mirror/LocalAI
1
0 Fork 0
mirror of https://github.com/mudler/LocalAI.git synced 2026-10-28 09:08:54 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
0a44303c212e69e070115bbb834912755df07905
LocalAI/scripts/addons/suites.json
T
mudler-agentandEttore Di Giacinto 0a44303c21 fix(addons): one page title, one primary action and clearer empty states (#12850) 
A visual pass over the add-on pages found the same few problems on
several of them. Fix them with one rule per problem instead of page by
page.

Titles: every add-on page takes the host page-title size. Talk and Tables
no longer shrink it, Studio draws one "Studio" title above its tabs (the
card of a generator is a section), and Voice keeps one title on all its
tabs. The Text to speech tab gets a styled form. The "not available"
page shows the add-on name, not the lowercase id, and sits at the same
inset as an add-on page.

One primary action: the empty state of a list carries the add button, so
the header button waits until there is something in the list (Voice
library, enrolling a speaker or a person, Add rows). The Add-ons page
shows one way into Browse. A table with no columns says so once.

Tables: Share is hidden when there are no named accounts. The active
table tab is highlighted and an empty tab list leaves no gap before
"New table".

Studio: the tab strip stays on one row at 1280 wide, /studio/3d opens
the 3D tab, and an input chip has a divider between its label and its
placeholder.

Fine-tune and Quantize: the Experimental badge sits beside the lede, not
inside the h1; an open step shows its number instead of an empty circle;
the sticky action bar keeps a gap above it.

The footer shows nothing for the empty version of a source build, and
the Voice Text to speech tab says where to get a model when none is
installed.

Assisted-by: Claude:claude-sonnet-5-5 [Claude Code]

Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Co-authored-by: Ettore Di Giacinto <mudler@localai.io>
2026-10-23 12:35:44 +02:00

3459 lines
252 KiB
JSON
Raw Blame History

{
"prerequisites": {
"kind": "shell",
"commands": [
[
"sh",
"scripts/addons/prerequisites_test.sh"
]
],
"cases": [
"missing-go",
"old-go",
"future-go",
"old-node",
"wrong-node",
"wrong-protoc",
"absent-generated",
"empty-name",
"future-suite",
"empty-selection",
"failed-child",
"failed-case-named",
"failed-tail-kept",
"zero-tests",
"skipped-tests",
"exact-tag-pin",
"wrong-tag-sum",
"ginkgo-empty",
"ginkgo-skipped",
"ginkgo-missing",
"ginkgo-failed-spec-named",
"ginkgo-failure-message",
"browser-setup-failure",
"configured-browser-missing",
"configured-browser-setup",
"contracts-empty",
"contracts-skipped",
"gateway-missing-report",
"gateway-skipped-report",
"ui-report-failed",
"ui-report-skipped",
"ui-report-flaky",
"ui-report-empty",
"ui-report-missing",
"leak-ignores-command-line",
"leak-finds-working-directory"
],
"readiness": {
"ginkgo": {
"command": [
"go",
"test",
"-count=1",
"-p",
"2",
"-tags",
"auth",
"<temporary SQLite probe>",
"-ginkgo.json-report=<unique report>"
],
"cases": [
"sqlite transaction"
]
},
"commands": [
[
"sh",
"scripts/addons/prepare.sh",
"--check"
],
[
"tests/e2e-ui/ui-test-server",
"--mock-backend=<absolute mock-backend>",
"--port=<isolated port>"
],
[
"core/http/react-ui/node_modules/.bin/playwright",
"--version"
],
[
"node",
"--input-type=module",
"-e",
"<browser readiness probe>",
"<healthy server URL>"
]
],
"cases": [
"toolchain",
"server health",
"browser"
]
}
},
"contracts": {
"kind": "ginkgo",
"commands": [
[
"go",
"test",
"-count=1",
"-p",
"2",
"-tags",
"auth",
"./pkg/addons/contract",
"-ginkgo.json-report=../../../.cache/addons/logs/contracts.json"
]
],
"cases": [
"accepts independent service tool page and chat capabilities",
"rejects invalid namespace IDs and executable paths",
"rejects add-on IDs that the host serves as a route segment",
"rejects invalid versions ranges and capabilities",
"rejects unknown duplicate trailing and oversized manifest JSON",
"rejects incompatible host API protocol SDK data and platform fixtures",
"validates UI only when declared and rejects inconsistent contributions",
"uses canonical version one wire fixtures",
"rejects incomplete expired or forged authority shapes",
"rejects unknown and oversized wire payloads",
"validates finite defaults overrides and cross field bounds",
"validates preview receipt states and output descriptions",
"accepts the apps surface fields and keeps headless manifests valid",
"rejects unknown and reserved launch modes",
"rejects remote data absolute and traversing icon paths",
"requires the main page to be one of the declared pages",
"bounds localized titles and descriptions and rejects markup",
"requires the existence tool of an addon whose resources are created or deleted",
"reserves the segments of the navigation routes",
"refuses an add-on that needs a newer SDK than the host provides, and says so",
"accepts a range that contains the host SDK",
"accepts a range that spans the host SDK",
"refuses an add-on built for SDK 1 only on a version 2 host",
"keeps the generic message for a range that is malformed",
"accepts a read tool that names no resource",
"keeps a create tool free of the resource argument",
"refuses a read tool that offers the resource without requiring it",
"refuses a write or schema tool without a resource",
"still accepts a read tool that requires its resource",
"still accepts a write or schema tool that requires its resource"
],
"report": ".cache/addons/logs/contracts.json"
},
"catalog": {
"kind": "ginkgo",
"commands": [
[
"go",
"test",
"-count=1",
"-p",
"2",
"-tags",
"auth",
"./core/services/addons/catalog",
"-ginkgo.json-report=../../../../.cache/addons/logs/catalog.json"
]
],
"cases": [
"fetches private bearer and basic catalogs without OCI credentials",
"blocks redirects without leaking credentials or error details",
"keeps duplicate names source scoped and excludes disabled sources",
"reports refresh failures rather than serving stale success",
"resolves the host platform from a multi platform catalog",
"selects exact configured owner targets and rejects absent or ambiguous targets",
"requires authoritative administration for all source edits",
"persists protected references and removes sources without touching installs",
"invalidates cached releases on explicit source changes",
"rejects secret URLs invalid digests duplicate identities and malformed catalogs",
"refuses a library entry whose add-on ID is a host route segment",
"lists and gets protected source copies including disabled and empty sources after reload",
"requires current authoritative administration and context for source reads",
"serializes source reads with concurrent configuration edits",
"pins channels and restricts package transport to secure or opted in loopback origins",
"surfaces optional UI metadata in search results and resolutions without changing plain entries",
"rejects entries with remote icons, reserved launch modes, markup or overlong display text",
"lists only releases the configured target platform can install",
"keeps the compatibility hint of an entry and refuses a malformed range",
"lists the releases of one add-on for every platform, from the cache, and refuses a failed library",
"names an unavailable credential reference as a credential failure inside the refresh failure",
"reads a YAML list of releases with the documented fields",
"accepts an empty library written as an empty list",
"refuses a JSON index",
"refuses an unknown field, at the top and inside ui",
"refuses a second document, a mapping, an empty body and a duplicate key",
"refuses duplicate identities",
"enforces the release count and the size limit"
],
"report": ".cache/addons/logs/catalog.json"
},
"packages": {
"kind": "ginkgo",
"commands": [
[
"go",
"test",
"-count=1",
"-p",
"2",
"-tags",
"auth",
"./core/services/addons/packages",
"-ginkgo.json-report=../../../../.cache/addons/logs/packages.json"
]
],
"cases": [
"stages verified HTTP bytes and commits immutable receipts without activation",
"rejects untrusted integrity forged releases and digest mismatches",
"rejects traversal links collisions and excessive extraction",
"rejects cancellation disk full and preserves existing packages",
"rejects platform data API SDK and missing asset mismatches",
"pins and verifies real local OCI distribution bytes without a container runtime",
"rejects downloaded digest mismatch redirects cancellation and file count limits",
"accepts optional UI only with real immutable assets and rejects non executable entrypoints",
"does not allow remote verification policy to replace owner trust",
"requires source opt in before any plaintext OCI request",
"bounds compressed OCI PAX expansion before tar parsing",
"bounds compressed OCI GNU expansion before tar parsing",
"counts padding trailing bytes and layers at the exact expanded boundary",
"denies nonloopback plaintext and redirect responses at the transport boundary",
"bounds expanded bytes cumulatively across real OCI layers",
"bounds sparse logical output across files and layers preserving old packages",
"accepts exact sparse output budget and cancels synthesized writes",
"stages real trusted signatures and rejects signed identity digest and trust mismatches offline",
"records the digest of a packaged immutable icon in the receipt and refuses unusable icons"
],
"report": ".cache/addons/logs/packages.json"
},
"lifecycle": {
"kind": "ginkgo",
"commands": [
[
"go",
"test",
"-count=1",
"-p",
"2",
"-tags",
"auth",
"./core/services/addons",
"-ginkgo.json-report=../../../.cache/addons/logs/lifecycle.json"
]
],
"cases": [
"recovers every durable journal boundary without replaying publication",
"removes abandoned staging without removing published packages on recovery",
"keeps immutable history on successful upgrade and reinstallation",
"excludes competing owners and rejects conflicting durable identities",
"never opens replica roots or elects an absent owner",
"binds duplicate operation IDs to actor and command and serializes conflicts",
"refuses commands and asset reads for an add-on ID the host serves as a route",
"retains generations identity data and grants across uninstall and restart",
"preserves old packages and active generation on manager upgrade failure",
"requires current authoritative administration even for idempotent retries",
"rejects symlinked package roots without touching external staging",
"executes enabled owner intent on startup and stops on disable and close without forwarder execution",
"retries runtime synchronization after canceled disable and generation upgrade",
"binds lifecycle lookup to current admin and original actor without writes or repair",
"cancels status lookup while a lifecycle writer holds the journal lock",
"denies enable and disable for a stale generation without recording anything",
"lists the identifiers of installed addons, disabled ones included",
"refuses to list installed identifiers while recovery is required",
"lists apps by visibility and serves an icon only for a visible app at its generation",
"reports the supervisor state of an app through a crash and a restart",
"reads a flat directory in batches and stops at the entry bound",
"adds up nested files and reports a complete walk as not truncated",
"never follows or counts a symbolic link",
"keeps a result for a short time so polling does not walk again",
"stops at the time bound and reports a truncated size",
"does not keep a result cut short by the caller",
"is what the installed view reports for the data directory",
"resolves a package for the current enabled generation and digest only",
"answers from the current installed manifest only and follows a generation change",
"reports a digest-only change of a moving channel, applies nothing and offers the pinned upgrade",
"refuses a second operation ID for the same transition, in flight or done, and applies it once",
"runs concurrent requests with one operation ID once and gives each the same answer",
"serializes conflicting upgrades by the installed digest and refuses the loser without a record",
"refuses a candidate that is not the one the library resolves now",
"refuses an upgrade to the digest that is already installed",
"rechecks compatibility at execution and refuses an incompatible candidate",
"selects a newer immutable version and treats a rewritten version as an integrity error",
"keeps the last good generation when the candidate cannot be staged",
"never switches the library or channel, and a failed check is never up to date",
"lets an administrator refresh and everyone with the feature read a redacted status",
"shows the pending update in the apps list from the cache only",
"does not accept pins without an update checker or on another action",
"keeps the unpinned typed upgrade of an earlier release working",
"carries the SDK refusal text to the caller of a failed install and keeps the generic error",
"installs an add-on whose SDK range contains the host SDK",
"upgrades an installed add-on through the same path as a manual upgrade",
"does nothing when no newer version is listed",
"refuses a candidate whose package no longer matches its listed digest and replaces nothing",
"refuses a candidate that fails the signature policy of its library and replaces nothing",
"does not upgrade to a release the host cannot run",
"does nothing without an update checker",
"keeps the manual upgrade closed to a caller who is not an administrator"
],
"report": ".cache/addons/logs/lifecycle.json"
},
"runtime": {
"kind": "ginkgo",
"commands": [
[
"go",
"test",
"-count=1",
"-p",
"2",
"-tags",
"auth",
"./core/services/addons/runtime",
"-ginkgo.json-report=../../../../.cache/addons/logs/runtime.json"
]
],
"cases": [
"registers only ready generation bound service headless and UI capabilities",
"rejects forged registration nonloopback and stale incarnation handshakes",
"bounds readiness and handles exit during start and stop",
"withdraws immediately drains boundedly and rejects stale process identities",
"exhausts restart budget without retaining dead registrations",
"does not inherit secrets and exits when the private parent channel closes",
"rejects foreign supervisor handles and numeric PID substitutions",
"resets restart budget only after sustained authenticated health",
"authenticates every request and separates trusted authority from model arguments",
"bounds output streams cancellation deadlines and stop admission",
"tells a 409 conflict of the add-on from an outage",
"rejects nonloopback endpoints and bounds oversized streams and concurrency",
"never reports failed between a launch starting and the restarted process being published",
"reserves a draining slot against concurrent starts",
"waits for a restart launch worker before acknowledging stop",
"exposes a new incarnation client after restart without reviving the old client",
"kills the exact paused child of a killed owner before launching its replacement",
"fails closed on ambiguous launch identities and preserves unrelated reused PIDs",
"retains a canceled restart slot until cleanup completes and rejects duplicate supervisors",
"refuses a missing established ledger and fences failed cleanup publication",
"withdraws and initiates every live slot before a cleanup timeout",
"reports stopped, running, failed, starting and running again across a crash and a restart",
"keeps reporting failed once the restart budget is exhausted",
"creates one private data directory per addon and passes its path in the startup object",
"gives no data directory without a data root and refuses an unsafe root or addon ID",
"gives an add-on that the host setting names a host endpoint of its own",
"gives an add-on that the host setting does not name no host endpoint",
"closes the host endpoint when the incarnation ends",
"an HTTP 400 answer",
"an HTTP 422 answer",
"keeps a bounded, printable reason and nothing else of the body",
"leaves 503, 500 and 404 as outages",
"types a withdrawn client, a full slot table, a bad envelope and a missing schema as not sent",
"keeps a not-sent error an ErrRuntime for callers that do not tell them apart",
"types a refused connection as not sent",
"never types a possibly-sent request as not sent"
],
"report": ".cache/addons/logs/runtime.json"
},
"gateway": {
"kind": "ginkgo",
"commands": [
[
"go",
"test",
"-count=1",
"-p",
"2",
"-tags",
"auth",
"./core/services/addons/gateway",
"-ginkgo.json-report=../../../../.cache/addons/logs/gateway.json"
],
[
"go",
"test",
"-count=1",
"-p",
"2",
"-tags",
"auth",
"./core/http/endpoints/addons",
"-ginkgo.json-report=../../../../.cache/addons/logs/gateway-http.json"
]
],
"cases": [
"serves only declared installed generation assets and rejects traversal",
"fails closed without current identity or resource policy and reports the original ID of an unknown mutation outcome",
"reports an unclassified account check error as unavailable on every path and a wrapped denial as forbidden",
"propagates interrupted progress cancellation through the receiving frontend",
"validates finite relay budgets and prevents disabling polling bounds",
"builds a carrier only from complete pinned identities",
"types an unknown mutation outcome as unavailable without losing its operation",
"rejects untrusted peers wrong audience body expiry replay and revoked credentials",
"alternates pinned frontends and rejects untrusted certificates without local fallback",
"reports the original operation after lost mutation replies without retrying",
"rejects a stream longer than its receiving frontend budget",
"rejects a CA signed peer without a pin on the owner side",
"refuses an owner whose CA signed certificate is not the pinned owner",
"returns the artifact status through the owner from every frontend with one denial for the rest",
"types the owner's refusal and outage of a lookup the same from every frontend",
"writes an attachment header that cannot be broken out of",
"rotates the enforced audience on restart and rejects captured requests",
"never expires the response deadline after the relay returned",
"returns the owner's forbidden status for an invalid kind and for missing policy",
"still reports unavailable when the owner is unable to serve and not forbidden",
"reaches the same decision through both frontends and delivers bytes when allowed",
"keeps aborting when revocation happens after bytes were written",
"bounds progress, asset and file relays by their own limit",
"alternates real owner journal status and terminates coarse progress without submitting again",
"reports an account store outage as unavailable and a refused account as forbidden",
"rejects unknown lifecycle argument fields before touching the owner journal",
"reports a runtime that cannot serve as unavailable through both frontends",
"reports an output that ends before its first byte as unavailable",
"fails closed as unavailable for an unclassified owner error",
"keeps authorization and policy denials forbidden",
"keeps a mutation unknown when the runtime fails after the owner applied it",
"keeps a mutation unknown when the owner reports recovery required for its operation",
"reports a mutation as unknown when the owner cannot serve it at all",
"keeps a mutation unknown on the owner's own frontend and leaves reads and denials alone",
"lets unavailability win when an error wraps both a denial and an unavailable cause",
"does not leak attachment headers into an error when the first read fails",
"treats every action except the known reads as a mutation",
"keeps resolved resources under admission for JSON and attachment bytes",
"closes interrupted output and releases admission on disconnect",
"rechecks revoked credentials during attachment copying",
"adopts read outputs as private artifacts inside admission and replaces a forged resource identity",
"refuses at ingest a file result larger than the relay file bound so nothing unservable is staged",
"denies private relays without host resolution and admission",
"serves declared assets of the current enabled generation by package digest only",
"allows only an exact declared tool name and fails closed otherwise",
"never contacts the add-on for an undeclared tool and still serves a declared one",
"denies a repeated key at any depth however it is spelled",
"denies arguments that are not exactly one object",
"separates a denial from an unavailable declaration source",
"answers 503 and never contacts the add-on when the source is unavailable or the arguments repeat a key",
"is the typed invalid request on the owner for a read, never an outage",
"is the typed invalid request on the owner for a proposal call",
"is the typed invalid request on the owner for a json relay",
"is the same typed answer from a forwarding frontend",
"stores a proposal from an API key and lets only the proposer's browser session confirm it",
"cancels a proposal from the same chain and never lets typed dispatch or relay confirm",
"denies sharing and deletion proposals and an unauthenticated caller",
"serves the local owner's confirmation only from a same-origin fetch of the host page",
"reports a lost reply with the original operation from forwarding frontends and resolves it by receipt",
"lets only the resource owner's browser session abandon an unresolved outcome and then accepts writes",
"lets the owner role list an editor's unresolved proposal and abandon it by the listed digest from every frontend",
"tells an editor of a blocked write only that it is denied",
"returns the applied proposal when the confirmed operation committed",
"answers an owner outage by the owner's state with the same type from every frontend",
"keeps a proposal confirmable by the same ID after the owner could not reach the addon",
"documents the proposal routes and the proposal schema in the Swagger spec",
"serves one owner journal through two real authenticated HTTP frontends and rejects paused keys",
"serves the synthetic owner through the real chain, denies sharing and rejects named callers",
"checks browser CSRF feature and admin access with real stored keys",
"serves a private file result as a safe attachment over real HTTP",
"never renders hostile names or active media types inline",
"answers one 403 for unknown, foreign, incomplete and expired artifacts and requires the feature and a principal",
"denies the download of a disabled addon and serves it again after enable",
"relays the same bytes, headers and denials through two forwarding frontends",
"keeps a file result of a read denied whole without an artifact store",
"serves the local owner's file only in local-owner mode",
"documents the artifact routes and the artifact schema in the Swagger spec",
"rejects anonymous callers and forged forwarding headers",
"gates the feature and then administration for named keys",
"requires same-origin browser requests for cookie mutations",
"registers only the dispatch, relay and proposal mutations",
"reserves every first path segment the host registers under /api/addons",
"gates the artifact routes by authentication and feature",
"gates the proposal routes by feature and refuses a confirmation from a key before the owner is asked",
"rejects anonymous and forged forwarding authority through real authentication",
"lets callers through only when the deployment selected local-owner mode",
"keeps authentication, the feature gate and administration when accounts exist",
"reports an unknown mutation outcome from a forwarding frontend with the original operation",
"documents every field the error responses emit in the Swagger schema",
"reports an unavailable read as plain unavailability",
"reports a denial as forbidden",
"reports an unclassified account check error as unavailable and a definite denial as forbidden",
"reports an unknown mutation outcome from the owner's own frontend with the original operation",
"lists the enabled installed apps for a reader and the disabled ones too for administrators, the same from every frontend",
"lets only administrators start and stop, through the lifecycle manager, and denies a stale generation",
"serves the verified icon through the host route and denies it identically otherwise",
"reports a lost start as an unknown outcome with its original operation and a lost list as unavailable",
"documents the apps routes and every field of the app view in the Swagger spec",
"lists every registered addon route in the feature registry",
"gates the apps routes by authentication, feature and administration",
"serves catalog search, details and the installed management view to administrators only, the same from every frontend",
"refuses every management call of the owner itself for a caller that is not an administrator",
"saves, refreshes and removes a library by reference and leaves installed addons alone",
"upgrades an installed addon through the typed action and keeps its earlier generation",
"reports a lost source change as an unknown outcome and a lost read as unavailable",
"documents the management actions and every emitted field of the installed view",
"serves the declared files of the current package through every frontend with immutable headers",
"lists the same URLs the route serves, and only for an enabled addon",
"denies every other path, digest, addon and credential form with one answer and no immutable caching",
"accepts a same-origin browser session and refuses a cross-site or direct one",
"withdraws the code the moment the addon is disabled, uninstalled or replaced, even for a page that is still open",
"refuses a declared file that is not a regular file of the package",
"documents the asset route and its binary response in the Swagger spec",
"gives the same 403 on the owner and on a forwarding frontend and never contacts the add-on",
"lists the caller's own pending proposals the same from the owner and every forwarding frontend",
"gives every caller with the feature the same status from every frontend, redacted for non-administrators",
"checks only for an administrator's own browser session, and applies nothing",
"upgrades only to the checked candidate, with the same typed refusals from every frontend, and never twice",
"runs two concurrent upgrades from two frontends once: the same ID shares the answer, another ID is a conflict",
"refuses an incompatible candidate and a library that cannot be read, with a typed answer",
"reports a lost upgrade as an unknown outcome with its original operation, and a lost status read or check as plainly unavailable",
"keeps the update actions out of the tools and names every field of the status in the Swagger spec",
"answers an add-on's invalid-request refusal as a typed 400 from the owner and from a forwarding frontend"
],
"report": ".cache/addons/logs/gateway.json",
"reports": [
{
"path": ".cache/addons/logs/gateway.json",
"cases": [
"serves only declared installed generation assets and rejects traversal",
"fails closed without current identity or resource policy and reports the original ID of an unknown mutation outcome",
"reports an unclassified account check error as unavailable on every path and a wrapped denial as forbidden",
"propagates interrupted progress cancellation through the receiving frontend",
"validates finite relay budgets and prevents disabling polling bounds",
"builds a carrier only from complete pinned identities",
"types an unknown mutation outcome as unavailable without losing its operation",
"rejects untrusted peers wrong audience body expiry replay and revoked credentials",
"alternates pinned frontends and rejects untrusted certificates without local fallback",
"reports the original operation after lost mutation replies without retrying",
"rejects a stream longer than its receiving frontend budget",
"rejects a CA signed peer without a pin on the owner side",
"refuses an owner whose CA signed certificate is not the pinned owner",
"returns the artifact status through the owner from every frontend with one denial for the rest",
"types the owner's refusal and outage of a lookup the same from every frontend",
"writes an attachment header that cannot be broken out of",
"rotates the enforced audience on restart and rejects captured requests",
"never expires the response deadline after the relay returned",
"returns the owner's forbidden status for an invalid kind and for missing policy",
"still reports unavailable when the owner is unable to serve and not forbidden",
"reaches the same decision through both frontends and delivers bytes when allowed",
"keeps aborting when revocation happens after bytes were written",
"bounds progress, asset and file relays by their own limit",
"alternates real owner journal status and terminates coarse progress without submitting again",
"reports an account store outage as unavailable and a refused account as forbidden",
"rejects unknown lifecycle argument fields before touching the owner journal",
"reports a runtime that cannot serve as unavailable through both frontends",
"reports an output that ends before its first byte as unavailable",
"fails closed as unavailable for an unclassified owner error",
"keeps authorization and policy denials forbidden",
"keeps a mutation unknown when the runtime fails after the owner applied it",
"keeps a mutation unknown when the owner reports recovery required for its operation",
"reports a mutation as unknown when the owner cannot serve it at all",
"keeps a mutation unknown on the owner's own frontend and leaves reads and denials alone",
"lets unavailability win when an error wraps both a denial and an unavailable cause",
