genichin/gitea-agent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[verified] Bound evidence commands and reap process groups

Browse Source
This commit is contained in:
gitea-spec-agent
2026-10-11 07:56:25 +00:00
parent 6cb2317667
commit 18222f2ca8
9 changed files with 630 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
harness/tests/impl/test_evidence_manifest.py
+20 -8
View File
@@ -49,7 +49,7 @@ class EvidenceManifestTests(unittest.TestCase):
def plan(self, commands=None, **extra):
if commands is None:
commands = [{"id": "check", "purpose": "show input", "argv": ["git", "show", "HEAD:input.txt"], "expected_exit_code": 0, "claims": ["output"]}]
data = {"hash_paths": ["input.txt"], "commands": commands}
data = {"hash_paths": ["input.txt"], "commands": [dict({"timeout_seconds": 5}, **command) for command in commands]}
data.update(extra); p = self.artifacts / "plan.json"; p.write_text(json.dumps(data)); p.chmod(0o600); return p
def run_manifest(self, plan=None):
@@ -71,6 +71,9 @@ class EvidenceManifestTests(unittest.TestCase):
"/commands/0/output",
"/commands/0/started_at_utc",
"/commands/0/finished_at_utc",
"/commands/0/timeout_seconds",
"/commands/0/execution_status",
"/commands/0/termination",
],
)
self.assertEqual(manifest["files"][0]["sha256"], hashlib.sha256(b"hello\n").hexdigest())
@@ -115,9 +118,11 @@ class EvidenceManifestTests(unittest.TestCase):
"claims": ["bounded"],
}])
result = self.invoke("run", "--repo-root", self.repo, "--plan", plan.name, "--output", "overflow.json")
self.assertNotEqual(result.returncode, 0)
self.assertIn("exceeds max_output_bytes", result.stderr)
self.assertFalse((self.artifacts / "overflow.json").exists())
self.assertEqual(result.returncode, 1)
overflow = json.loads((self.artifacts / "overflow.json").read_text())
self.assertEqual(overflow["result"], "failure")
self.assertEqual(overflow["commands"][0]["execution_status"], "output_limit")
self.assertLessEqual(len(overflow["commands"][0]["output"].encode()), 16)
self.assertEqual(out.read_bytes(), prior)
def test_output_collision_and_password_argument_are_rejected(self):
@@ -231,12 +236,19 @@ class EvidenceManifestTests(unittest.TestCase):
obj["schema"]="evidence-manifest/v1"
del obj["artifact"]
obj["excluded_paths"]=["plan.json", "manifest.json"]
(self.repo / "plan.json").write_bytes((self.artifacts / "plan.json").read_bytes())
archived_plan=json.loads((self.artifacts / "plan.json").read_text())
archived_plan["commands"][0].pop("timeout_seconds", None)
(self.repo / "plan.json").write_text(json.dumps(archived_plan))
obj["plan"]["sha256"] = hashlib.sha256((self.repo / "plan.json").read_bytes()).hexdigest()
for key in ("timeout_seconds", "execution_status", "termination"):
obj["commands"][0].pop(key, None)
obj["claims"] = {key: pointers[:6] for key, pointers in obj["claims"].items()}
archived=self.repo / "manifest.json"
archived.write_text(json.dumps(obj, sort_keys=True, separators=(",", ":"), ensure_ascii=False)+"\n")
run_git(self.repo, "add", "plan.json", "manifest.json"); run_git(self.repo, "commit", "-qm", "historical evidence fixture")
before=archived.read_bytes()
self.assertEqual(self.invoke("validate-legacy", "--repo-root", self.repo, "--manifest", "manifest.json").returncode, 0)
archived_result = self.invoke("validate-legacy", "--repo-root", self.repo, "--manifest", "manifest.json")
self.assertEqual(archived_result.returncode, 0, archived_result.stderr)
self.assertEqual(archived.read_bytes(), before)
self.assertEqual(run_git(self.repo, "status", "--porcelain").stdout, "")
@@ -266,7 +278,7 @@ class ExternalEvidenceTests(unittest.TestCase):
run_git(self.repo, "add", "input.txt")
run_git(self.repo, "commit", "-qm", "initial")
self.plan = self.artifacts / "evidence-plan.json"
self.plan.write_text(json.dumps({"hash_paths": ["input.txt"], "commands": [{"id": "check", "argv": ["git", "show", "HEAD:input.txt"], "claims": ["output"]}]}))
self.plan.write_text(json.dumps({"hash_paths": ["input.txt"], "commands": [{"id": "check", "argv": ["git", "show", "HEAD:input.txt"], "timeout_seconds": 5, "claims": ["output"]}]}))
self.plan.chmod(0o600)
self.manifest = self.artifacts / "evidence-manifest.json"
@@ -459,7 +471,7 @@ class ExternalEvidenceTests(unittest.TestCase):
result = self.invoke("run", "--plan", self.plan.name, "--output", self.manifest.name)
self.assertEqual(result.returncode, 0, result.stderr)
data = json.loads(self.manifest.read_text())
self.assertEqual(data["schema"], "evidence-manifest/v2")
self.assertEqual(data["schema"], "evidence-manifest/v3")
self.assertEqual(data["source_revision"], head)
self.assertEqual(data["artifact"]["run_id"], "run-a")
self.assertEqual(data["artifact"]["issue"], 1)