Hare
7bb4096373
T-729: distinguish issued_in_future from expired with exact checked times and overflow-safe deltas; retain request-binding mismatch reasons and proof verification progress. Correlate claimed Runtime/Worker/JTI via fixed-size fingerprints and server-generated rejection IDs, bound request metadata, omit query/raw claims/error/body/header/key material. Preserve allow/deny ordering and generic 401 responses; document diagnostic limits and T-728 policy ownership. Reported same-machine incident remains unconfirmed. Validation: worker-runtime auth filter 3 passed; worker-runtime crate 345 lib + 17 per binary passed; Server auth logging 3 passed (17 rejection cases on both routers plus bounded metadata and generic repository401); workspace_config_integration 12 passed; Server crate 692 lib + 11 bin passed; root cargo check; cargo fmt --all -- --check; rustfmt included config tests --check; git diff --check HEAD. Existing no-default Runtime feature-gate breakage remains documented and out of scope.
34 lines
2.1 KiB
Markdown
34 lines
2.1 KiB
Markdown
# T-729: restored base test-only compile blocker
|
|
|
|
The assigned checkout starts at `f9d4c97f` (WIP 0.2 integration). On 2026-10-08,
|
|
`cargo test -p yoi-workspace-server --lib auth_logging_tests` could not compile
|
|
because `server_workspace_config_wip_tests.rs` still calls `WipRuntime::discover`
|
|
(lines 152 and 192), which no longer exists, and external `WipRuntime::call`
|
|
(lines 170 and 200), which is now crate-private. At the initial failure those
|
|
files were unchanged by the T-729 diagnostic work.
|
|
|
|
A narrow test filter still builds all lib test modules, so it cannot isolate the
|
|
new authentication boundary tests from this unrelated test API mismatch. This
|
|
was escalated on T-729 instead of silently disabling those tests or widening the
|
|
Ticket to migrate unrelated configuration tests. Future API migration work should
|
|
check affected test-only consumers as well as the normal compilation closure.
|
|
|
|
The additional no-default-features check also fails in unchanged Runtime modules:
|
|
`resource.rs`, `worker_backend.rs` and `worker_source.rs` import feature-gated
|
|
`workspace_request`, `reqwest` and `futures` unconditionally. The no-default lib
|
|
test build additionally calls feature-gated filesystem constructors. This is not
|
|
an auth diagnostic regression and was not repaired by broadening T-729. Default
|
|
Runtime crate tests pass (345 library tests, 17 tests in each of the two binaries);
|
|
root `cargo check` passes. After correcting the T-729 SHA formatting, the Server
|
|
lib test build reports only the four existing WIP API errors above.
|
|
|
|
## Resolution of the Server prerequisite
|
|
|
|
Ticket T-729 seq7 explicitly authorized a narrow test-only migration. Commit
|
|
`717ff255` replaces the helpers with public Tree, path-centered Inspect and
|
|
structured InterfaceReference Invoke. All existing Backend authority, attachment,
|
|
mutation, stale observation and unknown-outcome assertions are retained. All 12
|
|
`workspace_config_integration` tests pass, and the authentication logging tests
|
|
now run (3 passed). No production API was exposed or legacy API revived. The
|
|
no-default-features issue remains separate and unresolved.
|