@furongjun1999/dsh-memory 0.4.7 → 0.4.9

package/md_cg/test_hyperedge.py

@@ -0,0 +1,245 @@
+# -*- coding: utf-8 -*-
+"""超边（hyperedge）验收：第四阶段计划批次 A（T1-T4）。
+
+T1 注册面 4 处对齐（audit 真源 ×2 + 工具面自描述 + 对齐清单）+ register 注入；
+T2 schema 往返（row → payload → node → payload 六列逐字段一致）；
+T3 audit 三态（未注入 DEFER / 注入后 ACCEPT、REJECT）；
+T4 fail-closed（缺列/坏结构显式报错不猜测）+ writepipe 链端到端落盘。
+"""
+
+import os
+import shutil
+import sys
+import tempfile
+import traceback
+
+from . import audit as audit_mod
+from . import hyperedge
+from . import writepipe
+from .mdcos import MdCGSecure
+from .security import Principal
+
+_ok = 0
+_bad = []
+
+# 台账六列两种典型行：标准行（六列全值）与稀疏行（早期遗留，仅 verify_id/iter_id）
+_ROW_STD = {"received_at": "2026-09-17T16:40:07",
+            "verify_id": "verify-fff1ce7-phase0", "commit": "fff1ce7",
+            "verdict": "PASS", "receipt_job": "h1789634407680_445c",
+            "iter_id": "iter-002-carrier-align"}
+_ROW_SPARSE = {"received_at": "", "verify_id": "close-clean-batch",
+               "commit": "", "verdict": "", "receipt_job": "",
+               "iter_id": "iter-002-carrier-align"}
+
+
+def _check(name, cond, detail=""):
+    global _ok
+    if cond:
+        _ok += 1
+        print("  ok   %s" % name)
+    else:
+        _bad.append("%s %s" % (name, detail))
+        print("  FAIL %s %s" % (name, detail))
+
+
+def _src(name):
+    here = os.path.dirname(os.path.abspath(__file__))
+    with open(os.path.join(here, name), encoding="utf-8") as f:
+        return f.read()
+
+
+def _mk_cg(tmp):
+    p = Principal(tenant="default", actor="t_hyperedge", role="designer",
+                  can_write=True, can_admin=True)
+    return MdCGSecure(tempfile.mkdtemp(dir=tmp), principal=p)
+
+
+def _t1_registry():
+    print("\n【T1】注册面 4 处对齐 + register 注入")
+    _check("① audit.CONTENT_KINDS 注册 hyperedge（回放比对语义）",
+           "hyperedge" in audit_mod.CONTENT_KINDS
+           and "回放" in audit_mod.CONTENT_KINDS["hyperedge"],
+           str(audit_mod.CONTENT_KINDS.get("hyperedge")))
+    _check("② audit.KIND_BASIS[hyperedge]=test",
+           audit_mod.KIND_BASIS.get("hyperedge") == "test",
+           str(audit_mod.KIND_BASIS.get("hyperedge")))
+    # ③④ 工具面自描述与对齐清单：源码文本断言（与 test_p2_mcp 守卫同口径，
+    # 防「真源扩了、自描述没跟」）
+    _check("③ mcp_server content_kind 描述含 hyperedge",
+           "work_wip|ccg_marks|hyperedge" in _src("mcp_server.py"))
+    _check("④ test_p2_mcp 对齐清单含 hyperedge",
+           '"ccg_marks", "hyperedge"' in _src("test_p2_mcp.py"))
+    # register 注入面（MDCG_VERIFIER_MODULES 回调契约）：注入幂等、可还原
+    ok = False
+    try:
+        hyperedge.register(audit_mod)
+        ok = (audit_mod.VERIFIERS.get("hyperedge") is hyperedge.verify_payload)
+        hyperedge.register(audit_mod)          # 重复加载幂等
+        ok = ok and (audit_mod.VERIFIERS.get("hyperedge")
+                     is hyperedge.verify_payload)
+    except Exception as exc:  # noqa: BLE001
+        print("      register 异常：%r" % exc)
+    finally:
+        audit_mod.VERIFIERS.pop("hyperedge", None)   # 还原默认态（T3 重测 DEFER）
+    _check("register(audit_mod) 注入幂等可回调", ok)
+
+
+def _t2_roundtrip():
+    print("\n【T2】schema 往返（row→payload→node→payload）")
+    p = hyperedge.row_from_ledger(_ROW_STD)
