claude-multiacc 2.0.66 → 2.0.68

package/tests/test_release_validation.py

@@ -0,0 +1,894 @@
+#!/usr/bin/env python3
+"""Fail closed when release evidence does not match its author and exact source."""
+
+from __future__ import annotations
+
+import copy
+import base64
+from datetime import datetime, timedelta, timezone
+import hashlib
+import io
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tarfile
+import tempfile
+import time
+import unittest
+from unittest import mock
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "scripts"))
+
+import release_validation as validation  # noqa: E402
+import publish_validated as publisher  # noqa: E402
+
+
+class AuthenticatedReleaseTests(unittest.TestCase):
+    NOW = datetime(2026, 10, 25, 12, 0, 0, tzinfo=timezone.utc)
+    TREE = "a" * 40
+    VERSION = "2.0.66"
+    ARTIFACT = "b" * 64
+    ACTOR = "release-maintainer"
+
+    def status(self, context, description, *, age=60, state="success", actor=None, sid=1):
+        stamp = (self.NOW - timedelta(seconds=age)).isoformat().replace("+00:00", "Z")
+        return {
+            "id": sid,
+            "context": context,
+            "description": description,
+            "state": state,
+            "creator": {"login": self.ACTOR if actor is None else actor},
+            "created_at": stamp,
+            "updated_at": stamp,
+        }
+
+    def statuses(self):
+        return [
+            self.status(validation.CONTEXT,
+                        f"v1:{self.TREE}:{validation.POLICY_SHA256}"),
+            self.status(validation.ARTIFACT_CONTEXT,
+                        f"v1:{self.VERSION}:{self.ARTIFACT}", sid=2),
+        ]
+
+    def authenticate(self, statuses, **overrides):
+        arguments = {
+            "tree": self.TREE,
+            "version": self.VERSION,
+            "artifact_sha256": self.ARTIFACT,
+            "actor": self.ACTOR,
+            "now": self.NOW,
+        }
+        arguments.update(overrides)
+        return validation.authenticate(statuses, **arguments)
+
+    def test_matching_authenticated_evidence_is_accepted(self):
+        self.assertIsInstance(self.authenticate(self.statuses()), dict)
+
+    def test_both_independent_statuses_are_required(self):
+        statuses = self.statuses()
+        for evidence in ([], statuses[:1], statuses[1:]):
+            with self.subTest(contexts=[s["context"] for s in evidence]):
+                with self.assertRaises(ValueError):
+                    self.authenticate(evidence)
+
+    def test_either_status_must_succeed_and_come_from_the_required_actor(self):
+        for index in range(2):
+            for field, value in (("state", "failure"), ("state", "error"),
+                                 ("state", "pending"),
+                                 ("creator", {"login": "another-user"}),
+                                 ("creator", {})):
+                with self.subTest(index=index, field=field, value=value):
+                    statuses = self.statuses()
+                    statuses[index][field] = value
+                    with self.assertRaises(ValueError):
+                        self.authenticate(statuses)
+
+    def test_evidence_binds_tree_policy_version_and_artifact(self):
+        variants = (
+            (0, f"v1:{'c' * 40}:{validation.POLICY_SHA256}"),
+            (0, f"v1:{self.TREE}:{'c' * 64}"),
+            (1, f"v1:2.0.67:{self.ARTIFACT}"),
+            (1, f"v1:{self.VERSION}:{'c' * 64}"),
+        )
+        for index, description in variants:
+            with self.subTest(index=index, description=description):
+                statuses = self.statuses()
+                statuses[index]["description"] = description
+                with self.assertRaises(ValueError):
+                    self.authenticate(statuses)
+
+    def test_changed_release_inputs_cannot_reuse_old_evidence(self):
+        for override in ({"tree": "c" * 40}, {"version": "2.0.67"},
+                         {"artifact_sha256": "c" * 64}, {"actor": "another-user"}):
+            with self.subTest(override=override):
+                with self.assertRaises(ValueError):
+                    self.authenticate(self.statuses(), **override)
+
+    def test_invalid_expected_release_identity_is_rejected(self):
+        for override in ({"tree": "not-a-tree"}, {"artifact_sha256": "short"},
+                         {"version": "latest"}, {"actor": ""}, {"actor": "  "}):
+            with self.subTest(override=override):
+                with self.assertRaises(ValueError):
+                    self.authenticate(self.statuses(), **override)
+
+    def test_malformed_or_extended_descriptions_are_not_evidence(self):
+        for index in range(2):
+            for transform in (lambda s: s.replace("v1:", "v2:", 1),
+                              lambda s: s + ":extra", lambda s: "", lambda s: None):
+                statuses = self.statuses()
+                statuses[index]["description"] = transform(statuses[index]["description"])
+                with self.subTest(index=index, description=statuses[index]["description"]):
+                    with self.assertRaises(ValueError):
+                        self.authenticate(statuses)
+
+    def test_newer_non_success_or_untrusted_status_invalidates_old_success(self):
+        for index in range(2):
+            for change in ({"state": "failure"}, {"state": "pending"},
+                           {"creator": {"login": "another-user"}}):
+                statuses = self.statuses()
+                newest = copy.deepcopy(statuses[index])
+                newest.update(change)
+                newest["id"] = 100
+                newest["created_at"] = self.NOW.isoformat()
+                newest["updated_at"] = newest["created_at"]
+                # Do not accidentally accept the first matching success in API input.
