.nornir/testmatrix-arms.json
{
"_comment": [
"Rescue arms for the gated-tests guard (nornir_testmatrix::gatedtests).",
"A tests/*.rs whose crate-level `#![cfg(feature = \"X\")]` is not satisfied by its",
"crate's `default` closure does not SKIP. It compiles to an EMPTY test binary and",
"libtest prints `running 0 tests ... ok`. An arm here is the declared re-invocation",
"that turns the features on; `xtask/tests/silenced_tests_guard.rs` holds this file to",
"what is on disk, and `cargo xtask gate --arms` (phase 5) RUNS them.",
"",
"── 2026-07-21 / 2026-08-01 (HISTORY — the three gui arms are GONE) ─────────",
"The first two rounds of this file rescued holger-server-ui's five gui-gated targets",
"and then the two that gated on features `gui` does not imply (demo_walk, one of",
"which had NEVER compiled). That whole crate left for the holger-egui repository on",
"2026-09-16: there is no server/ui/ and no holger-server-ui in [workspace] members.",
"All three arms therefore named a package this workspace does not contain, and they",
"rescued nothing (`audit_repo` on 2026-09-20: `0 rescued by declared arms`). A dead",
"arm is not harmless — it is the file looking populated while covering zero targets —",
"so they are deleted rather than carried. The reasoning they recorded is kept above",
"and in xtask/tests/silenced_tests_guard.rs's header, which is where it belongs.",
"",
"── 2026-09-20 — SIX SILENCED GUARDS, MEASURED ─────────────────────────────",
"`cargo test -p xtask --test silenced_tests_guard` on main at b8562f3:",
"",
" 88 test targets scanned · 7 feature-gated · 0 rescued by declared arms",
" · 6 SILENCED (47 hidden test fns) — RED",
"",
"Every one of the six is a SECURITY guard, and every one of them reported `ok`",
"having executed nothing:",
"",
" server/lib/tests/open_appliance_loads_no_paid_module.rs 6 fns meter-guests",
" THE OPEN APPLIANCE'S MODULE CENSUS. Boots a real holger with the real",
" allocation.wasm and asserts every loaded module by blake3 digest, that the",
" effective grant holds none of principal.read/digest.read/clock.read/",
" audit.write, and that this boot's wasmtime linker defines exactly the granted",
" set. It is the guard that the OPEN appliance cannot load a paid module.",
" MEASURED: `cargo test -p holger-server-lib --test",
" open_appliance_loads_no_paid_module` printed `running 0 tests ... ok`.",
" Its arm names BOTH features: with `meter-guests` alone the file compiles, but",
" three of the six tests are additionally `#[cfg(feature = \"wasm-plugins\")]`",
" and the other two take their own explicit `cfg!(not(wasm-plugins))` branch and",
" assert nothing. An arm with one feature would rescue a two-test stub and call",
" it a census.",
" server/lib/tests/the_meter_is_what_answers.rs 11 fns meter-guests",
" plugin/host/tests/the_grant_is_the_linker.rs 8 fns meter-guests+wasm-plugins",
" plugin/host/tests/resource_bounds_are_named_refusals.rs 7 fns wasm-plugins",
" plugin/host/tests/an_unsigned_module_stops_the_boot.rs 6 fns wasm-plugins+verify-modules",
" server/lib/tests/metering_doors.rs 9 fns metered",
"",
"PRECONDITION, and it is fragile enough to state here: the four arms marked",
"\"needs the wasm guests\" load a REAL module from",
"target/wasm32-unknown-unknown/release/, so `cargo xtask build-wasm-plugins` must",
"have run first. On oden that verb FAILS under the default toolchain —",
"/usr/local/bin/rustc carries no wasm32-unknown-unknown std — and works as",
"`RUSTUP_TOOLCHAIN=stable ~/.cargo/bin/cargo xtask build-wasm-plugins`. `cargo xtask",
"gate --arms` builds the guests itself before running any arm, so the precondition is",
"the gate's problem and not an operator's memory.",
"",
"What these arms PROVE once `cargo xtask gate --arms` is run: each file compiles",
"under the features it declares AND its tests execute, with `ArmRun::green()`",
"refusing an arm that compiled but ran zero tests — the same vacuum, one level up.",
"What they do NOT prove: that the gate is run on a schedule. holger has no CI; the",
"gate is a door, and a door still has to be opened."
