@kernel-sig/console 0.1.0

package/backend/tests/test_classification.py

@@ -0,0 +1,498 @@
+"""分类规则与子系统推导。
+
+规则集基于 openEuler 与上游内核的实际提交惯例：
+标题采用 "subsystem: description"，正文用 "fixes #N" 关联 Issue。
+"""
+
+import json
+from pathlib import Path
+
+import pytest
+
+from app.domain.classification import (
+    KIND_RULES,
+    TITLE_CONFIDENCE,
+    Kind,
+    _inclusion_kind,
+    classification_label,
+    classify_by_rules,
+    derive_subsystem,
+    extract_cve_ids,
+    extract_linked_issues,
+    extract_title_subsystem,
+    normalize_subsystem,
+    parse_commit_metadata,
+    subsystem_for_path,
+    subsystem_label,
+)
+
+FIXTURES = Path(__file__).parent / "fixtures" / "atomgit"
+
+
+def _load(name: str):
+    return json.loads((FIXTURES / name).read_text(encoding="utf-8"))
+
+
+# --- CVE 提取 ---------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    ("text", "expected"),
+    [
+        ("Fix CVE-2026-89613 in netfilter", ["CVE-2026-89613"]),
+        ("cve-2024-1234: fix", ["CVE-2024-1234"]),
+        ("Multiple: CVE-2024-1234 and CVE-2025-5678", ["CVE-2024-1234", "CVE-2025-5678"]),
+        ("no cve here", []),
+        # 序号部分不足 4 位不是合法 CVE 编号，不应被误当成一个
+        ("CVE-2024-1 is malformed", []),
+    ],
+)
+def test_extract_cve_ids(text, expected):
+    assert extract_cve_ids(text) == expected
+
+
+def test_extract_cve_deduplicates():
+    assert extract_cve_ids("CVE-2024-1234 and CVE-2024-1234") == ["CVE-2024-1234"]
+
+
+# --- 关联 Issue 提取 --------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    ("body", "expected"),
+    [
+        ("fixes #1234", [1234]),
+        ("Fixes: #1234", [1234]),
+        ("resolves #99", [99]),
+        ("closes #7", [7]),
+        ("fix #1 and fix #2", [1, 2]),
+        ("no link", []),
+    ],
+)
+def test_extract_linked_issues(body, expected):
+    assert extract_linked_issues(body) == expected
+
+
+def test_extract_linked_issues_deduplicates():
+    assert extract_linked_issues("fixes #5\nfixes #5") == [5]
+
+
+# --- 标题子系统 -------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    ("title", "expected"),
+    [
+        ("net: fix use-after-free", "net"),
+        ("mm/hugetlb: correct accounting", "mm/hugetlb"),
+        ("KVM: arm64: fix uninitialised level", "KVM"),
+        ("drivers/net/ethernet: add support", "drivers/net/ethernet"),
+    ],
+)
+def test_extract_title_subsystem(title, expected):
+    assert extract_title_subsystem(title) == expected
+
+
+@pytest.mark.parametrize(
+    "title",
+    [
+        'Revert "net: something"',
+        "PATCH v2: fix",
+        "v3: update",
+        "no colon here",
+        "",
+    ],
+)
+def test_non_subsystem_prefixes_are_rejected(title):
+    """Revert / PATCH v2 / v3 这类前缀不是子系统，误判会污染统计。"""
+    assert extract_title_subsystem(title) is None
+
+
+# --- 类型判定 ---------------------------------------------------------
+
+
+def test_cve_wins_over_other_keywords():
+    """标题同时含 'fix' 与 CVE 编号时，应判为 CVE —— 安全修复优先级更高。"""
+    result = classify_by_rules("net: fix CVE-2026-12345 use-after-free", "")
+    assert result.kind is Kind.CVE
+    assert result.confidence == 1.0
+    assert result.cve_ids == ["CVE-2026-12345"]
+
+
+def test_cve_detected_from_body_when_absent_in_title():
+    result = classify_by_rules("net: fix crash", "This addresses CVE-2026-9999.")
