@furongjun1999/dsh-memory 0.5.0 → 0.6.0

package/md_cg/test_links_concurrent_write.py

@@ -0,0 +1,188 @@
+# -*- coding: utf-8 -*-
+"""连接层并发写守卫（缺陷：load→改内存→save 无锁 + 固定临时名互踩）。
+
+缺陷形态（缺陷报告 2026-09-25 复现证实，medium）：links 连接层全部变更
+（handshake/observe/promote/degrade/isolate/withdraw/decay）是
+load→改内存→save 的读-改-写，无跨进程锁；save 用固定临时名 p+".tmp"
+（fsutil.py:6-8 明载的已实名反模式：两写者共享同一临时文件，后者截断
+前者写了一半的内容）。并发下后写者整文件覆盖前写者——静默丢一方信任
+更新（20/20 实证：终态一方 evidence_count=0），互踩 .tmp 产生交织内容
+（audit 超单写者上限实拍）。
+
+修复方向：save 改走 fsutil.atomic_write（mkstemp 唯一临时名 + 带短重试
+rename）；各变更原语以 FileLock 为 load→mutate→save 全程加连接级互斥。
+
+红守卫 = 缺陷报告 Barrier 对齐双线程复现（两线程都完成 load+mutate 后
+在 save 点对齐同时落盘）：
+  S1 observe×observe（不同连接）：双方都返回 ok 而终态一方 evidence_count
+     丢失 = 静默丢更新（红）；audit 超上限/文件不可解析亦不得出现；
+  S2 observe×degrade（跨原语家族）：同一读-改-写形态，两方效果都幸存。
+对齐窗处理：barrier 超时（3s）短于 FileLock 超时（10s）——修复后另一
+写者被连接锁挡在临界区外、barrier 自然超时Broken，捕获后照常落盘（无
+死锁）；修复前双方都快速到达 save 点、barrier 正常放行 → 确定性竞态。
+运行：python -m md_cg.test_links_concurrent_write
+"""
+from __future__ import annotations
+
+import os
+import shutil
+import sys
+import tempfile
+import threading
+
+from . import links
+
+PASS = FAIL = 0
+FAILS = []
+
+BARRIER_TIMEOUT = 3.0     # < FileLock 默认 10s：锁化后对齐窗自然超时，不死锁
+
+
+def ok(cond, label):
+    global PASS, FAIL
+    if cond:
+        PASS += 1
+        print(f"  OK   {label}")
+    else:
+        FAIL += 1
+        FAILS.append(label)
+        print(f"  FAIL {label}")
+
+
+def _race(p, calls):
+    """双线程在 save 点 Barrier 对齐并发执行 calls 里的两个变更。
+
+    calls: [(fn, kwargs), (fn, kwargs)]——fn 为 links 模块变更原语。
+    返回 (两线程结果, 对齐是否达成)。对齐未达成（barrier 超时 Broken）
+    属修复后预期形态，单独如实报告。
+    """
+    real_save = links.save
+    barrier = threading.Barrier(2)
+    aligned = {"hit": True}
+    results = [None, None]
+
+    def aligned_save(data, path=None):
+        try:
+            barrier.wait(timeout=BARRIER_TIMEOUT)
+        except threading.BrokenBarrierError:
+            aligned["hit"] = False   # 另一写者未到（被锁挡住）——修复后预期
+        return real_save(data, path)
+
+    def worker(i, fn, kw):
+        try:
+            results[i] = {"ok": fn(**kw).get("ok")}
+        except Exception as exc:                    # noqa: BLE001
+            results[i] = {"exc": f"{type(exc).__name__}: {exc}"}
+
+    links.save = aligned_save
+    try:
+        ts = [threading.Thread(target=worker, args=(i, fn, kw))
+              for i, (fn, kw) in enumerate(calls)]
+        for t in ts:
+            t.start()
+        for t in ts:
+            t.join(timeout=60)
+    finally:
+        links.save = real_save
+    return results, aligned["hit"]
+
+
+def _seq_ref_audit_len(tmp):
+    """单写者合法基线：同序列（handshake→observe）在无并发下顺序重放的
+    audit 长度（本机实测 3：handshake + version_misaligned + observe——
+    未声明版本会多记一条，故不得硬编码 2）。"""
+    p = os.path.join(tmp, "ref", "_links.json")
+    links.handshake("peerRef", path=p)
+    links.observe("agent:peerRef", evidence="顺序基线", positive=True, path=p)
+    return len(links.get("agent:peerRef", path=p)["audit"])
+
+
+def _get_link(p, peer):
+    data = links.load(p)
