@furongjun1999/dsh-memory 0.4.8 → 0.4.9

package/md_cg/test_retr_s9_entity_ctx.py

@@ -0,0 +1,175 @@
+# -*- coding: utf-8 -*-
+"""S9b 三元组反查 · 工具面集成探针（阶段二 4.2 T9，脚本式，exit code 定成败）。
+
+用法：python -X utf8 -m md_cg.test_retr_s9_entity_ctx
+库层原语语义归 `test_retr_s9_edges.py`，本件只测**工具面集成**：
+- 分派全链路：`_cg_dispatch` / `_cg_call` → `_edges_call` → `provenance.find_edges`
+- op 缺省推导防呆负例：`child=` 不构成 edges 签名，漏 op 走 read 不冒充反查
+- 权限闸双面：`ops_allow` 含 edges 放行；不含 → AccessDenied（通配 "*" 不限）
+- 渐进披露：slim 后 op=edges 段被投影、职责行 ≤160；`op=help,query=edges` 无损取回
+- schema 一致性：扁平参数面与库层签名同形（含 expand_nodes）；无 subject/predicate/object 第二套参数
+- 协议对账：`protocol.audit` AST 自动发现 edges（extension_ops 报告项，ok=True）
+- FUNC_DESC 覆盖守卫：cogmap_sync 功能描述表必须登记 ("cg", "edges")
+"""
+import inspect
+import json
+import os
+import sys
+import tempfile
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from md_cg import provenance, protocol, tool_face as tf          # noqa: E402
+from md_cg.mdcg import MdCG                                      # noqa: E402
+from md_cg.mdcos import MdCGSecure                               # noqa: E402
+from md_cg.security import AccessDenied, Principal               # noqa: E402
+from md_cg import mcp_server as ms                               # noqa: E402
+
+passed = 0
+failed = 0
+T = "阿尔法 三元组 反查 探针"
+
+# _edges_call 透传的扁平参数面（schema ↔ 实现同形守卫的期望集）
+EDGE_ARGS = ("child", "parent", "relation", "batch",
+             "start_time", "end_time", "start_operator", "end_operator",
+             "time_axis", "ordering", "offset", "limit", "aggregation",
+             "expand_nodes")
+
+
+def check(name, cond, detail=""):
+    global passed, failed
+    if cond:
+        passed += 1
+        print("  [PASS] " + name)
+    else:
+        failed += 1
+        print("  [FAIL] " + name + "  " + detail)
+
+
+def _build(root):
+    cg = MdCG(root)
+    for nid in ("p1", "p2"):
+        cg.add(nid, T, "knowledge")
+    cg.add("a1", T, "knowledge", derived_from=["p1"])
+    cg.add("a2", T, "knowledge", derived_from=["p1"], relation="extracted_from")
+    cg.flush()
+    return cg
+
+
+def _raises(exc, fn):
+    try:
+        fn()
+    except exc:
+        return True
+    except Exception:                                       # noqa: BLE001
+        return False
+    return False
+
+
+def main():
+    root = tempfile.mkdtemp(prefix="retr_s9b_")
+    cg = _build(root)
+
+    # ================= 1) 分派全链路 =================
+    r = ms._cg_dispatch(cg, {"op": "edges", "child": "a1"})
+    check("dispatch 直调：op=edges → _edges_call → find_edges（ok/readonly/total）",
+          isinstance(r, dict) and r.get("ok") is True and r.get("readonly") is True
+          and r.get("op") == "edges" and r.get("total") == 1
+          and r["edges"][0]["child"] == "a1", str(r)[:200])
+
+    rc = ms._cg_call(cg, {"op": "edges", "child": "a2", "expand_nodes": True})
+    check("_cg_call 外层透传 expand_nodes：边附端点摘要（a2 在库 / p1 在库）",
+          rc.get("ok") is True and rc.get("total") == 1
+          and rc["edges"][0]["child_node"]["present"] is True
+          and rc["edges"][0]["parent_node"]["present"] is True,
+          str(rc.get("edges", [{}])[0].get("child_node")))
+
+    # ================= 2) op 缺省推导防呆（负例）=================
