@furongjun1999/dsh-memory 0.5.0 → 0.6.0

package/md_cg/test_n130_verify_falsified_protect.py

@@ -0,0 +1,185 @@
+# -*- coding: utf-8 -*-
+"""N130 守卫：verify(verdict="falsified") 的删除必须过「不可遗忘」保护。
+
+缺陷形态（2026-09-25 引擎域新发现，编号 N130，high）：verify() 的 falsified
+分支（mdcg.py:3188-3195）对原节点 os.remove **永久硬删**，全程不经
+protect.guard_forget / require_layer_write / override——self/anchor 层、
+protected 标记、importance≥0.7 的受保护节点可被一次 verify 调用一键删除，
+无快照、无留痕、不进 trash；对照 forget 路径（mdcos.py:2294）同一个删除
+动作需 require_admin + guard_forget 双闸（旧版本先快照、动作全程留痕）。
+
+攻击面：任何持 verify op 的主体（verify 角色 ops_allow 即含 verify，
+designer ops=["*"] 天然含）对任意 node_id 调 cg(op=verify,
+verdict=falsified) 一次调用永久删除；无需 override 无需 admin。
+
+修复：①falsified 分支在任何副作用（add_rejected / os.remove）之前接
+protect.guard_forget（受保护节点需显式 override=True——旧版本自动快照 +
+_protected_audit 留痕，与 forget 路径同一语义；拒绝抛 ProtectionError，
+原节点原样保留）；②MdCGSecure.verify 对 falsified 按原节点层做
+require_layer_write（与 add/add_rejected 同一闸口——verify 角色
+layers_allow=["rejected","contextual"]，本就「不得改被验证内容」，
+tokens.py:171 显式 forbidden）。
+
+红项 = R1-R7（四类受保护节点一键硬删复现 + secure 面层写缺口）；
+G 项锁语义不变（普通节点 falsified 负记忆化、override 显式放行 + 快照留痕）。
+运行：python -m md_cg.test_n130_verify_falsified_protect
+"""
+from __future__ import annotations
+
+import os
+import shutil
+import sys
+import tempfile
+
+try:
+    from . import protect
+    from .mdcos import MdCGOS, MdCGSecure
+    from .security import AccessDenied, Principal
+except ImportError:                                  # 直接脚本运行
+    sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+    from md_cg import protect
+    from md_cg.mdcos import MdCGOS, MdCGSecure
+    from md_cg.security import AccessDenied, Principal
+
+PASS = FAIL = 0
+FAILS = []
+
+
+def ok(cond, label):
+    global PASS, FAIL
+    if cond:
+        PASS += 1
+        print(f"  OK   {label}")
+    else:
+        FAIL += 1
+        FAILS.append(label)
+        print(f"  FAIL {label}")
+
+
+_BODY = "# 功能名：N130 守卫\n\n# 生效条件：无条件\n\n正文。\n"
+
+
+def _exists(cg, nid):
+    """索引条目在且盘面文件在（硬删后两者都会消失）。"""
+    e = (cg.index.get("nodes") or {}).get(nid)
+    return (e is not None
+            and os.path.exists(os.path.join(cg.root, e["path"])))
+
+
+def _falsified_must_reject(cg, nid, label):
+    """对 nid 做 falsified：期望 ProtectionError 且节点原样保留。"""
+    raised = None
+    try:
+        cg.verify(nid, "N130 守卫的反例证据", "falsified")
+    except protect.ProtectionError as exc:
+        raised = exc
+    ok(raised is not None, f"{label}1 falsified 受保护节点被拒（ProtectionError）")
+    ok(_exists(cg, nid), f"{label}2 拒绝后索引与盘面文件原样保留")
+
+
+def _seed(cg):
+    """四类受保护节点 + 一类普通节点（对照）。"""
+    cg.add("n_self", _BODY, layer="self")
+    cg.add("n_anchor", _BODY, layer="anchor")
+    cg.add("n_prot", _BODY, layer="knowledge")
+    protect.mark(cg, "n_prot", "N130 守卫：显式保护标记")
+    cg.add("n_imp", _BODY, layer="knowledge", importance=0.9)
+    cg.add("n_plain", _BODY, layer="knowledge")
+
+
+def _base_shape(tmp):
+    """A：基类引擎面（无令牌）——四类受保护节点不得被 falsified 一键硬删。"""
