From 679db749b99d3ef308d9a7409b9145eab156d7fc Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 09:59:09 +0900 Subject: [PATCH 01/45] test(governance): declare ConceptWeave Product ruleset target --- config/conceptweave-product-ruleset.json | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 config/conceptweave-product-ruleset.json diff --git a/config/conceptweave-product-ruleset.json b/config/conceptweave-product-ruleset.json new file mode 100644 index 0000000000..34c12c565c --- /dev/null +++ b/config/conceptweave-product-ruleset.json @@ -0,0 +1,9 @@ +{ + "schema_version": 1, + "target_repository": "ContextualWisdomLab/ConceptWeave", + "target_branch": "main", + "ruleset_name": "ConceptWeave Product acceptance", + "ruleset_id": null, + "required_check": "Product acceptance", + "forbidden_check": "Product metadata-only" +} From 144d31bdfa9a192216113237898d91e771d28773 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 10:00:14 +0900 Subject: [PATCH 02/45] test(governance): specify staged ConceptWeave Product enforcement --- ...eptweave_product_ruleset_reconciliation.py | 521 ++++++++++++++++++ 1 file changed, 521 insertions(+) create mode 100644 tests/test_conceptweave_product_ruleset_reconciliation.py diff --git a/tests/test_conceptweave_product_ruleset_reconciliation.py b/tests/test_conceptweave_product_ruleset_reconciliation.py new file mode 100644 index 0000000000..7f4767fc28 --- /dev/null +++ b/tests/test_conceptweave_product_ruleset_reconciliation.py @@ -0,0 +1,521 @@ +from __future__ import annotations + +import base64 +import json +import subprocess +from pathlib import Path +from types import SimpleNamespace + +import pytest + +from scripts.ci import reconcile_conceptweave_product_ruleset as p +from scripts.ci.reconcile_ruleset_governance import ( + AmbiguousRulesetWriteError, + RulesetGovernanceError, +) + + +def manifest(ruleset_id=None): + return { + "schema_version": 1, + "target_repository": p.TARGET_FULL_NAME, + "target_branch": p.TARGET_BRANCH, + "ruleset_name": p.RULESET_NAME, + "ruleset_id": ruleset_id, + "required_check": p.PRODUCT_CHECK, + "forbidden_check": p.METADATA_ONLY_CHECK, + } + + +def write_manifest(tmp_path: Path, data): + path = tmp_path / "manifest.json" + path.write_text(json.dumps(data), encoding="utf-8") + return path + + +def live_payload(ruleset_id=99, *, enforcement="evaluate", integration_id=None): + payload = p._desired(enforcement=enforcement, integration_id=integration_id) + return { + "id": ruleset_id, + "source_type": "Repository", + "source": p.TARGET_FULL_NAME, + **payload, + } + + +def test_manifest_valid(tmp_path): + assert p.load_product_manifest(write_manifest(tmp_path, manifest())) == manifest() + + +@pytest.mark.parametrize( + "mutate", + [ + lambda d: d.update(extra=True), + lambda d: d.__setitem__("schema_version", 2), + lambda d: d.__setitem__("target_repository", "x/y"), + lambda d: d.__setitem__("target_branch", "dev"), + lambda d: d.__setitem__("ruleset_name", "x"), + lambda d: d.__setitem__("required_check", "x"), + lambda d: d.__setitem__("forbidden_check", "x"), + lambda d: d.__setitem__("ruleset_id", 0), + lambda d: d.__setitem__("ruleset_id", True), + ], +) +def test_manifest_rejects_invalid(tmp_path, mutate): + data = manifest() + mutate(data) + with pytest.raises(RulesetGovernanceError): + p.load_product_manifest(write_manifest(tmp_path, data)) + + +def test_target_and_desired_validation(): + assert p._target(7).ruleset_id == 7 + with pytest.raises(RulesetGovernanceError): + p._target(0) + assert p._desired(enforcement="evaluate", integration_id=None)["enforcement"] == "evaluate" + assert p._desired(enforcement="active", integration_id=15368)["rules"][0]["parameters"]["required_status_checks"][0]["integration_id"] == 15368 + with pytest.raises(RulesetGovernanceError): + p._desired(enforcement="bad", integration_id=None) + with pytest.raises(RulesetGovernanceError): + p._desired(enforcement="active", integration_id=0) + + +def test_assert_shape(monkeypatch): + target = p._target(9) + monkeypatch.setattr(p, "_assert_target_provenance", lambda live, target: None) + p._assert_shape(live_payload(9), target, enforcement="evaluate", integration_id=None) + bad = live_payload(9) + bad["name"] = "bad" + with pytest.raises(RulesetGovernanceError, match="name"): + p._assert_shape(bad, target, enforcement="evaluate", integration_id=None) + bad = live_payload(9) + bad["bypass_actors"] = [{"actor_id": 1}] + with pytest.raises(RulesetGovernanceError, match="reviewed"): + p._assert_shape(bad, target, enforcement="evaluate", integration_id=None) + + +def test_repository_rulesets_and_named(monkeypatch): + monkeypatch.setattr(p, "_gh_api_list", lambda *a: [ + {"id": 1, "name": "other", "source_type": "Repository", "source": p.TARGET_FULL_NAME}, + {"id": 2, "name": p.RULESET_NAME, "source_type": "Repository", "source": p.TARGET_FULL_NAME}, + ]) + assert p._named_ruleset()["id"] == 2 + monkeypatch.setattr(p, "_gh_api_list", lambda *a: [ + {"id": 1, "name": p.RULESET_NAME, "source_type": "Organization", "source": p.ORGANIZATION} + ]) + with pytest.raises(RulesetGovernanceError, match="foreign"): + p._repository_rulesets() + monkeypatch.setattr(p, "_gh_api_list", lambda *a: [ + {"id": 1, "name": p.RULESET_NAME, "source_type": "Repository", "source": p.TARGET_FULL_NAME}, + {"id": 2, "name": p.RULESET_NAME, "source_type": "Repository", "source": p.TARGET_FULL_NAME}, + ]) + with pytest.raises(RulesetGovernanceError, match="multiple"): + p._named_ruleset() + + +def test_live(monkeypatch): + target = p._target(4) + monkeypatch.setattr(p, "_gh_api", lambda *a, **k: {"id": 4}) + monkeypatch.setattr(p, "_assert_target_provenance", lambda live, target: None) + assert p._live(target)["id"] == 4 + + +@pytest.mark.parametrize("rules", [[], [{}, {}]]) +def test_active_integration_rejects_rule_count(rules): + with pytest.raises(RulesetGovernanceError, match="one rule"): + p._active_integration_id({"rules": rules}) + + +@pytest.mark.parametrize("checks", [[], [{}, {}]]) +def test_active_integration_rejects_check_count(checks): + live = {"rules": [{"parameters": {"required_status_checks": checks}}]} + with pytest.raises(RulesetGovernanceError, match="one check"): + p._active_integration_id(live) + + +def test_active_integration_id(): + live = {"rules": [{"parameters": {"required_status_checks": [{"integration_id": 15368}]}}]} + assert p._active_integration_id(live) == 15368 + live["rules"][0]["parameters"]["required_status_checks"][0]["integration_id"] = None + with pytest.raises(RulesetGovernanceError, match="positive"): + p._active_integration_id(live) + + +def test_verify_absent_and_unpinned_existing(monkeypatch): + monkeypatch.setattr(p, "_named_ruleset", lambda: None) + assert p.verify_product_ruleset(manifest()) == "absent" + monkeypatch.setattr(p, "_named_ruleset", lambda: {"id": 9}) + with pytest.raises(RulesetGovernanceError, match="pin"): + p.verify_product_ruleset(manifest()) + + +def test_verify_pinned_missing(monkeypatch): + monkeypatch.setattr(p, "_named_ruleset", lambda: None) + with pytest.raises(RulesetGovernanceError, match="absent"): + p.verify_product_ruleset(manifest(9)) + + +def test_verify_evaluate_active_and_unknown(monkeypatch): + monkeypatch.setattr(p, "_named_ruleset", lambda: {"id": 9}) + monkeypatch.setattr(p, "_assert_target_provenance", lambda *a: None) + monkeypatch.setattr(p, "_live", lambda t: live_payload(9)) + assert p.verify_product_ruleset(manifest(9)) == "evaluate" + monkeypatch.setattr(p, "_live", lambda t: live_payload(9, enforcement="active", integration_id=15368)) + assert p.verify_product_ruleset(manifest(9)) == "active" + bad = live_payload(9) + bad["enforcement"] = "disabled" + monkeypatch.setattr(p, "_live", lambda t: bad) + with pytest.raises(RulesetGovernanceError, match="unsupported"): + p.verify_product_ruleset(manifest(9)) + + +def completed(stdout="", returncode=0): + return SimpleNamespace(stdout=stdout, stderr="", returncode=returncode) + + +def test_create_evaluate_success(monkeypatch): + created = live_payload(11) + monkeypatch.setattr(subprocess, "run", lambda *a, **k: completed(json.dumps(created))) + assert p._create_evaluate_ruleset()["id"] == 11 + + +def test_create_evaluate_success_invalid_json_settles(monkeypatch): + monkeypatch.setattr(subprocess, "run", lambda *a, **k: completed("{")) + monkeypatch.setattr(p, "_named_ruleset", lambda: {"id": 12}) + monkeypatch.setattr(p, "_live", lambda t: live_payload(12)) + monkeypatch.setattr(p, "_assert_target_provenance", lambda *a: None) + assert p._create_evaluate_ruleset()["id"] == 12 + + +@pytest.mark.parametrize("outcome", ["timeout", "nonzero"]) +def test_create_evaluate_ambiguous_settles(monkeypatch, outcome): + def run(*a, **k): + if outcome == "timeout": + raise subprocess.TimeoutExpired("gh", 30) + return completed("", 1) + monkeypatch.setattr(subprocess, "run", run) + monkeypatch.setattr(p, "_named_ruleset", lambda: {"id": 13}) + monkeypatch.setattr(p, "_live", lambda t: live_payload(13)) + monkeypatch.setattr(p, "_assert_target_provenance", lambda *a: None) + assert p._create_evaluate_ruleset()["id"] == 13 + + +def test_create_evaluate_ambiguous_without_live_identity(monkeypatch): + monkeypatch.setattr(subprocess, "run", lambda *a, **k: completed("", 1)) + monkeypatch.setattr(p, "_named_ruleset", lambda: None) + with pytest.raises(RulesetGovernanceError, match="ambiguous"): + p._create_evaluate_ruleset() + + +def test_bootstrap_pinned_evaluate_and_active(monkeypatch): + calls = [] + monkeypatch.setattr(p, "_assert_current_main", lambda sha: calls.append(sha)) + monkeypatch.setattr(p, "_named_ruleset", lambda: {"id": 20}) + monkeypatch.setattr(p, "_assert_target_provenance", lambda *a: None) + monkeypatch.setattr(p, "_live", lambda t: live_payload(20)) + assert p.bootstrap_product_ruleset(manifest(20), expected_main_sha="a"*40) == 20 + monkeypatch.setattr(p, "_live", lambda t: live_payload(20, enforcement="active", integration_id=15368)) + assert p.bootstrap_product_ruleset(manifest(20), expected_main_sha="a"*40) == 20 + assert len(calls) == 4 + + +def test_bootstrap_pinned_missing(monkeypatch): + monkeypatch.setattr(p, "_assert_current_main", lambda sha: None) + monkeypatch.setattr(p, "_named_ruleset", lambda: None) + with pytest.raises(RulesetGovernanceError, match="absent"): + p.bootstrap_product_ruleset(manifest(20), expected_main_sha="a"*40) + + +def test_bootstrap_unpinned_existing(monkeypatch): + monkeypatch.setattr(p, "_assert_current_main", lambda sha: None) + monkeypatch.setattr(p, "_named_ruleset", lambda: {"id": 21}) + with pytest.raises(RulesetGovernanceError, match="pin"): + p.bootstrap_product_ruleset(manifest(), expected_main_sha="a"*40) + + +def test_bootstrap_creates_and_verifies_history(monkeypatch): + seen = [] + monkeypatch.setattr(p, "_assert_current_main", lambda sha: seen.append(sha)) + monkeypatch.setattr(p, "_named_ruleset", lambda: None) + monkeypatch.setattr(p, "_create_evaluate_ruleset", lambda: live_payload(22)) + monkeypatch.setattr(p, "_assert_target_provenance", lambda *a: None) + monkeypatch.setattr(p, "_latest_history_version", lambda target: 3) + monkeypatch.setattr(p, "_history_version_state", lambda target, version: live_payload(22)) + assert p.bootstrap_product_ruleset(manifest(), expected_main_sha="a"*40) == 22 + assert seen == ["a"*40, "a"*40] + + +def test_decode_workflow(): + text = "name: Product" + payload = { + "type": "file", + "encoding": "base64", + "content": base64.b64encode(text.encode()).decode(), + } + assert p._decode_workflow(payload) == text + with pytest.raises(RulesetGovernanceError, match="base64 file"): + p._decode_workflow({"type": "dir", "encoding": "base64", "content": ""}) + with pytest.raises(RulesetGovernanceError, match="malformed"): + p._decode_workflow({"type": "file", "encoding": "base64", "content": None}) + with pytest.raises(RulesetGovernanceError, match="invalid"): + p._decode_workflow({"type": "file", "encoding": "base64", "content": "!"}) + + +def test_assert_base_product_workflow(monkeypatch): + good = "name: Product\nx: 'Product acceptance'\ny: 'Product metadata-only'\n" + monkeypatch.setattr(p, "_gh_api", lambda *a, **k: { + "type": "file", + "encoding": "base64", + "content": base64.b64encode(good.encode()).decode(), + }) + p._assert_base_product_workflow("a"*40) + bad = "name: Product\n" + monkeypatch.setattr(p, "_gh_api", lambda *a, **k: { + "type": "file", + "encoding": "base64", + "content": base64.b64encode(bad.encode()).decode(), + }) + with pytest.raises(RulesetGovernanceError, match="identities"): + p._assert_base_product_workflow("a"*40) + + +def canary_api(head_sha="b"*40, base_sha="a"*40, run_id=77, pr_number=5, *, + pr_state="open", draft=False, base_ref="main", run_name="Product", + run_event="pull_request", run_status="completed", run_conclusion="success", + job_name="Product acceptance", job_status="completed", job_conclusion="success", + app_id=15368, bound=True, check_ok=True): + workflow = "name: Product\nn: 'Product acceptance'\nm: 'Product metadata-only'\n" + def api(method, endpoint, **kwargs): + if endpoint.endswith(f"pulls/{pr_number}"): + return { + "state": pr_state, + "draft": draft, + "head": {"sha": head_sha}, + "base": {"ref": base_ref, "sha": base_sha}, + } + if endpoint.endswith("git/ref/heads/main"): + return {"object": {"sha": base_sha}} + if "contents/.github/workflows/product.yml" in endpoint: + return { + "type": "file", + "encoding": "base64", + "content": base64.b64encode(workflow.encode()).decode(), + } + if endpoint.endswith(f"actions/runs/{run_id}"): + return { + "name": run_name, + "event": run_event, + "head_sha": head_sha, + "status": run_status, + "conclusion": run_conclusion, + "check_suite_id": 900, + "pull_requests": [ + { + "number": pr_number if bound else pr_number + 1, + "head": {"sha": head_sha}, + "base": {"sha": base_sha}, + } + ], + } + if f"actions/runs/{run_id}/jobs" in endpoint: + return { + "jobs": [ + { + "name": job_name, + "status": job_status, + "conclusion": job_conclusion, + } + ] + } + if "check-runs" in endpoint: + return { + "check_runs": [ + { + "name": p.PRODUCT_CHECK if check_ok else "Other", + "check_suite": {"id": 900}, + "status": "completed", + "conclusion": "success", + "app": {"id": app_id}, + } + ] + } + raise AssertionError(endpoint) + return api + + +def test_canary_success(monkeypatch): + monkeypatch.setattr(p, "_gh_api", canary_api()) + assert p._canary_integration_id(pr_number=5, run_id=77) == 15368 + + +@pytest.mark.parametrize( + "kwargs,match", + [ + ({}, "positive"), + ], +) +def test_canary_nonpositive(kwargs, match): + with pytest.raises(RulesetGovernanceError, match=match): + p._canary_integration_id(pr_number=0, run_id=1) + + +@pytest.mark.parametrize( + "api,match", + [ + (canary_api(pr_state="closed"), "open"), + (canary_api(draft=True), "open"), + (canary_api(head_sha="bad"), "malformed"), + (canary_api(base_ref="dev"), "protected main"), + (canary_api(run_name="Other"), "terminal Product"), + (canary_api(run_event="push"), "terminal Product"), + (canary_api(run_status="queued"), "terminal Product"), + (canary_api(run_conclusion="failure"), "terminal Product"), + (canary_api(bound=False), "bound"), + (canary_api(job_name="Product metadata-only"), "exactly one"), + (canary_api(job_status="queued"), "not successful"), + (canary_api(job_conclusion="failure"), "not successful"), + (canary_api(check_ok=False), "one exact"), + (canary_api(app_id=0), "positive integration"), + ], +) +def test_canary_rejects(monkeypatch, api, match): + monkeypatch.setattr(p, "_gh_api", api) + with pytest.raises(RulesetGovernanceError, match=match): + p._canary_integration_id(pr_number=5, run_id=77) + + +def test_canary_rejects_stale_base(monkeypatch): + api = canary_api() + def stale(method, endpoint, **kwargs): + if endpoint.endswith("git/ref/heads/main"): + return {"object": {"sha": "c"*40}} + return api(method, endpoint, **kwargs) + monkeypatch.setattr(p, "_gh_api", stale) + with pytest.raises(RulesetGovernanceError, match="current"): + p._canary_integration_id(pr_number=5, run_id=77) + + +def