"does not leak attachment headers into an error when the first read fails",
"treats every action except the known reads as a mutation",
"keeps resolved resources under admission for JSON and attachment bytes",
"closes interrupted output and releases admission on disconnect",
"rechecks revoked credentials during attachment copying",
"adopts read outputs as private artifacts inside admission and replaces a forged resource identity",
"refuses at ingest a file result larger than the relay file bound so nothing unservable is staged",
"denies private relays without host resolution and admission",
"serves declared assets of the current enabled generation by package digest only",
"allows only an exact declared tool name and fails closed otherwise",
"never contacts the add-on for an undeclared tool and still serves a declared one",
"denies a repeated key at any depth however it is spelled",
"denies arguments that are not exactly one object",
"separates a denial from an unavailable declaration source",
"answers 503 and never contacts the add-on when the source is unavailable or the arguments repeat a key",
"is the typed invalid request on the owner for a read, never an outage",
"is the typed invalid request on the owner for a proposal call",
"is the typed invalid request on the owner for a json relay",
"is the same typed answer from a forwarding frontend"
]
},
{
"path": ".cache/addons/logs/gateway-http.json",
"cases": [
"stores a proposal from an API key and lets only the proposer's browser session confirm it",
"cancels a proposal from the same chain and never lets typed dispatch or relay confirm",
"denies sharing and deletion proposals and an unauthenticated caller",
"serves the local owner's confirmation only from a same-origin fetch of the host page",
"reports a lost reply with the original operation from forwarding frontends and resolves it by receipt",
"lets only the resource owner's browser session abandon an unresolved outcome and then accepts writes",
"lets the owner role list an editor's unresolved proposal and abandon it by the listed digest from every frontend",
"tells an editor of a blocked write only that it is denied",
"returns the applied proposal when the confirmed operation committed",
"answers an owner outage by the owner's state with the same type from every frontend",
"keeps a proposal confirmable by the same ID after the owner could not reach the addon",
"documents the proposal routes and the proposal schema in the Swagger spec",
"serves one owner journal through two real authenticated HTTP frontends and rejects paused keys",
"serves the synthetic owner through the real chain, denies sharing and rejects named callers",
"checks browser CSRF feature and admin access with real stored keys",
"serves a private file result as a safe attachment over real HTTP",
"never renders hostile names or active media types inline",
"answers one 403 for unknown, foreign, incomplete and expired artifacts and requires the feature and a principal",
"denies the download of a disabled addon and serves it again after enable",
"relays the same bytes, headers and denials through two forwarding frontends",
"keeps a file result of a read denied whole without an artifact store",
"serves the local owner's file only in local-owner mode",
"documents the artifact routes and the artifact schema in the Swagger spec",
"rejects anonymous callers and forged forwarding headers",
"gates the feature and then administration for named keys",
"requires same-origin browser requests for cookie mutations",
"registers only the dispatch, relay and proposal mutations",
"reserves every first path segment the host registers under /api/addons",
"gates the artifact routes by authentication and feature",
"gates the proposal routes by feature and refuses a confirmation from a key before the owner is asked",
"rejects anonymous and forged forwarding authority through real authentication",
"lets callers through only when the deployment selected local-owner mode",
"keeps authentication, the feature gate and administration when accounts exist",
"reports an unknown mutation outcome from a forwarding frontend with the original operation",
"documents every field the error responses emit in the Swagger schema",
"reports an unavailable read as plain unavailability",
"reports a denial as forbidden",
"reports an unclassified account check error as unavailable and a definite denial as forbidden",
"reports an unknown mutation outcome from the owner's own frontend with the original operation",
"lists the enabled installed apps for a reader and the disabled ones too for administrators, the same from every frontend",
"lets only administrators start and stop, through the lifecycle manager, and denies a stale generation",
"serves the verified icon through the host route and denies it identically otherwise",
"reports a lost start as an unknown outcome with its original operation and a lost list as unavailable",
"documents the apps routes and every field of the app view in the Swagger spec",
"lists every registered addon route in the feature registry",
"gates the apps routes by authentication, feature and administration",
"serves catalog search, details and the installed management view to administrators only, the same from every frontend",
"refuses every management call of the owner itself for a caller that is not an administrator",
"saves, refreshes and removes a library by reference and leaves installed addons alone",
"upgrades an installed addon through the typed action and keeps its earlier generation",
"reports a lost source change as an unknown outcome and a lost read as unavailable",
"documents the management actions and every emitted field of the installed view",
"serves the declared files of the current package through every frontend with immutable headers",
"lists the same URLs the route serves, and only for an enabled addon",
"denies every other path, digest, addon and credential form with one answer and no immutable caching",
"accepts a same-origin browser session and refuses a cross-site or direct one",
"withdraws the code the moment the addon is disabled, uninstalled or replaced, even for a page that is still open",
"refuses a declared file that is not a regular file of the package",
"documents the asset route and its binary response in the Swagger spec",
"gives the same 403 on the owner and on a forwarding frontend and never contacts the add-on",
"lists the caller's own pending proposals the same from the owner and every forwarding frontend",
"gives every caller with the feature the same status from every frontend, redacted for non-administrators",
"checks only for an administrator's own browser session, and applies nothing",
"upgrades only to the checked candidate, with the same typed refusals from every frontend, and never twice",
"runs two concurrent upgrades from two frontends once: the same ID shares the answer, another ID is a conflict",
"refuses an incompatible candidate and a library that cannot be read, with a typed answer",
"reports a lost upgrade as an unknown outcome with its original operation, and a lost status read or check as plainly unavailable",
"keeps the update actions out of the tools and names every field of the status in the Swagger spec",
"answers an add-on's invalid-request refusal as a typed 400 from the owner and from a forwarding frontend",
"returns the SDK refusal text to the administrator and the generic message for an unrelated failure",
"returns the same text through a forwarding frontend"
]
}
]
},
"policy": {
"kind": "ginkgo",
"commands": [
[
"go",
"test",
"-count=1",
"-p",
"2",
"-tags",
"auth",
"./core/services/addons/policy",
"-ginkgo.json-report=../../../../.cache/addons/logs/policy.json"
]
],
"cases": [
"enforces the viewer editor owner matrix on fixture resources",
"denies installation administrators and unrelated users any access to user data",
"does not leak resource existence and treats unknown actions as owner mutations",
"never grants the owner role or a grant to the owner and the synthetic principals",
"rejects anonymous and legacy synthetic principals in named mode",
"checks credential and account status on every admission",
"keeps no current-user state shared between concurrent admissions",
"disables sharing in explicit local-owner mode and lets every local caller own the resource",
"refuses a mode switch of populated data without a stopped backed-up migration",
"retains resources and grants across a restart and an uninstall of the package",
"refuses a corrupt store and a second opener",
"stops admitted work of a revoked user and acknowledges only after it ended",
"lets a racing revocation win against read and write admissions",
"serializes writes per resource while reads run concurrently",
"bounds the revocation wait and does not acknowledge a stuck drain",
"invalidates pending proposals on revoke and downgrade and fails closed when it cannot",
"requires explicit creation authority and keeps pending registrations inaccessible",
"reconciles a registration interrupted by a crash from the durable store",
"keeps a record whose existence cannot be established and settles the rest",
"never drops a committed resource and counts pending quota unchanged",
"retries kept records from the loop on a tick and on a kick, and stops on Close",
"closes a loop that never started without waiting",
"maps opaque ids to the trusted addon and owner and keeps an absent policy denying",
"does not acknowledge a retried downgrade while the lowered user's write still runs",
"retries a failed proposal invalidation after the lowered grant is already durable",
"keeps the drain owed across a restart",
"does not cancel work admitted under a later grant when a lowering is retried",
"still waits for and cancels work admitted before the lowering when the regrant is retried",
"stops work admitted after a regrant when the role is lowered again",
"keeps the epoch of the owed drain across a restart",
"keeps a drain mark that a concurrent lowering replaced while a retry was waiting",
"maps a store outage to unavailable and a disabled account to forbidden",
"caps pending and committed registrations per user and in total",
"applies finite defaults when no limit is configured",
"denies creation as unavailable when the authority cannot tell",
"reports an unclassified account or creation check error as unavailable and a definite denial as forbidden",
"does not start the work when revocation cancels the admission before run",
"rejects persisted unknown roles and trailing bytes without resetting the store",
"removes stale temporary files on open",
"stops accepting writes after a failed directory sync and keeps the applied change",
"retains resources and grants across a real manager uninstall and restart",
"stores a pending proposal with its exact effects and never executes it",
"applies exactly the stored arguments once and answers a repeat from the stored receipt",
"refuses changed arguments, other actors, unknown identifiers and an unbound digest",
"never lets an API key, plain text or a boolean approve",
"accepts the local owner as the confirming principal in local-owner mode only",
"expires a proposal and refuses a late or repeated confirmation",
"refuses a proposal made stale by a new generation or a moved revision",
"cancels a proposal for good and restricts who may propose which action",
"never accepts sharing, deletion, reads or unclassified actions as proposals",
"cancels pending proposals when authority is lowered and lets a revocation win the confirmation race",
"persists every transition atomically before it is reported",
"does not dispatch when the executing state cannot be made durable",
"keeps a lost reply unknown, blocks conflicting writes and resolves it by receipt without a replay",
"reports a lost reply from the owner's own gateway with the original operation",
"recovers a crash after dispatch by receipt and a crash before dispatch as unknown without replay",
"keeps pending proposals across a restart and never resets a corrupt store",
"bounds the pending proposals of one user and the store as a whole",
"records expiry and collects settled proposals without any read so a quiet clock cannot fill the store",
"records expiry durably when the owner starts and when it recovers",
"keeps settled proposals for the retention window only",
"keeps one user from starving others and never drops another user's live proposal",
"bounds the stored canonical arguments per user and in total with a typed quota error",
"looks an unresolved receipt up again with backoff for a finite window and never applies again",
"lets only the resource owner's browser session abandon an unresolved outcome and then unblocks writes",
"records a late receipt of an abandoned outcome instead of hiding it",
"settles by lookup instead of abandoning when the receipt is final",
"refuses a stored abandonment that names nobody and keeps looking up in the background",
"binds the digest to the operation, actor, resource, generation, action, arguments and revision",
"refuses a stored proposal whose operation, actor, resource, generation or arguments changed at rest",
"issues resource identifiers the envelope contract accepts",
"is unavailable until it is attached to a policy and a runtime",
"keeps executing, outcome-unknown and abandoned records far past retention and still dedupes them",
"waits for the background run and for lookups in flight before it closes, and writes nothing after",
"lets the owner role list the unresolved proposals of its resource and abandon one by the listed digest",
"names the blocking proposal in the denial only to the resource owner",
"refuses an unbound digest when the owner abandons through the gateway or the broker",
"answers the same typed outage for a resolution whoever proposed the operation",
"returns the applied proposal when the owner cannot read it back after a successful apply",
"does not show another user's blocking operation in a proposal view",
"denies a proposal for an undeclared tool before any preview and stores nothing",
"denies a proposal that names a tool when no tool source is installed",
"rechecks the stored tool at confirmation and never applies a withdrawn tool",
"denies a proposal whose arguments repeat a key and stores nothing",
"reports an unavailable declaration source as unavailable, never as a denial",
"does not apply at confirmation while the declaration source is unavailable, and applies once it recovers",
"reserves a create proposal as a pending resource that nobody can reach",
"commits the reservation on confirmation and makes the proposer the private owner",
"abandons the reservation when a create proposal is cancelled or expires",
"abandons the reservation when the addon rejects the creation",
"keeps a lost create reply pending and unknown and settles it by receipt",
"abandons an unknown create only when the addon confirms the backing is absent",
"settles reservations at restart by asking the addon and keeps those of live proposals",
"bounds concurrent create proposals by the pending quota",
"lets only the proposer confirm, cancel or read a create proposal",
"denies a create proposal when creation authority is revoked before confirmation",
"denies a create proposal for an undeclared tool or an existing resource without reserving",
"does not let reconcile drop the reservation of a creation in flight",
"commits the reservation at recovery when the crash came after the receipt was stored",
"never reads an add-on that cannot answer as a backing that is gone",
"accepts the explicit answer of the declared existence tool, true or false",
"holds the resources of one add-on and leaves another add-on alone",
"cancels admitted work and reports a drain that did not finish",
"restores grants through the account directory and the lowerings since the backup, never beyond them",
"keeps a bounded durable log of lowered access",
"keeps a revocation however many later lowerings of another person follow",
"restores the data but no access when the history may have lost a lowering",
"reads a store that is full of lowerings as one whose history may be cut",
"applies a lowering made after the export whatever time the backup is given",
"refuses a change that was authorized just before the hold began",
"cancels a pending proposal and leaves an executing one outcome-unknown after a restore",
"forgets the records of one add-on and no other",
"maps an owner on a restore to a local-owner store only when nothing named is in it",
"migrates the ownership of a stopped store with a backup and an explicit mapping and refuses a populated downgrade",
"refuses a proposal whose preview the add-on refused, storing nothing",
"settles a confirmation the add-on refused as rejected, never as an unknown outcome"
],
"report": ".cache/addons/logs/policy.json"
},
"proposals": {
"kind": "ginkgo",
"commands": [
[
"go",
"test",
"-count=1",
"-p",
"2",
"-tags",
"auth",
"./core/services/addons/policy",
"-ginkgo.json-report=../../../../.cache/addons/logs/proposals.json"
],
[
"go",
"test",
"-count=1",
"-p",
"2",
"-tags",
"auth",
"./core/http/endpoints/addons",
"-ginkgo.json-report=../../../../.cache/addons/logs/proposals-http.json"
]
],
"cases": [
"requires explicit creation authority and keeps pending registrations inaccessible",
"reconciles a registration interrupted by a crash from the durable store",
"keeps a record whose existence cannot be established and settles the rest",
"never drops a committed resource and counts pending quota unchanged",
"retries kept records from the loop on a tick and on a kick, and stops on Close",
"closes a loop that never started without waiting",
"stops admitted work of a revoked user and acknowledges only after it ended",
"lets a racing revocation win against read and write admissions",
"serializes writes per resource while reads run concurrently",
"bounds the revocation wait and does not acknowledge a stuck drain",
"invalidates pending proposals on revoke and downgrade and fails closed when it cannot",
"maps a store outage to unavailable and a disabled account to forbidden",
"maps opaque ids to the trusted addon and owner and keeps an absent policy denying",
"disables sharing in explicit local-owner mode and lets every local caller own the resource",
"refuses a mode switch of populated data without a stopped backed-up migration",
"retains resources and grants across a restart and an uninstall of the package",
"refuses a corrupt store and a second opener",
"caps pending and committed registrations per user and in total",
"applies finite defaults when no limit is configured",
"denies creation as unavailable when the authority cannot tell",
"does not acknowledge a retried downgrade while the lowered user's write still runs",
"retries a failed proposal invalidation after the lowered grant is already durable",
"keeps the drain owed across a restart",
"does not start the work when revocation cancels the admission before run",
"retains resources and grants across a real manager uninstall and restart",
"rejects persisted unknown roles and trailing bytes without resetting the store",
"removes stale temporary files on open",
"stops accepting writes after a failed directory sync and keeps the applied change",
"enforces the viewer editor owner matrix on fixture resources",
"denies installation administrators and unrelated users any access to user data",
"does not leak resource existence and treats unknown actions as owner mutations",
"never grants the owner role or a grant to the owner and the synthetic principals",
"does not cancel work admitted under a later grant when a lowering is retried",
"still waits for and cancels work admitted before the lowering when the regrant is retried",
"stops work admitted after a regrant when the role is lowered again",
"keeps the epoch of the owed drain across a restart",
"keeps a drain mark that a concurrent lowering replaced while a retry was waiting",
"reports an unclassified account or creation check error as unavailable and a definite denial as forbidden",
"rejects anonymous and legacy synthetic principals in named mode",
"checks credential and account status on every admission",
"keeps no current-user state shared between concurrent admissions",
"stores a pending proposal with its exact effects and never executes it",
"applies exactly the stored arguments once and answers a repeat from the stored receipt",
"refuses changed arguments, other actors, unknown identifiers and an unbound digest",
"never lets an API key, plain text or a boolean approve",
"accepts the local owner as the confirming principal in local-owner mode only",
"expires a proposal and refuses a late or repeated confirmation",
"refuses a proposal made stale by a new generation or a moved revision",
"cancels a proposal for good and restricts who may propose which action",
"never accepts sharing, deletion, reads or unclassified actions as proposals",
"cancels pending proposals when authority is lowered and lets a revocation win the confirmation race",
"persists every transition atomically before it is reported",
"does not dispatch when the executing state cannot be made durable",
"keeps a lost reply unknown, blocks conflicting writes and resolves it by receipt without a replay",
"reports a lost reply from the owner's own gateway with the original operation",
"recovers a crash after dispatch by receipt and a crash before dispatch as unknown without replay",
"keeps pending proposals across a restart and never resets a corrupt store",
"bounds the pending proposals of one user and the store as a whole",
"records expiry and collects settled proposals without any read so a quiet clock cannot fill the store",
"records expiry durably when the owner starts and when it recovers",
"keeps settled proposals for the retention window only",
"keeps one user from starving others and never drops another user's live proposal",
"bounds the stored canonical arguments per user and in total with a typed quota error",
"looks an unresolved receipt up again with backoff for a finite window and never applies again",
"lets only the resource owner's browser session abandon an unresolved outcome and then unblocks writes",
"records a late receipt of an abandoned outcome instead of hiding it",
"settles by lookup instead of abandoning when the receipt is final",
"refuses a stored abandonment that names nobody and keeps looking up in the background",
"binds the digest to the operation, actor, resource, generation, action, arguments and revision",
"refuses a stored proposal whose operation, actor, resource, generation or arguments changed at rest",
"issues resource identifiers the envelope contract accepts",
"is unavailable until it is attached to a policy and a runtime",
"keeps executing, outcome-unknown and abandoned records far past retention and still dedupes them",
"waits for the background run and for lookups in flight before it closes, and writes nothing after",
"lets the owner role list the unresolved proposals of its resource and abandon one by the listed digest",
"names the blocking proposal in the denial only to the resource owner",
"refuses an unbound digest when the owner abandons through the gateway or the broker",
"answers the same typed outage for a resolution whoever proposed the operation",
"returns the applied proposal when the owner cannot read it back after a successful apply",
"does not show another user's blocking operation in a proposal view",
"denies a proposal for an undeclared tool before any preview and stores nothing",
"denies a proposal that names a tool when no tool source is installed",
"rechecks the stored tool at confirmation and never applies a withdrawn tool",
"denies a proposal whose arguments repeat a key and stores nothing",
"reports an unavailable declaration source as unavailable, never as a denial",
"does not apply at confirmation while the declaration source is unavailable, and applies once it recovers",
"reserves a create proposal as a pending resource that nobody can reach",
"commits the reservation on confirmation and makes the proposer the private owner",
"abandons the reservation when a create proposal is cancelled or expires",
"abandons the reservation when the addon rejects the creation",
"keeps a lost create reply pending and unknown and settles it by receipt",
"abandons an unknown create only when the addon confirms the backing is absent",
"settles reservations at restart by asking the addon and keeps those of live proposals",
"bounds concurrent create proposals by the pending quota",
"lets only the proposer confirm, cancel or read a create proposal",
"denies a create proposal when creation authority is revoked before confirmation",
"denies a create proposal for an undeclared tool or an existing resource without reserving",
"does not let reconcile drop the reservation of a creation in flight",
"commits the reservation at recovery when the crash came after the receipt was stored",
"never reads an add-on that cannot answer as a backing that is gone",
"accepts the explicit answer of the declared existence tool, true or false",
"holds the resources of one add-on and leaves another add-on alone",
"cancels admitted work and reports a drain that did not finish",
"restores grants through the account directory and the lowerings since the backup, never beyond them",
"keeps a bounded durable log of lowered access",
"keeps a revocation however many later lowerings of another person follow",
"restores the data but no access when the history may have lost a lowering",
"reads a store that is full of lowerings as one whose history may be cut",
"applies a lowering made after the export whatever time the backup is given",
"refuses a change that was authorized just before the hold began",
"cancels a pending proposal and leaves an executing one outcome-unknown after a restore",
"forgets the records of one add-on and no other",
"maps an owner on a restore to a local-owner store only when nothing named is in it",
"migrates the ownership of a stopped store with a backup and an explicit mapping and refuses a populated downgrade",
"refuses a proposal whose preview the add-on refused, storing nothing",
"settles a confirmation the add-on refused as rejected, never as an unknown outcome",
"stores a proposal from an API key and lets only the proposer's browser session confirm it",
"cancels a proposal from the same chain and never lets typed dispatch or relay confirm",
"denies sharing and deletion proposals and an unauthenticated caller",
"serves the local owner's confirmation only from a same-origin fetch of the host page",
"reports a lost reply with the original operation from forwarding frontends and resolves it by receipt",
"lets only the resource owner's browser session abandon an unresolved outcome and then accepts writes",
"lets the owner role list an editor's unresolved proposal and abandon it by the listed digest from every frontend",
"tells an editor of a blocked write only that it is denied",
"returns the applied proposal when the confirmed operation committed",
"answers an owner outage by the owner's state with the same type from every frontend",
"keeps a proposal confirmable by the same ID after the owner could not reach the addon",
"documents the proposal routes and the proposal schema in the Swagger spec",
"serves one owner journal through two real authenticated HTTP frontends and rejects paused keys",
"serves the synthetic owner through the real chain, denies sharing and rejects named callers",
"checks browser CSRF feature and admin access with real stored keys",
"serves a private file result as a safe attachment over real HTTP",
"never renders hostile names or active media types inline",
"answers one 403 for unknown, foreign, incomplete and expired artifacts and requires the feature and a principal",
"denies the download of a disabled addon and serves it again after enable",
"relays the same bytes, headers and denials through two forwarding frontends",
"keeps a file result of a read denied whole without an artifact store",
"serves the local owner's file only in local-owner mode",
"documents the artifact routes and the artifact schema in the Swagger spec",
"rejects anonymous callers and forged forwarding headers",
"gates the feature and then administration for named keys",
"requires same-origin browser requests for cookie mutations",
"registers only the dispatch, relay and proposal mutations",
"reserves every first path segment the host registers under /api/addons",
"gates the artifact routes by authentication and feature",
"gates the proposal routes by feature and refuses a confirmation from a key before the owner is asked",
"rejects anonymous and forged forwarding authority through real authentication",
"lets callers through only when the deployment selected local-owner mode",
"keeps authentication, the feature gate and administration when accounts exist",
"reports an unknown mutation outcome from a forwarding frontend with the original operation",
"documents every field the error responses emit in the Swagger schema",
"reports an unavailable read as plain unavailability",
"reports a denial as forbidden",
"reports an unclassified account check error as unavailable and a definite denial as forbidden",
"reports an unknown mutation outcome from the owner's own frontend with the original operation",
"lists the enabled installed apps for a reader and the disabled ones too for administrators, the same from every frontend",
