[2073 by GPT-5.6 Sol] Add canonical macOS and Linux first-release profile while deferring Windows publication - #2076

> propr@0.8.15 test:full:prepared
> npm run test:server


> propr@0.8.15 test:server
> node scripts/run-test-suite.mjs


[1/333] apps/desktop/scripts/assert-windows-mvp-package.test.mjs
TAP version 13
# Subtest: Windows MVP ASAR main entry
    # Subtest: uses the rooted listPackage representation accepted by extractFile
    ok 1 - uses the rooted listPackage representation accepted by extractFile
      ---
      duration_ms: 29.463799
      type: 'test'
      ...
    # Subtest: preserves the Windows separator after removing the one archive root
    ok 2 - preserves the Windows separator after removing the one archive root
      ---
      duration_ms: 0.210362
      type: 'test'
      ...
    # Subtest: rejects traversal, duplicate entries, and case-colliding main paths
    ok 3 - rejects traversal, duplicate entries, and case-colliding main paths
      ---
      duration_ms: 0.617039
      type: 'test'
      ...
    1..3
ok 1 - Windows MVP ASAR main entry
  ---
  duration_ms: 31.099653
  type: 'suite'
  ...
1..1
# tests 3
# suites 1
# pass 3
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 259.636664

[2/333] apps/desktop/scripts/build-windows-machine-installer.test.mjs
TAP version 13
# Subtest: sets explicit Windows-1252 MSI and summary code pages in probe and production WXS
ok 1 - sets explicit Windows-1252 MSI and summary code pages in probe and production WXS
  ---
  duration_ms: 1.441098
  type: 'test'
  ...
# Subtest: accepts the exact MSI ProductVersion boundary and retains version and upgrade identity in WXS
ok 2 - accepts the exact MSI ProductVersion boundary and retains version and upgrade identity in WXS
  ---
  duration_ms: 0.39234
  type: 'test'
  ...
# Subtest: rejects every unsupported ProductVersion at the direct installer builder entry point
ok 3 - rejects every unsupported ProductVersion at the direct installer builder entry point
  ---
  duration_ms: 1.357918
  type: 'test'
  ...
# Subtest: uses per-machine scope without explicitly authoring the derived ALLUSERS property
ok 4 - uses per-machine scope without explicitly authoring the derived ALLUSERS property
  ---
  duration_ms: 0.33731
  type: 'test'
  ...
# Subtest: authors the complete per-machine Start Menu contract for x64 and ARM64
ok 5 - authors the complete per-machine Start Menu contract for x64 and ARM64
  ---
  duration_ms: 0.773075
  type: 'test'
  ...
# Subtest: selects only the installed x64 WiX directory or an explicit ARM64 build directory
ok 6 - selects only the installed x64 WiX directory or an explicit ARM64 build directory
  ---
  duration_ms: 0.494581
  type: 'test'
  ...
# Subtest: uses a ten-minute timeout only for production Light
ok 7 - uses a ten-minute timeout only for production Light
  ---
  duration_ms: 0.225663
  type: 'test'
  ...
# Subtest: keeps WiX processes and their emitted diagnostics bounded
ok 8 - keeps WiX processes and their emitted diagnostics bounded
  ---
  duration_ms: 0.111108
  type: 'test'
  ...
# Subtest: emits WiX v3 default registry values without empty Name attributes
ok 9 - emits WiX v3 default registry values without empty Name attributes
  ---
  duration_ms: 0.379754
  type: 'test'
  ...
1..9
# tests 9
# suites 0
# pass 9
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 224.586617

[3/333] apps/desktop/scripts/packaged-smoke-support.test.mjs
TAP version 13
# Subtest: packaged smoke native window layout
    # Subtest: accepts the preferred size while retaining responsive containment
    ok 1 - accepts the preferred size while retaining responsive containment
      ---
      duration_ms: 1.348705
      type: 'test'
      ...
    # Subtest: accepts the 1024x720-clamped size while retaining responsive containment
    ok 2 - accepts the 1024x720-clamped size while retaining responsive containment
      ---
      duration_ms: 0.175245
      type: 'test'
      ...
    # Subtest: accepts the configured minimum size while retaining responsive containment
    ok 3 - accepts the configured minimum size while retaining responsive containment
      ---
      duration_ms: 0.100494
      type: 'test'
      ...
    # Subtest: accepts the undersized work area while retaining responsive containment
    ok 4 - accepts the undersized work area while retaining responsive containment
      ---
      duration_ms: 0.09722
      type: 'test'
      ...
    # Subtest: rejects an unclamped window or a viewport inconsistent with native content chrome
    ok 5 - rejects an unclamped window or a viewport inconsistent with native content chrome
      ---
      duration_ms: 0.443943
      type: 'test'
      ...
    # Subtest: accepts actual reduced native sizing only when both minimum constraints are exercised
    ok 6 - accepts actual reduced native sizing only when both minimum constraints are exercised
      ---
      duration_ms: 0.171694
      type: 'test'
      ...
    1..6
ok 1 - packaged smoke native window layout
  ---
  duration_ms: 3.525377
  type: 'suite'
  ...
# Subtest: packaged smoke child environment
    # Subtest: passes only platform launch inputs and private profile paths from a hostile parent
    ok 1 - passes only platform launch inputs and private profile paths from a hostile parent
      ---
      duration_ms: 14.628219
      type: 'test'
      ...
    # Subtest: keeps cleanup bounded to the generated profile root
    ok 2 - keeps cleanup bounded to the generated profile root
      ---
      duration_ms: 8.361984
      type: 'test'
      ...
    # Subtest: accepts only a normalized absolute Windows SystemRoot directory
    ok 3 - accepts only a normalized absolute Windows SystemRoot directory
      ---
      duration_ms: 1.574869
      type: 'test'
      ...
    # Subtest: contains no parent environment spread, enumeration, denylist, PATH, or shell launch
    ok 4 - contains no parent environment spread, enumeration, denylist, PATH, or shell launch
      ---
      duration_ms: 3.537367
      type: 'test'
      ...
    # Subtest: requires the adjacent packaged spawn options with LF or CRLF source
    ok 5 - requires the adjacent packaged spawn options with LF or CRLF source
      ---
      duration_ms: 1.545181
      type: 'test'
      ...
    1..5
ok 2 - packaged smoke child environment
  ---
  duration_ms: 30.1056
  type: 'suite'
  ...
1..2
# tests 11
# suites 2
# pass 11
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 265.212572

