test: postage advisory policy round trip (#30) - #64
Open
mfw78 wants to merge 2 commits into
Open
Conversation
Drive the registry derive-header, guard, submit sequence over the postage adapter native verbs, projected onto the host wire types through a test-local VenueInvoker. A recording guard pins the loop order and the policy-legible header it reads (enforceable BZZ erc20 gives, display-grade capacity service want, Gnosis settlement, eip712), and the requires-signing outcome settles at the kit signer mock. A denying guard stays advisory: the submission still reaches the adapter and its pre-sign leg, and a refused derivation ends the loop before the checkpoint. videre-host gains a feature-gated test-utils re-export of Liveness and SubmitQuota, so an out-of-crate install_for_test caller needs no direct nexum-runtime pin.
… registry The invoker projected quote, status, and cancel onto the host wire types but no test drove them, so a transposed quotation leg or a folded refusal would have gone unseen. Price the purchase through the registry and pin the fee as its own zero bzz leg, that pricing derives no header and runs no checkpoint, that a quotation valid past the ledger horizon does not stale its own submit, and that status and cancel stay terminally unsupported through the registry. Name the native reach in the module doc: the round trip runs over a wire projection of the Rust verbs, not a booted postage-venue.wasm actor.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a test-only
policy_round_tripmodule topostage-venuethat drives the realVenueRegistrysubmit sequence (derive-header -> advisoryEgressGuard-> submit) over the postage adapter's native verbs, using a test-localVenueInvokerinstalled throughinstall_for_test, mirroring the precedentsubmit_round_trips_through_derive_guard_submit.videre-hostgains a feature-gatedtest_utilsmodule (behind thetest-utilsfeature) re-exportingnexum_runtime::engine_config::SubmitQuotaandnexum_runtime::host::actor::Livenessso the venue crate's tests can callinstall_for_testwithout taking a directnexum-runtimedependency.postage-venue'sCargo.tomlgainsdev-dependenciesonfutures(for theBoxFutureinvoker projection),tokio(rt,macros), andvidere-hostwith thetest-utilsfeature.Why
Closes #30
The postage adapter's guard checkpoint was covered only indirectly; this pins the actual loop order and the advisory nature of the guard on the real registry path rather than a stand-in. Three cases are pinned: (1) loop order plus the policy-legible header the guard reads (enforceable BZZ erc20 gives with canonical uint total, display-grade service wants, Gnosis settlement, eip712) and the requires-signing leg settling at the previous car's
MockSigner; (2) a guard deny stays advisory, i.e. submission still reaches the adapter and its pre-sign leg; (3) a refused derivation ends the loop before the guard and submit are reached.Testing
All checks run on a fresh clone of
nullislabs/videre-nexum-moduleat detachedorigin/test/postage-policy-round-trip(4bc794d), rustc/cargo 1.94.0.cargo clippy -p videre-host -p postage-venue --all-targets --all-features -- -D warnings- clean, no warnings.cargo test --doc -p videre-host -p postage-venue --all-features-Doc-tests videre_host: 0 passed, 0 failed;postage-venueiscrate-type = ["cdylib"]so cargo emits no doctest target for it (expected, not a gap).RUSTDOCFLAGS='-D warnings' cargo doc --no-deps -p videre-host -p postage-venue --all-features- both crates documented, no warnings.The round trip was also red-teamed by mutation: making
VenueRegistry::submitenforce aDenyverdict instead of logging it turnsguard_deny_stays_advisory_on_the_postage_pathred, which gives the advisory-seam claim real teeth; the order assertions also catch a skipped or reordered checkpoint, and the invalid-purchase test genuinely pins that a refused derivation ends the loop before the guard and the adapter.AI Assistance
Implementation by claude-fable-5, red-team review by claude-opus-5, PR authored by claude-sonnet-5.