+    print("--- A 基类引擎面：guard_forget 前置")
+    root = os.path.join(tmp, "base")
+    cg = MdCGOS(root)
+    _seed(cg)
+
+    _falsified_must_reject(cg, "n_self", "R1_self")
+    _falsified_must_reject(cg, "n_anchor", "R2_anchor")
+    _falsified_must_reject(cg, "n_prot", "R3_protected")
+    _falsified_must_reject(cg, "n_imp", "R4_importance0.9")
+
+    ok(all(_exists(cg, n) for n in
+           ("n_self", "n_anchor", "n_prot", "n_imp")),
+       "R5 四次拒绝后四个受保护节点全部健在")
+    ok(not os.path.isdir(os.path.join(cg.root, protect.HISTORY_DIR)),
+       "R6 拒绝路径零副作用（未创建 _protected_history）")
+
+    # G1：普通节点 falsified 语义不变（负记忆化 + 原节点移除）
+    r = cg.verify("n_plain", "普通节点反例", "falsified")
+    ok(r.get("action") == "falsified", "G1a 普通 knowledge 节点 falsified 照常放行")
+    ok(not _exists(cg, "n_plain"), "G1b 原 knowledge 节点按负记忆化移除（语义不变）")
+    neg = [e for e in (cg.index.get("nodes") or {}).values()
+           if e.get("layer") == "rejected"]
+    ok(len(neg) == 1, "G1c rejected 层出现负记忆条目（语义不变）")
+
+    # G2：override=True 显式放行 + 快照留痕（与 forget 路径同一能力面）
+    r2 = cg.verify("n_prot", "显式 override 的反例", "falsified", override=True)
+    ok(r2.get("action") == "falsified", "G2a override=True 显式放行 falsified")
+    ok(not _exists(cg, "n_prot"), "G2b override 放行后原节点移除")
+    hist = protect.history(cg, "n_prot")
+    ok(len(hist) == 1, "G2c override 放行前旧版本已快照进 _protected_history")
+    audit = os.path.join(cg.root, protect.AUDIT_FILE)
+    ok(os.path.exists(audit) and "override_forget" in open(
+        audit, encoding="utf-8").read(),
+       "G2d override_forget 动作已留痕 _protected_audit.jsonl")
+    cg.close()
+
+
+def _secure_shape(tmp):
+    """B：MdCGSecure 面——falsified 删除按原节点层做 require_layer_write。"""
+    print("--- B 安全面：层写权限校验")
+    root = os.path.join(tmp, "secure")
+    verify_p = Principal(actor="verifier-1", role="verify", can_write=True,
+                         can_admin=False, clearance="internal",
+                         layers_allow=["rejected", "contextual"],
+                         ops_allow=["info", "read", "verify"])
+    designer_p = Principal(actor="designer-1", role="designer", can_write=True,
+                           can_admin=True, clearance="secret")
+    # 预置用 designer（knowledge 层只有可写该层的身份能建），攻击用 verify 角色
+    cg = MdCGSecure(root, principal=designer_p, master_key=bytes(range(32)))
+    cg.add("s_kn", _BODY, layer="knowledge")            # verify 角色无权写 knowledge
+    cg.add("s_ctx", _BODY, layer="contextual")          # verify 角色本职可写
+    cg.close()
+
+    # R7：verify 角色 falsified knowledge 节点 → 层写拒绝，节点原样保留
+    cg = MdCGSecure(root, principal=verify_p, master_key=bytes(range(32)))
+    raised = None
+    try:
+        cg.verify("s_kn", "verify 角色反例", "falsified")
+    except AccessDenied as exc:
+        raised = exc
+    ok(raised is not None, "R7a verify 角色 falsified knowledge 层被拒（AccessDenied）")
+    ok(_exists(cg, "s_kn"), "R7b 拒绝后 knowledge 节点索引与盘面原样保留")
+
+    # G3：verify 角色 falsified contextual 节点 → 本职可写，照常负记忆化