+                for ordered in (statuses + [newest], [newest] + statuses):
+                    with self.subTest(index=index, change=change, newest_first=ordered[0] is newest):
+                        with self.assertRaises(ValueError):
+                            self.authenticate(ordered)
+
+    def test_fresh_success_supersedes_an_older_failure(self):
+        statuses = self.statuses()
+        old = copy.deepcopy(statuses[0])
+        old["state"] = "failure"
+        old["created_at"] = (self.NOW - timedelta(hours=2)).isoformat()
+        old["updated_at"] = old["created_at"]
+        self.assertIsInstance(self.authenticate([old] + statuses), dict)
+
+    def test_status_id_breaks_a_same_second_timestamp_tie(self):
+        statuses = self.statuses()
+        newest = copy.deepcopy(statuses[0])
+        newest.update(id=100, state="failure")
+        for ordered in (statuses + [newest], [newest] + statuses):
+            with self.subTest(newest_first=ordered[0] is newest):
+                with self.assertRaises(ValueError):
+                    self.authenticate(ordered)
+
+    def test_stale_future_or_unparseable_timestamps_are_rejected(self):
+        invalid = (
+            (self.NOW - timedelta(hours=24, seconds=1)).isoformat(),
+            (self.NOW + timedelta(seconds=301)).isoformat(),
+            "not-a-timestamp",
+            None,
+        )
+        for index in range(2):
+            for stamp in invalid:
+                statuses = self.statuses()
+                statuses[index]["created_at"] = stamp
+                statuses[index]["updated_at"] = stamp
+                with self.subTest(index=index, stamp=stamp):
+                    with self.assertRaises(ValueError):
+                        self.authenticate(statuses)
+
+    def test_documented_freshness_boundaries_are_inclusive(self):
+        for age in (24 * 3600, -300):
+            statuses = self.statuses()
+            stamp = (self.NOW - timedelta(seconds=age)).isoformat()
+            for status in statuses:
+                status["created_at"] = stamp
+                status["updated_at"] = stamp
+            with self.subTest(age=age):
+                self.assertIsInstance(self.authenticate(statuses), dict)
+
+    def test_unrelated_statuses_do_not_substitute_for_required_contexts(self):
+        extra = self.status("unrelated-check", "anything", state="failure", actor="another-user")
+        self.assertIsInstance(self.authenticate([extra] + self.statuses()), dict)
+        with self.assertRaises(ValueError):
+            self.authenticate([extra])
+
+
+class RepositoryFixture:
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory(prefix="multiacc-release-identity-")
+        self.addCleanup(self.tmp.cleanup)
+        self.root = Path(self.tmp.name)
+        self.env = {**os.environ, "GIT_CONFIG_NOSYSTEM": "1", "GIT_CONFIG_GLOBAL": os.devnull,
+                    "GIT_AUTHOR_NAME": "Release fixture", "GIT_AUTHOR_EMAIL": "release@example.invalid",
+                    "GIT_COMMITTER_NAME": "Release fixture", "GIT_COMMITTER_EMAIL": "release@example.invalid"}
+        self.git("init", "-q")
+        (self.root / "CLAUDE.md").write_text("Fixture instructions.\n")
+        (self.root / "OTHER.md").write_text("Other fixture instructions.\n")
+        (self.root / "AGENTS.md").symlink_to("CLAUDE.md")
+        self.commit()
+
+    def git(self, *args):
+        return subprocess.check_output(["git", "-C", str(self.root), *args],
+                                       env=self.env, text=True, stderr=subprocess.STDOUT).strip()
+
+    def commit(self):
+        self.git("add", "--all")
+        self.git("commit", "-qm", "Fixture source")
+
+
+class GitIdentityTests(RepositoryFixture, unittest.TestCase):
+    def test_clean_repository_identity_uses_committed_head_and_tree(self):
+        identity = validation.git_identity(self.root)
+        self.assertEqual(identity["head"], self.git("rev-parse", "HEAD"))
+        self.assertEqual(identity["tree"], self.git("rev-parse", "HEAD^{tree}"))
+
+    def test_staged_unstaged_and_untracked_changes_are_rejected(self):
+        (self.root / "CLAUDE.md").write_text("Changed source.\n")
+        with self.assertRaises(ValueError):
+            validation.git_identity(self.root)
+        self.git("add", "CLAUDE.md")
+        with self.assertRaises(ValueError):
+            validation.git_identity(self.root)
+        self.commit()
+        (self.root / "untracked-source.py").write_text("print('unvalidated')\n")
+        with self.assertRaises(ValueError):
+            validation.git_identity(self.root)
+
+    def test_symlink_target_change_changes_identity_and_invalidates_receipt(self):
+        previous = validation.git_identity(self.root)
+        (self.root / "AGENTS.md").unlink()
+        (self.root / "AGENTS.md").symlink_to("OTHER.md")
+        self.commit()
+        current = validation.git_identity(self.root)
+        self.assertNotEqual(previous["tree"], current["tree"])
+        case = AuthenticatedReleaseTests()
+        statuses = case.statuses()
+        statuses[0]["description"] = f"v1:{previous['tree']}:{validation.POLICY_SHA256}"
+        with self.assertRaises(ValueError):
+            case.authenticate(statuses, tree=current["tree"])
+
+
+class ReleaseEvidenceTests(RepositoryFixture, unittest.TestCase):
+    REPOSITORY = "owner/claude-multiacc"
+    ACTOR = "release-maintainer"
