feat: ship dual-signed online module marketplace

product-source/hololake-native-desktop/scripts/human-authorization.test.mjs

@@ -0,0 +1,27 @@
+import assert from 'node:assert/strict'
+import { readFileSync } from 'node:fs'
+import test from 'node:test'
+
+const read = (path) => readFileSync(new URL(`../${path}`, import.meta.url), 'utf8')
+const contract = JSON.parse(read('contracts/human-authorization.json'))
+const webview = JSON.parse(read('contracts/numbered-ipc-registry.json'))
+const broker = JSON.parse(read('contracts/direct-local-broker-numbered-registry.json'))
+
+test('human authorization is a durable numbered state machine rather than a UI-only button', () => {
+  assert.equal(contract.state, 'NATIVE_FAIL_CLOSED')
+  assert.deepEqual(contract.lifecycle, ['PENDING_HUMAN', 'APPROVED', 'DENIED', 'EXPIRED', 'CONSUMED'])
+  assert.equal(contract.destructive_purge.enabled, false)
+  assert.equal(contract.ticket.single_use, true)
+  assert.equal(contract.ticket.requester_session_bound, true)
+  assert.equal(contract.invariants.proposal_is_not_authorization, true)
+  assert.equal(contract.invariants.approval_is_not_execution, true)
+})
+
+test('the human client and external execution carrier meet through distinct exact numbered routes', () => {
+  const webviewNumbers = new Set(webview.operations.map((item) => item.operation_number))
+  const brokerNumbers = new Set(broker.operations.map((item) => item.operation_number))
+  assert.ok(contract.routes.human_client.every((number) => webviewNumbers.has(number)))
+  assert.ok(contract.routes.external_execution_carrier.every((number) => brokerNumbers.has(number)))
+  const decisions = webview.operations.filter((item) => contract.routes.human_client.includes(item.operation_number))
+  assert.ok(decisions.every((item) => item.admission === 'VERIFIED_HUMAN_ROUTE'))
+})