@furongjun1999/dsh-memory 0.4.11 → 0.5.0

package/md_cg/test_i27_e041_identity.py

@@ -0,0 +1,128 @@
+# -*- coding: utf-8 -*-
+"""issue #27 守卫：E041 身份识别（归一化 + 令牌凭据），非裸字符串相等。
+
+病灶（2026-09-23 外部报告，两方独立复现）：E041「LLM 不得自己验证自己」
+的三处判据是裸 `==`（attest / link 准入门 / recalibrate）——`agent-A` 编译、
+`agent-a` 验证即可绕过并落盘（报告实测 WRITTEN=6）。而代码声明宣称
+「结构级阻断，不依赖 prompt 自觉」。
+
+修复（分层，处置强度如实声明）：
+  ①身份归一比较（_same_subject：casefold + 去空白 + 去尾部括号注记）
+    ——拦截报告表格全部同源变体（对旧实现能红）；
+  ②verifier_token 凭据通路（mdcg 令牌 HMAC 验签，与 narrowed_principal
+    同一信任源）——根本保障；令牌身份自证同样 E041；伪造令牌 fail-closed；
+  ③诚实降级标注——无令牌时 AttestResult.verifier_identity =
+    "self-reported"，下游策略/审计可识别。
+"""
+import json
+import os
+import sys
+import tempfile
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from md_cg import ccgc, tokens
+
+PASS = 0
+FAIL = 0
+FAILS = []
+
+
+def check(name, cond, detail=""):
+    global PASS, FAIL
+    if cond:
+        PASS += 1
+        print(f"  OK   {name}")
+    else:
+        FAIL += 1
+        FAILS.append(name)
+        print(f"  FAIL {name}  {detail}")
+
+
+def main():
+    # 令牌文件隔离（issue/verify 经 TOKEN_FILE_ENV 同源）
+    tf = tempfile.mkdtemp(prefix="mdcg_i27_tok_")
+    tokens.TOKEN_FILE_ENV and os.environ.setdefault(tokens.TOKEN_FILE_ENV
+                                                    if isinstance(tokens.TOKEN_FILE_ENV, str)
+                                                    else "MDCG_TOKEN_FILE",
+                                                    os.path.join(tf, "tokens.json"))
+    tok_env = tokens.token_file()
+    os.environ[tokens.TOKEN_FILE_ENV] = tok_env
+
+    print("== X1 归一化：报告表格全形态拦截（attest 面，能红旧实现）==")
+    compiled = "agent-A"
+    variants = {
+        "完全相同（旧实现也拦）": "agent-A",
+        "小写（报告 BYPASS 形态）": "agent-a",
+        "全大写": "AGENT-A",
+        "括号注记后缀": "agent-A（复核）",
+        "夹空白": " agent - a ",
+    }
+    for label, ver in variants.items():
+        r = ccgc.attest("node_x", ccgc.ACCEPT, ver, compiled, ledger=False)
+        want = label != "完全相同（旧实现也拦）"
+        check(f"X1 {label} → E041{'（旧实现也拦，回归对照）' if not want else '（能红旧实现）'}",
+              (not r.ok) and r.error.startswith("E041"),
+              f"error={r.error[:80]}")
+    check("X1z 自报身份诚实标注（verifier_identity=self-reported）",
+          r.verifier_identity == "self-reported")
+
+    print("== X2 verifier_token 凭据通路（根本保障）==")
+    tk = tokens.issue("verifier", actor="external-reviewer",
+                      path=tok_env)["token"]
+    r2 = ccgc.attest("node_x", ccgc.ACCEPT, "随便自报的字符串",
+                     "agent-A", ledger=False, verifier_token=tk)
+    check("X2a 令牌身份覆盖自报（verifier=令牌 actor）",
+          r2.ok and r2.verifier == "external-reviewer"
+          and r2.verifier_identity == "token",
+          f"ok={r2.ok} verifier={r2.verifier} id={r2.verifier_identity}")