[4/333] apps/desktop/scripts/release-architecture.test.mjs
TAP version 13
# Subtest: machine-wide Windows artifacts require a real MSI compound file
ok 1 - machine-wide Windows artifacts require a real MSI compound file
  ---
  duration_ms: 6.381463
  type: 'test'
  ...
# Subtest: administrative MSI payload inspection
    # Subtest: uses exact fixed native extractor argv and minimal environments
    ok 1 - uses exact fixed native extractor argv and minimal environments
      ---
      duration_ms: 1.000249
      type: 'test'
      ...
    # Subtest: accepts only the canonical application with the one administrative root prefix
    ok 2 - accepts only the canonical application with the one administrative root prefix
      ---
      duration_ms: 10.523671
      type: 'test'
      ...
    # Subtest: rejects path escapes and case collisions from the Linux listing before extraction
    ok 3 - rejects path escapes and case collisions from the Linux listing before extraction
      ---
      duration_ms: 0.790644
      type: 'test'
      ...
    # Subtest: uses fixed missing and duplicate canonical-app codes with bounded counts
    ok 4 - uses fixed missing and duplicate canonical-app codes with bounded counts
      ---
      duration_ms: 7.587699
      type: 'test'
      ...
    # Subtest: distinguishes authority resources, unsafe trees, and architecture mismatch without path data
    ok 5 - distinguishes authority resources, unsafe trees, and architecture mismatch without path data
      ---
      duration_ms: 7.877557
      type: 'test'
      ...
    # Subtest: maps extractor failures to one redacted tool code
    ok 6 - maps extractor failures to one redacted tool code
      ---
      duration_ms: 2.402182
      type: 'test'
      ...
    # Subtest: retains compound-file, per-machine scope, and canonical PE evidence across extraction
    ok 7 - retains compound-file, per-machine scope, and canonical PE evidence across extraction
      ---
      duration_ms: 3.696093
      type: 'test'
      ...
    # Subtest: fails closed on extractor nonzero, stderr, output overflow, and timeout
    ok 8 - fails closed on extractor nonzero, stderr, output overflow, and timeout
      ---
      duration_ms: 140.915387
      type: 'test'
      ...
    1..8
ok 2 - administrative MSI payload inspection
  ---
  duration_ms: 175.850524
  type: 'suite'
  ...
# Subtest: DEB and RPM executable layouts
    # Subtest: accept only the canonical regular ELF payload and documented launcher symlink
    ok 1 - accept only the canonical regular ELF payload and documented launcher symlink
      ---
      duration_ms: 16.492382
      type: 'test'
      ...
    # Subtest: reject missing and extra payload names for both package formats
    ok 2 - reject missing and extra payload names for both package formats
      ---
      duration_ms: 14.611328
      type: 'test'
      ...
    # Subtest: reject unexpected same-name file types and non-ELF or cross-architecture payloads
    ok 3 - reject unexpected same-name file types and non-ELF or cross-architecture payloads
      ---
      duration_ms: 15.191785
      type: 'test'
      ...
    # Subtest: reject launcher escapes, cycles, and targets other than the canonical payload
    ok 4 - reject launcher escapes, cycles, and targets other than the canonical payload
      ---
      duration_ms: 8.545658
      type: 'test'
      ...
    # Subtest: reject special files with the executable name
    ok 5 - reject special files with the executable name
      ---
      duration_ms: 9.096608
      type: 'test'
      ...
    1..5
ok 3 - DEB and RPM executable layouts
  ---
  duration_ms: 64.425506
  type: 'suite'
  ...
# Subtest: DMG application layout
    # Subtest: accepts the real Forge tree with its install link and nested Electron helper bundles
    ok 1 - accepts the real Forge tree with its install link and nested Electron helper bundles
      ---
      duration_ms: 11.864258
      type: 'test'
      ...
    # Subtest: rejects a symbolic-link canonical helper bundle
    ok 2 - rejects a symbolic-link canonical helper bundle
      ---
      duration_ms: 7.415516
      type: 'test'
      ...
    # Subtest: rejects a symbolic-link canonical helper executable ancestor
    ok 3 - rejects a symbolic-link canonical helper executable ancestor
      ---
      duration_ms: 5.846436
      type: 'test'
      ...
    # Subtest: rejects every symbolic link outside canonical framework internals
    ok 4 - rejects every symbolic link outside canonical framework internals
      ---
      duration_ms: 8.760559
      type: 'test'
      ...
    # Subtest: rejects escaping, cyclic, missing, and case-mismatched framework symbolic links
    ok 5 - rejects escaping, cyclic, missing, and case-mismatched framework symbolic links
      ---
      duration_ms: 32.241355
      type: 'test'
      ...
    # Subtest: never treats Linux 7z sanitized install-link output as native layout evidence
    ok 6 - never treats Linux 7z sanitized install-link output as native layout evidence
      ---
      duration_ms: 7.093616
      type: 'test'
      ...
    # Subtest: rejects wrong bundles, alternate same-name executables, and canonical symlink escapes
    ok 7 - rejects wrong bundles, alternate same-name executables, and canonical symlink escapes
      ---
      duration_ms: 12.04932
      type: 'test'
      ...
    # Subtest: rejects alternate top-level application bundles
    ok 8 - rejects alternate top-level application bundles
      ---
      duration_ms: 7.377357
      type: 'test'
      ...
    # Subtest: rejects unsafe links inside the canonical application bundle
    ok 9 - rejects unsafe links inside the canonical application bundle
      ---
      duration_ms: 8.470879
      type: 'test'
      ...
    # Subtest: rejects non-helper nested application bundles
    ok 10 - rejects non-helper nested application bundles
      ---
      duration_ms: 9.083786
      type: 'test'
      ...
    # Subtest: rejects case-colliding top-level entries when the filesystem permits them
    ok 11 - rejects case-colliding top-level entries when the filesystem permits them
      ---
      duration_ms: 6.399372
      type: 'test'
      ...
    # Subtest: rejects special files inside the canonical application bundle
    ok 12 - rejects special files inside the canonical application bundle
      ---
      duration_ms: 13.75261
      type: 'test'
      ...
    1..12
ok 4 - DMG application layout
  ---
  duration_ms: 131.244325
  type: 'suite'
  ...
1..4
# tests 26
# suites 3
# pass 26
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 579.269627

