@furongjun1999/dsh-memory 0.6.0 → 0.7.0

package/md_cg/test_n139_dek_provision_failclosed.py

@@ -0,0 +1,185 @@
+# -*- coding: utf-8 -*-
+"""N139 守卫（第 5 轮，2026-09-27）：密钥库损坏/漂移回落 fail-closed——
+provision_dek 不得据空表静默重签整份覆盖。
+
+留档复测（v8 N139 首报 → v9/v15/v16 历轮成立 → 本轮第 5 次，medium 维持）：
+
+病灶①（crypto.py:263-274）：_load_keys 遇「文件在但 JSON 截断/损坏」
+（ValueError）或「OSError 不可读」或「顶层 dict 但 envelopes 缺失/非 dict」
+（版本漂移）时 `except (ValueError, OSError): pass` 静默回落空 envelopes
+——零告警零标记。
+病灶②（:290-314）：provision_dek 据空表走重签分支生成新 DEK 并 _save_keys
+（:313，唯一写点；rotate_dek :343-345 委托之）整份覆盖写回——旧信封无痕
+抹除、旧密文永久不可解，全程无备份无审计无 stderr。
+
+红守卫（哑 KEK=os.urandom(32) + 临时目录，确定性、零真实状态）：
+  R1 截断 _keys.json → provision_dek 必失败（LockedError）+ stderr 告警
+     + 原文件字节不被覆盖；
+  R2 读面零闸变：unwrap_dek 对损坏文件照旧按无信封抛 LockedError；
+  R3 fresh install（缺文件 ≠ 损坏）零闸变：provision 照常签发；
+  R4 完好文件幂等路径零误伤（同 (tenant, actor) 重进 → 原 DEK 原样）；
+  R5 版本漂移面（合法 JSON 但 envelopes 非映射）同闸；
+  R6 生产面（mdcos.MdCGSecure 构造）：损坏文件下 _crypto_error 留痕、
+     dek=None、坏文件字节原样（fail-closed 降级不崩进程）。
+
+运行：python -m md_cg.test_n139_dek_provision_failclosed
+"""
+from __future__ import annotations
+
+import contextlib
+import io
+import os
+import shutil
+import sys
+import tempfile
+
+from . import crypto
+from .mdcos import MdCGSecure
+
+PASS = FAIL = 0
+FAILS = []
+MARK = "密钥库损坏"              # stderr 告警/拒绝消息稳定锚点
+
+
+def check(name, cond, detail=""):
+    global PASS, FAIL
+    if cond:
+        PASS += 1
+        print("  OK   " + name)
+    else:
+        FAIL += 1
+        FAILS.append(name)
+        print("  FAIL " + name + "  " + str(detail)[:110])
+
+
+def _provision(root, kek, tenant, actor, **kw):
+    """provision_dek 捕获异常，返回 (dek|None, exc|None)。"""
+    try:
+        return crypto.provision_dek(root, kek, tenant, actor, **kw), None
+    except crypto.CryptoError as e:
+        return None, e
+
+
+def _unwrap(root, kek, tenant, actor):
+    try:
+        return crypto.unwrap_dek(root, kek, tenant, actor), None
+    except crypto.CryptoError as e:
+        return None, e
+
+
+def _read(p):
+    with open(p, "rb") as f:
+        return f.read()
+
+
+def main():
+    sys.stdout.reconfigure(encoding="utf-8", errors="replace")
+    tmp = tempfile.mkdtemp(prefix="mdcg_n139_")
+    kek = os.urandom(32)           # 哑 KEK：仅本守卫用，绝不触真实主密钥
+    try:
+        # ---------- R1 截断文件 → provision fail-closed ----------
+        print("== R1 截断 _keys.json → provision_dek 必失败且原文件不被覆盖 ==")
+        root1 = os.path.join(tmp, "r1")
+        os.makedirs(root1)
+        dek_a, e_a = _provision(root1, kek, "tenantA", "actorA")
+        check("R1a 基线：正常签发 DEK", dek_a is not None and e_a is None,
+              f"dek={'有' if dek_a else '无'} exc={e_a}")
+        kf = crypto.keys_path(root1)
+        good = _read(kf)
+        with open(kf, "wb") as f:
+            f.write(b'{"v": 1, "alg": "cha')   # 截断 JSON（哑损坏样本）
+        corrupt = _read(kf)
+        check("R1b 损坏样本在位（截断 JSON）",
+              corrupt != good and len(corrupt) < len(good),
+              f"len={len(corrupt)} vs {len(good)}")
+        buf = io.StringIO()
+        with contextlib.redirect_stderr(buf):
+            dek_b, e_b = _provision(root1, kek, "tenantB", "actorB")