+    check("X2b 不同主体凭据放行（非自证）",
+          r2.ok is True)
+
+    print("== X3 令牌身份自证仍 E041（归一化形态）==")
+    tk_self = tokens.issue("verifier", actor="Agent-a",
+                           path=tok_env)["token"]
+    r3 = ccgc.attest("node_x", ccgc.ACCEPT, "whoever",
+                     "agent-A", ledger=False, verifier_token=tk_self)
+    check("X3 令牌 actor 与编译方归一同源 → E041",
+          (not r3.ok) and r3.error.startswith("E041"),
+          f"error={r3.error[:80]}")
+
+    print("== X4 伪造令牌 fail-closed ==")
+    r4 = ccgc.attest("node_x", ccgc.ACCEPT, "whoever",
+                     "agent-A", ledger=False,
+                     verifier_token="mdcg1.verifier.tk_fake.badsecretvalue")
+    check("X4 令牌验签失败 → 拒绝（不回落自报）",
+          (not r4.ok) and "E041" in r4.error and "令牌" in r4.error,
+          f"error={r4.error[:90]}")
+
+    print("== X5 link 准入门归一化（能红旧实现）==")
+    compiled_obj = ccgc.CompileResult(node_id="node_x", actor="agent-A")
+    compiled_obj.success = True
+    att_ok = ccgc.attest("node_x", ccgc.ACCEPT, "agent-a",
+                         "agent-A", ledger=False)
+    # attest 已拦（attest.ok=False），模拟旧数据面：手构 ok 签章验证 link 门自身
+    att = ccgc.AttestResult(node_id="node_x", state=ccgc.ACCEPT,
+                            verifier="agent-a", compiled_by="agent-A",
+                            ok=True, token="t")
+    lr = ccgc.link(compiled_obj, att, apply=False, actor="agent-A")
+    check("X5 link 门大小写变体 → E041",
+          any(e.startswith("E041") for e in lr.errors),
+          f"errors={lr.errors[:2]}")
+
+    print("== X6 不同主体正常放行（不误杀）==")
+    att_ok2 = ccgc.attest("node_x", ccgc.ACCEPT, "external-reviewer",
+                          "agent-A", ledger=False)
+    check("X6 真不同主体签章 ok（召回面不回归）",
+          att_ok2.ok and att_ok2.verifier_identity == "self-reported")
+
+    print()
+    if FAILS:
+        print(f"FAILED: {len(FAILS)} 项 → {', '.join(FAILS)}")
+        return 1
+    print(f"ALL OK: {PASS} 项（issue #27 E041 身份识别守卫全绿）")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/md_cg/test_i28_hotcache_prodpath.py

@@ -0,0 +1,122 @@
+# -*- coding: utf-8 -*-
+"""issue #28 守卫：hotcache 生产路径挂载（读侧写侧已接、中间从未装上）。
+
+病灶（2026-09-23 外部报告）：search_rrf 读 hotcache（mdcos:1195）、writepipe
+写后失效（writepipe:436），但全仓无任何 attach() 调用——生产 get(cg) 恒
+None，重复 query 永远全量重扫。与 #25 同模式：读写两侧在、挂载点悬空。
+
+修复：MdCGOS.__init__ 按 MDCG_HOTCACHE=1 显式挂载（默认关零变更）；
+容量 env 可配（MDCG_HOTCACHE_MAX_NODES/MAX_QUERIES）。
+
+断言：
+  H1 默认零变更（无 env → get 为 None，能红「无条件挂载」的过度修复）；
+  H2 开关开启 → 生产类（MdCGSecure）get 非 None（能红旧实现）；
+  H3 query 缓存命中（重复 query meta.cached=True + stats）；
+  H4 写后失效联动（写入 → query 缓存全清，不返回陈旧结果）；
+  H5 容量 env 生效（max_nodes 缩容 → LRU 淘汰按新上限）。
+"""
+import json
+import os
+import sys
+import tempfile
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from md_cg import hotcache
