thth 2.13.2__tar.gz → 2.14.0__tar.gz

{thth-2.13.2 → thth-2.14.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: thth
-Version: 2.13.2
+Version: 2.14.0
 Summary: 承認済みの投稿だけを投げる門（Threads・Bluesky・Mastodon）。人が承認し、記録は利用者の git に残る。
 Project-URL: Homepage, https://thth.me
 Project-URL: Source, https://github.com/aokings/thth

{thth-2.13.2 → thth-2.14.0}/mcp/server.py

@@ -505,8 +505,8 @@ ADMIN_TOOLS = [
     for name in ("inventory", "account", "log", "tokens", "release", "diff")]
 
 
-ADMIN_TOOLS.append({'name':'thth_admin_budget_set','description':'Set the X monthly read estimate cap; administrator only, by required; no provider call',
-    'inputSchema':{'type':'object','properties':{key:{'type':'string'} for key in ('monthly','currency','rate','rate_source','by')},
+ADMIN_TOOLS.append({'name':'thth_admin_budget_set','description':'Set the X monthly read estimate cap (kind x_read, default) or the monthly post count cap (kind x_posts); administrator only, by required; no provider call',
+    'inputSchema':{'type':'object','properties':{key:{'type':'string'} for key in ('monthly','currency','rate','rate_source','by','kind')},
                    'required':['monthly','by'],'additionalProperties':False}})
 
