@furongjun1999/dsh-memory 0.4.11 → 0.5.1

package/md_cg/test_n123_derive_expiry_chain.py

@@ -0,0 +1,205 @@
+# -*- coding: utf-8 -*-
+"""N123 攻击复现守卫：derive 子令牌 TTL 无上限夹紧 + 过期不沿派生链传播。
+
+缺陷（v15 留档 + 引擎域/检索域复测三度成立）：
+  ① derive() 子令牌 expires_at=(now+ttl) 不与父 expires_at 取 min——
+     父 ttl=0.5s、子 ttl=999999 时子比父多活 11.5 天；
+  ② verify_token 只查自身记录 expires_at——父令牌过期后子令牌仍以原密级通过。
+攻击面：持 delegable designer 令牌面（宿主进程/提示注入驱动 derive）先派生
+长 TTL 子令牌再令父令牌自然到期——授权回收被时间维度旁路（revoke 有级联
+tokens.py:523-526，唯过期没有，「派生只能收窄」缺时间维度）。
+
+修复方向：子 expires_at=min(请求值, 父 expires_at)（父无界取请求值）
++ verify_token 沿 parent 链传播过期校验（防环；父记录缺失告警不阻断）。
+
+运行：python -m md_cg.test_n123_derive_expiry_chain
+纪律：全程 MDCG_TOKEN_FILE / path= 指向系统临时目录哑令牌文件，不触真实令牌库。
+"""
+from __future__ import annotations
+
+import json
+import os
+import shutil
+import sys
+import tempfile
+import time
+
+from . import tokens
+from .tokens import TOKEN_FILE_ENV, TokenError
+
+PASS = FAIL = 0
+FAILS = []
+
+
+def check(name, cond, detail=""):
+    global PASS, FAIL
+    if cond:
+        PASS += 1
+        print(f"  [PASS] {name}" + (f"  · {detail}" if detail else ""))
+    else:
+        FAIL += 1
+        FAILS.append(name)
+        print(f"  [FAIL] {name}  · {detail}")
+
+
+def denied(fn, *a, **kw):
+    """执行 fn，返回 (是否被拒, 错误文本)。"""
+    try:
+        fn(*a, **kw)
+        return False, ""
+    except TokenError as e:
+        return True, str(e)
+
+
+def main():
+    sys.stdout.reconfigure(encoding="utf-8", errors="replace")
+    root = tempfile.mkdtemp(prefix="mdcg_n123_")
+    tf = os.path.join(root, "_tokens.json")
+    # 哑环境兜底：即使代码内部遗漏 path= 也绝不回落到真实 ~/.mdcg 令牌库
+    old_env = os.environ.get(TOKEN_FILE_ENV)
+    os.environ[TOKEN_FILE_ENV] = tf
+    try:
+        # ========== 攻击复现 ①：derive 长 TTL 子令牌不被父界夹紧 ==========
+        print("\n[1] derive 夹紧：子 expires_at = min(请求值, 父 expires_at)")
+        d = tokens.issue("designer", actor="n123-designer", ttl=3600.0, path=tf)
+        child = tokens.derive(d["token"], "record", actor="n123-child",
+                              ttl=999999.0, path=tf)
+        dexp = d["expires_at"]
+        cexp = child["expires_at"]
+        check("子令牌过期时间不超过父令牌", cexp is not None and dexp is not None
+              and float(cexp) <= float(dexp) + 1e-6,
+              f"child-parent={float(cexp) - float(dexp):.1f}s（旧代码 +999639s）")
+        check("夹紧开口 clamped 标注 expires_at",
+              "expires_at" in (child.get("clamped") or []),
+              f"clamped={child.get('clamped')}")
+
+        # ========== 攻击复现 ②：父过期后子令牌沿链拒验（免 sleep：手工置父已过期） ==========
+        print("\n[2] verify 沿链传播：父记录过期 → 子令牌拒绝")
+        data = json.load(open(tf, encoding="utf-8"))
+        data["tokens"][d["token_id"]]["expires_at"] = time.time() - 1.0
+        with open(tf, "w", encoding="utf-8") as f:
+            json.dump(data, f, ensure_ascii=False)
+        ok_p, why_p = denied(tokens.verify_token, d["token"], path=tf)
+        ok_c, why_c = denied(tokens.verify_token, child["token"], path=tf)
+        check("父令牌过期被拒（基线，旧代码即拦）", ok_p, why_p[:60])
