Primitive-Origins/context-primitive-code-agent-pack-v0

1{"id":"cp-auth::password_hash_and_verify_roundtrip::explain_behavior","input":"\n#[test]\nfn password_hash_and_verify_roundtrip() -> Result<(), Box<dyn std::error::Error>> {\n    let hash = StoredPasswordHash::hash(\"correct horse battery staple\")?;\n    assert!(hash.verify(\"correct horse battery staple\"));\n    assert!(!hash.verify(\"wrong horse battery staple\"));\n    assert!(!hash.as_str().contains(\"correct horse\"));\n    Ok(())\n}","instruction":"Explain what the Rust test `password_hash_and_verify_roundtrip` verifies.","output":"The test `password_hash_and_verify_roundtrip` verifies password hash and verify roundtrip. It belongs to cp-auth and covers domains: auth. Observed statuses: none; error codes: none; assertions: 3.","source_test_id":"cp-auth::password_hash_and_verify_roundtrip","task":"behavior_explanation"}2{"id":"cp-auth::access_token_expires_after_15_minutes::explain_behavior","input":"\n#[test]\nfn access_token_expires_after_15_minutes() -> Result<(), Box<dyn std::error::Error>> {\n    let dir = temp_dir(\"expiry\")?;\n    let mut accounts = AccountStore::open(&dir, &key())?;\n    let account = accounts.create(create_owner(\"owner\", \"correct horse battery staple\"))?;\n    let mut sessions = SessionStore::open(&dir, &key())?;\n    let (access, _, session) = sessions.create(&account)?;\n    assert!(\n        sessions\n            .verify_access_token(access.expose(), session.access_token_expires_at)\n            .is_err()\n    );\n    Ok(())\n}","instruction":"Explain what the Rust test `access_token_expires_after_15_minutes` verifies.","output":"The test `access_token_expires_after_15_minutes` verifies access token expires after 15 minutes. It belongs to cp-auth and covers domains: auth. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-auth::access_token_expires_after_15_minutes","task":"behavior_explanation"}3{"id":"cp-bus::dead_letter_preserves_original_record_hash::explain_behavior","input":"\n    #[test]\n    fn dead_letter_preserves_original_record_hash() -> Result<(), Box<dyn std::error::Error>> {\n        let path = temp_path(\"dead-letter\");\n        let mut store = StreamStore::open(&path)?;\n        let appended = append_task(&mut store, \"t1\")?;\n        let sub = Subscription::new(\n            SubscriptionId::new(\"sub-a\")?,\n            \"consumer-a\",\n            &NodeId::new(\"node-a\")?,\n            SubjectFilter::new(\"task.*\")?,\n        )?;\n        assert_eq!(store.read(&sub, 1).len(), 1);\n        store.decide(\n            \"consumer-a\",\n            1,\n            AckDecision::DeadLetter {\n                reason: \"poison payload\".to_string(),\n            },\n        )?;\n        assert_eq!(store.peek(&sub, 10).len(), 0);\n        let dead_letter = store\n            .dead_letters()\n            .first()\n            .ok_or(\"dead letter should be recorded\")?;\n        assert_eq!(dead_letter.original_record_hash, appended.hash);\n        let reopened = StreamStore::open(&path)?;\n        assert_eq!(\n            reopened.dead_letters()[0].original_record_hash,\n            appended.hash\n        );\n        fs::remove_file(path)?;\n        Ok(())\n    }","instruction":"Explain what the Rust test `dead_letter_preserves_original_record_hash` verifies.","output":"The test `dead_letter_preserves_original_record_hash` verifies dead letter preserves original record hash. It belongs to cp-bus and covers domains: task. Observed statuses: none; error codes: none; assertions: 4.","source_test_id":"cp-bus::dead_letter_preserves_original_record_hash","task":"behavior_explanation"}4{"id":"cp-bus::retention_writes_compaction_marker_without_erasing_truth::explain_behavior","input":"\n    #[test]\n    fn retention_writes_compaction_marker_without_erasing_truth()\n    -> Result<(), Box<dyn std::error::Error>> {\n        let path = temp_path(\"retention\");\n        let mut store = StreamStore::open(&path)?;\n        append_task(&mut store, \"t1\")?;\n        append_task(&mut store, \"t2\")?;\n        let marker = store.write_compaction_marker(RetentionPolicy {\n            compact_before_or_at: 1,\n            reason: \"test retention\".to_string(),\n        })?;\n        assert_eq!(marker.compacted_through_sequence, 1);\n        assert_eq!(marker.retained_original_records, 2);\n        let reopened = StreamStore::open(&path)?;\n        assert_eq!(reopened.records().len(), 2);\n        assert_eq!(reopened.verify()?.checked_records, 2);\n        fs::remove_file(path)?;\n        Ok(())\n    }","instruction":"Explain what the Rust test `retention_writes_compaction_marker_without_erasing_truth` verifies.","output":"The test `retention_writes_compaction_marker_without_erasing_truth` verifies retention writes compaction marker without erasing truth. It belongs to cp-bus and covers domains: task. Observed statuses: none; error codes: none; assertions: 4.","source_test_id":"cp-bus::retention_writes_compaction_marker_without_erasing_truth","task":"behavior_explanation"}5{"id":"cp-bus::interrupted_write_recovers_or_fails_closed::explain_behavior","input":"\n    #[test]\n    fn interrupted_write_recovers_or_fails_closed() -> Result<(), Box<dyn std::error::Error>> {\n        let path = temp_path(\"interrupted\");\n        let mut store = StreamStore::open(&path)?;\n        append_task(&mut store, \"t1\")?;\n        {\n            let mut file = OpenOptions::new().append(true).open(&path)?;\n            file.write_all(br#\"{\"body\":{\"sequence\":2\"#)?;\n            file.sync_data()?;\n        }\n        let reopened = StreamStore::open(&path)?;\n        assert_eq!(reopened.records().len(), 1);\n        assert!(sidecar_path(&path, \"recovery\").exists());\n\n        let closed_path = temp_path(\"interrupted-closed\");\n        let mut closed = StreamStore::open(&closed_path)?;\n        append_task(&mut closed, \"t1\")?;\n        {\n            let mut file = OpenOptions::new().append(true).open(&closed_path)?;\n            file.write_all(br#\"{\"bad\":\"complete\"}\"#)?;\n            file.write_all(b\"\\n\")?;\n            file.sync_data()?;\n        }\n        let err = StreamStore::open(&closed_path)\n            .err()\n            .ok_or(\"complete malformed line must fail closed\")?;\n        assert!(matches!(err, StreamStoreError::Json(_)));\n        fs::remove_file(path)?;\n        fs::remove_file(closed_path)?;\n        Ok(())\n    }","instruction":"Explain what the Rust test `interrupted_write_recovers_or_fails_closed` verifies.","output":"The test `interrupted_write_recovers_or_fails_closed` verifies interrupted write recovers or fails closed. It belongs to cp-bus and covers domains: task. Observed statuses: none; error codes: none; assertions: 3.","source_test_id":"cp-bus::interrupted_write_recovers_or_fails_closed","task":"behavior_explanation"}6{"id":"cp-bus::consumer_lag_reports_per_subscription::explain_behavior","input":"\n    #[test]\n    fn consumer_lag_reports_per_subscription() -> Result<(), Box<dyn std::error::Error>> {\n        let path = temp_path(\"lag\");\n        let mut store = StreamStore::open(&path)?;\n        append_task(&mut store, \"t1\")?;\n        append_task(&mut store, \"t2\")?;\n        let sub = Subscription::new(\n            SubscriptionId::new(\"sub-a\")?,\n            \"consumer-a\",\n            &NodeId::new(\"node-a\")?,\n            SubjectFilter::new(\"task.*\")?,\n        )?;\n        let first = store.read(&sub, 1);\n        store.decide(\"consumer-a\", first[0].body.sequence, AckDecision::Ack)?;\n        let lag = store.consumer_lag(&sub);\n        assert_eq!(lag.consumer_id, \"consumer-a\");\n        assert_eq!(lag.last_delivered_sequence, 1);\n        assert_eq!(lag.last_acked_sequence, 1);\n        assert_eq!(lag.pending_records, 1);\n        assert_eq!(lag.highest_matching_sequence, 2);\n        fs::remove_file(path)?;\n        Ok(())\n    }","instruction":"Explain what the Rust test `consumer_lag_reports_per_subscription` verifies.","output":"The test `consumer_lag_reports_per_subscription` verifies consumer lag reports per subscription. It belongs to cp-bus and covers domains: task. Observed statuses: none; error codes: none; assertions: 5.","source_test_id":"cp-bus::consumer_lag_reports_per_subscription","task":"behavior_explanation"}7{"id":"cp-config::invalid_data_dir_fails::explain_behavior","input":"\n    #[test]\n    fn invalid_data_dir_fails() -> Result<(), Box<dyn std::error::Error>> {\n        let file = write_file(\"relative-dir\", \"data_dir = \\\"relative/path\\\"\\n\")?;\n        let result = ConfigLoader::load(&[\n            ConfigLayer::CompiledDefaults,\n            ConfigLayer::LocalNodeFile(file),\n        ]);\n        assert!(matches!(\n            result,\n            Err(ConfigError::InvalidValue {\n                field: \"data_dir\",\n                ..\n            })\n        ));\n        Ok(())\n    }","instruction":"Explain what the Rust test `invalid_data_dir_fails` verifies.","output":"The test `invalid_data_dir_fails` verifies invalid data dir fails. It belongs to cp-config and covers domains: general. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-config::invalid_data_dir_fails","task":"behavior_explanation"}8{"id":"cp-core::rejects_unknown_event_in_strict_mode::explain_behavior","input":"\n    #[test]\n    fn rejects_unknown_event_in_strict_mode() -> Result<(), String> {\n        let err = match validate_payload(\"tenant.custom.event\", [\"anything\"], true) {\n            Ok(_) => return Err(\"strict mode should reject unknown events\".to_string()),\n            Err(err) => err,\n        };\n        assert_eq!(\n            err,\n            PayloadValidationError::UnknownEventType(\"tenant.custom.event\".to_string())\n        );\n        Ok(())\n    }","instruction":"Explain what the Rust test `rejects_unknown_event_in_strict_mode` verifies.","output":"The test `rejects_unknown_event_in_strict_mode` verifies rejects unknown event in strict mode. It belongs to cp-core and covers domains: event, tenant. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-core::rejects_unknown_event_in_strict_mode","task":"behavior_explanation"}9{"id":"cp-core::sha256_hex_matches_reference::explain_behavior","input":"\n    #[test]\n    fn sha256_hex_matches_reference() {\n        assert_eq!(\n            sha256_hex(b\"hello\"),\n            \"2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824\"\n        );\n    }","instruction":"Explain what the Rust test `sha256_hex_matches_reference` verifies.","output":"The test `sha256_hex_matches_reference` verifies sha256 hex matches reference. It belongs to cp-core and covers domains: general. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-core::sha256_hex_matches_reference","task":"behavior_explanation"}10{"id":"cp-core::owner_implies_all_roles::explain_behavior","input":"\n    #[test]\n    fn owner_implies_all_roles() {\n        assert!(Role::Owner.implies(Role::Admin));\n        assert!(Role::Owner.implies(Role::Operator));\n        assert!(Role::Owner.implies(Role::Developer));\n        assert!(Role::Owner.implies(Role::Auditor));\n        assert!(Role::Owner.implies(Role::Viewer));\n    }","instruction":"Explain what the Rust test `owner_implies_all_roles` verifies.","output":"The test `owner_implies_all_roles` verifies owner implies all roles. It belongs to cp-core and covers domains: rbac. Observed statuses: none; error codes: none; assertions: 5.","source_test_id":"cp-core::owner_implies_all_roles","task":"behavior_explanation"}11{"id":"cp-entitlement::audit_events_are_emitted::explain_behavior","input":"\n    #[test]\n    fn audit_events_are_emitted() -> Result<(), Box<dyn std::error::Error>> {\n        let mut bus = StreamStore::open(temp_path(\"audit\")?)?;\n        let audit = EntitlementAudit::new(NodeId::new(\"node-local\")?);\n\n        audit.check_started(&mut bus, \"license-a\")?;\n        audit.check_succeeded(&mut bus, \"license-a\", EntitlementDecision::Active)?;\n        audit.check_failed(&mut bus, \"license-a\", \"timeout\")?;\n        audit.mode_changed(\n            &mut bus,\n            EntitlementDecision::Grace,\n            EntitlementDecision::Restricted,\n        )?;\n        let event_types = bus\n            .records()\n            .iter()\n            .map(|record| record.body.event_type.as_str())\n            .collect::<Vec<_>>();\n\n        assert!(event_types.contains(&\"entitlement.check.started\"));\n        assert!(event_types.contains(&\"entitlement.check.succeeded\"));\n        assert!(event_types.contains(&\"entitlement.check.failed\"));\n        assert!(event_types.contains(&\"entitlement.mode.changed\"));\n        Ok(())\n    }","instruction":"Explain what the Rust test `audit_events_are_emitted` verifies.","output":"The test `audit_events_are_emitted` verifies audit events are emitted. It belongs to cp-entitlement and covers domains: event. Observed statuses: none; error codes: none; assertions: 4.","source_test_id":"cp-entitlement::audit_events_are_emitted","task":"behavior_explanation"}12{"id":"cp-entitlement::expired_license_enters_grace::explain_behavior","input":"\n    #[test]\n    fn expired_license_enters_grace() -> Result<(), Box<dyn std::error::Error>> {\n        let token = LicenseToken::signed(claims(1_000, 2_000), b\"vendor-key\")?;\n\n        assert_eq!(\n            LicenseVerifier::verify(&token, b\"vendor-key\", 1_500),\n            EntitlementDecision::Grace\n        );\n        Ok(())\n    }","instruction":"Explain what the Rust test `expired_license_enters_grace` verifies.","output":"The test `expired_license_enters_grace` verifies expired license enters grace. It belongs to cp-entitlement and covers domains: general. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-entitlement::expired_license_enters_grace","task":"behavior_explanation"}13{"id":"cp-governance::dag_rejects_cycle::explain_behavior","input":"\n    #[test]\n    fn dag_rejects_cycle() -> Result<(), Box<dyn std::error::Error>> {\n        let mut scribe = Scribe::new();\n        scribe.insert_node(ProvenanceNodeInput {\n            node_id: \"a\".to_string(),\n            entity_type: \"dataset\".to_string(),\n            entity_id: \"a\".to_string(),\n            event_type: \"foundry.dataset\".to_string(),\n            source: \"test\".to_string(),\n            timestamp_unix_ms: 1,\n            metadata: json!({}),\n        })?;\n        scribe.insert_node(ProvenanceNodeInput {\n            node_id: \"b\".to_string(),\n            entity_type: \"model\".to_string(),\n            entity_id: \"b\".to_string(),\n            event_type: \"model.outcome\".to_string(),\n            source: \"test\".to_string(),\n            timestamp_unix_ms: 1,\n            metadata: json!({}),\n        })?;\n        scribe.insert_edge(\n            \"a\",\n            \"b\",\n            DerivationType::DerivedFrom,\n            \"event-a\",\n            json!({}),\n            1,\n        )?;\n\n        let result = scribe.insert_edge(\n            \"b\",\n            \"a\",\n            DerivationType::DerivedFrom,\n            \"event-b\",\n            json!({}),\n            1,\n        );\n\n        assert_eq!(result, Err(ScribeError::CycleDetected));\n        Ok(())\n    }","instruction":"Explain what the Rust test `dag_rejects_cycle` verifies.","output":"The test `dag_rejects_cycle` verifies dag rejects cycle. It belongs to cp-governance and covers domains: event. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-governance::dag_rejects_cycle","task":"behavior_explanation"}14{"id":"cp-installer::windows_plan_builds_valid_powershell::explain_behavior","input":"\n    #[test]\n    fn windows_plan_builds_valid_powershell() -> Result<(), Box<dyn std::error::Error>> {\n        let plan = WindowsPlan::build(WindowsInstallConfig::default_for_source_binary(\n            \"target/release/cp-daemon.exe\",\n        ))?;\n\n        plan.validate()?;\n        assert_eq!(plan.platform, InstallPlatform::WindowsService);\n        assert!(plan.service_install_script.contains(\"New-Service\"));\n        assert!(plan.service_install_script.contains(\"-BinaryPathName\"));\n        assert!(\n            plan.service_install_script\n                .contains(\"-StartupType Automatic\")\n        );\n        assert!(plan.service_install_script.contains(\"Start-Service\"));\n        assert!(\n            plan.service_install_script\n                .contains(\"ContextPrimitiveDaemon\")\n        );\n        assert!(plan.actions.iter().any(|action| {\n            action.kind == InstallActionKind::WindowsServiceInstall\n                && action.detail.contains(\"PowerShell service installer\")\n        }));\n        Ok(())\n    }","instruction":"Explain what the Rust test `windows_plan_builds_valid_powershell` verifies.","output":"The test `windows_plan_builds_valid_powershell` verifies windows plan builds valid powershell. It belongs to cp-installer and covers domains: general. Observed statuses: none; error codes: none; assertions: 7.","source_test_id":"cp-installer::windows_plan_builds_valid_powershell","task":"behavior_explanation"}15{"id":"cp-installer::linux_plan_rejects_unsafe_modes::explain_behavior","input":"\n    #[test]\n    fn linux_plan_rejects_unsafe_modes() -> Result<(), Box<dyn std::error::Error>> {\n        assert!(matches!(\n            FileMode::new(0o777),\n            Err(InstallerError::InvalidMode(0o777))\n        ));\n        assert!(matches!(\n            FileMode::new(0o222),\n            Err(InstallerError::InvalidMode(0o222))\n        ));\n        let safe_mode = FileMode::new(0o700)?;\n        assert_eq!(safe_mode.raw(), 0o700);\n        Ok(())\n    }","instruction":"Explain what the Rust test `linux_plan_rejects_unsafe_modes` verifies.","output":"The test `linux_plan_rejects_unsafe_modes` verifies linux plan rejects unsafe modes. It belongs to cp-installer and covers domains: general. Observed statuses: none; error codes: none; assertions: 3.","source_test_id":"cp-installer::linux_plan_rejects_unsafe_modes","task":"behavior_explanation"}16{"id":"cp-installer::linux_plan_serializes_to_json::explain_behavior","input":"\n    #[test]\n    fn linux_plan_serializes_to_json() -> Result<(), Box<dyn std::error::Error>> {\n        let json = plan()?.to_pretty_json()?;\n\n        assert!(json.contains(\"\\\"platform\\\": \\\"LinuxSystemd\\\"\"));\n        assert!(json.contains(\"\\\"kind\\\": \\\"SystemdEnableNow\\\"\"));\n        Ok(())\n    }","instruction":"Explain what the Rust test `linux_plan_serializes_to_json` verifies.","output":"The test `linux_plan_serializes_to_json` verifies linux plan serializes to json. It belongs to cp-installer and covers domains: general. Observed statuses: none; error codes: none; assertions: 2.","source_test_id":"cp-installer::linux_plan_serializes_to_json","task":"behavior_explanation"}17{"id":"cp-installer::linux_plan_stages_files_without_system_install::explain_behavior","input":"\n    #[test]\n    fn linux_plan_stages_files_without_system_install() -> Result<(), Box<dyn std::error::Error>> {\n        let dir = test_dir(\"stage\")?;\n        let source = dir.join(\"cp-daemon-source\");\n        fs::create_dir_all(&dir)?;\n        write_linux_source_binaries(&source)?;\n        let plan = LinuxInstallPlan::build(LinuxInstallConfig::default_for_source_binary(&source))?;\n\n        let report = plan.stage(&dir.join(\"root\"))?;\n\n        assert_eq!(report.files.len(), 4);\n        assert_eq!(report.artifact_set_sha256.len(), 64);\n        assert!(report.manifest_path.exists());\n        let manifest = fs::read_to_string(&report.manifest_path)?;\n        assert!(manifest.contains(\"\\\"artifact_set_sha256\\\"\"));\n        assert!(\n            report\n                .files\n                .iter()\n                .any(|file| file.install_path == Path::new(\"/opt/context-primitive/bin/cp-daemon\"))\n        );\n        assert!(\n            report\n                .files\n                .iter()\n                .any(|file| file.install_path == Path::new(\"/opt/context-primitive/bin/cp-setup\"))\n        );\n        assert!(report.files.iter().all(|file| file.sha256.len() == 64));\n        assert!(\n            dir.join(\"root/opt/context-primitive/bin/cp-daemon\")\n                .exists()\n        );\n        assert!(dir.join(\"root/opt/context-primitive/bin/cp-setup\").exists());\n        assert!(\n            dir.join(\"root/etc/context-primitive/context-primitive.env\")\n                .exists()\n        );\n        assert!(\n            dir.join(\"root/etc/systemd/system/context-primitive.service\")\n                .exists()\n        );\n        Ok(())\n    }","instruction":"Explain what the Rust test `linux_plan_stages_files_without_system_install` verifies.","output":"The test `linux_plan_stages_files_without_system_install` verifies linux plan stages files without system install. It belongs to cp-installer and covers domains: general. Observed statuses: none; error codes: none; assertions: 11.","source_test_id":"cp-installer::linux_plan_stages_files_without_system_install","task":"behavior_explanation"}18{"id":"cp-installer::release_bundle_manifest_detects_tampered_bundle::explain_behavior","input":"\n    #[test]\n    fn release_bundle_manifest_detects_tampered_bundle() -> Result<(), Box<dyn std::error::Error>> {\n        let dir = test_dir(\"release-verify-tamper\")?;\n        let source = dir.join(\"cp-daemon-source\");\n        fs::create_dir_all(&dir)?;\n        write_linux_source_binaries(&source)?;\n        let plan = LinuxInstallPlan::build(LinuxInstallConfig::default_for_source_binary(&source))?;\n        let stage = plan.stage(&dir.join(\"stage\"))?;\n        let bundle = bundle_verified_stage(&stage.manifest_path, &dir.join(\"bundle\"))?;\n        let binary = bundle\n            .files\n            .iter()\n            .find(|file| file.install_path == Path::new(\"/opt/context-primitive/bin/cp-daemon\"))\n            .ok_or(InstallerError::InvalidRenderedFile(\n                \"missing bundled binary\",\n            ))?;\n        fs::write(&binary.bundle_path, b\"tampered\")?;\n\n        let verification = verify_release_bundle_manifest(&bundle.release_manifest_path)?;\n\n        assert!(!verification.passed);\n        assert!(verification.checks.iter().any(|check| !check.passed));\n        Ok(())\n    }","instruction":"Explain what the Rust test `release_bundle_manifest_detects_tampered_bundle` verifies.","output":"The test `release_bundle_manifest_detects_tampered_bundle` verifies release bundle manifest detects tampered bundle. It belongs to cp-installer and covers domains: general. Observed statuses: none; error codes: none; assertions: 2.","source_test_id":"cp-installer::release_bundle_manifest_detects_tampered_bundle","task":"behavior_explanation"}19{"id":"cp-installer::release_handoff_manifest_requires_verified_bundle::explain_behavior","input":"\n    #[test]\n    fn release_handoff_manifest_requires_verified_bundle() -> Result<(), Box<dyn std::error::Error>>\n    {\n        let dir = test_dir(\"release-handoff-clean\")?;\n        let source = dir.join(\"cp-daemon-source\");\n        fs::create_dir_all(&dir)?;\n        write_linux_source_binaries(&source)?;\n        let plan = LinuxInstallPlan::build(LinuxInstallConfig::default_for_source_binary(&source))?;\n        let stage = plan.stage(&dir.join(\"stage\"))?;\n        let bundle = bundle_verified_stage(&stage.manifest_path, &dir.join(\"bundle\"))?;\n        let handoff_path = dir.join(\"bundle/context-primitive-handoff-manifest.json\");\n        let release_manifest_bytes = fs::read(&bundle.release_manifest_path)?;\n\n        let handoff = write_release_handoff_manifest(&bundle.release_manifest_path, &handoff_path)?;\n\n        assert!(handoff_path.exists());\n        assert_eq!(\n            handoff.schema_version,\n            \"context-primitive.release-handoff.v1\"\n        );\n        assert_eq!(handoff.file_count, bundle.files.len());\n        assert_eq!(\n            handoff.release_manifest_sha256,\n            sha256_hex(&release_manifest_bytes)\n        );\n        assert_eq!(\n            handoff.bundle_artifact_set_sha256,\n            bundle.bundle_artifact_set_sha256\n        );\n        assert!(\n            handoff\n                .policy_assertions\n                .iter()\n                .all(|assertion| assertion.asserted)\n        );\n        Ok(())\n    }","instruction":"Explain what the Rust test `release_handoff_manifest_requires_verified_bundle` verifies.","output":"The test `release_handoff_manifest_requires_verified_bundle` verifies release handoff manifest requires verified bundle. It belongs to cp-installer and covers domains: general. Observed statuses: none; error codes: none; assertions: 10.","source_test_id":"cp-installer::release_handoff_manifest_requires_verified_bundle","task":"behavior_explanation"}20{"id":"cp-installer::parses_bundle_subcommand::explain_behavior","input":"\n    #[test]\n    fn parses_bundle_subcommand() -> Result<(), Box<dyn std::error::Error>> {\n        let args = CliArgs::parse([\n            \"bundle\".to_owned(),\n            \"--stage-manifest\".to_owned(),\n            \"/tmp/stage/context-primitive-stage-manifest.json\".to_owned(),\n            \"--bundle-dir\".to_owned(),\n            \"/tmp/context-primitive-bundle\".to_owned(),\n        ])?;\n        assert_eq!(args.command, CliCommand::Bundle);\n        assert_eq!(\n            args.verify_stage_manifest,\n            Some(PathBuf::from(\n                \"/tmp/stage/context-primitive-stage-manifest.json\"\n            ))\n        );\n        assert_eq!(\n            args.bundle_dir,\n            Some(PathBuf::from(\"/tmp/context-primitive-bundle\"))\n        );\n        Ok(())\n    }","instruction":"Explain what the Rust test `parses_bundle_subcommand` verifies.","output":"The test `parses_bundle_subcommand` verifies parses bundle subcommand. It belongs to cp-installer and covers domains: general. Observed statuses: none; error codes: none; assertions: 3.","source_test_id":"cp-installer::parses_bundle_subcommand","task":"behavior_explanation"}21{"id":"cp-installer::setup_non_interactive_mode_records_bootstrap_peers::explain_behavior","input":"\n    #[test]\n    fn setup_non_interactive_mode_records_bootstrap_peers() -> Result<(), Box<dyn std::error::Error>>\n    {\n        let mut config = config(\"peers\")?;\n        config.bootstrap_peers = vec![SetupBootstrapPeer::parse(\"node-peer@192.0.2.10:7400\")?];\n        config.install_service = true;\n\n        let report = run_non_interactive_setup(&config, \"correct horse battery staple\")?;\n        let peers = fs::read_to_string(config.config_dir.join(\"bootstrap-peers.toml\"))?;\n\n        assert!(report.install_service_requested);\n        assert!(report.service_handoff_file.is_some());\n        assert!(peers.contains(\"node-peer\"));\n        assert!(peers.contains(\"192.0.2.10:7400\"));\n        Ok(())\n    }","instruction":"Explain what the Rust test `setup_non_interactive_mode_records_bootstrap_peers` verifies.","output":"The test `setup_non_interactive_mode_records_bootstrap_peers` verifies setup non interactive mode records bootstrap peers. It belongs to cp-installer and covers domains: general. Observed statuses: none; error codes: none; assertions: 4.","source_test_id":"cp-installer::setup_non_interactive_mode_records_bootstrap_peers","task":"behavior_explanation"}22{"id":"cp-installer::setup_install_service_writes_reviewable_handoff::explain_behavior","input":"\n    #[test]\n    fn setup_install_service_writes_reviewable_handoff() -> Result<(), Box<dyn std::error::Error>> {\n        let mut config = config(\"service-handoff\")?;\n        config.install_service = true;\n\n        let report = run_non_interactive_setup(&config, \"correct horse battery staple\")?;\n        let path = report\n            .service_handoff_file\n            .ok_or(\"missing service handoff file\")?;\n        let handoff = fs::read_to_string(path)?;\n\n        assert!(\n            handoff.contains(\"LinuxSystemd\")\n                || handoff.contains(\"MacOsLaunchd\")\n                || handoff.contains(\"WindowsService\")\n        );\n        assert!(handoff.contains(\"context-primitive\"));\n        Ok(())\n    }","instruction":"Explain what the Rust test `setup_install_service_writes_reviewable_handoff` verifies.","output":"The test `setup_install_service_writes_reviewable_handoff` verifies setup install service writes reviewable handoff. It belongs to cp-installer and covers domains: general. Observed statuses: none; error codes: none; assertions: 2.","source_test_id":"cp-installer::setup_install_service_writes_reviewable_handoff","task":"behavior_explanation"}23{"id":"cp-kernel::legal_hold_cold_context_does_not_expire::explain_behavior","input":"\n    #[test]\n    fn legal_hold_cold_context_does_not_expire() -> Result<(), Box<dyn std::error::Error>> {\n        let policy = ContextLifecyclePolicy::new(100, 200, Some(300), 10, 90)?;\n        let mut manager = ContextLifecycleManager::new(policy);\n        let entry_id = EntryId::new(\"entry-a\")?;\n        let mut record = entry(\"entry-a\", ContextTemperature::Cold)?;\n        record.legal_hold = true;\n        record.archive_ref = Some(\"cold:entry-a\".to_string());\n        manager.upsert_entry(record)?;\n\n        manager.sweep(1_301)?;\n\n        assert_eq!(\n            manager.entry(&entry_id).ok_or(\"missing entry\")?.temperature,\n            ContextTemperature::Cold\n        );\n        Ok(())\n    }","instruction":"Explain what the Rust test `legal_hold_cold_context_does_not_expire` verifies.","output":"The test `legal_hold_cold_context_does_not_expire` verifies legal hold cold context does not expire. It belongs to cp-kernel and covers domains: general. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-kernel::legal_hold_cold_context_does_not_expire","task":"behavior_explanation"}24{"id":"cp-kernel::focused_semantic_route_uses_bge_m3_role::explain_behavior","input":"\n    #[test]\n    fn focused_semantic_route_uses_bge_m3_role() -> Result<(), Box<dyn std::error::Error>> {\n        let decision = ContextRouter.evaluate(request(\n            true,\n            false,\n            ContextRelevanceInput {\n                semantic_similarity: Some(0.82),\n                ..ContextRelevanceInput::default()\n            },\n        )?)?;\n        assert!(decision.allowed);\n        assert_eq!(decision.tier, ContextRouteTier::SemanticEmbedding);\n        assert_eq!(\n            decision.sidecar.focused_model,\n            DEFAULT_FOCUSED_RELEVANCE_MODEL\n        );\n        assert_eq!