qa360 2.2.1 → 2.2.13

package/core/src/proof/__tests__/temporal-regression.test.ts

@@ -1,537 +0,0 @@
-/**
- * Cryptographic Proof Temporal Regression Tests
- *
- * Tests that proofs created today remain verifiable:
- * 1. Across different versions of QA360
- * 2. After serialization/deserialization
- * 3. With stored keys
- *
- * This is CRITICAL for the long-term value of QA360 proofs.
- * A proof generated in v1.0 MUST be verifiable in v2.0, v3.0, etc.
- *
- * @see docs/rfc/proof-bundle-v1.md#temporal-stability
- */
-
-import { describe, it, expect } from 'vitest';
-import {
-  generateKeys,
-  sign,
-  verify,
-  createProofBundle,
-  verifyProofBundle,
-  canonicalize,
-  type ProofBundle,
-  type ProofBundleParams,
-  type KeyPair,
-} from '../index.js';
-import { promises as fs } from 'fs';
-import { join } from 'path';
-
-/**
- * VECTORS: Historical proof bundle for regression testing
- *
- * This proof was created with a deterministic keypair and data.
- * It MUST always verify successfully across all versions.
- *
- * Generated: 2025-01-01
- * Keypair seed: "qa360-regression-test-v1"
- */
-const HISTORICAL_PROOF_V1: ProofBundle = {
-  spec: 'qa360.proof.v1',
-  run: {
-    id: '550e8400-e29b-41d4-a716-446655440000',
-    startedAt: '2025-01-01T00:00:00.000Z',
-    finishedAt: '2025-01-01T00:05:00.000Z',
-    environment: {
-      os: 'linux',
-      node: '20.0.0',
-      arch: 'x64',
-      ci: false,
-    },
-    packHash: 'sha256-' + '0'.repeat(64),
-    ciContext: {
-      provider: null,
-    },
-  },
-  artifacts: [],
-  results: {
-    trustScore: 87,
-    gates: [
-      { name: 'api_smoke', status: 'pass', metrics: { p95_ms: 150 } },
-    ],
-  },
-  signing: {
-    algo: 'ed25519',
-    signerId: 'local@qa360',
-    timestamp: {
-      type: 'none',
-      token: null,
-    },
-    identity: {
-      type: 'none',
-      evidence: null,
-    },
-  },
-  // Signature will be computed in test setup
-  signature: '',
-};
-
-describe('Cryptographic Proof - Temporal Regression', () => {
-  /**
-   * REGRESSION TEST 1: Deterministic Signature
-   *
-   * Given the same keypair and data, the signature MUST be identical.
-   * This ensures our signing algorithm is stable across time.
-   */
-  describe('deterministic signatures', () => {
-    it('should produce identical signatures for same input', () => {
-      // Generate deterministic test keypair
-      const keyPair = generateKeys();
-
-      const testData = 'test-data-for-signing';
-      const signatures: string[] = [];
-
-      // Sign 100 times - all must be identical
-      for (let i = 0; i < 100; i++) {
-        signatures.push(sign(testData, keyPair.secretKey));
-      }
-
-      // All signatures must match
-      const firstSignature = signatures[0];
-      signatures.forEach((sig, idx) => {
-        expect(sig).toBe(firstSignature);
-        expect(sig.length).toBe(88); // Base64 Ed25519 signature
-      });
-    });
-
-    it('should verify signature across multiple runs', () => {
-      const keyPair = generateKeys();
-      const data = 'cross-run-verification';
-
-      // Sign and verify 100 times
-      for (let i = 0; i < 100; i++) {
-        const signature = sign(data, keyPair.secretKey);
-        expect(verify(data, signature, keyPair.publicKey)).toBe(true);
-      }
-    });
-  });
-
-  /**
-   * REGRESSION TEST 2: Serialization Roundtrip
-   *
-   * A proof serialized to JSON must deserialize and verify correctly.
-   * This simulates storing proofs on disk and reading them back later.
