@dzhechkov/p-replicator 1.5.13 → 1.5.15

package/templates/.claude/skills/goap-research-ed25519/scripts/test_evidence_provenance.py

@@ -0,0 +1,784 @@
+#!/usr/bin/env python3
+"""
+ADR Confirmation tests for the evidence-provenance axis.
+
+Every test here names the ADR property it proves. The three tamper tests are the
+core: an evidence class that can be edited with a text editor is not evidence of
+anything, and this feature would be decoration without them.
+
+    python3 -m unittest test_evidence_provenance -v
+"""
+
+import sys
+
+# Import NOTHING from this directory before this line. Running these tests used to
+# leave a __pycache__ inside the skill directory, and this skill is vendored into 11
+# copies kept byte-identical — so the stray directory read as canonical DRIFT and
+# turned an unrelated repo test red. Bytecode caching buys nothing for a suite that
+# runs in half a second; not writing it removes the failure mode entirely.
+sys.dont_write_bytecode = True
+
+import json
+import threading
+import unittest
+from http.server import BaseHTTPRequestHandler, HTTPServer
+
+import ed25519_verifier as ev
+import evidence_fetch as ef
+import source_tiers as st
+import check_report_evidence as gate
+
+
+def _verifier():
+    v = ev.Ed25519Verifier()
+    v.generate_keypair()
+    return v
+
+
+def _authentic_record(**overrides):
+    """A FetchRecord bearing this process's fetch witness.
+
+    The test reaches into `evidence_fetch._FETCH_WITNESS` ON PURPOSE: these cases
+    exercise SIGNATURE coverage, not fetch authenticity, and they must start from
+    a record the API accepts. Authenticity itself is proven separately by
+    `test_manual_path_cannot_mint_fetch_verified` (hand-built record REFUSED) and
+    by the live local-server fetches in FetchTests.
+    """
+    base = dict(
+        url="https://pubmed.ncbi.nlm.nih.gov/123",
+        final_url="https://pubmed.ncbi.nlm.nih.gov/123",
+        status=200,
+        sha256_body="a" * 64,
+        bytes_len=10,
+        fetched_at="2026-08-03T10:00:00Z",
+        witness=ef._FETCH_WITNESS,
+    )
+    base.update(overrides)
+    return ef.FetchRecord(**base)
+
+
+class EvidenceAxisTests(unittest.TestCase):
+    """ADR-001 — the axis is ORTHOGONAL to trust_class."""
+
+    def test_signed_but_asserted_is_expressible_and_gated(self):
+        """ADR-001 Confirmation: ISSUER_SIGNED + ASSERTED must be REPRESENTABLE,
+        verifiable as signed, and still refused by the report gate. Collapsing the
+        two axes into one field would make this state impossible to say."""
+        v = _verifier()
+        fact = v.create_asserted_fact(claim="Testosterone recovers without refeeding", issuer="researcher")
+        # Promote the trust axis while leaving the evidence axis untouched, then
+        # re-sign: this is a legitimate actor asserting provenance of a record it
+        # never read — the dangerous quadrant, and it must be expressible.
+        fact.trust_class = ev.TRUST_CLASS_ISSUER_SIGNED
+        fact.signature, _ = v.sign_content(ev.canonical_fact_message(fact))
+        v.registry.add("researcher", v.get_public_key_b64())
+
+        result = v.verify_fact(fact)
+        self.assertTrue(result.verified, "the signature itself is sound — the axes are independent")
+        self.assertEqual(fact.evidence_class, ev.EVIDENCE_ASSERTED)
+        self.assertEqual(result.confidence, 0.0, "evidence ceiling wins over trust ceiling (weakest link)")
+
+        report = "Conclusion: Testosterone recovers without refeeding, so no action is needed."
+        findings, _ = gate.evaluate(report, [json.loads(fact.to_json())])
+        self.assertTrue(findings, "a signed-but-unread claim must still be refused by the gate")
+        self.assertEqual(findings[0].kind, "ASSERTED_IN_REPORT")
+
+    def test_asserted_confidence_is_zero_not_low(self):
+        v = _verifier()
+        fact = v.create_asserted_fact(claim="X causes Y")
+        self.assertEqual(fact.confidence, 0.0)
+        self.assertEqual(ev.evidence_ceiling(ev.EVIDENCE_ASSERTED), 0.0)
+
+    def test_legacy_fact_evidence_is_unknown_not_guessed(self):
+        """A pre-axis fact must read as UNKNOWN — neither ASSERTED nor VERIFIED."""
+        v = _verifier()
+        legacy = v.create_signed_fact(claim="c", source_url="https://x.test", source_content="body", issuer="researcher")
+        self.assertIsNone(legacy.evidence_class)
+        self.assertEqual(ev.fact_schema_version(legacy), 1)
+        self.assertEqual(ev.evidence_ceiling(None), 1.0, "unknown contributes no ceiling of its own")
+        self.assertTrue(v.verify_fact(legacy).verified)
+
+
+class SignatureCoverageTests(unittest.TestCase):
+    """ADR-002 — the evidence class is UNDER the signature; both tamper directions fail."""
+
+    def setUp(self):
+        self.v = _verifier()
+        self.record = _authentic_record()
+
+    def test_evidence_class_tamper_swap_fails(self):
+        """Relabel LISTING_ONLY → FETCH_VERIFIED on a signed fact."""
