aaronrene / overseer-kit public
test_p_evidence_integrity.py python
85 lines 3.3 KB
Raw
sha256:a78e7e5a8740e03315f325d19edeb3aa1b306b3337d04abbaa9a9e0f3bbeb7a1 docs: MuseHub-first before ISR #74 — staging solidify NEXT Human 9 hours ago
1 """Data-integrity tests for P-evidence ledger hashing (§PE.10)."""
2
3 from __future__ import annotations
4
5 import json
6
7 import pytest
8
9 from tests.fixtures.p_evidence import load_p_evidence_entry, seed_p_evidence_repo
10 from tools.honesty.ledger import append_entry, parse_append_body, verify_ledger_file
11 from tools.honesty.types import LedgerAppendOptions
12 from tools.honesty.validate import EntryValidationError, validate_append_body
13
14
15 def test_tampered_artifact_sha256_breaks_verify(repo_root) -> None:
16 config = seed_p_evidence_repo(repo_root)
17 body = load_p_evidence_entry("verification-evidence-pass.json")
18 append_entry(
19 config=config,
20 repo_root=repo_root,
21 options=LedgerAppendOptions(kind="verification_evidence", body=body),
22 )
23 ledger = repo_root / ".overseer" / "honesty" / "VERDICT-LEDGER.jsonl"
24 text = ledger.read_text(encoding="utf-8")
25 ledger.write_text(text.replace("bbbbbbbb", "cccccccc", 1), encoding="utf-8")
26 verify = verify_ledger_file(config=config, repo_root=repo_root)
27 assert verify.exit_code == 22
28
29
30 def test_append_does_not_embed_file_bytes(repo_root) -> None:
31 config = seed_p_evidence_repo(repo_root)
32 image = repo_root / "docs" / "archive" / "verify" / "p-evidence-status.png"
33 raw = image.read_bytes()
34 body = load_p_evidence_entry("verification-evidence-pass.json")
35 body["artifacts"].append(
36 {
37 "type": "screenshot",
38 "sha256": "c" * 64,
39 "ref": "docs/archive/verify/p-evidence-status.png",
40 }
41 )
42 append_entry(
43 config=config,
44 repo_root=repo_root,
45 options=LedgerAppendOptions(kind="verification_evidence", body=body),
46 )
47 ledger_text = (repo_root / ".overseer" / "honesty" / "VERDICT-LEDGER.jsonl").read_text(encoding="utf-8")
48 assert raw.hex() not in ledger_text
49 assert "PNG" not in ledger_text
50
51
52 def test_path_escape_append_file_refused(repo_root) -> None:
53 outside = repo_root.parent / "escaped.json"
54 outside.write_text(json.dumps(load_p_evidence_entry("verification-evidence-pass.json")), encoding="utf-8")
55 body, code, _ = parse_append_body(
56 repo_root=repo_root,
57 file_path=str(outside),
58 stdin_text=None,
59 )
60 assert code == 4
61
62
63 def test_validation_failure_no_partial_write(repo_root) -> None:
64 config = seed_p_evidence_repo(repo_root)
65 ledger = repo_root / ".overseer" / "honesty" / "VERDICT-LEDGER.jsonl"
66 before = ledger.read_text(encoding="utf-8") if ledger.is_file() else ""
67 body = load_p_evidence_entry("verification-evidence-pass.json")
68 body["artifacts"] = []
69 with pytest.raises(EntryValidationError):
70 validate_append_body(kind="verification_evidence", body=body)
71 after = ledger.read_text(encoding="utf-8") if ledger.is_file() else ""
72 assert after == before
73
74
75 def test_idempotent_verify(repo_root) -> None:
76 config = seed_p_evidence_repo(repo_root)
77 body = load_p_evidence_entry("verification-evidence-pass.json")
78 append_entry(
79 config=config,
80 repo_root=repo_root,
81 options=LedgerAppendOptions(kind="verification_evidence", body=body),
82 )
83 first = verify_ledger_file(config=config, repo_root=repo_root)
84 second = verify_ledger_file(config=config, repo_root=repo_root)
85 assert first.exit_code == second.exit_code == 0
File History 1 commit
sha256:a78e7e5a8740e03315f325d19edeb3aa1b306b3337d04abbaa9a9e0f3bbeb7a1 docs: MuseHub-first before ISR #74 — staging solidify NEXT Human 9 hours ago