@furongjun1999/dsh-memory 0.5.0 → 0.5.1

package/md_cg/test_n130_verify_falsified_protect.py

@@ -0,0 +1,185 @@
+# -*- coding: utf-8 -*-
+"""N130 守卫：verify(verdict="falsified") 的删除必须过「不可遗忘」保护。
+
+缺陷形态（2026-09-25 引擎域新发现，编号 N130，high）：verify() 的 falsified
+分支（mdcg.py:3188-3195）对原节点 os.remove **永久硬删**，全程不经
+protect.guard_forget / require_layer_write / override——self/anchor 层、
+protected 标记、importance≥0.7 的受保护节点可被一次 verify 调用一键删除，
+无快照、无留痕、不进 trash；对照 forget 路径（mdcos.py:2294）同一个删除
+动作需 require_admin + guard_forget 双闸（旧版本先快照、动作全程留痕）。
+
+攻击面：任何持 verify op 的主体（verify 角色 ops_allow 即含 verify，
+designer ops=["*"] 天然含）对任意 node_id 调 cg(op=verify,
+verdict=falsified) 一次调用永久删除；无需 override 无需 admin。
+
+修复：①falsified 分支在任何副作用（add_rejected / os.remove）之前接
+protect.guard_forget（受保护节点需显式 override=True——旧版本自动快照 +
+_protected_audit 留痕，与 forget 路径同一语义；拒绝抛 ProtectionError，
+原节点原样保留）；②MdCGSecure.verify 对 falsified 按原节点层做
+require_layer_write（与 add/add_rejected 同一闸口——verify 角色
+layers_allow=["rejected","contextual"]，本就「不得改被验证内容」，
+tokens.py:171 显式 forbidden）。
+
+红项 = R1-R7（四类受保护节点一键硬删复现 + secure 面层写缺口）；
+G 项锁语义不变（普通节点 falsified 负记忆化、override 显式放行 + 快照留痕）。
+运行：python -m md_cg.test_n130_verify_falsified_protect
+"""
+from __future__ import annotations
+
+import os
+import shutil
+import sys
+import tempfile
+
+try:
+    from . import protect
+    from .mdcos import MdCGOS, MdCGSecure
+    from .security import AccessDenied, Principal
+except ImportError:                                  # 直接脚本运行
+    sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+    from md_cg import protect
+    from md_cg.mdcos import MdCGOS, MdCGSecure
+    from md_cg.security import AccessDenied, Principal
+
+PASS = FAIL = 0
+FAILS = []
+
+
+def ok(cond, label):
+    global PASS, FAIL
+    if cond:
+        PASS += 1
+        print(f"  OK   {label}")
+    else:
+        FAIL += 1
+        FAILS.append(label)
+        print(f"  FAIL {label}")
+
+
+_BODY = "# 功能名：N130 守卫\n\n# 生效条件：无条件\n\n正文。\n"
+
+
+def _exists(cg, nid):
+    """索引条目在且盘面文件在（硬删后两者都会消失）。"""
+    e = (cg.index.get("nodes") or {}).get(nid)
+    return (e is not None
+            and os.path.exists(os.path.join(cg.root, e["path"])))
+
+
+def _falsified_must_reject(cg, nid, label):
+    """对 nid 做 falsified：期望 ProtectionError 且节点原样保留。"""
+    raised = None
+    try:
+        cg.verify(nid, "N130 守卫的反例证据", "falsified")
+    except protect.ProtectionError as exc:
+        raised = exc
+    ok(raised is not None, f"{label}1 falsified 受保护节点被拒（ProtectionError）")
+    ok(_exists(cg, nid), f"{label}2 拒绝后索引与盘面文件原样保留")
+
+
+def _seed(cg):
+    """四类受保护节点 + 一类普通节点（对照）。"""
+    cg.add("n_self", _BODY, layer="self")
+    cg.add("n_anchor", _BODY, layer="anchor")
+    cg.add("n_prot", _BODY, layer="knowledge")
+    protect.mark(cg, "n_prot", "N130 守卫：显式保护标记")
+    cg.add("n_imp", _BODY, layer="knowledge", importance=0.9)
+    cg.add("n_plain", _BODY, layer="knowledge")
+
+
+def _base_shape(tmp):
+    """A：基类引擎面（无令牌）——四类受保护节点不得被 falsified 一键硬删。"""