+        fact = self.v.create_listing_fact(claim="c", source_url="https://x.test", reason="offline run")
+        self.assertTrue(self.v.verify_fact(fact).verified)
+        fact.evidence_class = ev.EVIDENCE_FETCH_VERIFIED
+        self.assertFalse(self.v.verify_fact(fact).verified, "swapping the class must break the signature")
+
+    def test_evidence_class_tamper_strip_fails(self):
+        """DOWNGRADE attack: remove the field so verification falls back to v1.
+        What breaks it is that the signed v2 text CONTAINS the three evidence keys
+        at all — not the schema marker (a discrimination run refuted that)."""
+        fact = self.v.create_fetched_fact(claim="c", fetch_record=self.record, issuer="researcher")
+        self.assertTrue(self.v.verify_fact(fact).verified)
+        fact.evidence_class = None
+        self.assertEqual(ev.fact_schema_version(fact), 1, "the fact now looks legacy…")
+        self.assertFalse(self.v.verify_fact(fact).verified, "…but its v2 signature must not accept the v1 message")
+
+    def test_evidence_class_tamper_add_fails(self):
+        """UPGRADE attack: bolt the field onto a legacy v1 fact."""
+        legacy = self.v.create_signed_fact(claim="c", source_url="https://x.test", source_content="b", issuer="researcher")
+        self.assertTrue(self.v.verify_fact(legacy).verified)
+        legacy.evidence_class = ev.EVIDENCE_FETCH_VERIFIED
+        self.assertFalse(self.v.verify_fact(legacy).verified, "adding the field must break a v1 signature")
+
+    def test_fetch_date_and_source_date_are_also_covered(self):
+        fact = self.v.create_fetched_fact(claim="c", fetch_record=self.record, issuer="researcher", source_date="2024-01-01")
+        self.assertTrue(self.v.verify_fact(fact).verified)
+        fact.fetch_date = "2099-01-01T00:00:00Z"
+        self.assertFalse(self.v.verify_fact(fact).verified, "fetch_date is signed, not decorative")
+
+    def test_v1_and_v2_messages_differ_for_identical_shared_fields(self):
+        """The two schemas are distinguishable because v2 carries extra keys; the
+        marker is self-description and the v3 growth point, not the protection."""
+        fact = self.v.create_listing_fact(claim="c", source_url="https://x.test", reason="r")
+        self.assertNotEqual(ev.canonical_fact_message_v1(fact), ev.canonical_fact_message_v2(fact))
+        self.assertIn(ev.FACT_SCHEMA_V2, ev.canonical_fact_message_v2(fact))
+
+
+class EarnedClassTests(unittest.TestCase):
+    """ADR-003 — FETCH_VERIFIED requires an artifact only a real fetch produces."""
+
+    def test_manual_path_cannot_mint_fetch_verified(self):
+        """The load-bearing property: no manual route yields FETCH_VERIFIED."""
+        v = _verifier()
+        listing = v.create_listing_fact(claim="c", source_url="https://x.test", reason="hand-supplied body")
+        asserted = v.create_asserted_fact(claim="c")
+        self.assertEqual(listing.evidence_class, ev.EVIDENCE_LISTING_ONLY)
+        self.assertEqual(asserted.evidence_class, ev.EVIDENCE_ASSERTED)
+
+        # …and the constructor that CAN mint it refuses anything lacking proof.
+        class NotAFetch:
+            status = 200
+            final_url = "https://x.test"
+            # no sha256_body, no fetched_at
+        with self.assertRaises(ValueError):
+            v.create_fetched_fact(claim="c", fetch_record=NotAFetch(), issuer="researcher")
+
+        # Forging it in the JSON is caught by the signature (ADR-002).
+        forged = json.loads(listing.to_json())
+        forged["evidence_class"] = ev.EVIDENCE_FETCH_VERIFIED
+        self.assertFalse(v.verify_fact(ev.SignedFact.from_dict(forged)).verified)
+
+    def test_non_2xx_fetch_is_refused_as_evidence(self):
+        v = _verifier()
+        error_page = _authentic_record(url="https://x.test", final_url="https://x.test", status=404)
+        with self.assertRaises(ValueError):
+            v.create_fetched_fact(claim="c", fetch_record=error_page, issuer="researcher")
+
+    def test_listing_fact_demands_a_stated_reason(self):
+        v = _verifier()
+        with self.assertRaises(ValueError):
+            v.create_listing_fact(claim="c", source_url="https://x.test", reason="  ")
+
+
+class FetchTests(unittest.TestCase):
+    """The network path itself — against a local server, never the internet."""
