Record approved scanner revision 5 and verified cached-stream correction

docs/changes/2026-11-01-scanner-json-digest/native-r5/test_envelope.py

@@ -0,0 +1,26 @@
+from pathlib import Path
+from types import SimpleNamespace
+import importlib.util,unittest
+HERE=Path(__file__).resolve().parent
+s=importlib.util.spec_from_file_location('r5',HERE/'rollout.py');r=importlib.util.module_from_spec(s);s.loader.exec_module(r)
+ORIGINAL=HERE.parent/'native-r2'
+class Tests(unittest.TestCase):
+    def runner(self):
+        class Parent:
+            def __init__(self):self.calls=[];self.events=[]
+            def shell(self,pod,script,args,data,timeout):
+                self.calls.append((pod,script,args,data,timeout));return b'public-result'
+            def event(self,name,**fields):self.events.append((name,fields))
+        base=SimpleNamespace(ORIGINAL=ORIGINAL,make_runner=lambda m:Parent)
+        return r.make_runner(base,None)()
+    def test_only_stage_script_changes_and_call_contract_is_preserved(self):
+        x=self.runner();out=x.shell('pod',(ORIGINAL/'stage.sh').read_text(),('a','b'),b'public-input',7)
+        self.assertEqual(out,b'public-result');self.assertEqual(x.calls[0],('pod',(HERE/'stage.sh').read_text(),('a','b'),b'public-input',7))
+        self.assertFalse(x._cached_stage_call)
+        x.shell('pod','other reviewed script',('check',),None,9)
+        self.assertEqual(x.calls[1],('pod','other reviewed script',('check',),None,9))
+    def test_cached_change_is_only_consumption_and_count_check(self):
+        before=(ORIGINAL/'stage.sh').read_text();after=(HERE/'stage.sh').read_text()
+        addition='  # Finish the exec input stream even when no binary rewrite is needed.\n  received=$(wc -c)\n  test "$received" -eq "$(stat -c %s "$new/receive-secret-scan")"\n'
+        self.assertEqual(after.replace(addition,''),before)
+if __name__=='__main__':unittest.main()