WeKnora deployment source with the reviewed wiki identity, summary and recovery fixes

scripts/publish_public_runtime.test.cjs

@@ -0,0 +1,420 @@
+const assert = require('node:assert/strict')
+const test = require('node:test')
+const fs = require('node:fs')
+const path = require('node:path')
+const vm = require('node:vm')
+const { idle, assertIdleSnapshot, nativeQueues, queueStates, isActivatedRelease, assertPublicVerification,
+  assertFixtureReconciliation, publicVerificationReports, fixtureReconciliationCounts } = require('./publish_public_runtime.cjs')
+
+test('a frontend-only release with an unchanged API image is a new activation', () => {
+  const manifest = { release: 'public-20260920-165100', api_image_id: 'sha256:same-image' }
+  assert.equal(isActivatedRelease({ image: manifest.api_image_id, release: 'public-20260920-160500' }, manifest), false)
+  assert.equal(isActivatedRelease({ image: manifest.api_image_id, release: manifest.release }, manifest), true)
+  assert.equal(isActivatedRelease({ image: 'sha256:other-image', release: manifest.release }, manifest), false)
+  assert.equal(isActivatedRelease({ image: manifest.api_image_id, release: null }, manifest), false)
+})
+
+function emptySnapshot() {
+  return { workbench: 0, pending_ops: 0,
+    queues: Object.fromEntries(nativeQueues.map(name => [name,
+      Object.fromEntries(queueStates.map(state => [state, 0]))])) }
+}
+
+test('permits idle runtime while retaining archived and completed task history', () => {
+  const snapshot = emptySnapshot()
+  Object.assign(snapshot.queues.graph, { archived: 10, completed: 16 })
+  assert.doesNotThrow(() => assertIdleSnapshot(snapshot))
+})
+
+test('blocks persisted Wiki operations even when every Redis queue is empty', () => {
+  const snapshot = emptySnapshot()
+  snapshot.pending_ops = 1
+  assert.throws(() => assertIdleSnapshot(snapshot), /persisted background/)
+})
+
+test('blocks workbench jobs, uploads or reserved balances', () => {
+  const snapshot = emptySnapshot()
+  snapshot.workbench = 1
+  assert.throws(() => assertIdleSnapshot(snapshot), /jobs, uploads or reserved/)
+})
+
+for (const queue of nativeQueues) {
+  for (const state of queueStates) {
+    test(`blocks native ${queue} work in ${state} state`, () => {
+      const snapshot = emptySnapshot()
+      snapshot.queues[queue][state] = 1
+      assert.throws(() => assertIdleSnapshot(snapshot), /active or waiting/)
+    })
+  }
+}
+
+test('blocks newly discovered queues instead of ignoring future worker types', () => {
+  const snapshot = emptySnapshot()
+  snapshot.queues.future_worker = { ...snapshot.queues.graph, active: 1 }
+  assert.throws(() => assertIdleSnapshot(snapshot), /active or waiting/)
+})
+
+test('fails closed on missing queues and invalid count shapes', () => {
+  const snapshot = emptySnapshot()
+  delete snapshot.queues.graph
+  assert.throws(() => assertIdleSnapshot(snapshot), /Cannot verify/)
+  for (const count of [undefined, null, '', '0', -1, NaN, Infinity, 0.1, Number.MAX_SAFE_INTEGER + 1]) {
+    const item = emptySnapshot()
+    item.queues.wiki.active = count
+    assert.throws(() => assertIdleSnapshot(item), /Cannot verify/)
+    assert.throws(() => assertIdleSnapshot({ ...emptySnapshot(), pending_ops: count }), /Cannot verify/)
+  }
+})
+
+function fakeRuntime(overrides = {}, transformRedis = value => value) {
+  const runtime = {
+    DB_NAME: 'yawan_native_acceptance_20260915', REDIS_ADDR: 'actual-redis:6379',
+    REDIS_DB: '14', REDIS_USERNAME: 'worker', REDIS_PASSWORD: 'private-test-password', ...overrides,
+  }
+  const calls = []
+  const run = (binary, args, options) => {
+    calls.push({ binary, args, options })
+    if (args.includes('psql')) {
+      assert.match(args.at(-1), /count\(\*\) FROM task_pending_ops/)
+      return JSON.stringify({ workbench: 0, pending_ops: 0 })
+    }
+    if (args.includes('inspect')) return JSON.stringify(Object.entries(runtime).map(([key, value]) => `${key}=${value}`))
+    assert.ok(args.includes('redis-cli'))
+    return transformRedis(JSON.stringify(emptySnapshot().queues))
+  }
+  return { run, calls }
+}
+
+test('reads actual Redis identity and DB with no password in argv or parent env', () => {
+  const previous = process.env.REDISCLI_AUTH
+  const { run, calls } = fakeRuntime()
+  assert.doesNotThrow(() => idle(run))
+  const command = calls.at(-1)
+  assert.equal(command.binary, 'docker')