+        check("R1c 损坏标记下 provision 被拒（LockedError 且含锚点）",
+              dek_b is None and e_b is not None and MARK in str(e_b),
+              f"dek={'有' if dek_b else '无'} "
+              f"exc={type(e_b).__name__}: {str(e_b)[:80]}")
+        check("R1d stderr 告警开口（含锚点与路径）",
+              MARK in buf.getvalue() and kf in buf.getvalue(),
+              buf.getvalue().strip()[:100])
+        check("R1e 原文件字节不被覆盖（无痕抹除被阻断）",
+              _read(kf) == corrupt,
+              f"len={len(_read(kf))} vs {len(corrupt)}")
+
+        # ---------- R2 读面零闸变 ----------
+        print("== R2 读面零闸变：unwrap 照旧按无信封抛 ==")
+        _, e2 = _unwrap(root1, kek, "tenantA", "actorA")
+        check("R2 损坏文件下 unwrap 仍抛 LockedError（不假装能解密）",
+              e2 is not None, f"exc={type(e2).__name__ if e2 else None}")
+
+        # ---------- R3 fresh install 零闸变 ----------
+        print("== R3 fresh install（缺文件≠损坏）零闸变 ==")
+        root3 = os.path.join(tmp, "r3")
+        os.makedirs(root3)
+        dek3, e3 = _provision(root3, kek, "tenantC", "actorC")
+        check("R3 缺文件时 provision 照常签发",
+              e3 is None and dek3 is not None
+              and os.path.isfile(crypto.keys_path(root3)),
+              f"dek={'有' if dek3 else '无'} exc={e3}")
+
+        # ---------- R4 完好文件幂等路径零误伤 ----------
+        print("== R4 完好文件幂等路径零误伤 ==")
+        dek4, e4 = _provision(root3, kek, "tenantC", "actorC")
+        check("R4 同 (tenant, actor) 重进 → 原 DEK 原样",
+              e4 is None and dek4 == dek3, f"exc={e4}")
+
+        # ---------- R5 版本漂移面 ----------
+        print("== R5 版本漂移（顶层合法但 envelopes 缺失/非 dict）同闸 ==")
+        root5 = os.path.join(tmp, "r5")
+        os.makedirs(root5)
+        drift = b'{"v": 0, "note": "legacy-without-envelopes"}'
+        with open(crypto.keys_path(root5), "wb") as f:
+            f.write(drift)
+        buf5 = io.StringIO()
+        with contextlib.redirect_stderr(buf5):
+            dek5, e5 = _provision(root5, kek, "tenantD", "actorD")
+        check("R5a 漂移文件下 provision 被拒（LockedError 且含锚点）",
+              dek5 is None and e5 is not None and MARK in str(e5),
+              f"dek={'有' if dek5 else '无'} "
+              f"exc={type(e5).__name__}: {str(e5)[:80]}")
+        check("R5b 漂移原文件字节不被覆盖",
+              _read(crypto.keys_path(root5)) == drift)
+
+        # ---------- R6 生产面（MdCGSecure 构造） ----------
+        print("== R6 生产面：MdCGSecure 构造遇损坏密钥库 fail-closed 降级 ==")
+        root6 = os.path.join(tmp, "r6")
+        os.makedirs(root6)
+        with open(crypto.keys_path(root6), "wb") as f:
+            f.write(b'{"v": 1, "alg": "cha')
+        corrupt6 = _read(crypto.keys_path(root6))
+        old_mk = os.environ.get(crypto.MASTER_ENV)
+        os.environ[crypto.MASTER_ENV] = os.urandom(32).hex()   # 哑主密钥（env 路径）
+        try:
+            cg = MdCGSecure(root6, principal=None, master_key=bytes(range(32)))
+            check("R6a 构造不崩（LockedError ⊂ CryptoError 被既有 catch 捕获）",
+                  cg is not None)
+            check("R6b _crypto_error 留痕且含锚点",
+                  MARK in str(getattr(cg, "_crypto_error", "")),
+                  f"_crypto_error={str(getattr(cg, '_crypto_error', ''))[:90]}")
