foxclaw 0.1.0 → 0.1.3

package/python/tests/test_settings.py

@@ -0,0 +1,265 @@
+"""配置校验(core/settings.py)的行为测试。
+
+立这些档的目的是让"配置错时的提示"本身成为被测试的对象:它比崩溃更容易腐坏 ——
+提示错了没人会发现,只会让用户在错误的方向上改。
+"""
+import json
+
+import pytest
+
+from foxclaw import cli
+from foxclaw.core import settings
+
+
+@pytest.fixture(autouse=True)
+def _reset_warned(monkeypatch):
+    monkeypatch.setattr(settings, "_warned", set())
+
+
+def test_get_int_reads_value(monkeypatch):
+    monkeypatch.setenv("FOXCLAW_PORT", "9001")
+    assert settings.get_int("FOXCLAW_PORT") == 9001
+
+
+def test_get_int_blank_means_default(monkeypatch):
+    monkeypatch.setenv("FOXCLAW_PORT", "   ")
+    assert settings.get_int("FOXCLAW_PORT") == 8000
+
+
+def test_get_int_unset_means_default(monkeypatch):
+    monkeypatch.delenv("FOXCLAW_PORT", raising=False)
+    assert settings.get_int("FOXCLAW_PORT") == 8000
+
+
+def test_get_int_bad_value_names_variable_and_caller(monkeypatch):
+    monkeypatch.setenv("FOXCLAW_PORT", "80oo")
+    with pytest.raises(settings.ConfigError) as ei:
+        settings.get_int("FOXCLAW_PORT")
+    msg = str(ei.value)
+    assert "FOXCLAW_PORT" in msg and "80oo" in msg
+    assert "期望" in msg and "8000" in msg
+    assert "test_settings.py" in msg
+
+
+def test_get_int_below_min(monkeypatch):
+    monkeypatch.setenv("FOXCLAW_GATEWAY_RATE", "-5")
+    with pytest.raises(settings.ConfigError):
+        settings.get_int("FOXCLAW_GATEWAY_RATE")
+
+
+def test_fractional_timeout_allowed(monkeypatch):
+    monkeypatch.setenv("FOXCLAW_TOOL_TIMEOUT", "0.3")
+    assert settings.get_float("FOXCLAW_TOOL_TIMEOUT") == pytest.approx(0.3)
+
+
+def test_get_float_accepts_int_text(monkeypatch):
+    monkeypatch.setenv("FOXCLAW_LLM_COOLDOWN", "30")
+    assert settings.get_float("FOXCLAW_LLM_COOLDOWN") == 30.0
+
+
+def test_get_safe_degrades_and_warns_once(monkeypatch, caplog):
+    monkeypatch.setenv("FOXCLAW_TRACE_SLOW_MS", "慢")
+    with caplog.at_level("WARNING", logger="foxclaw.config"):
+        assert settings.get_safe("FOXCLAW_TRACE_SLOW_MS") == 1000.0
+        assert settings.get_safe("FOXCLAW_TRACE_SLOW_MS") == 1000.0
+    assert sum("FOXCLAW_TRACE_SLOW_MS" in r.message for r in caplog.records) == 1
+
+
+def test_get_safe_unknown_name_returns_default(monkeypatch):
+    monkeypatch.setenv("SOME_UNDECLARED_KNOB", "abc")
+    assert settings.get_safe("SOME_UNDECLARED_KNOB", "dflt") == "abc"
+    assert settings.get_safe("NOT_SET_AT_ALL_X", 7) == 7
+
+
+def _clean(monkeypatch, *keys):
+    """清掉一组变量,避免宿主机上真实存在的键干扰断言。"""
+    for k in keys:
+        monkeypatch.delenv(k, raising=False)
+
+
+def test_check_flags_type_error_without_raising(monkeypatch):
+    monkeypatch.setenv("FOXCLAW_PORT", "80oo")
+    issues = settings.check({"FOXCLAW_PORT": "80oo", "DEEPSEEK_API_KEY": "x"})
+    errs = [i for i in issues if i.level == "error"]
+    assert len(errs) == 1 and errs[0].code == "type" and errs[0].name == "FOXCLAW_PORT"
+    assert errs[0].hint == ""
+
+
+def test_check_collects_multiple_errors(monkeypatch):