(\n            decision.reason,\n            \"focused_relevance_routed_to_configured_model\"\n        );\n        Ok(())\n    }","instruction":"Explain what the Rust test `focused_semantic_route_uses_bge_m3_role` verifies.","output":"The test `focused_semantic_route_uses_bge_m3_role` verifies focused semantic route uses bge m3 role. It belongs to cp-kernel and covers domains: general. Observed statuses: none; error codes: none; assertions: 4.","source_test_id":"cp-kernel::focused_semantic_route_uses_bge_m3_role","task":"behavior_explanation"}25{"id":"cp-kernel::focused_route_blocks_when_bge_role_not_live::explain_behavior","input":"\n    #[test]\n    fn focused_route_blocks_when_bge_role_not_live() -> Result<(), Box<dyn std::error::Error>> {\n        let mut request = request(true, false, ContextRelevanceInput::default())?;\n        request.sidecar.focused_model = \"other-model\".to_owned();\n        let decision = ContextRouter.evaluate(request)?;\n        assert!(!decision.allowed);\n        assert_eq!(decision.tier, ContextRouteTier::Blocked);\n        assert_eq!(decision.reason, \"required_context_model_not_live\");\n        Ok(())\n    }","instruction":"Explain what the Rust test `focused_route_blocks_when_bge_role_not_live` verifies.","output":"The test `focused_route_blocks_when_bge_role_not_live` verifies focused route blocks when bge role not live. It belongs to cp-kernel and covers domains: general. Observed statuses: none; error codes: none; assertions: 3.","source_test_id":"cp-kernel::focused_route_blocks_when_bge_role_not_live","task":"behavior_explanation"}26{"id":"cp-kernel::verified_claims_flow_into_authority_snapshot::explain_behavior","input":"\n    #[test]\n    fn verified_claims_flow_into_authority_snapshot() -> Result<(), Box<dyn std::error::Error>> {\n        let mut store = AgentIdentityStore::new();\n        let agent = AgentId::new(\"agent-a\")?;\n        store.register(agent.clone(), 1_000)?;\n        store.verify_claim(&agent, VerifiedClaim::capability(\"Context.Write\")?, 1_001)?;\n        store.verify_claim(&agent, VerifiedClaim::domain(\"System\")?, 1_002)?;\n\n        let claims = store.effective_claims(&agent);\n\n        assert!(claims.capabilities.contains(\"context.write\"));\n        assert!(claims.domains.contains(\"system\"));\n        Ok(())\n    }","instruction":"Explain what the Rust test `verified_claims_flow_into_authority_snapshot` verifies.","output":"The test `verified_claims_flow_into_authority_snapshot` verifies verified claims flow into authority snapshot. It belongs to cp-kernel and covers domains: auth, agent. Observed statuses: none; error codes: none; assertions: 2.","source_test_id":"cp-kernel::verified_claims_flow_into_authority_snapshot","task":"behavior_explanation"}27{"id":"cp-kernel::disabled_identity_has_no_effective_claims::explain_behavior","input":"\n    #[test]\n    fn disabled_identity_has_no_effective_claims() -> Result<(), Box<dyn std::error::Error>> {\n        let mut store = AgentIdentityStore::new();\n        let agent = AgentId::new(\"agent-a\")?;\n        store.register(agent.clone(), 1_000)?;\n        store.verify_claim(&agent, VerifiedClaim::capability(\"context.write\")?, 1_001)?;\n        store.disable(&agent, \"operator action\", 1_002)?;\n\n        let claims = store.effective_claims(&agent);\n\n        assert!(claims.capabilities.is_empty());\n        Ok(())\n    }","instruction":"Explain what the Rust test `disabled_identity_has_no_effective_claims` verifies.","output":"The test `disabled_identity_has_no_effective_claims` verifies disabled identity has no effective claims. It belongs to cp-kernel and covers domains: agent. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-kernel::disabled_identity_has_no_effective_claims","task":"behavior_explanation"}28{"id":"cp-kernel::schema_violation_triggers_escalation::explain_behavior","input":"\n    #[test]\n    fn schema_violation_triggers_escalation() -> Result<(), Box<dyn Error>> {\n        let trust = trust()?;\n        let engine = ModelEscalationEngine::default();\n        let mut request = request()?;\n        request.verification_outcome = VerificationOutcome::SchemaViolation;\n\n        let decision = engine.evaluate(&trust, &request)?;\n\n        assert_eq!(decision.outcome, ModelEscalationOutcome::Escalated);\n        assert_eq!(\n            decision.escalation_signal,\n            Some(EscalationSignal::SchemaValidationFailed)\n        );\n        assert_eq!(decision.reason, \"schema_validation_triggered_escalation\");\n        Ok(())\n    }","instruction":"Explain what the Rust test `schema_violation_triggers_escalation` verifies.","output":"The test `schema_violation_triggers_escalation` verifies schema violation triggers escalation. It belongs to cp-kernel and covers domains: trust. Observed statuses: none; error codes: none; assertions: 3.","source_test_id":"cp-kernel::schema_violation_triggers_escalation","task":"behavior_explanation"}29{"id":"cp-kernel::support_access_capped_at_auditor::explain_behavior","input":"\n    #[test]\n    fn support_access_capped_at_auditor() -> Result<(), Box<dyn std::error::Error>> {\n        let request = SupportAccessRequest::new(\n            support()?,\n            org()?,\n            Some(workspace()?),\n            true,\n            1_000,\n            \"incident review\",\n            Role::Admin,\n        )?;\n        assert_eq!(\n            SupportAccessRule::binding_for(&request),\n            Err(SupportAccessError::RoleAboveAuditor {\n                requested: Role::Admin\n            })\n        );\n\n        let allowed = SupportAccessRequest::new(\n            support()?,\n            org()?,\n            Some(workspace()?),\n            true,\n            1_000,\n            \"incident review\",\n            Role::Auditor,\n        )?;\n        let binding = SupportAccessRule::binding_for(&allowed)?;\n        assert_eq!(binding.role, Role::Auditor);\n        Ok(())\n    }","instruction":"Explain what the Rust test `support_access_capped_at_auditor` verifies.","output":"The test `support_access_capped_at_auditor` verifies support access capped at auditor. It belongs to cp-kernel and covers domains: rbac, support. Observed statuses: none; error codes: none; assertions: 2.","source_test_id":"cp-kernel::support_access_capped_at_auditor","task":"behavior_explanation"}30{"id":"cp-kernel::same_sequence_hash_mismatch_is_divergence::explain_behavior","input":"\n    #[test]\n    fn same_sequence_hash_mismatch_is_divergence() -> Result<(), Box<dyn Error>> {\n        let decision = LedgerReconciliation.evaluate(ReconciliationRequest {\n            coordinator_node_id: None,\n            local_head: head(\"1\", 10, hash_a(), true)?,\n            peer_heads: vec![head(\"2\", 10, hash_b(), true)?],\n        })?;\n\n        assert!(!decision.aligned);\n        assert_eq!(decision.peers[0].status, ReconciliationStatus::Diverged);\n        Ok(())\n    }","instruction":"Explain what the Rust test `same_sequence_hash_mismatch_is_divergence` verifies.","output":"The test `same_sequence_hash_mismatch_is_divergence` verifies same sequence hash mismatch is divergence. It belongs to cp-kernel and covers domains: general. Observed statuses: none; error codes: none; assertions: 2.","source_test_id":"cp-kernel::same_sequence_hash_mismatch_is_divergence","task":"behavior_explanation"}31{"id":"cp-kernel::peer_ahead_requires_local_replay_not_owner_override::explain_behavior","input":"\n    #[test]\n    fn peer_ahead_requires_local_replay_not_owner_override() -> Result<(), Box<dyn Error>> {\n        let decision = LedgerReconciliation.evaluate(ReconciliationRequest {\n            coordinator_node_id: Some(NodeId::new(\"1\")?),\n            local_head: head(\"1\", 7, hash_a(), true)?,\n            peer_heads: vec![head(\"2\", 10, hash_b(), true)?],\n        })?;\n\n        assert!(!decision.aligned);\n        assert_eq!(decision.accepted_owner_node_id, None);\n        assert_eq!(decision.peers[0].status, ReconciliationStatus::LocalBehind);\n        assert_eq!(decision.peers[0].reason, \"local_needs_replay\");\n        Ok(())\n    }","instruction":"Explain what the Rust test `peer_ahead_requires_local_replay_not_owner_override` verifies.","output":"The test `peer_ahead_requires_local_replay_not_owner_override` verifies peer ahead requires local replay not owner override. It belongs to cp-kernel and covers domains: general. Observed statuses: none; error codes: none; assertions: 4.","source_test_id":"cp-kernel::peer_ahead_requires_local_replay_not_owner_override","task":"behavior_explanation"}32{"id":"cp-kernel::tenant_evaluation_exposes_failed_binding_reason::explain_behavior","input":"\n    #[test]\n    fn tenant_evaluation_exposes_failed_binding_reason() -> Result<(), Box<dyn std::error::Error>> {\n        let (mut tenants, tenant_id) = tenant_registry()?;\n        tenants.bind_agent(\n            &tenant_id,\n            AgentId::new(\"agent-b\")?,\n            \"primary\",\n            TenantBindingStatus::Failed,\n            1_002,\n        )?;\n        let mut task = task()?;\n        task.tenant_id = Some(tenant_id);\n        let identities = identities()?;\n        let mut trust = TrustStore::new(0.05)?;\n        trust.record_success(AgentId::new(\"agent-a\")?, 3.0, Some(\"system\"))?;\n        trust.record_success(AgentId::new(\"agent-b\")?, 3.0, Some(\"system\"))?;\n\n        let evaluation = SchedulerBridge::new(0.35)?.evaluate_with_tenants(\n            &task,\n            &identities,\n            &trust,\n            Some(&tenants),\n            &candidates()?,\n        )?;\n\n        let failed = evaluation\n            .ineligible\n            .iter()\n            .find(|candidate| candidate.agent_id.as_str() == \"agent-b\")\n            .ok_or(\"missing failed candidate reason\")?;\n        assert_eq!(failed.reason.as_str(), \"tenant_binding_ineligible\");\n        Ok(())\n    }","instruction":"Explain what the Rust test `tenant_evaluation_exposes_failed_binding_reason` verifies.","output":"The test `tenant_evaluation_exposes_failed_binding_reason` verifies tenant evaluation exposes failed binding reason. It belongs to cp-kernel and covers domains: task, trust, agent, tenant. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-kernel::tenant_evaluation_exposes_failed_binding_reason","task":"behavior_explanation"}33{"id":"cp-kernel::self_dependency_is_rejected::explain_behavior","input":"\n    #[test]\n    fn self_dependency_is_rejected() -> Result<(), Box<dyn std::error::Error>> {\n        let task = TaskId::new(\"task-a\")?;\n        let request = create_request()?.with_dependencies([task]);\n\n        assert_eq!(request, Err(TaskError::SelfDependency));\n        Ok(())\n    }","instruction":"Explain what the Rust test `self_dependency_is_rejected` verifies.","output":"The test `self_dependency_is_rejected` verifies self dependency is rejected. It belongs to cp-kernel and covers domains: task. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-kernel::self_dependency_is_rejected","task":"behavior_explanation"}34{"id":"cp-kernel::metadata_rejects_agent_lifecycle_fields::explain_behavior","input":"\n    #[test]\n    fn metadata_rejects_agent_lifecycle_fields() -> Result<(), Box<dyn std::error::Error>> {\n        let mut registry = TenantRegistry::new();\n        let mut metadata = BTreeMap::new();\n        metadata.insert(\"kill_reason\".to_string(), Value::String(\"bad\".to_string()));\n        let err = registry\n            .register(\n                TenantId::new(\"tenant-a\")?,\n                \"example.test\",\n                [\"base\"],\n                \"/state/tenant-a\",\n                metadata,\n                1_000,\n            )\n            .expect_err(\"forbidden metadata should fail\");\n        assert!(matches!(err, TenantError::ForbiddenMetadataField(_)));\n        Ok(())\n    }","instruction":"Explain what the Rust test `metadata_rejects_agent_lifecycle_fields` verifies.","output":"The test `metadata_rejects_agent_lifecycle_fields` verifies metadata rejects agent lifecycle fields. It belongs to cp-kernel and covers domains: agent, tenant. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-kernel::metadata_rejects_agent_lifecycle_fields","task":"behavior_explanation"}35{"id":"cp-kernel::registry_persists_and_reloads_tenant_home_and_bindings::explain_behavior","input":"\n    #[test]\n    fn registry_persists_and_reloads_tenant_home_and_bindings()\n    -> Result<(), Box<dyn std::error::Error>> {\n        let (mut registry, tenant) = registry_with_tenant()?;\n        let agent = AgentId::new(\"agent-primary\")?;\n        registry.bind_agent(\n            &tenant,\n            agent.clone(),\n            \"primary\",\n            TenantBindingStatus::Active,\n            1_001,\n        )?;\n        let path = temp_registry_path(\"tenant-registry-reload\");\n        let store = TenantRegistryStore::new(path.clone());\n\n        store.save(&registry)?;\n        let loaded = store.load()?;\n        let loaded_tenant = loaded\n            .tenant(&tenant)\n            .ok_or(\"missing tenant after reload\")?;\n\n        assert_eq!(loaded_tenant.domain, \"example.test\");\n        assert!(loaded.is_agent_eligible_for_tenant(&tenant, &agent));\n        let _ = std::fs::remove_file(path);\n        Ok(())\n    }","instruction":"Explain what the Rust test `registry_persists_and_reloads_tenant_home_and_bindings` verifies.","output":"The test `registry_persists_and_reloads_tenant_home_and_bindings` verifies registry persists and reloads tenant home and bindings. It belongs to cp-kernel and covers domains: agent, tenant. Observed statuses: none; error codes: none; assertions: 2.","source_test_id":"cp-kernel::registry_persists_and_reloads_tenant_home_and_bindings","task":"behavior_explanation"}36{"id":"cp-kernel::explicit_trust_kill_marks_tenant_binding_failed_and_promotes_standby::explain_behavior","input":"\n    #[test]\n    fn explicit_trust_kill_marks_tenant_binding_failed_and_promotes_standby()\n    -> Result<(), Box<dyn std::error::Error>> {\n        let (mut tenants, tenant, primary, standby) = tenant_registry()?;\n        let mut store = TrustStore::new(0.25)?;\n\n        let emissions = store.kill_with_tenant_replacement(\n            primary.clone(),\n            \"operator kill\",\n            &mut tenants,\n            1_003,\n        )?;\n\n        let record = tenants.tenant(&tenant).ok_or(\"missing tenant\")?;\n        assert!(record.enabled);\n        assert!(!record.suspended);\n        assert_eq!(emissions[0].event_type, \"tenant.agent.replacement_needed\");\n        assert!(!tenants.is_agent_eligible_for_tenant(&tenant, &primary));\n        assert!(tenants.is_agent_eligible_for_tenant(&tenant, &standby));\n        Ok(())\n    }","instruction":"Explain what the Rust test `explicit_trust_kill_marks_tenant_binding_failed_and_promotes_standby` verifies.","output":"The test `explicit_trust_kill_marks_tenant_binding_failed_and_promotes_standby` verifies explicit trust kill marks tenant binding failed and promotes standby. It belongs to cp-kernel and covers domains: trust, event, agent, tenant. Observed statuses: none; error codes: none; assertions: 5.","source_test_id":"cp-kernel::explicit_trust_kill_marks_tenant_binding_failed_and_promotes_standby","task":"behavior_explanation"}37{"id":"cp-mwl::auth_login_refresh_and_logout_use_real_sessions::explain_behavior","input":"\n#[test]\nfn auth_login_refresh_and_logout_use_real_sessions() -> Result<(), Box<dyn std::error::Error>> {\n    let api = auth_router()?;\n    let login = api.handle(ApiRequest::new(\"POST\", \"/auth/login\").json(&json!({\n        \"username\": \"owner\",\n        \"password\": \"correct horse battery staple\"\n    }))?);\n    assert_eq!