@furongjun1999/dsh-memory 0.5.1 → 0.6.1

package/md_cg/test_rejected_credential_forms.py

@@ -0,0 +1,188 @@
+# -*- coding: utf-8 -*-
+"""负记忆里**凭据形态**的覆盖守卫（PR#44 复核补，2026-09-28）。
+
+运行：python -X utf8 -m md_cg.test_rejected_credential_forms
+
+为什么另立一套（与 `test_rejected_redact.py` 的分工）：那一套守的是
+「命中禁表 → 原文不落盘」的**主路径**；本套守的是 PR#44 复核时实测出来的
+三个**未覆盖形态**——主路径绿了、凭据照样能落盘：
+
+  F1 全形态令牌 `mdcg1.<role>.<id>.<secret>`：只有 id 段命中禁表，负记忆脱敏
+     按命中片段替换 → 掩掉 id 却把 **role 与密钥段**原样写进 rejected。
+     令牌的可用性靠 role+id+secret 三段凑齐（`tokens.parse_token`），而 id 早已
+     可公开查得（仓库/npm 曾发出），故密钥段落盘等于凭据可被拼回。
+  F2 脱敏必须是**跨度合并**而非逐条串行 `re.sub`：串行时窄规则先把 id 换成
+     占位符，宽规则再也匹配不上那段文字，密钥段漏掩（实测反例即 F1 的成因）。
+  F3 `tags`：正文命中禁表而 tags 夹带凭据时，tags 原先原样进负记忆。
+  F4 防误伤：泛形写法 `mdcg1.<role>.<id>.<secret>`（文档用）不得被拒。
+  F5 跨闸口径：写入闸门禁表与发布门禁 `check_publish_artifact.R1_CONTENT_RULES`
+     对同一合成令牌必须同判——两闸分叉正是本缺陷的根因。
+  F6 判别力自证：无凭据的正文经脱敏后与原文逐字相同。
+
+实验纪律：临时目录 + 临时 policy（其 forbidden 拷贝**真源** data/policy.json，
+故本套同时钉住真源不丢这两条令牌口径）；哑值 `tk_0123456789abcdef` 与
+`SYNTHFRAG...` 均为合成串，**非真凭据**。
+"""
+from __future__ import annotations
+
+import io
+import json
+import os
+import re
+import shutil
+import sys
+import tempfile
+import traceback
+
+from . import audit, writepipe
+from .mdcos import MdCGSecure
+from .security import Principal
+
+ID = "tk_0123456789abcdef"                                   # 哑令牌 id（与禁表同形）
+FRAG = "SYNTHFRAG_do_not_use_0123456789"                   # 合成密钥段，非真凭据
+# 变量名刻意不叫 FRAG_*：发布门禁 APIKEY_LITERAL 规则会命中
+# `secret = "<16+ 字符>"` 这种**形似密钥赋值**的行（本条即被它抓到过一次）。
+FULL = "mdcg1.designer." + ID + "." + FRAG                 # 全形态令牌（合成）
+GENERIC = "mdcg1.<role>.<id>.<secret>"                       # 泛形写法（文档用）
+
+_ok = 0
+_bad = []
+
+
+def ok(name, cond, detail=""):
+    global _ok
+    if cond:
+        _ok += 1
+        print("  ok   %s" % name)
+    else:
+        _bad.append("%s %s" % (name, detail))
+        print("  FAIL %s %s" % (name, detail))
+
+
+def _repo_root() -> str:
+    return os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+
+
+def _policy() -> dict:
+    with io.open(os.path.join(_repo_root(), "data", "policy.json"), encoding="utf-8") as fh:
+        return json.load(fh)
+
+
+def _files_with(root, needle):
+    hits = []
+    for dp, _dn, fs in os.walk(root):
+        for f in fs:
+            fp = os.path.join(dp, f)
+            try:
+                with io.open(fp, encoding="utf-8", errors="ignore") as fh:
+                    if needle in fh.read():
+                        hits.append(os.path.relpath(fp, root))
+            except OSError:
+                continue
+    return hits
+
+
+def _mk_cg(tmp, name):
+    p = Principal(tenant="default", actor="t_forms", role="designer",
+                  can_write=True, can_admin=True)
+    return MdCGSecure(os.path.join(tmp, name), principal=p)