+    print("--- A 基类引擎面：guard_forget 前置")
+    root = os.path.join(tmp, "base")
+    cg = MdCGOS(root)
+    _seed(cg)
+
+    _falsified_must_reject(cg, "n_self", "R1_self")
+    _falsified_must_reject(cg, "n_anchor", "R2_anchor")
+    _falsified_must_reject(cg, "n_prot", "R3_protected")
+    _falsified_must_reject(cg, "n_imp", "R4_importance0.9")
+
+    ok(all(_exists(cg, n) for n in
+           ("n_self", "n_anchor", "n_prot", "n_imp")),
+       "R5 四次拒绝后四个受保护节点全部健在")
+    ok(not os.path.isdir(os.path.join(cg.root, protect.HISTORY_DIR)),
+       "R6 拒绝路径零副作用（未创建 _protected_history）")
+
+    # G1：普通节点 falsified 语义不变（负记忆化 + 原节点移除）
+    r = cg.verify("n_plain", "普通节点反例", "falsified")
+    ok(r.get("action") == "falsified", "G1a 普通 knowledge 节点 falsified 照常放行")
+    ok(not _exists(cg, "n_plain"), "G1b 原 knowledge 节点按负记忆化移除（语义不变）")
+    neg = [e for e in (cg.index.get("nodes") or {}).values()
+           if e.get("layer") == "rejected"]
+    ok(len(neg) == 1, "G1c rejected 层出现负记忆条目（语义不变）")
+
+    # G2：override=True 显式放行 + 快照留痕（与 forget 路径同一能力面）
+    r2 = cg.verify("n_prot", "显式 override 的反例", "falsified", override=True)
+    ok(r2.get("action") == "falsified", "G2a override=True 显式放行 falsified")
+    ok(not _exists(cg, "n_prot"), "G2b override 放行后原节点移除")
+    hist = protect.history(cg, "n_prot")
+    ok(len(hist) == 1, "G2c override 放行前旧版本已快照进 _protected_history")
+    audit = os.path.join(cg.root, protect.AUDIT_FILE)
+    ok(os.path.exists(audit) and "override_forget" in open(
+        audit, encoding="utf-8").read(),
+       "G2d override_forget 动作已留痕 _protected_audit.jsonl")
+    cg.close()
+
+
+def _secure_shape(tmp):
+    """B：MdCGSecure 面——falsified 删除按原节点层做 require_layer_write。"""
+    print("--- B 安全面：层写权限校验")
+    root = os.path.join(tmp, "secure")
+    verify_p = Principal(actor="verifier-1", role="verify", can_write=True,
+                         can_admin=False, clearance="internal",
+                         layers_allow=["rejected", "contextual"],
+                         ops_allow=["info", "read", "verify"])
+    designer_p = Principal(actor="designer-1", role="designer", can_write=True,
+                           can_admin=True, clearance="secret")
+    # 预置用 designer（knowledge 层只有可写该层的身份能建），攻击用 verify 角色
+    cg = MdCGSecure(root, principal=designer_p, master_key=bytes(range(32)))
+    cg.add("s_kn", _BODY, layer="knowledge")            # verify 角色无权写 knowledge
+    cg.add("s_ctx", _BODY, layer="contextual")          # verify 角色本职可写
+    cg.close()
+
+    # R7：verify 角色 falsified knowledge 节点 → 层写拒绝，节点原样保留
+    cg = MdCGSecure(root, principal=verify_p, master_key=bytes(range(32)))
+    raised = None
+    try:
+        cg.verify("s_kn", "verify 角色反例", "falsified")
+    except AccessDenied as exc:
+        raised = exc
+    ok(raised is not None, "R7a verify 角色 falsified knowledge 层被拒（AccessDenied）")
+    ok(_exists(cg, "s_kn"), "R7b 拒绝后 knowledge 节点索引与盘面原样保留")
+
+    # G3：verify 角色 falsified contextual 节点 → 本职可写，照常负记忆化