(login.status, 200);\n    let parsed: Value = serde_json::from_slice(&login.body)?;\n    let access = parsed[\"access_token\"]\n        .as_str()\n        .ok_or(\"missing access token\")?;\n    let refresh = parsed[\"refresh_token\"]\n        .as_str()\n        .ok_or(\"missing refresh token\")?;\n    assert_eq!(parsed[\"expires_in\"], 900);\n    {\n        let resources = api_state_resources(&api);\n        let resources = resources\n            .lock()\n            .map_err(|_| \"api resources lock poisoned\")?;\n        assert!(resources.bus.records().iter().any(|record| {\n            record.body.event_type.as_str() == \"auth.login.success\"\n                && record.body.payload[\"account_id\"].is_string()\n                && record.body.payload[\"session_id\"].is_string()\n        }));\n    }\n\n    let accounts = api.handle(\n        ApiRequest::new(\"GET\", \"/auth/accounts\")\n            .header(\"authorization\", format!(\"Bearer {access}\")),\n    );\n    assert_eq!(accounts.status, 200);\n\n    let refreshed = api.handle(\n        ApiRequest::new(\"POST\", \"/auth/token/refresh\").json(&json!({\"refresh_token\": refresh}))?,\n    );\n    assert_eq!(refreshed.status, 200);\n    let refreshed_body: Value = serde_json::from_slice(&refreshed.body)?;\n    let refreshed_access = refreshed_body[\"access_token\"]\n        .as_str()\n        .ok_or(\"missing refreshed access token\")?;\n    assert_ne!(refreshed_access, access);\n\n    let logout = api.handle(\n        ApiRequest::new(\"POST\", \"/auth/logout\")\n            .header(\"authorization\", format!(\"Bearer {refreshed_access}\")),\n    );\n    assert_eq!(logout.status, 201);\n\n    let rejected = api.handle(\n        ApiRequest::new(\"GET\", \"/auth/accounts\")\n            .header(\"authorization\", format!(\"Bearer {refreshed_access}\")),\n    );\n    assert_eq!(rejected.status, 401);\n    Ok(())\n}","instruction":"Explain what the Rust test `auth_login_refresh_and_logout_use_real_sessions` verifies.","output":"The test `auth_login_refresh_and_logout_use_real_sessions` verifies auth login refresh and logout use real sessions. It belongs to cp-mwl and covers domains: auth, event. Observed statuses: [200, 201, 401]; error codes: none; assertions: 8.","source_test_id":"cp-mwl::auth_login_refresh_and_logout_use_real_sessions","task":"behavior_explanation"}38{"id":"cp-mwl::metrics_endpoint_emits_authority_denied_counter::explain_behavior","input":"\n#[test]\nfn metrics_endpoint_emits_authority_denied_counter() -> Result<(), Box<dyn std::error::Error>> {\n    let api = router()?;\n    {\n        let resources = api_state_resources(&api);\n        let resources = resources.lock().map_err(|_| \"state lock poisoned\")?;\n        let policy = cp_kernel::AuthorityPolicy::kernel_default()?\n            .with_metrics(std::sync::Arc::clone(&resources.metrics));\n        let decision = policy.authorize(\n            &resources.trust,\n            &resources.human_seat,\n            crate::state::now_ms(),\n            &AgentId::new(\"agent-a\")?,\n            \"context.write\",\n            &cp_kernel::ClaimsSnapshot::new(),\n        );\n        assert!(!decision.allowed);\n    }\n    let response = api.handle(ApiRequest::new(\"GET\", \"/metrics\"));\n    assert_eq!(response.status, 200);\n    let body = String::from_utf8(response.body)?;\n    assert!(\n        body.contains(&format!(\"{CP_KERNEL_AUTHORITY_DENIED_TOTAL} 1\")),\n        \"{body}\"\n    );\n    Ok(())\n}","instruction":"Explain what the Rust test `metrics_endpoint_emits_authority_denied_counter` verifies.","output":"The test `metrics_endpoint_emits_authority_denied_counter` verifies metrics endpoint emits authority denied counter. It belongs to cp-mwl and covers domains: auth, trust, metrics, agent. Observed statuses: [200]; error codes: none; assertions: 3.","source_test_id":"cp-mwl::metrics_endpoint_emits_authority_denied_counter","task":"behavior_explanation"}39{"id":"cp-mwl::workflow_create_accepts_valid_loom_schema::explain_behavior","input":"\n#[test]\nfn workflow_create_accepts_valid_loom_schema() -> Result<(), Box<dyn std::error::Error>> {\n    let body: Value = serde_json::from_str(&valid_workflow_body(\"workflow-valid\"))?;\n    let api = router()?;\n    let response = api.handle(\n        ApiRequest::new(\"POST\", \"/workflows\")\n            .header(\"authorization\", \"Bearer developer\")\n            .json(&body)?,\n    );\n    assert_eq!(response.status, 201);\n    let persisted = api.handle(\n        ApiRequest::new(\"GET\", \"/workflows/workflow-valid\")\n            .header(\"authorization\", \"Bearer developer\"),\n    );\n    assert_eq!(persisted.status, 200);\n    let parsed: Value = serde_json::from_slice(&persisted.body)?;\n    assert_eq!(parsed[\"workflow_id\"], \"workflow-valid\");\n    assert_eq!(parsed[\"definition\"][\"blocks\"][0][\"size\"][\"width\"], 260);\n    Ok(())\n}","instruction":"Explain what the Rust test `workflow_create_accepts_valid_loom_schema` verifies.","output":"The test `workflow_create_accepts_valid_loom_schema` verifies workflow create accepts valid loom schema. It belongs to cp-mwl and covers domains: auth, workflow. Observed statuses: [200, 201]; error codes: none; assertions: 4.","source_test_id":"cp-mwl::workflow_create_accepts_valid_loom_schema","task":"behavior_explanation"}40{"id":"cp-mwl::agent_claimable_task_inbox_filters_open_tasks::explain_behavior","input":"\n#[test]\nfn agent_claimable_task_inbox_filters_open_tasks() -> Result<(), Box<dyn std::error::Error>> {\n    let api = router()?;\n    for (task_id, binding_role) in [\n        (\"task-inbox-echo\", \"simple_worker.echo\"),\n        (\"task-inbox-health\", \"simple_worker.health_check\"),\n        (\"task-inbox-shell\", \"simple_worker.shell\"),\n    ] {\n        let task = json!({\n            \"task_id\": task_id,\n            \"status\": \"created\",\n            \"assigned_agent_id\": null,\n            \"assigned_node_id\": null,\n            \"workflow_run_id\": null,\n            \"workflow_id\": null,\n            \"edge_id\": null,\n            \"tenant_id\": null,\n            \"binding_role\": binding_role,\n            \"selected_model_tier\": \"Tier3B\",\n            \"lease_expires_at_ms\": null,\n            \"attempt_count\": 0,\n            \"max_attempts\": 1,\n            \"retry_reason\": null,\n            \"failure_reason\": null,\n            \"failed_at_ms\": null,\n            \"completed_by_agent_id\": null,\n            \"completed_at_ms\": null\n        });\n        let created = api.handle(\n            ApiRequest::new(\"POST\", \"/tasks\")\n                .header(\"authorization\", \"Bearer developer\")\n                .json(&task)?,\n        );\n        assert_eq!(created.status, 201);\n    }\n\n    let exact = api.handle(\n        ApiRequest::new(\n            \"GET\",\n            \"/agents/agent-a/tasks/claimable?binding_role=simple_worker.echo\",\n        )\n        .header(\"authorization\", \"Bearer developer\"),\n    );\n    assert_eq!(exact.status, 200);\n    let exact_body: Value = serde_json::from_slice(&exact.body)?;\n    let exact_tasks = exact_body[\"tasks\"].as_array().unwrap();\n    assert_eq!(exact_tasks.len(), 1);\n    assert_eq!(exact_tasks[0][\"task_id\"], \"task-inbox-echo\");\n\n    let prefixed = api.handle(\n        ApiRequest::new(\n            \"GET\",\n            \"/agents/agent-a/tasks/claimable?binding_role_prefix=simple_worker.&limit=2\",\n        )\n        .header(\"authorization\", \"Bearer developer\"),\n    );\n    assert_eq!(prefixed.status, 200);\n    let prefixed_body: Value = serde_json::from_slice(&prefixed.body)?;\n    let prefixed_tasks = prefixed_body[\"tasks\"].as_array().unwrap();\n    assert_eq!(prefixed_tasks.len(), 2);\n    assert!(\n        prefixed_tasks\n            .iter()\n            .all(|task| task[\"status\"] == \"created\")\n    );\n    Ok(())\n}","instruction":"Explain what the Rust test `agent_claimable_task_inbox_filters_open_tasks` verifies.","output":"The test `agent_claimable_task_inbox_filters_open_tasks` verifies agent claimable task inbox filters open tasks. It belongs to cp-mwl and covers domains: auth, workflow, task, agent, tenant. Observed statuses: [200, 201]; error codes: none; assertions: 7.","source_test_id":"cp-mwl::agent_claimable_task_inbox_filters_open_tasks","task":"behavior_explanation"}41{"id":"cp-mwl::workflow_task_completion_marks_run_completed::explain_behavior","input":"\n#[test]\nfn workflow_task_completion_marks_run_completed() -> Result<(), Box<dyn std::error::Error>> {\n    let api = router()?;\n    let workflow: Value = serde_json::from_str(&valid_workflow_body(\"workflow-task-done\"))?;\n    let workflow_created = api.handle(\n        ApiRequest::new(\"POST\", \"/workflows\")\n            .header(\"authorization\", \"Bearer developer\")\n            .json(&workflow)?,\n    );\n    assert_eq!(workflow_created.status, 201);\n    let task = json!({\n        \"task_id\": \"task-workflow-done\",\n        \"status\": \"created\",\n        \"assigned_agent_id\": null,\n        \"assigned_node_id\": null,\n        \"workflow_run_id\": \"run-workflow-task-done\",\n        \"workflow_id\": \"workflow-task-done\",\n        \"edge_id\": \"edge-a\",\n        \"tenant_id\": null,\n        \"binding_role\": \"simple_worker_block.echo\",\n        \"selected_model_tier\": \"Tier3B\",\n        \"lease_expires_at_ms\": null,\n        \"attempt_count\": 0,\n        \"max_attempts\": 1,\n        \"retry_reason\": null,\n        \"failure_reason\": null,\n        \"failed_at_ms\": null,\n        \"completed_by_agent_id\": null,\n        \"completed_at_ms\": null\n    });\n    let created = api.handle(\n        ApiRequest::new(\"POST\", \"/tasks\")\n            .header(\"authorization\", \"Bearer developer\")\n            .json(&task)?,\n    );\n    assert_eq!(created.status, 201);\n    let claimed = api.handle(\n        ApiRequest::new(\"POST\", \"/tasks/task-workflow-done/claim\")\n            .header(\"authorization\", \"Bearer developer\")\n            .json(&json!({\"agent_id\": \"agent-a\", \"node_id\": \"node-local\"}))?,\n    );\n    assert_eq!(claimed.status, 200);\n    let claim: Value = serde_json::from_slice(&claimed.body)?;\n    let lease_token = claim[\"lease_token\"].as_str().unwrap_or_default();\n\n    let completed = api.handle(\n        ApiRequest::new(\"POST\", \"/tasks/task-workflow-done/complete\")\n            .header(\"authorization\", \"Bearer developer\")\n            .json(&low_risk_completion_body(\"agent-a\", lease_token))?,\n    );\n    assert_eq!(completed.status, 200);\n\n    let run_detail = api.handle(\n        ApiRequest::new(\"GET\", \"/workflow-runs/run-workflow-task-done\")\n            .header(\"authorization\", \"Bearer operator\"),\n    );\n    assert_eq!(run_detail.status, 200);\n    let run: Value = serde_json::from_slice(&run_detail.body)?;\n    assert_eq!(run[\"summary\"][\"status\"], \"completed\");\n    assert_eq!(run[\"summary\"][\"terminal\"], true);\n    let event_types = run[\"timeline\"]\n        .as_array()\n        .into_iter()\n        .flatten()\n        .filter_map(|event| event[\"event_type\"].as_str())\n        .collect::<Vec<_>>();\n    assert!(event_types.contains(&\"task.completed\"));\n    assert!(event_types.contains(&\"workflow.completed\"));\n    Ok(())\n}","instruction":"Explain what the Rust test `workflow_task_completion_marks_run_completed` verifies.","output":"The test `workflow_task_completion_marks_run_completed` verifies workflow task completion marks run completed. It belongs to cp-mwl and covers domains: auth, workflow, task, event, agent, tenant. Observed statuses: [200, 201]; error codes: none; assertions: 9.","source_test_id":"cp-mwl::workflow_task_completion_marks_run_completed","task":"behavior_explanation"}42{"id":"cp-net::acl_allow_passes_permitted_frame::explain_behavior","input":"\n    #[test]\n    fn acl_allow_passes_permitted_frame() -> Result<(), Box<dyn std::error::Error>> {\n        let acl = policy(AclAction::Allow)?;\n        assert_eq!(\n            acl.evaluate(\n                &NodeId::new(\"node-a\")?,\n                &NodeId::new(\"node-b\")?,\n                Some(&EventType::new(\"task.created\")?)\n            ),\n            AclAction::Allow\n        );\n        Ok(())\n    }","instruction":"Explain what the Rust test `acl_allow_passes_permitted_frame` verifies.","output":"The test `acl_allow_passes_permitted_frame` verifies acl allow passes permitted frame. It belongs to cp-net and covers domains: task, event. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-net::acl_allow_passes_permitted_frame","task":"behavior_explanation"}43{"id":"cp-net::wrong_target_is_silently_dropped::explain_behavior","input":"\n    #[tokio::test]\n    async fn wrong_target_is_silently_dropped() -> Result<(), Box<dyn std::error::Error>> {\n        let (tx, mut rx) = mpsc::channel(8);\n        let wrong_local = NodeId::new(\"node-other\")?;\n        let admitted = Arc::new(RwLock::new(BTreeSet::from([peer_id()?])));\n        let dispatcher = FrameDispatcher::new(wrong_local, admitted, tx);\n\n        let packet = make_wire_packet(&peer_id()?, &local_id()?)?;\n        dispatcher.dispatch(peer_addr()?, &packet).await?;\n\n        assert!(\n            rx.try_recv().is_err(),\n            \"frame addressed to a different node must be silently dropped\"\n        );\n        Ok(())\n    }","instruction":"Explain what the Rust test `wrong_target_is_silently_dropped` verifies.","output":"The test `wrong_target_is_silently_dropped` verifies wrong target is silently dropped. It belongs to cp-net and covers domains: general. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-net::wrong_target_is_silently_dropped","task":"behavior_explanation"}44{"id":"cp-net::malformed_packet_is_silently_dropped::explain_behavior","input":"\n    #[tokio::test]\n    async fn malformed_packet_is_silently_dropped() -> Result<(), Box<dyn std::error::Error>> {\n        let (tx, mut rx) = mpsc::channel(8);\n        let admitted = Arc::new(RwLock::new(BTreeSet::from([peer_id()?])));\n        let dispatcher = FrameDispatcher::new(local_id()?, admitted, tx);\n\n        dispatcher\n            .dispatch(peer_addr()?, \"this is not a valid wire packet\")\n            .await?;\n\n        assert!(\n            rx.try_recv().is_err(),\n            \"malformed packet must be silently dropped\"\n        );\n        Ok(())\n    }","instruction":"Explain what the Rust test `malformed_packet_is_silently_dropped` verifies.","output":"The test `malformed_packet_is_silently_dropped` verifies malformed packet is silently dropped. It belongs to cp-net and covers domains: general. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-net::malformed_packet_is_silently_dropped","task":"behavior_explanation"}45{"id":"cp-net::acl_allow_passes_permitted_frame::explain_behavior","input":"\n    #[tokio::test]\n    async fn acl_allow_passes_permitted_frame() -> Result<(), Box<dyn std::error::Error>> {\n        let (tx, mut rx) = mpsc::channel(8);\n        let (denied_tx, mut denied_rx) = mpsc::channel(8);\n        let admitted = Arc::new(RwLock::new(BTreeSet::from([peer_id()?])));\n        let dispatcher = FrameDispatcher::new(local_id()?, admitted, tx).with_acl(\n            Arc::new(AclPolicy {\n                rules: vec![TransportAcl {\n                    rule_id: \"allow-task\".to_owned(),\n                    from_node_pattern: NodePattern::Exact(peer_id()?),\n                    to_node_pattern: NodePattern::Exact(local_id()?),\n                    allowed_event_type_patterns: vec![\"task.