+
+    @classmethod
+    def setUpClass(cls):
+        class Handler(BaseHTTPRequestHandler):
+            def do_GET(self):  # noqa: N802
+                if self.path == "/ok":
+                    body = b"hello evidence"
+                    self.send_response(200)
+                    self.send_header("Content-Type", "text/plain")
+                    self.send_header("Content-Length", str(len(body)))
+                    self.end_headers()
+                    self.wfile.write(body)
+                elif self.path == "/redirect":
+                    self.send_response(302)
+                    self.send_header("Location", "/ok")
+                    self.end_headers()
+                elif self.path == "/big":
+                    body = b"x" * 4096
+                    self.send_response(200)
+                    self.send_header("Content-Length", str(len(body)))
+                    self.end_headers()
+                    self.wfile.write(body)
+                else:
+                    self.send_response(404)
+                    self.end_headers()
+
+            def log_message(self, *args):  # silence
+                pass
+
+        cls.server = HTTPServer(("127.0.0.1", 0), Handler)
+        cls.port = cls.server.server_address[1]
+        cls.thread = threading.Thread(target=cls.server.serve_forever, daemon=True)
+        cls.thread.start()
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.server.shutdown()
+        cls.server.server_close()
+
+    def _url(self, path):
+        return f"http://127.0.0.1:{self.port}{path}"
+
+    def test_successful_fetch_produces_a_real_body_hash(self):
+        import hashlib
+        record = ef.fetch_source(self._url("/ok"), _allow_private=True)
+        self.assertIsInstance(record, ef.FetchRecord)
+        self.assertEqual(record.status, 200)
+        self.assertEqual(record.sha256_body, hashlib.sha256(b"hello evidence").hexdigest())
+        self.assertTrue(record.fetched_at.endswith("Z"))
+
+    def test_redirect_is_followed_and_final_url_recorded(self):
+        record = ef.fetch_source(self._url("/redirect"), _allow_private=True)
+        self.assertIsInstance(record, ef.FetchRecord)
+        self.assertTrue(record.final_url.endswith("/ok"))
+        self.assertNotEqual(record.url, record.final_url)
+
+    def test_oversize_body_is_refused_not_truncated(self):
+        """A truncated body would hash to something no repeat fetch reproduces."""
+        failure = ef.fetch_source(self._url("/big"), max_bytes=100, _allow_private=True)
+        self.assertIsInstance(failure, ef.FetchFailure)
+        self.assertIn("max_bytes", failure.reason)
+
+    def test_404_is_a_named_failure_not_a_record(self):
+        failure = ef.fetch_source(self._url("/missing"), _allow_private=True)
+        self.assertIsInstance(failure, ef.FetchFailure)
+        self.assertIn("404", failure.reason)
+
+    def test_non_http_scheme_is_refused_before_io(self):
+        """file:// would let a local read masquerade as network evidence."""
+        failure = ef.fetch_source("file:///etc/passwd")
+        self.assertIsInstance(failure, ef.FetchFailure)
+        self.assertIn("scheme", failure.reason)
+
+    def test_offline_degrades_to_listing_with_a_stated_reason(self):
+        v = _verifier()
+        failure = ef.fetch_source("http://127.0.0.1:1/unreachable", timeout=1, _allow_private=True)
+        self.assertIsInstance(failure, ef.FetchFailure)
+        fact = v.create_listing_fact(claim="c", source_url=failure.url, reason=failure.reason)
+        self.assertEqual(fact.evidence_class, ev.EVIDENCE_LISTING_ONLY)
+        self.assertIn("evidence_note", fact.metadata)
+
+
+class SourceTierTests(unittest.TestCase):
+    def test_known_domains_map_to_their_tier(self):
+        self.assertEqual(st.classify_source("https://www.cochrane.org/x").tier, st.TIER_A)
+        self.assertEqual(st.classify_source("https://pubmed.ncbi.nlm.nih.gov/123").tier, st.TIER_B)
+        self.assertEqual(st.classify_source("https://www.medrxiv.org/y").tier, st.TIER_C)
+
+    def test_unknown_domain_is_tier_d_not_an_exception(self):
+        verdict = st.classify_source("https://some-blog.example/post")
+        self.assertEqual(verdict.tier, st.TIER_D)
+        self.assertFalse(verdict.known)
+
+    def test_lookalike_domain_does_not_inherit_a_tier(self):
+        """cochrane.org.evil.com must NOT read as tier A — suffix LABELS, not endswith."""
+        self.assertEqual(st.classify_source("https://cochrane.org.evil.com/x").tier, st.TIER_D)
+
+    def test_missing_source_date_is_flagged_not_waved_through(self):
+        stale, reason = st.is_stale(None, kind="guideline")
+        self.assertTrue(stale)
+        self.assertIn("missing", reason)
+
+    def test_old_source_is_stale_fresh_one_is_not(self):
+        self.assertTrue(st.is_stale("2015-01-01", kind="guideline")[0])
+        from datetime import datetime, timezone
+        self.assertFalse(st.is_stale(datetime.now(timezone.utc).strftime("%Y-%m-%d"), kind="guideline")[0])
+
+
+class ReportGateTests(unittest.TestCase):
+    """FR-4 — the gate is an exit code, not advice."""
+
+    def _fact(self, claim, evidence_class, url="https://x.test"):
+        return {"claim": claim, "source_url": url, "evidence_class": evidence_class}
+
+    def test_asserted_claim_used_in_report_fails(self):
+        report = "The patient's metabolism recovered without fasting, so we proceed."
+        facts = [self._fact("metabolism recovered without fasting", "ASSERTED")]
+        findings, counts = gate.evaluate(report, facts)
+        self.assertEqual(len(findings), 1)
+        self.assertEqual(counts["ASSERTED"], 1)
+
+    def test_asserted_fact_not_used_in_report_is_not_a_violation(self):
+        report = "Unrelated content about iron saturation."
+        facts = [self._fact("metabolism recovered without fasting", "ASSERTED")]
+        findings, _ = gate.evaluate(report, facts)
+        self.assertEqual(findings, [])
+
+    def test_unmarked_listing_only_fails_marked_passes(self):
+        claim = "transferrin saturation rose from 37 to 53 percent"
+        unmarked = f"We note that {claim} over six months."
