foxclaw 0.1.0 → 0.1.2

package/python/tests/test_shadow_learning.py

@@ -0,0 +1,330 @@
+"""批次 4 · P0-1 Harness 自学习影子验证 + 回滚 + 边界。
+
+验收(执行计划/文稿附录 C):
+  BLOCK 进 shadow_rules → 观察 N 次 → promote/discard;安全维度禁学。
+覆盖(对应文稿「验证」四条 + 回滚/边界/持久化/事件):
+  1. BLOCK(tool) → 规则进 shadow_rules,**不生效**(不进 rules、不重建索引)
+  2. 影子观察:适用场景计数 observations;双轨 would_block/would_pass
+  3. 观察达标 → promote(移入 rules、生效、history、事件)
+  4. 误伤规则(would_block 率 > 0.3)→ discard;无意义规则(双零)→ discard
+  5. 安全边界:semantic BLOCK 不生成规则(仅权重);未知维度 fail-closed 只记录
+  6. rollback(rule_id):撤出生效、标记 rolled_back、不再生效
+  7. 持久化:shadow_rules/history 落盘,重载后影子状态保留
+  8. 事件:proposed/promoted/discarded/rolled_back 全发出
+"""
+import os
+import sys
+import tempfile
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).parent.parent))
+os.environ.setdefault("FOXCLAW_SKIP_DOTENV", "1")
+os.environ.setdefault("HKC_EMBEDDING", "stub")
+
+CHECKS = []
+
+
+def check(cond, msg):
+    CHECKS.append((bool(cond), msg))
+    print(f"  {'✓' if cond else '✗'} {msg}")
+    if not cond:
+        raise AssertionError(f"断言失败: {msg}")
+
+
+from foxclaw.core.thought_chain import ThoughtChain, ThoughtNode
+from foxclaw.harness.harness import Harness
+
+
+def _tc():
+    return ThoughtChain(db_path=tempfile.mktemp(suffix=".db"))
+
+
+def fresh(tc, promote_min_obs=3, baseline_entities=frozenset({"预算"})):
+    """实判态 harness:跳过阈值校准观测期,固定阈值,小 promote 门槛便于测试。"""
+    h = Harness(agent_id="t", thought_chain=tc,
+                policy_path=tempfile.mktemp(suffix=".yaml"),
+                shadow_rounds=0, promote_min_obs=promote_min_obs)
+    h.register_goal("分析财务预算", allowed_tool_categories={"read", "finance"},
+                    baseline_entities=baseline_entities)
+    h._shadow_mode = False
+    h._block_threshold, h._warn_threshold = 0.25, 0.18
+    return h
+
+
+def node(tc, tool=None, entities=None, content="继续分析预算"):
+    n = ThoughtNode.create(session_id="s", agent_id="t", type="tool_intent",
+                           content=content, conf=0.9,
+                           tool_name=tool, entities=entities or [])
+    tc.add_node(n)
+    return n
+
+
+def events_of(h):
+    """收集 harness bus 本地发出的事件名序列。"""
+    return getattr(h, "_test_events", [])
+
+
+def _tap_events(h):
+    h._test_events = []
+    for ev in ("shadow_rule_proposed", "shadow_rule_promoted",
+               "shadow_rule_discarded", "shadow_rule_rolled_back"):
+        h.bus.on(ev, lambda data, _ev=ev: h._test_events.append(_ev))
+
+
+# ── 1+2. BLOCK 进影子 + 双轨观察 ────────────────────────────
+
+def test_block_goes_to_shadow():
+    print("\n【1】BLOCK → 影子候选(不生效)+ 双轨观察计数")
+    tc = _tc()
+    h = fresh(tc, promote_min_obs=3)
+    _tap_events(h)
+
+    # 越权工具 → BLOCK(dominant=tool)→ 影子候选
+    r = h.check(node(tc, tool="delete_everything"))
+    check(r.is_blocked, "越权工具被 BLOCK(行为不变)")
+    check(not h._is_penalized_tool("delete_everything"),
+          "影子期不生效:工具未被 penalize(未重建索引)")
+    sh_rules = h._policy["shadow_rules"]
+    check(len(sh_rules) == 1, "候选进入 shadow_rules(非 rules)")