+    env = {"FOXCLAW_PORT": "x", "FOXCLAW_GATEWAY_RATE": "y",
+           "DEEPSEEK_API_KEY": "k"}
+    names = {i.name for i in settings.check(env) if i.level == "error"}
+    assert {"FOXCLAW_PORT", "FOXCLAW_GATEWAY_RATE"} <= names
+
+
+def test_check_choice_error(monkeypatch):
+    issues = settings.check({"LLM_PROVIDER": "deepsek", "DEEPSEEK_API_KEY": "k"})
+    codes = {(i.code, i.name) for i in issues if i.level == "error"}
+    assert ("choice", "LLM_PROVIDER") in codes
+
+
+def test_check_clean_env_has_no_error():
+    assert [i for i in settings.check({"DEEPSEEK_API_KEY": "k"}) if i.level == "error"] == []
+
+
+def test_check_secret_value_is_masked_in_message():
+    issues = settings.check({"LLM_PROVIDER": "openai", "OPENAI_API_KEY": " sk-live-1234567890 "})
+    msg = " ".join(i.message for i in issues)
+    assert "sk-live-1234567890" not in msg
+
+
+def test_provider_without_key_is_error():
+    issues = settings.check({"LLM_PROVIDER": "deepseek", "ANTHROPIC_API_KEY": ""})
+    hit = [i for i in issues if i.code == "provider_key"]
+    assert hit and hit[0].level == "error" and hit[0].name == "DEEPSEEK_API_KEY"
+
+
+def test_provider_with_key_is_fine():
+    issues = settings.check({"LLM_PROVIDER": "deepseek", "DEEPSEEK_API_KEY": "k"})
+    assert not [i for i in issues if i.code == "provider_key"]
+
+
+def test_legacy_provider_name_also_checked():
+    issues = settings.check({"FOXCLAW_PROVIDER": "openai"})
+    assert [i for i in issues if i.code == "provider_key"]
+
+
+def test_no_key_at_all_is_warn_not_error():
+    issues = settings.check({})
+    hit = [i for i in issues if i.code == "no_llm"]
+    assert hit and hit[0].level == "warn"
+
+
+def test_typo_key_is_flagged_with_suggestion():
+    issues = settings.check({"DEEPSEEK_API_KEY": "k", "FOXCLAW_TOOL_TIMEOUTS": "60"})
+    hit = [i for i in issues if i.name == "FOXCLAW_TOOL_TIMEOUTS"]
+    assert hit and hit[0].code == "unknown_key"
+    assert "FOXCLAW_TOOL_TIMEOUT" in hit[0].hint
+
+
+def test_known_key_is_not_flagged():
+    issues = settings.check({"FOXCLAW_TOOL_TIMEOUT": "60", "DEEPSEEK_API_KEY": "k"})
+    assert not [i for i in issues if i.name == "FOXCLAW_TOOL_TIMEOUT"]
+
+
+def test_system_env_vars_are_not_flagged():
+    issues = settings.check({"PATH": "/usr/bin", "DEEPSEEK_API_KEY": "k"})
+    assert not [i for i in issues if i.name == "PATH"]
+
+
+def test_known_keys_covers_real_usage():
+    known = settings.known_keys()
+    for name in ("FOXCLAW_PORT", "FOXCLAW_TOOL_TIMEOUT", "DEEPSEEK_API_KEY",
+                 "FOXCLAW_CHANNEL_SIGNING_SECRET"):
+        assert name in known
+    assert "NOT_A_REAL_KEY_NAME" not in known
+
+
+def test_signing_key_id_without_secret_warns():
+    issues = settings.check({"DEEPSEEK_API_KEY": "k",
+                             "FOXCLAW_CHANNEL_SIGNING_KEY_ID": "k2"})
+    assert [i for i in issues if i.code == "signing_pair"]
+
+
+def test_short_signing_secret_warns():
+    issues = settings.check({"DEEPSEEK_API_KEY": "k",
+                             "FOXCLAW_CHANNEL_SIGNING_SECRET": "short"})
