[verified] Enforce delegation adoption at runtime consumers

This commit is contained in:
2026-10-11 07:11:40 +00:00
parent 9367d5a3a1
commit 6cb2317667
19 changed files with 1112 additions and 47 deletions
+20 -20
View File
@@ -55,7 +55,7 @@ def publication_fixture():
'official': True, 'dismissed': False, 'stale': head != t['head'],
'submitted_at': old_time, 'updated_at': old_time, 'comments_count': 0,
'pull_request_url': url}
sr = review(9, p['spec_reviewer'], support.render_review(spec_result, {'src/a.py'}),
sr = review(9, p['spec_reviewer'], support.render_review(spec_result, {'src/a.py'}, declaration={'mode': 'none'}),
t['head'], 'APPROVED')
previous = review(8, p['reviewer'], 'old review body', 'd' * 40, 'REQUEST_CHANGES')
s = {'identity': copy.deepcopy(p['reviewer']), 'spec_user': copy.deepcopy(p['spec_reviewer']),
@@ -159,22 +159,22 @@ class NativeReviewTests(unittest.TestCase):
p, before, after, exact = publication_fixture()
api = FakeAPI(p, before, after, exact); lease = FakeLease()
with tempfile.TemporaryDirectory() as td:
result = m.publish(p, before, api, lease, td)
result = m.publish(p, before, api, lease, td, declaration={'mode': 'none'})
self.assertEqual(result['mode'], 'created')
self.assertEqual(api.posts, 1)
self.assertEqual(m.publish(p, before, api, lease, td)['mode'], 'no_op')
self.assertEqual(m.publish(p, before, api, lease, td, declaration={'mode': 'none'})['mode'], 'no_op')
self.assertEqual(api.posts, 1)
self.assertNotIn('body', json.loads((Path(td) / 'intent.json').read_text()))
for applies in [True, False]:
api = FakeAPI(p, before, after, exact); api.timeout = True; api.apply = applies
with self.subTest(applies=applies), tempfile.TemporaryDirectory() as td:
if applies:
self.assertEqual(m.publish(p, before, api, lease, td)['mode'], 'reconciled')
self.assertEqual(m.publish(p, before, api, lease, td)['mode'], 'no_op')
self.assertEqual(m.publish(p, before, api, lease, td, declaration={'mode': 'none'})['mode'], 'reconciled')
self.assertEqual(m.publish(p, before, api, lease, td, declaration={'mode': 'none'})['mode'], 'no_op')
else:
for _ in range(2):
with self.assertRaises(m.UncertainPublication) as error:
m.publish(p, before, api, lease, td)
m.publish(p, before, api, lease, td, declaration={'mode': 'none'})
self.assertNotIn('secret transport detail', str(error.exception))
self.assertEqual(api.posts, 1)
def test_api_adapter_checks_identity_first_and_collects_all_pages(self):
@@ -296,7 +296,7 @@ class NativeReviewTests(unittest.TestCase):
p['spec_paths'] = ['src/a.py', 'tests/existing.py']
spec_result = support.parse_review(before['reviews'][1]['body'], {'src/a.py'})
spec_result['criteria'][0]['test_paths'] = ['tests/existing.py']
before['reviews'][1]['body'] = support.render_review(spec_result, set(p['spec_paths']))
before['reviews'][1]['body'] = support.render_review(spec_result, set(p['spec_paths']), declaration={'mode': 'none'})
try:
m.validate_snapshot(p, before)
except m.ValidationError:
@@ -333,7 +333,7 @@ class NativeReviewTests(unittest.TestCase):
p, before, after, exact = publication_fixture(); api = FakeAPI(p, before, after, exact); lease = FakeLease()
if kind == 'expired': lease.valid = False
else: api.identity = lambda: p['spec_reviewer']
with self.assertRaises(m.ValidationError): m.publish(p, before, api, lease, td)
with self.assertRaises(m.ValidationError): m.publish(p, before, api, lease, td, declaration={'mode': 'none'})
self.assertEqual(api.posts, 0)
self.assertFalse((Path(td) / 'intent.json').exists())
@@ -348,7 +348,7 @@ class NativeReviewTests(unittest.TestCase):
with self.subTest(case=i), tempfile.TemporaryDirectory() as td:
p, before, after, exact = publication_fixture(); api = FakeAPI(p, copy.deepcopy(before), after, exact)
change(api.before)
with self.assertRaises(m.ValidationError): m.publish(p, before, api, FakeLease(), td)
with self.assertRaises(m.ValidationError): m.publish(p, before, api, FakeLease(), td, declaration={'mode': 'none'})
self.assertEqual(api.posts, 0)
def test_pagination_total_duplicate_and_truncation_are_hard_errors(self):
@@ -424,7 +424,7 @@ class NativeReviewTests(unittest.TestCase):
m = self.module(); p, before, after, exact = publication_fixture()
api = FakeAPI(p, before, after, exact); api.created = True
with tempfile.TemporaryDirectory() as td:
result = m.publish(p, after, api, FakeLease(), td)
result = m.publish(p, after, api, FakeLease(), td, declaration={'mode': 'none'})
self.assertEqual(result['mode'], 'no_op'); self.assertFalse(result['wrote'])
self.assertEqual(api.posts, 0)
self.assertFalse((Path(td) / 'intent.json').exists())
@@ -441,7 +441,7 @@ class NativeReviewTests(unittest.TestCase):
after['pagination']['reviews'][0].update(count=4, declared_total=4)