*\".to_owned()],\n                    action: AclAction::Allow,\n                }],\n                default_action: AclAction::Deny,\n            }),\n            denied_tx,\n        );\n\n        let packet = make_wire_packet(&peer_id()?, &local_id()?)?;\n        dispatcher.dispatch(peer_addr()?, &packet).await?;\n\n        assert!(rx.try_recv().is_ok());\n        assert!(denied_rx.try_recv().is_err());\n        Ok(())\n    }","instruction":"Explain what the Rust test `acl_allow_passes_permitted_frame` verifies.","output":"The test `acl_allow_passes_permitted_frame` verifies acl allow passes permitted frame. It belongs to cp-net and covers domains: task, event, transport. Observed statuses: none; error codes: none; assertions: 2.","source_test_id":"cp-net::acl_allow_passes_permitted_frame","task":"behavior_explanation"}46{"id":"cp-net::two_nodes_negotiate_session_on_loopback::explain_behavior","input":"\n    #[tokio::test]\n    async fn two_nodes_negotiate_session_on_loopback() -> Result<(), Box<dyn std::error::Error>> {\n        let key_a = key_a()?;\n        let key_b = key_b()?;\n        let mut dir_a = TransportPeerDirectory::open(temp_dir(\"a\")?, NodeId::new(\"node-a\")?)?;\n        let mut dir_b = TransportPeerDirectory::open(temp_dir(\"b\")?, NodeId::new(\"node-b\")?)?;\n        enroll_pair(&mut dir_a, &mut dir_b, &key_a, &key_b)?;\n        let socket_a = UdpListener::bind(&NetConfig::new(\"127.0.0.1:0\".parse()?)).await?;\n        let socket_b = UdpListener::bind(&NetConfig::new(\"127.0.0.1:0\".parse()?)).await?;\n        let addr_b = socket_b.local_addr()?;\n\n        let responder = tokio::spawn(async move {\n            let mut buf = Vec::new();\n            let (peer_addr, raw) = socket_b.receive_frame(&mut buf).await?;\n            let exchange = UdpHandshakeExchange::new();\n            exchange\n                .accept(\n                    &socket_b,\n                    &raw,\n                    peer_addr,\n                    UdpHandshakeAcceptRequest {\n                        directory: &dir_b,\n                        local_transport_key_id: TransportKeyId::new(\"mesh-key-1\")?,\n                        local_key_pair: &key_b,\n                        now_ms: 1,\n                        allow_relay: true,\n                        allow_loopback: true,\n                    },\n                )\n                .await\n        });\n\n        let exchange = UdpHandshakeExchange::new();\n        let initiator_session = exchange\n            .initiate(\n                &socket_a,\n                addr_b,\n                UdpHandshakeInitiateRequest {\n                    directory: &dir_a,\n                    local_transport_key_id: TransportKeyId::new(\"mesh-key-1\")?,\n                    local_key_pair: &key_a,\n                    peer_node_id: NodeId::new(\"node-b\")?,\n                    expected_peer_key_id: TransportKeyId::new(\"mesh-key-1\")?,\n                    now_ms: 1,\n                    allow_relay: true,\n                    allow_loopback: true,\n                },\n            )\n            .await?;\n        let responder_session = responder.await??;\n        assert_eq!(initiator_session.peer.node_id, NodeId::new(\"node-b\")?);\n        assert_eq!(responder_session.peer.node_id, NodeId::new(\"node-a\")?);\n        Ok(())\n    }","instruction":"Explain what the Rust test `two_nodes_negotiate_session_on_loopback` verifies.","output":"The test `two_nodes_negotiate_session_on_loopback` verifies two nodes negotiate session on loopback. It belongs to cp-net and covers domains: transport. Observed statuses: none; error codes: none; assertions: 2.","source_test_id":"cp-net::two_nodes_negotiate_session_on_loopback","task":"behavior_explanation"}47{"id":"cp-net::handshake_rejects_replayed_nonce::explain_behavior","input":"\n    #[tokio::test]\n    async fn handshake_rejects_replayed_nonce() -> Result<(), Box<dyn std::error::Error>> {\n        let key_a = key_a()?;\n        let key_b = key_b()?;\n        let mut dir_a =\n            TransportPeerDirectory::open(temp_dir(\"replay-a\")?, NodeId::new(\"node-a\")?)?;\n        let mut dir_b =\n            TransportPeerDirectory::open(temp_dir(\"replay-b\")?, NodeId::new(\"node-b\")?)?;\n        enroll_pair(&mut dir_a, &mut dir_b, &key_a, &key_b)?;\n        let socket_a = UdpListener::bind(&NetConfig::new(\"127.0.0.1:0\".parse()?)).await?;\n        let socket_b = UdpListener::bind(&NetConfig::new(\"127.0.0.1:0\".parse()?)).await?;\n        let raw = encode_init(&UdpHandshakeInitFrame {\n            local_node_id: NodeId::new(\"node-a\")?,\n            peer_node_id: NodeId::new(\"node-b\")?,\n            local_key_id: TransportKeyId::new(\"mesh-key-1\")?,\n            local_nonce: [7; 32],\n        })?;\n        let exchange = UdpHandshakeExchange::new();\n        let peer_addr = socket_a.local_addr()?;\n        exchange\n            .accept(\n                &socket_b,\n                &raw,\n                peer_addr,\n                UdpHandshakeAcceptRequest {\n                    directory: &dir_b,\n                    local_transport_key_id: TransportKeyId::new(\"mesh-key-1\")?,\n                    local_key_pair: &key_b,\n                    now_ms: 1,\n                    allow_relay: true,\n                    allow_loopback: true,\n                },\n            )\n            .await?;\n        assert!(matches!(\n            exchange\n                .accept(\n                    &socket_b,\n                    &raw,\n                    peer_addr,\n                    UdpHandshakeAcceptRequest {\n                        directory: &dir_b,\n                        local_transport_key_id: TransportKeyId::new(\"mesh-key-1\")?,\n                        local_key_pair: &key_b,\n                        now_ms: 1,\n                        allow_relay: true,\n                        allow_loopback: true,\n                    },\n                )\n                .await,\n            Err(UdpHandshakeError::Replay)\n        ));\n        drop(dir_a);\n        Ok(())\n    }","instruction":"Explain what the Rust test `handshake_rejects_replayed_nonce` verifies.","output":"The test `handshake_rejects_replayed_nonce` verifies handshake rejects replayed nonce. It belongs to cp-net and covers domains: transport. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-net::handshake_rejects_replayed_nonce","task":"behavior_explanation"}48{"id":"cp-net::relay_client_forwards_encrypted_frame::explain_behavior","input":"\n    #[tokio::test]\n    async fn relay_client_forwards_encrypted_frame() -> Result<(), Box<dyn std::error::Error>> {\n        let client_socket = UdpSocket::bind(\"127.0.0.1:0\").await?;\n        let relay_socket = UdpSocket::bind(\"127.0.0.1:0\").await?;\n        let target_socket = UdpSocket::bind(\"127.0.0.1:0\").await?;\n        let relay = RelayClient::new(relay_socket.local_addr()?);\n        let target = NodeId::new(\"node-target\")?;\n        let encrypted = b\"sealed-ciphertext\".to_vec();\n\n        relay\n            .forward(&client_socket, target.clone(), encrypted.clone())\n            .await?;\n        let mut buf = [0_u8; 512];\n        let (len, _) = timeout(Duration::from_secs(1), relay_socket.recv_from(&mut buf)).await??;\n        let frame = RelayFrame::decode(&buf[..len])?;\n        assert_eq!(frame.target_node_id, target);\n        assert_eq!(frame.encrypted_payload, encrypted);\n        relay_socket\n            .send_to(&frame.encrypted_payload, target_socket.local_addr()?)\n            .await?;\n        let (len, _) = timeout(Duration::from_secs(1), target_socket.recv_from(&mut buf)).await??;\n        assert_eq!(&buf[..len], b\"sealed-ciphertext\");\n        Ok(())\n    }","instruction":"Explain what the Rust test `relay_client_forwards_encrypted_frame` verifies.","output":"The test `relay_client_forwards_encrypted_frame` verifies relay client forwards encrypted frame. It belongs to cp-net and covers domains: general. Observed statuses: none; error codes: none; assertions: 3.","source_test_id":"cp-net::relay_client_forwards_encrypted_frame","task":"behavior_explanation"}49{"id":"cp-net::relay_server_forwards_bidirectional_opaque_payloads::explain_behavior","input":"\n    #[tokio::test]\n    async fn relay_server_forwards_bidirectional_opaque_payloads()\n    -> Result<(), Box<dyn std::error::Error>> {\n        let node_a = NodeId::new(\"node-a\")?;\n        let node_b = NodeId::new(\"node-b\")?;\n        let socket_a = UdpSocket::bind(\"127.0.0.1:0\").await?;\n        let socket_b = UdpSocket::bind(\"127.0.0.1:0\").await?;\n        let mut peers = RelayPeerDirectory::new();\n        peers.upsert(node_a.clone(), socket_a.local_addr()?);\n        peers.upsert(node_b.clone(), socket_b.local_addr()?);\n        let relay = UdpRelayServer::bind(\"127.0.0.1:0\".parse()?, peers).await?;\n        let client_a = RelayClient::new(relay.local_addr()?);\n        let client_b = RelayClient::new(relay.local_addr()?);\n\n        client_a\n            .forward(&socket_a, node_b.clone(), b\"sealed-a-to-b\".to_vec())\n            .await?;\n        let report = timeout(Duration::from_secs(1), relay.forward_one()).await??;\n        assert!(report.forwarded);\n        assert_eq!(report.target_node_id, node_b);\n        assert_eq!(report.payload_bytes, b\"sealed-a-to-b\".len());\n        let mut buf = [0_u8; 512];\n        let (len, _) = timeout(Duration::from_secs(1), socket_b.recv_from(&mut buf)).await??;\n        assert_eq!(&buf[..len], b\"sealed-a-to-b\");\n\n        client_b\n            .forward(&socket_b, node_a.clone(), b\"sealed-b-to-a\".to_vec())\n            .await?;\n        let report = timeout(Duration::from_secs(1), relay.forward_one()).await??;\n        assert!(report.forwarded);\n        assert_eq!(report.target_node_id, node_a);\n        let (len, _) = timeout(Duration::from_secs(1), socket_a.recv_from(&mut buf)).await??;\n        assert_eq!(&buf[..len], b\"sealed-b-to-a\");\n        Ok(())\n    }","instruction":"Explain what the Rust test `relay_server_forwards_bidirectional_opaque_payloads` verifies.","output":"The test `relay_server_forwards_bidirectional_opaque_payloads` verifies relay server forwards bidirectional opaque payloads. It belongs to cp-net and covers domains: general. Observed statuses: none; error codes: none; assertions: 7.","source_test_id":"cp-net::relay_server_forwards_bidirectional_opaque_payloads","task":"behavior_explanation"}50{"id":"cp-observability::correlation_id_is_unique::explain_behavior","input":"\n    #[test]\n    fn correlation_id_is_unique() {\n        let first = CorrelationId::new();\n        let second = CorrelationId::new();\n        assert_ne!(first, second);\n        assert_eq!(first.as_str().len(), 32);\n        assert!(first.as_str().chars().all(|ch| ch.is_ascii_hexdigit()));\n    }","instruction":"Explain what the Rust test `correlation_id_is_unique` verifies.","output":"The test `correlation_id_is_unique` verifies correlation id is unique. It belongs to cp-observability and covers domains: general. Observed statuses: none; error codes: none; assertions: 3.","source_test_id":"cp-observability::correlation_id_is_unique","task":"behavior_explanation"}51{"id":"cp-observability::health_payload_serializes::explain_behavior","input":"\n    #[test]\n    fn health_payload_serializes() -> Result<(), Box<dyn std::error::Error>> {\n        let payload = HealthPayload::new(\n            HealthStatus::Healthy,\n            NodeId::new(\"node-health\")?,\n            42,\n            \"0.1.0\",\n        );\n        let json = serde_json::to_string(&payload)?;\n        assert!(json.contains(\"\\\"status\\\":\\\"healthy\\\"\"));\n        assert!(json.contains(\"\\\"node_id\\\":\\\"node-health\\\"\"));\n        Ok(())\n    }","instruction":"Explain what the Rust test `health_payload_serializes` verifies.","output":"The test `health_payload_serializes` verifies health payload serializes. It belongs to cp-observability and covers domains: general. Observed statuses: none; error codes: none; assertions: 2.","source_test_id":"cp-observability::health_payload_serializes","task":"behavior_explanation"}52{"id":"cp-participant-sdk::capability_route_rejects_unonboarded_provider::explain_behavior","input":"\n    #[test]\n    fn capability_route_rejects_unonboarded_provider() -> Result<()> {\n        let mut ledger = TaskLedger::new();\n        let mut bus = temp_bus(\"unonboarded\")?;\n        let identities = identities()?;\n        let trust = TrustStore::new(0.0)\n            .map_err(|error| ParticipantSdkError::Unauthorized(error.to_string()))?;\n\n        let result = route_capability_via_task_lease(\n            &request()?,\n            &[provider()?],\n            &identities,\n            &trust,\n            &mut ledger,\n            &mut bus,\n            &NodeId::new(\"1\")?,\n        );\n\n        assert!(matches!(result, Err(ParticipantSdkError::Unauthorized(_))));\n        assert!(\n            !bus.records()\n                .iter()\n                .any(|record| record.body.event_type == \"capability.route.dispatched\")\n        );\n        Ok(())\n    }","instruction":"Explain what the Rust test `capability_route_rejects_unonboarded_provider` verifies.","output":"The test `capability_route_rejects_unonboarded_provider` verifies capability route rejects unonboarded provider. It belongs to cp-participant-sdk and covers domains: auth, task, trust, event. Observed statuses: none; error codes: none; assertions: 2.","source_test_id":"cp-participant-sdk::capability_route_rejects_unonboarded_provider","task":"behavior_explanation"}53{"id":"cp-participant-sdk::participant_manifest_validates_clean_input::explain_behavior","input":"\n    #[test]\n    fn participant_manifest_validates_clean_input() -> Result<()> {\n        manifest()?.validate()\n    }","instruction":"Explain what the Rust test `participant_manifest_validates_clean_input` verifies.","output":"The test `participant_manifest_validates_clean_input` verifies participant manifest validates clean input. It belongs to cp-participant-sdk and covers domains: general. Observed statuses: none; error codes: none; assertions: 0.","source_test_id":"cp-participant-sdk::participant_manifest_validates_clean_input","task":"behavior_explanation"}54{"id":"cp-participant-sdk::subscribe_outside_scope_is_rejected::explain_behavior","input":"\n    #[test]\n    fn subscribe_outside_scope_is_rejected() -> Result<()> {\n        let policy = CompiledParticipantPolicy::compile(&manifest()?)?;\n        let check = policy_check(\n            \"tool.private\",\n            \"tool\",\n            Some(SubscriptionTier::BroadAwareness),\n        )?;\n        let denial = policy\n            .check_subscribe(&check)\n            .err()\n            .ok_or_else(|| ParticipantSdkError::Unauthorized(\"subscribe should deny\".to_owned()))?;\n        assert_eq!(denial.reason, \"subscribe outside compiled policy\");\n        Ok(())\n    }","instruction":"Explain what the Rust test `subscribe_outside_scope_is_rejected` verifies.","output":"The test `subscribe_outside_scope_is_rejected` verifies subscribe outside scope is rejected. It belongs to cp-participant-sdk and covers domains: auth. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-participant-sdk::subscribe_outside_scope_is_rejected","task":"behavior_explanation"}55{"id":"cp-participant-sdk::claim_verification_approves_matching_capability::explain_behavior","input":"\n    #[test]\n    fn claim_verification_approves_matching_capability() -> Result<()> {\n        let mut identities = AgentIdentityStore::new();\n        verify_capability_claim(&mut identities, AgentId::new(\"worker-a\")?, \"tool\", 1)?;\n        assert!(identities.record(&AgentId::new(\"worker-a\")?).is_some());\n        Ok(())\n    }","instruction":"Explain what the Rust test `claim_verification_approves_matching_capability` verifies.","output":"The test `claim_verification_approves_matching_capability` verifies claim verification approves matching capability. It belongs to cp-participant-sdk and covers domains: agent. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-participant-sdk::claim_verification_approves_matching_capability","task":"behavior_explanation"}56{"id":"cp-participant-sdk::onboarded_agent_runtime_slice_leases_focuses_and_completes_verified::explain_behavior","input":"\n    #[test]\n    fn onboarded_agent_runtime_slice_leases_focuses_and_completes_verified() -> Result<()> {\n        let (node, org, workspace) = ids()?;\n        let mut bus = temp_bus(\"runtime-slice\")?;\n        let mut agent_manifest = manifest()?;\n        agent_manifest.participant_kind = ParticipantKind::Agent;\n        ParticipantRegistration::register(&agent_manifest, &mut bus, &node, &org, &workspace)?;\n\n        let mut ledger = TaskLedger::new();\n        let task_id = TaskId::new(\"task-a\")?;\n        ledger.create(TaskCreateRequest::new(\n            task_id.clone(),\n            AgentId::new(\"creator\")?,\n            [\"tool\"],\n            [\"docs\"],\n            ModelTier::Tier3B,\n            1,\n        )?)?;\n\n        let lease = request_task_lease(\n            &TaskLeaseRequest {\n                task_id: task_id.clone(),\n                worker_id: ProfileId::new(\"worker-a\")?,\n                node_id: node.clone(),\n                lease_ttl_ms: 30_000,\n            },\n            &mut ledger,\n            &mut bus,\n            &node,\n        )?;\n        assert!(\n            bus.records()\n                .iter()\n                .any(|record| record.body.event_type == \"participant.task_lease.claimed\")\n        );\n\n        append_context_event(\n            &mut bus,\n            &node,\n            \"context.write.recorded\",\n            \"task.task-a.context\",\n            json!({\n                \"task_id\": \"task-a\",\n                \"tenant_id\": \"tenant-a\",\n                \"workflow_id\": \"workflow-a\",\n                \"workflow_run_id\": \"run-a\",\n                \"semantic_similarity\": 0.91,\n                \"secret\": \"focused-detail-visible\"\n            }),\n        )?;\n\n        let leased_task = ledger\n            .record(&task_id)\n            .ok_or_else(|| ParticipantSdkError::Unauthorized(\"missing leased task\".to_owned()))?\n            .clone();\n        assert_eq!(leased_task.status, TaskStatus::Claimed);\n        let lease_created_at = leased_task\n            .lease\n            .as_ref()\n            .ok_or_else(|| ParticipantSdkError::Unauthorized(\"missing task lease\".to_owned()))?\n            .created_at_unix_ms;\n        let aperture = ContextAperture::from_task_state(TaskStateContextSubscriptionRequest {\n            agent_id: AgentId::new(\"worker-a\")?,\n            task: Some(leased_task),\n            tenant_id: Some(cp_core::TenantId::new(\"tenant-a\")?),\n            workflow_id: Some(WorkflowId::new(\"workflow-a\")?),\n            workflow_run_id: Some(\"run-a\".to_owned()),\n            domain: Some(\"docs\".to_owned()),\n            node_id: Some(node.clone()),\n            peripheral_event_types: BTreeSet::from([EventType::new(\"context.write.recorded\")?]),\n            max_peripheral_events: 64,\n            semantic_recall: true,\n            max_focused_context_bytes: 64 * 1024,\n            trust_score: 0.90,\n            authority_level: AuthorityScopeLevel::SuggestedWrite,\n            now_unix_ms: lease_created_at,\n        })\n        .map_err(|error| ParticipantSdkError::Unauthorized(error.to_string()))?;\n        assert!(aperture.focused.is_some());\n\n        let mut subscription =\n            EventSubscription::focused([EventType::new(\"context.write.recorded\")?], \"task.task-a\")?;\n        let context = subscription.poll_context(&bus, &aperture, 16);\n        let focused = context\n            .iter()\n            .find(|record| record.event_type == \"context.write.recorded\")\n            .ok_or_else(|| {\n                ParticipantSdkError::Unauthorized(\"missing focused context\".to_owned())\n            })?;\n        assert_eq!(focused.tier, ApertureRelevanceTier::FocusedDetail);\n        assert_eq!(\n            focused\n                .payload\n                .as_ref()\n                .and_then(|payload| payload.get(\"secret\")),\n            Some(&json!(\"focused-detail-visible\"))\n        );\n\n        let evidence = TaskCompletionEvidence {\n            risk_class: TaskRiskClass::Medium,\n            verification_outcome: VerificationOutcome::Passed,\n            verifier_agent_id: Some(AgentId::new(\"code-verifier\")?),\n        };\n        complete_verified_task(\n            &TaskCompletionRequest {\n                task_id: task_id.clone(),\n                worker_id: ProfileId::new(\"worker-a\")?,\n                lease_token: lease.token,\n                evidence,\n                completed_at_unix_ms: lease_created_at + 1,\n            },\n            &mut ledger,\n            &mut bus,\n            &node,\n        )?;\n        assert_eq!(\n            ledger\n                .record(&task_id)\n                .ok_or_else(|| ParticipantSdkError::Unauthorized(\"missing task\".to_owned()))?\n                .status,\n            TaskStatus::Completed\n        );\n        assert!(\n            bus.records()\n                .iter()\n                .any(|record| record.body.event_type == \"participant.task_completion.accepted\")\n        );\n        Ok(())\n    }","instruction":"Explain what the Rust test `onboarded_agent_runtime_slice_leases_focuses_and_completes_verified` verifies.","output":"The test `onboarded_agent_runtime_slice_leases_focuses_and_completes_verified` verifies onboarded agent runtime slice leases focuses and completes verified. It belongs to cp-participant-sdk and covers domains: auth, workflow, task, trust, event, agent, tenant. Observed statuses: none; error codes: none; assertions: 7.","source_test_id":"cp-participant-sdk::onboarded_agent_runtime_slice_leases_focuses_and_completes_verified","task":"behavior_explanation"}57{"id":"cp-participant-sdk::verified_completion_denies_missing_verifier_and_records_denial::explain_behavior","input":"\n    #[test]\n    fn verified_completion_denies_missing_verifier_and_records_denial() -> Result<()> {\n        let (node, org, workspace) = ids()?;\n        let mut bus = temp_bus(\"completion-denied\")?;\n        let mut agent_manifest = manifest()?;\n        agent_manifest.participant_kind = ParticipantKind::Agent;\n        ParticipantRegistration::register(&agent_manifest, &mut bus, &node, &org, &workspace)?;\n\n        let mut ledger = TaskLedger::new();\n        let task_id = TaskId::new(\"task-a\")?;\n        ledger.create(TaskCreateRequest::new(\n            task_id.clone(),\n            AgentId::new(\"creator\")?,\n            [\"tool\"],\n            [\"docs\"],\n            ModelTier::Tier3B,\n            1,\n        )?)?;\n        let lease = request_task_lease(\n            &TaskLeaseRequest {\n                task_id: task_id.clone(),\n                worker_id: ProfileId::new(\"worker-a\")?,\n                node_id: node.clone(),\n                lease_ttl_ms: 30_000,\n            },\n            &mut ledger,\n            &mut bus,\n            &node,\n        )?;\n        let lease_created_at = ledger\n            .record(&task_id)\n            .and_then(|task| task.lease.as_ref())\n            .map(|lease| lease.created_at_unix_ms)\n            .ok_or_else(|| ParticipantSdkError::Unauthorized(\"missing task lease\".to_owned()))?;\n\n        let result = complete_verified_task(\n            &TaskCompletionRequest {\n                task_id: task_id.clone(),\n                worker_id: ProfileId::new(\"worker-a\")?,\n                lease_token: lease.token,\n                evidence: TaskCompletionEvidence {\n                    risk_class: TaskRiskClass::Medium,\n                    verification_outcome: VerificationOutcome::Passed,\n                    verifier_agent_id: None,\n                },\n                completed_at_unix_ms: lease_created_at + 1,\n            },\n            &mut ledger,\n            &mut bus,\n            &node,\n        );\n\n        assert!(matches!(result, Err(ParticipantSdkError::Task(_))));\n        assert_eq!(\n            ledger\n                .record(&task_id)\n                .ok_or_else(|| ParticipantSdkError::Unauthorized(\"missing task\".to_owned()))?\n                .status,\n            TaskStatus::Claimed\n        );\n        assert!(\n            bus.records()\n                .iter()\n                .any(|record| record.body.event_type == \"participant.task_completion.denied\")\n        );\n        assert!(\n            !bus.records()\n                .iter()\n                .any(|record| record.body.event_type == \"participant.task_completion.accepted\")\n        );\n        Ok(())\n    }","instruction":"Explain what the Rust test `verified_completion_denies_missing_verifier_and_records_denial` verifies.","output":"The test `verified_completion_denies_missing_verifier_and_records_denial` verifies verified completion denies missing verifier and records denial. It belongs to cp-participant-sdk and covers domains: auth, task, event, agent. Observed statuses: none; error codes: none; assertions: 4.","source_test_id":"cp-participant-sdk::verified_completion_denies_missing_verifier_and_records_denial","task":"behavior_explanation"}58{"id":"cp-participant-sdk::plugin_node_unregister_removes_from_palette::explain_behavior","input":"\n    #[test]\n    fn plugin_node_unregister_removes_from_palette() -> Result<()> {\n        let (node, _, _) = ids()?;\n        let mut bus = temp_bus(\"unregister\")?;\n        PluginNodeRegistration::unregister(&ProfileId::new(\"plugin-uppercase\")?, &mut bus, &node)?;\n        assert!(\n            bus.records()\n                .iter()\n                .any(|r| r.body.event_type == \"plugin_node.unregistered\")\n        );\n        Ok(())\n    }","instruction":"Explain what the Rust test `plugin_node_unregister_removes_from_palette` verifies.","output":"The test `plugin_node_unregister_removes_from_palette` verifies plugin node unregister removes from palette. It belongs to cp-participant-sdk and covers domains: plugin, event. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-participant-sdk::plugin_node_unregister_removes_from_palette","task":"behavior_explanation"}59{"id":"cp-participant-sdk::task_state_subscription_focuses_only_for_live_claimed_lease::explain_behavior","input":"\n    #[test]\n    fn task_state_subscription_focuses_only_for_live_claimed_lease() -> Result<()> {\n        let subscription = EventSubscription::for_task_state(\n            [EventType::new(\"context.write.recorded\")?],\n            Some(TaskStatus::Claimed),\n            true,\n            Some(\"task.task-a\"),\n        )?;\n\n        assert_eq!(subscription.tier(), &SubscriptionTier::DeepRelevance);\n        assert!(subscription.has_authorized_scope());\n        Ok(())\n    }","instruction":"Explain what the Rust test `task_state_subscription_focuses_only_for_live_claimed_lease` verifies.","output":"The test `task_state_subscription_focuses_only_for_live_claimed_lease` verifies task state subscription focuses only for live claimed lease. It belongs to cp-participant-sdk and covers domains: auth, task, event. Observed statuses: none; error codes: none; assertions: 2.","source_test_id":"cp-participant-sdk::task_state_subscription_focuses_only_for_live_claimed_lease","task":"behavior_explanation"}60{"id":"cp-participant-sdk::task_state_subscription_closes_focus_after_completion::explain_behavior","input":"\n    #[test]\n    fn task_state_subscription_closes_focus_after_completion() -> Result<()> {\n        let subscription = EventSubscription::for_task_state(\n            [EventType::new(\"task.assigned\")?],\n            Some(TaskStatus::Completed),\n            true,\n            Some(\"task.task-a\"),\n        )?;\n\n        assert_eq!(subscription.tier(), &SubscriptionTier::BroadAwareness);\n        assert!(!subscription.has_authorized_scope());\n        Ok(())\n    }","instruction":"Explain what the Rust test `task_state_subscription_closes_focus_after_completion` verifies.","output":"The test `task_state_subscription_closes_focus_after_completion` verifies task state subscription closes focus after completion. It belongs to cp-participant-sdk and covers domains: auth, task, event. Observed statuses: none; error codes: none; assertions: 2.","source_test_id":"cp-participant-sdk::task_state_subscription_closes_focus_after_completion","task":"behavior_explanation"}61{"id":"cp-participant-sdk::poll_context_hides_payload_for_peripheral_summary::explain_behavior","input":"\n    #[test]\n    fn poll_context_hides_payload_for_peripheral_summary() -> Result<()> {\n        let mut bus = temp_bus(\"peripheral\")?;\n        append_event(\n            &mut bus,\n            \"task.assigned\",\n            \"task.assigned\",\n            json!({\"secret\": \"hidden\"}),\n        )?;\n        let mut subscription =\n            EventSubscription::peripheral_summaries([EventType::new(\"task.assigned\")?]);\n\n        let aperture = aperture().map_err(|error| {\n            ParticipantSdkError::Unauthorized(format!(\"invalid aperture: {error}\"))\n        })?;\n        let records = subscription.poll_context(&bus, &aperture, 10);\n\n        assert_eq!(records.len(), 1);\n        assert_eq!(records[0].tier, ApertureRelevanceTier::PeripheralSummary);\n        assert!(!records[0].include_payload);\n        assert_eq!(records[0].payload, None);\n        Ok(())\n    }","instruction":"Explain what the Rust test `poll_context_hides_payload_for_peripheral_summary` verifies.","output":"The test `poll_context_hides_payload_for_peripheral_summary` verifies poll context hides payload for peripheral summary. It belongs to cp-participant-sdk and covers domains: auth, task, event. Observed statuses: none; error codes: none; assertions: 4.","source_test_id":"cp-participant-sdk::poll_context_hides_payload_for_peripheral_summary","task":"behavior_explanation"}62{"id":"cp-participant-sdk::poll_context_includes_payload_for_focused_detail::explain_behavior","input":"\n    #[test]\n    fn poll_context_includes_payload_for_focused_detail() -> Result<()> {\n        let mut bus = temp_bus(\"focused\")?;\n        onboard_agent(&mut bus)?;\n        append_event(\n            &mut bus,\n            \"context.write.recorded\",\n            \"context.write.recorded\",\n            json!