agent_os_kernel 3.1.0__py3-none-any.whl

nexus/tests/test_reputation.py

@@ -0,0 +1,328 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+"""Tests for the Reputation Engine."""
+
+import os
+import sys
+from datetime import datetime, timedelta, timezone
+
+import pytest
+
+_nexus_parent = os.path.join(os.path.dirname(__file__), "..", "..")
+if _nexus_parent not in sys.path:
+    sys.path.insert(0, _nexus_parent)
+
+from nexus.reputation import ReputationEngine, ReputationHistory, TrustScore, TrustTier, SlashEvent
+
+
+class TestTrustTier:
+    """Tests for TrustScore.get_tier() classmethod."""
+
+    def test_verified_partner_at_900(self):
+        assert TrustScore.get_tier(900) == TrustTier.VERIFIED_PARTNER
+
+    def test_verified_partner_at_1000(self):
+        assert TrustScore.get_tier(1000) == TrustTier.VERIFIED_PARTNER
+
+    def test_trusted_at_700(self):
+        assert TrustScore.get_tier(700) == TrustTier.TRUSTED
+
+    def test_trusted_at_899(self):
+        assert TrustScore.get_tier(899) == TrustTier.TRUSTED
+
+    def test_standard_at_500(self):
+        assert TrustScore.get_tier(500) == TrustTier.STANDARD
+
+    def test_standard_at_699(self):
+        assert TrustScore.get_tier(699) == TrustTier.STANDARD
+
+    def test_probationary_at_300(self):
+        assert TrustScore.get_tier(300) == TrustTier.PROBATIONARY
+
+    def test_probationary_at_499(self):
+        assert TrustScore.get_tier(499) == TrustTier.PROBATIONARY
+
+    def test_untrusted_at_299(self):
+        assert TrustScore.get_tier(299) == TrustTier.UNTRUSTED
+
+    def test_untrusted_at_zero(self):
+        assert TrustScore.get_tier(0) == TrustTier.UNTRUSTED
+
+
+class TestTrustScoreMeetsThreshold:
+    """Tests for TrustScore.meets_threshold()."""
+
+    def test_meets_when_equal(self):
+        ts = TrustScore(
+            agent_did="did:nexus:a", total_score=500, tier=TrustTier.STANDARD,
+            base_score=400, behavioral_modifier=100, capability_modifier=0,
+        )
+        assert ts.meets_threshold(500) is True
+
+    def test_meets_when_above(self):
+        ts = TrustScore(
+            agent_did="did:nexus:a", total_score=700, tier=TrustTier.TRUSTED,
+            base_score=600, behavioral_modifier=100, capability_modifier=0,
+        )
+        assert ts.meets_threshold(500) is True
+
+    def test_fails_when_below(self):
+        ts = TrustScore(
+            agent_did="did:nexus:a", total_score=300, tier=TrustTier.PROBATIONARY,
+            base_score=300, behavioral_modifier=0, capability_modifier=0,
+        )
+        assert ts.meets_threshold(500) is False
+
+
+class TestReputationHistory:
+    """Tests for ReputationHistory properties."""
+
+    def test_success_rate_with_tasks(self):
+        h = ReputationHistory(
+            agent_did="did:nexus:a", successful_tasks=8, failed_tasks=2, total_tasks=10,
+        )
+        assert h.success_rate == pytest.approx(0.8)
+
+    def test_success_rate_no_tasks(self):
+        h = ReputationHistory(agent_did="did:nexus:a")
+        assert h.success_rate == 0.0
+
+    def test_dispute_win_rate_with_disputes(self):
+        h = ReputationHistory(
+            agent_did="did:nexus:a", disputes_won=3, disputes_lost=1,
+        )
+        assert h.dispute_win_rate == pytest.approx(0.75)
+
+    def test_dispute_win_rate_no_disputes(self):
+        h = ReputationHistory(agent_did="did:nexus:a")
+        assert h.dispute_win_rate == 0.5  # neutral default
+
+
+class TestCalculateTrustScore:
+    """Tests for ReputationEngine.calculate_trust_score()."""