after['pagination']['review_comments_11'] = [{'page': 1, 'count': 0, 'declared_total': 0, 'link': None}]
api = FakeAPI(p, before, after, exact); api.created = True
with self.assertRaises(m.ValidationError): m.publish(p, before, api, FakeLease(), td)
with self.assertRaises(m.ValidationError): m.publish(p, before, api, FakeLease(), td, declaration={'mode': 'none'})
self.assertEqual(api.posts, 0)
def test_readback_failure_and_changed_journal_plan_never_retry_post(self):
@@ -449,11 +449,11 @@ class NativeReviewTests(unittest.TestCase):
api.read_review = lambda target, rid: (_ for _ in ()).throw(TimeoutError('DO_NOT_ECHO_TRANSPORT_SECRET'))
with tempfile.TemporaryDirectory() as td:
for _ in range(2):
with self.assertRaises(Exception) as raised: m.publish(p, before, api, FakeLease(), td)
with self.assertRaises(Exception) as raised: m.publish(p, before, api, FakeLease(), td, declaration={'mode': 'none'})
self.assertNotIn('DO_NOT_ECHO_TRANSPORT_SECRET', str(raised.exception))
self.assertEqual(api.posts, 1)
different = copy.deepcopy(p); different['body'] += 'different'
with self.assertRaises(m.ValidationError): m.publish(different, before, api, FakeLease(), td)
with self.assertRaises(m.ValidationError): m.publish(different, before, api, FakeLease(), td, declaration={'mode': 'none'})
self.assertEqual(api.posts, 1)
def test_journal_symlinks_hardlinks_and_changed_baseline_are_rejected(self):
@@ -463,10 +463,10 @@ class NativeReviewTests(unittest.TestCase):
with self.assertRaises(m.ValidationError): m.Journal(link)
api = FakeAPI(p, before, after, exact); api.timeout = True; api.apply = False
journal = root / 'journal'
with self.assertRaises(m.UncertainPublication): m.publish(p, before, api, FakeLease(), journal)
with self.assertRaises(m.UncertainPublication): m.publish(p, before, api, FakeLease(), journal, declaration={'mode': 'none'})
saved = json.loads((journal / 'before.json').read_text()); saved['issue']['body'] = 'changed'
(journal / 'before.json').write_text(json.dumps(saved))
with self.assertRaises(m.ValidationError): m.publish(p, before, api, FakeLease(), journal)
with self.assertRaises(m.ValidationError): m.publish(p, before, api, FakeLease(), journal, declaration={'mode': 'none'})
self.assertEqual(api.posts, 1)
with m.Journal(root / 'hardlinks') as j:
j.write('a.json', {'safe': True}); os.link(j.path / 'a.json', j.path / 'b.json')
@@ -485,7 +485,7 @@ class NativeReviewTests(unittest.TestCase):
m = self.module(); p, before, after, exact = publication_fixture(); api = FakeAPI(p, before, after, exact)
lease = FakeLease(); lease.check = lambda plan: False
with tempfile.TemporaryDirectory() as td:
with self.assertRaises(m.ValidationError): m.publish(p, before, api, lease, td)
with self.assertRaises(m.ValidationError): m.publish(p, before, api, lease, td, declaration={'mode': 'none'})
self.assertEqual(api.posts, 0)
def test_live_rest_bridge_over_loopback_publishes_once_then_no_ops(self):
import threading
@@ -533,10 +533,10 @@ class NativeReviewTests(unittest.TestCase):
api = m.ApiAdapter(request, origin=m.ORIGIN + '/api/v1', credential_source='$HERMES_HOME/.env:GITEA_TOKEN')
baseline = api.snapshot(p['target'])
with tempfile.TemporaryDirectory() as td:
result = m.publish(p, baseline, api, FakeLease(), td)
result = m.publish(p, baseline, api, FakeLease(), td, declaration={'mode': 'none'})
self.assertEqual(result['mode'], 'created'); self.assertEqual(result['projected_review_ids'], [8])
self.assertTrue(result['commit_file_order_normalized'])
second = m.publish(p, baseline, api, FakeLease(), td)
second = m.publish(p, baseline, api, FakeLease(), td, declaration={'mode': 'none'})
self.assertEqual(second['mode'], 'no_op'); self.assertFalse(second['wrote'])
self.assertEqual(state['posts'], 1); self.assertEqual(server.received, m.build_payload(p))
finally:
@@ -591,10 +591,10 @@ class NativeReviewTests(unittest.TestCase):
with self.subTest(field=field), tempfile.TemporaryDirectory() as td:
p, before, after, exact = publication_fixture(); api = FakeAPI(p, before, after, exact)
api.timeout = True; api.apply = False
with self.assertRaises(m.UncertainPublication): m.publish(p, before, api, FakeLease(), td)
with self.assertRaises(m.UncertainPublication): m.publish(p, before, api, FakeLease(), td, declaration={'mode': 'none'})
path = Path(td) / 'intent.json'; intent = json.loads(path.read_text()); intent[field] = 'corrupt'
path.write_text(json.dumps(intent)); api.created = True
with self.assertRaises(m.ValidationError): m.publish(p, before, api, FakeLease(), td)
with self.assertRaises(m.ValidationError): m.publish(p, before, api, FakeLease(), td, declaration={'mode': 'none'})
self.assertEqual(api.posts, 1)
def test_issue_repository_mismatch_is_not_accepted(self):