+    r = cg.verify("s_ctx", "verify 角色反例（contextual）", "falsified")
+    ok(r.get("action") == "falsified", "G3a verify 角色 falsified contextual 层放行")
+    ok(not _exists(cg, "s_ctx"), "G3b contextual 节点按负记忆化移除（语义不变）")
+    cg.close()
+
+    # R8：designer（层写不限）falsified self 层节点仍被 guard_forget 拦截
+    cg = MdCGSecure(root, principal=designer_p, master_key=bytes(range(32)))
+    cg.add("s_self", _BODY, layer="self")
+    _falsified_must_reject(cg, "s_self", "R8_designer_self")
+    cg.close()
+
+
+def main():
+    tmp = tempfile.mkdtemp(prefix="mdcg_n130_guard_")
+    try:
+        _base_shape(tmp)
+        _secure_shape(tmp)
+    finally:
+        shutil.rmtree(tmp, ignore_errors=True)
+
+    print("\n" + "=" * 60)
+    print(f"结果：PASS {PASS} / FAIL {FAIL}")
+    if FAILS:
+        for f in FAILS:
+            print(f"  - {f}")
+    return 0 if FAIL == 0 else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/md_cg/test_n131_merge_gate.py

@@ -0,0 +1,205 @@
+# -*- coding: utf-8 -*-
+"""N131 守卫：review_decide(merge) 的目标写入必须过 add 同款双闸。
+
+缺陷形态（2026-09-25 引擎域新发现，编号 N131，high）：review_decide 的
+merge 分支（mdcos.py:2221-2255）把提案内容直接 _write_node 追加进任意
+merge_into 目标节点，绕过 guard_write 与 require_layer_write——accept/edit
+走 self.add()（:2211）有 MdCGSecure.add :3769 require_layer_write 与基类
+add mdcg.py:1311 guard_write 双闸，merge 直写零闸；mcp_server review_decide
+注释「accept/edit 落节点时的层写仍由下游 require_layer_write 拦截」对 merge
+不成立，orchestr 角色 forbidden「anchor/self/goals/knowledge 层」
+（tokens.py:123）被打穿。
+
+攻击面：持 review+write op 的令牌（orchestr 的 ops_allow 两者皆含，
+tokens.py:120；designer 全权）——propose 任意内容 → review_decide(pid,
+decision="merge", merge_into=<self/anchor/immutable/knowledge 任意节点 id>)
+注入任意文本。
+
+修复：merge 分支在 _write_node 之前接与 add 同款双闸——principal 在位先
+require_layer_write(目标层, 目标敏感度)（与 MdCGSecure.add 同序同错型），
+再 guard_write（self/anchor 层、immutable 标记，对照 add :1311；override
+显式传参时快照+留痕放行，与 add 能力面对齐）；闸在 _record_decision 之前
+抛出——裁决不落库、提案留 pending（审计节点写入本就在 try/except 内，
+闸放那里会被吞成 record_error，形同虚设）。
+
+红项 = R1-R4（self/immutable 目标引擎面 + knowledge/self 目标 orchestr 面
+注入复现）；G 项锁语义不变（普通目标 merge 追加、orchestr 本职 contextual
+目标放行、designer override 放行）+ 两对照（orchestr add self 被拒 /
+designer add 覆 immutable 被拒——闸原本就在，只是 merge 绕过）。
+运行：python -m md_cg.test_n131_merge_gate
+"""
+from __future__ import annotations
+
+import os
+import shutil
+import sys
+import tempfile
+
+try:
+    from . import protect
+    from .mdcos import MdCGOS, MdCGSecure
+    from .security import AccessDenied, Principal
+except ImportError:                                  # 直接脚本运行
+    sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+    from md_cg import protect
+    from md_cg.mdcos import MdCGOS, MdCGSecure
+    from md_cg.security import AccessDenied, Principal
+
+PASS = FAIL = 0
+FAILS = []
+
+
+def ok(cond, label):
+    global PASS, FAIL
+    if cond:
+        PASS += 1
+        print(f"  OK   {label}")
+    else:
+        FAIL += 1
+        FAILS.append(label)
+        print(f"  FAIL {label}")
+
+
+_MARK = "攻击者注入段落"
+
+
+def _body(name):