+  assert.ok(command.args.includes('EVAL_RO'))
+  assert.equal(command.args[command.args.indexOf('-h') + 1], 'actual-redis')
+  assert.equal(command.args[command.args.indexOf('-n') + 1], '14')
+  assert.equal(command.args[command.args.indexOf('--user') + 1], 'worker')
+  assert.equal(command.options.env.REDISCLI_AUTH, 'private-test-password')
+  assert.equal(process.env.REDISCLI_AUTH, previous)
+  assert.ok(!command.args.join(' ').includes('private-test-password'))
+  assert.ok(calls.every(call => call.options.timeout === 15000))
+})
+
+test('preserves runtime TLS verification and supports IPv6 Redis addresses', () => {
+  const { run, calls } = fakeRuntime({ REDIS_ADDR: '[::1]:6380', REDIS_USE_TLS: 'true', REDIS_TLS_SERVER_NAME: 'redis.example.test' })
+  idle(run)
+  const args = calls.at(-1).args
+  assert.equal(args[args.indexOf('-h') + 1], '::1')
+  assert.equal(args[args.indexOf('-p') + 1], '6380')
+  assert.ok(args.includes('--tls'))
+  assert.equal(args[args.indexOf('--sni') + 1], 'redis.example.test')
+  assert.ok(!args.includes('--insecure'))
+})
+
+test('does not publish when Redis auth, transport or response validation fails', () => {
+  for (const transform of [() => 'NOAUTH private-test-password', () => '{invalid', () => { throw new Error('connection failed private-test-password') }]) {
+    const { run } = fakeRuntime({}, transform)
+    assert.throws(() => idle(run), error => {
+      assert.match(error.message, /publication stopped/)
+      assert.ok(!error.message.includes('private-test-password'))
+      return true
+    })
+  }
+  for (const overrides of [{ REDIS_ADDR: '' }, { REDIS_DB: '' }, { REDIS_DB: 'broken' }, { DB_NAME: 'old_database' }]) {
+    assert.throws(() => idle(fakeRuntime(overrides).run), /publication stopped/)
+  }
+})
+
+test('minimum queue coverage follows the native Go worker topology', () => {
+  const source = fs.readFileSync(path.join(__dirname, '../internal/types/task.go'), 'utf8')
+  const names = [...source.matchAll(/^\s*Queue\w+\s*=\s*"([^"]+)"/gm)].map(match => match[1])
+  assert.deepEqual([...nativeQueues].sort(), names.sort())
+})
+
+const clock = Date.parse('2026-09-19T18:00:00.000Z')
+function publicationFixture() {
+  return {
+    manifest: {
+      url: 'https://agent.pducv.cn', activated_at: '2026-09-19T14:29:38.265Z',
+      api_activated_at: '2026-09-19T14:51:44.349Z',
+      frontend_built_at: '2026-09-19T15:18:58.094Z',
+      frontend_activated_at: '2026-09-19T15:22:00.000Z',
+    },
+    report: {
+      started_at: '2026-09-19T15:23:00.000Z', checked_at: '2026-09-19T15:24:18.110Z',
+      origin: 'https://agent.pducv.cn', api_origin: 'https://agent.pducv.cn', checks: [{passed: true}], failures: [], passed: true,
+    },
+  }
+}
+const verifyPublication = (manifest, report) => assertPublicVerification(manifest, report, 'fixture-report', clock)
+
+for (const name of ['public-navigation', 'public-access-control']) {
+  test(`${name} requires proof its API checks use the public origin`, () => {
+    const {manifest, report} = publicationFixture()
+    assert.doesNotThrow(() => assertPublicVerification(manifest, report, name, clock))
+    for (const api_origin of [undefined, '', 'invalid', 'http://127.0.0.1:18080', 'https://another.example']) {
+      assert.throws(() => assertPublicVerification(manifest, {...report, api_origin}, name, clock), /Wrong verification API origin/)
+    }
+  })
+}
+
+test('accepts complete verification begun after all runtime changes with either completion timestamp field', () => {
+  const {manifest, report} = publicationFixture()
+  assert.doesNotThrow(() => verifyPublication(manifest, report))
+  const legacyCompletion = {...report, time: report.checked_at, base: report.origin + '/api/v1'}
+  delete legacyCompletion.checked_at
+  delete legacyCompletion.origin
+  assert.doesNotThrow(() => verifyPublication(manifest, legacyCompletion))
+})
+
+test('rejects checks begun before initial, API or UI activation even when completed afterward', () => {
+  const {manifest, report} = publicationFixture()
+  for (const field of ['activated_at', 'api_activated_at', 'frontend_activated_at']) {
+    const start = new Date(Date.parse(manifest[field]) - 1).toISOString()
+    assert.throws(() => verifyPublication(manifest, {...report, started_at: start}), /started before this runtime/)
+  }
+  // Building a new image does not mean it has replaced the served frontend.
