portfolio-optimiser/tests/test_ingest_stamp_fail_closed_loadbearing.py

"""RED-FIRST: the ingest ownership stamp check must be FAIL-CLOSED on the *value*, not just on
field presence. Before this fix ``_carries_complete_ingest_stamp`` compared ``generated`` against
the single literal string ``"true"`` — a YAML-1.1 truthy form such as ``yes``/``on`` slipped the
gate open even though a real YAML reader reads it as boolean ``True`` (measured with PyYAML's
``safe_load`` core-schema resolver, the same resolver family ``ruamel``/most YAML tooling ships:
``yes``/``no``/``true``/``false``/``on``/``off``, any case, are read as bool; bare ``y``/``n`` and
``1``/``0`` are NOT — they resolve to string/int). ``okf.py`` stays a hand-rolled, PyYAML-free
line parser (D7 constraint), so the vocabulary is a plain literal set, not a real parser call."""

import pytest

from portfolio_optimiser import okf


def test_yaml_truthy_form_yes_is_recognized_as_the_stamp(tmp_path) -> None:
    """``generated: yes`` is read as boolean True by a real YAML reader, so it is the SAME stamp
    as ``generated: true`` and must be refused identically."""
    fm = {"type": "reference", "generated": "yes", "ingest_manifest": "bygg@0123456789abcdef"}
    with pytest.raises(okf.IngestStampError):
        okf.write_concept_file(str(tmp_path), "forged.md", fm, "body\n")
    assert not (tmp_path / "forged.md").exists()  # refused, not silently repaired


def test_yaml_truthy_form_on_mixed_case_is_recognized_as_the_stamp(tmp_path) -> None:
    """Case-insensitivity must hold for every truthy form, not only ``true``/``True``/``TRUE``."""
    fm = {"type": "reference", "generated": "On", "ingest_manifest": "bygg@0123456789abcdef"}
    with pytest.raises(okf.IngestStampError):
        okf.write_concept_file(str(tmp_path), "forged.md", fm, "body\n")
    assert not (tmp_path / "forged.md").exists()


def test_literal_true_still_refused_control(tmp_path) -> None:
    """Control: the literal the gate has always recognized must still raise — otherwise the two
    assertions above could pass against a gate that raises unconditionally, proving nothing."""
    fm = {"type": "reference", "generated": "true", "ingest_manifest": "bygg@0123456789abcdef"}
    with pytest.raises(okf.IngestStampError):
        okf.write_concept_file(str(tmp_path), "forged.md", fm, "body\n")
    assert not (tmp_path / "forged.md").exists()


def test_non_yaml_boolean_forms_are_not_treated_as_the_stamp(tmp_path) -> None:
    """``1`` and bare ``y`` are NOT read as boolean True by a real YAML reader (measured: PyYAML
    resolves them to int ``1`` and string ``"y"``, never bool) — widening the true-vocabulary to
    include them would over-block curated content no ingest pipeline ever produces, and no YAML
    reader would read as the stamp either. Both write through unchanged, same as any other
    unrecognized ``generated`` value paired with a manifest."""
    for value in ("1", "y", "maybe"):
        name = f"curated-{value}.md"
        okf.write_concept_file(
            str(tmp_path),
            name,
            {"type": "reference", "generated": value, "ingest_manifest": "bygg@0123456789abcdef"},
            "body\n",
        )
        assert (tmp_path / name).exists()


def test_half_stamp_remains_legal_generated_alone(tmp_path) -> None:
    """CLAUDE.md's ingest-stamp invariant: either half of the stamp alone is still legal curated
    content — even when that half is written in a non-``true`` truthy form."""
    okf.write_concept_file(str(tmp_path), "a.md", {"type": "reference", "generated": "yes"}, "b\n")
    assert (tmp_path / "a.md").exists()


def test_half_stamp_remains_legal_manifest_alone(tmp_path) -> None:
    okf.write_concept_file(
        str(tmp_path),
        "b.md",
        {"type": "reference", "ingest_manifest": "bygg@0123456789abcdef"},
        "c\n",
    )
    assert (tmp_path / "b.md").exists()


def test_unstamped_file_written_as_before(tmp_path) -> None:
    okf.write_concept_file(str(tmp_path), "c.md", {"type": "reference"}, "d\n")
    assert (tmp_path / "c.md").exists()


