src/mimir_lens/room_feed/boundary_tests.rs
//! The system boundary through the lens doors ([`crate::mimir_lens::answer`]
//! and `CodeRoom.Answer` `Mimir.SystemBoundary`), over the `net` fixture
//! ([`super::fixture::boundary_ws`]): which of our functions reach which
//! class of system call, and the path each answer names.
use serde_json::{Value, json};
use super::fixture::{self, boundary_ws};
fn state(v: &Value) -> &str {
v["lens_meta"]["state"].as_str().unwrap_or_else(|| panic!("no lens_meta.state: {v}"))
}
fn class<'a>(classes: &'a Value, name: &str) -> Option<&'a Value> {
classes.as_array().and_then(|a| a.iter().find(|c| c["class"] == name))
}
fn path(row: &Value) -> Vec<String> {
row["path"].as_array().unwrap_or_else(|| panic!("no path: {row}")).iter().map(|s| s.as_str().unwrap().to_string()).collect()
}
#[test]
fn system_boundary_names_the_classes_a_repo_reaches_and_the_path_of_each() {
let _g = fixture::serial();
let ws = boundary_ws::workspace(true);
let v = ws.ask("system_boundary", json!({ "repo": boundary_ws::NET }));
assert_eq!(state(&v), "complete", "{v}");
let net = class(&v["classes"], "network").unwrap_or_else(|| panic!("no network class: {}", v["classes"]));
// fetch crosses into the dependency; start reaches it through fetch
assert_eq!(net["functions"], 2, "{net}");
assert_eq!(net["syscalls"], json!(["connect"]));
let row = &net["from"][0];
assert_eq!((row["border"].as_bool(), row["syscall"].as_str(), row["uncertain"].as_bool()), (Some(true), Some("connect"), Some(false)), "{row}");
let p = path(row);
assert!(p[0].ends_with("fetch"), "{p:?}");
assert!(p[1].contains("get"), "{p:?}");
assert!(p.iter().any(|s| s.contains("TcpStream")), "{p:?}");
assert!(p[p.len() - 2].contains("connect"), "libc connect before the call: {p:?}");
assert_eq!(p.last().unwrap(), "syscall connect #42 (network)", "{p:?}");
assert_eq!(row["hops"], 5);
assert_eq!(row["kernel_entry"], "__x64_sys_connect", "the call enters the kernel there (BTF)");
let file = class(&v["classes"], "file").unwrap_or_else(|| panic!("no file class: {}", v["classes"]));
assert_eq!(file["functions"], 1);
assert_eq!(file["syscalls"], json!(["openat"]), "glibc opens with openat");
assert!(path(&file["from"][0]).last().unwrap().starts_with("syscall openat #257"));
// the pure fn is in no class
let all = v.to_string();
assert!(!all.contains("sum"), "the pure fn reaches nothing: {all}");
assert_eq!((v["functions_seen"].as_u64(), v["functions_reaching"].as_u64()), (Some(4), Some(3)));
// `worst` lists the rows (border crossings first), each naming its path
assert!(v["worst"].as_array().unwrap().iter().all(|r| !path(r).is_empty()));
}
#[test]
fn a_class_asked_for_is_the_only_one_answered_and_a_wrong_one_refused() {
let _g = fixture::serial();
let ws = boundary_ws::workspace(true);
let v = ws.ask("system_boundary", json!({ "repo": boundary_ws::NET, "class": "network" }));
let classes: Vec<&str> = v["classes"].as_array().unwrap().iter().map(|c| c["class"].as_str().unwrap()).collect();
assert_eq!(classes, vec!["network"], "{v}");
let bad = ws.ask("system_boundary", json!({ "repo": boundary_ws::NET, "class": "networking" }));
assert_eq!(state(&bad), "invalid_argument", "{bad}");
}
#[test]
fn data_reach_answers_which_of_our_functions_reach_the_network_with_a_path() {
let _g = fixture::serial();
let ws = boundary_ws::workspace(true);
let v = ws.ask("data_reach", json!({ "class": "network" }));
let sys = &v["syscalls"];
assert_eq!(sys.as_array().map(Vec::len), Some(1), "{v}");
let net = class(sys, "network").unwrap();
let fns: Vec<&str> = net["from"].as_array().unwrap().iter().map(|r| r["function"].as_str().unwrap()).collect();
assert!(fns.iter().any(|f| f.ends_with("fetch")) && fns.iter().any(|f| f.ends_with("start")), "{fns:?}");