+        marked = f"We note that {claim} (LISTING_ONLY: карточка не открывалась — перепроверьте)."
+        facts = [self._fact(claim, "LISTING_ONLY")]
+        self.assertEqual(len(gate.evaluate(unmarked, facts)[0]), 1)
+        self.assertEqual(gate.evaluate(marked, facts)[0], [])
+
+    def test_marker_far_from_the_claim_does_not_count(self):
+        claim = "transferrin saturation rose from 37 to 53 percent"
+        far = f"We note that {claim}." + ("filler. " * 200) + "LISTING_ONLY appendix note"
+        findings, _ = gate.evaluate(far, [self._fact(claim, "LISTING_ONLY")])
+        self.assertEqual(len(findings), 1, "a marker in the appendix does not warn the reader on page 2")
+
+    def test_legacy_facts_are_counted_and_named_never_folded_into_clean(self):
+        report = "Some claim about lipids appears here in the body of the report."
+        facts = [{"claim": "Some claim about lipids", "source_url": "u"}]  # no evidence_class
+        findings, counts = gate.evaluate(report, facts)
+        self.assertEqual(findings, [])
+        self.assertEqual(counts["UNKNOWN_LEGACY"], 1)
+        self.assertIn("predate the evidence axis", gate.render(findings, counts))
+
+    def test_paraphrased_claim_is_still_detected(self):
+        claim = "omega-3 supplementation raised LDL cholesterol by forty percent"
+        report = "Reported omega-3 supplementation figures show raised LDL cholesterol by roughly forty percent overall."
+        findings, _ = gate.evaluate(report, [self._fact(claim, "ASSERTED")])
+        self.assertEqual(len(findings), 1, "over-detection is preferred: a miss is silent, an alarm is arguable")
+
+    def test_gate_cli_exit_codes(self):
+        import tempfile, os
+        with tempfile.TemporaryDirectory() as tmp:
+            report_path = os.path.join(tmp, "r.md")
+            facts_path = os.path.join(tmp, "f.json")
+            with open(report_path, "w", encoding="utf-8") as fh:
+                fh.write("The claim about iron overload appears in this report body.")
+            with open(facts_path, "w", encoding="utf-8") as fh:
+                json.dump([self._fact("claim about iron overload", "ASSERTED")], fh)
+            self.assertEqual(gate.main(["--report", report_path, "--facts", facts_path]), 1)
+            self.assertEqual(gate.main(["--report", report_path, "--facts", os.path.join(tmp, "nope.json")]), 2)
+
+
+
+
+class HardeningTests(unittest.TestCase):
+    """Findings from the cross-model QE round — each closed with its own test."""
+
+    def test_qe1_hand_built_record_cannot_mint_fetch_verified(self):
+        """A duck-typed record with four plausible attributes minted FETCH_VERIFIED
+        without any network I/O. The record must be authentic, not merely shaped right."""
+        v = _verifier()
+        forged = ef.FetchRecord(
+            url="https://pubmed.ncbi.nlm.nih.gov/1", final_url="https://pubmed.ncbi.nlm.nih.gov/1",
+            status=200, sha256_body="c" * 64, bytes_len=5, fetched_at="2026-08-03T00:00:00Z",
+        )  # constructed by hand → no witness
+        self.assertFalse(forged.is_authentic())
+        with self.assertRaises(ValueError) as ctx:
+            v.create_fetched_fact(claim="c", fetch_record=forged, issuer="researcher")
+        self.assertIn("fetch_source", str(ctx.exception))
+
+        import types
+        ns = types.SimpleNamespace(status=200, final_url="u", sha256_body="d" * 64, fetched_at="t")
+        with self.assertRaises(ValueError):
+            v.create_fetched_fact(claim="c", fetch_record=ns, issuer="researcher")
+
+    def test_qe6_tier_ceiling_is_actually_applied_to_v2_facts(self):
+        """The documented min(trust, evidence, tier) was not implemented — tier was
+        never consulted, so an unknown-domain fact kept 0.60 instead of 0.40."""
+        v = _verifier()
+        unknown = v.create_listing_fact(claim="c", source_url="https://some-blog.example/p", reason="listing")
+        self.assertEqual(v.verify_fact(unknown).confidence, 0.40, "tier D must cap below the 0.50 evidence ceiling")
+        known = v.create_listing_fact(claim="c", source_url="https://www.cochrane.org/x", reason="listing")
+        self.assertEqual(v.verify_fact(known).confidence, 0.50, "tier A leaves the evidence ceiling as the binding one")
+
+    def test_qe6b_legacy_facts_are_not_retroactively_rescored(self):
+        """Wiring a NEW ceiling must not change how OLD records score."""
+        v = _verifier()
+        legacy = v.create_signed_fact(claim="c", source_url="https://some-blog.example/p",
+                                      source_content="b", issuer="researcher")
+        self.assertEqual(v.verify_fact(legacy).confidence, 0.60, "a v1 fact keeps its original semantics")
+
+    def test_qe16_frozen_v1_fixture_still_verifies(self):
+        """Backward compatibility proven against a STORED artifact, not against the
+        current implementation verifying its own current output — a regression that
+        changed signing AND verification together would pass that weaker check."""