+    _check("载荷三键齐备",
+           set(p) == {"ledger_row", "frontmatter", "content"}, str(sorted(p)))
+    fm = p["frontmatter"]
+    _check("fm 键集齐备（EXTRA_FM_KEYS 全在）",
+           all(k in fm for k in hyperedge.EXTRA_FM_KEYS), str(sorted(fm)))
+    _check("fm 值映射正确（零编造）",
+           fm["content_kind"] == "hyperedge"
+           and fm["edge_type"] == "cross_verify"
+           and fm["source"] == "receipts_ledger"
+           and fm["participants"] == [_ROW_STD["verify_id"],
+                                      _ROW_STD["receipt_job"]]
+           and fm["evidence"] == [{"verify_id": _ROW_STD["verify_id"],
+                                   "commit": _ROW_STD["commit"],
+                                   "verdict": _ROW_STD["verdict"],
+                                   "received_at": _ROW_STD["received_at"]}]
+           and fm["corrections"] == []
+           and fm["iter_id"] == _ROW_STD["iter_id"]
+           and fm["received_at"] == _ROW_STD["received_at"]
+           and fm["verdict"] == _ROW_STD["verdict"]
+           and fm["ledger_row"]["receipt_job"] == _ROW_STD["receipt_job"],
+           repr(fm)[:200])
+    node = {"id": hyperedge.node_id_for(_ROW_STD),
+            "frontmatter": dict(fm), "content": p["content"]}
+    p2 = hyperedge.payload_from_node(node)
+    v = hyperedge.verify_payload(p2)
+    _check("节点回放重建 ACCEPT", v["state"] == "ACCEPT", str(v)[:140])
+    _check("detail 带幂等 id",
+           (v.get("detail") or {}).get("node_id") == node["id"], str(v)[:140])
+    rebuilt = hyperedge.rows_from_fm(p2["frontmatter"])
+    _check("六列逐字段一致",
+           all(rebuilt[c] == _ROW_STD[c] for c in hyperedge.LEDGER_COLUMNS),
+           repr(rebuilt))
+    ps = hyperedge.row_from_ledger(_ROW_SPARSE)
+    vs = hyperedge.verify_payload(hyperedge.payload_from_node(
+        {"frontmatter": ps["frontmatter"], "content": ps["content"]}))
+    _check("稀疏行（空列占位）往返一致", vs["state"] == "ACCEPT", str(vs)[:140])
+    _check("稀疏行正文空字段为事实陈述（非编造占位）",
+           "（台账原始行无此字段）" in ps["content"])
+    _check("幂等键稳定且区分不同行",
+           hyperedge.node_id_for(_ROW_STD)
+           == hyperedge.node_id_for(dict(_ROW_STD))
+           and hyperedge.node_id_for(_ROW_STD)
+           != hyperedge.node_id_for(_ROW_SPARSE))
+    _check("正文四段标记齐备",
+           all(m in p["content"] for m in hyperedge.CONTENT_MARKERS))
+    _check("build_content 决定论（同 fm 恒同正文）",
+           hyperedge.build_content(fm) == p["content"])
+
+
+def _t3_audit_states():
+    print("\n【T3】audit 三态（未注入 DEFER / 注入后 ACCEPT、REJECT）")
+    payload = hyperedge.row_from_ledger(_ROW_STD)
+    saved = audit_mod.VERIFIERS.pop(hyperedge.CONTENT_KIND, None)
+    try:
+        v = audit_mod.audit("hyperedge", payload)
+        _check("未注入验证器 → DEFER（诚实不假装通过）",
+               v["state"] == "DEFER", str(v)[:140])
+        audit_mod.register_verifier(hyperedge.CONTENT_KIND,
+                                    hyperedge.verify_payload)
+        v = audit_mod.audit("hyperedge", payload)
+        _check("注入后一致载荷 ACCEPT", v["state"] == "ACCEPT", str(v)[:140])
+        tampered = {"ledger_row": payload["ledger_row"],
+                    "frontmatter": hyperedge.fm_from_row(
