# TASK METADATA

- **Target Files:** `server/main.test.ts`, `server/tests/forward_auth.test.ts`,
  `server/tests/rpc.test.ts`, `server/tests/auth.test.ts`,
  `server/tests/events.test.ts`, `server/tests/scopes.test.ts`
- **Core Objective:** Phase 5 (Test Suite Tier Separation): Decompose the
  1,577-line `server/main.test.ts` monolith into isolated, domain-specific test
  suites under `server/tests/` preserving 100% test coverage and hermetic
  execution without live database daemons.
- **Dependencies:**
  `tasks/new/2026-0825.01.jul.story.arch.monolith-decomposition-roadmap-1845.md`
- **Additional Important Notes:** Must run with `deno test --allow-all` and
  maintain all 59+ test steps passing cleanly.

---

### 2. Architectural Considerations & Risks

- **Risks:**
  - Mock state pollution across test files (e.g. shared `sqlWrapper` or `valkey`
    stubs leaking between test cases).
- **Alternatives:**
  - Keeping all tests in `server/main.test.ts`; rejected because single massive
    test files make targeted debugging and CI test parallelization difficult.

### 3. Proposed Implementation

1. **Create Domain Test Files (`server/tests/`):**
   - `server/tests/forward_auth.test.ts`: Tier 1 & 2 ForwardAuth tests, cookie
     domain scoping, bypass rules, and guest sandbox tests.
   - `server/tests/rpc.test.ts`: Tier 3 ConnectRPC session validation, RBAC
     grant evaluation, and SPIFFE attestation tests.
   - `server/tests/auth.test.ts`: WebAuthn registration/login PRF extraction,
     session creation, and audit logging.
   - `server/tests/events.test.ts`: Multi-claim event passes, PIN join
     endpoints, session extension, and master killswitch.
   - `server/tests/scopes.test.ts`: Zero-trust scope guards, self-revocation,
     and UI `/admin` redirection gates.
2. **Quality Gates & Validation:**
   - Run `deno test --allow-all` to ensure all domain test suites execute
     hermetically and pass with 0 failures.