+
+
+def _masked_regions(text):
+    """把占位符折叠成统一记号——用于比较「哪些字被掩」，与规则序号无关。"""
+    return re.sub(r"\[已过滤:禁表#\d+\]", "<MASK>", text)
+
+
+def main() -> int:
+    tmp = tempfile.mkdtemp(prefix="cred_forms_")
+    old_policy = os.environ.get("MDCG_POLICY_FILE")
+    try:
+        _run(tmp)
+    except Exception:
+        traceback.print_exc()
+        _bad.append("未捕获异常")
+    finally:
+        shutil.rmtree(tmp, ignore_errors=True)
+        if old_policy is None:
+            os.environ.pop("MDCG_POLICY_FILE", None)
+        else:
+            os.environ["MDCG_POLICY_FILE"] = old_policy
+    print("\n凭据形态覆盖守卫：%d 通过%s" % (
+        _ok, ("，%d 失败：%s" % (len(_bad), "; ".join(_bad))) if _bad else ""))
+    return 1 if _bad else 0
+
+
+def _run(tmp):
+    src = _policy()
+    policy = os.path.join(tmp, "policy.json")
+    # 只搬 forbidden：保持与真源同口径（required 用不着，本套不走缺要素路径）
+    with io.open(policy, "w", encoding="utf-8") as f:
+        json.dump({"forbidden": src["forbidden"], "required": ["PASSED"]}, f)
+    os.environ["MDCG_POLICY_FILE"] = policy
+    rules = {"forbidden": src["forbidden"]}
+    pipe = writepipe.install_default_gates(writepipe.WritePipeline())
+
+    print("== F5 跨闸口径：写入闸门与发布门禁对同一合成令牌同判 ==")
+    import importlib.util
+    _sp = os.path.join(_repo_root(), "scripts", "check_publish_artifact.py")
+    spec = importlib.util.spec_from_file_location("_cpa_forms", _sp)
+    cpa = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(cpa)
+    pub = [rx for _n, rx, *_ in [tuple(x) + (None,) if len(x) == 2 else x
+                                 for x in cpa.R1_CONTENT_RULES]
+           if hasattr(rx, "search") and rx.search(FULL)]
+    write_hit = [p for p in src["forbidden"] if re.search(p, FULL)]
+    ok(bool(pub) and bool(write_hit),
+       "F5 两闸同判命中（发布 %d 条 / 写入 %d 条）" % (len(pub), len(write_hit)), repr((pub, write_hit)))
+
+    print("== F1 全形态令牌经写入闸门 → 凭据不落盘 ==")
+    cg = _mk_cg(tmp, "root_f1")
+    out = pipe.execute(cg, {"content_kind": "text", "layer": "knowledge",
+                            "content": "PASSED 用 %s 调发布接口" % FULL})
+    ok("F1 命中 → rejected", out.get("moved_to") == "rejected"
+       and out.get("committed") is False, repr(out.get("verdict", {}).get("state")))
+    ok("F1a 库内无密钥段明文", not _files_with(cg.root, FRAG),
+       repr(_files_with(cg.root, FRAG)))
+    ok("F1b 库内无 id 明文", not _files_with(cg.root, ID),
+       repr(_files_with(cg.root, ID)))
+    rid = out.get("id")
+    body = ""
+    if rid in cg.index["nodes"]:
+        _fm, body = cg._read(cg.index["nodes"][rid])
+    ok("F1c 负记忆整段被掩", "[已过滤:禁表#" in (body or "") and FRAG not in (body or ""),
+       repr((body or "")[:120]))
+
+    print("== F2 跨度合并：与规则顺序无关、密钥段零残留 ==")
+    one = audit.redact_forbidden("PASSED 用 %s 调接口" % FULL, rules)