+            check("R6c dek=None（fail-closed 降级，private/secret 写被拒）",
+                  getattr(cg, "dek", "MISSING") is None,
+                  f"dek={getattr(cg, 'dek', 'MISSING')}")
+            check("R6d 坏文件字节原样", _read(crypto.keys_path(root6)) == corrupt6)
+        finally:
+            if old_mk is None:
+                os.environ.pop(crypto.MASTER_ENV, None)
+            else:
+                os.environ[crypto.MASTER_ENV] = old_mk
+    finally:
+        shutil.rmtree(tmp, ignore_errors=True)
+
+    print()
+    if FAILS:
+        print("FAILED: %d 项 → %s" % (len(FAILS), ", ".join(FAILS)))
+        return 1
+    print("ALL OK: %d 项（N139 密钥库损坏回落 fail-closed 守卫全绿）" % PASS)
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/md_cg/test_n176_link_trust.py

@@ -0,0 +1,221 @@
+# -*- coding: utf-8 -*-
+"""N176 守卫：无令牌签章（self-reported）不得经 link 落 knowledge 层。
+
+病灶（N176，high，2026-09-27）：attest 无 verifier_token 时验证方身份是
+**纯自报字符串**，AttestResult.verifier_identity="self-reported" 只是如实
+标注——但 link（:709-798）/link_pending（:984-1000）与全仓对该字段**零消费**，
+docstring「下游策略可据此拒绝」是未兑现空防线。record 角色（can_write=True、
+ops_allow 含 ccg，md_cg/tokens.py:126-141）单 agent 即可：
+    compile → attest(verdict=ACCEPT, verifier=任意编造名, 无令牌) → link(apply=true)
+编造名与 compiled_by 不同源（E041 只拦同源变体），未经验证的内容带「已签章」
+状态直写 knowledge 层（_cg._write_node）并进入检索传播，绕过 review 编外复核
+与裁定 A（LLM 不得自己验证自己）。
+
+修复契约（N176 最小修，兑现下游消费）：
+  link(apply=true) 对 verifier_identity != "token"（含历史 pending 缺字段）
+  一律 E052 拒绝写入；dry-run 不拦（附 E052 预告 warning）；
+  有令牌路径与同源 E041 不动；link_pending 经委托同闸，拒绝后 pending 保留
+  （暂存非存档，待令牌验证方复核）。全量验证方信任协议留档不扩。
+
+运行：python -m md_cg.test_n176_link_trust
+环境纪律：全程哑令牌（临时 MDCG_TOKEN_FILE）+ 临时记忆根，不触真实令牌库。
+"""
+from __future__ import annotations
+
+import json
+import os
+import shutil
+import sys
+import tempfile
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from md_cg import ccgc, nodefile, tokens
+from md_cg.mdcos import MdCGOS
+from md_cg.readcache import direct_read
+
+PASS = 0
+FAIL = 0
+FAILS = []
+
+
+def check(name, cond, detail=""):
+    global PASS, FAIL
+    if cond:
+        PASS += 1
+        print("  OK   " + name)
+    else:
+        FAIL += 1
+        FAILS.append(name)
+        print("  FAIL " + name + "  " + detail)
+
+
+DIALOG = ("文件摄取分派：按扩展名把文件路由到对应摄取器"
+          "。该方法使用扩展名映射表进行路由"
+          "。此功能在本地文件系统中生效"
+          "。仅对本地可读文件生效"
+          "。2026-09-16"
+          "。通过回放测试验证"
+          "。二进制文件不适用")
+
+SLOTS = {
+    "observation_position": {"value": "此功能在本地文件系统中生效"},
+    "observation_tool": {"value": "该方法使用扩展名映射表进行路由"},
+    "time_window": {"value": [0.0, 9999999999.0]},
+    "existence_constraint": {"value": "仅对本地可读文件生效"},
+}
+
+MARKS = {
+    "功能名": {"value": "文件摄取分派：按扩展名把文件路由到对应摄取器"},
+    "子功能": {"value": "按扩展名把文件路由到对应摄取器"},
+    "执行": {"value": "使用扩展名映射表进行路由"},
+    "验证方式": {"value": "回放测试", "basis": "test"},
+    "不适用条件": {"value": "二进制文件不适用"},
+}
+
+MARK_LINE = "功能名：文件摄取分派：按扩展名把文件路由到对应摄取器"
+
+
+def _seed(root, node):
+    cg = MdCGOS(root)
+    cg.add(node, "# 功能名：待编译节点\n\n占位正文。\n", layer="knowledge")
+    cg.flush()
+    cg.rebuild_index()
+    return cg
+
+
+def _disk(cg, node):
+    entry = (cg.index.get("nodes") or {}).get(node)