[5/333] apps/desktop/scripts/release-artifacts.test.mjs
TAP version 13
# Subtest: desktop release artifacts
    # Subtest: dry-runs the canonical macOS/Linux profile through finalize and signed update metadata
    ok 1 - dry-runs the canonical macOS/Linux profile through finalize and signed update metadata
      ---
      duration_ms: 125.587465
      type: 'test'
      ...
    # Subtest: fails closed for missing profiles and rejects Windows fragments in the macOS/Linux profile
    ok 2 - fails closed for missing profiles and rejects Windows fragments in the macOS/Linux profile
      ---
      duration_ms: 66.886948
      type: 'test'
      ...
    # Subtest: stages named artifacts and finalizes unsigned validation metadata
    ok 3 - stages named artifacts and finalizes unsigned validation metadata
      ---
      duration_ms: 43.420684
      type: 'test'
      ...
    # Subtest: rejects extensionless, doubled-extension, case-conflicting, duplicate, wrong-kind, stale, and mixed-target names
    ok 4 - rejects extensionless, doubled-extension, case-conflicting, duplicate, wrong-kind, stale, and mixed-target names
      ---
      duration_ms: 250.650369
      type: 'test'
      ...
    # Subtest: rejects altered DMG bytes even when fragment artifact metadata is rewritten
    ok 5 - rejects altered DMG bytes even when fragment artifact metadata is rewritten
      ---
      duration_ms: 29.372075
      type: 'test'
      ...
    # Subtest: rejects permanent DMG replacement or in-place mutation during held inspection without emitting evidence
    ok 6 - rejects permanent DMG replacement or in-place mutation during held inspection without emitting evidence
      ---
      duration_ms: 10.486385
      type: 'test'
      ...
    # Subtest: keeps held A bytes, evidence, and publication stable when original and public pathnames change during inspection
    ok 7 - keeps held A bytes, evidence, and publication stable when original and public pathnames change during inspection
      ---
      duration_ms: 7.952029
      type: 'test'
      ...
    # Subtest: continues to reject a mutable pathname passed directly to DMG inspection
    ok 8 - continues to reject a mutable pathname passed directly to DMG inspection
      ---
      duration_ms: 0.343788
      type: 'test'
      ...
    # Subtest: requires explicit fixture authority for Windows-hosted DMG evidence tests
    ok 9 - requires explicit fixture authority for Windows-hosted DMG evidence tests # SKIP
      ---
      duration_ms: 0.139665
      type: 'test'
      ...
    # Subtest: accepts real Darwin mode-0700 directory and mode-0600 single-link file authority
    ok 10 - accepts real Darwin mode-0700 directory and mode-0600 single-link file authority # SKIP
      ---
      duration_ms: 0.217362
      type: 'test'
      ...
    # Subtest: rejects native Darwin broad mode, foreign owner, extra link, replacement type, and symlink with fixed authority codes
    ok 11 - rejects native Darwin broad mode, foreign owner, extra link, replacement type, and symlink with fixed authority codes # SKIP
      ---
      duration_ms: 0.044992
      type: 'test'
      ...
    # Subtest: accepts native xattr/ctime-only change when held bytes and identity are unchanged
    ok 12 - accepts native xattr/ctime-only change when held bytes and identity are unchanged # SKIP
      ---
      duration_ms: 0.027247
      type: 'test'
      ...
    # Subtest: does not emit claimed DMG layout evidence without the native-validation marker
    ok 13 - does not emit claimed DMG layout evidence without the native-validation marker
      ---
      duration_ms: 9.257004
      type: 'test'
      ...
    # Subtest: strictly rejects missing, mixed, stale, malformed, or fabricated native DMG evidence
    ok 14 - strictly rejects missing, mixed, stale, malformed, or fabricated native DMG evidence
      ---
      duration_ms: 309.344695
      type: 'test'
      ...
    # Subtest: rejects native DMG evidence copied between x64 and arm64 fragments
    ok 15 - rejects native DMG evidence copied between x64 and arm64 fragments
      ---
      duration_ms: 31.967082
      type: 'test'
      ...
    # Subtest: rejects duplicate target fragments before aggregation
    ok 16 - rejects duplicate target fragments before aggregation
      ---
      duration_ms: 19.141171
      type: 'test'
      ...
    # Subtest: rejects either Windows fragment when the installed ordinary-user application gate was skipped
    ok 17 - rejects either Windows fragment when the installed ordinary-user application gate was skipped
      ---
      duration_ms: 75.179818
      type: 'test'
      ...
    # Subtest: fails closed when trusted update signing configuration is incomplete
    ok 18 - fails closed when trusted update signing configuration is incomplete
      ---
      duration_ms: 64.793127
      type: 'test'
      ...
    # Subtest: signs cryptographically bound feeds only in the trusted release phase
    ok 19 - signs cryptographically bound feeds only in the trusted release phase
      ---
      duration_ms: 55.521373
      type: 'test'
      ...
    # Subtest: refuses to sign a renamed extensionless distributable
    ok 20 - refuses to sign a renamed extensionless distributable
      ---
      duration_ms: 36.184779
      type: 'test'
      ...
    # Subtest: refuses to sign when artifact bytes changed after unsigned finalization
    ok 21 - refuses to sign when artifact bytes changed after unsigned finalization
      ---
      duration_ms: 43.398613
      type: 'test'
      ...
    # Subtest: rejects unsigned production metadata and actual signer mismatches
    ok 22 - rejects unsigned production metadata and actual signer mismatches
      ---
      duration_ms: 88.308464
      type: 'test'
      ...
    # Subtest: rejects mixed Windows signers and tampered fingerprint evidence
    ok 23 - rejects mixed Windows signers and tampered fingerprint evidence
      ---
      duration_ms: 46.493773
      type: 'test'
      ...
    # Subtest: parses x64 and arm64 ELF, PE, and Mach-O executable fixtures
    ok 24 - parses x64 and arm64 ELF, PE, and Mach-O executable fixtures
      ---
      duration_ms: 1.171344
      type: 'test'
      ...
    # Subtest: derives Windows target architecture from the full NUPKG independently of its supported bootstrapper
    ok 25 - derives Windows target architecture from the full NUPKG independently of its supported bootstrapper
      ---
      duration_ms: 16.221696
      type: 'test'
      ...
    # Subtest: binds ZIP and NUPKG executables to exact maker-specific canonical paths
    ok 26 - binds ZIP and NUPKG executables to exact maker-specific canonical paths
      ---
      duration_ms: 3.55729
      type: 'test'
      ...
    # Subtest: rejects missing, corrupt, mismatched, and ambiguous packaged Windows authority helpers
    ok 27 - rejects missing, corrupt, mismatched, and ambiguous packaged Windows authority helpers
      ---
      duration_ms: 5.20667
      type: 'test'
      ...
    # Subtest: accepts only the real Forge macOS framework-internal symbolic-link layout
    ok 28 - accepts only the real Forge macOS framework-internal symbolic-link layout
      ---
      duration_ms: 3.696577
      type: 'test'
      ...
    # Subtest: rejects hostile macOS ZIP symbolic links before trusting their payloads
    ok 29 - rejects hostile macOS ZIP symbolic links before trusting their payloads
      ---
      duration_ms: 16.023779
      type: 'test'
      ...
    # Subtest: rejects unsafe, duplicate, shadowed, forged, alternate, and noncanonical archive layouts
    ok 30 - rejects unsafe, duplicate, shadowed, forged, alternate, and noncanonical archive layouts
      ---
      duration_ms: 5.194761
      type: 'test'
      ...
    # Subtest: rejects cross-labeled package architectures at staging and finalization
    ok 31 - rejects cross-labeled package architectures at staging and finalization
      ---
      duration_ms: 36.353812
      type: 'test'
      ...
    1..31
ok 1 - desktop release artifacts
  ---
  duration_ms: 1404.888306
  type: 'suite'
  ...
1..1
# tests 31
# suites 1
# pass 27
# fail 0
# cancelled 0
# skipped 4
# todo 0
# duration_ms 1630.916024