],
"arms": [
{
"package": "holger-server-lib",
"test": "the_provenance_gate_stands",
"note": "W17's four proofs. A declared attestation trust root that cannot be read is holger-attest-10 and takes the WHOLE declaration down (measured at bb0302e: from_der_root_files pushed the bytes, so an empty file or a stray PEM became an anchor that matched nothing and the boot said the evidence plane was mounted). The provenance gate refuses an unattested promotion by name with holger-promote-10, refuses a statement about somebody else's bytes, and under Require with NO declared root refuses every hop with holger-attest-11 rather than blaming an artifact. And an estate that declares no root prints a DIFFERENT sentence from one that wrote `provenance: Off` -- the whole defence of the Warn default. Feature `supply-chain` (lean cut 2026-10-17): the promotion engine and its gates are a non-default plane; every row that promotes names it through `jobs`.",
"features": ["supply-chain"]
},
{
"package": "holger-plugin-host",
"test": "the_meter_fuel_ceiling",
"features": ["meter-guests", "wasm-plugins"],
"note": "?17's MEASUREMENT and its ceiling. Loads the real allocation.wasm, asks wasmtime what each of the nine calls burned, and asserts the worst of them is still 100x under the Meter kind's ceiling -- so the number in plugin/abi stops being true the moment the guest outgrows it. Also holds the runaway WAT guest to a NAMED fuel refusal. Silenced without both features: no loader, no Meter kind, zero tests, `ok`."
},
{
"package": "holger-server-lib",
"test": "the_storage_meters_measure_a_real_filesystem",
"features": ["meter-guests", "wasm-plugins"],
"note": "the statvfs proof. Its four filesystem tests run under the default closure; the arm exists for the two in `mod the_open_guest`, which need `meter-guests` to bind the real AllocationMeter over the real HolgerMeterServices and are what prove capacity()/selftest() stopped saying there was nothing to check. Without the arm those two are dark while the file still prints ok -- the same shape the six guards of 2026-09-20 had."
},
{
"package": "holger",
"test": "appliance_gate",
"no_default_features": true,
"features": ["mvp-server", "appliance"],
"note": "the appliance ceremony robot. required-features = [appliance], which cargo SKIPS on a plain `cargo test` with NO warning, no error and no line of output -- strictly darker than an empty binary printing `ok`. Found 2026-09-20 by nornir-testmatrix 0.2.13; 0.2.9 could not see this class at all. The file header always named this exact command; nothing ran it. Verified: 6 passed."
},
{
"package": "holger",
"test": "real_boot_estate_box",
"no_default_features": true,
"features": ["mvp-server", "appliance", "paired", "auth-passkey", "sign", "metered", "admit-share", "front", "wasm-plugins", "meter-guests", "fmt-raw", "fmt-rust", "jobs", "supply-chain", "intel-fetch", "mirror", "dev-narrate"],
"note": "D7, the REAL boot of an estate box with the media's features (mvp-server-musl-metered-narrate): the built holger-server, the shipped declaration, a staged WireGuard seed and the kept feed. Main and twin reach STAGE serving; a twin fed no holger_console_token waits before its doors start (test3-holger-rs r6: the shop fed the bearer to the front alone). required-features = [paired, metered], skipped by a plain cargo test; this arm runs it."
},
{
"package": "holger-server-lib",
"test": "open_appliance_loads_no_paid_module",
"features": ["meter-guests", "wasm-plugins"],
"note": "the OPEN appliance's module census — needs the wasm guests (allocation.wasm)"
},
{
"package": "holger-server-lib",
"test": "the_meter_module_is_verified_before_it_loads",
"features": ["meter-guests", "wasm-plugins"],
"note": "E4: a meter .wasm is verified against the plugin trust root before it loads — no root (holger-plugin-13), unsigned (6), a stranger's or a moved signature (7) refused; a signed one loads with its signer in the census"
},
{
"package": "holger-server-lib",
"test": "the_meter_is_what_answers",
"features": ["meter-guests", "wasm-plugins", "supply-chain"],
"note": "the loaded guest is what answers the usage door — needs the wasm guests, and supply-chain for the promotion and ingest gates it drives (lean cut 2026-10-17)"
},
{
"package": "holger-server-lib",
"test": "intake_chain_holds_a_wheel_until_available",
"features": ["supply-chain"],
"note": "the intake chain over the real doors: a wheel PUT over HTTP sits in INGESTED, is not downloadable, refuses skips by name and reaches AVAILABLE only through every state; the chain is the supply-chain plane"
},
{
"package": "holger-server-lib",
"test": "ai_models_on_the_intake_chain",
"features": ["supply-chain"],
"note": "AI models on the intake chain (lane S10): generated GGUF, Safetensors and ONNX files pass SCANNED with their metadata in the property store and the search axis; a benign pickle, a fake .pt zip with data.pkl, a pickle renamed .safetensors and a lying Safetensors header are refused by code; models.allow_pickle must name a declared repository; the chain is the supply-chain plane"