+    return direct_read(cg, entry)
+
+
+def main():
+    global PASS, FAIL
+    tmp = tempfile.mkdtemp(prefix="mdcg_n176_")
+    tok_env = os.path.join(tmp, "tokens.json")
+    old_tf = os.environ.get(tokens.TOKEN_FILE_ENV)
+    os.environ[tokens.TOKEN_FILE_ENV] = tok_env
+    try:
+        # ---------- X1 攻击前提：record 权限面（tokens.py:126-141） ----------
+        print("== X1 record 角色权限面（哑令牌临时库）==")
+        rec = tokens.issue("record", actor="worker-a", path=tok_env)
+        check("X1a record 令牌可签发（哑临时令牌文件）", bool(rec.get("token")))
+        spec = tokens.ROLE_SPECS.get("record") or {}
+        check("X1b record can_write=True", spec.get("can_write") is True)
+        check("X1c record ops_allow 含 ccg", "ccg" in (spec.get("ops_allow") or []))
+        pr = tokens.verify_token(rec["token"])
+        check("X1d 令牌主体=worker-a", getattr(pr, "actor", "") == "worker-a")
+
+        root = os.path.join(tmp, "root")
+        cg = _seed(root, "tgt")
+
+        # ---------- X2 攻击复现：编造名无令牌 → link(apply=true) 必须拒 ----------
+        print("== X2 攻击复现：编造名无令牌签章 → link(apply=true) 必须拒 ==")
+        r = ccgc.compile_dialog(DIALOG, "tgt", "worker-a",
+                                slots=SLOTS, marks=MARKS, cg=cg)
+        check("X2a compile success（攻击面成立）", r.success,
+              "errors=" + "; ".join(r.errors[:2]))
+        at = ccgc.attest("tgt", ccgc.ACCEPT, "hive:reflect:fake-unit", "worker-a",
+                         evidence="编外复核（伪造）", cg=cg)
+        check("X2b 编造名过 attest（E041 只拦同源，病灶如实留证）",
+              at.ok and at.verifier_identity == "self-reported",
+              "ok=%s id=%s err=%s" % (at.ok, at.verifier_identity, at.error[:60]))
+        l = ccgc.link(r, at, cg=cg, apply=True)
+        check("X2c link(apply=true) 拒绝且 written==0（E052）",
+              (not l.ok) and l.written == 0
+              and any(str(e).startswith("E052") for e in l.errors),
+              "ok=%s written=%s errors=%s" % (l.ok, l.written, l.errors[:2]))
+        _fm1, c1 = _disk(cg, "tgt")
+        check("X2d knowledge 层未被写入（六要素仍不全）",
+              not nodefile.ccg_completeness(c1)["complete"],
+              "complete=" + str(nodefile.ccg_completeness(c1)))
+        check("X2e 未进入检索传播（盘上正文无六行）", MARK_LINE not in (c1 or ""))
+
+        # ---------- X3 link_pending 同闸（委托面，:984-1000） ----------
+        print("== X3 link_pending 同闸 ==")
+        sv = ccgc.save_pending(cg, r, at)
+        lp = ccgc.link_pending(cg, "tgt", apply=True, actor="worker-a")
+        check("X3a link_pending(apply=true) 拒绝（E052）",
+              (not lp.ok) and lp.written == 0
+              and any(str(e).startswith("E052") for e in lp.errors),
+              "ok=%s errors=%s" % (lp.ok, lp.errors[:2]))
+        check("X3b pending 保留（暂存非存档，可待令牌复核）",
+              os.path.isfile(sv.get("path") or ""))
+
+        # ---------- X4 MCP 工具面同闸（compile→attest→link 全程） ----------
+        print("== X4 MCP 工具面同闸 ==")
+        cg2 = _seed(root, "tgt2")
+        from md_cg import mcp_server as mcp
+        c2 = mcp._ccg_call(cg2, {"ccg": {"action": "compile", "node_id": "tgt2",
+                                         "actor": "worker-a", "dialog": DIALOG,