+    check(h._policy.get("rules", []) == [], "rules 仍为空(未生效)")
+    sh = sh_rules[0]["shadow"]
+    check(sh["status"] == "observing" and sh["observations"] == 0,
+          "影子账本初始化 observing/0")
+    check("shadow_rule_proposed" in events_of(h), "shadow_rule_proposed 事件已发")
+    check(any(e["event"] == "propose" for e in h._policy["history"]),
+          "history 记 propose")
+
+    # 双轨观察:同维度(tool)、real 不 BLOCK 的场景 → 影子会拦(would_block++)
+    # 用一个**允许集内**的工具:real tool 分 0.0 → real PASS;影子 penalize → tool=1.0 → 影子 BLOCK
+    # 注意 penalize 影子只在 scores.tool>0 时生效(action 语义),允许集内工具 tool=0 → 影子也不拦。
+    # 因此 would_block 的观察需要一个「real 不拦但工具分非零」的场景:用另一个越权但权重不足 BLOCK 的工具。
+    # 简化:直接再 check 同一场景——real 仍 BLOCK(阈值未变),影子也 BLOCK → 双零计数,observations 累积。
+    for _ in range(2):
+        h.check(node(tc, tool="delete_everything"))
+    sh = h._policy["shadow_rules"][0]["shadow"]
+    check(sh["observations"] == 2, f"适用场景 observations 累积(实为 {sh['observations']})")
+    # 第 3 次适用 → 达标判定:双零(would_block=0 且 would_pass=0)→ 无意义 → discard
+    h.check(node(tc, tool="delete_everything"))
+    sh = h._policy["shadow_rules"][0]["shadow"]
+    check(sh["status"] == "discarded",
+          "双零证据(影子与 real 判定完全一致)→ 无意义 → discard")
+    check("shadow_rule_discarded" in events_of(h), "shadow_rule_discarded 事件已发")
+    check(h._policy.get("rules", []) == [], "discard 后 rules 仍为空")
+
+
+# ── 3. promote 路径 ─────────────────────────────────────────
+
+def test_promote_after_evidence():
+    print("\n【2】影子证据达标 → promote(生效 + history + 事件)")
+    tc = _tc()
+    # promote 的判定(文稿):0 < would_block/obs ≤ 0.3(或 would_pass>0)。
+    # 即规则「偶尔多拦一点」才算有价值且非误伤;全拦(>0.3)是误伤 discard,全同(双零) discard。
+    # 构造:promote_min_obs=5,序列 = 1 次「real PASS/影子 BLOCK」(wb=1)+ 4 次「双零」,
+    # 达标时 wb/obs = 1/5 = 0.2 ≤ 0.3 → promote。
+    h = fresh(tc, promote_min_obs=5)
+    _tap_events(h)
+    cand = {
+        "id": "rule_manual_test",
+        "trigger": {"harness_status": "BLOCK", "dominant_dim": "tool",
+                    "delta_threshold": 0.3},
+        "action": {"type": "penalize_tool", "tool_pattern": "suspicious_api",
+                   "weight_delta": -0.3},
+        "created_at": "2026-10-01T00:00:00+00:00",
+        "source": "harness_learned", "agent_id": "t",
+        "shadow": {"created_at": "2026-10-01T00:00:00+00:00",
+                   "observations": 0, "would_block": 0, "would_pass": 0,
+                   "status": "observing"},
+    }
+    h._policy["shadow_rules"].append(cand)
+
+    # suspicious_api 工具分固定 0.5(部分匹配):real delta 未跨阈 → PASS;
+    # 影子 penalize 抬到 1.0 → 跨阈 BLOCK → would_block+1。
+    # 「双零」场景:dominant=tool 的其它工具(real PASS,且影子 penalize 的 pattern
+    # 不匹配它 → 影子不抬分 → 与 real 一致)。适用性按 dominant_dim 匹配,
+    # 这类场景为 cand 累积 observations 但不产生 would_block。
+    orig = h.tool_drift.score
+    h.tool_drift.score = lambda tool, allowed: 0.5 if tool == "suspicious_api" else orig(tool, allowed)
+    try:
+        r = h.check(node(tc, tool="suspicious_api"))     # wb=1, obs=1
+        check(not r.is_blocked, "real 判定 PASS(tool=0.5 未跨阈,影子不拦 real)")