+    ok("F2 密钥段与 id 均被掩", FRAG not in one and ID not in one, repr(one))
+    flip = {"forbidden": list(reversed(src["forbidden"]))}
+    two = audit.redact_forbidden("PASSED 用 %s 调接口" % FULL, flip)
+    ok("F2a 规则顺序颠倒 → 掩码区域相同", _masked_regions(one) == _masked_regions(two),
+       repr((_masked_regions(one), _masked_regions(two))))
+
+    print("== F3 tags 夹带凭据 → 负记忆里的 tags 同样被掩 ==")
+    cg3 = _mk_cg(tmp, "root_f3")
+    out3 = pipe.execute(cg3, {"content_kind": "text", "layer": "knowledge",
+                              "content": "PASSED 正文含 %s" % ID, "tags": [FULL, "正常标签"]})
+    rid3 = out3.get("id")
+    fm3 = {}
+    if rid3 in cg3.index["nodes"]:
+        fm3, _b3 = cg3._read(cg3.index["nodes"][rid3])
+    ok("F3 负记忆 tags 无密钥段", FRAG not in json.dumps(fm3.get("tags"), ensure_ascii=False),
+       repr(fm3.get("tags")))
+    ok("F3a 库内任何文件无密钥段明文", not _files_with(cg3.root, FRAG),
+       repr(_files_with(cg3.root, FRAG)))
+
+    print("== F4 防误伤：泛形写法不被拒、正常正文不受影响 ==")
+    cg4 = _mk_cg(tmp, "root_f4")
+    out4 = pipe.execute(cg4, {"content_kind": "text", "layer": "knowledge",
+                              "content": "PASSED 令牌形如 %s ，照此书写" % GENERIC})
+    ok("F4 泛形写法过闸（不被拒）", out4.get("moved_to") != "rejected",
+       repr(out4.get("moved_to")))
+    text = "PASSED 一条与凭据无关的正文，含 mdcg1 一词与 tk_zzzz 哑值"
+    ok("F6 无凭据正文脱敏后逐字不变", audit.redact_forbidden(text, rules) == text,
+       repr(audit.redact_forbidden(text, rules)))
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/md_cg/test_rejected_redact.py

@@ -0,0 +1,146 @@
+# -*- coding: utf-8 -*-
+"""负记忆脱敏守卫（issue #43）：命中禁表被 REJECT 的写入，凭据原文不得随 rejected 落盘。
+
+背景：writepipe._gate_audit 的 REJECT 分支把正文前 200 字交给 cg.add_rejected，
+命中 forbidden（凭据形态）的内容虽被拦下、committed=false，原文却写进
+`rejected/rej_*.md`，按返回的 id 可原样读回——拦截之后又把凭据存了一遍。
+
+断言：
+  R1 命中禁表 → moved_to=rejected；库目录下**任何文件**都不含哑值明文；
+     rejected 节点正文带占位符「[已过滤:禁表#」；evidence 仍给出命中模式（可审计）
+  R2 凭据跨 200 字截断边界 → 残片（哑值前 8 字符）同样不落盘（先脱敏后截断）
+  R3 缺必需要素的 REJECT（可修正，无禁表命中）→ 负记忆保留原文（行为不变）
+  R4 redact_forbidden 单元：多处命中全替换、非法正则跳过不抛错、无规则原样返回
+
+红基线：在改动前的 main 上跑本文件，R1a/R1b/R2 为红（其余两态皆绿）。
+实验纪律：全程临时目录 + 临时 policy（MDCG_POLICY_FILE 只指向临时文件）；
+哑值 `tk_0123456789abcdef` 仅匹配禁表形态，**非真凭据**。
+运行：python -X utf8 -m md_cg.test_rejected_redact（退出码 0 = 全绿）
+"""
+
+import json
+import os
+import shutil
+import sys
+import tempfile
+import traceback
+
+from . import audit, writepipe
+from .mdcos import MdCGSecure
+from .security import Principal
+
+FAKE = "tk_0123456789abcdef"          # 哑值，非真凭据
+TK = r"\btk_[0-9a-f]{8,}\b"           # 与 data/policy.json 批次71新增模式同形
+
+_ok = 0
+_bad = []
+
+
+def _check(name, cond, detail=""):
+    global _ok
+    if cond:
+        _ok += 1
+        print("  ok   %s" % name)
+    else:
+        _bad.append("%s %s" % (name, detail))
