package web import "testing" // R-50b(a) — wrapper drift must be VISIBLE, and "unknown" must never read as "mismatch". // // The wrapper is root-owned, 0755, and installed from raw/branch/main: unversioned, unpinned, and // absent from every manifest until v0.68.0. This is the surface that makes drift answerable. func TestParseReportedWrapperSHA(t *testing.T) { cases := []struct { name, report, want string }{ {"present", `{"host":{"wrapper_sha256":"AABBCC"}}`, "aabbcc"}, {"lowercased and trimmed", `{"host":{"wrapper_sha256":" AaBb "}}`, "aabb"}, {"absent key", `{"host":{"agent_version":"0.91.0"}}`, ""}, {"no host stanza", `{"guests":[]}`, ""}, {"empty report", ``, ""}, {"malformed json", `{nope`, ""}, } for _, tc := range cases { t.Run(tc.name, func(t *testing.T) { if got := parseReportedWrapperSHA(tc.report); got != tc.want { t.Errorf("parseReportedWrapperSHA(%q) = %q, want %q", tc.report, got, tc.want) } }) } } // The comparison itself. The load-bearing case is the pair of UNKNOWNS: an un-vouched hub, or an // agent below 0.91.0 that reports nothing, must be quiet — lighting every host amber on rollout day // is how a warning gets trained into background noise. func TestWrapperDriftComparison(t *testing.T) { const vouched = "1111111111111111111111111111111111111111111111111111111111111111" const other = "2222222222222222222222222222222222222222222222222222222222222222" cases := []struct { name, reported, vouched, want string }{ {"match", vouched, vouched, "ok"}, {"match is case-insensitive", "AAAA", "aaaa", "ok"}, {"mismatch", other, vouched, "mismatch"}, {"agent reports nothing (pre-0.91.0) → quiet", "", vouched, ""}, {"hub has vouched nothing → quiet", vouched, "", ""}, {"neither side known → quiet", "", "", ""}, } for _, tc := range cases { t.Run(tc.name, func(t *testing.T) { got := compareWrapperSHA(tc.reported, tc.vouched) if got != tc.want { t.Errorf("compareWrapperSHA(%q, %q) = %q, want %q", tc.reported, tc.vouched, got, tc.want) } }) } }