Skip to content

Commit b88b356

Browse files
committed
test(plugin-security): the boot census holds no curated sys_capability row
Claude-Session: https://claude.ai/code/session_0113mDBBZPBFzvZqbJqfaFMv Co-authored-by: Claude <noreply@anthropic.com>
1 parent 4d997e7 commit b88b356

1 file changed

Lines changed: 8 additions & 9 deletions

File tree

‎packages/plugins/plugin-security/src/builtin-capabilities.boot.test.ts‎

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,10 @@
44
* [ADR-0131 D3, ADR-0066 D1] The curated platform capabilities as declared
55
* `capability` metadata, read off a REAL boot of this plugin: what the security
66
* catalog read lists, what the boot writes into `sys_capability`, and what the
7-
* capability seeders report.
7+
* capability seeder reports.
88
*
99
* The boot is the plugin's own — `init`, `start`, then its `kernel:ready`
10-
* handlers in registration order (both capability seeding passes included) —
10+
* handlers in registration order (the declared-capability seeding included) —
1111
* over a real `ObjectQL` engine on a SQLite file, so a second boot can open the
1212
* database the first one seeded.
1313
*
@@ -26,9 +26,9 @@
2626
*
2727
* Read off the producers, never off a registry: the curated entries from
2828
* `PLATFORM_CAPABILITIES`, the stack's from its declaration. The census is the
29-
* one the boot wrote before the curated capabilities were declared — the
30-
* curated pass's rows plus the stack's package row — which is why an
31-
* unchanged census is the pin that the declarations changed no row.
29+
* stack's package row and nothing else: the curated capabilities live in the
30+
* registry, and the boot writes no `sys_capability` row for them (the curated
31+
* seeder is retired), on a fresh database or on one it opened again.
3232
*/
3333

3434
import { describe, it, expect, beforeAll, afterAll, vi } from 'vitest';
@@ -192,9 +192,8 @@ async function census(engine: ObjectQL): Promise<string[]> {
192192
.sort();
193193
}
194194

195-
/** The census the boot writes, read off the producers (module doc). */
195+
/** The census the boot writes, read off the producers (module doc): no curated row. */
196196
const EXPECTED_CENSUS = [
197-
...PLATFORM_CAPABILITIES.map((c) => [c.name, 'platform', '-', c.label, c.description, c.scope, true].join(' | ')),
198197
[STACK_CAPABILITY.name, 'package', STACK_PACKAGE, STACK_CAPABILITY.label, STACK_CAPABILITY.description, STACK_CAPABILITY.scope, true].join(' | '),
199198
].sort();
200199

@@ -248,10 +247,10 @@ describe.each(SCENARIOS)('a $posture boot, the stack capability $declared', ({ p
248247
}
249248
});
250249

251-
it('the boot writes the census it wrote before the declarations, on a fresh and on a seeded database', async () => {
250+
it('the boot writes no curated row — only the stack’s package row — on a fresh and on a seeded database', async () => {
252251
expect(await census(fresh.engine)).toEqual(EXPECTED_CENSUS);
253252
expect(await census(reseeded.engine)).toEqual(EXPECTED_CENSUS);
254-
// The seeded database needs no write at all: every row already reads as declared.
253+
// The seeded database needs no write at all: the package row already reads as declared.
255254
expect(reseeded.writes).toEqual([]);
256255
});
257256

0 commit comments

Comments
 (0)