+        print("  FAIL %s %s" % (name, detail))
+
+
+def _files_containing(root, needle):
+    hits = []
+    for dp, _dn, fs in os.walk(root):
+        for f in fs:
+            fp = os.path.join(dp, f)
+            try:
+                with open(fp, encoding="utf-8", errors="ignore") as fh:
+                    if needle in fh.read():
+                        hits.append(os.path.relpath(fp, root))
+            except OSError:
+                continue
+    return hits
+
+
+def _mk_cg(tmp, name):
+    p = Principal(tenant="default", actor="t_redact", role="designer",
+                  can_write=True, can_admin=True)
+    return MdCGSecure(os.path.join(tmp, name), principal=p)
+
+
+def _rejected_text(cg, rid):
+    fm, content = cg._read(cg.index["nodes"][rid])
+    return content or ""
+
+
+def main():
+    tmp = tempfile.mkdtemp(prefix="rejected_redact_")
+    old_policy = os.environ.pop("MDCG_POLICY_FILE", None)
+    try:
+        _run(tmp)
+    except Exception:
+        traceback.print_exc()
+        _bad.append("未捕获异常")
+    finally:
+        shutil.rmtree(tmp, ignore_errors=True)
+        if old_policy is not None:
+            os.environ["MDCG_POLICY_FILE"] = old_policy
+        else:
+            os.environ.pop("MDCG_POLICY_FILE", None)
+    print("\n负记忆脱敏守卫：%d 通过%s" % (
+        _ok, ("，%d 失败：%s" % (len(_bad), "; ".join(_bad))) if _bad else ""))
+    return 1 if _bad else 0
+
+
+def _run(tmp):
+    policy = os.path.join(tmp, "policy.json")
+    with open(policy, "w", encoding="utf-8") as f:
+        json.dump({"forbidden": [TK], "required": ["PASSED"]}, f)
+    os.environ["MDCG_POLICY_FILE"] = policy
+    pipe = writepipe.install_default_gates(writepipe.WritePipeline())
+
+    # ---------- R1 命中禁表：凭据不落盘 ----------
+    cg = _mk_cg(tmp, "root_r1")
+    out = pipe.execute(cg, {"content_kind": "text", "layer": "knowledge",
+                            "content": "PASSED 用令牌 %s 调发布接口" % FAKE})
+    _check("R1 命中禁表 → rejected", out.get("moved_to") == "rejected"
+           and out.get("committed") is False, repr(out))
+    hits = _files_containing(cg.root, FAKE)
+    _check("R1a 库目录无哑值明文", not hits, repr(hits))
+    rid = out.get("id")
+    body = _rejected_text(cg, rid) if rid in cg.index["nodes"] else ""
+    _check("R1b rejected 正文带占位符", "[已过滤:禁表#1]" in body, repr(body))
+    ev = (out.get("verdict") or {}).get("evidence") or ""
+    _check("R1c evidence 仍给出命中模式", TK in ev and FAKE not in ev, repr(ev))
+
+    # ---------- R2 跨 200 字截断边界 ----------
+    cg2 = _mk_cg(tmp, "root_r2")
+    # 哑值起点在第 190 字：截前 200 字剩「tk_0123456」（仅 7 位 hex，已不匹配
+    # 禁表模式）——若先截断后脱敏，这段残片会漏过脱敏直接落盘。
+    content = "PASSED " + "x" * 182 + " " + FAKE
+    out = pipe.execute(cg2, {"content_kind": "text", "layer": "knowledge",
+                             "content": content})
