },
+  {
+    name: 'rejects an invalid unreachable-recipient label',
+    response: {
+      entry: APPEND_LOG_ENTRY,
+      unreachableRecipients: [{ id: 'missing-reviewer', label: null }],
+    },
+    accepts: false,
+  },
+];
+
 export const ROLE_SECTION_ROUND_TRIP_CONFORMANCE: readonly string[] = [
   '',
   'Preamble only.',
@@ -189,6 +324,23 @@ const CREATE_CUBE_INITIAL: CreateCubeRequest = {
   template: 'default',
 };
 
+export interface CubeTemplateAcceptanceConformanceVector {
+  name: string;
+  template: unknown;
+  accepts: boolean;
+}
+
+/** Protocol v6's complete closed acceptance set for cube-creation templates. */
+export const CUBE_TEMPLATE_ACCEPTANCE_CONFORMANCE:
+readonly CubeTemplateAcceptanceConformanceVector[] = [
+  { name: 'accepts the legacy default template', template: 'default', accepts: true },
+  { name: 'accepts the software-development template', template: 'software-dev', accepts: true },
+  { name: 'accepts the starter template', template: 'starter', accepts: true },
+  { name: 'accepts the local-model template', template: 'local-model', accepts: true },
+  { name: 'rejects an unknown template name', template: 'custom', accepts: false },
+  { name: 'rejects a non-string template', template: null, accepts: false },
+];
+
 /** Stateful vectors: name, repository identity, and template bind the retry key. */
 export const CREATE_CUBE_RETRY_CONFORMANCE: readonly CreateCubeRetryConformanceVector[] = [
   {
@@ -291,6 +443,150 @@ readonly CreateCubeAssociationConformanceVector[] = [
   },
 ];
 
+export interface ResolveRepositoryCubeConformanceVector {
+  name: string;
+  request: ResolveRepositoryCubeRequest;
+  associated: boolean;
+  expected:
+    | { outcome: 'none'; status: 200; authority_state_delta: Record<string, never> }
+    | { outcome: 'resolved'; status: 200; authority_state_delta: Record<string, never> };
+}
+
+const REPOSITORY_CUBE_ONE = '00000000-0000-4000-8000-000000000131';
+const REPOSITORY_ONE: ResolveRepositoryCubeRequest = {
+  working_repo_name: 'repository-one',
+  repository: { kind: 'origin', value: 'https://github.com/Byte-Ventures/repository-one' },
+};
+const REPOSITORY_TWO: ResolveRepositoryCubeRequest = {
+  working_repo_name: 'repository-two',
+  repository: { kind: 'origin', value: 'https://github.com/Byte-Ventures/repository-two' },
+};
+
+/** Resolution is read-only and returns only explicit none or authoritative stored fields. */
+export const RESOLVE_REPOSITORY_CUBE_CONFORMANCE:
+readonly ResolveRepositoryCubeConformanceVector[] = [
+  {
+    name: 'unassociated repository resolves explicit none without mutation',
+    request: REPOSITORY_ONE,
+    associated: false,
+    expected: { outcome: 'none', status: 200, authority_state_delta: {} },
+  },
+  {
+    name: 'associated repository resolves authoritative stored fields without mutation',
+    request: { ...REPOSITORY_ONE, working_repo_name: 'ignored-new-display' },
+    associated: true,
+    expected: { outcome: 'resolved', status: 200, authority_state_delta: {} },
+  },
+];
+
+export interface AssociateRepositoryCubeConformanceVector {
+  name: string;
+  initial: AssociateRepositoryCubeRequest;
+  retry: AssociateRepositoryCubeRequest;
+  expected:
+    | {
+      outcome: 'resolved';
+      status: 200;
+      initial_authority_state_delta: { repository_associations: 1 };
+      retry_authority_state_delta: Record<string, never>;
+    }
+    | {
+      outcome: 'repository_conflict' | 'cube_conflict';