+    VERSION = "2.0.66"
+
+    def setUp(self):
+        super().setUp()
+        (self.root / "package.json").write_text(json.dumps(
+            {"name": "claude-multiacc", "version": self.VERSION}))
+        self.commit()
+        self.identity = validation.git_identity(self.root)
+        evidence = tempfile.TemporaryDirectory(prefix="multiacc-release-evidence-")
+        self.addCleanup(evidence.cleanup)
+        self.evidence = Path(evidence.name)
+        self.receipt = self.evidence / "receipt.json"
+        (self.evidence / "artifact").mkdir()
+        self.tarball = self.evidence / "artifact" / f"claude-multiacc-{self.VERSION}.tgz"
+        self.tarball.write_bytes(b"validated package fixture")
+        self.artifact = {"filename": self.tarball.name, "sha256": validation.sha256(self.tarball),
+                         "integrity": "sha512-validated-fixture"}
+        self.record = {"schema": 1, **self.identity, "policy_sha256": validation.POLICY_SHA256,
+                       "version": self.VERSION, "completed_at": time.time(),
+                       "checks": [], "artifact": self.artifact}
+        for name, command in validation.CHECKS:
+            log = self.evidence / f"{name}.log"
+            log.write_text(f"Passed {name}\n")
+            self.record["checks"].append({"name": name, "command": list(command),
+                                           "returncode": 0, "log": log.name,
+                                           "log_sha256": validation.sha256(log)})
+        self.write_receipt()
+        self.posts = []
+        self.remote_tree = self.identity["tree"]
+        self.pulls = []
+        self.environment_patch = mock.patch.dict(os.environ, {"GITHUB_ACTIONS": ""})
+        self.environment_patch.start()
+        self.addCleanup(self.environment_patch.stop)
+        self.api_patch = mock.patch.object(validation, "github", side_effect=self.github)
+        self.api = self.api_patch.start()
+        self.addCleanup(self.api_patch.stop)
+
+    def write_receipt(self):
+        self.receipt.write_text(json.dumps(self.record))
+
+    def status(self, context, description, sid):
+        return {"context": context, "description": description, "id": sid,
+                "state": "success", "creator": {"login": self.ACTOR},
+                "created_at": datetime.now(timezone.utc).isoformat()}
+
+    def statuses(self):
+        return [self.status(validation.CONTEXT,
+                            f"v1:{self.identity['tree']}:{validation.POLICY_SHA256}", 1),
+                self.status(validation.ARTIFACT_CONTEXT,
+                            f"v1:{self.VERSION}:{self.artifact['sha256']}", 2)]
+
+    def github(self, endpoint, payload=None):
+        if payload is not None:
+            self.posts.append((endpoint, payload))
+            return self.status(payload["context"], payload["description"], len(self.posts))
+        if endpoint == "user":
+            return {"login": self.ACTOR}
+        if "/git/commits/" in endpoint:
+            return {"tree": {"sha": self.remote_tree}}
+        if endpoint.endswith("/pulls?per_page=100"):
+            return self.pulls
+        if endpoint.endswith("/statuses?per_page=100"):
+            return self.statuses()
+        raise AssertionError(f"unexpected GitHub fixture endpoint: {endpoint}")
+
+    def publish(self):
+        return validation.publish(self.root, self.REPOSITORY, self.receipt)
+
+    def assert_no_attestation(self, error=ValueError):
+        with self.assertRaises(error):
+            self.publish()
+        self.api.assert_not_called()
+        self.assertEqual(self.posts, [])
+
+    def test_valid_receipt_posts_both_exact_head_attestations(self):
+        result = self.publish()
+        self.assertEqual(result["tree"], self.identity["tree"])
+        self.assertEqual(len(self.posts), 2)
+        for endpoint, payload in self.posts:
+            self.assertEqual(endpoint, f"repos/{self.REPOSITORY}/statuses/{self.identity['head']}")
+            self.assertEqual(payload["state"], "success")
+        self.assertEqual({p[1]["context"] for p in self.posts},
+                         {validation.CONTEXT, validation.ARTIFACT_CONTEXT})
+
+    def test_dirty_source_never_posts_an_attestation(self):
+        (self.root / "CLAUDE.md").write_text("Unvalidated source\n")
+        self.assert_no_attestation()
+
+    def test_new_committed_source_cannot_reuse_a_receipt(self):
+        (self.root / "CLAUDE.md").write_text("New committed source\n")
+        self.commit()
+        self.assert_no_attestation()
+
+    def test_missing_check_or_changed_command_cannot_attest(self):
+        original = copy.deepcopy(self.record)
+        for modification in ("missing", "command", "failed", "boolean-returncode"):
+            self.record = copy.deepcopy(original)
+            if modification == "missing":
+                self.record["checks"].pop()
+            elif modification == "command":
+                self.record["checks"][0]["command"] = ["true"]
+            elif modification == "failed":
+                self.record["checks"][0]["returncode"] = 1
+            else:
+                self.record["checks"][0]["returncode"] = False
+            self.write_receipt()
+            with self.subTest(modification=modification):
+                self.assert_no_attestation()
+
+    def test_changed_or_missing_logs_cannot_attest(self):
+        log = self.evidence / self.record["checks"][0]["log"]