-   */
-  describe('serialization roundtrip', () => {
-    it('should survive JSON serialization', async () => {
-      const keyPair = generateKeys();
-
-      const params: ProofBundleParams = {
-        startedAt: new Date('2025-01-01T00:00:00Z'),
-        finishedAt: new Date('2025-01-01T00:05:00Z'),
-        packHash: 'sha256-' + 'a'.repeat(64),
-        artifacts: [],
-        trustScore: 92,
-        gates: [
-          { name: 'api_smoke', status: 'pass', metrics: { p95_ms: 120 } },
-          { name: 'ui', status: 'pass', metrics: { coverage: 85 } },
-        ],
-        keyPair,
-      };
-
-      // Create original proof
-      const original = await createProofBundle(params);
-
-      // Serialize to JSON
-      const json = JSON.stringify(original);
-
-      // Deserialize
-      const deserialized = JSON.parse(json) as ProofBundle;
-
-      // Verify deserialized proof
-      const result = await verifyProofBundle(deserialized, keyPair.publicKey);
-
-      expect(result.valid).toBe(true);
-      expect(result.details?.trustScore).toBe(92);
-    });
-
-    it('should handle JSON with different whitespace', async () => {
-      const keyPair = generateKeys();
-
-      const params: ProofBundleParams = {
-        startedAt: new Date('2025-01-01T00:00:00Z'),
-        finishedAt: new Date('2025-01-01T00:05:00Z'),
-        packHash: 'sha256-' + 'b'.repeat(64),
-        artifacts: [],
-        trustScore: 88,
-        gates: [{ name: 'test', status: 'pass' }],
-        keyPair,
-      };
-
-      const original = await createProofBundle(params);
-
-      // Serialize with different formatting
-      const compact = JSON.stringify(original);
-      const pretty = JSON.stringify(original, null, 2);
-      const ugly = JSON.stringify(original, null, 4);
-
-      // All should verify
-      expect(await verifyProofBundle(JSON.parse(compact), keyPair.publicKey)).toHaveProperty('valid', true);
-      expect(await verifyProofBundle(JSON.parse(pretty), keyPair.publicKey)).toHaveProperty('valid', true);
-      expect(await verifyProofBundle(JSON.parse(ugly), keyPair.publicKey)).toHaveProperty('valid', true);
-    });
-  });
-
-  /**
-   * REGRESSION TEST 3: Canonical Form Stability
-   *
-   * The canonicalization algorithm MUST be stable.
-   * If it changes, old signatures will break.
-   */
-  describe('canonical form stability', () => {
-    it('should produce consistent canonical JSON', () => {
-      const obj = {
-        z: 1,
-        a: 2,
-        nested: { z: 'last', a: 'first' },
-        array: [3, 1, 2],
-      };
-
-      const canonical1 = canonicalize(obj);
-      const canonical2 = canonicalize(obj);
-      const canonical3 = canonicalize(obj);
-
-      expect(canonical1).toBe(canonical2);
-      expect(canonical2).toBe(canonical3);
-    });
-
-    it('should handle Unicode consistently', () => {
-      const obj = {
-        text: 'Hello 世界 🌍',
-        emoji: '🔐🔑',
-        special: 'café naïve résumé',
-      };
-
-      const canonical1 = canonicalize(obj);
-      const canonical2 = canonicalize(obj);
-
-      expect(canonical1).toBe(canonical2);
-    });
-
-    it('should handle edge cases consistently', () => {
-      const cases = [
-        { empty: {} },
-        { null: null },
-        { number: 42 },
-        { negative: -1 },
-        { zero: 0 },
-        { float: 3.14 },
-        { scientific: 1.5e10 },
-        { escaped: 'quote"quote' },
-        { array: [] },
-        { nested: { deeply: { nested: { value: 1 } } } },
-      ];
-
-      cases.forEach((obj) => {
-        const c1 = canonicalize(obj);
-        const c2 = canonicalize(obj);
-        expect(c1).toBe(c2);
-      });
-    });
-  });
-
-  /**
-   * REGRESSION TEST 4: Key Independence
-   *
-   * Verification MUST work independently of key loading method.
-   * Keys from disk, memory, or network should all work the same.
-   */
-  describe('key independence', () => {
-    it('should verify with keys from different sources', async () => {
-      const keyPair = generateKeys();
-
-      const params: ProofBundleParams = {
-        startedAt: new Date('2025-01-01T00:00:00Z'),
-        finishedAt: new Date('2025-01-01T00:05:00Z'),
-        packHash: 'sha256-' + 'c'.repeat(64),
-        artifacts: [],
-        trustScore: 90,
-        gates: [{ name: 'test', status: 'pass' }],
-        keyPair,
-      };
-
-      const bundle = await createProofBundle(params);
-
-      // Verify with original keypair
-      const result1 = await verifyProofBundle(bundle, keyPair.publicKey);
-
-      // Verify with cloned keypair (simulating re-load)
-      const clonedKey: KeyPair = {
-        publicKey: new Uint8Array(keyPair.publicKey),
-        secretKey: new Uint8Array(keyPair.secretKey),
-      };
-      const result2 = await verifyProofBundle(bundle, clonedKey.publicKey);
-
-      // Both should verify
-      expect(result1.valid).toBe(true);
-      expect(result2.valid).toBe(true);
-      expect(result1.code).toBe(result2.code);
-    });
-  });
-
-  /**
-   * REGRESSION TEST 5: Tamper Detection
-   *
-   * Any modification to signed data MUST be detected.
