From a10b271a8d7bed88a197c94b49329d57c379ffba Mon Sep 17 00:00:00 2001
From: ruv <ruv@ruv.net>
Date: Mon, 6 Jul 2026 21:18:50 -0400
Subject: [PATCH] test(witness): pin the shape-gate boundaries so a relaxed
 bound can't accept malformed witnesses (#4)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Beta feedback #4 (mutation finding): verifyWitness's shape gate uses EXACT checks — public_key.length
=== 64, signature.length === 128, schema === 1. The existing tests only cover UNDER-length keys/sigs
('short') and schema 999, so a boundary mutant that relaxes `!== 64` → `< 64` (or `!== 1` → `> 1`)
would accept OVER-length keys/sigs and schema 0/negative and survive the suite.

Adds boundary tests pinning the other side of each bound:
- an over-length public_key (65) is rejected,
- an over-length signature (129) is rejected,
- schema 0 and schema -1 are rejected.

Verified: the over-length-key test FAILS under `!== 64` → `< 64`, and the schema test FAILS under
`!== 1` → `> 1`; both pass on the real code (then reverted).

Test-only; no behaviour change. Full create-agent-harness suite 384/384; tsc clean.

Co-Authored-By: claude-flow <ruv@ruv.net>
---
 .../__tests__/witness-client.test.ts          | 31 +++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/packages/create-agent-harness/__tests__/witness-client.test.ts b/packages/create-agent-harness/__tests__/witness-client.test.ts
index a99a245e..b7fc30fe 100644
--- a/packages/create-agent-harness/__tests__/witness-client.test.ts
+++ b/packages/create-agent-harness/__tests__/witness-client.test.ts
@@ -58,6 +58,37 @@ describe('verifyWitness — shape gate', () => {
     });
     expect(r.valid).toBe(true);
   });
+
+  // GH #4 (mutation finding): the length/schema gates use EXACT checks (=== 64 / === 128 / === 1).
+  // The existing tests only cover UNDER-length ('short') and schema 999, so a boundary mutant that
+  // relaxes `!== 64` → `< 64` (or `!== 1` → `> 1`) would accept OVER-length keys/sigs and schema 0/
+  // negative and survive. These pin the OTHER side of each boundary.
+  describe('boundary bounds (mutation guard, #4)', () => {
+    const base = {
+      schema: 1, harness: 'x', version: '0.1.0', entries: [],
+      public_key: 'a'.repeat(64), signature: 'b'.repeat(128),
+    };
+
+    it('rejects an OVER-length public_key (65)', async () => {
+      const r = await verifyWitness({ ...base, public_key: 'a'.repeat(65) });
+      expect(r.valid).toBe(false);
+      expect(r.reason).toMatch(/public_key/);
+    });
+
+    it('rejects an OVER-length signature (129)', async () => {
+      const r = await verifyWitness({ ...base, signature: 'b'.repeat(129) });
+      expect(r.valid).toBe(false);
+      expect(r.reason).toMatch(/signature/);
+    });
+
+    it('rejects schema 0 and negative (not just >1)', async () => {
+      for (const schema of [0, -1]) {
+        const r = await verifyWitness({ ...base, schema });
+        expect(r.valid).toBe(false);
+        expect(r.reason).toMatch(/schema/);
+      }
+    });
+  });
 });
 
 describe('findWitness', () => {