+  assert.throws(() => verifyPublication(manifest, {...report, started_at: '2026-09-19T15:20:00.000Z'}), /started before this runtime/)
+})
+
+test('initial activation needs no fabricated API or UI refresh timestamps', () => {
+  const {manifest, report} = publicationFixture()
+  const initial = {url: manifest.url, activated_at: manifest.activated_at}
+  assert.doesNotThrow(() => verifyPublication(initial, report))
+  assert.throws(() => verifyPublication({...initial, previous_apis: [{}]}, report), /Missing API/)
+  assert.throws(() => verifyPublication({...initial, previous_frontends: [{}]}, report), /Invalid publication timestamp/)
+})
+
+test('requires actual UI activation after every frontend rebuild', () => {
+  const {manifest, report} = publicationFixture()
+  const missingActivation = {...manifest}
+  delete missingActivation.frontend_activated_at
+  assert.throws(() => verifyPublication(missingActivation, report), /frontend_activated_at/)
+  const missingBuild = {...manifest}
+  delete missingBuild.frontend_built_at
+  assert.throws(() => verifyPublication(missingBuild, report), /frontend_built_at/)
+  assert.throws(() => verifyPublication({...manifest, frontend_activated_at: '2026-09-19T15:00:00.000Z'}, report), /activation predates its build/)
+})
+
+test('fails closed for every invalid manifest timestamp instead of comparing against NaN', () => {
+  const {manifest, report} = publicationFixture()
+  const invalid = [undefined, null, '', false, 0, 'invalid', '2026-02-30T00:00:00.000Z', '2026-09-20T00:00:00.000Z']
+  for (const field of ['activated_at', 'api_activated_at', 'frontend_built_at', 'frontend_activated_at']) {
+    for (const value of invalid) {
+      assert.throws(() => verifyPublication({...manifest, [field]: value}, report), /Invalid publication timestamp/)
+    }
+  }
+  assert.throws(() => verifyPublication({url: manifest.url}, report), /activated_at/)
+  assert.throws(() => verifyPublication({...manifest, api_activated_at: '2026-09-19T13:00:00.000Z'}, report), /predates activation/)
+})
+
+test('rejects missing, invalid, future and reversed report timing rather than using completion as start', () => {
+  const {manifest, report} = publicationFixture()
+  for (const field of ['started_at', 'checked_at']) {
+    for (const value of [undefined, null, '', false, 0, 'invalid', '2026-02-30T00:00:00.000Z', '2026-09-20T00:00:00.000Z']) {
+      assert.throws(() => verifyPublication(manifest, {...report, [field]: value}), /Invalid publication timestamp/)
+    }
+  }
+  assert.throws(() => verifyPublication(manifest, {...report, checked_at: '2026-09-19T15:22:30.000Z'}), /finished before it started/)
+})
+
+test('rejects truthy pass flags, empty checks, individual failures and a different origin', () => {
+  const {manifest, report} = publicationFixture()
+  for (const change of [{passed: 'true'}, {checks: []}, {checks: [{passed: false}]}, {checks: [{passed: 'true'}]},
+    {failures: ['cleanup failed']}, {failures: undefined}]) {
+    assert.throws(() => verifyPublication(manifest, {...report, ...change}), /did not pass/)
+  }
+  assert.throws(() => verifyPublication(manifest, {...report, origin: 'http://127.0.0.1:18088'}), /Wrong verification origin/)
+})
+
+test('rejects failed, malformed or contradictory cleanup results even when the top-level report passed', () => {
+  const {manifest, report} = publicationFixture()
+  for (const cleanup of [undefined, null, {}, false, 'passed', [], [null], [true],
+    [{name: 'knowledge fixture', passed: false}], [{name: 'knowledge fixture', passed: 'true'}],
+    [{name: '', passed: true}], [{passed: true}], [{name: 'knowledge fixture', passed: true, error: 'cleanup failed'}]]) {
+    assert.throws(() => verifyPublication(manifest, {...report, cleanup}), /cleanup did not pass/)
+  }
+  assert.doesNotThrow(() => verifyPublication(manifest, {...report, cleanup: [{name: 'knowledge fixture', passed: true}]}))
+})
+
+function reconciliationFixture() {
+  const {manifest, report} = publicationFixture()