+        for i in range(4):                               # obs=5,双零(pattern 不匹配)
+            h.check(node(tc, tool=f"other_tool_{i}"))
+        rules = h._policy.get("rules", [])
+        check(any(x["id"] == "rule_manual_test" for x in rules),
+              "证据达标(wb/obs=1/5≤0.3)→ promote 到 rules")
+        check(h._policy["shadow_rules"] == [], "shadow_rules 已清空(promote 移出)")
+        check(h._is_penalized_tool("suspicious_api"),
+              "promote 后规则生效(索引重建)")
+        check(any(e["event"] == "promote" for e in h._policy["history"]),
+              "history 记 promote")
+        check("shadow_rule_promoted" in events_of(h), "shadow_rule_promoted 事件已发")
+        # 生效验证:同一工具再来一次 → real 被抬到 1.0 → BLOCK
+        r2 = h.check(node(tc, tool="suspicious_api"))
+        check(r2.is_blocked, "promote 后同一工具被真实 BLOCK(规则级生效闭环)")
+    finally:
+        h.tool_drift.score = orig
+
+
+# ── 4. discard 路径(误伤)──────────────────────────────────
+
+def test_discard_harmful_rule():
+    print("\n【3】误伤规则(would_block 率>0.3)→ discard")
+    tc = _tc()
+    h = fresh(tc, promote_min_obs=3)
+    _tap_events(h)
+    cand = {
+        "id": "rule_harmful",
+        "trigger": {"harness_status": "BLOCK", "dominant_dim": "tool",
+                    "delta_threshold": 0.3},
+        "action": {"type": "penalize_tool", "tool_pattern": "get_balance"},
+        "created_at": "2026-10-01T00:00:00+00:00",
+        "source": "harness_learned", "agent_id": "t",
+        "shadow": {"created_at": "2026-10-01T00:00:00+00:00",
+                   "observations": 0, "would_block": 0, "would_pass": 0,
+                   "status": "observing"},
+    }
+    h._policy["shadow_rules"].append(cand)
+    # get_balance 在允许集外?finance 允许集={"read","finance"},get_balance 不在 → tool=1.0。
+    # real delta=0.3*1.0=0.3 > 0.25 → real BLOCK;影子也 BLOCK → 双零 → 无意义 discard。
+    # 要 would_block 率高:real PASS、影子 BLOCK —— 同【2】操纵分数:
+    orig = h.tool_drift.score
+    h.tool_drift.score = lambda tool, allowed: 0.5 if tool == "get_balance" else orig(tool, allowed)
+    try:
+        # 前 2 次:real PASS 影子 BLOCK → would_block=2;第 3 次达标判定:
+        # would_block/obs = 2/3 ≈ 0.67 > 0.3 → discard(误伤)
+        for _ in range(3):
+            h.check(node(tc, tool="get_balance"))
+        sh = h._policy["shadow_rules"][0]["shadow"]
+        check(sh["status"] == "discarded",
+              f"would_block 率 {sh['would_block']}/{sh['observations']} > 0.3 → discard")
+        check(sh["would_block"] >= 2, "would_block 如实计数(影子会多拦)")
+        check(not h._is_penalized_tool("get_balance"), "误伤规则未生效")
+        check("shadow_rule_discarded" in events_of(h), "discard 事件已发")
+    finally:
+        h.tool_drift.score = orig
+
+
+# ── 5. 安全边界 ─────────────────────────────────────────────
+
+def test_safety_boundary():
+    print("\n【4】安全边界:semantic 仅权重级 / 未知维度 fail-closed")
+    tc = _tc()
+    h = fresh(tc)
+    _tap_events(h)
+
+    # semantic BLOCK:高语义漂移(完全跑题的内容)→ 不生成规则,只调权重
+    w0 = dict(h.weights)
+    r = h.check(node(tc, content="量子力学与黑洞信息悖论的数学形式化推导",