+    r = cg.verify("s_ctx", "verify 角色反例（contextual）", "falsified")
+    ok(r.get("action") == "falsified", "G3a verify 角色 falsified contextual 层放行")
+    ok(not _exists(cg, "s_ctx"), "G3b contextual 节点按负记忆化移除（语义不变）")
+    cg.close()
+
+    # R8：designer（层写不限）falsified self 层节点仍被 guard_forget 拦截
+    cg = MdCGSecure(root, principal=designer_p, master_key=bytes(range(32)))
+    cg.add("s_self", _BODY, layer="self")
+    _falsified_must_reject(cg, "s_self", "R8_designer_self")
+    cg.close()
+
+
+def main():
+    tmp = tempfile.mkdtemp(prefix="mdcg_n130_guard_")
+    try:
+        _base_shape(tmp)
+        _secure_shape(tmp)
+    finally:
+        shutil.rmtree(tmp, ignore_errors=True)
+
+    print("\n" + "=" * 60)
+    print(f"结果：PASS {PASS} / FAIL {FAIL}")
+    if FAILS:
+        for f in FAILS:
+            print(f"  - {f}")
+    return 0 if FAIL == 0 else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/md_cg/test_n131_merge_gate.py

@@ -0,0 +1,205 @@
+# -*- coding: utf-8 -*-
+"""N131 守卫：review_decide(merge) 的目标写入必须过 add 同款双闸。
+
+缺陷形态（2026-09-25 引擎域新发现，编号 N131，high）：review_decide 的
+merge 分支（mdcos.py:2221-2255）把提案内容直接 _write_node 追加进任意
+merge_into 目标节点，绕过 guard_write 与 require_layer_write——accept/edit
+走 self.add()（:2211）有 MdCGSecure.add :3769 require_layer_write 与基类
+add mdcg.py:1311 guard_write 双闸，merge 直写零闸；mcp_server review_decide
+注释「accept/edit 落节点时的层写仍由下游 require_layer_write 拦截」对 merge
+不成立，orchestr 角色 forbidden「anchor/self/goals/knowledge 层」
+（tokens.py:123）被打穿。
+
+攻击面：持 review+write op 的令牌（orchestr 的 ops_allow 两者皆含，
+tokens.py:120；designer 全权）——propose 任意内容 → review_decide(pid,
+decision="merge", merge_into=<self/anchor/immutable/knowledge 任意节点 id>)
+注入任意文本。
+
+修复：merge 分支在 _write_node 之前接与 add 同款双闸——principal 在位先
+require_layer_write(目标层, 目标敏感度)（与 MdCGSecure.add 同序同错型），
+再 guard_write（self/anchor 层、immutable 标记，对照 add :1311；override
+显式传参时快照+留痕放行，与 add 能力面对齐）；闸在 _record_decision 之前
+抛出——裁决不落库、提案留 pending（审计节点写入本就在 try/except 内，
+闸放那里会被吞成 record_error，形同虚设）。
+
+红项 = R1-R4（self/immutable 目标引擎面 + knowledge/self 目标 orchestr 面
+注入复现）；G 项锁语义不变（普通目标 merge 追加、orchestr 本职 contextual
+目标放行、designer override 放行）+ 两对照（orchestr add self 被拒 /
+designer add 覆 immutable 被拒——闸原本就在，只是 merge 绕过）。
+运行：python -m md_cg.test_n131_merge_gate
+"""
+from __future__ import annotations
+
+import os
+import shutil
+import sys
+import tempfile
+
+try:
+    from . import protect
+    from .mdcos import MdCGOS, MdCGSecure
+    from .security import AccessDenied, Principal
+except ImportError:                                  # 直接脚本运行
+    sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+    from md_cg import protect
+    from md_cg.mdcos import MdCGOS, MdCGSecure
+    from md_cg.security import AccessDenied, Principal
+
+PASS = FAIL = 0
+FAILS = []
+
+
+def ok(cond, label):
+    global PASS, FAIL
+    if cond:
+        PASS += 1
+        print(f"  OK   {label}")
+    else:
+        FAIL += 1
+        FAILS.append(label)
+        print(f"  FAIL {label}")
+
+
