[aterga]

Motivation

Bump the PocketIC test harness to v15 — the first version whose bundled replica implements the request-delegation permissions extension (dfinity/ic#10449). This is a prerequisite for adding integration tests that exercise read-only (queries-only) delegation enforcement end-to-end (follow-up to #4016). Landing the bump on its own keeps that dependency/infra change reviewable in isolation, separate from the feature work.

Changes

• Cargo.toml: pocket-ic "9.0.2" → "15". This transitively bumps candid 0.10.20→0.10.31, ic-management-canister-types 0.3.3→0.5.0, and ic-transport-types 0.40→0.45 across the workspace (i.e. it touches the II canister's own dependency tree). The canister and the test framework compile with no code changes.
• demos/vc_issuer/Cargo.toml: same pocket-ic "9.0.2" → "15" bump (it pins pocket-ic directly and path-depends on canister_tests, so it must move in lockstep to avoid a two-version collision), plus the Cargo.lock refresh.
• scripts/test-canisters.sh: POCKET_IC_SERVER_VERSION 9.0.3 → 15.0.0 (same release-asset name; download mechanism unchanged).
• .github/workflows/canister-tests.yml: the two dfinity/pocketic action pins 9.0.3 → 15.0.0.
• Test adaptations for v15's cycle-funding behavior (v15 funds freshly-created canisters with a default balance; no production code is affected):
  • archive::should_expose_status: assert the status exposes a funded balance (> 0) instead of a hard-coded 0.
  • should_deploy_archive_with_cycles: assert the delta spent on archive creation (exactly canister_creation_cycles_cost) rather than an absolute, base-dependent post-deploy balance.
  • icrc3_test_vectors: also strip the environment-dependent top-level root_key_hex and canister_sig_pk_hex (the latter embeds the PocketIC-assigned canister id) before comparing. The deterministic message_hex / signed_message_hex bytes are byte-identical — no II-side change.

The E2E Playwright launcher pin (icp-cli-network-launcher v12, see the in-file comment about dfinity/ic#10226) is intentionally left untouched — that's a separate pocket-ic build used only by the browser suite.

Tests

• cargo check across internet_identity + canister_tests (incl. tests): clean, no porting needed.
• Full delegation integration suite (37 tests) passes locally against pocket-ic-server 15.0.0.
• The three adapted tests above pass locally against pocket-ic-server 15.0.0.
• CI runs the complete canister-tests suite on v15.

Note for the follow-up enforcement tests: round-tripping an II canister-signature delegation through the replica's ingress validation may interact with dfinity/ic#10226 (strict subnet_type cert check). That will be verified when the enforcement-test harness (make_live + ic-agent) is added.

🤖 Generated with Claude Code

https://claude.ai/code/session_018gHRjyFYqumMxAMwbPRLuN

---

Generated by Claude Code

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to ae37fd7.

Security Overview

• 🔎 Scanned files: 9 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/6d3e3b61-710b-4b2b-9c0b-43458b6314b6?scanId=eb5c4f05-1742-47e4-af3e-073f0848550e&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► .github/workflows/canister-tests.yml     Update PocketIC server version from 9.0.3 to 15.0.0 for tests
Enhancement	► scripts/test-canisters.sh     Set POCKET_IC_SERVER_VERSION to 15.0.0
Enhancement	► Cargo.lock     Bump dependencies: pocket-ic to 15.0.0; update related crates (candid, candid_derive, ic-management-canister-types, ic-transport-types, thiserror, thiserror-impl, tower-http, reqwest, etc.) accordingly
Enhancement	► Cargo.toml     Bump pocket-ic to 15; update related dependency versions
Enhancement	► demos/vc_issuer/Cargo.lock     Align with updated dependencies (candid/candid_derive to 0.10.31; pocket-ic to 15)
Enhancement	► demos/vc_issuer/Cargo.toml     Bump pocket-ic to 15
Enhancement	► src/archive/tests/tests.rs     Update test assertion to check for funded cycles rather than exact value
Enhancement	► src/internet_identity/tests/integration/archive_integration.rs     Add ARCHIVE_CREATION_CYCLES_COST constant and verify deployment spends expected cycles; adjust balance checks accordingly
Enhancement	► src/internet_identity/tests/integration/attributes.rs     Update vector normalization to strip unstable environment-dependent fields via strip_unstable()

[Copilot]

Pull request overview

Updates the project’s PocketIC-based integration-test harness to PocketIC v15 (server + Rust crate), and adjusts a few cycle- and snapshot-related assertions to account for v15’s environment-dependent outputs and default canister funding behavior.

Changes:

• Bump pocket-ic dependency (workspace + VC issuer demo) and refresh lockfiles.
• Update CI + scripts to install/run pocket-ic-server 15.0.0.
• Adapt a small set of integration tests to assert stable deltas/fields instead of environment-dependent absolute values.

Reviewed changes

Copilot reviewed 7 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
Cargo.toml	Bumps workspace pocket-ic dependency to major v15.
Cargo.lock	Lockfile refresh reflecting transitive dependency updates from PocketIC v15.
demos/vc_issuer/Cargo.toml	Bumps demo’s direct pocket-ic dependency to v15 to avoid multi-version conflicts.
demos/vc_issuer/Cargo.lock	Demo lockfile refresh for PocketIC v15 and transitive changes.
scripts/test-canisters.sh	Updates POCKET_IC_SERVER_VERSION to 15.0.0.
.github/workflows/canister-tests.yml	Updates GitHub Actions PocketIC server version pins to 15.0.0.
src/internet_identity/tests/integration/archive_integration.rs	Updates archive deployment cycle assertions to use a delta rather than an absolute balance.
src/archive/tests/tests.rs	Updates status test to assert non-zero cycles (PocketIC now funds new canisters).
src/internet_identity/tests/integration/attributes.rs	Makes ICRC-3 snapshot comparisons robust by stripping additional environment-dependent fields.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.