cursedbelt 2.8.0 → 3.0.0

package/src/server/runtime/governance.spec.ts

@@ -1,650 +0,0 @@
-/**
- * The governance tier through a REAL `bootEngineApp` (owner directive; 05 §B2's
- * product consumers).
- *
- * `cwip`'s own suites prove the two interceptors against a real storage provider.
- * What they cannot prove is the thing that made §B2 "proven but unused": that a
- * real app, composed by the ONE wiring function a generated app calls, actually
- * runs them. So every case here boots `bootEngineApp` with a governance
- * pipeline and drives a REPOSITORY op through the app's own storage provider —
- * and reads rows, never call counts.
- */
-import { Database } from 'bun:sqlite';
-import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
-import {
-  CC_REGISTRY_MIGRATIONS,
-  CC_REGISTRY_NAMESPACE,
-  createRegistryIdentityStore,
-  createRegistrySecretsStore,
-} from 'cwip/cc-registry';
-import {
-  CC_SALT_BYTES,
-  createRowSigner,
-  createSecretEnvelopeManager,
-  SecureKey,
-  setArgon2idDeriver,
-  type Argon2idDeriver,
-} from 'cwip/guard';
-import { assertCcPragmas, getTxnLifetimeGuard, runNamespacedMigrations } from 'cwip/sqlite';
-import {
-  createSqliteExecutor,
-  ensureAuditTrailSchema,
-  QUOTA_EXCEEDED,
-  SYSTEM_ACTOR,
-  type InterceptorEvent,
-  type ObjectStore,
-  type StatementExecutor,
-} from 'cwip/storage';
-import type { TelemetryWriter } from 'cwip/telemetry';
-import { effectivePermissions } from '../../core/session/claims';
-import { verifyAppConfig } from '../../verify/pipeline';
-import type { EffectiveManifest } from '../../verify/types';
-import { runWithRequestClaims } from '../mixins/requestClaims';
-import { createSessionSigner } from '../guard/sessionSigner';
-import { bootEngineApp, type BootedEngineApp } from './recipe';
-import { createGovernanceTier, mutationsOnly, quotaTierFromPlans, rowsPerDomainQuota } from './governance';
-
-const TENANT = 't_gov';
-
-const APP = {
-  configVersion: 1,
-  app: { id: 'governance-demo', title: 'Governance Demo' },
-  profile: 'local',
-  engines: ['knowledge', 'system'],
-  instances: [
-    { engine: 'knowledge', id: 'notes', features: { notes: true, todos: true } },
-    { engine: 'system', id: 'utils', features: { notifications: true } },
-  ],
-} as const;
-
-const memoryObjectStore = (): ObjectStore =>
-  ({
-    put: async (key: string) => ({ key, size: 0, modifiedAt: new Date().toISOString() }),
-    get: async () => null,
-    stat: async () => null,
-    delete: async () => false,
-    signedUrl: async (key: string) => `memory://${key}`,
-  }) as ObjectStore;
-
-const stubTelemetry = (): TelemetryWriter =>
-  ({
-    recordApiCall: () => undefined,
-    recordMeterEvent: () => ({ eventUuid: 'evt', durable: 'table' }),
-    flush: async () => ({ apiCalls: 0, meterEvents: 0, dropped: 0 }),
-    drainSpill: async () => 0,
-    stats: () => ({ queued: 0, dropped: 0, spilled: 0, flushed: 0 }),
-    close: async () => undefined,
-  }) as unknown as TelemetryWriter;
-
-let handles: Record<string, Database>;
-/** The audit trail's OWN handle — never one the pipeline is attached to. */
-let governanceDb: Database;
-let governanceExecutor: StatementExecutor;
-let booted: BootedEngineApp | undefined;
-let manifest: EffectiveManifest;
-let afterErrors: unknown[];
-
-/** A repository-shaped op, run through the app's own provider. */
-const createNote = (id: string, tenantId: string | null = TENANT) => ({
-  name: 'knowledge.createNote',
-  ...(tenantId === null ? {} : { tenantId }),
-  run: (ctx: { driver: unknown; emit(m: unknown): void }) => {
-    (ctx.driver as Database)
-      .query(
-        "INSERT INTO k_items (id, tenant_id, user_id, item_type, title) VALUES (?, ?, 'u_test', 'note', ?)",