({\n                \"task_id\": \"task-a\",\n                \"tenant_id\": \"tenant-a\",\n                \"workflow_id\": \"workflow-a\",\n                \"workflow_run_id\": \"run-a\",\n                \"semantic_similarity\": 0.88,\n                \"secret\": \"visible\"\n            }),\n        )?;\n        let mut subscription =\n            EventSubscription::focused([EventType::new(\"context.write.recorded\")?], \"task.task-a\")?;\n\n        let aperture = aperture().map_err(|error| {\n            ParticipantSdkError::Unauthorized(format!(\"invalid aperture: {error}\"))\n        })?;\n        let records = subscription.poll_context(&bus, &aperture, 10);\n\n        assert_eq!(records.len(), 1);\n        assert_eq!(records[0].tier, ApertureRelevanceTier::FocusedDetail);\n        assert!(records[0].include_payload);\n        assert_eq!(\n            records[0]\n                .payload\n                .as_ref()\n                .and_then(|payload| payload.get(\"secret\")),\n            Some(&json!(\"visible\"))\n        );\n        Ok(())\n    }","instruction":"Explain what the Rust test `poll_context_includes_payload_for_focused_detail` verifies.","output":"The test `poll_context_includes_payload_for_focused_detail` verifies poll context includes payload for focused detail. It belongs to cp-participant-sdk and covers domains: auth, workflow, task, event, agent, tenant. Observed statuses: none; error codes: none; assertions: 4.","source_test_id":"cp-participant-sdk::poll_context_includes_payload_for_focused_detail","task":"behavior_explanation"}63{"id":"cp-services::rejects_secret_metadata::explain_behavior","input":"\n    #[test]\n    fn rejects_secret_metadata() -> Result<(), Box<dyn std::error::Error>> {\n        let mut registry = Apothecary::new();\n        let mut input = provider_input()?;\n        input.metadata = json!({\"api_key\": \"do-not-store\"});\n\n        assert_eq!(\n            registry.register_provider(input),\n            Err(ApothecaryError::SecretMaterialRejected)\n        );\n        Ok(())\n    }","instruction":"Explain what the Rust test `rejects_secret_metadata` verifies.","output":"The test `rejects_secret_metadata` verifies rejects secret metadata. It belongs to cp-services and covers domains: general. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-services::rejects_secret_metadata","task":"behavior_explanation"}64{"id":"cp-services::rejects_missing_citation_source::explain_behavior","input":"\n    #[test]\n    fn rejects_missing_citation_source() -> Result<(), Box<dyn std::error::Error>> {\n        let mut chronicle = Chronicle::new();\n        let mut input = input()?;\n        input.sections = vec![section(\"missing-event\")?];\n\n        assert_eq!(\n            chronicle.generate(input),\n            Err(ChronicleError::MissingCitationSource)\n        );\n        Ok(())\n    }","instruction":"Explain what the Rust test `rejects_missing_citation_source` verifies.","output":"The test `rejects_missing_citation_source` verifies rejects missing citation source. It belongs to cp-services and covers domains: event. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-services::rejects_missing_citation_source","task":"behavior_explanation"}65{"id":"cp-services::invalid_evidence_hash_is_rejected::explain_behavior","input":"\n    #[test]\n    fn invalid_evidence_hash_is_rejected() -> Result<(), Box<dyn std::error::Error>> {\n        let mut echo = Echo::new();\n        let mut input = grade_input(\"out-a\", 8_000)?;\n        input.evidence_hash = \"bad\".to_string();\n\n        assert_eq!(\n            echo.grade_output(input),\n            Err(EchoError::InvalidEvidenceHash)\n        );\n        Ok(())\n    }","instruction":"Explain what the Rust test `invalid_evidence_hash_is_rejected` verifies.","output":"The test `invalid_evidence_hash_is_rejected` verifies invalid evidence hash is rejected. It belongs to cp-services and covers domains: general. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-services::invalid_evidence_hash_is_rejected","task":"behavior_explanation"}66{"id":"cp-transport::admission_store_revokes_without_deleting_record::explain_behavior","input":"\n    #[test]\n    fn admission_store_revokes_without_deleting_record() -> Result<(), Box<dyn std::error::Error>> {\n        let root = temp_dir(\"revoke\");\n        let mut store = TransportAdmissionStore::open(&root, NodeId::new(\"node-a\")?)?;\n        store.upsert(admission(\"node-b\")?)?;\n\n        store.revoke(&NodeId::new(\"node-b\")?)?;\n        let reopened = TransportAdmissionStore::open(&root, NodeId::new(\"node-a\")?)?;\n\n        assert_eq!(reopened.admissions().len(), 1);\n        assert!(reopened.admissions()[0].revoked);\n        assert!(matches!(\n            reopened.admit(\n                &NodeId::new(\"node-b\")?,\n                &TransportKeyId::new(\"mesh-key-1\")?,\n                200\n            ),\n            Err(TransportAdmissionStoreError::Admission(\n                AdmissionError::Revoked(_)\n            ))\n        ));\n\n        fs::remove_dir_all(root)?;\n        Ok(())\n    }","instruction":"Explain what the Rust test `admission_store_revokes_without_deleting_record` verifies.","output":"The test `admission_store_revokes_without_deleting_record` verifies admission store revokes without deleting record. It belongs to cp-transport and covers domains: transport. Observed statuses: none; error codes: none; assertions: 3.","source_test_id":"cp-transport::admission_store_revokes_without_deleting_record","task":"behavior_explanation"}67{"id":"cp-transport::admission_store_rejects_self_admission::explain_behavior","input":"\n    #[test]\n    fn admission_store_rejects_self_admission() -> Result<(), Box<dyn std::error::Error>> {\n        let root = temp_dir(\"self\");\n        let mut store = TransportAdmissionStore::open(&root, NodeId::new(\"node-a\")?)?;\n\n        assert!(matches!(\n            store.upsert(admission(\"node-a\")?),\n            Err(TransportAdmissionStoreError::SelfAdmission)\n        ));\n\n        fs::remove_dir_all(root)?;\n        Ok(())\n    }","instruction":"Explain what the Rust test `admission_store_rejects_self_admission` verifies.","output":"The test `admission_store_rejects_self_admission` verifies admission store rejects self admission. It belongs to cp-transport and covers domains: transport. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-transport::admission_store_rejects_self_admission","task":"behavior_explanation"}68{"id":"cp-transport::aead_rejects_all_zero_key::explain_behavior","input":"\n    #[test]\n    fn aead_rejects_all_zero_key() {\n        assert_eq!(\n            AeadKeyMaterial::from_bytes([0; 32]),\n            Err(CryptoError::WeakKeyMaterial)\n        );\n    }","instruction":"Explain what the Rust test `aead_rejects_all_zero_key` verifies.","output":"The test `aead_rejects_all_zero_key` verifies aead rejects all zero key. It belongs to cp-transport and covers domains: transport. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-transport::aead_rejects_all_zero_key","task":"behavior_explanation"}69{"id":"cp-transport::directory_opens_negotiated_link_for_admitted_peer::explain_behavior","input":"\n    #[test]\n    fn directory_opens_negotiated_link_for_admitted_peer() -> Result<(), Box<dyn std::error::Error>>\n    {\n        let root = temp_dir(\"negotiated\");\n        let local_key_pair = key_pair_a()?;\n        let peer_key_pair = key_pair_b()?;\n        let mut directory = TransportPeerDirectory::open(&root, NodeId::new(\"node-a\")?)?;\n        directory.enroll_peer(admission_with_key(\"node-b\", &peer_key_pair)?)?;\n\n        let opened = directory.open_negotiated_link(session_request(\"node-b\", &local_key_pair)?)?;\n\n        assert_eq!(opened.admission.node_id, NodeId::new(\"node-b\")?);\n        assert_eq!(opened.link.peer_node_id(), &NodeId::new(\"node-b\")?);\n        assert_eq!(\n            opened.negotiated_session.peer.node_id,\n            NodeId::new(\"node-b\")?\n        );\n        assert_eq!(\n            opened.negotiated_session.selected_endpoint.value,\n            \"udp://10.0.0.2:7400\"\n        );\n\n        fs::remove_dir_all(root)?;\n        Ok(())\n    }","instruction":"Explain what the Rust test `directory_opens_negotiated_link_for_admitted_peer` verifies.","output":"The test `directory_opens_negotiated_link_for_admitted_peer` verifies directory opens negotiated link for admitted peer. It belongs to cp-transport and covers domains: transport. Observed statuses: none; error codes: none; assertions: 4.","source_test_id":"cp-transport::directory_opens_negotiated_link_for_admitted_peer","task":"behavior_explanation"}70{"id":"cp-transport::directory_rejects_negotiation_for_revoked_peer::explain_behavior","input":"\n    #[test]\n    fn directory_rejects_negotiation_for_revoked_peer() -> Result<(), Box<dyn std::error::Error>> {\n        let root = temp_dir(\"negotiated-revoked\");\n        let local_key_pair = key_pair_a()?;\n        let mut directory = TransportPeerDirectory::open(&root, NodeId::new(\"node-a\")?)?;\n        directory.enroll_peer(admission(\"node-b\")?)?;\n        directory.revoke_peer(&NodeId::new(\"node-b\")?)?;\n\n        assert!(matches!(\n            directory.open_negotiated_link(session_request(\"node-b\", &local_key_pair)?),\n            Err(TransportPeerDirectoryError::AdmissionStore(\n                TransportAdmissionStoreError::Admission(AdmissionError::Revoked(_))\n            ))\n        ));\n\n        fs::remove_dir_all(root)?;\n        Ok(())\n    }","instruction":"Explain what the Rust test `directory_rejects_negotiation_for_revoked_peer` verifies.","output":"The test `directory_rejects_negotiation_for_revoked_peer` verifies directory rejects negotiation for revoked peer. It belongs to cp-transport and covers domains: transport. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-transport::directory_rejects_negotiation_for_revoked_peer","task":"behavior_explanation"}71{"id":"cp-transport::directory_rejects_negotiation_with_wrong_peer_key_id::explain_behavior","input":"\n    #[test]\n    fn directory_rejects_negotiation_with_wrong_peer_key_id()\n    -> Result<(), Box<dyn std::error::Error>> {\n        let root = temp_dir(\"negotiated-wrong-key\");\n        let local_key_pair = key_pair_a()?;\n        let mut directory = TransportPeerDirectory::open(&root, NodeId::new(\"node-a\")?)?;\n        directory.enroll_peer(admission(\"node-b\")?)?;\n        let mut request = session_request(\"node-b\", &local_key_pair)?;\n        request.expected_peer_key_id = TransportKeyId::new(\"mesh-key-2\")?;\n\n        assert!(matches!(\n            directory.open_negotiated_link(request),\n            Err(TransportPeerDirectoryError::AdmissionStore(\n                TransportAdmissionStoreError::Admission(AdmissionError::KeyIdMismatch { .. })\n            ))\n        ));\n\n        fs::remove_dir_all(root)?;\n        Ok(())\n    }","instruction":"Explain what the Rust test `directory_rejects_negotiation_with_wrong_peer_key_id` verifies.","output":"The test `directory_rejects_negotiation_with_wrong_peer_key_id` verifies directory rejects negotiation with wrong peer key id. It belongs to cp-transport and covers domains: transport. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-transport::directory_rejects_negotiation_with_wrong_peer_key_id","task":"behavior_explanation"}72{"id":"cp-transport::negotiated_link_does_not_ack_inbound_before_processing::explain_behavior","input":"\n    #[test]\n    fn negotiated_link_does_not_ack_inbound_before_processing()\n    -> Result<(), Box<dyn std::error::Error>> {\n        let root_a = temp_dir(\"negotiated-link-pending-a\");\n        let root_b = temp_dir(\"negotiated-link-pending-b\");\n        let key_a = key_pair_a()?;\n        let key_b = key_pair_b()?;\n        let mut directory_a = TransportPeerDirectory::open(&root_a, NodeId::new(\"node-a\")?)?;\n        let mut directory_b = TransportPeerDirectory::open(&root_b, NodeId::new(\"node-b\")?)?;\n        directory_a.enroll_peer(admission_with_key(\"node-b\", &key_b)?)?;\n        directory_b.enroll_peer(admission_with_key(\"node-a\", &key_a)?)?;\n        let mut link_a = directory_a.open_negotiated_link(session_request(\"node-b\", &key_a)?)?;\n        let mut link_b = directory_b.open_negotiated_link(session_request_with_role(\n            TransportNegotiationRole::Responder,\n            \"node-a\",\n            &key_b,\n            [2; 32],\n            [1; 32],\n        )?)?;\n\n        link_a.queue_payload(FrameKind::Data, None, b\"pending\".to_vec())?;\n        let outbound = link_a.deliver_outbound_packets(1)?;\n        link_b.accept_inbound_packets(outbound.iter().map(|record| record.packet.clone()))?;\n        let opened = link_b.open_inbound_frames(1)?;\n\n        assert_eq!(opened[0].frame.payload, b\"pending\");\n        assert_eq!(link_b.status().inbound_unacked, 1);\n        assert!(link_b.ack_inbound(opened[0].spool_sequence)?);\n        assert_eq!(link_b.status().inbound_unacked, 0);\n\n        fs::remove_dir_all(root_a)?;\n        fs::remove_dir_all(root_b)?;\n        Ok(())\n    }","instruction":"Explain what the Rust test `negotiated_link_does_not_ack_inbound_before_processing` verifies.","output":"The test `negotiated_link_does_not_ack_inbound_before_processing` verifies negotiated link does not ack inbound before processing. It belongs to cp-transport and covers domains: transport. Observed statuses: none; error codes: none; assertions: 4.","source_test_id":"cp-transport::negotiated_link_does_not_ack_inbound_before_processing","task":"behavior_explanation"}73{"id":"cp-transport::negotiated_link_journals_rejected_batch::explain_behavior","input":"\n    #[test]\n    fn negotiated_link_journals_rejected_batch() -> Result<(), Box<dyn std::error::Error>> {\n        let root_a = temp_dir(\"journaled-reject-a\");\n        let root_b = temp_dir(\"journaled-reject-b\");\n        let journal_b_path = root_b.join(\"handoff-b.jsonl\");\n        let key_a = key_pair_a()?;\n        let key_b = key_pair_b()?;\n        let mut directory_a = TransportPeerDirectory::open(&root_a, NodeId::new(\"node-a\")?)?;\n        let mut directory_b = TransportPeerDirectory::open(&root_b, NodeId::new(\"node-b\")?)?;\n        directory_a.enroll_peer(admission_with_key(\"node-b\", &key_b)?)?;\n        directory_b.enroll_peer(admission_with_key(\"node-a\", &key_a)?)?;\n        let mut link_a = directory_a.open_negotiated_link(session_request(\"node-b\", &key_a)?)?;\n        let mut link_b = directory_b.open_negotiated_link(session_request_with_role(\n            TransportNegotiationRole::Responder,\n            \"node-a\",\n            &key_b,\n            [2; 32],\n            [1; 32],\n        )?)?;\n        let mut journal_b = TransportPacketHandoffJournal::open(&journal_b_path)?;\n\n        link_a.queue_payload(FrameKind::Data, None, b\"reject\".to_vec())?;\n        let mut batch = link_a.prepare_egress_batch(1)?;\n        batch.target_node_id = NodeId::new(\"node-c\")?;\n\n        assert!(matches!(\n            link_b.accept_journaled_egress_batch(&batch, &mut journal_b),\n            Err(TransportPeerNegotiatedLinkError::BatchPeerMismatch { .. })\n        ));\n        assert_eq!(journal_b.records().len(), 1);\n        assert_eq!(\n            journal_b.records()[0].kind,\n            TransportPacketHandoffKind::Rejected\n        );\n        assert_eq!