+    for lk in (data.get("links") or {}).values():
+        if lk.get("peer_node_id") == "agent:" + peer:
+            return lk
+    return None
+
+
+def _scenario_observe_race(tmp):
+    """S1：双线程并发 observe 不同连接——对齐在 save 点。"""
+    print("== S1 observe×observe（save 点对齐） ==")
+    p = os.path.join(tmp, "s1", "_links.json")
+    links.handshake("peerA", path=p)
+    links.handshake("peerB", path=p)
+
+    results, aligned = _race(p, [
+        (links.observe, {"peer": "agent:peerA", "evidence": "并发证据A",
+                         "positive": True, "path": p}),
+        (links.observe, {"peer": "agent:peerB", "evidence": "并发证据B",
+                         "positive": True, "path": p}),
+    ])
+    ok(all(r and r.get("ok") for r in results),
+       f"S1a 双方 observe 均成功无异常（实测 {results}）——静默丢更新的前提"
+       f"是『返回 ok 但更新消失』")
+    print(f"  ..   save 点对齐达成={aligned}（修复前应 True=真竞态；"
+          f"修复后 False=另一写者被锁挡住，属预期）")
+
+    la, lb = _get_link(p, "peerA"), _get_link(p, "peerB")
+    ok(la is not None and lb is not None,
+       "S1b 终态文件可解析且两条连接都在（无交织撕裂丢连接）")
+    eca = (la or {}).get("evidence_count")
+    ecb = (lb or {}).get("evidence_count")
+    ok(eca == 1 and ecb == 1,
+       f"S1c 无静默丢更新（peerA={eca}/peerB={ecb}，应 1/1——旧代码"
+       f"后写者整文件覆盖前写者，一方恒 0）")
+    ref = _seq_ref_audit_len(tmp)
+    aa = len((la or {}).get("audit") or [])
+    ab = len((lb or {}).get("audit") or [])
+    ok(aa == ref and ab == ref,
+       f"S1d audit 恰为单写者合法基线（A={aa}/B={ab}，顺序重放基线={ref}；"
+       f"旧代码丢更新侧偏少、固定临时名互踩可超限——缺陷实拍 audit 超上限）")
+    ok(not os.path.exists(p + ".tmp"),
+       "S1e 固定临时名不再出现（改走 atomic_write 唯一临时名）")
+
+
+def _scenario_cross_family(tmp):
+    """S2：observe×degrade 跨原语家族（同一 load→mutate→save 形态）。"""
+    print("== S2 observe×degrade（跨原语） ==")
+    p = os.path.join(tmp, "s2", "_links.json")
+    links.handshake("peerC", path=p)
+    links.handshake("peerD", path=p)
+
+    results, aligned = _race(p, [
+        (links.observe, {"peer": "agent:peerC", "evidence": "并发证据C",
+                         "positive": True, "path": p}),
+        (links.degrade, {"peer": "agent:peerD", "reason": "并发降级守卫",
+                         "path": p}),
+    ])
+    ok(all(r and r.get("ok") for r in results),
+       f"S2a 双方均成功无异常（实测 {results}）")
+    print(f"  ..   save 点对齐达成={aligned}")
+    lc, ld = _get_link(p, "peerC"), _get_link(p, "peerD")
+    ok(lc is not None and ld is not None, "S2b 两条连接都在（文件未撕裂）")
+    ok((lc or {}).get("evidence_count") == 1
+       and (ld or {}).get("status") == "degraded",
+       f"S2c 两方效果都幸存（C.evidence_count="
+       f"{(lc or {}).get('evidence_count')}，D.status="
+       f"{(ld or {}).get('status')}——旧代码丢一方）")
+    ok(not os.path.exists(p + ".tmp"), "S2d 固定临时名不再出现")
+
+
+def main():
+    tmp = tempfile.mkdtemp(prefix="mdcg_links_race_")
+    try:
+        _scenario_observe_race(tmp)
+        _scenario_cross_family(tmp)
+    finally:
+        shutil.rmtree(tmp, ignore_errors=True)
+
+    print("\n" + "=" * 60)
+    print(f"结果：PASS {PASS} / FAIL {FAIL}")
+    if FAILS:
+        for f in FAILS:
+            print(f"  - {f}")
+    return 0 if FAIL == 0 else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/md_cg/test_merge_upsert.py

@@ -0,0 +1,168 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""merge 裁决定向增量收尾守卫（issue：merge 用 rebuild_index O(N) 收尾）。
+
+缺陷形态（缺陷报告实测）：review_decide(merge) 只改一个目标节点
+（content 追加 + 不适用条件并集）却用 rebuild_index 收尾——_scan_nodes
+全库逐文件 open+parse（1500 池实测 ~97-247ms/次），而同场景 accept/edit
+走 add+flush 增量收尾（O(1)，~3.4ms）。
+
+本守卫断言（调用计数/对账形态，非时间阈值）：
+  M1 merge 零全库扫描：merge 裁决期间 _scan_nodes 调用 == 0
+     （旧代码 rebuild→1 次全库扫描 → 红）；
+  M2 upsert 与 rebuild 同源零漂移：merge 完成后目标节点索引条目与
+     之后再 rebuild_index 的条目逐位相等（entry 构造唯一真源）；
+  M3 merge 语义保持：content 追加命中、不适用条件并集、裁决记录
+     accepted、级联关闭同内容兄弟提案；
+  M4 accept 对照不受影响（零全库扫描、结果 ok）；
+  M5 定向收尾落增量日志：merge 后未 flush 尾部（_dirty）在统一收尾
+     flush 后，新进程重开可见目标新条目（增量账本，不靠 rebuild 救回）。
+"""
+import os
+import shutil
+import sys
+import tempfile
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+import md_cg.mdcg as mdcg_mod               # noqa: E402
+from md_cg.mdcos import MdCGOS              # noqa: E402
+
+PASS = 0
+FAIL = 0
+FAILS = []
+
+
+def check(name, cond, detail=""):
+    global PASS, FAIL
+    if cond:
+        PASS += 1
+        print(f"  OK   {name}")
+    else:
+        FAIL += 1
+        FAILS.append(name)
+        print(f"  FAIL {name}  {detail}")
+
+
+def count_scans(fn):
+    n = 0
+    real = mdcg_mod.MdCG._scan_nodes
+
+    def _spy(self):
+        nonlocal n
+        n += 1
+        return real(self)
+
+    mdcg_mod.MdCG._scan_nodes = _spy
+    try:
+        return fn(), n
+    finally:
+        mdcg_mod.MdCG._scan_nodes = real
+
+
+def build(root, n=6):
+    cg = MdCGOS(root)
+    for i in range(n):
+        cg.add("mem_%02d" % i, "# 功能名：样本 %d\n# 正文：蜂群调度 内容 %d" % (i, i),
+               layer="knowledge")
+    cg.add("tgt", "# 功能名：合并目标\n# 正文：目标原始内容 星云\n目标正文。",
+           layer="knowledge", tags=["合并"],
+           non_applicable_conditions=["旧条件甲"])
+    cg.close()
+    return root
+
+
+def main():
+    root = tempfile.mkdtemp(prefix="mdcg_merge_guard_")
+    try:
+        build(root)
+        cg = MdCGOS(root)
+        pid = cg.propose("cand", "# 功能名：候选\n# 正文：候选正文 水位信箱",
+                         layer="knowledge")
+        # 同内容兄弟提案（级联关闭面）：propose 对同 payload_hash 幂等返回
+        # 既有 pid——兄弟须以他进程形态手工入队（同 phash 不同 pid）
+        from md_cg.fsutil import append_jsonl
+        from md_cg.mdcos import _sig
+        sib_content = "# 功能名：候选\n# 正文：候选正文 水位信箱"
+        append_jsonl(cg.inbox_log,
+                     {"t": 1.0, "pid": "prop_sib_manual", "id": "cand_sib",
+                      "content": sib_content, "layer": "knowledge",
+                      "tags": [], "condition_space": {}, "verify": {},
+                      "payload_hash": _sig(sib_content), "actor": "ext"})
+
+        out, n_scan = count_scans(
+            lambda: cg.review_decide(pid, "merge", merge_into="tgt",
+                                     reason="guard"))
+        print("  (merge 期间 _scan_nodes 调用 %d 次)" % n_scan)