+    assert result.kind is Kind.CVE
+
+
+@pytest.mark.parametrize(
+    ("title", "expected"),
+    [
+        ("net: fix use-after-free in xfrm", Kind.BUGFIX),
+        ("mm: fix oob access", Kind.BUGFIX),
+        ("backport upstream fix for page cache", Kind.BACKPORT),
+        ("[OLK-6.6] cherry-pick fix for nvme", Kind.BACKPORT),
+        ("net: add support for new NIC", Kind.FEATURE),
+        ("fs: introduce new mount option", Kind.FEATURE),
+        ("kernel: refactor scheduler init", Kind.REFACTOR),
+        ("docs: update README", Kind.DOCS),
+    ],
+)
+def test_kind_detection(title, expected):
+    assert classify_by_rules(title, "").kind is expected
+
+
+def test_unknown_when_nothing_matches():
+    result = classify_by_rules("net: adjust things", "some body text")
+    assert result.kind is Kind.UNKNOWN
+    assert result.confidence == 0.0
+    assert result.rule_name is None
+
+
+def test_backport_has_higher_priority_than_bugfix():
+    """'backport ... fix ...' 应判为 backport，否则 backport 统计会漏。"""
+    result = classify_by_rules("backport: fix memory leak", "")
+    assert result.kind is Kind.BACKPORT
+
+
+def test_rules_are_ordered_by_priority():
+    priorities = [r.priority for r in KIND_RULES]
+    assert priorities == sorted(priorities, reverse=True)
+
+
+def test_result_carries_title_subsystem():
+    result = classify_by_rules("netfilter: fix leak", "")
+    assert result.title_subsystem == "netfilter"
+
+
+# --- 子系统推导 -------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    ("path", "expected"),
+    [
+        ("net/core/sock.c", "net"),
+        ("fs/ext4/inode.c", "fs"),
+        ("mm/memory.c", "mm"),
+        ("arch/arm64/kvm/hyp/pgtable.c", "arm64"),
+        ("drivers/net/ethernet/hisilicon/hns3.c", "net-drivers"),
+        ("kernel/sched/core.c", "kernel-core"),
+        ("drivers/gpu/drm/amd/amdgpu.c", "drm"),
+        ("unknown/file.c", None),
+    ],
+)
+def test_subsystem_for_path(path, expected):
+    assert subsystem_for_path(path) == expected
+
+
+def test_longest_prefix_wins():
+    """drivers/net 必须优先于 drivers/，否则网络驱动会被归入「其他驱动」。"""
+    assert subsystem_for_path("drivers/net/x.c") == "net-drivers"
+    assert subsystem_for_path("drivers/foo/x.c") == "drivers-other"
+
+
+def test_derive_subsystem_picks_majority():
+    primary, related = derive_subsystem(["net/core/a.c", "net/core/b.c", "net/ipv4/c.c", "mm/d.c"])
+    assert primary == "net"
+    assert "mm" in related
+
+
+def test_derive_subsystem_keeps_related_for_context():
+    """多数派不代表全部 —— 相关子系统一并返回，不做取舍。"""
+    primary, related = derive_subsystem(["drivers/a.c", "drivers/b.c", "mm/important.c"])
+    assert primary == "drivers-other"
+    assert "mm" in related
+
+
+def test_derive_subsystem_empty_input():
+    assert derive_subsystem([]) == (None, [])
+
+
+def test_derive_subsystem_ignores_unknown_paths():
+    assert derive_subsystem(["unknown/a.c", "other/b.c"]) == (None, [])
+
+
+def test_subsystem_label_is_localized():
+    assert subsystem_label("net") == "网络"
+    assert subsystem_label(None) == "未归类"
+    assert subsystem_label("some-unknown") == "some-unknown"
+
+
+def test_classification_label_uses_kind_prefix():
+    """与仓库中已有的 kind/abandoned 等标签保持同一命名习惯。"""
+    assert classification_label(Kind.CVE) == "kind/cve"
+    assert classification_label(Kind.BACKPORT) == "kind/backport"
+
+
+# --- 对真实标题的验证 -------------------------------------------------
+
+
+def test_real_open_pr_titles_are_classified():
+    """对真实 PR 标题跑一遍，确认没有异常且分布合理。"""
+    pulls = _load("pulls_page1.json")
+    kinds: dict[str, int] = {}