+    assert [i for i in issues if i.code == "weak_secret"]
+
+
+def test_open_cors_without_api_key_warns():
+    issues = settings.check({"DEEPSEEK_API_KEY": "k", "FOXCLAW_CORS_ORIGINS": "*"})
+    assert [i for i in issues if i.code == "open_cors"]
+
+
+def test_gateway_off_with_api_key_warns():
+    issues = settings.check({"DEEPSEEK_API_KEY": "k", "FOXCLAW_API_KEY": "s3cret",
+                             "FOXCLAW_GATEWAY": "0"})
+    assert [i for i in issues if i.code == "gateway_off"]
+
+
+@pytest.mark.parametrize("value,expect", [("", "(空)"), ("abcd", "****"),
+                                          ("sk-1234567890", "sk******90")])
+def test_mask(value, expect):
+    assert settings.mask(value) == expect
+
+
+def test_is_secret_heuristics():
+    assert settings.is_secret("DEEPSEEK_API_KEY")
+    assert settings.is_secret("SOME_TOKEN_X")
+    assert settings.is_secret("AMAP_JS_SCODE")
+    assert not settings.is_secret("FOXCLAW_PORT")
+
+
+def test_format_issues_counts_and_limit():
+    issues = [settings.Issue("error", "type", f"K{i}", "m") for i in range(5)]
+    out = settings.format_issues(issues, limit=2)
+    assert "5 个错误" in out and "另有 3 条" in out
+
+
+def test_format_issues_clean():
+    assert "通过" in settings.format_issues([])
+
+
+def test_fatal_issues_only_type_and_choice():
+    issues = [settings.Issue("error", "type", "A", "m"),
+              settings.Issue("error", "provider_key", "B", "m"),
+              settings.Issue("warn", "type", "C", "m")]
+    assert [i.name for i in settings.fatal_issues(issues)] == ["A"]
+
+
+def test_cli_config_check_exit_code_on_error(monkeypatch, capsys):
+    monkeypatch.setenv("FOXCLAW_PORT", "80oo")
+    assert cli.main(["config", "check"]) == 1
+    out = capsys.readouterr().out
+    assert "FOXCLAW_PORT" in out and "80oo" in out
+
+
+def test_cli_config_check_clean_exit_zero(monkeypatch, capsys):
+    monkeypatch.setenv("DEEPSEEK_API_KEY", "k")
+    monkeypatch.delenv("FOXCLAW_PORT", raising=False)
+    assert cli.main(["config", "check"]) == 0
+    assert "配置检查" in capsys.readouterr().out
+
+
+def test_cli_config_check_json(monkeypatch, capsys):
+    monkeypatch.setenv("FOXCLAW_PORT", "80oo")
+    cli.main(["config", "check", "--json"])
+    data = json.loads(capsys.readouterr().out)
+    assert isinstance(data, list) and data[0]["name"] == "FOXCLAW_PORT"
+
+
+def test_cli_config_without_action_is_usage_error(capsys):
+    assert cli.main(["config"]) == 2
+    assert "config check" in capsys.readouterr().out
+
+
+def test_cli_config_show_masks_secrets(monkeypatch, capsys):
+    monkeypatch.setenv("DEEPSEEK_API_KEY", "sk-abcdef123456")
+    cli.main(["config", "show"])
+    out = capsys.readouterr().out
+    assert "sk-abcdef123456" not in out and "DEEPSEEK_API_KEY" in out
+
+
+def test_cli_config_show_reveal(monkeypatch, capsys):
+    monkeypatch.setenv("DEEPSEEK_API_KEY", "sk-abcdef123456")
+    cli.main(["config", "show", "--reveal"])
+    assert "sk-abcdef123456" in capsys.readouterr().out
+
+