+from md_cg.mdcos import MdCGSecure
+
+PASS = 0
+FAIL = 0
+FAILS = []
+
+
+def check(name, cond, detail=""):
+    global PASS, FAIL
+    if cond:
+        PASS += 1
+        print(f"  OK   {name}")
+    else:
+        FAIL += 1
+        FAILS.append(name)
+        print(f"  FAIL {name}  {detail}")
+
+
+def _mk(root):
+    from md_cg.security import Principal
+    return MdCGSecure(root, principal=Principal(
+        actor="t_i28", clearance="secret", can_write=True,
+        role="designer", auth_mode="test"))
+
+
+def main():
+    print("== H1 默认零变更 ==")
+    os.environ.pop("MDCG_HOTCACHE", None)
+    cg1 = _mk(tempfile.mkdtemp(prefix="mdcg_i28a_"))
+    check("H1 无 env → 不挂载（get=None；能红『无条件挂载』误修）",
+          hotcache.get(cg1) is None)
+
+    print("== H2 开关挂载（能红旧实现）==")
+    os.environ["MDCG_HOTCACHE"] = "1"
+    try:
+        cg2 = _mk(tempfile.mkdtemp(prefix="mdcg_i28b_"))
+        check("H2 生产类构造后 hotcache 已挂（旧实现恒 None）",
+              hotcache.get(cg2) is not None)
+        cg2.add("mem_h1", "# 功能名：热缓存探针\n# 正文：hotcache probe 内容",
+                layer="knowledge")
+
+        print("== H3 query 缓存命中 ==")
+        _r1, m1 = cg2.search_rrf("hotcache probe") if hasattr(
+            cg2, "search_rrf") else (None, {})
+        _r2, m2 = cg2.search_rrf("hotcache probe")
+        check("H3a 重复 query 命中缓存（meta.cached=True）",
+              m2.get("cached") is True,
+              json.dumps(m2, ensure_ascii=False, default=str)[:160])
+        st = hotcache.get(cg2).stats()
+        check("H3b 统计计数可见（query_hits>=1）",
+              st.get("query_hits", 0) >= 1, json.dumps(st))
+
+        print("== H4 写后失效联动（生产写入路径）==")
+        # 失效挂在 writepipe 的 after_trust（MCP op=write 路径）——库层直调
+        # cg.add 不经过该链（内部/测试场景），其失效缺口如实登记不在本断言。
+        from md_cg.mcp_server import _cg_dispatch
+        _w = _cg_dispatch(cg2, {"op": "write", "content_kind": "code",
+                                "layer": "knowledge", "node_id": "mem_h2",
+                                "content": "def h2():\n    return 'hotcache new'\n"})
+        check("H4a 生产写入成功（失效触发前提）",
+              _w.get("committed") is True,
+              json.dumps(_w, ensure_ascii=False, default=str)[:160])
+        _r3, m3 = cg2.search_rrf("hotcache probe")
+        check("H4b 写入后 query 缓存全清（不返回陈旧结果）",
+              m3.get("cached") is not True,
+              json.dumps({k: m3.get(k) for k in ("cached", "tier")},
+                         ensure_ascii=False))
+
+        print("== H5 容量 env 生效 ==")
+        os.environ["MDCG_HOTCACHE_MAX_NODES"] = "3"
+        cg3 = _mk(tempfile.mkdtemp(prefix="mdcg_i28c_"))
+        hc3 = hotcache.get(cg3)
+        check("H5a 容量 env 进入实例（max_nodes=3）",
+              hc3 is not None and hc3._max_nodes == 3,
+              f"max_nodes={getattr(hc3, '_max_nodes', None)}")
