test: identity, ledger, integration, TLS suites

[chazmaniandinkle]

Summary

Adds a test suite for the constellation package covering identity, ledger integrity, full-stack integration, and trust/heartbeat logic (2,126 lines across 4 files).

What's covered

• identity_test.go (385 lines) — ECDSA P-256 identity generation, persistence, and signing. Covers GenerateIdentity, SaveIdentity, LoadIdentity, NodeID derivation, Sign/Verify, MarshalPublicKey/PublicKeyFromDER roundtrips.

• ledger_test.go (569 lines) — Hash-chained event ledger and coherence validation. Covers CanonicalizeEvent, HashEvent, NewEvent, canonical JSON (RFC 8785), ValidateCoherence (hash chain, schema, temporal monotonicity).

• integration_test.go (646 lines) — Multi-node full-stack: identity, git store, ledger, heartbeat, HTTP protocol, peer trust scoring. Uses real git repos in temp dirs and real HTTP servers on ephemeral ports.

• tls_test.go (526 lines) — Trust scoring, peer registry, heartbeat signing, identity conflict detection. (Note: constellation does NOT use TLS certificates; ECDSA-signed heartbeats provide mutual authentication.)

Test plan

• go test ./... passes locally
• CI workflow picks them up on the PR

[chazmaniandinkle]

Codex pre-merge review + amendment

Ran a read-only Codex review (gpt-5.3-codex, high reasoning) against the diff. Five findings surfaced, all test-hygiene concerns. Amendment commit e58a7a7 addresses all five.

Addressed in e58a7a7

1. TestNode_TamperDetectedByHealthEndpoint oracle (integration_test.go:504-525). The test ignored HTTP status and JSON decode errors, so a broken /health pipeline would leave report.Pass at the zero value and incorrectly satisfy the test. Fix: add status and decode-error checks.

The status check accepts either 200 or 503: /health intentionally returns 503 when report.Pass == false (per protocol.go:200-203, the HTTP-native tamper signal), still writing a valid JSON body. Applying a strict 200-only check would reject the real tamper path — Codex's original suggested-fix language didn't account for this contract. Any other status (e.g., 5xx without body, 404) now fails fast:

if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusServiceUnavailable {
    t.Fatalf("/health returned status %d, want 200 or 503", resp.StatusCode)
}

The JSON decode check is a separate t.Fatalf. The test can now only pass when /health actually reports non-Pass due to tamper detection, not when something broke upstream.

2. TestProtocol_PeersEndpoint empty-list assertion (integration_test.go:620-621). The "expected empty list" check was a t.Logf, so regressions wouldn't fail CI. Promoted to t.Errorf("expected empty peers on fresh node, got %d", len(peers)).

3. startTestNode goroutine log race (integration_test.go:40, 44). The background goroutine used t.Logf for a non-graceful-shutdown error path, a common source of post-test logging races if the goroutine outlives the test body. Switched to log.Printf (stdlib), which is safe outside the test lifecycle.

4. Ignored constructor/append errors (integration_test.go:177, 178, 205, 208). TestGitStore_LastEvent and TestGitStore_CorruptEvent_DetectedByCoherence discarded err from NewEvent and AppendEvent as _, which can mask regressions or lead to nil dereferences instead of precise test failures. Now check with t.Fatalf at each call site.

5. TestPublicKeyFromDER_NonECDSAKey was permanently skipped (identity_test.go:315). The original skip reason cited "requires RSA key generation to test type assertion — deferred to manual review," with a comment that crypto/rsa wasn't available. This was stale — crypto/rsa is in the Go standard library. Un-skipped with an inline RSA fixture (~8 lines: rsa.GenerateKey(rand.Reader, 2048) + x509.MarshalPKIXPublicKey). The test now actually exercises the non-ECDSA rejection branch at identity.go:119-122.

Verification

Full suite green including -tags integration:

• go build ./... clean
• go test ./... → ok (0.3s, non-tagged)
• go test -tags integration -run "TestNode_TamperDetected|TestProtocol_PeersEndpoint|TestPublicKeyFromDER_NonECDSAKey|TestGitStore_LastEvent|TestGitStore_CorruptEvent_DetectedByCoherence" -count=1 → PASS (12.7s)

Verdict

Codex returned "needs changes"; all five findings addressed.