v0.3.14-pre.004

crates/ksp-worker-raw-transaction-ingest-lib/tests/hardening.rs

@@ -1,7 +1,7 @@
 // file: crates/ksp-worker-raw-transaction-ingest-lib/tests/hardening.rs
-// version: 27
+// version: 28
 
-//! External public, security, redaction and release-boundary hardening canaries through `v0.3.14-pre.003`.
+//! External public, security, redaction and release-boundary hardening canaries through `v0.3.14-pre.004`.
 
 fn network(value: &'static str) -> std::option::Option<ksp_store_lib::RawNetworkId> {
     let result = ksp_store_lib::RawNetworkId::new(value);
@@ -1024,3 +1024,33 @@ fn v0_3_14_pre_003_websocket_continuity_observation_reuses_transport_snapshot_so
     assert!(!worker.contains("set_from_slot("));
     return;
 }
+
+#[test]
+fn v0_3_14_pre_004_yellowstone_replay_evidence_is_transport_owned_and_fail_closed_without_coverage_proof() {
+    let worker = include_str!("../src/runtime_resources.rs");
+    let transport = include_str!("../../ksp-onchain-transport-lib/src/grpc_stream.rs");
+    for required in [
+        "snapshot.replay_delivery_count()",
+        "snapshot.replay_coverage_unproven_count()",
+        "source_replay_delivery_total",
+        "source_replay_coverage_unproven_total",
+        "source.replay_coverage_unproven",
+    ] {
+        assert!(worker.contains(required), "required pre.004 Worker replay-evidence guard missing: {required}");
+    }
+    for required in [
+        "replay_delivery_count",
+        "replay_coverage_unproven_count",
+        "pending_replay_from_slot",
+        "tracker.begin_replay(effective_from_slot)",
+        "first_available > requested",
+    ] {
+        assert!(transport.contains(required), "required pre.004 Transport replay-evidence guard missing: {required}");
+    }
+    for forbidden in ["subscribe_replay_info(", "set_from_slot(", "YellowstoneReplayInfo", "last_requested_from_slot()"] {
+        assert!(!worker.contains(forbidden), "pre.004 Worker took replay ownership: {forbidden}");
+    }
+    assert!(!transport.contains("replay_covered_count"));
+    assert!(!transport.contains("replay_coverage_proven_count"));
+    return;
+}

crates/ksp-worker-raw-transaction-ingest-lib/tests/release_completeness.rs

@@ -1,7 +1,7 @@
 // file: crates/ksp-worker-raw-transaction-ingest-lib/tests/release_completeness.rs
-// version: 22
+// version: 23
 
-//! Release-completeness canaries through the `v0.3.14-pre.003` WebSocket continuity-observation tranche.
+//! Release-completeness canaries through the `v0.3.14-pre.004` Yellowstone native replay-evidence tranche.
 
 #[test]
 fn pre_010_production_module_inventory_is_exact() -> std::io::Result<()> {
@@ -248,3 +248,18 @@ fn v0_3_13_pre_012_cross_layer_completeness_security_inventory_is_exact() {
     assert!(public_api.contains("v0_3_13_pre_012_completeness_closure_adds_no_public_implementation_surface"));
     return;
 }
+
+#[test]
+fn v0_3_14_pre_004_native_replay_evidence_canaries_are_present_without_public_replay_ownership() {
+    let hardening = include_str!("hardening.rs");
+    let resources = include_str!("../src/runtime_resources.rs");
+    let resource_tests = include_str!("../unit_tests/runtime_resources.rs");
+    let root = include_str!("../src/lib.rs");
+    assert!(hardening.contains("v0_3_14_pre_004_yellowstone_replay_evidence_is_transport_owned_and_fail_closed_without_coverage_proof"));
+    assert!(resource_tests.contains("v0_3_14_pre_004_replay_delivery_is_not_coverage_and_unproven_coverage_fails_closed"));
+    assert!(resources.contains("source.replay_coverage_unproven"));
+    assert!(!root.contains("ReplayInfo"));
+    assert!(!root.contains("from_slot"));
+    assert!(!root.contains("set_from_slot"));
+    return;
+}