+        import os
+        path = os.path.join(os.path.dirname(os.path.abspath(__file__)), "fixture_legacy_v1_fact.json")
+        with open(path, "r", encoding="utf-8") as handle:
+            fixture = json.load(handle)
+        verifier = ev.Ed25519Verifier()
+        fact = ev.SignedFact.from_dict(fixture["fact"])
+        self.assertIsNone(fact.evidence_class, "the fixture is a genuine pre-axis fact")
+        self.assertTrue(verifier.verify_fact(fact).verified, "a frozen v1 fact must verify forever")
+
+    def test_qe2_empty_ledger_cannot_clear_a_report(self):
+        """Passing an empty facts file made any medical report exit 0."""
+        import tempfile, os
+        with tempfile.TemporaryDirectory() as tmp:
+            report = os.path.join(tmp, "r.md"); facts = os.path.join(tmp, "f.json")
+            open(report, "w").write("Any claim at all appears in this report body.")
+            json.dump([], open(facts, "w"))
+            self.assertEqual(gate.main(["--report", report, "--facts", facts]), 2,
+                             "an empty ledger is unevaluable, never clean")
+
+    def test_qe3_tampered_fact_is_caught_by_the_gate_not_just_the_verifier(self):
+        """Flipping a signed ASSERTED record to FETCH_VERIFIED in the JSON fooled the
+        gate: it read evidence_class as an unsigned string and never verified."""
+        v = _verifier()
+        asserted = v.create_asserted_fact(claim="the IMEI ban was introduced in Turkey")
+        forged = json.loads(asserted.to_json())
+        forged["evidence_class"] = ev.EVIDENCE_FETCH_VERIFIED
+        findings = gate.verify_ledger_signatures([forged])
+        self.assertTrue(findings)
+        self.assertEqual(findings[0].kind, "TAMPERED_FACT")
+
+    def test_qe5_every_occurrence_needs_its_own_marker(self):
+        claim = "transferrin saturation rose from 37 to 53 percent"
+        text = (f"Early on we note that {claim} (LISTING_ONLY: не открывалась)." + " filler." * 120 +
+                f" Later we repeat that {claim} without any warning at all.")
+        findings, _ = gate.evaluate(text, [{"claim": claim, "source_url": "u", "evidence_class": "LISTING_ONLY"}])
+        self.assertEqual(len(findings), 1, "one marked mention must not clear an unmarked one elsewhere")
+
+    def test_qe4_short_and_numeric_paraphrase_is_detected(self):
+        """`LDL rose 40%` vs `LDL increased 40%` shares the number, not long words."""
+        claim = "LDL rose 40% on the higher dose"
+        report = "In that arm LDL increased 40% on the higher dose, which we consider material."
+        findings, _ = gate.evaluate(report, [{"claim": claim, "source_url": "u", "evidence_class": "ASSERTED"}])
+        self.assertEqual(len(findings), 1)
+
+    def test_qe4b_claim_wrapped_across_lines_is_detected(self):
+        claim = "transferrin saturation above 45 percent warrants attention in men"
+        report = "We note transferrin saturation\nabove 45 percent warrants\nattention in men here."
+        findings, _ = gate.evaluate(report, [{"claim": claim, "source_url": "u", "evidence_class": "ASSERTED"}])
+        self.assertEqual(len(findings), 1, "markdown wrapping must not hide a claim from the gate")
+
+    def test_qe9_unrecognised_evidence_class_is_a_violation_not_legacy(self):
+        claim = "iron overload warrants HFE testing in this context"
+        report = f"Our position: {claim}, pending review."
+        findings, counts = gate.evaluate(report, [{"claim": claim, "source_url": "u", "evidence_class": "ASSERTED "}])
+        self.assertEqual(len(findings), 1)
+        self.assertEqual(findings[0].kind, "UNRECOGNISED_EVIDENCE_CLASS")
+
+    def test_qe9b_malformed_ledger_entry_refuses_evaluation(self):
+        import tempfile, os
+        with tempfile.TemporaryDirectory() as tmp:
+            report = os.path.join(tmp, "r.md"); facts = os.path.join(tmp, "f.json")
+            open(report, "w").write("body")
+            json.dump([{"claim": "ok", "evidence_class": "ASSERTED"}, "not-an-object"], open(facts, "w"))
+            self.assertEqual(gate.main(["--report", report, "--facts", facts]), 2)
+
+    def test_qe8_ssrf_private_addresses_are_refused(self):
+        for url in ("http://127.0.0.1/x", "http://localhost/x", "http://169.254.169.254/latest/meta-data/",
+                    "http://10.0.0.1/x", "http://192.168.1.1/x"):
+            failure = ef.fetch_source(url, timeout=2)
+            self.assertIsInstance(failure, ef.FetchFailure, f"{url} must be refused")
+            self.assertIn("non-public", failure.reason)
+
+    def test_qe12_unbounded_max_bytes_is_refused(self):
+        failure = ef.fetch_source("https://example.com/", max_bytes=10 ** 12)
+        self.assertIsInstance(failure, ef.FetchFailure)
+        self.assertIn("max_bytes", failure.reason)
+
+    def test_qe11_malformed_urls_return_named_failures_not_exceptions(self):
+        for url in ("http://[::1", "http://exa mple.com/x", "http://host:notaport/x", "notaurl"):
+            result = ef.fetch_source(url, timeout=2)
+            self.assertIsInstance(result, ef.FetchFailure, f"{url!r} must degrade, not raise")
+
+    def test_qe13_non_http_scheme_gets_no_tier(self):
+        self.assertEqual(st.classify_source("file://who.int/etc/passwd").tier, st.TIER_D)
+
+    def test_qe14_future_dated_source_is_flagged(self):
+        stale, reason = st.is_stale("2099-01-01", kind="guideline")
+        self.assertTrue(stale)
+        self.assertIn("future", reason)
+
+
+class LearningBridgeTests(unittest.TestCase):
+    """Slice H — the privacy invariant, rebuilt after a cross-model review broke the
+    first design. The guard is an ALLOWLIST (a method lesson carries no digits and no
+    identifiers), because enumerating what personal data looks like is an arms race
+    whose every gap is a leaked medical fact."""