-   * This is the core security guarantee.
-   */
-  describe('tamper detection', () => {
-    it('should detect single bit flip', async () => {
-      const keyPair = generateKeys();
-
-      const params: ProofBundleParams = {
-        startedAt: new Date('2025-01-01T00:00:00Z'),
-        finishedAt: new Date('2025-01-01T00:05:00Z'),
-        packHash: 'sha256-' + 'd'.repeat(64),
-        artifacts: [],
-        trustScore: 85,
-        gates: [{ name: 'test', status: 'pass' }],
-        keyPair,
-      };
-
-      const bundle = await createProofBundle(params);
-
-      // Tamper: change trust score by 1
-      bundle.results.trustScore = 86;
-
-      const result = await verifyProofBundle(bundle, keyPair.publicKey);
-
-      expect(result.valid).toBe(false);
-      expect(result.code).toBeGreaterThan(0);
-    });
-
-    it('should detect timestamp tampering', async () => {
-      const keyPair = generateKeys();
-
-      const params: ProofBundleParams = {
-        startedAt: new Date('2025-01-01T00:00:00Z'),
-        finishedAt: new Date('2025-01-01T00:05:00Z'),
-        packHash: 'sha256-' + 'e'.repeat(64),
-        artifacts: [],
-        trustScore: 88,
-        gates: [{ name: 'test', status: 'pass' }],
-        keyPair,
-      };
-
-      const bundle = await createProofBundle(params);
-
-      // Tamper: change started time
-      bundle.run.startedAt = '2025-01-01T01:00:00.000Z';
-
-      const result = await verifyProofBundle(bundle, keyPair.publicKey);
-
-      expect(result.valid).toBe(false);
-    });
-
-    it('should detect gate status change', async () => {
-      const keyPair = generateKeys();
-
-      const params: ProofBundleParams = {
-        startedAt: new Date('2025-01-01T00:00:00Z'),
-        finishedAt: new Date('2025-01-01T00:05:00Z'),
-        packHash: 'sha256-' + 'f'.repeat(64),
-        artifacts: [],
-        trustScore: 90,
-        gates: [{ name: 'api_smoke', status: 'pass', metrics: {} }],
-        keyPair,
-      };
-
-      const bundle = await createProofBundle(params);
-
-      // Tamper: change pass to fail
-      bundle.results.gates[0].status = 'fail';
-
-      const result = await verifyProofBundle(bundle, keyPair.publicKey);
-
-      expect(result.valid).toBe(false);
-    });
-  });
-
-  /**
-   * REGRESSION TEST 6: Version Compatibility
-   *
-   * Proofs should contain version info and handle schema evolution.
-   */
-  describe('version compatibility', () => {
-    it('should include spec version', async () => {
-      const keyPair = generateKeys();
-
-      const params: ProofBundleParams = {
-        startedAt: new Date('2025-01-01T00:00:00Z'),
-        finishedAt: new Date('2025-01-01T00:05:00Z'),
-        packHash: 'sha256-' + '1'.repeat(64),
-        artifacts: [],
-        trustScore: 87,
-        gates: [{ name: 'test', status: 'pass' }],
-        keyPair,
-      };
-
-      const bundle = await createProofBundle(params);
-
-      expect(bundle.spec).toBe('qa360.proof.v1');
-    });
-
-    it('should handle v1 spec format', async () => {
-      const keyPair = generateKeys();
-
-      // Manually construct a v1 proof to verify our verifier handles it
-      const params: ProofBundleParams = {
-        startedAt: new Date('2025-01-01T00:00:00Z'),
-        finishedAt: new Date('2025-01-01T00:05:00Z'),
-        packHash: 'sha256-' + '2'.repeat(64),
-        artifacts: [
-          { name: 'screenshot.png', sha256: 'sha256-' + 'a'.repeat(64), size: 12345 },
-        ],
-        trustScore: 91,
-        gates: [
-          { name: 'api_smoke', status: 'pass', metrics: { p95_ms: 100 } },
-          { name: 'ui', status: 'pass', metrics: { coverage: 95 } },
-        ],
-        keyPair,
-      };
-
-      const bundle = await createProofBundle(params);
-
-      // Verify the bundle
-      const result = await verifyProofBundle(bundle, keyPair.publicKey);
-
-      expect(result.valid).toBe(true);
-      expect(result.details?.artifactsTotal).toBe(1);
-      expect(result.details?.trustScore).toBe(91);
-    });
-  });
-
-  /**
-   * REGRESSION TEST 7: Persistent Proof Storage
-   *
-   * Simulate storing a proof to disk and reading it back later.
-   * This is what happens in production.
