v0.3.15-pre.007

crates/ksp-app-raw-transaction-ingest-desk/tests/desktop_security.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-app-raw-transaction-ingest-desk/tests/desktop_security.rs
-// version: 3
+// version: 4
 
 //! Desktop security canaries for the Raw Transaction Ingest Desk scaffold.
 
@@ -82,3 +82,31 @@ fn pre_006_route_inventory_dto_surface_excludes_endpoint_secret_and_physical_sto
         assert!(!dto.contains(forbidden), "route DTO contains forbidden field marker {forbidden}");
     }
 }
+
+#[test]
+fn pre_007_start_request_and_acknowledgement_are_logical_only_and_resource_free() {
+    let dto = read_text(app_root().join("src/dto_route.rs").as_path());
+    for required in ["profile_id", "route_id", "inventory_generation", "commitment", "network"] {
+        assert!(dto.contains(required), "missing safe Start field marker {required}");
+    }
+    for forbidden in [
+        "endpoint_name",
+        "endpoint_url",
+        "api_key",
+        "connection_uri",
+        "source_key",
+        "secret_metadata",
+        "worker_handle",
+        "http_pool",
+        "ws_endpoint",
+        "yellowstone_channel",
+    ] {
+        assert!(!dto.contains(forbidden), "Start DTO exposes forbidden physical marker {forbidden}");
+    }
+    let route_start = read_text(app_root().join("src/route_start.rs").as_path());
+    assert!(route_start.contains("ERROR_CODE_ROUTE_START_STALE_INVENTORY"));
+    assert!(route_start.contains("build_route_inventory_with_environment"));
+    assert!(route_start.contains("resolve_store_config_profile"));
+    assert!(!route_start.contains("with_context("endpoint"));
+    assert!(!route_start.contains("with_context("provider"));
+}