[kriszyp]

⊙ Problem

Two security regressions fixed on main — #3594 (sealed tables with tracked updates across a table re-declaration) and #3755 (the local principal) — had only single-process or domain-socket coverage. Nothing checked them across two HTTP workers, or from a real non-loopback source address.

🤔 Is a test-only PR the right fix?

As specified, yes. Both fixes are on main; what is missing is a test that fails when they regress.

💡 Solution

Two integration suites pass on RocksDB and LMDB and fail on the pre-fix base.

• database/sealed-redeclare-tracked-update: a sealed table rejects an undeclared own property assigned on a Table.update() instance next to a declared edit, with 2 HTTP workers. Rejected arms assert detail[0].code === 'unknown_property' and an unchanged updatedAt.
• security/local-principal-isolation: nothing from a non-loopback address becomes the local principal (headers, body hdb_user, pre-auth header, replayed cookies, MQTT, minted tokens, scoped token, reserved name).

🤔 Which non-loopback address does the security suite use?

HARPER_TEST_NON_LOOPBACK_ADDRESS, else the first external IPv4 interface of the host. With neither, the suite skips with that reason. A CI runner with no external IPv4 would skip silently; the other choice is a dedicated network namespace.

🔧 Changes

• integrationTests/database/sealed-redeclare-tracked-update.test.ts and its fixture (resources.js, config.yaml): seven held handles, four fresh handles, two REST patches, one re-declaration in worker B.
• integrationTests/security/local-principal-isolation.test.ts and its fixture (resources.js, config.yaml, schema.graphql): eight arms plus a direct check that a principal named local without the _localPrincipal marker gets no local role. The address choice and skip and per-run ports replace the hard-coded docker0 address; the scoped-token mint must return 200. Look hardest at the address choice.

✅ Verification

• Both files pass on RocksDB and LMDB (27 of 27 cases each).
• Red on the pre-fix base, forced rebuild: sealed suite fails A3 and B3 on Fix Date chaining and preserve validation across table re-declarations #3594's merge base (83d515f2d); the security suite fails 4 cases on the parent of Run local-trust requests as a fixed local principal instead of re-reading a stored super user per request #3755's merge commit.
• Mutating isLocalPrincipal to check the name only turns the new direct check and arm 8 red.
• Skip path checked with an empty HARPER_TEST_NON_LOOPBACK_ADDRESS.

Docs: none; test-only.

_{🤖 Generated by Anthropic Claude (Sonnet 5.5, dispatch dev agent); posted via @kriszyp.}

Release target: v5.4 — test-only; the fixes under test are not on v5.3
Related PRs: #3594 overlaps, #3653 independent, #3803 independent, #3610 independent
Complexity: medium

Late Grok findings

12 surviving (highest minor) — Grok reviewed 5b7ab01

• minor — integrationTests/database/sealed-redeclare-tracked-update/resources.js:58 — a held handle can be aborted by the open-transaction limit inside the time budgets the test allows itself. Arms then fail with an "open too long" 422 instead of unknown_property, and the setup test still passes
• minor — integrationTests/database/sealed-redeclare-tracked-update.test.ts:163 — request() has no timeout, and onThread/waitFor check their deadlines only between awaits. A stalled exchange hangs the before hook with no attribution instead of failing it
• minor — integrationTests/security/local-principal-isolation.test.ts:614 — note() (console.log, line 51) writes credential values to CI stdout
• minor — integrationTests/database/sealed-redeclare-tracked-update.test.ts:378 — the \b7\b|\b99\b scan runs over successful response bodies, which contain threadId. A worker whose threadId is 7 or 99 fails A4, A4p or B4 although no attempted value was stored
• minor — integrationTests/security/local-principal-isolation.test.ts:752 — arm 6 can pass vacuously, and its look-alike users are created as super users
• nit — integrationTests/security/local-principal-isolation.test.ts:71 — freePorts closes the probe servers without awaiting the close, and openMqtt (lines 228-253) has no connect or upgrade timeout
• nit — integrationTests/security/local-principal-isolation.test.ts:546 — after a refused CONNACK, mqttAttempt returns before publishing (line 289). The itemStatus(remote.itemId) 404 check (also at line 853) therefore cannot fail once line 544 passes
• nit — integrationTests/database/sealed-redeclare-tracked-update.test.ts:419 — body.threadId ?? threadA falls back to threadA on 4xx bodies, so the assertion is always true on rejected arms
• nit — integrationTests/database/sealed-redeclare-tracked-update.test.ts:331 — a convergence failure is caught, the gate still opens, and the arms run against an unconverged schema
• nit — integrationTests/database/sealed-redeclare-tracked-update.test.ts:261 — added comments narrate the next line or act as section banners
• nit — integrationTests/security/local-principal-isolation/resources.js:3 — the fixture uses the loader-injected Resource and databases globals, while the sibling fixture in this PR imports from harper
• nit — integrationTests/database/sealed-redeclare-tracked-update.test.ts:17 — the suite title includes [engine=…], but the run note gives no HARPER_STORAGE_ENGINE=lmdb invocation

Not standing: 3 merged. Grok ran 19m (19m from launch to report); the fold adjudication (cursor-grok@5b7ab01b1c30-97417a8d, claude) took 2m.

_{Review-Coverage: authored=claude; ran=cursor-composer,gemini,codex,cursor-grok; late=cursor-grok:adjudicated; adjudicated=domain,domain(codex); declined=muse; rounds=4; full=2 @ 052b543}

_{Review-Attention: read ~4m (decisions: do-less-alternative, platform-scope, retired-field-semantics) @ 052b543}

[gemini-code-assist]

Code Review

This pull request introduces comprehensive integration tests covering sealed table re-declarations across multiple workers and local principal isolation security mechanisms. The review feedback identifies two potential sources of test flakiness: a regex assertion in the sealed table tests that could falsely fail if a worker's thread ID matches an excluded value, and asynchronous session writes in the security tests that should be polled with a timeout rather than asserted immediately.