-   */
-  describe('persistent storage simulation', () => {
-    it('should survive write and read from filesystem', async () => {
-      const keyPair = generateKeys();
-
-      const params: ProofBundleParams = {
-        startedAt: new Date('2025-01-01T00:00:00Z'),
-        finishedAt: new Date('2025-01-01T00:05:00Z'),
-        packHash: 'sha256-' + '3'.repeat(64),
-        artifacts: [],
-        trustScore: 93,
-        gates: [{ name: 'test', status: 'pass' }],
-        keyPair,
-      };
-
-      const original = await createProofBundle(params);
-
-      // Simulate writing to disk (using a temp file would be better, but we'll just serialize)
-      const serialized = JSON.stringify(original, null, 2);
-
-      // Simulate reading from disk
-      const deserialized = JSON.parse(serialized) as ProofBundle;
-
-      // Verify
-      const result = await verifyProofBundle(deserialized, keyPair.publicKey);
-
-      expect(result.valid).toBe(true);
-      expect(result.details?.trustScore).toBe(93);
-    });
-
-    it('should preserve all fields through roundtrip', async () => {
-      const keyPair = generateKeys();
-
-      const params: ProofBundleParams = {
-        runId: '550e8400-e29b-41d4-a716-446655440001', // Valid UUID
-        startedAt: new Date('2025-01-01T00:00:00Z'),
-        finishedAt: new Date('2025-01-01T00:05:00Z'),
-        packHash: 'sha256-' + '4'.repeat(64),
-        artifacts: [
-          { name: 'report.html', sha256: 'sha256-' + 'a'.repeat(64), size: 5000 },
-          { name: 'test.log', sha256: 'sha256-' + 'b'.repeat(64), size: 1000 },
-        ],
-        trustScore: 89,
-        gates: [
-          { name: 'api_smoke', status: 'pass', metrics: { p95_ms: 150 } },
-          { name: 'perf', status: 'pass', metrics: { p95_ms: 200 } },
-        ],
-        keyPair,
-      };
-
-      const original = await createProofBundle(params);
-
-      // Roundtrip through JSON
-      const deserialized = JSON.parse(JSON.stringify(original)) as ProofBundle;
-
-      // Check all fields preserved
-      expect(deserialized.spec).toBe(original.spec);
-      expect(deserialized.run.id).toBe(original.run.id);
-      expect(deserialized.run.startedAt).toBe(original.run.startedAt);
-      expect(deserialized.run.finishedAt).toBe(original.run.finishedAt);
-      expect(deserialized.run.packHash).toBe(original.run.packHash);
-      expect(deserialized.artifacts).toHaveLength(original.artifacts.length);
-      expect(deserialized.results.trustScore).toBe(original.results.trustScore);
-      expect(deserialized.results.gates).toHaveLength(original.results.gates.length);
-      expect(deserialized.signature).toBe(original.signature);
-
-      // Verify signature still valid
-      const result = await verifyProofBundle(deserialized, keyPair.publicKey);
-      expect(result.valid).toBe(true);
-    });
-  });
-});
-
-/**
- * Historical Proof Anchor
- *
- * This test creates an anchor proof that can be used for regression testing
- * across versions. The signature is computed once and stored.
- *
- * Future versions should load this proof and verify it succeeds.
- *
- * IMPORTANT: If this test fails, it means the canonicalization or signing
- * algorithm has changed in a backward-incompatible way!
- */
-describe('Historical Proof Anchor', () => {
-  it('should create a stable anchor proof for future regression', async () => {
-    // Use a fixed keypair for reproducibility
-    // In real implementation, we'd use a seeded key generator
-    const keyPair = generateKeys();
-
-    const anchorHash = 'sha256-' + 'a'.repeat(60) + '0'.repeat(4); // Valid format
-
-    const params: ProofBundleParams = {
-      runId: '550e8400-e29b-41d4-a716-446655440002', // Valid UUID
-      startedAt: new Date('2025-01-01T00:00:00Z'),
-      finishedAt: new Date('2025-01-01T00:05:00Z'),
-      packHash: anchorHash,
-      artifacts: [],
-      trustScore: 100,
-      gates: [
-        { name: 'anchor_test', status: 'pass', metrics: { anchor: true } },
-      ],
-      keyPair,
-    };
-
-    const bundle = await createProofBundle(params);
-
-    // This proof MUST verify
-    const result = await verifyProofBundle(bundle, keyPair.publicKey);
-
-    expect(result.valid).toBe(true);
-    expect(result.code).toBe(0);
-
-    // Log the signature for potential external storage
-    // In production, this would be stored in a regression test data file
-    console.log('Anchor proof signature:', bundle.signature);
-    console.log('Anchor proof run ID:', bundle.run.id);
-  });
-});