-      )
-      .run(id, tenantId ?? TENANT, `Note ${id}`);
-    ctx.emit({ table: 'k_items', op: 'insert', rowId: id, tenantId: tenantId ?? TENANT });
-    return Promise.resolve({ id });
-  },
-});
-
-const noteCount = (): number =>
-  ((handles.knowledge as Database).query('SELECT COUNT(*) AS n FROM k_items').get() as { n: number }).n;
-
-beforeEach(async () => {
-  handles = {
-    knowledge: new Database(':memory:'),
-    media: new Database(':memory:'),
-    search: new Database(':memory:'),
-    system: new Database(':memory:'),
-  };
-  governanceDb = new Database(':memory:');
-  governanceExecutor = createSqliteExecutor(governanceDb);
-  await ensureAuditTrailSchema(governanceExecutor);
-  afterErrors = [];
-  const verified = await verifyAppConfig({ config: APP, moment: 'boot', capabilities: {} });
-  if (!verified.manifest) throw new Error(`config failed to verify: ${JSON.stringify(verified.diagnostics)}`);
-  manifest = verified.manifest;
-});
-
-afterEach(async () => {
-  await booted?.stop();
-  booted = undefined;
-  for (const db of Object.values(handles)) {
-    getTxnLifetimeGuard(db)?.dispose();
-    db.close();
-  }
-  governanceDb.close();
-});
-
-const boot = (tier: ReturnType<typeof createGovernanceTier>): BootedEngineApp => {
-  booted = bootEngineApp({
-    manifest,
-    handles,
-    objects: memoryObjectStore(),
-    telemetry: stubTelemetry(),
-    allowedOrigins: ['http://localhost:4747'],
-    meterSpillDrainIntervalMs: 0,
-    interceptors: tier.interceptors,
-  });
-  return booted;
-};
-
-describe('the audit trail, through a composed app', () => {
-  it('records a repository write the app made — and the app never mentions auditing', async () => {
-    const tier = createGovernanceTier({
-      onAfterError: (error) => afterErrors.push(error),
-      auditTrail: { executor: governanceExecutor },
-    });
-    const app = boot(tier);
-
-    await app.ctx.storage.domain('knowledge').exec(createNote('n1') as never);
-
-    const trail = await tier.auditTrail?.read({ tenantId: TENANT });
-    expect(trail).toHaveLength(1);
-    expect(trail?.[0]).toMatchObject({
-      action: 'knowledge.createNote',
-      domain: 'knowledge',
-      profile: 'local',
-      tenantId: TENANT,
-      targetId: 'n1',
-    });
-    expect(afterErrors).toEqual([]);
-  });
-
-  it('records the VERIFIED REQUEST ACTOR, not a caller-supplied name', async () => {
-    const tier = createGovernanceTier({
-      onAfterError: (error) => afterErrors.push(error),
-      auditTrail: { executor: governanceExecutor },
-    });
-    const app = boot(tier);
-
-    // The bridge: the same channel `guardDeps.currentClaims` reads. An audit
-    // trail whose actor came from the request BODY would be a document the
-    // subject of the audit gets to write.
-    await runWithRequestClaims(
-      {
-        tenantId: TENANT,
-        userId: 'u_ann',
-        role: 'ADMIN',
-        permissions: [],
-        privateScope: false,
-        exp: 0,
-        jti: 'j1',
-      },
-      () => app.ctx.storage.domain('knowledge').exec(createNote('n1') as never),
-    );
-
-    expect((await tier.auditTrail?.read({ tenantId: TENANT }))?.[0]?.actor).toBe('u_ann');
-  });
-
-  it('records SYSTEM_ACTOR for a write with no request behind it', async () => {
-    const tier = createGovernanceTier({
-      onAfterError: (error) => afterErrors.push(error),
-      auditTrail: { executor: governanceExecutor },
-    });
-    const app = boot(tier);
-    // A job handler, a migration, the vault reaper. "The system did it" is a
-    // fact; an empty column would mean "we failed to record who did it".