+                     entities=["预算"]))
+    if r.is_blocked and r.dominant_dim == "semantic":
+        check(h._policy.get("shadow_rules", []) == [],
+              "semantic BLOCK 不生成影子规则(仅权重级)")
+        check(h.weights["semantic"] > w0["semantic"],
+              "semantic 权重被上调(权重级学习保留)")
+    else:
+        # stub 向量下语义分可能不足 BLOCK —— 直接驱动内部入口验证分支语义
+        from foxclaw.harness.harness import HarnessResult
+        res = HarnessResult(status="BLOCK", delta=0.9, dominant_dim="semantic",
+                            scores={"semantic": 0.9, "tool": 0.0, "scope": 0.0},
+                            reason="t")
+        h._trigger_policy_learning(node(tc), res)
+        check(h._policy.get("shadow_rules", []) == [],
+              "semantic BLOCK(直驱)不生成影子规则(仅权重级)")
+        check(h.weights["semantic"] > w0["semantic"], "semantic 权重上调")
+
+    # 未知维度:fail-closed,权重都不动,只记录
+    from foxclaw.harness.harness import HarnessResult
+    w1 = dict(h.weights)
+    res = HarnessResult(status="BLOCK", delta=0.9, dominant_dim="financial",
+                        scores={}, reason="t")
+    h._trigger_policy_learning(node(tc), res)
+    check(h.weights == w1, "未知维度 fail-closed:权重不动")
+    check(any(e["event"] == "skip" for e in h._policy["history"]),
+          "未知维度只记录(history skip)")
+    check(h._policy.get("shadow_rules", []) == [], "未知维度不生成规则")
+    check("shadow_rule_proposed" not in events_of(h), "未知维度不发 propose 事件")
+
+
+# ── 6. 回滚 ────────────────────────────────────────────────
+
+def test_rollback():
+    print("\n【5】rollback:撤出生效 + 标记 rolled_back + 不再生效")
+    tc = _tc()
+    h = fresh(tc)
+    _tap_events(h)
+    # 手工放一条已生效规则(模拟已 promote)
+    h._policy["rules"].append({
+        "id": "rule_rb", "trigger": {"dominant_dim": "tool"},
+        "action": {"type": "penalize_tool", "tool_pattern": "bad_tool"},
+        "source": "harness_learned", "agent_id": "t"})
+    h._reindex_learned_actions()
+    check(h._is_penalized_tool("bad_tool"), "前提:规则生效中")
+
+    ok = h.rollback("rule_rb")
+    check(ok, "rollback 返回 True")
+    check(not h._is_penalized_tool("bad_tool"), "回滚后不再生效(索引已重建)")
+    check(h._policy["rules"] == [], "rules 已移除该规则")
+    rb = h._policy["shadow_rules"][0]
+    check(rb["shadow"]["status"] == "rolled_back", "规则标记 rolled_back(保留可审计)")
+    check(any(e["event"] == "rollback" for e in h._policy["history"]),
+          "history 记 rollback")
+    check("shadow_rule_rolled_back" in events_of(h), "rolled_back 事件已发")
+    check(h.rollback("nonexistent") is False, "找不到规则返回 False")
+
+    # rolled_back 的规则不再参与双轨评估
+    h.check(node(tc, tool="bad_tool"))
+    check(h._policy["shadow_rules"][0]["shadow"]["observations"] == 0,
+          "rolled_back 不再参与影子观察")
+
+
+# ── 7. 持久化 ───────────────────────────────────────────────
+
+def test_persistence():
+    print("\n【6】持久化:shadow/history 落盘,重载保留")
+    tc = _tc()
+    p = tempfile.mktemp(suffix=".yaml")
+    h = Harness(agent_id="t", thought_chain=tc, policy_path=p,
+                shadow_rounds=0, promote_min_obs=3)