+        check("M1a merge 裁决零全库扫描（旧代码 rebuild→1 次 O(N) 扫描）",
+              n_scan == 0, f"scans={n_scan}")
+        check("M3a merge 返回 ok 且 node_id 指向目标",
+              out.get("ok") and out.get("node_id") == "tgt", str(out)[:120])
+
+        # M2 upsert 与 rebuild 同源：先存 merge 后条目，rebuild 后逐位比对
+        e_after_merge = dict(cg.index["nodes"].get("tgt") or {})
+        cg.rebuild_index()
+        e_after_rebuild = dict(cg.index["nodes"].get("tgt") or {})
+        check("M2a merge 定向 upsert 条目与 rebuild 后逐位一致（同源零漂移）",
+              e_after_merge == e_after_rebuild,
+              f"diff={ {k: (e_after_merge.get(k), e_after_rebuild.get(k)) for k in set(e_after_merge) | set(e_after_rebuild) if e_after_merge.get(k) != e_after_rebuild.get(k)} }")
+
+        node = cg.get("tgt")
+        check("M3b content 追加命中（候选正文并入目标）",
+              node and "候选正文 水位信箱" in (node.get("content") or ""),
+              str(node)[:80])
+        neg = (node.get("frontmatter") or {}).get("non_applicable_conditions")
+        check("M3c 不适用条件并集（fm 旧条件保留，无新增时原样）",
+              neg == ["旧条件甲"], f"neg={neg}")
+
+        st = cg._pid_status().get(pid) or {}
+        check("M3d 裁决记录 accepted", st.get("status") == "accepted",
+              str(st)[:80])
+        casc = out.get("cascade_closed") or []
+        check("M3e 级联关闭同内容兄弟提案（手工入队形态）",
+              "prop_sib_manual" in casc, f"casc={casc}")
+
+        # M4 accept 对照
+        print("== M4 accept 对照 ==")
+        root4 = tempfile.mkdtemp(prefix="mdcg_merge_guard4_")
+        try:
+            build(root4)
+            cg4 = MdCGOS(root4)
+            pid4 = cg4.propose("acc", "# 功能名：接受候选\n# 正文：接受正文",
+                               layer="knowledge")
+            out4, n_scan4 = count_scans(
+                lambda: cg4.review_decide(pid4, "accept", reason="guard"))
+            check("M4a accept 裁决零全库扫描（对照不受影响）",
+                  n_scan4 == 0, f"scans={n_scan4}")
+            check("M4b accept 落节点 ok",
+                  out4.get("ok") and out4.get("node_id") == "acc", str(out4)[:80])
+            cg4.close()
+        finally:
+            shutil.rmtree(root4, ignore_errors=True)
+
+        # M5 增量账本：merge 库重开（新进程形态），目标条目可见且带新内容指纹
+        print("== M5 增量账本跨进程可见 ==")
+        cg.close()
+        cg5 = MdCGOS(root)
+        try:
+            e5 = (cg5.index.get("nodes") or {}).get("tgt")
+            node5 = cg5.get("tgt")
+            check("M5a 重开后目标条目在索引（增量日志，不靠 rebuild 救回）",
+                  bool(e5))
+            check("M5b 重开后目标内容为合并后版本",
+                  node5 and "候选正文 水位信箱" in (node5.get("content") or ""))
+        finally:
+            cg5.close()
+    finally:
+        shutil.rmtree(root, ignore_errors=True)
+
+    print("\n" + "=" * 60)
+    print(f"结果：PASS {PASS} / FAIL {FAIL}")
+    if FAILS:
+        for f in FAILS:
+            print(f"  - {f}")
+    return 0 if FAIL == 0 else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/md_cg/test_n123_derive_expiry_chain.py

@@ -0,0 +1,205 @@
+# -*- coding: utf-8 -*-
+"""N123 攻击复现守卫：derive 子令牌 TTL 无上限夹紧 + 过期不沿派生链传播。
+
+缺陷（v15 留档 + 引擎域/检索域复测三度成立）：
