v0.3.13-pre.007

crates/ksp-worker-raw-transaction-ingest-lib/tests/hardening.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-worker-raw-transaction-ingest-lib/tests/hardening.rs
-// version: 16
+// version: 17
 
 //! External public, security, redaction and release-boundary hardening canaries for `pre.010`.
 
@@ -397,7 +397,7 @@ fn v0_3_12_pre_006_runtime_resource_contract_opens_one_supervised_transport_sour
         assert!(resources.contains(required), "productive runtime-resource source behavior missing: {required}");
     }
     assert!(runtime.contains("start_with_runtime_resources"));
-    assert!(runtime.contains("run_single_live_source(source_settings, stop_receiver, admission_sender, processing_frontier_sender)"));
+    assert!(runtime.contains("run_live_sources(source_settings, stop_receiver, admission_sender, processing_frontier_sender)"));
     for forbidden in ["ksp_config_lib::", "ksp_store_postgres_lib::", "reqwest::", "tonic::", "yellowstone_grpc_proto::"] {
         assert!(!resources.contains(forbidden) && !runtime.contains(forbidden), "pre.006 runtime source crossed a forbidden boundary: {forbidden}");
     }
@@ -718,3 +718,36 @@ fn v0_3_12_pre_009_hydration_retry_ownership_and_no_orphan_cleanup_are_explicit(
     assert!(!resources.contains("unbounded_channel"), "Worker introduced an unbounded channel");
     return;
 }
+
+#[test]
+fn v0_3_13_pre_007_multi_source_supervisor_is_fail_closed_joined_and_does_not_publish_source_identity() {
+    let root = include_str!("../src/lib.rs");
+    let resources = include_str!("../src/runtime_resources.rs");
+    for required in [
+        "MAX_RAW_TRANSACTION_INGEST_LIVE_SOURCES",
+        "RawTransactionIngestSourceInventory",
+        "std::sync::Mutex",
+        "tokio::task::JoinSet",
+        "source.configured_source_closed",
+        "source.task_join_failed",
+        "source_stop_sender.send_replace(true)",
+        "drain_live_source_tasks",
+        "processing_frontier_slot = std::option::Option::None",
+        "saturating_add",
+    ] {
+        assert!(resources.contains(required), "required pre.007 supervisor hardening guard missing: {required}");
+    }
+    for forbidden in [
+        "pub struct RawTransactionIngestSourceInventory",
+        "pub struct RawTransactionIngestSourceInventoryPublisher",
+        "pub fn source_key(",
+        "source_keys:",
+        "unbounded_channel",
+        "primary_source",
+        "standby_source",
+        "first_provider_wins",
+    ] {
+        assert!(!root.contains(forbidden), "private source identity/scheduling policy leaked into public root: {forbidden}");
+    }
+    return;
+}