+        log.write_text("A replacement log\n")
+        self.assert_no_attestation()
+        log.unlink()
+        self.assert_no_attestation(OSError)
+
+    def test_changed_artifact_cannot_attest(self):
+        self.tarball.write_bytes(b"changed package")
+        self.assert_no_attestation()
+
+    def test_stale_or_future_receipt_cannot_attest(self):
+        for age in (validation.MAX_AGE_SECONDS + 60, -600):
+            self.record["completed_at"] = time.time() - age
+            self.write_receipt()
+            with self.subTest(age=age):
+                self.assert_no_attestation()
+
+    def test_remote_source_mismatch_never_posts_success(self):
+        self.remote_tree = "c" * 40
+        with self.assertRaises(ValueError):
+            self.publish()
+        self.assertEqual(self.posts, [])
+
+    def packed(self, root, output):
+        Path(output).mkdir(parents=True, exist_ok=True)
+        (Path(output) / self.artifact["filename"]).write_bytes(self.tarball.read_bytes())
+        return dict(self.artifact)
+
+    def verify(self):
+        return validation.verify(self.root, self.REPOSITORY, self.ACTOR, self.evidence / "verified")
+
+    def test_direct_commit_verifies_its_own_statuses(self):
+        with mock.patch.object(validation, "pack", side_effect=self.packed):
+            result = self.verify()
+        self.assertEqual(result["validation_head"], self.identity["head"])
+        self.assertTrue((self.evidence / "verified" / "release.json").is_file())
+        self.assertEqual(self.posts, [])
+
+    def merged_pull(self, head=None, repository=None):
+        return {"merged_at": datetime.now(timezone.utc).isoformat(),
+                "merge_commit_sha": self.identity["head"],
+                "head": {"sha": head or "b" * 40,
+                         "repo": {"full_name": repository or self.REPOSITORY}}}
+
+    def test_merged_commit_uses_matching_original_pr_head_evidence(self):
+        self.pulls = [self.merged_pull()]
+        with mock.patch.object(validation, "pack", side_effect=self.packed):
+            result = self.verify()
+        self.assertEqual(result["head"], self.identity["head"])
+        self.assertEqual(result["validation_head"], "b" * 40)
+        self.assertIn(mock.call(f"repos/{self.REPOSITORY}/commits/{'b' * 40}/statuses?per_page=100"),
+                      self.api.call_args_list)
+
+    def test_merge_tree_mismatch_rejects_before_packing(self):
+        self.pulls = [self.merged_pull()]
+        self.remote_tree = "c" * 40
+        with mock.patch.object(validation, "pack") as pack:
+            with self.assertRaises(ValueError):
+                self.verify()
+        pack.assert_not_called()
+        self.assertEqual(self.posts, [])
+
+    def test_foreign_or_ambiguous_pr_head_is_rejected(self):
+        for pulls in ([self.merged_pull(repository="another/repository")],
+                      [self.merged_pull(), self.merged_pull(head="c" * 40)]):
+            self.pulls = pulls
+            with self.subTest(pulls=pulls), mock.patch.object(validation, "pack") as pack:
+                with self.assertRaises(ValueError):
+                    self.verify()
+                pack.assert_not_called()
+
+    def test_source_changed_during_pack_never_produces_verified_record(self):
+        def changed_pack(root, output):
+            artifact = self.packed(root, output)
+            (root / "CLAUDE.md").write_text("Source changed during package creation\n")
+            return artifact
+        with mock.patch.object(validation, "pack", side_effect=changed_pack):
+            with self.assertRaises(ValueError):
+                self.verify()
+        self.assertFalse((self.evidence / "verified" / "release.json").exists())
+
+    def test_repacked_artifact_must_match_authenticated_digest(self):
+        def different_pack(root, output):
+            artifact = self.packed(root, output)
+            artifact["sha256"] = "f" * 64
+            return artifact
+        with mock.patch.object(validation, "pack", side_effect=different_pack):
+            with self.assertRaises(ValueError):
+                self.verify()
+        self.assertFalse((self.evidence / "verified" / "release.json").exists())
+
+    def test_missing_trusted_actor_fails_before_external_requests(self):
+        with self.assertRaises(ValueError):
+            validation.verify(self.root, self.REPOSITORY, "", self.evidence / "verified")
+        self.api.assert_not_called()
+
+
+class ValidatedPublicationTests(RepositoryFixture, unittest.TestCase):
+    VERSION = "2.0.66"
+
+    def setUp(self):
+        super().setUp()
+        (self.root / "package.json").write_text(json.dumps(
+            {"name": "claude-multiacc", "version": self.VERSION}))
+        self.commit()
+        self.identity = validation.git_identity(self.root)
+        artifacts = tempfile.TemporaryDirectory(prefix="multiacc-publication-fixture-")
+        self.addCleanup(artifacts.cleanup)
+        self.output = Path(artifacts.name)
+        self.tarball = self.output / f"claude-multiacc-{self.VERSION}.tgz"
+        self.tarball.write_bytes(b"exact validated release package")
+        self.record = {**self.identity, "version": self.VERSION,
+                       "artifact": {"filename": self.tarball.name,
+                                    "sha256": validation.sha256(self.tarball),