+    h.register_goal("分析财务预算", allowed_tool_categories={"read", "finance"},
+                    baseline_entities=frozenset({"预算"}))
+    h._shadow_mode = False
+    h.check(node(tc, tool="delete_everything"))     # BLOCK → 影子
+
+    import yaml
+    doc = yaml.safe_load(open(p, encoding="utf-8"))
+    check("shadow_rules" in doc and len(doc["shadow_rules"]) == 1,
+          "shadow_rules 已落盘")
+    check("history" in doc and any(e["event"] == "propose" for e in doc["history"]),
+          "history 已落盘")
+
+    # 重载:影子状态保留,继续观察
+    h2 = Harness(agent_id="t", thought_chain=tc, policy_path=p,
+                 shadow_rounds=0, promote_min_obs=3)
+    h2.register_goal("分析财务预算", allowed_tool_categories={"read", "finance"},
+                     baseline_entities=frozenset({"预算"}))
+    h2._shadow_mode = False
+    check(len(h2._policy["shadow_rules"]) == 1
+          and h2._policy["shadow_rules"][0]["shadow"]["status"] == "observing",
+          "重载后影子规则与观察状态保留")
+    check(not h2._is_penalized_tool("delete_everything"),
+          "重载后影子仍未生效")
+    os.unlink(p)
+
+
+def main():
+    print("=" * 60)
+    print("批次 4 · P0-1 影子学习(shadow→promote/discard+回滚+边界)")
+    print("=" * 60)
+    test_block_goes_to_shadow()
+    test_promote_after_evidence()
+    test_discard_harmful_rule()
+    test_safety_boundary()
+    test_rollback()
+    test_persistence()
+    print("\n" + "=" * 60)
+    print(f"✓ 全部 {len(CHECKS)} 项断言通过")
+    print("=" * 60)
+
+
+if __name__ == "__main__":
+    main()

package/python/tests/test_shared_write.py

@@ -0,0 +1,207 @@
+"""
+共享层写入策略回归 (P0-3) —— 全离线,不依赖 HMR / LLM。
+
+验证:
+  1. facet 归一:{type:<记忆类型>} ∪ tags,且**排除** agent:<id> 隔离标记
+  2. 判定分支:全局允许 / 职责域允许 / 未登记写入方 / 职责域不符
+  3. 三种模式:audit 不拦、warn 不拦、enforce 拦截(抛 SharedWriteDenied)
+  4. 未挂策略时完全向后兼容(返回 None,不抛不记)
+  5. 审计事件:内容只留哈希 + 短预览,不把正文灌进事件流
+  6. **现有 8 处合法共享写入在默认策略下全部放行**(audit 基线不误伤)
+  7. 端到端:MockHMR 挂策略后 ingest(shared=True) 真走闸门
+"""
+import os, sys
+from pathlib import Path
+sys.path.insert(0, str(Path(__file__).parent.parent))
+
+
+def check(cond, msg):
+    if not cond:
+        raise AssertionError(f"✗ {msg}")
+    print(f"  ✓ {msg}")
+
+
+class _FakeSpine:
+    """记录事件的极简脊柱替身(不引入 EventSpine,保持测试独立)。"""
+    def __init__(self):
+        self.events = []
+
+    def publish(self, topic, payload=None, source="", correlation_id=None):
+        self.events.append({"topic": topic, "payload": payload or {}, "source": source})
+
+
+def test_facets():
+    print("\n【1】facet 归一")
+    from foxclaw.core.shared_write import SharedWritePolicy
+    f = SharedWritePolicy.facets_of("decision",
+                                    ["dispatch", "agent:office", "shared", "to:finance"])
+    check(f == ("type:decision", "dispatch", "to:finance"),
+          f"agent:<id> 与 shared 标记均被排除、其余保序去重: {f}")
+    check(SharedWritePolicy.facets_of("", []) == (), "空输入 → 空 facet")
+
+
+def test_evaluate_branches():
+    print("\n【2】判定分支")
+    from foxclaw.core.shared_write import SharedWritePolicy
+    p = SharedWritePolicy(mode="enforce")