+    return (f"# 功能名：{name}\n# 生效条件：无条件\n# 子功能：无\n"
+            f"# 执行：无\n# 验证方式：test\n# 不适用条件：无\n\n原始正文。")
+
+
+def _content_of(cg, nid):
+    n = cg.get(nid)
+    return (n or {}).get("content") or ""
+
+
+def _merge_must_reject(cg, pid, target, exc_type, label):
+    """merge 进 target：期望 exc_type 且目标内容原样。"""
+    raised = None
+    try:
+        cg.review_decide(pid, "merge", merge_into=target)
+    except exc_type as exc:
+        raised = exc
+    ok(raised is not None, f"{label}1 merge 进 {target} 被拒（{exc_type.__name__}）")
+    ok(_MARK not in _content_of(cg, target),
+       f"{label}2 拒绝后 {target} 正文无注入内容")
+
+
+def _base_shape(tmp):
+    """A：基类引擎面（无令牌）——self/immutable 目标不得被 merge 直写。"""
+    print("--- A 基类引擎面：guard_write 闸")
+    root = os.path.join(tmp, "base")
+    cg = MdCGOS(root)
+    cg.add("tgt_self", _body("自我目标"), layer="self")
+    cg.add("tgt_imm", _body("不可覆盖目标"), layer="knowledge", immutable=True)
+    cg.add("tgt_plain", _body("普通目标"), layer="knowledge")
+    ok(protect.is_immutable(cg, "tgt_imm")[0],
+       "A0 预置生效：tgt_imm 判定为不可覆盖")
+    for nid in ("p_self", "p_imm", "p_plain"):
+        cg.propose(nid, _body(nid) + "\n" + _MARK + "\n", layer="knowledge")
+
+    _merge_must_reject(cg, next(r["pid"] for r in cg.review_list()
+                                if r["id"] == "p_self"),
+                       "tgt_self", protect.ProtectionError, "R1_self")
+    _merge_must_reject(cg, next(r["pid"] for r in cg.review_list()
+                                if r["id"] == "p_imm"),
+                       "tgt_imm", protect.ProtectionError, "R2_immutable")
+
+    # G1：普通目标 merge 照常放行（test_merge_upsert / test_p2 语义不变）
+    pid_plain = next(r["pid"] for r in cg.review_list() if r["id"] == "p_plain")
+    r = cg.review_decide(pid_plain, "merge", merge_into="tgt_plain")
+    ok(r.get("ok") and r.get("node_id") == "tgt_plain",
+       "G1a 普通 knowledge 目标 merge 照常放行")
+    ok(_MARK in _content_of(cg, "tgt_plain"),
+       "G1b 追加内容进入目标正文（merge 本职不变）")
+    cg.close()
+
+
+def _secure_shape(tmp):
+    """B：MdCGSecure 面——merge 按目标层做 require_layer_write（orchestr 面）。"""
+    print("--- B 安全面：orchestr 层写校验")
+    root = os.path.join(tmp, "secure")
+    designer_p = Principal(actor="designer-1", role="designer", can_write=True,
+                           can_admin=True, clearance="secret")
+    orch_p = Principal(actor="orch-1", role="orchestr", can_write=True,
+                       can_admin=False, clearance="internal",
+                       layers_allow=["contextual", "unresolved", "rejected"],
+                       ops_allow=["info", "route", "read", "write", "review"])
+    cg = MdCGSecure(root, principal=designer_p, master_key=bytes(range(32)))
+    cg.add("t_kn", _body("知识目标"), layer="knowledge")
+    cg.add("t_ctx", _body("情境目标"), layer="contextual")
+    cg.add("t_self", _body("自我目标"), layer="self")
+    cg.close()
+
+    # 对照 R3：orchestr 直接 add 写 self 层被拒（身份确实受限，闸原本就在）
+    cg = MdCGSecure(root, principal=orch_p, master_key=bytes(range(32)))