+                                    "integrity": "sha512-" + base64.b64encode(
+                                        hashlib.sha512(self.tarball.read_bytes()).digest()).decode()}}
+        self.release = self.output / "release.json"
+        self.release.write_text(json.dumps(self.record))
+        self.commands = []
+        self.did_publish = False
+        self.publish_error = False
+        self.registry_existing = None
+        self.registry_output = None
+        self.registry_latest = "2.0.65"
+        self.readback_integrity = self.record["artifact"]["integrity"]
+        self.readback_results = []
+        self.readback_calls = 0
+        self.process_timeouts = []
+        self.clock = datetime(2026, 10, 25, 12, 0, tzinfo=timezone.utc).timestamp()
+        self.sleeps = []
+        self.remote_tag = ""
+        self.run_age = 20
+
+    def response(self, argv):
+        self.commands.append(list(argv))
+        if argv == ["git", "rev-parse", "HEAD"]:
+            return 0, self.identity["head"], ""
+        if argv[:2] == ["gh", "api"]:
+            created = datetime.now(timezone.utc) - timedelta(seconds=self.run_age)
+            return 0, json.dumps({"created_at": created.isoformat()}), ""
+        if argv[:3] == ["git", "ls-remote", "--tags"]:
+            return 0, self.remote_tag, ""
+        if argv[:2] == ["npm", "view"]:
+            if argv[2] == "claude-multiacc":
+                return 0, self.registry_latest, ""
+            self.assertEqual(argv[2], f"claude-multiacc@{self.VERSION}")
+            integrity = self.readback_integrity if self.did_publish else self.registry_existing
+            if integrity is None:
+                return 1, "", "npm error code E404"
+            return 0, (json.dumps(integrity) if self.registry_output is None
+                       else self.registry_output), ""
+        if argv[:2] == ["npm", "publish"]:
+            self.did_publish = True
+            return (1, "", "publication response lost") if self.publish_error else (0, "published fixture", "")
+        if argv[:2] in (["git", "config"], ["git", "tag"], ["git", "push"]):
+            return 0, "", ""
+        raise AssertionError(f"unexpected publication command: {argv}")
+
+    def execute(self, argv, root=None, timeout=30):
+        code, out, err = self.response(argv)
+        if code:
+            raise ValueError(err)
+        return out
+
+    def run_process(self, argv, **kwargs):
+        self.process_timeouts.append((list(argv), kwargs.get("timeout"), self.clock))
+        if argv[:3] == ["npm", "view", f"claude-multiacc@{self.VERSION}"] and self.did_publish:
+            self.readback_calls += 1
+            self.assertLess(self.readback_calls, 200, "registry polling must make bounded progress")
+            if self.readback_results:
+                result = self.readback_results.pop(0)
+                if isinstance(result, Exception):
+                    self.commands.append(list(argv))
+                    if isinstance(result, subprocess.TimeoutExpired):
+                        self.clock += kwargs["timeout"]
+                    raise result
+                self.readback_integrity = result
+        code, out, err = self.response(argv)
+        if kwargs.get("check") and code:
+            raise subprocess.CalledProcessError(code, argv, output=out, stderr=err)
+        return subprocess.CompletedProcess(argv, code, stdout=out, stderr=err)
+
+    def publish(self):
+        created = datetime.fromtimestamp(self.clock - self.run_age, timezone.utc)
+        self.deadline = created.timestamp() + 115
+        def sleep(seconds):
+            self.assertGreater(seconds, 0)
+            self.assertLessEqual(seconds, 1)
+            self.sleeps.append(seconds)
+            self.clock += seconds
+        with mock.patch.object(publisher, "execute", side_effect=self.execute), \
+                mock.patch.object(publisher.subprocess, "run", side_effect=self.run_process), \
+                mock.patch.object(publisher.time, "time", side_effect=lambda: self.clock), \
+                mock.patch.object(publisher.time, "sleep", side_effect=sleep):
+            return publisher.publish_release(self.record, self.root, self.output, created)
+
+    def assert_not_published_or_tagged(self):
+        self.assertFalse(self.did_publish)
+        self.assertFalse(any(command[:2] in (["git", "tag"], ["git", "push"])
+                             for command in self.commands), self.commands)
+
+    def test_only_exact_verified_tarball_is_published_then_tagged(self):
+        result = self.publish()
+        publications = [command for command in self.commands if command[:2] == ["npm", "publish"]]
+        self.assertEqual(len(publications), 1)
+        self.assertEqual(publications[0][2], str(self.tarball))
+        self.assertIn("--ignore-scripts", publications[0])
+        self.assertTrue(any(command[:2] == ["git", "push"] for command in self.commands))
+        self.assertEqual(result["integrity"], self.record["artifact"]["integrity"])
+
+    def test_artifact_tamper_prevents_any_external_action(self):
+        self.tarball.write_bytes(b"unvalidated bytes")
+        with self.assertRaises(ValueError):
+            self.publish()
+        self.assertEqual(self.commands, [])
+
+    def test_recorded_integrity_must_match_the_actual_tarball(self):
+        self.record["artifact"]["integrity"] = "sha512-forged"
+        with self.assertRaises(ValueError):