+    rd = ms._cg_call(cg, {"child": "a1"})
+    check("漏 op 不冒充反查：child= 不是 edges 签名 → 按既有规则推导为 read（op_derived 透出）",
+          rd.get("op") == "read" and rd.get("op_derived") is True,
+          str({k: rd.get(k) for k in ("op", "op_derived")}))
+    check("显式 op 优先：op=edges 时 op_derived 不出现（推导只兜底不覆盖）",
+          "op_derived" not in rc)
+
+    # ================= 3) 权限闸双面 =================
+    p_ok = Principal(actor="anon", role="anonymous", can_write=False,
+                     ops_allow=("info", "route", "read", "edges"))
+    p_no = Principal(actor="narrow", role="reader", can_write=False,
+                     ops_allow=("info", "route", "read"))
+    cg_ok = MdCGSecure(root, principal=p_ok)
+    cg_no = MdCGSecure(root, principal=p_no)
+    check("ops_allow 含 edges → 放行（只读结果正常返回）",
+          ms._cg_dispatch(cg_ok, {"op": "edges", "parent": "p1"}).get("total") == 2)
+    check("ops_allow 不含 edges → AccessDenied（角色作用域闸，不静默降级）",
+          _raises(AccessDenied, lambda: ms._cg_dispatch(cg_no, {"op": "edges"})),
+          "expected AccessDenied")
+    check("通配白名单不受新 op 影响：ops_allow=('*',) 放行（designer 形态）",
+          ms._cg_dispatch(
+              MdCGSecure(root, principal=Principal(
+                  actor="boss", role="designer", can_write=True, can_admin=True,
+                  ops_allow=("*",))),
+              {"op": "edges", "relation": "derived_from"})["total"] == 1)
+
+    # ================= 4) 渐进披露（投影 ↔ help 回取）=================
+    slim = {t["name"]: t for t in tf.slim_tools(ms.ALL_TOOLS)}
+    cg_slim_desc = slim["cg"].get("description") or ""
+    check("slim 后 op=edges 段被投影（常驻上下文不付费）",
+          "op=edges：" not in cg_slim_desc and "edges" not in tf.op_sections(cg_slim_desc),
+          cg_slim_desc[:120])
+    check("slim 后 cg 职责行仍 ≤160 字符（投影不破尺寸预算）",
+          len(cg_slim_desc) <= 160, str(len(cg_slim_desc)))
+    h = tf.help_text(ms.ALL_TOOLS, query="edges")
+    hit = next((x for x in h.get("hits", []) if x.get("op") == "edges"), None)
+    check("op=help,query=edges 无损取回：命中 op 段落与透传参数清单（expand_nodes 在列）",
+          h.get("ok") is True and hit is not None
+          and "expand_nodes" in json.dumps(hit.get("params") or []),
+          str(h)[:200])
+
+    # ================= 5) schema 一致性 =================
+    cg_tool = next(t for t in ms.ALL_TOOLS if t["name"] == "cg")
+    isch = cg_tool.get("inputSchema") or {}
+    props = isch.get("properties") or {}
+    req = set(isch.get("required") or [])
+    check("schema：edges 全部透传参数在列且均为可选（required 不含）",
+          all(k in props for k in EDGE_ARGS)
+          and not (req & set(EDGE_ARGS)),
+          str([k for k in EDGE_ARGS if k not in props]))
+    check("schema：predicate/object 不进参数面（subject 是 identity/self_state/link 既有主体参数，非 edges 引入）",
+          not ({"predicate", "object"} & set(props)))
+    _ec_src = inspect.getsource(ms._edges_call)
+    check("实现面：_edges_call 不读 subject/predicate/object 第二套参数键（术语映射只在 docstring）",
+          not any(('"%s"' % k) in _ec_src or ("'%s'" % k) in _ec_src
+                  for k in ("subject", "predicate", "object")),
+          str([k for k in ("subject", "predicate", "object")
+               if k in _ec_src]))
+    check("实现签名：find_edges 用 expand_nodes（旧名 expand 已废除，防回潮）",
