[aterga]

Summary

discover::tests::resolve_app_identity_skips_probe_for_known_apps fails on main and on every PR with left: Declared, right: Known, which turns the test job red. The code is correct; the test is stale.

• What changed: oisy.com now publishes /.well-known/ii-derivation-origin, answering 200 text/plain with https://oisy.com.
• Why Declared is correct: resolve_app_identity deliberately lets an app's own declaration win over the known-app registry.
• The second purpose is gone too: the test also pinned the over-cap Layer 5 regression on oisy.com serving its SPA shell at that path, which it no longer does.

This PR makes the test robust to apps adopting the declaration, and moves the over-cap regression into an offline test.

Related issues

Unblocks CI for #236, which is red only on this test.

Changes

crates/imcp2-core/src/discover.rs, test code and one doc comment only:

• resolve_app_identity_skips_probe_for_known_apps (live). It now checks three registry apps that today still declare nothing: nns.internetcomputer.org, multidex.ai and app.icpswap.com.
  • Each app must resolve to its registry derivation origin without the IC probe running (application_is_ic == None).
  • The source may be either Known (the registry filled the gap) or Declared (the app's own declaration, which must agree with the registry).
  • At least one app must still resolve through the registry, so the Known path stays covered. If they all adopt the declaration, the failure message says to add another registry app.
  • One site changing no longer breaks the test. oisy.com and nns.ic0.app have already adopted the declaration.
• an_over_cap_layer5_body_reads_as_no_declaration (new, offline).
  • A loopback TcpListener serves a page larger than MAX_DERIVATION_ORIGIN_BYTES.
  • Under Overflow::NotTheDocument, fetch_well_known must read it as WellKnown::Absent: the app declares nothing, which is not a failed check.
  • Under Overflow::Unknown, the same body must read as Unreachable ("larger than…").
  • The test calls fetch_well_known directly, because resolve_app_identity's SSRF guard refuses loopback.
  • The two live apps above currently serve an over-cap SPA shell at the Layer 5 path, so the live test still exercises this path too.
• Overflow::NotTheDocument doc. It no longer claims OISY serves that page, and points to the offline test instead.

Testing

• The live test passes against today's sites. Probed today: oisy.com and nns.ic0.app resolve Declared; the three apps above resolve Known.
• The offline test fails when NotTheDocument is mapped to Unreachable, which is the regression it pins.

Checklist:

• cargo build --locked --all-targets
• cargo test --locked --workspace --all-targets: all pass (imcp2 lib 82, bin 8, routers 10; imcp2-core 217; imcp2-local 21).
• cargo fmt --all / cargo clippy --workspace --all-targets (tree is warning-free)
• npm test --prefix monitoring/mcp-status (n/a, dashboard untouched)

Checklist

• I have read the Contributing guidelines.
• Docs (README / comments) updated for any user-visible change.
• No secrets, credentials, or internal-only information are included.

---

Generated by Claude Code

[Copilot]

🟡 Changes recommended

The offline test supplies Overflow::NotTheDocument directly, so it would miss a regression in resolve_declared_origin that restores resolution failures for oversized pages.

1 open issue

• Add loopback coverage for declared-origin resolution · New

What changed in this PR

Updates imcp2-core identity-discovery tests to tolerate known apps publishing derivation-origin declarations, while moving oversized-response regression coverage offline.

Changes:

• Checks three registry apps, accepting matching Known or Declared results while requiring at least one registry fallback.
• Adds a loopback regression test for both overflow policies.
• Replaces the OISY-specific doc comment with a reference to the offline test.

File	Description
crates/​imcp2-core/​src/​discover.rs	Revises live known-app checks, adds offline overflow coverage, and updates documentation.

_{Review effort: Max}