+            self.publish()
+        self.assertEqual(self.commands, [])
+
+    def test_changed_head_prevents_publication(self):
+        self.record["head"] = "c" * 40
+        self.release.write_text(json.dumps(self.record))
+        with self.assertRaises(ValueError):
+            self.publish()
+        self.assert_not_published_or_tagged()
+
+    def test_exhausted_total_run_budget_prevents_publication(self):
+        self.run_age = 130
+        with self.assertRaises(ValueError):
+            self.publish()
+        self.assert_not_published_or_tagged()
+
+    def test_newer_registry_version_blocks_an_unpublished_old_candidate(self):
+        self.registry_latest = "2.0.99"
+        with self.assertRaises(ValueError):
+            self.publish()
+        self.assert_not_published_or_tagged()
+
+    def test_conflicting_remote_tag_is_checked_before_publishing(self):
+        self.remote_tag = f"{'f' * 40}\trefs/tags/v{self.VERSION}\n"
+        with self.assertRaises(ValueError):
+            self.publish()
+        self.assert_not_published_or_tagged()
+
+    def test_conflicting_existing_registry_bytes_are_never_republished(self):
+        self.registry_existing = "sha512-another-artifact"
+        with self.assertRaises(ValueError):
+            self.publish()
+        self.assert_not_published_or_tagged()
+
+    def test_identical_existing_release_repairs_tag_without_republishing(self):
+        self.registry_existing = self.record["artifact"]["integrity"]
+        self.registry_latest = "2.0.99"
+        self.publish()
+        self.assertFalse(self.did_publish)
+        self.assertTrue(any(command[:2] == ["git", "push"] for command in self.commands))
+
+    def test_npm12_existing_singleton_integrity_repairs_tag_without_republishing(self):
+        self.registry_existing = [self.record["artifact"]["integrity"]]
+        self.registry_latest = "2.0.99"
+        result = self.publish()
+        self.assertEqual(result["integrity"], self.record["artifact"]["integrity"])
+        self.assertFalse(self.did_publish)
+        self.assertTrue(any(command[:2] == ["git", "push"] for command in self.commands))
+
+    def test_npm12_singleton_readback_confirms_exact_new_publication(self):
+        self.readback_integrity = [self.record["artifact"]["integrity"]]
+        result = self.publish()
+        self.assertEqual(result["integrity"], self.record["artifact"]["integrity"])
+        self.assertEqual(sum(command[:2] == ["npm", "publish"] for command in self.commands), 1)
+        self.assertTrue(any(command[:2] == ["git", "push"] for command in self.commands))
+
+    def test_npm12_singleton_recovers_a_lost_publish_response(self):
+        self.publish_error = True
+        self.readback_integrity = [self.record["artifact"]["integrity"]]
+        result = self.publish()
+        self.assertEqual(result["integrity"], self.record["artifact"]["integrity"])
+        self.assertEqual(sum(command[:2] == ["npm", "publish"] for command in self.commands), 1)
+        self.assertTrue(any(command[:2] == ["git", "push"] for command in self.commands))
+
+    def test_npm12_conflicting_singleton_integrity_is_never_republished(self):
+        self.registry_existing = ["sha512-another-artifact"]
+        with self.assertRaisesRegex(ValueError, "different bytes"):
+            self.publish()
+        self.assert_not_published_or_tagged()
+
+    def test_malformed_or_ambiguous_integrity_prevents_publication(self):
+        integrity = self.record["artifact"]["integrity"]
+        self.registry_existing = integrity
+        for value in ([], [integrity, integrity], [integrity, "sha512-other"],
+                      [[integrity]], [None], [42], {"integrity": integrity},
+                      None, True, 42, "", [""]):
+            with self.subTest(value=value):
+                self.commands.clear()
+                self.registry_output = json.dumps(value)
+                with self.assertRaisesRegex(ValueError, "ambiguous or malformed"):
+                    self.publish()
+                self.assert_not_published_or_tagged()
+        for output in ("not-json", '["unterminated"', json.dumps(integrity) + " trailing"):
+            with self.subTest(output=output):
+                self.commands.clear()
+                self.registry_output = output
+                with self.assertRaises(ValueError):
+                    self.publish()
+                self.assert_not_published_or_tagged()
+
+    def test_ambiguous_readback_never_creates_a_tag(self):
+        integrity = self.record["artifact"]["integrity"]
+        self.readback_integrity = [integrity, integrity]
+        with self.assertRaisesRegex(ValueError, "ambiguous or malformed"):
+            self.publish()
+        self.assertTrue(self.did_publish)
+        self.assertFalse(any(command[:2] in (["git", "tag"], ["git", "push"])
+                             for command in self.commands), self.commands)
+
+    def test_npm12_mismatched_readback_never_creates_a_tag(self):
+        self.readback_integrity = ["sha512-another-artifact"]
+        with self.assertRaisesRegex(ValueError, "did not confirm"):
+            self.publish()
+        self.assertTrue(self.did_publish)
+        self.assertFalse(any(command[:2] in (["git", "tag"], ["git", "push"])
+                             for command in self.commands), self.commands)
+
+    def test_lost_publish_response_recovers_only_after_exact_registry_readback(self):
