feat: ship dual-signed online module marketplace

product-source/hololake-native-desktop/scripts/distribution-plane-router.test.mjs

@@ -0,0 +1,81 @@
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import test from 'node:test'
+
+const contract = JSON.parse(fs.readFileSync(new URL('../contracts/distribution-plane-router.json', import.meta.url), 'utf8'))
+const plane = (scope) => contract.planes.find((item) => item.scope === scope)
+
+test('distribution scope is explicit and may never be guessed from content', () => {
+  assert.equal(contract.schema, 'hololake.distribution-plane-router/v1')
+  assert.equal(contract.classification.authority, 'EXPLICIT_SIGNED_RELEASE_ENVELOPE')
+  assert.equal(contract.classification.semantic_guessing_allowed, false)
+  assert.equal(contract.classification.missing_or_conflicting_scope, 'FAIL_CLOSED')
+  assert.ok(contract.classification.required_fields.includes('scope'))
+  assert.ok(contract.classification.required_fields.includes('contentSha256'))
+})
+
+test('public zero-core protocol updates are publisher-approved but do not ask every device again', () => {
+  const item = plane('PUBLIC_ZERO_CORE_PROTOCOL')
+  assert.equal(item.physical_node, 'GH-CVM-MAIN-PROD-01')
+  assert.equal(item.logical_source, 'ZERO_POINT_ORIGIN_PUBLIC_PROJECTION_HOSTED_OUTSIDE_PRIVATE_FIFTH_DOMAIN')
+  assert.deepEqual(item.required_signer_classes, [
+    'ZERO_POINT_ORIGIN_PUBLIC_SCOPE_SIGNER',
+    'ENTERPRISE_ZERO_CORE_DISTRIBUTION_SIGNER',
+  ])
+  assert.equal(item.publisher_human_confirmation_required, true)
+  assert.equal(item.per_device_human_install_confirmation_required, false)
+  assert.equal(item.automatic_atomic_activation_after_self_test, true)
+  assert.equal(item.arbitrary_native_code_allowed, false)
+  assert.equal(item.arbitrary_webview_javascript_allowed, false)
+  assert.equal(contract.current_observed_gaps_2026_08_19.zero_point_signed_payload_activation, 'CLIENT_IMPLEMENTED_DUAL_SIGNER_TRUST_NOT_PROVISIONED')
+})
+
+test('private fifth-domain updates can never enter the public stream', () => {
+  const item = plane('PRIVATE_FIFTH_DOMAIN')
+  assert.equal(item.public_propagation_allowed, false)
+  assert.equal(item.cross_domain_replication_allowed, false)
+  assert.notEqual(item.signer_class, plane('PUBLIC_ZERO_CORE_PROTOCOL').signer_class)
+})
+
+test('marketplace synchronizes a signed catalog but installs a selected module only with human permission review', () => {
+  const item = plane('PUBLIC_ENTERPRISE_MODULE_CATALOG')
+  assert.equal(item.client_full_repository_clone_required, false)
+  assert.equal(item.raw_repository_is_executable_input, false)
+  assert.equal(item.catalog_index_automatic_sync, true)
+  assert.equal(item.module_install_human_confirmation_required, true)
+  assert.equal(item.permission_expansion_human_confirmation_required, true)
+  assert.equal(item.lighthouse_number_registration_required, true)
+})
+
+test('application binary remains a separately signed and human-confirmed release plane', () => {
+  const item = plane('APPLICATION_BINARY')
+  assert.equal(item.platform_signing_required, true)
+  assert.equal(item.updater_signature_required, true)
+  assert.equal(item.per_device_human_install_confirmation_required, true)
+  assert.equal(item.automatic_restart_allowed, false)
+})
+
+test('the lake lamp is a tiny signed version signal rather than a repository clone', () => {
+  assert.equal(contract.lamp_protocol.transport, 'HTTPS_CONDITIONAL_GET')
+  assert.equal(contract.lamp_protocol.full_repository_clone_for_LIGHT_SIGNAL, false)
+  assert.ok(contract.lamp_protocol.cache_validation.includes('ETAG'))
+  assert.ok(contract.lamp_protocol.check_events.includes('NETWORK_RESUME'))
+  assert.ok(contract.activation_pipeline.includes('SIGN_WITH_PLANE_SPECIFIC_KEY'))
+  assert.ok(contract.client_protocol_activation.includes('KEEP_LAST_KNOWN_GOOD_ROLLBACK'))
+})
+
+test('all four planes use distinct signer classes', () => {
+  assert.equal(contract.planes.length, 4)
+  assert.equal(new Set(contract.planes.map((item) => item.signer_class)).size, 4)
+})
+
+test('fifth-domain navigation uses a one-time handoff and exports no private authority', () => {
+  const handoff = contract.cross_node_management_handoff
+  assert.equal(handoff.source_node, 'JD-FD-PRIMARY')
+  assert.equal(handoff.target_node, 'GH-CVM-MAIN-PROD-01')
+  assert.equal(handoff.password_forwarding_allowed, false)
+  assert.equal(handoff.enterprise_four_domain_authority_inherited, false)
+  assert.equal(handoff.private_fifth_domain_authority_exported, false)
+  assert.ok(handoff.ticket_properties.includes('REPLAY_PROTECTED'))
+  assert.equal(handoff.current_state, 'NOT_IMPLEMENTED')
+})