liqiang
b119135836
Build latest book artifacts / build (push) Canceled after 0s
dependency resolution / resolve (3.11) (push) Canceled after 0s
dependency resolution / resolve (3.13) (push) Canceled after 0s
deploy-pages / build (push) Canceled after 0s
deploy-pages / deploy (push) Canceled after 0s
i18n consistency check / check (push) Canceled after 0s
provider adoption tests / test (chapter2/context-compression) (push) Canceled after 0s
provider adoption tests / test (chapter2/prompt-injection) (push) Canceled after 0s
provider adoption tests / test (chapter2/system-hint) (push) Canceled after 0s
provider adoption tests / test (chapter3/log-sanitization) (push) Canceled after 0s
web-search-agent tests / test (push) Canceled after 0s
web-search-agent tests / agentbook (push) Canceled after 0s
77 lines
3.3 KiB
Python
77 lines
3.3 KiB
Python
import hashlib
|
|
import json
|
|
import re
|
|
from pathlib import Path
|
|
|
|
|
|
ROOT = Path(__file__).resolve().parent
|
|
RUN = ROOT / "validation" / "runs" / "exp10-1-kimi-k2.5-tavily-receipts-20260730-v3"
|
|
|
|
|
|
def sha256_bytes(value: bytes) -> str:
|
|
return hashlib.sha256(value).hexdigest()
|
|
|
|
|
|
def canonical_bytes(value) -> bytes:
|
|
return json.dumps(
|
|
value, ensure_ascii=False, sort_keys=True, separators=(",", ":")
|
|
).encode("utf-8")
|
|
|
|
|
|
def test_official_manifest_binds_artifacts_and_runtime_sources():
|
|
manifest = json.loads((RUN / "manifest.json").read_text(encoding="utf-8"))
|
|
assert manifest["acceptance"] == {
|
|
"overall_status": "pass",
|
|
"passed_gates": 15,
|
|
"total_gates": 15,
|
|
}
|
|
for name, expected in manifest["artifact_sha256"].items():
|
|
assert sha256_bytes((RUN / name).read_bytes()) == expected
|
|
for name, expected in manifest["runtime_source_sha256"].items():
|
|
assert sha256_bytes((ROOT / name).read_bytes()) == expected
|
|
|
|
|
|
def test_official_moonshot_receipts_are_raw_hashed_and_unique():
|
|
receipts = json.loads((RUN / "moonshot_receipts.json").read_text(encoding="utf-8"))["receipts"]
|
|
assert len(receipts) == 9
|
|
assert len({item["response_id"] for item in receipts}) == len(receipts)
|
|
assert {item["role"] for item in receipts} == {
|
|
"triage", "research", "data_analysis", "writing",
|
|
}
|
|
for item in receipts:
|
|
assert item["response"]["id"] == item["response_id"]
|
|
assert item["response"]["usage"]["total_tokens"] > 0
|
|
assert sha256_bytes(canonical_bytes(item["request"])) == item["request_sha256"]
|
|
assert sha256_bytes(canonical_bytes(item["response"])) == item["response_sha256"]
|
|
|
|
|
|
def test_official_tavily_receipts_retain_raw_bodies_without_credentials():
|
|
receipts = json.loads((RUN / "tavily_receipts.json").read_text(encoding="utf-8"))["receipts"]
|
|
assert len(receipts) == 3
|
|
for item in receipts:
|
|
assert item["response"]["http_status"] == 200
|
|
assert "api_key" not in item["request"]["body"]
|
|
raw = item["response"]["raw_body"].encode("utf-8")
|
|
assert len(raw) == item["raw_response_bytes"]
|
|
assert sha256_bytes(raw) == item["raw_response_sha256"]
|
|
assert sha256_bytes(canonical_bytes(item["request"])) == item["request_sha256"]
|
|
|
|
|
|
def test_official_acceptance_latest_and_credential_scan_are_consistent():
|
|
acceptance = json.loads((RUN / "acceptance.json").read_text(encoding="utf-8"))
|
|
evidence = json.loads((RUN / "evidence.json").read_text(encoding="utf-8"))
|
|
latest = json.loads((ROOT / "validation" / "latest.json").read_text(encoding="utf-8"))
|
|
assert acceptance["overall_status"] == "pass"
|
|
assert evidence["status"] == "complete"
|
|
assert all(acceptance["behavior_gates"].values())
|
|
assert all(acceptance["provenance_gates"].values())
|
|
assert evidence["handoff_chain"] == [
|
|
"triage", "research", "data_analysis", "writing", "triage",
|
|
]
|
|
assert latest["run_id"] == acceptance["run_id"]
|
|
assert latest["manifest_sha256"] == sha256_bytes((RUN / "manifest.json").read_bytes())
|
|
|
|
combined = b"\n".join(path.read_bytes() for path in RUN.iterdir() if path.is_file())
|
|
assert not re.search(rb'(?i)"(?:api[_-]?key|authorization)"\s*:\s*"(?!<redacted>|null|")[^"]+"', combined)
|
|
assert not re.search(rb'(?i)bearer\s+[a-z0-9._~+/=-]{16,}', combined)
|