+        self.publish_error = True
+        result = self.publish()
+        self.assertEqual(result["integrity"], self.record["artifact"]["integrity"])
+        self.assertEqual(sum(command[:2] == ["npm", "publish"] for command in self.commands), 1)
+        self.assertTrue(any(command[:2] == ["git", "push"] for command in self.commands))
+
+    def test_existing_matching_annotated_tag_needs_no_write(self):
+        self.registry_existing = self.record["artifact"]["integrity"]
+        self.remote_tag = (f"{'f' * 40}\trefs/tags/v{self.VERSION}\n"
+                           f"{self.identity['head']}\trefs/tags/v{self.VERSION}^{{}}\n")
+        self.publish()
+        self.assert_not_published_or_tagged()
+
+    def test_registry_readback_mismatch_prevents_tagging(self):
+        self.readback_integrity = "sha512-not-what-was-validated"
+        with self.assertRaises(ValueError):
+            self.publish()
+        self.assertTrue(self.did_publish)
+        self.assertFalse(any(command[:2] in (["git", "tag"], ["git", "push"])
+                             for command in self.commands), self.commands)
+
+    def test_registry_confirmation_can_arrive_after_more_than_five_misses(self):
+        self.readback_results = [None] * 7 + [self.record["artifact"]["integrity"]]
+        result = self.publish()
+        self.assertEqual(result["integrity"], self.record["artifact"]["integrity"])
+        self.assertEqual(self.readback_calls, 8)
+        self.assertEqual(sum(command[:2] == ["npm", "publish"] for command in self.commands), 1)
+        self.assertTrue(any(command[:2] == ["git", "push"] for command in self.commands))
+        self.assertLessEqual(self.clock, self.deadline - 18)
+
+    def test_missing_confirmation_exhausts_only_readback_budget_without_tagging(self):
+        self.readback_integrity = None
+        with self.assertRaises(publisher.PublicationPending):
+            self.publish()
+        self.assertGreater(self.readback_calls, 5)
+        self.assertGreater(len(self.sleeps), 5)
+        self.assertEqual(self.clock, self.deadline - 18)
+        self.assertTrue(self.did_publish)
+        self.assertFalse(any(command[:2] in (["git", "tag"], ["git", "push"])
+                             for command in self.commands), self.commands)
+
+    def test_timed_out_registry_readback_can_recover_with_exact_bytes(self):
+        self.readback_results = [subprocess.TimeoutExpired("npm view", 8),
+                                 self.record["artifact"]["integrity"]]
+        result = self.publish()
+        self.assertEqual(result["integrity"], self.record["artifact"]["integrity"])
+        self.assertEqual(self.readback_calls, 2)
+        self.assertTrue(any(command[:2] == ["git", "push"] for command in self.commands))
+        self.assertLessEqual(self.clock, self.deadline - 18)
+
+    def test_timeout_near_deadline_cannot_consume_tag_reserve(self):
+        self.run_age = 89.5
+        self.readback_results = [subprocess.TimeoutExpired("npm view", 8)]
+        with self.assertRaises(publisher.PublicationPending):
+            self.publish()
+        self.assertEqual(self.readback_calls, 1)
+        readback = [entry for entry in self.process_timeouts
+                    if entry[0][:3] == ["npm", "view", f"claude-multiacc@{self.VERSION}"]][-1]
+        self.assertEqual(readback[1], 7.5)
+        self.assertEqual(self.clock, self.deadline - 18)
+        self.assertFalse(any(command[:2] in (["git", "tag"], ["git", "push"])
+                             for command in self.commands), self.commands)
+
+
+class PackedArtifactTests(unittest.TestCase):
+    VERSION = "2.0.66"
+
+    def setUp(self):
+        temporary = tempfile.TemporaryDirectory(prefix="multiacc-pack-fixture-")
+        self.addCleanup(temporary.cleanup)
+        self.root = Path(temporary.name) / "source"
+        self.root.mkdir()
+        self.output = Path(temporary.name) / "output"
+        self.output.mkdir()
+        self.package = {"name": "claude-multiacc", "version": self.VERSION}
+        (self.root / "package.json").write_text(json.dumps(self.package))
+        self.filename = f"claude-multiacc-{self.VERSION}.tgz"
+        self.manifests = [self.package]
+        self.npm_output = ""
+
+    def npm_pack(self, argv, root=None, timeout=30):
+        self.assertEqual(argv[:4], ["npm", "pack", "--ignore-scripts", "--pack-destination"])
+        self.assertEqual(root, self.root)
+        destination = Path(argv[4])
+        self.assertNotEqual(destination, self.output)
+        self.assertEqual(list(destination.iterdir()), [])
+        for index, manifest in enumerate(self.manifests):
+            filename = self.filename if index == 0 else f"unexpected-{index}.tgz"
+            with tarfile.open(destination / filename, "w:gz") as archive:
+                if manifest is not None:
+                    data = json.dumps(manifest).encode()
+                    info = tarfile.TarInfo("package/package.json")
+                    info.size = len(data)
+                    archive.addfile(info, io.BytesIO(data))
+        return self.npm_output
+
+    def pack(self):
+        with mock.patch.object(validation, "execute", side_effect=self.npm_pack):
+            return validation.pack(self.root, self.output)
+
+    def test_verified_archive_is_independent_of_npm_output_envelope(self):
+        stale = self.output / "unrelated-previous-package.tgz"