+    denied = None
+    try:
+        cg.add("x_self", _body("越权"), layer="self")
+    except AccessDenied as exc:
+        denied = exc
+    ok(denied is not None, "R3 对照：orchestr add 写 self 层被拒（AccessDenied）")
+
+    # R4/R5：orchestr merge 注入 knowledge / self 层目标——旧码双写路径全绕
+    #（提案内容须互异：propose 按 payload_hash 幂等去重，同内容返回既有 pid）
+    pid_kn = cg.propose("a_kn", _body("提案注入知识") + "\n" + _MARK + "知识\n",
+                        layer="contextual")
+    _merge_must_reject(cg, pid_kn, "t_kn", AccessDenied, "R4_orch_knowledge")
+    pid_self = cg.propose("a_self", _body("提案注入自我") + "\n" + _MARK + "自我\n",
+                          layer="contextual")
+    _merge_must_reject(cg, pid_self, "t_self", AccessDenied, "R5_orch_self")
+
+    # G2：orchestr 本职可写层（contextual）目标 merge 照常放行
+    pid_ctx = cg.propose("a_ctx", _body("提案注入情境") + "\n" + _MARK + "情境\n",
+                         layer="contextual")
+    r = cg.review_decide(pid_ctx, "merge", merge_into="t_ctx")
+    ok(r.get("ok") and _MARK in _content_of(cg, "t_ctx"),
+       "G2 orchestr merge 进本职 contextual 目标放行且内容追加（本职不变）")
+    cg.close()
+
+    # 对照 R6：designer add 覆写 immutable 既有节点被拒（guard_write 对照）+
+    # G3：designer merge 带 override 进 immutable 目标显式放行（快照+留痕）
+    cg = MdCGSecure(root, principal=designer_p, master_key=bytes(range(32)))
+    cg.add("t_imm2", _body("不可覆盖"), layer="knowledge", immutable=True)
+    prot = None
+    try:
+        cg.add("t_imm2", _body("覆写"), layer="knowledge")
+    except protect.ProtectionError as exc:
+        prot = exc
+    ok(prot is not None, "R6 对照：designer add 覆写 immutable 节点被拒"
+                         "（ProtectionError）")
+    cg.close()
+
+    cg = MdCGSecure(root, principal=designer_p, master_key=bytes(range(32)))
+    pid_ov = cg.propose("a_ov", _body("提案") + "\n" + _MARK + "\n",
+                        layer="knowledge")
+    r = cg.review_decide(pid_ov, "merge", merge_into="t_imm2", override=True)
+    ok(r.get("ok") and _MARK in _content_of(cg, "t_imm2"),
+       "G3a designer override=True merge 进 immutable 目标显式放行")
+    hist = protect.history(cg, "t_imm2")
+    ok(len(hist) >= 1, "G3b override 放行前旧版本已快照 _protected_history")
+    audit = os.path.join(cg.root, protect.AUDIT_FILE)
+    ok(os.path.exists(audit) and "override_write" in open(
+        audit, encoding="utf-8").read(),
+       "G3c override_write 动作已留痕 _protected_audit.jsonl")
+    cg.close()
+
+
+def main():
+    tmp = tempfile.mkdtemp(prefix="mdcg_n131_guard_")
+    try:
+        _base_shape(tmp)
+        _secure_shape(tmp)
+    finally:
+        shutil.rmtree(tmp, ignore_errors=True)
+
+    print("\n" + "=" * 60)
+    print(f"结果：PASS {PASS} / FAIL {FAIL}")
+    if FAILS:
+        for f in FAILS:
+            print(f"  - {f}")
+    return 0 if FAIL == 0 else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/md_cg/test_none_id_write_guard.py

@@ -0,0 +1,165 @@
+# -*- coding: utf-8 -*-
+"""test_none_id_write_guard —— None.md 脏节点写入面守卫（DSH 在役库实测缺陷 P3）
+