 SERVER_TOOLS = [

thth-2.14.0/tests/helpers/fake_x.py

@@ -0,0 +1,138 @@
+"""偽の X（loopback HTTP）。**本物の api.x.com は 1 度も叩かない。**
+
+`initialize` → `append`（multipart・`segment_index`）→ `finalize` → STATUS →
+`metadata` → `POST /2/tweets` の順序と本体をそのまま記録して、試験が wire を
+見られるようにする。応答は `state` の欄で差し替える。
+"""
+from __future__ import annotations
+
+import json
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+import re
+import threading
+import urllib.parse
+
+
+def parse_multipart(raw, content_type):
+    """`segment_index` と `media` の中身だけを取り出す（試験用の最小の実装）。"""
+    boundary = content_type.partition('boundary=')[2].encode('ascii')
+    fields = {}
+    for part in raw.split(b'--' + boundary):
+        head, separator, body = part.partition(b'\r\n\r\n')
+        if not separator:
+            continue
+        name = re.search(rb'name="([^"]+)"', head)
+        if not name:
+            continue
+        fields[name.group(1).decode()] = body[:-2] if body.endswith(b'\r\n') else body
+    return fields
+
+
+def new_state():
+    return {'calls': [], 'uploads': {}, 'segments': {}, 'status': {}, 'next_media': 100,
+            'next_post': '1900000000000000001', 'reply': {}, 'on_tweet': None,
+            'on_append': None, 'on_status': None, 'metadata_status': {}, 'tweets': [],
+            'me': {'data': {'id': '123', 'username': 'demo'}}, 'posts': None}
+
+
+class _Handler(BaseHTTPRequestHandler):
+    state: dict = {}
+
+    def log_message(self, *a):
+        pass
+
+    def reply(self, code, body):
+        raw = b'' if body is None else json.dumps(body).encode()
+        self.send_response(code)
+        for key, value in self.state['reply'].get(self.path, {}).items():
+            self.send_header(key, value)
+        self.send_header('Content-Length', str(len(raw)))
+        self.end_headers()
+        self.wfile.write(raw)
+
+    def _body(self):
+        length = int(self.headers.get('Content-Length') or 0)
+        return self.rfile.read(length) if length else b''
+
+    def do_GET(self):
+        path, _, query = self.path.partition('?')
+        values = urllib.parse.parse_qs(query)
+        self.state['calls'].append(('GET', path, values))
+        if path == '/2/media/upload':
+            identifier = values.get('media_id', [''])[0]
+            if self.state['on_status']:
+                self.state['on_status']()
+            queue = self.state['status'].get(identifier) or []
+            info = queue.pop(0) if queue else {'state': 'succeeded'}
+            if isinstance(info, tuple):
+                return self.reply(info[0], info[1])
+            return self.reply(200, {'data': {'id': identifier, 'processing_info': info}})
+        if path == '/2/users/me':
+            return self.reply(200, self.state['me'])
+        if re.fullmatch(r'/2/users/[0-9]+/tweets', path):
+            return self.reply(200, self.state['posts'] if self.state['posts'] is not None
+                              else {'data': [], 'meta': {'result_count': 0}})
+        return self.reply(404, {})
+
+    def do_DELETE(self):
+        self.state['calls'].append(('DELETE', self.path, {}))
+        return self.reply(200, {'data': {'deleted': True}})
+
+    def do_POST(self):
+        raw = self._body()
+        content = self.headers.get('Content-Type') or ''
+        if content.startswith('multipart/form-data'):
+            fields = parse_multipart(raw, content)
+            payload = fields.get('media', b'')
+            body = {'segment_index': fields.get('segment_index', b'').decode(),
+                    'bytes': len(payload)}
+            identifier = self.path.split('/')[-2]
+            self.state['segments'].setdefault(identifier, []).append(body['segment_index'])
+            self.state['uploads'][identifier] = self.state['uploads'].get(identifier, b'') + payload
+            self.state['calls'].append(('POST', self.path, body))
+            if self.state['on_append']:
+                self.state['on_append']()
+            return self.reply(200, {'data': {'id': identifier, 'expires_after_secs': 3600}})
+        body = json.loads(raw) if raw else {}
+        self.state['calls'].append(('POST', self.path, body))
+        if self.path == '/2/media/upload/initialize':
+            self.state['next_media'] += 1
+            identifier = str(self.state['next_media'])
+            return self.reply(200, {'data': {'id': identifier, 'expires_after_secs': 3600}})
+        if self.path.endswith('/finalize'):
+            identifier = self.path.split('/')[-2]
+            queue = self.state['status'].get(identifier)
+            info = {'state': 'pending', 'check_after_secs': 0} if queue else None
+            data = {'id': identifier}
+            if info is not None:
+                data['processing_info'] = info
+            return self.reply(200, {'data': data})
+        if self.path == '/2/media/metadata':
+            status = self.state['metadata_status'].get(body.get('id'), 200)
+            return self.reply(status, {} if status == 200 else {'title': 'refused'})
+        if self.path == '/2/tweets':
+            if self.state['on_tweet']:
+                self.state['on_tweet']()
+            self.state['tweets'].append(body)
+            return self.reply(201, {'data': {'id': self.state['next_post'], 'text': body.get('text', '')}})
+        return self.reply(404, {})
+
+
+def serve(monkeypatch=None):
+    """試験のための server を 1 本立てて `(state, url, shutdown)` を返す。"""
+    state = new_state()
+    handler = type('Handler', (_Handler,), {'state': state})
+    server = ThreadingHTTPServer(('127.0.0.1', 0), handler)
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+    url = 'http://127.0.0.1:' + str(server.server_port)
+
+    def shutdown():
+        server.shutdown()
+        server.server_close()
+        thread.join(3)
+    return state, url, shutdown
+
+
+def calls(state, method, suffix):
+    return [row for row in state['calls'] if row[0] == method and row[1].endswith(suffix)]

{thth-2.13.2 → thth-2.14.0}/tests/test_adapter_boundary.py

@@ -706,7 +706,7 @@ def test_TB5_知らない媒体のdoctorは黙って異常なしにしない(tmp
 
 # --- T3 の配線（2026-09-13・Bluesky と Mastodon を REGISTRY に載せる） ---------
 
-def test_T3_REGISTRYに3媒体が載っている():
+def test_T3_REGISTRYに4媒体が載っている():
     """**足すのは 1 行だけ**（設計 v2 §4.2「台帳と登録」）。
 
     ここが落ちると、台帳に `media: bluesky` と書いても
@@ -714,9 +714,11 @@ def test_T3_REGISTRYに3媒体が載っている():
     """
     from thth.adapters import bluesky as bluesky_mod
     from thth.adapters import mastodon as mastodon_mod
-    assert adapters_mod.known_media() == ["bluesky", "mastodon", "threads"]
+    from thth.adapters import x as x_mod
+    assert adapters_mod.known_media() == ["bluesky", "mastodon", "threads", "x"]
     assert adapters_mod.REGISTRY["bluesky"] is bluesky_mod.BlueskyAdapter
     assert adapters_mod.REGISTRY["mastodon"] is mastodon_mod.MastodonAdapter
+    assert adapters_mod.REGISTRY["x"] is x_mod.XAdapter
 
 
 def test_T3_全媒体のCAPABILITIESが境界の語彙に収まる():