+          "expand_nodes" in inspect.signature(provenance.find_edges).parameters
+          and "expand" not in inspect.signature(provenance.find_edges).parameters,
+          str(list(inspect.signature(provenance.find_edges).parameters)))
+
+    # ================= 6) 协议对账（AST 自动发现）=================
+    au = protocol.audit()
+    check("protocol.audit：ok=True、shape_errors 空（edges 属扩展面不违例）",
+          au.get("ok") is True and not au.get("shape_errors")
+          and not au.get("errors"), str(au.get("errors")))
+    check("protocol.audit：AST 自动发现 edges 分支（extension_ops 报告项在列）",
+          "edges" in (au.get("actual") or [])
+          and "edges" in (au.get("extension_ops") or []),
+          str(au.get("actual")))
+
+    # ================= 7) FUNC_DESC 覆盖守卫 =================
+    sync_path = os.path.join(os.path.dirname(os.path.dirname(
+        os.path.abspath(__file__))), "scripts", "cogmap_sync.py")
+    sync_src = open(sync_path, encoding="utf-8").read()
+    check("cogmap_sync.FUNC_DESC 登记 (\"cg\", \"edges\")（功能调用映射表覆盖门禁的前置）",
+          '("cg", "edges")' in sync_src)
+
+    print("\ntest_retr_s9_entity_ctx: %d 通过 / %d 失败" % (passed, failed))
+    return 0 if failed == 0 else 1
+
+
+if __name__ == "__main__":
+    if hasattr(sys.stdout, "reconfigure"):
+        sys.stdout.reconfigure(encoding="utf-8")
+    sys.exit(main())

package/md_cg/test_review_conformance.py

@@ -11,6 +11,9 @@
   ⑦ 并发幂等（真多进程）：N 进程同内容并发 propose → 恰好 1 条、pid 全同
   ⑧ 并发不丢（真多进程）：N 进程×M 条不同内容 → inbox 读回恰好 N×M 条
   ⑨ decisions 并发不丢（真多进程）：并发裁决 → 记录恰好 N 条且指纹完整
+  ⑩ 安全层转发：MdCGSecure.propose 的幂等/info 透传
+  ⑪ NOOP 裁决：只留痕（jsonl + 审计节点）不落业务节点、不写负记忆、终态关闭、
+     统计可见，且与 reject 的留痕状态可区分
 
 运行：python -m md_cg.test_review_conformance
 """
@@ -89,7 +92,7 @@ def _run_worker(workdir, root, mode, arg="", timeout=120):
 def main():
     workdir = tempfile.mkdtemp(prefix="mdcg_conf_wk_")
     root = tempfile.mkdtemp(prefix="mdcg_conf_")
-    root2 = root2b = root3 = root4 = ""
+    root2 = root2b = root3 = root4 = root5 = ""
     _ensure_worker(workdir)
     try:
         cg = MdCGOS(root, actor="test")
@@ -295,13 +298,67 @@ def main():
               "info" not in (sec_rec.get("extra") or {}),
               str(sec_rec.get("extra")))
 
+        # ---------------- ⑪ NOOP 裁决（治理层动作） ----------------
+        print("\n【11】NOOP 裁决：只留痕、不落节点、不写负记忆、终态关闭")
+        root5 = tempfile.mkdtemp(prefix="mdcg_conf_noop_")
+        cg5 = MdCGOS(root5, actor="test-noop")
+
+        def _neg_n():
+            """负记忆条目数（rejected 层）——NOOP 不得增加它。"""
+            return sum(1 for e in cg5.index["nodes"].values()
+                       if (e.get("layer") or "") == "rejected")
+
+        nb = _neg_n()
+        np1 = cg5.propose("noop1", "# 功能名：NOOP 探针\n\n已评估，判定无需改动。\n",
+                          layer="knowledge")
+        dn = cg5.review_decide(np1, "noop", reason="评估过，无需改动")
+        check("noop 裁决成功且 decision=noop",
+              dn.get("ok") is True and dn.get("decision") == "noop", str(dn)[:80])
+        check("noop 不落业务节点", not cg5.get("noop1"), "")
+        nrecs = [r for r in cg5.decisions() if r.get("pid") == np1]
+        check("noop 进 decisions 留痕（status=noop + record_hash）",
+              len(nrecs) == 1 and nrecs[0].get("status") == "noop"