test_activate_success(monkeypatch): + main_calls = [] + live_calls = {"n": 0} + monkeypatch.setattr(p, "_assert_current_main", lambda sha: main_calls.append(sha)) + monkeypatch.setattr(p, "_named_ruleset", lambda: {"id": 30}) + monkeypatch.setattr(p, "_assert_target_provenance", lambda *a: None) + before = live_payload(30) + after = live_payload(30, enforcement="active", integration_id=15368) + def live(target): + live_calls["n"] += 1 + return before if live_calls["n"] <= 2 else after + monkeypatch.setattr(p, "_live", live) + monkeypatch.setattr(p, "_canary_integration_id", lambda **k: 15368) + monkeypatch.setattr(p, "_latest_history_version", lambda target: 4) + monkeypatch.setattr(p, "_gh_api", lambda *a, **k: {}) + verified = [] + monkeypatch.setattr(p, "_verify_ruleset_history_transition", lambda *a, **k: verified.append((a, k))) + assert p.activate_product_ruleset( + manifest(30), expected_main_sha="a"*40, canary_pr=5, canary_run_id=77 + ) == 15368 + assert len(main_calls) == 4 + assert verified + + +def test_activate_ambiguous_success(monkeypatch): + monkeypatch.setattr(p, "_assert_current_main", lambda sha: None) + monkeypatch.setattr(p, "_named_ruleset", lambda: {"id": 31}) + monkeypatch.setattr(p, "_assert_target_provenance", lambda *a: None) + monkeypatch.setattr(p, "_live", lambda target: live_payload(31)) + monkeypatch.setattr(p, "_canary_integration_id", lambda **k: 15368) + monkeypatch.setattr(p, "_latest_history_version", lambda target: 4) + def api(*a, **k): + raise AmbiguousRulesetWriteError("x") + monkeypatch.setattr(p, "_gh_api", api) + after = live_payload(31, enforcement="active", integration_id=15368) + monkeypatch.setattr(p, "_confirm_ambiguous_put", lambda *a, **k: after) + assert p.activate_product_ruleset( + manifest(31), expected_main_sha="a"*40, canary_pr=5, canary_run_id=77 + ) == 15368 + + +def test_activate_requires_pinned(monkeypatch): + monkeypatch.setattr(p, "_assert_current_main", lambda sha: None) + with pytest.raises(RulesetGovernanceError, match="adoption"): + p.activate_product_ruleset( + manifest(), expected_main_sha="a"*40, canary_pr=1, canary_run_id=1 + ) + + +def test_activate_missing_or_active_or_concurrent(monkeypatch): + monkeypatch.setattr(p, "_assert_current_main", lambda sha: None) + monkeypatch.setattr(p, "_named_ruleset", lambda: None) + with pytest.raises(RulesetGovernanceError, match="absent"): + p.activate_product_ruleset(manifest(32), expected_main_sha="a"*40, canary_pr=1, canary_run_id=1) + monkeypatch.setattr(p, "_named_ruleset", lambda: {"id": 32}) + monkeypatch.setattr(p, "_assert_target_provenance", lambda *a: None) + monkeypatch.setattr(p, "_live", lambda target: live_payload(32, enforcement="active", integration_id=15368)) + with pytest.raises(RulesetGovernanceError, match="already active"): + p.activate_product_ruleset(manifest(32), expected_main_sha="a"*40, canary_pr=1, canary_run_id=1) + + states = iter([live_payload(32), {**live_payload(32), "bypass_actors": [{"actor_id": 1}]}]) + monkeypatch.setattr(p, "_live", lambda target: next(states)) + monkeypatch.setattr(p, "_canary_integration_id", lambda **k: 15368) + monkeypatch.setattr(p, "_latest_history_version", lambda target: 1) + with pytest.raises(RulesetGovernanceError, match="concurrently"): + p.activate_product_ruleset(manifest(32), expected_main_sha="a"*40, canary_pr=1, canary_run_id=1) + + +def test_positive_int_and_parse_args(): + assert p._positive_int("2") == 2 + with pytest.raises(Exception): + p._positive_int("0") + args = p._parse_args(["--mode", "validate"]) + assert args.mode == "validate" + + +def test_main_modes(monkeypatch, tmp_path, capsys): + path = write_manifest(tmp_path, manifest()) + assert p.main(["--manifest", str(path), "--mode", "validate"]) == 0 + monkeypatch.delenv("GH_TOKEN", raising=False) + with pytest.raises(RulesetGovernanceError, match="GH_TOKEN"): + p.main(["--manifest", str(path), "--mode", "verify"]) + monkeypatch.setenv("GH_TOKEN", "x") + monkeypatch.setattr(p, "verify_product_ruleset", lambda m: "absent") + assert p.main(["--manifest", str(path), "--mode", "verify"]) == 0 + monkeypatch.delenv("CWL_RULESET_RECONCILE_ENABLED", raising=False) + with pytest.raises(RulesetGovernanceError, match="disabled"): + p.main(["--manifest", str(path), "--mode", "bootstrap", "--expected-main-sha", "a"*40]) + monkeypatch.setenv("CWL_RULESET_RECONCILE_ENABLED", "true") + with pytest.raises(RulesetGovernanceError, match="expected"): + p.main(["--manifest", str(path), "--mode", "bootstrap"]) + monkeypatch.setattr(p, "bootstrap_product_ruleset", lambda *a, **k: 44) + assert p.main(["--manifest", str(path), "--mode", "bootstrap", "--expected-main-sha", "a"*40]) == 0 + with pytest.raises(RulesetGovernanceError, match="canary"): + p.main(["--manifest", str(path), "--mode", "activate", "--expected-main-sha", "a"*40]) + + pinned = write_manifest(tmp_path, manifest(44)) + monkeypatch.setattr(p, "activate_product_ruleset", lambda *a, **k: 15368) + assert p.main([ + "--manifest", str(pinned), "--mode", "activate", "--expected-main-sha", "a"*40, + "--canary-pr", "5", "--canary-run-id", "77", + ]) == 0 + assert "integration_id=15368" in capsys.readouterr().out + + +def test_cli_success_and_error(monkeypatch, capsys): + monkeypatch.setattr(p, "main", lambda: 0) + with pytest.raises(SystemExit) as exc: + p.cli() + assert exc.value.code == 0 + monkeypatch.setattr(p, "main", lambda: (_ for _ in ()).throw(RulesetGovernanceError("boom"))) + with pytest.raises(SystemExit) as exc: + p.cli() + assert exc.value.code == 1 + assert "boom" in capsys.readouterr().err + + +def test_main_bootstrap_pinned_skips_adoption_message(monkeypatch, tmp_path, capsys): + path = write_manifest(tmp_path, manifest(45)) + monkeypatch.setenv("GH_TOKEN", "x") + monkeypatch.setenv("CWL_RULESET_RECONCILE_ENABLED", "true") + monkeypatch.setattr(p, "bootstrap_product_ruleset", lambda *a, **k: 45) + assert p.main(["--manifest", str(path), "--mode", "bootstrap", "--expected-main-sha", "a"*40]) == 0 + assert "adoption required" not in capsys.readouterr().out From 1add6c970fa38b0f8de29ad2c77c79b5f36d8cbe Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 10:01:14 +0900 Subject: [PATCH 03/45] fix(governance): stage ConceptWeave Product ruleset lifecycle --- .../reconcile_conceptweave_product_ruleset.py | 623 ++++++++++++++++++ 1 file changed, 623 insertions(+) create mode 100644 scripts/ci/reconcile_conceptweave_product_ruleset.py diff --git a/scripts/ci/reconcile_conceptweave_product_ruleset.py b/scripts/ci/reconcile_conceptweave_product_ruleset.py new file mode 100644 index 0000000000..6e7975b1ea --- /dev/null +++ b/scripts/ci/reconcile_conceptweave_product_ruleset.py @@ -0,0 +1,623 @@ +#!/usr/bin/env python3 +"""Stage ConceptWeave Product ruleset enforcement without bootstrap deadlock.""" + +from __future__ import annotations + +import argparse +import base64 +import json +import os +import re +import subprocess +import sys +from pathlib import Path +from typing import Any + +from scripts.ci.reconcile_ruleset_governance import ( + API_REQUEST_TIMEOUT_SECONDS, + API_VERSION, + AmbiguousRulesetWriteError, + RulesetGovernanceError, + RulesetTarget, + _assert_current_main, + _assert_target_provenance, + _confirm_ambiguous_put, + _editable_projection, + _gh_api, + _gh_api_list, + _history_version_state, + _latest_history_version, + _plain_dict, + _plain_list, + _verify_ruleset_history_transition, +) + +ORGANIZATION = "ContextualWisdomLab" +TARGET_REPOSITORY = "ConceptWeave" +TARGET_FULL_NAME = f"{ORGANIZATION}/{TARGET_REPOSITORY}" +TARGET_BRANCH = "main" +RULESET_NAME = "ConceptWeave Product acceptance" +PRODUCT_WORKFLOW_PATH = ".github/workflows/product.yml" +PRODUCT_WORKFLOW_NAME = "Product" +PRODUCT_CHECK = "Product acceptance" +METADATA_ONLY_CHECK = "Product metadata-only" +GIT_SHA_RE = re.compile(r"^[0-9a-f]{40}$") + + +def load_product_manifest(path: Path) -> dict[str, Any]: + """Load and strictly validate the reviewed ConceptWeave Product manifest.""" + + root = _plain_dict(json.loads(path.read_text(encoding="utf-8")), field="product manifest") + expected_keys = { + "schema_version", + "target_repository", + "target_branch", + "ruleset_name", + "ruleset_id", + "required_check", + "forbidden_check", + } + if set(root) != expected_keys: + raise RulesetGovernanceError("Product manifest has an unexpected key set") + expected = { + "schema_version": 1, + "target_repository": TARGET_FULL_NAME, + "target_branch": TARGET_BRANCH, + "ruleset_name": RULESET_NAME, + "required_check": PRODUCT_CHECK, + "forbidden_check": METADATA_ONLY_CHECK, + } + mismatches = [key for key, value in expected.items() if root.get(key) != value] + if mismatches: + raise RulesetGovernanceError( + f"Product manifest has unsupported fields: {', '.join(sorted(mismatches))}" + ) + ruleset_id = root["ruleset_id"] + if ruleset_id is not None and (type(ruleset_id) is not int or ruleset_id <= 0): + raise RulesetGovernanceError("Product manifest ruleset_id must be null or positive") + return root + + +def _target(ruleset_id: int) -> RulesetTarget: + """Build the exact repository-owned ruleset identity after source adoption.""" + + if type(ruleset_id) is not int or ruleset_id <= 0: + raise RulesetGovernanceError("Product ruleset identity must be positive") + return RulesetTarget( + scope="repository", + owner=ORGANIZATION, + repository=TARGET_REPOSITORY, + ruleset_id=ruleset_id, + name=RULESET_NAME, + ) + + +def _desired(*, enforcement: str, integration_id: int | None) -> dict[str, Any]: + """Return the exact evaluate or active Product ruleset mutation body.""" + + if enforcement not in {"evaluate", "active"}: + raise RulesetGovernanceError("Product ruleset enforcement is unsupported") + check: dict[str, Any] = {"context": PRODUCT_CHECK} + if integration_id is not None: + if type(integration_id) is not int or integration_id <= 0: + raise RulesetGovernanceError("Product integration identity must be positive") + check["integration_id"] = integration_id + return { + "name": RULESET_NAME, + "target": "branch", + "enforcement": enforcement, + "bypass_actors": [], + "conditions": { + "ref_name": { + "include": [f"refs/heads/{TARGET_BRANCH}"], + "exclude": [], + } + }, + "rules": [ + { + "type": "required_status_checks", + "parameters": { + "do_not_enforce_on_create": False, + "required_status_checks": [check], + "strict_required_status_checks_policy": True, + }, + } + ], + } + + +def _assert_shape( + live: dict[str, Any], + target: RulesetTarget, + *, + enforcement: str, + integration_id: int | None, +) -> None: + """Require exact provenance and policy for the dedicated Product ruleset.""" + + _assert_target_provenance(live, target) + if live.get("name") != RULESET_NAME: + raise RulesetGovernanceError("Product ruleset name drifted") + if _editable_projection(live) != _desired( + enforcement=enforcement, + integration_id=integration_id, + ): + raise RulesetGovernanceError( + f"Product ruleset does not match reviewed {enforcement} policy" + ) + + +def _repository_rulesets() -> list[dict[str, Any]]: + """List repository-owned rulesets only, excluding inherited organization rules.""" + + payload = _gh_api_list( + "GET", + f"repos/{TARGET_FULL_NAME}/rulesets?includes_parents=false&per_page=100", + ) + result: list[dict[str, Any]] = [] + for item in payload: + live = _plain_dict(item, field="repository ruleset list entry") + if live.get("source_type") != "Repository" or live.get("source") != TARGET_FULL_NAME: + raise RulesetGovernanceError( + "repository-only Product ruleset discovery returned foreign provenance" + ) + result.append(live) + return result + + +def _named_ruleset() -> dict[str, Any] | None: + """Return the one exact-name repository ruleset or fail on duplicate identity.""" + + matches = [item for item in _repository_rulesets() if item.get("name") == RULESET_NAME] + if len(matches) > 1: + raise RulesetGovernanceError("multiple ConceptWeave Product rulesets are ambiguous") + return matches[0] if matches else None + + +def _live(target: RulesetTarget) -> dict[str, Any]: + """Fetch one pinned Product ruleset from its immutable repository identity.""" + + payload = _gh_api("GET", target.endpoint) + _assert_target_provenance(payload, target) + return payload + + +def _active_integration_id(live: dict[str, Any]) -> int: + """Return the exact integration identity bound by an active Product policy.""" + + rules = _plain_list(live.get("rules"), field="Product rules") + if len(rules) != 1: + raise RulesetGovernanceError("active Product ruleset must contain one rule") + rule = _plain_dict(rules[0], field="Product required-status rule") + parameters = _plain_dict( + rule.get("parameters"), field="Product required-status parameters" + ) + checks = _plain_list( + parameters.get("required_status_checks"), + field="Product required status checks", + ) + if len(checks) != 1: + raise RulesetGovernanceError("active Product ruleset must require one check") + check = _plain_dict(checks[0], field="Product required status check") + integration_id = check.get("integration_id") + if type(integration_id) is not int or integration_id <= 0: + raise RulesetGovernanceError( + "active Product ruleset lacks a positive integration identity" + ) + return integration_id + + +def verify_product_ruleset(manifest: dict[str, Any]) -> str: + """Verify absent, evaluate, or active live state without mutating governance.""" + + pinned_id = manifest["ruleset_id"] + named = _named_ruleset() + if pinned_id is None: + if named is None: + return "absent" + raise RulesetGovernanceError( + f"Product ruleset exists as id={named.get('id')}; pin it in reviewed source" + ) + target = _target(pinned_id) + if named is None or named.get("id") != pinned_id: + raise RulesetGovernanceError("pinned Product ruleset is absent or name-drifted") + live = _live(target) + if live.get("enforcement") == "evaluate": + _assert_shape(live, target, enforcement="evaluate", integration_id=None) + return "evaluate" + if live.get("enforcement") == "active": + integration_id = _active_integration_id(live) + _assert_shape( + live, + target, + enforcement="active", + integration_id=integration_id, + ) + return "active" + raise RulesetGovernanceError("Product ruleset enforcement is unsupported") + + +def _create_evaluate_ruleset() -> dict[str, Any]: + """Create the evaluate-only Product ruleset with ambiguous-result settlement.""" + + endpoint = f"repos/{TARGET_FULL_NAME}/rulesets" + body = _desired(enforcement="evaluate", integration_id=None) + command = [ + "gh", + "api", + "--method", + "POST", + "-H", + f"X-GitHub-Api-Version: {API_VERSION}", + endpoint, + "--input", + "-", + ] + ambiguous: BaseException | None = None + try: + completed = subprocess.run( + command, + check=False, + input=json.dumps(body, separators=(",", ":")), + capture_output=True, + text=True, + timeout=API_REQUEST_TIMEOUT_SECONDS, + ) + except subprocess.TimeoutExpired as exc: + ambiguous = exc + else: + if completed.returncode == 0: + try: + return _plain_dict( + json.loads(completed.stdout), + field="Product ruleset create response", + ) + except json.JSONDecodeError as exc: + ambiguous = exc + else: + ambiguous = AmbiguousRulesetWriteError( + "GitHub Product ruleset POST outcome is ambiguous" + ) + + settled = _named_ruleset() + if settled is None: + raise RulesetGovernanceError( + "Product ruleset create outcome remains ambiguous with no live identity" + ) from ambiguous + ruleset_id = settled.get("id") + target = _target(ruleset_id) + live = _live(target) + _assert_shape(live, target, enforcement="evaluate", integration_id=None) + return live + + +def bootstrap_product_ruleset( + manifest: dict[str, Any], + *, + expected_main_sha: str, +) -> int: + """Create evaluate policy or verify the exact reviewed source-adopted identity.""" + + _assert_current_main(expected_main_sha) + pinned_id = manifest["ruleset_id"] + named = _named_ruleset() + if pinned_id is not None: + target = _target(pinned_id) + if named is None or named.get("id") != pinned_id: + raise RulesetGovernanceError("pinned Product ruleset is absent