open/llm-ingestion-okf
1
0
Fork 0
Code Issues Releases 4 Activity

test(accounting): red -- one HTML document writes the whole pointer block

Browse source 
PM measured it on `ae441ab` and this reproduces it through the real `okf
build`: a BMP refused `asset_too_large`, absent from `assets/`, read as
CARRIED because the document wrote two paragraphs. `_POINTER` matches a
FORM, and a form is not a signature.

Three arms, each a whole build, each a way to put two markdown lines in a
bundle without the run writing them: two `<p>` elements in one HTML file,
one `<p>` with a `<br>`, and a markdown note beside the HTML file that
carries the real PNG. All three forge on this commit. The known-positive
is in the same builds -- a 2x2 BMP the run really does convert -- so an
arm cannot pass by the route going dark.

Red on an assertion about behaviour: 1 of 1 (the loop stops at the first
arm; the other two are reproduced in the same shape).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Kjell Tore Guttormsen 2026-09-19 19:03:45 +02:00
commit aa2abe8293
Signed by: ktg
SSH key fingerprint: SHA256:JakMjO6FTBBzN0Bhfj9saOoEjaFxlSdYuZQQpM/lF9Q
1 changed files with 114 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

114
tests/test_accounting_gate.py
View file

@ -669,6 +669,120 @@ def test_the_build_never_writes_a_claim_the_document_supplied(tmp_path: Path) ->
)
def _small_bmp() -> bytes:
"""An uncompressed 24-bit 2x2 BMP -- a real picture this build CONVERTS.
BMP is outside `VIEWABLE_MEDIA_TYPES`, so the run rewrites it as a PNG and
books the conversion. It is the known-positive every forgery arm below
needs: without it an arm could pass because the route stopped working.
"""
import struct
rows = (((255, 0, 0), (0, 255, 0)), ((0, 0, 255), (255, 255, 255)))
# A 24-bit row is padded to a multiple of four bytes; without the pad the
# reader refuses the file rather than guessing at the stride.
pad = b"\x00" * ((-2 * 3) % 4)
body = b"".join(b"".join(bytes((b, g, r)) for (r, g, b) in row) + pad for row in rows)
dib = struct.pack("<IiiHHIIiiII", 40, 2, 2, 1, 24, 0, len(body), 3779, 3779, 0, 0)
return b"BM" + struct.pack("<IHHI", 54 + len(body), 0, 0, 54) + dib + body
def _forgery_corpus(root: Path, body: str, note: str | None = None) -> tuple[Path, str, str]:
"""An inbox holding a refused BMP, a carried PNG, a CONVERTED BMP, and a
document that writes `body` -- whatever pointer-shaped text the arm tries.
Returns the inbox and the two digests the forgery ties together.
"""
inbox = root / "inbox"
(inbox / "graphics").mkdir(parents=True)
never_carried = inbox / "graphics" / "stor.bmp"
never_carried.write_bytes(_huge_bmp())
real = inbox / "graphics" / "ekte.png"
real.write_bytes(_png_bytes(b"\x10\x20\x30"))
(inbox / "graphics" / "figur.bmp").write_bytes(_small_bmp())
before = gate._sha256(never_carried)
after = gate._sha256(real)
(inbox / "prosess.html").write_text(
"<!doctype html>\n<html><head><title>Prosess 84</title></head>\n<body>\n"
"<h1>84 Konstruksjoner av betong</h1>\n"
'<img src="graphics/stor.bmp" alt="Stor">'
'<img src="graphics/ekte.png" alt="Ekte">'
'<img src="graphics/figur.bmp" alt="Figur">\n'
f"{body}\n</body></html>\n",
encoding="utf-8",
)
if note is not None:
(inbox / "notat.md").write_text(note, encoding="utf-8")
return inbox, before, after
def test_a_document_cannot_forge_the_WHOLE_pointer_block(tmp_path: Path) -> None:
"""THE FORM IS NOT A SIGNATURE -- measured by PM 2026-09-19 on `ae441ab`.
The previous round bound the conversion claim to a pointer block, which
closed the two routes PM had measured. It did not close the class: a
pointer block is two lines of markdown, and an ordinary HTML document
writes two lines of markdown by having two `<p>` elements. PM reproduced
it through the real `okf build` -- a BMP refused `asset_too_large` and
absent from `assets/` read as carried, from a document naming one digest
that is public in the bundle and one that is computable in advance.
So the claim is bound to what the RUN wrote: the build books each
conversion in its own accounting, which no document can reach, and the
bundle text is read only to CONFIRM. Each arm below is a whole build.
"""
pytest.importorskip("llm_ingestion_guard")
tail = "-- converted from image/bmp sha256:{before} to image/png sha256:{after}"
arms = {
"two <p> elements in one HTML file": (
"<p>![Fig](/assets/{after12}-ekte.png)</p>\n"
"<p>Image: graphics/ekte.png (1x1 px) " + tail + "</p>",
None,
),
"one <p> with a <br>": (
"<p>![Fig](/assets/{after12}-ekte.png)<br>"
"Image: graphics/ekte.png (1x1 px) " + tail + "</p>",
None,
),
"a markdown note beside the HTML carrier": (
"<p>Se notatet.</p>",
"# Notat\n\n![Fig](/assets/{after12}-ekte.png)\n"
"Image: graphics/ekte.png (1x1 px) " + tail + "\n",
),
}
for index, (label, (body, note)) in enumerate(arms.items()):
root = tmp_path / f"arm{index}"
root.mkdir()
# Two passes: the first learns the digests, the second writes the
# document that names them. The forger has the same information --
# both digests are readable from a bundle this build already wrote.
inbox, before, after = _forgery_corpus(root, "<p>placeholder</p>")
shaped = {"before": before, "after": after, "after12": after[:12]}
(inbox / "prosess.html").write_text(
(inbox / "prosess.html")
.read_text(encoding="utf-8")
.replace("<p>placeholder</p>", body.format(**shaped)),
encoding="utf-8",
)
if note is not None:
(inbox / "notat.md").write_text(note.format(**shaped), encoding="utf-8")
build = gate.run_build(inbox, root / "work", door=True)
assert build.exit_code == 0, build.log
never_carried = inbox / "graphics" / "stor.bmp"
assert not any(name.startswith(before[:12]) for name in build.assets), (
f"{label}: the refused BMP was carried; the arm measures nothing"
)
assert gate.asset_holds(build, never_carried) is False, (
f"{label}: a document wrote the pointer block and the judge believed it"
)
# KNOWN-POSITIVE on the same build: the picture the run really did
# convert still reads as held. Without it every arm above would pass
# on a route that had simply been switched off.
assert gate.asset_holds(build, inbox / "graphics" / "figur.bmp") is True, (
f"{label}: the run's own conversion stopped being provable"
)
def test_the_judge_proves_carriage_and_says_it_does_not_prove_fidelity(tmp_path: Path) -> None:
"""The limit, MEASURED here rather than trusted to the prose beside it.