+  Object.assign(manifest, {release: 'public-20260919-223000', stage: 'origin-ready',
+    frontend_built_at: '2026-09-19T16:50:23.481Z', frontend_activated_at: '2026-09-19T16:50:27.512Z'})
+  const reports = Object.fromEntries(publicVerificationReports.map((name, index) => [name, {...structuredClone(report),
+    started_at: `2026-09-19T17:0${index}:00.000Z`, checked_at: `2026-09-19T17:0${index}:30.000Z` }]))
+  reports['public-resource-files'].prefix = 'file-isolation-1758300000000'
+  const indexed = reports['public-indexed-retrieval-isolation']
+  indexed.fixtures = {kbs: ['00000000-0000-4000-8000-000000000001']}
+  indexed.cleanup = indexed.fixtures.kbs.map(id => ({name: `knowledge ${id}`, passed: true}))
+  const reconciliation = {release: manifest.release, origin: manifest.url, read_only: true,
+    checked_at: '2026-09-19T17:07:00.000Z', passed: true, failures: [],
+    reports: Object.fromEntries(publicVerificationReports.map(name => [name, {
+      started_at: reports[name].started_at, completed_at: reports[name].checked_at,
+    }])), checks: [...fixtureReconciliationCounts.map(name => ({name, count: 0, passed: true})), {
+      name: 'file_fixture_directory_removed', passed: true,
+      path: path.resolve(__dirname, '../../acceptance/files/10059/exports/file-isolation-1758300000000'),
+    }]}
+  return {manifest, reports, reconciliation}
+}
+
+const invalidIndexedCleanup = [
+  ['missing cleanup', report => {delete report.cleanup}, /Incomplete indexed knowledge cleanup/],
+  ['empty cleanup', report => {report.cleanup = []}, /cleanup did not pass/],
+  ['only account cleanup', report => {report.cleanup = [{name: 'user fixture', passed: true}]}, /Incomplete indexed knowledge cleanup/],
+  ['mismatched knowledge cleanup', report => {report.cleanup[0].name = 'knowledge 00000000-0000-4000-8000-000000000002'}, /Incomplete indexed knowledge cleanup/],
+  ['duplicate knowledge cleanup', report => {report.cleanup.push({...report.cleanup[0]})}, /Incomplete indexed knowledge cleanup/],
+  ['unmatched extra knowledge cleanup', report => {report.cleanup.push({name: 'knowledge 00000000-0000-4000-8000-000000000002', passed: true})}, /Incomplete indexed knowledge cleanup/],
+  ['second knowledge fixture without cleanup', report => {report.fixtures.kbs.push('00000000-0000-4000-8000-000000000002')}, /Incomplete indexed knowledge cleanup/],
+  ['failed knowledge cleanup', report => {report.cleanup[0].passed = false}, /cleanup did not pass/],
+  ['missing fixtures', report => {delete report.fixtures}, /Invalid indexed knowledge fixtures/],
+  ['missing knowledge fixtures', report => {delete report.fixtures.kbs}, /Invalid indexed knowledge fixtures/],
+  ['empty knowledge fixtures', report => {report.fixtures.kbs = []}, /Invalid indexed knowledge fixtures/],
+  ['invalid knowledge fixture', report => {report.fixtures.kbs = ['fixture']; report.cleanup[0].name = 'knowledge fixture'}, /Invalid indexed knowledge fixtures/],
+  ['duplicate knowledge fixtures', report => {report.fixtures.kbs.push(report.fixtures.kbs[0])}, /Invalid indexed knowledge fixtures/],
+]
+
+for (const [label, mutate, pattern] of invalidIndexedCleanup) {
+  test(`blocks final publication for indexed retrieval with ${label}`, async () => {
+    const value = reconciliationFixture()
+    mutate(value.reports['public-indexed-retrieval-isolation'])
+    assert.throws(() => assertFixtureReconciliation(value.manifest, value.reconciliation, value.reports, clock), pattern)
+    const publisher = injectedPublisher(value)
+    await assert.rejects(publisher.publish(), pattern)
+    assert.deepEqual(publisher.writes, [])
+  })
+}
+
+test('indexed retrieval accepts every knowledge cleanup alongside account and role cleanup', () => {
+  const {manifest, reports, reconciliation} = reconciliationFixture()
+  const indexed = reports['public-indexed-retrieval-isolation']
+  indexed.fixtures.kbs.push('00000000-0000-4000-8000-000000000002')
+  indexed.cleanup.push({name: `knowledge ${indexed.fixtures.kbs[1]}`, passed: true},