{thth-2.13.2 → thth-2.14.0}/tests/test_selfupdate.py

@@ -870,10 +870,12 @@ def test_D11_署名検証後にrefが動いても検証したOIDだけをmerge
              "+refs/heads/release:refs/remotes/origin/release"],
             check=True,
         )
-        return True
+        return None
 
     monkeypatch.setenv(selfupdate.REQUIRE_SIGNED_ENV, "1")
-    monkeypatch.setattr(selfupdate, "verify_release_signature", 検証後にrefを進める)
+    monkeypatch.setattr(selfupdate, "release_signature",
+                         lambda app_dir, oid: {"state": "verified",
+                                               "key_id": 検証後にrefを進める(app_dir, oid)})
 
     message, moved = selfupdate._pull_locked(pair["work"])
     merged = selfupdate.head(pair["work"])
@@ -902,9 +904,14 @@ def test_D11_verify_commitの実git引数はrefでなく固定OID(tmp_path, monk
 
     monkeypatch.setattr(selfupdate, "_git", 記録して実行)
     # fixture の commit は未署名なので結果は False。ここで確かめるのは、実際の
-    # `git verify-commit` が可変 ref でなく固定 OID を受け取ること。
+    # `git verify-commit` が可変 ref でなく固定 OID を受け取ること（2.14 から
+    # allowed_signers を明示し、落ちたら「無い」と「合わない」を言い分ける）。
     assert selfupdate.verify_release_signature(pair["work"], oid) is False
-    assert calls == [["verify-commit", oid]]
+    signers = selfupdate.allowed_signers_path()
+    assert calls == [["-c", "gpg.format=ssh", "-c", "gpg.ssh.program=ssh-keygen",
+                      "-c", "gpg.ssh.allowedSignersFile=" + signers, "verify-commit", oid],
+                     ["cat-file", "commit", oid]]
+    assert selfupdate.release_signature(pair["work"], oid)["state"] == selfupdate.SIGNATURE_MISSING
 
 
 def test_P2_5_boardは署名を確かめているかを1語出す(tmp_path, monkeypatch, capsys):

{thth-2.13.2 → thth-2.14.0}/tests/test_v211_auth_integration.py

@@ -42,7 +42,7 @@ def test_app_json_cli_reads_same_profile_store_presence_only(env,monkeypatch,cap
     if media=='x':values.update(client_type='confidential',redirect_uri=auth_x.CALLBACK)
     monkeypatch.setattr('sys.stdin',io.StringIO(json.dumps(values)))
     assert cli.main(['app','set',media,'--stdin','--by','operator'])==0
-    path=env['app'] if media=='threads' else authclients.path_for('x',None,{})
+    path=env['app'] if media=='threads' else auth_x.client_path({})
     if media=='threads':assert appenv.load_app_env()==(values['client_id'],values['client_secret'])
     else:
         cfg=cfg_media(env,'x');profile=auth_x.XAuthProfile.prepare(cfg)
@@ -69,7 +69,7 @@ def test_app_by_before_any_read_input_or_write(env,legacy):
 def test_app_save_fault_retains_append_contract(env,monkeypatch,media,fault):
     values={'client_id':opaque(),'client_secret':opaque()}
     if media=='x':values.update(client_type='confidential',redirect_uri=auth_x.CALLBACK)
-    path=env['app'] if media=='threads' else authclients.path_for('x',None,{})
+    path=env['app'] if media=='threads' else auth_x.client_path({})
     if media=='x':authclients.write(path,values)
     old=path.read_bytes();values['client_secret']=opaque();lines=[]
     emit_fault(monkeypatch,fault)