+              and bool(nrecs[0].get("record_hash")),
+              f"n={len(nrecs)} status={nrecs[0].get('status') if nrecs else '-'}")
+        check("noop 不写负记忆（rejected 条目数不增）", _neg_n() == nb,
+              f"{nb}→{_neg_n()}")
+        check("noop 后提案终态关闭（review_list 不再列出）",
+              not any(r.get("pid") == np1 for r in cg5.review_list()), "")
+        dn2 = cg5.review_decide(np1, "noop")
+        check("重复 noop 幂等拒绝（already_decided）",
+              dn2.get("ok") is False and dn2.get("error") == "already_decided",
+              str(dn2.get("error")))
+        audit = cg5.review_records(pid=np1)
+        check("noop 的 md 审计记录节点已落（外部来源可复核）",
+              len(audit) == 1, f"n={len(audit)}")
+        vrec = cg5.verify_review_record(audit[0]["id"]) if audit else {}
+        check("noop 审计记录指纹复核一致且状态为 noop",
+              vrec.get("ok") is True and vrec.get("status") == "noop",
+              str(vrec)[:90])
+        st5 = cg5.review_stats()
+        check("review_stats 统计到 noop（by_decision.noop=1）且队列已清",
+              st5.get("noop") == 1
+              and (st5.get("by_decision") or {}).get("noop") == 1
+              and st5.get("pending") == 0 and st5.get("closed") == 1,
+              str(st5))
+        # 语义分界：noop 与 reject 都终止提案，但留痕状态必须可区分
+        # （否则「评估过、无需改动」会被误读为「否掉了这条候选」）
+        rj1 = cg5.propose("rej1", "# 功能名：NOOP 对照探针\n\n对照用。\n",
+                          layer="knowledge")
+        dr = cg5.review_decide(rj1, "reject", reason="对照")
+        rjrec = [r for r in cg5.decisions() if r.get("pid") == rj1]
+        check("noop 与 reject 留痕状态可区分（noop vs rejected）",
+              dr.get("ok") is True and bool(rjrec)
+              and rjrec[0].get("status") == "rejected",
+              f"reject_status={rjrec[0].get('status') if rjrec else '-'}")
+
         print(f"\n===== conformance：PASS={PASS} FAIL={FAIL} =====")
         if FAILS:
             print("失败项：", "；".join(FAILS))
         return 1 if FAIL else 0
     finally:
         shutil.rmtree(workdir, ignore_errors=True)
-        for r in (root, root2, root2b, root3, root4):
+        for r in (root, root2, root2b, root3, root4, root5):
             if r:
                 shutil.rmtree(r, ignore_errors=True)
 

package/md_cg/test_role_views.py

@@ -0,0 +1,354 @@
+# -*- coding: utf-8 -*-
+"""角色化读取视图（roleviews）验收：第四阶段计划批次 C（H4）。
+
+T1 规则表守卫——WORK_ROLES 白名单字面一致 + content_kind 合法枚举
+   + 三视图资格维度与计划 §4.1 规则表一致；
+T2 matches 单点谓词判定矩阵（三视图 × 各类元数据）+ 非法 view fail-closed；
+T3 库层 fail-closed——candidates/search/search_rrf/recall 四入口
+   非法 view 一律 ValueError（不静默回落）；
+T4 零行为变更（H4 核心）——view=None（缺省）与不传 view 逐位一致
+   （同 id 同序同分）；
+T5 三视图端到端——各自命中集不同；receipt 与 main 在 role 维度互补；
+   无 role 的 code 节点三视图皆不可见（类型启发严格口径，bench 校准
+   是法定修正通道）；
+T6 缓存隔离——同 query 不同 view 不串味（缓存键含 view），同 view
+   命中缓存且结果一致；
+T7 Secure 层——_candidates 签名同步（kw 透传不炸）+ search_rrf
+   全称量词断言（结果集全部满足视图资格，图扩展扩散路径不泄漏）；
+T8 recall 双路径透传——use_rrf 两分支端到端 + fail-closed 贯通；
+T9 MCP 透传面——源码断言（read/route 分支 view= + schema 登记项，
+   与 test_hyperedge T1③④ 同口径，防「库层通了、工具面没接」）。
+
+运行：python -m md_cg.test_role_views
+"""
+
+import os
+import shutil
+import sys
+import tempfile
+import traceback
+
+from . import roleviews
+from . import hotcache
+from .mdcos import MdCGSecure, WORK_ROLES
