test(enterprise): verify runtime isolation checklist

backend/package.json

@@ -41,7 +41,7 @@
     "prepack": "npm run build",
     "typecheck": "tsc --noEmit",
     "test": "jest",
-    "test:core": "jest --runInBand --forceExit src/agent/communication/__tests__/agentMessageBus.test.ts src/agent/core/executors/__tests__/strategyExecutor.test.ts src/agent/core/executors/__tests__/hypothesisExecutor.test.ts src/agent/context/__tests__/enhancedSessionContext.test.ts src/tests/adbTools.test.ts src/services/__tests__/sessionLogger.test.ts src/services/__tests__/traceAnalysisSkillConfig.test.ts src/agent/agents/domain/__tests__/registry.test.ts src/agentv3/__tests__/sqlIncludeInjector.test.ts src/agentv3/__tests__/analysisPatternMemory.test.ts src/agentv3/__tests__/claudeRuntimeRuntimeSnapshots.test.ts src/middleware/__tests__/auth.test.ts src/assistant/application/__tests__/assistantApplicationService.test.ts src/services/__tests__/rbac.test.ts src/routes/__tests__/agentRoutesRbac.test.ts src/routes/__tests__/ownerGuardRoutes.test.ts src/routes/__tests__/requestContextRouteCoverage.test.ts src/middleware/__tests__/legacyApiCompatibility.test.ts src/services/__tests__/enterpriseDb.test.ts src/services/__tests__/enterpriseSchema.test.ts src/services/__tests__/enterpriseRepository.test.ts src/services/__tests__/processRss.test.ts src/services/__tests__/workingTraceProcessor.enterpriseIsolation.test.ts src/services/__tests__/traceProcessorLeaseStore.test.ts src/services/__tests__/traceProcessorLeaseModeDecision.test.ts src/services/__tests__/traceProcessorLeaseProcessorRouting.test.ts src/services/__tests__/traceProcessorSqlWorker.test.ts src/services/__tests__/traceProcessorRamBudget.test.ts src/scripts/__tests__/benchmarkTraceProcessorRss.test.ts src/services/__tests__/analysisRunStore.test.ts src/services/__tests__/agentEventStore.test.ts src/services/__tests__/enterpriseKnowledgeScope.test.ts src/services/__tests__/enterpriseMigration.test.ts src/services/__tests__/runtimeSnapshotStore.test.ts src/services/providerManager/__tests__/localSecretStore.test.ts src/services/providerManager/__tests__/enterpriseProviderStore.test.ts src/routes/__tests__/enterpriseTraceMetadataRoutes.test.ts src/routes/__tests__/traceProcessorProxyRoutes.test.ts src/routes/__tests__/enterpriseReportRoutes.test.ts src/routes/__tests__/enterpriseRestartPersistence.test.ts",
+    "test:core": "jest --runInBand --forceExit src/agent/communication/__tests__/agentMessageBus.test.ts src/agent/core/executors/__tests__/strategyExecutor.test.ts src/agent/core/executors/__tests__/hypothesisExecutor.test.ts src/agent/context/__tests__/enhancedSessionContext.test.ts src/tests/adbTools.test.ts src/services/__tests__/sessionLogger.test.ts src/services/__tests__/traceAnalysisSkillConfig.test.ts src/agent/agents/domain/__tests__/registry.test.ts src/agentv3/__tests__/sqlIncludeInjector.test.ts src/agentv3/__tests__/analysisPatternMemory.test.ts src/agentv3/__tests__/claudeRuntimeRuntimeSnapshots.test.ts src/middleware/__tests__/auth.test.ts src/assistant/application/__tests__/assistantApplicationService.test.ts src/services/__tests__/rbac.test.ts src/routes/__tests__/agentRoutesRbac.test.ts src/routes/__tests__/ownerGuardRoutes.test.ts src/middleware/__tests__/legacyApiCompatibility.test.ts src/services/__tests__/enterpriseDb.test.ts src/services/__tests__/enterpriseSchema.test.ts src/services/__tests__/enterpriseRepository.test.ts src/services/__tests__/processRss.test.ts src/services/__tests__/workingTraceProcessor.enterpriseIsolation.test.ts src/services/__tests__/traceProcessorLeaseStore.test.ts src/services/__tests__/traceProcessorLeaseModeDecision.test.ts src/services/__tests__/traceProcessorLeaseProcessorRouting.test.ts src/services/__tests__/traceProcessorSqlWorker.test.ts src/services/__tests__/traceProcessorRamBudget.test.ts src/scripts/__tests__/benchmarkTraceProcessorRss.test.ts src/scripts/__tests__/enterpriseRuntimeIsolationChecklist.test.ts src/services/__tests__/analysisRunStore.test.ts src/services/__tests__/agentEventStore.test.ts src/services/__tests__/enterpriseKnowledgeScope.test.ts src/services/__tests__/enterpriseMigration.test.ts src/services/__tests__/runtimeSnapshotStore.test.ts src/services/providerManager/__tests__/localSecretStore.test.ts src/services/providerManager/__tests__/enterpriseProviderStore.test.ts src/routes/__tests__/enterpriseTraceMetadataRoutes.test.ts src/routes/__tests__/traceProcessorProxyRoutes.test.ts src/routes/__tests__/enterpriseReportRoutes.test.ts src/routes/__tests__/enterpriseRestartPersistence.test.ts",
     "test:watch": "jest --watch",
     "test:coverage": "jest --coverage",
     "test:unit": "jest --testPathPatterns=src/tests",