+
+    def setUp(self):
+        import learning_bridge
+        self.lb = learning_bridge
+
+    def test_method_lessons_pass(self):
+        for good in (
+            "total testosterone is uninterpretable without SHBG — always order the companion test",
+            "a relative risk without an absolute one misleads; convert before reporting",
+            "check the study population before transferring an effect to a patient profile",
+            "a prolonged fast lowers total testosterone substantially, with LH down and FSH normal",
+        ):
+            self.assertTrue(self.lb.check_lesson(good).ok, good)
+
+    def test_every_measured_bypass_from_the_review_is_closed(self):
+        """These EXACT strings were measured passing by the reviewer. Each is a
+        regression anchor: they must never be accepted again."""
+        for bad in (
+            "TSH was 8.04 mIU/L when fasting",            # threshold-word laundering
+            "testosterone 8.04 nmol/l was below baseline",
+            "Alice's BMI 25 was below baseline",
+            "Patient John Smith has HIV",                  # a name
+            "MRN 84729163: creatinine elevated",           # an identifier
+            "reach me at doctor@clinic.example",           # an email
+            "call +7 916 123 45 67",                       # a phone
+            "05/08/2026 repeat the panel",                 # a non-ISO date
+            "8 мая 2026 пересдать",                        # a Russian date
+            "sodium 128 mEq/L",                            # a unit outside the old list
+            "creatinine 130 µmol/L",                       # a micro sign
+            "8.04 nanomoles per litre",                    # a spelled-out unit
+        ):
+            self.assertFalse(self.lb.check_lesson(bad).ok, f"must refuse: {bad}")
+
+    def test_a_number_needs_an_EXPLICIT_human_decision_never_an_inferred_one(self):
+        """The first design inferred 'this number is a threshold' from a nearby word,
+        and one stray 'when' laundered a lab value. Now a human passes the flag."""
+        threshold = "transferrin saturation above 45% warrants attention in men"
+        self.assertFalse(self.lb.check_lesson(threshold).ok, "digits refused by default")
+        self.assertTrue(self.lb.check_lesson(threshold, allow_numbers=True).ok)
+
+    def test_the_flag_cannot_wave_through_a_person_or_an_identifier(self):
+        self.assertFalse(self.lb.check_lesson("у пациента 45%", allow_numbers=True).ok)
+        self.assertFalse(self.lb.check_lesson("MRN 84729163 note", allow_numbers=True).ok)
+        self.assertFalse(self.lb.check_lesson("Patient John Smith 45%", allow_numbers=True).ok)
+
+    def test_the_accept_message_does_NOT_claim_safety(self):
+        """A shape detector may not issue a safety certificate — saying 'safe to teach'
+        transfers responsibility the guard does not have."""
+        note = self.lb.check_lesson("a method lesson about companion tests").note
+        self.assertNotIn("safe to teach", note)
+        self.assertIn("not a safety certificate", note)
+        self.assertIn("responsible", note)
+
+    def test_empty_lesson_is_refused(self):
+        self.assertFalse(self.lb.check_lesson("   ").ok)
+
+    def test_absent_dz_is_a_NOTE_not_a_failure(self):
+        original = self.lb.shutil.which
+        self.lb.shutil.which = lambda _name: None
+        try:
+            self.assertIn("self-learning is OFF", self.lb.status())
+            self.assertIn("self-learning is OFF", self.lb.recall("anything"))
+            code, message = self.lb.teach("a valid method lesson about companion tests")
+            self.assertEqual(code, 0, "a missing optional dependency is not an error")
+            self.assertIn("self-learning is OFF", message)
+        finally:
+            self.lb.shutil.which = original
+
+    def test_privacy_guard_runs_BEFORE_any_dz_call(self):
+        calls = []
+        original = self.lb._run_dz
+        self.lb._run_dz = lambda *a, **k: (calls.append(a) or (0, "", ""))
+        try:
+            code, message = self.lb.teach("тестостерон 8.04 нмоль/л у пациента")
+            self.assertEqual(code, 1)
+            self.assertIn("REFUSED", message)
+            self.assertEqual(calls, [], "no dz call may happen for a refused lesson")
+        finally:
+            self.lb._run_dz = original
+
+    def test_argument_injection_through_the_query_is_refused(self):
+        """`recall("--all")` would become `dz recall --all …` and dump the whole store.
+        This is ARGUMENT injection — shell quoting does not address it."""
+        calls = []
+        original = self.lb._run_dz
+        self.lb._run_dz = lambda *a, **k: (calls.append(a) or (0, "", ""))
+        try:
+            self.assertIn("would be read as an option", self.lb.recall("--all"))
+            code, msg = self.lb.teach("--reward 1.0 laundered")
+            self.assertEqual(code, 1)
+            self.assertIn("read it as an option", msg)
+            self.assertEqual(calls, [], "neither call may reach dz")
+        finally:
+            self.lb._run_dz = original
+
+    def test_older_cli_is_detected_by_CAPABILITY_not_by_exit_code(self):
+        """The sharpest finding of the review: the previous dz did NOT reject --domain.