+from .security import Principal
+
+_ok = 0
+_bad = []
+
+
+def _check(name, cond, detail=""):
+    global _ok
+    if cond:
+        _ok += 1
+        print("  ok   %s" % name)
+    else:
+        _bad.append("%s %s" % (name, detail))
+        print("  FAIL %s %s" % (name, detail))
+
+
+def _src(name):
+    here = os.path.dirname(os.path.abspath(__file__))
+    with open(os.path.join(here, name), encoding="utf-8") as f:
+        return f.read()
+
+
+def _mk_cg(tmp):
+    p = Principal(tenant="default", actor="t_roleviews", role="designer",
+                  can_write=True, can_admin=True)
+    return MdCGSecure(tempfile.mkdtemp(dir=tmp), principal=p)
+
+
+# 混合语料：共享主题词「极光」（同 query 命中全体，视图过滤看差异）
+_CORPUS = [
+    # (nid, layer, content_kind, role, tail)
+    ("rv_e1", "knowledge", "text", "user", "观测报告正文结论"),
+    ("rv_e2", "knowledge", "work_done", None, "工作完成结论记录"),
+    ("rv_e3", "knowledge", "ccg_marks", None, "判据面与环境陷阱"),
+    ("rv_e4", "contextual", "text", None, "情境上下文补充"),
+    ("rv_e5", "knowledge", "code", "command", "命令脚本片段"),
+    ("rv_e6", "knowledge", "text", "tool-output", "工具输出记录"),
+    ("rv_e7", "knowledge", "code", None, "无角色代码片段"),
+]
+# 各视图预期可见集（T5 断言依据，与 roleviews.matches 语义独立推导）
+_EXPECT = {
+    None: {"rv_e1", "rv_e2", "rv_e3", "rv_e4", "rv_e7"},
+    "main": {"rv_e1", "rv_e2"},
+    "verifier": {"rv_e1", "rv_e3", "rv_e4"},
+    "receipt": {"rv_e5", "rv_e6"},
+}
+
+
+def _seed(cg):
+    for nid, layer, ck, role, tail in _CORPUS:
+        kw = {"layer": layer, "content_kind": ck}
+        if role is not None:
+            kw["role"] = role
+        cg.add(nid, "极光 %s" % tail, **kw)
+
+
+def _ids(res):
+    return [r[0]["id"] for r in res]
+
+
+def _nid_of_entry(e):
+    """candidates 索引 entry 无顶层 id 键——nid 取 path 的 stem（*.md）。"""
+    p = (e.get("path") or "").replace("\\", "/")
+    return p.rsplit("/", 1)[-1][:-3] if p.endswith(".md") else p
+
+
+def _collect_ids(o, acc=None):
+    """递归收集容器里所有节点标识（id 或 path，不依赖 recall 返回键形）。"""
+    if acc is None:
+        acc = set()
+    if isinstance(o, dict):
+        for k, v in o.items():
+            if isinstance(v, str) and k == "id":
+                acc.add(v)
+            elif isinstance(v, str) and k == "path":
+                acc.add(_nid_of_entry({"path": v}))
+            else:
+                _collect_ids(v, acc)
+    elif isinstance(o, (list, tuple)):
+        for it in o:
+            _collect_ids(it, acc)
+    return acc
+
+
+def _t1_rules():
+    print("\n【T1】规则表守卫（真源一致性）")
+    _check("① receipt 白名单与 mdcos.WORK_ROLES 字面一致（防两处漂移）",
+           roleviews.ROLE_VIEWS["receipt"]["roles"] == WORK_ROLES,
+           "%r vs %r" % (roleviews.ROLE_VIEWS["receipt"]["roles"], WORK_ROLES))
+    _check("② 视图名集合 = {main, verifier, receipt}",
+           set(roleviews.ROLE_VIEWS) == {"main", "verifier", "receipt"},
+           str(sorted(roleviews.ROLE_VIEWS)))
+    from . import audit as audit_mod
+    _check("③ main/verifier 的 content_kinds 均为合法枚举（⊆audit.CONTENT_KINDS）",
+           set(roleviews.ROLE_VIEWS["main"]["content_kinds"])
+           | set(roleviews.ROLE_VIEWS["verifier"]["content_kinds"])
+           <= set(audit_mod.CONTENT_KINDS))
+    _check("④ main 资格=text|work_done ∧ knowledge 层（计划 §4.1）",