backend/src/scripts/__tests__/enterpriseRuntimeIsolationChecklist.test.ts

@@ -0,0 +1,84 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Copyright (C) 2024-2026 Gracker (Chris)
+// This file is part of SmartPerfetto. See LICENSE for details.
+
+import fs from 'fs';
+import path from 'path';
+import { RUNTIME_ISOLATION_CHECKLIST } from '../enterpriseRuntimeIsolationChecklist';
+
+const REPO_ROOT = path.resolve(__dirname, '../../../..');
+const README_PATH = 'docs/features/enterprise-multi-tenant/README.md';
+const CHECKLIST_DOC_PATH = 'docs/features/enterprise-multi-tenant/runtime-isolation-checklist.md';
+
+const EXPECTED_IDS = [
+  'proxy-status-websocket-query',
+  'http-rpc-target-lease-proxy',
+  'websocket-fifo-query-order',
+  'agent-frontend-same-lease-stats',
+  'sse-terminal-events-persisted',
+  'running-run-independent-cleanup',
+  'upload-temp-path-unique',
+  'url-upload-streaming',
+  'legacy-register-rpc-disabled',
+  'cleanup-draining-audit',
+  'window-scoped-session-storage',
+  'report-generation-isolated-priority',
+  'single-supervisor-crash-recovery',
+  'timeout-health-admin-drain',
+  'rss-budget-observed-highwater',
+] as const;
+
+function readRepoFile(relativePath: string): string {
+  return fs.readFileSync(path.join(REPO_ROOT, relativePath), 'utf8');
+}
+
+describe('enterprise runtime isolation checklist', () => {
+  it('keeps the §11.11 checklist as an explicit 15-item contract', () => {
+    expect(RUNTIME_ISOLATION_CHECKLIST.map(item => item.id)).toEqual(EXPECTED_IDS);
+    expect(new Set(RUNTIME_ISOLATION_CHECKLIST.map(item => item.vulnerability)).size).toBe(EXPECTED_IDS.length);
+    expect(new Set(RUNTIME_ISOLATION_CHECKLIST.map(item => item.acceptance)).size).toBe(EXPECTED_IDS.length);
+  });
+
+  it('maps every README §11.11 vulnerability and acceptance row to the checklist', () => {
+    const readme = readRepoFile(README_PATH);
+
+    for (const item of RUNTIME_ISOLATION_CHECKLIST) {
+      expect(readme).toContain(item.vulnerability);
+      expect(readme).toContain(item.acceptance);
+    }
+    expect(readme).toContain('- [x] 4.12 §11.11 漏洞清单：每行设计验收都打勾验证');
+    expect(readme).toContain(`- [x] \`${CHECKLIST_DOC_PATH}\``);
+  });
+
+  it('verifies the evidence file and pattern for every checklist item', () => {
+    const checkedEvidence = new Set<string>();
+
+    for (const item of RUNTIME_ISOLATION_CHECKLIST) {
+      expect(item.evidence.length).toBeGreaterThan(0);
+      for (const evidence of item.evidence) {
+        const evidencePath = path.join(REPO_ROOT, evidence.file);
+        expect(fs.existsSync(evidencePath)).toBe(true);
+
+        const content = readRepoFile(evidence.file);
+        expect(evidence.patterns.length).toBeGreaterThan(0);
+        for (const pattern of evidence.patterns) {
+          expect(content).toContain(pattern);
+          checkedEvidence.add(`${evidence.file}:${pattern}`);
+        }
+      }
+    }
+
+    expect(checkedEvidence.size).toBeGreaterThanOrEqual(EXPECTED_IDS.length * 2);
+  });
+
+  it('keeps the runtime isolation checklist document synchronized with the contract', () => {
+    const doc = readRepoFile(CHECKLIST_DOC_PATH);
+
+    for (const item of RUNTIME_ISOLATION_CHECKLIST) {
+      expect(doc).toContain(item.id);
+      expect(doc).toContain(item.vulnerability);
+      expect(doc).toContain(item.acceptance);
+    }
+    expect(doc).toContain('cd backend && npx jest --runInBand src/scripts/__tests__/enterpriseRuntimeIsolationChecklist.test.ts');
+  });
+});