+        for i in range(6):
+            hc3.put_node(f"n{i}", {"layer": "knowledge"}, "")
+            _ = hc3.get_node(f"n{i}")     # 反复摸 n0..n5 → n0/n1 应被挤出
+        check("H5b LRU 按新上限淘汰（size==3，最旧两节点不在）",
+              len(hc3._nodes) == 3
+              and hotcache.get(cg3).get_node("n0") is None
+              and hotcache.get(cg3).get_node("n5") is not None,
+              f"size={len(hc3._nodes)}")
+    finally:
+        os.environ.pop("MDCG_HOTCACHE", None)
+        os.environ.pop("MDCG_HOTCACHE_MAX_NODES", None)
+
+    print()
+    if FAILS:
+        print(f"FAILED: {len(FAILS)} 项 → {', '.join(FAILS)}")
+        return 1
+    print(f"ALL OK: {PASS} 项（issue #28 热缓存生产路径守卫全绿）")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/md_cg/test_identity_attribution.py

@@ -1,147 +1,147 @@
-# -*- coding: utf-8 -*-
-"""test_identity_attribution · 写入归属（writer/session/harness）与检索会话过滤
-
-背景：多会话共用一个 root 时，读取记忆无法区分「本会话写的」与「其他会话写的」。
-修复：写入自动归属（MdCGSecure 写路径注入 writer/session/harness）+ 检索
-session= 过滤（_candidates 一处生效：search/search_rrf/recall 全链路）+
-审计/提案入队补 session + MDCG_SESSION env（部署侧固定会话归属）。
-边界：归属是归因维度不参与授权；MCP 面不透传写入归属入参（客户端不得伪造），
-库层调用方可显式覆盖（setdefault）；writer 语义=最后写入者。
-"""
-import glob
-import json
-import shutil
-import sys
-import tempfile
-import os
-
-sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
-
-# Windows cmd 默认 GBK 代码页：带圈数字 ⑪⑫⑬ 等不在 GBK 内，打印即
-# UnicodeEncodeError，且崩在断言之后、报告之前 —— 同一测试「因环境而异」。
-# 测试自带 UTF-8 兜底，不依赖调用方记得加 -X utf8（可复现性纪律）。
-if hasattr(sys.stdout, "reconfigure"):
-    sys.stdout.reconfigure(encoding="utf-8", errors="replace")
-
-from md_cg.mdcg import MdCG
-from md_cg.mdcos import MdCGSecure
-from md_cg.security import DEFAULT_SENSITIVITY, Principal
-
-_ok = 0
-_fail = []
-
-
-def check(name, cond, detail=""):
-    global _ok
-    if cond:
-        _ok += 1
-        print("[PASS] " + name)
-    else:
-        _fail.append(name)
-        print("[FAIL] %s  · %s" % (name, str(detail)[:240]))
-
-
-def _p(actor, session):
-    return Principal(actor=actor, clearance=DEFAULT_SENSITIVITY,
-                     can_write=True, can_admin=True, role="designer",
-                     session=session, harness="test-harness")
-
-
-def _last_jsonl(pattern):
-    rec = None
-    for path in glob.glob(pattern, recursive=True):
-        with open(path, encoding="utf-8", errors="replace") as f:
-            for line in f:
-                if line.strip():
-                    rec = json.loads(line)
-    return rec
-
-
-def _row(r):
-    """search 原生返回 (node, score, qual, prov) tuple；dict 则原样。"""
-    return r if isinstance(r, dict) else (r[0] if r else {})
-
-
-root = tempfile.mkdtemp(prefix="mdcg_attr_")
-try:
-    cg = MdCGSecure(root, principal=_p("alice", "sess_A"))
-
-    # ① 写入自动归属
-    nid1 = cg.add("n1", "甲会话写的知识条目", layer="knowledge")