+    frag = FAKE[:8]
+    hits = _files_containing(cg2.root, frag)
+    _check("R2 截断边界残片不落盘", out.get("moved_to") == "rejected" and not hits,
+           repr((out.get("moved_to"), hits)))
+
+    # ---------- R3 缺必需要素：原文保留（行为不变） ----------
+    cg3 = _mk_cg(tmp, "root_r3")
+    out = pipe.execute(cg3, {"content_kind": "text", "layer": "knowledge",
+                             "content": "缺要素的正文，补齐后可重写"})
+    rid = out.get("id")
+    body = _rejected_text(cg3, rid) if rid in cg3.index["nodes"] else ""
+    _check("R3 缺要素负记忆保留原文", out.get("moved_to") == "rejected"
+           and "缺要素的正文，补齐后可重写" in body, repr((out.get("moved_to"), body)))
+
+    # ---------- R4 redact_forbidden 单元 ----------
+    rules = {"forbidden": ["(unclosed", TK, "", r"\bsk-[A-Za-z0-9]{20,}"]}
+    s = "a %s b %s c sk-%s" % (FAKE, FAKE, "A" * 24)
+    r = audit.redact_forbidden(s, rules)
+    _check("R4a 多处命中全替换", FAKE not in r and "sk-AAAA" not in r
+           and r.count("[已过滤:禁表#2]") == 2 and "[已过滤:禁表#3]" in r, repr(r))
+    _check("R4b 无规则原样返回", audit.redact_forbidden(s, {}) == s)
+    _check("R4c 非法正则跳过不抛错", "[已过滤:禁表#1]" not in r)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/md_cg/test_retr_s1b.py

@@ -83,7 +83,7 @@ def main():
 
     root = tempfile.mkdtemp(prefix="retr_s1b_")
     cg = _build(root)
-    b_sense = [e.get("bucket") for e in cg.index["nodes"].values()
+    b_sense = [e.get("bucket") for e in list(cg.index["nodes"].values())
                if e.get("path", "").endswith("s1.md")][0]
     check("写入侧确实落了桶", bool(b_sense) and b_sense != "orphan", str(b_sense))
 
@@ -142,7 +142,7 @@ def main():
     cgi.add("a1", "感知系统 记忆", "knowledge", tags=["domain:感知系统"])
     cgi.add("b1", "图数据库 邻接", "knowledge", tags=["domain:图数据库"])
     cgi.flush()
-    bi = [e.get("bucket") for e in cgi.index["nodes"].values()
+    bi = [e.get("bucket") for e in list(cgi.index["nodes"].values())
           if e.get("path", "").endswith("a1.md")][0]
     # 对照组必须用**同一个 min_results**（否则比的是两次不同检索，不是回退等价）
     _setenv(MDCG_GATE_S1B_BUCKET=None)

package/md_cg/test_retr_s5.py

@@ -9,7 +9,8 @@
 - 相邻抑制：与 rejected 节点有边相连（文本不重叠）的正候选同样被抑制
 - 无关候选不被抑制；λ 可配（0=不抑制，1=压到 0 且不低于 0）
 - 阈值真的在过滤：部分重叠候选在 thr=0.6 下不抑制、thr=0.4 下被抑制
-- 负记忆条目在 S5 开时不再与正候选同权（1.0 → 1-λ）
+- 负覆盖条目不参与分数竞争：分数恒哨兵 0.0（负性走独立字段），S5 的 λ 只作用于
+  正候选——H10① 2026-09-30（改前该条目被赋 1.0，高过任何真实候选）
 - 无负记忆命中时不落 s5 审计；幂等（重复检索 / 索引重建）
 """
 import os
@@ -61,6 +62,12 @@ def _scores(results):
     return {r[0]["id"]: round(float(r[1]), 6) for r in results}
 
 
+def _neg_card(results):
+    """结果里的负覆盖条目卡（判据：独立字段 negative_coverage）。"""
+    return next((r[0] for r in results
+                 if r[0].get("negative_coverage")), None)
+
+
 def _build(root):
     cg = MdCG(root)
     # 三个正候选都含查询词（都会成为 T2 命中），差别只在「与负记忆的关系」：
@@ -90,8 +97,13 @@ def main():