+def test_serve_aborts_before_starting_on_bad_type(monkeypatch):
+    monkeypatch.setenv("FOXCLAW_PORT", "80oo")
+    args = cli.build_parser().parse_args(["serve"])
+    assert cli._cmd_serve(args) == 2
+
+
+def test_serve_semantic_warning_does_not_block(monkeypatch):
+    monkeypatch.setenv("FOXCLAW_CORS_ORIGINS", "*")
+    monkeypatch.setenv("DEEPSEEK_API_KEY", "k")
+    args = cli.build_parser().parse_args(["serve"])
+    import sys
+    import types
+    fake = types.ModuleType("uvicorn")
+    fake.run = lambda *a, **k: None
+    monkeypatch.setitem(sys.modules, "uvicorn", fake)
+    assert cli._cmd_serve(args) == 0

package/python/tests/test_shadow_learning.py

@@ -0,0 +1,290 @@
+"""批次 4 · P0-1 Harness 自学习影子验证 + 回滚 + 边界。
+
+验收(执行计划/文稿附录 C):
+  BLOCK 进 shadow_rules → 观察 N 次 → promote/discard;安全维度禁学。
+覆盖(对应文稿「验证」四条 + 回滚/边界/持久化/事件):
+  1. BLOCK(tool) → 规则进 shadow_rules,**不生效**(不进 rules、不重建索引)
+  2. 影子观察:适用场景计数 observations;双轨 would_block/would_pass
+  3. 观察达标 → promote(移入 rules、生效、history、事件)
+  4. 误伤规则(would_block 率 > 0.3)→ discard;无意义规则(双零)→ discard
+  5. 安全边界:semantic BLOCK 不生成规则(仅权重);未知维度 fail-closed 只记录
+  6. rollback(rule_id):撤出生效、标记 rolled_back、不再生效
+  7. 持久化:shadow_rules/history 落盘,重载后影子状态保留
+  8. 事件:proposed/promoted/discarded/rolled_back 全发出
+"""
+import os
+import sys
+import tempfile
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).parent.parent))
+os.environ.setdefault("FOXCLAW_SKIP_DOTENV", "1")
+os.environ.setdefault("HKC_EMBEDDING", "stub")
+
+CHECKS = []
+
+
+def check(cond, msg):
+    CHECKS.append((bool(cond), msg))
+    print(f"  {'✓' if cond else '✗'} {msg}")
+    if not cond:
+        raise AssertionError(f"断言失败: {msg}")
+
+
+from foxclaw.core.thought_chain import ThoughtChain, ThoughtNode
+from foxclaw.harness.harness import Harness
+
+
+def _tc():
+    return ThoughtChain(db_path=tempfile.mktemp(suffix=".db"))
+
+
+def fresh(tc, promote_min_obs=3, baseline_entities=frozenset({"预算"})):
+    """实判态 harness:跳过阈值校准观测期,固定阈值,小 promote 门槛便于测试。"""
+    h = Harness(agent_id="t", thought_chain=tc,
+                policy_path=tempfile.mktemp(suffix=".yaml"),
+                shadow_rounds=0, promote_min_obs=promote_min_obs)
+    h.register_goal("分析财务预算", allowed_tool_categories={"read", "finance"},
+                    baseline_entities=baseline_entities)
+    h._shadow_mode = False
+    h._block_threshold, h._warn_threshold = 0.25, 0.18
+    return h
+
+
+def node(tc, tool=None, entities=None, content="继续分析预算"):
+    n = ThoughtNode.create(session_id="s", agent_id="t", type="tool_intent",
+                           content=content, conf=0.9,
+                           tool_name=tool, entities=entities or [])
+    tc.add_node(n)
+    return n
+
+
+def events_of(h):
+    """收集 harness bus 本地发出的事件名序列。"""
+    return getattr(h, "_test_events", [])
+
+
+def _tap_events(h):
+    h._test_events = []
+    for ev in ("shadow_rule_proposed", "shadow_rule_promoted",
+               "shadow_rule_discarded", "shadow_rule_rolled_back"):
+        h.bus.on(ev, lambda data, _ev=ev: h._test_events.append(_ev))
