fix(ci): document eloqnt MIT exceptions and isolate A2A vitest

Clear two HARD base-reds on release/v3.8.51 (#12581): next-intl's
@eloqnt/* 0.0.x tarballs omit a license field (registry SPDX is MIT),
and the A2A lifecycle vitest no longer opens real SQLite via default
persistence.

changelog.d/fixes/12581-basereds-licenses-a2a-lifecycle.md

@@ -0,0 +1 @@
+- **fix(ci):** document MIT exceptions for `@eloqnt/{config,format-json,format-po}` (next-intl transitive; locked tarballs omit `license`) and keep the A2A lifecycle vitest off the real SQLite persistence seam ([#12581](https://github.com/diegosouzapw/OmniRoute/issues/12581))

config/quality/.license-allowlist.json

@@ -74,6 +74,24 @@
       "justification": "CC-BY-4.0 applies to the caniuse browser-support data (a dataset, not code). The Creative Commons Attribution license requires attribution when distributing — OmniRoute does not distribute caniuse-lite data directly to end users; it is consumed by browserslist/PostCSS at build time to generate CSS compatibility info. This is a widely accepted pattern in the Node.js ecosystem (caniuse-lite is in millions of projects). Attribution is satisfied by keeping the package in node_modules with its original license file.",
       "risk": "low",
       "reviewAt": "v4.0.0"
+    },
+    "@eloqnt/config": {
+      "license": "MIT",
+      "justification": "Transitive of next-intl (MIT). npm registry SPDX for the @eloqnt scope is MIT; @eloqnt/config@0.1.0 republished with license: MIT. The locked 0.0.2 tarball (next-intl's ^0.0.2 range, which is 0.0.x only) omits both package.json#license and a LICENSE file, so license-checker reports UNKNOWN. Same author (Jan Amann / amannn). OmniRoute does not modify the package. Re-review when next-intl bumps the range to a release that ships the license field.",
+      "risk": "low",
+      "reviewAt": "v4.0.0"
+    },
+    "@eloqnt/format-json": {
+      "license": "MIT",
+      "justification": "Same as @eloqnt/config: next-intl transitive, registry SPDX MIT, locked 0.0.3 tarball omits license field and LICENSE file so the checker reports UNKNOWN. Re-review with the next-intl range bump.",
+      "risk": "low",
+      "reviewAt": "v4.0.0"
+    },
+    "@eloqnt/format-po": {
+      "license": "MIT",
+      "justification": "Same as @eloqnt/config: next-intl transitive, registry SPDX MIT, locked 0.0.3 tarball omits license field and LICENSE file so the checker reports UNKNOWN. Re-review with the next-intl range bump.",
+      "risk": "low",
+      "reviewAt": "v4.0.0"
     }
   }
 }

open-sse/mcp-server/__tests__/a2aLifecycle.test.ts

@@ -1,11 +1,21 @@
 import { afterEach, describe, expect, it } from "vitest";
-import { A2ATaskManager } from "../../../src/lib/a2a/taskManager.ts";
+import { A2ATaskManager, type A2APersistence } from "../../../src/lib/a2a/taskManager.ts";
 import { executeA2ATaskWithState } from "../../../src/lib/a2a/taskExecution.ts";
 
 const managers: A2ATaskManager[] = [];
 
+// Default persistence opens SQLite (167 migrations) inside the vitest thread pool.
+// Tests inject a no-op so they never touch the DB (same seam as a2a-task-persistence.test.ts).
+function noopPersistence(): A2APersistence {
+  return {
+    upsert: (() => {}) as A2APersistence["upsert"],
+    appendEvent: (() => {}) as A2APersistence["appendEvent"],
+    purge: ((): number => 0) as A2APersistence["purge"],
+  };
+}
+
 function createManager(ttlMinutes = 5) {
-  const manager = new A2ATaskManager(ttlMinutes);
+  const manager = new A2ATaskManager(ttlMinutes, noopPersistence());
   managers.push(manager);
   return manager;
 }
@@ -44,9 +54,14 @@ describe("A2A task lifecycle regressions", () => {
     tm.updateTask(task.id, "working");
 
     await expect(
-      executeA2ATaskWithState(tm, task, async () => {
-        throw new Error("upstream failure");
-      })
+      executeA2ATaskWithState(
+        tm,
+        task,
+        async () => {
+          throw new Error("upstream failure");
+        },
+        { search: async () => [], appendEvent: () => {} }
+      )
     ).rejects.toThrow("upstream failure");
 
     const loaded = tm.getTask(task.id);

tests/unit/build/check-licenses.test.ts

@@ -330,3 +330,19 @@ test("integration: classifyLicense denies AGPL-3.0 against real allowlist", () =
   const result = classifyLicense("hypothetical-agpl@1.0.0", "AGPL-3.0", allowlist);
   assert.equal(result.status, "denied");
 });
+
+test("integration: @eloqnt/* UNKNOWN licenses are documented exceptions (next-intl transitive)", () => {
+  const allowlist = loadAllowlist();
+  for (const pkg of [
+    "@eloqnt/config@0.0.2",
+    "@eloqnt/format-json@0.0.3",
+    "@eloqnt/format-po@0.0.3",
+  ]) {
+    const result = classifyLicense(pkg, "UNKNOWN", allowlist);
+    assert.equal(
+      result.status,
+      "exception",
+      `${pkg} ships no license field; must be a documented exception, not allowed/denied`
+    );
+  }
+});