fix(local-qa): harden Host-Worker protocol

.github/workflows/rust-ci.yml

@@ -124,10 +124,18 @@ jobs:
         with:
           node-version: 20
           cache: npm
-          cache-dependency-path: packages/qa-contracts/package-lock.json
+          cache-dependency-path: |
+            apps/local-qa-runtime/workers/package-lock.json
+            packages/qa-contracts/package-lock.json
       - name: Install QA contracts
         working-directory: packages/qa-contracts
         run: npm ci --ignore-scripts
       - name: Test QA contracts
         working-directory: packages/qa-contracts
         run: npm run --ignore-scripts test
+      - name: Install Local QA workers
+        working-directory: apps/local-qa-runtime/workers
+        run: npm ci --ignore-scripts
+      - name: Test Local QA workers
+        working-directory: apps/local-qa-runtime/workers
+        run: npm run --ignore-scripts test

apps/local-qa-runtime/browser-adapter/src/lib.rs

@@ -1025,6 +1025,7 @@ mod unix {
 
         #[test]
         fn fixture_serves_only_the_fixed_contract() {
+            let _browser_guard = browser_test_guard();
             let fixture = FixtureServer::start().expect("fixture starts");
             let address = fixture.address;
             let ok = send_request(
@@ -1481,8 +1482,10 @@ mod unix {
             }
         }
 
+        #[cfg(target_os = "linux")]
         struct KillOnDrop(Child);
 
+        #[cfg(target_os = "linux")]
         impl KillOnDrop {
             fn spawn(executable: &str, arguments: &[&str]) -> Self {
                 Self(
@@ -1501,6 +1504,7 @@ mod unix {
             }
         }
 
+        #[cfg(target_os = "linux")]
         impl Drop for KillOnDrop {
             fn drop(&mut self) {
                 let _ = self.0.kill();

apps/local-qa-runtime/tests/scaffold-structure.sh

@@ -22,8 +22,11 @@ expected=$(printf '%s\n' \
   apps/local-qa-runtime/workers/src/index.ts \
   apps/local-qa-runtime/workers/src/json.ts \
   apps/local-qa-runtime/workers/src/policy.ts \
+  apps/local-qa-runtime/workers/src/protocol-worker.ts \
   apps/local-qa-runtime/workers/src/worker-error.ts \
-  apps/local-qa-runtime/workers/test/browser-smoke.test.mjs)
+  apps/local-qa-runtime/workers/src/worker-main.ts \
+  apps/local-qa-runtime/workers/test/browser-smoke.test.mjs \
+  apps/local-qa-runtime/workers/test/protocol-worker.test.mjs)
 actual=$(find apps/local-qa-runtime -type f \( -name '*.rs' -o -name '*.ts' -o -name '*.mjs' \) \
   ! -path '*/node_modules/*' ! -path '*/target/*' ! -path '*/dist/*' | sort)
 [[ "$actual" == "$expected" ]] || { echo 'unexpected Local QA source file' >&2; exit 1; }

apps/local-qa-runtime/workers/src/index.ts

@@ -13,4 +13,4 @@ export {
   type WorkerErrorCode,
 } from "./policy.js";
 
-export { runProtocolWorker } from "./protocol-worker.js";
+export { runProtocolWorker, type ProtocolFailureCode } from "./protocol-worker.js";

apps/local-qa-runtime/workers/src/policy.ts

@@ -182,6 +182,7 @@ export async function runBrowserSmoke(
           bytes: RUNNER_LOG.slice(),
         }),
         "local-evidence-object",
+        "evidence/1",
         "qa.local-evidence/v1",
       );
     } catch (error) {
@@ -201,7 +202,13 @@ export async function runBrowserSmoke(
   const finishedAt = await clockNow(ports.clock);
   const finishedMonotonicMs = await monotonicNow(ports.clock);
   const durationMs = finishedMonotonicMs - startedMonotonicMs;
-  if (!Number.isSafeInteger(durationMs) || durationMs < 0) {
+  const wallDurationMs = Date.parse(finishedAt) - Date.parse(startedAt);
+  if (
+    !Number.isSafeInteger(durationMs) ||
+    durationMs < 0 ||
+    wallDurationMs < 0 ||
+    wallDurationMs !== durationMs
+  ) {
     throw new BrowserSmokeWorkerError("clock.invalid_value");
   }
 
@@ -333,11 +340,13 @@ function validateSessionResult(value: unknown): {
     sanitizedObservationRef: validateReference(
       value.sanitizedObservationRef,
       "local-sanitized-observation",
+      "observation/0",
       "qa.local-evidence/v1",
     ),
     screenshotEvidenceRef: validateReference(
       value.screenshotEvidenceRef,
       "local-evidence-object",
+      "evidence/0",
       "qa.local-evidence/v1",
     ),
   };
@@ -346,6 +355,7 @@ function validateSessionResult(value: unknown): {
 function validateReference<TSchema extends string>(
   value: unknown,
   expectedKind: string,
+  expectedId: string,
   expectedSchema: TSchema,
 ): DigestBoundRef<TSchema> {
   if (!isRecord(value)) {
@@ -361,10 +371,7 @@ function validateReference<TSchema extends string>(
   }
   if (
     value.kind !== expectedKind ||
-    typeof value.id !== "string" ||
-    !(expectedKind === "local-sanitized-observation"
-      ? /^observation\/[0-9]+$/.test(value.id)
-      : /^evidence\/[0-9]+$/.test(value.id)) ||
+    value.id !== expectedId ||
     value.schema_version !== expectedSchema ||
     typeof value.content_digest !== "string" ||
     !/^sha256:[0-9a-f]{64}$/.test(value.content_digest) ||
@@ -400,7 +407,7 @@ async function clockNow(clock: ClockPort): Promise<string> {
   } catch {
     throw new BrowserSmokeWorkerError("clock.failed");
   }
-  if (typeof value !== "string") {
+  if (typeof value !== "string" || !isWorkerTimestamp(value)) {
     throw new BrowserSmokeWorkerError("clock.invalid_value");
   }
   return value;
@@ -419,6 +426,12 @@ async function monotonicNow(clock: ClockPort): Promise<number> {
   return value;
 }
 
+function isWorkerTimestamp(value: string): boolean {
+  if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(value)) return false;
+  const millis = Date.parse(value);
+  return Number.isFinite(millis) && new Date(millis).toISOString() === value;
+}
+
 function isExactRecord(value: unknown, expectedKeys: readonly string[]): value is Record<string, unknown> {
   if (!isRecord(value)) {
     return false;