asks: prove the reviewed flow — the controller's root-free word asked before an approval, the desk on its own account, a tap only on the words shown, the question saying who asks and what each answer does, and a rehearsal at the terminal for the live acceptance

asks/proof_test.go

@@ -109,13 +109,19 @@ func TestTheOperatorsAnswerEndToEnd(t *testing.T) {
 		first = a.ask("a1", "Flip the lab's switch?", time.Hour)
 		firstMessage = l.tg.waitFor("the first question with its buttons", operatorAccount, since, 90*time.Second,
 			func(m tgMessage) bool { return !m.Edited && button(m, "Approve") != "" && button(m, "Decline") != "" })
-		if !strings.Contains(firstMessage.Text, "Flip the lab's switch?") || !strings.Contains(firstMessage.Text, "approve or decline") {
-			t.Errorf("the question does not say what is asked and why: %q", firstMessage.Text)
+		for _, says := range []string{"Flip the lab's switch?", "approve or decline", "lab-asker",
+			"the switch is flipped, once", "nothing is flipped"} {
+			if !strings.Contains(firstMessage.Text, says) {
+				t.Errorf("the question does not say %q (what is asked, why, by whom, what each answer does, what "+
+					"no answer does): %q", says, firstMessage.Text)
+			}
 		}
 		tapped := time.Now()
 		l.tg.tapped(operatorAccount, operatorAccount, "private", firstMessage.ID, button(firstMessage, "Approve"))
 		l.tg.waitFor("the refusal of an approval inside the hour", operatorAccount, tapped, 90*time.Second,
-			func(m tgMessage) bool { return strings.Contains(m.Text, "can approve from") })
+			func(m tgMessage) bool {
+				return strings.Contains(m.Text, "That answer was not taken") && strings.Contains(m.Text, "linked at")
+			})
 		if !a.noWordOn("a1", 2*time.Second) || len(a.performed()) != 0 {
 			t.Fatalf("an approval inside the hour was a warrant: %v", a.performed())
 		}
@@ -152,7 +158,7 @@ func TestTheOperatorsAnswerEndToEnd(t *testing.T) {
 		if w.AskDigest != first.Digest() {
 			t.Errorf("the warrant names the digest %s, not the ask's %s", w.AskDigest, first.Digest())
 		}
-		if got := a.performed(); len(got) != 1 || got[0]["switch"] != "approve" {
+		if got := a.performed(); len(got) != 1 || got[0]["arg.switch"] != "approve" {
 			t.Fatalf("performed %v, want the one bound act once", got)
 		}
 		// Every copy says how it ended, its buttons gone.
@@ -197,20 +203,19 @@ func TestTheOperatorsAnswerEndToEnd(t *testing.T) {
 		m := l.tg.waitFor("the second question", operatorAccount, since, 90*time.Second,
 			func(m tgMessage) bool { return !m.Edited && button(m, "Approve") != "" })
 		// The buttons' data reached a stranger (a forwarded question), who taps in their own chat with the bot:
-		// refused, and the operator is told which account tried. The stranger is told nothing.
-		tapped := time.Now()
+		// the channel never showed that message there, so the tap goes nowhere, and the stranger is told
+		// nothing. (A stranger's answer that does reach the router is refused there and told to the operator by
+		// name: the router's own test.)
 		l.tg.tapped(strangerAccount, strangerAccount, "private", m.ID, button(m, "Approve"))
-		l.tg.waitFor("the operator told another account tried", operatorAccount, tapped, 90*time.Second,
-			func(m tgMessage) bool {
-				return strings.Contains(m.Text, "Another account tried to answer") && strings.Contains(m.Text, fmt.Sprint(strangerAccount))
-			})
-		if got := l.tg.since(strangerAccount, since); len(got) != 0 {
-			t.Errorf("the bot answered the stranger: %+v", got)
-		}
+		// The operator taps a message whose words are not the ones the channel put there.
+		l.tg.tappedOn(operatorAccount, operatorAccount, "private", m.ID, button(m, "Approve"), "Flip ALL the switches?")
 		// The operator taps in a group the bot is in: not their own chat, dropped by the channel.
 		l.tg.tapped(operatorAccount, groupChat, "supergroup", m.ID, button(m, "Approve"))
 		if !a.noWordOn("a2", 3*time.Second) {
-			t.Fatal("a tap from another account, or from a group, was a warrant")
+			t.Fatal("a tap from another account, on changed words, or from a group, was a warrant")
+		}
+		if got := l.tg.since(strangerAccount, since); len(got) != 0 {
+			t.Errorf("the bot answered the stranger: %+v", got)
 		}
 		if got := l.tg.since(groupChat, since); len(got) != 0 {
 			t.Errorf("the bot answered in a group: %+v", got)
@@ -278,23 +283,42 @@ func TestTheOperatorsAnswerEndToEnd(t *testing.T) {
 	})
 
