coulomb/emergent-security
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Bind knowledge retrieval to sealed bytes and invalidate changed releases

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a10238-7ecc-78e2-903d-075f50e913cc
This commit is contained in:
tegwick 2026-10-03 17:44:52 +02:00
parent 416f9919c5
commit d0bf65e964
16 changed files with 335 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

42
tests/test_knowledge.py
View file

@ -225,6 +225,48 @@ def test_resume_reload_rechecks_sources_instead_of_reusing_a_verdict(bundle):
assert first["package_digest"] != second["package_digest"]
def test_loaded_package_refuses_card_changed_after_validation(bundle):
package = Knowledge(bundle)
(bundle / "cards/start.md").write_text("unsealed injected guidance")
with pytest.raises(KnowledgeError, match="content changed"):
package.retrieve("start", today=TODAY)
@pytest.mark.parametrize("operation", ["retrieve", "check", "source_status"])
def test_loaded_package_requires_reload_after_resealed_withdrawal(bundle, operation):
package = Knowledge(bundle)
edit_source(bundle, status="withdrawn")
with pytest.raises(KnowledgeError, match="reload"):
if operation == "retrieve":
package.retrieve("start", today=TODAY)
elif operation == "check":
package.check(today=TODAY)
else:
package.source_status("net-kingdom", None, TODAY)
assert Knowledge(bundle).retrieve("start", today=TODAY)["status"] == "withheld"
def test_returned_card_uses_the_same_bytes_that_were_verified(bundle, monkeypatch):
package = Knowledge(bundle)
path = bundle / "cards/start.md"
original = path.read_text()
read_bytes = Path.read_bytes
verified_reads = []
def replace_after_read(candidate):
data = read_bytes(candidate)
if candidate == path:
verified_reads.append(candidate)
path.write_text("injected after hash verification")
return data
monkeypatch.setattr(Path, "read_bytes", replace_after_read)
result = package.retrieve("start", today=TODAY)
assert len(verified_reads) == 1
assert result["content"] == original
assert result["package_digest"] == package.package_digest
@pytest.mark.parametrize('owner,card', [('informed-decision', 'decisions'), ('runbook-tutorials', 'runbooks')])
def test_withdrawn_handoff_owner_withholds_journey_and_startup(bundle, owner, card):
sources = read_yaml(bundle / 'sources.yaml')