test: enforce critical scenario and protocol evidence (stage 2)

[luokerenx4]

The scenario/contract catalog now has executable evidence for a bounded critical local set, and source CI fails when its required assertions do not actually pass. The new shutdown journey also reproduces a real lifecycle bug: child termination previously allowed dispose() to return before terminal task/conversation/Issue/delivery persistence finished. Shutdown now drains those continuations, shares completion across concurrent disposal calls and rejects new dispatches.

Builds on merged #1667 and targets current dev at e024be3. This PR contains only Stage 2 (one commit, 37 changed files), rather than a stacked Stage 1 diff. Keep it open for maintainer review.

Changes

• Add three central integration specs (10 cases): broker-free reusable Chat with real controlled child output decoding; native Session identity recovery after child failure, HTTP interrupt/release and stale-execution rejection; real loopback Alice/UTA approval HTTP with missing/stale hashes, readonly changes, concurrent duplicate approval, ledger replay after restart, transport reconnect, venue rejection and cancellation.
• Resolve critical-local from five reviewed, bounded coverage rows. Fourteen required assertion references must appear uniquely and pass. Skipped/omitted/ambiguous evidence, narrowing the gate, empty execution, report/spawn errors and hook/cleanup failures cannot produce acceptance. Existing pnpm test and side-effect lanes retain their scopes.
• Extend the existing selector with actual Vitest JSON receipts: commit/index tree, dirty state, platform, execution/skip/failure counts, required evidence and temporary report cleanup. Warnings are explicitly uncollected diagnostics; native/venue cleanup and artifact acceptance are not inferred.
• Invoke pnpm test:critical inside the existing dev PR and master/manual source jobs and always upload its receipt. Keep the existing job topology, build/release authority and dedicated platform/paper runners.
• Reject empty/truncated desktop Workspace receipts unless all twelve actual producer subchecks pass, including cleanup; retain renderer-error rejection. Update owner guides, matrix gaps and the canonical plan.

External agent executables use controlled real Node children; venue behavior uses MockBroker behind real loopback HTTP. These tests prove local affected layers, not paid native CLI authentication or real brokerage execution.

Validation

Check	Observed result
Required gate on published clean commit 2c13e8058aa750036ffae1aac9cc208da0fd810d	5 files, 17 cases, all 14 required assertion references passed; receipt accepted with dirty=false
Complete deterministic integration	5 files / 29 cases passed
Workflow/selector contracts	12 files / 107 cases passed
Root, UTA, UI and central spec/runner-guard types	All passed
Real Guardian recovery smoke	Duplicate ownership, graceful takeover, crash reclamation and forced stubborn-child reclamation passed
Shutdown regression falsification	Deliberately delayed terminal persistence fails with the prior service implementation and passes with the fix
Actual Vitest collection	Exact catalog match: 873 hermetic and 5 integration specs; total inventory 900 specs / 70 commands
Syntax, repository document references, whitespace	Passed

The bounded gate measured 22.23 seconds in the initial verified run. The final published tree is identical to the locally verified tree. This host used the documented prebuilt native subprocess dependencies and inherited pnpm_config_verify_deps_before_run=false to avoid pnpm implicitly reinstalling a modified manifest.

Full hermetic run is not green: all 873 files ran; 869 passed, 3 failed and 1 skipped; 7,450 cases passed, 4 failed and 5 skipped. Connector unlink timed out and passed the isolated two-file rerun. The Office Session action failure also reproduces on unmodified dev and matches existing #1440; the other Office carry failure passes isolated rerun (on both baseline and this branch), while the two-file rerun failed a different replay transition. The unchanged PTY recovery test observed five probes instead of its exact expected four, then passed isolated rerun; tracked separately as #1671. These UI/CLI files are untouched, and their failures are retained as failed evidence rather than reclassified as acceptance.

Review order and limits

1. New central specs and tests/helpers/workspace-journey.ts: real layers, controlled boundaries and failure/recovery assertions.
2. src/workspaces/service.ts: dispatch admission/completion tracking and terminal persistence during shutdown.
3. scripts/test-results.mjs, runner/receipt guards, tests/gates.json and the existing source CI jobs.
4. docs/testing.md and plans/test-system-grouping.md: execution receipts and remaining gaps.

Try pnpm test:critical --receipt artifacts/tests/critical-local.json or inspect with pnpm test:select --gate critical-local --json. Required gates reject selector/test-name narrowing.

Native macOS/Windows desktop close/reopen/explicit quit, browser onboarding/PTY reconnect, Docker/SSH, external-provider and real paper-account acceptance were not run. Their broader matrix rows remain partial; native/artifact consumers retain their own acceptance receipts. No release operation or merge is included.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
openalice-demo	Ready	Preview	Sep 30, 2026 9:59am UTC