aaronrene / overseer-kit public
test_isr_integrity.py python
104 lines 3.6 KB
Raw
sha256:0e9549ec7b463911bc08b7d586dc320b1ac9b1f5c943ee7e3865dcc6cb0f6f83 chore(governance): sync handover+roadmap to 84db8c8 (drift:… Human 10 hours ago
1 """Data-integrity tests for ISR ledger hashing (§ISR.11)."""
2
3 from __future__ import annotations
4
5 import pytest
6
7 from tests.fixtures.isr import load_isr_entry, seed_isr_repo
8 from tools.honesty.canonical import compute_entry_hash
9 from tools.honesty.ledger import append_entry, verify_ledger_file
10 from tools.honesty.status import HonestyStatusOptions, run_honesty_status
11 from tools.honesty.types import LedgerAppendOptions
12 from tools.honesty.validate import EntryValidationError, validate_append_body
13
14
15 def test_tamper_producer_session_breaks_verify(repo_root) -> None:
16 config = seed_isr_repo(repo_root)
17 body = load_isr_entry("isr-pass.json")
18 append_entry(
19 config=config,
20 repo_root=repo_root,
21 options=LedgerAppendOptions(kind="independent_second_review", body=body),
22 )
23 ledger = repo_root / ".overseer" / "honesty" / "VERDICT-LEDGER.jsonl"
24 text = ledger.read_text(encoding="utf-8")
25 ledger.write_text(
26 text.replace("builder-chat-1", "tampered-builder", 1),
27 encoding="utf-8",
28 )
29 assert verify_ledger_file(config=config, repo_root=repo_root).exit_code == 22
30
31
32 def test_canonical_hash_includes_isr_fields() -> None:
33 base = {
34 "v": 1,
35 "kind": "independent_second_review",
36 "actor_session_id": "v1",
37 "producer_session_id": "p1",
38 "isr_verdict": "pass",
39 }
40 h1 = compute_entry_hash(base)
41 h2 = compute_entry_hash({**base, "isr_verdict": "findings"})
42 h3 = compute_entry_hash({**base, "producer_session_id": "p2"})
43 assert h1 != h2
44 assert h1 != h3
45
46
47 def test_append_does_not_embed_chat_transcript(repo_root) -> None:
48 config = seed_isr_repo(repo_root)
49 body = load_isr_entry("isr-pass.json")
50 body["notes"] = "summary only — no full transcript"
51 append_entry(
52 config=config,
53 repo_root=repo_root,
54 options=LedgerAppendOptions(kind="independent_second_review", body=body),
55 )
56 ledger_text = (
57 repo_root / ".overseer" / "honesty" / "VERDICT-LEDGER.jsonl"
58 ).read_text(encoding="utf-8")
59 assert "Human:" not in ledger_text
60 assert "```python" not in ledger_text
61
62
63 def test_validate_fail_writes_nothing(repo_root) -> None:
64 seed_isr_repo(repo_root)
65 ledger = repo_root / ".overseer" / "honesty" / "VERDICT-LEDGER.jsonl"
66 before = ledger.read_text(encoding="utf-8") if ledger.is_file() else ""
67 body = load_isr_entry("isr-pass.json")
68 body["isr_verdict"] = "nope"
69 with pytest.raises(EntryValidationError):
70 validate_append_body(kind="independent_second_review", body=body)
71 after = ledger.read_text(encoding="utf-8") if ledger.is_file() else ""
72 assert after == before
73
74
75 def test_mode_d_omit_vs_pin_does_not_rewrite_ledger(repo_root) -> None:
76 config = seed_isr_repo(repo_root, require_independent_second_reviewer="require")
77 body = load_isr_entry("isr-pass.json")
78 append_entry(
79 config=config,
80 repo_root=repo_root,
81 options=LedgerAppendOptions(kind="independent_second_review", body=body),
82 )
83 ledger = repo_root / ".overseer" / "honesty" / "VERDICT-LEDGER.jsonl"
84 before = ledger.read_text(encoding="utf-8")
85 run_honesty_status(
86 config=config,
87 repo_root=repo_root,
88 options=HonestyStatusOptions(
89 hook=None,
90 artifact=None,
91 independent_second_review="ISR-b",
92 ),
93 )
94 run_honesty_status(
95 config=config,
96 repo_root=repo_root,
97 options=HonestyStatusOptions(
98 hook=None,
99 artifact=None,
100 independent_second_review="ISR-b",
101 producer_session="builder-chat-1",
102 ),
103 )
104 assert ledger.read_text(encoding="utf-8") == before
File History 1 commit
sha256:6abcf1fa82a7a621ccbc945f19acdba5bc0db54569599404a1452fb4a096a199 fix(ISR): default require_independent_second_reviewer to require Human minor ⚠ 10 hours ago