aaronrene / overseer-kit public
test_provenance_integration.py python
111 lines 4.2 KB
Raw
sha256:0e9549ec7b463911bc08b7d586dc320b1ac9b1f5c943ee7e3865dcc6cb0f6f83 chore(governance): sync handover+roadmap to 84db8c8 (drift:… Human 9 hours ago
1 """Integration tests for Track P / P1 provenance (§P0.8)."""
2
3 from __future__ import annotations
4
5 import yaml
6
7 from adapters.config import load_config
8 from tests.support import (
9 attach_signed_provenance,
10 generate_ed25519_keypair,
11 load_honesty_config,
12 load_honesty_entry,
13 sign_append_body,
14 )
15 from tools.honesty.genesis import build_genesis_entry
16 from tools.honesty.ledger import append_entry, verify_ledger_file
17 from tools.honesty.ledger_io import serialize_entry
18 from tools.honesty.types import LedgerAppendOptions
19
20
21 def _seed_genesis(repo_root, *, ts: str = "2026-01-01T00:00:00Z") -> dict:
22 genesis = build_genesis_entry(ts=ts)
23 ledger = repo_root / ".overseer" / "honesty" / "VERDICT-LEDGER.jsonl"
24 ledger.parent.mkdir(parents=True, exist_ok=True)
25 ledger.write_text(serialize_entry(genesis), encoding="utf-8")
26 return genesis
27
28
29 def test_append_with_soft_provenance(repo_root) -> None:
30 config = load_honesty_config(repo_root)
31 body = load_honesty_entry(repo_root, "verdict-pass.json")
32 body["provenance"] = {"agent_id": "cursor-agent", "model_id": "gpt-5.6"}
33 result = append_entry(
34 config=config,
35 repo_root=repo_root,
36 options=LedgerAppendOptions(kind="verdict", body=body),
37 )
38 assert result.exit_code == 0
39 assert verify_ledger_file(config=config, repo_root=repo_root).exit_code == 0
40
41
42 def test_append_with_signed_provenance(repo_root) -> None:
43 config = load_honesty_config(repo_root)
44 genesis = _seed_genesis(repo_root)
45 private_key, pubkey = generate_ed25519_keypair()
46 body = load_honesty_entry(repo_root, "verdict-pass.json")
47 body["ts"] = "2026-01-02T00:00:00Z"
48 body = attach_signed_provenance(body, pubkey_token=pubkey)
49 body = sign_append_body(
50 body,
51 kind="verdict",
52 prev_hash=genesis["entry_hash"],
53 private_key=private_key,
54 pubkey_token=pubkey,
55 )
56 result = append_entry(
57 config=config,
58 repo_root=repo_root,
59 options=LedgerAppendOptions(kind="verdict", body=body),
60 )
61 assert result.exit_code == 0
62 assert verify_ledger_file(config=config, repo_root=repo_root).exit_code == 0
63
64
65 def test_verify_bad_signature_exit_25(repo_root) -> None:
66 config = load_honesty_config(repo_root)
67 genesis = _seed_genesis(repo_root)
68 private_key, pubkey = generate_ed25519_keypair()
69 body = load_honesty_entry(repo_root, "verdict-pass.json")
70 body["ts"] = "2026-01-02T00:00:00Z"
71 body = attach_signed_provenance(body, pubkey_token=pubkey)
72 body = sign_append_body(
73 body,
74 kind="verdict",
75 prev_hash=genesis["entry_hash"],
76 private_key=private_key,
77 pubkey_token=pubkey,
78 )
79 append_entry(
80 config=config,
81 repo_root=repo_root,
82 options=LedgerAppendOptions(kind="verdict", body=body),
83 )
84 ledger = repo_root / ".overseer" / "honesty" / "VERDICT-LEDGER.jsonl"
85 lines = ledger.read_text(encoding="utf-8").strip().splitlines()
86 entry = __import__("json").loads(lines[-1])
87 entry["provenance"]["sig"] = "ed25519:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
88 lines[-1] = __import__("json").dumps(entry, ensure_ascii=False, separators=(",", ":"), sort_keys=True)
89 ledger.write_text("\n".join(lines) + "\n", encoding="utf-8")
90 assert verify_ledger_file(config=config, repo_root=repo_root).exit_code == 25
91
92
93 def test_require_agent_signature_gate_on_verdict(repo_root) -> None:
94 load_honesty_config(repo_root)
95 cfg = repo_root / ".overseer" / "config.yaml"
96 data = yaml.safe_load(cfg.read_text(encoding="utf-8"))
97 data["vcs"]["regime"] = "muse+git-mirror"
98 data["vcs"]["canonical"] = "muse"
99 data["vcs"]["muse"]["staging_remote"] = "staging"
100 data["vcs"]["muse"]["main_branch"] = "main"
101 data["vcs"]["git"]["mirror_branch"] = "muse-mirror"
102 data["honesty"]["require_agent_signature"] = True
103 cfg.write_text(yaml.safe_dump(data), encoding="utf-8")
104 config = load_config(cfg)
105 body = load_honesty_entry(repo_root, "verdict-pass.json")
106 result = append_entry(
107 config=config,
108 repo_root=repo_root,
109 options=LedgerAppendOptions(kind="verdict", body=body),
110 )
111 assert result.exit_code == 26
File History 1 commit
sha256:6abcf1fa82a7a621ccbc945f19acdba5bc0db54569599404a1452fb4a096a199 fix(ISR): default require_independent_second_reviewer to require Human minor ⚠ 9 hours ago