diff --git a/.github/workflows/community-tooling799.yml b/.github/workflows/community-tooling799.yml index 2fed4190c8..b0e57b08cf 100644 --- a/.github/workflows/community-tooling799.yml +++ b/.github/workflows/community-tooling799.yml @@ -1,8 +1,8 @@ name: Community exact tooling and scoped audits on: workflow_dispatch: + # Keep these path-scoped checks available on contributor fork branches. push: - branches: [main] paths: - 'research/clifford-state-performance/**' - 'research/gram-prefix-performance/**' @@ -11,6 +11,10 @@ on: - 'research/sw4-owner-optimality/**' - 'research/pr695-digest-audit/**' - 'scripts/verify_pr_reconciliation.py' + - 'scripts/replay_historical_check.py' + - 'scripts/historical-ci-inputs/**' + - 'tests/test_pr_reconciliation.py' + - 'tests/test_historical_check.py' - 'tests/test_reconciliation_archive.py' - '.github/workflows/community-tooling799.yml' pull_request: @@ -22,6 +26,10 @@ on: - 'research/sw4-owner-optimality/**' - 'research/pr695-digest-audit/**' - 'scripts/verify_pr_reconciliation.py' + - 'scripts/replay_historical_check.py' + - 'scripts/historical-ci-inputs/**' + - 'tests/test_pr_reconciliation.py' + - 'tests/test_historical_check.py' - 'tests/test_reconciliation_archive.py' - '.github/workflows/community-tooling799.yml' permissions: @@ -53,6 +61,7 @@ jobs: - name: Current ledger and archive integrity controls run: | python -B scripts/verify_pr_reconciliation.py + python -B -m unittest discover -s tests -p 'test_historical_check.py' -v python -B -m unittest discover -s tests -p 'test_*reconciliation*.py' -v python -B -O -m unittest discover -s tests -p 'test_*reconciliation*.py' -v - run: git diff --exit-code diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml index 4446616e87..0b88bd2639 100644 --- a/.github/workflows/verify.yml +++ b/.github/workflows/verify.yml @@ -37,7 +37,8 @@ jobs: - name: Check arithmetic, source hashes, finite identities, and patches run: | if [ "${{ matrix.group }}" = clones ]; then - make skip-clones-verify split-skip-producer + python -B scripts/replay_historical_check.py skip-clones + make split-skip-producer python -B scripts/replay_historical_check.py split-skip else make verify-${{ matrix.group }} diff --git a/scripts/historical-ci-inputs/README.md b/scripts/historical-ci-inputs/README.md index c438694334..60fc82c1e2 100644 --- a/scripts/historical-ci-inputs/README.md +++ b/scripts/historical-ci-inputs/README.md @@ -3,7 +3,7 @@ These are exact Git blobs, not new source pins or changes to the selected result. The maintenance launcher `scripts/replay_historical_check.py` verifies each blob against its unchanged predecessor manifest, copies tracked working files into a -temporary tree, replaces just the declared historical input there, and executes +temporary tree, replaces only the declared historical inputs there, and executes the original checkers. It works with shallow CI checkouts and changes no live source file. The live Makefile must still preserve its entire authenticated historical prefix; appended targets are allowed, prefix mutations reject. All other inputs remain the current tracked working @@ -19,6 +19,16 @@ reproducibility gate as well as protecting the live checkout. | `Makefile` | `Makefile` | `b84ba67156a01f9c2cb34fe1e3cb1dcdeab00d9c` | `research/community-reconciliation92-audit/MANIFEST.json` | | `audit_fused_block.py` | `scripts/audit_fused_block.py` | `6e564879f51ae16f23d392e9e196c605f36d90df` | `research/split-skip/SOURCE.json` | +The split-skip replay restores all three exact helpers named by its unchanged +manifest: the fused-block snapshot above, the exclusion circuit preserved in +`research/exclusion-embedding-masks/baseline.py`, and the shared-point circuit +preserved in `research/shared-point-digest/baseline.py`. The latter two are +Wentao Li's retained baselines for the accepted support-mask and digest +optimizations. Both also match the PR53 parent `3ffd4021995c959ac02d12920e0279ae97dd03c7`. +Each replacement and reviewed live successor is independently authenticated; +missing pins, corrupted baselines, duplicate paths, untracked dependencies and +unknown live source changes reject before copying. No original checker is edited. + Use `python3 -B scripts/replay_historical_check.py r420` (add `--native` for C++17/Boost), `reconciliation92`, or `split-skip`. These check historical finite constructions/provenance; they do not recertify the current selected supplier or diff --git a/scripts/replay_historical_check.py b/scripts/replay_historical_check.py index ef23ca1a13..0f5f964395 100644 --- a/scripts/replay_historical_check.py +++ b/scripts/replay_historical_check.py @@ -48,6 +48,53 @@ } +# Keep PR53's frozen source pin intact while replaying against the reviewed +# successor of the faster exclusion support-mask checker. Original exact bytes +# are retained by the linked baseline package (Wentao Li / VictorLiwentao). +# Dennis with substantial OpenAI Codex assistance; Apache-2.0. +CONFIG['skip-clones'] = { + 'manifest': 'research/skip-clones/SOURCE.json', + 'field': 'files', + 'path': 'scripts/exclusion_circuit.py', + 'input_from_root': True, + 'input': 'research/exclusion-embedding-masks/baseline.py', + 'sha256': 'b253f9d7318becda1c1f3b24e2287ed44a9c27fcea00cf9d531afb950d0457a0', + 'accepted_live_sha256': [ + 'f9fbcd6e85e442cbd0926ac0887414e20735b2dc923d2d5822c803ceb46726d3', + ], + 'commands': [ + ['research/skip-clones/producer.py'], + ['research/skip-clones/witness.py', '--output', + 'research/skip-clones/certificate.json'], + ['-m', 'unittest', 'discover', '-s', 'tests', + '-p', 'test_skip_clones.py', '-v'], + ], +} +CONFIG['skip-clones-tests'] = { + **CONFIG['skip-clones'], + 'commands': [CONFIG['skip-clones']['commands'][-1]], +} + + +# The split-skip manifest binds three historical helpers. Restore each exact +# dependency, retaining Wentao Li's two optimized live successors unchanged. +CONFIG['split-skip']['accepted_live_sha256'] = [ + '6fe64f886309d9154e33a3d67a16e8714cebc424a7a248b3080f8cab7d94179b', +] +CONFIG['split-skip']['additional_inputs'] = [ + {**CONFIG['skip-clones'], 'manifest': 'research/split-skip/SOURCE.json'}, + { + 'manifest': 'research/split-skip/SOURCE.json', 'field': 'files', + 'path': 'scripts/shared_point_circuit.py', 'input_from_root': True, + 'input': 'research/shared-point-digest/baseline.py', + 'sha256': 'c9bb7a5df92d260a4e3ad532b53e26936730d7c93f7facfb0784957c1e81c8ba', + 'accepted_live_sha256': [ + 'f5abbf6d61f3c10349416a3e1a1ed038bbd1279ed223367f2df549de46dd7ea5', + ], + }, +] + + def require(condition, message): if not condition: raise ValueError(message) @@ -67,7 +114,13 @@ def authenticated_input(root, config, inputs=INPUTS): require(entry.get('representation') == 'bytes', 'Expected exact byte representation') entry = entry.get('sha256') require(entry == config['sha256'], 'Missing or changed predecessor source pin') - data = safe_path(inputs, config['input']).read_bytes() + # A replay must not hide an unrelated live source mutation. + if 'accepted_live_sha256' in config: + live = hashlib.sha256(safe_path(root, config['path']).read_bytes()).hexdigest() + require(live in (config['sha256'], *config['accepted_live_sha256']), + 'Unrecognized live source update: ' + config['path']) + input_root = root if config.get('input_from_root') else inputs + data = safe_path(input_root, config['input']).read_bytes() require(hashlib.sha256(data).hexdigest() == entry, 'Changed historical input') if config.get('preserve_prefix'): require(data.endswith(b'\n') and safe_path(root, config['path']).read_bytes().startswith(data), @@ -82,9 +135,16 @@ def tracked_paths(root): def materialize(root, destination, config, paths, inputs=INPUTS): """Copy tracked working bytes only; never share writable links with the checkout.""" - data = authenticated_input(root, config, inputs) - require(config['path'] in paths and config['manifest'] in paths, - 'Historical input or manifest is not tracked') + configurations = [config, *config.get('additional_inputs', [])] + replacements = {} + for entry in configurations: + require(entry['path'] not in replacements, 'Duplicate historical replacement') + data = authenticated_input(root, entry, inputs) + require(entry['path'] in paths and entry['manifest'] in