+  ① derive() 子令牌 expires_at=(now+ttl) 不与父 expires_at 取 min——
+     父 ttl=0.5s、子 ttl=999999 时子比父多活 11.5 天；
+  ② verify_token 只查自身记录 expires_at——父令牌过期后子令牌仍以原密级通过。
+攻击面：持 delegable designer 令牌面（宿主进程/提示注入驱动 derive）先派生
+长 TTL 子令牌再令父令牌自然到期——授权回收被时间维度旁路（revoke 有级联
+tokens.py:523-526，唯过期没有，「派生只能收窄」缺时间维度）。
+
+修复方向：子 expires_at=min(请求值, 父 expires_at)（父无界取请求值）
++ verify_token 沿 parent 链传播过期校验（防环；父记录缺失告警不阻断）。
+
+运行：python -m md_cg.test_n123_derive_expiry_chain
+纪律：全程 MDCG_TOKEN_FILE / path= 指向系统临时目录哑令牌文件，不触真实令牌库。
+"""
+from __future__ import annotations
+
+import json
+import os
+import shutil
+import sys
+import tempfile
+import time
+
+from . import tokens
+from .tokens import TOKEN_FILE_ENV, TokenError
+
+PASS = FAIL = 0
+FAILS = []
+
+
+def check(name, cond, detail=""):
+    global PASS, FAIL
+    if cond:
+        PASS += 1
+        print(f"  [PASS] {name}" + (f"  · {detail}" if detail else ""))
+    else:
+        FAIL += 1
+        FAILS.append(name)
+        print(f"  [FAIL] {name}  · {detail}")
+
+
+def denied(fn, *a, **kw):
+    """执行 fn，返回 (是否被拒, 错误文本)。"""
+    try:
+        fn(*a, **kw)
+        return False, ""
+    except TokenError as e:
+        return True, str(e)
+
+
+def main():
+    sys.stdout.reconfigure(encoding="utf-8", errors="replace")
+    root = tempfile.mkdtemp(prefix="mdcg_n123_")
+    tf = os.path.join(root, "_tokens.json")
+    # 哑环境兜底：即使代码内部遗漏 path= 也绝不回落到真实 ~/.mdcg 令牌库
+    old_env = os.environ.get(TOKEN_FILE_ENV)
+    os.environ[TOKEN_FILE_ENV] = tf
+    try:
+        # ========== 攻击复现 ①：derive 长 TTL 子令牌不被父界夹紧 ==========
+        print("\n[1] derive 夹紧：子 expires_at = min(请求值, 父 expires_at)")
+        d = tokens.issue("designer", actor="n123-designer", ttl=3600.0, path=tf)
+        child = tokens.derive(d["token"], "record", actor="n123-child",
+                              ttl=999999.0, path=tf)
+        dexp = d["expires_at"]
+        cexp = child["expires_at"]
+        check("子令牌过期时间不超过父令牌", cexp is not None and dexp is not None
+              and float(cexp) <= float(dexp) + 1e-6,
+              f"child-parent={float(cexp) - float(dexp):.1f}s（旧代码 +999639s）")
+        check("夹紧开口 clamped 标注 expires_at",
+              "expires_at" in (child.get("clamped") or []),
+              f"clamped={child.get('clamped')}")
+
+        # ========== 攻击复现 ②：父过期后子令牌沿链拒验（免 sleep：手工置父已过期） ==========
+        print("\n[2] verify 沿链传播：父记录过期 → 子令牌拒绝")
+        data = json.load(open(tf, encoding="utf-8"))
+        data["tokens"][d["token_id"]]["expires_at"] = time.time() - 1.0
+        with open(tf, "w", encoding="utf-8") as f:
+            json.dump(data, f, ensure_ascii=False)
+        ok_p, why_p = denied(tokens.verify_token, d["token"], path=tf)
+        ok_c, why_c = denied(tokens.verify_token, child["token"], path=tf)
+        check("父令牌过期被拒（基线，旧代码即拦）", ok_p, why_p[:60])
+        check("父过期后子令牌沿链拒验（N123 核心断言）", ok_c, why_c[:60])
+
+        # ========== 攻击复现 ③：真实自然到期端到端 ==========
+        print("\n[3] 端到端：父 ttl=0.4 自然到期 → 长 TTL 子令牌（ttl=999999）失效")
+        d3 = tokens.issue("designer", actor="n123-e2e", ttl=0.4, path=tf)