+
+    d = p.evaluate("office", "decision", ["finance", "transfer"])
+    check(not d.allowed, f"办公 Agent 写财务域内容 → 拒绝 ({d.reason})")
+
+    d = p.evaluate("supervisor", "decision", ["dispatch", "multi_step"])
+    check(d.allowed, "主管的职责域为 * → 放行")
+
+    d = p.evaluate("office", "preference", ["preference"])
+    check(d.allowed, "全局允许 facet(preference)→ 任何 Agent 放行(偏好本就要跨 Agent)")
+
+    d = p.evaluate("system", "execution", ["truth_pipeline"])
+    check(d.allowed, "真值沉淀(tags=truth_pipeline)放行")
+
+    d = p.evaluate("stranger", "decision", [])
+    check(not d.allowed and "未登记" in d.reason, f"未登记写入方 → 拒绝 ({d.reason})")
+
+    d = p.evaluate(None, "decision", [])
+    check(not d.allowed, "agent_id 缺失(unknown)→ 拒绝")
+
+
+def test_modes():
+    print("\n【3】三种模式")
+    from foxclaw.core.shared_write import (
+        SharedWritePolicy, guard_shared_write, SharedWriteDenied)
+
+    class _Backend:
+        pass
+
+    for mode, should_raise in (("audit", False), ("warn", False), ("enforce", True)):
+        be = _Backend()
+        be.shared_write_policy = SharedWritePolicy(mode=mode)
+        be.shared_write_spine = _FakeSpine()
+        raised = False
+        try:
+            guard_shared_write(be, "office", "财务应给办公转账", "decision", ["finance"])
+        except SharedWriteDenied:
+            raised = True
+        check(raised == should_raise, f"mode={mode} → 越界写入{'被拦截' if should_raise else '放行'}")
+
+    # 放行的情况下也必须留下事件(audit 的价值就在"看得见")
+    be = _Backend(); be.shared_write_policy = SharedWritePolicy(mode="audit")
+    be.shared_write_spine = _FakeSpine()
+    guard_shared_write(be, "office", "x", "decision", ["finance"])
+    evs = [e for e in be.shared_write_spine.events if e["topic"] == "memory.shared.write"]
+    check(len(evs) == 1 and evs[0]["payload"]["allowed"] is False,
+          "audit 模式:虽放行,但事件里标 allowed=False(可见)")
+    check(evs[0]["payload"]["mode"] == "audit", "事件带 mode,便于区分灰度阶段")
+
+
+def test_backward_compat():
+    print("\n【4】未挂策略 → 完全向后兼容")
+    from foxclaw.core.shared_write import guard_shared_write
+
+    class _Bare:
+        pass
+
+    check(guard_shared_write(_Bare(), "office", "x", "decision", ["finance"]) is None,
+          "未挂策略的 backend → 返回 None(不抛、不记)")
+
+
+def test_audit_payload_privacy():
+    print("\n【5】审计事件不留正文")
+    from foxclaw.core.shared_write import SharedWritePolicy, guard_shared_write
+
+    class _B:
+        pass
+    be = _B(); be.shared_write_policy = SharedWritePolicy(mode="audit")
+    be.shared_write_spine = _FakeSpine()
+    # 造一条**明显长于预览上限**的内容,才能验证"截断"这件事本身
+    secret = "开头" + "填" * 120 + "结尾不应出现"
+    guard_shared_write(be, "office", secret, "decision", ["finance"])
+    p = be.shared_write_spine.events[0]["payload"]
+    check(len(p["content_preview"]) <= 60, "预览截断到 ≤60 字符")
+    check("结尾不应出现" not in p["content_preview"], "超出预览上限的部分不进事件流")
+    check(len(p["content_sha"]) == 16, "同时留 16 位摘要哈希,便于比对同一内容")
+
+
+def test_existing_legitimate_writes_pass():
+    print("\n【6】现有 8 处合法共享写入,默认策略下全部放行(基线不误伤)")