paths, + 'Historical input or manifest is not tracked') + if entry.get('input_from_root'): + require(entry['input'] in paths, 'Historical baseline is not tracked') + replacements[entry['path']] = data require(not destination.exists(), 'Replay destination already exists') destination.mkdir(parents=True) expected = {} @@ -95,10 +155,12 @@ def materialize(root, destination, config, paths, inputs=INPUTS): target.parent.mkdir(parents=True, exist_ok=True) shutil.copyfile(source, target) expected[name] = hashlib.sha256(target.read_bytes()).hexdigest() - safe_path(destination, config['path']).write_bytes(data) - expected[config['path']] = config['sha256'] - # Authenticate again in the copied tree before executing any checker. - authenticated_input(destination, config, inputs) + for entry in configurations: + safe_path(destination, entry['path']).write_bytes(replacements[entry['path']]) + expected[entry['path']] = entry['sha256'] + # Authenticate every replacement again before executing any checker. + for entry in configurations: + authenticated_input(destination, entry, inputs) return expected diff --git a/scripts/run_isolated_tests.py b/scripts/run_isolated_tests.py index d95ff0740d..e923a69198 100644 --- a/scripts/run_isolated_tests.py +++ b/scripts/run_isolated_tests.py @@ -10,6 +10,8 @@ --workers controls the width). Every module keeps the exact sequential command and its captured stdout/stderr bytes are replayed in sorted module order, so the combined receipts match a sequential run module for module. +For PR53 skip-clones, the unchanged module command runs in a temporary +copy with its authenticated frozen source instead of the optimized successor. """ import argparse from concurrent.futures import ThreadPoolExecutor @@ -22,7 +24,7 @@ def module_command(python, tests_dir, name): - """The one command every module runs, unchanged from the sequential runner.""" + """Default unchanged command for a test module.""" return [python, '-m', 'unittest', 'discover', '-s', str(tests_dir), '-p', name, '-v'] @@ -45,7 +47,17 @@ def run_modules(files, python=None, tests_dir=None, cwd=None, workers=None): env.pop('PYTHONOPTIMIZE', None) def run_one(path): - result = subprocess.run(module_command(python, tests_dir, path.name), + command = module_command(python, tests_dir, path.name) + # Run this frozen package's original tests in its authenticated overlay. + # Other test modules continue to exercise the live checkout unchanged. + if (path.name == 'test_skip_clones.py' + and Path(tests_dir).resolve() == (ROOT / 'tests').resolve() + and Path(cwd).resolve() == ROOT.resolve() + and (ROOT / 'research/skip-clones/SOURCE.json').is_file() + and (ROOT / 'scripts/replay_historical_check.py').is_file()): + command = [python, '-B', str(ROOT / 'scripts/replay_historical_check.py'), + 'skip-clones-tests'] + result = subprocess.run(command, cwd=cwd, env=env, stdout=subprocess.PIPE, stderr=subprocess.PIPE) return path, result.returncode, result.stdout, result.stderr diff --git a/scripts/verify_pr_reconciliation.py b/scripts/verify_pr_reconciliation.py index de2a019067..d0a73966d1 100644 --- a/scripts/verify_pr_reconciliation.py +++ b/scripts/verify_pr_reconciliation.py @@ -8,6 +8,8 @@ import tempfile import json import zipfile +import subprocess +import sys ROOT = Path(__file__).resolve().parents[1] AUDIT = ROOT / 'research/pr-reconciliation-20261012' @@ -33,6 +35,65 @@ def check_batch1047_file(item): require(original.endswith(b'\n') and current.startswith(original), 'Historical Makefile content changed') +def check_frontier890_file(item): + """Authenticate the exact spectrum pin refresh accepted in 02c46c7e. + + Preserve the frozen frontier890 receipt. Sagar Thakrar's refresh changed + only the single_intersection.py source digest in SOURCE.json and RESULT.json; + every other byte, including all 41 mathematical cases, must still match. + Dennis with substantial OpenAI Codex assistance; Apache-2.0. + """ + name = item['integrated_path'] + current = (ROOT / name).read_bytes() + if hashlib.sha256(current).hexdigest() == item['integrated_sha256']: + return + predecessors = { + 