feat(device-plane): add fail-closed deploy foundation

2026-07-25 21:29:05 +03:00
parent e9e03143cd
commit e217723784
36 changed files with 3729 additions and 0 deletions
@@ -0,0 +1,51 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import {
+  ARUSNAVI_B2_MODEL_PROFILE,
+  assertB2ProfileInvariant,
+  inspectUnverifiedInitialBytes,
+} from "../src/index.mjs";
+
+test("records the official B2 route and identity evidence", () => {
+  assert.equal(assertB2ProfileInvariant(), true);
+  assert.equal(ARUSNAVI_B2_MODEL_PROFILE.monitoringServerSlots, 4);
+  assert.equal(ARUSNAVI_B2_MODEL_PROFILE.protocol, "INTERNAL");
+  assert.equal(ARUSNAVI_B2_MODEL_PROFILE.serverIdentity.kind, "imei");
+  assert.equal(
+    ARUSNAVI_B2_MODEL_PROFILE.routeCompatibility.gelios,
+    "parallel-preserved",
+  );
+});
+
+test("fails closed instead of guessing an IMEI from unverified bytes", () => {
+  const fakeBytes = Buffer.from(
+    "unverified-frame-with-fake-identifier-000000000000001",
+    "utf8",
+  );
+  const evidence = inspectUnverifiedInitialBytes(fakeBytes);
+  const serialized = JSON.stringify(evidence);
+  assert.equal(evidence.status, "official_framing_required");
+  assert.equal(evidence.identifierExtracted, false);
+  assert.equal(serialized.includes("000000000000001"), false);
+  assert.match(evidence.contentDigest, /^sha256:[a-f0-9]{64}$/);
+});
+
+test("enforces the bounded initial frame evidence window", () => {
+  assert.throws(
+    () => inspectUnverifiedInitialBytes(Buffer.alloc(0)),
+    /b2_initial_bytes_empty/,
+  );
+  assert.throws(
+    () => inspectUnverifiedInitialBytes(Buffer.alloc(4097)),
+    /b2_initial_bytes_limit_exceeded/,
+  );
+});
+
+test("exports no command builder and keeps transport disabled", () => {
+  assert.equal(ARUSNAVI_B2_MODEL_PROFILE.commandTransport.status, "disabled");
+  assert.equal(
+    ARUSNAVI_B2_MODEL_PROFILE.commandTransport.exportedCommandBuilders,
+    0,
+  );
+});