-    fm1 = cg.get(nid1)["frontmatter"]
-    check("①写入自动归属 writer/session",
-          fm1.get("writer") == "alice" and fm1.get("session") == "sess_A", fm1)
-    check("①b harness 归属落盘", fm1.get("harness") == "test-harness", fm1)
-
-    # ② 索引同步（_stage 透传）
-    e1 = cg.index["nodes"].get(nid1) or {}
-    check("②索引带归属", e1.get("session") == "sess_A", e1)
-
-    # ③ 显式覆盖（库层调用方可传；MCP 面不透传）
-    nid2 = cg.add("n2", "显式会话标签条目", layer="knowledge", session="sess_custom")
-    fm2 = cg.get(nid2)["frontmatter"]
-    check("③显式覆盖尊重调用方", fm2.get("session") == "sess_custom", fm2)
-
-    # ④ 更新刷新为最后写入者（另一身份写同 id）
-    cg2 = MdCGSecure(root, principal=_p("bob", "sess_B"))
-    cg2.add("n1", "乙会话更新了这条", layer="knowledge")
-    fm1b = cg.get("n1")["frontmatter"]
-    check("④更新刷新 writer/session",
-          fm1b.get("writer") == "bob" and fm1b.get("session") == "sess_B", fm1b)
-
-    # ⑤ 检索透出归属（node.frontmatter 零改动自动生效）
-    res, _meta = cg2.search("乙会话更新")
-    hit = next((_row(r) for r in res if _row(r).get("id") == "n1"), None)
-    check("⑤检索透出归属",
-          bool(hit) and (hit.get("frontmatter") or {}).get("session") == "sess_B",
-          [_row(r).get("id") for r in res])
-
-    # ⑥ search 会话过滤
-    res_b, _ = cg2.search("知识", session="sess_B")
-    ids_b = {_row(r).get("id") for r in res_b}
-    check("⑥search 会话过滤", "n1" in ids_b and "n2" not in ids_b, ids_b)
-
-    # ⑦ recall 会话过滤（RRF 主链）
-    pack = cg2.recall("知识", session="sess_custom")
-    hits = pack.get("pack") if isinstance(pack, dict) else None
-    hid = {_row(h).get("id") for h in (hits or [])}
-    check("⑦recall 会话过滤", "n2" in hid and "n1" not in hid,
-          list(hid) or (list(pack.keys()) if isinstance(pack, dict) else type(pack)))
-
-    # ⑧ 审计带 session
-    last_audit = _last_jsonl(os.path.join(root, "**", "*audit*.jsonl"))
-    check("⑧审计带 session",
-          bool(last_audit) and last_audit.get("session") == "sess_B", last_audit)
-
-    # ⑨ propose 入队带 session
-    cg2.propose("n_prop", "提案内容", layer="knowledge")
-    rec_inbox = _last_jsonl(os.path.join(root, "**", "*inbox*.jsonl"))
-    check("⑨提案入队带 session",
-          bool(rec_inbox) and rec_inbox.get("session") == "sess_B", rec_inbox)
-
-    # ⑩ 旧节点兼容（基类写入、无归属字段）
-    cg0 = MdCG(root)
-    cg0.add("legacy", "旧库无归属节点的知识", layer="knowledge")
-    cgs = MdCGSecure(root, principal=_p("carol", "sess_C"))
-    res_all, _m = cgs.search("旧库无归属")
-    check("⑩旧节点默认检索不受影响",
-          any(_row(r).get("id") == "legacy" for r in res_all),
-          [_row(r).get("id") for r in res_all])
-    res_f, _ = cgs.search("旧库无归属", session="sess_C")
-    check("⑩b 旧节点被会话过滤排除（不炸）",
-          all(_row(r).get("id") != "legacy" for r in res_f),
-          [_row(r).get("id") for r in res_f])
-
-    # ⑪⑫ 负记忆归属
-    rn = cg2.add_rejected("假设X", "已被证伪")
-    fm_r = cg2.get(rn)["frontmatter"]