+        check("父过期后子令牌沿链拒验（N123 核心断言）", ok_c, why_c[:60])
+
+        # ========== 攻击复现 ③：真实自然到期端到端 ==========
+        print("\n[3] 端到端：父 ttl=0.4 自然到期 → 长 TTL 子令牌（ttl=999999）失效")
+        d3 = tokens.issue("designer", actor="n123-e2e", ttl=0.4, path=tf)
+        c3 = tokens.derive(d3["token"], "record", actor="n123-e2e-child",
+                           ttl=999999.0, path=tf)
+        check("派生时子界已被父夹紧",
+              float(c3["expires_at"]) <= float(d3["expires_at"]) + 1e-6,
+              f"child={c3['expires_at']:.1f} parent={d3['expires_at']:.1f}")
+        time.sleep(0.7)
+        ok_p3, why_p3 = denied(tokens.verify_token, d3["token"], path=tf)
+        ok_c3, why_c3 = denied(tokens.verify_token, c3["token"], path=tf)
+        check("父自然到期被拒", ok_p3, why_p3[:60])
+        check("子令牌随父到期失效（修复前：verify OK 继续用）", ok_c3, why_c3[:60])
+
+        # ========== 正向 ④：父无界时取请求值（不误夹成无界/不过度收窄） ==========
+        print("\n[4] 父无界：子 TTL 取请求值")
+        d4 = tokens.issue("designer", actor="n123-bounded", path=tf)  # 无 ttl
+        check("父无界 expires_at=None", d4["expires_at"] is None)
+        c4 = tokens.derive(d4["token"], "record", actor="n123-bounded-child",
+                           ttl=60.0, path=tf)
+        now = time.time()
+        check("父无界时子 expires_at=now+60（取请求值）",
+              c4["expires_at"] is not None
+              and 58.0 <= float(c4["expires_at"]) - now <= 62.0,
+              f"delta={float(c4['expires_at']) - now:.1f}s")
+        check("父无界夹紧不开口",
+              "expires_at" not in (c4.get("clamped") or []),
+              f"clamped={c4.get('clamped')}")
+        # 子短于父：取请求值不延长
+        c4b = tokens.derive(d4["token"], "record", actor="n123-short", ttl=1.0,
+                            path=tf)
+        check("子短于父取请求值", c4b["expires_at"] is not None
+              and float(c4b["expires_at"]) - now <= 2.0)
+        # 子无 ttl：沿用父（旧行为保持——父无界即无界）
+        c4c = tokens.derive(d4["token"], "record", actor="n123-inherit", path=tf)
+        check("子未指定 ttl 沿用父界（无界父→无界子）",
+              c4c["expires_at"] is None, f"expires_at={c4c['expires_at']}")
+
+        # ========== 正向 ⑤：子自身先到期仍按自身拒（不因沿链放宽） ==========
+        print("\n[5] 子自身过期仍拦截")
+        d5 = tokens.issue("designer", actor="n123-self", ttl=3600.0, path=tf)
+        c5 = tokens.derive(d5["token"], "record", actor="n123-self-child",
+                           ttl=0.05, path=tf)
+        time.sleep(0.15)
+        ok_c5, why_c5 = denied(tokens.verify_token, c5["token"], path=tf)
+        ok_d5, _ = denied(tokens.verify_token, d5["token"], path=tf)
+        check("子自身先到期被拒", ok_c5 and not ok_d5, why_c5[:60])
+
+        # ========== 加固 ⑥：存量库三层链 + 防环 ==========
+        print("\n[6] 存量库三层链传播 + parent 环防护")
+        # 三层链：gp（无界）→ p（已过期）→ gc；修复前 verify(gc) 只看自身 → OK
+        d6 = tokens.issue("designer", actor="n123-gp", path=tf)
+        p6 = tokens.derive(d6["token"], "orchestr", actor="n123-p", path=tf)
+        # 手工构造第三层（正常 derive 封口 delegable=False，模拟存量库/手工库）