[6/333] apps/desktop/scripts/release-preflight.test.mjs
TAP version 13
# Subtest: desktop release preflight
    # Subtest: accepts only a new immutable tag reachable from protected main and a protected environment
    ok 1 - accepts only a new immutable tag reachable from protected main and a protected environment
      ---
      duration_ms: 2.743506
      type: 'test'
      ...
    # Subtest: accepts an authorization-visible bypass list and fails closed for hidden or denied ruleset details
    ok 2 - accepts an authorization-visible bypass list and fails closed for hidden or denied ruleset details
      ---
      duration_ms: 1.135739
      type: 'test'
      ...
    # Subtest: paginates repository rulesets and reads every full rule definition
    ok 3 - paginates repository rulesets and reads every full rule definition
      ---
      duration_ms: 3.546955
      type: 'test'
      ...
    # Subtest: requires an exact active bypass-free update and deletion tag ruleset
    ok 4 - requires an exact active bypass-free update and deletion tag ruleset
      ---
      duration_ms: 1.582917
      type: 'test'
      ...
    # Subtest: rejects ruleset mutation or deletion during preflight
    ok 5 - rejects ruleset mutation or deletion during preflight
      ---
      duration_ms: 1.283242
      type: 'test'
      ...
    # Subtest: requires the complete effective environment policy set to be exactly desktop-v* tags
    ok 6 - requires the complete effective environment policy set to be exactly desktop-v* tags
      ---
      duration_ms: 3.195852
      type: 'test'
      ...
    # Subtest: requires the separately protected preflight credential environment
    ok 7 - requires the separately protected preflight credential environment
      ---
      duration_ms: 0.758084
      type: 'test'
      ...
    # Subtest: paginates all environment policies and rejects a permissive policy on a later page
    ok 8 - paginates all environment policies and rejects a permissive policy on a later page
      ---
      duration_ms: 0.938999
      type: 'test'
      ...
    # Subtest: rejects missing or ambiguous environment protection and explicit API denial
    ok 9 - rejects missing or ambiguous environment protection and explicit API denial
      ---
      duration_ms: 0.933583
      type: 'test'
      ...
    # Subtest: rejects tags not created by this push, tags off main, and moved or existing releases
    ok 10 - rejects tags not created by this push, tags off main, and moved or existing releases
      ---
      duration_ms: 5.6576
      type: 'test'
      ...
    1..10
ok 1 - desktop release preflight
  ---
  duration_ms: 23.076838
  type: 'suite'
  ...
1..1
# tests 10
# suites 1
# pass 10
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 240.954813

[7/333] apps/desktop/scripts/release-publish.test.mjs
TAP version 13
# Subtest: atomic desktop release publication
    # Subtest: creates a draft, verifies the exact profile assets, then publishes
    ok 1 - creates a draft, verifies the exact profile assets, then publishes
      ---
      duration_ms: 63.270032
      type: 'test'
      ...
    # Subtest: leaves a partial upload as a recoverable draft and resumes only matching assets
    ok 2 - leaves a partial upload as a recoverable draft and resumes only matching assets
      ---
      duration_ms: 34.119999
      type: 'test'
      ...
    # Subtest: rejects unexpected, duplicate, size, and content-digest asset mismatches without publishing
    ok 3 - rejects unexpected, duplicate, size, and content-digest asset mismatches without publishing
      ---
      duration_ms: 29.980881
      type: 'test'
      ...
    # Subtest: rejects tag drift before publishing the verified draft
    ok 4 - rejects tag drift before publishing the verified draft
      ---
      duration_ms: 10.616802
      type: 'test'
      ...
    # Subtest: rejects local files outside or missing from finalized checksums
    ok 5 - rejects local files outside or missing from finalized checksums
      ---
      duration_ms: 3.101019
      type: 'test'
      ...
    # Subtest: rejects accidental Windows artifacts in the macOS/Linux manifest before any API call
    ok 6 - rejects accidental Windows artifacts in the macOS/Linux manifest before any API call
      ---
      duration_ms: 3.263434
      type: 'test'
      ...
    1..6
ok 1 - atomic desktop release publication
  ---
  duration_ms: 145.761543
  type: 'suite'
  ...
1..1
# tests 6
# suites 1
# pass 6
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 344.731143

[8/333] apps/desktop/scripts/verify-darwin-image.test.mjs
TAP version 13
# Subtest: Darwin image verification retries only bounded documented resource states
ok 1 - Darwin image verification retries only bounded documented resource states
  ---
  duration_ms: 14.061603
  type: 'test'
  ...
# Subtest: Darwin image verification does not retry malformed/truncated images or accept mutation
ok 2 - Darwin image verification does not retry malformed/truncated images or accept mutation
  ---
  duration_ms: 10.218825
  type: 'test'
  ...
# Subtest: Darwin image verification holds a fixed hdiutil image behind a real mutation and replacement barrier
ok 3 - Darwin image verification holds a fixed hdiutil image behind a real mutation and replacement barrier # SKIP
  ---
  duration_ms: 0.239311
  type: 'test'
  ...
1..3
# tests 3
# suites 0
# pass 2
# fail 0
# cancelled 0
# skipped 1
# todo 0
# duration_ms 238.520216

[9/333] apps/desktop/src/deep-link-delivery.test.ts
TAP version 13
# Subtest: desktop deep-link delivery
    # Subtest: queues links received after did-finish-load until the ready window is registered
    ok 1 - queues links received after did-finish-load until the ready window is registered
      ---
      duration_ms: 1.167332
      type: 'test'
      ...
    # Subtest: delivers a queued initial Connect URL before packaged smoke asserts it and only once
    ok 2 - delivers a queued initial Connect URL before packaged smoke asserts it and only once
      ---
      duration_ms: 0.434641
      type: 'test'
      ...
    1..2
ok 1 - desktop deep-link delivery
  ---
  duration_ms: 2.399278
  type: 'suite'
  ...
1..1
# tests 2
# suites 1
# pass 2
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 214.409931

[10/333] apps/desktop/src/ipc.test.ts
TAP version 13
# Subtest: desktop session IPC operations
    # Subtest: logs out through the active Electron session with credentials and without following redirects
    ok 1 - logs out through the active Electron session with credentials and without following redirects
      ---
      duration_ms: 21.393285
      type: 'test'
      ...
    # Subtest: rejects untrusted logout endpoints before making a session request
    ok 2 - rejects untrusted logout endpoints before making a session request
      ---
      duration_ms: 0.636942
      type: 'test'
      ...
    1..2
ok 1 - desktop session IPC operations
  ---
  duration_ms: 23.078352
  type: 'suite'
  ...
1..1
# tests 2
# suites 1
# pass 2
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 245.806679

[11/333] apps/desktop/src/preload-bridge.test.ts
TAP version 13
# Subtest: desktop preload bridge
    # Subtest: exposes only the narrow frozen namespaces
    ok 1 - exposes only the narrow frozen namespaces
      ---
      duration_ms: 1.276773
      type: 'test'
      ...
    # Subtest: maps profile and credential operations to fixed channels
    ok 2 - maps profile and credential operations to fixed channels
      ---
      duration_ms: 0.405487
      type: 'test'
      ...
    # Subtest: does not expose Electron event objects to deep-link listeners
    ok 3 - does not expose Electron event objects to deep-link listeners
      ---
      duration_ms: 0.195898
      type: 'test'
      ...
    # Subtest: buffers startup and second-instance deep links until the renderer subscribes
    ok 4 - buffers startup and second-instance deep links until the renderer subscribes
      ---
      duration_ms: 0.229031
      type: 'test'
      ...
    1..4
ok 1 - desktop preload bridge
  ---
  duration_ms: 2.966354
  type: 'suite'
  ...
1..1
# tests 4
# suites 1
# pass 4
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 240.123407