+_MARK = "攻击者注入段落"
+
+
+def _body(name):
+    return (f"# 功能名：{name}\n# 生效条件：无条件\n# 子功能：无\n"
+            f"# 执行：无\n# 验证方式：test\n# 不适用条件：无\n\n原始正文。")
+
+
+def _content_of(cg, nid):
+    n = cg.get(nid)
+    return (n or {}).get("content") or ""
+
+
+def _merge_must_reject(cg, pid, target, exc_type, label):
+    """merge 进 target：期望 exc_type 且目标内容原样。"""
+    raised = None
+    try:
+        cg.review_decide(pid, "merge", merge_into=target)
+    except exc_type as exc:
+        raised = exc
+    ok(raised is not None, f"{label}1 merge 进 {target} 被拒（{exc_type.__name__}）")
+    ok(_MARK not in _content_of(cg, target),
+       f"{label}2 拒绝后 {target} 正文无注入内容")
+
+
+def _base_shape(tmp):
+    """A：基类引擎面（无令牌）——self/immutable 目标不得被 merge 直写。"""
+    print("--- A 基类引擎面：guard_write 闸")
+    root = os.path.join(tmp, "base")
+    cg = MdCGOS(root)
+    cg.add("tgt_self", _body("自我目标"), layer="self")
+    cg.add("tgt_imm", _body("不可覆盖目标"), layer="knowledge", immutable=True)
+    cg.add("tgt_plain", _body("普通目标"), layer="knowledge")
+    ok(protect.is_immutable(cg, "tgt_imm")[0],
+       "A0 预置生效：tgt_imm 判定为不可覆盖")
+    for nid in ("p_self", "p_imm", "p_plain"):
+        cg.propose(nid, _body(nid) + "\n" + _MARK + "\n", layer="knowledge")
+
+    _merge_must_reject(cg, next(r["pid"] for r in cg.review_list()
+                                if r["id"] == "p_self"),
+                       "tgt_self", protect.ProtectionError, "R1_self")
+    _merge_must_reject(cg, next(r["pid"] for r in cg.review_list()
+                                if r["id"] == "p_imm"),
+                       "tgt_imm", protect.ProtectionError, "R2_immutable")
+
+    # G1：普通目标 merge 照常放行（test_merge_upsert / test_p2 语义不变）
+    pid_plain = next(r["pid"] for r in cg.review_list() if r["id"] == "p_plain")
+    r = cg.review_decide(pid_plain, "merge", merge_into="tgt_plain")
+    ok(r.get("ok") and r.get("node_id") == "tgt_plain",
+       "G1a 普通 knowledge 目标 merge 照常放行")
+    ok(_MARK in _content_of(cg, "tgt_plain"),
+       "G1b 追加内容进入目标正文（merge 本职不变）")
+    cg.close()
+
+
+def _secure_shape(tmp):
+    """B：MdCGSecure 面——merge 按目标层做 require_layer_write（orchestr 面）。"""
+    print("--- B 安全面：orchestr 层写校验")
+    root = os.path.join(tmp, "secure")
+    designer_p = Principal(actor="designer-1", role="designer", can_write=True,
+                           can_admin=True, clearance="secret")
+    orch_p = Principal(actor="orch-1", role="orchestr", can_write=True,
+                       can_admin=False, clearance="internal",
+                       layers_allow=["contextual", "unresolved", "rejected"],
+                       ops_allow=["info", "route", "read", "write", "review"])
+    cg = MdCGSecure(root, principal=designer_p, master_key=bytes(range(32)))
+    cg.add("t_kn", _body("知识目标"), layer="knowledge")
+    cg.add("t_ctx", _body("情境目标"), layer="contextual")
+    cg.add("t_self", _body("自我目标"), layer="self")
+    cg.close()
+
+    # 对照 R3：orchestr 直接 add 写 self 层被拒（身份确实受限，闸原本就在）