-    await app.ctx.storage.domain('knowledge').exec(createNote('n1') as never);
-    expect((await tier.auditTrail?.read({ tenantId: TENANT }))?.[0]?.actor).toBe(SYSTEM_ACTOR);
-  });
-
-  it('🔴 audits READS too, because `exec` is an OP choke point — not a mutation one', async () => {
-    const tier = createGovernanceTier({
-      onAfterError: (error) => afterErrors.push(error),
-      auditTrail: { executor: governanceExecutor },
-    });
-    const app = boot(tier);
-
-    await app.ctx.storage.domain('knowledge').exec(createNote('n1') as never);
-    // The CDC tap delivers off the writer's stack, so the bridge's read has not
-    // necessarily happened yet. Draining is what makes this assertion about the
-    // design rather than about scheduling.
-    await app.ctx.storage.domain('knowledge').drainMutations();
-    await Bun.sleep(5);
-
-    // The app itself issued a READ: `bootEngineApp` wires the CDC search bridge,
-    // whose resolve step calls `knowledge.getRecord` to fetch the row it is about
-    // to index. Nothing about the interceptor event distinguishes that from a
-    // write. Asserted rather than described, because this is exactly the shape of
-    // fact a file header claims and a suite never checks.
-    const trail = await tier.auditTrail?.read({ tenantId: TENANT });
-    expect(trail?.map((entry) => entry.action).sort()).toEqual([
-      'knowledge.createNote',
-      'knowledge.getRecord',
-    ]);
-  });
-
-  it('records writes ONLY when the deployment opts into mutationsOnly', async () => {
-    const tier = createGovernanceTier({
-      onAfterError: (error) => afterErrors.push(error),
-      auditTrail: { executor: governanceExecutor, when: mutationsOnly() },
-    });
-    const app = boot(tier);
-
-    await app.ctx.storage.domain('knowledge').exec(createNote('n1') as never);
-
-    const trail = await tier.auditTrail?.read({ tenantId: TENANT });
-    expect(trail?.map((entry) => entry.action)).toEqual(['knowledge.createNote']);
-  });
-
-  it('records NOTHING for a transaction the app rolled back', async () => {
-    const tier = createGovernanceTier({
-      onAfterError: (error) => afterErrors.push(error),
-      auditTrail: { executor: governanceExecutor },
-    });
-    const app = boot(tier);
-
-    await expect(
-      app.ctx.storage.domain('knowledge').transaction(async (tx) => {
-        await tx.exec(createNote('n1') as never);
-        throw new Error('business rule');
-      }),
-    ).rejects.toThrow('business rule');
-
-    expect(noteCount()).toBe(0);
-    expect(await tier.auditTrail?.read({ tenantId: TENANT })).toEqual([]);
-  });
-});
-
-describe('the quota gate, through a composed app', () => {
-  const tierWithQuota = (limit: number) =>
-    createGovernanceTier({
-      onAfterError: (error) => afterErrors.push(error),
-      quota: quotaTierFromPlans({
-        plans: () => ({ limits: { 'rows.knowledge': limit } }),
-        usage: async () => noteCount(),
-        quotaFor: rowsPerDomainQuota({ 'rows.knowledge': limit }),
-      }),
-    });
-
-  it('refuses the write that would take a tenant past its TIER allowance', async () => {
-    const app = boot(tierWithQuota(2));
-    await app.ctx.storage.domain('knowledge').exec(createNote('n1') as never);
-    await app.ctx.storage.domain('knowledge').exec(createNote('n2') as never);
-
-    await expect(app.ctx.storage.domain('knowledge').exec(createNote('n3') as never)).rejects.toMatchObject({
-      code: QUOTA_EXCEEDED,
-      status: 402,
-    });
-    // The row count is the assertion: a gate that threw AFTER the insert would
-    // satisfy `rejects` and enforce nothing.
-    expect(noteCount()).toBe(2);
-  });
-
-  it('lets a HIGHER tier through where a lower one was refused — same app, same op', async () => {
-    const app = boot(tierWithQuota(5));
-    for (const id of ['n1', 'n2', 'n3']) await app.ctx.storage.domain('knowledge').exec(createNote(id) as never);
-    // The negative control for the test above: the refusal was the ceiling, not
-    // something else about the third write.