+        data6 = json.load(open(tf, encoding="utf-8"))
+        prec = data6["tokens"][p6["token_id"]]
+        gc_id = "tk_n123gc01"
+        data6["tokens"][gc_id] = dict(prec, role="record", actor="n123-gc",
+                                      delegable=False, parent=p6["token_id"],
+                                      expires_at=time.time() + 999999.0)
+        data6["tokens"][p6["token_id"]]["expires_at"] = time.time() - 1.0
+        with open(tf, "w", encoding="utf-8") as f:
+            json.dump(data6, f, ensure_ascii=False)
+        gc_token = tokens.make_token("record", gc_id, "x" * 43)
+        # 摘要需匹配：直接改库中 hash
+        data6 = json.load(open(tf, encoding="utf-8"))
+        data6["tokens"][gc_id]["hash"] = tokens._hash("x" * 43)
+        with open(tf, "w", encoding="utf-8") as f:
+            json.dump(data6, f, ensure_ascii=False)
+        t0 = time.monotonic()
+        ok_gc, why_gc = denied(tokens.verify_token, gc_token, path=tf)
+        cost = time.monotonic() - t0
+        check("中间层过期 → 孙令牌沿链拒验", ok_gc, why_gc[:60])
+        check("沿链校验无死循环（<2s）", cost < 2.0, f"{cost:.3f}s")
+        # 防环：A.parent=B 且 B.parent=A，均未过期 → 应通过且不挂
+        data6 = json.load(open(tf, encoding="utf-8"))
+        a_id, b_id = "tk_n123loopA", "tk_n123loopB"
+        data6["tokens"][a_id] = {"role": "designer", "actor": "loop-a",
+                                 "tenant": "default", "clearance": "secret",
+                                 "can_write": True, "can_admin": True,
+                                 "layers_allow": ["*"], "ops_allow": ["*"],
+                                 "delegable": False, "parent": b_id,
+                                 "issued_by": "loop", "issued_at": now,
+                                 "expires_at": None, "revoked_at": None,
+                                 "label": "", "hash": tokens._hash("la" * 16)}
+        data6["tokens"][b_id] = {"role": "record", "actor": "loop-b",
+                                 "tenant": "default", "clearance": "internal",
+                                 "can_write": True, "can_admin": False,
+                                 "layers_allow": None, "ops_allow": None,
+                                 "delegable": False, "parent": a_id,
+                                 "issued_by": "loop", "issued_at": now,
+                                 "expires_at": None, "revoked_at": None,
+                                 "label": "", "hash": tokens._hash("lb" * 16)}
+        with open(tf, "w", encoding="utf-8") as f:
+            json.dump(data6, f, ensure_ascii=False)
+        t0 = time.monotonic()
+        try:
+            tokens.verify_token(tokens.make_token("designer", a_id, "la" * 16),
+                                path=tf)
+            loop_ok = True
+        except TokenError:
+            loop_ok = True          # 拒绝也可（fail-closed），关键是不挂
+        cost = time.monotonic() - t0
+        check("parent 环不挂死（防环）", loop_ok and cost < 2.0, f"{cost:.3f}s")
+    finally:
+        if old_env is None:
+            os.environ.pop(TOKEN_FILE_ENV, None)