     base = _scores(r_off)
     check("默认关：meta 不含 gates 键", "gates" not in m_off,
           str(sorted(m_off.keys())))
-    check("默认关：负记忆条目与正候选同权（1.0）",
-          base.get("rejected/h_rej.md") == 1.0, str(base))
+    check("默认关：负覆盖条目分数＝哨兵 0.0（不再冒充 1.0 候选，且不高过任何"
+          "正候选；负性走独立字段 negative_coverage）",
+          base.get("rejected/h_rej.md") == 0.0
+          and (_neg_card(r_off) or {}).get("negative_coverage") is True
+          and max(v for k, v in base.items()
+                  if k != "rejected/h_rej.md") >= base["rejected/h_rej.md"],
+          str(base))
 
     # ---- 2) 子开关未设（总开关开、S1/S2 显式关）→ S5 不生效 ----
     _setenv(MDCG_RETRIEVAL_PIPELINE="1", MDCG_GATE_S5_NEG=None,
@@ -122,8 +134,9 @@ def main():
           sc5.get("pos_clean") == base.get("pos_clean")
           and "pos_clean" not in _sup,
           "%s vs %s  sup=%s" % (sc5.get("pos_clean"), base.get("pos_clean"), sorted(_sup)))
-    check("负记忆条目不再同权（1.0 → 0.5）",
-          sc5.get("rejected/h_rej.md") == 0.5, str(sc5.get("rejected/h_rej.md")))
+    check("负覆盖条目不再参与分数竞争（S5 只降正候选；条目恒哨兵 0.0）",
+          sc5.get("rejected/h_rej.md") == 0.0,
+          str(sc5.get("rejected/h_rej.md")))
 
     # ---- 4) λ 可配：0=不抑制；1=压到 0 且 ≥0 ----
     _setenv(MDCG_NEG_LAMBDA="0")
@@ -159,8 +172,8 @@ def main():
     r4, m4 = cg.search(QUERY, k=10, judge=False, record=False)
     sc4 = _scores(r4)
     g4 = (m4.get("gates") or {}).get("s5") or {}
-    check("λ=0.25：负记忆条目 0.75 且审计记 0.25",
-          sc4.get("rejected/h_rej.md") == 0.75 and g4.get("lambda") == 0.25,
+    check("λ=0.25：审计记 0.25、负覆盖条目仍非分数（哨兵 0.0，不随 λ 变）",
+          sc4.get("rejected/h_rej.md") == 0.0 and g4.get("lambda") == 0.25,
           "%s %s" % (sc4.get("rejected/h_rej.md"), g4))
 
     # ---- 6) 无负记忆命中：不落 s5 审计 ----

package/md_cg/test_review_cli_attribution.py

@@ -0,0 +1,177 @@
+# -*- coding: utf-8 -*-
+"""md_cg · review_cli 归因守卫（P1 裁决面身份归因退化，DSH 端在役实测）
+
+缺陷（修复前）：`review_cli._cg` 构造 `Principal(actor="designer-cli", ...)`
+不传 session → `security.Principal.__init__` 每次随机生成 `sess_<uuid12>`；
+accept 落盘经 `MdCGSecure._attribution` 的 setdefault，writer 缺省成裁决者
+designer-cli——于是 DSH 端实测：5 个裁决节点 5 个互不相同的随机会话 id、
+writer 全被 designer-cli 覆盖，原始写入者（dsh-memory，提案记录 actor 有）
+不可追溯。
+
+守卫（修复前红）：
+  ① review_cli accept --session <s> → 落盘节点 frontmatter.session == <s>
+  ② 落盘节点 frontmatter.writer == 提案记录的原始 actor（dsh-memory）
+  ③ 裁决者身份不丢失：frontmatter.reviewer == "designer-cli"
+  ④ 稳定性：同一 --session 两次裁决 → 两节点 session 一致
+  ⑤ 兜底：未传 --session 时环境变量 MDCG_SESSION 生效
+  ⑥ 仍无（两者皆缺省）→ stderr 告警一行 + 维持随机会话（现状兼容）
+
+运行：python -m md_cg.test_review_cli_attribution
+"""
+from __future__ import annotations
+
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+
+from . import nodefile
+from .mdcos import MdCGOS, MdCGSecure
+from .security import Principal
+