+    {name: 'user fixture', passed: true}, {name: 'role fixture', passed: true})
+  assert.doesNotThrow(() => assertFixtureReconciliation(manifest, reconciliation, reports, clock))
+})
+
+test('accepts complete zero-residue reconciliation tied to all seven reports after the latest activation', () => {
+  const {manifest, reports, reconciliation} = reconciliationFixture()
+  assert.doesNotThrow(() => assertFixtureReconciliation(manifest, reconciliation, reports, clock))
+  const indexed = reports['public-indexed-retrieval-isolation']
+  indexed.time = indexed.checked_at
+  delete indexed.checked_at
+  assert.doesNotThrow(() => assertFixtureReconciliation(manifest, reconciliation, reports, clock))
+})
+
+for (const name of publicVerificationReports) {
+  test(`rejects reconciliation that refers to a previous execution of ${name}`, () => {
+    for (const field of ['started_at', 'completed_at']) {
+      const {manifest, reports, reconciliation} = reconciliationFixture()
+      reconciliation.reports[name][field] = '2026-09-19T16:55:00.000Z'
+      assert.throws(() => assertFixtureReconciliation(manifest, reconciliation, reports, clock), /does not match current report/)
+    }
+  })
+  test(`rejects ${name} started before the latest activation even with matching reconciliation metadata`, () => {
+    const {manifest, reports, reconciliation} = reconciliationFixture()
+    reports[name].started_at = '2026-09-19T16:50:27.511Z'
+    reconciliation.reports[name].started_at = reports[name].started_at
+    assert.throws(() => assertFixtureReconciliation(manifest, reconciliation, reports, clock), /started before this runtime/)
+  })
+}
+
+for (const [label, mutate, pattern] of [
+  ['different release', value => {value.reconciliation.release = 'public-20260919-000000'}, /identity/],
+  ['different origin', value => {value.reconciliation.origin = 'http://127.0.0.1:18088'}, /identity/],
+  ['non-read-only result', value => {value.reconciliation.read_only = false}, /identity/],
+  ['failed result', value => {value.reconciliation.passed = false}, /did not pass/],
+  ['reported failure', value => {value.reconciliation.failures.push('residual rows')}, /did not pass/],
+  ['future check', value => {value.reconciliation.checked_at = '2026-09-20T00:00:00.000Z'}, /Invalid publication timestamp/],
+  ['missing check time', value => {delete value.reconciliation.checked_at}, /Invalid publication timestamp/],
+  ['check before final source completes', value => {value.reconciliation.checked_at = '2026-09-19T17:06:29.999Z'}, /predates source report/],
+  ['missing source metadata', value => {delete value.reconciliation.reports['public-navigation']}, /all seven/],
+  ['renamed source metadata', value => {value.reconciliation.reports.wrong = value.reconciliation.reports['public-navigation']; delete value.reconciliation.reports['public-navigation']}, /does not match/],
+  ['extra source metadata', value => {value.reconciliation.reports.extra = {}}, /all seven/],
+  ['missing source report', value => {delete value.reports['public-navigation']}, /did not pass/],
+  ['failed source report', value => {value.reports['public-navigation'].passed = false}, /did not pass/],
+  ['failed source cleanup', value => {value.reports['public-indexed-retrieval-isolation'].cleanup[0].passed = false}, /cleanup did not pass/],
+  ['missing residual check', value => {value.reconciliation.checks.pop()}, /missing required residual checks/],
+  ['duplicate residual check', value => {value.reconciliation.checks[1] = value.reconciliation.checks[0]}, /missing required residual checks/],
+  ['unknown residual check', value => {value.reconciliation.checks[0].name = 'unrelated'}, /missing required residual checks/],
+  ['invalid numeric count', value => {value.reconciliation.checks[0].count = '0'}, /residual rows/],
+  ['positive count with passed true', value => {value.reconciliation.checks[0].count = 1}, /residual rows/],
+  ['missing count', value => {delete value.reconciliation.checks[0].count}, /residual rows/],