+        else:
+            os.environ[TOKEN_FILE_ENV] = old_env
+        shutil.rmtree(root, ignore_errors=True)
+
+    print(f"\n通过 {PASS} / 失败 {FAIL}")
+    if FAILS:
+        print("失败项：" + "，".join(FAILS))
+    return 0 if FAIL == 0 else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/md_cg/test_n130_verify_falsified_protect.py

@@ -0,0 +1,185 @@
+# -*- coding: utf-8 -*-
+"""N130 守卫：verify(verdict="falsified") 的删除必须过「不可遗忘」保护。
+
+缺陷形态（2026-09-25 引擎域新发现，编号 N130，high）：verify() 的 falsified
+分支（mdcg.py:3188-3195）对原节点 os.remove **永久硬删**，全程不经
+protect.guard_forget / require_layer_write / override——self/anchor 层、
+protected 标记、importance≥0.7 的受保护节点可被一次 verify 调用一键删除，
+无快照、无留痕、不进 trash；对照 forget 路径（mdcos.py:2294）同一个删除
+动作需 require_admin + guard_forget 双闸（旧版本先快照、动作全程留痕）。
+
+攻击面：任何持 verify op 的主体（verify 角色 ops_allow 即含 verify，
+designer ops=["*"] 天然含）对任意 node_id 调 cg(op=verify,
+verdict=falsified) 一次调用永久删除；无需 override 无需 admin。
+
+修复：①falsified 分支在任何副作用（add_rejected / os.remove）之前接
+protect.guard_forget（受保护节点需显式 override=True——旧版本自动快照 +
+_protected_audit 留痕，与 forget 路径同一语义；拒绝抛 ProtectionError，
+原节点原样保留）；②MdCGSecure.verify 对 falsified 按原节点层做
+require_layer_write（与 add/add_rejected 同一闸口——verify 角色
+layers_allow=["rejected","contextual"]，本就「不得改被验证内容」，
+tokens.py:171 显式 forbidden）。
+
+红项 = R1-R7（四类受保护节点一键硬删复现 + secure 面层写缺口）；
+G 项锁语义不变（普通节点 falsified 负记忆化、override 显式放行 + 快照留痕）。
+运行：python -m md_cg.test_n130_verify_falsified_protect
+"""
+from __future__ import annotations
+
+import os
+import shutil
+import sys
+import tempfile
+
+try:
+    from . import protect
+    from .mdcos import MdCGOS, MdCGSecure
+    from .security import AccessDenied, Principal
+except ImportError:                                  # 直接脚本运行
+    sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+    from md_cg import protect
+    from md_cg.mdcos import MdCGOS, MdCGSecure
+    from md_cg.security import AccessDenied, Principal
+
+PASS = FAIL = 0
+FAILS = []
+
+
+def ok(cond, label):
+    global PASS, FAIL
+    if cond:
+        PASS += 1
+        print(f"  OK   {label}")
+    else:
+        FAIL += 1
+        FAILS.append(label)
+        print(f"  FAIL {label}")
+
+
+_BODY = "# 功能名：N130 守卫\n\n# 生效条件：无条件\n\n正文。\n"
+
+
+def _exists(cg, nid):
+    """索引条目在且盘面文件在（硬删后两者都会消失）。"""
+    e = (cg.index.get("nodes") or {}).get(nid)
+    return (e is not None
+            and os.path.exists(os.path.join(cg.root, e["path"])))
+
+
+def _falsified_must_reject(cg, nid, label):
+    """对 nid 做 falsified：期望 ProtectionError 且节点原样保留。"""
+    raised = None
+    try:
+        cg.verify(nid, "N130 守卫的反例证据", "falsified")
+    except protect.ProtectionError as exc:
+        raised = exc
+    ok(raised is not None, f"{label}1 falsified 受保护节点被拒（ProtectionError）")
+    ok(_exists(cg, nid), f"{label}2 拒绝后索引与盘面文件原样保留")
+
+
+def _seed(cg):
+    """四类受保护节点 + 一类普通节点（对照）。"""
+    cg.add("n_self", _BODY, layer="self")
+    cg.add("n_anchor", _BODY, layer="anchor")
+    cg.add("n_prot", _BODY, layer="knowledge")