+现场（DSH 端在役库实测）：``knowledge/orphan/None.md`` 出现在检索与 route 候选中
+参与打分。取证链（2026-09-26，临时库实弹复现）：
+
+  1. 批次 24（2a57c2a2，2026-09-24）之前 ``add()`` 对 node_id **零校验**，
+     ``path = os.path.join(d, f"{node_id}.md")`` 直拼——``add(None, ...)`` 直落
+     ``None.md``（旧版直接源头，git 取证 ``git show 2a57c2a2^:md_cg/mdcg.py``）。
+  2. 现行代码 ``add(None)``/``add("")`` 已被 P0-1 白名单拒绝（mdcg.py _NODE_ID_RE），
+     **但字符串 ``"None"``（Python ``str(None)`` 的污染形态）形状合法照常放行**：
+     实弹复现 ``add("None", ...)`` → 生成 ``knowledge/orphan/None.md``。
+     ``"null"``（TS/JS ``String(null)`` 形态）同族放行。这是现行写入面残留洞。
+  3. 盘上存量 ``None.md`` 经 ``_scan_nodes`` 全库扫描收录为 ``id="None"``，
+     ``search``/route 候选参与打分（复现实测命中）——与 DSH 病理现象完全吻合。
+
+修复（本守卫的红绿两态锚点）：``md_cg/mdcg.py`` ``add()`` 写入边界把空语义值的
+字符串化污染形态（整串精确等值 ``"None"`` / ``"null"``，**大小写敏感、不扩子串**）
+结构化拒绝（ValueError，fail-closed）——add 是全部写入链（writepipe 执行器 /
+review accept / identity / consolidate / branches）落盘的唯一真源边界，堵一处即
+全链路堵死。``_move_layer`` 等直写点只对已在索引中的既有节点操作，不新造 id。
+
+清理面（不在本守卫内，运维建议）：存量 None.md 属历史脏数据——删除
+``<root>/knowledge/orphan/None.md`` 文件后 ``rebuild_index()`` 即从索引与检索/
+route 候选中消失（[6] 的收录取证即清理有效性依据）；勿用 ``add("None",...)``
+覆写清理（修复后该形态被拒）。
+
+隔离纪律：全程 ``tempfile.mkdtemp`` 临时库，MDCG_ROOT/MDCG_TOKEN_FILE 不参与
+（库实例以显式 root 构造），不触真实令牌库与真实在役数据目录。
+
+自检 floor：断言总数低于 FLOOR 视为失败——防「探针面失效 → 假绿」。
+
+运行：python -X utf8 -m md_cg.test_none_id_write_guard
+"""
+from __future__ import annotations
+
+import os
+import sys
+import tempfile
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from md_cg.mdcos import MdCGOS  # noqa: E402
+
+FLOOR = 12           # 断言总数下限（防假绿）
+passed = failed = 0
+
+
+def check(name, cond, detail=""):
+    global passed, failed
+    if cond:
+        passed += 1
+        print("  [PASS] " + name)
+    else:
+        failed += 1
+        print("  [FAIL] " + name + "  " + str(detail)[:200])
+
+
+def _none_md_hits(root):
+    """盘面上所有 None.md（大小写不敏感——Windows 盘面本就不区分）。"""
+    hits = []
+    for dirpath, _dirs, files in os.walk(root):
+        for f in files:
+            if f.lower() == "none.md":
+                hits.append(os.path.relpath(os.path.join(dirpath, f), root)
+                            .replace("\\", "/"))
+    return sorted(hits)
+
+
+def main():
+    root = tempfile.mkdtemp(prefix="mdcg_none_guard_")
+    try:
+        return _run(root)
+    finally:
+        import shutil
+        shutil.rmtree(root, ignore_errors=True)   # 测毕清理（临时库纪律）
+
+
+def _run(root):
+    cg = MdCGOS(root)
+
+    print("[1] 红形态：字符串 \"None\"（str(None) 污染形态）在写入边界拒绝")
+    rejected = False
+    try:
+        nid = cg.add("None", "污染形态内容 无条件")
+        check("add(\"None\") 被拒绝", False, "返回了 " + repr(nid))
+    except ValueError as e:
+        rejected = True
+        check("add(\"None\") 被拒绝", True)
+        check("拒绝是结构化 ValueError 且消息点名形态",
+              "None" in str(e) and "node_id" in str(e), str(e)[:120])
+    check("盘面无 None.md 生成", _none_md_hits(root) == [], _none_md_hits(root))
+    check("索引无 id='None' 条目", "None" not in cg.index["nodes"])
+