+        stale.write_bytes(b"unrelated earlier artifact")
+        for output in ("", "npm notice package contents\nclaude-multiacc-2.0.66.tgz",
+                       '[{"filename":"wrong.tgz","integrity":"forged"}]',
+                       '{"packages":[{"shasum":"forged"}]}'):
+            with self.subTest(output=output):
+                self.npm_output = output
+                artifact = self.pack()
+                packed = (self.output / self.filename).read_bytes()
+                self.assertEqual(artifact, {
+                    "filename": self.filename,
+                    "sha256": hashlib.sha256(packed).hexdigest(),
+                    "integrity": "sha512-" + base64.b64encode(hashlib.sha512(packed).digest()).decode(),
+                })
+                self.assertEqual(stale.read_bytes(), b"unrelated earlier artifact")
+
+    def test_missing_new_archive_cannot_reuse_an_old_artifact(self):
+        (self.output / self.filename).write_bytes(b"stale existing artifact")
+        self.manifests = []
+        with self.assertRaisesRegex(ValueError, "one package archive"):
+            self.pack()
+
+    def test_multiple_archives_are_rejected(self):
+        self.manifests = [self.package, self.package]
+        with self.assertRaisesRegex(ValueError, "one package archive"):
+            self.pack()
+        self.assertEqual(list(self.output.glob("*.tgz")), [])
+
+    def test_archive_without_package_manifest_is_rejected(self):
+        self.manifests = [None]
+        with self.assertRaises((KeyError, ValueError)):
+            self.pack()
+        self.assertEqual(list(self.output.glob("*.tgz")), [])
+
+    def test_wrong_packed_package_name_or_version_is_rejected(self):
+        for changes in ({"name": "another-package"}, {"version": "2.0.65"}):
+            with self.subTest(changes=changes):
+                self.manifests = [{**self.package, **changes}]
+                with self.assertRaisesRegex(ValueError, "identity differs"):
+                    self.pack()
+                self.assertEqual(list(self.output.glob("*.tgz")), [])
+
+
+class PublicationAttemptTests(unittest.TestCase):
+    CREATED = "2026-10-24T10:00:00Z"
+    STARTED = "2026-10-25T12:00:00Z"
+
+    def setUp(self):
+        temporary = tempfile.TemporaryDirectory(prefix="multiacc-attempt-fixture-")
+        self.addCleanup(temporary.cleanup)
+        self.output = Path(temporary.name)
+        self.release = self.output / "release.json"
+        self.summary = self.output / "summary.md"
+        self.record = {"tree": "a" * 40, "artifact": {"sha256": "b" * 64}}
+        self.release.write_text(json.dumps(self.record))
+        self.environment = {"GITHUB_ACTIONS": "true", "GITHUB_REPOSITORY": "owner/claude-multiacc",
+                            "GITHUB_RUN_ID": "123", "GITHUB_STEP_SUMMARY": str(self.summary)}
+        self.result = {"name": "claude-multiacc", "version": "2.0.66", "tag": "v2.0.66"}
+
+    def main(self, attempt=None, error=None):
+        environment = dict(self.environment)
+        if attempt is not None:
+            environment["GITHUB_RUN_ATTEMPT"] = str(attempt)
+        with mock.patch.dict(os.environ, environment, clear=True), \
+                mock.patch.object(sys, "argv", ["publish_validated.py", "--release", str(self.release)]), \
+                mock.patch.object(publisher, "execute", return_value=json.dumps({
+                    "created_at": self.CREATED, "run_started_at": self.STARTED})) as api, \
+                mock.patch.object(publisher, "publish_release", return_value=self.result,
+                                  side_effect=error) as publish:
+            try:
+                publisher.main()
+            finally:
+                api.assert_called_once_with([
+                    "gh", "api", f"repos/owner/claude-multiacc/actions/runs/123/attempts/{attempt or 1}"])
+                publish.assert_called_once()
+                self.assertEqual(publish.call_args.args[0], self.record)
+                self.assertEqual(publish.call_args.args[2], self.output)
+                self.started = publish.call_args.args[3]
+
+    def test_first_attempt_uses_original_creation_time_including_queue_delay(self):
+        self.main()
+        self.assertEqual(self.started, datetime.fromisoformat(self.CREATED.replace("Z", "+00:00")))
+        summary = self.summary.read_text()
+        self.assertIn(self.CREATED, summary)
+        self.assertIn("attempt 1 started", summary)
+        self.assertIn(self.STARTED, summary)
+
+    def test_rerun_uses_attempt_start_instead_of_old_original_creation(self):
+        self.main(attempt=2)
+        self.assertEqual(self.started, datetime.fromisoformat(self.STARTED.replace("Z", "+00:00")))
+        summary = self.summary.read_text()
+        self.assertIn(self.CREATED, summary)
+        self.assertIn("attempt 2 started", summary)
+        self.assertIn(self.STARTED, summary)
+
+    def test_pending_registry_confirmation_does_not_claim_deployment(self):
+        with self.assertRaises(publisher.PublicationPending):
+            self.main(attempt=2, error=publisher.PublicationPending("not confirmed"))
+        summary = self.summary.read_text()
+        self.assertIn("pending registry confirmation", summary)
+        self.assertIn("not deployed", summary)
+        self.assertNotIn("Published", summary)
+
+
+if __name__ == "__main__":
+    unittest.main()