+        c3 = tokens.derive(d3["token"], "record", actor="n123-e2e-child",
+                           ttl=999999.0, path=tf)
+        check("派生时子界已被父夹紧",
+              float(c3["expires_at"]) <= float(d3["expires_at"]) + 1e-6,
+              f"child={c3['expires_at']:.1f} parent={d3['expires_at']:.1f}")
+        time.sleep(0.7)
+        ok_p3, why_p3 = denied(tokens.verify_token, d3["token"], path=tf)
+        ok_c3, why_c3 = denied(tokens.verify_token, c3["token"], path=tf)
+        check("父自然到期被拒", ok_p3, why_p3[:60])
+        check("子令牌随父到期失效（修复前：verify OK 继续用）", ok_c3, why_c3[:60])
+
+        # ========== 正向 ④：父无界时取请求值（不误夹成无界/不过度收窄） ==========
+        print("\n[4] 父无界：子 TTL 取请求值")
+        d4 = tokens.issue("designer", actor="n123-bounded", path=tf)  # 无 ttl
+        check("父无界 expires_at=None", d4["expires_at"] is None)
+        c4 = tokens.derive(d4["token"], "record", actor="n123-bounded-child",
+                           ttl=60.0, path=tf)
+        now = time.time()
+        check("父无界时子 expires_at=now+60（取请求值）",
+              c4["expires_at"] is not None
+              and 58.0 <= float(c4["expires_at"]) - now <= 62.0,
+              f"delta={float(c4['expires_at']) - now:.1f}s")
+        check("父无界夹紧不开口",
+              "expires_at" not in (c4.get("clamped") or []),
+              f"clamped={c4.get('clamped')}")
+        # 子短于父：取请求值不延长
+        c4b = tokens.derive(d4["token"], "record", actor="n123-short", ttl=1.0,
+                            path=tf)
+        check("子短于父取请求值", c4b["expires_at"] is not None
+              and float(c4b["expires_at"]) - now <= 2.0)
+        # 子无 ttl：沿用父（旧行为保持——父无界即无界）
+        c4c = tokens.derive(d4["token"], "record", actor="n123-inherit", path=tf)
+        check("子未指定 ttl 沿用父界（无界父→无界子）",
+              c4c["expires_at"] is None, f"expires_at={c4c['expires_at']}")
+
+        # ========== 正向 ⑤：子自身先到期仍按自身拒（不因沿链放宽） ==========
+        print("\n[5] 子自身过期仍拦截")
+        d5 = tokens.issue("designer", actor="n123-self", ttl=3600.0, path=tf)
+        c5 = tokens.derive(d5["token"], "record", actor="n123-self-child",
+                           ttl=0.05, path=tf)
+        time.sleep(0.15)
+        ok_c5, why_c5 = denied(tokens.verify_token, c5["token"], path=tf)
+        ok_d5, _ = denied(tokens.verify_token, d5["token"], path=tf)
+        check("子自身先到期被拒", ok_c5 and not ok_d5, why_c5[:60])
+
+        # ========== 加固 ⑥：存量库三层链 + 防环 ==========
+        print("\n[6] 存量库三层链传播 + parent 环防护")
+        # 三层链：gp（无界）→ p（已过期）→ gc；修复前 verify(gc) 只看自身 → OK
+        d6 = tokens.issue("designer", actor="n123-gp", path=tf)
+        p6 = tokens.derive(d6["token"], "orchestr", actor="n123-p", path=tf)
+        # 手工构造第三层（正常 derive 封口 delegable=False，模拟存量库/手工库）
+        data6 = json.load(open(tf, encoding="utf-8"))
+        prec = data6["tokens"][p6["token_id"]]
+        gc_id = "tk_n123gc01"
+        data6["tokens"][gc_id] = dict(prec, role="record", actor="n123-gc",
+                                      delegable=False, parent=p6["token_id"],