-    expect(noteCount()).toBe(3);
-  });
-
-  it('does not gate a read', async () => {
-    const app = boot(tierWithQuota(1));
-    await app.ctx.storage.domain('knowledge').exec(createNote('n1') as never);
-    await expect(
-      app.ctx.storage.domain('knowledge').exec({
-        name: 'knowledge.listNotes',
-        tenantId: TENANT,
-        run: () => Promise.resolve([]),
-      } as never),
-    ).resolves.toEqual([]);
-  });
-});
-
-describe('both tiers together — the shape a deployment actually wires', () => {
-  it('audits what it admits and audits NOTHING it refused', async () => {
-    const tier = createGovernanceTier({
-      onAfterError: (error) => afterErrors.push(error),
-      auditTrail: { executor: governanceExecutor },
-      quota: quotaTierFromPlans({
-        plans: () => ({ limits: { 'rows.knowledge': 1 } }),
-        usage: async () => noteCount(),
-        quotaFor: rowsPerDomainQuota({ 'rows.knowledge': 1 }),
-      }),
-    });
-    const app = boot(tier);
-
-    await app.ctx.storage.domain('knowledge').exec(createNote('n1') as never);
-    await expect(app.ctx.storage.domain('knowledge').exec(createNote('n2') as never)).rejects.toMatchObject({
-      code: QUOTA_EXCEEDED,
-    });
-
-    const trail = await tier.auditTrail?.read({ tenantId: TENANT });
-    // ONE entry. The quota gate's `before` aborted the second op, so its `after`
-    // never ran — an audit trail listing a write that was REFUSED would be as
-    // wrong as one listing a write that rolled back.
-    // ONE createNote entry. The quota gate's `before` aborted the second op, so
-    // its `after` never ran — an audit trail listing a write that was REFUSED
-    // would be as wrong as one listing a write that rolled back.
-    expect(trail?.filter((entry) => entry.action === 'knowledge.createNote')).toHaveLength(1);
-    expect(trail?.some((entry) => entry.targetId === 'n2')).toBe(false);
-    expect(noteCount()).toBe(1);
-  });
-
-  it('registers the quota gate FIRST, so a refusal wins', () => {
-    const tier = createGovernanceTier({
-      onAfterError: () => {},
-      auditTrail: { executor: governanceExecutor },
-      quota: quotaTierFromPlans({
-        plans: () => ({ limits: {} }),
-        usage: async () => 0,
-        quotaFor: () => null,
-      }),
-    });
-    // Fixed now so that adding a `before` to the audit trail later cannot
-    // silently reverse the order — `runBefore` walks registrations in order and
-    // the first throw wins.
-    expect(tier.registered.map((hook) => hook.id)).toEqual(['cc.quota-gate', 'cc.audit-trail']);
-  });
-
-  it('declares both hooks as chain TERMINATORS for the V4 cycle audit', () => {
-    const tier = createGovernanceTier({
-      onAfterError: () => {},
-      auditTrail: { executor: governanceExecutor },
-      quota: quotaTierFromPlans({ plans: () => ({ limits: {} }), usage: async () => 0, quotaFor: () => null }),
-    });
-    // Neither writes through a repository, so neither can trigger another
-    // mutation — which is exactly what `eventbus-cycle` needs to know, and what
-    // makes a cyclic pair a BOOT failure rather than a runaway transaction.
-    expect(tier.registered.every((hook) => hook.depthGuarded === true)).toBe(true);
-    expect(tier.registered.every((hook) => (hook.emits ?? []).length === 0)).toBe(true);
-  });
-
-  it('refuses an audit trail with nowhere to write, at construction', () => {
-    expect(() => createGovernanceTier({ onAfterError: () => {}, auditTrail: {} })).toThrow(/sink|executor/i);
-  });
-
-  it('builds an EMPTY pipeline when nothing is configured, rather than undefined', () => {
-    const tier = createGovernanceTier({ onAfterError: () => {} });
-    // A host that wired nothing still gets something it can pass
-    // unconditionally; the alternative is a conditional at every call site and
-    // one of them getting it wrong.