+
+    def test_unknown_verification_gives_low_base(self, reputation_engine):
+        history = ReputationHistory(agent_did="did:nexus:a")
+        score = reputation_engine.calculate_trust_score("unknown", history)
+        assert score.base_score == 100
+
+    def test_registered_verification(self, reputation_engine):
+        history = ReputationHistory(agent_did="did:nexus:a")
+        score = reputation_engine.calculate_trust_score("registered", history)
+        assert score.base_score == 400
+
+    def test_verified_verification(self, reputation_engine):
+        history = ReputationHistory(agent_did="did:nexus:a")
+        score = reputation_engine.calculate_trust_score("verified", history)
+        assert score.base_score == 650
+
+    def test_verified_partner_verification(self, reputation_engine):
+        history = ReputationHistory(agent_did="did:nexus:a")
+        score = reputation_engine.calculate_trust_score("verified_partner", history)
+        assert score.base_score == 800
+
+    def test_successful_tasks_increase_score(self, reputation_engine):
+        history = ReputationHistory(
+            agent_did="did:nexus:a", successful_tasks=50, total_tasks=50,
+        )
+        score = reputation_engine.calculate_trust_score("registered", history)
+        assert score.behavioral_modifier > 0
+
+    def test_failed_tasks_decrease_score(self, reputation_engine):
+        history = ReputationHistory(
+            agent_did="did:nexus:a", failed_tasks=10, total_tasks=10,
+        )
+        score = reputation_engine.calculate_trust_score("registered", history)
+        assert score.behavioral_modifier < 0
+
+    def test_disputes_lost_reduce_score(self, reputation_engine):
+        history = ReputationHistory(
+            agent_did="did:nexus:a", disputes_lost=3,
+        )
+        score = reputation_engine.calculate_trust_score("registered", history)
+        assert score.behavioral_modifier < 0
+
+    def test_capability_modifier_idempotency(self, reputation_engine):
+        history = ReputationHistory(agent_did="did:nexus:a")
+        score = reputation_engine.calculate_trust_score(
+            "registered", history, capabilities={"idempotency": True},
+        )
+        assert score.capability_modifier >= 20
+
+    def test_capability_modifier_reversibility_full(self, reputation_engine):
+        history = ReputationHistory(agent_did="did:nexus:a")
+        score = reputation_engine.calculate_trust_score(
+            "registered", history, capabilities={"reversibility": "full"},
+        )
+        assert score.capability_modifier >= 50
+
+    def test_privacy_ephemeral_boost(self, reputation_engine):
+        history = ReputationHistory(agent_did="did:nexus:a")
+        score = reputation_engine.calculate_trust_score(
+            "registered", history, privacy={"retention_policy": "ephemeral"},
+        )
+        assert score.capability_modifier >= 30
+
+    def test_score_clamped_to_0_1000(self, reputation_engine):
+        # Very bad history
+        history = ReputationHistory(
+            agent_did="did:nexus:a", failed_tasks=100, total_tasks=100,
+            disputes_lost=10, times_slashed=10,
+        )
+        score = reputation_engine.calculate_trust_score("unknown", history)
+        assert 0 <= score.total_score <= 1000
+
+    def test_score_has_correct_tier(self, reputation_engine):
+        history = ReputationHistory(agent_did="did:nexus:a")
+        score = reputation_engine.calculate_trust_score("verified_partner", history)
+        assert score.tier == TrustScore.get_tier(score.total_score)
+
+
+class TestRecordTaskOutcome:
+    """Tests for ReputationEngine.record_task_outcome()."""
+
+    def test_success_increments(self, reputation_engine):
+        h = reputation_engine.record_task_outcome("did:nexus:a", "success")
+        assert h.successful_tasks == 1
+        assert h.total_tasks == 1
+
+    def test_failure_increments(self, reputation_engine):
+        h = reputation_engine.record_task_outcome("did:nexus:a", "failure")
+        assert h.failed_tasks == 1
+        assert h.total_tasks == 1
+
+    def test_partial_increments_both(self, reputation_engine):
+        h = reputation_engine.record_task_outcome("did:nexus:a", "partial")
+        assert h.successful_tasks == 0.5
+        assert h.failed_tasks == 0.5
+        assert h.total_tasks == 1
+
+    def test_multiple_outcomes_accumulate(self, reputation_engine):
+        reputation_engine.record_task_outcome("did:nexus:a", "success")
+        reputation_engine.record_task_outcome("did:nexus:a", "success")
+        h = reputation_engine.record_task_outcome("did:nexus:a", "failure")
+        assert h.successful_tasks == 2
+        assert h.failed_tasks == 1
+        assert h.total_tasks == 3
+
+
+class TestRecordDisputeOutcome:
+    """Tests for ReputationEngine.record_dispute_outcome()."""