+           set(roleviews.ROLE_VIEWS["main"]["content_kinds"]) == {"text", "work_done"}
+           and roleviews.ROLE_VIEWS["main"]["layers"] == ("knowledge",))
+    _check("⑤ verifier 资格=ccg_marks|text ∧ knowledge|contextual 层（计划 §4.1）",
+           set(roleviews.ROLE_VIEWS["verifier"]["content_kinds"]) == {"ccg_marks", "text"}
+           and set(roleviews.ROLE_VIEWS["verifier"]["layers"])
+           == {"knowledge", "contextual"})
+    _check("⑥ include_work 旗标：main/verifier=False，receipt=True",
+           roleviews.ROLE_VIEWS["main"]["include_work"] is False
+           and roleviews.ROLE_VIEWS["verifier"]["include_work"] is False
+           and roleviews.ROLE_VIEWS["receipt"]["include_work"] is True)
+    _check("⑦ views() 返回排序稳定元组",
+           roleviews.views() == ("main", "receipt", "verifier"),
+           str(roleviews.views()))
+
+
+def _t2_matches():
+    print("\n【T2】matches 单点谓词判定矩阵")
+    M = roleviews.matches
+    cases = [
+        # (fm, view, 期望, 说明)
+        ({"layer": "knowledge", "content_kind": "text"}, "main", True,
+         "text+knowledge 命中 main"),
+        ({"layer": "knowledge", "content_kind": "work_done"}, "main", True,
+         "work_done 命中 main"),
+        ({"layer": "contextual", "content_kind": "text"}, "main", False,
+         "contextual 层不在 main"),
+        ({"layer": "knowledge", "content_kind": "code", "role": "command"},
+         "main", False, "code 不在 main 类型集"),
+        ({"layer": "knowledge", "content_kind": "text", "role": "tool-output"},
+         "main", False, "工作角色在 main 一票否决"),
+        ({"layer": "knowledge", "content_kind": "text", "role": "command"},
+         "main", False, "command 角色在 main 一票否决"),
+        ({"layer": "knowledge", "content_kind": "text"}, "verifier", True,
+         "text+knowledge 命中 verifier"),
+        ({"layer": "knowledge", "content_kind": "ccg_marks"}, "verifier", True,
+         "marks 命中 verifier"),
+        ({"layer": "contextual", "content_kind": "text"}, "verifier", True,
+         "contextual+text 命中 verifier"),
+        ({"layer": "contextual", "content_kind": "ccg_marks"}, "verifier", True,
+         "contextual+marks 命中 verifier"),
+        ({"layer": "knowledge", "content_kind": "work_done"}, "verifier", False,
+         "work_done 不在 verifier 类型集"),
+        ({"role": "command"}, "receipt", True, "command 命中 receipt 白名单"),
+        ({"role": "tool-output"}, "receipt", True, "tool-output 命中 receipt"),
+        ({"role": "edit"}, "receipt", True, "edit 命中 receipt"),
+        ({"role": "user"}, "receipt", False, "普通角色不进 receipt"),
+        ({"content_kind": "code"}, "receipt", False,
+         "无 role 的 code 不进 receipt（类型启发严格口径）"),
+        ({"layer": "knowledge"}, "main", True,
+         "缺 content_kind 按 text 对待（fail-open 惯例）"),
+        ({"layer": "knowledge", "content_kind": "ccg_marks"}, "main", False,
+         "marks 不进 main"),
+    ]
+    for fm, view, exp, why in cases:
+        got = M(fm, view)
+        _check("matches(%s, %s)=%s · %s" % (fm, view, exp, why),
+               got == exp, "got %r" % got)
+    try:
+        M({"layer": "knowledge"}, "bogus")
+        _check("非法 view ValueError（fail-closed）", False, "未抛出")
+    except ValueError:
+        _check("非法 view ValueError（fail-closed）", True)