-    expect(tier.registered).toEqual([]);
-    expect(tier.interceptors.interceptors).toEqual([]);
-    expect(tier.auditTrail).toBeUndefined();
-  });
-});
-
-describe('rowsPerDomainQuota', () => {
-  const event = (action: string, domain = 'knowledge'): InterceptorEvent => ({
-    action,
-    domain: domain as InterceptorEvent['domain'],
-    profile: 'local',
-    tenantId: TENANT,
-    inTransaction: false,
-  });
-
-  it('draws on rows.<domain> for a create-shaped op', () => {
-    expect(rowsPerDomainQuota()(event('knowledge.createNote'))).toEqual({ metric: 'rows.knowledge' });
-    expect(rowsPerDomainQuota()(event('knowledge.insertNote'))).toEqual({ metric: 'rows.knowledge' });
-    expect(rowsPerDomainQuota()(event('knowledge.addNote'))).toEqual({ metric: 'rows.knowledge' });
-  });
-
-  it('draws on nothing for a read, an update or a delete', () => {
-    for (const action of ['knowledge.listNotes', 'knowledge.updateNote', 'knowledge.deleteNote'])
-      expect(rowsPerDomainQuota()(event(action))).toBeNull();
-  });
-
-  it('does not match a word that merely CONTAINS create', () => {
-    // `recreateIndex` is maintenance, not a new row. The regex requires the verb
-    // to be followed by a capital, so it anchors on the dotted action's verb.
-    expect(rowsPerDomainQuota()(event('knowledge.recreateIndex'))).toBeNull();
-  });
-
-  it('gates only the domains the caller named', () => {
-    const quotaFor = rowsPerDomainQuota({ 'rows.knowledge': 10 });
-    expect(quotaFor(event('knowledge.createNote'))).toEqual({ metric: 'rows.knowledge' });
-    // Relying on "absent limit ⇒ unlimited" to make this harmless is true today
-    // and is the kind of thing that stops being true.
-    expect(quotaFor(event('media.createAsset', 'media'))).toBeNull();
-  });
-});
-
-/* ------------------------------------------------- the read surface (D25) */
-
-/**
- * `GET /api/guard/audit` — the half the previous landing did not have.
- *
- * A trail that is written continuously and readable only from a `bun repl` is a
- * compliance record nobody can produce. These drive the route over the composed
- * app's own HTTP surface, with real minted sessions, because the two properties
- * that matter are both about the REQUEST: what the caller is allowed to see, and
- * whose trail they get.
- */
-describe('the audit trail read route', () => {
-  const GUARDED_APP = {
-    configVersion: 1,
-    app: { id: 'governance-read', title: 'Governance Read' },
-    profile: 'local',
-    engines: ['guard', 'knowledge'],
-    instances: [
-      { engine: 'guard', id: 'guard', features: { rbac: true } },
-      { engine: 'knowledge', id: 'notes', features: { notes: true } },
-    ],
-  } as const;
-
-  let signer: ReturnType<typeof createSessionSigner>;
-  let registry: Database;
-
-  /**
-   * A deterministic argon2id stand-in. The guard engine's boot gate refuses to
-   * serve without a registered KDF, which is the same gate a real host satisfies
-   * in `host.ts`; no case here derives a password, so a stub is honest.
-   */
-  const stubArgon2id: Argon2idDeriver = ({ password, salt, keyLength }) => {
-    const out = new Uint8Array(keyLength);
-    for (let i = 0; i < keyLength; i += 1)
-      out[i] = ((password[i % password.length] ?? 0) ^ (salt[i % salt.length] ?? 0) ^ (i & 0xff)) & 0xff;
-    return out;
-  };
-
-  beforeEach(() => setArgon2idDeriver(stubArgon2id));
-
-  /**
-   * The guard tier over an in-memory registry — what `createLocalGuardServices`
-   * builds from a data root, minus the files.