[12/333] apps/desktop/src/profile-store.test.ts
TAP version 13
# Subtest: desktop profile store
    # Subtest: persists validated profiles and active selection
    ok 1 - persists validated profiles and active selection
      ---
      duration_ms: 11.002473
      type: 'test'
      ...
    # Subtest: encrypts credentials before writing app-owned storage
    ok 2 - encrypts credentials before writing app-owned storage
      ---
      duration_ms: 4.846283
      type: 'test'
      ...
    # Subtest: serializes concurrent credential writes with last-write semantics
    ok 3 - serializes concurrent credential writes with last-write semantics
      ---
      duration_ms: 4.077693
      type: 'test'
      ...
    # Subtest: orders concurrent credential writes and removals by invocation
    ok 4 - orders concurrent credential writes and removals by invocation
      ---
      duration_ms: 6.377125
      type: 'test'
      ...
    # Subtest: refuses plaintext fallback when encryption is unavailable or basic_text
    ok 5 - refuses plaintext fallback when encryption is unavailable or basic_text
      ---
      duration_ms: 1.842813
      type: 'test'
      ...
    # Subtest: rejects unsafe endpoints and path-like profile identifiers
    ok 6 - rejects unsafe endpoints and path-like profile identifiers
      ---
      duration_ms: 4.331373
      type: 'test'
      ...
    1..6
ok 1 - desktop profile store
  ---
  duration_ms: 33.801769
  type: 'suite'
  ...
1..1
# tests 6
# suites 1
# pass 6
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 261.171907

[13/333] apps/desktop/src/release-config.test.ts
TAP version 13
# Subtest: desktop release configuration
    # Subtest: keeps Linux maker executables aligned with the packaged executable
    ok 1 - keeps Linux maker executables aligned with the packaged executable
      ---
      duration_ms: 508.806606
      type: 'test'
      ...
    # Subtest: propagates an explicit independent desktop version
    ok 2 - propagates an explicit independent desktop version
      ---
      duration_ms: 0.402826
      type: 'test'
      ...
    # Subtest: accepts the exact MSI ProductVersion numeric boundary for Windows releases
    ok 3 - accepts the exact MSI ProductVersion numeric boundary for Windows releases
      ---
      duration_ms: 0.186837
      type: 'test'
      ...
    # Subtest: preserves the stable SemVer diagnostic for malformed Windows release versions
    ok 4 - preserves the stable SemVer diagnostic for malformed Windows release versions
      ---
      duration_ms: 0.498618
      type: 'test'
      ...
    # Subtest: rejects canonical stable Windows versions outside MSI bounds with one fixed actionable diagnostic
    ok 5 - rejects canonical stable Windows versions outside MSI bounds with one fixed actionable diagnostic
      ---
      duration_ms: 0.221441
      type: 'test'
      ...
    # Subtest: preserves stable SemVer policy outside the Windows MSI path
    ok 6 - preserves stable SemVer policy outside the Windows MSI path
      ---
      duration_ms: 0.177581
      type: 'test'
      ...
    # Subtest: keeps updates disabled unless they are explicitly enabled
    ok 7 - keeps updates disabled unless they are explicitly enabled
      ---
      duration_ms: 0.095271
      type: 'test'
      ...
    # Subtest: requires a signed build and a complete trusted update configuration
    ok 8 - requires a signed build and a complete trusted update configuration
      ---
      duration_ms: 0.8089
      type: 'test'
      ...
    # Subtest: parses canonical Windows certificate or SPKI SHA-256 pin allowlists for artifact signing
    ok 9 - parses canonical Windows certificate or SPKI SHA-256 pin allowlists for artifact signing
      ---
      duration_ms: 0.510542
      type: 'test'
      ...
    # Subtest: fails closed to unsupported Windows updates even when every update variable is configured or malformed
    ok 10 - fails closed to unsupported Windows updates even when every update variable is configured or malformed
      ---
      duration_ms: 0.416878
      type: 'test'
      ...
    # Subtest: preserves opaque signing credentials while normalizing non-secret members
    ok 11 - preserves opaque signing credentials while normalizing non-secret members
      ---
      duration_ms: 0.152666
      type: 'test'
      ...
    # Subtest: rejects whitespace-only and partially configured signing groups with fixed diagnostics
    ok 12 - rejects whitespace-only and partially configured signing groups with fixed diagnostics
      ---
      duration_ms: 0.185775
      type: 'test'
      ...
    # Subtest: fails closed when a production signing or notarization condition is absent
    ok 13 - fails closed when a production signing or notarization condition is absent
      ---
      duration_ms: 0.478999
      type: 'test'
      ...
    1..13
ok 1 - desktop release configuration
  ---
  duration_ms: 514.501466
  type: 'suite'
  ...
1..1
# tests 13
# suites 1
# pass 13
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 781.52271

[14/333] apps/desktop/src/release-workflow.test.ts
TAP version 13
# Subtest: desktop trusted release workflow
    # Subtest: keeps pull-request packaging unsigned and completely secretless
    ok 1 - keeps pull-request packaging unsigned and completely secretless
      ---
      duration_ms: 1.179564
      type: 'test'
      ...
    # Subtest: allows production only from a new protected-main desktop tag after protected read-only preflight
    ok 2 - allows production only from a new protected-main desktop tag after protected read-only preflight
      ---
      duration_ms: 1.923687
      type: 'test'
      ...
    # Subtest: grants the preflight token Environments read for both environment API calls without exposing it
    ok 3 - grants the preflight token Environments read for both environment API calls without exposing it
      ---
      duration_ms: 0.296592
      type: 'test'
      ...
    # Subtest: keeps required macOS certificates and the update private key inside preflight-dependent environment jobs
    ok 4 - keeps required macOS certificates and the update private key inside preflight-dependent environment jobs
      ---
      duration_ms: 0.276641
      type: 'test'
      ...
    # Subtest: fails closed for every production signing, notarization, update, and signer condition
    ok 5 - fails closed for every production signing, notarization, update, and signer condition
      ---
      duration_ms: 0.28584
      type: 'test'
      ...
    # Subtest: preserves the opaque Windows certificate password for package and MSI signing
    ok 6 - preserves the opaque Windows certificate password for package and MSI signing
      ---
      duration_ms: 0.164522
      type: 'test'
      ...
    # Subtest: rechecks package architecture in staging and finalization and publishes only signed new releases
    ok 7 - rechecks package architecture in staging and finalization and publishes only signed new releases
      ---
      duration_ms: 0.374308
      type: 'test'
      ...
    # Subtest: retains the exact native matrix when the workflow checkout uses CRLF
    ok 8 - retains the exact native matrix when the workflow checkout uses CRLF
      ---
      duration_ms: 0.621669
      type: 'test'
      ...
    # Subtest: runs the native DMG layout suite on both macOS architectures
    ok 9 - runs the native DMG layout suite on both macOS architectures
      ---
      duration_ms: 1.03605
      type: 'test'
      ...
    # Subtest: keeps complete Windows validation assertions runnable but non-blocking and outside production
    ok 10 - keeps complete Windows validation assertions runnable but non-blocking and outside production
      ---
      duration_ms: 1.285142
      type: 'test'
      ...
    # Subtest: keeps native Windows MSI validation isolated from canonical aggregation
    ok 11 - keeps native Windows MSI validation isolated from canonical aggregation
      ---
      duration_ms: 0.458703
      type: 'test'
      ...
    # Subtest: bounds and diagnoses installed Windows process lifecycles on x64 and ARM64
    ok 12 - bounds and diagnoses installed Windows process lifecycles on x64 and ARM64
      ---
      duration_ms: 3.481467
      type: 'test'
      ...
    # Subtest: uses bounded network logon impersonation with secure native credential cleanup
    ok 13 - uses bounded network logon impersonation with secure native credential cleanup
      ---
      duration_ms: 0.510711
      type: 'test'
      ...
    # Subtest: requires the exact ordinary-user SID before bounded presence and absence checks
    ok 14 - requires the exact ordinary-user SID before bounded presence and absence checks
      ---
      duration_ms: 0.528404
      type: 'test'
      ...
    # Subtest: keeps shortcut proof output fixed and redacted and rejects the legacy process proof
    ok 15 - keeps shortcut proof output fixed and redacted and rejects the legacy process proof
      ---
      duration_ms: 0.534169
      type: 'test'
      ...
    # Subtest: emits fixed uninstall and cleanup substages without masking the primary failure
    ok 16 - emits fixed uninstall and cleanup substages without masking the primary failure
      ---
      duration_ms: 1.500791
      type: 'test'
      ...
    # Subtest: keeps the canonical common shortcut and ownership-aware nonrecursive cleanup
    ok 17 - keeps the canonical common shortcut and ownership-aware nonrecursive cleanup
      ---
      duration_ms: 0.617424
      type: 'test'
      ...
    # Subtest: replaces a hostile privileged parent environment with the exact smoke child allowlist
    ok 18 - replaces a hostile privileged parent environment with the exact smoke child allowlist
      ---
      duration_ms: 1.0816
      type: 'test'
      ...
    # Subtest: keeps spaced and unspaced smoke argv values as distinct ArgumentList entries
    ok 19 - keeps spaced and unspaced smoke argv values as distinct ArgumentList entries
      ---
      duration_ms: 0.359299
      type: 'test'
      ...
    # Subtest: opens installed Windows smoke evidence with a bounded, redacted reader
    ok 20 - opens installed Windows smoke evidence with a bounded, redacted reader
      ---
      duration_ms: 1.452241
      type: 'test'
      ...
    # Subtest: configures signed updates only for macOS and never advertises a Windows update feed
    ok 21 - configures signed updates only for macOS and never advertises a Windows update feed
      ---
      duration_ms: 0.329027
      type: 'test'
      ...
    1..21
ok 1 - desktop trusted release workflow
  ---
  duration_ms: 20.15008
  type: 'suite'
  ...
1..1
# tests 21
# suites 1
# pass 21
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 274.216621

