Trace from Controls to Tests (draft)
Goal: Follow each signing control to the tests that prove it.
NOTE
Draft
This trace is hand-written for the draft. The final trace is to be produced from the product's own control list, so it is never a second copy kept by hand. Test files are named by repository and path. For a coming control, the tests named are the ones planned; they do not exist yet. Each release's test-plan rows are listed with its change notice.
The rule for each new test: it fails before the code exists, it carries a near miss (the case the check must not catch), and a deliberate fault put into the code must make it fail. For the built controls, this draft names the test file for each control; the generated trace will name each test inside it.
Repositories: api is the OpenX API, common is the published package @o-industrial/common.
Controls built today
| Control | Clause | Tests |
|---|---|---|
| Signer and time are set by the server; values in the request are ignored | §11.50(a)(1), (a)(2) | api tests/src/services/provenanceSignatures.tests.ts |
| The meaning must be on the workspace's list | §11.50(a)(3), §11.10(g) | api tests/src/utils/resolveSignatureMeanings.tests.ts |
| A digest the signer did not see writes nothing | §11.70 | api tests/src/services/provenanceSignatures.tests.ts |
| The link to the record is re-checked on every read, verify and export | §11.70, §14 (b) | api tests/src/utils/provenance/signatureLinkCheck.tests.ts |
| Each signature is sealed by the workspace's own key | §11.50(b), §11.70 | api tests/src/utils/provenance/signatureSeal.tests.ts |
| Two different people, when the two-person rule is on | §11.200(a)(3), §11.10(f) | api tests/src/utils/provenance/signatureTwoPerson.tests.ts |
Signing needs Workspace.Provenance.Sign | §11.10(d), (g) | api tests/src/utils/provenance/signatureRight.tests.ts |
| Signatures export with their own columns | §11.10(b) | api tests/src/services/provenanceExportSignatures.tests.ts |
Controls coming
| Control | Clause | Tests (planned) | When |
|---|---|---|---|
| One same-person rule across sign-ins | §11.100(a), §11.200(a)(3) | api tests/src/utils/provenance/samePerson.tests.ts | Now |
| One published nonce function, with a fixed test vector | §11.70, §11.200(a)(1) | common tests/eac/signingLoginNonce.tests.ts | Now |
| "May this person sign now?" check, which writes and spends nothing | §11.10(d), (g) | api tests/src/utils/provenance/signatureCheck.tests.ts | Wave 1 |
| A login made for this record and meaning (Nonce form) | §11.70, §11.200(a)(1), (a)(2) | api tests/src/utils/provenance/decideSigningProof.tests.ts, signatureTiedProof.tests.ts | Wave 1 |
| Each login signs once | §11.200(a)(1) | api tests/src/utils/provenance/signingLoginLedger.tests.ts | Wave 1 |
| The challenge keeps the tie at write-first sites (Challenge form) | §11.70, §11.200(a)(1) | api tests/src/utils/provenance/signingChallengeTie.tests.ts | Wave 1 |
| Batch: one login, the list shown, all or nothing | §11.200(a)(1), §11.70 | api tests/src/utils/provenance/signatureBatch.tests.ts | Wave 1 |
| Every refusal names its fix | §11.300(d) | common tests/eac/SigningRefusals.tests.ts | Wave 1 |
| Full evidence on every signature (printed name, title, issuer, calling app, proof form, login time) | §11.50(a)(1), (b) | api tests/src/utils/provenance/signatureEvidence.tests.ts | Now and wave 1 |
| Every refused signing is recorded | §11.10(e), §11.300(d) | api tests/src/utils/provenance/recordSigningRefusal.tests.ts | Now |
| A printable certificate | §11.50(b), §11.10(b) | api tests/src/utils/provenance/renderSignatureCertificate.tests.ts | Wave 1 |
| Signature events over HTTP | §11.300(d) | api tests/src/services/signatureEvents/ | Now |
| Verify without us | §11.70, §11.10(b) | common tests/verify/verifyProvenanceExport.tests.ts | Now |
| Non-persons refused by name | §11.100(a) | api tests/src/utils/provenance/signerNotAPerson.tests.ts | Wave 3 |
| An app-made token is never the proof | §11.200(a)(3) | api tests/src/utils/provenance/decideSigningProof.tests.ts | Wave 3 |
| A signature with no tied proof is refused by default | §11.200(a)(1) | api tests/src/utils/provenance/signatureReauth.tests.ts (rewritten) | Wave 3 |
When. Signing changes roll out in steps, so apps already signing keep working. Now: pieces that add and change nothing for a caller. Wave 1: OpenX accepts the tied proofs beside today's path. Wave 2: Sample Management moves onto them. Wave 3: OpenX refuses the old path. Final text of this pack follows wave 3.
End-to-end journeys (coming)
| Journey | What it walks |
|---|---|
| Signing tied to the record | The check, a login with the nonce, the signature, the same login refused |
| Batch signing | Three listed records under one login |
| The certificate | Opens a ceremony's certificate |
| Signature events | Adds a subscription and sees a delivery |
These run against a test login system, which is still to be set up.
Next steps
- What to run in your own validation -> IQ and OQ outline
- Who owns each clause -> Responsibility by clause