+
+    def test_won_increments(self, reputation_engine):
+        h = reputation_engine.record_dispute_outcome("did:nexus:a", "won")
+        assert h.disputes_won == 1
+
+    def test_lost_increments(self, reputation_engine):
+        h = reputation_engine.record_dispute_outcome("did:nexus:a", "lost")
+        assert h.disputes_lost == 1
+
+
+class TestSlashReputation:
+    """Tests for ReputationEngine.slash_reputation()."""
+
+    def test_critical_slash_penalty(self, reputation_engine):
+        event = reputation_engine.slash_reputation(
+            "did:nexus:a", reason="fraud", severity="critical",
+        )
+        assert event.score_reduction == 200
+
+    def test_high_slash_penalty(self, reputation_engine):
+        event = reputation_engine.slash_reputation(
+            "did:nexus:a", reason="hallucination", severity="high",
+        )
+        assert event.score_reduction == 100
+
+    def test_medium_slash_penalty(self, reputation_engine):
+        event = reputation_engine.slash_reputation(
+            "did:nexus:a", reason="timeout", severity="medium",
+        )
+        assert event.score_reduction == 50
+
+    def test_low_slash_penalty(self, reputation_engine):
+        event = reputation_engine.slash_reputation(
+            "did:nexus:a", reason="policy_violation", severity="low",
+        )
+        assert event.score_reduction == 25
+
+    def test_slash_updates_history(self, reputation_engine):
+        reputation_engine.slash_reputation("did:nexus:a", reason="fraud", severity="critical")
+        h = reputation_engine._get_or_create_history("did:nexus:a")
+        assert h.times_slashed == 1
+        assert h.total_slash_amount == 200
+
+    def test_slash_with_evidence(self, reputation_engine):
+        event = reputation_engine.slash_reputation(
+            "did:nexus:a", reason="fraud", severity="high",
+            evidence_hash="ev_hash_123", trace_id="trace_456",
+        )
+        assert event.evidence_hash == "ev_hash_123"
+        assert event.trace_id == "trace_456"
+
+    def test_slash_broadcast_flag(self, reputation_engine):
+        event = reputation_engine.slash_reputation(
+            "did:nexus:a", reason="fraud", severity="high", broadcast=False,
+        )
+        assert event.broadcast_to_network is False
+        assert event.broadcast_at is None
+
+    def test_slash_score_after_not_negative(self, reputation_engine):
+        event = reputation_engine.slash_reputation(
+            "did:nexus:a", reason="fraud", severity="critical",
+        )
+        assert event.score_after >= 0
+
+
+class TestCheckTrustThreshold:
+    """Tests for ReputationEngine.check_trust_threshold()."""
+
+    def test_new_agent_below_default_threshold(self, reputation_engine):
+        meets, score = reputation_engine.check_trust_threshold("did:nexus:new")
+        assert score.total_score == 400  # registered base
+        assert meets is False  # 400 < 500
+
+    def test_custom_threshold(self, reputation_engine):
+        meets, score = reputation_engine.check_trust_threshold("did:nexus:a", required_score=300)
+        assert meets is True  # 400 >= 300
+
+
+class TestLeaderboard:
+    """Tests for ReputationEngine.get_leaderboard()."""
+
+    def test_empty_leaderboard(self, reputation_engine):
+        assert reputation_engine.get_leaderboard() == []
+
+    def test_leaderboard_sorted_descending(self, reputation_engine):
+        # Populate cache via check_trust_threshold
+        reputation_engine.check_trust_threshold("did:nexus:a")
+        reputation_engine.check_trust_threshold("did:nexus:b")
+        board = reputation_engine.get_leaderboard()
+        assert len(board) == 2
+        for i in range(len(board) - 1):
+            assert board[i].total_score >= board[i + 1].total_score
+
+    def test_leaderboard_limit(self, reputation_engine):
+        for i in range(5):
+            reputation_engine.check_trust_threshold(f"did:nexus:agent-{i}")
+        board = reputation_engine.get_leaderboard(limit=3)
+        assert len(board) == 3
+
+
+class TestSlashHistory:
+    """Tests for ReputationEngine.get_slash_history()."""