+    print("[2] 红形态：字符串 \"null\"（String(null) 跨语言同族形态）")
+    try:
+        nid = cg.add("null", "跨语言污染形态内容 无条件")
+        check("add(\"null\") 被拒绝", False, "返回了 " + repr(nid))
+    except ValueError:
+        check("add(\"null\") 被拒绝", True)
+    check("盘面仍无 None.md/null.md", _none_md_hits(root) == [],
+          _none_md_hits(root))
+
+    print("[3] 防误杀：含 None/null 子串的合法 id 照常写入（只拒整串精确等值）")
+    ok1 = cg.add("NoneBot_1", "含 None 子串的合法 id 无条件")
+    ok2 = cg.add("nullify_test", "含 null 子串的合法 id 无条件")
+    check("add(\"NoneBot_1\") 正常", ok1 == "NoneBot_1")
+    check("add(\"nullify_test\") 正常", ok2 == "nullify_test")
+
+    print("[4] 既有语义不回退：None 本体 / falsy 仍结构化拒绝（P0-1）")
+    # 注：add(123) 是既有合法行为（"123" 匹配白名单），不入守卫——非字符串
+    # 原值入索引快照属相邻缺陷（_scan_nodes/_load_index 混型键 sorted 崩），
+    # 超出本守卫目标，取证记录于修复报告。
+    for bad in (None, "", 0):
+        try:
+            cg.add(bad, "非法形态内容")
+            check("add(%r) 仍被拒绝" % (bad,), False, "竟返回成功")
+        except ValueError:
+            check("add(%r) 仍被拒绝（ValueError）" % (bad,), True)
+
+    print("[5] writepipe 链：node_id=\"None\" 不落盘（DEFER/BLINDSPOT 短路入队"
+          "或落盘前被 add 边界拒绝，两态皆 fail-closed）")
+    from md_cg import writepipe
+    pipe = writepipe.WritePipeline()
+    writepipe.install_default_gates(pipe)
+    committed = None
+    try:
+        out = pipe.execute(cg, {"content": "writepipe 污染形态", "node_id": "None",
+                                "content_kind": "work_done",
+                                "生效条件": "writepipe 守卫探针"})
+        committed = out.get("committed")
+    except ValueError:
+        committed = False                       # 落盘前被 add 边界拒绝（修复态）
+    check("writepipe 对 node_id='None' 不提交落盘", committed is not True,
+          repr(committed))
+    check("盘面无 None.md（writepipe 后复查）", _none_md_hits(root) == [],
+          _none_md_hits(root))
+
+    print("[6] 存量脏数据收录取证：盘上 None.md 被 _scan_nodes 收进索引（DSH 病理机理；"
+          "亦是清理建议的依据——删文件 + rebuild 即消失）")
+    d = os.path.join(root, "knowledge", "orphan")
+    os.makedirs(d, exist_ok=True)
+    with open(os.path.join(d, "None.md"), "w", encoding="utf-8") as f:
+        f.write("---\nid: None\nlayer: knowledge\nimportance: 0.5\n"
+                "confidence: 0.6\ncreated_at: 1\ntags: []\n---\n\n历史脏数据内容\n")
+    cg2 = MdCGOS(root)                      # 重开：走 _scan_nodes 全库扫描
+    cg2.rebuild_index()
+    check("历史 None.md 被扫描收录（机理复证）", "None" in cg2.index["nodes"])
+    res, _m = cg2.search_rrf("历史脏数据内容", k=10, judge=False)
+    check("检索候选命中 id='None'（病理复证）",
+          any(r[0]["id"] == "None" for r in res), [r[0]["id"] for r in res])
+    os.remove(os.path.join(d, "None.md"))   # 清理后即消失（清理建议有效性）
+    cg3 = MdCGOS(root)
+    cg3.rebuild_index()
+    check("删文件 + rebuild 后 id='None' 从索引消失（清理有效）",
+          "None" not in cg3.index["nodes"])
+
+    check(f"断言总数不低于 FLOOR（{passed} >= {FLOOR}）", passed >= FLOOR)
+
+    print(f"\nnone_id_write_guard: {passed} 通过 / {failed} 失败")
+    return 0 if not failed else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())