+
+
+def test_block_goes_to_shadow():
+    print("\n【1】BLOCK → 影子候选(不生效)+ 双轨观察计数")
+    tc = _tc()
+    h = fresh(tc, promote_min_obs=3)
+    _tap_events(h)
+
+    r = h.check(node(tc, tool="delete_everything"))
+    check(r.is_blocked, "越权工具被 BLOCK(行为不变)")
+    check(not h._is_penalized_tool("delete_everything"),
+          "影子期不生效:工具未被 penalize(未重建索引)")
+    sh_rules = h._policy["shadow_rules"]
+    check(len(sh_rules) == 1, "候选进入 shadow_rules(非 rules)")
+    check(h._policy.get("rules", []) == [], "rules 仍为空(未生效)")
+    sh = sh_rules[0]["shadow"]
+    check(sh["status"] == "observing" and sh["observations"] == 0,
+          "影子账本初始化 observing/0")
+    check("shadow_rule_proposed" in events_of(h), "shadow_rule_proposed 事件已发")
+    check(any(e["event"] == "propose" for e in h._policy["history"]),
+          "history 记 propose")
+
+    for _ in range(2):
+        h.check(node(tc, tool="delete_everything"))
+    sh = h._policy["shadow_rules"][0]["shadow"]
+    check(sh["observations"] == 2, f"适用场景 observations 累积(实为 {sh['observations']})")
+    h.check(node(tc, tool="delete_everything"))
+    sh = h._policy["shadow_rules"][0]["shadow"]
+    check(sh["status"] == "discarded",
+          "双零证据(影子与 real 判定完全一致)→ 无意义 → discard")
+    check("shadow_rule_discarded" in events_of(h), "shadow_rule_discarded 事件已发")
+    check(h._policy.get("rules", []) == [], "discard 后 rules 仍为空")
+
+
+def test_promote_after_evidence():
+    print("\n【2】影子证据达标 → promote(生效 + history + 事件)")
+    tc = _tc()
+    h = fresh(tc, promote_min_obs=5)
+    _tap_events(h)
+    cand = {
+        "id": "rule_manual_test",
+        "trigger": {"harness_status": "BLOCK", "dominant_dim": "tool",
+                    "delta_threshold": 0.3},
+        "action": {"type": "penalize_tool", "tool_pattern": "suspicious_api",
+                   "weight_delta": -0.3},
+        "created_at": "2026-10-01T00:00:00+00:00",
+        "source": "harness_learned", "agent_id": "t",
+        "shadow": {"created_at": "2026-10-01T00:00:00+00:00",
+                   "observations": 0, "would_block": 0, "would_pass": 0,
+                   "status": "observing"},
+    }
+    h._policy["shadow_rules"].append(cand)
+
+    orig = h.tool_drift.score
+    h.tool_drift.score = lambda tool, allowed: 0.5 if tool == "suspicious_api" else orig(tool, allowed)
+    try:
+        r = h.check(node(tc, tool="suspicious_api"))
+        check(not r.is_blocked, "real 判定 PASS(tool=0.5 未跨阈,影子不拦 real)")
+        for i in range(4):
+            h.check(node(tc, tool=f"other_tool_{i}"))
+        rules = h._policy.get("rules", [])
+        check(any(x["id"] == "rule_manual_test" for x in rules),
+              "证据达标(wb/obs=1/5≤0.3)→ promote 到 rules")
+        check(h._policy["shadow_rules"] == [], "shadow_rules 已清空(promote 移出)")
+        check(h._is_penalized_tool("suspicious_api"),
+              "promote 后规则生效(索引重建)")
+        check(any(e["event"] == "promote" for e in h._policy["history"]),
+              "history 记 promote")