},
{
"package": "holger-server-lib",
"test": "intake_serves_pip",
"features": ["supply-chain"],
"note": "W1: pip through the intake chain over the real doors. A twine form POST /incoming/legacy/ (the digest is the wheel's, not the form's) and a PUT are INGESTED; S4's AdvanceArtifact walks the first wheel with two approvers (the importer refused); S5's /production/simple/ and /production/simple/<pkg>/ list it with the sealed sha256 only at AVAILABLE, as PEP 503 HTML and as PEP 691 JSON by Accept, and never list the INGESTED one"
},
{
"package": "holger-server-lib",
"test": "intake_serves_pip",
"features": ["supply-chain"],
"ignored": true,
"note": "W1: the REAL pip (docker.io/library/python:3.13-slim-trixie under podman --network host) runs `pip install --index-url <holger>/production/simple/ demo-pkg` after the two-approver walk, installs the AVAILABLE 1.0.0 (not the INGESTED 1.1.0) and imports it. #[ignore]d for a plain cargo test; no podman FAILS by name, never a skip"
},
{
"package": "holger-server-lib",
"test": "scan_sandbox_live",
"features": ["supply-chain"],
"note": "SANDBOX-SCAN (owner 2026-10-23): every scan through the scan worker (in-process in a test build): cgr.dev/chainguard/static gets its package list and a clean CVE list; the same image with an old openssl gets the real Wolfi advisories with their severities; a planted gzip bomb is refused by name; a traversal archive is refused and writes nothing outside; with sandbox: required and no podman every scan is refused as holger-sandbox-1 and nothing is walked in-process"
},
{
"package": "holger-server-lib",
"test": "scan_sandbox_live",
"features": ["supply-chain"],
"ignored": true,
"note": "SANDBOX-SCAN container arms (cargo xtask scan-worker tests, HOLGER_TEST_SANDBOX=required): a bomb the inspector lets through is killed by the container's wall clock (holger-sandbox-2); EICAR is found by clamd in its own sandboxed container"
},
{
"package": "holger-server-lib",
"test": "replication_runs_as_a_resumable_job",
"features": ["mirror"],
"note": "OX-WIRED4: replication as a resumable job through the real doors of a booted holger (mirror: the ReplicationService door and the job queue). Replicate with execute answers a job id and zero counts, JobService.GetJob follows it to done with the counts, prod serves the bytes over FetchArtifact, a second run copies nothing, a Reader admits no job; a replication left queued by a process that died is resumed by the next Holger::start and runs to done"
},
{
"package": "holger-sandbox",
"test": "live_podman",
"features": [],
"ignored": true,
"note": "SANDBOX-SCAN: the worker image under real rootless podman, probed from inside: no network, no name resolves, the root, /etc and /in read-only, the scratch cap holds, uid 65532, no capabilities, no-new-privileges, seccomp on; past the wall clock holger-sandbox-2, past the memory holger-sandbox-3, past the report cap holger-sandbox-4; no container left behind"
},
{
"package": "holger-server-lib",
"test": "pull_through_runs_the_intake_chain",
"features": ["jobs", "online"],
"note": "Pull-through runs the intake chain (owner 2026-10-23), real PyPI and cgr.dev fixtures behind a local fake upstream. pip: 503 + Retry-After, INGESTED as pull-through:pypi, POLICY_CHECKED, 404 while it waits for a person, served from the sealed store after approval; an EICAR wheel refused at the door and never served; auto-approval on, on under approvals: 2 (one vote), refused at load without the floor. OCI: chainguard/static pulled whole with its cosign .sig/.att handed to the provenance verifier, served after approval; the default verifier fails closed; an unsigned image is refused by require_signed"
},
{
"package": "holger-server-lib",
"test": "intake_separation_of_duties",
"features": ["supply-chain"],
"note": "separation of duties over the wire verb (gRPC AdvanceArtifact/GetArtifactState + HTTP /-/intake): the importer never approves even with both duties, two distinct approvers for APPROVED, an Auditor moves nothing, a Developer reads only AVAILABLE; the intake chain is the supply-chain plane"
},
{
"package": "holger-server-lib",
"test": "the_estate_declaration_runs_the_intake_chain",
"features": ["supply-chain", "auth-passkey", "estate"],
"note": "the shipped estate declaration (holger-recipe estate_ron, the file estate-media stages on the box media) boots and runs the intake chain end to end: the console ingests and walks the required scan, never approves, two invited passkey approvers make it APPROVED, production serves it and its PEP 503 index, the audit chain verifies, the staged korp root PEM is the pinned DER"
},
{
"package": "holger-server-lib",
"test": "the_estate_declaration_runs_the_provenance_scanner",
"features": ["supply-chain", "auth-passkey", "estate"],
"note": "HOL-MVP-FORMATS: the shipped estate declaration (holger-recipe estate_ron) installs the provenance scanner (scan.provenance, default: prefer): the intake chain reports the holger-provenance engine in its provenance slot, so the Security page says Provenance: on"