"lets only administrators start and stop, through the lifecycle manager, and denies a stale generation",
"serves the verified icon through the host route and denies it identically otherwise",
"reports a lost start as an unknown outcome with its original operation and a lost list as unavailable",
"documents the apps routes and every field of the app view in the Swagger spec",
"lists every registered addon route in the feature registry",
"gates the apps routes by authentication, feature and administration",
"serves catalog search, details and the installed management view to administrators only, the same from every frontend",
"refuses every management call of the owner itself for a caller that is not an administrator",
"saves, refreshes and removes a library by reference and leaves installed addons alone",
"upgrades an installed addon through the typed action and keeps its earlier generation",
"reports a lost source change as an unknown outcome and a lost read as unavailable",
"documents the management actions and every emitted field of the installed view",
"serves the declared files of the current package through every frontend with immutable headers",
"lists the same URLs the route serves, and only for an enabled addon",
"denies every other path, digest, addon and credential form with one answer and no immutable caching",
"accepts a same-origin browser session and refuses a cross-site or direct one",
"withdraws the code the moment the addon is disabled, uninstalled or replaced, even for a page that is still open",
"refuses a declared file that is not a regular file of the package",
"documents the asset route and its binary response in the Swagger spec",
"gives the same 403 on the owner and on a forwarding frontend and never contacts the add-on",
"lists the caller's own pending proposals the same from the owner and every forwarding frontend",
"gives every caller with the feature the same status from every frontend, redacted for non-administrators",
"checks only for an administrator's own browser session, and applies nothing",
"upgrades only to the checked candidate, with the same typed refusals from every frontend, and never twice",
"runs two concurrent upgrades from two frontends once: the same ID shares the answer, another ID is a conflict",
"refuses an incompatible candidate and a library that cannot be read, with a typed answer",
"reports a lost upgrade as an unknown outcome with its original operation, and a lost status read or check as plainly unavailable",
"keeps the update actions out of the tools and names every field of the status in the Swagger spec",
"answers an add-on's invalid-request refusal as a typed 400 from the owner and from a forwarding frontend"
],
"report": ".cache/addons/logs/proposals.json",
"reports": [
{
"path": ".cache/addons/logs/proposals.json",
"cases": [
"requires explicit creation authority and keeps pending registrations inaccessible",
"reconciles a registration interrupted by a crash from the durable store",
"keeps a record whose existence cannot be established and settles the rest",
"never drops a committed resource and counts pending quota unchanged",
"retries kept records from the loop on a tick and on a kick, and stops on Close",
"closes a loop that never started without waiting",
"stops admitted work of a revoked user and acknowledges only after it ended",
"lets a racing revocation win against read and write admissions",
"serializes writes per resource while reads run concurrently",
"bounds the revocation wait and does not acknowledge a stuck drain",
"invalidates pending proposals on revoke and downgrade and fails closed when it cannot",
"maps a store outage to unavailable and a disabled account to forbidden",
"maps opaque ids to the trusted addon and owner and keeps an absent policy denying",
"disables sharing in explicit local-owner mode and lets every local caller own the resource",
"refuses a mode switch of populated data without a stopped backed-up migration",
"retains resources and grants across a restart and an uninstall of the package",
"refuses a corrupt store and a second opener",
"caps pending and committed registrations per user and in total",
"applies finite defaults when no limit is configured",
"denies creation as unavailable when the authority cannot tell",
"does not acknowledge a retried downgrade while the lowered user's write still runs",
"retries a failed proposal invalidation after the lowered grant is already durable",
"keeps the drain owed across a restart",
"does not start the work when revocation cancels the admission before run",
"retains resources and grants across a real manager uninstall and restart",
"rejects persisted unknown roles and trailing bytes without resetting the store",
"removes stale temporary files on open",
"stops accepting writes after a failed directory sync and keeps the applied change",
"enforces the viewer editor owner matrix on fixture resources",
"denies installation administrators and unrelated users any access to user data",
"does not leak resource existence and treats unknown actions as owner mutations",
"never grants the owner role or a grant to the owner and the synthetic principals",
"does not cancel work admitted under a later grant when a lowering is retried",
"still waits for and cancels work admitted before the lowering when the regrant is retried",
"stops work admitted after a regrant when the role is lowered again",
"keeps the epoch of the owed drain across a restart",
"keeps a drain mark that a concurrent lowering replaced while a retry was waiting",
"reports an unclassified account or creation check error as unavailable and a definite denial as forbidden",
"rejects anonymous and legacy synthetic principals in named mode",
"checks credential and account status on every admission",
"keeps no current-user state shared between concurrent admissions",
"stores a pending proposal with its exact effects and never executes it",
"applies exactly the stored arguments once and answers a repeat from the stored receipt",
"refuses changed arguments, other actors, unknown identifiers and an unbound digest",
"never lets an API key, plain text or a boolean approve",
"accepts the local owner as the confirming principal in local-owner mode only",
"expires a proposal and refuses a late or repeated confirmation",
"refuses a proposal made stale by a new generation or a moved revision",
"cancels a proposal for good and restricts who may propose which action",
"never accepts sharing, deletion, reads or unclassified actions as proposals",
"cancels pending proposals when authority is lowered and lets a revocation win the confirmation race",
"persists every transition atomically before it is reported",
"does not dispatch when the executing state cannot be made durable",
"keeps a lost reply unknown, blocks conflicting writes and resolves it by receipt without a replay",
"reports a lost reply from the owner's own gateway with the original operation",
"recovers a crash after dispatch by receipt and a crash before dispatch as unknown without replay",
"keeps pending proposals across a restart and never resets a corrupt store",
"bounds the pending proposals of one user and the store as a whole",
"records expiry and collects settled proposals without any read so a quiet clock cannot fill the store",
"records expiry durably when the owner starts and when it recovers",
"keeps settled proposals for the retention window only",
"keeps one user from starving others and never drops another user's live proposal",
"bounds the stored canonical arguments per user and in total with a typed quota error",
"looks an unresolved receipt up again with backoff for a finite window and never applies again",
"lets only the resource owner's browser session abandon an unresolved outcome and then unblocks writes",
"records a late receipt of an abandoned outcome instead of hiding it",
"settles by lookup instead of abandoning when the receipt is final",
"refuses a stored abandonment that names nobody and keeps looking up in the background",
"binds the digest to the operation, actor, resource, generation, action, arguments and revision",
"refuses a stored proposal whose operation, actor, resource, generation or arguments changed at rest",
"issues resource identifiers the envelope contract accepts",
"is unavailable until it is attached to a policy and a runtime",
"keeps executing, outcome-unknown and abandoned records far past retention and still dedupes them",
"waits for the background run and for lookups in flight before it closes, and writes nothing after",
"lets the owner role list the unresolved proposals of its resource and abandon one by the listed digest",
"names the blocking proposal in the denial only to the resource owner",
"refuses an unbound digest when the owner abandons through the gateway or the broker",
"answers the same typed outage for a resolution whoever proposed the operation",
"returns the applied proposal when the owner cannot read it back after a successful apply",
"does not show another user's blocking operation in a proposal view",
"denies a proposal for an undeclared tool before any preview and stores nothing",
"denies a proposal that names a tool when no tool source is installed",
"rechecks the stored tool at confirmation and never applies a withdrawn tool",
"denies a proposal whose arguments repeat a key and stores nothing",
"reports an unavailable declaration source as unavailable, never as a denial",
"does not apply at confirmation while the declaration source is unavailable, and applies once it recovers",
"reserves a create proposal as a pending resource that nobody can reach",
"commits the reservation on confirmation and makes the proposer the private owner",
"abandons the reservation when a create proposal is cancelled or expires",
"abandons the reservation when the addon rejects the creation",
"keeps a lost create reply pending and unknown and settles it by receipt",
"abandons an unknown create only when the addon confirms the backing is absent",
"settles reservations at restart by asking the addon and keeps those of live proposals",
"bounds concurrent create proposals by the pending quota",
"lets only the proposer confirm, cancel or read a create proposal",
"denies a create proposal when creation authority is revoked before confirmation",
"denies a create proposal for an undeclared tool or an existing resource without reserving",
"does not let reconcile drop the reservation of a creation in flight",
"commits the reservation at recovery when the crash came after the receipt was stored",
"never reads an add-on that cannot answer as a backing that is gone",
"accepts the explicit answer of the declared existence tool, true or false",
"holds the resources of one add-on and leaves another add-on alone",
"cancels admitted work and reports a drain that did not finish",
"restores grants through the account directory and the lowerings since the backup, never beyond them",
"keeps a bounded durable log of lowered access",
"keeps a revocation however many later lowerings of another person follow",
"restores the data but no access when the history may have lost a lowering",
"reads a store that is full of lowerings as one whose history may be cut",
"applies a lowering made after the export whatever time the backup is given",
"refuses a change that was authorized just before the hold began",
"cancels a pending proposal and leaves an executing one outcome-unknown after a restore",
"forgets the records of one add-on and no other",
"maps an owner on a restore to a local-owner store only when nothing named is in it",
"migrates the ownership of a stopped store with a backup and an explicit mapping and refuses a populated downgrade",
"refuses a proposal whose preview the add-on refused, storing nothing",
"settles a confirmation the add-on refused as rejected, never as an unknown outcome"
]
},
{
"path": ".cache/addons/logs/proposals-http.json",
"cases": [
"stores a proposal from an API key and lets only the proposer's browser session confirm it",
"cancels a proposal from the same chain and never lets typed dispatch or relay confirm",
"denies sharing and deletion proposals and an unauthenticated caller",
"serves the local owner's confirmation only from a same-origin fetch of the host page",
"reports a lost reply with the original operation from forwarding frontends and resolves it by receipt",
"lets only the resource owner's browser session abandon an unresolved outcome and then accepts writes",
"lets the owner role list an editor's unresolved proposal and abandon it by the listed digest from every frontend",
"tells an editor of a blocked write only that it is denied",
"returns the applied proposal when the confirmed operation committed",
"answers an owner outage by the owner's state with the same type from every frontend",
"keeps a proposal confirmable by the same ID after the owner could not reach the addon",
"documents the proposal routes and the proposal schema in the Swagger spec",
"serves one owner journal through two real authenticated HTTP frontends and rejects paused keys",
"serves the synthetic owner through the real chain, denies sharing and rejects named callers",
"checks browser CSRF feature and admin access with real stored keys",
"serves a private file result as a safe attachment over real HTTP",
"never renders hostile names or active media types inline",
"answers one 403 for unknown, foreign, incomplete and expired artifacts and requires the feature and a principal",
"denies the download of a disabled addon and serves it again after enable",
"relays the same bytes, headers and denials through two forwarding frontends",
"keeps a file result of a read denied whole without an artifact store",
"serves the local owner's file only in local-owner mode",
"documents the artifact routes and the artifact schema in the Swagger spec",
"rejects anonymous callers and forged forwarding headers",
"gates the feature and then administration for named keys",
"requires same-origin browser requests for cookie mutations",
"registers only the dispatch, relay and proposal mutations",
"reserves every first path segment the host registers under /api/addons",
"gates the artifact routes by authentication and feature",
"gates the proposal routes by feature and refuses a confirmation from a key before the owner is asked",
"rejects anonymous and forged forwarding authority through real authentication",
"lets callers through only when the deployment selected local-owner mode",
"keeps authentication, the feature gate and administration when accounts exist",
"reports an unknown mutation outcome from a forwarding frontend with the original operation",
"documents every field the error responses emit in the Swagger schema",
"reports an unavailable read as plain unavailability",
"reports a denial as forbidden",
"reports an unclassified account check error as unavailable and a definite denial as forbidden",
"reports an unknown mutation outcome from the owner's own frontend with the original operation",
"lists the enabled installed apps for a reader and the disabled ones too for administrators, the same from every frontend",
"lets only administrators start and stop, through the lifecycle manager, and denies a stale generation",
"serves the verified icon through the host route and denies it identically otherwise",
"reports a lost start as an unknown outcome with its original operation and a lost list as unavailable",
"documents the apps routes and every field of the app view in the Swagger spec",
"lists every registered addon route in the feature registry",
"gates the apps routes by authentication, feature and administration",
"serves catalog search, details and the installed management view to administrators only, the same from every frontend",
"refuses every management call of the owner itself for a caller that is not an administrator",
"saves, refreshes and removes a library by reference and leaves installed addons alone",
"upgrades an installed addon through the typed action and keeps its earlier generation",
"reports a lost source change as an unknown outcome and a lost read as unavailable",
"documents the management actions and every emitted field of the installed view",
"serves the declared files of the current package through every frontend with immutable headers",
"lists the same URLs the route serves, and only for an enabled addon",
"denies every other path, digest, addon and credential form with one answer and no immutable caching",
"accepts a same-origin browser session and refuses a cross-site or direct one",
"withdraws the code the moment the addon is disabled, uninstalled or replaced, even for a page that is still open",
"refuses a declared file that is not a regular file of the package",
"documents the asset route and its binary response in the Swagger spec",
"gives the same 403 on the owner and on a forwarding frontend and never contacts the add-on",
"lists the caller's own pending proposals the same from the owner and every forwarding frontend",
"gives every caller with the feature the same status from every frontend, redacted for non-administrators",
"checks only for an administrator's own browser session, and applies nothing",
"upgrades only to the checked candidate, with the same typed refusals from every frontend, and never twice",
"runs two concurrent upgrades from two frontends once: the same ID shares the answer, another ID is a conflict",
"refuses an incompatible candidate and a library that cannot be read, with a typed answer",
"reports a lost upgrade as an unknown outcome with its original operation, and a lost status read or check as plainly unavailable",
"keeps the update actions out of the tools and names every field of the status in the Swagger spec",
"answers an add-on's invalid-request refusal as a typed 400 from the owner and from a forwarding frontend",
"returns the SDK refusal text to the administrator and the generic message for an unrelated failure",
"returns the same text through a forwarding frontend"
]
}
]
},
"artifacts": {
"kind": "ginkgo",
"commands": [
[
"go",
"test",
"-count=1",
"-p",
"2",
"-tags",
"auth",
"./core/services/addons/artifacts",
"-ginkgo.json-report=../../../../.cache/addons/logs/artifacts.json"
],
[
"go",
"test",
"-count=1",
"-p",
"2",
"-tags",
"auth",
"./core/services/addons/gateway",
"-ginkgo.json-report=../../../../.cache/addons/logs/artifacts-gateway.json"
],
[
"go",
"test",
"-count=1",
"-p",
"2",
"-tags",
"auth",
"./core/http/endpoints/addons",
"-ginkgo.json-report=../../../../.cache/addons/logs/artifacts-http.json"
]
],
"cases": [
"adopts every output of a result or none, and shows the owner only its own status",
"sanitizes attachment names and maps media types to a fixed allowlist",
"applies finite default limits and rejects partial or unbounded overrides",
"keeps staged bytes behind the object store boundary and publishes only complete writes",
"never serves an artifact at or after expiry, including during admission and mid-stream",
"fails a transfer that outlives its artifact",
"fails a transfer whose source is revoked before completion and denies a revoked download",
"stops a download stream when the source is revoked mid-stream",
"requires read access to every source resource at completion and download",
"denies a disabled or unavailable account at ingestion and download",
"denies downloads of a disabled addon, keeps the bytes and serves again only while unexpired with current permissions",
"denies downloads after uninstall and removes the bytes at the next sweep",
"sweeps expired artifacts, abandoned partials and orphan files without touching live transfers",
"enforces per-user, total and size limits atomically under concurrent ingestion",
"bounds concurrent transfers and concurrent downloads",
"cancels a transfer by its context or by its owner and removes the partial bytes",
"returns the same artifact for a repeated request without a second transfer",
"keeps addon handles operation-bound and out of metadata and views",
"keeps complete artifacts across a restart and settles interrupted transfers",
"keeps the bytes of a transfer that completes while a sweep is running",
"never loses the bytes of a complete artifact when sweeps race with several completing transfers",
"answers a transient storage error as unavailable and keeps the bytes and the record",
"marks an artifact corrupt only for missing bytes or a size mismatch",
"answers a download that races with an expiry or a drop like any expired identifier",
"refuses a corrupt metadata store and stops writing after a failed sync",
"waits for background transfers before Close returns and writes nothing after",
"ingests a file result into a private staged artifact with a host-generated identifier",
"never uses an addon handle, URL or path as an identifier or a file path",
"answers one denial for an unknown identifier and for another principal's artifact",
"never serves incomplete, short, long or failed transfers and removes their partial bytes",
"streams ingestion and download without buffering the whole file",
"rejects an output declared larger than one artifact may be before reading it",
"never opens an output for a request that names a tool no source declares",
"denies an output request whose arguments repeat a key and never opens the output",
"reports an unavailable declaration source as unavailable and never opens the output",
"shortens the lifetime and keeps the bounds consistent, and zero keeps the defaults",
"fails the artifact with a fixed reason that says it was refused, not that the add-on is down",
"serves only declared installed generation assets and rejects traversal",
"fails closed without current identity or resource policy and reports the original ID of an unknown mutation outcome",
"reports an unclassified account check error as unavailable on every path and a wrapped denial as forbidden",
"propagates interrupted progress cancellation through the receiving frontend",
"validates finite relay budgets and prevents disabling polling bounds",
"builds a carrier only from complete pinned identities",
"types an unknown mutation outcome as unavailable without losing its operation",
"rejects untrusted peers wrong audience body expiry replay and revoked credentials",
"alternates pinned frontends and rejects untrusted certificates without local fallback",
"reports the original operation after lost mutation replies without retrying",
"rejects a stream longer than its receiving frontend budget",
"rejects a CA signed peer without a pin on the owner side",
"refuses an owner whose CA signed certificate is not the pinned owner",
"returns the artifact status through the owner from every frontend with one denial for the rest",
"types the owner's refusal and outage of a lookup the same from every frontend",
"writes an attachment header that cannot be broken out of",
"rotates the enforced audience on restart and rejects captured requests",
"never expires the response deadline after the relay returned",
"returns the owner's forbidden status for an invalid kind and for missing policy",
"still reports unavailable when the owner is unable to serve and not forbidden",
"reaches the same decision through both frontends and delivers bytes when allowed",
"keeps aborting when revocation happens after bytes were written",
"bounds progress, asset and file relays by their own limit",
"alternates real owner journal status and terminates coarse progress without submitting again",
"reports an account store outage as unavailable and a refused account as forbidden",
"rejects unknown lifecycle argument fields before touching the owner journal",
"reports a runtime that cannot serve as unavailable through both frontends",
"reports an output that ends before its first byte as unavailable",
"fails closed as unavailable for an unclassified owner error",
"keeps authorization and policy denials forbidden",
"keeps a mutation unknown when the runtime fails after the owner applied it",
"keeps a mutation unknown when the owner reports recovery required for its operation",
"reports a mutation as unknown when the owner cannot serve it at all",
"keeps a mutation unknown on the owner's own frontend and leaves reads and denials alone",
"lets unavailability win when an error wraps both a denial and an unavailable cause",
"does not leak attachment headers into an error when the first read fails",
"treats every action except the known reads as a mutation",
"keeps resolved resources under admission for JSON and attachment bytes",
"closes interrupted output and releases admission on disconnect",
"rechecks revoked credentials during attachment copying",
"adopts read outputs as private artifacts inside admission and replaces a forged resource identity",
"refuses at ingest a file result larger than the relay file bound so nothing unservable is staged",
"denies private relays without host resolution and admission",
"serves declared assets of the current enabled generation by package digest only",
"allows only an exact declared tool name and fails closed otherwise",
"never contacts the add-on for an undeclared tool and still serves a declared one",
"denies a repeated key at any depth however it is spelled",
"denies arguments that are not exactly one object",
"separates a denial from an unavailable declaration source",
"answers 503 and never contacts the add-on when the source is unavailable or the arguments repeat a key",
"is the typed invalid request on the owner for a read, never an outage",
"is the typed invalid request on the owner for a proposal call",
"is the typed invalid request on the owner for a json relay",
"is the same typed answer from a forwarding frontend",
"stores a proposal from an API key and lets only the proposer's browser session confirm it",
"cancels a proposal from the same chain and never lets typed dispatch or relay confirm",
"denies sharing and deletion proposals and an unauthenticated caller",
"serves the local owner's confirmation only from a same-origin fetch of the host page",
"reports a lost reply with the original operation from forwarding frontends and resolves it by receipt",
"lets only the resource owner's browser session abandon an unresolved outcome and then accepts writes",
"lets the owner role list an editor's unresolved proposal and abandon it by the listed digest from every frontend",
"tells an editor of a blocked write only that it is denied",
"returns the applied proposal when the confirmed operation committed",
"answers an owner outage by the owner's state with the same type from every frontend",
"keeps a proposal confirmable by the same ID after the owner could not reach the addon",
"documents the proposal routes and the proposal schema in the Swagger spec",
"serves one owner journal through two real authenticated HTTP frontends and rejects paused keys",
"serves the synthetic owner through the real chain, denies sharing and rejects named callers",
"checks browser CSRF feature and admin access with real stored keys",
"serves a private file result as a safe attachment over real HTTP",
"never renders hostile names or active media types inline",
"answers one 403 for unknown, foreign, incomplete and expired artifacts and requires the feature and a principal",
"denies the download of a disabled addon and serves it again after enable",
"relays the same bytes, headers and denials through two forwarding frontends",
"keeps a file result of a read denied whole without an artifact store",
"serves the local owner's file only in local-owner mode",
"documents the artifact routes and the artifact schema in the Swagger spec",
"rejects anonymous callers and forged forwarding headers",
"gates the feature and then administration for named keys",
"requires same-origin browser requests for cookie mutations",
"registers only the dispatch, relay and proposal mutations",
"reserves every first path segment the host registers under /api/addons",
"gates the artifact routes by authentication and feature",
"gates the proposal routes by feature and refuses a confirmation from a key before the owner is asked",
"rejects anonymous and forged forwarding authority through real authentication",
"lets callers through only when the deployment selected local-owner mode",
"keeps authentication, the feature gate and administration when accounts exist",
"reports an unknown mutation outcome from a forwarding frontend with the original operation",
"documents every field the error responses emit in the Swagger schema",
"reports an unavailable read as plain unavailability",
"reports a denial as forbidden",
"reports an unclassified account check error as unavailable and a definite denial as forbidden",
"reports an unknown mutation outcome from the owner's own frontend with the original operation",
"lists the enabled installed apps for a reader and the disabled ones too for administrators, the same from every frontend",
"lets only administrators start and stop, through the lifecycle manager, and denies a stale generation",
"serves the verified icon through the host route and denies it identically otherwise",
"reports a lost start as an unknown outcome with its original operation and a lost list as unavailable",
"documents the apps routes and every field of the app view in the Swagger spec",
"lists every registered addon route in the feature registry",
"gates the apps routes by authentication, feature and administration",