+
+    def test_empty_history(self, reputation_engine):
+        assert reputation_engine.get_slash_history() == []
+
+    def test_filter_by_agent(self, reputation_engine):
+        reputation_engine.slash_reputation("did:nexus:a", reason="fraud", severity="high")
+        reputation_engine.slash_reputation("did:nexus:b", reason="timeout", severity="low")
+        events = reputation_engine.get_slash_history(agent_did="did:nexus:a")
+        assert len(events) == 1
+        assert events[0].agent_did == "did:nexus:a"
+
+    def test_filter_by_since(self, reputation_engine):
+        reputation_engine.slash_reputation("did:nexus:a", reason="fraud", severity="high")
+        future = datetime.now(timezone.utc) + timedelta(hours=1)
+        events = reputation_engine.get_slash_history(since=future)
+        assert len(events) == 0

nexus/tests/test_schemas.py

@@ -0,0 +1,295 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+"""Tests for Nexus schema models."""
+
+import os
+import sys
+from datetime import datetime, timedelta, timezone
+
+import pytest
+
+_nexus_parent = os.path.join(os.path.dirname(__file__), "..", "..")
+if _nexus_parent not in sys.path:
+    sys.path.insert(0, _nexus_parent)
+
+from nexus.schemas.manifest import (
+    AgentIdentity,
+    AgentCapabilities,
+    AgentPrivacy,
+    MuteRules,
+    AgentManifest,
+)
+from nexus.schemas.escrow import EscrowRequest, EscrowReceipt, EscrowStatus
+from nexus.schemas.receipt import JobReceipt, JobCompletionReceipt, SignedReceipt
+from nexus.schemas.compliance import ComplianceRecord, ComplianceAuditReport
+
+
+class TestAgentIdentity:
+    """Tests for AgentIdentity DID format validation."""
+
+    def test_valid_did(self):
+        identity = AgentIdentity(
+            did="did:nexus:my-agent", verification_key="ed25519:key123", owner_id="org",
+        )
+        assert identity.did == "did:nexus:my-agent"
+
+    def test_invalid_did_prefix(self):
+        with pytest.raises(Exception):
+            AgentIdentity(
+                did="did:other:my-agent", verification_key="ed25519:key123", owner_id="org",
+            )
+
+    def test_invalid_verification_key(self):
+        with pytest.raises(Exception):
+            AgentIdentity(
+                did="did:nexus:my-agent", verification_key="rsa:key123", owner_id="org",
+            )
+
+    def test_valid_ed25519_key(self):
+        identity = AgentIdentity(
+            did="did:nexus:agent", verification_key="ed25519:abc", owner_id="org",
+        )
+        assert identity.verification_key == "ed25519:abc"
+
+
+class TestAgentCapabilities:
+    """Tests for AgentCapabilities constraints."""
+
+    def test_max_concurrency_min(self):
+        with pytest.raises(Exception):
+            AgentCapabilities(max_concurrency=0)
+
+    def test_max_concurrency_max(self):
+        with pytest.raises(Exception):
+            AgentCapabilities(max_concurrency=1001)
+
+    def test_max_concurrency_valid(self):
+        cap = AgentCapabilities(max_concurrency=500)
+        assert cap.max_concurrency == 500
+
+    def test_sla_latency_min(self):
+        with pytest.raises(Exception):
+            AgentCapabilities(sla_latency_ms=50)  # min 100
+
+    def test_sla_latency_max(self):
+        with pytest.raises(Exception):
+            AgentCapabilities(sla_latency_ms=500000)  # max 300000
+
+    def test_sla_latency_valid(self):
+        cap = AgentCapabilities(sla_latency_ms=10000)
+        assert cap.sla_latency_ms == 10000
+
+    def test_defaults(self):
+        cap = AgentCapabilities()
+        assert cap.max_concurrency == 10
+        assert cap.idempotency is False
+        assert cap.reversibility == "partial"
+
+
+class TestAgentManifest:
+    """Tests for AgentManifest creation."""