'research/single-intersection-spectrum-audit/RESULT.json': + '9cb2210e148b2cce3fe59cf529fbf99f3b663dc7673db2e3969246595692f580', + 'research/single-intersection-spectrum-audit/SOURCE.json': + '610fb9887add31b4f597a39dc58b3beff0e14c91a5fd7ee340c3b2e7d4b0fb4c', + } + require(name in predecessors and item['integrated_sha256'] == predecessors[name], + 'Changed integrated file: ' + name) + old = b'08ddae46e5621a5b4c525b504e67ae655abe9b49461d894feaa7abc89a51847d' + new = b'6874d41b75590369182ed61e0c6da5b547e035e0e43b50ea2b39e1f3861dca6d' + source = 'scripts/experiments/single_intersection.py' + require(hashlib.sha256((ROOT / source).read_bytes()).hexdigest().encode() == new, + 'Changed spectrum successor source') + require(json.loads(current)['source_sha256'][source].encode() == new + and current.count(new) == 1, 'Changed spectrum source pin') + require(hashlib.sha256(current.replace(new, old)).hexdigest() == predecessors[name], + 'Changed spectrum evidence beyond the accepted source pin') + + +def check_batch932_file(item): + """Bind exact assertion-safety and historical replay runner successors. + + Credit woklerx for keeping assertions enabled in child research processes. + These two exact successor blobs are an explicit maintenance adaptation, + not permission to change any other bytes or the frozen batch932 receipt. + Also authenticate the exact PR53 replay adapter and its test from c58c1778; + this extension retains the earlier assertion guard and every module. + """ + name = item['integrated_path'] + digest = hashlib.sha256((ROOT / name).read_bytes()).hexdigest() + if digest == item['integrated_sha256']: + return + successors = { + 'scripts/run_isolated_tests.py': ( + '96ea543e6c707424afe247e77bd86c82152f90fc76a0773c4232145da5cdf8d1', + ('b1c645e815a6abfbfdc2d77c4121c543ed0ca958095e97e1181d64e84cac0ed8', + '05839996482058359b2ab8087d7d96e76934bd03d79981df9b99447e8ed09331')), + 'tests/test_isolated_test_runner.py': ( + '628391b6abfbc8674ceec1751867a4392f2cc0b5b66886243e139af86cf355ac', + ('8262f36202e426b849a925123ff789843115d5e564962710c31ab14f84c88067', + '6f5ad20a5f174be0aab874cf524cba01c5401dafa46dd176999bad43ab566522')), + } + require(name in successors and successors[name][0] == item['integrated_sha256'] + and digest in successors[name][1], + 'Changed integrated file: ' + name) + + def check_family_decision(item, decision): """Bind projected ledger state to its authoritative, pinned family decision.""" fields = ('number', 'reviewed_head', 'current_head', 'disposition', @@ -416,8 +477,7 @@ def main(): if item['action'] == 'pending': require(not decision['review_completion']['changed_file_coverage'], 'Incomplete review') if item.get('integrated_sha256'): - require(hashlib.sha256((ROOT / item['integrated_path']).read_bytes()).hexdigest() - == item['integrated_sha256'], 'Changed integrated file: ' + item['integrated_path']) + check_frontier890_file(item) if item['action'] != 'retained': require(bool(item.get('reason')), 'Missing scope or adaptation reason') print('PASS frontier890 batch: reviewed sources, finite replays, scoped claims and closure bindings') @@ -444,8 +504,7 @@ def main(): if item['action'] == 'pending': require(not decision['review_completion']['changed_file_coverage'], 'Incomplete review') if item.get('integrated_sha256'): - require(hashlib.sha256((ROOT / item['integrated_path']).read_bytes()).hexdigest() - == item['integrated_sha256'], 'Changed integrated file: ' + item['integrated_path']) + check_batch932_file(item) if item['action'] != 'retained': require(bool(item.get('reason')), 'Missing scope or adaptation reason') print('PASS batch932 batch: reviewed sources, finite replays, scoped claims and closure bindings') @@ -573,7 +632,10 @@ def main(): runpy.run_path(str(historical_five), run_name='__main__') reconciliation92 = ROOT / 'research/community-reconciliation92-audit/verify.py' if reconciliation92.exists(): - runpy.run_path(str(reconciliation92), run_name='__main__') + # The original checker binds the pre-PR154 Makefile. Reuse the + # authenticated isolated replay rather than weakening that pin. + subprocess.run([sys.executable, '-B', str(ROOT / 'scripts/replay_historical_check.py'), + 'reconciliation92'], cwd=ROOT, check=True) third100 = ROOT / 'research/community-reconciliation-third100-audit/verify.py' if third100.exists(): runpy.run_path(str(third100), run_name='__main__') diff --git a/tests/test_historical_check.py b/tests/test_historical_check.py index cc4921d825..0f9c8f732d 100644 --- a/tests/test_historical_check.py +++ b/tests/test_historical_check.py @@ -90,6 +90,96 @@ def test_makefile_append_is_allowed_but_original_prefix_mutation_rejects(self): with self.assertRaisesRegex(ValueError, 'prefix changed'): checker.authenticated_input(root, config, inputs) + def test_skip_clone_frozen_source_replay_binding(self): + config = checker.CONFIG['skip-clones'] + predecessor = (ROOT / config['input']).read_bytes() + pins = json.loads((ROOT / config['manifest']).read_bytes()) + self.assertEqual(hashlib.sha256(predecessor).hexdigest(), config['sha256']) + self.assertEqual(pins['files'][config['path']], config['sha256']) + self.assertEqual(checker.authenticated_input(ROOT, config), predecessor) + suite = checker.CONFIG['skip-clones-tests'] + self.assertEqual(suite['sha256'], config['sha256']) + self.assertEqual(suite['commands'], config['commands'][-1:]) + + def test_skip_clone_overlay_rejects_unknown_live_and_corrupt_baseline(self): + with tempfile.TemporaryDirectory() as td: + root, inputs, config, paths = self.fixture(td) + original = (inputs / 'old.txt').read_bytes() + (root / 'baseline.txt').write_bytes(original) + current = hashlib.sha256((root / 'input.txt').read_bytes()).hexdigest() + config.update(input='baseline.txt', input_from_root=True, + accepted_live_sha256=[current]) + self.assertEqual(checker.authenticated_input(root, config, inputs), original) + (root / 'input.txt').write_bytes(b'unreviewed source edit\\n') + with self.assertRaisesRegex(ValueError, 'Unrecognized live source update'): + checker.authenticated_input(root, config, inputs) + (root / 'input.txt').write_bytes(original) + self.assertEqual(checker.authenticated_input(root, config, inputs), original) + (root / 'baseline.txt').write_bytes(b'changed frozen evidence\\n') + with self.assertRaisesRegex(ValueError, 'Changed historical input'): + checker.authenticated_input(root, config, inputs) + + def multi_fixture(self, temporary): + root, inputs, config, paths = self.fixture(temporary) + original = b'second historical dependency\n' + (inputs / 'second.txt').write_bytes(original) + (root / 'second.py').write_bytes(b'current optimized dependency\n') + digest = hashlib.sha256(original).hexdigest() + pins = json.loads((root / 'manifest.json').read_bytes()) + pins['files']['second.py'] = digest + (root / 'manifest.json').write_text(json.dumps(pins)) + config['additional_inputs'] = [dict( + manifest='manifest.json', field='files', path='second.py', + input='second.txt', sha256=digest)] + return root, inputs, config, paths + ['second.py'] + + def test_multiple_overlays_preserve_live_bytes_and_each_output_gate(self): + with tempfile.TemporaryDirectory() as td: + root, inputs, config, paths = self.multi_fixture(td) + before = {name: (root / name).read_bytes() for name in paths} + target = Path(td) / 'copy' + expected = checker.materialize(root, target, config, paths, inputs) + self.assertEqual((target / 'input.txt').read_bytes(), (inputs / 'old.txt').read_bytes()) + self.assertEqual((target / 'second.py').read_bytes(), (inputs / 'second.txt').read_bytes()) + checker.verify_unchanged(target, expected) + for name in ('input.txt', 'second.py', 'unrelated.py'): + original = (target / name).read_bytes() + (target / name).write_bytes(original + b'corruption') + with self.subTest(path=name), self.assertRaisesRegex(ValueError, 'Replay changed'): + checker.verify_unchanged(target, expected) + (target / name).write_bytes(original) + self.assertEqual({name: (root / name).read_bytes() for name in paths}, before) + + def test_corrupt_additional_input_rejects_before_copy(self): + with tempfile.TemporaryDirectory() as td: + root, inputs, config, paths = self.multi_fixture(td) + (inputs / 'second.txt').write_bytes(b'corrupt