fix(housekeeping): harden audited command dispatch

src/features/housekeeping/foundation/commands/registry.test.ts

@@ -5,6 +5,7 @@ import {
 	getHousekeepingCommand,
 	type HousekeepingCommand,
 	registerHousekeepingCommand,
+	sealHousekeepingCommandRegistry,
 } from "./registry";
 
 function command(
@@ -24,12 +25,19 @@ function command(
 }
 
 describe("housekeeping command registry", () => {
-	it("returns the exact command registered under its global ID", () => {
+	it("returns the validated snapshot registered under its global ID", () => {
 		const registered = command("people.registry.lookup");
 
 		registerHousekeepingCommand(registered);
 
-		expect(getHousekeepingCommand(registered.id)).toBe(registered);
+		expect(getHousekeepingCommand(registered.id)).toMatchObject({
+			id: "people.registry.lookup",
+			owner: "people",
+			risk: "safe",
+			requiresReason: false,
+			rateLimit: { attempts: 4, windowMs: 30_000 },
+		});
+		expect(getHousekeepingCommand(registered.id)).not.toBe(registered);
 	});
 
 	it("rejects a duplicate global command ID before it can shadow its owner", () => {
@@ -47,4 +55,79 @@ describe("housekeeping command registry", () => {
 			),
 		).toThrow("command owner mismatch: people.registry.owner-mismatch");
 	});
+	it("stores a frozen snapshot that resists mutation through the original definition", () => {
+		const original = command("people.registry.immutable");
+		const callerOwnedInput = original.input;
+		registerHousekeepingCommand(original);
+		const registered = getHousekeepingCommand(original.id);
+		if (!registered) throw new Error("registered command missing");
+
+		const registeredInput = registered.input;
+		const registeredExecute = registered.execute;
+		(original as { risk: "safe" | "sensitive" }).risk = "sensitive";
+		(original as { owner: "people" | "system" }).owner = "system";
+		(original as { input: z.ZodType<{ id: number }> }).input = z.object({
+			id: z.literal(999),
+		});
+		(original.capability.slugs as string[]).push("admin.settings.edit");
+		(original.rateLimit as { attempts: number }).attempts = 999;
+		(
+			original as {
+				execute: HousekeepingCommand<{ id: number }, { id: number }>["execute"];
+			}
+		).execute = async (context) => ok({ id: 999 }, context.correlationId);
+
+		expect(registered).toMatchObject({
+			risk: "safe",
+			owner: "people",
+			capability: { slugs: ["admin.users.view"] },
+			rateLimit: { attempts: 4, windowMs: 30_000 },
+		});
+		expect(registered.input).toBe(registeredInput);
+		expect(registered.input).not.toBe(callerOwnedInput);
+		expect(Object.isFrozen(callerOwnedInput)).toBe(false);
+		expect(registered.execute).toBe(registeredExecute);
+		expect(Object.isFrozen(registered)).toBe(true);
+		expect(Object.isFrozen(registered.input)).toBe(true);
+		expect(Object.isFrozen(registered.capability)).toBe(true);
+		expect(Object.isFrozen(registered.capability.slugs)).toBe(true);
+		expect(Object.isFrozen(registered.rateLimit)).toBe(true);
+	});
+
+	it.each([
+		["risk", { risk: "dangerous" }],
+		["requiresReason", { requiresReason: "yes" }],
+		[
+			"capability mode",
+			{ capability: { mode: "none", slugs: ["admin.users.view"] } },
+		],
+		["empty capability", { capability: { mode: "any", slugs: [] } }],
+		[
+			"unknown capability",
+			{ capability: { mode: "any", slugs: ["forged.permission"] } },
+		],
+		["execute", { execute: null }],
+		[
+			"Zod schema",
+			{ input: { safeParse: () => ({ success: true, data: {} }) } },
+		],
+		["normalized ID", { id: " people.registry.invalid-id " }],
+	] as const)("rejects an invalid %s definition", (label, override) => {
+		const invalid = {
+			...command(
+				`people.registry.invalid-${label.toLowerCase().replaceAll(" ", "-")}`,
+			),
+			...override,
+		} as unknown as HousekeepingCommand<{ id: number }, { id: number }>;
+
+		expect(() => registerHousekeepingCommand(invalid)).toThrow();
+	});
+
+	it("seals the global registry after deterministic bootstrap", () => {
+		sealHousekeepingCommandRegistry();
+
+		expect(() =>
+			registerHousekeepingCommand(command("people.registry.after-seal")),
+		).toThrow("command registry is sealed");
+	});
 });