or name-drifted") + live = _live(target) + if live.get("enforcement") == "active": + integration_id = _active_integration_id(live) + _assert_shape( + live, + target, + enforcement="active", + integration_id=integration_id, + ) + else: + _assert_shape(live, target, enforcement="evaluate", integration_id=None) + _assert_current_main(expected_main_sha) + return pinned_id + + if named is not None: + raise RulesetGovernanceError( + f"Product ruleset exists as id={named.get('id')}; pin it before mutation" + ) + created = _create_evaluate_ruleset() + ruleset_id = created.get("id") + target = _target(ruleset_id) + _assert_shape(created, target, enforcement="evaluate", integration_id=None) + version = _latest_history_version(target) + history_state = _history_version_state(target, version) + _assert_shape(history_state, target, enforcement="evaluate", integration_id=None) + _assert_current_main(expected_main_sha) + return ruleset_id + + +def _decode_workflow(payload: dict[str, Any]) -> str: + """Decode an exact GitHub contents response for the Product workflow.""" + + if payload.get("type") != "file" or payload.get("encoding") != "base64": + raise RulesetGovernanceError("Product workflow contents are not a base64 file") + content = payload.get("content") + if type(content) is not str: + raise RulesetGovernanceError("Product workflow content is malformed") + try: + return base64.b64decode(content, validate=True).decode("utf-8") + except (ValueError, UnicodeDecodeError) as exc: + raise RulesetGovernanceError("Product workflow content is invalid UTF-8 base64") from exc + + +def _assert_base_product_workflow(base_sha: str) -> None: + """Require the protected canary base to contain both reviewed Product identities.""" + + payload = _gh_api( + "GET", + f"repos/{TARGET_FULL_NAME}/contents/{PRODUCT_WORKFLOW_PATH}?ref={base_sha}", + ) + text = _decode_workflow(payload) + for fragment in ("name: Product", "'Product acceptance'", "'Product metadata-only'"): + if fragment not in text: + raise RulesetGovernanceError( + "protected-base Product workflow lacks reviewed check identities" + ) + + +def _canary_integration_id(*, pr_number: int, run_id: int) -> int: + """Prove an exact current-base successful Product canary and return its app ID.""" + + if pr_number <= 0 or run_id <= 0: + raise RulesetGovernanceError("canary identities must be positive") + pr = _gh_api("GET", f"repos/{TARGET_FULL_NAME}/pulls/{pr_number}") + if pr.get("state") != "open" or pr.get("draft") is True: + raise RulesetGovernanceError("Product canary PR must be open and non-draft") + head = _plain_dict(pr.get("head"), field="Product canary head") + base = _plain_dict(pr.get("base"), field="Product canary base") + head_sha = str(head.get("sha") or "").lower() + base_sha = str(base.get("sha") or "").lower() + if not GIT_SHA_RE.fullmatch(head_sha) or not GIT_SHA_RE.fullmatch(base_sha): + raise RulesetGovernanceError("Product canary returned malformed head/base SHA") + if base.get("ref") != TARGET_BRANCH: + raise RulesetGovernanceError("Product canary does not target protected main") + if _gh_api( + "GET", + f"repos/{TARGET_FULL_NAME}/git/ref/heads/{TARGET_BRANCH}", + ).get("object", {}).get("sha") != base_sha: + raise RulesetGovernanceError("Product canary base is not current protected main") + _assert_base_product_workflow(base_sha) + + run = _gh_api("GET", f"repos/{TARGET_FULL_NAME}/actions/runs/{run_id}") + if ( + run.get("name") != PRODUCT_WORKFLOW_NAME + or run.get("event") != "pull_request" + or run.get("head_sha") != head_sha + or run.get("status") != "completed" + or run.get("conclusion") != "success" + ): + raise RulesetGovernanceError( + "canary run is not exact-head terminal Product success" + ) + run_prs = _plain_list(run.get("pull_requests"), field="Product canary run pull_requests") + bound = False + for item in run_prs: + run_pr = _plain_dict(item, field="Product canary run pull request") + run_head = _plain_dict(run_pr.get("head"), field="Product canary run head") + run_base = _plain_dict(run_pr.get("base"), field="Product canary run base") + if ( + run_pr.get("number") == pr_number + and run_head.get("sha") == head_sha + and run_base.get("sha") == base_sha + ): + bound = True + break + if not bound: + raise RulesetGovernanceError("Product canary run is not bound to live PR head/base") + + jobs = _plain_list( + _gh_api( + "GET", + f"repos/{TARGET_FULL_NAME}/actions/runs/{run_id}/jobs?filter=latest&per_page=100", + ).get("jobs"), + field="Product canary jobs", + ) + acceptance = [ + _plain_dict(job, field="Product canary job") + for job in jobs + if _plain_dict(job, field="Product canary job").get("name") == PRODUCT_CHECK + ] + if len(acceptance) != 1: + raise RulesetGovernanceError( + "Product canary must contain exactly one Product acceptance job" + ) + if ( + acceptance[0].get("status") != "completed" + or acceptance[0].get("conclusion") != "success" + ): + raise RulesetGovernanceError("Product acceptance canary job is not successful") + + checks = _plain_list( + _gh_api( + "GET", + f"repos/{TARGET_FULL_NAME}/commits/{head_sha}/check-runs" + "?check_name=Product%20acceptance&filter=latest&per_page=100", + ).get("check_runs"), + field="Product acceptance check runs", + ) + suite_id = run.get("check_suite_id") + matched: list[dict[str, Any]] = [] + for item in checks: + check = _plain_dict(item, field="Product acceptance check") + suite = _plain_dict(check.get("check_suite"), field="Product acceptance check suite") + if ( + check.get("name") == PRODUCT_CHECK + and suite.get("id") == suite_id + and check.get("status") == "completed" + and check.get("conclusion") == "success" + ): + matched.append(check) + if len(matched) != 1: + raise RulesetGovernanceError( + "Product canary lacks one exact successful Product acceptance check" + ) + app = _plain_dict(matched[0].get("app"), field="Product acceptance app") + integration_id = app.get("id") + if type(integration_id) is not int or integration_id <= 0: + raise RulesetGovernanceError( + "Product acceptance check lacks a positive integration identity" + ) + return integration_id + + +def activate_product_ruleset( + manifest: dict[str, Any], + *, + expected_main_sha: str, + canary_pr: int, + canary_run_id: int, +) -> int: + """Promote evaluate to active only after exact current-base Product evidence.""" + + _assert_current_main(expected_main_sha) + pinned_id = manifest["ruleset_id"] + if type(pinned_id) is not int or pinned_id <= 0: + raise RulesetGovernanceError("Product activation requires reviewed ruleset_id adoption") + target = _target(pinned_id) + named = _named_ruleset() + if named is None or named.get("id") != pinned_id: + raise RulesetGovernanceError("pinned Product ruleset is absent or name-drifted") + first = _live(target) + if first.get("enforcement") == "active": + raise RulesetGovernanceError("Product ruleset is already active; use verify") + _assert_shape(first, target, enforcement="evaluate", integration_id=None) + + integration_id = _canary_integration_id( + pr_number=canary_pr, + run_id=canary_run_id, + ) + desired = _desired(enforcement="active", integration_id=integration_id) + baseline_version = _latest_history_version(target) + _assert_current_main(expected_main_sha) + second = _live(target) + if _editable_projection(second) != _editable_projection(first): + raise RulesetGovernanceError( + "Product ruleset changed concurrently; refusing activation" + ) + _assert_shape(second, target, enforcement="evaluate", integration_id=None) + _assert_current_main(expected_main_sha) + + history_verified = False + try: + _gh_api("PUT", target.endpoint, body=desired) + except (AmbiguousRulesetWriteError, subprocess.TimeoutExpired): + after = _confirm_ambiguous_put( + target, + baseline_version=baseline_version, + desired=desired, + expected_main_sha=expected_main_sha, + ) + history_verified = True + else: + after = _live(target) + + _assert_shape( + after, + target, + enforcement="active", + integration_id=integration_id, + ) + if not history_verified: + _verify_ruleset_history_transition( + target, + baseline_version, + desired, + expected_main_sha=None, + ) + _assert_current_main(expected_main_sha) + return integration_id + + +def _positive_int(value: str) -> int: + """Parse one strictly positive CLI integer.""" + + parsed = int(value) + if parsed <= 0: + raise argparse.ArgumentTypeError("value must be positive") + return parsed + + +def _parse_args(argv: list[str] | None = None) -> argparse.Namespace: + """Parse source validation, live verification, bootstrap, and activation modes.""" + + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument( + "--manifest", + type=Path, + default=Path("config/conceptweave-product-ruleset.json"), + ) + parser.add_argument( + "--mode", + required=True, + choices=("validate", "verify", "bootstrap", "activate"), + ) + parser.add_argument("--expected-main-sha") + parser.add_argument("--canary-pr", type=_positive_int) + parser.add_argument("--canary-run-id", type=_positive_int) + return parser.parse_args(argv) + + +def main(argv: list[str] | None = None) -> int: + """Execute the requested fail-closed Product ruleset lifecycle phase.""" + + args = _parse_args(argv) + manifest = load_product_manifest(args.manifest) + if args.mode == "validate": + print("validated ConceptWeave Product ruleset manifest") + return 0 + if not os.environ.get("GH_TOKEN"): + raise RulesetGovernanceError("GH_TOKEN is required for live Product governance") + if args.mode == "verify": + print(f"Product ruleset stage={verify_product_ruleset(manifest)}") + return 0 + if os.environ.get("CWL_RULESET_RECONCILE_ENABLED") != "true": + raise RulesetGovernanceError("privileged ruleset reconciliation is disabled") + if not args.expected_main_sha: + raise RulesetGovernanceError("expected protected main SHA is required for mutation") + if args.mode == "bootstrap": + ruleset_id = bootstrap_product_ruleset( + manifest, + expected_main_sha=args.expected_main_sha, + ) + print(f"Product ruleset id={ruleset_id}") + if manifest["ruleset_id"] is None: + print("reviewed source adoption required before further mutation") + return 0 + if args.canary_pr is None or args.canary_run_id is None: + raise RulesetGovernanceError("activate requires canary PR and run IDs") + integration_id = activate_product_ruleset( + manifest, + expected_main_sha=args.expected_main_sha, + canary_pr=args.canary_pr, + canary_run_id=args.canary_run_id, + ) + print(f"Product ruleset active integration_id={integration_id}") + return 0 + + +def cli() -> None: + """Run the command-line boundary with concise fail-closed diagnostics.""" + + try: + raise SystemExit(main()) + except ( + OSError, + ValueError, + json.JSONDecodeError, + subprocess.TimeoutExpired, + RulesetGovernanceError, + ) as exc: + print(f"ConceptWeave Product ruleset reconciliation failed: {exc}", file=sys.stderr) + raise SystemExit(1) from exc + + +if __name__ == "__main__": # pragma: no cover - subprocess contract + cli() From da519a0ff16f0eed334fa673e52d53cee10afc12 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 10:02:04 +0900 Subject: [PATCH 04/45] ci(governance): validate staged Product ruleset owner path --- ...conceptweave-product-ruleset-reconcile.yml | 192 ++++++++++++++++++ 1 file changed, 192 insertions(+) create mode 100644 .github/workflows/conceptweave-product-ruleset-reconcile.yml diff --git a/.github/workflows/conceptweave-product-ruleset-reconcile.yml b/.github/workflows/conceptweave-product-ruleset-reconcile.yml new file mode 100644 index 0000000000..fd6e7baee9 --- /dev/null +++ b/.github/workflows/conceptweave-product-ruleset-reconcile.yml @@ -0,0 +1,192 @@ +name: ConceptWeave Product Ruleset Reconcile + +on: + pull_request: + paths: + - "config/conceptweave-product-ruleset.json" + - "scripts/ci/reconcile_conceptweave_product_ruleset.py" + - "tests/test_conceptweave_product_ruleset_reconciliation.py" + - "docs/doctoring/conceptweave-product-ruleset-bootstrap.md" + - ".github/workflows/conceptweave-product-ruleset-reconcile.yml" + push: + branches: + - main + paths: + - "config/conceptweave-product-ruleset.json" + - "scripts/ci/reconcile_conceptweave_product_ruleset.py" + - "tests/test_conceptweave_product_ruleset_reconciliation.py" + - "docs/doctoring/conceptweave-product-ruleset-bootstrap.md" + - ".github/workflows/conceptweave-product-ruleset-reconcile.yml" + workflow_dispatch: + inputs: + mode: + description: "Read live state, create evaluate policy, or activate after a real Product canary" + required: true + type: choice + default: verify + options: + - verify + - bootstrap + - activate + canary_pr: + description: "Open non-draft ConceptWeave canary PR number; required only for activate" + required: false + type: string + canary_run_id: + description: "Exact successful repository-owned Product workflow run; required only for activate" + required: false + type: string + +permissions: + contents: read + +concurrency: + group: conceptweave-product-ruleset-${{ github.event_name == 'pull_request' && github.event.pull_request.number || 'owner-plane' }} + # PR validation may supersede itself. Privileged create/PUT plus immutable-history + # settlement must never be cancelled midway. + cancel-in-progress: ${{ github.event_name == 'pull_request' }} + +jobs: + validate: + runs-on: ubuntu-slim + timeout-minutes: 20 + steps: + - name: Harden runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + - name: Check out exact revision + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + ref: ${{ github.event.pull_request.head.sha || github.sha }} + persist-credentials: false + - name: Verify exact revision + shell: bash + run: test "$(git rev-parse HEAD)" = "${{ github.event.pull_request.head.sha || github.sha }}" + - name: Set up Python + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + with: + python-version: "3.12" + - name: Install hash-locked test tooling + run: >- + python -m pip install --disable-pip-version-check --require-hashes + --only-binary=:all: -r requirements-opencode-review-ci-hashes.txt + - name: Validate reviewed Product target manifest + run: >- + python scripts/ci/reconcile_conceptweave_product_ruleset.py + --manifest config/conceptweave-product-ruleset.json + --mode validate + - name: Prove Product ruleset lifecycle contract + env: + COVERAGE_RCFILE: /dev/null + run: | + set -euo pipefail + python -m coverage run \ + --branch \ + --include=scripts/ci/reconcile_conceptweave_product_ruleset.py \ + -m pytest -q tests/test_conceptweave_product_ruleset_reconciliation.py + python -m coverage report \ + --fail-under=100 \ + --show-missing \ + --include=scripts/ci/reconcile_conceptweave_product_ruleset.py + python -m interrogate \ + --fail-under 100 \ + scripts/ci/reconcile_conceptweave_product_ruleset.py + git diff --check + + verify-live: + if: >- + github.event_name == 'push' || + (github.event_name == 'workflow_dispatch' && inputs.mode == 'verify') + needs: validate + runs-on: ubuntu-slim + timeout-minutes: 10 + environment: ruleset-governance-maintenance + steps: + - name: Harden runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + - name: Check out trusted revision + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + ref: ${{ github.sha }} + persist-credentials: false + - name: Verify exact trusted revision + run: test "$(git rev-parse HEAD)" = "$GITHUB_SHA" + - name: Verify live Product ruleset stage + env: + GH_TOKEN: ${{ secrets.CWL_RULESET_ADMIN_TOKEN }} + run: >- + python scripts/ci/reconcile_conceptweave_product_ruleset.py + --manifest config/conceptweave-product-ruleset.json + --mode verify + + mutate-owner-plane: + if: >- + github.event_name == 'workflow_dispatch' && + github.ref == 'refs/heads/main' && + (inputs.mode == 'bootstrap' || inputs.mode == 'activate') && + vars.CWL_RULESET_RECONCILE_ENABLED == 'true' + needs: validate + runs-on: ubuntu-24.04 + # The shared #1644 immutable-history recovery path is intentionally allowed + # to finish even under slow GitHub API settlement. + timeout-minutes: 360 + environment: ruleset-governance-maintenance + steps: + - name: Harden runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + - name: Check out trusted protected main + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + ref: ${{ github.sha }} + persist-credentials: false + - name: Verify exact trusted revision + run: test "$(git rev-parse HEAD)" = "$GITHUB_SHA" + - name: Require dedicated ruleset administration credential + env: + GH_TOKEN: ${{ secrets.CWL_RULESET_ADMIN_TOKEN }} + run: test -n "$GH_TOKEN" + - name: Validate activation inputs + if: inputs.mode == 'activate' + env: + CANARY_PR: ${{ inputs.canary_pr }} + CANARY_RUN_ID: ${{ inputs.canary_run_id }} + shell: bash + run: | + [[ "$CANARY_PR" =~ ^[1-9][0-9]*$ ]] + [[ "$CANARY_RUN_ID" =~ ^[1-9][0-9]*$ ]] + - name: Bootstrap evaluate policy + if: inputs.mode == 'bootstrap' + env: + GH_TOKEN: ${{ secrets.CWL_RULESET_ADMIN_TOKEN }} + CWL_RULESET_RECONCILE_ENABLED: ${{ vars.CWL_RULESET_RECONCILE_ENABLED }} + run: >- + python scripts/ci/reconcile_conceptweave_product_ruleset.py + --manifest config/conceptweave-product-ruleset.json + --mode bootstrap + --expected-main-sha "$GITHUB_SHA" + - name: Activate policy from exact Product canary + if: inputs.mode == 'activate' + env: + GH_TOKEN: ${{ secrets.CWL_RULESET_ADMIN_TOKEN }} + CWL_RULESET_RECONCILE_ENABLED: ${{ vars.CWL_RULESET_RECONCILE_ENABLED }} + CANARY_PR: ${{ inputs.canary_pr }} + CANARY_RUN_ID: ${{ inputs.canary_run_id }} + run: >- + python scripts/ci/reconcile_conceptweave_product_ruleset.py + --manifest config/conceptweave-product-ruleset.json + --mode activate + --expected-main-sha "$GITHUB_SHA" + --canary-pr "$CANARY_PR" + --canary-run-id "$CANARY_RUN_ID" + - name: Verify post-change live state + env: + GH_TOKEN: ${{ secrets.CWL_RULESET_ADMIN_TOKEN }} + run: >- + python scripts/ci/reconcile_conceptweave_product_ruleset.py + --manifest config/conceptweave-product-ruleset.json + --mode verify From 5638acc3063b788bc0a761bc51f5df8185e1d329 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 10:03:01 +0900 Subject: [PATCH 05/45] docs(governance): record Product ruleset bootstrap boundary --- .../conceptweave-product-ruleset-bootstrap.md | 44 +++++++++++++++++++ 1 file changed, 44 insertions(+) create mode 100644 docs/doctoring/conceptweave-product-ruleset-bootstrap.md diff --git a/docs/doctoring/conceptweave-product-ruleset-bootstrap.md b/docs/doctoring/conceptweave-product-ruleset-bootstrap.md new file mode 100644 index 0000000000..89e64f1caa --- /dev/null +++ b/docs/doctoring/conceptweave-product-ruleset-bootstrap.md @@ -0,0 +1,44 @@ +# ConceptWeave Product ruleset bootstrap + +## Decision + +ConceptWeave owns its Product acceptance workflow; `.github` owns the privileged GitHub governance mechanism that can make that repository-owned result merge-blocking. The Product check therefore remains repository-local while this control-plane code manages only the repository-scoped policy around it. + +The live state observed on 2026-09-23 has one inherited ruleset, organization ruleset `18156473`, and no ConceptWeave-owned ruleset. Protected ConceptWeave `main@f4f440dd58c77d7cd90dff8a1eb2eeb9a9940425` does not contain `.github/workflows/product.yml`. PR `ContextualWisdomLab/ConceptWeave#35@2f3bc5851e4c02ac9d4f038bb9e816f0e3ba2788` introduces that producer, but its exact-head Actions inventory consequently contains only central required workflows and no repository-owned Product run. + +That ordering creates a bootstrap constraint. Activating a required `Product acceptance` status before #35 lands would require a result that the protected base cannot emit. The correct lifecycle is staged rather than bypassed. + +## Lifecycle + +1. Review this source on top of canonical ruleset-governance owner PR `.github#1644`. The initial manifest deliberately carries `ruleset_id: null` because no repository ruleset exists yet. +2. After #1644 and this dependent source have reached protected `.github/main`, an authorized maintenance run may create the ConceptWeave repository ruleset only in GitHub's `evaluate` enforcement state. Creation is bound to the exact protected control-repository SHA and the dedicated `ruleset-governance-maintenance` environment/credential. +3. The created positive ruleset ID is then adopted into `config/conceptweave-product-ruleset.json` through ordinary review. An already-existing unpinned rule is never silently adopted by a later mutation. +4. Separately, #772/#1351/#1644 must remove the structurally unsatisfiable generic human-approval requirement and routine administrator bypass without weakening central workflow, thread, deletion, or non-fast-forward protections. +5. #35 may then land normally under the existing protected central controls. This is the one-time producer bootstrap boundary; an administrator bypass, synthetic status, or fabricated reviewer is not an acceptable shortcut. +6. With Product present on protected ConceptWeave `main`, Foundation `ContextualWisdomLab/ConceptWeave#1` (or another substantive current-base successor) supplies the activation canary. The canary must be open and non-draft, target the exact current protected `main`, and have an exact-head terminal-success repository-owned `Product` run whose `Product acceptance` job and check-run belong to the same check suite. +7. Activation derives the positive GitHub App integration ID from that real successful check rather than guessing it. The ruleset is promoted from `evaluate` to `active` with exactly one required status: `Product acceptance`. `Product metadata-only` is intentionally excluded because metadata-only PR edits skip the Product validation job. +8. After activation, a substantive canary head transition is used to observe the ordinary merge path while Product is pending and then successful. The merge remains blocked while the new exact-head Product result is absent/pending/failed and may satisfy only the Product gate after terminal success. Central security/review/thread requirements continue to apply independently. + +## Safety boundary + +The reconciler discovers repository-owned rulesets with inherited parents excluded and rejects duplicate exact-name matches or foreign provenance. It never places the ConceptWeave-only status into the organization-wide ruleset. + +Privileged mutations require `CWL_RULESET_RECONCILE_ENABLED=true`, a distinct `CWL_RULESET_ADMIN_TOKEN`, the protected `ruleset-governance-maintenance` environment, and an exact `.github/main` SHA. Activation reuses #1644's immutable-history verification, ambiguous-PUT settlement, and compensating collision recovery instead of maintaining a second weaker update algorithm. Privileged runs are serialized and non-cancellable during the mutation/recovery critical section. + +Creation is intentionally narrower than activation. A successful or transport-ambiguous POST must converge to one exact-name repository-owned ruleset with the reviewed `evaluate` payload; bootstrap then verifies its latest immutable history state. Further mutation is refused until that new ruleset ID is committed to reviewed source. + +Activation additionally proves the Product producer from GitHub itself: live PR head/base, current protected base ref, Product workflow content at that base, exact run identity/status/conclusion, run-to-PR binding, exact `Product acceptance` job, matching check suite, successful check-run, and positive check-app ID. Predecessor runs, `Product metadata-only`, another check suite, stale base, Draft PR, or an inherited ruleset cannot satisfy activation. + +## Evidence and standards + +GitHub's repository ruleset API exposes `evaluate` and `active` enforcement and supports repository ruleset creation/update under Administration write authority. Required status check rules support an `integration_id`, allowing the active rule to bind the observed GitHub Actions producer rather than only a textual context. This source keeps the binding absent during evaluate bootstrap because no protected-base Product check exists yet; the ID is introduced only from the live canary at activation. + +Control intent maps to NIST SP 800-53 Rev. 5 AC-6 (least privilege) and CM-3 (configuration change control): privileged credentials remain separated from normal PR execution, mutations are exact-source-bound and reviewed, and live configuration changes are independently re-read and history-checked. The repository-specific Product gate complements, rather than replaces, the organization-wide review/security controls. + +## Verification + +The focused contract suite exercises manifest rejection, exact repository discovery, evaluate creation and ambiguous-create settlement, source adoption, evaluate/active verification, protected-base Product presence, stale/malformed canary rejection, run/job/check-suite/app binding, concurrent policy drift, normal activation history verification, ambiguous activation settlement, and CLI privilege boundaries. + +Before this source is treated as accepted, run the focused suite with branch coverage against `scripts/ci/reconcile_conceptweave_product_ruleset.py`, require 100% statement/branch coverage and 100% interrogate docstrings, run `git diff --check`, and then repeat on the eventual current-main descendant after #1644 has been reconciled. Historical GREEN from this dependent branch does not transfer across that restack. + +Refs: `.github#2348`, `.github#1644`, `.github#772`, `.github#1351`, `ContextualWisdomLab/ConceptWeave#35`, `ContextualWisdomLab/ConceptWeave#1`, `ContextualWisdomLab/ConceptWeave#4`. From b875f58e0dd22385c443fd072751228fdee26a3e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 10:03:31 +0900 Subject: [PATCH 06/45] fix(governance): keep Product ruleset mutation explicitly staged --- .../workflows/conceptweave-product-ruleset-reconcile.yml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/.github/workflows/conceptweave-product-ruleset-reconcile.yml b/.github/workflows/conceptweave-product-ruleset-reconcile.yml index fd6e7baee9..90e893319a 100644 --- a/.github/workflows/conceptweave-product-ruleset-reconcile.yml +++ b/.github/workflows/conceptweave-product-ruleset-reconcile.yml @@ -95,9 +95,7 @@ jobs: git diff --check verify-live: - if: >- - github.event_name == 'push' || - (github.event_name == 'workflow_dispatch' && inputs.mode == 'verify') + if: github.event_name == 'workflow_dispatch' && inputs.mode == 'verify' needs: validate runs-on: ubuntu-slim timeout-minutes: 10 @@ -183,7 +181,8 @@ jobs: --expected-main-sha "$GITHUB_SHA" --canary-pr "$CANARY_PR" --canary-run-id "$CANARY_RUN_ID" - - name: Verify post-change live state + - name: Verify active post-change live state + if: inputs.mode == 'activate' env: GH_TOKEN: ${{ secrets.CWL_RULESET_ADMIN_TOKEN }} run: >- From ac183d3e1a0b3b8bbd749241e3fababf0861601f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 10:04:12 +0900 Subject: [PATCH 07/45] test(governance): lock Product ruleset workflow trust boundary --- ...t_conceptweave_product_ruleset_workflow.py | 41 +++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 tests/test_conceptweave_product_ruleset_workflow.py diff --git a/tests/test_conceptweave_product_ruleset_workflow.py b/tests/test_conceptweave_product_ruleset_workflow.py new file mode 100644 index 0000000000..ca27315ef6 --- /dev/null +++ b/tests/test_conceptweave_product_ruleset_workflow.py @@ -0,0 +1,41 @@ +from pathlib import Path + + +WORKFLOW = Path(".github/workflows/conceptweave-product-ruleset-reconcile.yml") +MANIFEST = Path("config/conceptweave-product-ruleset.json") + + +def test_product_ruleset_workflow_keeps_mutation_manual_and_serialized() -> None: + """Require privileged Product ruleset changes to stay manual and non-cancellable.""" + + text = WORKFLOW.read_text(encoding="utf-8") + assert "workflow_dispatch:" in text + assert "github.event_name == 'workflow_dispatch'" in text + assert "github.ref == 'refs/heads/main'" in text + assert "vars.CWL_RULESET_RECONCILE_ENABLED == 'true'" in text + assert "environment: ruleset-governance-maintenance" in text + assert "GH_TOKEN: ${{ secrets.CWL_RULESET_ADMIN_TOKEN }}" in text + assert "cancel-in-progress: ${{ github.event_name == 'pull_request' }}" in text + assert "if: github.event_name == 'workflow_dispatch' && inputs.mode == 'verify'" in text + assert "github.event_name == 'push' ||" not in text + + +def test_product_ruleset_workflow_keeps_bootstrap_and_activation_distinct() -> None: + """Keep evaluate creation separate from canary-gated active promotion.""" + + text = WORKFLOW.read_text(encoding="utf-8") + assert "--mode bootstrap" in text + assert "--mode activate" in text + assert "--canary-pr \"$CANARY_PR\"" in text + assert "--canary-run-id \"$CANARY_RUN_ID\"" in text + assert "- name: Verify active post-change live state\n if: inputs.mode == 'activate'" in text + assert "- name: Verify post-change live state" not in text + + +def test_product_ruleset_manifest_starts_unadopted() -> None: + """Initial source must not guess the absent repository ruleset identity.""" + + text = MANIFEST.read_text(encoding="utf-8") + assert '"ruleset_id": null' in text + assert '"required_check": "Product acceptance"' in text + assert '"forbidden_check": "Product metadata-only"' in text From bf14f6942bcd106d8f80db94f1dfe83f9ff966bd Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 10:04:39 +0900 Subject: [PATCH 08/45] ci(governance): execute Product ruleset workflow contract --- .../workflows/conceptweave-product-ruleset-reconcile.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/conceptweave-product-ruleset-reconcile.yml b/.github/workflows/conceptweave-product-ruleset-reconcile.yml index 90e893319a..67a1812004 100644 --- a/.github/workflows/conceptweave-product-ruleset-reconcile.yml +++ b/.github/workflows/conceptweave-product-ruleset-reconcile.yml @@ -6,6 +6,7 @@ on: - "config/conceptweave-product-ruleset.json" - "scripts/ci/reconcile_conceptweave_product_ruleset.py" - "tests/test_conceptweave_product_ruleset_reconciliation.py" + - "tests/test_conceptweave_product_ruleset_workflow.py" - "docs/doctoring/conceptweave-product-ruleset-bootstrap.md" - ".github/workflows/conceptweave-product-ruleset-reconcile.yml" push: @@ -15,6 +16,7 @@ on: - "config/conceptweave-product-ruleset.json" - "scripts/ci/reconcile_conceptweave_product_ruleset.py" - "tests/test_conceptweave_product_ruleset_reconciliation.py" + - "tests/test_conceptweave_product_ruleset_workflow.py" - "docs/doctoring/conceptweave-product-ruleset-bootstrap.md" - ".github/workflows/conceptweave-product-ruleset-reconcile.yml" workflow_dispatch: @@ -84,7 +86,9 @@ jobs: python -m coverage run \ --branch \ --include=scripts/ci/reconcile_conceptweave_product_ruleset.py \ - -m pytest -q tests/test_conceptweave_product_ruleset_reconciliation.py + -m pytest -q \ + tests/test_conceptweave_product_ruleset_reconciliation.py \ + tests/test_conceptweave_product_ruleset_workflow.py python -m coverage report \ --fail-under=100 \ --show-missing \ From 9996009d0ddf6c8320e19107193156126812e59c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 10:07:41 +0900 Subject: [PATCH 09/45] test(governance): require pinned Python on privileged Product paths --- tests/test_conceptweave_product_ruleset_workflow.