+    cg = MdCGSecure(root, principal=orch_p, master_key=bytes(range(32)))
+    denied = None
+    try:
+        cg.add("x_self", _body("越权"), layer="self")
+    except AccessDenied as exc:
+        denied = exc
+    ok(denied is not None, "R3 对照：orchestr add 写 self 层被拒（AccessDenied）")
+
+    # R4/R5：orchestr merge 注入 knowledge / self 层目标——旧码双写路径全绕
+    #（提案内容须互异：propose 按 payload_hash 幂等去重，同内容返回既有 pid）
+    pid_kn = cg.propose("a_kn", _body("提案注入知识") + "\n" + _MARK + "知识\n",
+                        layer="contextual")
+    _merge_must_reject(cg, pid_kn, "t_kn", AccessDenied, "R4_orch_knowledge")
+    pid_self = cg.propose("a_self", _body("提案注入自我") + "\n" + _MARK + "自我\n",
+                          layer="contextual")
+    _merge_must_reject(cg, pid_self, "t_self", AccessDenied, "R5_orch_self")
+
+    # G2：orchestr 本职可写层（contextual）目标 merge 照常放行
+    pid_ctx = cg.propose("a_ctx", _body("提案注入情境") + "\n" + _MARK + "情境\n",
+                         layer="contextual")
+    r = cg.review_decide(pid_ctx, "merge", merge_into="t_ctx")
+    ok(r.get("ok") and _MARK in _content_of(cg, "t_ctx"),
+       "G2 orchestr merge 进本职 contextual 目标放行且内容追加（本职不变）")
+    cg.close()
+
+    # 对照 R6：designer add 覆写 immutable 既有节点被拒（guard_write 对照）+
+    # G3：designer merge 带 override 进 immutable 目标显式放行（快照+留痕）
+    cg = MdCGSecure(root, principal=designer_p, master_key=bytes(range(32)))
+    cg.add("t_imm2", _body("不可覆盖"), layer="knowledge", immutable=True)
+    prot = None
+    try:
+        cg.add("t_imm2", _body("覆写"), layer="knowledge")
+    except protect.ProtectionError as exc:
+        prot = exc
+    ok(prot is not None, "R6 对照：designer add 覆写 immutable 节点被拒"
+                         "（ProtectionError）")
+    cg.close()
+
+    cg = MdCGSecure(root, principal=designer_p, master_key=bytes(range(32)))
+    pid_ov = cg.propose("a_ov", _body("提案") + "\n" + _MARK + "\n",
+                        layer="knowledge")
+    r = cg.review_decide(pid_ov, "merge", merge_into="t_imm2", override=True)
+    ok(r.get("ok") and _MARK in _content_of(cg, "t_imm2"),
+       "G3a designer override=True merge 进 immutable 目标显式放行")
+    hist = protect.history(cg, "t_imm2")
+    ok(len(hist) >= 1, "G3b override 放行前旧版本已快照 _protected_history")
+    audit = os.path.join(cg.root, protect.AUDIT_FILE)
+    ok(os.path.exists(audit) and "override_write" in open(
+        audit, encoding="utf-8").read(),
+       "G3c override_write 动作已留痕 _protected_audit.jsonl")
+    cg.close()
+
+
+def main():
+    tmp = tempfile.mkdtemp(prefix="mdcg_n131_guard_")
+    try:
+        _base_shape(tmp)
+        _secure_shape(tmp)
+    finally:
+        shutil.rmtree(tmp, ignore_errors=True)
+
+    print("\n" + "=" * 60)
+    print(f"结果：PASS {PASS} / FAIL {FAIL}")
+    if FAILS:
+        for f in FAILS:
+            print(f"  - {f}")
+    return 0 if FAIL == 0 else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/md_cg/test_p1x_ref_root.py

@@ -0,0 +1,160 @@
+# -*- coding: utf-8 -*-
