From e2db768012079b82e6f1ff7191d475494b06d2a2 Mon Sep 17 00:00:00 2001
From: morluto <76467478+morluto@users.noreply.github.com>
Date: Fri, 16 Oct 2026 04:05:12 +0800
Subject: [PATCH] test(pcap): verify timestamps through the named summary
 contract

Move the capinfos oracle to inspect_pcap_capture, whose summary retains timestamps. The field-inspection contract does not expose them. Check both CLI and MCP results against the independently observed producer values.
---
 scripts/verify-packet-capture.mjs | 58 +++++++++++++++++++------------
 1 file changed, 36 insertions(+), 22 deletions(-)

diff --git a/scripts/verify-packet-capture.mjs b/scripts/verify-packet-capture.mjs
index e359842101..031567df06 100644
--- a/scripts/verify-packet-capture.mjs
+++ b/scripts/verify-packet-capture.mjs
@@ -111,24 +111,6 @@ let primaryError;
 try {
   await writeFile(path, source);
   await writeFile(bluetooth, bluetoothSource);
-  const capinfosOutput = (
-    await execute(
-      process.env.REA_CAPINFOS_COMMAND ?? "capinfos",
-      ["-M", "--", path],
-      {
-        env: { ...environment, LC_ALL: "C", LANG: "C" },
-        timeout: 60000,
-        maxBuffer: 64 * 1024,
-      },
-    )
-  ).stdout;
-  const expectedCaptureStart =
-    /^(?:Earliest|First) packet time:\s*(.+)$/mu.exec(capinfosOutput)?.[1] ??
-    null;
-  const expectedCaptureEnd =
-    /^(?:Latest|Last) packet time:\s*(.+)$/mu.exec(capinfosOutput)?.[1] ?? null;
-  assert.ok(expectedCaptureStart, capinfosOutput);
-  assert.ok(expectedCaptureEnd, capinfosOutput);
   await client.connect(transport);
   const tool = (await client.listTools()).tools.find(
     ({ name }) => name === "inspect_packet_capture",
@@ -155,10 +137,6 @@ try {
         .update(await readFile(input.path))
         .digest("hex"),
     );
-    if (input.path === path) {
-      assert.equal(report.capture_start, expectedCaptureStart);
-      assert.equal(report.capture_end, expectedCaptureEnd);
-    }
     assert.equal(report.hardware_acquisition, "not-performed");
     assert.equal(report.limits.address_space_bytes, expectedAddressSpace);
     assert.equal(report.tool.configured_path, process.env.REA_TSHARK_COMMAND);
@@ -287,6 +265,27 @@ try {
   assert.ok(pcapAjv.validateSchema(pcapTool.inputSchema));
   assert.ok(pcapAjv.validateSchema(pcapTool.outputSchema));
   for (const capturePath of [path, bluetooth]) {
+    const capinfosOutput = (
+      await execute(
+        process.env.REA_CAPINFOS_COMMAND ?? "capinfos",
+        ["-M", "--", capturePath],
+        {
+          env: { ...environment, LC_ALL: "C", LANG: "C" },
+          timeout: 60000,
+          maxBuffer: 64 * 1024,
+        },
+      )
+    ).stdout;
+    const expectedCaptureStart =
+      /^(?:Earliest|First) packet time:[ \t]*(.+)$/mu
+        .exec(capinfosOutput)?.[1]
+        ?.trim() ?? null;
+    const expectedCaptureEnd =
+      /^(?:Latest|Last) packet time:[ \t]*(.+)$/mu
+        .exec(capinfosOutput)?.[1]
+        ?.trim() ?? null;
+    assert.ok(expectedCaptureStart, capinfosOutput);
+    assert.ok(expectedCaptureEnd, capinfosOutput);
     const response = await client.callTool({
       name: pcapTool.name,
       arguments: { path: capturePath, detail: "summary" },
@@ -297,12 +296,27 @@ try {
       pcapAjv.errorsText(),
     );
     const summary = parseEvidence(response.structuredContent).normalized_result;
+    assert.equal(summary.summary.capture_start, expectedCaptureStart);
+    assert.equal(summary.summary.capture_end, expectedCaptureEnd);
     assert.equal(
       summary.summary.target.sha256,
       createHash("sha256")
         .update(await readFile(capturePath))
         .digest("hex"),
     );
+    const cli = parseEvidence(
+      JSON.parse(
+        (
+          await execute(
+            process.execPath,
+            [entrypoint, "inspect-pcap-capture", capturePath, "--json"],
+            { env: environment, timeout: 60000, maxBuffer: 16 * 1024 * 1024 },
+          )
+        ).stdout,
+      ),
+    );
+    assert.equal(cli.normalized_result.capture_start, expectedCaptureStart);
+    assert.equal(cli.normalized_result.capture_end, expectedCaptureEnd);
     const source = {
       kind: "retained-evidence",
       evidence_id: summary.parent_evidence_id,