+        Its parser accepted any `--key value` and cmdRecall ignored it, exiting 0 with
+        unfiltered results — so an exit-code test could never fire, and the earlier
+        version of THIS test fabricated a failure that no release ever produced. The
+        observable difference is the boost note; its absence is what 'too old' means."""
+        original = self.lb._run_dz
+        # Old CLI: exit 0, results, and NO boost note.
+        self.lb._run_dz = lambda *a, **k: (0, "dz recall \"x\"  —  1 hit(s)\n  [0.90] (general) a lesson", "")
+        try:
+            out = self.lb.recall("transferrin")
+            self.assertIn("a lesson", out, "the results are still returned")
+            self.assertIn("WITHOUT the domain boost", out)
+            self.assertIn("predates", out)
+        finally:
+            self.lb._run_dz = original
+
+    def test_current_cli_with_the_boost_note_reports_no_degradation(self):
+        """The note text here is the REAL renderer output, not a paraphrase. The earlier
+        version of this test invented a format the CLI never produced, so it blessed the
+        substring check instead of proving the capability. The two tail phrases are
+        pinned on the TypeScript side by a matching test."""
+        original = self.lb._run_dz
+        # Copied VERBATIM from a live run:
+        #   node dist/bin.js recall "signature" --limit 2 --domain testing
+        real_note = ('  domain "health-research": among 6 candidate(s) — 1 exact match(es), '
+                     '3 changed position; foreign-domain lessons kept (a boost, not a filter)')
+        self.lb._run_dz = lambda *a, **k: (
+            0, 'dz recall "x"  —  1 hit(s)\n  [0.90] (health-research) a lesson\n' + real_note, "")
+        try:
+            out = self.lb.recall("transferrin")
+            self.assertNotIn("predates", out)
+        finally:
+            self.lb._run_dz = original
+
+    def test_the_no_match_note_ALSO_counts_as_capability(self):
+        """A --domain run that matched nothing still proves the CLI understands --domain.
+        Reading only the 'a boost, not a filter' tail would have reported a perfectly
+        current CLI as too old whenever the domain happened to match nothing."""
+        original = self.lb._run_dz
+        real_note = ('  domain "health-research": no lesson in this result carries it — '
+                     'order unchanged, nothing was hidden')
+        self.lb._run_dz = lambda *a, **k: (0, 'dz recall "x"  —  1 hit(s)\n  [0.90] (general) x\n' + real_note, "")
+        try:
+            self.assertNotIn("predates", self.lb.recall("x"))
+        finally:
+            self.lb._run_dz = original
+
+    def test_capability_cannot_be_FORGED_by_recalled_lesson_content(self):
+        """Round 2: the marker was the bare substring `domain "`, which a LESSON can
+        contain. A probe the payload can forge is not a probe — an old CLI returning
+        this ordinary lesson was certified as boost-capable."""
+        original = self.lb._run_dz
+        self.lb._run_dz = lambda *a, **k: (
+            0,
+            'dz recall "x"  —  1 hit(s)\n'
+            '  [0.90] (general) remember domain "ownership" before reporting',
+            "",
+        )
+        try:
+            self.assertIn("predates", self.lb.recall("x"))
+        finally:
+            self.lb._run_dz = original
+
+    # ---------------------------------------------------------------- round 2
+    # Every case below is a REPRODUCER the cross-model reviewer ran against the
+    # previous guard and got the wrong answer for. They stay here permanently: a
+    # privacy guard is only as good as the bypasses it can no longer be talked into.
+
+    def test_round2_a_name_beside_a_diagnosis_is_REFUSED(self):
+        """The worst miss of the round. The old rule hunted a name — two capitalised
+        words in a row, exempting the sentence start — so BOTH of these passed."""
+        for leak in ("John Smith has HIV", "Patient John has HIV"):
+            with self.subTest(leak=leak):
+                self.assertFalse(self.lb.check_lesson(leak).ok)
+
+    def test_round2_a_capitalised_word_after_the_first_is_refused_whatever_it_is(self):
+        """The replacement rule is a property of the ACCEPTED form (a method lesson is
+        written in lower case), not a hunt for names — because names cannot be listed.
+        It refuses legitimate title-cased method vocabulary too, deliberately: the fix
+        is one keystroke and the false negative it closes is a named person."""
+        verdict = self.lb.check_lesson("compare Testosterone Replacement Therapy against placebo")
+        self.assertFalse(verdict.ok)
+        self.assertIn("lower case", verdict.note)
+        # …and the lower-cased form is accepted, so the advice actually works.
+        self.assertTrue(self.lb.check_lesson("compare testosterone replacement therapy against placebo").ok)
+
+    def test_round2_ALL_CAPS_and_mixed_case_acronyms_still_pass(self):
+        """The capitalisation rule must not cost the vocabulary lessons are written in."""
+        for ok_text in (
+            "total testosterone is uninterpretable without SHBG",
+            "a single ferritin cannot separate overload from inflammation, pair it with CRP",
+            "apoB tracks risk better than LDL alone",
+        ):
+            with self.subTest(text=ok_text):
+                self.assertTrue(self.lb.check_lesson(ok_text).ok, ok_text)
+
+    def test_round2_a_value_SPELLED_OUT_is_still_a_value(self):
+        """`John's TSH was eight point zero four` carried a reading past a digit-only rule."""