{thth-2.13.2 → thth-2.14.0}/tests/test_v211_x_auth.py

@@ -25,9 +25,7 @@ def env(tmp_path,monkeypatch):
     cfg.update(account='alpha',project='demo',handle='demo',repo_dir=str(root/'repos/_none'),token=str(root/'alpha.token'),env=str(root/'alpha.env'))
     ledger=ledgers/'alpha.json';ledger.write_text(json.dumps(cfg));cfg=accounts.load_account('alpha')
     data=dict(root=root,home=home,cfg=cfg,ledger=ledger,client_id=opaque(),client_secret=opaque(),code=opaque(),token=opaque(),refresh=opaque(),calls=[],behavior={},queries=[],lines=[],hook=None)
-    path=authclients.path_for('x',None,cfg);data['client_path']=path
     data['client']={'client_id':data['client_id'],'client_secret':data['client_secret'],'client_type':'confidential','redirect_uri':x.CALLBACK}
-    authclients.write(path,data['client'])
     class Handler(BaseHTTPRequestHandler):
         def log_message(self,*a):pass
         def do_GET(self):self.answer(None)
@@ -44,6 +42,9 @@ def env(tmp_path,monkeypatch):
             self.send_response(status);self.end_headers();self.wfile.write(json.dumps(body).encode())
     server=ThreadingHTTPServer(('127.0.0.1',0),Handler)
     monkeypatch.setenv('THTH_X_BASE_URL',f'http://127.0.0.1:{server.server_port}')
+    # 2.14: client は scope 集合ごとの世代に置く（origin は上書き後に決まる）。
+    path=x.client_path(cfg);data['client_path']=path
+    authclients.write(path,data['client'])
     # This auth fixture now explicitly provisions a synthetic read cap.
     # Budget default-zero and setter/audit contracts have separate 2.12 tests.
     from thth import budget_x,server_files
@@ -88,8 +89,9 @@ def test_success_pkce_basic_observed_expiry_and_auth_only(env,capsys):
     assert (jst.parse(token['expires_at'])-jst.parse(token['obtained_at'])).total_seconds()==7200
     assert token['scopes']==x.SCOPES and token['scopes_source']=='response' and token['auth_via']=='paste'
     assert stat.S_IMODE(Path(env['cfg']['token']).stat().st_mode)==0o600
-    assert adapters.capabilities_for('x')==set()
-    with pytest.raises(adapters.UnknownMedium):adapters.make_adapter(env['cfg'],token)
+    # 2.14: X は投稿 adapter を持つ（2.11 の auth-only ではなくなった）。
+    assert adapters.capabilities_for('x')=={'recent_posts'}
+    assert adapters.make_adapter(env['cfg'],token).user_id=='123'
     output='\n'.join(env['lines'])+json.dumps(admin_log.read())+capsys.readouterr().out
     for value in [env['token'],env['refresh'],env['client_secret'],env['code'],session['state'],session['read_key'],session['code_verifier']]:assert value not in output
 
@@ -212,7 +214,7 @@ def test_cli_account_add_then_auth_reaches_x_profile(env,monkeypatch):
     monkeypatch.setattr('builtins.input',lambda:x.CALLBACK+'?'+urllib.parse.urlencode({'code':env['code'],'state':authflow._read_session('newx')['state']}))
     assert cli.main(['auth','newx','--by','operator','--paste'])==0
     cfg=accounts.load_account('newx');assert cfg['production'] is False and cfg['scheduled'] is False
-    assert accounts.load_token(cfg)['user_id']=='123' and adapters.capabilities_for('x')==set()
+    assert accounts.load_token(cfg)['user_id']=='123' and adapters.capabilities_for('x')=={'recent_posts'}
 
 
 @pytest.mark.parametrize('fault',['zero','partial','fsync','rollback'])

{thth-2.13.2 → thth-2.14.0}/tests/test_v213_bluesky_webm_named.py

@@ -39,7 +39,7 @@ def test_mastodon_still_accepts_the_same_webm(tmp_path):
 
 
 def test_policy_table_names_every_medium():
-    assert set(media.MEDIUM_POLICY) == {'threads', 'bluesky', 'mastodon'}
+    assert set(media.MEDIUM_POLICY) == {'threads', 'bluesky', 'mastodon', 'x'}
     assert media.MEDIUM_POLICY['mastodon']['allow_webm'] is True
     # An edit list is no longer a per-medium policy: every medium takes one.
     assert all(set(p) <= {'allow_webm'} for p in media.MEDIUM_POLICY.values())