+    protect.mark(cg, "n_prot", "N130 守卫：显式保护标记")
+    cg.add("n_imp", _BODY, layer="knowledge", importance=0.9)
+    cg.add("n_plain", _BODY, layer="knowledge")
+
+
+def _base_shape(tmp):
+    """A：基类引擎面（无令牌）——四类受保护节点不得被 falsified 一键硬删。"""
+    print("--- A 基类引擎面：guard_forget 前置")
+    root = os.path.join(tmp, "base")
+    cg = MdCGOS(root)
+    _seed(cg)
+
+    _falsified_must_reject(cg, "n_self", "R1_self")
+    _falsified_must_reject(cg, "n_anchor", "R2_anchor")
+    _falsified_must_reject(cg, "n_prot", "R3_protected")
+    _falsified_must_reject(cg, "n_imp", "R4_importance0.9")
+
+    ok(all(_exists(cg, n) for n in
+           ("n_self", "n_anchor", "n_prot", "n_imp")),
+       "R5 四次拒绝后四个受保护节点全部健在")
+    ok(not os.path.isdir(os.path.join(cg.root, protect.HISTORY_DIR)),
+       "R6 拒绝路径零副作用（未创建 _protected_history）")
+
+    # G1：普通节点 falsified 语义不变（负记忆化 + 原节点移除）
+    r = cg.verify("n_plain", "普通节点反例", "falsified")
+    ok(r.get("action") == "falsified", "G1a 普通 knowledge 节点 falsified 照常放行")
+    ok(not _exists(cg, "n_plain"), "G1b 原 knowledge 节点按负记忆化移除（语义不变）")
+    neg = [e for e in (cg.index.get("nodes") or {}).values()
+           if e.get("layer") == "rejected"]
+    ok(len(neg) == 1, "G1c rejected 层出现负记忆条目（语义不变）")
+
+    # G2：override=True 显式放行 + 快照留痕（与 forget 路径同一能力面）
+    r2 = cg.verify("n_prot", "显式 override 的反例", "falsified", override=True)
+    ok(r2.get("action") == "falsified", "G2a override=True 显式放行 falsified")
+    ok(not _exists(cg, "n_prot"), "G2b override 放行后原节点移除")
+    hist = protect.history(cg, "n_prot")
+    ok(len(hist) == 1, "G2c override 放行前旧版本已快照进 _protected_history")
+    audit = os.path.join(cg.root, protect.AUDIT_FILE)
+    ok(os.path.exists(audit) and "override_forget" in open(
+        audit, encoding="utf-8").read(),
+       "G2d override_forget 动作已留痕 _protected_audit.jsonl")
+    cg.close()
+
+
+def _secure_shape(tmp):
+    """B：MdCGSecure 面——falsified 删除按原节点层做 require_layer_write。"""
+    print("--- B 安全面：层写权限校验")
+    root = os.path.join(tmp, "secure")
+    verify_p = Principal(actor="verifier-1", role="verify", can_write=True,
+                         can_admin=False, clearance="internal",
+                         layers_allow=["rejected", "contextual"],
+                         ops_allow=["info", "read", "verify"])
+    designer_p = Principal(actor="designer-1", role="designer", can_write=True,
+                           can_admin=True, clearance="secret")
+    # 预置用 designer（knowledge 层只有可写该层的身份能建），攻击用 verify 角色
+    cg = MdCGSecure(root, principal=designer_p, master_key=bytes(range(32)))
+    cg.add("s_kn", _BODY, layer="knowledge")            # verify 角色无权写 knowledge
+    cg.add("s_ctx", _BODY, layer="contextual")          # verify 角色本职可写
+    cg.close()
+
+    # R7：verify 角色 falsified knowledge 节点 → 层写拒绝，节点原样保留
+    cg = MdCGSecure(root, principal=verify_p, master_key=bytes(range(32)))
+    raised = None
+    try:
+        cg.verify("s_kn", "verify 角色反例", "falsified")
+    except AccessDenied as exc:
+        raised = exc
