"""PR-0 selective upstream import-plan and provenance contracts.""" from __future__ import annotations import hashlib import json import re from pathlib import Path from jsonschema import Draft202012Validator, FormatChecker ROOT = Path(__file__).resolve().parents[1] UPSTREAM = ROOT / "references/upstream/yinduzhanxing" PLAN = UPSTREAM / "import-plan.json" SOURCE_MANIFEST = UPSTREAM / "source-manifest.json" IMPORT_SCHEMA = ROOT / "references/cross_project_contract/import_manifest.schema.json" LEGACY_SNAPSHOT = ROOT / "references/cross_project_contract/imports/snapshot-9034e1967032d09c.json" PINNED_IMPORT_RECORD = ROOT / "references/cross_project_contract/imports/commit-5db72537741fcedaa7b5498502d4a31b0f9fc147.json" EXPECTED_SOURCES = { "scripts/evidence_maturity.py", "scripts/assertion_policy.py", "scripts/evidence_labeled_reporting.py", "scripts/calculation_profile_contract.py", "scripts/report_pack_contract.py", "scripts/domain_profile_builder.py", "scripts/unified_calculation_archive.py", "scripts/specialized_evidence_packets.py", "scripts/timing_evidence_packets.py", } EXPECTED_CATEGORIES = { "calculation_contracts", "evidence_assertion_contracts", "report_domain_profile_contracts", "research_oracle_assets", } EXPECTED_REJECTIONS = { "fixed_event_domain_count_threshold", "sparse_start_mid_end_rectification_scan", "weaken_three_engine_gate", "weaken_required_layers", "weaken_stability_gate", "remove_commercial_routes", } EXPECTED_UPSTREAM_IDENTITY = { "source_repository": "732642856/yinduzhanxing", "source_repository_url": "https://github.com/732642856/yinduzhanxing", "source_commit": "5db72537741fcedaa7b5498502d4a31b0f9fc147", "source_tree_sha256": "18e3122ef73c2776a950bfec128efeb09ac0524ec1d2179390260166b87ca814", } EXPECTED_SOURCE_GIT_TREE = "16935cb68a6fa1ef72661cfca4650a42c60e9b2c" EXPECTED_ARCHIVE_SHA256 = "07d6b71af311160c544433eb9d51beb5b0a5e4bd0afabd4a7d43d3edb573518d" EXPECTED_ARCHIVE_FILE_COUNT = 2901 EXPECTED_SOURCE_SKILL_SHA256 = "ef453dd8dd4a9da72b56010ec33bb7dab57fd72333d8785cac0986d5456e17c5" def _load(path: Path) -> dict: return json.loads(path.read_text(encoding="utf-8")) def test_import_plan_records_all_nine_upstream_sources_and_semantic_destinations() -> None: plan = _load(PLAN) entries = plan["entries"] assert len(entries) == 9 assert {entry["source"] for entry in entries} == EXPECTED_SOURCES assert {entry["category"] for entry in entries} == EXPECTED_CATEGORIES assert [entry["action"] for entry in entries].count("adapt") == 8 assert [entry["action"] for entry in entries].count("reference_only") == 1 for entry in entries: assert set(("source", "category", "action", "reason", "targets", "tests")) <= set(entry) assert entry["source"].startswith("scripts/") assert entry["reason"] assert entry["targets"] and all(target.startswith(("scripts/", "references/")) for target in entry["targets"]) assert entry["tests"] and all(test.startswith("tests/") for test in entry["tests"]) archive = next(entry for entry in entries if entry["source"] == "scripts/unified_calculation_archive.py") assert archive["action"] == "reference_only" assert "runtime truth" in archive["reason"] assert "none of these research scripts is copied" in plan["boundary"] def test_rejected_regressions_protect_server_truth_gates_and_commercial_routes() -> None: plan = _load(PLAN) rejections = plan["rejected_regressions"] assert {item["id"] for item in rejections} == EXPECTED_REJECTIONS assert all(item["action"] == "reject" for item in rejections) by_id = {item["id"]: item for item in rejections} fixed_count = by_id["fixed_event_domain_count_threshold"]["reason"].lower() assert "3 events" in fixed_count and "2 domains" in fixed_count assert "not sufficient" in fixed_count and "cannot bypass" in fixed_count sparse_scan = by_id["sparse_start_mid_end_rectification_scan"]["reason"].lower() assert all(token in