+    for pull in pulls:
+        result = classify_by_rules(pull["title"], pull.get("body") or "")
+        kinds[result.kind.value] = kinds.get(result.kind.value, 0) + 1
+    assert kinds, "应至少归类出一条"
+    assert sum(kinds.values()) == len(pulls)
+
+
+def test_real_pr_bodies_yield_linked_issues():
+    """openEuler 的 PR 模板要求填 fixes #N，正文中应能提取到。"""
+    pulls = _load("pulls_page1.json")
+    total = sum(len(extract_linked_issues(pull.get("body") or "")) for pull in pulls)
+    assert total >= 0  # 部分 PR 未填，不应抛异常
+
+
+# --- 标题子系统的归一化 -----------------------------------------------
+
+
+@pytest.mark.parametrize(
+    ("declared", "expected"),
+    [
+        ("net", "net"),
+        ("net/sched", "net"),
+        ("mm", "mm"),
+        ("mm/hugetlb", "mm"),
+        ("drivers/net/ethernet", "net-drivers"),
+        ("arm64", "arm64"),
+        ("arch/arm64", "arm64"),
+        ("drm", "drm"),
+        ("fs", "fs"),
+        ("io_uring", "io_uring"),
+        ("NET", "net"),
+        ("/net/", "net"),
+    ],
+)
+def test_normalize_subsystem_maps_title_prefixes(declared, expected):
+    """标题写法五花八门，但统计口径必须收敛到同一取值域。
+
+    否则按子系统统计时会出现 net / net/sched / net/core 三个近义项。
+    """
+    assert normalize_subsystem(declared) == expected
+
+
+@pytest.mark.parametrize("declared", ["", None, "   ", "randomsubsystem"])
+def test_normalize_subsystem_rejects_unknown(declared):
+    """不认识就返回 None —— 塞进一个假分类比留空更有害。"""
+    assert normalize_subsystem(declared) is None
+
+
+# --- 缺陷形态的识别 ---------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    ("title", "reason"),
+    [
+        ("remoteproc: Prevent crash handling to race with rproc_del()", "崩溃与竞争"),
+        ("net: fix use-after-free in xfrm_policy", "既有 fix 也有 UAF"),
+        ("mm: add missing hugetlb_lock in __unmap_hugepage_range()", "缺锁=缺陷"),
+        ("ipv4: validate IPV4_DEVCONF attributes properly", "原先校验不当"),
+        ("xen: Don't track # of local child partitions", "否定句式"),
+        ("HISI-CCA and HISI-CCA-DA bugfixs", "拼写不规范的 bugfix"),
+        ("mm: fix memory leak on error path", "内存泄漏"),
+    ],
+)
+def test_defect_idioms_are_bugfixes(title, reason):
+    """内核补丁标题描述"改了什么"而非"属于哪一类"。
+
+    只认 fix/bug 两个字会大量漏判（实测未命中样本里近半数属此类），
+    因此把缺陷的具体形态也纳入规则。
+    """
+    assert classify_by_rules(title, "").kind is Kind.BUGFIX, reason
+
+
+@pytest.mark.parametrize(
+    "title",
+    [
+        # \b 边界必须挡住 "trace" —— 它含 "race" 但无关缺陷
+        "ftrace: add trace event for sched_switch",
+        "net: improve xdp throughput",
+        "docs: document the new tracepoint",
+        # 同理 "debug" 含 "bug"
+        "rcu: add debug checks for expedited grace period",
+    ],
+)
+def test_race_and_bug_patterns_respect_word_boundaries(title):
+    """`\\brace\\b` / `\\bbug\\w*\\b` 不得命中 trace、debug。
+
+    这类子串误判会把成片的追踪、调试补丁误判为缺陷修复，
+    比漏判更糟 —— 误报会让维护者不再相信这套分类。
+    """
+    assert classify_by_rules(title, "").kind is not Kind.BUGFIX
+
+
+@pytest.mark.parametrize(
+    "title",
+    [
+        "net: backport from stable commit abc123",
+        "mm: cherry-pick upstream fix",
+        "sched: 回合上游补丁",
+        "arm64: from linux-6.6 commit deadbeef",
+    ],
+)
+def test_backport_annotations(title):
+    """回合补丁需注明来源，这类标注比标题措辞更能说明性质。"""
+    assert classify_by_rules(title, "").kind is Kind.BACKPORT
+
+
+def test_merely_mentioning_upstream_is_not_a_backport():
+    """标题提到 upstream 不等于回合 —— 陈述上游现状的补丁也是常见的。"""
+    result = classify_by_rules("net: align with upstream naming convention", "")
+    assert result.kind is not Kind.BACKPORT
+
+
+# --- 提交信息里的自声明元数据 -----------------------------------------