+                                      expires_at=time.time() + 999999.0)
+        data6["tokens"][p6["token_id"]]["expires_at"] = time.time() - 1.0
+        with open(tf, "w", encoding="utf-8") as f:
+            json.dump(data6, f, ensure_ascii=False)
+        gc_token = tokens.make_token("record", gc_id, "x" * 43)
+        # 摘要需匹配：直接改库中 hash
+        data6 = json.load(open(tf, encoding="utf-8"))
+        data6["tokens"][gc_id]["hash"] = tokens._hash("x" * 43)
+        with open(tf, "w", encoding="utf-8") as f:
+            json.dump(data6, f, ensure_ascii=False)
+        t0 = time.monotonic()
+        ok_gc, why_gc = denied(tokens.verify_token, gc_token, path=tf)
+        cost = time.monotonic() - t0
+        check("中间层过期 → 孙令牌沿链拒验", ok_gc, why_gc[:60])
+        check("沿链校验无死循环（<2s）", cost < 2.0, f"{cost:.3f}s")
+        # 防环：A.parent=B 且 B.parent=A，均未过期 → 应通过且不挂
+        data6 = json.load(open(tf, encoding="utf-8"))
+        a_id, b_id = "tk_n123loopA", "tk_n123loopB"
+        data6["tokens"][a_id] = {"role": "designer", "actor": "loop-a",
+                                 "tenant": "default", "clearance": "secret",
+                                 "can_write": True, "can_admin": True,
+                                 "layers_allow": ["*"], "ops_allow": ["*"],
+                                 "delegable": False, "parent": b_id,
+                                 "issued_by": "loop", "issued_at": now,
+                                 "expires_at": None, "revoked_at": None,
+                                 "label": "", "hash": tokens._hash("la" * 16)}
+        data6["tokens"][b_id] = {"role": "record", "actor": "loop-b",
+                                 "tenant": "default", "clearance": "internal",
+                                 "can_write": True, "can_admin": False,
+                                 "layers_allow": None, "ops_allow": None,
+                                 "delegable": False, "parent": a_id,
+                                 "issued_by": "loop", "issued_at": now,
+                                 "expires_at": None, "revoked_at": None,
+                                 "label": "", "hash": tokens._hash("lb" * 16)}
+        with open(tf, "w", encoding="utf-8") as f:
+            json.dump(data6, f, ensure_ascii=False)
+        t0 = time.monotonic()
+        try:
+            tokens.verify_token(tokens.make_token("designer", a_id, "la" * 16),
+                                path=tf)
+            loop_ok = True
+        except TokenError:
+            loop_ok = True          # 拒绝也可（fail-closed），关键是不挂
+        cost = time.monotonic() - t0
+        check("parent 环不挂死（防环）", loop_ok and cost < 2.0, f"{cost:.3f}s")
+    finally:
+        if old_env is None:
+            os.environ.pop(TOKEN_FILE_ENV, None)
+        else:
+            os.environ[TOKEN_FILE_ENV] = old_env
+        shutil.rmtree(root, ignore_errors=True)
+
+    print(f"\n通过 {PASS} / 失败 {FAIL}")
+    if FAILS:
+        print("失败项：" + "，".join(FAILS))
+    return 0 if FAIL == 0 else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())