feat: add signed numbered module lifecycle

product-source/hololake-native-desktop/scripts/module-donor-admission.test.mjs

@@ -31,9 +31,13 @@ test('legacy numbering donor is rejected and the numbered IPC root remains singu
 })
 
 test('hot installation is artifact, permission, self-test and rollback backed', () => {
+  assert.equal(catalog.hot_install_boundary.runtime_state, 'SIGNED_DECLARATIVE_PACKAGE_ENGINE_IMPLEMENTED')
+  assert.equal(catalog.hot_install_boundary.numbered_module_runtime_operations.length, 7)
   assert.equal(catalog.hot_install_boundary.source_repository_is_directly_executable, false)
   assert.equal(catalog.hot_install_boundary.immutable_signed_artifact_required, true)
   assert.equal(catalog.hot_install_boundary.compatibility_manifest_required, true)
   assert.equal(catalog.hot_install_boundary.rollback_on_self_test_failure, true)
   assert.equal(catalog.hot_install_boundary.user_data_survives_unmount, true)
+  assert.equal(catalog.hot_install_boundary.arbitrary_native_code_allowed, false)
+  assert.equal(catalog.hot_install_boundary.arbitrary_webview_javascript_allowed, false)
 })

product-source/hololake-native-desktop/scripts/module-package-runtime.test.mjs

@@ -0,0 +1,37 @@
+import assert from 'node:assert/strict'
+import { readFileSync } from 'node:fs'
+import test from 'node:test'
+
+const contract = JSON.parse(readFileSync(new URL('../contracts/module-package-runtime.json', import.meta.url), 'utf8'))
+const registry = JSON.parse(readFileSync(new URL('../contracts/numbered-ipc-registry.json', import.meta.url), 'utf8'))
+const rust = readFileSync(new URL('../src-tauri/src/module_package_runtime.rs', import.meta.url), 'utf8')
+
+test('module packages are signed declarative artifacts rather than executable repositories', () => {
+  assert.equal(contract.schema, 'hololake.module-package-runtime/v1')
+  assert.equal(contract.signature.source_repository_is_executable, false)
+  assert.equal(contract.signature.package_bytes_are_signed_exactly, true)
+  assert.equal(contract.host.arbitrary_native_code, false)
+  assert.equal(contract.host.arbitrary_webview_javascript, false)
+  assert.equal(contract.host.declarative_payload_only, true)
+  assert.equal(contract.rules.self_test_before_active, true)
+  assert.equal(contract.rules.failed_self_test_rolls_back, true)
+  assert.equal(contract.rules.unmount_preserves_user_data, true)
+})
+
+test('module lifecycle is reachable only through numbered verified-human routes', () => {
+  const routes = registry.operations.filter((route) => route.module_number === 'HLP-NIPC-MOD-0020')
+  assert.equal(routes.length, 7)
+  assert.deepEqual(routes.map((route) => route.operation_number), [
+    'HLP-NIPC-OP-0063',
+    'HLP-NIPC-OP-0064',
+    'HLP-NIPC-OP-0065',
+    'HLP-NIPC-OP-0066',
+    'HLP-NIPC-OP-0067',
+    'HLP-NIPC-OP-0068',
+    'HLP-NIPC-OP-0069',
+  ])
+  assert.ok(routes.every((route) => route.admission === 'VERIFIED_HUMAN_ROUTE'))
+  assert.match(rust, /MINISIGN_ED25519|PublicKey::decode/)
+  assert.match(rust, /module_receipts/)
+  assert.match(rust, /ROLLBACK_PENDING_SELF_TEST/)
+})

product-source/hololake-native-desktop/scripts/unified-number-coordinate-tree.test.mjs

@@ -7,8 +7,8 @@ test('identity, webview and direct broker numbers compile into one unique eviden
   const generated = JSON.parse(readFileSync(new URL('../generated/unified-number-coordinate-tree.json', import.meta.url), 'utf8'))
   assert.deepEqual(generated, compileUnifiedNumberTree())
   assert.equal(generated.recordId, 'HLP-UNIFIED-NUMBER-TREE-001')
-  assert.equal(generated.routeCount, 84)
-  assert.equal(new Set(generated.routes.map((route) => route.path)).size, 84)
+  assert.equal(generated.routeCount, 91)
+  assert.equal(new Set(generated.routes.map((route) => route.path)).size, 91)
   assert.equal(generated.invariants.everyPhysicalCallHasNumberedRoute, true)
   assert.equal(generated.invariants.everyAcceptedCallHasEvidenceClass, true)
   assert.ok(generated.routes.every((route) => route.admission && route.evidence))