mesh-controller/cmd/mesh-controller/probe_agent_root_test.go

package main

import (
	"strings"
	"testing"

	"github.com/novox/mesh-controller/internal/conditions"
)

// novox/hq ADR 0259 §8, rule 3: the probe fails today — agents run as the operator's account, which has
// passwordless sudo, and the login shell runs their commands as it — and passes only once neither holds.
func TestAnAgentAbleToBecomeRootWhereTheRouterRunsIsSaid(t *testing.T) {
	root := escalation{Root: true, Why: "(ALL : ALL) NOPASSWD: ALL"}
	none := escalation{Why: "no rule lets it without a password"}
	base := func() agentRootFacts {
		return agentRootFacts{Machine: "anchor", Trusted: []string{"telegram", "messenger"}, Runtime: "ops",
			Answers: map[string]escalation{}}
	}

	today := base()
	today.Agent, today.LoginShell = "ops", true
	today.Answers["ops"] = root
	got := agentRootObservations(today)
	if len(got) != 1 || got[0].Severity != conditions.Urgent || got[0].Kind != kindAgentRoot ||
		!strings.Contains(got[0].Summary, "the operator's account") || !strings.Contains(got[0].Summary, "the login shell") {
		t.Fatalf("today: %+v", got)
	}

	agentsMoved := base()
	agentsMoved.Agent, agentsMoved.AgentNamed, agentsMoved.LoginShell = "agents", true, true
	agentsMoved.Answers["agents"], agentsMoved.Answers["ops"] = none, root
	if got := agentRootObservations(agentsMoved); len(got) != 1 || strings.Contains(got[0].Summary, "agents (") ||
		!strings.Contains(got[0].Summary, "the login shell") {
		t.Errorf("agents of their own account, the login shell still the runtime's: %+v", got)
	}

	closed := base()
	closed.Agent, closed.AgentNamed = "agents", true
	closed.Answers["agents"], closed.Answers["ops"] = none, root
	if got := agentRootObservations(closed); len(got) != 0 {
		t.Errorf("agents of their own account and no login shell there: %+v", got)
	}

	noAgents := base()
	noAgents.Answers["ops"] = root
	if got := agentRootObservations(noAgents); len(got) != 0 {
		t.Errorf("no agent runs there and no login shell is held: %+v", got)
	}
}

// Its words are plain, as every condition's are (novox/hq ADR 0253).
func TestTheRootConditionIsSaidInPlainWords(t *testing.T) {
	f := agentRootFacts{Machine: "anchor", Trusted: []string{"telegram"}, Runtime: "ops", Agent: "ops",
		Answers: map[string]escalation{"ops": {Root: true, Why: "x"}}}
	o := agentRootObservations(f)[0]
	if why, ok := conditions.PlainWords(conditions.Words{Headline: o.Headline, Explanation: o.Explanation,
		Needs: o.Needs, Resolved: o.Resolved}, "anchor"); !ok {
		t.Errorf("not plain: %s", why)
	}
}

// novox/hq ADR 0268: the login shell counts only where its execute is served, and fails closed — the holder's
// setting resolving to anything but serve and the bus hearing no execute there is the one way it is withheld.
func TestTheLoginShellCountsOnlyWhereExecuteIsServed(t *testing.T) {
	val := func(v any) *any { return &v }
	cases := []struct {
		name          string
		claims        bool
		setting       *any
		heard, asked  bool
		served        bool
		saysInTheWhys string
	}{
		{"withheld by the setting and silent on the bus", true, val("withhold"), false, true, false, ""},
		{"withheld by the setting, the machine not yet pushed", true, val("withhold"), true, true, true, "the bus hears"},
		{"the setting serves", true, val("serve"), false, true, true, "setting there is serve"},
		{"a wrong value withholds, as the holder does", true, val("Serve"), false, true, false, ""},
		{"the setting withholds, the bus could not be asked", true, val("withhold"), false, false, true, "could not be asked"},
		{"a holder with no such setting that claims execute", true, nil, false, true, true, "claims execute"},
		{"a holder with no such setting that does not claim it, heard all the same", false, nil, true, true, true, "the bus hears"},
		{"a holder with no such setting that does not claim it, silent", false, nil, false, true, false, ""},
	}
	for _, c := range cases {
		served, why := loginShellServed("zsh", c.claims, c.setting, c.heard, c.asked)
		if served != c.served || (c.saysInTheWhys != "" && !strings.Contains(why, c.saysInTheWhys)) {
			t.Errorf("%s: served %v (%q), want %v saying %q", c.name, served, why, c.served, c.saysInTheWhys)
		}
	}

	// The control-node with execute withheld and agents of their own account: nothing is said.
	f := agentRootFacts{Machine: "anchor", Trusted: []string{"telegram"}, Runtime: "ops", Agent: "agents", AgentNamed: true,
		Answers: map[string]escalation{"ops": {Root: true, Why: "NOPASSWD"}, "agents": {Why: "none"}}}
	f.LoginShell, f.LoginShellWhy = loginShellServed("zsh", true, val("withhold"), false, true)
	if got := agentRootObservations(f); len(got) != 0 {
		t.Errorf("execute withheld and agents confined: %+v", got)
	}
	// Withheld in the setting, still answered on the bus: said, with why.
	f.LoginShell, f.LoginShellWhy = loginShellServed("zsh", true, val("withhold"), true, true)
	if got := agentRootObservations(f); len(got) != 1 || !strings.Contains(got[0].Summary, "the bus hears execute answered there") {
		t.Errorf("execute still answered: %+v", got)
	}
}

// hq ADR 0259 §8 as amended on 2026-10-09: a machine where a trusted party runs and who can become root is not
// measured raises the same urgent condition, so the router, which reads the condition, approves nothing there.
func TestRootNotMeasuredWhereTheRouterRunsIsSaidAndNeverAPass(t *testing.T) {
	o := agentRootUnmeasured(agentRootFacts{Machine: "anchor", Trusted: []string{"telegram", "messenger"}},
		"the sudo module is not assigned there, so who can become root is not measured")
	if o.Kind != kindAgentRoot || o.Severity != conditions.Urgent || o.Machine != "anchor" ||
		!strings.Contains(o.Summary, "not measured") || !strings.Contains(o.Summary, "messenger, telegram") {
		t.Errorf("%+v", o)
	}
	if why, ok := conditions.PlainWords(conditions.Words{Headline: o.Headline, Explanation: o.Explanation,
		Needs: o.Needs, Resolved: o.Resolved}, "anchor"); !ok {
		t.Errorf("not plain: %s", why)
	}
	// The same key as a measured yes, so the router's one rule reads both.
	measured := agentRootObservations(agentRootFacts{Machine: "anchor", Trusted: []string{"telegram"}, Runtime: "ops",
		Agent: "ops", Answers: map[string]escalation{"ops": {Root: true, Why: "x"}}})[0]
	if o.Key() != measured.Key() {
		t.Errorf("keys differ: %s, %s", o.Key(), measured.Key())
	}
}