+      status: 409;
+      error: 'REPOSITORY_ALREADY_ASSOCIATED' | 'CUBE_ALREADY_ASSOCIATED';
+      diagnostic_disclosure: 'none';
+      retry_authority_state_delta: Record<string, never>;
+    };
+}
+
+/** Explicit cube IDs bind atomically; names never select or identify a cube. */
+export const ASSOCIATE_REPOSITORY_CUBE_CONFORMANCE:
+readonly AssociateRepositoryCubeConformanceVector[] = [
+  {
+    name: 'same explicit cube and repository binding is idempotent',
+    initial: { cube_id: REPOSITORY_CUBE_ONE, ...REPOSITORY_ONE },
+    retry: { cube_id: REPOSITORY_CUBE_ONE, ...REPOSITORY_ONE },
+    expected: {
+      outcome: 'resolved',
+      status: 200,
+      initial_authority_state_delta: { repository_associations: 1 },
+      retry_authority_state_delta: {},
+    },
+  },
+  {
+    name: 'repository already bound to another cube conflicts without mutation',
+    initial: { cube_id: REPOSITORY_CUBE_ONE, ...REPOSITORY_ONE },
+    retry: { cube_id: '00000000-0000-4000-8000-000000000132', ...REPOSITORY_ONE },
+    expected: {
+      outcome: 'repository_conflict',
+      status: 409,
+      error: 'REPOSITORY_ALREADY_ASSOCIATED',
+      diagnostic_disclosure: 'none',
+      retry_authority_state_delta: {},
+    },
+  },
+  {
+    name: 'cube already bound to another repository conflicts without mutation',
+    initial: { cube_id: REPOSITORY_CUBE_ONE, ...REPOSITORY_ONE },
+    retry: { cube_id: REPOSITORY_CUBE_ONE, ...REPOSITORY_TWO },
+    expected: {
+      outcome: 'cube_conflict',
+      status: 409,
+      error: 'CUBE_ALREADY_ASSOCIATED',
+      diagnostic_disclosure: 'none',
+      retry_authority_state_delta: {},
+    },
+  },
+];
+
+export const REPOSITORY_CUBE_PERMISSION_CONFORMANCE = [
+  {
+    name: 'association denies an inaccessible explicit cube without mutation',
+    request: { cube_id: REPOSITORY_CUBE_ONE, ...REPOSITORY_ONE },
+    expected: { status: 403, error: 'ACCESS_DENIED', authority_state_delta: {} },
+  },
+  {
+    name: 'same-client binding to an inaccessible cube is non-enumerating',
+    request: { cube_id: REPOSITORY_CUBE_ONE, ...REPOSITORY_ONE },
+    precondition: 'repository_bound_to_inaccessible_cube',
+    expected: {
+      resolve: { status: 200, outcome: 'none', authority_state_delta: {} },
+      associate: {
+        status: 403,
+        error: 'ACCESS_DENIED',
+        diagnostic_disclosure: 'none',
+        authority_state_delta: {},
+      },
+    },
+  },
+  {
+    name: 'another client binding is neither resolved nor treated as a conflict',
+    request: { cube_id: REPOSITORY_CUBE_ONE, ...REPOSITORY_ONE },
+    precondition: 'repository_bound_by_another_client',
+    expected: {
+      resolve: { status: 200, outcome: 'none', authority_state_delta: {} },
+      associate: {
+        status: 200,
+        outcome: 'resolved',
+        authority_state_delta: { repository_associations: 1 },
+      },
+    },
+  },
+] as const;
+
+export const REPOSITORY_CUBE_AUTHORITATIVE_STATE_CONFORMANCE = [
+  {
+    name: 'legacy cube with invalid authoritative roles is rejected without mutation',
+    request: { cube_id: REPOSITORY_CUBE_ONE, ...REPOSITORY_ONE },
+    expected: {
+      status: 409,
+      error: 'INVALID_INPUT',
+      diagnostic_disclosure: 'none',
+      authority_state_delta: {},
+    },
+  },
+] as const;
+
 export const ENROLLMENT_AUTHORITY_CONFORMANCE = [
   {
     name: 'ordinary enrollment creates no authority or cube state',