+                        dict(_ROW_STD, commit="deadbee0")),
+                    "content": payload["content"]}
+        v = audit_mod.audit("hyperedge", tampered)
+        _check("锚与结构不一致 REJECT（点名差异列）",
+               v["state"] == "REJECT" and "commit" in v["evidence"],
+               str(v)[:160])
+        v = audit_mod.audit("hyperedge",
+                            {"frontmatter": payload["frontmatter"],
+                             "content": payload["content"]})
+        _check("缺 ledger_row 锚 REJECT（fail-closed）",
+               v["state"] == "REJECT", str(v)[:140])
+        v = audit_mod.audit("hyperedge", {"content": "x", "action": None})
+        _check("无 fm 键载荷 REJECT（不猜测）", v["state"] == "REJECT",
+               str(v)[:140])
+    finally:
+        if saved is not None:
+            audit_mod.VERIFIERS[hyperedge.CONTENT_KIND] = saved
+
+
+def _t4_failclosed_and_pipeline(tmp):
+    print("\n【T4】fail-closed 与 writepipe 链端到端")
+    try:
+        hyperedge.row_from_ledger({"verify_id": "x"})
+        _check("缺列显式报错（不猜测补值）", False, "未抛 ValueError")
+    except ValueError:
+        _check("缺列显式报错（不猜测补值）", True)
+    except Exception as exc:  # noqa: BLE001
+        _check("缺列显式报错（不猜测补值）", False, repr(exc))
+    try:
+        hyperedge.rows_from_fm({"participants": ["only-one"]})
+        _check("participants 非定长二元显式报错", False, "未抛 ValueError")
+    except ValueError:
+        _check("participants 非定长二元显式报错", True)
+    p = hyperedge.row_from_ledger(_ROW_STD)
+    _check("corrections 迁移期恒空", p["frontmatter"]["corrections"] == [])
+    # 透传纯函数：非 hyperedge 零键、hyperedge 只收非 None 超边键
+    _check("_hyperedge_extra 非 hyperedge 返回空",
+           writepipe._hyperedge_extra({"content_kind": "text",
+                                       "iter_id": "x"}) == {})
+    ex = writepipe._hyperedge_extra({"content_kind": "hyperedge",
+                                     "iter_id": "i1", "corrections": None})
+    _check("_hyperedge_extra 只收非 None 超边键",
+           ex == {"content_kind": "hyperedge", "iter_id": "i1"}, repr(ex))
+    # writepipe 链端到端：a 平铺 fm 键 → audit 闸（验证器装配）→ 链尾落 fm
+    cg = _mk_cg(tmp)
+    audit_mod.register_verifier(hyperedge.CONTENT_KIND,
+                                hyperedge.verify_payload, override=True)
+    try:
+        a = {"op": "write", "node_id": hyperedge.node_id_for(_ROW_STD),
+             "content_kind": "hyperedge", "content": p["content"],
+             "layer": "knowledge", "tags": ["receipt"]}
+        a.update(p["frontmatter"])            # fm 键平铺（EXTRA_FM_KEYS 通道）
+        out = writepipe.default_pipeline().execute(cg, a)
+        _check("writepipe 落盘 committed", out.get("committed") is True,
+               str(out)[:180])
+        rec = cg.get(a["node_id"]) or {}
+        fm = rec.get("frontmatter") or {}
+        _check("超边 fm 落盘完整（锚 + 结构键）",
+               fm.get("content_kind") == "hyperedge"
+               and fm.get("participants") == p["frontmatter"]["participants"]
+               and (fm.get("ledger_row") or {}).get("commit") == _ROW_STD["commit"]
+               and (fm.get("evidence") or [{}])[0].get("verdict") == "PASS"
+               and fm.get("iter_id") == _ROW_STD["iter_id"],