+PASS = FAIL = 0
+FAILS = []
+
+REPO = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+
+DUMMY_KEY = "ab" * 32          # 哑主密钥：子进程绝不触真实 ~/.mdcg/master.key
+
+
+def check(name, cond, detail=""):
+    global PASS, FAIL
+    if cond:
+        PASS += 1
+        print(f"  [PASS] {name}" + (f"  · {detail}" if detail else ""))
+    else:
+        FAIL += 1
+        FAILS.append(name)
+        print(f"  [FAIL] {name}  · {detail}")
+
+
+def _child_env(extra=None, remove=("MDCG_SESSION", "DSH_SESSION_ID",
+                                   "MDCG_REDTEAM_REQUIRED")):
+    """子进程环境：哑密钥 + UTF-8 + PYTHONPATH 指向本仓（纪律 15）。
+
+    remove 里的会话/红队环境变量先摘除——守卫 ①~④⑥ 必须证明 --session
+    是唯一来源，不能被外层环境偷跑。
+    """
+    env = dict(os.environ)
+    for k in remove:
+        env.pop(k, None)
+    env["MDCG_MASTER_KEY"] = DUMMY_KEY
+    env["PYTHONUTF8"] = "1"
+    env["PYTHONIOENCODING"] = "utf-8"
+    env["PYTHONPATH"] = REPO + os.pathsep + env.get("PYTHONPATH", "")
+    env.update(extra or {})
+    return env
+
+
+def _run_cli(root, argv, extra=None):
+    """跑一次 review_cli 子命令（包内入口 python -m md_cg.review_cli）。"""
+    return subprocess.run(
+        [sys.executable, "-m", "md_cg.review_cli"] + argv,
+        capture_output=True, text=True, encoding="utf-8", errors="replace",
+        env=_child_env(extra), cwd=REPO)
+
+
+def _propose(root, nid, content):
+    """以原始写入者身份（dsh-memory，DSH 端 agent 形态）入队一条提案。"""
+    cg = MdCGSecure(root, principal=Principal(
+        actor="dsh-memory", clearance="internal", can_write=True,
+        can_admin=False, role="recorder", session="sess_writer_orig"))
+    try:
+        return cg.propose(nid, content, layer="knowledge", tags=["attr"])
+    finally:
+        cg.close()
+
+
+def _fm(root, nid):
+    """直读节点文件 frontmatter（不经密级读闸——守卫只看归因字段）。"""
+    probe = MdCGOS(root, actor="probe")
+    try:
+        e = (probe.index.get("nodes") or {}).get(nid)
+        if not e:
+            return None
+        with open(os.path.join(root, e["path"]), encoding="utf-8") as f:
+            fm, _c = nodefile.loads(f.read())
+        return fm
+    finally:
+        probe.close()
+
+
+def main():
+    roots = []
+    try:
+        print("\n【①~③】accept --session → 落盘归因（session/writer/reviewer）")
+        root_a = tempfile.mkdtemp(prefix="cliattrib_a_")
+        roots.append(root_a)
+        pid = _propose(root_a, "attr-node-1", "P1 归因守卫：原始写入者应可追溯。")
+        r = _run_cli(root_a, ["accept", pid, "--session", "sess_decide_01",
+                              "--root", root_a, "--reason", "归因守卫"])
+        check("review_cli accept --session 退出码 0", r.returncode == 0,
+              (r.stdout or r.stderr or "")[:200])
+        fm = _fm(root_a, "attr-node-1")
+        check("frontmatter.session == 传入 --session",
+              bool(fm) and fm.get("session") == "sess_decide_01",