[15/333] apps/desktop/src/security.test.ts
TAP version 13
# Subtest: desktop URL security
    # Subtest: only accepts HTTPS and loopback HTTP API endpoints
    ok 1 - only accepts HTTPS and loopback HTTP API endpoints
      ---
      duration_ms: 1.486741
      type: 'test'
      ...
    # Subtest: denies unsafe external browser schemes and credential-bearing URLs
    ok 2 - denies unsafe external browser schemes and credential-bearing URLs
      ---
      duration_ms: 0.26032
      type: 'test'
      ...
    # Subtest: requires an exact loopback development origin
    ok 3 - requires an exact loopback development origin
      ---
      duration_ms: 0.280974
      type: 'test'
      ...
    # Subtest: retains IPC trust for hash-routed packaged renderer URLs only
    ok 4 - retains IPC trust for hash-routed packaged renderer URLs only
      ---
      duration_ms: 0.263241
      type: 'test'
      ...
    # Subtest: allowlists custom protocol actions and extracts them from argv
    ok 5 - allowlists custom protocol actions and extracts them from argv
      ---
      duration_ms: 0.412198
      type: 'test'
      ...
    # Subtest: accepts a normal internal dashboard route from an open deep link
    ok 6 - accepts a normal internal dashboard route from an open deep link
      ---
      duration_ms: 1.017302
      type: 'test'
      ...
    # Subtest: revalidates open links after canonical serialization
    ok 7 - revalidates open links after canonical serialization
      ---
      duration_ms: 1.216754
      type: 'test'
      ...
    # Subtest: rejects encoded delimiters combined with encoded traversal
    ok 8 - rejects encoded delimiters combined with encoded traversal
      ---
      duration_ms: 0.646527
      type: 'test'
      ...
    # Subtest: rejects malformed and unsafe open deep-link paths
    ok 9 - rejects malformed and unsafe open deep-link paths
      ---
      duration_ms: 1.249786
      type: 'test'
      ...
    # Subtest: publishes a restrictive production policy
    ok 10 - publishes a restrictive production policy
      ---
      duration_ms: 0.533226
      type: 'test'
      ...
    # Subtest: relaxes inline scripts only while Vite serves the development renderer
    ok 11 - relaxes inline scripts only while Vite serves the development renderer
      ---
      duration_ms: 0.205154
      type: 'test'
      ...
    1..11
ok 1 - desktop URL security
  ---
  duration_ms: 12.347181
  type: 'suite'
  ...
1..1
# tests 11
# suites 1
# pass 11
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 263.482792

[16/333] apps/desktop/src/signed-update-policy.test.ts
TAP version 13
# Subtest: Windows signed-update public boundary is fixed unsupported with zero external or apply calls
ok 1 - Windows signed-update public boundary is fixed unsupported with zero external or apply calls
  ---
  duration_ms: 1.271189
  type: 'test'
  ...
# Subtest: signed macOS feeds accept only the canonical ZIP extension and matching artifact URL
ok 2 - signed macOS feeds accept only the canonical ZIP extension and matching artifact URL
  ---
  duration_ms: 1.798194
  type: 'test'
  ...
# Subtest: macOS signed-update check remains check-only and verifies its exact feed and artifact
ok 3 - macOS signed-update check remains check-only and verifies its exact feed and artifact # SKIP
  ---
  duration_ms: 0.076896
  type: 'test'
  ...
1..3
# tests 3
# suites 0
# pass 2
# fail 0
# cancelled 0
# skipped 1
# todo 0
# duration_ms 269.444478

[17/333] apps/desktop/src/smoke-test-authorization.test.ts
TAP version 13
# Subtest: packaged smoke profile authorization
    # Subtest: requires both argv and environment smoke triggers with the explicit isolated directory
    ok 1 - requires both argv and environment smoke triggers with the explicit isolated directory
      ---
      duration_ms: 1.17344
      type: 'test'
      ...
    # Subtest: rejects a dual-authorized smoke invocation when the isolated directory is missing
    ok 2 - rejects a dual-authorized smoke invocation when the isolated directory is missing
      ---
      duration_ms: 0.141844
      type: 'test'
      ...
    # Subtest: rejects relative, default, non-smoke, and duplicate directories
    ok 3 - rejects relative, default, non-smoke, and duplicate directories
      ---
      duration_ms: 0.309121
      type: 'test'
      ...
    # Subtest: does not enable mutating smoke behavior in development or without a trigger
    ok 4 - does not enable mutating smoke behavior in development or without a trigger
      ---
      duration_ms: 0.123325
      type: 'test'
      ...
    # Subtest: terminates a malformed packaged smoke attempt without an interactive failure path
    ok 5 - terminates a malformed packaged smoke attempt without an interactive failure path
      ---
      duration_ms: 0.410572
      type: 'test'
      ...
    # Subtest: authorizes the isolated directory before profile and lifecycle construction
    ok 6 - authorizes the isolated directory before profile and lifecycle construction
      ---
      duration_ms: 0.20083
      type: 'test'
      ...
    # Subtest: registers one-shot lifecycle shutdown before smoke window creation and preserves required evidence order
    ok 7 - registers one-shot lifecycle shutdown before smoke window creation and preserves required evidence order
      ---
      duration_ms: 1.019574
      type: 'test'
      ...
    1..7
ok 1 - packaged smoke profile authorization
  ---
  duration_ms: 4.477957
  type: 'suite'
  ...
1..1
# tests 7
# suites 1
# pass 7
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 233.858182

