test_gfg_d2_fail_closed.py
file-level
1
files
1
commits
0
hotspots
0
🧊 dead
0
💥 blast risk
| 1 | """Security: fail-closed on missing muse_commit_id; no optimistic aligned (§D2F.9).""" |
| 2 | |
| 3 | from __future__ import annotations |
| 4 | |
| 5 | from pathlib import Path |
| 6 | |
| 7 | from adapters.errors import ReadError |
| 8 | from tests.support import adapter_for, make_runner |
| 9 | |
| 10 | |
| 11 | def test_missing_muse_commit_id_is_read_error_not_git_sha( |
| 12 | muse_git_mirror_config, repo_root: Path |
| 13 | ) -> None: |
| 14 | muse = repo_root / ".muse" |
| 15 | muse.mkdir(parents=True) |
| 16 | (muse / "git-bridge.toml").write_text( |
| 17 | '[last_export]\ngit_sha = "' + ("a" * 40) + '"\n', |
| 18 | encoding="utf-8", |
| 19 | ) |
| 20 | adapter = adapter_for(muse_git_mirror_config, repo_root, make_runner({})) |
| 21 | result = adapter.read_canonical_anchor() |
| 22 | assert isinstance(result, ReadError) |
| 23 | assert "muse_commit_id" in str(result) |
| 24 | # Must not silently treat git_sha as aligned anchor |
| 25 | assert not hasattr(result, "anchor_sha") or getattr(result, "anchor_sha", None) is None |