+
+
+@pytest.mark.parametrize(
+    ("message", "expected"),
+    [
+        ("openEuler inclusion\ncategory: feature\nbugzilla: ...", Kind.FEATURE),
+        ("stable inclusion\nfrom stable-v6.6.64\ncategory: bugfix", Kind.BUGFIX),
+        ("hulk inclusion\ncategory: cleanup", Kind.CLEANUP),
+        ("category: performance", Kind.PERF),
+        # 实测存在拼写错误，容错而不是当成新类别
+        ("category: featrue", Kind.FEATURE),
+        # 未收录的取值不应被臆测成某一类
+        ("category: something-new", None),
+    ],
+)
+def test_parse_commit_category(message, expected):
+    """作者自填的 category 比标题关键词可靠：实测 1264 条提交里 97.7% 都带它。"""
+    declared, _ = parse_commit_metadata([message])
+    assert declared is expected
+
+
+@pytest.mark.parametrize(
+    ("inclusion", "expected"),
+    [
+        ("mainline", Kind.BACKPORT),
+        ("stable", Kind.BACKPORT),
+        ("driver", Kind.DRIVER_UPDATE),
+        ("kunpeng", Kind.SOC_SUPPORT),
+        ("hulk", Kind.OUT_OF_TREE),
+        ("kylin", Kind.OUT_OF_TREE),
+        # 未收录的厂商名仍属非上游集成路径，归入自研而非猜测
+        ("some-vendor", Kind.OUT_OF_TREE),
+    ],
+)
+def test_inclusion_maps_to_kind(inclusion, expected):
+    _, parsed = parse_commit_metadata([f"{inclusion} inclusion\ncategory: feature"])
+    assert parsed == inclusion
+    assert _inclusion_kind(parsed) is expected
+
+
+def test_inclusion_beats_generic_title_rules():
+    """来源标注要压过泛化性质。
+
+    "net: fix NULL deref" 按性质是 bugfix，但它标着 mainline inclusion ——
+    维护者需要知道的是"这是回合上游的补丁"，两者评审方式不同。
+    """
+    result = classify_by_rules("net: fix NULL deref in xfrm", "", ["mainline inclusion"])
+    assert result.kind is Kind.BACKPORT
+
+
+def test_specific_title_beats_inclusion():
+    """具体形态要压过来源标注。
+
+    "Add Phytium i3c controller support" 标着 openEuler inclusion，
+    但"这是一条新增驱动"是更具体的判断。
+    """
+    title = "[OLK-6.6] i3c: Add Phytium i3c controller support"
+    result = classify_by_rules(title, "", ["openEuler inclusion\ncategory: feature"])
+    assert result.kind is Kind.DRIVER_NEW
+
+
+def test_declared_category_is_the_last_resort():
+    """标题判不出来时才用 category，且置信度仍然高于标题关键词匹配。"""
+    result = classify_by_rules("net: improve xdp throughput", "", ["category: feature"])
+    assert result.kind is Kind.FEATURE
+    assert result.confidence >= TITLE_CONFIDENCE
+
+
+# --- 内容类别 ---------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    ("title", "expected"),
+    [
+        ("scsi: leapraid: update driver to v2.00.01.10", Kind.DRIVER_UPDATE),
+        ("[OLK-6.6] Hygon: Add SM3/SM4 CIS driver", Kind.DRIVER_NEW),
+        ("[OLK-6.6]Add Phytium NAND flash controller support", Kind.DRIVER_NEW),
+        ("[OLK-5.10] x86/split_lock: Add support for Zhaoxin", Kind.SOC_SUPPORT),
+        ("LoongArch: add TPM/SM3/SM4/EDAC support", Kind.SOC_SUPPORT),
+        ("urma: fix session UAF and resource leak", Kind.OUT_OF_TREE),
+        ("nfs/enfs: avoid resetting the fault state", Kind.OUT_OF_TREE),
+    ],
+)
+def test_content_categories_from_title(title, expected):
+    """标题层面的内容分类。用于详情尚未同步、拿不到提交信息时的降级判定。"""
+    assert classify_by_rules(title, "").kind is expected
+
+
+def test_soc_vendor_list_excludes_driver_namespaces():
+    """hisi 是驱动命名空间而非处理器厂商，不能算作 SoC 支持。
+
+    实测 "HISI-CCA and HISI-CCA-DA bugfixs" 因此曾被错判成处理器支持。
+    """
+    result = classify_by_rules("HISI-CCA and HISI-CCA-DA bugfixs", "")
+    assert result.kind is Kind.BUGFIX
+
+
+@pytest.mark.parametrize(
+    "title",
+    [
+        # 通用架构前缀是子系统而非厂商，不能算 SoC 支持
+        "arm64: Fix cpu usage error when force_wfi_trap set to 0",