sparse_scan for token in ("start", "midpoint", "end")) assert "not a complete" in sparse_scan for rejection_id in ( "weaken_three_engine_gate", "weaken_required_layers", "weaken_stability_gate", ): assert by_id[rejection_id]["action"] == "reject" assert by_id[rejection_id]["commercial_owner"].startswith("scripts/") routes = by_id["remove_commercial_routes"] assert routes["preserved_routes"] == ["migration", "family", "annual"] assert "commercial-runtime-owned" in routes["reason"] def test_formal_varga_is_evidence_only_and_cannot_close_local_truth() -> None: policy = _load(PLAN)["formal_varga_policy"] assert policy["action"] == "reference_only" reason = policy["reason"].lower() for token in ("evidence_only", "cannot claim", "cannot", "api key"): assert token in reason assert "local-formula parity" in reason assert "required layers" in reason def test_source_manifest_pins_valid_archive_commit_tree_and_root_skill_hash() -> None: manifest = _load(SOURCE_MANIFEST) plan = _load(PLAN) assert manifest["source_mode"] == "archive" assert manifest["import_policy_version"] == 2 assert manifest["imported_at"] != manifest["source_committed_at"] assert {key: manifest[key] for key in EXPECTED_UPSTREAM_IDENTITY} == EXPECTED_UPSTREAM_IDENTITY assert {key: plan[key] for key in EXPECTED_UPSTREAM_IDENTITY} == EXPECTED_UPSTREAM_IDENTITY assert manifest["source_git_tree"] == EXPECTED_SOURCE_GIT_TREE assert manifest["archive_sha256"] == EXPECTED_ARCHIVE_SHA256 assert manifest["archive_file_count"] == EXPECTED_ARCHIVE_FILE_COUNT assert manifest["source_committed_at"] == "2026-08-13T18:03:53Z" assert re.fullmatch(r"[0-9a-f]{40}", manifest["source_commit"]) assert re.fullmatch(r"[0-9a-f]{64}", manifest["source_tree_sha256"]) source_skill_sha256 = manifest.get("source_skill_sha256", manifest["skill_sha256"]) assert re.fullmatch(r"[0-9a-f]{64}", source_skill_sha256) snapshot_hash = hashlib.sha256((UPSTREAM / "SKILL.md").read_bytes()).hexdigest() assert source_skill_sha256 == snapshot_hash == EXPECTED_SOURCE_SKILL_SHA256 assert manifest["skill_sha256"] == manifest["source_skill_sha256"] def test_import_manifest_schema_accepts_archive_and_legacy_snapshot_records() -> None: schema = _load(IMPORT_SCHEMA) validator = Draft202012Validator(schema, format_checker=FormatChecker()) legacy = _load(LEGACY_SNAPSHOT) pinned = _load(PINNED_IMPORT_RECORD) validator.validate(legacy) validator.validate(pinned) invalid_git = dict(pinned, source_mode="git", source_commit="unknown") assert list(validator.iter_errors(invalid_git)) assert "archive" in schema["properties"]["source_mode"]["enum"] source_manifest = _load(SOURCE_MANIFEST) plan = _load(PLAN) assert pinned["source_repository"] == source_manifest["source_repository"] == plan["source_repository"] assert pinned["source_repository_url"] == source_manifest["source_repository_url"] == plan["source_repository_url"] == EXPECTED_UPSTREAM_IDENTITY["source_repository_url"] assert pinned["source_commit"] == source_manifest["source_commit"] == plan["source_commit"] assert pinned["source_tree_hash"] == source_manifest["source_tree_sha256"] == plan["source_tree_sha256"] assert pinned["source_skill_sha256"] == source_manifest["source_skill_sha256"] == EXPECTED_SOURCE_SKILL_SHA256 def test_raman_2026_08_20_packets_are_adapt_only_and_exclude_blocked_batches() -> None: plan = _load(PLAN) support = plan["raman_2026_08_20_support"] assert support["action"] == "adapt" packet_dir = ROOT / support["target"] names = {path.name for path in packet_dir.glob("*.json")} assert set(support["packets"]) <= names assert "scripts/raman_support_observations.py" in support["targets"] for prefix in support["rejected_packets"]: assert not any(name.startswith(prefix) for name in names) assert "health" in " ".join(support["rejected_packets"]) assert "unique-minute" in support["reason"] or "support-only" in support["reason"]