Audit native transports and retain secure export diagnostics

tests/ai-gateway-revalidation.test.mjs

@@ -31,3 +31,13 @@ for(const change of ['revoke','same-version-policy','output-revoke','client-abor
  await assert.rejects(runApprovedAI({store,config,deviceId,policy,prompt:'Public fixture prompt',signal:controller.signal}),error=>error.status===(change==='same-version-policy'?409:403)&&error.ruleId==='ai-authorization-changed');
  assert.equal(deliveries,change==='output-revoke'?1:0);
 });
+
+test('caller cancellation retains fixed authorization status while native fetch is pending',async t=>{
+ const directory=mkdtempSync(join(tmpdir(),'safetynet-ai-abort-')),store=openStore(directory),deviceId=randomUUID(),controller=new AbortController();
+ store.db.prepare('INSERT INTO devices(id,name,platform,user,token_hash) VALUES(?,?,?,?,?)').run(deviceId,'Fixture','win32','Fixture',randomUUID());
+ let received;const incoming=new Promise(resolve=>{received=resolve;});const provider=createServer((req,_res)=>{req.resume();received();}).listen(0,'127.0.0.1');await new Promise(resolve=>provider.once('listening',resolve));
+ t.after(async()=>{provider.closeAllConnections();await new Promise(resolve=>provider.close(resolve));store.db.close();rmSync(directory,{recursive:true,force:true});});
+ const p=store.get('policy');p.ai={...p.ai,enabled:true,trustMode:'local',model:'fixture'};store.put('policy',p);
+ const pending=runApprovedAI({store,config:{aiBaseUrl:`http://127.0.0.1:${provider.address().port}`,aiModel:'fixture'},deviceId,policy:store.effectivePolicy(deviceId),prompt:'Public fixture',signal:controller.signal});
+ const rejected=assert.rejects(pending,error=>error.status===403&&error.ruleId==='ai-authorization-changed');await incoming;controller.abort();await rejected;
+});