# anet QA 周报 — 2026-05-12 11:45 UTC

_自动生成 by [scripts/qa-status.sh](../../scripts/qa-status.sh)_

## 测试库当前状态

| 层 | 数量 | 工具 |
|----|------|------|
| L0 unit（代码视角，bun:test） | 3 | `cd server && bun test` |
| L1 contract（用户视角，Docker） | 16 | `bash scripts/qa.sh --l1` |
| 历史保护资产 | 35 | （不动） |

## L0 单测列表

- `auth-tokens` — 25 expect call(s) — [server/src/auth-tokens.test.ts](../../server/src/auth-tokens.test.ts)
- `auth-validate` — 23 expect call(s) — [server/src/auth-validate.test.ts](../../server/src/auth-validate.test.ts)
- `password-dict` — 15 expect call(s) — [server/src/password-dict.test.ts](../../server/src/password-dict.test.ts)

## L1 contract 测试列表

- `qa-cli-01-hub-start` — [tests/qa-cli-01-hub-start/](../../tests/qa-cli-01-hub-start/)
  _banner / port / 凭证文件落地 / 幂等性 任一坏都让新用户卡住。_
- `qa-cli-02-network-create` — [tests/qa-cli-02-network-create/](../../tests/qa-cli-02-network-create/)
  _- 非交互登录（`--username/--password`）_
- `qa-dash-07-auth-boundary` — [tests/qa-dash-07-auth-boundary/](../../tests/qa-dash-07-auth-boundary/)
  _攻击者可以 curl 直接打 hub。这条测试枚举 dashboard 调的所有端点 + SSE + MCP，_
- `qa-dash-08-cross-account-views` — [tests/qa-dash-08-cross-account-views/](../../tests/qa-dash-08-cross-account-views/)
  _[R17 HUB-06b](../qa-hub-06b-cross-user-isolation/) 覆盖了 `/api/networks` `/api/tasks`（无 filt_
- `qa-dash-10-incremental-poll` — [tests/qa-dash-10-incremental-poll/](../../tests/qa-dash-10-incremental-poll/)
  _所以 dashboard 实际用增量轮询：每隔 N 秒打 `?since=<lastseen>` 拿新数据。_
- `qa-hub-05-roundtrip` — [tests/qa-hub-05-roundtrip/](../../tests/qa-hub-05-roundtrip/)
- `qa-hub-06b-cross-user-isolation` — [tests/qa-hub-06b-cross-user-isolation/](../../tests/qa-hub-06b-cross-user-isolation/)
  _即使 bob 知道 alice 的 networkid（IDOR），也不能直接调 alice 的 API。_
- `qa-hub-06-token-revoke` — [tests/qa-hub-06-token-revoke/](../../tests/qa-hub-06-token-revoke/)
  _派生 token 是否随母 token 失效，是 fleet-management 类工具的核心契约。_
- `qa-hub-07-sse-reconnect` — [tests/qa-hub-07-sse-reconnect/](../../tests/qa-hub-07-sse-reconnect/)
  _这个测试 pin 关键契约：「断开期间的任务不能丢」—— 通过 getinbox 拿，�_
- `qa-hub-08-restart-persistence` — [tests/qa-hub-08-restart-persistence/](../../tests/qa-hub-08-restart-persistence/)
  _这条测试 pin 三个持久化契约：session 行、inbox/task 行、ntok 验证。_
- `qa-hub-09-task-state-machine` — [tests/qa-hub-09-task-state-machine/](../../tests/qa-hub-09-task-state-machine/)
  _- `replied` 分支：[NODE-02](../qa-node-02-success-reply/) R6 已测_
- `qa-node-02-success-reply` — [tests/qa-node-02-success-reply/](../../tests/qa-node-02-success-reply/)
  _但成功路径（status=replied + result 文本回填）没单独测。真 LLM 烧钱不可取�_
- `qa-node-03b-task-events` — [tests/qa-node-03b-task-events/](../../tests/qa-node-03b-task-events/)
  _「这个 task 经历了什么、谁动的」。之前完全没人测。_
- `qa-ut-01-auth-tokens` — [tests/qa-ut-01-auth-tokens/](../../tests/qa-ut-01-auth-tokens/)
  _[R5 (HUB-06)](../qa-hub-06-token-revoke/) 在 E2E 层覆盖了撤销，但生成/解析的形�_
- `qa-ut-02-password-dict` — [tests/qa-ut-02-password-dict/](../../tests/qa-ut-02-password-dict/)
  _补一层 ms 级单测，PR 改 dict 文件能秒拦截 regression — 不必等慢的 E2E 跑完。_
- `qa-ut-03-auth-validate` — [tests/qa-ut-03-auth-validate/](../../tests/qa-ut-03-auth-validate/)
  _[test30 step 3](../test30-v0.8-auth-deprecation) E2E 只测 2 个弱密码，UT-03 测 14+ 个 + 边_

## 累计抠出的 SDK 设计 finding

- Tests with GAP-style sections: **5**
- Canonical count (rows in [v0-summary.md](v0-summary.md#累计抠出的-11-条-sdk-设计-finding) findings table): **11**

完整清单见 [docs/qa/v0-summary.md](v0-summary.md#累计抠出的-11-条-sdk-设计-finding)。

## 本地 `bash scripts/qa.sh` 实测

测试集合：
    L0 unit (bun test, local, ms-budget):
      - password-dict  (server/src/password-dict.test.ts)
      - auth-tokens  (server/src/auth-tokens.test.ts)
      - auth-validate  (server/src/auth-validate.test.ts)
    L1 contract (Docker, ~10-15s each):
      - tests/qa-cli-01-hub-start/
      - tests/qa-cli-02-network-create/
      - tests/qa-dash-07-auth-boundary/
      - tests/qa-dash-08-cross-account-views/
      - tests/qa-dash-10-incremental-poll/
      - tests/qa-hub-05-roundtrip/
      - tests/qa-hub-06-token-revoke/
      - tests/qa-hub-06b-cross-user-isolation/
      - tests/qa-hub-07-sse-reconnect/
      - tests/qa-hub-08-restart-persistence/
      - tests/qa-hub-09-task-state-machine/
      - tests/qa-node-02-success-reply/
      - tests/qa-node-03b-task-events/

## Trend vs 上次跑这个脚本

- L1 测试：16 → 16 （Δ 0）
- Finding：11 → 11 （Δ 0）

---
_Generated 2026-05-12 11:45 UTC · issue [#31](https://github.com/sleep2agi/agent-network/issues/31)_
