Kjell Tore Guttormsen
ed696d2650
_carries_complete_ingest_stamp sammenlignet generated kun mot literalen "true" og
feilet AAPENT: en pinnet ingest-writer som skrev "yes"/"on" ville sluppet det
komplette eierskaps-stempelet forbi write_concept_file uten en eneste lokal diff.
_YAML_TRUE_LITERALS ({"true","yes","on"}, case-insensitivt) er naa ENESTE vokabular,
malt mot PyYAML sin safe_load-resolver; "1"/bare "y"/"n" er bevisst utelatt siden en
YAML-leser aldri leser dem som bool. Halv-stempel forblir lovlig.
RED-foerst (tests/test_ingest_stamp_fail_closed_loadbearing.py), fire mutasjoner
alle roede mot hele suiten (904 passed/5 skipped): revert til literalen "true"
(2 roede) - over-widen til aa inkludere 1/y (1 roed) - and->or paa halv-stempel
(4 roede) - detach gaten helt (4 roede).
Ordre: 20260821T152153Z-432035430-from-portfolio-optimiser
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UhxZ7XNjAFHFenWX5j9pev
77 lines
3.9 KiB
Python
77 lines
3.9 KiB
Python
"""RED-FIRST: the ingest ownership stamp check must be FAIL-CLOSED on the *value*, not just on
|
|
field presence. Before this fix ``_carries_complete_ingest_stamp`` compared ``generated`` against
|
|
the single literal string ``"true"`` — a YAML-1.1 truthy form such as ``yes``/``on`` slipped the
|
|
gate open even though a real YAML reader reads it as boolean ``True`` (measured with PyYAML's
|
|
``safe_load`` core-schema resolver, the same resolver family ``ruamel``/most YAML tooling ships:
|
|
``yes``/``no``/``true``/``false``/``on``/``off``, any case, are read as bool; bare ``y``/``n`` and
|
|
``1``/``0`` are NOT — they resolve to string/int). ``okf.py`` stays a hand-rolled, PyYAML-free
|
|
line parser (D7 constraint), so the vocabulary is a plain literal set, not a real parser call."""
|
|
|
|
import pytest
|
|
|
|
from portfolio_optimiser import okf
|
|
|
|
|
|
def test_yaml_truthy_form_yes_is_recognized_as_the_stamp(tmp_path) -> None:
|
|
"""``generated: yes`` is read as boolean True by a real YAML reader, so it is the SAME stamp
|
|
as ``generated: true`` and must be refused identically."""
|
|
fm = {"type": "reference", "generated": "yes", "ingest_manifest": "bygg@0123456789abcdef"}
|
|
with pytest.raises(okf.IngestStampError):
|
|
okf.write_concept_file(str(tmp_path), "forged.md", fm, "body\n")
|
|
assert not (tmp_path / "forged.md").exists() # refused, not silently repaired
|
|
|
|
|
|
def test_yaml_truthy_form_on_mixed_case_is_recognized_as_the_stamp(tmp_path) -> None:
|
|
"""Case-insensitivity must hold for every truthy form, not only ``true``/``True``/``TRUE``."""
|
|
fm = {"type": "reference", "generated": "On", "ingest_manifest": "bygg@0123456789abcdef"}
|
|
with pytest.raises(okf.IngestStampError):
|
|
okf.write_concept_file(str(tmp_path), "forged.md", fm, "body\n")
|
|
assert not (tmp_path / "forged.md").exists()
|
|
|
|
|
|
def test_literal_true_still_refused_control(tmp_path) -> None:
|
|
"""Control: the literal the gate has always recognized must still raise — otherwise the two
|
|
assertions above could pass against a gate that raises unconditionally, proving nothing."""
|
|
fm = {"type": "reference", "generated": "true", "ingest_manifest": "bygg@0123456789abcdef"}
|
|
with pytest.raises(okf.IngestStampError):
|
|
okf.write_concept_file(str(tmp_path), "forged.md", fm, "body\n")
|
|
assert not (tmp_path / "forged.md").exists()
|
|
|
|
|
|
def test_non_yaml_boolean_forms_are_not_treated_as_the_stamp(tmp_path) -> None:
|
|
"""``1`` and bare ``y`` are NOT read as boolean True by a real YAML reader (measured: PyYAML
|
|
resolves them to int ``1`` and string ``"y"``, never bool) — widening the true-vocabulary to
|
|
include them would over-block curated content no ingest pipeline ever produces, and no YAML
|
|
reader would read as the stamp either. Both write through unchanged, same as any other
|
|
unrecognized ``generated`` value paired with a manifest."""
|
|
for value in ("1", "y", "maybe"):
|
|
name = f"curated-{value}.md"
|
|
okf.write_concept_file(
|
|
str(tmp_path),
|
|
name,
|
|
{"type": "reference", "generated": value, "ingest_manifest": "bygg@0123456789abcdef"},
|
|
"body\n",
|
|
)
|
|
assert (tmp_path / name).exists()
|
|
|
|
|
|
def test_half_stamp_remains_legal_generated_alone(tmp_path) -> None:
|
|
"""CLAUDE.md's ingest-stamp invariant: either half of the stamp alone is still legal curated
|
|
content — even when that half is written in a non-``true`` truthy form."""
|
|
okf.write_concept_file(str(tmp_path), "a.md", {"type": "reference", "generated": "yes"}, "b\n")
|
|
assert (tmp_path / "a.md").exists()
|
|
|
|
|
|
def test_half_stamp_remains_legal_manifest_alone(tmp_path) -> None:
|
|
okf.write_concept_file(
|
|
str(tmp_path),
|
|
"b.md",
|
|
{"type": "reference", "ingest_manifest": "bygg@0123456789abcdef"},
|
|
"c\n",
|
|
)
|
|
assert (tmp_path / "b.md").exists()
|
|
|
|
|
|
def test_unstamped_file_written_as_before(tmp_path) -> None:
|
|
okf.write_concept_file(str(tmp_path), "c.md", {"type": "reference"}, "d\n")
|
|
assert (tmp_path / "c.md").exists()
|