{thth-2.13.2 → thth-2.14.0}/tests/test_v213_capabilities.py

@@ -17,7 +17,7 @@ from thth import media, media_capabilities as caps, mediaformats, tool_version
 
 SOURCE = {path: path.read_text(encoding='utf-8')
           for path in sorted(Path(thth.__file__).resolve().parent.rglob('*.py'))}
-LITERAL = re.compile(r"unsupported_attachment: (mastodon|bluesky|threads)/([a-z0-9_]*)")
+LITERAL = re.compile(r"unsupported_attachment: (mastodon|bluesky|threads|x)/([a-z0-9_]*)")
 BARE = re.compile(r"unsupported_attachment: ([a-z0-9_][a-z0-9_ ]*)['\"]")
 INSPECTION = re.compile(r"Inspection\(\s*'([a-z0-9_]+)'")
 REQUIRED = ('image', 'video', 'audio', 'carousel', 'poll', 'quote', 'link', 'gif', 'text',
@@ -91,6 +91,11 @@ def test_the_rulings_are_written_down_as_given():
     assert caps.CAPABILITIES['mastodon']['visibility_private'] == 'unsupported: ledger_public_only'
     assert caps.CAPABILITIES['mastodon']['link'] == 'body_only'
     assert caps.CAPABILITIES['bluesky']['webm'] == 'unsupported: provider_format'
+    # 2.14: 引用は「API に無い」のではなく tier で使えない（設計 §0・§7）。
+    assert caps.CAPABILITIES['x']['quote'] == 'unsupported: provider_tier_enterprise_only'
+    assert caps.CAPABILITIES['x']['carousel_quote'] == 'unsupported: provider_tier_enterprise_only'
+    assert caps.CAPABILITIES['x']['link'] == 'body_only'
+    assert caps.CAPABILITIES['x']['reply_control'] == 'supported'
     for medium in caps.MEDIA:
         assert caps.CAPABILITIES[medium]['aac_adts'] == 'unsupported: privacy_inspection_boundary_unverified'
         assert caps.CAPABILITIES[medium]['asf'] == 'unsupported: deferred_by_ruling_c14'

{thth-2.13.2 → thth-2.14.0}/tests/test_v213_media_foundation.py

@@ -181,8 +181,9 @@ def test_prepared_approved_threads_image_is_selected_until_source_changes(repo,
 
 def test_approved_attachment_for_unsupported_provider_is_rejected(repo):
     from thth import select
-    cfg = {'account': 'demo', 'media': 'x', 'repo_dir': str(repo)}
-    original = v1().replace('## threads', '## x')
+    # 2.14 で X は載ったので、**まだ載っていない媒体**でこの筋を守る。
+    cfg = {'account': 'demo', 'media': 'whatsapp', 'repo_dir': str(repo)}
+    original = v1().replace('## threads', '## whatsapp')
     draft = queuefile.parse_text(original, 'q.md')
     manifest = media.manifest_for(draft.front_matter, cfg)
     approved_sha = approval.compute_approved_sha(**args(), media_manifest=manifest)
@@ -213,7 +214,7 @@ def test_legacy_nondefault_posts_indent_writeback():
 
 
 @pytest.mark.parametrize('medium,expected', [
-    ('x', 'media_provider_unavailable'),
+    ('whatsapp', 'media_provider_unavailable'),
     ('threads', 'approval_stale'),
 ])
 def test_direct_core_guard_never_constructs_adapter(medium, expected):