},
{
"package": "holger-server-lib",
"test": "the_artifact_trail_lists_every_step",
"features": ["supply-chain"],
"note": "S8: a wheel's trail by sha256 over gRPC AuditService and HTTP /-/audit/trail lists imported, hash verified, scanned per scanner, policy passed, approved per approver, sealed, hash verified, exported in order; Auditor/Admin only; an edited record breaks the chain and verify names it; a dead SIEM sink does not stop the import and the export catches up from its cursor"
},
{
"package": "holger-server-lib",
"test": "the_audit_chain_and_its_siem_export",
"features": ["sign"],
"note": "S8: the audit hash chain, signed checkpoints, and each SIEM exporter's wire format (JSON lines, RFC 5424 syslog over UDP/TCP/TLS, CEF, OTLP/HTTP JSON) against local listeners"
},
{
"package": "holger-server-lib",
"test": "door_reserved_property_floor",
"features": ["supply-chain"],
"note": "the reserved-property admin floor on the HTTP /-/properties write door; the property store and both its doors are the supply-chain plane (lean cut 2026-10-17)"
},
{
"package": "holger-server-lib",
"test": "metering_doors",
"features": ["metered"],
"note": "the signed-entitlement seam: the conversion, its replay stamp, the forged-fact refusal"
},
{
"package": "holger-server-lib",
"test": "a_lapsed_repository_is_purged_through_the_admin_door",
"features": ["metered"],
"note": "the non-payment purge (holger-lifecycle eef78f8): EntitlementService.Purge empties a Suspended repository and refuses a paying one"
},
{
"package": "holger-server-lib",
"test": "a_purge_follows_the_one_boxs_grace",
"features": ["metered"],
"note": "lane M5: one purge guard (metered::purgeable) on both purge doors; a lapsed, Suspended or Retention repository is purged when the ONE box orders it, and holger keeps no day count"
},
{
"package": "holger-server-lib",
"test": "a_purge_on_the_main_is_applied_on_its_twin",
"features": ["metered"],
"note": "the twin applies the main's purge record (holger-lifecycle 1fbbc1d): two real holgers, the twin deletes what the main purged and keeps what came after"
},
{
"package": "holger-plugin-host",
"test": "the_grant_is_the_linker",
"features": ["meter-guests", "wasm-plugins"],
"note": "the capability grant IS the linker — needs the wasm guests"
},
{
"package": "holger-plugin-host",
"test": "resource_bounds_are_named_refusals",
"features": ["wasm-plugins"],
"note": "fuel, deadline and memory ceilings as NAMED refusals — needs the wasm guests"
},
{
"package": "holger-plugin-host",
"test": "an_unsigned_module_stops_the_boot",
"features": ["wasm-plugins", "verify-modules"],
"note": "an unsigned or tampered module stops the boot rather than shortening the catalog"
},
{
"package": "holger-plugin-host",
"test": "the_floor_never_lets_a_module_go_back",
"features": ["wasm-plugins", "verify-modules"],
"note": "W14, the anti-rollback floor. Real CMS-signed modules against a real root, loaded through the real HandlerCatalog under a KEPT floor: a first activation sets the floor and says so; a correctly signed OLDER version is refused by name (holger-plugin-10, naming supplier/product/offered/floor); the floor survives a restart from disk alone; a corrupt floor file is a refusal (holger-plugin-11), never Absent; two products are two lanes. Silenced without both features: no loader, no verifier, zero tests, `ok` -- which is exactly the shape the chain had before this arm."
},
{
"package": "holger-server-lib",
"test": "real_clients_restore_from_holger",
"ignored": true,
"note": "the REAL dotnet client (mcr.microsoft.com/dotnet/sdk:8.0, NuGet 6.11.2) under podman --network host: `dotnet restore` of a project whose one PackageReference pulls a second package through its .nuspec dependency group, nuget.config <clear/> + holger's v3 index as the ONLY source, then `dotnet package search` against the same index. Asserts exit 0, both .nupkg on the mounted NUGET_PACKAGES dir byte-equal to what holger served, and both ids in the search JSON. #[ignore]d for a plain cargo test (pulls a container image); this arm is what reaches it. No podman = FAILS by name, never a skip. 2026-09-20: this arm is what caught the service index advertising no SearchQueryService type NuGet.Client looks for (it walks /Versioned, /3.4.0, /3.0.0-beta); the spec-read implementation listed the bare type, /3.0.0-rc and /3.5.0 and the client said `The source does not have a Search service!`. The SAME target holds the second real client, and one arm reaches both (an arm names a test TARGET, there is no per-fn filter): docker.io/library/composer:2 (PHP 8.5) -- `composer install` of a root composer.json requiring a package that requires another, repositories = holger only (packagist.org: false), resolved from the p2 documents holger synthesizes out of bare dist zips. Asserts exit 0, both packages under vendor/, composer.lock naming both versions and a dist url that points back at holger, and the two zips in COMPOSER_CACHE_DIR byte-equal to what holger served. Composer accepted the spec-based p2 synthesis with no backend change."