-   */
-  const guardDepsOver = (db: Database, label: string) => {
-    const rowSigner = createRowSigner({ integrityKey: SecureKey.adopt(new Uint8Array(32).fill(7), label) });
-    const manager = createSecretEnvelopeManager({ salt: new Uint8Array(CC_SALT_BYTES).fill(3) });
-    return {
-      manager,
-      secrets: createRegistrySecretsStore(db, { manager, signer: rowSigner }),
-      identity: createRegistryIdentityStore(db, { signer: rowSigner }),
-    };
-  };
-
-  const tokenFor = (input: { tenantId: string; userId: string; permissions: string[] }): string =>
-    signer.mint({
-      tenantId: input.tenantId,
-      userId: input.userId,
-      role: 'OWNER',
-      permissions: input.permissions,
-      privateScope: true,
-    }).token;
-
-  /** Boot a guard+knowledge app with the trail on, and return an HTTP driver. */
-  const bootGuarded = async (): Promise<(path: string, token?: string) => Promise<Response>> => {
-    const verified = await verifyAppConfig({ config: GUARDED_APP, moment: 'boot', capabilities: {} });
-    if (!verified.manifest) throw new Error(`config failed to verify: ${JSON.stringify(verified.diagnostics)}`);
-    signer = createSessionSigner({ ttlSeconds: 300 });
-    registry = new Database(':memory:');
-    assertCcPragmas(registry);
-    runNamespacedMigrations(registry, CC_REGISTRY_MIGRATIONS, { namespace: CC_REGISTRY_NAMESPACE });
-    const guardDeps = guardDepsOver(registry, 'governance-spec-integrity');
-
-    const tier = createGovernanceTier({
-      onAfterError: (error) => afterErrors.push(error),
-      auditTrail: { executor: governanceExecutor, when: mutationsOnly() },
-    });
-
-    booted = bootEngineApp({
-      manifest: verified.manifest,
-      handles,
-      objects: memoryObjectStore(),
-      telemetry: stubTelemetry(),
-      signer,
-      allowedOrigins: ['http://localhost:4747'],
-      meterSpillDrainIntervalMs: 0,
-      interceptors: tier.interceptors,
-      auditTrail: tier.auditTrail,
-      guardDeps,
-    });
-
-    return async (path: string, token?: string) =>
-      await booted!.app.fetch(
-        new Request(`http://localhost${path}`, token ? { headers: { authorization: `Bearer ${token}` } } : {}),
-      );
-  };
-
-  afterEach(() => {
-    registry?.close();
-    setArgon2idDeriver(null); // process-wide seam — never leak the stub into other suites
-  });
-
-  it('serves the calling tenant its own trail, and the entries are the app’s own writes', async () => {
-    const fetchApp = await bootGuarded();
-    const handle = booted!.ctx.storage.domain('knowledge');
-    await handle.exec(createNote('n_read_1') as never);
-
-    const response = await fetchApp(
-      '/api/guard/audit',
-      tokenFor({ tenantId: TENANT, userId: 'u_admin', permissions: ['audit:read'] }),
-    );
-
-    expect(response.status).toBe(200);
-    const body = (await response.json()) as { success: boolean; entries: { action: string; targetId?: string }[] };
-    expect(body.success).toBe(true);
-    expect(body.entries.map((entry) => entry.action)).toContain('knowledge.createNote');
-    expect(body.entries.find((entry) => entry.targetId === 'n_read_1')).toBeDefined();
-  });
-
-  it('never serves ANOTHER tenant’s trail — the scope is the token, not a parameter', async () => {
-    const fetchApp = await bootGuarded();
-    await booted!.ctx.storage.domain('knowledge').exec(createNote('n_theirs') as never);
-
-    // A perfectly valid, fully-privileged session for a DIFFERENT tenant. This
-    // is the read that would leak everything: an audit table is one table across
-    // every tenant, so a `?tenantId=` this route honored would be a
-    // cross-tenant disclosure of the most sensitive surface the product has.
-    const response = await fetchApp(
-      `/api/guard/audit?tenantId=${TENANT}`,
-      tokenFor({ tenantId: 't_other', userId: 'u_other', permissions: ['audit:read', 'infra:write'] }),
-    );
-
-    expect(response.status).toBe(200);
-    const body = (await response.json()) as { entries: unknown[] };
-    expect(body.entries).toEqual([]);
-  });
-
-  it('refuses a session without audit:read — INCLUDING a full infra:write one (D27)', async () => {
-    const fetchApp = await bootGuarded();
-    await booted!.ctx.storage.domain('knowledge').exec(createNote('n_gated') as never);
-
-    const member = await fetchApp(
-      '/api/guard/audit',
-      tokenFor({ tenantId: TENANT, userId: 'u_member', permissions: ['knowledge:write'] }),
-    );
-    expect(member.status).toBe(403);
-
-    // THE D27 assertion. `infra:write` used to be this route's gate, so a token
-    // carrying it (plus every other permission in the vocabulary EXCEPT
-    // `audit:read`) is exactly the session that would still pass if the split
-    // were nominal — a renamed constant checked against the old grant. It is
-    // also the case a "any permission at all" check could not distinguish.