thth-2.14.0/tests/test_v214_release_signing.py

@@ -0,0 +1,157 @@
+"""2.14.0 §5: release の SSH 署名。鍵はこの試験の中で作って、外に出さない。"""
+import argparse
+import os
+import shutil
+import subprocess
+
+import pytest
+
+from thth import cli as cli_mod, report as report_mod, selfupdate
+from tests.test_selfupdate import _advance_main, _app_pair, _release
+
+
+def _run(*args, **kwargs):
+    return subprocess.run(list(args), capture_output=True, text=True, **kwargs)
+
+
+@pytest.fixture
+def keys(tmp_path):
+    """使い捨ての ed25519 鍵を 2 本（信じる鍵・信じない鍵）。"""
+    if shutil.which('ssh-keygen') is None:
+        pytest.skip('ssh-keygen がありません（SSH 署名の検証は測れません）')
+    made = {}
+    for name in ('trusted', 'other'):
+        path = tmp_path / name
+        result = _run('ssh-keygen', '-q', '-t', 'ed25519', '-N', '', '-C', name, '-f', str(path))
+        if result.returncode != 0:
+            pytest.skip('ssh-keygen が鍵を作れません')
+        fingerprint = _run('ssh-keygen', '-lf', str(path) + '.pub').stdout.split()[1]
+        made[name] = {'private': str(path), 'public': str(path) + '.pub',
+                      'line': (tmp_path / (name + '.pub')).read_text().strip(),
+                      'fingerprint': fingerprint}
+    allowed = tmp_path / 'allowed_signers'
+    allowed.write_text('thth-release ' + made['trusted']['line'] + '\n')
+    allowed.chmod(0o600)
+    made['allowed'] = str(allowed)
+    return made
+
+
+def sign_with(repo, key):
+    _run('git', '-C', repo, 'config', 'gpg.format', 'ssh')
+    _run('git', '-C', repo, 'config', 'user.signingkey', key['public'])
+
+
+def commit(repo, text, *, signed):
+    path = os.path.join(repo, 'docs', 'sns', 'queue', 'version.txt')
+    with open(path, 'w', encoding='utf-8') as stream:
+        stream.write(text)
+    args = ['git', '-C', repo, 'commit', '-aq'] + (['-S'] if signed else []) + ['-m', 'advance']
+    return _run(*args)
+
+
+@pytest.fixture
+def signed_pair(tmp_path, keys, monkeypatch):
+    pair = _app_pair(tmp_path)
+    monkeypatch.setenv(selfupdate.ALLOWED_SIGNERS_ENV, keys['allowed'])
+    sign_with(pair['seed'], keys['trusted'])
+    if commit(pair['seed'], 'v2\n', signed=True).returncode != 0:
+        pytest.skip('この git は SSH 署名を作れません')
+    _release(pair)
+    return pair
+
+
+def test_a_commit_signed_by_the_trusted_key_verifies_and_names_the_key(signed_pair, keys):
+    subprocess.run(['git', '-C', signed_pair['work'], 'fetch', '-q', 'origin',
+                    '+refs/heads/release:refs/remotes/origin/release'], check=True)
+    oid = _run('git', '-C', signed_pair['work'], 'rev-parse', 'origin/release').stdout.strip()
+    found = selfupdate.release_signature(signed_pair['work'], oid)
+    assert found['state'] == 'verified'
+    assert found['key_id'] == keys['trusted']['fingerprint']
+    assert selfupdate.verify_release_signature(signed_pair['work'], oid) is True
+
+
+def test_an_unsigned_commit_is_missing_not_invalid(tmp_path, keys, monkeypatch):
+    pair = _app_pair(tmp_path)
+    monkeypatch.setenv(selfupdate.ALLOWED_SIGNERS_ENV, keys['allowed'])
+    _advance_main(pair)
+    _release(pair)
+    subprocess.run(['git', '-C', pair['work'], 'fetch', '-q', 'origin',
+                    '+refs/heads/release:refs/remotes/origin/release'], check=True)
+    oid = _run('git', '-C', pair['work'], 'rev-parse', 'origin/release').stdout.strip()
+    found = selfupdate.release_signature(pair['work'], oid)
+    assert found == {'state': selfupdate.SIGNATURE_MISSING, 'key_id': None}
+    assert selfupdate.verify_release_signature(pair['work'], oid) is False
+
+
+def test_a_commit_signed_by_an_untrusted_key_is_invalid(tmp_path, keys, monkeypatch):
+    pair = _app_pair(tmp_path)
+    monkeypatch.setenv(selfupdate.ALLOWED_SIGNERS_ENV, keys['allowed'])