"serves catalog search, details and the installed management view to administrators only, the same from every frontend",
"refuses every management call of the owner itself for a caller that is not an administrator",
"saves, refreshes and removes a library by reference and leaves installed addons alone",
"upgrades an installed addon through the typed action and keeps its earlier generation",
"reports a lost source change as an unknown outcome and a lost read as unavailable",
"documents the management actions and every emitted field of the installed view",
"serves the declared files of the current package through every frontend with immutable headers",
"lists the same URLs the route serves, and only for an enabled addon",
"denies every other path, digest, addon and credential form with one answer and no immutable caching",
"accepts a same-origin browser session and refuses a cross-site or direct one",
"withdraws the code the moment the addon is disabled, uninstalled or replaced, even for a page that is still open",
"refuses a declared file that is not a regular file of the package",
"documents the asset route and its binary response in the Swagger spec",
"gives the same 403 on the owner and on a forwarding frontend and never contacts the add-on",
"lists the caller's own pending proposals the same from the owner and every forwarding frontend",
"gives every caller with the feature the same status from every frontend, redacted for non-administrators",
"checks only for an administrator's own browser session, and applies nothing",
"upgrades only to the checked candidate, with the same typed refusals from every frontend, and never twice",
"runs two concurrent upgrades from two frontends once: the same ID shares the answer, another ID is a conflict",
"refuses an incompatible candidate and a library that cannot be read, with a typed answer",
"reports a lost upgrade as an unknown outcome with its original operation, and a lost status read or check as plainly unavailable",
"keeps the update actions out of the tools and names every field of the status in the Swagger spec",
"answers an add-on's invalid-request refusal as a typed 400 from the owner and from a forwarding frontend"
],
"report": ".cache/addons/logs/artifacts.json",
"reports": [
{
"path": ".cache/addons/logs/artifacts.json",
"cases": [
"adopts every output of a result or none, and shows the owner only its own status",
"sanitizes attachment names and maps media types to a fixed allowlist",
"applies finite default limits and rejects partial or unbounded overrides",
"keeps staged bytes behind the object store boundary and publishes only complete writes",
"never serves an artifact at or after expiry, including during admission and mid-stream",
"fails a transfer that outlives its artifact",
"fails a transfer whose source is revoked before completion and denies a revoked download",
"stops a download stream when the source is revoked mid-stream",
"requires read access to every source resource at completion and download",
"denies a disabled or unavailable account at ingestion and download",
"denies downloads of a disabled addon, keeps the bytes and serves again only while unexpired with current permissions",
"denies downloads after uninstall and removes the bytes at the next sweep",
"sweeps expired artifacts, abandoned partials and orphan files without touching live transfers",
"enforces per-user, total and size limits atomically under concurrent ingestion",
"bounds concurrent transfers and concurrent downloads",
"cancels a transfer by its context or by its owner and removes the partial bytes",
"returns the same artifact for a repeated request without a second transfer",
"keeps addon handles operation-bound and out of metadata and views",
"keeps complete artifacts across a restart and settles interrupted transfers",
"keeps the bytes of a transfer that completes while a sweep is running",
"never loses the bytes of a complete artifact when sweeps race with several completing transfers",
"answers a transient storage error as unavailable and keeps the bytes and the record",
"marks an artifact corrupt only for missing bytes or a size mismatch",
"answers a download that races with an expiry or a drop like any expired identifier",
"refuses a corrupt metadata store and stops writing after a failed sync",
"waits for background transfers before Close returns and writes nothing after",
"ingests a file result into a private staged artifact with a host-generated identifier",
"never uses an addon handle, URL or path as an identifier or a file path",
"answers one denial for an unknown identifier and for another principal's artifact",
"never serves incomplete, short, long or failed transfers and removes their partial bytes",
"streams ingestion and download without buffering the whole file",
"rejects an output declared larger than one artifact may be before reading it",
"never opens an output for a request that names a tool no source declares",
"denies an output request whose arguments repeat a key and never opens the output",
"reports an unavailable declaration source as unavailable and never opens the output",
"shortens the lifetime and keeps the bounds consistent, and zero keeps the defaults",
"fails the artifact with a fixed reason that says it was refused, not that the add-on is down"
]
},
{
"path": ".cache/addons/logs/artifacts-gateway.json",
"cases": [
"serves only declared installed generation assets and rejects traversal",
"fails closed without current identity or resource policy and reports the original ID of an unknown mutation outcome",
"reports an unclassified account check error as unavailable on every path and a wrapped denial as forbidden",
"propagates interrupted progress cancellation through the receiving frontend",
"validates finite relay budgets and prevents disabling polling bounds",
"builds a carrier only from complete pinned identities",
"types an unknown mutation outcome as unavailable without losing its operation",
"rejects untrusted peers wrong audience body expiry replay and revoked credentials",
"alternates pinned frontends and rejects untrusted certificates without local fallback",
"reports the original operation after lost mutation replies without retrying",
"rejects a stream longer than its receiving frontend budget",
"rejects a CA signed peer without a pin on the owner side",
"refuses an owner whose CA signed certificate is not the pinned owner",
"returns the artifact status through the owner from every frontend with one denial for the rest",
"types the owner's refusal and outage of a lookup the same from every frontend",
"writes an attachment header that cannot be broken out of",
"rotates the enforced audience on restart and rejects captured requests",
"never expires the response deadline after the relay returned",
"returns the owner's forbidden status for an invalid kind and for missing policy",
"still reports unavailable when the owner is unable to serve and not forbidden",
"reaches the same decision through both frontends and delivers bytes when allowed",
"keeps aborting when revocation happens after bytes were written",
"bounds progress, asset and file relays by their own limit",
"alternates real owner journal status and terminates coarse progress without submitting again",
"reports an account store outage as unavailable and a refused account as forbidden",
"rejects unknown lifecycle argument fields before touching the owner journal",
"reports a runtime that cannot serve as unavailable through both frontends",
"reports an output that ends before its first byte as unavailable",
"fails closed as unavailable for an unclassified owner error",
"keeps authorization and policy denials forbidden",
"keeps a mutation unknown when the runtime fails after the owner applied it",
"keeps a mutation unknown when the owner reports recovery required for its operation",
"reports a mutation as unknown when the owner cannot serve it at all",
"keeps a mutation unknown on the owner's own frontend and leaves reads and denials alone",
"lets unavailability win when an error wraps both a denial and an unavailable cause",
"does not leak attachment headers into an error when the first read fails",
"treats every action except the known reads as a mutation",
"keeps resolved resources under admission for JSON and attachment bytes",
"closes interrupted output and releases admission on disconnect",
"rechecks revoked credentials during attachment copying",
"adopts read outputs as private artifacts inside admission and replaces a forged resource identity",
"refuses at ingest a file result larger than the relay file bound so nothing unservable is staged",
"denies private relays without host resolution and admission",
"serves declared assets of the current enabled generation by package digest only",
"allows only an exact declared tool name and fails closed otherwise",
"never contacts the add-on for an undeclared tool and still serves a declared one",
"denies a repeated key at any depth however it is spelled",
"denies arguments that are not exactly one object",
"separates a denial from an unavailable declaration source",
"answers 503 and never contacts the add-on when the source is unavailable or the arguments repeat a key",
"is the typed invalid request on the owner for a read, never an outage",
"is the typed invalid request on the owner for a proposal call",
"is the typed invalid request on the owner for a json relay",
"is the same typed answer from a forwarding frontend"
]
},
{
"path": ".cache/addons/logs/artifacts-http.json",
"cases": [
"stores a proposal from an API key and lets only the proposer's browser session confirm it",
"cancels a proposal from the same chain and never lets typed dispatch or relay confirm",
"denies sharing and deletion proposals and an unauthenticated caller",
"serves the local owner's confirmation only from a same-origin fetch of the host page",
"reports a lost reply with the original operation from forwarding frontends and resolves it by receipt",
"lets only the resource owner's browser session abandon an unresolved outcome and then accepts writes",
"lets the owner role list an editor's unresolved proposal and abandon it by the listed digest from every frontend",
"tells an editor of a blocked write only that it is denied",
"returns the applied proposal when the confirmed operation committed",
"answers an owner outage by the owner's state with the same type from every frontend",
"keeps a proposal confirmable by the same ID after the owner could not reach the addon",
"documents the proposal routes and the proposal schema in the Swagger spec",
"serves one owner journal through two real authenticated HTTP frontends and rejects paused keys",
"serves the synthetic owner through the real chain, denies sharing and rejects named callers",
"checks browser CSRF feature and admin access with real stored keys",
"serves a private file result as a safe attachment over real HTTP",
"never renders hostile names or active media types inline",
"answers one 403 for unknown, foreign, incomplete and expired artifacts and requires the feature and a principal",
"denies the download of a disabled addon and serves it again after enable",
"relays the same bytes, headers and denials through two forwarding frontends",
"keeps a file result of a read denied whole without an artifact store",
"serves the local owner's file only in local-owner mode",
"documents the artifact routes and the artifact schema in the Swagger spec",
"rejects anonymous callers and forged forwarding headers",
"gates the feature and then administration for named keys",
"requires same-origin browser requests for cookie mutations",
"registers only the dispatch, relay and proposal mutations",
"reserves every first path segment the host registers under /api/addons",
"gates the artifact routes by authentication and feature",
"gates the proposal routes by feature and refuses a confirmation from a key before the owner is asked",
"rejects anonymous and forged forwarding authority through real authentication",
"lets callers through only when the deployment selected local-owner mode",
"keeps authentication, the feature gate and administration when accounts exist",
"reports an unknown mutation outcome from a forwarding frontend with the original operation",
"documents every field the error responses emit in the Swagger schema",
"reports an unavailable read as plain unavailability",
"reports a denial as forbidden",
"reports an unclassified account check error as unavailable and a definite denial as forbidden",
"reports an unknown mutation outcome from the owner's own frontend with the original operation",
"lists the enabled installed apps for a reader and the disabled ones too for administrators, the same from every frontend",
"lets only administrators start and stop, through the lifecycle manager, and denies a stale generation",
"serves the verified icon through the host route and denies it identically otherwise",
"reports a lost start as an unknown outcome with its original operation and a lost list as unavailable",
"documents the apps routes and every field of the app view in the Swagger spec",
"lists every registered addon route in the feature registry",
"gates the apps routes by authentication, feature and administration",
"serves catalog search, details and the installed management view to administrators only, the same from every frontend",
"refuses every management call of the owner itself for a caller that is not an administrator",
"saves, refreshes and removes a library by reference and leaves installed addons alone",
"upgrades an installed addon through the typed action and keeps its earlier generation",
"reports a lost source change as an unknown outcome and a lost read as unavailable",
"documents the management actions and every emitted field of the installed view",
"serves the declared files of the current package through every frontend with immutable headers",
"lists the same URLs the route serves, and only for an enabled addon",
"denies every other path, digest, addon and credential form with one answer and no immutable caching",
"accepts a same-origin browser session and refuses a cross-site or direct one",
"withdraws the code the moment the addon is disabled, uninstalled or replaced, even for a page that is still open",
"refuses a declared file that is not a regular file of the package",
"documents the asset route and its binary response in the Swagger spec",
"gives the same 403 on the owner and on a forwarding frontend and never contacts the add-on",
"lists the caller's own pending proposals the same from the owner and every forwarding frontend",
"gives every caller with the feature the same status from every frontend, redacted for non-administrators",
"checks only for an administrator's own browser session, and applies nothing",
"upgrades only to the checked candidate, with the same typed refusals from every frontend, and never twice",
"runs two concurrent upgrades from two frontends once: the same ID shares the answer, another ID is a conflict",
"refuses an incompatible candidate and a library that cannot be read, with a typed answer",
"reports a lost upgrade as an unknown outcome with its original operation, and a lost status read or check as plainly unavailable",
"keeps the update actions out of the tools and names every field of the status in the Swagger spec",
"answers an add-on's invalid-request refusal as a typed 400 from the owner and from a forwarding frontend",
"returns the SDK refusal text to the administrator and the generic message for an unrelated failure",
"returns the same text through a forwarding frontend"
]
}
]
},
"apps": {
"kind": "ginkgo",
"commands": [
[
"go",
"test",
"-count=1",
"-p",
"2",
"-tags",
"auth",
"./core/services/addons/apps",
"-ginkgo.json-report=../../../../.cache/addons/logs/apps.json"
],
[
"go",
"test",
"-count=1",
"-p",
"2",
"-tags",
"auth",
"./core/services/addons",
"-ginkgo.json-report=../../../.cache/addons/logs/apps-lifecycle.json"
],
[
"go",
"test",
"-count=1",
"-p",
"2",
"-tags",
"auth",
"./core/services/addons/runtime",
"-ginkgo.json-report=../../../../.cache/addons/logs/apps-runtime.json"
],
[
"go",
"test",
"-count=1",
"-p",
"2",
"-tags",
"auth",
"./core/http/endpoints/addons",
"-ginkgo.json-report=../../../../.cache/addons/logs/apps-http.json"
]
],
"cases": [
"lists installed enabled addons for users and adds installed disabled ones only for administrators",
"derives display fields, the main page and the icon URL from the verified manifest only",
"bounds the tool summary and coerces unknown process states to failed",
"shows controls and the management link only to administrators and never leaks owner details",
"describes the immutable UI assets of an enabled addon by the package digest and never otherwise",
"denies enable and disable for a stale generation without recording anything",
"lists the identifiers of installed addons, disabled ones included",
"refuses to list installed identifiers while recovery is required",
"lists apps by visibility and serves an icon only for a visible app at its generation",
"cancels status lookup while a lifecycle writer holds the journal lock",
"retries runtime synchronization after canceled disable and generation upgrade",
"rejects symlinked package roots without touching external staging",
"recovers every durable journal boundary without replaying publication",
"removes abandoned staging without removing published packages on recovery",
"keeps immutable history on successful upgrade and reinstallation",
"excludes competing owners and rejects conflicting durable identities",
"never opens replica roots or elects an absent owner",
"binds duplicate operation IDs to actor and command and serializes conflicts",
"refuses commands and asset reads for an add-on ID the host serves as a route",
"retains generations identity data and grants across uninstall and restart",
"preserves old packages and active generation on manager upgrade failure",
"requires current authoritative administration even for idempotent retries",
"executes enabled owner intent on startup and stops on disable and close without forwarder execution",
"binds lifecycle lookup to current admin and original actor without writes or repair",
"reports the supervisor state of an app through a crash and a restart",
"reads a flat directory in batches and stops at the entry bound",
"adds up nested files and reports a complete walk as not truncated",
"never follows or counts a symbolic link",
"keeps a result for a short time so polling does not walk again",
"stops at the time bound and reports a truncated size",
"does not keep a result cut short by the caller",
"is what the installed view reports for the data directory",
"resolves a package for the current enabled generation and digest only",
"answers from the current installed manifest only and follows a generation change",
"reports a digest-only change of a moving channel, applies nothing and offers the pinned upgrade",
"refuses a second operation ID for the same transition, in flight or done, and applies it once",
"runs concurrent requests with one operation ID once and gives each the same answer",
"serializes conflicting upgrades by the installed digest and refuses the loser without a record",
"refuses a candidate that is not the one the library resolves now",
"refuses an upgrade to the digest that is already installed",
"rechecks compatibility at execution and refuses an incompatible candidate",
"selects a newer immutable version and treats a rewritten version as an integrity error",
"keeps the last good generation when the candidate cannot be staged",
"never switches the library or channel, and a failed check is never up to date",
"lets an administrator refresh and everyone with the feature read a redacted status",
"shows the pending update in the apps list from the cache only",
"does not accept pins without an update checker or on another action",
"keeps the unpinned typed upgrade of an earlier release working",
"registers only ready generation bound service headless and UI capabilities",
"rejects forged registration nonloopback and stale incarnation handshakes",
"bounds readiness and handles exit during start and stop",
"withdraws immediately drains boundedly and rejects stale process identities",
"exhausts restart budget without retaining dead registrations",
"does not inherit secrets and exits when the private parent channel closes",
"fails closed on ambiguous launch identities and preserves unrelated reused PIDs",
"retains a canceled restart slot until cleanup completes and rejects duplicate supervisors",
"rejects nonloopback endpoints and bounds oversized streams and concurrency",
"reports stopped, running, failed, starting and running again across a crash and a restart",
"keeps reporting failed once the restart budget is exhausted",
"rejects foreign supervisor handles and numeric PID substitutions",
"resets restart budget only after sustained authenticated health",
"kills the exact paused child of a killed owner before launching its replacement",
"never reports failed between a launch starting and the restarted process being published",
"reserves a draining slot against concurrent starts",
"waits for a restart launch worker before acknowledging stop",
"exposes a new incarnation client after restart without reviving the old client",
"refuses a missing established ledger and fences failed cleanup publication",
"authenticates every request and separates trusted authority from model arguments",
"bounds output streams cancellation deadlines and stop admission",
"tells a 409 conflict of the add-on from an outage",
"withdraws and initiates every live slot before a cleanup timeout",
"creates one private data directory per addon and passes its path in the startup object",
"gives no data directory without a data root and refuses an unsafe root or addon ID",
"gives an add-on that the host setting names a host endpoint of its own",
"gives an add-on that the host setting does not name no host endpoint",
"closes the host endpoint when the incarnation ends",
"an HTTP 400 answer",
"an HTTP 422 answer",
"keeps a bounded, printable reason and nothing else of the body",
"leaves 503, 500 and 404 as outages",
"rejects anonymous and forged forwarding authority through real authentication",
"lets callers through only when the deployment selected local-owner mode",
"keeps authentication, the feature gate and administration when accounts exist",
"lists the enabled installed apps for a reader and the disabled ones too for administrators, the same from every frontend",
"lets only administrators start and stop, through the lifecycle manager, and denies a stale generation",
"serves the verified icon through the host route and denies it identically otherwise",
"reports a lost start as an unknown outcome with its original operation and a lost list as unavailable",
"documents the apps routes and every field of the app view in the Swagger spec",
"rejects anonymous callers and forged forwarding headers",
"gates the feature and then administration for named keys",
"requires same-origin browser requests for cookie mutations",
"registers only the dispatch, relay and proposal mutations",
"reserves every first path segment the host registers under /api/addons",
"gates the artifact routes by authentication and feature",
"lists every registered addon route in the feature registry",
"gates the apps routes by authentication, feature and administration",
"gates the proposal routes by feature and refuses a confirmation from a key before the owner is asked",
"checks browser CSRF feature and admin access with real stored keys",
"stores a proposal from an API key and lets only the proposer's browser session confirm it",
"cancels a proposal from the same chain and never lets typed dispatch or relay confirm",
"denies sharing and deletion proposals and an unauthenticated caller",
"serves the local owner's confirmation only from a same-origin fetch of the host page",
"reports a lost reply with the original operation from forwarding frontends and resolves it by receipt",
"lets only the resource owner's browser session abandon an unresolved outcome and then accepts writes",
"lets the owner role list an editor's unresolved proposal and abandon it by the listed digest from every frontend",
"tells an editor of a blocked write only that it is denied",
"returns the applied proposal when the confirmed operation committed",
"answers an owner outage by the owner's state with the same type from every frontend",
"keeps a proposal confirmable by the same ID after the owner could not reach the addon",
"documents the proposal routes and the proposal schema in the Swagger spec",
"reports an unknown mutation outcome from a forwarding frontend with the original operation",
"documents every field the error responses emit in the Swagger schema",
"reports an unavailable read as plain unavailability",
"reports a denial as forbidden",
"reports an unclassified account check error as unavailable and a definite denial as forbidden",
"reports an unknown mutation outcome from the owner's own frontend with the original operation",
"serves a private file result as a safe attachment over real HTTP",
"never renders hostile names or active media types inline",
"answers one 403 for unknown, foreign, incomplete and expired artifacts and requires the feature and a principal",
"denies the download of a disabled addon and serves it again after enable",
"relays the same bytes, headers and denials through two forwarding frontends",
"keeps a file result of a read denied whole without an artifact store",
"serves the local owner's file only in local-owner mode",
"documents the artifact routes and the artifact schema in the Swagger spec",
"serves one owner journal through two real authenticated HTTP frontends and rejects paused keys",
"serves the synthetic owner through the real chain, denies sharing and rejects named callers",
"serves catalog search, details and the installed management view to administrators only, the same from every frontend",
"refuses every management call of the owner itself for a caller that is not an administrator",
"saves, refreshes and removes a library by reference and leaves installed addons alone",
"upgrades an installed addon through the typed action and keeps its earlier generation",
"reports a lost source change as an unknown outcome and a lost read as unavailable",
"documents the management actions and every emitted field of the installed view",
"serves the declared files of the current package through every frontend with immutable headers",
"lists the same URLs the route serves, and only for an enabled addon",
"denies every other path, digest, addon and credential form with one answer and no immutable caching",
"accepts a same-origin browser session and refuses a cross-site or direct one",
"withdraws the code the moment the addon is disabled, uninstalled or replaced, even for a page that is still open",
"refuses a declared file that is not a regular file of the package",
"documents the asset route and its binary response in the Swagger spec",
"gives the same 403 on the owner and on a forwarding frontend and never contacts the add-on",
"lists the caller's own pending proposals the same from the owner and every forwarding frontend",
"gives every caller with the feature the same status from every frontend, redacted for non-administrators",
"checks only for an administrator's own browser session, and applies nothing",
"upgrades only to the checked candidate, with the same typed refusals from every frontend, and never twice",
"runs two concurrent upgrades from two frontends once: the same ID shares the answer, another ID is a conflict",
"refuses an incompatible candidate and a library that cannot be read, with a typed answer",
"reports a lost upgrade as an unknown outcome with its original operation, and a lost status read or check as plainly unavailable",
"keeps the update actions out of the tools and names every field of the status in the Swagger spec",
"answers an add-on's invalid-request refusal as a typed 400 from the owner and from a forwarding frontend",
"types a withdrawn client, a full slot table, a bad envelope and a missing schema as not sent",
"keeps a not-sent error an ErrRuntime for callers that do not tell them apart",
"types a refused connection as not sent",
"never types a possibly-sent request as not sent",
"carries the SDK refusal text to the caller of a failed install and keeps the generic error",
"installs an add-on whose SDK range contains the host SDK",
"returns the SDK refusal text to the administrator and the generic message for an unrelated failure",
"returns the same text through a forwarding frontend"
],
"report": ".cache/addons/logs/apps.json",
"reports": [
{
"path": ".cache/addons/logs/apps.json",
"cases": [
"lists installed enabled addons for users and adds installed disabled ones only for administrators",
"derives display fields, the main page and the icon URL from the verified manifest only",
"bounds the tool summary and coerces unknown process states to failed",
"shows controls and the management link only to administrators and never leaks owner details",
"describes the immutable UI assets of an enabled addon by the package digest and never otherwise"
]
},
{
"path": ".cache/addons/logs/apps-lifecycle.json",
"cases": [
"denies enable and disable for a stale generation without recording anything",