baseline') + target = Path(td) / 'copy' + with self.assertRaisesRegex(ValueError, 'Changed historical input'): + checker.materialize(root, target, config, paths, inputs) + self.assertFalse(target.exists()) + + def test_duplicate_and_untracked_dependencies_reject_before_copy(self): + with tempfile.TemporaryDirectory() as td: + root, inputs, config, paths = self.multi_fixture(td) + target = Path(td) / 'copy' + with self.assertRaisesRegex(ValueError, 'not tracked'): + checker.materialize(root, target, config, paths[:-1], inputs) + config['additional_inputs'].append(dict(config['additional_inputs'][0])) + with self.assertRaisesRegex(ValueError, 'Duplicate'): + checker.materialize(root, target, config, paths, inputs) + self.assertFalse(target.exists()) + + def test_all_split_skip_dependencies_match_frozen_manifest(self): + config = checker.CONFIG['split-skip'] + entries = [config, *config['additional_inputs']] + self.assertEqual({entry['path'] for entry in entries}, { + 'scripts/audit_fused_block.py', 'scripts/exclusion_circuit.py', + 'scripts/shared_point_circuit.py'}) + for entry in entries: + with self.subTest(path=entry['path']): + checker.authenticated_input(ROOT, entry) + def test_real_snapshots_match_unchanged_predecessor_pins(self): for name, config in checker.CONFIG.items(): with self.subTest(package=name): diff --git a/tests/test_isolated_test_runner.py b/tests/test_isolated_test_runner.py index 18ff944711..d1fae1fdee 100644 --- a/tests/test_isolated_test_runner.py +++ b/tests/test_isolated_test_runner.py @@ -131,6 +131,14 @@ def test_default_invocation_keeps_receipt_and_summary(self): self.assertFalse(any(line.startswith('PASS all') for line in lines)) self.assertIn('Failed modules: test_b_fail.py', result.stderr.decode()) + def test_same_named_synthetic_clone_test_still_fails(self): + # A name alone must not trigger the production historical overlay. + box = self.sandbox({'test_skip_clones.py': FAIL_MODULE}) + result = box.run('--workers', '1') + self.assertNotEqual(result.returncode, 0) + self.assertIn('deliberate negative control', result.stderr.decode()) + self.assertIn('Failed modules: test_skip_clones.py', result.stderr.decode()) + def test_inherited_optimization_cannot_hide_verifier_assertions(self): # Research tests call verifiers that still use Python assert. The # outer runner itself may be optimized, but its checks must not be. diff --git a/tests/test_pr_reconciliation.py b/tests/test_pr_reconciliation.py index db6b7a2ac2..91fe99956e 100644 --- a/tests/test_pr_reconciliation.py +++ b/tests/test_pr_reconciliation.py @@ -121,6 +121,123 @@ def read_text(path, *args, **kwargs): checker.main() +class SpectrumRefresh(unittest.TestCase): + def setUp(self): + coverage = json.loads((ROOT / 'research/community-frontier890-audit/CONTENT-COVERAGE.json').read_bytes()) + self.items = [deepcopy(item) for row in coverage['pull_requests'].values() + for item in row['files'] if item.get('integrated_path') in { + 'research/single-intersection-spectrum-audit/RESULT.json', + 'research/single-intersection-spectrum-audit/SOURCE.json'}] + self.old = b'08ddae46e5621a5b4c525b504e67ae655abe9b49461d894feaa7abc89a51847d' + self.new = b'6874d41b75590369182ed61e0c6da5b547e035e0e43b50ea2b39e1f3861dca6d' + + def test_exact_accepted_refresh_and_original_bytes_pass(self): + self.assertEqual(len(self.items), 2) + for item in self.items: + checker.check_frontier890_file(item) + current = (ROOT / item['integrated_path']).read_bytes() + original = current.replace(self.new, self.old) + self.assertEqual(sha256(original).hexdigest(), item['integrated_sha256']) + with patch.object(Path, 'read_bytes', return_value=original): + checker.check_frontier890_file(item) + + def test_any_other_proof_or_metadata_edit_is_rejected(self): + for item in self.items: + current = (ROOT / item['integrated_path']).read_bytes() + for mutated in (current.replace(b'"assignment_seed": 65', b'"assignment_seed": 66'), + current + b' ', current.replace(self.new, b'0' * 64), + current + self.new): + self.assertNotEqual(mutated, current) + original_read = Path.read_bytes + def read(path): + return mutated