aaronrene / overseer-kit public
test_provenance_e2e.py python
120 lines 4.2 KB
Raw
sha256:a78e7e5a8740e03315f325d19edeb3aa1b306b3337d04abbaa9a9e0f3bbeb7a1 docs: MuseHub-first before ISR #74 — staging solidify NEXT Human 10 hours ago
1 """End-to-end CLI tests for Track P / P1 provenance (§P0.8)."""
2
3 from __future__ import annotations
4
5 import json
6 from pathlib import Path
7
8 import yaml
9
10 from cli.kit_root import kit_root
11 from tests.support import (
12 attach_signed_provenance,
13 generate_ed25519_keypair,
14 git_status_runner,
15 honesty_artifact_hash,
16 load_honesty_entry,
17 run_cli,
18 seed_honesty_repo,
19 sign_append_body,
20 )
21 from tools.honesty.genesis import build_genesis_entry
22 from tools.honesty.ledger_io import serialize_entry
23
24
25 def _enable_muse_signature_requirement(tmp_path: Path) -> None:
26 cfg = tmp_path / ".overseer" / "config.yaml"
27 data = yaml.safe_load(cfg.read_text(encoding="utf-8"))
28 data["vcs"]["regime"] = "muse+git-mirror"
29 data["vcs"]["canonical"] = "muse"
30 data["vcs"]["muse"]["staging_remote"] = "staging"
31 data["vcs"]["muse"]["main_branch"] = "main"
32 data["vcs"]["git"]["mirror_branch"] = "muse-mirror"
33 data["honesty"]["require_agent_signature"] = True
34 cfg.write_text(yaml.safe_dump(data), encoding="utf-8")
35
36
37 def test_e2e_signed_verdict_and_verify_green(tmp_path: Path) -> None:
38 seed_honesty_repo(tmp_path)
39 genesis = build_genesis_entry(ts="2026-01-01T00:00:00Z")
40 ledger = tmp_path / ".overseer" / "honesty" / "VERDICT-LEDGER.jsonl"
41 ledger.parent.mkdir(parents=True, exist_ok=True)
42 ledger.write_text(serialize_entry(genesis), encoding="utf-8")
43 private_key, pubkey = generate_ed25519_keypair()
44 artifact_hash = honesty_artifact_hash(tmp_path)
45 body = load_honesty_entry(tmp_path, "verdict-pass.json", artifact_hash=artifact_hash)
46 body["ts"] = "2026-01-02T00:00:00Z"
47 body = attach_signed_provenance(body, pubkey_token=pubkey)
48 body = sign_append_body(
49 body,
50 kind="verdict",
51 prev_hash=genesis["entry_hash"],
52 private_key=private_key,
53 pubkey_token=pubkey,
54 )
55 payload = tmp_path / "payload.json"
56 payload.write_text(json.dumps(body), encoding="utf-8")
57 assert (
58 run_cli(
59 ["ledger", "append", "--kind", "verdict", "--file", "payload.json"],
60 cwd=tmp_path,
61 runner=git_status_runner(),
62 kit=kit_root(),
63 )
64 == 0
65 )
66 assert run_cli(["ledger", "verify"], cwd=tmp_path, runner=git_status_runner(), kit=kit_root()) == 0
67
68
69 def test_e2e_git_only_unsigned_cycle_still_green(tmp_path: Path) -> None:
70 seed_honesty_repo(tmp_path)
71 artifact_hash = honesty_artifact_hash(tmp_path)
72 body = load_honesty_entry(tmp_path, "verdict-pass.json", artifact_hash=artifact_hash)
73 body["provenance"] = {"agent_id": "cursor-agent", "model_id": "gpt-5.6"}
74 payload = tmp_path / "payload.json"
75 payload.write_text(json.dumps(body), encoding="utf-8")
76 assert (
77 run_cli(
78 ["ledger", "append", "--kind", "verdict", "--file", "payload.json"],
79 cwd=tmp_path,
80 runner=git_status_runner(),
81 kit=kit_root(),
82 )
83 == 0
84 )
85 assert (
86 run_cli(
87 ["honesty-status", "--hook", "handoff", "--artifact", "artifacts/sample.txt", "--json"],
88 cwd=tmp_path,
89 runner=git_status_runner(),
90 kit=kit_root(),
91 json_mode=True,
92 )
93 == 0
94 )
95
96
97 def test_e2e_git_only_require_agent_signature_config_exit_26(tmp_path: Path) -> None:
98 seed_honesty_repo(tmp_path)
99 cfg = tmp_path / ".overseer" / "config.yaml"
100 data = yaml.safe_load(cfg.read_text(encoding="utf-8"))
101 data["honesty"]["require_agent_signature"] = True
102 cfg.write_text(yaml.safe_dump(data), encoding="utf-8")
103 code = run_cli(["ledger", "verify"], cwd=tmp_path, runner=git_status_runner(), kit=kit_root())
104 assert code == 26
105
106
107 def test_e2e_muse_required_signature_unsigned_verdict_exit_26(tmp_path: Path) -> None:
108 seed_honesty_repo(tmp_path)
109 _enable_muse_signature_requirement(tmp_path)
110 artifact_hash = honesty_artifact_hash(tmp_path)
111 body = load_honesty_entry(tmp_path, "verdict-pass.json", artifact_hash=artifact_hash)
112 payload = tmp_path / "payload.json"
113 payload.write_text(json.dumps(body), encoding="utf-8")
114 code = run_cli(
115 ["ledger", "append", "--kind", "verdict", "--file", "payload.json"],
116 cwd=tmp_path,
117 runner=git_status_runner(),
118 kit=kit_root(),
119 )
120 assert code == 26
File History 2 commits
sha256:a78e7e5a8740e03315f325d19edeb3aa1b306b3337d04abbaa9a9e0f3bbeb7a1 docs: MuseHub-first before ISR #74 — staging solidify NEXT Human 10 hours ago
sha256:4671b7f787ddbe63ced31c895b688c77ab495653b65a730b423329f26b3c1439 feat: K1-P1 complete — agent provenance, build-verification… Sonnet 4.6 patch 52 days ago