Add protected interaction evidence and measured debugging phases

apps/browser/management-channel.cjs

@@ -19,19 +19,25 @@ async function protectedPolicyRequest({device,request,save}){
   try{const response=await request(device.server,'/api/device/channel/policy',context.request,device.token);return channel.finish(response,challenge,context);}
   finally{context.responseKey.fill(0);}
 }
-async function protectedEvidenceRequest({device,request,save,payload}){
+async function protectedEvidenceRequest({device,request,save,payload,assertCurrent=()=>{},traceOperation=async(_name,fn)=>fn()}){
+  assertCurrent();
   await initializeSigningPin({device,request,save});
+  assertCurrent();
   const crypto=channel.evidenceChannel;
-  const challenge=await request(device.server,'/api/device/channel/evidence/challenge',{},device.token);
+  const challenge=await traceOperation('evidence.challenge',()=>request(device.server,'/api/device/channel/evidence/challenge',{},device.token));
+  assertCurrent();
   crypto.verifyChallenge(challenge,device.id,device.publicKey,device.channelSignatureKey);
-  const context=crypto.prepare(challenge,payload);
+  let context;
   try{
-    const response=await request(device.server,'/api/device/channel/evidence',context.request,device.token);
+    await traceOperation('evidence.encrypt',()=>{context=crypto.prepare(challenge,payload);});
+    assertCurrent();
+    const response=await traceOperation('evidence.send',()=>request(device.server,'/api/device/channel/evidence',context.request,device.token));
     // Status is trusted only inside the authenticated encrypted acknowledgement.
-    const result=crypto.finish(response,challenge,context);
+    assertCurrent();
+    const result=await traceOperation('evidence.ack',()=>crypto.finish(response,challenge,context));assertCurrent();
     if(!result||Object.keys(result).sort().join(',')!=='body,status'||!Number.isInteger(result.status)||result.status<200||result.status>599||!result.body||typeof result.body!=='object'||Array.isArray(result.body))throw Error('Protected evidence acknowledgement invalid');
     if(result.status>=300){const error=Error('Protected evidence submission refused');error.status=result.status;throw error;}
     return result.body;
-  }finally{context.responseKey.fill(0);}
+  }finally{context?.responseKey.fill(0);}
 }
 module.exports={protectedPolicyRequest,protectedEvidenceRequest,deploymentPin};