TASK-6e4ff870-a386-4a11-a59c-444ebc23732e: harden B0 fixture scenarios

docs/TEST_INTEGRITY.md

@@ -2702,3 +2702,36 @@ test_integrity_note:
     did_relax_any_assertion: false
     if_true_explain_spec_basis: ""
 ```
+
+## 2026-10-01 — Candidate attempt-store B0 namespace and lexical-metadata correction
+
+```yaml
+test_integrity_note:
+  change_type: new_tests
+  scenarios:
+    - id: SCN-candidate-store-fixture-nonpromotion
+      given: The public store and provisioner module namespaces
+      when: Their exports are enumerated
+      then: Each exactly equals its B0 allowlist, so renamed database, connection, root, path, manifest, or selector exports fail
+    - id: SCN-candidate-store-fixture-authority
+      given: Clones of actually issued harness and fixture objects
+      when: Provisioning or inspection is attempted through those clones
+      then: Both are WeakMap-refused without exposing or selecting a fixture target
+    - id: SCN-candidate-store-metadata-drift
+      given: A provisioned fixture and an enumerated fixture-only lexical metadata corruption
+      when: Read-only metadata verification runs
+      then: An uppercase digest is rejected separately from the existing format-valid all-zero digest drift
+  observable_outcomes:
+    - Exact public export arrays and stable authority or metadata refusal codes
+    - No caller SQLite execution, raw handle, registered target, or fixture promotion
+  determinism_controls:
+    - Hermetic own-mkdtemp fixture, private WeakMap capabilities, fixture-only temporary check-constraint bypass, and no retry or live state
+  anti_cheat_rationale:
+    prevents:
+      - Renaming a raw database initializer or connection verifier to evade a name denylist
+      - Forging a capability by copying an issued public object
+      - Treating a format-valid digest mismatch as sufficient lexical validation coverage
+  relaxation:
+    did_relax_any_assertion: false
+    if_true_explain_spec_basis: ""
+```

src/control-plane/candidate-attempt-store-provisioner.mjs

@@ -13,7 +13,9 @@ import {
 
 const harnesses = new WeakMap();
 const fixtures = new WeakMap();
-const TEST_CORRUPTIONS = new Set(['nonempty', 'registered-relationship', 'ddl-drift', 'malformed-meta']);
+const TEST_CORRUPTIONS = new Set([
+  'nonempty', 'registered-relationship', 'ddl-drift', 'digest-drift', 'malformed-meta-lexical',
+]);
 const DIGEST_PATTERN = /^[0-9a-f]{64}$/;
 const MAX_IDENTIFIER_BYTES = 128;
 
@@ -190,12 +192,22 @@ export function applyCandidateAttemptStoreFixtureTestCorruptionV1(input = {}) {
     mkdirSync(markerRoot);
     writeFileSync(join(markerRoot, 'install-manifest.json'), '{"fixture":"registered-relationship"}\n', { flag: 'wx' });
   }
-  if (kind === 'ddl-drift' || kind === 'malformed-meta') {
+  if (kind === 'ddl-drift' || kind === 'digest-drift' || kind === 'malformed-meta-lexical') {
     if (!state.fixture) fail('Fixture corruption requires a provisioned fixture', 'CANDIDATE_STORE_FIXTURE_INPUT_INVALID', { kind });
     const database = new DatabaseSync(databasePath(state));
     try {
       if (kind === 'ddl-drift') database.exec('CREATE TABLE fixture_schema_drift (id TEXT PRIMARY KEY)');
-      else database.prepare('UPDATE candidate_attempt_store_meta SET ddl_digest = ? WHERE singleton = 1').run('0'.repeat(64));
+      if (kind === 'digest-drift') {
+        database.prepare('UPDATE candidate_attempt_store_meta SET ddl_digest = ? WHERE singleton = 1').run('0'.repeat(64));
+      }
+      if (kind === 'malformed-meta-lexical') {
+        database.exec('PRAGMA ignore_check_constraints = ON');