+               str({k: fm.get(k)
+                    for k in ("content_kind", "participants")})[:180])
+        v = hyperedge.verify_payload(hyperedge.payload_from_node(rec))
+        _check("落库节点回放 ACCEPT（写读同进程）", v["state"] == "ACCEPT",
+               str(v)[:140])
+    finally:
+        audit_mod.VERIFIERS.pop(hyperedge.CONTENT_KIND, None)
+
+
+def main():
+    tmp = tempfile.mkdtemp(prefix="hyperedge_")
+    try:
+        _t1_registry()
+        _t2_roundtrip()
+        _t3_audit_states()
+        _t4_failclosed_and_pipeline(tmp)
+    except Exception:  # noqa: BLE001
+        traceback.print_exc()
+        _bad.append("未捕获异常")
+    finally:
+        shutil.rmtree(tmp, ignore_errors=True)
+        # 全局态还原：验证器注册表不留测试残留
+        audit_mod.VERIFIERS.pop(hyperedge.CONTENT_KIND, None)
+    print("\nhyperedge 验收：%d 通过%s"
+          % (_ok, ("，%d 失败：%s" % (len(_bad), "; ".join(_bad))) if _bad else ""))
+    return 1 if _bad else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/md_cg/test_identity_attribution.py

@@ -17,6 +17,12 @@ import os
 
 sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
 
+# Windows cmd 默认 GBK 代码页：带圈数字 ⑪⑫⑬ 等不在 GBK 内，打印即
+# UnicodeEncodeError，且崩在断言之后、报告之前 —— 同一测试「因环境而异」。
+# 测试自带 UTF-8 兜底，不依赖调用方记得加 -X utf8（可复现性纪律）。
+if hasattr(sys.stdout, "reconfigure"):
+    sys.stdout.reconfigure(encoding="utf-8", errors="replace")
+
 from md_cg.mdcg import MdCG
 from md_cg.mdcos import MdCGSecure
 from md_cg.security import DEFAULT_SENSITIVITY, Principal

package/md_cg/test_index_durability.py

@@ -0,0 +1,224 @@
+# -*- coding: utf-8 -*-
+"""md_cg · 索引持久化守卫（跨进程可见性 · 进程退出兜底）
+
+运行：python -m md_cg.test_index_durability
+
+背景（2026-09-16 取证，首例=审核裁决通路）：
+  节点 .md 由 `add()` **立即写盘**，但索引条目先进内存 `_dirty`，靠 `flush()` /
+  `close()` 落分片日志。一次性进程（CLI / 脚本）写入 1~2 条、远未达 autoflush(64)
+  阈值即退出 → 日志无记录；而**已有 `_index.json` 的根重开时不重扫目录**
+  （`_load_index`：快照优先，仅重放日志），于是节点「**在盘上但索引无条目**」，
+  其它进程与重载后的长驻进程都检索不到，只能靠某次全量 `rebuild_index()` 偶然救回。
+  表象极易被误判为「写入丢失」——故本测试以**索引可见性**（而非 `get()`）为判据。
+
+固化三处修复 + 一处反证（防测试空转）：
+  ① 库层进程退出兜底（`mdcg._LIVE_CGS` + atexit）：子进程不显式收尾也能落盘；
+  ② `review_decide` 统一收尾：目标节点 **与** 审计记录节点双落盘
+     （accept/edit 写前者、`_record_decision` 写后者；reject 路径**只**写后者）；
+  ③ `review_cli` 显式 `close()`：真实缺陷现场（一次性 CLI 裁决）端到端；
+  ④ 反证组：清空兜底登记 → 复现「索引不可见」，证明 ①② 确在生效。
+
+  `_index.json` 快照是「贴真实库形态」的必要前提：空 root 首开会全扫目录，
+  恰好掩盖本缺陷（这也是首版复现实验失败的教训）。
+"""
+from __future__ import annotations
+
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+
+from .mdcos import MdCGOS
+
+PASS = FAIL = 0
+FAILS = []
+
+REPO = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+
+CCG = ("# 功能名：{n}\n# 生效条件：{c}\n# 子功能：{s}\n# 执行：{e}\n"
+       "# 验证方式：test\n# 不适用条件：{neg}\n\n{body}\n")
+
+
+def check(name, cond, detail=""):
+    global PASS, FAIL
+    if cond:
+        PASS += 1
+        print(f"  [PASS] {name}" + (f"  · {detail}" if detail else ""))
+    else:
+        FAIL += 1
+        FAILS.append(name)
+        print(f"  [FAIL] {name}  · {detail}")
+
+
+def mk(n, cond, body, neg="其它"):
+    return CCG.format(n=n, c=cond, s=body[:20], e=body, neg=neg, body=body)
+
+
+def _child_env():
+    """子进程环境：显式 UTF-8 + PYTHONPATH 指向本仓（纪律 15：不经 Windows shell）。"""