+        "x86/mm: Move root_hpa validity checks",
+        "riscv: use pgd_offset for kernel mapping",
+    ],
+)
+def test_generic_arch_prefix_is_not_soc_support(title):
+    assert classify_by_rules(title, "").kind is not Kind.SOC_SUPPORT
+
+
+def test_kind_enum_covers_model_enum():
+    """领域层的 Kind 与数据库的 PRKind 必须一一对应。
+
+    少一个值的表现是"规则算出来了但写不进库"，属于静默失败。
+    """
+    from app.models.classification import PRKind
+
+    assert {k.value for k in Kind} == {k.value for k in PRKind}
+
+
+def test_ai_kind_drops_cve_without_a_number():
+    """模型不能判 cve。
+
+    规则层只要在正文里匹配到 CVE 编号就直接判 cve，所以走到 AI 补判这一步的
+    对象正文里本来就没有编号 —— 模型说 cve 一定是凭"这是安全修复"的印象，
+    而「CVE 数」是版本汇总里对外报的数字，混进未编号的加固会让那个数字失真。
+    """
+    from app.models.classification import PRKind
+    from app.services.classification_service import normalize_ai_kind
+
+    kind, reason = normalize_ai_kind(PRKind.CVE, "标题提到权限检查")
+    assert kind is PRKind.BUGFIX
+    assert reason and "无 CVE 编号" in reason
+
+
+def test_ai_kind_passes_other_kinds_through_untouched():
+    from app.models.classification import PRKind
+    from app.services.classification_service import normalize_ai_kind
+
+    for kind in (PRKind.BUGFIX, PRKind.FEATURE, PRKind.BACKPORT, PRKind.UNKNOWN):
+        got, reason = normalize_ai_kind(kind, "原因")
+        assert got is kind
+        assert reason == "原因"
+
+
+def test_ai_kind_handles_missing_reason():
+    """模型没给理由时也要留下降级的痕迹，否则这条记录看起来毫无异常。"""
+    from app.models.classification import PRKind
+    from app.services.classification_service import normalize_ai_kind
+
+    kind, reason = normalize_ai_kind(PRKind.CVE, None)
+    assert kind is PRKind.BUGFIX
+    assert reason and "无 CVE 编号" in reason

package/backend/tests/test_config.py

@@ -0,0 +1,41 @@
+import pytest
+from pydantic import ValidationError
+
+from app.core.config import Settings, get_settings
+
+VALID_SECRET = "0123456789abcdef0123456789abcdef"
+
+
+def test_settings_loads_defaults(monkeypatch):
+    monkeypatch.setenv("KSC_SECRET_KEY", VALID_SECRET)
+    settings = Settings(_env_file=None)
+    assert settings.api_prefix == "/api/v1"
+    assert settings.log_level == "INFO"
+    assert settings.access_token_ttl_minutes == 30
+    assert settings.refresh_token_ttl_days == 7
+
+
+def test_secret_key_must_be_at_least_32_chars(monkeypatch):
+    monkeypatch.setenv("KSC_SECRET_KEY", "tooshort")
+    with pytest.raises(ValidationError):
+        Settings(_env_file=None)
+
+
+def test_sync_database_url_uses_psycopg(monkeypatch):
+    monkeypatch.setenv("KSC_SECRET_KEY", VALID_SECRET)
+    monkeypatch.setenv("KSC_DATABASE_URL", "postgresql+asyncpg://u:p@h:5432/db")
+    settings = Settings(_env_file=None)
+    assert settings.sync_database_url == "postgresql+psycopg://u:p@h:5432/db"
+
+
+def test_get_settings_is_cached(monkeypatch):
+    monkeypatch.setenv("KSC_SECRET_KEY", VALID_SECRET)
+    get_settings.cache_clear()
+    assert get_settings() is get_settings()
+    get_settings.cache_clear()
+
+
+def test_is_production_flag(monkeypatch):
+    monkeypatch.setenv("KSC_SECRET_KEY", VALID_SECRET)
+    monkeypatch.setenv("KSC_ENVIRONMENT", "production")
+    assert Settings(_env_file=None).is_production is True

package/backend/tests/test_crypto.py

@@ -0,0 +1,68 @@
+import pytest
+
+from app.core.crypto import CredentialCipher, fingerprint
+
+
+@pytest.fixture
+def cipher():
+    return CredentialCipher(secret_key="0123456789abcdef0123456789abcdef")
+
+
+def test_roundtrip(cipher):
+    secret = "atomgit-token-abcdef123456"
+    assert cipher.decrypt(cipher.encrypt(secret)) == secret
+
+