+        check("shadow_rule_promoted" in events_of(h), "shadow_rule_promoted 事件已发")
+        r2 = h.check(node(tc, tool="suspicious_api"))
+        check(r2.is_blocked, "promote 后同一工具被真实 BLOCK(规则级生效闭环)")
+    finally:
+        h.tool_drift.score = orig
+
+
+def test_discard_harmful_rule():
+    print("\n【3】误伤规则(would_block 率>0.3)→ discard")
+    tc = _tc()
+    h = fresh(tc, promote_min_obs=3)
+    _tap_events(h)
+    cand = {
+        "id": "rule_harmful",
+        "trigger": {"harness_status": "BLOCK", "dominant_dim": "tool",
+                    "delta_threshold": 0.3},
+        "action": {"type": "penalize_tool", "tool_pattern": "get_balance"},
+        "created_at": "2026-10-01T00:00:00+00:00",
+        "source": "harness_learned", "agent_id": "t",
+        "shadow": {"created_at": "2026-10-01T00:00:00+00:00",
+                   "observations": 0, "would_block": 0, "would_pass": 0,
+                   "status": "observing"},
+    }
+    h._policy["shadow_rules"].append(cand)
+    orig = h.tool_drift.score
+    h.tool_drift.score = lambda tool, allowed: 0.5 if tool == "get_balance" else orig(tool, allowed)
+    try:
+        for _ in range(3):
+            h.check(node(tc, tool="get_balance"))
+        sh = h._policy["shadow_rules"][0]["shadow"]
+        check(sh["status"] == "discarded",
+              f"would_block 率 {sh['would_block']}/{sh['observations']} > 0.3 → discard")
+        check(sh["would_block"] >= 2, "would_block 如实计数(影子会多拦)")
+        check(not h._is_penalized_tool("get_balance"), "误伤规则未生效")
+        check("shadow_rule_discarded" in events_of(h), "discard 事件已发")
+    finally:
+        h.tool_drift.score = orig
+
+
+def test_safety_boundary():
+    print("\n【4】安全边界:semantic 仅权重级 / 未知维度 fail-closed")
+    tc = _tc()
+    h = fresh(tc)
+    _tap_events(h)
+
+    w0 = dict(h.weights)
+    r = h.check(node(tc, content="量子力学与黑洞信息悖论的数学形式化推导",
+                     entities=["预算"]))
+    if r.is_blocked and r.dominant_dim == "semantic":
+        check(h._policy.get("shadow_rules", []) == [],
+              "semantic BLOCK 不生成影子规则(仅权重级)")
+        check(h.weights["semantic"] > w0["semantic"],
+              "semantic 权重被上调(权重级学习保留)")
+    else:
+        from foxclaw.harness.harness import HarnessResult
+        res = HarnessResult(status="BLOCK", delta=0.9, dominant_dim="semantic",
+                            scores={"semantic": 0.9, "tool": 0.0, "scope": 0.0},
+                            reason="t")
+        h._trigger_policy_learning(node(tc), res)
+        check(h._policy.get("shadow_rules", []) == [],
+              "semantic BLOCK(直驱)不生成影子规则(仅权重级)")
+        check(h.weights["semantic"] > w0["semantic"], "semantic 权重上调")
+
+    from foxclaw.harness.harness import HarnessResult
+    w1 = dict(h.weights)
+    res = HarnessResult(status="BLOCK", delta=0.9, dominant_dim="financial",
+                        scores={}, reason="t")
+    h._trigger_policy_learning(node(tc), res)
+    check(h.weights == w1, "未知维度 fail-closed:权重不动")
+    check(any(e["event"] == "skip" for e in h._policy["history"]),