+    env = dict(os.environ)
+    env["PYTHONUTF8"] = "1"
+    env["PYTHONIOENCODING"] = "utf-8"
+    env["PYTHONPATH"] = REPO + os.pathsep + env.get("PYTHONPATH", "")
+    return env
+
+
+def _run_child(code):
+    """以子进程执行一段脚本（argv 列表，shell=False）。"""
+    fd, path = tempfile.mkstemp(suffix=".py", prefix="_idxguard_")
+    with os.fdopen(fd, "w", encoding="utf-8") as f:
+        f.write(code)
+    try:
+        return subprocess.run([sys.executable, path], capture_output=True,
+                              text=True, encoding="utf-8", errors="replace",
+                              env=_child_env(), cwd=REPO)
+    finally:
+        try:
+            os.remove(path)
+        except OSError:
+            pass
+
+
+def _seed(root, nid="seed"):
+    """建一个「已有快照」的库形态（缺陷成立的必要前提）。"""
+    cg = MdCGOS(root, actor="seed")
+    cg.add(nid, mk("种子节点", "问种子", "仅用于建索引快照"),
+           verification_basis="test")
+    cg.flush()
+    cg.rebuild_index()
+    cg.close()
+
+
+def _visible(root, nid):
+    """索引可见性判据：**新实例**（模拟其它进程 / 重载后的长驻进程）索引里是否有该条目。
+
+    刻意不用 `get()`：它夹带密级/密钥可读性判据，会把「索引缺失」与「读不到」混为一谈。
+    """
+    probe = MdCGOS(root, actor="probe")
+    try:
+        return nid in (probe.index.get("nodes") or {})
+    finally:
+        probe.close()
+
+
+CHILD_BODY = (
+    "import sys\n"
+    "sys.path.insert(0, {repo!r})\n"
+    "from md_cg.mdcos import MdCGOS\n"
+    "cg = MdCGOS({root!r}, actor='child', autoflush=64)\n"
+    "cg.add({nid!r}, {content!r}, verification_basis='test')\n"
+)
+
+
+def main():
+    roots = []
+    try:
+        # ---------------- ① 进程退出兜底（atexit） ----------------
+        print("\n【①】库层进程退出兜底：子进程不显式收尾")
+        root_a = tempfile.mkdtemp(prefix="idxdur_a_")
+        roots.append(root_a)
+        _seed(root_a)
+        r = _run_child(CHILD_BODY.format(
+            repo=REPO, root=root_a, nid="n_atexit",
+            content=mk("兜底测试节点", "问兜底", "子进程写一条后直接退出")) +
+            "# 故意不 close：验证进程退出兜底（atexit）\n")
+        check("子进程正常退出", r.returncode == 0, (r.stderr or "")[:200])
+        check("兜底生效：新进程索引可见", _visible(root_a, "n_atexit"))
+
+        # ---------------- ④ 反证组（防测试空转） ----------------
+        print("\n【④】反证组：清空兜底登记 → 复现缺陷")
+        root_b = tempfile.mkdtemp(prefix="idxdur_b_")
+        roots.append(root_b)
+        _seed(root_b)
+        r = _run_child(CHILD_BODY.format(
+            repo=REPO, root=root_b, nid="n_nohook",
+            content=mk("反证测试节点", "问反证", "清空兜底登记后退出")) +
+            "# 反证：摘掉兜底登记（等价于修复前形态）\n"
+            "from md_cg.mdcg import _LIVE_CGS\n"
+            "_LIVE_CGS.clear()\n")
+        check("反证子进程正常退出", r.returncode == 0, (r.stderr or "")[:200])
+        check("反证：索引不可见（缺陷可复现，证明兜底是有效变量）",
+              not _visible(root_b, "n_nohook"))
+
+        # ---------------- ③ 显式 close 对照（原有正路不回归） ----------------
+        print("\n【③】显式收尾对照：close() 仍是正路")
+        root_c = tempfile.mkdtemp(prefix="idxdur_c_")
+        roots.append(root_c)
+        _seed(root_c)
+        r = _run_child(CHILD_BODY.format(
+            repo=REPO, root=root_c, nid="n_close",
+            content=mk("显式收尾节点", "问收尾", "子进程写一条后 close")) +
+            "cg.close()\n")