[18/333] apps/desktop/src/smoke-test-evidence.test.ts
TAP version 13
# Subtest: packaged smoke evidence
    # Subtest: does not create evidence for a non-smoke run
    ok 1 - does not create evidence for a non-smoke run
      ---
      duration_ms: 1.538143
      type: 'test'
      ...
    # Subtest: writes only fixed allowlisted event-only records and suppresses duplicates
    ok 2 - writes only fixed allowlisted event-only records and suppresses duplicates
      ---
      duration_ms: 4.377714
      type: 'test'
      ...
    # Subtest: flushes the bounded lifecycle in emission order
    ok 3 - flushes the bounded lifecycle in emission order
      ---
      duration_ms: 5.282861
      type: 'test'
      ...
    1..3
ok 1 - packaged smoke evidence
  ---
  duration_ms: 12.103624
  type: 'suite'
  ...
1..1
# tests 3
# suites 1
# pass 3
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 238.904825

[19/333] apps/desktop/src/vite-file-system-url.test.ts
TAP version 13
# Subtest: Vite filesystem renderer URLs
    # Subtest: preserves an absolute POSIX path after the /@fs/ prefix
    ok 1 - preserves an absolute POSIX path after the /@fs/ prefix
      ---
      duration_ms: 0.585762
      type: 'test'
      ...
    # Subtest: normalizes a Windows drive-letter path and separators
    ok 2 - normalizes a Windows drive-letter path and separators
      ---
      duration_ms: 0.148152
      type: 'test'
      ...
    1..2
ok 1 - Vite filesystem renderer URLs
  ---
  duration_ms: 1.524805
  type: 'suite'
  ...
1..1
# tests 2
# suites 1
# pass 2
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 215.953999

[20/333] apps/desktop/src/window-options.test.ts
TAP version 13
# Subtest: desktop BrowserWindow security
    # Subtest: isolates and sandboxes the renderer without Node or webviews
    ok 1 - isolates and sandboxes the renderer without Node or webviews
      ---
      duration_ms: 1.217741
      type: 'test'
      ...
    # Subtest: uses the native inset title bar only on macOS
    ok 2 - uses the native inset title bar only on macOS
      ---
      duration_ms: 0.14219
      type: 'test'
      ...
    # Subtest: retains the preferred and minimum responsive window sizes
    ok 3 - retains the preferred and minimum responsive window sizes
      ---
      duration_ms: 0.12411
      type: 'test'
      ...
    # Subtest: centers the initial window within the selected display work area
    ok 4 - centers the initial window within the selected display work area
      ---
      duration_ms: 0.225011
      type: 'test'
      ...
    1..4
ok 1 - desktop BrowserWindow security
  ---
  duration_ms: 2.598447
  type: 'suite'
  ...
# Subtest: desktop BrowserWindow display sizing
    # Subtest: clamps preferred and minimum sizing for a normal work area
    ok 1 - clamps preferred and minimum sizing for a normal work area
      ---
      duration_ms: 0.216275
      type: 'test'
      ...
    # Subtest: clamps preferred and minimum sizing for a exactly bounded work area
    ok 2 - clamps preferred and minimum sizing for a exactly bounded work area
      ---
      duration_ms: 0.065027
      type: 'test'
      ...
    # Subtest: clamps preferred and minimum sizing for a narrow work area
    ok 3 - clamps preferred and minimum sizing for a narrow work area
      ---
      duration_ms: 0.106278
      type: 'test'
      ...
    # Subtest: clamps preferred and minimum sizing for a short work area
    ok 4 - clamps preferred and minimum sizing for a short work area
      ---
      duration_ms: 0.250455
      type: 'test'
      ...
    # Subtest: clamps preferred and minimum sizing for a work area smaller in both dimensions
    ok 5 - clamps preferred and minimum sizing for a work area smaller in both dimensions
      ---
      duration_ms: 0.171218
      type: 'test'
      ...
    # Subtest: selects the display nearest the cursor for multi-display window placement
    ok 6 - selects the display nearest the cursor for multi-display window placement
      ---
      duration_ms: 0.531149
      type: 'test'
      ...
    # Subtest: falls back deterministically to the primary display
    ok 7 - falls back deterministically to the primary display
      ---
      duration_ms: 0.263415
      type: 'test'
      ...
    1..7
ok 2 - desktop BrowserWindow display sizing
  ---
  duration_ms: 1.938466
  type: 'suite'
  ...
1..2
# tests 11
# suites 2
# pass 11
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 230.324765

[21/333] packages/api/test/agentLoginRoutes.test.ts
TAP version 13
# Subtest: agent login session manager
    # Subtest: builds an allowlisted Docker login container without forwarding host secrets
    ok 1 - builds an allowlisted Docker login container without forwarding host secrets
      ---
      duration_ms: 2.62094
      type: 'test'
      ...
    # Subtest: maps a ProPR-managed account to the managed host root and marks its container ownership as safe to normalize
    ok 2 - maps a ProPR-managed account to the managed host root and marks its container ownership as safe to normalize
      ---
      duration_ms: 1.204439
      type: 'test'
      ...
    # Subtest: creates a ProPR-managed credential directory before starting Docker
    ok 3 - creates a ProPR-managed credential directory before starting Docker
      ---
      duration_ms: 2.084211
      type: 'test'
      ...
    # Subtest: fails clearly instead of resolving a default home path inside a containerized API
    ok 4 - fails clearly instead of resolving a default home path inside a containerized API
      ---
      duration_ms: 0.597713
      type: 'test'
      ...
    # Subtest: rejects unsafe credential roots and option-like image names
    ok 5 - rejects unsafe credential roots and option-like image names
      ---
      duration_ms: 0.381277
      type: 'test'
      ...
    # Subtest: streams sanitized output, accepts input, and records successful completion
    ok 6 - streams sanitized output, accepts input, and records successful completion
      ---
      duration_ms: 1.471446
      type: 'test'
      ...
    # Subtest: prevents concurrent logins that write the same credential directory
    ok 7 - prevents concurrent logins that write the same credential directory
      ---
      duration_ms: 0.581463
      type: 'test'
      ...
    # Subtest: pulls a missing agent image before creating the login container
    ok 8 - pulls a missing agent image before creating the login container
      ---
      duration_ms: 0.605486
      type: 'test'
      ...
    # Subtest: renews the session deadline when the user sends input
    ok 9 - renews the session deadline when the user sends input
      ---
      duration_ms: 0.544323
      type: 'test'
      ...
    # Subtest: sweeps only orphaned login containers from the current stack scope
    ok 10 - sweeps only orphaned login containers from the current stack scope
      ---
      duration_ms: 0.469158
      type: 'test'
      ...
    1..10
ok 1 - agent login session manager
  ---
  duration_ms: 11.791912
  type: 'suite'
  ...
# Subtest: agent login routes
    # Subtest: starts and returns only the requesting user login session
    ok 1 - starts and returns only the requesting user login session
      ---
      duration_ms: 0.700541
      type: 'test'
      ...
    # Subtest: accepts the same agent alias on start and follow-up calls, including while disabled
    ok 2 - accepts the same agent alias on start and follow-up calls, including while disabled
      ---
      duration_ms: 0.48824
      type: 'test'
      ...
    # Subtest: rejects interactive login for an unsupported agent type
    ok 3 - rejects interactive login for an unsupported agent type
      ---
      duration_ms: 0.383976
      type: 'test'
      ...
    1..3
ok 2 - agent login routes
  ---
  duration_ms: 1.694596
  type: 'suite'
  ...
# [2026-09-02 18:58:19.100 +0000] �[32mINFO�[39m: �[36mSQLite database connection established successfully�[39m
#     filename: "/tmp/propr-test-suite-QPAGWS/021-agentLoginRoutes.test.ts/propr.test.sqlite"
#     environment: "test"
# [2026-09-02 18:58:19.110 +0000] �[32mINFO�[39m: �[36mSQLite database connection closed�[39m
# [2026-09-02 18:58:19.110 +0000] �[32mINFO�[39m: �[36mShutting down queue...�[39m
# [2026-09-02 18:58:19.110 +0000] �[32mINFO�[39m: �[36mQueue was never initialized, nothing to shutdown�[39m
1..2
# tests 13
# suites 2
# pass 13
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 2068.893793