 	// --- 7. While an agent can become root where the router runs, nothing proven there approves.
-	t.Run("while an agent can become root on the router's machine, approve is not offered", func(t *testing.T) {
-		key := "machine." + machine + ".agent-root"
-		l.raise(map[string]any{"key": key, "kind": "agent-root", "severity": "urgent",
-			"summary":  "an agent can become root on anchor without a person",
-			"headline": "Root without you on anchor", "explanation": "A program working for you can become root.",
-			"subject": map[string]any{"scope": "machine", "id": machine, "machine": machine},
-			"raised":  time.Now().UTC().Format(time.RFC3339Nano)})
-		time.Sleep(2 * time.Second)
+	t.Run("while the controller cannot say root is free where the router runs, nothing approves", func(t *testing.T) {
+		// An approval the operator already sees on the phone, then root stops being free.
 		since := time.Now()
-		a.ask("a3", "Flip it while root is open?", time.Hour)
-		m := l.tg.waitFor("the third question", operatorAccount, since, 90*time.Second,
-			func(m tgMessage) bool { return !m.Edited && button(m, "Decline") != "" })
-		if button(m, "Approve") != "" {
-			t.Errorf("approve was offered on Telegram while an agent can become root there: %v", labels(m))
+		a.ask("a5", "Flip it while root is checked?", time.Hour)
+		m := l.tg.waitFor("the question asked while root was free", operatorAccount, since, 90*time.Second,
+			func(m tgMessage) bool { return !m.Edited && button(m, "Approve") != "" })
+		l.mu.Lock()
+		l.notFree = map[string]string{machine: "an agent can become root without a person"}
+		asked := l.rootAsked
+		l.mu.Unlock()
+		tapped := time.Now()
+		l.tg.tapped(operatorAccount, operatorAccount, "private", m.ID, button(m, "Approve"))
+		l.tg.waitFor("the refusal of an approval while root is not free", operatorAccount, tapped, 90*time.Second,
+			func(m tgMessage) bool { return strings.Contains(m.Text, "That answer was not taken") })
+		l.mu.Lock()
+		askedAgain := l.rootAsked > asked
+		l.mu.Unlock()
+		if !askedAgain {
+			t.Error("the router judged an approval without asking the controller whether root is free")
 		}
-		l.clear(key)
-		if err := a.client.Cancel("a3"); err != nil {
+		if !a.noWordOn("a5", 2*time.Second) {
+			t.Fatal("an approval was a warrant while root was not free")
+		}
+		// A new ask that needs an approval is refused to its asker, in words: no channel can carry it now.
+		a.ask("a3", "Flip it while root is not free?", time.Hour)
+		w := a.warrantFor("a3", 30*time.Second)
+		if w.Outcome != asks.OutcomeRefused || w.By != nil {
+			t.Errorf("an approving ask while root is not free: %+v", w)
+		}
+		if got := a.performed(); len(got) != 1 {
+			t.Fatalf("performed %v while root was not free", got)
+		}
+		l.mu.Lock()
+		l.notFree = nil
+		l.mu.Unlock()
+		if err := a.client.Cancel("a5"); err != nil {
 			t.Errorf("taking the ask back: %v", err)
 		}
 	})