+        check("显式 close 子进程正常退出", r.returncode == 0, (r.stderr or "")[:200])
+        check("显式 close：新进程索引可见", _visible(root_c, "n_close"))
+
+        # ---------------- ② review_decide 通路统一收尾 ----------------
+        print("\n【②】审核裁决通路：目标节点 + 审计记录节点双落盘")
+        root_d = tempfile.mkdtemp(prefix="idxdur_d_")
+        roots.append(root_d)
+        _seed(root_d, nid="seed_d")
+        osd = MdCGOS(root_d, actor="designer")
+        pid = osd.propose("n_acc", mk("受审节点", "问受审", "审核落盘的目标节点"),
+                          verify={"kind": "test", "assertions": ["断言通过"]})
+        out = osd.review_decide(pid, "accept", reason="测试判据")
+        check("accept 裁决成功", bool(out.get("ok")), str(out)[:160])
+        rec_nid = out.get("record_node_id")
+        probe = MdCGOS(root_d, actor="probe")
+        try:
+            check("accept：目标节点索引可见（新实例）",
+                  out.get("node_id") in probe.index["nodes"], str(out.get("node_id")))
+            check("accept：审计记录节点索引可见（新实例）",
+                  bool(rec_nid) and rec_nid in probe.index["nodes"], str(rec_nid))
+            check("accept：review_records 可列出（复核面不空）",
+                  any(x["id"] == rec_nid for x in probe.review_records(pid=pid)))
+        finally:
+            probe.close()
+
+        pid2 = osd.propose("n_rej", mk("被拒节点", "问被拒", "reject 只记裁决不落目标节点"))
+        out2 = osd.review_decide(pid2, "reject", reason="不通过")
+        check("reject 裁决成功", bool(out2.get("ok")), str(out2)[:160])
+        rec2 = out2.get("record_node_id")
+        check("reject：审计记录节点索引可见（该路径只写它）",
+              bool(rec2) and _visible(root_d, rec2), str(rec2))
+        osd.close()
+
+        # ---------------- ③ review_cli 端到端（真实缺陷现场） ----------------
+        print("\n【③】review_cli 端到端（一次性 CLI 裁决）")
+        root_e = tempfile.mkdtemp(prefix="idxdur_e_")
+        roots.append(root_e)
+        _seed(root_e, nid="seed_e")
+        ose = MdCGOS(root_e, actor="designer")
+        pid_e = ose.propose("n_cli", mk("CLI 裁决节点", "问 CLI",
+                                        "review_cli 落盘的目标节点"))
+        ose.close()
+        r = subprocess.run(
+            [sys.executable, os.path.join(REPO, "scripts", "review_cli.py"),
+             "accept", pid_e, "--root", root_e, "--reason", "端到端守卫测试"],
+            capture_output=True, text=True, encoding="utf-8", errors="replace",
+            env=_child_env(), cwd=REPO)
+        check("review_cli 退出码 0", r.returncode == 0,
+              (r.stdout or r.stderr or "")[:200])
+        check("review_cli：目标节点索引可见（新进程）", _visible(root_e, "n_cli"))
+        probe = MdCGOS(root_e, actor="probe")
+        try:
+            recs = probe.review_records(pid=pid_e)
+            check("review_cli：审计记录节点索引可见",
+                  bool(recs) and all(x["id"] in probe.index["nodes"] for x in recs),
+                  str([x["id"] for x in recs]))
+        finally:
+            probe.close()
+    finally:
+        for r_ in roots:
+            shutil.rmtree(r_, ignore_errors=True)
+
+    print("\n" + "=" * 64)
+    print(f"PASS={PASS}  FAIL={FAIL}")
+    if FAILS:
+        print("失败项：" + "；".join(FAILS))
+    return 0 if FAIL == 0 else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())
+