From bf22760392be4d5b98be6fcccfee1eac16361f52 Mon Sep 17 00:00:00 2001
From: OrcaWin <alpha-eng@stably.ai>
Date: Fri, 16 Oct 2026 05:19:54 -0700
Subject: [PATCH] test: exercise real gate authorization refusals (#29332)

* test: batch lint fixtures and remove repeated runtime scan

* test(cli): consolidate owner coverage and remove false decoding proof

* test(renderer): retain IPC lifecycle behavior without copied inventories

* test: share floating panel behavior suite startup

* test: retire synthetic runtime constructor probes

* test: share saved terminal title runtime setup

* test: share native chat render cost setup

* test: share terminal close continuity runtime setup

* test(runtime): prove mobile geometry through desktop restores

* test(runtime): skip unused RPC catalog in bind-host coverage

* test: share transcript scroll suite startup

* test: share SSH lease candidacy suite startup

* test: exercise real gate authorization refusals

---------

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
---
 .../methods/orchestration/gates/gates.test.ts | 28 ++++++++++++++++++
 ...tion-11745-regression-verification.test.ts | 29 +------------------
 2 files changed, 29 insertions(+), 28 deletions(-)

diff --git a/src/main/runtime/rpc/methods/orchestration/gates/gates.test.ts b/src/main/runtime/rpc/methods/orchestration/gates/gates.test.ts
index b58784f628d..d3d5776ebcc 100644
--- a/src/main/runtime/rpc/methods/orchestration/gates/gates.test.ts
+++ b/src/main/runtime/rpc/methods/orchestration/gates/gates.test.ts
@@ -40,6 +40,34 @@ describe('orchestration RPC methods', () => {
       expect(updated?.status).toBe('blocked')
     })
 
+    it('refuses a foreign Run task when no legacy adoption exists', async () => {
+      setup()
+      expect(db.getLegacyAdoption()).toBeUndefined()
+      const callerRun = db.getCurrentRunForPane(h.coordinatorPaneKey)
+      if (!callerRun) {
+        throw new Error('Expected the caller to have a bound Run')
+      }
+      const foreignRun = db.createRun({
+        objective: 'foreign work',
+        coordinatorHandle: 'term_foreign_coord',
+        coordinatorPaneKey: 'tab_foreign:77777777-7777-4777-8777-777777777777'
+      })
+      const foreignTask = db.createTask({ spec: 'foreign assignment', runId: foreignRun.id })
+
+      await expect(
+        call('orchestration.gateCreate', {
+          task: foreignTask.id,
+          question: 'Proceed?',
+          from: 'term_coord'
+        })
+      ).rejects.toMatchObject({
+        code: 'task_not_found',
+        message: `Task ${foreignTask.id} was not found in Run ${callerRun.id}.`
+      })
+      expect(db.getTask(foreignTask.id)?.status).toBe('ready')
+      expect(db.listGates({ taskId: foreignTask.id })).toHaveLength(0)
+    })
+
     it('rejects invalid options JSON', async () => {
       setup()
       const task = db.createTask({ spec: 'work' })
diff --git a/src/main/runtime/rpc/orchestration-11745-regression-verification.test.ts b/src/main/runtime/rpc/orchestration-11745-regression-verification.test.ts
index cd2899deb88..af061376846 100644
--- a/src/main/runtime/rpc/orchestration-11745-regression-verification.test.ts
+++ b/src/main/runtime/rpc/orchestration-11745-regression-verification.test.ts
@@ -29,7 +29,6 @@ import { createRootDispatch } from '../orchestration/db/root-dispatch-test-fixtu
 // Why: an unrelated caller the runtime CAN resolve to a pane — otherwise the refusal would be
 // stable_pane_required and would prove nothing about Run authorization.
 const OUTSIDER_HANDLE = CURRENT_WORKER_HANDLE
-const OUTSIDER_PANE = CURRENT_WORKER_PANE
 
 const tempDirs: string[] = []
 const databases: OrchestrationDb[] = []
@@ -182,33 +181,6 @@ describe('#11745 H1 — gate methods authorize the caller Run', () => {
     expect(before.task).toBe('blocked')
   })
 
-  it('G4 refuses a stranger Run with NO legacy adoption in play', () => {
-    // Why: G4 must hold on a plain runtime, so the fix cannot be an artifact of adoption state.
-    const dir = mkdtempSync(join(tmpdir(), 'orca-11745-g4-'))
-    tempDirs.push(dir)
-    const db = new OrchestrationDb(join(dir, 'orchestration.db'))
-    databases.push(db)
-    expect(db.getLegacyAdoption()).toBeUndefined()
-
-    const runA = db.createRun({
-      objective: 'run A',
-      coordinatorHandle: CURRENT_COORDINATOR_HANDLE,
-      coordinatorPaneKey: CURRENT_COORDINATOR_PANE
-    })
-    const runC = db.createRun({
-      objective: 'run C',
-      coordinatorHandle: OUTSIDER_HANDLE,
-      coordinatorPaneKey: OUTSIDER_PANE
-    })
-    const strangerTask = db.createTask({ spec: 'stranger work', runId: runC.id })
-
-    // The Run-scope decision the gate handler makes: A's pane resolves to A, never to C.
-    expect(db.getCurrentRunForPane(CURRENT_COORDINATOR_PANE)?.id).toBe(runA.id)
-    expect(strangerTask.run_id).toBe(runC.id)
-    expect(db.listGates({ taskId: strangerTask.id })).toHaveLength(0)
-    expect(db.getTask(strangerTask.id)?.status).toBe('ready')
-  })
-
   it('POSITIVE: a legitimately bound coordinator still gates its own Run end to end', async () => {
     const harness = createHarness()
     const runA = bindRunA(harness)
@@ -486,6 +458,7 @@ describe('#11745 H2 — revoked principal on an unclaimed adopted Run', () => {
 
     expect(response.ok).toBe(false)
     expect(response.error.code).not.toBe('legacy_read_only')
+    expect(response.error.code).toBe('run_required')
     expect(adoptedGraph(harness)).toEqual(before)
   })
 })