// border first: fetch leaves our code, start only calls fetch
assert!(fns[0].ends_with("fetch"), "{fns:?}");
assert!(path(&net["from"][1]).first().unwrap().ends_with("start"));
assert_eq!(path(&net["from"][1]).last().unwrap(), "syscall connect #42 (network)");
}
#[test]
fn reachable_vuln_says_what_the_vulnerable_crate_can_reach_at_the_boundary() {
let _g = fixture::serial();
let ws = boundary_ws::workspace(true);
let v = ws.ask("reachable_vuln", json!({}));
let row = v["worst"].as_array().unwrap().iter().find(|r| r["crate"] == "hyperish").unwrap_or_else(|| panic!("no hyperish finding: {v}"));
let b = &row["boundary"];
assert_eq!(b["classes"], json!(["network"]), "{row}");
let p = path(b);
assert!(p[0].ends_with("fetch") && p[1].contains("get"), "our fn, then into the crate: {p:?}");
assert_eq!(p.last().unwrap(), "syscall connect #42 (network)");
}
#[test]
fn the_code_room_door_answers_the_system_boundary_view() {
let _g = fixture::serial();
let ws = boundary_ws::workspace(true);
let v = crate::code_room::reader::answer("Mimir.SystemBoundary", &ws.reach(), &json!({ "repo": boundary_ws::NET })).unwrap();
assert_eq!(v["state"], "complete", "{v}");
assert!(class(&v["classes"], "network").is_some());
}
/// A lake the boundary never ran on holds no `syscall` node, and data_reach
/// must not fold the dependency universe (8.2 M nodes, 951 s on the lake
/// copy, 2026-10-19) only to say so: the same empty `syscalls` section with
/// the same no-boundary note, and the ring room never built.
#[test]
fn data_reach_without_the_boundary_skips_the_universe_fold() {
let _g = fixture::serial();
let ws = boundary_ws::workspace(false);
let v = ws.ask("data_reach", json!({}));
assert_eq!(v["syscalls"], json!([]), "{v}");
assert_eq!(v["syscall_functions_seen"], 0);
assert_eq!(v["syscall_functions_reaching"], 0);
assert!(
v["evidence_note"].as_str().unwrap().contains("syscalls: no system call node in the room"),
"the no-boundary note is the same as the folded path's: {v}"
);
let ring = crate::code_room::Scope::current().with_universe(true);
assert!(ws.room.peek(&ring).unwrap().is_none(), "the universe room was folded only to answer 'no boundary'");
}
/// `warm_ring` BIRTHS the dependency-ring view when none is kept and the
/// caller saw a boundary (`birth`), and a later call finds the kept one
/// whatever the flag. (Live 2026-10-20: the first 140-166 s ring fold
/// happened under a lens on the panes lane and kept losing the post-consume
/// races — the warm job now pays the first fold on the rooms lane, and the
/// pinned view plus the advance keep it alive from there.) Without `birth`
/// the no-boundary law stands: nothing folds the universe to say "no
/// boundary".
#[test]
fn warm_ring_births_the_ring_view_and_keeps_it() {
let _g = fixture::serial();
let ws = boundary_ws::workspace(true);
let ring = crate::code_room::Scope::current().with_universe(true);
assert!(ws.room.peek(&ring).unwrap().is_none(), "no ring view kept yet");
assert!(ws.room.warm_ring(false).unwrap().is_none(), "no birth without the boundary gate");
let first = ws.room.warm_ring(true).unwrap();
assert!(first.is_some(), "warm_ring pays the first ring fold when none is kept");
assert!(!first.unwrap().0, "a birth is a build, not an advance");
assert!(ws.room.peek(&ring).unwrap().is_some(), "the ring view is kept");
let again = ws.room.warm_ring(false).unwrap();
assert!(again.is_some(), "a kept ring view is found again, birth flag or not");
}
#[test]
fn without_the_boundary_written_the_lens_says_so_instead_of_reaching_nothing() {
let _g = fixture::serial();
let ws = boundary_ws::workspace(false);
let v = ws.ask("system_boundary", json!({ "repo": boundary_ws::NET }));
assert_eq!(state(&v), "empty_gap", "{v}");
assert!(v["evidence_note"].as_str().unwrap().contains("boundary"), "{v}");
}