135 lines
7.5 KiB
Python
135 lines
7.5 KiB
Python
import re
|
|
import subprocess
|
|
import sys
|
|
import unittest
|
|
from pathlib import Path
|
|
|
|
ROOT = Path(__file__).resolve().parents[3]
|
|
SCRIPT = ROOT / "harness/agents/impl/skills/gitea-issue-rework/scripts/evidence_manifest.py"
|
|
PREPARE_SCRIPT = ROOT / "harness/lib/verification_root.py"
|
|
CACHE = ROOT / "harness/operations/repository-cache.md"
|
|
SKILLS = {
|
|
"implementation": ROOT / "harness/agents/impl/skills/gitea-issue-implementation/SKILL.md",
|
|
"rework": ROOT / "harness/agents/impl/skills/gitea-issue-rework/SKILL.md",
|
|
"review": ROOT / "harness/agents/spec/skills/gitea-implementation-spec-review/SKILL.md",
|
|
}
|
|
CANONICAL = "<harness-root>/repositories/<owner>/<repo>/worktrees/issue-<number>/verification/<run-id>"
|
|
|
|
|
|
class VerificationContractDocumentationTests(unittest.TestCase):
|
|
def test_runtime_policy_is_broker_owned_and_separate_from_verification(self):
|
|
text = CACHE.read_text(encoding="utf-8")
|
|
self.assertIn("runtime/<workflow-run-id>", text)
|
|
self.assertIn("broker.handle", text)
|
|
self.assertIn("broker.sock", text)
|
|
self.assertIn("ready JSON", text)
|
|
self.assertIn("runtime 생성은 승인이나 admission을 의미하지 않는다", text)
|
|
self.assertIn("active resource", text)
|
|
self.assertIn("unknown", text)
|
|
self.assertIn("성공 기록을 실패로 덮어쓰지 않는다", text)
|
|
for path in SKILLS.values():
|
|
with self.subTest(path=path.name):
|
|
role = path.read_text(encoding="utf-8")
|
|
gate = role.split("## Managed-lock broker gate", 1)[1].split("\n## ", 1)[0]
|
|
self.assertIn("broker-generated", gate)
|
|
self.assertIn("ready JSON", gate)
|
|
self.assertNotIn("pre-created", gate)
|
|
self.assertNotIn("pre-create", gate)
|
|
|
|
def test_role_runtime_startup_precedes_and_does_not_replace_admission(self):
|
|
roles = [path for path in (ROOT / 'harness/agents').rglob('SKILL.md')
|
|
if 'broker-generated runtime' in path.read_text()]
|
|
self.assertEqual(len(roles), 6)
|
|
for path in roles:
|
|
with self.subTest(role=path.parent.name):
|
|
gate = path.read_text().split('## Managed-lock broker gate', 1)[1].split('\n## ', 1)[0]
|
|
self.assertIn('ready 이후 각 workflow의 진입 검증·승인 조건을 확인한다', gate)
|
|
self.assertIn('Runtime 생성은 approval이나 worktree admission을 대신하지 않는다', gate)
|
|
self.assertIn('ready JSON의 `handle`/`socket`', gate)
|
|
|
|
def test_evidence_plan_disables_python_bytecode_in_clean_checkout(self):
|
|
import json
|
|
template = ROOT / "harness/agents/impl/skills/gitea-issue-rework/templates/evidence-plan.json"
|
|
plan = json.loads(template.read_text())
|
|
self.assertIn("-B", plan["commands"][0]["argv"])
|
|
self.assertIn("PYTHONDONTWRITEBYTECODE", plan["command_env_allowlist"])
|
|
|
|
def test_all_roles_reference_canonical_external_artifacts(self):
|
|
for path in (CACHE, *SKILLS.values()):
|
|
with self.subTest(path=path.name):
|
|
text = path.read_text(encoding="utf-8")
|
|
self.assertIn(CANONICAL, text)
|
|
self.assertIn("evidence_gap", text)
|
|
self.assertIn("[REDACTED]", text)
|
|
self.assertIn("evidence-manifest/v2", text)
|
|
|
|
def test_examples_match_real_helper_cli_not_unsupported_options(self):
|
|
for path in (SKILLS["implementation"], SKILLS["rework"]):
|
|
section = path.read_text().split("## Canonical external verification evidence", 1)[1]