if path == ROOT / item['integrated_path'] else original_read(path) + with patch.object(Path, 'read_bytes', read), self.assertRaises(ValueError): + checker.check_frontier890_file(item) + + def test_changed_mathematical_case_is_rejected(self): + item = next(item for item in self.items if item['integrated_path'].endswith('RESULT.json')) + current = (ROOT / item['integrated_path']).read_bytes() + mutated = current.replace(b'"binary_rank": 3,', b'"binary_rank": 4,', 1) + self.assertNotEqual(current, mutated) + original_read = Path.read_bytes + def read(path): + return mutated if path == ROOT / item['integrated_path'] else original_read(path) + with patch.object(Path, 'read_bytes', read), self.assertRaisesRegex(ValueError, 'beyond'): + checker.check_frontier890_file(item) + + def test_forged_historical_pin_is_rejected(self): + for item in self.items: + item['integrated_sha256'] = '0' * 64 + with self.assertRaisesRegex(ValueError, 'Changed integrated file'): + checker.check_frontier890_file(item) + + def test_successor_helper_drift_is_rejected(self): + original_read = Path.read_bytes + def read(path): + return b'changed helper' if path == ROOT / 'scripts/experiments/single_intersection.py' else original_read(path) + with patch.object(Path, 'read_bytes', read): + for item in self.items: + with self.assertRaisesRegex(ValueError, 'Changed spectrum successor source'): + checker.check_frontier890_file(item) + + def test_unrelated_file_changes_still_fail(self): + item = {'integrated_path': 'CONTRIBUTING.md', 'integrated_sha256': '0' * 64} + with self.assertRaisesRegex(ValueError, 'Changed integrated file'): + checker.check_frontier890_file(item) + + +class AssertionSafetyRefresh(unittest.TestCase): + def setUp(self): + coverage = json.loads((ROOT / 'research/community-batch932-audit/CONTENT-COVERAGE.json').read_bytes()) + self.items = [deepcopy(item) for row in coverage['pull_requests'].values() + for item in row['files'] if item.get('integrated_path') in { + 'scripts/run_isolated_tests.py', 'tests/test_isolated_test_runner.py'}] + + def test_exact_accepted_successors_pass(self): + self.assertEqual(len(self.items), 2) + for item in self.items: + checker.check_batch932_file(item) + + def test_historical_adapter_cannot_be_disabled(self): + item = next(item for item in self.items if item['integrated_path'].startswith('scripts/')) + current = (ROOT / item['integrated_path']).read_bytes() + mutated = current.replace(b"path.name == 'test_skip_clones.py'", b'False') + self.assertNotEqual(current, mutated) + original_read = Path.read_bytes + def read(path): + return mutated if path == ROOT / item['integrated_path'] else original_read(path) + with patch.object(Path, 'read_bytes', read), self.assertRaises(ValueError): + checker.check_batch932_file(item) + + def test_assertion_guard_removal_and_other_byte_edits_fail(self): + original_read = Path.read_bytes + for item in self.items: + current = (ROOT / item['integrated_path']).read_bytes() + mutations = [current + b' '] + if item['integrated_path'].startswith('scripts/'): + mutations.append(current.replace(b"env.pop('PYTHONOPTIMIZE', None)", b'pass')) + for mutated in mutations: + self.assertNotEqual(current, mutated) + def read(path): + return mutated if path == ROOT / item['integrated_path'] else original_read(path) + with patch.object(Path, 'read_bytes', read), self.assertRaises(ValueError): + checker.check_batch932_file(item) + + def test_forged_predecessor_and_cross_file_successor_fail(self): + for item in self.items: + item['integrated_sha256'] = '0' * 64 + with self.assertRaises(ValueError): + checker.check_batch932_file(item) + other = (ROOT / self.items[1]['integrated_path']).read_bytes() + with patch.object(Path, 'read_bytes', return_value=other), self.assertRaises(ValueError): + checker.check_batch932_file(self.items[0]) + + def test_unrelated_file_still_needs_exact_bytes(self): + item = {'integrated_path': 'CONTRIBUTING.md', 'integrated_sha256': '0' * 64} + with self.assertRaises(ValueError): + checker.check_batch932_file(item) + + class ReviewCompletion(unittest.TestCase): def setUp(self): self.decision = {