[22/333] packages/api/test/agentRuntimeRoutes.test.ts
TAP version 13
# Subtest: agent runtime package routes
    # Subtest: queues one validated package profile for the unified agent image
    ok 1 - queues one validated package profile for the unified agent image
      ---
      duration_ms: 3.695804
      type: 'test'
      ...
    # Subtest: persists a failed state when queue submission fails
    ok 2 - persists a failed state when queue submission fails
      ---
      duration_ms: 0.808795
      type: 'test'
      ...
    # Subtest: rejects a package missing from an effective runtime before queueing
    ok 3 - rejects a package missing from an effective runtime before queueing
      ---
      duration_ms: 0.634939
      type: 'test'
      ...
    # Subtest: times out slow runtime package validation before queueing
    ok 4 - times out slow runtime package validation before queueing
      ---
      duration_ms: 5.768683
      type: 'test'
      ...
    # Subtest: returns package suggestions from configured runtimes
    ok 5 - returns package suggestions from configured runtimes
      ---
      duration_ms: 0.705137
      type: 'test'
      ...
    # Subtest: enforces PROPR_ADMIN_USERS when configured
    ok 6 - enforces PROPR_ADMIN_USERS when configured
      ---
      duration_ms: 0.249789
      type: 'test'
      ...
    # Subtest: denies runtime package changes by default when no admin policy is configured
    ok 7 - denies runtime package changes by default when no admin policy is configured
      ---
      duration_ms: 0.284623
      type: 'test'
      ...
    # Subtest: requires runtime-management permission before returning runtime package state
    ok 8 - requires runtime-management permission before returning runtime package state
      ---
      duration_ms: 0.271546
      type: 'test'
      ...
    # Subtest: warms the package catalog when an admin loads runtime package state
    ok 9 - warms the package catalog when an admin loads runtime package state
      ---
      duration_ms: 0.399993
      type: 'test'
      ...
    # Subtest: does not warm the package catalog when a member is rejected
    ok 10 - does not warm the package catalog when a member is rejected
      ---
      duration_ms: 1.715038
      type: 'test'
      ...
    # Subtest: resolves the runtime build queue lazily when queueing
    ok 11 - resolves the runtime build queue lazily when queueing
      ---
      duration_ms: 0.741314
      type: 'test'
      ...
    # Subtest: reports apply load failures through the route response
    ok 12 - reports apply load failures through the route response
      ---
      duration_ms: 0.277457
      type: 'test'
      ...
    # Subtest: verifies the current effective images through the runtime-management boundary
    ok 13 - verifies the current effective images through the runtime-management boundary
      ---
      duration_ms: 0.365365
      type: 'test'
      ...
    # Subtest: rejects runtime verification without runtime-management permission
    ok 14 - rejects runtime verification without runtime-management permission
      ---
      duration_ms: 0.201965
      type: 'test'
      ...
    1..14
ok 1 - agent runtime package routes
  ---
  duration_ms: 17.442343
  type: 'suite'
  ...
# [2026-09-02 18:58:20.955 +0000] �[32mINFO�[39m: �[36mSQLite database connection established successfully�[39m
#     filename: "/tmp/propr-test-suite-QPAGWS/022-agentRuntimeRoutes.test.ts/propr.test.sqlite"
#     environment: "test"
# [2026-09-02 18:58:20.970 +0000] �[32mINFO�[39m: �[36mSQLite database connection closed�[39m
1..1
# tests 14
# suites 1
# pass 14
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 1697.293096

[23/333] packages/api/test/attachmentUploadCleanup.test.ts
TAP version 13
# Subtest: upload handler removes Multer files rejected before attachment processing
ok 1 - upload handler removes Multer files rejected before attachment processing
  ---
  duration_ms: 6.478008
  type: 'test'
  ...
# Subtest: attachment processing removes temporary and final files when persistence fails
ok 2 - attachment processing removes temporary and final files when persistence fails
  ---
  duration_ms: 4.758071
  type: 'test'
  ...
# Subtest: temporary cleanup refuses paths outside its configured root
ok 3 - temporary cleanup refuses paths outside its configured root
  ---
  duration_ms: 0.550847
  type: 'test'
  ...
# Subtest: temporary cleanup rejects dot-segment paths that resolve above its root
ok 4 - temporary cleanup rejects dot-segment paths that resolve above its root
  ---
  duration_ms: 0.430497
  type: 'test'
  ...
# Subtest: attachment processing rejects path-like draft IDs and still cleans its temp file
ok 5 - attachment processing rejects path-like draft IDs and still cleans its temp file
  ---
  duration_ms: 1.622416
  type: 'test'
  ...
# [2026-09-02 18:58:22.763 +0000] �[32mINFO�[39m: �[36mSQLite database connection established successfully�[39m
#     filename: "/tmp/propr-test-suite-QPAGWS/023-attachmentUploadCleanup.test.ts/propr.test.sqlite"
#     environment: "test"
# [2026-09-02 18:58:22.776 +0000] �[32mINFO�[39m: �[36mSQLite database connection closed�[39m
1..5
# tests 5
# suites 0
# pass 5
# fail 0
# cancelled 0
# skipped 0
# todo 0
# duration_ms 1677.030745

[24/333] packages/api/test/authGithubTokens.test.ts
TAP version 13
# Refreshing GitHub token for user octocat (force=true)
# Successfully refreshed GitHub token for user octocat
# Refreshing GitHub token for user octocat (force=true)
# GitHub token refresh failed with status 503
# Refreshing GitHub token for user octocat (force=true)
# Sub

...(truncated)