+    ok(raised is not None, "R7a verify 角色 falsified knowledge 层被拒（AccessDenied）")
+    ok(_exists(cg, "s_kn"), "R7b 拒绝后 knowledge 节点索引与盘面原样保留")
+
+    # G3：verify 角色 falsified contextual 节点 → 本职可写，照常负记忆化
+    r = cg.verify("s_ctx", "verify 角色反例（contextual）", "falsified")
+    ok(r.get("action") == "falsified", "G3a verify 角色 falsified contextual 层放行")
+    ok(not _exists(cg, "s_ctx"), "G3b contextual 节点按负记忆化移除（语义不变）")
+    cg.close()
+
+    # R8：designer（层写不限）falsified self 层节点仍被 guard_forget 拦截
+    cg = MdCGSecure(root, principal=designer_p, master_key=bytes(range(32)))
+    cg.add("s_self", _BODY, layer="self")
+    _falsified_must_reject(cg, "s_self", "R8_designer_self")
+    cg.close()
+
+
+def main():
+    tmp = tempfile.mkdtemp(prefix="mdcg_n130_guard_")
+    try:
+        _base_shape(tmp)
+        _secure_shape(tmp)
+    finally:
+        shutil.rmtree(tmp, ignore_errors=True)
+
+    print("\n" + "=" * 60)
+    print(f"结果：PASS {PASS} / FAIL {FAIL}")
+    if FAILS:
+        for f in FAILS:
+            print(f"  - {f}")
+    return 0 if FAIL == 0 else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/md_cg/test_n131_merge_gate.py

@@ -0,0 +1,205 @@
+# -*- coding: utf-8 -*-
+"""N131 守卫：review_decide(merge) 的目标写入必须过 add 同款双闸。
+
+缺陷形态（2026-09-25 引擎域新发现，编号 N131，high）：review_decide 的
+merge 分支（mdcos.py:2221-2255）把提案内容直接 _write_node 追加进任意
+merge_into 目标节点，绕过 guard_write 与 require_layer_write——accept/edit
+走 self.add()（:2211）有 MdCGSecure.add :3769 require_layer_write 与基类
+add mdcg.py:1311 guard_write 双闸，merge 直写零闸；mcp_server review_decide
+注释「accept/edit 落节点时的层写仍由下游 require_layer_write 拦截」对 merge
+不成立，orchestr 角色 forbidden「anchor/self/goals/knowledge 层」
+（tokens.py:123）被打穿。
+
+攻击面：持 review+write op 的令牌（orchestr 的 ops_allow 两者皆含，
+tokens.py:120；designer 全权）——propose 任意内容 → review_decide(pid,
+decision="merge", merge_into=<self/anchor/immutable/knowledge 任意节点 id>)
+注入任意文本。
+
+修复：merge 分支在 _write_node 之前接与 add 同款双闸——principal 在位先
+require_layer_write(目标层, 目标敏感度)（与 MdCGSecure.add 同序同错型），
+再 guard_write（self/anchor 层、immutable 标记，对照 add :1311；override
+显式传参时快照+留痕放行，与 add 能力面对齐）；闸在 _record_decision 之前
+抛出——裁决不落库、提案留 pending（审计节点写入本就在 try/except 内，
+闸放那里会被吞成 record_error，形同虚设）。
+
+红项 = R1-R4（self/immutable 目标引擎面 + knowledge/self 目标 orchestr 面
+注入复现）；G 项锁语义不变（普通目标 merge 追加、orchestr 本职 contextual
+目标放行、designer override 放行）+ 两对照（orchestr add self 被拒 /
+designer add 覆 immutable 被拒——闸原本就在，只是 merge 绕过）。
+运行：python -m md_cg.test_n131_merge_gate
+"""
+from __future__ import annotations
+
+import os
+import shutil
+import sys
+import tempfile
+
+try:
+    from . import protect
+    from .mdcos import MdCGOS, MdCGSecure
+    from .security import AccessDenied, Principal
+except ImportError:                                  # 直接脚本运行
+    sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+    from md_cg import protect
+    from md_cg.mdcos import MdCGOS, MdCGSecure
+    from md_cg.security import AccessDenied, Principal
+
+PASS = FAIL = 0
+FAILS = []
+
+
+def ok(cond, label):
+    global PASS, FAIL