# --- P13b row 1: the V1 provenance form of the SAME stamp -------------------------------------
#
# RED-FIRST, measured 2026-09-12: ``llm-ingestion-okf`` v0.8.5 emits the ownership stamp as a flow
# MAPPING — ``generated: { by: process:okf-ingest, at: <ingested_at> }`` — where v0.3.2 emitted the
# literal ``true``. ``_YAML_TRUE_LITERALS`` cannot see that form (measured: ``True`` on the literal,
# ``False`` on the mapping), so the forgery refusal went INERT on exactly the form the pinned writer
# now produces, with this whole file GREEN. That is the trap this file's own docstring was written
# for, arriving by a spelling it did not anticipate.
#
# The predicate widens from "reads as boolean True" to "claims ingest ownership", of which the
# boolean is the pre-V1 spelling. The recogniser for the new half is ``decode_flow_value`` — the ONE
# decoder, the same argument ``write_concept_file`` already makes for ``verified``: the writer
# refuses exactly what the reader can read, and a second copy of the rule would be free to drift.

_V1_STAMP = "{ by: process:okf-ingest, at: 2026-07-03T12:00:00Z }"


def test_v1_flow_mapping_form_is_recognized_as_the_stamp(tmp_path) -> None:
    """The form okf >=0.8.5 actually emits, measured against the golden bundles it materialises."""
    fm = {"type": "reference", "generated": _V1_STAMP, "ingest_manifest": "bygg@0123456789abcdef"}
    with pytest.raises(okf.IngestStampError):
        okf.write_concept_file(str(tmp_path), "forged.md", fm, "body\n")
    assert not (tmp_path / "forged.md").exists()  # refused, not silently repaired


def test_v1_flow_sequence_form_is_recognized_too(tmp_path) -> None:
    """SPEC §5.2's one-element MUST reads a bare mapping as a one-element list, so the sequence
    spelling of the same claim cannot be the way past the gate. Fail-closed by construction."""
    fm = {
        "type": "reference",
        "generated": f"[{_V1_STAMP}]",
        "ingest_manifest": "bygg@0123456789abcdef",
    }
    with pytest.raises(okf.IngestStampError):
        okf.write_concept_file(str(tmp_path), "forged.md", fm, "body\n")
    assert not (tmp_path / "forged.md").exists()


def test_v1_half_stamp_remains_legal(tmp_path) -> None:
    """The half-stamp rule is UNCHANGED by the widening: a provenance mapping alone, with no
    manifest, is still legitimate curated content and is written."""
    okf.write_concept_file(
        str(tmp_path), "a.md", {"type": "reference", "generated": _V1_STAMP}, "b\n"
    )
    assert (tmp_path / "a.md").exists()


def test_an_undecodable_generated_value_is_not_the_stamp(tmp_path) -> None:
    """The discriminator that keeps the new half from collapsing into "any non-empty value": a
    ``generated`` the decoder REFUSES is not an ownership claim, so it writes through paired with a
    manifest exactly as ``1``/``y``/``maybe`` do above. Without this arm, a gate widened to
    ``bool(generated)`` would pass every arm in this file."""
    for value in ("{ broken", "[not-a-mapping]", "{ nosep }"):
        name = f"curated-{abs(hash(value))}.md"
        okf.write_concept_file(
            str(tmp_path),
            name,
            {"type": "reference", "generated": value, "ingest_manifest": "bygg@0123456789abcdef"},
            "body\n",
        )
        assert (tmp_path / name).exists()