+    except Exception as exc:  # noqa: BLE001
+        _check("非法 view ValueError（fail-closed）", False, repr(exc))
+
+
+def _t3_failclosed(cg):
+    print("\n【T3】库层 fail-closed（四入口非法 view）")
+    for name, fn in [
+        ("_candidates", lambda: cg._candidates(view="bogus")),
+        ("search", lambda: cg.search("极光", view="bogus")),
+        ("search_rrf", lambda: cg.search_rrf("极光", view="bogus")),
+        ("recall/non-rrf", lambda: cg.recall("极光", budget_tokens=200,
+                                             use_rrf=False, view="bogus")),
+        ("recall/rrf", lambda: cg.recall("极光", budget_tokens=200,
+                                         view="bogus")),
+    ]:
+        try:
+            fn()
+            _check("%s 非法 view ValueError" % name, False, "未抛出")
+        except ValueError:
+            _check("%s 非法 view ValueError" % name, True)
+        except Exception as exc:  # noqa: BLE001
+            _check("%s 非法 view ValueError" % name, False, repr(exc))
+
+
+def _t4_zero_drift(cg):
+    print("\n【T4】零行为变更（view=None ≡ 不传 view，逐位）")
+    a, _ma = cg.search("极光")
+    b, _mb = cg.search("极光", view=None)
+    _check("search：同 id 同序同分",
+           [(x[0]["id"], round(x[1], 9)) for x in a]
+           == [(x[0]["id"], round(x[1], 9)) for x in b])
+    ra, _mra = cg.search_rrf("极光")
+    rb, _mrb = cg.search_rrf("极光", view=None)
+    _check("search_rrf：同 id 同序同分",
+           [(x[0]["id"], round(x[1], 9)) for x in ra]
+           == [(x[0]["id"], round(x[1], 9)) for x in rb])
+    ca = cg._candidates()
+    cb = cg._candidates(view=None)
+    _check("_candidates：同 id 同序",
+           [_nid_of_entry(x) for x in ca] == [_nid_of_entry(x) for x in cb])
+    m1 = cg.recall("极光", budget_tokens=4000)
+    m2 = cg.recall("极光", budget_tokens=4000, view=None)
+    _check("recall：结构同型", type(m1) is type(m2) and bool(m1) == bool(m2))
+
+
+def _t5_views(cg):
+    print("\n【T5】三视图端到端（候选层 + search 面）")
+    for view, exp in _EXPECT.items():
+        if view is None:
+            continue
+        got = {_nid_of_entry(e) for e in cg._candidates(view=view)}
+        _check("candidates(view=%s) 命中集 %s" % (view, sorted(exp)),
+               got == exp, "got %s" % sorted(got))
+        res, _meta = cg.search("极光", k=20, view=view)
+        got_s = set(_ids(res))
+        _check("search(view=%s) 命中集一致" % view, got_s == exp,
+               "got %s" % sorted(got_s))
+    # receipt 与 main 在 role 维度互补（本语料：工作角色 ↔ 非工作角色不重叠）
+    main_set = {_nid_of_entry(e) for e in cg._candidates(view="main")}
+    rec_set = {_nid_of_entry(e) for e in cg._candidates(view="receipt")}
+    _check("main × receipt 在 role 维度互斥", not (main_set & rec_set),
+           "交集 %s" % sorted(main_set & rec_set))
+    # 无 role 的 code 节点三视图皆不可见（类型启发严格口径，bench 校准通道）
+    _check("rv_e7（无 role 的 code）三视图皆不可见",
+           all("rv_e7" not in {_nid_of_entry(e) for e in cg._candidates(view=v)}
+               for v in ("main", "verifier", "receipt")))
+
+
+def _t6_cache(cg):
+    print("\n【T6】缓存隔离（view 进键）")
+    hotcache.attach(cg)
+    r1, _ = cg.search_rrf("极光", k=20, view="main")
+    r2, _ = cg.search_rrf("极光", k=20, view="receipt")
+    ids_main = set(_ids(r1))
+    ids_rec = set(_ids(r2))
+    _check("同 query 不同 view 结果互斥（不串味）",