"lists the identifiers of installed addons, disabled ones included",
"refuses to list installed identifiers while recovery is required",
"lists apps by visibility and serves an icon only for a visible app at its generation",
"cancels status lookup while a lifecycle writer holds the journal lock",
"retries runtime synchronization after canceled disable and generation upgrade",
"rejects symlinked package roots without touching external staging",
"recovers every durable journal boundary without replaying publication",
"removes abandoned staging without removing published packages on recovery",
"keeps immutable history on successful upgrade and reinstallation",
"excludes competing owners and rejects conflicting durable identities",
"never opens replica roots or elects an absent owner",
"binds duplicate operation IDs to actor and command and serializes conflicts",
"refuses commands and asset reads for an add-on ID the host serves as a route",
"retains generations identity data and grants across uninstall and restart",
"preserves old packages and active generation on manager upgrade failure",
"requires current authoritative administration even for idempotent retries",
"executes enabled owner intent on startup and stops on disable and close without forwarder execution",
"binds lifecycle lookup to current admin and original actor without writes or repair",
"reports the supervisor state of an app through a crash and a restart",
"reads a flat directory in batches and stops at the entry bound",
"adds up nested files and reports a complete walk as not truncated",
"never follows or counts a symbolic link",
"keeps a result for a short time so polling does not walk again",
"stops at the time bound and reports a truncated size",
"does not keep a result cut short by the caller",
"is what the installed view reports for the data directory",
"resolves a package for the current enabled generation and digest only",
"answers from the current installed manifest only and follows a generation change",
"reports a digest-only change of a moving channel, applies nothing and offers the pinned upgrade",
"refuses a second operation ID for the same transition, in flight or done, and applies it once",
"runs concurrent requests with one operation ID once and gives each the same answer",
"serializes conflicting upgrades by the installed digest and refuses the loser without a record",
"refuses a candidate that is not the one the library resolves now",
"refuses an upgrade to the digest that is already installed",
"rechecks compatibility at execution and refuses an incompatible candidate",
"selects a newer immutable version and treats a rewritten version as an integrity error",
"keeps the last good generation when the candidate cannot be staged",
"never switches the library or channel, and a failed check is never up to date",
"lets an administrator refresh and everyone with the feature read a redacted status",
"shows the pending update in the apps list from the cache only",
"does not accept pins without an update checker or on another action",
"keeps the unpinned typed upgrade of an earlier release working",
"carries the SDK refusal text to the caller of a failed install and keeps the generic error",
"installs an add-on whose SDK range contains the host SDK"
]
},
{
"path": ".cache/addons/logs/apps-runtime.json",
"cases": [
"registers only ready generation bound service headless and UI capabilities",
"rejects forged registration nonloopback and stale incarnation handshakes",
"bounds readiness and handles exit during start and stop",
"withdraws immediately drains boundedly and rejects stale process identities",
"exhausts restart budget without retaining dead registrations",
"does not inherit secrets and exits when the private parent channel closes",
"fails closed on ambiguous launch identities and preserves unrelated reused PIDs",
"retains a canceled restart slot until cleanup completes and rejects duplicate supervisors",
"rejects nonloopback endpoints and bounds oversized streams and concurrency",
"reports stopped, running, failed, starting and running again across a crash and a restart",
"keeps reporting failed once the restart budget is exhausted",
"rejects foreign supervisor handles and numeric PID substitutions",
"resets restart budget only after sustained authenticated health",
"kills the exact paused child of a killed owner before launching its replacement",
"never reports failed between a launch starting and the restarted process being published",
"reserves a draining slot against concurrent starts",
"waits for a restart launch worker before acknowledging stop",
"exposes a new incarnation client after restart without reviving the old client",
"refuses a missing established ledger and fences failed cleanup publication",
"authenticates every request and separates trusted authority from model arguments",
"bounds output streams cancellation deadlines and stop admission",
"tells a 409 conflict of the add-on from an outage",
"withdraws and initiates every live slot before a cleanup timeout",
"creates one private data directory per addon and passes its path in the startup object",
"gives no data directory without a data root and refuses an unsafe root or addon ID",
"gives an add-on that the host setting names a host endpoint of its own",
"gives an add-on that the host setting does not name no host endpoint",
"closes the host endpoint when the incarnation ends",
"an HTTP 400 answer",
"an HTTP 422 answer",
"keeps a bounded, printable reason and nothing else of the body",
"leaves 503, 500 and 404 as outages",
"types a withdrawn client, a full slot table, a bad envelope and a missing schema as not sent",
"keeps a not-sent error an ErrRuntime for callers that do not tell them apart",
"types a refused connection as not sent",
"never types a possibly-sent request as not sent"
]
},
{
"path": ".cache/addons/logs/apps-http.json",
"cases": [
"rejects anonymous and forged forwarding authority through real authentication",
"lets callers through only when the deployment selected local-owner mode",
"keeps authentication, the feature gate and administration when accounts exist",
"lists the enabled installed apps for a reader and the disabled ones too for administrators, the same from every frontend",
"lets only administrators start and stop, through the lifecycle manager, and denies a stale generation",
"serves the verified icon through the host route and denies it identically otherwise",
"reports a lost start as an unknown outcome with its original operation and a lost list as unavailable",
"documents the apps routes and every field of the app view in the Swagger spec",
"rejects anonymous callers and forged forwarding headers",
"gates the feature and then administration for named keys",
"requires same-origin browser requests for cookie mutations",
"registers only the dispatch, relay and proposal mutations",
"reserves every first path segment the host registers under /api/addons",
"gates the artifact routes by authentication and feature",
"lists every registered addon route in the feature registry",
"gates the apps routes by authentication, feature and administration",
"gates the proposal routes by feature and refuses a confirmation from a key before the owner is asked",
"checks browser CSRF feature and admin access with real stored keys",
"stores a proposal from an API key and lets only the proposer's browser session confirm it",
"cancels a proposal from the same chain and never lets typed dispatch or relay confirm",
"denies sharing and deletion proposals and an unauthenticated caller",
"serves the local owner's confirmation only from a same-origin fetch of the host page",
"reports a lost reply with the original operation from forwarding frontends and resolves it by receipt",
"lets only the resource owner's browser session abandon an unresolved outcome and then accepts writes",
"lets the owner role list an editor's unresolved proposal and abandon it by the listed digest from every frontend",
"tells an editor of a blocked write only that it is denied",
"returns the applied proposal when the confirmed operation committed",
"answers an owner outage by the owner's state with the same type from every frontend",
"keeps a proposal confirmable by the same ID after the owner could not reach the addon",
"documents the proposal routes and the proposal schema in the Swagger spec",
"reports an unknown mutation outcome from a forwarding frontend with the original operation",
"documents every field the error responses emit in the Swagger schema",
"reports an unavailable read as plain unavailability",
"reports a denial as forbidden",
"reports an unclassified account check error as unavailable and a definite denial as forbidden",
"reports an unknown mutation outcome from the owner's own frontend with the original operation",
"serves a private file result as a safe attachment over real HTTP",
"never renders hostile names or active media types inline",
"answers one 403 for unknown, foreign, incomplete and expired artifacts and requires the feature and a principal",
"denies the download of a disabled addon and serves it again after enable",
"relays the same bytes, headers and denials through two forwarding frontends",
"keeps a file result of a read denied whole without an artifact store",
"serves the local owner's file only in local-owner mode",
"documents the artifact routes and the artifact schema in the Swagger spec",
"serves one owner journal through two real authenticated HTTP frontends and rejects paused keys",
"serves the synthetic owner through the real chain, denies sharing and rejects named callers",
"serves catalog search, details and the installed management view to administrators only, the same from every frontend",
"refuses every management call of the owner itself for a caller that is not an administrator",
"saves, refreshes and removes a library by reference and leaves installed addons alone",
"upgrades an installed addon through the typed action and keeps its earlier generation",
"reports a lost source change as an unknown outcome and a lost read as unavailable",
"documents the management actions and every emitted field of the installed view",
"serves the declared files of the current package through every frontend with immutable headers",
"lists the same URLs the route serves, and only for an enabled addon",
"denies every other path, digest, addon and credential form with one answer and no immutable caching",
"accepts a same-origin browser session and refuses a cross-site or direct one",
"withdraws the code the moment the addon is disabled, uninstalled or replaced, even for a page that is still open",
"refuses a declared file that is not a regular file of the package",
"documents the asset route and its binary response in the Swagger spec",
"gives the same 403 on the owner and on a forwarding frontend and never contacts the add-on",
"lists the caller's own pending proposals the same from the owner and every forwarding frontend",
"gives every caller with the feature the same status from every frontend, redacted for non-administrators",
"checks only for an administrator's own browser session, and applies nothing",
"upgrades only to the checked candidate, with the same typed refusals from every frontend, and never twice",
"runs two concurrent upgrades from two frontends once: the same ID shares the answer, another ID is a conflict",
"refuses an incompatible candidate and a library that cannot be read, with a typed answer",
"reports a lost upgrade as an unknown outcome with its original operation, and a lost status read or check as plainly unavailable",
"keeps the update actions out of the tools and names every field of the status in the Swagger spec",
"answers an add-on's invalid-request refusal as a typed 400 from the owner and from a forwarding frontend",
"returns the SDK refusal text to the administrator and the generic message for an unrelated failure",
"returns the same text through a forwarding frontend"
]
}
]
},
"gallery-ui": {
"kind": "shell",
"commands": [
[
"sh",
"scripts/addons/gallery_ui.sh"
]
],
"cases": [
"unit: query normalization bounds text, library and page",
"unit: an operation book keeps one identity per action until it is done",
"unit: responses classify the same way everywhere",
"unit: polling backs off on failure, slows when hidden and stays bounded",
"unit: library drafts accept references and refuse secrets before sending",
"unit: tabs: the server decides, the page only avoids showing what it will refuse",
"unit: app chips never turn an unknown state into running",
"unit: titles follow the language, then the default text, then the id",
"unit: update status comes only from an authoritative check",
"unit: the api sends one dispatch shape and classifies refusals",
"unit: an unknown outcome is read with the original identity and never resubmitted",
"unit: a denial is not retried and an exhausted read is reported as unknown",
"unit: an action book binds one identity to one click and its retries",
"unit: an action book mints a fresh identity once an action is resolved",
"unit: an action book blocks another action on a subject with an unknown outcome until it is resolved or dismissed",
"unit: a completed status that left the add-on unchanged is not reported as done",
"apps: lists enabled apps with state chips, the icon route and Open only for a main page",
"apps: a headless add-on shows its tools and no Open action",
"apps: a reader gets no start, stop, manage or management tabs",
"apps: an administrator starts an app with a fresh operation ID and the listed generation",
"apps: a lost start is read with the same operation ID and never submitted again",
"apps: an unknown start is resolved or dismissed before the next action and never replays its ID",
"apps: dismissing an unknown outcome lets the next click mint a new operation",
"apps: a completed status that left the app unchanged is not shown as done",
"apps: a refused start shows the server denial and refreshes the list",
"apps: the list refreshes on a bounded interval, backs off on errors and stops when left",
"apps: an add-on that contributes UI keeps the list current off the page and its disable stops the reads",
"apps: a viewer without the add-ons feature never requests the list",
"browse: searches the libraries, pages and shows trust and platform facts",
"browse: installing asks first and leaves the add-on disabled until it is enabled",
"installed: health is separate from enabled and the details show trust, compatibility and storage",
"installed: an update is shown only from the owner update field and upgrade sends that version",
"installed: uninstalling warns that data is kept before anything is submitted",
"installed: Escape cancels the uninstall dialog only, then closes the sheet, and focus returns",
"installed: an unknown enable blocks other actions on the add-on until it is read",
"installed: a headless add-on keeps its details, health and tools",
"installed: a refusal from the server is shown even though the tab was offered",
"libraries: a private library is saved by credential reference and never carries a secret",
"libraries: removing a library says installed add-ons stay and leaves them installed",
"libraries: a refresh reports its result and a failed fetch is shown as failed",
"keyboard: the tab list moves with the arrow keys and actions are reachable",
"narrow: at 400 px the apps page is one column without sideways scrolling",
"theme: the apps page follows the light and dark tokens",
"i18n: the page follows the interface language",
"hub: the Add-ons tab appears only for an account that holds the feature",
"regression: the backends catalog still searches, pages and shows its empty state"
]
},
"esm-ui": {
"kind": "shell",
"commands": [
[
"sh",
"scripts/addons/esm_ui.sh"
]
],
"cases": [
"unit: sdk: compatibility accepts only a range that holds the host SDK version",
"unit: sdk: the object is a frozen allowlist that carries the host React and no host internals",
"unit: sdk: hooks run on the host React instance and a wrapper keeps one component type",
"unit: sdk: icons outside the semantic set fall back and theme tokens are a fixed set",
"unit: sdk: navigation stays inside the add-on prefix and its declared pages",
"unit: sdk: api calls carry the add-on and its generation and nothing else is reachable",
"unit: sdk: after the signal aborts every service refuses and each disposer runs once",
"unit: sdk: markDirty reports unsaved edits once per change and notifications are bounded",
"unit: sdk: locale is scoped to the add-on and falls back to the default text",
"unit: sdk: layers are host wrappers with a bounded spec",
"unit: css: every selector is scoped to the add-on root and the global ones are neutralised",
"unit: css: imports, fonts, external urls and unknown at-rules are dropped and keyframes are renamed",
"unit: css: no value that loads a URL survives anywhere in the sheet",
"unit: css: harmless values, escapes in strings and nested rules are kept",
"unit: css: two add-ons that use the same class names get disjoint scopes",
"unit: loader: asset URLs must be same-origin immutable URLs of the add-on own package",
"unit: loader: an incompatible SDK range is never imported and leaves a clear error",
"unit: loader: the module receives only the host SDK, its result is validated and styles are scoped",
"unit: loader: a module without createAddon, with a bad result or a bare import is a load error",
"unit: loader: a hanging import times out and an abort cancels and cleans up",
"unit: loader: dispose runs once, aborts the SDK signal and removes the styles",
"unit: loader: chat actions are limited to declared ids and carry only the conversation context",
"unit: registry: disable, uninstall, crash and update withdraw a loaded add-on at once",
"unit: registry: unsaved edits keep a withdrawn add-on stale until the user reloads",
"unit: registry: a poll never replaces a withdrawn instance; only reload does",
"unit: registry: a hold ends with its last holder and a load that was withdrawn leaves no instance behind",
"unit: registry: navigation and chat actions come only from usable add-ons of the current generation",
"unit: registry: the Add-ons tab lists page links only when the registry has usable add-ons",
"unit: registry: the list is read off the Add-ons page only for a viewer with the feature and a UI contribution",
"go: describes the immutable UI assets of an enabled addon by the package digest and never otherwise",
"go: resolves a package for the current enabled generation and digest only",
"go: serves declared assets of the current enabled generation by package digest only",
"go: serves the declared files of the current package through every frontend with immutable headers",
"go: lists the same URLs the route serves, and only for an enabled addon",
"go: denies every other path, digest, addon and credential form with one answer and no immutable caching",
"go: accepts a same-origin browser session and refuses a cross-site or direct one",
"go: withdraws the code the moment the addon is disabled, uninstalled or replaced, even for a page that is still open",
"go: refuses a declared file that is not a regular file of the package",
"go: documents the asset route and its binary response in the Swagger spec",
"esm: a fixture add-on installed after the host build loads through real authorization and draws in its own root",
"esm: hooks run on the host React and the add-on keeps its state across renders",
"esm: the add-on style sheet is scoped to its root and leaves the host and other add-ons alone",
"esm: a component that throws is contained by the error boundary and the shell keeps working",
"esm: deep links, the bare add-on address and a proxy path prefix reach the same declared page",
"esm: a host that does not provide the add-on SDK range never imports its code and says so",
"esm: a module that imports React by a bare specifier fails to load and no second React is resolved",
"esm: the server decides asset access: undeclared files, traversal, other add-ons, credentials in URLs and foreign sessions are denied",
"esm: an add-on navigates only to its own declared pages and the host draws the add-on navigation",
"esm: dialogs an add-on opens are owned by the host: focus, Escape and the close button",
"esm: a dialog or panel whose render throws is contained and the host app keeps running",
"esm: unsaved edits are guarded when leaving the page",
"esm: the page keeps inside the viewport at 400 px and follows the light and dark themes",
"esm: a member without the add-ons feature gets no add-on page and no code",
"esm: disabling an add-on unmounts it, aborts its signal, drops its styles and denies its code at once",
"esm: a withdrawn add-on with unsaved edits stays on screen until the user decides, and never saves",
"esm: an update withdraws the old generation, denies its code and loads the new one only on an explicit reload"
]
},
"host-slots": {
"kind": "shell",
"commands": [
[
"sh",
"scripts/addons/host_slots.sh"
]
],
"cases": [
"unit: slots: the registry is closed and each slot has a frozen minimal props contract",
"unit: slots: props carry only the contract and never message text or history",
"unit: slots: declared component names come from the manifest only and the module cannot add more",
"unit: slots: the loader hands the host only declared components and never an imperative registration",
"unit: slots: contributions come only from enabled, usable, current-generation add-ons that are ready",
"unit: slots: an action appears only in its declared placement and carries its own target",
"unit: slots: labels follow the language with a safe fallback",
"unit: slots: a renderer is found only for the addon own declared tool and kind",
"unit: slots: an action sends its declared tool and the sanitized context, and results are bounded text",
"unit: slots: disable, crash and update unmount every contribution through the runtime",
"unit: slots: contributions keep the apps list polled while they exist",
"unit: slots: the approval frame decides from the stored proposal and never from the renderer",
"unit: slots: the SDK can present an approval of its own addon only through the host",
"unit: slots: a page that only needs the list reads it once and never retries a failed read",
"go: accepts tool and component chat actions, slots and own-tool renderers",
"go: keeps bare chat action identifiers and every earlier fixture valid",
"go: rejects every undeclared, unsafe or inconsistent contribution at install",
"go: keeps the closed slot list and the icon allowlist equal to the host",
"go: lists actions, slots and renderers for an enabled addon and keeps the identifiers",
"go: lists no contribution for a disabled addon, whoever asks",
"slots: the composer overflow menu holds the declared composer actions and components only",
"slots: a tool action calls only its declared own tool and draws the declared result renderer",
"slots: message actions sit in the message action row and carry no message text",
"slots: a component action opens the add-on component in a host dialog and a throwing one is contained",
"slots: the host approval frame owns Confirm and Cancel and the card only draws details",
"slots: the settings page ends with a host-owned section for each contributing add-on",
"slots: the navigation slot adds its entry after the add-on navigation links of the Build hub",
"slots: add-on style sheets that collide with host class names change no host node",
"slots: keyboard users open the menu, move through it, close it with Escape and run an action",
"slots: the layout keeps inside a 400 px screen in the light theme",
"slots: a caller without the add-ons feature sees no contribution and the server denies the tool call",
"slots: disabling the add-on through the real owner removes every contribution and enabling brings them back"
]
},
"foundation-acceptance": {
"kind": "shell",
"commands": [
[
"sh",
"scripts/addons/foundation.sh"
]
],
"cases": [
"go: fails closed on every frontend while the owner is down, executes nothing locally and recovers the last good package and data on restart",
"go: refuses a second owner on the same storage and keeps one process per add-on",
"go: stops an add-on process orphaned by an owner crash before it starts the next one",
"go: leaves no process behind when a cluster with an orphaned add-on is taken down",
"go: keeps the last good generation running and its data when an upgrade fails to start",
"go: keeps the last good code and data when the owner is killed in the middle of an upgrade and recovers on restart",
"go: keeps retained data and a consistent lifecycle when the owner is killed in the middle of an enable",
"go: keeps the files of the package of an installed add-on read only",
"go: keeps the last good generation running and the retained data when the new generation cannot start",
"go: restores the last good generation and resumes the same operation when the request is canceled during an upgrade start",
"go: converges on the last good generation after a crash that follows the rollback start and precedes any journal write",
"go: starts the owner when an enabled add-on cannot become ready and fails only that add-on",
"go: gives an ordinary account the apps list and no management on any node",
"go: returns the same typed denial from the owner and from each frontend",
"go: refuses a session on every node once it was ended through one frontend",
"go: refuses an API key on every node once it was revoked through one frontend",
"go: installs the UI, tool and service-only packages from the catalog through a frontend without starting them and leaves the host binary and UI build unchanged",
"go: activates each package through the other frontend and runs one process per add-on under the owner only",
"go: lists the same apps from the owner and both frontends and shows only what each declared",
"go: serves reads of the UI, tool and service-only packages alternately through the owner and both frontends",
"go: denies an account without the feature, a stranger to the resource and an anonymous caller the same way on every node",
"go: takes the actor from the authenticated credential only and ignores forged actor and authority headers",
"go: denies a tool the add-on did not declare and a generation that is not current on every node",
"go: relays JSON and a private file result and downloads the file through a different frontend than the one that produced it",
"go: relays lifecycle status and progress of an operation to the administrator who made it and to nobody else",
"go: serves the immutable UI assets by package digest through a non-owner frontend and refuses everything else",
"go: applies one confirmed change exactly once through a different frontend than the one that proposed it",
"go: reports a lost reply as outcome unknown with the original operation ID and settles it by receipt lookup without a second apply",
"go: upgrades to a new generation, denies the previous generation and its assets, and keeps the retained data",
"go: disables, removes and reinstalls an add-on while its data and grants remain",
"go: never changes the host binary or the shipped UI build over the whole lifecycle",
"regression: model and backend gallery specs (core/gallery)",
"regression: gallery operation specs (core/services/galleryop)",
"regression: process adapter specs (pkg/model)",
"foundation: a member opens the add-on through each non-owner frontend and its module comes from the owner by digest",
"foundation: the owner and both frontends list the same add-on to the same account",
"foundation: a member sees the Apps list only and the server refuses every management request",
"foundation: an account without the add-ons feature gets no apps and no code on any node",
"foundation: an administrator manages through a frontend and the change is the owner's",
"foundation: deep links of the add-on page work behind a proxy path prefix on a non-owner frontend",
"foundation: a session ended through one frontend is refused for add-on assets by the other servers"
]
},
"tables-databases": {
"kind": "ginkgo",
"commands": [
[
"go",
"test",
"-count=1",
"-p",
"2",
"-tags",
"auth",
"./addons/tables/internal/store",
"-ginkgo.json-report=../../../../.cache/addons/logs/tables-databases-store.json"
],
[
"go",
"test",
"-count=1",
"-p",
"2",
"-tags",
"auth",
"./tests/addons/tables",
"-ginkgo.json-report=../../../.cache/addons/logs/tables-databases.json"
]
],
"report": ".cache/addons/logs/tables-databases-store.json",
"reports": [
{
"path": ".cache/addons/logs/tables-databases-store.json",
"cases": [
"enforces the size cap on every connection and fails with a typed capacity error",
"builds a database under a data directory containing percent, question and hash characters",
"leaves no change and no receipt when the process dies before commit, and the ID can still apply",
"finds the committed receipt after a crash between commit and reply and never applies twice",
"replays one operation ID to one receipt and refuses another request under the same ID",
"applies one change once when the same operation arrives concurrently",
"keeps a rejected change out of the receipts so its ID is not burnt",
"encodes the receipt payload so the host can read what changed",
"creates, renames and drops tables with stable internal identifiers and one revision step each",
"adds typed columns, renames them without touching identifiers and never uses a label in SQL",