+                                         "marks": MARKS, "slots": SLOTS}})
+        check("X4a MCP compile 成功并落 pending",
+              c2.get("ok") and (c2.get("pending") or {}).get("ok"))
+        c3 = mcp._ccg_call(cg2, {"ccg": {"action": "attest", "node_id": "tgt2",
+                                         "verdict": "ACCEPT",
+                                         "verifier": "hive:reflect:fake-unit2",
+                                         "compiled_by": "worker-a",
+                                         "evidence": "伪造复核"}})
+        check("X4b MCP attest 自报签章通过（病灶如实留证）",
+              c3.get("ok") and (c3.get("attest") or {}).get("verifier_identity")
+              == "self-reported",
+              json.dumps(c3.get("attest") or {}, ensure_ascii=False)[:120])
+        c4 = mcp._ccg_call(cg2, {"ccg": {"action": "link", "node_id": "tgt2",
+                                         "apply": True}})
+        check("X4c MCP link(apply=true) 拒绝（E052）",
+              (not c4.get("ok")) and "E052" in json.dumps(c4, ensure_ascii=False),
+              json.dumps(c4, ensure_ascii=False)[:160])
+
+        # ---------- X5 对照面：有令牌路径不误伤 ----------
+        print("== X5 对照面：有令牌签章正常落库 ==")
+        tk = tokens.issue("verify", actor="external-reviewer", path=tok_env)["token"]
+        at2 = ccgc.attest("tgt", ccgc.ACCEPT, "随意自报字符串会被覆盖", "worker-a",
+                          evidence="真实编外验证方", cg=cg, verifier_token=tk)
+        check("X5a 令牌签章 identity=token 且覆盖自报",
+              at2.ok and at2.verifier == "external-reviewer"
+              and at2.verifier_identity == "token",
+              "ok=%s id=%s" % (at2.ok, at2.verifier_identity))
+        l2 = ccgc.link(r, at2, cg=cg, apply=True)
+        check("X5b 有令牌签章 link 落库六行", l2.ok and l2.written == 6,
+              "ok=%s written=%s errors=%s" % (l2.ok, l2.written, l2.errors[:2]))
+        _fm2, c2d = _disk(cg, "tgt")
+        check("X5c 六要素齐备（正常通路不受影响）",
+              nodefile.ccg_completeness(c2d)["complete"])
+
+        # ---------- X6 对照面：同源 E041 不动 ----------
+        print("== X6 对照面：同源 E041 不动 ==")
+        at3 = ccgc.attest("tgt", ccgc.ACCEPT, "Worker-A", "worker-a", cg=cg)
+        check("X6a 同源变体仍 E041", (not at3.ok) and at3.error.startswith("E041"),
+              "err=" + at3.error[:60])
+
+        # ---------- X7 dry-run 不拦（附 E052 预告） ----------
+        print("== X7 dry-run 不拦 ==")
+        cg3 = _seed(root, "tgt3")
+        r3 = ccgc.compile_dialog(DIALOG, "tgt3", "worker-a",
+                                 slots=SLOTS, marks=MARKS, cg=cg3)
+        at4 = ccgc.attest("tgt3", ccgc.ACCEPT, "hive:reflect:fake-unit3", "worker-a",
+                          cg=cg3)
+        ld = ccgc.link(r3, at4, cg=cg3, apply=False)
+        check("X7a dry-run ok=True 且附 E052 预告 warning",
+              ld.ok and ld.dry_run and ld.written == 0
+              and any("E052" in w for w in ld.warnings),
+              "ok=%s warnings=%s" % (ld.ok, ld.warnings[:2]))
+        _fm3, c3d = _disk(cg3, "tgt3")
+        check("X7b dry-run 确未写入", MARK_LINE not in (c3d or ""))
+    finally:
+        if old_tf is None:
+            os.environ.pop(tokens.TOKEN_FILE_ENV, None)
+        else:
+            os.environ[tokens.TOKEN_FILE_ENV] = old_tf
+        shutil.rmtree(tmp, ignore_errors=True)
+
+    print()
+    if FAILS:
+        print("FAILED: %d 项 → %s" % (len(FAILS), ", ".join(FAILS)))
+        return 1
+    print("ALL OK: %d 项（N176 无令牌签章不落 knowledge 层守卫全绿）" % PASS)
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/md_cg/test_n178_units_jobid_gate.py

@@ -0,0 +1,212 @@
+# -*- coding: utf-8 -*-
+"""md_cg · units 派发通道 job_id 结构闸守卫（N178，越池读写）
+
+缺陷（修复前）：`md_cg/units.py` 把**调用方给的** job_id 直接 `os.path.join`
+进池路径，全程无结构校验——
+  · `poll(job_id, jobs)`（units.py:336）`d = os.path.join(jobs_dir(jobs), str(job_id or ""))`
+    → `poll("../victim")`、`poll("<绝对路径>")` 都把 d 指到**池外**，随后
+    `RESULT_FILE`（result.json）被正常读出、`content` 原样进返回值
+    （:353-373）——越池读全文；`wait`（:386 循环 poll）与 `run` 同源继承。
+  · `submit(...)`（:305-306）`jd, job_id = jobs_dir(jobs), _job_id()` 后
+    `d = os.path.join(jd, job_id)` 直接 `os.makedirs(d)` + 落 spec.json/status.json
+    ——job_id 来源一旦不是 `_job_id()`（同族 N145 池推导、外部派发器注入、
+    未来新增 id 源），就是「任意目录 + 生成名」的建目录/写文件原语。
+同族家法已有：`hive/hive_mcp/mcp_server.py:133-143 _valid_job_id`（`_t_poll`
+:481、`_t_kill` :515 用）与 `hive/src/job.rs:63-67 valid_job_id`（同为
+「单路径分量」结构闸，2026-09-25 缺陷）。units 是本缺口的**漏网面**。
+
+修复：`units._valid_job_id`（单点结构闸，deny-by-default 字符白名单）+
+三处接线——`poll` 入口拒（`state="invalid_job_id"` 结构化拒、content 恒 None）、
+`wait` 入口拒（**不得进轮询循环**：否则非法 id 要空转满 timeout_s）、
+`submit` 落盘前拒（makedirs 之前）。
+
+口径说明（为何**不**照抄 hive 的 "h" 前缀）：`_valid_job_id` 家法要求
+`startswith("h")`，而本模块对外的既有契约允许任意宿主派发器的 job 目录——
+`md_cg/test_units_poll.py:47/53/57` 用的就是 "j_empty"/"j_good"/"j_fail"。
+前缀收紧会误杀既有契约，故此处只保留「**不含路径成分**」的结构判据
+（字符集 = **区块白名单** `hive/id_charset_blocks.txt`，与 hive 两侧共读同一份数据；
+另允许结构字符 `_` `-` `.`；首尾非点；拒 `/` `\\` `:` NUL、控制/零宽/双向控制字符
+与首尾空白），判别力等价于路径穿越防护，且 `_job_id()` 自身产物必过（下方 :[0]
+自洽断言）。**2026-09-30 ①-(c) 判据换面后**本闸从「ASCII 白名单」换成「同一份区块
+表」，放宽面带来的静默风险由逐条显式拒收挡住（`md_cg/units.py::_valid_job_id`）。
+
+守卫（五组，全部临时池 + 临时目录，**绝不碰在役 jobs 目录**）：
+  ① 红转绿：池外造 `outside/result.json`（content="SECRET-OUTSIDE"）→
+     `poll("../outside")` 修前**读到池外全文**（ok=True/content 泄漏）；
+     修后结构化拒 `state="invalid_job_id"` 且 content 为 None；
+  ② 绝对路径形态同拒（`os.path.join` 遇绝对路径会丢弃池前缀）；
+  ③ 拒形态清单：`..` / 分隔符 / 盘符·ADS(`C:x`) / NUL / 空串 / 纯点 / 尾点 /
+     空白 / 非 str，全拒且 content 恒 None；
+  ④ `wait` 同闸且**立即返回**（不进轮询：无 timeout 键、无 waited_s）；
+  ⑤ `submit` 落盘前拒：注入 `_job_id` 返回 "../escaped"（证明落点无闸）——
+     修前在**池外**建出 `escaped/spec.json`；修后 ok=False 且该目录不存在；
+     并验证合法 submit→poll 闭环不回归（状态 pending、终态 False）。
+
+运行：python -m md_cg.test_n178_units_jobid_gate
+"""
+from __future__ import annotations
+
+import gc
+import json
+import os
+import shutil
+import sys
+import tempfile
+import time
+
+from . import units
+
+PASS = FAIL = 0
+FAILS = []
+
+SECRET = "SECRET-OUTSIDE"           # 池外 result.json 的正文（泄漏探针）
+
+
+def _clean(root):
+    """尽力清理临时池：Windows 下句柄未释放会让 rmtree 静默失败，故重试并告警。"""
+    for _ in range(4):
+        shutil.rmtree(root, ignore_errors=True)
+        if not os.path.exists(root):
+            return
+        gc.collect()
+        time.sleep(0.2)
+    print("  [warn] 临时目录未能清理（句柄占用？）：%s" % os.path.basename(root))
+
+
+def check(name, cond, detail=""):