+    if cond:
+        PASS += 1
+        print(f"  OK   {label}")
+    else:
+        FAIL += 1
+        FAILS.append(label)
+        print(f"  FAIL {label}")
+
+
+_MARK = "攻击者注入段落"
+
+
+def _body(name):
+    return (f"# 功能名：{name}\n# 生效条件：无条件\n# 子功能：无\n"
+            f"# 执行：无\n# 验证方式：test\n# 不适用条件：无\n\n原始正文。")
+
+
+def _content_of(cg, nid):
+    n = cg.get(nid)
+    return (n or {}).get("content") or ""
+
+
+def _merge_must_reject(cg, pid, target, exc_type, label):
+    """merge 进 target：期望 exc_type 且目标内容原样。"""
+    raised = None
+    try:
+        cg.review_decide(pid, "merge", merge_into=target)
+    except exc_type as exc:
+        raised = exc
+    ok(raised is not None, f"{label}1 merge 进 {target} 被拒（{exc_type.__name__}）")
+    ok(_MARK not in _content_of(cg, target),
+       f"{label}2 拒绝后 {target} 正文无注入内容")
+
+
+def _base_shape(tmp):
+    """A：基类引擎面（无令牌）——self/immutable 目标不得被 merge 直写。"""
+    print("--- A 基类引擎面：guard_write 闸")
+    root = os.path.join(tmp, "base")
+    cg = MdCGOS(root)
+    cg.add("tgt_self", _body("自我目标"), layer="self")
+    cg.add("tgt_imm", _body("不可覆盖目标"), layer="knowledge", immutable=True)
+    cg.add("tgt_plain", _body("普通目标"), layer="knowledge")
+    ok(protect.is_immutable(cg, "tgt_imm")[0],
+       "A0 预置生效：tgt_imm 判定为不可覆盖")
+    for nid in ("p_self", "p_imm", "p_plain"):
+        cg.propose(nid, _body(nid) + "\n" + _MARK + "\n", layer="knowledge")
+
+    _merge_must_reject(cg, next(r["pid"] for r in cg.review_list()
+                                if r["id"] == "p_self"),
+                       "tgt_self", protect.ProtectionError, "R1_self")
+    _merge_must_reject(cg, next(r["pid"] for r in cg.review_list()
+                                if r["id"] == "p_imm"),
+                       "tgt_imm", protect.ProtectionError, "R2_immutable")
+
+    # G1：普通目标 merge 照常放行（test_merge_upsert / test_p2 语义不变）
+    pid_plain = next(r["pid"] for r in cg.review_list() if r["id"] == "p_plain")
+    r = cg.review_decide(pid_plain, "merge", merge_into="tgt_plain")
+    ok(r.get("ok") and r.get("node_id") == "tgt_plain",
+       "G1a 普通 knowledge 目标 merge 照常放行")
+    ok(_MARK in _content_of(cg, "tgt_plain"),
+       "G1b 追加内容进入目标正文（merge 本职不变）")
+    cg.close()
+
+
+def _secure_shape(tmp):
+    """B：MdCGSecure 面——merge 按目标层做 require_layer_write（orchestr 面）。"""
+    print("--- B 安全面：orchestr 层写校验")
+    root = os.path.join(tmp, "secure")
+    designer_p = Principal(actor="designer-1", role="designer", can_write=True,
+                           can_admin=True, clearance="secret")
+    orch_p = Principal(actor="orch-1", role="orchestr", can_write=True,
+                       can_admin=False, clearance="internal",
+                       layers_allow=["contextual", "unresolved", "rejected"],
+                       ops_allow=["info", "route", "read", "write", "review"])
+    cg = MdCGSecure(root, principal=designer_p, master_key=bytes(range(32)))
+    cg.add("t_kn", _body("知识目标"), layer="knowledge")
+    cg.add("t_ctx", _body("情境目标"), layer="contextual")