+"""test_p1x_ref_root.py · P1-X 回归守卫：op=ref / index_code / index_doc 的根白名单
+
+安全缺陷（两份独立报告合并，severity=high）：op=ref 是越权任意文件读原语——
+probe_ref 以调用方自报的 root 与 ref.path 直接 os.path.join 后 open 全文回读
+（refindex.py），无租户根校验、无 check_path_root、无密级闸。三形态全部漏：
+
+  ① 自报 root 指向记忆根外（victim/secret.txt 全文进模型上下文）；
+  ② ref.path 绝对路径（os.path.join 遇绝对路径丢弃 root）；
+  ③ '../' 上跳。
+同族缺口：index_code / index_doc 的 path 同样不走 check_path_root
+（P1-4 只覆盖 ingest/export/link/mdcg_ingest）。
+
+修复：_ref_call 的 read/get 分支按「最终将打开的完整路径」挂
+check_path_root(MDCG_INGEST_ROOT)；index_code/index_doc 对模型可控的显式
+path 挂同闸。语义与 P1-4 先例一致：env 未设置 = 放开（部署开关，默认行为
+不变）；设置了 = realpath 落根内否则拒（fail-closed，上跳与绝对路径在
+realpath 归一后自然涵盖）。
+
+本文件钉死：三形态 + 索引越界必须拒绝；白名单内索引/回读不误伤；
+env 未设保持放开语义；ingest 先例闸与 guest op 闸不回归。
+运行：python -m md_cg.test_p1x_ref_root
+"""
+from __future__ import annotations
+
+import os
+import shutil
+import sys
+import tempfile
+
+from . import corpus, tokens
+from .mdcg import MdCG
+from .mcp_server import call_tool
+from .security import AccessDenied
+
+PASS = FAIL = 0
+FAILS = []
+
+SECRET_TEXT = ("AKIAIOSFODNN7EXAMPLE-DUMMY\n"        # 哑数据，非真实凭据
+               "secret-line-2=dummy\nsecret-line-3=dummy\n")
+ALPHA_TEXT = '""" 供能注释。"""\n\ndef compute(mass):\n    return mass\n'
+
+
+def check(name, cond, detail=""):
+    global PASS, FAIL
+    if cond:
+        PASS += 1
+        print(f"  [PASS] {name}" + (f"  · {detail}" if detail else ""))
+    else:
+        FAIL += 1
+        FAILS.append(name)
+        print(f"  [FAIL] {name}  · {detail}")
+
+
+def denied(fn):
+    """断言 fn 被拒：抛 PermissionError，或返回 ok=False。"""
+    try:
+        out = fn()
+        return out.get("ok") is False, f"returned ok={out.get('ok')}"
+    except PermissionError as exc:
+        return True, f"PermissionError({str(exc)[:40]}…)"
+
+
+def main():
+    print("=" * 68)
+    print("md_cg P1-X 验收 · op=ref/index_code/index_doc 根白名单（三形态防越权读）")
+    print("=" * 68)
+
+    tmp = tempfile.mkdtemp(prefix="mdcg_p1x_")
+    memroot = os.path.join(tmp, "memroot")      # 认知图根（服务器侧）
+    allow = os.path.join(tmp, "allow")          # 部署白名单内的代码目录
+    victim = os.path.join(tmp, "victim")        # 白名单外（宿主敏感区模拟）
+    os.makedirs(allow)
+    os.makedirs(victim)
+    with open(os.path.join(victim, "secret.txt"), "w", encoding="utf-8") as f:
+        f.write(SECRET_TEXT)
+    with open(os.path.join(allow, "alpha.py"), "w", encoding="utf-8") as f:
+        f.write(ALPHA_TEXT)
+
+    env = "MDCG_INGEST_ROOT"
+    old = os.environ.get(env)
+    os.environ[env] = allow                      # 部署声明：只有 allow/ 可读入
+
+    corpus.reset_root(memroot)
+    cg = MdCG(memroot)
+    full = {"lineno": 1, "end": 99}              # 无 hash → 不做漂移校验直读
+
+    try:
+        print("\n【1】三形态越权读必须被拒（fail-closed）")
+        ok, d = denied(lambda: call_tool(cg, "cg", {
+            "op": "ref", "ref": dict(path="secret.txt", root=victim, **full)}))
+        check("①a 自报 root 越界被拒（secret 不进上下文）", ok, d)
+        ok, d = denied(lambda: call_tool(cg, "cg", {
+            "op": "ref", "root": allow,