-    const infra = await fetchApp(
-      '/api/guard/audit',
-      tokenFor({
-        tenantId: TENANT,
-        userId: 'u_infra',
-        permissions: ['infra:write', 'knowledge:write', 'knowledge:delete'],
-      }),
-    );
-    expect(infra.status).toBe(403);
-
-    expect((await fetchApp('/api/guard/audit')).status).toBe(401);
-  });
-
-  it('an ADMIN gets the trail from an explicit per-membership grant, not from their role', async () => {
-    const fetchApp = await bootGuarded();
-    await booted!.ctx.storage.domain('knowledge').exec(createNote('n_granted') as never);
-
-    // Option C in one pair of requests: the role table gives ADMIN nothing here
-    // (in a tenant where ADMINs manage each other the trail is a record of what
-    // the other ADMINs did), and `identity.setMembershipPermissions` is the path
-    // that turns it on for one person without changing it for every customer.
-    const byRole = effectivePermissions('ADMIN');
-    expect(byRole).not.toContain('audit:read');
-    const granted = effectivePermissions('ADMIN', ['audit:read']);
-    expect(granted).toContain('audit:read');
-
-    expect(
-      (await fetchApp('/api/guard/audit', tokenFor({ tenantId: TENANT, userId: 'u_a', permissions: [...byRole] })))
-        .status,
-    ).toBe(403);
-    expect(
-      (await fetchApp('/api/guard/audit', tokenFor({ tenantId: TENANT, userId: 'u_a', permissions: [...granted] })))
-        .status,
-    ).toBe(200);
-  });
-
-  it('clamps a caller-supplied page size rather than trusting it', async () => {
-    const fetchApp = await bootGuarded();
-    const handle = booted!.ctx.storage.domain('knowledge');
-    for (let i = 0; i < 5; i += 1) await handle.exec(createNote(`n_page_${i}`) as never);
-
-    const token = tokenFor({ tenantId: TENANT, userId: 'u_admin', permissions: ['audit:read'] });
-    const paged = (await (await fetchApp('/api/guard/audit?limit=2', token)).json()) as { entries: unknown[] };
-    expect(paged.entries).toHaveLength(2);
-
-    // `limit` reaches a `LIMIT ?`; an unbounded one pages a whole trail into one
-    // response.
-    const huge = (await (await fetchApp('/api/guard/audit?limit=100000', token)).json()) as { entries: unknown[] };
-    expect(huge.entries.length).toBeLessThanOrEqual(200);
-  });
-
-  it('is ABSENT when no trail is wired — not a 500, and not an empty list', async () => {
-    const verified = await verifyAppConfig({ config: GUARDED_APP, moment: 'boot', capabilities: {} });
-    signer = createSessionSigner({ ttlSeconds: 300 });
-    registry = new Database(':memory:');
-    assertCcPragmas(registry);
-    runNamespacedMigrations(registry, CC_REGISTRY_MIGRATIONS, { namespace: CC_REGISTRY_NAMESPACE });
-    booted = bootEngineApp({
-      manifest: verified.manifest!,
-      handles,
-      objects: memoryObjectStore(),
-      telemetry: stubTelemetry(),
-      signer,
-      allowedOrigins: ['http://localhost:4747'],
-      meterSpillDrainIntervalMs: 0,
-      guardDeps: guardDepsOver(registry, 'governance-spec-integrity-2'),
-    });
-
-    const response = await booted.app.fetch(
-      new Request('http://localhost/api/guard/audit', {
-        headers: {
-          authorization: `Bearer ${tokenFor({ tenantId: TENANT, userId: 'u_admin', permissions: ['audit:read'] })}`,
-        },
-      }),
-    );
-
-    // The surface does not exist, which is what V7.1 requires of an unwired
-    // sub-block: a route that answered `{entries: []}` would say "nothing has
-    // happened" when the truth is "nothing is being recorded".
-    expect(response.status).toBe(404);
-  });
-});