+              str(fm and fm.get("session")))
+        check("frontmatter.writer == 提案原始 actor（dsh-memory）",
+              bool(fm) and fm.get("writer") == "dsh-memory",
+              str(fm and fm.get("writer")))
+        check("裁决者身份保留于 frontmatter.reviewer == designer-cli",
+              bool(fm) and fm.get("reviewer") == "designer-cli",
+              str(fm and fm.get("reviewer")))
+
+        print("\n【④】同一 --session 两次裁决 → 落盘归属一致")
+        pid2 = _propose(root_a, "attr-node-2",
+                        "P1 归因守卫第二提案：同批裁决同会话。")
+        r2 = _run_cli(root_a, ["accept", pid2, "--session", "sess_decide_01",
+                               "--root", root_a, "--reason", "归因守卫"])
+        fm2 = _fm(root_a, "attr-node-2")
+        check("第二节点 session 与第一节点一致",
+              r2.returncode == 0 and bool(fm) and bool(fm2)
+              and fm2.get("session") == fm.get("session") == "sess_decide_01",
+              "%r vs %r" % (fm and fm.get("session"), fm2 and fm2.get("session")))
+
+        print("\n【⑤】MDCG_SESSION 环境变量兜底")
+        pid3 = _propose(root_a, "attr-node-3",
+                        "P1 归因守卫第三提案：环境变量会话。")
+        r3 = _run_cli(root_a, ["accept", pid3, "--root", root_a,
+                               "--reason", "归因守卫"],
+                      extra={"MDCG_SESSION": "sess_env_03"})
+        fm3 = _fm(root_a, "attr-node-3")
+        check("无 --session 时 MDCG_SESSION 生效",
+              r3.returncode == 0 and bool(fm3)
+              and fm3.get("session") == "sess_env_03",
+              str(fm3 and fm3.get("session")))
+
+        print("\n【⑥】两者皆缺省 → stderr 告警一行 + 维持随机会话")
+        pid4 = _propose(root_a, "attr-node-4",
+                        "P1 归因守卫第四提案：随机会话告警。")
+        r4 = _run_cli(root_a, ["accept", pid4, "--root", root_a,
+                               "--reason", "归因守卫"])
+        fm4 = _fm(root_a, "attr-node-4")
+        check("退出码 0（告警不阻断裁决）", r4.returncode == 0,
+              (r4.stdout or r4.stderr or "")[:200])
+        warn = [ln for ln in (r4.stderr or "").splitlines() if ln.strip()]
+        check("stderr 恰一行随机会话告警",
+              len(warn) == 1 and "随机会话" in warn[0], str(warn))
+        check("缺省仍落随机会话 id（sess_ 前缀，现状兼容）",
+              bool(fm4) and str(fm4.get("session", "")).startswith("sess_"),
+              str(fm4 and fm4.get("session")))
+        check("无 --session 时原始 writer 归因同样在位",
+              bool(fm4) and fm4.get("writer") == "dsh-memory",
+              str(fm4 and fm4.get("writer")))
+    finally:
+        for r_ in roots:
+            shutil.rmtree(r_, ignore_errors=True)
+
+    print("\n" + "=" * 64)
+    print(f"PASS={PASS}  FAIL={FAIL}")
+    if FAILS:
+        print("失败项：" + "；".join(FAILS))
+    return 0 if FAIL == 0 else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())