informed-decision/docs/evidence/2026-10-11-purpose-image-release/test_preflight_optimization.py
tegwick e0359bcb6c Prepare purpose image release with bounded custody protocol and owner reviews
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
2026-10-11 03:54:35 +02:00

37 lines
1.7 KiB
Python

import ast
from pathlib import Path
import subprocess
import sys
import tempfile
import unittest
ROOT = Path(__file__).parent
class OptimizedInterpreterGate(unittest.TestCase):
def test_local_optimized_interpreter_refuses_before_transport_or_output(self):
with tempfile.TemporaryDirectory() as folder:
output = Path(folder) / 'new-receipt.json'
result = subprocess.run([sys.executable, '-O', str(ROOT / 'preflight.py'),
'--receipt-output', str(output)], capture_output=True, text=True)
self.assertNotEqual(result.returncode, 0)
self.assertIn('optimized interpreter refused', result.stderr)
self.assertFalse(output.exists())
def test_remote_optimized_interpreter_refuses_before_candidate_or_commands(self):
tree = ast.parse((ROOT / 'preflight.py').read_text())
remote = next(node.value.value for node in tree.body
if isinstance(node, ast.Assign) and isinstance(node.value, ast.Constant)
and any(isinstance(target, ast.Name) and target.id == 'program'
for target in node.targets))
# Unresolved literals would fail immediately after this gate. Under -O
# the first refusal must be optimization, before any kubectl dispatch.
result = subprocess.run([sys.executable, '-O', '-'], input=remote,
capture_output=True, text=True)
self.assertNotEqual(result.returncode, 0)
self.assertIn('optimized interpreter refused', result.stderr)
self.assertNotIn('NameError', result.stderr)
if __name__ == '__main__':
unittest.main()