+  ['wrong directory', value => {value.reconciliation.checks.at(-1).path = '/unrelated/path'}, /wrong attachment directory/],
+  ['missing directory', value => {delete value.reconciliation.checks.at(-1).path}, /wrong attachment directory/],
+  ['unsafe file prefix', value => {value.reports['public-resource-files'].prefix = '../../private'}, /wrong attachment directory/],
+]) {
+  test(`blocks publication for ${label}`, () => {
+    const value = reconciliationFixture()
+    mutate(value)
+    assert.throws(() => assertFixtureReconciliation(value.manifest, value.reconciliation, value.reports, clock), pattern)
+  })
+}
+
+function injectedPublisher(value, missingReconciliation = false) {
+  const writes = [], reads = []
+  const module = {exports: {}}
+  const injectedRequire = name => {
+    if (name === 'node:fs') return {
+      readFileSync: file => {
+        reads.push(path.basename(file))
+        if (file.endsWith('/manifest.json')) return JSON.stringify(value.manifest)
+        if (file.endsWith('/public-fixture-reconciliation.json')) {
+          if (missingReconciliation) throw new Error('Missing reconciliation file')
+          return JSON.stringify(value.reconciliation)
+        }
+        const report = value.reports[path.basename(file, '.json')]
+        assert.ok(report, 'Unexpected file read')
+        return JSON.stringify(report)
+      },
+      writeFileSync: (file, contents) => writes.push({file, value: JSON.parse(contents)}),
+    }
+    if (name === 'node:child_process') return {execFileSync: () => assert.fail('External command forbidden')}
+    return require(name)
+  }
+  class FrozenDate extends Date {
+    constructor(...args) { super(...(args.length ? args : [clock])) }
+    static now() { return clock }
+  }
+  const context = {require: injectedRequire, module, __dirname, URL, AbortSignal, Date: FrozenDate,
+    fetch: async () => ({ok: true, json: async () => ({release: value.manifest.release})}), console: {log() {}}}
+  vm.runInNewContext(fs.readFileSync(path.join(__dirname, 'publish_public_runtime.cjs'), 'utf8')
+    + '\n;globalThis.publish = markPublished;', context)
+  return {writes, reads, publish: () => context.publish(value.manifest.release)}
+}
+
+test('mark-published cannot write either manifest when reconciliation is absent or failed', async () => {
+  for (const absent of [true, false]) {
+    const value = reconciliationFixture()
+    value.reconciliation.passed = false
+    const publisher = injectedPublisher(value, absent)
+    await assert.rejects(publisher.publish(), /Missing reconciliation file|did not pass/)
+    assert.deepEqual(publisher.writes, [])
+    assert.ok(publisher.reads.includes('public-fixture-reconciliation.json'))
+  }
+})
+
+test('mark-published persists only after current reports and their final reconciliation pass', async () => {
+  const value = reconciliationFixture()
+  const publisher = injectedPublisher(value)
+  await publisher.publish()
+  assert.equal(publisher.writes.length, 2)
+  assert.ok(publisher.reads.includes('public-fixture-reconciliation.json'))
+  for (const write of publisher.writes) {
+    assert.equal(write.value.stage, 'published')
+    assert.equal(write.value.fixture_reconciliation_checked_at, value.reconciliation.checked_at)
+    assert.deepEqual(write.value.public_verification_reports, publicVerificationReports)
+  }
+})
+
+test('every required producer captures execution start before requests and writes it in its report', () => {
+  for (const name of ['verify_public_release', 'verify_navigation_parity', 'verify_access_control',
+    'verify_resource_isolation_live', 'verify_resource_files_live', 'verify_public_tenant_isolation',
+    'verify_indexed_retrieval_isolation']) {
+    const source = fs.readFileSync(path.join(__dirname, `${name}.cjs`), 'utf8')
+    const start = source.indexOf('const startedAt = new Date().toISOString()')
+    assert.ok(start >= 0 && start < source.indexOf('fetch('), `${name}: capture start before requests`)
+    assert.match(source, /started_at:\s*startedAt/, `${name}: persist captured start`)
+  }
+})