+
+    def test_valid_manifest(self, sample_manifest):
+        assert sample_manifest.identity.did == "did:nexus:test-agent-v1"
+        assert sample_manifest.verification_level == "registered"
+
+    def test_is_attestation_valid_false_by_default(self, sample_manifest):
+        assert sample_manifest.is_attestation_valid() is False
+
+    def test_is_attestation_valid_when_set(self):
+        m = AgentManifest(
+            identity=AgentIdentity(
+                did="did:nexus:a", verification_key="ed25519:k", owner_id="org",
+            ),
+            attestation_signature="sig_123",
+            attestation_expires=datetime.now(timezone.utc) + timedelta(hours=24),
+        )
+        assert m.is_attestation_valid() is True
+
+    def test_is_attestation_expired(self):
+        m = AgentManifest(
+            identity=AgentIdentity(
+                did="did:nexus:a", verification_key="ed25519:k", owner_id="org",
+            ),
+            attestation_signature="sig_123",
+            attestation_expires=datetime.now(timezone.utc) - timedelta(hours=1),
+        )
+        assert m.is_attestation_valid() is False
+
+    def test_to_iatp_manifest(self, sample_manifest):
+        iatp = sample_manifest.to_iatp_manifest()
+        assert iatp["$schema"].startswith("https://")
+        assert iatp["identity"]["verification_key"] == "ed25519:testkey123abc"
+
+
+class TestEscrowRequestConstraints:
+    """Tests for EscrowRequest validation."""
+
+    def test_credits_must_be_positive(self):
+        with pytest.raises(Exception):
+            EscrowRequest(
+                requester_did="did:nexus:a", provider_did="did:nexus:b",
+                task_hash="h", credits=-1,
+            )
+
+    def test_credits_max_10000(self):
+        with pytest.raises(Exception):
+            EscrowRequest(
+                requester_did="did:nexus:a", provider_did="did:nexus:b",
+                task_hash="h", credits=10001,
+            )
+
+    def test_timeout_min_60(self):
+        with pytest.raises(Exception):
+            EscrowRequest(
+                requester_did="did:nexus:a", provider_did="did:nexus:b",
+                task_hash="h", credits=100, timeout_seconds=30,
+            )
+
+    def test_timeout_max_86400(self):
+        with pytest.raises(Exception):
+            EscrowRequest(
+                requester_did="did:nexus:a", provider_did="did:nexus:b",
+                task_hash="h", credits=100, timeout_seconds=100000,
+            )
+
+
+class TestJobReceipt:
+    """Tests for JobReceipt.compute_hash()."""
+
+    def test_compute_hash_deterministic(self):
+        now = datetime(2024, 1, 1, 12, 0, 0)
+        r1 = JobReceipt(
+            receipt_id="r1", task_id="t1", requester_did="did:nexus:a",
+            provider_did="did:nexus:b", task_hash="hash1", created_at=now,
+        )
+        r2 = JobReceipt(
+            receipt_id="r1", task_id="t1", requester_did="did:nexus:a",
+            provider_did="did:nexus:b", task_hash="hash1", created_at=now,
+        )
+        assert r1.compute_hash() == r2.compute_hash()
+
+    def test_compute_hash_differs_for_different_data(self):
+        now = datetime(2024, 1, 1, 12, 0, 0)
+        r1 = JobReceipt(
+            receipt_id="r1", task_id="t1", requester_did="did:nexus:a",
+            provider_did="did:nexus:b", task_hash="hash1", created_at=now,
+        )
+        r2 = JobReceipt(
+            receipt_id="r2", task_id="t1", requester_did="did:nexus:a",
+            provider_did="did:nexus:b", task_hash="hash1", created_at=now,
+        )
+        assert r1.compute_hash() != r2.compute_hash()
+
+    def test_hash_is_sha256(self):
+        r = JobReceipt(
+            receipt_id="r1", task_id="t1", requester_did="did:nexus:a",
+            provider_did="did:nexus:b", task_hash="hash1",
+        )
+        h = r.compute_hash()
+        assert len(h) == 64  # SHA-256 hex digest length
+
+
+class TestSignedReceipt:
+    """Tests for SignedReceipt methods."""