"validates labels by length, characters and case-insensitive uniqueness",
"refuses type changes, unknown operations, expressions and unknown types",
"encodes typed defaults as literals and survives hostile defaults",
"enforces required columns and refuses unique defaults that would collide",
"adds a unique column through a unique index and refuses duplicates atomically",
"drops a column by rebuilding the table and loses exactly what the preview reported",
"never hands out a row ID again after a column drop rebuilds the table",
"keeps the row ID counter when a column drop rebuilds a table emptied by deletes",
"leaves the original table, data and revision intact when a rebuild fails midway",
"previews exact effects and dependent data loss and changes nothing",
"refuses a stale expected revision with the current revision and applies nothing",
"keeps finite limits on tables and columns",
"migrates a database made before the catalog existed on its first schema change",
"inserts bound rows atomically with defaults, required and unique checks",
"updates by explicit IDs and by filter and bumps only the data revision",
"deletes by IDs or filter and refuses broad, empty or oversized selections",
"previews exact count, sample and conflicts without changing anything",
"refuses a changed revision and never re-evaluates a filter against new rows",
"applies exactly one of two proposals made on the same revision",
"replays a row operation by ID and refuses another request under the same ID",
"leaves no change when the process dies before commit and finds the receipt after commit",
"reserves the row id label so no column can shadow it",
"keeps a row table's data across a column drop that rebuilds it",
"reads selected columns with stable row IDs and typed JSON values",
"filters with bounded AND/OR trees and every operator, matching a reference evaluator on random trees",
"escapes LIKE wildcards in text filters",
"keeps NULL semantics: comparisons never match NULL and is-null finds it",
"sorts with a stable row ID tie-break and pages through a cursor that stops at a revision change",
"counts, sums, averages and bounds groups of aggregates",
"reports a real sum or average that overflows as the typed arithmetic error",
"never lets a label, operator or value reach SQL as text",
"honours hard limits on page size, filter depth, conditions, in-lists, sort keys and result bytes",
"stops a query when the context is cancelled or the deadline passes",
"encodes all five types as JSON and writes 64-bit integers as strings beyond 2^53",
"orders datetimes chronologically across fractional seconds and offsets",
"creates one private WAL database file named by the host resource ID",
"never lets an opaque ID or a name reach outside the storage directory",
"refuses a symbolic link as storage directory, database file or ledger",
"is idempotent by operation ID and never creates a second database",
"serializes concurrent creation of one operation into one database",
"recovers creation after a crash on either side of the file, and hides half-built files",
"renames only the named database and replays a renamed operation without effect",
"reports an unknown database and creates nothing for it",
"honours the busy timeout and the per-operation deadline, then succeeds once the lock is gone",
"encodes its receipts so the host can read them",
"writes a header and one record per row with RFC 4180 quoting, UTF-8 and the documented value forms",
"prefixes text cells and labels that a spreadsheet would run, never numbers",
"honours columns, the row identifier column, filter, sort and the row limit of the query",
"reads one snapshot: writes that commit while the export streams are not in it, and are not blocked by it",
"streams a large table row by row with bounded memory",
"fails cleanly past the row or byte bound and keeps the bound finite by default",
"stops on cancellation, on its deadline and on a failing destination, and reports each",
"does not change the database it reads",
"records the current format of a new store and migrates nothing",
"migrates every database in its own transaction, records the version last and repeats as a no-op",
"leaves a database whose step fails exactly as it was and resumes on the next run",
"refuses data in a newer format, a downgrade and a version it has no path to, and writes nothing",
"leaves no pending line for a change the add-on refused, so the same ID applies the corrected request"
]
},
{
"path": ".cache/addons/logs/tables-databases.json",
"cases": [
"starts the real executable through the authenticated handshake and refuses unauthenticated callers",
"creates a database under the host-assigned ID and lists it only for people who may read it",
"drops the reservation when the addon refuses the name, and leaves no database",
"drops a reservation at reconcile when the crash came before the database was created",
"commits a reservation at reconcile when the crash came after the database was created",
"never exposes a database that has no host record",
"renames one database by operation, replays safely, and leaves every other database alone",
"rejects an undeclared tool, a forged addon binding and an unknown resource",
"keeps databases and operation receipts across an addon restart",
"fails closed when the addon cannot answer, and drops only for an addon that is not installed",
"creates a database from a chat proposal that only the proposer's session confirms",
"settles reservations at bootstrap by asking the real addon and keeps those of pending proposals",
"reads and mutates rows with the exact preview, refuses wrong actions and keeps receipts across a restart",
"declares the row tools and refuses a row tool the manifest does not name",
"changes the schema as the owner, shows data loss in the preview and refuses an editor at the host and the addon",
"rejects a stale schema revision, replays an operation and keeps receipts across a restart",
"declares the schema tools and refuses any schema tool the manifest does not name",
"applies row changes only on the proposer's confirmation and rejects a proposal whose database moved",
"offers the manifest tools to a permitted user and nothing to a user without the feature or after revocation",
"stores every change as a pending proposal and applies it only on the proposer's own session, exactly once",
"keeps the roles of the host for tool calls and rejects forged fields before the owner sees them",
"lists at most the bound of pending proposals and refuses more than the user's quota"
]
}
],
"cases": [
"enforces the size cap on every connection and fails with a typed capacity error",
"builds a database under a data directory containing percent, question and hash characters",
"leaves no change and no receipt when the process dies before commit, and the ID can still apply",
"finds the committed receipt after a crash between commit and reply and never applies twice",
"replays one operation ID to one receipt and refuses another request under the same ID",
"applies one change once when the same operation arrives concurrently",
"keeps a rejected change out of the receipts so its ID is not burnt",
"encodes the receipt payload so the host can read what changed",
"creates, renames and drops tables with stable internal identifiers and one revision step each",
"adds typed columns, renames them without touching identifiers and never uses a label in SQL",
"validates labels by length, characters and case-insensitive uniqueness",
"refuses type changes, unknown operations, expressions and unknown types",
"encodes typed defaults as literals and survives hostile defaults",
"enforces required columns and refuses unique defaults that would collide",
"adds a unique column through a unique index and refuses duplicates atomically",
"drops a column by rebuilding the table and loses exactly what the preview reported",
"never hands out a row ID again after a column drop rebuilds the table",
"keeps the row ID counter when a column drop rebuilds a table emptied by deletes",
"leaves the original table, data and revision intact when a rebuild fails midway",
"previews exact effects and dependent data loss and changes nothing",
"refuses a stale expected revision with the current revision and applies nothing",
"keeps finite limits on tables and columns",
"migrates a database made before the catalog existed on its first schema change",
"inserts bound rows atomically with defaults, required and unique checks",
"updates by explicit IDs and by filter and bumps only the data revision",
"deletes by IDs or filter and refuses broad, empty or oversized selections",
"previews exact count, sample and conflicts without changing anything",
"refuses a changed revision and never re-evaluates a filter against new rows",
"applies exactly one of two proposals made on the same revision",
"replays a row operation by ID and refuses another request under the same ID",
"leaves no change when the process dies before commit and finds the receipt after commit",
"reserves the row id label so no column can shadow it",
"keeps a row table's data across a column drop that rebuilds it",
"reads selected columns with stable row IDs and typed JSON values",
"filters with bounded AND/OR trees and every operator, matching a reference evaluator on random trees",
"escapes LIKE wildcards in text filters",
"keeps NULL semantics: comparisons never match NULL and is-null finds it",
"sorts with a stable row ID tie-break and pages through a cursor that stops at a revision change",
"counts, sums, averages and bounds groups of aggregates",
"reports a real sum or average that overflows as the typed arithmetic error",
"never lets a label, operator or value reach SQL as text",
"honours hard limits on page size, filter depth, conditions, in-lists, sort keys and result bytes",
"stops a query when the context is cancelled or the deadline passes",
"encodes all five types as JSON and writes 64-bit integers as strings beyond 2^53",
"orders datetimes chronologically across fractional seconds and offsets",
"creates one private WAL database file named by the host resource ID",
"never lets an opaque ID or a name reach outside the storage directory",
"refuses a symbolic link as storage directory, database file or ledger",
"is idempotent by operation ID and never creates a second database",
"serializes concurrent creation of one operation into one database",
"recovers creation after a crash on either side of the file, and hides half-built files",
"renames only the named database and replays a renamed operation without effect",
"reports an unknown database and creates nothing for it",
"honours the busy timeout and the per-operation deadline, then succeeds once the lock is gone",
"encodes its receipts so the host can read them",
"writes a header and one record per row with RFC 4180 quoting, UTF-8 and the documented value forms",
"prefixes text cells and labels that a spreadsheet would run, never numbers",
"honours columns, the row identifier column, filter, sort and the row limit of the query",
"reads one snapshot: writes that commit while the export streams are not in it, and are not blocked by it",
"streams a large table row by row with bounded memory",
"fails cleanly past the row or byte bound and keeps the bound finite by default",
"stops on cancellation, on its deadline and on a failing destination, and reports each",
"does not change the database it reads",
"records the current format of a new store and migrates nothing",
"migrates every database in its own transaction, records the version last and repeats as a no-op",
"leaves a database whose step fails exactly as it was and resumes on the next run",
"refuses data in a newer format, a downgrade and a version it has no path to, and writes nothing",
"leaves no pending line for a change the add-on refused, so the same ID applies the corrected request",
"starts the real executable through the authenticated handshake and refuses unauthenticated callers",
"creates a database under the host-assigned ID and lists it only for people who may read it",
"drops the reservation when the addon refuses the name, and leaves no database",
"drops a reservation at reconcile when the crash came before the database was created",
"commits a reservation at reconcile when the crash came after the database was created",
"never exposes a database that has no host record",
"renames one database by operation, replays safely, and leaves every other database alone",
"rejects an undeclared tool, a forged addon binding and an unknown resource",
"keeps databases and operation receipts across an addon restart",
"fails closed when the addon cannot answer, and drops only for an addon that is not installed",
"creates a database from a chat proposal that only the proposer's session confirms",
"settles reservations at bootstrap by asking the real addon and keeps those of pending proposals",
"reads and mutates rows with the exact preview, refuses wrong actions and keeps receipts across a restart",
"declares the row tools and refuses a row tool the manifest does not name",
"changes the schema as the owner, shows data loss in the preview and refuses an editor at the host and the addon",
"rejects a stale schema revision, replays an operation and keeps receipts across a restart",
"declares the schema tools and refuses any schema tool the manifest does not name",
"applies row changes only on the proposer's confirmation and rejects a proposal whose database moved",
"offers the manifest tools to a permitted user and nothing to a user without the feature or after revocation",
"stores every change as a pending proposal and applies it only on the proposer's own session, exactly once",
"keeps the roles of the host for tool calls and rejects forged fields before the owner sees them",
"lists at most the bound of pending proposals and refuses more than the user's quota"
]
},
"tables-schema": {
"kind": "ginkgo",
"commands": [
[
"go",
"test",
"-count=1",
"-p",
"2",
"-tags",
"auth",
"./addons/tables/internal/store",
"-ginkgo.json-report=../../../../.cache/addons/logs/tables-schema-store.json"
],
[
"go",
"test",
"-count=1",
"-p",
"2",
"-tags",
"auth",
"./tests/addons/tables",
"-ginkgo.json-report=../../../.cache/addons/logs/tables-schema.json"
]
],
"report": ".cache/addons/logs/tables-schema-store.json",
"reports": [
{
"path": ".cache/addons/logs/tables-schema-store.json",
"cases": [
"enforces the size cap on every connection and fails with a typed capacity error",
"builds a database under a data directory containing percent, question and hash characters",
"leaves no change and no receipt when the process dies before commit, and the ID can still apply",
"finds the committed receipt after a crash between commit and reply and never applies twice",
"replays one operation ID to one receipt and refuses another request under the same ID",
"applies one change once when the same operation arrives concurrently",
"keeps a rejected change out of the receipts so its ID is not burnt",
"encodes the receipt payload so the host can read what changed",
"creates, renames and drops tables with stable internal identifiers and one revision step each",
"adds typed columns, renames them without touching identifiers and never uses a label in SQL",
"validates labels by length, characters and case-insensitive uniqueness",
"refuses type changes, unknown operations, expressions and unknown types",
"encodes typed defaults as literals and survives hostile defaults",
"enforces required columns and refuses unique defaults that would collide",
"adds a unique column through a unique index and refuses duplicates atomically",
"drops a column by rebuilding the table and loses exactly what the preview reported",
"never hands out a row ID again after a column drop rebuilds the table",
"keeps the row ID counter when a column drop rebuilds a table emptied by deletes",
"leaves the original table, data and revision intact when a rebuild fails midway",
"previews exact effects and dependent data loss and changes nothing",
"refuses a stale expected revision with the current revision and applies nothing",
"keeps finite limits on tables and columns",
"migrates a database made before the catalog existed on its first schema change",
"inserts bound rows atomically with defaults, required and unique checks",
"updates by explicit IDs and by filter and bumps only the data revision",
"deletes by IDs or filter and refuses broad, empty or oversized selections",
"previews exact count, sample and conflicts without changing anything",
"refuses a changed revision and never re-evaluates a filter against new rows",
"applies exactly one of two proposals made on the same revision",
"replays a row operation by ID and refuses another request under the same ID",
"leaves no change when the process dies before commit and finds the receipt after commit",
"reserves the row id label so no column can shadow it",
"keeps a row table's data across a column drop that rebuilds it",
"reads selected columns with stable row IDs and typed JSON values",
"filters with bounded AND/OR trees and every operator, matching a reference evaluator on random trees",
"escapes LIKE wildcards in text filters",
"keeps NULL semantics: comparisons never match NULL and is-null finds it",
"sorts with a stable row ID tie-break and pages through a cursor that stops at a revision change",
"counts, sums, averages and bounds groups of aggregates",
"reports a real sum or average that overflows as the typed arithmetic error",
"never lets a label, operator or value reach SQL as text",
"honours hard limits on page size, filter depth, conditions, in-lists, sort keys and result bytes",
"stops a query when the context is cancelled or the deadline passes",
"encodes all five types as JSON and writes 64-bit integers as strings beyond 2^53",
"orders datetimes chronologically across fractional seconds and offsets",
"creates one private WAL database file named by the host resource ID",
"never lets an opaque ID or a name reach outside the storage directory",
"refuses a symbolic link as storage directory, database file or ledger",
"is idempotent by operation ID and never creates a second database",
"serializes concurrent creation of one operation into one database",
"recovers creation after a crash on either side of the file, and hides half-built files",
"renames only the named database and replays a renamed operation without effect",
"reports an unknown database and creates nothing for it",
"honours the busy timeout and the per-operation deadline, then succeeds once the lock is gone",
"encodes its receipts so the host can read them",
"writes a header and one record per row with RFC 4180 quoting, UTF-8 and the documented value forms",
"prefixes text cells and labels that a spreadsheet would run, never numbers",
"honours columns, the row identifier column, filter, sort and the row limit of the query",
"reads one snapshot: writes that commit while the export streams are not in it, and are not blocked by it",
"streams a large table row by row with bounded memory",
"fails cleanly past the row or byte bound and keeps the bound finite by default",
"stops on cancellation, on its deadline and on a failing destination, and reports each",
"does not change the database it reads",
"records the current format of a new store and migrates nothing",
"migrates every database in its own transaction, records the version last and repeats as a no-op",
"leaves a database whose step fails exactly as it was and resumes on the next run",
"refuses data in a newer format, a downgrade and a version it has no path to, and writes nothing",
"leaves no pending line for a change the add-on refused, so the same ID applies the corrected request"
]
},
{
"path": ".cache/addons/logs/tables-schema.json",
"cases": [
"starts the real executable through the authenticated handshake and refuses unauthenticated callers",
"creates a database under the host-assigned ID and lists it only for people who may read it",
"drops the reservation when the addon refuses the name, and leaves no database",
"drops a reservation at reconcile when the crash came before the database was created",
"commits a reservation at reconcile when the crash came after the database was created",
"never exposes a database that has no host record",
"renames one database by operation, replays safely, and leaves every other database alone",
"rejects an undeclared tool, a forged addon binding and an unknown resource",
"keeps databases and operation receipts across an addon restart",
"fails closed when the addon cannot answer, and drops only for an addon that is not installed",
"creates a database from a chat proposal that only the proposer's session confirms",
"settles reservations at bootstrap by asking the real addon and keeps those of pending proposals",
"reads and mutates rows with the exact preview, refuses wrong actions and keeps receipts across a restart",
"declares the row tools and refuses a row tool the manifest does not name",
"changes the schema as the owner, shows data loss in the preview and refuses an editor at the host and the addon",
"rejects a stale schema revision, replays an operation and keeps receipts across a restart",
"declares the schema tools and refuses any schema tool the manifest does not name",
"applies row changes only on the proposer's confirmation and rejects a proposal whose database moved",
"offers the manifest tools to a permitted user and nothing to a user without the feature or after revocation",
"stores every change as a pending proposal and applies it only on the proposer's own session, exactly once",
"keeps the roles of the host for tool calls and rejects forged fields before the owner sees them",
"lists at most the bound of pending proposals and refuses more than the user's quota"
]
}
],
"cases": [
"enforces the size cap on every connection and fails with a typed capacity error",
"builds a database under a data directory containing percent, question and hash characters",
"leaves no change and no receipt when the process dies before commit, and the ID can still apply",
"finds the committed receipt after a crash between commit and reply and never applies twice",
"replays one operation ID to one receipt and refuses another request under the same ID",
"applies one change once when the same operation arrives concurrently",
"keeps a rejected change out of the receipts so its ID is not burnt",
"encodes the receipt payload so the host can read what changed",
"creates, renames and drops tables with stable internal identifiers and one revision step each",
"adds typed columns, renames them without touching identifiers and never uses a label in SQL",
"validates labels by length, characters and case-insensitive uniqueness",
"refuses type changes, unknown operations, expressions and unknown types",
"encodes typed defaults as literals and survives hostile defaults",
"enforces required columns and refuses unique defaults that would collide",
"adds a unique column through a unique index and refuses duplicates atomically",
"drops a column by rebuilding the table and loses exactly what the preview reported",
"never hands out a row ID again after a column drop rebuilds the table",
"keeps the row ID counter when a column drop rebuilds a table emptied by deletes",
"leaves the original table, data and revision intact when a rebuild fails midway",
"previews exact effects and dependent data loss and changes nothing",
"refuses a stale expected revision with the current revision and applies nothing",
"keeps finite limits on tables and columns",
"migrates a database made before the catalog existed on its first schema change",
"inserts bound rows atomically with defaults, required and unique checks",
"updates by explicit IDs and by filter and bumps only the data revision",
"deletes by IDs or filter and refuses broad, empty or oversized selections",
"previews exact count, sample and conflicts without changing anything",
"refuses a changed revision and never re-evaluates a filter against new rows",
"applies exactly one of two proposals made on the same revision",
"replays a row operation by ID and refuses another request under the same ID",
"leaves no change when the process dies before commit and finds the receipt after commit",
"reserves the row id label so no column can shadow it",
"keeps a row table's data across a column drop that rebuilds it",
"reads selected columns with stable row IDs and typed JSON values",
"filters with bounded AND/OR trees and every operator, matching a reference evaluator on random trees",
"escapes LIKE wildcards in text filters",
"keeps NULL semantics: comparisons never match NULL and is-null finds it",
"sorts with a stable row ID tie-break and pages through a cursor that stops at a revision change",
"counts, sums, averages and bounds groups of aggregates",
"reports a real sum or average that overflows as the typed arithmetic error",
"never lets a label, operator or value reach SQL as text",
"honours hard limits on page size, filter depth, conditions, in-lists, sort keys and result bytes",
"stops a query when the context is cancelled or the deadline passes",
"encodes all five types as JSON and writes 64-bit integers as strings beyond 2^53",
"orders datetimes chronologically across fractional seconds and offsets",
"creates one private WAL database file named by the host resource ID",
"never lets an opaque ID or a name reach outside the storage directory",
"refuses a symbolic link as storage directory, database file or ledger",
"is idempotent by operation ID and never creates a second database",
"serializes concurrent creation of one operation into one database",
"recovers creation after a crash on either side of the file, and hides half-built files",
"renames only the named database and replays a renamed operation without effect",
"reports an unknown database and creates nothing for it",
"honours the busy timeout and the per-operation deadline, then succeeds once the lock is gone",
"encodes its receipts so the host can read them",
"writes a header and one record per row with RFC 4180 quoting, UTF-8 and the documented value forms",
"prefixes text cells and labels that a spreadsheet would run, never numbers",
"honours columns, the row identifier column, filter, sort and the row limit of the query",
"reads one snapshot: writes that commit while the export streams are not in it, and are not blocked by it",
"streams a large table row by row with bounded memory",
"fails cleanly past the row or byte bound and keeps the bound finite by default",
"stops on cancellation, on its deadline and on a failing destination, and reports each",
"does not change the database it reads",
"records the current format of a new store and migrates nothing",
"migrates every database in its own transaction, records the version last and repeats as a no-op",
"leaves a database whose step fails exactly as it was and resumes on the next run",
"refuses data in a newer format, a downgrade and a version it has no path to, and writes nothing",
"leaves no pending line for a change the add-on refused, so the same ID applies the corrected request",
"starts the real executable through the authenticated handshake and refuses unauthenticated callers",
"creates a database under the host-assigned ID and lists it only for people who may read it",
"drops the reservation when the addon refuses the name, and leaves no database",
"drops a reservation at reconcile when the crash came before the database was created",
"commits a reservation at reconcile when the crash came after the database was created",
"never exposes a database that has no host record",
"renames one database by operation, replays safely, and leaves every other database alone",
"rejects an undeclared tool, a forged addon binding and an unknown resource",
"keeps databases and operation receipts across an addon restart",
"fails closed when the addon cannot answer, and drops only for an addon that is not installed",
"creates a database from a chat proposal that only the proposer's session confirms",
"settles reservations at bootstrap by asking the real addon and keeps those of pending proposals",
"reads and mutates rows with the exact preview, refuses wrong actions and keeps receipts across a restart",
"declares the row tools and refuses a row tool the manifest does not name",
"changes the schema as the owner, shows data loss in the preview and refuses an editor at the host and the addon",
"rejects a stale schema revision, replays an operation and keeps receipts across a restart",
"declares the schema tools and refuses any schema tool the manifest does not name",
"applies row changes only on the proposer's confirmation and rejects a proposal whose database moved",
"offers the manifest tools to a permitted user and nothing to a user without the feature or after revocation",
"stores every change as a pending proposal and applies it only on the proposer's own session, exactly once",
"keeps the roles of the host for tool calls and rejects forged fields before the owner sees them",
"lists at most the bound of pending proposals and refuses more than the user's quota"
]
},
"tables-rows": {
"kind": "ginkgo",
"commands": [
[
"go",
"test",
"-count=1",
"-p",
"2",
"-tags",
"auth",
"./addons/tables/internal/store",
"-ginkgo.json-report=../../../../.cache/addons/logs/tables-rows-store.json"
],
[
"go",
"test",
"-count=1",
"-p",
"2",
"-tags",
"auth",
"./tests/addons/tables",
