test: harden G2 conformance invariants

crates/psyche-coven/src/port.rs

@@ -18,6 +18,7 @@ const EXECUTION_REQUEST_SCHEMA: &str = "psyche.execution_request.v1";
 const MAX_STRING_BYTES: usize = 255;
 const MAX_ARTIFACTS: usize = 1024;
 const MAX_SAFE_INTEGER: u64 = 9_007_199_254_740_991;
+const MAX_CONTENT_SIZE_BYTES: u64 = i64::MAX as u64;
 
 /// A capability that a Coven implementation may advertise.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
@@ -810,7 +811,8 @@ impl ContentAddressedReference {
     /// Validates metadata only; this does not attest payload bytes.
     pub fn validate(&self) -> Result<(), PortError> {
         validate_media_type(&self.media_type)?;
-        if self.size_bytes == 0 || self.size_bytes > MAX_SAFE_INTEGER || !utc(self.expires_at) {
+        if self.size_bytes == 0 || self.size_bytes > MAX_CONTENT_SIZE_BYTES || !utc(self.expires_at)
+        {
             return Err(PortError::InvalidRequest);
         }
         Ok(())

crates/psyche-coven/tests/bindings.rs

@@ -137,10 +137,10 @@ fn content_reference_rejects_digest_size_media_type_and_lifetime_mismatch() {
     zero.size_bytes = 0;
     assert!(zero.validate().is_err());
     let mut oversized = reference.clone();
-    oversized.size_bytes = 9_007_199_254_740_992;
+    oversized.size_bytes = (i64::MAX as u64) + 1;
     assert!(oversized.validate().is_err());
     let mut maximum = reference.clone();
-    maximum.size_bytes = 9_007_199_254_740_991;
+    maximum.size_bytes = i64::MAX as u64;
     maximum.validate().unwrap();
     let maximum: ContentAddressedReference =
         serde_json::from_value(serde_json::to_value(maximum).unwrap()).unwrap();

crates/psyche-test-support/src/lib.rs

@@ -19,7 +19,7 @@ pub use suites::{
     assert_c_s8_terminal_authority, assert_c_s9_cancellation_acknowledgement,
     assert_c_s10_result_artifact_binding, assert_c_s11_restart_persistence,
     assert_c_s12_structured_denial, assert_surface_unknown_delivery, scripted_fixture,
-    scripted_surface, unsupported_fixture,
+    scripted_fixture_with_session_id, scripted_surface, unsupported_fixture,
 };
 pub use surface::{
     FakeSurface, FakeSurfaceBuilder, SurfaceFakeBuildError, SurfaceFakeCall, SurfaceScriptReturn,