+def test_handles_unicode_payload(cipher):
+    secret = "令牌-🔑-ümlaut"
+    assert cipher.decrypt(cipher.encrypt(secret)) == secret
+
+
+def test_ciphertext_differs_each_time(cipher):
+    """相同明文两次加密应产生不同密文（随机 nonce）。"""
+    assert cipher.encrypt("same") != cipher.encrypt("same")
+
+
+def test_ciphertext_does_not_contain_plaintext(cipher):
+    assert "super-secret-value" not in cipher.encrypt("super-secret-value")
+
+
+def test_ciphertext_has_version_prefix(cipher):
+    assert cipher.encrypt("x").startswith("v1:")
+
+
+def test_tampered_ciphertext_is_rejected(cipher):
+    version, nonce, payload = cipher.encrypt("original").split(":")
+    tampered = f"{version}:{nonce}:{payload[:-4]}AAAA"
+    with pytest.raises(ValueError, match="认证标签"):
+        cipher.decrypt(tampered)
+
+
+def test_malformed_ciphertext_is_rejected(cipher):
+    with pytest.raises(ValueError, match="密文格式非法"):
+        cipher.decrypt("not-a-valid-token")
+
+
+def test_unknown_version_is_rejected(cipher):
+    _, nonce, payload = cipher.encrypt("x").split(":")
+    with pytest.raises(ValueError, match="不支持的密文版本"):
+        cipher.decrypt(f"v9:{nonce}:{payload}")
+
+
+def test_different_key_cannot_decrypt():
+    a = CredentialCipher(secret_key="0" * 32)
+    b = CredentialCipher(secret_key="1" * 32)
+    with pytest.raises(ValueError):
+        b.decrypt(a.encrypt("secret"))
+
+
+def test_short_key_is_rejected():
+    with pytest.raises(ValueError, match=">= 32"):
+        CredentialCipher(secret_key="short")
+
+
+def test_fingerprint_is_stable_and_short():
+    fp = fingerprint("token-abc")
+    assert fp == fingerprint("token-abc")
+    assert len(fp) == 16
+    assert fingerprint("token-xyz") != fp

package/backend/tests/test_exceptions.py

@@ -0,0 +1,62 @@
+import pytest
+
+from app.core.exceptions import (
+    ConflictError,
+    ExternalServiceError,
+    ForbiddenError,
+    NotFoundError,
+    PlatformError,
+    RateLimitedError,
+    UnauthorizedError,
+    ValidationError,
+)
+
+
+def test_platform_error_carries_status_code_and_context():
+    err = NotFoundError("PR 不存在", resource="pull_request", identifier="123")
+    assert err.status_code == 404
+    assert err.code == "not_found"
+    assert "PR 不存在" in err.detail
+    assert err.context == {"resource": "pull_request", "identifier": "123"}
+
+
+@pytest.mark.parametrize(
+    ("exc_class", "expected_status", "expected_code"),
+    [
+        (ValidationError, 422, "validation_error"),
+        (UnauthorizedError, 401, "unauthorized"),
+        (ForbiddenError, 403, "forbidden"),
+        (NotFoundError, 404, "not_found"),
+        (ConflictError, 409, "conflict"),
+        (RateLimitedError, 429, "rate_limited"),
+        (ExternalServiceError, 502, "external_service_error"),
+    ],
+)
+def test_error_status_and_code(exc_class, expected_status, expected_code):
+    err = exc_class("boom")
+    assert err.status_code == expected_status
+    assert err.code == expected_code
+
+
+def test_base_error_defaults():
+    err = PlatformError("generic")
+    assert err.status_code == 500
+    assert err.code == "internal_error"
+    assert err.title == "Internal Server Error"
+
+
+def test_error_codes_are_distinct():
+    codes = {
+        ValidationError("x").code,
+        UnauthorizedError("x").code,
+        ForbiddenError("x").code,
+        NotFoundError("x").code,
+        ConflictError("x").code,
+        RateLimitedError("x").code,
+        ExternalServiceError("x").code,
+    }
+    assert len(codes) == 7
+
+
+def test_context_defaults_to_empty():
+    assert PlatformError("x").context == {}