+    global PASS, FAIL
+    if cond:
+        PASS += 1
+        print(f"  [PASS] {name}" + (f" · {detail}" if detail else ""))
+    else:
+        FAIL += 1
+        FAILS.append(f"{name} · {detail}" if detail else name)
+        print(f"  [FAIL] {name}" + (f" · {detail}" if detail else ""))
+
+
+def _mk_job(root, job_id, payload):
+    """在 root 下造一个终态 job 目录（result.json + status.json）。"""
+    d = os.path.join(root, job_id)
+    os.makedirs(d, exist_ok=True)
+    with open(os.path.join(d, "result.json"), "w", encoding="utf-8") as f:
+        json.dump(payload, f, ensure_ascii=False)
+    with open(os.path.join(d, "status.json"), "w", encoding="utf-8") as f:
+        json.dump({"job_id": job_id, "state": "done", "model": "stub"}, f,
+                  ensure_ascii=False)
+    return d
+
+
+def _leaked(r) -> bool:
+    """结果是否带出池外正文（越池读成立的判据）。"""
+    return SECRET in str(r.get("content") or "")
+
+
+def main():
+    print("=" * 68)
+    print("md_cg units · job_id 结构闸（N178 越池读写）")
+    print("=" * 68)
+    tmp = tempfile.mkdtemp(prefix="mdcg_units_n178_")
+    pool = os.path.join(tmp, "pool")
+    outside = os.path.join(tmp, "outside")
+    os.makedirs(pool, exist_ok=True)
+    _mk_job(outside, "", {"ok": True, "content": SECRET})
+    # 注：_mk_job(root=outside, job_id="") 落到 outside 本身（result.json 直接在池外根）
+    vj = getattr(units, "_valid_job_id", None)
+
+    try:
+        # ---------- [0] 闸门自洽：合法形态必过（含既有测试契约） ----------
+        print("\n[0] 闸门存在且合法形态必过（不误杀既有契约）")
+        check("① _valid_job_id 已定义且可调用", callable(vj),
+              f"got {vj!r}（修前无此闸）")
+        for good in ("h1758000000000_1a2b", "j_empty", "j_good", "j_fail",
+                     units._job_id()):
+            check(f"① 合法 id 放行：{good!r}", callable(vj) and vj(good) is True,
+                  f"got {vj(good) if callable(vj) else None!r}")
+
+        # ---------- [1] 红转绿：相对穿越读池外 ----------
+        print("\n[1] poll 相对穿越（../outside）")
+        r1 = units.poll("../outside", jobs=pool)
+        check("① 结构化拒（state=invalid_job_id）",
+              r1.get("state") == "invalid_job_id", str(r1)[:140])
+        check("① 池外正文未进返回值（修前 content=SECRET-OUTSIDE）",
+              not _leaked(r1) and r1.get("content") is None,
+              f"content={r1.get('content')!r}")
+        check("① ok 为 False 且给出可归因 error",
+              r1.get("ok") is False and "非法" in str(r1.get("error") or ""),
+              str(r1.get("error"))[:120])
+        check("① 池内对照：同名相对形态不误伤（pool/<合法名>）",
+              units.poll("j_none", jobs=pool).get("state") == "missing",
+              str(units.poll("j_none", jobs=pool))[:100])
+
+        # ---------- [2] 绝对路径形态 ----------
+        print("\n[2] poll 绝对路径（os.path.join 遇绝对路径丢弃池前缀）")
+        r2 = units.poll(outside, jobs=pool)
+        check("② 结构化拒且未泄漏", r2.get("state") == "invalid_job_id"
+              and not _leaked(r2), str(r2)[:140])
+
+        # ---------- [3] 拒形态清单 ----------
+        print("\n[3] 拒形态清单（均须结构化拒且 content 恒 None）")
+        bad_ids = ["..", "../outside", r"..\outside", "a/b", "a\\b", "C:x", "h:x",
+                   "a\x00b", "", ".", "...", "x.", "x..", " x", "x ", "   ",
+                   "h/../../x", "h/."]