},
{
"package": "holger",
"test": "airgap_export_import",
"features": ["supply-chain", "secure_update", "sign"],
"note": "S5, the airgap through the real binary: an export refuses an artifact without evidence by name (holger-airgap-2) and writes nothing; a tampered bundle is refused at import (a flipped byte, forged evidence re-signed by a trusted release signer = holger-airgap-9, a swapped payload = holger-airgap-8); the imported wheel lands AVAILABLE on an offline holger and is served through the PEP 503 index with the right #sha256. The export and the intake chain are the supply-chain plane."
},
{
"package": "holger",
"test": "promote_cli",
"features": ["supply-chain"],
"note": "The LOCAL `holger-server promote` verb, end to end. The verb is part of the `supply-chain` plane since the lean cut (2026-10-17), so the default build carries neither the verb nor these tests; this arm turns it on."
},
{
"package": "holger",
"test": "bundle_time",
"features": ["secure_update"],
"note": "`holger-server bundle import` decides expiry by the estate's one clock. `secure_update` left the default on 2026-10-22 (the small `cargo build`), so this arm turns the gateway on."
},
{
"package": "holger",
"test": "intel_offline",
"features": ["secure_update"],
"note": "`intel build --offline` and the intel import through the real binary. `secure_update` left the default on 2026-10-22, so this arm turns it on."
},
{
"package": "holger",
"test": "bundle_import_audit",
"features": ["secure_update"],
"note": "The bundle import's audit records through the real binary. `secure_update` left the default on 2026-10-22, so this arm turns it on."
},
{
"package": "holger-server-lib",
"test": "migration_door_e2e",
"features": ["migration"],
"note": "MigrationService against a mock Nexus over a real port. `migration` (lean cut 2026-10-17) carries the service and its agent-lib + connectors; off by default, so without this arm the file compiles to zero tests."
},
{
"package": "holger-plugin-host",
"test": "the_forge_signed_guests_load",
"features": ["wasm-plugins", "verify-modules", "meter-guests"],
"note": "the forge-signed guests (dwarves buildthing --variant plugin-*) load, answer, and are refused by name when their provenance is wrong. Needs the forge-built guests with their .p7s beside them; the owner-root test skips BY NAME without HOLGER_PLUGIN_TRUST_ROOT, the three refusal tests run unconditionally."
},
{
"package": "holger-server-lib",
"test": "the_guest_delivers_what_holger_verifies",
"features": ["metered"],
"note": "holger-monetize-guest's EntitlementService.Set bytes decode with this server's types and verify under monetize's Ed25519 key"
},
{
"package": "holger-server-lib",
"test": "the_one_monetizes_orders_reach_holgers_verbs",
"features": ["metered"],
"note": "G1-pull: every pulled order kind runs holger's own verb through fleet_box::FleetBox or is refused by name"
},
{
"package": "holger-server-lib",
"test": "a_paid_signup_makes_its_first_repository",
"features": ["metered"],
"note": "M4: a paid signup's add_principal makes its first repository (served at once since M4b, its fact at once); a paid refusal names the estate's pay page"
},
{
"package": "holger-server-lib",
"test": "a_sold_repository_serves_at_once",
"features": ["metered"],
"note": "M4b: a repository made by add_principal takes an upload and serves it with no restart; downloads racing the route swap stay correct"
},
{
"package": "holger-server-lib",
"test": "sold_state_survives_the_twin_and_a_recharge",
"features": ["metered"],
"note": "P4 (A8 lane 10): fleet/signups.json, fleet/sold-repositories.json and the sold repositories' artifacts ride the twin (sold before and while it follows) and come back with a recharge"
},
{
"package": "holger-server-lib",
"test": "a_buyer_signs_in_with_the_shops_link_and_owns_their_repository",
"features": ["metered", "front"],
"note": "P1: the shop's first-login invite enrols the estate's first admin once (RepositoryAdmin, SecurityApprover, Auditor); the paid order's repository is the buyer's and private; the renewal door is an admin's. `front` since A28 M14: it reads the public roster (/-/releases), and front left server-lib's default"