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/tests/test_conceptweave_product_ruleset_workflow.py b/tests/test_conceptweave_product_ruleset_workflow.py index ca27315ef6..49e0374269 100644 --- a/tests/test_conceptweave_product_ruleset_workflow.py +++ b/tests/test_conceptweave_product_ruleset_workflow.py @@ -20,6 +20,15 @@ def test_product_ruleset_workflow_keeps_mutation_manual_and_serialized() -> None assert "github.event_name == 'push' ||" not in text +def test_product_ruleset_workflow_pins_python_on_every_python_job() -> None: + """Do not let privileged governance depend on incidental runner Python.""" + + text = WORKFLOW.read_text(encoding="utf-8") + setup = "uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0" + assert text.count(setup) == 3 + assert text.count('python-version: "3.12"') == 3 + + def test_product_ruleset_workflow_keeps_bootstrap_and_activation_distinct() -> None: """Keep evaluate creation separate from canary-gated active promotion.""" From 7107eb6d45af7b56860f3c9cf85b868576fa0c16 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 10:14:30 +0900 Subject: [PATCH 10/45] test(governance): cover GitHub wrapped contents encoding --- ...weave_product_ruleset_contents_encoding.py | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 tests/test_conceptweave_product_ruleset_contents_encoding.py diff --git a/tests/test_conceptweave_product_ruleset_contents_encoding.py b/tests/test_conceptweave_product_ruleset_contents_encoding.py new file mode 100644 index 0000000000..34664a5df7 --- /dev/null +++ b/tests/test_conceptweave_product_ruleset_contents_encoding.py @@ -0,0 +1,22 @@ +from __future__ import annotations + +import base64 + +from scripts.ci import reconcile_conceptweave_product_ruleset as p + + +def test_decode_workflow_accepts_github_line_wrapped_base64() -> None: + """GitHub Contents API line wrapping must not invalidate a legitimate workflow.""" + + text = ( + "name: Product\n" + "jobs:\n" + " acceptance:\n" + " name: 'Product acceptance'\n" + " metadata: 'Product metadata-only'\n" + ) + encoded = base64.b64encode(text.encode("utf-8")).decode("ascii") + wrapped = "\n".join(encoded[index : index + 60] for index in range(0, len(encoded), 60)) + "\n" + payload = {"type": "file", "encoding": "base64", "content": wrapped} + + assert p._decode_workflow(payload) == text From 56e47603c97517468ea23d71c12180fe0d96f339 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 10:14:57 +0900 Subject: [PATCH 11/45] test(governance): execute wrapped contents regression --- .github/workflows/conceptweave-product-ruleset-reconcile.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/conceptweave-product-ruleset-reconcile.yml b/.github/workflows/conceptweave-product-ruleset-reconcile.yml index 67a1812004..2c80c84f05 100644 --- a/.github/workflows/conceptweave-product-ruleset-reconcile.yml +++ b/.github/workflows/conceptweave-product-ruleset-reconcile.yml @@ -6,6 +6,7 @@ on: - "config/conceptweave-product-ruleset.json" - "scripts/ci/reconcile_conceptweave_product_ruleset.py" - "tests/test_conceptweave_product_ruleset_reconciliation.py" + - "tests/test_conceptweave_product_ruleset_contents_encoding.py" - "tests/test_conceptweave_product_ruleset_workflow.py" - "docs/doctoring/conceptweave-product-ruleset-bootstrap.md" - ".github/workflows/conceptweave-product-ruleset-reconcile.yml" @@ -15,7 +16,8 @@ on: paths: - "config/conceptweave-product-ruleset.json" - "scripts/ci/reconcile_conceptweave_product_ruleset.py" - - "tests/test_conceptweave_product_ruleset_reconciliation.py" + - "tests/test_conceptweave-product-ruleset-reconciliation.py" + - "tests/test_conceptweave_product_ruleset_contents_encoding.py" - "tests/test_conceptweave_product_ruleset_workflow.py" - "docs/doctoring/conceptweave-product-ruleset-bootstrap.md" - ".github/workflows/conceptweave-product-ruleset-reconcile.yml" @@ -88,6 +90,7 @@ jobs: --include=scripts/ci/reconcile_conceptweave_product_ruleset.py \ -m pytest -q \ tests/test_conceptweave_product_ruleset_reconciliation.py \ + tests/test_conceptweave_product_ruleset_contents_encoding.py \ tests/test_conceptweave_product_ruleset_workflow.py python -m coverage report \ --fail-under=100 \ From 25e571f9247f1510f529c4f64e042ed442b5786d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 10:16:23 +0900 Subject: [PATCH 12/45] fix(governance): accept GitHub line-wrapped contents encoding --- scripts/ci/reconcile_conceptweave_product_ruleset.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/scripts/ci/reconcile_conceptweave_product_ruleset.py b/scripts/ci/reconcile_conceptweave_product_ruleset.py index 6e7975b1ea..fe637431f7 100644 --- a/scripts/ci/reconcile_conceptweave_product_ruleset.py +++ b/scripts/ci/reconcile_conceptweave_product_ruleset.py @@ -342,8 +342,9 @@ def _decode_workflow(payload: dict[str, Any]) -> str: content = payload.get("content") if type(content) is not str: raise RulesetGovernanceError("Product workflow content is malformed") + normalized = content.replace("\r", "").replace("\n", "") try: - return base64.b64decode(content, validate=True).decode("utf-8") + return base64.b64decode(normalized, validate=True).decode("utf-8") except (ValueError, UnicodeDecodeError) as exc: raise RulesetGovernanceError("Product workflow content is invalid UTF-8 base64") from exc From 6699252706301248d329a77e005f132e50758b7f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 10:16:59 +0900 Subject: [PATCH 13/45] fix(governance): keep ruleset regression paths exact --- .github/workflows/conceptweave-product-ruleset-reconcile.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/conceptweave-product-ruleset-reconcile.yml b/.github/workflows/conceptweave-product-ruleset-reconcile.yml index 2c80c84f05..d9299e64c8 100644 --- a/.github/workflows/conceptweave-product-ruleset-reconcile.yml +++ b/.github/workflows/conceptweave-product-ruleset-reconcile.yml @@ -16,7 +16,7 @@ on: paths: - "config/conceptweave-product-ruleset.json" - "scripts/ci/reconcile_conceptweave_product_ruleset.py" - - "tests/test_conceptweave-product-ruleset-reconciliation.py" + - "tests/test_conceptweave_product_ruleset_reconciliation.py" - "tests/test_conceptweave_product_ruleset_contents_encoding.py" - "tests/test_conceptweave_product_ruleset_workflow.py" - "docs/doctoring/conceptweave-product-ruleset-bootstrap.md" From 06ae30fdb1d593bbe34ec14aca2043f6849ca8c4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 10:22:03 +0900 Subject: [PATCH 14/45] test(governance): require package module entrypoint --- tests/test_conceptweave_product_ruleset_workflow.py | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/tests/test_conceptweave_product_ruleset_workflow.py b/tests/test_conceptweave_product_ruleset_workflow.py index 49e0374269..5d9d251459 100644 --- a/tests/test_conceptweave_product_ruleset_workflow.py +++ b/tests/test_conceptweave_product_ruleset_workflow.py @@ -29,6 +29,16 @@ def test_product_ruleset_workflow_pins_python_on_every_python_job() -> None: assert text.count('python-version: "3.12"') == 3 +def test_product_ruleset_workflow_uses_package_module_entrypoint() -> None: + """Run package-qualified imports without PYTHONPATH or direct-script ambiguity.""" + + text = WORKFLOW.read_text(encoding="utf-8") + module = "python -m scripts.ci.reconcile_conceptweave_product_ruleset" + assert text.count(module) == 5 + assert "python scripts/ci/reconcile_conceptweave_product_ruleset.py" not in text + assert "PYTHONPATH" not in text + + def test_product_ruleset_workflow_keeps_bootstrap_and_activation_distinct() -> None: """Keep evaluate creation separate from canary-gated active promotion.""" From c875b35b6ca4312756062c6ac75154d3d865e0bc Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 10:22:31 +0900 Subject: [PATCH 15/45] fix(governance): run reconciler as package module --- .../conceptweave-product-ruleset-reconcile.yml | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/.github/workflows/conceptweave-product-ruleset-reconcile.yml b/.github/workflows/conceptweave-product-ruleset-reconcile.yml index d9299e64c8..9dc28887a4 100644 --- a/.github/workflows/conceptweave-product-ruleset-reconcile.yml +++ b/.github/workflows/conceptweave-product-ruleset-reconcile.yml @@ -77,7 +77,7 @@ jobs: --only-binary=:all: -r requirements-opencode-review-ci-hashes.txt - name: Validate reviewed Product target manifest run: >- - python scripts/ci/reconcile_conceptweave_product_ruleset.py + python -m scripts.ci.reconcile_conceptweave_product_ruleset --manifest config/conceptweave-product-ruleset.json --mode validate - name: Prove Product ruleset lifecycle contract @@ -119,11 +119,15 @@ jobs: persist-credentials: false - name: Verify exact trusted revision run: test "$(git rev-parse HEAD)" = "$GITHUB_SHA" + - name: Set up Python + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + with: + python-version: "3.12" - name: Verify live Product ruleset stage env: GH_TOKEN: ${{ secrets.CWL_RULESET_ADMIN_TOKEN }} run: >- - python scripts/ci/reconcile_conceptweave_product_ruleset.py + python -m scripts.ci.reconcile_conceptweave_product_ruleset --manifest config/conceptweave-product-ruleset.json --mode verify @@ -151,6 +155,10 @@ jobs: persist-credentials: false - name: Verify exact trusted revision run: test "$(git rev-parse HEAD)" = "$GITHUB_SHA" + - name: Set up Python + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + with: + python-version: "3.12" - name: Require dedicated ruleset administration credential env: GH_TOKEN: ${{ secrets.CWL_RULESET_ADMIN_TOKEN }} @@ -170,7 +178,7 @@ jobs: GH_TOKEN: ${{ secrets.CWL_RULESET_ADMIN_TOKEN }} CWL_RULESET_RECONCILE_ENABLED: ${{ vars.CWL_RULESET_RECONCILE_ENABLED }} run: >- - python scripts/ci/reconcile_conceptweave_product_ruleset.py + python -m scripts.ci.reconcile_conceptweave_product_ruleset --manifest config/conceptweave-product-ruleset.json --mode bootstrap --expected-main-sha "$GITHUB_SHA" @@ -182,7 +190,7 @@ jobs: CANARY_PR: ${{ inputs.canary_pr }} CANARY_RUN_ID: ${{ inputs.canary_run_id }} run: >- - python scripts/ci/reconcile_conceptweave_product_ruleset.py + python -m scripts.ci.reconcile_conceptweave_product_ruleset --manifest config/conceptweave-product-ruleset.json --mode activate --expected-main-sha "$GITHUB_SHA" @@ -193,6 +201,6 @@ jobs: env: GH_TOKEN: ${{ secrets.CWL_RULESET_ADMIN_TOKEN }} run: >- - python scripts/ci/reconcile_conceptweave_product_ruleset.py + python -m scripts.ci.reconcile_conceptweave_product_ruleset --manifest config/conceptweave-product-ruleset.json --mode verify From 1ec554eca2a214de998f8c08ccf3244298c5b8b5 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 10:47:37 +0900 Subject: [PATCH 16/45] test(governance): expose bootstrap main-race window --- ...eptweave_product_ruleset_bootstrap_race.py | 44 +++++++++++++++++++ 1 file changed, 44 insertions(+) create mode 100644 tests/test_conceptweave_product_ruleset_bootstrap_race.py diff --git a/tests/test_conceptweave_product_ruleset_bootstrap_race.py b/tests/test_conceptweave_product_ruleset_bootstrap_race.py new file mode 100644 index 0000000000..6ee4a7a8a3 --- /dev/null +++ b/tests/test_conceptweave_product_ruleset_bootstrap_race.py @@ -0,0 +1,44 @@ +from __future__ import annotations + +import pytest + +from scripts.ci import reconcile_conceptweave_product_ruleset as p +from scripts.ci.reconcile_ruleset_governance import RulesetGovernanceError + + +def _manifest() -> dict[str, object]: + return { + "schema_version": 1, + "target_repository": p.TARGET_FULL_NAME, + "target_branch": p.TARGET_BRANCH, + "ruleset_name": p.RULESET_NAME, + "ruleset_id": None, + "required_check": p.PRODUCT_CHECK, + "forbidden_check": p.METADATA_ONLY_CHECK, + } + + +def test_bootstrap_rechecks_protected_main_immediately_before_create(monkeypatch): + expected = "a" * 40 + current_main_checks: list[str] = [] + created = False + + def assert_current_main(sha: str) -> None: + current_main_checks.append(sha) + if len(current_main_checks) == 2: + raise RulesetGovernanceError("protected main advanced") + + def create_evaluate_ruleset(): + nonlocal created + created = True + return {"id": 91} + + monkeypatch.setattr(p, "_assert_current_main", assert_current_main) + monkeypatch.setattr(p, "_named_ruleset", lambda: None) + monkeypatch.setattr(p, "_create_evaluate_ruleset", create_evaluate_ruleset) + + with pytest.raises(RulesetGovernanceError, match="advanced"): + p.bootstrap_product_ruleset(_manifest(), expected_main_sha=expected) + + assert current_main_checks == [expected, expected] + assert created is False From 0fd4e917bd4d6bb0b8f60dc6b7e91c07dca64b4e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 10:48:09 +0900 Subject: [PATCH 17/45] test(governance): run bootstrap race regression --- .github/workflows/conceptweave-product-ruleset-reconcile.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/conceptweave-product-ruleset-reconcile.yml b/.github/workflows/conceptweave-product-ruleset-reconcile.yml index 9dc28887a4..8a202a42bf 100644 --- a/.github/workflows/conceptweave-product-ruleset-reconcile.yml +++ b/.github/workflows/conceptweave-product-ruleset-reconcile.yml @@ -7,6 +7,7 @@ on: - "scripts/ci/reconcile_conceptweave_product_ruleset.py" - "tests/test_conceptweave_product_ruleset_reconciliation.py" - "tests/test_conceptweave_product_ruleset_contents_encoding.py" + - "tests/test_conceptweave_product_ruleset_bootstrap_race.py" - "tests/test_conceptweave_product_ruleset_workflow.py" - "docs/doctoring/conceptweave-product-ruleset-bootstrap.md" - ".github/workflows/conceptweave-product-ruleset-reconcile.yml" @@ -18,6 +19,7 @@ on: - "scripts/ci/reconcile_conceptweave_product_ruleset.py" - "tests/test_conceptweave_product_ruleset_reconciliation.py" - "tests/test_conceptweave_product_ruleset_contents_encoding.py" + - "tests/test_conceptweave_product_ruleset_bootstrap_race.py" - "tests/test_conceptweave_product_ruleset_workflow.py" - "docs/doctoring/conceptweave-product-ruleset-bootstrap.md" - ".github/workflows/conceptweave-product-ruleset-reconcile.yml" @@ -91,6 +93,7 @@ jobs: -m pytest -q \ tests/test_conceptweave_product_ruleset_reconciliation.py \ tests/test_conceptweave_product_ruleset_contents_encoding.py \ + tests/test_conceptweave_product_ruleset_bootstrap_race.py \ tests/test_conceptweave_product_ruleset_workflow.py python -m coverage report \ --fail-under=100 \ From 660f5ff46b39b5c023d05617c48eb927c13f8ba5 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 10:50:29 +0900 Subject: [PATCH 18/45] test(governance): isolate bootstrap mutation race --- tests/test_conceptweave_product_ruleset_bootstrap_race.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tests/test_conceptweave_product_ruleset_bootstrap_race.py b/tests/test_conceptweave_product_ruleset_bootstrap_race.py index 6ee4a7a8a3..f1bcc6f5d1 100644 --- a/tests/test_conceptweave_product_ruleset_bootstrap_race.py +++ b/tests/test_conceptweave_product_ruleset_bootstrap_race.py @@ -36,6 +36,9 @@ def create_evaluate_ruleset(): monkeypatch.setattr(p, "_assert_current_main", assert_current_main) monkeypatch.setattr(p, "_named_ruleset", lambda: None) monkeypatch.setattr(p, "_create_evaluate_ruleset", create_evaluate_ruleset) + monkeypatch.setattr(p, "_assert_shape", lambda *args, **kwargs: None) + monkeypatch.setattr(p, "_latest_history_version", lambda target: 1) + monkeypatch.setattr(p, "_history_version_state", lambda target, version: {}) with pytest.raises(RulesetGovernanceError, match="advanced"): p.bootstrap_product_ruleset(_manifest(), expected_main_sha=expected) From 48bbc1f5a6b12159593c17975e7574ee966c8017 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 10:52:11 +0900 Subject: [PATCH 19/45] fix(governance): recheck main before Product ruleset create --- scripts/ci/reconcile_conceptweave_product_ruleset.py | 1 + 1 file changed, 1 insertion(+) diff --git a/scripts/ci/reconcile_conceptweave_product_ruleset.py b/scripts/ci/reconcile_conceptweave_product_ruleset.py index fe637431f7..614eee45a5 100644 --- a/scripts/ci/reconcile_conceptweave_product_ruleset.py +++ b/scripts/ci/reconcile_conceptweave_product_ruleset.py @@ -323,6 +323,7 @@ def bootstrap_product_ruleset( raise RulesetGovernanceError( f"Product ruleset exists as id={named.get('id')}; pin it before mutation" ) + _assert_current_main(expected_main_sha) created = _create_evaluate_ruleset() ruleset_id = created.get("id") target = _target(ruleset_id) From cfbdbbe9b53d878a417fb90d1ac84205490d029b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 10:58:16 +0900 Subject: [PATCH 20/45] test(governance): expect bootstrap mutation guard --- tests/test_conceptweave_product_ruleset_reconciliation.