feat(hololake): add signed dynamic capability routing

product-source/hololake-native-desktop/scripts/dynamic-capability-routing.test.mjs

@@ -0,0 +1,40 @@
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import test from 'node:test'
+
+const contract = JSON.parse(
+  fs.readFileSync(new URL('../contracts/dynamic-capability-routing.json', import.meta.url), 'utf8'),
+)
+const foundation = JSON.parse(
+  fs.readFileSync(new URL('../foundation.json', import.meta.url), 'utf8'),
+)
+
+test('server capability routing is dynamic and never hardcodes a finite fleet', () => {
+  assert.equal(contract.registry.dynamic_node_count, true)
+  assert.equal(contract.registry.fixed_node_slots, false)
+  assert.equal(contract.registry.endpoint_hardcoding_allowed, false)
+  assert.equal(contract.registry.signer_trust_is_external_to_registry_payload, true)
+  assert.equal(contract.registry.unprovisioned_trust_fails_closed, true)
+  assert.equal(contract.registry.webview_registry_or_health_mutation_allowed, false)
+  assert.equal(contract.registry.platform_carries_user_workload_concurrency, false)
+})
+
+test('routing requires exact human persona domain capability and signed health bindings', () => {
+  assert.deepEqual(contract.route_resolution.required_bindings, [
+    'HUMAN_ID',
+    'PERSONA_ID',
+    'DOMAIN_ID',
+    'CAPABILITY_ID',
+    'NODE_PROTOCOL_PUBLIC_KEY',
+    'FRESH_SIGNED_HEALTH_RECEIPT',
+  ])
+  assert.equal(contract.route_resolution.ssh_or_root_is_identity, false)
+  assert.equal(contract.route_resolution.stale_or_unsigned_health_is_eligible, false)
+  assert.equal(contract.route_resolution.external_ai_route_requires_active_local_session, true)
+})
+
+test('the native mainline reports only implemented dynamic routing capabilities', () => {
+  assert.equal(foundation.dynamic_capability_registry_implemented, true)
+  assert.equal(foundation.signed_node_health_routing_implemented, true)
+  assert.equal(foundation.production_node_write_admission_implemented, false)
+})