aaronrene / overseer-kit public
test_p_deploy_integrity.py python
98 lines 4.0 KB
Raw
sha256:0e9549ec7b463911bc08b7d586dc320b1ac9b1f5c943ee7e3865dcc6cb0f6f83 chore(governance): sync handover+roadmap to 84db8c8 (drift:… Human 2 days ago
1 """Data-integrity tests for P-deploy Mode C matching (§PD.9)."""
2
3 from __future__ import annotations
4
5 import json
6
7 from tests.fixtures.p_deploy import load_p_deploy_entry, seed_p_deploy_repo
8 from tools.honesty.ledger import append_entry, verify_ledger_file
9 from tools.honesty.status import HonestyStatusOptions, run_honesty_status
10 from tools.honesty.types import LedgerAppendOptions
11 from tools.honesty.validate import find_matching_deploy_health
12
13
14 def test_mode_c_match_depends_on_artifact_type_string(repo_root) -> None:
15 config = seed_p_deploy_repo(repo_root, require_deploy_health="require")
16 body = load_p_deploy_entry("verification-with-deploy-health.json")
17 append_entry(
18 config=config,
19 repo_root=repo_root,
20 options=LedgerAppendOptions(kind="verification_evidence", body=body),
21 )
22 ledger = repo_root / ".overseer" / "honesty" / "VERDICT-LEDGER.jsonl"
23 text = ledger.read_text(encoding="utf-8")
24 # Tamper type after write — breaks hash chain (22) OR if we only read raw for match, fail match.
25 lines = text.strip().splitlines()
26 last = json.loads(lines[-1])
27 last["artifacts"][1]["type"] = "screenshot"
28 # Keep entry_hash stale so verify fails
29 lines[-1] = json.dumps(last, separators=(",", ":"), sort_keys=True)
30 ledger.write_text("\n".join(lines) + "\n", encoding="utf-8")
31 verify = verify_ledger_file(config=config, repo_root=repo_root)
32 assert verify.exit_code == 22
33
34
35 def test_tampered_deploy_health_sha256_breaks_verify(repo_root) -> None:
36 config = seed_p_deploy_repo(repo_root)
37 body = load_p_deploy_entry("verification-with-deploy-health.json")
38 append_entry(
39 config=config,
40 repo_root=repo_root,
41 options=LedgerAppendOptions(kind="verification_evidence", body=body),
42 )
43 ledger = repo_root / ".overseer" / "honesty" / "VERDICT-LEDGER.jsonl"
44 text = ledger.read_text(encoding="utf-8")
45 ledger.write_text(text.replace("dddddddd", "eeeeeeee", 1), encoding="utf-8")
46 verify = verify_ledger_file(config=config, repo_root=repo_root)
47 assert verify.exit_code == 22
48
49
50 def test_append_embeds_hashes_refs_only_no_health_body(repo_root) -> None:
51 config = seed_p_deploy_repo(repo_root)
52 health_path = repo_root / "artifacts" / "deploy-health.json"
53 raw = health_path.read_text(encoding="utf-8")
54 body = load_p_deploy_entry("verification-with-deploy-health.json")
55 append_entry(
56 config=config,
57 repo_root=repo_root,
58 options=LedgerAppendOptions(kind="verification_evidence", body=body),
59 )
60 ledger_text = (repo_root / ".overseer" / "honesty" / "VERDICT-LEDGER.jsonl").read_text(
61 encoding="utf-8"
62 )
63 assert '"status":"ok"' not in ledger_text
64 assert raw.strip() not in ledger_text
65
66
67 def test_type_mismatch_fails_mode_c_match_without_tamper(repo_root) -> None:
68 entry = load_p_deploy_entry("verification-with-deploy-health.json")
69 entry["artifacts"][1]["type"] = "screenshot"
70 assert (
71 find_matching_deploy_health(
72 [entry],
73 phase_id="Track P / P-deploy",
74 frozen_spec=None,
75 )
76 is None
77 )
78
79
80 def test_validation_failure_no_partial_write(repo_root) -> None:
81 config = seed_p_deploy_repo(repo_root)
82 ledger = repo_root / ".overseer" / "honesty" / "VERDICT-LEDGER.jsonl"
83 before = ledger.read_text(encoding="utf-8") if ledger.is_file() else ""
84 body = load_p_deploy_entry("verification-with-deploy-health.json")
85 body["artifacts"] = []
86 result = append_entry(
87 config=config,
88 repo_root=repo_root,
89 options=LedgerAppendOptions(kind="verification_evidence", body=body),
90 )
91 assert result.exit_code == 24
92 after = ledger.read_text(encoding="utf-8") if ledger.is_file() else ""
93 # genesis may auto-create; ensure no verification_evidence kind written
94 assert "deploy_health" not in after or before == after
95 if after != before:
96 # only genesis allowed
97 lines = [json.loads(line) for line in after.strip().splitlines()]
98 assert all(line.get("kind") == "genesis" for line in lines)
File History 1 commit
sha256:6abcf1fa82a7a621ccbc945f19acdba5bc0db54569599404a1452fb4a096a199 fix(ISR): default require_independent_second_reviewer to require Human minor ⚠ 2 days ago