"-ginkgo.json-report=../../../.cache/addons/logs/tables-rows.json"
]
],
"report": ".cache/addons/logs/tables-rows-store.json",
"reports": [
{
"path": ".cache/addons/logs/tables-rows-store.json",
"cases": [
"enforces the size cap on every connection and fails with a typed capacity error",
"builds a database under a data directory containing percent, question and hash characters",
"leaves no change and no receipt when the process dies before commit, and the ID can still apply",
"finds the committed receipt after a crash between commit and reply and never applies twice",
"replays one operation ID to one receipt and refuses another request under the same ID",
"applies one change once when the same operation arrives concurrently",
"keeps a rejected change out of the receipts so its ID is not burnt",
"encodes the receipt payload so the host can read what changed",
"creates, renames and drops tables with stable internal identifiers and one revision step each",
"adds typed columns, renames them without touching identifiers and never uses a label in SQL",
"validates labels by length, characters and case-insensitive uniqueness",
"refuses type changes, unknown operations, expressions and unknown types",
"encodes typed defaults as literals and survives hostile defaults",
"enforces required columns and refuses unique defaults that would collide",
"adds a unique column through a unique index and refuses duplicates atomically",
"drops a column by rebuilding the table and loses exactly what the preview reported",
"never hands out a row ID again after a column drop rebuilds the table",
"keeps the row ID counter when a column drop rebuilds a table emptied by deletes",
"leaves the original table, data and revision intact when a rebuild fails midway",
"previews exact effects and dependent data loss and changes nothing",
"refuses a stale expected revision with the current revision and applies nothing",
"keeps finite limits on tables and columns",
"migrates a database made before the catalog existed on its first schema change",
"inserts bound rows atomically with defaults, required and unique checks",
"updates by explicit IDs and by filter and bumps only the data revision",
"deletes by IDs or filter and refuses broad, empty or oversized selections",
"previews exact count, sample and conflicts without changing anything",
"refuses a changed revision and never re-evaluates a filter against new rows",
"applies exactly one of two proposals made on the same revision",
"replays a row operation by ID and refuses another request under the same ID",
"leaves no change when the process dies before commit and finds the receipt after commit",
"reserves the row id label so no column can shadow it",
"keeps a row table's data across a column drop that rebuilds it",
"reads selected columns with stable row IDs and typed JSON values",
"filters with bounded AND/OR trees and every operator, matching a reference evaluator on random trees",
"escapes LIKE wildcards in text filters",
"keeps NULL semantics: comparisons never match NULL and is-null finds it",
"sorts with a stable row ID tie-break and pages through a cursor that stops at a revision change",
"counts, sums, averages and bounds groups of aggregates",
"reports a real sum or average that overflows as the typed arithmetic error",
"never lets a label, operator or value reach SQL as text",
"honours hard limits on page size, filter depth, conditions, in-lists, sort keys and result bytes",
"stops a query when the context is cancelled or the deadline passes",
"encodes all five types as JSON and writes 64-bit integers as strings beyond 2^53",
"orders datetimes chronologically across fractional seconds and offsets",
"creates one private WAL database file named by the host resource ID",
"never lets an opaque ID or a name reach outside the storage directory",
"refuses a symbolic link as storage directory, database file or ledger",
"is idempotent by operation ID and never creates a second database",
"serializes concurrent creation of one operation into one database",
"recovers creation after a crash on either side of the file, and hides half-built files",
"renames only the named database and replays a renamed operation without effect",
"reports an unknown database and creates nothing for it",
"honours the busy timeout and the per-operation deadline, then succeeds once the lock is gone",
"encodes its receipts so the host can read them",
"writes a header and one record per row with RFC 4180 quoting, UTF-8 and the documented value forms",
"prefixes text cells and labels that a spreadsheet would run, never numbers",
"honours columns, the row identifier column, filter, sort and the row limit of the query",
"reads one snapshot: writes that commit while the export streams are not in it, and are not blocked by it",
"streams a large table row by row with bounded memory",
"fails cleanly past the row or byte bound and keeps the bound finite by default",
"stops on cancellation, on its deadline and on a failing destination, and reports each",
"does not change the database it reads",
"records the current format of a new store and migrates nothing",
"migrates every database in its own transaction, records the version last and repeats as a no-op",
"leaves a database whose step fails exactly as it was and resumes on the next run",
"refuses data in a newer format, a downgrade and a version it has no path to, and writes nothing",
"leaves no pending line for a change the add-on refused, so the same ID applies the corrected request"
]
},
{
"path": ".cache/addons/logs/tables-rows.json",
"cases": [
"starts the real executable through the authenticated handshake and refuses unauthenticated callers",
"creates a database under the host-assigned ID and lists it only for people who may read it",
"drops the reservation when the addon refuses the name, and leaves no database",
"drops a reservation at reconcile when the crash came before the database was created",
"commits a reservation at reconcile when the crash came after the database was created",
"never exposes a database that has no host record",
"renames one database by operation, replays safely, and leaves every other database alone",
"rejects an undeclared tool, a forged addon binding and an unknown resource",
"keeps databases and operation receipts across an addon restart",
"fails closed when the addon cannot answer, and drops only for an addon that is not installed",
"creates a database from a chat proposal that only the proposer's session confirms",
"settles reservations at bootstrap by asking the real addon and keeps those of pending proposals",
"reads and mutates rows with the exact preview, refuses wrong actions and keeps receipts across a restart",
"declares the row tools and refuses a row tool the manifest does not name",
"changes the schema as the owner, shows data loss in the preview and refuses an editor at the host and the addon",
"rejects a stale schema revision, replays an operation and keeps receipts across a restart",
"declares the schema tools and refuses any schema tool the manifest does not name",
"applies row changes only on the proposer's confirmation and rejects a proposal whose database moved",
"offers the manifest tools to a permitted user and nothing to a user without the feature or after revocation",
"stores every change as a pending proposal and applies it only on the proposer's own session, exactly once",
"keeps the roles of the host for tool calls and rejects forged fields before the owner sees them",
"lists at most the bound of pending proposals and refuses more than the user's quota"
]
}
],
"cases": [
"enforces the size cap on every connection and fails with a typed capacity error",
"builds a database under a data directory containing percent, question and hash characters",
"leaves no change and no receipt when the process dies before commit, and the ID can still apply",
"finds the committed receipt after a crash between commit and reply and never applies twice",
"replays one operation ID to one receipt and refuses another request under the same ID",
"applies one change once when the same operation arrives concurrently",
"keeps a rejected change out of the receipts so its ID is not burnt",
"encodes the receipt payload so the host can read what changed",
"creates, renames and drops tables with stable internal identifiers and one revision step each",
"adds typed columns, renames them without touching identifiers and never uses a label in SQL",
"validates labels by length, characters and case-insensitive uniqueness",
"refuses type changes, unknown operations, expressions and unknown types",
"encodes typed defaults as literals and survives hostile defaults",
"enforces required columns and refuses unique defaults that would collide",
"adds a unique column through a unique index and refuses duplicates atomically",
"drops a column by rebuilding the table and loses exactly what the preview reported",
"never hands out a row ID again after a column drop rebuilds the table",
"keeps the row ID counter when a column drop rebuilds a table emptied by deletes",
"leaves the original table, data and revision intact when a rebuild fails midway",
"previews exact effects and dependent data loss and changes nothing",
"refuses a stale expected revision with the current revision and applies nothing",
"keeps finite limits on tables and columns",
"migrates a database made before the catalog existed on its first schema change",
"inserts bound rows atomically with defaults, required and unique checks",
"updates by explicit IDs and by filter and bumps only the data revision",
"deletes by IDs or filter and refuses broad, empty or oversized selections",
"previews exact count, sample and conflicts without changing anything",
"refuses a changed revision and never re-evaluates a filter against new rows",
"applies exactly one of two proposals made on the same revision",
"replays a row operation by ID and refuses another request under the same ID",
"leaves no change when the process dies before commit and finds the receipt after commit",
"reserves the row id label so no column can shadow it",
"keeps a row table's data across a column drop that rebuilds it",
"reads selected columns with stable row IDs and typed JSON values",
"filters with bounded AND/OR trees and every operator, matching a reference evaluator on random trees",
"escapes LIKE wildcards in text filters",
"keeps NULL semantics: comparisons never match NULL and is-null finds it",
"sorts with a stable row ID tie-break and pages through a cursor that stops at a revision change",
"counts, sums, averages and bounds groups of aggregates",
"reports a real sum or average that overflows as the typed arithmetic error",
"never lets a label, operator or value reach SQL as text",
"honours hard limits on page size, filter depth, conditions, in-lists, sort keys and result bytes",
"stops a query when the context is cancelled or the deadline passes",
"encodes all five types as JSON and writes 64-bit integers as strings beyond 2^53",
"orders datetimes chronologically across fractional seconds and offsets",
"creates one private WAL database file named by the host resource ID",
"never lets an opaque ID or a name reach outside the storage directory",
"refuses a symbolic link as storage directory, database file or ledger",
"is idempotent by operation ID and never creates a second database",
"serializes concurrent creation of one operation into one database",
"recovers creation after a crash on either side of the file, and hides half-built files",
"renames only the named database and replays a renamed operation without effect",
"reports an unknown database and creates nothing for it",
"honours the busy timeout and the per-operation deadline, then succeeds once the lock is gone",
"encodes its receipts so the host can read them",
"writes a header and one record per row with RFC 4180 quoting, UTF-8 and the documented value forms",
"prefixes text cells and labels that a spreadsheet would run, never numbers",
"honours columns, the row identifier column, filter, sort and the row limit of the query",
"reads one snapshot: writes that commit while the export streams are not in it, and are not blocked by it",
"streams a large table row by row with bounded memory",
"fails cleanly past the row or byte bound and keeps the bound finite by default",
"stops on cancellation, on its deadline and on a failing destination, and reports each",
"does not change the database it reads",
"records the current format of a new store and migrates nothing",
"migrates every database in its own transaction, records the version last and repeats as a no-op",
"leaves a database whose step fails exactly as it was and resumes on the next run",
"refuses data in a newer format, a downgrade and a version it has no path to, and writes nothing",
"leaves no pending line for a change the add-on refused, so the same ID applies the corrected request",
"starts the real executable through the authenticated handshake and refuses unauthenticated callers",
"creates a database under the host-assigned ID and lists it only for people who may read it",
"drops the reservation when the addon refuses the name, and leaves no database",
"drops a reservation at reconcile when the crash came before the database was created",
"commits a reservation at reconcile when the crash came after the database was created",
"never exposes a database that has no host record",
"renames one database by operation, replays safely, and leaves every other database alone",
"rejects an undeclared tool, a forged addon binding and an unknown resource",
"keeps databases and operation receipts across an addon restart",
"fails closed when the addon cannot answer, and drops only for an addon that is not installed",
"creates a database from a chat proposal that only the proposer's session confirms",
"settles reservations at bootstrap by asking the real addon and keeps those of pending proposals",
"reads and mutates rows with the exact preview, refuses wrong actions and keeps receipts across a restart",
"declares the row tools and refuses a row tool the manifest does not name",
"changes the schema as the owner, shows data loss in the preview and refuses an editor at the host and the addon",
"rejects a stale schema revision, replays an operation and keeps receipts across a restart",
"declares the schema tools and refuses any schema tool the manifest does not name",
"applies row changes only on the proposer's confirmation and rejects a proposal whose database moved",
"offers the manifest tools to a permitted user and nothing to a user without the feature or after revocation",
"stores every change as a pending proposal and applies it only on the proposer's own session, exactly once",
"keeps the roles of the host for tool calls and rejects forged fields before the owner sees them",
"lists at most the bound of pending proposals and refuses more than the user's quota"
]
},
"tables-tools": {
"kind": "shell",
"commands": [
[
"sh",
"scripts/addons/tables_tools.sh"
]
],
"cases": [
"unit: tools: the namespace is the brokered add-on tool names only",
"unit: tools: a proposal result of an add-on tool gives its identifier and nothing else",
"unit: tools: other kinds, other tools and malformed identifiers give no card",
"unit: tools: the stored history keeps the reference of a proposal and no row data",
"unit: tools: the card facts come from the stored proposal and never from model text",
"unit: tools: stale, expired, blocked and settled proposals cannot be decided",
"unit: tools: a confirmation names the displayed proposal and its digest and nothing a model supplied",
"unit: tools: the add-on tools switch is offered only when an add-on offers tools",
"go: accepts the Tables definitions and classifies every model-facing tool",
"go: keeps the schema bytes of a parsed manifest equal to what the runtime echoes back",
"go: rejects a definition that declares an identity, role, approval or operation property",
"go: rejects an undeclared tool, a repeated tool, an unknown kind and a missing or unbounded schema",
"go: binds one actor to an executor and serves tools through the broker only",
"go: refuses to bind an executor when the owner denies the actor",
"go: routes the add-on namespace to the broker and never to another executor",
"go: never offers or runs a tool of an MCP session under the add-on namespace",
"go: reads the opt-in once and answers a surface that has no broker with a typed rejection",
"go: takes the actor from the trusted request context only",
"go: classifies every source file that discovers or executes tools",
"go: flags source that hands sessions to the agent library without the namespace filter",
"go: installs the namespace filter wherever sessions reach the agent library",
"go: does not offer a session tool of the add-on namespace to the job model",
"go: names a reason and an enforcement for every rejection and an actor for every route, with real files",
"go: keeps the table of the Tables documentation in step with the matrix",
"go: lets only the brokered consumers import the adapter",
"go: has no add-on tool and no add-on route in the admin assistant catalog",
"go: discovers namespaced tools with schemas from the manifest for enabled running addons only",
"go: offers nothing for a disabled, stopped or failed addon and nothing when the owner cannot answer",
"go: has no tool for sharing, deleting a database, purging retained data or approving",
"go: drops a definition whose namespaced name is not a valid function name or does not fit",
"go: reads through the gateway with the immutable actor, the listed generation and the resource taken out of the arguments",
"go: refuses an oversized result instead of truncating it",
"go: returns file results as private artifact references with no bytes",
"go: passes a denial, an outage and an unknown outcome through unchanged",
"go: turns a row change into a proposal reference and never applies",
"go: proposes schema changes under the schema action and creation with no resource",
"go: gives every call its own operation ID so one call can never replay another",
"go: reports a proposal outage with the typed error and no reference",
"go: rejects forged identity, role, approval and operation fields before anything reaches the owner",
"go: rejects approval aliases, undefined tools and names outside the namespace",
"go: rejects arguments that are not exactly one bounded object with known, typed properties",
"go: has no way to confirm, cancel or resolve a proposal",
"go: uses the actor of each call and nothing a previous call left behind",
"go: refuses an actor without a user or credential before any call",
"go: serves the real gateway type as its backend",
"go: lists the caller's own pending proposals the same from the owner and every forwarding frontend",
"go: offers the manifest tools to a permitted user and nothing to a user without the feature or after revocation",
"go: stores every change as a pending proposal and applies it only on the proposer's own session, exactly once",
"go: keeps the roles of the host for tool calls and rejects forged fields before the owner sees them",
"go: lists at most the bound of pending proposals and refuses more than the user's quota",
"proposals: a tool call in chat stores a pending proposal and the card shows the host record, not the model text",
"proposals: confirming in the card applies the change exactly once and a repeat returns the stored receipt",
"proposals: row changes show the exact count and a bounded sample, and nothing changes until the person confirms",
"proposals: cancel withdraws the proposal and nothing is applied",
"proposals: an expired proposal is disabled in the card and the host refuses a late confirmation",
"proposals: forged fields and approval names in a tool call create no proposal",
"proposals: a user whose add-ons feature is withdrawn sees no data and the host answers no",
"proposals: logging out clears the card and leaves no data in the stored conversation",
"go: gives the model an error result that says the request was invalid, for a read and for a change",
"go: keeps an outage an error, never the refused result"
]
},
"tables-admin": {
"kind": "ginkgo",
"commands": [
[
"go",
"test",
"-count=1",
"-p",
"2",
"-tags",
"auth",
"./tests/addons/tablesadmin",
"-ginkgo.json-report=../../../.cache/addons/logs/tables-admin.json"
]
],
"report": ".cache/addons/logs/tables-admin.json",
"cases": [
"keys a reference by user, conversation and add-on, bounds it per user and in total and expires what is unused",
"is durable, held by one process, never resets a corrupt file and stops writing after a failed sync",
"serves concurrent users without losing a reference",
"keeps the newest bounded number, validates them on load and remaps them with the owner",
"creates private databases by the person's own action, once per operation, and lists them only for their owner",
"keeps the owner, editor and viewer matrix on the UI routes and shows each person only their own role",
"shares whole databases by immutable account ID behind a bounded picker that tells nothing else",
"keeps sharing disabled in local-owner mode with a typed answer and no named users",
"waits for a revoked user's admitted work and cancels it before acknowledging the revocation",
"answers every typed denial exactly as the owner does and carries every mutation to the owner",
"reports an unknown outcome with the original operation ID and leaves reads plainly unavailable when the owner cannot be reached",
"answers the sharing denial of local-owner mode the same from a frontend",
"deletes the data, the grants and the pending proposals only on the owner's typed confirmation and keeps the add-on installed",
"stops and waits for admitted work of every user before it asks the add-on to delete",
"makes the add-on refuse its delete tool under every action but the host's delete action",
"never offers the delete tool to a model, a proposal, a typed read or an agent",
"denies a stale tab: the generation and the revision the owner saw decide, and nothing is removed",
"finishes or undoes a deletion that a crash interrupted at every step",
"keeps the delete tool out of the model tools and their definitions",
"refuses an admin tool that is also a model tool, has a definition, or is not mapped",
"documents every route, every emitted field and every typed answer in the Swagger spec",
"lists every route in the instructions registry, the feature registry and the documentation, with no MCP tool for any",
"keeps one selection per user, conversation and add-on, across people, conversations and restarts",
"lets a tool call omit the database in a conversation and resolves it at the owner with typed errors",
"withdraws the management and the tool path while the add-on is disabled and restores them on enable",
"answers a revoked, deleted or tampered reference like an unknown database and never reuses it",
"applies schema and row changes under the roles of the host, once per operation, with a receipt and no proposal",
"refuses crafted writes by a viewer, an editor's schema change, a revoked editor and an installation administrator",
"carries a UI change to the owner from a forwarding frontend and answers as the owner does",
"exports a table with exact bytes and attachment headers over real HTTP and shows no one else the file",
"keeps a shared database's file private, applies the person's own filter and sort, and denies after the grant is withdrawn",
"serves the same bytes and headers through a forwarding frontend, and fails the same way for a stranger",
"answers a result past the export limit as data with no file",
"binds an output handle to its operation, person and database",
"fails a truncated, grown or vanished stream and never serves it",
"fails the transfer when the store cannot write, and when the source is revoked before completion",
"expires the file only, enforces the quota per person and leaves the database as it was"
]
},
"tables-ui": {
"kind": "shell",
"commands": [
[
"sh",
"scripts/addons/tables_ui.sh"
]
],
"cases": [
"unit: resources: every call carries this add-on and its generation and nothing the add-on chose",
"unit: resources: an operation identifier chosen by the caller is kept across a retry",
"unit: resources: nothing is sent once the add-on is withdrawn",
"unit: resources: a malformed identifier is refused before any request",
"unit: resources: the request of each call names the route, the method and the own-session confirmation",
"unit: resources: an unknown operation and a body the host did not shape are refused",
"unit: resources: typed answers of the host keep their type for the page",
"unit: resources: the client of a stale answer is told it is stale",
"unit: resources: a typed read names the resource the person chose and the client sends it",
"unit: resources: a typed read always carries an operation identifier the owner accepts",
"unit: resources: the conversation header goes on a chat request that uses add-on tools, and only a well-formed one",
"unit: batch: typed rows become wire rows and an untouched optional column is left to its default",
"unit: batch: every cell error is named by row and column and nothing is sent",
"unit: batch: steps stay inside the add-on bounds",
"unit: batch: the selection toggles by row identifier and survives paging",
"unit: layout: Share is offered only where the installation has named accounts",
"unit: layout: a table with no rows offers Add rows once, in its empty state",
"unit: layout: a reader, or a table with no columns, is offered no Add rows",
"unit: errors: each answer of the host gets its own words and recovery",
"unit: codecs: text keeps what was typed, bounds it, and null is explicit",
"unit: codecs: integers are exact up to 64 bits and never silently rounded",
"unit: codecs: reals are finite numbers",
"unit: codecs: booleans are true, false or empty for an optional column",
"unit: codecs: datetimes are read as UTC and sent as RFC 3339",
"unit: codecs: an unknown column type is refused",
"unit: codecs: the editor round-trips stored values",
"unit: codecs: grid text and the unchanged-field test",
"unit: codecs: a datetime with a fraction of a second is not rewritten by editing another field",
"unit: codecs: datetimes are compared as instants and offsets are normalised",
"unit: filters: operators follow the column type",
"unit: filters: a leaf, a list and the null tests are built from typed values",
"unit: filters: a condition that cannot be sent is an error, never dropped",
"unit: query: the arguments are the tool schema and nothing else",
"unit: query: pages go forward by the add-on cursor and back by the ones kept",
"unit: query: a column header cycles ascending, descending and none",
"unit: i18n: every language of the host has every key of the English bundle and nothing else",
"unit: i18n: a translation keeps the placeholders of the English text and carries no markup",
"unit: build: the bundle is plain JavaScript that names nothing it does not define",
"unit: build: the module exports createAddon and imports nothing",
"unit: render: createAddon returns the page, the declared component, a chat action and dispose",
"unit: render: the list, one database and the picker draw their loading state without a host",
"unit: render: what the page read is emptied when the add-on is withdrawn, by signal and by dispose",
"unit: retry: a read that met an unavailable add-on is tried again and then succeeds",
"unit: retry: it gives the last error back after the bound and never loops",
"unit: retry: a refusal, a stale answer or an unknown outcome is never repeated",
"unit: retry: a withdrawn add-on stops the waiting and the reads",
"go: applies schema and row changes under the roles of the host, once per operation, with a receipt and no proposal",
"go: refuses crafted writes by a viewer, an editor's schema change, a revoked editor and an installation administrator",
"go: carries a UI change to the owner from a forwarding frontend and answers as the owner does",
"tables-ui: a new database is private to its owner and a second person sees nothing of it",
"tables-ui: the owner builds a schema and rows, shares by name and each role gets its own controls",
"tables-ui: typed editors, structured filters, sort, paging and bounded batches work on real rows",
"tables-ui: editing another column leaves a datetime with a fraction of a second byte-identical",
"tables-ui: a revoke while a person is editing denies the next save and the page says it is unavailable",
"tables-ui: an installation administrator sees no database of other people and has no data privilege",
"tables-ui: deleting a database shows the warnings, needs the typed name and removes data and shares",
"tables-ui: a tab of an older generation is denied after an upgrade and after a disable",
"tables-ui: Select database keeps one database for each person and conversation and a tool call uses it",
"tables-ui: the pages work by keyboard, at 400 pixels and in the light and dark themes",
"tables-ui: logging out clears what was read and the next person on the same tab sees none of it",
"tables-ui: in local-owner mode sharing is disabled and the owner still manages databases"
]
},
"tables-csv": {
"kind": "shell",
"commands": [
[
"sh",
"scripts/addons/tables_csv.sh"
]
],
"cases": [
"unit: artifacts: only a host identifier names a file, and the only link is the host route",
"unit: artifacts: the card offers a download only for a complete file that has not expired",