-    check("⑪负记忆归属", fm_r.get("writer") == "bob"
-          and fm_r.get("session") == "sess_B", fm_r)
-    ru = cg2.add_unresolved("问题Y", "已有线索若干")
-    fm_u = cg2.get(ru)["frontmatter"]
-    check("⑫未解清单归属", fm_u.get("session") == "sess_B", fm_u)
-
-    print("\n通过 %d / 失败 %d" % (_ok, len(_fail)))
-    sys.exit(1 if _fail else 0)
-finally:
-    shutil.rmtree(root, ignore_errors=True)
+# -*- coding: utf-8 -*-
+"""test_identity_attribution · 写入归属（writer/session/harness）与检索会话过滤
+
+背景：多会话共用一个 root 时，读取记忆无法区分「本会话写的」与「其他会话写的」。
+修复：写入自动归属（MdCGSecure 写路径注入 writer/session/harness）+ 检索
+session= 过滤（_candidates 一处生效：search/search_rrf/recall 全链路）+
+审计/提案入队补 session + MDCG_SESSION env（部署侧固定会话归属）。
+边界：归属是归因维度不参与授权；MCP 面不透传写入归属入参（客户端不得伪造），
+库层调用方可显式覆盖（setdefault）；writer 语义=最后写入者。
+"""
+import glob
+import json
+import shutil
+import sys
+import tempfile
+import os
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+# Windows cmd 默认 GBK 代码页：带圈数字 ⑪⑫⑬ 等不在 GBK 内，打印即
+# UnicodeEncodeError，且崩在断言之后、报告之前 —— 同一测试「因环境而异」。
+# 测试自带 UTF-8 兜底，不依赖调用方记得加 -X utf8（可复现性纪律）。
+if hasattr(sys.stdout, "reconfigure"):
+    sys.stdout.reconfigure(encoding="utf-8", errors="replace")
+
+from md_cg.mdcg import MdCG
+from md_cg.mdcos import MdCGSecure
+from md_cg.security import DEFAULT_SENSITIVITY, Principal
+
+_ok = 0
+_fail = []
+
+
+def check(name, cond, detail=""):
+    global _ok
+    if cond:
+        _ok += 1
+        print("[PASS] " + name)
+    else:
+        _fail.append(name)
+        print("[FAIL] %s  · %s" % (name, str(detail)[:240]))
+
+
+def _p(actor, session):
+    return Principal(actor=actor, clearance=DEFAULT_SENSITIVITY,
+                     can_write=True, can_admin=True, role="designer",
+                     session=session, harness="test-harness")
+
+
+def _last_jsonl(pattern):
+    rec = None
+    for path in glob.glob(pattern, recursive=True):
+        with open(path, encoding="utf-8", errors="replace") as f:
+            for line in f:
+                if line.strip():
+                    rec = json.loads(line)
+    return rec
+
+
+def _row(r):
+    """search 原生返回 (node, score, qual, prov) tuple；dict 则原样。"""
+    return r if isinstance(r, dict) else (r[0] if r else {})
+
+
+root = tempfile.mkdtemp(prefix="mdcg_attr_")
+try:
+    cg = MdCGSecure(root, principal=_p("alice", "sess_A"))
+
+    # ① 写入自动归属
+    nid1 = cg.add("n1", "甲会话写的知识条目", layer="knowledge")
+    fm1 = cg.get(nid1)["frontmatter"]
+    check("①写入自动归属 writer/session",
+          fm1.get("writer") == "alice" and fm1.get("session") == "sess_A", fm1)
+    check("①b harness 归属落盘", fm1.get("harness") == "test-harness", fm1)
+
+    # ② 索引同步（_stage 透传）
+    e1 = cg.index["nodes"].get(nid1) or {}
+    check("②索引带归属", e1.get("session") == "sess_A", e1)
+
+    # ③ 显式覆盖（库层调用方可传；MCP 面不透传）