+
+    def _make_signed_receipt(self, req_sig=None, prov_sig=None, nexus_witnessed=False, nexus_sig=None):
+        receipt = JobCompletionReceipt(
+            receipt_id="r1", task_id="t1", requester_did="did:nexus:a",
+            provider_did="did:nexus:b", task_hash="h", outcome="success",
+            duration_ms=100,
+        )
+        return SignedReceipt(
+            receipt=receipt,
+            receipt_hash=receipt.compute_hash(),
+            requester_signature=req_sig,
+            provider_signature=prov_sig,
+            nexus_witnessed=nexus_witnessed,
+            nexus_signature=nexus_sig,
+        )
+
+    def test_is_fully_signed_both(self):
+        sr = self._make_signed_receipt(req_sig="sig_r", prov_sig="sig_p")
+        assert sr.is_fully_signed() is True
+
+    def test_is_not_fully_signed_missing_provider(self):
+        sr = self._make_signed_receipt(req_sig="sig_r")
+        assert sr.is_fully_signed() is False
+
+    def test_is_not_fully_signed_missing_requester(self):
+        sr = self._make_signed_receipt(prov_sig="sig_p")
+        assert sr.is_fully_signed() is False
+
+    def test_is_nexus_witnessed(self):
+        sr = self._make_signed_receipt(nexus_witnessed=True, nexus_sig="sig_n")
+        assert sr.is_nexus_witnessed() is True
+
+    def test_is_not_nexus_witnessed_no_sig(self):
+        sr = self._make_signed_receipt(nexus_witnessed=True, nexus_sig=None)
+        assert sr.is_nexus_witnessed() is False
+
+    def test_is_not_nexus_witnessed_flag_false(self):
+        sr = self._make_signed_receipt(nexus_witnessed=False, nexus_sig="sig_n")
+        assert sr.is_nexus_witnessed() is False
+
+
+class TestComplianceRecord:
+    """Tests for ComplianceRecord.compute_hash()."""
+
+    def test_compute_hash_deterministic(self):
+        now = datetime(2024, 6, 1, 12, 0, 0)
+        r1 = ComplianceRecord(event_id="e1", event_type="agent_registered", timestamp=now)
+        r2 = ComplianceRecord(event_id="e1", event_type="agent_registered", timestamp=now)
+        assert r1.compute_hash() == r2.compute_hash()
+
+    def test_compute_hash_excludes_signature(self):
+        now = datetime(2024, 6, 1, 12, 0, 0)
+        r1 = ComplianceRecord(event_id="e1", event_type="agent_registered", timestamp=now)
+        r2 = ComplianceRecord(
+            event_id="e1", event_type="agent_registered", timestamp=now, signature="sig",
+        )
+        assert r1.compute_hash() == r2.compute_hash()
+
+
+class TestEscrowReceiptMethods:
+    """Tests for EscrowReceipt.is_expired() and is_active()."""
+
+    def _make_receipt(self, status=EscrowStatus.PENDING, expires_delta_hours=1):
+        return EscrowReceipt(
+            escrow_id="e1",
+            request=EscrowRequest(
+                requester_did="did:nexus:a", provider_did="did:nexus:b",
+                task_hash="h", credits=100,
+            ),
+            status=status,
+            expires_at=datetime.now(timezone.utc) + timedelta(hours=expires_delta_hours),
+            requester_signature="sig",
+        )
+
+    def test_not_expired(self):
+        r = self._make_receipt(expires_delta_hours=1)
+        assert r.is_expired() is False
+
+    def test_expired(self):
+        r = self._make_receipt(expires_delta_hours=-1)
+        assert r.is_expired() is True
+
+    def test_active_pending(self):
+        r = self._make_receipt(status=EscrowStatus.PENDING)
+        assert r.is_active() is True
+
+    def test_active_active(self):
+        r = self._make_receipt(status=EscrowStatus.ACTIVE)
+        assert r.is_active() is True
+
+    def test_active_awaiting(self):
+        r = self._make_receipt(status=EscrowStatus.AWAITING_VALIDATION)
+        assert r.is_active() is True
+
+    def test_not_active_released(self):
+        r = self._make_receipt(status=EscrowStatus.RELEASED)
+        assert r.is_active() is False
+
+    def test_not_active_refunded(self):
+        r = self._make_receipt(status=EscrowStatus.REFUNDED)
+        assert r.is_active() is False