},
{
"package": "holger-server-lib",
"test": "a_buyer_on_a_shared_holger_redeems_their_signup_and_grants_others",
"features": ["metered"],
"note": "P1 Path B: a buyer on a shared holger redeems their signup and is bound as owner; owner-only reads and writes; the owner grants and revokes read and write, audited"
},
{
"package": "holger-server-lib",
"test": "a_visitor_reads_holgers_two_signup_choices",
"features": ["metered"],
"note": "lane SU1: a visitor reads Holger's two sign-up choices over a real holger's door (GET /-/signup answers both links: an account on this site and a private instance, each sold by the ONE box); the page decides nothing"
},
{
"package": "holger-server-lib",
"test": "repositories_wanted_clears_at_the_next_start",
"features": ["metered"],
"note": "W9: a sold repository the live route table cannot serve (gated template) is repositories_wanted until the next start serves it; nothing else acts on the word"
},
{
"package": "holger-server-lib",
"test": "an_estate_admin_invites_its_importer_and_approver",
"features": ["supply-chain"],
"note": "W7: the estate's duty table on a fresh box: the console's admins hold RepositoryAdmin + SecurityApprover and never import, they invite an Importer and a second approver by duty, and a wheel reaches AVAILABLE"
},
{
"package": "holger-server-lib",
"test": "a_lean_box_mails_its_sign_in_link_through_its_front",
"features": ["metered"],
"note": "A19 row 13 (the lean estate, the SMTP gap): the sign-in-again mail of a box behind its front dials a loopback forward through the front's egress door, naming the relay in its TLS"
},
{
"package": "holger-server-lib",
"test": "a_late_monetize_key_is_enforced_without_a_restart",
"features": ["metered"],
"note": "G1 (A7 row 8): the front's monetize key and pay page, fed after the start, are enforced in the same process (holger-metered-6 names the pay page)"
},
{
"package": "holger-server-lib",
"test": "the_paid_limit_refuses_the_upload_that_would_pass_it",
"features": ["metered"],
"note": "P1: the paid disk_bytes cap at the write door (holger-metered-6, DELETE still taken, suspended takes nothing, a declared length past the room refused on the head)"
},
{
"package": "holger-server-lib",
"test": "grpc_error_codes_on_the_wire",
"features": ["supply-chain"],
"note": "a_second_service_also_arrives_coded_on_the_wire drives PromotionService (holger-promote-7 on the wire), which is the supply-chain plane since the lean cut; the other five tests run under the default closure"
},
{
"package": "holger-server-lib",
"test": "meta_door_read_gate",
"features": ["supply-chain"],
"note": "a_denied_repo_stays_denied_however_the_query_spells_it drives the /-/sbom and /-/properties doors, which are the supply-chain plane since the lean cut; the other four tests run under the default closure"
},
{
"package": "holger-plugin-host",
"test": "router_cannot_tell_them_apart",
"features": ["wasm-plugins"],
"note": "a loaded module and a linked handler in one FastRoutes table answer alike — needs the wasm guests (registry::scan is the wasm host)"
},
{
"package": "holger-plugin-host",
"test": "config_names_the_reader",
"features": ["wasm-plugins"],
"note": "ron_handler names the reader, linked or loaded alike — needs the wasm guests"
},
{
"package": "holger-mannequin",
"features": ["gui"],
"note": "the mannequin GUI and its robot (eframe, wgpu, facett) sit behind the non-default `gui` feature (C1, 2026-10-19), so the mock daemon builds headless; this arm runs gui_robot, robot_shell, facet_reaction_matrix and look_preset_robot"
},
{
"package": "holger-server-lib",
"test": "bundle_import_runs_in_a_job",
"features": ["supply-chain", "fmt-raw"],
"note": "HOL-SANDBOX-TRAIT: every bundle is verified in a verify-bundle job through the server's one runner (here the in-process test runner): a good bundle imports through the job, a tampered one is refused with its reason audited, a malformed one or a crashed job fails only that job, the server never opens the bundle (inotify), a forged or replayed signed result is refused (holger-sandbox-16) and nothing lands."