+    from foxclaw.core.shared_write import SharedWritePolicy
+    p = SharedWritePolicy(mode="audit")
+
+    # 逐条取自真实调用点(memory_adapter 之前 grep 出的 shared=True 处)
+    cases = [
+        # (说明, agent_id, memory_type, tags)  —— 取自 agents.py 主管分发路径
+        ("主管·多步记录",   "supervisor", "decision", ["dispatch", "multi_step", "to:office"]),
+        ("主管·并行记录",   "supervisor", "decision", ["dispatch", "parallel", "to:finance"]),
+        ("主管·自答记录",   "supervisor", "decision", []),
+        # 取自 base.py 偏好共享(任何 Agent 都可能执行,这里取 office 这个"最受限"的)
+        ("偏好共享(办公)", "office",     "preference", ["preference"]),
+        ("偏好共享(助手)", "assistant",  "preference", ["preference"]),
+        # 取自 truth_pipeline.py 真值沉淀
+        ("真值沉淀",        "system",     "execution", ["truth_pipeline"]),
+    ]
+    bad = [(n, p.evaluate(a, t, g).reason) for n, a, t, g in cases
+           if not p.evaluate(a, t, g).allowed]
+    check(not bad, f"默认策略对现有合法写入零误伤(越界项: {bad})")
+
+
+def test_end_to_end_mock_backend():
+    print("\n【7】端到端:MockHMR 挂策略后 ingest(shared=True) 真走闸门")
+    from foxclaw.core.memory_adapter import MockHMR
+    from foxclaw.core.shared_write import (
+        SharedWritePolicy, attach, SharedWriteDenied)
+
+    be = MockHMR()
+    spine = _FakeSpine()
+
+    # 不共享的写入:不该产生任何共享事件
+    be.ingest("普通记忆", agent_id="office")
+    check(not spine.events, "shared=False → 闸门不介入(零事件)")
+
+    attach(be, SharedWritePolicy(mode="enforce"), spine=spine)
+    be.ingest("办公读书记录", agent_id="office", type="concept", tags=["preference"],
+              shared=True)
+    check(len(spine.events) == 1, "shared=True → 产生 memory.shared.write 事件")
+
+    try:
+        be.ingest("财务应给办公转账", agent_id="office", type="decision",
+                  tags=["finance"], shared=True)
+        check(False, "enforce 下办公 Agent 写财务域应被拒")
+    except SharedWriteDenied as e:
+        check("office" in str(e), f"越界写入被拦截: {e}")
+
+
+def test_mode_resolution():
+    print("\n【8】模式解析优先级")
+    from foxclaw.core.shared_write import SharedWritePolicy
+    old = os.environ.get("FOXCLAW_SHARED_WRITE_MODE")
+    try:
+        os.environ["FOXCLAW_SHARED_WRITE_MODE"] = "enforce"
+        check(SharedWritePolicy().mode == "enforce", "环境变量生效")
+        check(SharedWritePolicy(mode="audit").mode == "audit", "显式入参优先于环境变量")
+        os.environ["FOXCLAW_SHARED_WRITE_MODE"] = "乱填的值"
+        check(SharedWritePolicy().mode == "audit", "非法值回落 audit(保守:不拦截)")
+    finally:
+        if old is None:
+            os.environ.pop("FOXCLAW_SHARED_WRITE_MODE", None)
+        else:
+            os.environ["FOXCLAW_SHARED_WRITE_MODE"] = old
+
+
+def main():
+    print("=" * 60)
+    print("共享层写入策略(P0-3)")
+    print("=" * 60)
+    test_facets()
+    test_evaluate_branches()
+    test_modes()
+    test_backward_compat()
+    test_audit_payload_privacy()
+    test_existing_legitimate_writes_pass()
+    test_end_to_end_mock_backend()
+    test_mode_resolution()
+    print("\n" + "=" * 60)
+    print("✓ 共享层写入策略验证完成")
+    print("=" * 60)
+
+
+if __name__ == "__main__":
+    main()