+           ids_main == _EXPECT["main"] and ids_rec == _EXPECT["receipt"],
+           "main=%s receipt=%s" % (sorted(ids_main), sorted(ids_rec)))
+    r3, m3 = cg.search_rrf("极光", k=20, view="main")
+    _check("同 view 复用缓存且结果一致",
+           m3.get("cached") is True
+           and _ids(r3) == _ids(r1),
+           "cached=%r" % m3.get("cached"))
+
+
+def _t7_secure(cg):
+    print("\n【T7】Secure 层（签名同步 + 扩散路径兜底）")
+    out = cg._candidates(view="main")
+    _check("Secure._candidates(view=...) kw 透传不炸（签名同步守卫）",
+           isinstance(out, list)
+           and {_nid_of_entry(e) for e in out} == _EXPECT["main"],
+           "got %s" % sorted({_nid_of_entry(e) for e in out}))
+    res, _meta = cg.search_rrf("极光", k=50, view="main")
+    nodes = cg.index["nodes"]
+    _check("search_rrf 全称量词：结果全部满足 main 资格（扩散路径不泄漏）",
+           all(roleviews.matches(nodes[x[0]["id"]], "main") for x in res),
+           str([x[0]["id"] for x in res
+                if not roleviews.matches(nodes[x[0]["id"]], "main")]))
+    res2, _meta2 = cg.search_rrf("极光", k=50, view="receipt")
+    _check("search_rrf receipt 全称量词",
+           all(roleviews.matches(nodes[x[0]["id"]], "receipt") for x in res2)
+           and set(_ids(res2)) == _EXPECT["receipt"],
+           str(sorted(set(_ids(res2)))))
+
+
+def _t8_recall(cg):
+    print("\n【T8】recall 双路径透传")
+    out = cg.recall("极光", budget_tokens=4000, view="main")
+    got = _collect_ids(out) & {nid for nid, *_ in _CORPUS}
+    _check("recall(view=main) 结果全在 main 资格集", got == _EXPECT["main"],
+           "got %s" % sorted(got))
+    out2 = cg.recall("极光", budget_tokens=4000, view="receipt")
+    got2 = _collect_ids(out2) & {nid for nid, *_ in _CORPUS}
+    _check("recall(view=receipt) 结果全在 receipt 资格集",
+           got2 == _EXPECT["receipt"], "got %s" % sorted(got2))
+
+
+def _t9_mcp_surface():
+    print("\n【T9】MCP 透传面（源码断言，与 test_hyperedge T1③④ 同口径）")
+    src = _src("mcp_server.py")
+    # route 分支为 kwarg 形态（cg.search(..., view=a.get("view"))），
+    # read 分支为 _tkw dict 形态（"view": a.get("view")）——各恰 1 处，
+    # 比 >= 合计更严：防未来重复注册或单分支漏接。
+    _check("route 分支透传 view=a.get(\"view\")（kwarg 形态恰 1 处）",
+           src.count('view=a.get("view")') == 1,
+           "count=%d" % src.count('view=a.get("view")'))
+    _check("read 分支透传 view（_tkw dict 形态恰 1 处）",
+           src.count('"view": a.get("view")') == 1,
+           "count=%d" % src.count('"view": a.get("view")'))
+    _check("schema 登记 view 项（角色化读取视图）",
+           'view=_p("string", "read/route 的角色化读取视图' in src)
+
+
+def main():
+    tmp = tempfile.mkdtemp(prefix="mdcg_roleviews_")
+    try:
+        cg = _mk_cg(tmp)
+        _seed(cg)
+        _t1_rules()
+        _t2_matches()
+        _t3_failclosed(cg)
+        _t4_zero_drift(cg)
+        _t5_views(cg)
+        _t6_cache(cg)
+        _t7_secure(cg)
+        _t8_recall(cg)
+        _t9_mcp_surface()
+    finally:
+        shutil.rmtree(tmp, ignore_errors=True)
+    print("\n==== roleviews 验收：%d ok / %d fail ====" % (_ok, len(_bad)))
+    for b in _bad:
+        print("  FAIL> %s" % b)
+    return 1 if _bad else 0
+
+
+if __name__ == "__main__":
+    try:
+        sys.exit(main())
+    except Exception:  # noqa: BLE001
+        traceback.print_exc()
+        sys.exit(2)