},
{
"package": "holger-server-lib",
"test": "the_box_imports_bundles_without_a_shell",
"features": ["supply-chain", "jobs"],
"note": "W4: the box's import doors over the real doors. An intel bundle POSTed to /-/intel/import goes live and the intake scan reads it; an update bundle streamed to AdminService.ImportBundle lands AVAILABLE through IntakeChain::land_imported with its trail; the intel.inbox / bundle.inbox jera sweep archives or refuses with a .why.txt; a caller without RepositoryAdmin or SecurityApprover is refused holger-duty-2; a tampered bundle lands nothing"
},
{
"package": "holger-server-lib",
"test": "an_online_estate_refreshes_its_intel",
"features": ["jobs", "intel-refresh"],
"note": "W4: intel.refresh. An online estate's first boot fetches OSV/NVD/KEV from a loopback fixture mirror and lands them through the import door; a clean wheel then passes SCANNED and the vulnerable one is held; an intel.offline: true config queues no refresh and never dials (holger-import-7)"
},
{
"package": "holger-server-lib",
"test": "the_evidence_rpc_returns_signed_records",
"features": ["supply-chain", "sign"],
"note": "G2 (A18 §4 #9): PromotionService.GetArtifactEvidence returns every stored record with its DSSE envelope and signer certificate, the signed-evidence path holger-ui's artifact view shows. Dark without both features; run by this arm and by `cargo xtask suite-check` (step sign:holger-server-lib)."
},
{
"package": "holger-server-lib",
"test": "the_license_scanner_signs_its_evidence",
"features": ["supply-chain", "sign"],
"note": "G2 (A18 §4 #9): the SPDX license scanner's verdict is a signed evidence record. Dark without both features; run by this arm and by `cargo xtask suite-check` (sign:holger-server-lib)."
},
{
"package": "holger-server-lib",
"test": "the_scanner_framework_records_signed_evidence",
"features": ["supply-chain", "sign"],
"note": "G2 (A18 §4 #9): every scanner of the framework records signed evidence bound to the sha256. Dark without both features; run by this arm and by `cargo xtask suite-check` (sign:holger-server-lib)."
},
{
"package": "holger-provenance",
"test": "maven_pgp",
"features": ["pgp"],
"note": "T9b (2026-10-25): T9's real Maven Central .asc signatures (guava RSA/SHA-512, slf4j ECDSA P-521) against pinned keys. Dark without holger-provenance's `pgp` feature, which left the default so the default holger tree is back under its bound; run by this arm and by `cargo xtask suite-check` (trust:maven-pgp). Without the feature the same pins are refused by name: tests/pgp_build_feature.rs (trust:pgp-not-built)."
},
{
"package": "holger",
"test": "downstream_serves_the_build_systems",
"features": ["supply-chain", "secure_update", "sign", "jobs", "sync"],
"note": "H3: the downstream serves the on-prem build systems from the signed bundle its one upstream exported (pulled or imported), and an invalidated package is blocked there. Needs the downstream binary built first into the same target (`cargo build --manifest-path holger-downstream/Cargo.toml --features downstream-wg,sandbox-off --bin holger-downstream`; its jobs run in-process, lane HOL-SANDBOX-TRAIT) or HOLGER_DOWNSTREAM_BIN, and FAILS by name without it. A5A7 2026-10-26: 3 passed, 1 ignored."
},
{
"package": "holger",
"test": "one_way_downstream",
"features": ["supply-chain", "secure_update", "sign", "jobs", "sync"],
"note": "HOL-CDS: the one-way downstream takes the pushed bundle through its inbox after the admin's first-import grant and refuses every way out by line (suite-check `one-way` runs it beside the one-way binary). Declared here so the silenced-test guard sees its arm (HOL-PRODUCTS, 2026-10-30)."
},
{
"package": "holger-server-lib",
"test": "a_downstream_dials_only_its_upstream",
"features": ["gateway"],
"note": "H3: a downstream's egress is pinned to its one upstream; every other host is refused. A5A7 2026-10-26: 1 passed."
},
{
"package": "holger-server-lib",
"test": "pull_through_apk",
"features": ["jobs", "online", "supply-chain", "pull-apk"],
"note": "T8: apk pull-through runs the intake chain against a fake upstream (the hit waited for, bounded). A5A7 2026-10-26: 5 passed, 1 ignored (the real apk client)."
},
{
"package": "holger-server-lib",
"test": "sync_between_two_holgers",
"features": ["sync", "online", "supply-chain"],
"note": "H4: two Holgers sync over the sync link, and an invalidation reaches the other. A5A7 2026-10-26: 3 passed."
},
{
"package": "holger-server-lib",
"test": "the_open_meter_is_built_in",
"features": ["allow-meter"],
"note": "The open meter is built in under `allow-meter`. A5A7 2026-10-26: 2 passed."
},
{
"package": "holger",
"test": "e2e_internet_to_build_systems",
"features": ["supply-chain", "secure_update", "sign", "jobs", "sync", "online", "fmt-all"],
"note": "H6: the end-to-end gate. suite-check downstream:e2e compiles and runs it (it skips by name without the real clients); `cargo xtask e2e` runs it in its clients image with HOLGER_E2E_REQUIRED=1."