"unit: artifacts: sizes are written with a binary unit",
"unit: artifacts: a tool result keeps well formed identifiers of its own kind only, at most four",
"unit: export: the view becomes the arguments of the tool and nothing a page or a cursor",
"unit: export: the answer is a file, or the reason there is none",
"go: writes a header and one record per row with RFC 4180 quoting, UTF-8 and the documented value forms",
"go: prefixes text cells and labels that a spreadsheet would run, never numbers",
"go: honours columns, the row identifier column, filter, sort and the row limit of the query",
"go: reads one snapshot: writes that commit while the export streams are not in it, and are not blocked by it",
"go: streams a large table row by row with bounded memory",
"go: fails cleanly past the row or byte bound and keeps the bound finite by default",
"go: stops on cancellation, on its deadline and on a failing destination, and reports each",
"go: does not change the database it reads",
"go: answers with one operation-bound CSV output whose bytes the handle streams exactly once",
"go: refuses a handle from another user, another operation, another database or after expiry, and removes expired files",
"go: keeps a handle for a retry until the stream completed",
"go: reports a result past the limit as data without an output, and leaves no file",
"go: removes the staged file when the export fails and bounds what stays staged",
"go: is a read that needs the read action and refuses unknown fields and mutation arguments",
"go: serves the bytes on the protocol output route to the matching envelope only",
"go: exports a table with exact bytes and attachment headers over real HTTP and shows no one else the file",
"go: keeps a shared database's file private, applies the person's own filter and sort, and denies after the grant is withdrawn",
"go: serves the same bytes and headers through a forwarding frontend, and fails the same way for a stranger",
"go: answers a result past the export limit as data with no file",
"go: binds an output handle to its operation, person and database",
"go: fails a truncated, grown or vanished stream and never serves it",
"go: fails the transfer when the store cannot write, and when the source is revoked before completion",
"go: expires the file only, enforces the quota per person and leaves the database as it was",
"go: serves identical bytes and headers from every replica and denies every other way in",
"tables-artifacts: the person exports the view they see and downloads exact bytes with attachment headers",
"tables-artifacts: another person is denied exactly like an unknown file, shared or not",
"tables-artifacts: a viewer exports what they may read and withdrawing the share ends the download",
"tables-artifacts: a result past the export limit gives a message and no file",
"tables-artifacts: the chat draws the host card for an export and stores only its identifier",
"tables-artifacts: a person at the file quota is told so and no file is made",
"tables-artifacts: in local-owner mode the owner exports and downloads with no account"
]
},
"recovery": {
"kind": "shell",
"commands": [
[
"sh",
"scripts/addons/recovery.sh"
]
],
"cases": [
"unit: recovery: the owner's typed refusals keep their type and nothing else is invented",
"unit: recovery: the banner never reads an unknown state as ready",
"unit: recovery: upgrade progress follows the journaled phases",
"unit: recovery: the verification state is a word before it is a colour",
"unit: recovery: every refusal has words, and an unknown outcome keeps its own",
"unit: recovery: every locale carries the same recovery keys as English",
"unit: recovery: a restore needs a stopped add-on, the typed ID and, from another mode, an account",
"unit: recovery: a purge needs a scope and an add-on that is not running",
"unit: recovery: the client sends the operation as the confirmation header and types the refusals",
"go: backs up, publishes the package, migrates, checks health and publishes the generation in that order",
"go: undoes a failure at every journal phase before the publication and puts the old generation back on its own data",
"go: finishes an upgrade whose publication was made when a later step failed",
"go: applies one rule after a restart at any phase: unpublished is undone, published is finished",
"go: refuses a changed trusted identity and an older data format before it stops or writes anything",
"go: keeps the add-on unavailable in needs-recovery after a failed migration to a new format and retains the package and the recovery copy",
"go: restores the backup itself when a migration that keeps the format fails halfway",
"go: keeps a running add-on unavailable and recoverable when the backup cannot be verified at rollback",
"go: copies a WAL database consistently with a manifest, digests, restricted permissions and the owner state",
"go: holds admission and invalidates pending proposals for the add-on while it copies",
"go: reports a corrupt backup and refuses to use it",
"go: stops before copying when the storage is too small and leaves no partial backup",
"go: leaves no partial backup after a cancellation and starts the add-on again",
"go: starts the add-on again when the copy fails",
"go: keeps the only verified copy and the upgrade recovery copy under an explicit retention policy",
"go: never lets age or count remove the newest verified backup when retention is applied on demand",
"go: restores a local-owner backup to a named account through an explicit mapping",
"go: needs an administrator, the typed add-on ID, an explicit scope and an add-on that is not running",
"go: removes the data and its records but keeps the backups unless they are in the scope",
"go: touches no other add-on",
"go: finishes a purge that stopped after its journal was written",
"go: clears needs-recovery when the data it described is purged",
"go: refuses a backup when the policy cannot drain admitted work",
"go: refuses a backup of another add-on and touches neither data nor access",
"go: never lets a manual backup of half migrated data displace the pinned recovery copy",
"go: puts the data and the owner state back, warns about lost writes and keeps the replaced data as a recovery copy",
"go: counts the operations applied after the backup as lost writes",
"go: does not give back access that was taken away or whose account is gone",
"go: survives a restart that forgets the in-memory state: the revocation log is durable",
"go: refuses a running add-on, a stranger, an unknown backup and an invalid mapping without changing anything",
"go: refuses a backup of another trusted identity or of a newer data format",
"go: resumes or rolls back a restore that stopped at each phase, by one rule",
"go: holds the resources of one add-on and leaves another add-on alone",
"go: cancels admitted work and reports a drain that did not finish",
"go: restores grants through the account directory and the lowerings since the backup, never beyond them",
"go: keeps a bounded durable log of lowered access",
"go: keeps a revocation however many later lowerings of another person follow",
"go: restores the data but no access when the history may have lost a lowering",
"go: reads a store that is full of lowerings as one whose history may be cut",
"go: applies a lowering made after the export whatever time the backup is given",
"go: refuses a change that was authorized just before the hold began",
"go: cancels a pending proposal and leaves an executing one outcome-unknown after a restore",
"go: forgets the records of one add-on and no other",
"go: maps an owner on a restore to a local-owner store only when nothing named is in it",
"go: migrates the ownership of a stopped store with a backup and an explicit mapping and refuses a populated downgrade",
"go: records the current format of a new store and migrates nothing",
"go: migrates every database in its own transaction, records the version last and repeats as a no-op",
"go: leaves a database whose step fails exactly as it was and resumes on the next run",
"go: refuses data in a newer format, a downgrade and a version it has no path to, and writes nothing",
"go: makes a backup only for an administrator's own browser session and lists it",
"go: restores with warnings and does not give back a share that was revoked after the backup",
"go: restores only a backup of the add-on in the route and touches nothing otherwise",
"go: gives a forwarding frontend the same typed answers as the owner",
"go: purges only with the typed ID, a stopped add-on and an explicit scope, and touches nothing else",
"go: is never reachable by a model: no tool, no declared name and no route for an API key",
"go: upgrades an add-on with data through a backup and a migration and keeps its databases",
"go: undoes an upgrade whose package does not start and runs the old generation on its own data",
"go: hands retained data only to the same trusted source on a reinstall",
"go: documents every route and every emitted field in the Swagger spec, the instructions and the feature registry",
"recovery: an administrator backs up from the manage sheet and the backup is listed as verified",
"recovery: a person and a key cannot back up, restore or purge, and only the owner session of an administrator can",
"recovery: the restore dialog warns, asks for the typed ID and a restore does not give back a revoked share",
"recovery: a second backup, the sole recovery copy is kept and the keyboard reaches every action",
"recovery: the page shows a needs-recovery banner with restore and purge as the actions (status mocked)",
"recovery: a purge needs a scope, the typed ID and a stopped add-on, and removes the data and its shares"
]
},
"packaging": {
"kind": "shell",
"commands": [
[
"sh",
"scripts/addons/package_test.sh"
]
],
"cases": [
"go: joins every enabled platform leg into one verified index",
"go: never creates a partial index when an enabled platform has no leg",
"go: refuses duplicate legs, local-check legs, other versions and extra platforms",
"go: refuses a merged layout that lost a platform after the merge",
"go: builds a deterministic platform layout with executable, ui and manifest layers",
"go: restores the validated executable mode on extraction",
"go: refuses a platform that the matrix has not enabled unless it is a local check",
"go: refuses an invalid version, an existing layout and an empty executable",
"go: rejects a package without its entrypoint",
"go: rejects a declared UI whose layer or files are missing",
"go: rejects a package without a required runtime library",
"go: rejects a manifest whose platform differs from the image",
"go: rejects an image config or annotation of another platform",
"go: rejects a manifest version that differs from the release version",
"go: rejects another artifact type",
"go: rejects unexpected layers, roles and layer media types",
"go: rejects an unexpected file in the executable layer",
"go: rejects a blob whose bytes differ from its digest",
"go: rejects a receipt that does not match the image",
"go: rejects invalid extraction permissions",
"go: rejects a UI file that is executable or outside the declared directory",
"go: rejects traversal paths, links and duplicates",
"go: rejects a UI that bundles its own React runtime",
"go: rejects an icon that is not an image of its type",
"go: rejects an invalid platform layout marker or index",
"go: moves development forward and leaves it alone for an older commit",
"go: accepts a diverged branch head and refuses one commit with two contents",
"go: moves latest only to a newer stable version",
"go: refuses reserved or foreign alias names and unpublished digests, leaving aliases unchanged",
"go: promotes a branch channel under its hashed name",
"go: treats a force-pushed branch as the new truth for a push to the same ref",
"go: blocks the alias for anything but a push to the channel's own ref",
"go: refuses development when its commit is unreachable, even for a push",
"go: fails on any git error that is not a plain not-ancestor answer",
"go: tells an unreachable commit from a plain not-ancestor",
"go: accepts the add-on namespace and refuses every other go-skynet repository",
"go: reads a YAML list and refuses JSON, unknown fields and a second document",
"go: refuses missing and backend repositories before any request",
"go: pushes platform digests then the index, and a retry is digest-identical",
"go: rejects overwriting an immutable version with different content",
"go: adopts published content only for the same version and commit",
"go: refuses reserved aliases and mismatched tags as immutable tags",
"go: publishes nothing from a partial or local-check layout",
"go: fails closed when no platform is enabled, the file is absent or empty",
"go: rejects enabled platforms without a native runner or check, duplicates and unknown fields",
"go: prints the enabled platforms with their native runners",
"go: ships the checked-in matrix with every platform disabled until its native check passes",
"go: renders digest-pinned entries with an explicit add-on signer identity",
"go: renders an entry for every first-party add-on from its own template",
"go: refuses missing inputs, backend repositories, bad channels and unknown placeholders",
"go: carries placeholders only: no fabricated URL, registry or namespace",
"go: never publishes from a pull request, whatever the ref",
"go: maps master alone to development and publishes the commit tag",
"go: never publishes from a branch push, whatever the branch is named",
"go: keeps reserved names out of the branch namespace",
"go: separates refs that normalize to the same label",
"go: bounds empty, Unicode and very long branch names",
"go: lets a tag push prepare the immutable version and never move latest",
"go: promotes latest only for a published, stable, non-draft release",
"go: rejects unknown events and a malformed commit",
"go: prints the decision as key=value lines",
"go: accepts the checked-in workflow",
"go: rejects pull_request_target",
"go: rejects secrets in a pull request validation job",
"go: rejects id-token write outside the publishing job",
"go: rejects a registry login or publish in an untrusted job",
"go: rejects publish that does not wait for every platform leg",
"go: rejects publish that can run after a failed leg",
"go: rejects publish that does not need validate",
"go: rejects a package leg that does not need validate",
"go: rejects a validate job that cannot stop the release",
"go: rejects a package or promote job that runs after a failed validate",
"go: keeps validate unprivileged on every event",
"go: rejects promotion that does not wait for signing",
"go: rejects alias promotion before signing",
"go: rejects an alias command inside the publishing job",
"go: rejects a literal latest tag",
"go: rejects backend registries and backend workflows",
"go: rejects a signer identity that is a pattern or the backend workflow",
"go: rejects signing by tag or without referrers and the new bundle format",
"go: rejects missing serialization per channel",
"go: rejects publication that is shared between add-ons",
"go: rejects a workflow that names one add-on by path or skips an add-on in the matrix",
"go: rejects a plan that does not refuse an add-on without an enabled platform",
"go: rejects a plan that does not fail closed on missing configuration",
"go: rejects a plan that does not exit 1 for an add-on without an enabled platform on a publishing event",
"go: rejects a plan that treats any matrix error as no legs",
"go: rejects a repository rule that does not keep the configured repository for tables",
"go: rejects a publish or promote matrix that stops the other add-ons on a failure",
"go: rejects a publish job that downloads the layouts of other add-ons",
"go: rejects a promote job that does not check the digest format",
"go: derives a repository that the add-on tools accept for every add-on from the documented variable",
"go: fails on a publishing event when an add-on has no enabled platform",
"go: publishes when every add-on has an enabled platform",
"go: gives an add-on without an enabled platform no legs on an event that publishes nothing",
"go: fails on a missing or malformed platform file on every event",
"go: rejects a checkout of the pull request head or a persisted token",
"go: rejects write permission at workflow level and a literal platform matrix",
"go: rejects a publishing job without an environment or a gate",
"go: does not trust the backend workflow identity in the documented verification",
"go: installs the package built by package.sh and starts its executable",
"go: is refused when the signature carries another workflow identity",
"go: is refused when the owner policy names the backend workflow",
"go: is refused when the pinned digest is not the published image",
"go: gives identical digests for two builds of the same inputs",
"go: refuses a platform the matrix does not enable and a missing executable of another platform",
"package.sh builds and verifies a local check layout",
"package.sh refuses a platform the matrix has not enabled",
"package.sh refuses an existing non-empty layout",
"package.sh requires its arguments",
"package.sh refuses an invalid version",
"package.sh builds and verifies the voice add-on for the host",
"package.sh refuses a foreign platform without an executable: tables",
"package.sh refuses a foreign platform without an executable: voice",
"package.sh refuses a foreign platform without an executable: face",
"package.sh refuses a foreign platform without an executable: fine-tuning",
"package.sh refuses a foreign platform without an executable: quantization",
"package.sh refuses a foreign platform without an executable: studio",
"package.sh refuses a foreign platform without an executable: talk",
"package.sh refuses a foreign platform without an executable for every add-on",
"package.sh builds Tables with cgo and the pure Go add-ons without",
"matrix fails closed while no platform is enabled",
"matrix fails closed without a file",
"channel.sh: a pull request never publishes",
"channel.sh: master publishes development",
"channel.sh: a branch push never publishes, even a branch named latest",
"channel.sh: a tag push prepares the version and moves no alias",
"channel.sh: a published stable release promotes latest",
"channel.sh: a pre-release never promotes latest",
"channel.sh: a draft release fails",
"channel.sh: an unknown event fails",
"channel.sh: a tag that is not a version fails",
"workflow policy accepts the checked-in workflow",
"workflow policy rejects pull_request_target",
"workflow policy rejects a publish job that does not wait for every leg",
"workflow policy rejects a validate job that cannot stop the release",
"scripts never push, tag, sign or log in",
"packaging files never reference backend registries or workflows"
]
},
"updates": {
"kind": "shell",
"commands": [
[
"sh",
"scripts/addons/updates.sh"
]
],
"cases": [
"unit: updates: a failed, unknown or unreadable check is never current",
"unit: updates: an upgrade is offered only for a candidate the owner confirmed, with a digest to pin",
"unit: updates: the owner's typed refusals keep their type and are final answers",
"unit: updates: the apps list marks an update beside the process state, never in place of it",
"unit: updates: times are shown as the reader's own and a bad time as nothing",
"unit: updates: the client sends check and upgrade as the administrator's own action and types the refusals",
"unit: updates: every locale carries the same update keys as English, and words for every state, reason and refusal",
"go: offers a digest-only change of the branch-fix-cache channel with an identical version label",
"go: offers a digest-only change of the development channel with an identical version label",
"go: offers a digest-only change of the latest channel with an identical version label",
"go: is up to date when the channel resolves to the installed digest",
"go: never switches the channel: another channel and other versions are not offered",
"go: selects the highest compatible greater version of the same major",
"go: does not cross a major version",
"go: does not move a stable install to a pre-release and orders pre-releases below their release",
"go: treats a lower version as nothing to offer",
"go: reports the same digest as up to date",
"go: reports a rewritten immutable version as an integrity error, never an update",
"go: names the host, SDK and data format ranges a candidate does not fit",
"go: refuses a candidate whose data format ends below the installed one",
"go: reports a platform that is not offered, and prefers the compatible version over a newer incompatible one",
"go: does not check the SDK range of a candidate that declares no UI",
"go: reports a failed library as check-failed with the last success, never as up to date",
"go: names an unavailable source credential and an unreachable library by class",
"go: reports an add-on the library no longer lists as check-failed",
"go: returns an error for an add-on that is not installed and for a canceled caller",
"go: answers a status read from the cache and never evaluates or fetches",
"go: serves a fresh answer from the cache and evaluates again when it is stale",
"go: marks a cached answer older than the time to live as stale",
"go: refreshes the library only on an explicit refresh and applies nothing",
"go: limits explicit refreshes to one per interval and says so",
"go: shares one check among concurrent callers",
"go: never lets an explicit refresh join a plain evaluation that is already in flight",
"go: keeps the work of a canceled caller from spoiling the answer of the others",
"go: bounds the cache and forgets the answer of a replaced package",
"go: redacts the library, channel and digests for a caller who is not an administrator",
"go: keeps the compatibility hint of an entry and refuses a malformed range",
"go: lists the releases of one add-on for every platform, from the cache, and refuses a failed library",
"go: names an unavailable credential reference as a credential failure inside the refresh failure",
"go: reports a digest-only change of a moving channel, applies nothing and offers the pinned upgrade",
"go: refuses a second operation ID for the same transition, in flight or done, and applies it once",
"go: runs concurrent requests with one operation ID once and gives each the same answer",
"go: serializes conflicting upgrades by the installed digest and refuses the loser without a record",
"go: refuses a candidate that is not the one the library resolves now",
"go: refuses an upgrade to the digest that is already installed",
"go: rechecks compatibility at execution and refuses an incompatible candidate",
"go: selects a newer immutable version and treats a rewritten version as an integrity error",
"go: keeps the last good generation when the candidate cannot be staged",
"go: never switches the library or channel, and a failed check is never up to date",
"go: lets an administrator refresh and everyone with the feature read a redacted status",
"go: shows the pending update in the apps list from the cache only",
"go: does not accept pins without an update checker or on another action",
"go: keeps the unpinned typed upgrade of an earlier release working",
"go: gives every caller with the feature the same status from every frontend, redacted for non-administrators",
"go: checks only for an administrator's own browser session, and applies nothing",
"go: upgrades only to the checked candidate, with the same typed refusals from every frontend, and never twice",
"go: runs two concurrent upgrades from two frontends once: the same ID shares the answer, another ID is a conflict",
"go: refuses an incompatible candidate and a library that cannot be read, with a typed answer",
"go: reports a lost upgrade as an unknown outcome with its original operation, and a lost status read or check as plainly unavailable",
"go: keeps the update actions out of the tools and names every field of the status in the Swagger spec",
"updates: a library with nothing newer is up to date, and a member sees no update mark",
"updates: a moved channel with the same version label is an update, in the list and as a pending mark",
"updates: a member, a key and an outsider cannot check or upgrade",
"updates: the dialog names the library, versions and digests, a cancel sends nothing, and the upgrade backs up and keeps the data",
"updates: two requests for the same transition under different operations run it once",
"updates: a page that is behind cannot upgrade over a newer installed package",
"updates: a candidate this host cannot run shows its reason and has no upgrade",
"updates: an unreachable library is a failed check, never up to date, and says when it was last read",
"updates: on a narrow screen the check is reachable and runs from the keyboard",
"go: ends the checks in flight when it is closed and refuses new ones"
]
},
"tables-acceptance": {
"kind": "shell",
"commands": [
[
"sh",
"scripts/addons/tables_acceptance.sh"
]
],
"cases": [
"go: reports an update only on a check, shows a member no digest, refuses a key and applies one pinned candidate with the data and grants kept",
"go: refuses a change prepared on an old schema or data revision from two tabs of two people and applies nothing",
"go: replays an operation ID as one receipt from every node, conflicts on a different request and never applies twice or under a new ID",
"go: settles a revocation that races a confirmation: one outcome, applied at most once, and no work after the revocation",
"go: separates owner, editor, viewer, administrator and stranger across the browser routes, the REST routes and the chat tool consumer",
"go: serves the browser module to every account with the feature and to nobody else, from the owner and each frontend",
"go: fails every blocked consumer explicitly and never serves add-on tools to it",
"go: is the administrator's own action on every node and never a key's, a member's or a tool's",
"go: refuses a corrupt backup and a restore that is not allowed, and leaves the data as it was",
"go: restores a verified backup: the data goes back, the add-on starts again and access follows the current accounts",
"go: denies the open tabs of a disabled add-on everywhere and serves them again, with the same data, when it is enabled",
"go: keeps data and grants when the add-on is removed and installed again, and refuses what the old generation prepared",
"go: denies the next call of a paused key on every node and accepts it again when resumed",
"go: denies the browser, the key and the chat everywhere when the add-ons feature is withdrawn",
"go: lowers an editor to a viewer for the next call everywhere and drops the proposals the editor still held",
"go: refuses the session and the key of a disabled account on every node",
"go: ignores actor, forwarding and authority headers and fields on every node",
"go: denies authority, role and approval fields in the arguments of every consumer and creates nothing",
"go: applies a proposal only on the confirmation of the proposer's own tab, with its digest, exactly once",
"go: keeps every acknowledged change and applies no change twice when the Tables process is killed in the middle of a batch",
"go: keeps every acknowledged change and applies no change twice when the owner is killed in the middle of a batch and restarted",
"go: blocks every other write while a confirmation is unresolved, keeps reading, and accepts writes again only after the owner role resolves it",
"go: fails every response type closed with the same typed answer from both frontends, runs nothing there and serves everything again after the restart",
"go: exports a CSV through a frontend and serves the same bytes from every node to its requester only",
"go: stops the downloads of a person whose access to the database was revoked, on every node, and keeps the owner's",
"go: denies downloads while the add-on is disabled and serves a complete file again when it is enabled",
"go: answers the refusal as invalid_request with status 400 on every route and node and changes nothing",
"go: does not consume the operation ID of a refused change",
"go: denies an expired file identically from every node and leaves the data and the backups untouched",
"go: withdraws a transfer held in flight when the add-on is disabled and leaves no downloadable file",
"go: reports a change that committed and lost its answer as unknown, finds it by receipt and replays the same receipt once",
"tables-acceptance: a member opens the databases and a grid through each non-owner frontend and the module comes from the owner by digest",
"tables-acceptance: an approval card from chat on one frontend applies once and the row shows on the other frontend",
"tables-acceptance: deep links keep the proxy path prefix on a non-owner frontend and survive a reload",
"tables-acceptance: the grid works by keyboard, at 400 pixels and in both themes on a non-owner frontend",
"tables-acceptance: the page says it is unavailable while the owner is gone and recovers on reload when it is back",
"tables-acceptance: after logout nothing of the database is left in the page or the stored chat",
"manifest: the evidence manifest names the platform, the commands, the package digests and every case"
]
}
}
Reference in new issue View Git Blame Copy Permalink