(link_b.status().inbound_unacked, 0);\n\n        fs::remove_dir_all(root_a)?;\n        fs::remove_dir_all(root_b)?;\n        Ok(())\n    }","instruction":"Explain what the Rust test `negotiated_link_journals_rejected_batch` verifies.","output":"The test `negotiated_link_journals_rejected_batch` verifies negotiated link journals rejected batch. It belongs to cp-transport and covers domains: transport. Observed statuses: none; error codes: none; assertions: 4.","source_test_id":"cp-transport::negotiated_link_journals_rejected_batch","task":"behavior_explanation"}74{"id":"cp-transport::inbox_rejects_wrong_direction_packet::explain_behavior","input":"\n    #[test]\n    fn inbox_rejects_wrong_direction_packet() -> Result<(), Box<dyn std::error::Error>> {\n        let root = temp_dir(\"wrong-direction\");\n        let mut inbox =\n            TransportPeerInbox::open(&root, NodeId::new(\"node-a\")?, NodeId::new(\"node-b\")?)?;\n\n        assert!(matches!(\n            inbox.accept_packet(outbound_packet()?),\n            Err(TransportPeerInboxError::SourceNodeMismatch { .. })\n        ));\n        assert!(inbox.is_empty());\n\n        fs::remove_dir_all(root)?;\n        Ok(())\n    }","instruction":"Explain what the Rust test `inbox_rejects_wrong_direction_packet` verifies.","output":"The test `inbox_rejects_wrong_direction_packet` verifies inbox rejects wrong direction packet. It belongs to cp-transport and covers domains: transport. Observed statuses: none; error codes: none; assertions: 2.","source_test_id":"cp-transport::inbox_rejects_wrong_direction_packet","task":"behavior_explanation"}75{"id":"cp-transport::key_exchange_secret_feeds_transport_sessions::explain_behavior","input":"\n    #[test]\n    fn key_exchange_secret_feeds_transport_sessions() -> Result<(), Box<dyn std::error::Error>> {\n        let a = key_pair_a()?;\n        let b = key_pair_b()?;\n        let secret = derive_handshake_secret(&a.private_key, &a.public_key, &b.public_key)?;\n        let initiator = TransportHandshakeOffer::new(\n            NodeId::new(\"node-a\")?,\n            NodeId::new(\"node-b\")?,\n            TransportKeyId::new(\"mesh-key-1\")?,\n            HandshakeNonce::from_bytes([1; 32])?,\n        )?;\n        let responder = TransportHandshakeOffer::new(\n            NodeId::new(\"node-b\")?,\n            NodeId::new(\"node-a\")?,\n            TransportKeyId::new(\"mesh-key-1\")?,\n            HandshakeNonce::from_bytes([2; 32])?,\n        )?;\n        let (mut session_a, mut session_b) =\n            derive_transport_sessions(&initiator, &responder, &secret)?;\n\n        let sealed = session_a.seal_payload(FrameKind::Data, None, b\"payload\".to_vec())?;\n        let opened = session_b.open_frame(&sealed)?;\n\n        assert_eq!(opened.payload, b\"payload\");\n        Ok(())\n    }","instruction":"Explain what the Rust test `key_exchange_secret_feeds_transport_sessions` verifies.","output":"The test `key_exchange_secret_feeds_transport_sessions` verifies key exchange secret feeds transport sessions. It belongs to cp-transport and covers domains: transport. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-transport::key_exchange_secret_feeds_transport_sessions","task":"behavior_explanation"}76{"id":"cp-transport::key_exchange_rejects_weak_keys::explain_behavior","input":"\n    #[test]\n    fn key_exchange_rejects_weak_keys() {\n        assert_eq!(\n            TransportPrivateKey::from_bytes([0; 32]),\n            Err(KeyExchangeError::WeakPrivateKey)\n        );\n        assert_eq!(\n            TransportPublicKey::from_bytes([0; 32]),\n            Err(KeyExchangeError::WeakPublicKey)\n        );\n    }","instruction":"Explain what the Rust test `key_exchange_rejects_weak_keys` verifies.","output":"The test `key_exchange_rejects_weak_keys` verifies key exchange rejects weak keys. It belongs to cp-transport and covers domains: transport. Observed statuses: none; error codes: none; assertions: 2.","source_test_id":"cp-transport::key_exchange_rejects_weak_keys","task":"behavior_explanation"}77{"id":"cp-transport::revoked_peer_is_rejected::explain_behavior","input":"\n    #[test]\n    fn revoked_peer_is_rejected() -> Result<(), Box<dyn std::error::Error>> {\n        let a = profile(\"a\")?;\n        let b = profile(\"b\")?.revoked();\n        let policy = ConnectionPolicy::local_only(a.node_id.clone());\n        let err = match LoopbackTransport::connect(a, b.clone(), &policy) {\n            Ok(_) => return Err(\"revoked peer should be rejected\".into()),\n            Err(err) => err,\n        };\n        assert_eq!(\n            err,\n            LoopbackError::Rejected(ConnectionRejection::PeerRevoked(b.node_id))\n        );\n        Ok(())\n    }","instruction":"Explain what the Rust test `revoked_peer_is_rejected` verifies.","output":"The test `revoked_peer_is_rejected` verifies revoked peer is rejected. It belongs to cp-transport and covers domains: transport. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-transport::revoked_peer_is_rejected","task":"behavior_explanation"}78{"id":"cp-transport::negotiation_builds_matching_sessions::explain_behavior","input":"\n    #[test]\n    fn negotiation_builds_matching_sessions() -> Result<(), Box<dyn std::error::Error>> {\n        let key_a = key_pair_a()?;\n        let key_b = key_pair_b()?;\n        let book_a = admission_book_for(\"node-b\", \"mesh-key-1\", &key_b)?;\n        let book_b = admission_book_for(\"node-a\", \"mesh-key-1\", &key_a)?;\n        let nonce_a = HandshakeNonce::from_bytes([1; 32])?;\n        let nonce_b = HandshakeNonce::from_bytes([2; 32])?;\n        let mut negotiated_a = negotiate_transport_session(TransportNegotiationRequest {\n            role: TransportNegotiationRole::Initiator,\n            local_node_id: NodeId::new(\"node-a\")?,\n            local_transport_key_id: TransportKeyId::new(\"mesh-key-1\")?,\n            local_key_pair: &key_a,\n            admissions: &book_a,\n            peer_node_id: NodeId::new(\"node-b\")?,\n            expected_peer_key_id: TransportKeyId::new(\"mesh-key-1\")?,\n            local_nonce: nonce_a,\n            peer_nonce: nonce_b,\n            now_ms: 200,\n            allow_relay: true,\n            allow_loopback: false,\n        })?;\n        let mut negotiated_b = negotiate_transport_session(TransportNegotiationRequest {\n            role: TransportNegotiationRole::Responder,\n            local_node_id: NodeId::new(\"node-b\")?,\n            local_transport_key_id: TransportKeyId::new(\"mesh-key-1\")?,\n            local_key_pair: &key_b,\n            admissions: &book_b,\n            peer_node_id: NodeId::new(\"node-a\")?,\n            expected_peer_key_id: TransportKeyId::new(\"mesh-key-1\")?,\n            local_nonce: nonce_b,\n            peer_nonce: nonce_a,\n            now_ms: 200,\n            allow_relay: true,\n            allow_loopback: false,\n        })?;\n\n        let sealed =\n            negotiated_a\n                .session\n                .seal_payload(FrameKind::Data, None, b\"payload\".to_vec())?;\n        let opened = negotiated_b.session.open_frame(&sealed)?;\n\n        assert_eq!(opened.payload, b\"payload\");\n        assert_eq!(negotiated_a.selected_endpoint.value, \"udp://10.0.0.2:7400\");\n        assert_eq!(negotiated_a.initiator_offer, negotiated_b.initiator_offer);\n        assert_eq!(negotiated_a.responder_offer, negotiated_b.responder_offer);\n        Ok(())\n    }","instruction":"Explain what the Rust test `negotiation_builds_matching_sessions` verifies.","output":"The test `negotiation_builds_matching_sessions` verifies negotiation builds matching sessions. It belongs to cp-transport and covers domains: transport. Observed statuses: none; error codes: none; assertions: 4.","source_test_id":"cp-transport::negotiation_builds_matching_sessions","task":"behavior_explanation"}79{"id":"cp-transport::outbox_rejects_wrong_direction_packet::explain_behavior","input":"\n    #[test]\n    fn outbox_rejects_wrong_direction_packet() -> Result<(), Box<dyn std::error::Error>> {\n        let root = temp_dir(\"wrong-direction\");\n        let mut outbox =\n            TransportPeerOutbox::open(&root, NodeId::new(\"node-a\")?, NodeId::new(\"node-b\")?)?;\n\n        assert!(matches!(\n            outbox.queue_packet(reverse_packet()?),\n            Err(TransportPeerOutboxError::SourceNodeMismatch { .. })\n        ));\n        assert!(outbox.is_empty());\n\n        fs::remove_dir_all(root)?;\n        Ok(())\n    }","instruction":"Explain what the Rust test `outbox_rejects_wrong_direction_packet` verifies.","output":"The test `outbox_rejects_wrong_direction_packet` verifies outbox rejects wrong direction packet. It belongs to cp-transport and covers domains: transport. Observed statuses: none; error codes: none; assertions: 2.","source_test_id":"cp-transport::outbox_rejects_wrong_direction_packet","task":"behavior_explanation"}80{"id":"cp-transport::outbox_rejects_manifest_mismatch::explain_behavior","input":"\n    #[test]\n    fn outbox_rejects_manifest_mismatch() -> Result<(), Box<dyn std::error::Error>> {\n        let root = temp_dir(\"manifest\");\n        let outbox =\n            TransportPeerOutbox::open(&root, NodeId::new(\"node-a\")?, NodeId::new(\"node-b\")?)?;\n        let manifest_path = outbox.manifest_path().to_path_buf();\n        persist_manifest(\n            &manifest_path,\n            &TransportPeerOutboxManifest::new(NodeId::new(\"node-a\")?, NodeId::new(\"node-c\")?),\n        )?;\n\n        let err = TransportPeerOutbox::open(&root, NodeId::new(\"node-a\")?, NodeId::new(\"node-b\")?)\n            .err()\n            .ok_or(\"manifest mismatch should fail\")?;\n\n        assert!(matches!(\n            err,\n            TransportPeerOutboxError::ManifestMismatch { .. }\n        ));\n        fs::remove_dir_all(root)?;\n        Ok(())\n    }","instruction":"Explain what the Rust test `outbox_rejects_manifest_mismatch` verifies.","output":"The test `outbox_rejects_manifest_mismatch` verifies outbox rejects manifest mismatch. It belongs to cp-transport and covers domains: transport. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-transport::outbox_rejects_manifest_mismatch","task":"behavior_explanation"}81{"id":"cp-transport::cidr_rejects_host_bits::explain_behavior","input":"\n    #[test]\n    fn cidr_rejects_host_bits() {\n        assert_eq!(\n            OverlayCidr::new(Ipv4Addr::new(192, 168, 1, 7), 24),\n            Err(OverlayPolicyError::HostBitsSet {\n                network: Ipv4Addr::new(192, 168, 1, 7),\n                prefix_len: 24\n            })\n        );\n    }","instruction":"Explain what the Rust test `cidr_rejects_host_bits` verifies.","output":"The test `cidr_rejects_host_bits` verifies cidr rejects host bits. It belongs to cp-transport and covers domains: transport. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-transport::cidr_rejects_host_bits","task":"behavior_explanation"}82{"id":"cp-transport::registry_rejects_self_peer_enrollment::explain_behavior","input":"\n    #[test]\n    fn registry_rejects_self_peer_enrollment() -> Result<(), Box<dyn std::error::Error>> {\n        let root = temp_dir(\"self\");\n        let mut registry = TransportLinkRegistry::open(&root, NodeId::new(\"node-a\")?)?;\n\n        assert!(matches!(\n            registry.enroll_peer(NodeId::new(\"node-a\")?),\n            Err(TransportLinkRegistryError::SelfPeer)\n        ));\n\n        fs::remove_dir_all(root)?;\n        Ok(())\n    }","instruction":"Explain what the Rust test `registry_rejects_self_peer_enrollment` verifies.","output":"The test `registry_rejects_self_peer_enrollment` verifies registry rejects self peer enrollment. It belongs to cp-transport and covers domains: transport. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-transport::registry_rejects_self_peer_enrollment","task":"behavior_explanation"}83{"id":"cp-transport::session_rejects_nonce_from_wrong_direction::explain_behavior","input":"\n    #[test]\n    fn session_rejects_nonce_from_wrong_direction() -> Result<(), Box<dyn std::error::Error>> {\n        let (mut a, mut b) = session_pair()?;\n        let mut sealed = a.seal_payload(FrameKind::Data, None, b\"payload\".to_vec())?;\n        sealed.nonce = AeadNonce::from_session_sequence([9; 16], sealed.sequence);\n\n        assert_eq!(b.open_frame(&sealed), Err(SessionError::NonceMismatch));\n        Ok(())\n    }","instruction":"Explain what the Rust test `session_rejects_nonce_from_wrong_direction` verifies.","output":"The test `session_rejects_nonce_from_wrong_direction` verifies session rejects nonce from wrong direction. It belongs to cp-transport and covers domains: transport. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-transport::session_rejects_nonce_from_wrong_direction","task":"behavior_explanation"}84{"id":"cp-transport::spool_rejects_invalid_wire_packet::explain_behavior","input":"\n    #[test]\n    fn spool_rejects_invalid_wire_packet() -> Result<(), Box<dyn std::error::Error>> {\n        let path = temp_path(\"invalid\");\n        let mut spool = TransportPacketSpool::open(&path)?;\n\n        assert!(matches!(\n            spool.append_packet(\"not-a-wire-packet\"),\n            Err(TransportPacketSpoolError::Wire(\n                WirePacketError::WrongFieldCount { .. }\n            ))\n        ));\n        assert!(spool.is_empty());\n        if path.exists() {\n            fs::remove_file(path)?;\n        }\n        Ok(())\n    }","instruction":"Explain what the Rust test `spool_rejects_invalid_wire_packet` verifies.","output":"The test `spool_rejects_invalid_wire_packet` verifies spool rejects invalid wire packet. It belongs to cp-transport and covers domains: transport. Observed statuses: none; error codes: none; assertions: 2.","source_test_id":"cp-transport::spool_rejects_invalid_wire_packet","task":"behavior_explanation"}85{"id":"cp-transport::wire_decode_rejects_bad_nonce_length::explain_behavior","input":"\n    #[test]\n    fn wire_decode_rejects_bad_nonce_length() -> Result<(), Box<dyn std::error::Error>> {\n        let packet = encode_encrypted_frame(&encrypted_frame()?);\n        let mut fields: Vec<&str> = packet.split('\\t').collect();\n        fields[6] = \"abcd\";\n        let packet = fields.join(\"\\t\");\n\n        assert_eq!(\n            decode_encrypted_frame(&packet),\n            Err(WirePacketError::InvalidHexLength)\n        );\n        Ok(())\n    }","instruction":"Explain what the Rust test `wire_decode_rejects_bad_nonce_length` verifies.","output":"The test `wire_decode_rejects_bad_nonce_length` verifies wire decode rejects bad nonce length. It belongs to cp-transport and covers domains: transport. Observed statuses: none; error codes: none; assertions: 1.","source_test_id":"cp-transport::wire_decode_rejects_bad_nonce_length","task":"behavior_explanation"}86{"id":"cp-upgrade::upgrade_plan_for_no_op_migration::explain_behavior","input":"\n#[test]\nfn upgrade_plan_for_no_op_migration() -> Result<(), Box<dyn std::error::Error>> {\n    let dir = temp_dir(\"plan-no-op\")?;\n    let bus_path = dir.join(\"events.jsonl\");\n    write_bus(&bus_path)?;\n\n    let plan = UpgradePlan::build(&bus_path, &MigrationRegistry::default())?;\n\n    assert_eq!(plan.from_version, EventSchemaVersion::new(1, 0));\n    assert_eq!(plan.to_version, EventSchemaVersion::new(1, 0));\n    assert!(plan.steps.is_empty());\n    Ok(())\n}","instruction":"Explain what the Rust test `upgrade_plan_for_no_op_migration` verifies.","output":"The test `upgrade_plan_for_no_op_migration` verifies upgrade plan for no op migration. It belongs to cp-upgrade and covers domains: upgrade, event. Observed statuses: none; error codes: none; assertions: 3.","source_test_id":"cp-upgrade::upgrade_plan_for_no_op_migration","task":"behavior_explanation"}87