test(lan): end-to-end mTLS + capability-gate integration test (VA-8) #137

Merged

longjacksonle merged 1 commit from test/VA-8-lan-integration into main

2026-07-14 18:33:37 +02:00

longjacksonle commented

2026-07-14 18:19:39 +02:00

Owner

What

End-to-end integration test for the VA-8 LAN control-plane listener, added after the listener (#136) and its server-side trust anchor (VS-92, #110) merged.

Drives the real lan::spawn listener over mTLS:

A peer presenting a client cert signed by the shared agent CA completes the mTLS handshake, sends sysinfo (read-only) and gets a reply, then sends executecommand (mutating) and is refused with {"action":"error","error":"not-permitted"}.
A second test confirms a peer presenting no client cert cannot get a reply - mTLS is mandatory, the listener is not accept-anyone.

This covers the peer-interaction half of the VA-8 acceptance criteria (listener + mTLS peer auth + WebSocket + gated dispatch). The agent has no peer-dialer yet, so the harness plays the connecting peer, using the same trust shape as production (one agent CA signs every agent leaf directly, so a bare leaf verifies in one hop).

Testing

cargo test -p vervain-agent --test lan_listener - 2 pass. clippy --all-targets and fmt clean.

Part of VA-8.

## What End-to-end integration test for the VA-8 LAN control-plane listener, added after the listener (#136) and its server-side trust anchor (VS-92, #110) merged. Drives the real `lan::spawn` listener over mTLS: - A peer presenting a client cert **signed by the shared agent CA** completes the mTLS handshake, sends `sysinfo` (read-only) and gets a reply, then sends `executecommand` (mutating) and is refused with `{"action":"error","error":"not-permitted"}`. - A second test confirms a peer presenting **no client cert** cannot get a reply - mTLS is mandatory, the listener is not accept-anyone. This covers the peer-interaction half of the VA-8 acceptance criteria (listener + mTLS peer auth + WebSocket + gated dispatch). The agent has no peer-*dialer* yet, so the harness plays the connecting peer, using the same trust shape as production (one agent CA signs every agent leaf directly, so a bare leaf verifies in one hop). ## Testing `cargo test -p vervain-agent --test lan_listener` - 2 pass. clippy `--all-targets` and fmt clean. Part of VA-8.

longjacksonle added 1 commit

2026-07-14 18:19:39 +02:00

test(lan): end-to-end mTLS + capability-gate integration test (VA-8)

Check / fmt + clippy + tests (pull_request) Successful in 13m39s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

a395bd2386

Drive the real `lan::spawn` listener over mTLS: a peer presenting a client cert signed by the shared agent CA connects, a read-only inventory action round-trips, and a mutating action is refused by the capability gate. A second test confirms a peer presenting no client cert cannot get a reply (mTLS is mandatory, not accept-anyone).

This exercises the peer-interaction half of the VA-8 acceptance criteria end to end (listener + mTLS peer auth + WebSocket + gated dispatch). The agent has no peer-dialer yet, so the harness plays the connecting peer, mirroring the production trust setup where a single agent CA signs every agent leaf directly.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BFsMi3Vmf3pCc7mBdhZqoV