+    sign_with(pair['seed'], keys['other'])
+    if commit(pair['seed'], 'v2\n', signed=True).returncode != 0:
+        pytest.skip('この git は SSH 署名を作れません')
+    _release(pair)
+    subprocess.run(['git', '-C', pair['work'], 'fetch', '-q', 'origin',
+                    '+refs/heads/release:refs/remotes/origin/release'], check=True)
+    oid = _run('git', '-C', pair['work'], 'rev-parse', 'origin/release').stdout.strip()
+    found = selfupdate.release_signature(pair['work'], oid)
+    assert found == {'state': selfupdate.SIGNATURE_INVALID, 'key_id': None}
+
+
+def test_the_signed_release_is_taken_in_and_the_board_names_the_key(signed_pair, keys,
+                                                                    monkeypatch, capsys):
+    before = selfupdate.head(signed_pair['work'])
+    monkeypatch.setenv(selfupdate.REQUIRE_SIGNED_ENV, '1')
+    monkeypatch.setattr(os, 'execve', lambda *a: None)
+    selfupdate.pull_and_reexec(['thth'], app_dir=signed_pair['work'], log=lambda _l: None)
+    assert selfupdate.head(signed_pair['work']) != before
+    record = selfupdate.release_check(signed_pair['work'])
+    assert record['ok'] is True and record['signature_key'] == keys['trusted']['fingerprint']
+    monkeypatch.setattr(report_mod.selfupdate_mod, 'release_check', lambda *a, **k: dict(record))
+    cli_mod.cmd_board(argparse.Namespace(json=False, account=None))
+    assert '署名: 確認済み（' + keys['trusted']['fingerprint'] + '）' in capsys.readouterr().out
+
+
+@pytest.mark.parametrize('flavour,expected,line', [
+    ('unsigned', selfupdate.SIGNATURE_MISSING, '署名: 未確認（取り込んでいません）'),
+    ('untrusted', selfupdate.SIGNATURE_INVALID, '署名: 不正（取り込んでいません）'),
+])
+def test_an_unverifiable_release_is_not_taken_in_and_the_board_says_which(
+        tmp_path, keys, monkeypatch, capsys, flavour, expected, line):
+    pair = _app_pair(tmp_path)
+    monkeypatch.setenv(selfupdate.ALLOWED_SIGNERS_ENV, keys['allowed'])
+    if flavour == 'untrusted':
+        sign_with(pair['seed'], keys['other'])
+        if commit(pair['seed'], 'v2\n', signed=True).returncode != 0:
+            pytest.skip('この git は SSH 署名を作れません')
+    else:
+        _advance_main(pair)
+    _release(pair)
+    before = selfupdate.head(pair['work'])
+    monkeypatch.setenv(selfupdate.REQUIRE_SIGNED_ENV, '1')
+    execs = []
+    monkeypatch.setattr(os, 'execve', lambda *a: execs.append(a))
+    message = selfupdate.pull_and_reexec(['thth'], app_dir=pair['work'], log=lambda _l: None)
+    assert selfupdate.head(pair['work']) == before and execs == []
+    assert message and selfupdate.SIGNATURE_ERROR in message and expected in message
+    record = selfupdate.release_check(pair['work'])
+    assert record['ok'] is False and record['error'].endswith(expected)
+    monkeypatch.setattr(report_mod.selfupdate_mod, 'release_check', lambda *a, **k: dict(record))
+    cli_mod.cmd_board(argparse.Namespace(json=False, account=None))
+    assert line in capsys.readouterr().out
+
+
+def test_the_default_still_takes_an_unsigned_release(tmp_path, keys, monkeypatch):
+    pair = _app_pair(tmp_path)
+    monkeypatch.delenv(selfupdate.REQUIRE_SIGNED_ENV, raising=False)
+    monkeypatch.setenv(selfupdate.ALLOWED_SIGNERS_ENV, keys['allowed'])
+    before = selfupdate.head(pair['work'])
+    _advance_main(pair)
+    _release(pair)
+    monkeypatch.setattr(os, 'execve', lambda *a: None)
+    selfupdate.pull_and_reexec(['thth'], app_dir=pair['work'], log=lambda _l: None)
+    assert selfupdate.head(pair['work']) != before
+
+
+def test_the_allowed_signers_path_defaults_outside_the_project(monkeypatch):
+    monkeypatch.delenv(selfupdate.ALLOWED_SIGNERS_ENV, raising=False)
+    assert selfupdate.allowed_signers_path().endswith('/.config/thth/allowed_signers')