+    cg.add("t_self", _body("自我目标"), layer="self")
+    cg.close()
+
+    # 对照 R3：orchestr 直接 add 写 self 层被拒（身份确实受限，闸原本就在）
+    cg = MdCGSecure(root, principal=orch_p, master_key=bytes(range(32)))
+    denied = None
+    try:
+        cg.add("x_self", _body("越权"), layer="self")
+    except AccessDenied as exc:
+        denied = exc
+    ok(denied is not None, "R3 对照：orchestr add 写 self 层被拒（AccessDenied）")
+
+    # R4/R5：orchestr merge 注入 knowledge / self 层目标——旧码双写路径全绕
+    #（提案内容须互异：propose 按 payload_hash 幂等去重，同内容返回既有 pid）
+    pid_kn = cg.propose("a_kn", _body("提案注入知识") + "\n" + _MARK + "知识\n",
+                        layer="contextual")
+    _merge_must_reject(cg, pid_kn, "t_kn", AccessDenied, "R4_orch_knowledge")
+    pid_self = cg.propose("a_self", _body("提案注入自我") + "\n" + _MARK + "自我\n",
+                          layer="contextual")
+    _merge_must_reject(cg, pid_self, "t_self", AccessDenied, "R5_orch_self")
+
+    # G2：orchestr 本职可写层（contextual）目标 merge 照常放行
+    pid_ctx = cg.propose("a_ctx", _body("提案注入情境") + "\n" + _MARK + "情境\n",
+                         layer="contextual")
+    r = cg.review_decide(pid_ctx, "merge", merge_into="t_ctx")
+    ok(r.get("ok") and _MARK in _content_of(cg, "t_ctx"),
+       "G2 orchestr merge 进本职 contextual 目标放行且内容追加（本职不变）")
+    cg.close()
+
+    # 对照 R6：designer add 覆写 immutable 既有节点被拒（guard_write 对照）+
+    # G3：designer merge 带 override 进 immutable 目标显式放行（快照+留痕）
+    cg = MdCGSecure(root, principal=designer_p, master_key=bytes(range(32)))
+    cg.add("t_imm2", _body("不可覆盖"), layer="knowledge", immutable=True)
+    prot = None
+    try:
+        cg.add("t_imm2", _body("覆写"), layer="knowledge")
+    except protect.ProtectionError as exc:
+        prot = exc
+    ok(prot is not None, "R6 对照：designer add 覆写 immutable 节点被拒"
+                         "（ProtectionError）")
+    cg.close()
+
+    cg = MdCGSecure(root, principal=designer_p, master_key=bytes(range(32)))
+    pid_ov = cg.propose("a_ov", _body("提案") + "\n" + _MARK + "\n",
+                        layer="knowledge")
+    r = cg.review_decide(pid_ov, "merge", merge_into="t_imm2", override=True)
+    ok(r.get("ok") and _MARK in _content_of(cg, "t_imm2"),
+       "G3a designer override=True merge 进 immutable 目标显式放行")
+    hist = protect.history(cg, "t_imm2")
+    ok(len(hist) >= 1, "G3b override 放行前旧版本已快照 _protected_history")
+    audit = os.path.join(cg.root, protect.AUDIT_FILE)
+    ok(os.path.exists(audit) and "override_write" in open(
+        audit, encoding="utf-8").read(),
+       "G3c override_write 动作已留痕 _protected_audit.jsonl")
+    cg.close()
+
+
+def main():
+    tmp = tempfile.mkdtemp(prefix="mdcg_n131_guard_")
+    try:
+        _base_shape(tmp)
+        _secure_shape(tmp)
+    finally:
+        shutil.rmtree(tmp, ignore_errors=True)
+
+    print("\n" + "=" * 60)
+    print(f"结果：PASS {PASS} / FAIL {FAIL}")
+    if FAILS:
+        for f in FAILS:
+            print(f"  - {f}")
+    return 0 if FAIL == 0 else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())