+        for bad in bad_ids:
+            r = units.poll(bad, jobs=pool)
+            check(f"③ 拒 {bad!r}",
+                  r.get("state") == "invalid_job_id" and r.get("content") is None,
+                  f"state={r.get('state')!r} content={r.get('content')!r}")
+        for bad_ns in (123, None, 1.5, ["a"], {"a": 1}):
+            r = units.poll(bad_ns, jobs=pool)
+            check(f"③ 拒非 str {bad_ns!r}",
+                  r.get("state") == "invalid_job_id" and r.get("content") is None,
+                  f"state={r.get('state')!r}")
+
+        # ---------- [4] wait 同闸且不进轮询 ----------
+        print("\n[4] wait 入口同闸（fail-fast，不空转 timeout_s）")
+        r4 = units.wait("../outside", jobs=pool, timeout_s=0.3, poll_s=0.05)
+        check("④ 结构化拒且未泄漏", r4.get("state") == "invalid_job_id"
+              and not _leaked(r4), str(r4)[:140])
+        check("④ 未进轮询循环（无 timeout 键 / 无 waited_s）",
+              "timeout" not in r4 and r4.get("waited_s") is None, str(r4)[:140])
+
+        # ---------- [5] submit 落盘前拒 ----------
+        print("\n[5] submit 落盘前拒（注入生成器证明落点无闸）")
+        escaped = os.path.join(tmp, "escaped")
+        orig_gen = units._job_id
+        units._job_id = lambda: "../escaped"          # 模拟非生成器的 id 来源
+        try:
+            r5 = units.submit(prompt="探针", role=units.REFLECT,
+                              model="stub-model", jobs=pool)
+        finally:
+            units._job_id = orig_gen
+        check("⑤ 池外未建出 escaped/spec.json（修前会被建出）",
+              not os.path.isfile(os.path.join(escaped, "spec.json")),
+              f"ok={r5.get('ok')!r} spec存在={os.path.isfile(os.path.join(escaped, 'spec.json'))}")
+        check("⑤ 绿：submit 结构化拒",
+              r5.get("ok") is False and "非法" in str(r5.get("error") or ""),
+              str(r5.get("error"))[:120])
+
+        print("\n[5b] 合法 submit → poll 闭环不回归")
+        sub = units.submit(prompt="探针", role=units.REFLECT, model="stub-model",
+                           jobs=pool)
+        check("⑤ 合法 submit 仍可用（ok=True 且 id 过闸）",
+              sub.get("ok") is True and callable(vj) and vj(sub.get("job_id")) is True,
+              str(sub)[:140])
+        check("⑤ job 目录落在池内",
+              str(sub.get("job_dir") or "").startswith(os.path.abspath(pool)),
+              str(sub.get("job_dir")))
+        p = units.poll(sub.get("job_id"), jobs=pool)
+        check("⑤ 合法 poll 读到 pending（不误伤正常路径）",
+              p.get("state") == "pending" and p.get("terminal") is False,
+              f"state={p.get('state')!r} terminal={p.get('terminal')!r}")
+    finally:
+        _clean(tmp)
+
+    print("\n" + "=" * 68)
+    print(f"PASS={PASS}  FAIL={FAIL}")
+    if FAILS:
+        print("失败项：" + "；".join(FAILS))
+    return 0 if FAIL == 0 else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())