|
|
match = re.search(r"```sh\n(.*?)```", section, re.S)
|
|
assert match is not None
|
|
block = match.group(1).replace("\\\n", " ")
|
|
commands = [line for line in block.splitlines() if line.startswith("python3 ")]
|
|
self.assertEqual(len(commands), 3)
|
|
for op, command in zip(("prepare", "run", "validate"), commands):
|
|
with self.subTest(skill=path.parent.name, op=op):
|
|
declared = set(re.findall(r"--[a-z-]+", command))
|
|
if op == "prepare":
|
|
self.assertIn("harness/lib/verification_root.py", command)
|
|
help_result = subprocess.run(
|
|
[sys.executable, str(PREPARE_SCRIPT), op, "--help"],
|
|
text=True,
|
|
capture_output=True,
|
|
)
|
|
self.assertEqual(help_result.returncode, 0, help_result.stderr)
|
|
supported = set(re.findall(r"--[a-z-]+", help_result.stdout))
|
|
required = {"--root", "--owner", "--repository", "--issue", "--run-id", "--handle"}
|
|
self.assertEqual(declared, required)
|
|
self.assertTrue(declared <= supported)
|
|
else:
|
|
help_result = subprocess.run([sys.executable, str(SCRIPT), op, "--help"], text=True, capture_output=True)
|
|
self.assertEqual(help_result.returncode, 0)
|
|
supported = set(re.findall(r"--[a-z-]+", help_result.stdout))
|
|
required = {"--contract-path", "--repo-root", "--artifact-root"} | ({"--plan", "--output"} if op == "run" else {"--manifest"})
|
|
self.assertEqual(declared, required)
|
|
self.assertTrue(declared <= supported)
|
|
self.assertIn("exact current HEAD", section)
|
|
self.assertIn("validate-legacy", section)
|
|
self.assertIn("exclusion 없음", section)
|
|
|
|
def test_prepare_contract_binds_root_and_forbids_recursive_parent_creation(self):
|
|
for path in (CACHE, SKILLS["implementation"], SKILLS["rework"]):
|
|
with self.subTest(path=path.name):
|
|
text = path.read_text(encoding="utf-8")
|
|
self.assertIn("exact harness root", text)
|
|
self.assertIn("Path.mkdir(parents=True, mode=0o700)", text)
|
|
self.assertIn("자동 chmod", text)
|
|
|
|
def test_checkout_cleanup_preserves_verification_without_recursive_delete(self):
|
|
text = CACHE.read_text()
|
|
cleanup = text.split("## Worktree 실패 처리와 제거", 1)[1].split("## Credential 안전", 1)[0]
|
|
self.assertIn("`verification/`이 남으면 Issue directory를 보존한다", cleanup)
|
|
self.assertIn("Issue directory가 남는 것은 checkout 제거 실패가 아니다", cleanup)
|
|
self.assertIn("digest가 제거 전과 같음", cleanup)
|
|
self.assertIn("Artifact 폐기는 별도의 exact 경로 승인", text)
|
|
self.assertIn("mode `0700`", text)
|
|
self.assertIn("mode `0600`", text)
|
|
|
|
def test_spec_review_uses_immutable_source_and_not_moving_checkout(self):
|
|
section = SKILLS["review"].read_text().split("## External Issue verification evidence boundary", 1)[1]
|
|
self.assertIn("제품 테스트를 실행하지 않", section)
|
|
self.assertIn("moving implementation checkout", section)
|
|
self.assertIn("authoritative blob evidence", section)
|
|
self.assertIn("trusted `harness/.runtime`", section)
|
|
self.assertIn("Producer evidence와 reviewer 실행을 구분", section)
|
|
|
|
def test_rework_no_longer_excludes_repo_evidence_from_clean_tree(self):
|
|
text = SKILLS["rework"].read_text()
|
|
self.assertNotIn("plan과 manifest를 제외한 clean tree", text)
|
|
self.assertIn("새 evidence는 checkout 밖", text)
|
|
self.assertIn("archived v1 read-only", text)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|