+          "未知维度只记录(history skip)")
+    check(h._policy.get("shadow_rules", []) == [], "未知维度不生成规则")
+    check("shadow_rule_proposed" not in events_of(h), "未知维度不发 propose 事件")
+
+
+def test_rollback():
+    print("\n【5】rollback:撤出生效 + 标记 rolled_back + 不再生效")
+    tc = _tc()
+    h = fresh(tc)
+    _tap_events(h)
+    h._policy["rules"].append({
+        "id": "rule_rb", "trigger": {"dominant_dim": "tool"},
+        "action": {"type": "penalize_tool", "tool_pattern": "bad_tool"},
+        "source": "harness_learned", "agent_id": "t"})
+    h._reindex_learned_actions()
+    check(h._is_penalized_tool("bad_tool"), "前提:规则生效中")
+
+    ok = h.rollback("rule_rb")
+    check(ok, "rollback 返回 True")
+    check(not h._is_penalized_tool("bad_tool"), "回滚后不再生效(索引已重建)")
+    check(h._policy["rules"] == [], "rules 已移除该规则")
+    rb = h._policy["shadow_rules"][0]
+    check(rb["shadow"]["status"] == "rolled_back", "规则标记 rolled_back(保留可审计)")
+    check(any(e["event"] == "rollback" for e in h._policy["history"]),
+          "history 记 rollback")
+    check("shadow_rule_rolled_back" in events_of(h), "rolled_back 事件已发")
+    check(h.rollback("nonexistent") is False, "找不到规则返回 False")
+
+    h.check(node(tc, tool="bad_tool"))
+    check(h._policy["shadow_rules"][0]["shadow"]["observations"] == 0,
+          "rolled_back 不再参与影子观察")
+
+
+def test_persistence():
+    print("\n【6】持久化:shadow/history 落盘,重载保留")
+    tc = _tc()
+    p = tempfile.mktemp(suffix=".yaml")
+    h = Harness(agent_id="t", thought_chain=tc, policy_path=p,
+                shadow_rounds=0, promote_min_obs=3)
+    h.register_goal("分析财务预算", allowed_tool_categories={"read", "finance"},
+                    baseline_entities=frozenset({"预算"}))
+    h._shadow_mode = False
+    h.check(node(tc, tool="delete_everything"))
+
+    import yaml
+    doc = yaml.safe_load(open(p, encoding="utf-8"))
+    check("shadow_rules" in doc and len(doc["shadow_rules"]) == 1,
+          "shadow_rules 已落盘")
+    check("history" in doc and any(e["event"] == "propose" for e in doc["history"]),
+          "history 已落盘")
+
+    h2 = Harness(agent_id="t", thought_chain=tc, policy_path=p,
+                 shadow_rounds=0, promote_min_obs=3)
+    h2.register_goal("分析财务预算", allowed_tool_categories={"read", "finance"},
+                     baseline_entities=frozenset({"预算"}))
+    h2._shadow_mode = False
+    check(len(h2._policy["shadow_rules"]) == 1
+          and h2._policy["shadow_rules"][0]["shadow"]["status"] == "observing",
+          "重载后影子规则与观察状态保留")
+    check(not h2._is_penalized_tool("delete_everything"),
+          "重载后影子仍未生效")
+    os.unlink(p)
+
+
+def main():
+    print("=" * 60)
+    print("批次 4 · P0-1 影子学习(shadow→promote/discard+回滚+边界)")
+    print("=" * 60)
+    test_block_goes_to_shadow()
+    test_promote_after_evidence()
+    test_discard_harmful_rule()
+    test_safety_boundary()
+    test_rollback()
+    test_persistence()
+    print("\n" + "=" * 60)
+    print(f"✓ 全部 {len(CHECKS)} 项断言通过")
+    print("=" * 60)
+
+
+if __name__ == "__main__":
+    main()