+        try {
+          database.prepare('UPDATE candidate_attempt_store_meta SET ddl_digest = ? WHERE singleton = 1').run('A'.repeat(64));
+        } finally {
+          database.exec('PRAGMA ignore_check_constraints = OFF');
+        }
+      }
     } finally {
       database.close();
     }

test/fleet/candidate-attempt-store.test.mjs

@@ -108,6 +108,22 @@ test('SCN-candidate-store-fixture-nonpromotion: fixture attestation cannot expos
   const fixture = provisionCandidateAttemptStoreFixtureV1({ harness });
   const provisioner = await import('../../src/control-plane/candidate-attempt-store-provisioner.mjs');
   const store = await import('../../src/control-plane/candidate-attempt-store.mjs');
+  assert.deepEqual(Object.keys(store), [
+    'CANDIDATE_ATTEMPT_STORE_PROTOCOL_VERSION',
+    'CANDIDATE_ATTEMPT_STORE_SCHEMA_VERSION',
+    'candidateAttemptStoreDdlBytesV1',
+    'candidateAttemptStoreDdlStatementsV1',
+    'candidateAttemptStoreDigestsV1',
+    'candidateAttemptStoreSchemaBytesV1',
+  ], 'store public namespace must remain data-only and exact');
+  assert.deepEqual(Object.keys(provisioner), [
+    'applyCandidateAttemptStoreFixtureTestCorruptionV1',
+    'closeCandidateAttemptStoreFixtureHarnessV1',
+    'closeCandidateAttemptStoreFixtureV1',
+    'createCandidateAttemptStoreFixtureHarnessV1',
+    'inspectCandidateAttemptStoreFixtureV1',
+    'provisionCandidateAttemptStoreFixtureV1',
+  ], 'provisioner public namespace must remain exact');
   assert.equal(fixture.promotion, 'nonpromotable');
   assert.equal(inspectCandidateAttemptStoreFixtureV1({ fixture }).nonpromotable, true);
   for (const forbiddenExport of [
@@ -142,6 +158,14 @@ test('SCN-candidate-store-fixture-authority: foreign, closed, reused, nonempty,
   assert.deepEqual(executionCalls, [], 'public fixture APIs must reject caller database or forged authority before any database execution');
   closeCandidateAttemptStoreFixtureHarnessV1({ harness: issuedForBypassAttempt });
 
+  const issuedHarness = createCandidateAttemptStoreFixtureHarnessV1();
+  const copiedIssuedHarness = Object.freeze({ ...issuedHarness });
+  expectCode(() => provisionCandidateAttemptStoreFixtureV1({ harness: copiedIssuedHarness }), 'CANDIDATE_STORE_FIXTURE_AUTH_REQUIRED');
+  const issuedFixture = provisionCandidateAttemptStoreFixtureV1({ harness: issuedHarness });
+  const copiedIssuedFixture = Object.freeze({ ...issuedFixture });
+  expectCode(() => inspectCandidateAttemptStoreFixtureV1({ fixture: copiedIssuedFixture }), 'CANDIDATE_STORE_FIXTURE_AUTH_REQUIRED');
+  closeCandidateAttemptStoreFixtureV1({ fixture: issuedFixture });
+
   const closed = createCandidateAttemptStoreFixtureHarnessV1();
   closeCandidateAttemptStoreFixtureHarnessV1({ harness: closed });
   expectCode(() => provisionCandidateAttemptStoreFixtureV1({ harness: closed }), 'CANDIDATE_STORE_FIXTURE_AUTH_EXPIRED');
@@ -166,7 +190,8 @@ test('SCN-candidate-store-fixture-authority: foreign, closed, reused, nonempty,
 test('SCN-candidate-store-metadata-drift: only enumerated hermetic corruption can invalidate a provisioned fixture', () => {
   for (const [kind, code] of [
     ['ddl-drift', 'CANDIDATE_STORE_SCHEMA_DRIFT'],
-    ['malformed-meta', 'CANDIDATE_STORE_METADATA_INVALID'],
+    ['digest-drift', 'CANDIDATE_STORE_METADATA_INVALID'],
+    ['malformed-meta-lexical', 'CANDIDATE_STORE_METADATA_INVALID'],
   ]) {
     const harness = createCandidateAttemptStoreFixtureHarnessV1();
     const fixture = provisionCandidateAttemptStoreFixtureV1({ harness });