+    nid2 = cg.add("n2", "显式会话标签条目", layer="knowledge", session="sess_custom")
+    fm2 = cg.get(nid2)["frontmatter"]
+    check("③显式覆盖尊重调用方", fm2.get("session") == "sess_custom", fm2)
+
+    # ④ 更新刷新为最后写入者（另一身份写同 id）
+    cg2 = MdCGSecure(root, principal=_p("bob", "sess_B"))
+    cg2.add("n1", "乙会话更新了这条", layer="knowledge")
+    fm1b = cg.get("n1")["frontmatter"]
+    check("④更新刷新 writer/session",
+          fm1b.get("writer") == "bob" and fm1b.get("session") == "sess_B", fm1b)
+
+    # ⑤ 检索透出归属（node.frontmatter 零改动自动生效）
+    res, _meta = cg2.search("乙会话更新")
+    hit = next((_row(r) for r in res if _row(r).get("id") == "n1"), None)
+    check("⑤检索透出归属",
+          bool(hit) and (hit.get("frontmatter") or {}).get("session") == "sess_B",
+          [_row(r).get("id") for r in res])
+
+    # ⑥ search 会话过滤
+    res_b, _ = cg2.search("知识", session="sess_B")
+    ids_b = {_row(r).get("id") for r in res_b}
+    check("⑥search 会话过滤", "n1" in ids_b and "n2" not in ids_b, ids_b)
+
+    # ⑦ recall 会话过滤（RRF 主链）
+    pack = cg2.recall("知识", session="sess_custom")
+    hits = pack.get("pack") if isinstance(pack, dict) else None
+    hid = {_row(h).get("id") for h in (hits or [])}
+    check("⑦recall 会话过滤", "n2" in hid and "n1" not in hid,
+          list(hid) or (list(pack.keys()) if isinstance(pack, dict) else type(pack)))
+
+    # ⑧ 审计带 session
+    last_audit = _last_jsonl(os.path.join(root, "**", "*audit*.jsonl"))
+    check("⑧审计带 session",
+          bool(last_audit) and last_audit.get("session") == "sess_B", last_audit)
+
+    # ⑨ propose 入队带 session
+    cg2.propose("n_prop", "提案内容", layer="knowledge")
+    rec_inbox = _last_jsonl(os.path.join(root, "**", "*inbox*.jsonl"))
+    check("⑨提案入队带 session",
+          bool(rec_inbox) and rec_inbox.get("session") == "sess_B", rec_inbox)
+
+    # ⑩ 旧节点兼容（基类写入、无归属字段）
+    cg0 = MdCG(root)
+    cg0.add("legacy", "旧库无归属节点的知识", layer="knowledge")
+    cgs = MdCGSecure(root, principal=_p("carol", "sess_C"))
+    res_all, _m = cgs.search("旧库无归属")
+    check("⑩旧节点默认检索不受影响",
+          any(_row(r).get("id") == "legacy" for r in res_all),
+          [_row(r).get("id") for r in res_all])
+    res_f, _ = cgs.search("旧库无归属", session="sess_C")
+    check("⑩b 旧节点被会话过滤排除（不炸）",
+          all(_row(r).get("id") != "legacy" for r in res_f),
+          [_row(r).get("id") for r in res_f])
+
+    # ⑪⑫ 负记忆归属
+    rn = cg2.add_rejected("假设X", "已被证伪")
+    fm_r = cg2.get(rn)["frontmatter"]
+    check("⑪负记忆归属", fm_r.get("writer") == "bob"
+          and fm_r.get("session") == "sess_B", fm_r)
+    ru = cg2.add_unresolved("问题Y", "已有线索若干")
+    fm_u = cg2.get(ru)["frontmatter"]
+    check("⑫未解清单归属", fm_u.get("session") == "sess_B", fm_u)
+
+    print("\n通过 %d / 失败 %d" % (_ok, len(_fail)))
+    sys.exit(1 if _fail else 0)
+finally:
+    shutil.rmtree(root, ignore_errors=True)