+        self.assertFalse(self.lb.check_lesson("his tsh was eight point zero four").ok)
+        # A lone number-word is ordinary method prose and must NOT be refused.
+        self.assertTrue(self.lb.check_lesson("one marker alone cannot close the question").ok)
+
+    def test_round2_allow_numbers_never_waves_through_a_person(self):
+        """--allow-numbers is for a guideline threshold, never for a person plus a
+        reading. The old person list held only `his`/`her`, so these walked through."""
+        for leak in ("she has TSH 8.04 mIU/L", "subject has TSH 8.04 mIU/L",
+                     "the participant had ferritin 512"):
+            with self.subTest(leak=leak):
+                self.assertFalse(self.lb.check_lesson(leak, allow_numbers=True).ok)
+
+    def test_round2_only_a_double_dash_is_refused_as_an_option(self):
+        """`dz` treats `-contrast` as ordinary positional text (measured). Refusing it
+        blocked legitimate lessons to defend against nothing, and a guard that refuses
+        safe input teaches people to route around the guard."""
+        self.assertTrue(self.lb.check_lesson("-negative findings still require confirmation").ok)
+        self.assertIn("--", self.lb.teach("--all")[1])
+        self.assertIn("--", self.lb.recall("--all"))
+
+    def test_round2_the_docstring_no_longer_promises_a_retry_that_does_not_exist(self):
+        """The prose claimed recall retries without --domain; the code makes ONE call.
+        Documentation of behaviour that does not exist is a defect with no stack trace,
+        so it gets a test like any other."""
+        calls = []
+        original = self.lb._run_dz
+
+        def record(args, **kwargs):
+            calls.append(list(args))
+            return 1, "", "unknown option"
+
+        self.lb._run_dz = record
+        try:
+            self.lb.recall("x")
+            self.assertEqual(len(calls), 1, "exactly one call, no fallback")
+        finally:
+            self.lb._run_dz = original
+        self.assertNotIn("we retry WITHOUT the flag", self.lb.recall.__doc__ or "")
+
+
+    # ---------------------------------------------------------------- round 3
+    # The third review found the SAME class of defect a third time: two of the three
+    # clauses were still enumerations. These anchor the token-allowlist rewrite.
+
+    def test_round3_a_short_or_non_ascii_name_is_refused(self):
+        """`Li` was too short for the old 3-letter pattern; `Élodie` starts with a
+        Latin-1 capital it never matched; `method—John` hid behind an em dash that the
+        whitespace tokenizer did not split, landing the name inside the exempt first
+        token. Widening a name pattern buys one round; asking what an ACCEPTED token
+        looks like ends the game."""
+        for leak in ("patient Li has HIV", "patient Élodie has HIV", "method—John has HIV",
+                     "however Smith reported otherwise"):
+            with self.subTest(leak=leak):
+                self.assertFalse(self.lb.check_lesson(leak).ok, leak)
+
+    def test_round3_a_single_spelled_number_beside_a_person_is_a_reading(self):
+        """`his tsh was twelve` passed: one number word was not treated as a number.
+        A lone number word in ordinary prose still must not be refused."""
+        self.assertFalse(self.lb.check_lesson("his tsh was twelve").ok)
+        self.assertTrue(self.lb.check_lesson("one marker alone cannot close the question").ok)
+
+    def test_round3_singular_person_is_a_record_PLURAL_is_a_population(self):
+        """The first fix simply added `woman|man|adult|child` and immediately refused
+        `…warrants attention in men`, a textbook population lesson. Grammar, not a word
+        list, separates a cohort from a patient — and grammar is checkable."""
+        self.assertFalse(self.lb.check_lesson("the woman has tsh 8.04", allow_numbers=True).ok)
+        self.assertTrue(
+            self.lb.check_lesson("transferrin saturation above 45% warrants attention in men",
+                                 allow_numbers=True).ok)
+
+    def test_round3_a_token_mixing_letters_and_digits_is_an_identifier(self):
+        """`passport ab1234567` walked through --allow-numbers, because the identifier
+        list knew only email, phone and medical-record vocabulary. A threshold is a
+        number with at most a short unit after it; letters BEFORE digits is a label."""
+        for leak in ("passport ab1234567 identifies the holder",
+                     "trial NCT04368728 enrolled him at 8.04"):
+            with self.subTest(leak=leak):
+                self.assertFalse(self.lb.check_lesson(leak, allow_numbers=True).ok, leak)
+        # …and a real threshold with a unit still passes.
+        self.assertTrue(self.lb.check_lesson("a 56h fast lowers total testosterone by a third",
+                                             allow_numbers=True).ok)
+
+
+    def test_a_real_failure_is_not_disguised_as_an_old_cli(self):
+        """A crash, timeout or corrupt store must read as a failure, not as 'upgrade'."""
+        original = self.lb._run_dz
+        self.lb._run_dz = lambda *a, **k: (1, "", "store corrupt")
+        try:
+            out = self.lb.recall("x")
+            self.assertIn("WITHOUT prior lessons", out)
+            self.assertNotIn("predates", out)
+        finally:
+            self.lb._run_dz = original
+
+
+
+
+if __name__ == "__main__":
+    unittest.main()