fix: retain safe runtime proof rejection diagnostics

T-729: distinguish issued_in_future from expired with exact checked times and overflow-safe deltas; retain request-binding mismatch reasons and proof verification progress. Correlate claimed Runtime/Worker/JTI via fixed-size fingerprints and server-generated rejection IDs, bound request metadata, omit query/raw claims/error/body/header/key material. Preserve allow/deny ordering and generic 401 responses; document diagnostic limits and T-728 policy ownership. Reported same-machine incident remains unconfirmed. Validation: worker-runtime auth filter 3 passed; worker-runtime crate 345 lib + 17 per binary passed; Server auth logging 3 passed (17 rejection cases on both routers plus bounded metadata and generic repository401); workspace_config_integration 12 passed; Server crate 692 lib + 11 bin passed; root cargo check; cargo fmt --all -- --check; rustfmt included config tests --check; git diff --check HEAD. Existing no-default Runtime feature-gate breakage remains documented and out of scope.
2026-10-09 02:53:23 +09:00
parent 717ff2555f
commit 7bb4096373
7 changed files with 963 additions and 226 deletions
@@ -0,0 +1,33 @@
+# T-729: restored base test-only compile blocker
+
+The assigned checkout starts at `f9d4c97f` (WIP 0.2 integration). On 2026-10-08,
+`cargo test -p yoi-workspace-server --lib auth_logging_tests` could not compile
+because `server_workspace_config_wip_tests.rs` still calls `WipRuntime::discover`
+(lines 152 and 192), which no longer exists, and external `WipRuntime::call`
+(lines 170 and 200), which is now crate-private. At the initial failure those
+files were unchanged by the T-729 diagnostic work.
+
+A narrow test filter still builds all lib test modules, so it cannot isolate the
+new authentication boundary tests from this unrelated test API mismatch. This
+was escalated on T-729 instead of silently disabling those tests or widening the
+Ticket to migrate unrelated configuration tests. Future API migration work should
+check affected test-only consumers as well as the normal compilation closure.
+
+The additional no-default-features check also fails in unchanged Runtime modules:
+`resource.rs`, `worker_backend.rs` and `worker_source.rs` import feature-gated
+`workspace_request`, `reqwest` and `futures` unconditionally. The no-default lib
+test build additionally calls feature-gated filesystem constructors. This is not
+an auth diagnostic regression and was not repaired by broadening T-729. Default
+Runtime crate tests pass (345 library tests, 17 tests in each of the two binaries);
+root `cargo check` passes. After correcting the T-729 SHA formatting, the Server
+lib test build reports only the four existing WIP API errors above.
+
+## Resolution of the Server prerequisite
+
+Ticket T-729 seq7 explicitly authorized a narrow test-only migration. Commit
+`717ff255` replaces the helpers with public Tree, path-centered Inspect and
+structured InterfaceReference Invoke. All existing Backend authority, attachment,
+mutation, stale observation and unknown-outcome assertions are retained. All 12
+`workspace_config_integration` tests pass, and the authentication logging tests
+now run (3 passed). No production API was exposed or legacy API revived. The
+no-default-features issue remains separate and unresolved.