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/test_conceptweave_product_ruleset_reconciliation.py b/tests/test_conceptweave_product_ruleset_reconciliation.py index 7f4767fc28..f72d2dcede 100644 --- a/tests/test_conceptweave_product_ruleset_reconciliation.py +++ b/tests/test_conceptweave_product_ruleset_reconciliation.py @@ -242,7 +242,7 @@ def test_bootstrap_creates_and_verifies_history(monkeypatch): monkeypatch.setattr(p, "_latest_history_version", lambda target: 3) monkeypatch.setattr(p, "_history_version_state", lambda target, version: live_payload(22)) assert p.bootstrap_product_ruleset(manifest(), expected_main_sha="a"*40) == 22 - assert seen == ["a"*40, "a"*40] + assert seen == ["a"*40, "a"*40, "a"*40] def test_decode_workflow(): From e37dd17eee33461aa0493ecef074f1fff26a812d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 10:59:17 +0900 Subject: [PATCH 21/45] test(security): expose Product governance ref and runner boundary --- tests/test_conceptweave_product_ruleset_workflow.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/tests/test_conceptweave_product_ruleset_workflow.py b/tests/test_conceptweave_product_ruleset_workflow.py index 5d9d251459..81400bd6c1 100644 --- a/tests/test_conceptweave_product_ruleset_workflow.py +++ b/tests/test_conceptweave_product_ruleset_workflow.py @@ -20,6 +20,15 @@ def test_product_ruleset_workflow_keeps_mutation_manual_and_serialized() -> None assert "github.event_name == 'push' ||" not in text +def test_product_ruleset_workflow_binds_admin_token_jobs_to_trusted_main_and_hardened_runner() -> None: + """Never expose the ruleset admin credential from an arbitrary ref or unsupported runner.""" + + text = WORKFLOW.read_text(encoding="utf-8") + assert "if: github.event_name == 'workflow_dispatch' && inputs.mode == 'verify' && github.ref == 'refs/heads/main'" in text + assert "runs-on: ubuntu-slim" not in text + assert text.count("runs-on: ubuntu-24.04") == 3 + + def test_product_ruleset_workflow_pins_python_on_every_python_job() -> None: """Do not let privileged governance depend on incidental runner Python.""" From f37264ef539e555381cf0fac9a2779847dadcdc6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 11:00:22 +0900 Subject: [PATCH 22/45] fix(security): bind ruleset admin reads to protected main --- .../workflows/conceptweave-product-ruleset-reconcile.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/conceptweave-product-ruleset-reconcile.yml b/.github/workflows/conceptweave-product-ruleset-reconcile.yml index 8a202a42bf..272bb052e6 100644 --- a/.github/workflows/conceptweave-product-ruleset-reconcile.yml +++ b/.github/workflows/conceptweave-product-ruleset-reconcile.yml @@ -54,7 +54,7 @@ concurrency: jobs: validate: - runs-on: ubuntu-slim + runs-on: ubuntu-24.04 timeout-minutes: 20 steps: - name: Harden runner @@ -105,9 +105,9 @@ jobs: git diff --check verify-live: - if: github.event_name == 'workflow_dispatch' && inputs.mode == 'verify' + if: github.event_name == 'workflow_dispatch' && inputs.mode == 'verify' && github.ref == 'refs/heads/main' needs: validate - runs-on: ubuntu-slim + runs-on: ubuntu-24.04 timeout-minutes: 10 environment: ruleset-governance-maintenance steps: From 08b9e0d35e03e97f91d04409848b91d1e78356da Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 11:13:26 +0900 Subject: [PATCH 23/45] test(governance): prove Product activation target-main race --- ...ptweave_product_ruleset_activation_race.py | 132 ++++++++++++++++++ 1 file changed, 132 insertions(+) create mode 100644 tests/test_conceptweave_product_ruleset_activation_race.py diff --git a/tests/test_conceptweave_product_ruleset_activation_race.py b/tests/test_conceptweave_product_ruleset_activation_race.py new file mode 100644 index 0000000000..ca9e108caa --- /dev/null +++ b/tests/test_conceptweave_product_ruleset_activation_race.py @@ -0,0 +1,132 @@ +from __future__ import annotations + +import base64 + +import pytest + +from scripts.ci import reconcile_conceptweave_product_ruleset as p +from scripts.ci.reconcile_ruleset_governance import RulesetGovernanceError + + +def _live_payload( + ruleset_id: int, + *, + enforcement: str = "evaluate", + integration_id: int | None = None, +) -> dict[str, object]: + return { + "id": ruleset_id, + "source_type": "Repository", + "source": p.TARGET_FULL_NAME, + **p._desired(enforcement=enforcement, integration_id=integration_id), + } + + +def test_activation_aborts_when_conceptweave_main_advances_after_canary( + monkeypatch: pytest.MonkeyPatch, +) -> None: + """Do not activate from a canary whose protected target base has gone stale.""" + + ruleset_id = 30 + pr_number = 5 + run_id = 77 + base_sha = "a" * 40 + head_sha = "b" * 40 + advanced_main_sha = "c" * 40 + workflow = ( + "name: Product\n" + "acceptance: 'Product acceptance'\n" + "metadata: 'Product metadata-only'\n" + ) + main_reads = 0 + put_called = False + + def api(method: str, endpoint: str, **kwargs: object) -> dict[str, object]: + nonlocal main_reads, put_called + if endpoint.endswith(f"pulls/{pr_number}"): + return { + "state": "open", + "draft": False, + "head": {"sha": head_sha}, + "base": {"ref": p.TARGET_BRANCH, "sha": base_sha}, + } + if endpoint.endswith(f"git/ref/heads/{p.TARGET_BRANCH}"): + main_reads += 1 + current = base_sha if main_reads == 1 else advanced_main_sha + return {"object": {"sha": current}} + if f"contents/{p.PRODUCT_WORKFLOW_PATH}" in endpoint: + return { + "type": "file", + "encoding": "base64", + "content": base64.b64encode(workflow.encode()).decode(), + } + if endpoint.endswith(f"actions/runs/{run_id}"): + return { + "name": p.PRODUCT_WORKFLOW_NAME, + "event": "pull_request", + "head_sha": head_sha, + "status": "completed", + "conclusion": "success", + "check_suite_id": 900, + "pull_requests": [ + { + "number": pr_number, + "head": {"sha": head_sha}, + "base": {"sha": base_sha}, + } + ], + } + if f"actions/runs/{run_id}/jobs" in endpoint: + return { + "jobs": [ + { + "name": p.PRODUCT_CHECK, + "status": "completed", + "conclusion": "success", + } + ] + } + if "check-runs" in endpoint: + return { + "check_runs": [ + { + "name": p.PRODUCT_CHECK, + "check_suite": {"id": 900}, + "status": "completed", + "conclusion": "success", + "app": {"id": 15368}, + } + ] + } + if method == "PUT": + put_called = True + return {} + raise AssertionError(endpoint) + + live_reads = 0 + before = _live_payload(ruleset_id) + after = _live_payload(ruleset_id, enforcement="active", integration_id=15368) + + def live(_target: object) -> dict[str, object]: + nonlocal live_reads + live_reads += 1 + return before if live_reads <= 2 else after + + monkeypatch.setattr(p, "_assert_current_main", lambda _sha: None) + monkeypatch.setattr(p, "_named_ruleset", lambda: {"id": ruleset_id}) + monkeypatch.setattr(p, "_assert_target_provenance", lambda *_args: None) + monkeypatch.setattr(p, "_live", live) + monkeypatch.setattr(p, "_latest_history_version", lambda _target: 4) + monkeypatch.setattr(p, "_verify_ruleset_history_transition", lambda *_args, **_kwargs: None) + monkeypatch.setattr(p, "_gh_api", api) + + with pytest.raises(RulesetGovernanceError, match="current protected main"): + p.activate_product_ruleset( + {"ruleset_id": ruleset_id}, + expected_main_sha="d" * 40, + canary_pr=pr_number, + canary_run_id=run_id, + ) + + assert main_reads >= 2 + assert put_called is False From f2130292a22908d7bd3a4b5f839e9b92fd04f3e3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 11:13:57 +0900 Subject: [PATCH 24/45] test(governance): execute Product activation race RED --- .github/workflows/conceptweave-product-ruleset-reconcile.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/conceptweave-product-ruleset-reconcile.yml b/.github/workflows/conceptweave-product-ruleset-reconcile.yml index 272bb052e6..530f601d6c 100644 --- a/.github/workflows/conceptweave-product-ruleset-reconcile.yml +++ b/.github/workflows/conceptweave-product-ruleset-reconcile.yml @@ -8,6 +8,7 @@ on: - "tests/test_conceptweave_product_ruleset_reconciliation.py" - "tests/test_conceptweave_product_ruleset_contents_encoding.py" - "tests/test_conceptweave_product_ruleset_bootstrap_race.py" + - "tests/test_conceptweave_product_ruleset_activation_race.py" - "tests/test_conceptweave_product_ruleset_workflow.py" - "docs/doctoring/conceptweave-product-ruleset-bootstrap.md" - ".github/workflows/conceptweave-product-ruleset-reconcile.yml" @@ -20,6 +21,7 @@ on: - "tests/test_conceptweave_product_ruleset_reconciliation.py" - "tests/test_conceptweave_product_ruleset_contents_encoding.py" - "tests/test_conceptweave_product_ruleset_bootstrap_race.py" + - "tests/test_conceptweave_product_ruleset_activation_race.py" - "tests/test_conceptweave_product_ruleset_workflow.py" - "docs/doctoring/conceptweave-product-ruleset-bootstrap.md" - ".github/workflows/conceptweave-product-ruleset-reconcile.yml" @@ -94,6 +96,7 @@ jobs: tests/test_conceptweave_product_ruleset_reconciliation.py \ tests/test_conceptweave_product_ruleset_contents_encoding.py \ tests/test_conceptweave_product_ruleset_bootstrap_race.py \ + tests/test_conceptweave_product_ruleset_activation_race.py \ tests/test_conceptweave_product_ruleset_workflow.py python -m coverage report \ --fail-under=100 \ From b6074c741333d10a494de4eab5df6b50385f21c1 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 12:52:33 +0900 Subject: [PATCH 25/45] test(governance): require workflow-bound Product ruleset --- ...t_conceptweave_product_ruleset_workflow.py | 21 ++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/tests/test_conceptweave_product_ruleset_workflow.py b/tests/test_conceptweave_product_ruleset_workflow.py index 81400bd6c1..b5256382cf 100644 --- a/tests/test_conceptweave_product_ruleset_workflow.py +++ b/tests/test_conceptweave_product_ruleset_workflow.py @@ -3,6 +3,7 @@ WORKFLOW = Path(".github/workflows/conceptweave-product-ruleset-reconcile.yml") MANIFEST = Path("config/conceptweave-product-ruleset.json") +RECONCILER = Path("scripts/ci/reconcile_conceptweave_product_ruleset.py") def test_product_ruleset_workflow_keeps_mutation_manual_and_serialized() -> None: @@ -61,9 +62,23 @@ def test_product_ruleset_workflow_keeps_bootstrap_and_activation_distinct() -> N def test_product_ruleset_manifest_starts_unadopted() -> None: - """Initial source must not guess the absent repository ruleset identity.""" + """Initial source must not guess the absent organization ruleset identity.""" text = MANIFEST.read_text(encoding="utf-8") assert '"ruleset_id": null' in text - assert '"required_check": "Product acceptance"' in text - assert '"forbidden_check": "Product metadata-only"' in text + + +def test_product_gate_is_workflow_bound_and_conceptweave_scoped() -> None: + """Reject same-App/check-name enforcement in favor of an exact workflow rule.""" + + text = RECONCILER.read_text(encoding="utf-8") + assert "TARGET_REPOSITORY_ID = 1353201939" in text + assert 'scope="organization"' in text + assert 'f"orgs/{ORGANIZATION}/rulesets"' in text + assert '"repository_id": {"repository_ids": [TARGET_REPOSITORY_ID]}' in text + assert '"type": "workflows"' in text + assert '"repository_id": TARGET_REPOSITORY_ID' in text + assert '"path": PRODUCT_WORKFLOW_PATH' in text + assert '"ref": f"refs/heads/{TARGET_BRANCH}"' in text + assert '"required_status_checks"' not in text + assert "integration_id" not in text From 1592c186d1906a3c18ceea3b828f8537b0a57a5f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 15:20:14 +0900 Subject: [PATCH 26/45] test: require workflow ruleset evaluation evidence --- ...t_conceptweave_product_ruleset_workflow.py | 26 ++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/tests/test_conceptweave_product_ruleset_workflow.py b/tests/test_conceptweave_product_ruleset_workflow.py index b5256382cf..7816e0ebd4 100644 --- a/tests/test_conceptweave_product_ruleset_workflow.py +++ b/tests/test_conceptweave_product_ruleset_workflow.py @@ -69,16 +69,40 @@ def test_product_ruleset_manifest_starts_unadopted() -> None: def test_product_gate_is_workflow_bound_and_conceptweave_scoped() -> None: - """Reject same-App/check-name enforcement in favor of an exact workflow rule.""" + """Require one exact organization branch/workflow rule for ConceptWeave main.""" text = RECONCILER.read_text(encoding="utf-8") assert "TARGET_REPOSITORY_ID = 1353201939" in text assert 'scope="organization"' in text assert 'f"orgs/{ORGANIZATION}/rulesets"' in text + assert '"target": "branch"' in text assert '"repository_id": {"repository_ids": [TARGET_REPOSITORY_ID]}' in text + assert '"ref_name": {' in text + assert '"include": [f"refs/heads/{TARGET_BRANCH}"]' in text + assert '"bypass_actors": []' in text assert '"type": "workflows"' in text assert '"repository_id": TARGET_REPOSITORY_ID' in text assert '"path": PRODUCT_WORKFLOW_PATH' in text assert '"ref": f"refs/heads/{TARGET_BRANCH}"' in text assert '"required_status_checks"' not in text assert "integration_id" not in text + + +def test_activation_requires_exact_evaluate_rule_suite_after_base_retarget() -> None: + """Never promote merely because a local Product run happened to succeed.""" + + text = RECONCILER.read_text(encoding="utf-8") + required = ( + "rulesets/rule-suites", + "evaluate_status=evaluate", + '"base_ref_changed"', + '"committed"', + 'evaluation.get("rule_type") == "workflows"', + 'source.get("id") == ruleset_id', + 'evaluation.get("enforcement") == "evaluate"', + 'evaluation.get("result") == "pass"', + 'run.get("run_attempt") != 1', + 'run.get("path") != PRODUCT_WORKFLOW_PATH', + ) + missing = [fragment for fragment in required if fragment not in text] + assert not missing, f"missing evaluate-rule-suite activation contract: {missing}" From 5e83c61d2bd3faaf6e2baab0511a556065a61e10 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 15:23:08 +0900 Subject: [PATCH 27/45] fix: govern Product by workflow ruleset --- .../reconcile_conceptweave_product_ruleset.py | 365 ++++++++++-------- 1 file changed, 208 insertions(+), 157 deletions(-) diff --git a/scripts/ci/reconcile_conceptweave_product_ruleset.py b/scripts/ci/reconcile_conceptweave_product_ruleset.py index 614eee45a5..dbabce00ea 100644 --- a/scripts/ci/reconcile_conceptweave_product_ruleset.py +++ b/scripts/ci/reconcile_conceptweave_product_ruleset.py @@ -1,5 +1,5 @@ #!