+            "ref": dict(path=os.path.join(victim, "secret.txt"), **full)}))
+        check("①b ref.path 绝对路径被拒（join 丢弃 root 也拦）", ok, d)
+        ok, d = denied(lambda: call_tool(cg, "cg", {
+            "op": "ref", "root": allow,
+            "ref": dict(path=os.path.join("..", "victim", "secret.txt"),
+                        **full)}))
+        check("①c '../' 上跳被拒", ok, d)
+
+        print("\n【2】同族：index_code / index_doc 越界 path 必须被拒")
+        ok, d = denied(lambda: call_tool(cg, "cg", {"op": "index_code",
+                                                    "path": victim}))
+        check("②a index_code 越界 path 被拒", ok, d)
+        ok, d = denied(lambda: call_tool(cg, "cg", {"op": "index_doc",
+                                                    "path": victim}))
+        check("②b index_doc 越界 path 被拒", ok, d)
+
+        print("\n【3】白名单内不误伤")
+        out = call_tool(cg, "cg", {"op": "index_code", "path": allow})
+        nid = (out.get("ids") or [None])[0]
+        rr = call_tool(cg, "cg", {"op": "ref", "node_id": nid}) if nid \
+            else {"ok": False, "error": "no ids"}
+        check("③a 白名单内索引 + node 回读正常",
+              out.get("ok") and out.get("indexed", 0) >= 1
+              and rr.get("ok") is True and "compute" in (rr.get("text") or ""),
+              f"indexed={out.get('indexed')} ref_ok={rr.get('ok')}")
+        rr = call_tool(cg, "cg", {"op": "ref", "root": allow,
+                                  "ref": dict(path="alpha.py", lineno=1, end=2)})
+        check("③b 白名单内 inline ref 回读正常", rr.get("ok") is True,
+              f"ok={rr.get('ok')} err={rr.get('error')}")
+
+        print("\n【4】先例与开关语义不回归")
+        ok, d = denied(lambda: call_tool(cg, "cg", {
+            "op": "ingest", "action": "file",
+            "path": os.path.join(victim, "secret.txt")}))
+        check("④a ingest 越界仍被 P1-4 拦（先例闸不回归）", ok, d)
+        os.environ.pop(env, None)
+        rr = call_tool(cg, "cg", {
+            "op": "ref", "ref": dict(path="secret.txt", root=victim, **full)})
+        check("④b env 未设 = 部署开关放开（默认行为不变）",
+              rr.get("ok") is True
+              and "AKIAIOSFODNN7EXAMPLE" in (rr.get("text") or ""),
+              f"ok={rr.get('ok')}")
+        try:
+            tokens.Principal(role="guest", ops_allow=("read",), theory_ok=True
+                             ).require_op("ref")
+            ok, d = False, "guest 未被拒"
+        except AccessDenied:
+            ok, d = True, "AccessDenied"
+        check("④c guest 令牌 op=ref 仍被 require_op 拒", ok, d)
+    finally:
+        if old is None:
+            os.environ.pop(env, None)
+        else:
+            os.environ[env] = old
+        corpus.reset_root(memroot)              # 收尾：指向本次临时根
+        shutil.rmtree(tmp, ignore_errors=True)
+
+    print("\n" + "=" * 68)
+    print(f"P1-X 根白名单守卫: {PASS}/{PASS + FAIL} 通过")
+    if FAILS:
+        print("未过：" + "；".join(FAILS))
+    return 0 if FAIL == 0 else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())