fix: close performance evidence and budget gates

2026-09-02 08:27:21 +03:00
parent 1734003172
commit 5525557c3a
13 changed files with 541 additions and 39 deletions
--- a/tests/performance/reference-run.test.ts
+++ b/tests/performance/reference-run.test.ts
@@ -0,0 +1,93 @@
+import { createHash } from 'node:crypto';
+import { describe, expect, it } from 'vitest';
+import { authenticateReferenceRun, validateObservedReferenceEnvironment } from './reference-run';
+
+const attestation = (runIndex = 1) => ({
+  schema: 'portfolio-reference-run-attestation/v1',
+  profile: 'desktop-high',
+  runId: `desktop-reference-${runIndex}`,
+  capturedAt: '2026-09-02T05:00:00.000Z',
+  runIndex,
+  device: { model: 'Apple M1 MacBook Air', cpu: 'Apple M1', gpu: 'Apple M1 integrated GPU', ramGb: 8 },
+  browser: { name: 'Chromium', version: '140.0.0', driverVersion: 'Playwright 1.62.1' },
+  osVersion: 'macOS 15.6',
+  display: { refreshHz: 60 },
+  viewport: { width: 1_440, height: 900 },
+  network: { downstreamKbps: 10_000, upstreamKbps: 10_000, roundTripLatencyMs: 40 },
+  assertions: {
+    batteryPercent: 80,
+    powerSaving: false,
+    coolStart: true,
+    noOtherForegroundApplications: true,
+    cpuEmulation: false,
+    pageZoom: 1,
+    reducedMotion: 'no-preference',
+    saveData: false,
+    audioState: 'idle',
+    freshBrowserProfile: true,
+    startedFromAboutBlank: true,
+    storageCleared: { serviceWorkers: true, cacheStorage: true, httpCache: true, cookies: true, localStorage: true, sessionStorage: true, indexedDb: true, preferences: true },
+    physicalReferenceDevice: true,
+  },
+});
+
+describe('authenticated reference runs', () => {
+  it('cannot mark an ordinary developer trace as gating evidence', () => {
+    const bytes = Buffer.from(JSON.stringify(attestation()));
+    expect(() => authenticateReferenceRun({
+      referenceMode: false,
+      expectedProfile: 'desktop-high',
+      attestationBytes: bytes,
+      expectedDigest: createHash('sha256').update(bytes).digest('hex'),
+    })).toThrow(/reference mode/u);
+  });
+
+  it('fails closed on digest, device, network, or assertion mismatch', () => {
+    const invalid = attestation();
+    invalid.network.downstreamKbps = 9_999;
+    const bytes = Buffer.from(JSON.stringify(invalid));
+    expect(() => authenticateReferenceRun({
+      referenceMode: true,
+      expectedProfile: 'desktop-high',
+      attestationBytes: bytes,
+      expectedDigest: createHash('sha256').update(bytes).digest('hex'),
+    })).toThrow(/network/u);
+    expect(() => authenticateReferenceRun({
+      referenceMode: true,
+      expectedProfile: 'desktop-high',
+      attestationBytes: bytes,
+      expectedDigest: '0'.repeat(64),
+    })).toThrow(/digest/u);
+  });
+
+  it('authenticates only exact pinned metadata and validates browser-observed assertions', () => {
+    const bytes = Buffer.from(JSON.stringify(attestation()));
+    const authenticated = authenticateReferenceRun({
+      referenceMode: true,
+      expectedProfile: 'desktop-high',
+      attestationBytes: bytes,
+      expectedDigest: createHash('sha256').update(bytes).digest('hex'),
+    });
+    expect(authenticated).toMatchObject({ runId: 'desktop-reference-1', runIndex: 1, profile: 'desktop-high' });
+    expect(() => validateObservedReferenceEnvironment(authenticated, {
+      viewport: { width: 1_440, height: 900 },
+      visible: true,
+      reducedMotion: 'no-preference',
+      saveData: false,
+      pageZoom: 1,
+      browserName: 'Chromium',
+      browserVersion: '140.0.0',
+      startedFromAboutBlank: true,
+    })).not.toThrow();
+    expect(() => validateObservedReferenceEnvironment(authenticated, {
+      viewport: { width: 1_440, height: 899 },
+      visible: true,
+      reducedMotion: 'no-preference',
+      saveData: false,
+      pageZoom: 1,
+      browserName: 'Chromium',
+      browserVersion: '140.0.0',
+      startedFromAboutBlank: true,
+    })).toThrow(/viewport/u);
+  });
+});