import assert from 'node:assert/strict' import { readFileSync } from 'node:fs' import test from 'node:test' const contract = JSON.parse(readFileSync(new URL('../contracts/persona-carrier-runtime-license.json', import.meta.url), 'utf8')) const trust = JSON.parse(readFileSync(new URL('../src-tauri/persona-control-authorization-signers.json', import.meta.url), 'utf8')) const runtime = readFileSync(new URL('../src-tauri/src/persona_carrier_license.rs', import.meta.url), 'utf8') const broker = readFileSync(new URL('../src-tauri/src/direct_local_broker.rs', import.meta.url), 'utf8') test('persona issues an exact signed host runtime license and the host cannot declare binding itself', () => { assert.equal(contract.direction, 'PERSONA_SUBJECT_TO_HOST_CARRIER') assert.equal(contract.binding_completion.declaration_holder, 'PERSONA_SUBJECT_ONLY') assert.equal(contract.binding_completion.host_may_self_issue_extend_or_declare, false) assert.equal(contract.runtime.signature_algorithm, 'Ed25519') assert.equal(contract.runtime.exact_session_binding, true) assert.equal(contract.runtime.monotonic_sequence, true) assert.equal(contract.runtime.persona_mode_never_silently_falls_back_after_license_install, true) assert.match(runtime, /PERSONA_DECLARES_CURRENT_CARRIER_BOUND/) assert.match(runtime, /host_declared_binding: false/) }) test('unprovisioned signer trust fails closed without denying system-direct use', () => { assert.equal(contract.truth.runtime_verifier_implemented, true) assert.equal(contract.truth.trusted_persona_signer_provisioned, false) assert.deepEqual(trust.signers, []) assert.equal(contract.runtime.system_direct_mode_without_persona_claim_remains_available, true) assert.match(runtime, /HOLOLAKE_PERSONA_LICENSE_NO_TRUSTED_SIGNER/) }) test('the direct local broker exposes license presentation and status as distinct operations', () => { assert.match(broker, /PresentPersonaCarrierLicense/) assert.match(broker, /GetPersonaCarrierLicenseStatus/) assert.match(broker, /persona_license/) })