},
{
"package": "holger-server-lib",
"test": "a_dead_main_is_recharged_from_its_remote_twin",
"features": ["estate"],
"note": "H2's estate cut (HCUT): the recharge lane over the twin's door. suite-check estate:twin runs it."
},
{
"package": "holger-server-lib",
"test": "pairing_renewal",
"features": ["estate"],
"note": "H2's estate cut (HCUT): the pairing and replication certificates renewed. suite-check estate:twin runs it."
},
{
"package": "holger-server-lib",
"test": "the_twin_follows_at_once_when_certified",
"features": ["estate"],
"note": "H2's estate cut (HCUT): a certified twin follows at once. suite-check estate:twin runs it."
},
{
"package": "holger-server-lib",
"test": "the_twin_follows_over_mutual_tls_across_addresses",
"features": ["estate"],
"note": "H2's estate cut (HCUT): the twin over mutual TLS across addresses. suite-check estate:twin runs it."
},
{
"package": "holger-server-lib",
"test": "the_shipped_declaration_lets_the_front_certify_the_twin",
"features": ["supply-chain", "estate"],
"note": "The front certifies the twin under the shipped declaration (nordisk-twin's certify over GrpcBoxes): estate since H2's estate cut, supply-chain for the declaration's intake chain."
},
{
"package": "holger-server-lib",
"test": "the_estate_declaration_serves_npm_through_the_intake_chain",
"features": ["supply-chain", "estate"],
"note": "The shipped estate declaration (holger_recipe::estate_ron) names a replication_door, so the box boots only in an estate build (HCUT). suite-check estate:declaration runs it."
},
{
"package": "holger-server-lib",
"test": "the_shipped_declaration_keeps_the_fronts_installer_material",
"features": ["supply-chain", "estate"],
"note": "The shipped estate declaration (holger_recipe::estate_ron) names a replication_door, so the box boots only in an estate build (HCUT). suite-check estate:declaration runs it."
},
{
"package": "holger-server-lib",
"test": "an_airgap_estate_box_imports_signed_intel",
"features": ["supply-chain", "estate"],
"note": "The shipped estate declaration (holger_recipe::estate_ron) names a replication_door, so the box boots only in an estate build (HCUT). suite-check estate:declaration runs it."
},
{
"package": "holger-server-lib",
"test": "a_main_fed_its_keys_again_mails_through_its_relay",
"features": ["metered", "auth-passkey"],
"note": "MAIL-RELAY (row 12): a laid main fed its signed refeed again mails the first link through the kept relay at once, and an admin invite reaches its address through it. required-features = [metered, auth-passkey], skipped by a plain cargo test; the metered suite (cargo xtask test) and this arm run it."
},
{
"package": "holger-server-lib",
"test": "the_fed_public_repositories_are_read_with_no_sign_in",
"features": ["supply-chain", "estate"],
"note": "NIGHT-PUBREPO: an estate's public repositories are DATA, fed per estate and read with no sign-in on a gated box. The shipped estate declaration names a replication_door: an estate build only (HCUT)."
},
{
"package": "holger-server-lib",
"test": "a_downstream_takes_its_invite_through_its_door",
"features": ["downstream-wg"],
"note": "OX-WGDS3: a WireGuard downstream reads its keys and takes the upstream's signed invite through its own door (GET /-/sync/key, POST /-/sync/upstreams/invite). Also suite-check downstream:wg-invite (lane OX-WIRED2)."
},
{
"package": "holger-server-lib",
"test": "the_downstream_doors_enrol_invite_and_revoke",
"features": ["sync"],
"note": "OX-WIRED: the downstream doors POST /-/sync/downstreams/enrol, /invite and /revoke over HTTP end to end. Arm added by lane OX-WIRED2 (the silenced-tests guard was red on it)."
},
{
"package": "holger-server-lib",
"test": "a_downstreams_declaration_loads",
"features": ["sync"],
"note": "OX-WGDS3: a downstream medium's declaration (recipe downstream_ron, via: Front and via: Wireguard) loads strictly and says what the box will do. Arm added by lane OX-WIRED2 (the silenced-tests guard was red on it)."
},
{
"package": "holger-server-lib",
"test": "a_refeed_and_the_boot_agree_on_public_repositories",
"features": ["metered"],
"note": "RA5-19: the ONE box's signed refeed is kept only when the next boot can apply it, and the boot never refuses to start over a kept list (metered). Arm added by lane OX-WIRED2 (the silenced-tests guard was red on it)."
}
]
}