/usr/bin/env python3 -"""Stage ConceptWeave Product ruleset enforcement without bootstrap deadlock.""" +"""Govern the ConceptWeave Product workflow as a scoped organization branch ruleset.""" from __future__ import annotations @@ -10,6 +10,7 @@ import re import subprocess import sys +from datetime import datetime from pathlib import Path from typing import Any @@ -35,6 +36,7 @@ ORGANIZATION = "ContextualWisdomLab" TARGET_REPOSITORY = "ConceptWeave" TARGET_FULL_NAME = f"{ORGANIZATION}/{TARGET_REPOSITORY}" +TARGET_REPOSITORY_ID = 1353201939 TARGET_BRANCH = "main" RULESET_NAME = "ConceptWeave Product acceptance" PRODUCT_WORKFLOW_PATH = ".github/workflows/product.yml" @@ -79,47 +81,48 @@ def load_product_manifest(path: Path) -> dict[str, Any]: def _target(ruleset_id: int) -> RulesetTarget: - """Build the exact repository-owned ruleset identity after source adoption.""" + """Build the exact organization-owned Product ruleset identity.""" if type(ruleset_id) is not int or ruleset_id <= 0: raise RulesetGovernanceError("Product ruleset identity must be positive") return RulesetTarget( - scope="repository", + scope="organization", owner=ORGANIZATION, - repository=TARGET_REPOSITORY, + repository=None, ruleset_id=ruleset_id, name=RULESET_NAME, ) -def _desired(*, enforcement: str, integration_id: int | None) -> dict[str, Any]: - """Return the exact evaluate or active Product ruleset mutation body.""" +def _desired(*, enforcement: str) -> dict[str, Any]: + """Return the exact evaluate or active organization workflow rule.""" if enforcement not in {"evaluate", "active"}: raise RulesetGovernanceError("Product ruleset enforcement is unsupported") - check: dict[str, Any] = {"context": PRODUCT_CHECK} - if integration_id is not None: - if type(integration_id) is not int or integration_id <= 0: - raise RulesetGovernanceError("Product integration identity must be positive") - check["integration_id"] = integration_id return { "name": RULESET_NAME, "target": "branch", "enforcement": enforcement, "bypass_actors": [], "conditions": { + "repository_id": {"repository_ids": [TARGET_REPOSITORY_ID]}, "ref_name": { "include": [f"refs/heads/{TARGET_BRANCH}"], "exclude": [], - } + }, }, "rules": [ { - "type": "required_status_checks", + "type": "workflows", "parameters": { "do_not_enforce_on_create": False, - "required_status_checks": [check], - "strict_required_status_checks_policy": True, + "workflows": [ + { + "repository_id": TARGET_REPOSITORY_ID, + "path": PRODUCT_WORKFLOW_PATH, + "ref": f"refs/heads/{TARGET_BRANCH}", + } + ], }, } ], @@ -131,84 +134,52 @@ def _assert_shape( target: RulesetTarget, *, enforcement: str, - integration_id: int | None, ) -> None: """Require exact provenance and policy for the dedicated Product ruleset.""" _assert_target_provenance(live, target) if live.get("name") != RULESET_NAME: raise RulesetGovernanceError("Product ruleset name drifted") - if _editable_projection(live) != _desired( - enforcement=enforcement, - integration_id=integration_id, - ): + if _editable_projection(live) != _desired(enforcement=enforcement): raise RulesetGovernanceError( f"Product ruleset does not match reviewed {enforcement} policy" ) -def _repository_rulesets() -> list[dict[str, Any]]: - """List repository-owned rulesets only, excluding inherited organization rules.""" +def _organization_rulesets() -> list[dict[str, Any]]: + """List organization-owned rulesets and reject foreign provenance.""" - payload = _gh_api_list( - "GET", - f"repos/{TARGET_FULL_NAME}/rulesets?includes_parents=false&per_page=100", - ) + payload = _gh_api_list("GET", f"orgs/{ORGANIZATION}/rulesets?per_page=100") result: list[dict[str, Any]] = [] for item in payload: - live = _plain_dict(item, field="repository ruleset list entry") - if live.get("source_type") != "Repository" or live.get("source") != TARGET_FULL_NAME: + live = _plain_dict(item, field="organization ruleset list entry") + if live.get("source_type") != "Organization" or live.get("source") != ORGANIZATION: raise RulesetGovernanceError( - "repository-only Product ruleset discovery returned foreign provenance" + "organization Product ruleset discovery returned foreign provenance" ) result.append(live) return result def _named_ruleset() -> dict[str, Any] | None: - """Return the one exact-name repository ruleset or fail on duplicate identity.""" + """Return the one exact-name organization ruleset or fail on ambiguity.""" - matches = [item for item in _repository_rulesets() if item.get("name") == RULESET_NAME] + matches = [item for item in _organization_rulesets() if item.get("name") == RULESET_NAME] if len(matches) > 1: raise RulesetGovernanceError("multiple ConceptWeave Product rulesets are ambiguous") return matches[0] if matches else None def _live(target: RulesetTarget) -> dict[str, Any]: - """Fetch one pinned Product ruleset from its immutable repository identity.""" + """Fetch one pinned Product ruleset from its organization identity.""" payload = _gh_api("GET", target.endpoint) _assert_target_provenance(payload, target) return payload -def _active_integration_id(live: dict[str, Any]) -> int: - """Return the exact integration identity bound by an active Product policy.""" - - rules = _plain_list(live.get("rules"), field="Product rules") - if len(rules) != 1: - raise RulesetGovernanceError("active Product ruleset must contain one rule") - rule = _plain_dict(rules[0], field="Product required-status rule") - parameters = _plain_dict( - rule.get("parameters"), field="Product required-status parameters" - ) - checks = _plain_list( - parameters.get("required_status_checks"), - field="Product required status checks", - ) - if len(checks) != 1: - raise RulesetGovernanceError("active Product ruleset must require one check") - check = _plain_dict(checks[0], field="Product required status check") - integration_id = check.get("integration_id") - if type(integration_id) is not int or integration_id <= 0: - raise RulesetGovernanceError( - "active Product ruleset lacks a positive integration identity" - ) - return integration_id - - def verify_product_ruleset(manifest: dict[str, Any]) -> str: - """Verify absent, evaluate, or active live state without mutating governance.""" + """Verify absent, evaluate, or active live state without mutation.""" pinned_id = manifest["ruleset_id"] named = _named_ruleset() @@ -222,26 +193,18 @@ def verify_product_ruleset(manifest: dict[str, Any]) -> str: if named is None or named.get("id") != pinned_id: raise RulesetGovernanceError("pinned Product ruleset is absent or name-drifted") live = _live(target) - if live.get("enforcement") == "evaluate": - _assert_shape(live, target, enforcement="evaluate", integration_id=None) - return "evaluate" - if live.get("enforcement") == "active": - integration_id = _active_integration_id(live) - _assert_shape( - live, - target, - enforcement="active", - integration_id=integration_id, - ) - return "active" - raise RulesetGovernanceError("Product ruleset enforcement is unsupported") + enforcement = live.get("enforcement") + if enforcement not in {"evaluate", "active"}: + raise RulesetGovernanceError("Product ruleset enforcement is unsupported") + _assert_shape(live, target, enforcement=enforcement) + return str(enforcement) def _create_evaluate_ruleset() -> dict[str, Any]: - """Create the evaluate-only Product ruleset with ambiguous-result settlement.""" + """Create the evaluate-only organization ruleset with ambiguous-result settlement.""" - endpoint = f"repos/{TARGET_FULL_NAME}/rulesets" - body = _desired(enforcement="evaluate", integration_id=None) + endpoint = f"orgs/{ORGANIZATION}/rulesets" + body = _desired(enforcement="evaluate") command = [ "gh", "api", @@ -287,16 +250,34 @@ def _create_evaluate_ruleset() -> dict[str, Any]: ruleset_id = settled.get("id") target = _target(ruleset_id) live = _live(target) - _assert_shape(live, target, enforcement="evaluate", integration_id=None) + _assert_shape(live, target, enforcement="evaluate") return live +def _target_main_sha() -> str: + """Read and validate the exact protected ConceptWeave main revision.""" + + payload = _gh_api("GET", f"repos/{TARGET_FULL_NAME}/git/ref/heads/{TARGET_BRANCH}") + obj = _plain_dict(payload.get("object"), field="ConceptWeave main ref object") + sha = str(obj.get("sha") or "").lower() + if not GIT_SHA_RE.fullmatch(sha): + raise RulesetGovernanceError("ConceptWeave protected main SHA is malformed") + return sha + + +def _assert_target_main(expected_sha: str) -> None: + """Fail when ConceptWeave protected main is not the reviewed canary base.""" + + if _target_main_sha() != expected_sha: + raise RulesetGovernanceError("ConceptWeave protected main advanced") + + def bootstrap_product_ruleset( manifest: dict[str, Any], *, expected_main_sha: str, ) -> int: - """Create evaluate policy or verify the exact reviewed source-adopted identity.""" + """Create evaluate policy or verify the reviewed source-adopted identity.""" _assert_current_main(expected_main_sha) pinned_id = manifest["ruleset_id"] @@ -306,16 +287,10 @@ def bootstrap_product_ruleset( if named is None or named.get("id") != pinned_id: raise RulesetGovernanceError("pinned Product ruleset is absent or name-drifted") live = _live(target) - if live.get("enforcement") == "active": - integration_id = _active_integration_id(live) - _assert_shape( - live, - target, - enforcement="active", - integration_id=integration_id, - ) - else: - _assert_shape(live, target, enforcement="evaluate", integration_id=None) + enforcement = live.get("enforcement") + if enforcement not in {"evaluate", "active"}: + raise RulesetGovernanceError("Product ruleset enforcement is unsupported") + _assert_shape(live, target, enforcement=enforcement) _assert_current_main(expected_main_sha) return pinned_id @@ -323,15 +298,19 @@ def bootstrap_product_ruleset( raise RulesetGovernanceError( f"Product ruleset exists as id={named.get('id')}; pin it before mutation" ) + target_main_sha = _target_main_sha() + _assert_base_product_workflow(target_main_sha) _assert_current_main(expected_main_sha) + _assert_target_main(target_main_sha) created = _create_evaluate_ruleset() ruleset_id = created.get("id") target = _target(ruleset_id) - _assert_shape(created, target, enforcement="evaluate", integration_id=None) + _assert_shape(created, target, enforcement="evaluate") version = _latest_history_version(target) history_state = _history_version_state(target, version) - _assert_shape(history_state, target, enforcement="evaluate", integration_id=None) + _assert_shape(history_state, target, enforcement="evaluate") _assert_current_main(expected_main_sha) + _assert_target_main(target_main_sha) return ruleset_id @@ -351,22 +330,68 @@ def _decode_workflow(payload: dict[str, Any]) -> str: def _assert_base_product_workflow(base_sha: str) -> None: - """Require the protected canary base to contain both reviewed Product identities.""" + """Require protected main to contain the reviewed non-cancellable Product workflow.""" payload = _gh_api( "GET", f"repos/{TARGET_FULL_NAME}/contents/{PRODUCT_WORKFLOW_PATH}?ref={base_sha}", ) text = _decode_workflow(payload) - for fragment in ("name: Product", "'Product acceptance'", "'Product metadata-only'"): + for fragment in ( + "name: Product", + "'Product acceptance'", + "'Product metadata-only'", + "cancel-in-progress: false", + ): if fragment not in text: raise RulesetGovernanceError( - "protected-base Product workflow lacks reviewed check identities" + "protected-base Product workflow lacks reviewed acceptance contract" + ) + + +def _parse_timestamp(value: Any, *, field: str) -> datetime: + """Parse one GitHub ISO-8601 timestamp for ordering evidence.""" + + if type(value) is not str: + raise RulesetGovernanceError(f"{field} timestamp is missing") + try: + return datetime.fromisoformat(value.replace("Z", "+00:00")) + except ValueError as exc: + raise RulesetGovernanceError(f"{field} timestamp is malformed") from exc + + +def _latest_base_retarget(pr_number: int) -> datetime: + """Return the latest base-ref change and reject later source commits.""" + + timeline = _gh_api_list( + "GET", + f"repos/{TARGET_FULL_NAME}/issues/{pr_number}/timeline?per_page=100", + ) + retargets = [ + item for item in timeline + if _plain_dict(item, field="Product canary timeline event").get("event") + == "base_ref_changed" + ] + if not retargets: + raise RulesetGovernanceError("Product canary lacks a base_ref_changed event") + latest = max( + _parse_timestamp(item.get("created_at"), field="base retarget") + for item in retargets + ) + for item in timeline: + event = _plain_dict(item, field="Product canary timeline event") + if event.get("event") != "committed": + continue + created = _parse_timestamp(event.get("created_at"), field="post-retarget commit") + if created > latest: + raise RulesetGovernanceError( + "Product canary has a source commit after its base retarget" ) + return latest -def _canary_integration_id(*, pr_number: int, run_id: int) -> int: - """Prove an exact current-base successful Product canary and return its app ID.""" +def _canary_evidence(*, pr_number: int, run_id: int) -> tuple[str, str]: + """Prove exact current-base Product success after a source-neutral base retarget.""" if pr_number <= 0 or run_id <= 0: raise RulesetGovernanceError("canary identities must be positive") @@ -381,38 +406,35 @@ def _canary_integration_id(*, pr_number: int, run_id: int) -> int: raise RulesetGovernanceError("Product canary returned malformed head/base SHA") if base.get("ref") != TARGET_BRANCH: raise RulesetGovernanceError("Product canary does not target protected main") - if _gh_api( - "GET", - f"repos/{TARGET_FULL_NAME}/git/ref/heads/{TARGET_BRANCH}", - ).get("object", {}).get("sha") != base_sha: - raise RulesetGovernanceError("Product canary base is not current protected main") + _assert_target_main(base_sha) _assert_base_product_workflow(base_sha) + retargeted_at = _latest_base_retarget(pr_number) run = _gh_api("GET", f"repos/{TARGET_FULL_NAME}/actions/runs/{run_id}") if ( run.get("name") != PRODUCT_WORKFLOW_NAME + or run.get("path") != PRODUCT_WORKFLOW_PATH or run.get("event") != "pull_request" or run.get("head_sha") != head_sha or run.get("status") != "completed" or run.get("conclusion") != "success" + or run.get("run_attempt") != 1 ): raise RulesetGovernanceError( - "canary run is not exact-head terminal Product success" + "canary run is not exact first-attempt terminal Product success" ) + if _parse_timestamp(run.get("created_at"), field="Product canary run") <= retargeted_at: + raise RulesetGovernanceError("Product canary run predates the base retarget") + run_prs = _plain_list(run.get("pull_requests"), field="Product canary run pull_requests") - bound = False - for item in run_prs: - run_pr = _plain_dict(item, field="Product canary run pull request") - run_head = _plain_dict(run_pr.get("head"), field="Product canary run head") - run_base = _plain_dict(run_pr.get("base"), field="Product canary run base") - if ( - run_pr.get("number") == pr_number - and run_head.get("sha") == head_sha - and run_base.get("sha") == base_sha - ): - bound = True - break - if not bound: + if not any( + _plain_dict(item, field="Product canary run pull request").get("number") == pr_number + and _plain_dict(item, field="Product canary run pull request").get("head", {}).get("sha") + == head_sha + and _plain_dict(item, field="Product canary run pull request").get("base", {}).get("sha") + == base_sha + for item in run_prs + ): raise RulesetGovernanceError("Product canary run is not bound to live PR head/base") jobs = _plain_list( @@ -427,47 +449,71 @@ def _canary_integration_id(*, pr_number: int, run_id: int) -> int: for job in jobs if _plain_dict(job, field="Product canary job").get("name") == PRODUCT_CHECK ] - if len(acceptance) != 1: - raise RulesetGovernanceError( - "Product canary must contain exactly one Product acceptance job" - ) - if ( + if len(acceptance) != 1 or ( acceptance[0].get("status") != "completed" or acceptance[0].get("conclusion") != "success" ): - raise RulesetGovernanceError("Product acceptance canary job is not successful") + raise RulesetGovernanceError("Product acceptance canary job is not uniquely successful") + return base_sha, head_sha - checks = _plain_list( - _gh_api( - "GET", - f"repos/{TARGET_FULL_NAME}/commits/{head_sha}/check-runs" - "?check_name=Product%20acceptance&filter=latest&per_page=100", - ).get("check_runs"), - field="Product acceptance check runs", + +def _assert_evaluate_rule_suite( + *, + ruleset_id: int, + base_sha: str, + head_sha: str, + not_before: datetime, +) -> None: + """Require exact evaluate-mode workflow-rule PASS for the retarget canary.""" + + suites = _gh_api_list( + "GET", + f"repos/{TARGET_FULL_NAME}/rulesets/rule-suites" + f"?ref=refs/heads/{TARGET_BRANCH}&time_period=day" + "&evaluate_status=evaluate&per_page=100", ) - suite_id = run.get("check_suite_id") - matched: list[dict[str, Any]] = [] - for item in checks: - check = _plain_dict(item, field="Product acceptance check") - suite = _plain_dict(check.get("check_suite"), field="Product acceptance check suite") + candidates = [] + for raw in suites: + suite = _plain_dict(raw, field="Product evaluate rule suite") if ( - check.get("name") == PRODUCT_CHECK - and suite.get("id") == suite_id - and check.get("status") == "completed" - and check.get("conclusion") == "success" + suite.get("repository_id") == TARGET_REPOSITORY_ID + and suite.get("ref") == f"refs/heads/{TARGET_BRANCH}" + and suite.get("before_sha") == base_sha + and suite.get("after_sha") == head_sha + and _parse_timestamp(suite.get("pushed_at"), field="Product evaluate rule suite") + > not_before ): - matched.append(check) - if len(matched) != 1: + candidates.append(suite) + if len(candidates) != 1: raise RulesetGovernanceError( - "Product canary lacks one exact successful Product acceptance check" + "Product canary lacks one exact current-base evaluate rule suite" ) - app = _plain_dict(matched[0].get("app"), field="Product acceptance app") - integration_id = app.get("id") - if type(integration_id) is not int or integration_id <= 0: + suite_id = candidates[0].get("id") + if type(suite_id) is not int or suite_id <= 0: + raise RulesetGovernanceError("Product evaluate rule suite identity is malformed") + detail = _gh_api( + "GET", + f"repos/{TARGET_FULL_NAME}/rulesets/rule-suites/{suite_id}", + ) + evaluations = _plain_list( + detail.get("rule_evaluations"), + field="Product evaluate rule evaluations", + ) + matched = [] + for raw in evaluations: + evaluation = _plain_dict(raw, field="Product evaluate rule evaluation") + source = _plain_dict(evaluation.get("rule_source"), field="Product rule source") + if ( + source.get("id") == ruleset_id + and evaluation.get("enforcement") == "evaluate" + and evaluation.get("rule_type") == "workflows" + and evaluation.get("result") == "pass" + ): + matched.append(evaluation) + if len(matched) != 1: raise RulesetGovernanceError( - "Product acceptance check lacks a positive integration identity" + "Product workflow ruleset lacks exact evaluate-mode PASS evidence" ) - return integration_id def activate_product_ruleset( @@ -476,8 +522,8 @@ def activate_product_ruleset( expected_main_sha: str, canary_pr: int, canary_run_id: int, -) -> int: - """Promote evaluate to active only after exact current-base Product evidence.""" +) -> str: + """Promote evaluate to active only after exact retarget and rule-suite evidence.""" _assert_current_main(expected_main_sha) pinned_id = manifest["ruleset_id"] @@ -490,22 +536,31 @@ def activate_product_ruleset( first = _live(target) if first.get("enforcement") == "active": raise RulesetGovernanceError("Product ruleset is already active; use verify") - _assert_shape(first, target, enforcement="evaluate", integration_id=None) + _assert_shape(first, target, enforcement="evaluate") - integration_id = _canary_integration_id( + retargeted_at = _latest_base_retarget(canary_pr) + base_sha, head_sha = _canary_evidence( pr_number=canary_pr, run_id=canary_run_id, ) - desired = _desired(enforcement="active", integration_id=integration_id) + _assert_evaluate_rule_suite( + ruleset_id=pinned_id, + base_sha=base_sha, + head_sha=head_sha, + not_before=retargeted_at, + ) + desired = _desired(enforcement="active") baseline_version = _latest_history_version(target) _assert_current_main(expected_main_sha) + _assert_target_main(base_sha) second = _live(target) if _editable_projection(second) != _editable_projection(first): raise RulesetGovernanceError( "Product ruleset changed concurrently; refusing activation" ) - _assert_shape(second, target, enforcement="evaluate", integration_id=None) + _assert_shape(second, target, enforcement="evaluate") _assert_current_main(expected_main_sha) + _assert_target_main(base_sha) history_verified = False try: @@ -521,12 +576,7 @@ def activate_product_ruleset( else: after = _live(target) - _assert_shape( - after, - target, - enforcement="active", - integration_id=integration_id, - ) + _assert_shape(after, target, enforcement="active") if not history_verified: _verify_ruleset_history_transition( target, @@ -535,7 +585,8 @@ def activate_product_ruleset( expected_main_sha=None, ) _assert_current_main(expected_main_sha) - return integration_id + _assert_target_main(base_sha) + return "active" def _positive_int(value: str) -> int: @@ -595,13 +646,13 @@ def main(argv: list[str] | None = None) -> int: return 0 if args.canary_pr is None or args.canary_run_id is None: raise RulesetGovernanceError("activate requires canary PR and run IDs") - integration_id = activate_product_ruleset( + stage = activate_product_ruleset( manifest, expected_main_sha=args.expected_main_sha, canary_pr=args.canary_pr, canary_run_id=args.canary_run_id, ) - print(f"Product ruleset active integration_id={integration_id}") + print(f"Product ruleset stage={stage}") return 0 From 0ac72bc7421aa84c70f21b128777a9fd5614480c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 15:23:46 +0900 Subject: [PATCH 28/45] test: preserve Product bootstrap TOCTOU guard --- tests/test_conceptweave_product_ruleset_bootstrap_race.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/tests/test_conceptweave_product_ruleset_bootstrap_race.py b/tests/test_conceptweave_product_ruleset_bootstrap_race.py index f1bcc6f5d1..111c0ddc67 100644 --- a/tests/test_conceptweave_product_ruleset_bootstrap_race.py +++ b/tests/test_conceptweave_product_ruleset_bootstrap_race.py @@ -20,6 +20,7 @@ def _manifest() -> dict[str, object]: def test_bootstrap_rechecks_protected_main_immediately_before_create(monkeypatch): expected = "a" * 40 + target_main = "b" * 40 current_main_checks: list[str] = [] created = False @@ -35,10 +36,10 @@ def create_evaluate_ruleset(): monkeypatch.setattr(p, "_assert_current_main", assert_current_main) monkeypatch.setattr(p, "_named_ruleset", lambda: None) + monkeypatch.setattr(p, "_target_main_sha", lambda: target_main) + monkeypatch.setattr(p, "_assert_base_product_workflow", lambda sha: None) + monkeypatch.setattr(p, "_assert_target_main", lambda sha: None) monkeypatch.setattr(p, "_create_evaluate_ruleset", create_evaluate_ruleset) - monkeypatch.setattr(p, "_assert_shape", lambda *args, **kwargs: None) - monkeypatch.setattr(p, "_latest_history_version", lambda target: 1) - monkeypatch.setattr(p, "_history_version_state", lambda target, version: {}) with pytest.raises(RulesetGovernanceError, match="advanced"): p.bootstrap_product_ruleset(_manifest(), expected_main_sha=expected) From b0dcbdb779716b65475cfadb8e7d7124d35330c5 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 15:24:02 +0900 Subject: [PATCH 29/45] test: preserve Product activation target-main guard --- ...ptweave_product_ruleset_activation_race.py | 151 ++++++------------ 1 file changed, 52 insertions(+), 99 deletions(-) diff --git a/tests/test_conceptweave_product_ruleset_activation_race.py b/tests/test_conceptweave_product_ruleset_activation_race.py index ca9e108caa..25d390c59e 100644 --- a/tests/test_conceptweave_product_ruleset_activation_race.py +++ b/tests/test_conceptweave_product_ruleset_activation_race.py @@ -1,6 +1,6 @@ from __future__ import annotations -import base64 +from datetime import datetime, timezone import pytest @@ -8,125 +8,78 @@ from scripts.ci.reconcile_ruleset_governance import RulesetGovernanceError -def _live_payload( - ruleset_id: int, - *, - enforcement: str = "evaluate", - integration_id: int | None = None, -) -> dict[str, object]: +def _manifest(ruleset_id: int) -> dict[str, object]: + return { + "schema_version": 1, + "target_repository": p.TARGET_FULL_NAME, + "target_branch": p.TARGET_BRANCH, + "ruleset_name": p.RULESET_NAME, + "ruleset_id": ruleset_id, + "required_check": p.PRODUCT_CHECK, + "forbidden_check": p.METADATA_ONLY_CHECK, + } + + +def _live(ruleset_id: int) -> dict[str, object]: return { "id": ruleset_id, - "source_type": "Repository", - "source": p.TARGET_FULL_NAME, - **p._desired(enforcement=enforcement, integration_id=integration_id), + "source_type": "Organization", + "source": p.ORGANIZATION, + **p._desired(enforcement="evaluate"), } def test_activation_aborts_when_conceptweave_main_advances_after_canary( monkeypatch: pytest.MonkeyPatch, ) -> None: - """Do not activate from a canary whose protected target base has gone stale.""" + """Do not activate from evaluate evidence whose protected target base went stale.""" ruleset_id = 30 - pr_number = 5 - run_id = 77 base_sha = "a" * 40 head_sha = "b" * 40 - advanced_main_sha = "c" * 40 - workflow = ( - "name: Product\n" - "acceptance: 'Product acceptance'\n" - "metadata: 'Product metadata-only'\n" - ) - main_reads = 0 + target_checks = 0 put_called = False - - def api(method: str, endpoint: str, **kwargs: object) -> dict[str, object]: - nonlocal main_reads, put_called - if endpoint.endswith(f"pulls/{pr_number}"): - return { - "state": "open", - "draft": False, - "head": {"sha": head_sha}, - "base": {"ref": p.TARGET_BRANCH, "sha": base_sha}, - } - if endpoint.endswith(f"git/ref/heads/{p.TARGET_BRANCH}"): - main_reads += 1 - current = base_sha if main_reads == 1 else advanced_main_sha - return {"object": {"sha": current}} - if f"contents/{p.PRODUCT_WORKFLOW_PATH}" in endpoint: - return { - "type": "file", - "encoding": "base64", - "content": base64.b64encode(workflow.encode()).decode(), - } - if endpoint.endswith(f"actions/runs/{run_id}"): - return { - "name": p.PRODUCT_WORKFLOW_NAME, - "event": "pull_request", - "head_sha": head_sha, - "status": "completed", - "conclusion": "success", - "check_suite_id": 900, - "pull_requests": [ - { - "number": pr_number, - "head": {"sha": head_sha}, - "base": {"sha": base_sha}, - } - ], - } - if f"actions/runs/{run_id}/jobs" in endpoint: - return { - "jobs": [ - { - "name": p.PRODUCT_CHECK, - "status": "completed", - "conclusion": "success", - } - ] - } - if "check-runs" in endpoint: - return { - "check_runs": [ - { - "name": p.PRODUCT_CHECK, - "check_suite": {"id": 900}, - "status": "completed", - "conclusion": "success", - "app": {"id": 15368}, - } - ] - } - if method == "PUT": - put_called = True - return {} - raise AssertionError(endpoint) - - live_reads = 0 - before = _live_payload(ruleset_id) - after = _live_payload(ruleset_id, enforcement="active", integration_id=15368) - - def live(_target: object) -> dict[str, object]: - nonlocal live_reads - live_reads += 1 - return before if live_reads <= 2 else after + current = _live(ruleset_id) monkeypatch.setattr(p, "_assert_current_main", lambda _sha: None) monkeypatch.setattr(p, "_named_ruleset", lambda: {"id": ruleset_id}) - monkeypatch.setattr(p, "_assert_target_provenance", lambda *_args: None) - monkeypatch.setattr(p, "_live", live) + monkeypatch.setattr(p, "_live", lambda _target: current) + monkeypatch.setattr( + p, + "_latest_base_retarget", + lambda _pr: datetime(2026, 9, 23, 0, 0, tzinfo=timezone.utc), + ) + monkeypatch.setattr( + p, + "_canary_evidence", + lambda **_kwargs: (base_sha, head_sha), + ) + monkeypatch.setattr(p, "_assert_evaluate_rule_suite", lambda **_kwargs: None) monkeypatch.setattr(p, "_latest_history_version", lambda _target: 4) - monkeypatch.setattr(p, "_verify_ruleset_history_transition", lambda *_args, **_kwargs: None) + + def assert_target_main(_sha: str) -> None: + nonlocal target_checks + target_checks += 1 + if target_checks == 2: + raise RulesetGovernanceError("ConceptWeave protected main advanced") + + monkeypatch.setattr(p, "_assert_target_main", assert_target_main) + + def api(method: str, _endpoint: str, **_kwargs: object) -> dict[str, object]: + nonlocal put_called + if method == "PUT": + put_called = True + return {} + monkeypatch.setattr(p, "_gh_api", api) - with pytest.raises(RulesetGovernanceError, match="current protected main"): + with pytest.raises(RulesetGovernanceError, match="protected main advanced"): p.activate_product_ruleset( - {"ruleset_id": ruleset_id}, + _manifest(ruleset_id), expected_main_sha="d" * 40, - canary_pr=pr_number, - canary_run_id=run_id, + canary_pr=5, + canary_run_id=77, ) - assert main_reads >= 2 + assert target_checks == 2 assert put_called is False From f60691605fce3959a2327f145f23f4af6b4fa38b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 15:28:14 +0900 Subject: [PATCH 30/45] test: cover organization workflow ruleset lifecycle --- ...eptweave_product_ruleset_reconciliation.py | 585 ++++++++++-------- 1 file changed, 311 insertions(+), 274 deletions(-) diff --git a/tests/test_conceptweave_product_ruleset_reconciliation.py b/tests/test_conceptweave_product_ruleset_reconciliation.py index f72d2dcede..47739535ed 100644 --- a/tests/test_conceptweave_product_ruleset_reconciliation.py +++ b/tests/test_conceptweave_product_ruleset_reconciliation.py @@ -3,6 +3,7 @@ import base64 import json import subprocess +from datetime import datetime, timezone from pathlib import Path from types import SimpleNamespace @@ -33,23 +34,32 @@ def write_manifest(tmp_path: Path, data): return path -def live_payload(ruleset_id=99, *, enforcement="evaluate", integration_id=None): - payload = p._desired(enforcement=enforcement, integration_id=integration_id) +def live_payload(ruleset_id=99, *, enforcement="evaluate"): return { "id": ruleset_id, - "source_type": "Repository", - "source": p.TARGET_FULL_NAME, - **payload, + "source_type": "Organization", + "source": p.ORGANIZATION, + **p._desired(enforcement=enforcement), } -def test_manifest_valid(tmp_path): - assert p.load_product_manifest(write_manifest(tmp_path, manifest())) == manifest() +def completed(stdout="", returncode=0): + return SimpleNamespace(stdout=stdout, stderr="", returncode=returncode) -@pytest.mark.parametrize( - "mutate", - [ +def workflow_payload(text=None): + if text is None: + text = "name: Product\nx: 'Product acceptance'\ny: 'Product metadata-only'\nconcurrency:\n cancel-in-progress: false\n" + return { + "type": "file", + "encoding": "base64", + "content": base64.b64encode(text.encode()).decode(), + } + + +def test_manifest_valid_and_invalid(tmp_path): + assert p.load_product_manifest(write_manifest(tmp_path, manifest())) == manifest() + mutations = [ lambda d: d.update(extra=True), lambda d: d.__setitem__("schema_version", 2), lambda d: d.__setitem__("target_repository", "x/y"), @@ -59,55 +69,62 @@ def test_manifest_valid(tmp_path): lambda d: d.__setitem__("forbidden_check", "x"), lambda d: d.__setitem__("ruleset_id", 0), lambda d: d.__setitem__("ruleset_id", True), - ], -) -def test_manifest_rejects_invalid(tmp_path, mutate): - data = manifest() - mutate(data) - with pytest.raises(RulesetGovernanceError): - p.load_product_manifest(write_manifest(tmp_path, data)) - - -def test_target_and_desired_validation(): - assert p._target(7).ruleset_id == 7 + ] + for mutate in mutations: + data = manifest() + mutate(data) + with pytest.raises(RulesetGovernanceError): + p.load_product_manifest(write_manifest(tmp_path, data)) + + +def test_target_and_desired(): + target = p._target(7) + assert target.scope == "organization" + assert target.repository is None + assert target.endpoint.endswith("/7") with pytest.raises(RulesetGovernanceError): p._target(0) - assert p._desired(enforcement="evaluate", integration_id=None)["enforcement"] == "evaluate" - assert p._desired(enforcement="active", integration_id=15368)["rules"][0]["parameters"]["required_status_checks"][0]["integration_id"] == 15368 - with pytest.raises(RulesetGovernanceError): - p._desired(enforcement="bad", integration_id=None) + desired = p._desired(enforcement="evaluate") + assert desired["target"] == "branch" + assert desired["conditions"]["repository_id"]["repository_ids"] == [p.TARGET_REPOSITORY_ID] + assert desired["rules"][0]["type"] == "workflows" + assert desired["rules"][0]["parameters"]["workflows"][0] == { + "repository_id": p.TARGET_REPOSITORY_ID, + "path": p.PRODUCT_WORKFLOW_PATH, + "ref": "refs/heads/main", + } with pytest.raises(RulesetGovernanceError): - p._desired(enforcement="active", integration_id=0) + p._desired(enforcement="bad") def test_assert_shape(monkeypatch): target = p._target(9) monkeypatch.setattr(p, "_assert_target_provenance", lambda live, target: None) - p._assert_shape(live_payload(9), target, enforcement="evaluate", integration_id=None) + p._assert_shape(live_payload(9), target, enforcement="evaluate") bad = live_payload(9) bad["name"] = "bad" with pytest.raises(RulesetGovernanceError, match="name"): - p._assert_shape(bad, target, enforcement="evaluate", integration_id=None) + p._assert_shape(bad, target, enforcement="evaluate") bad = live_payload(9) bad["bypass_actors"] = [{"actor_id": 1}] with pytest.raises(RulesetGovernanceError, match="reviewed"): - p._assert_shape(bad, target, enforcement="evaluate", integration_id=None) + p._assert_shape(bad, target, enforcement="evaluate") -def test_repository_rulesets_and_named(monkeypatch): +def test_organization_rulesets_and_named(monkeypatch): monkeypatch.setattr(p, "_gh_api_list", lambda *a: [ - {"id": 1, "name": "other", "source_type": "Repository", "source": p.TARGET_FULL_NAME}, - {"id": 2, "name": p.RULESET_NAME, "source_type": "Repository", "source": p.TARGET_FULL_NAME}, + {"id": 1, "name": "other", "source_type": "Organization", "source": p.ORGANIZATION}, + {"id": 2, "name": p.RULESET_NAME, "source_type": "Organization", "source": p.ORGANIZATION}, ]) assert p._named_ruleset()["id"] == 2 monkeypatch.setattr(p, "_gh_api_list", lambda *a: [ - {"id": 1, "name": p.RULESET_NAME, "source_type": "Organization", "source": p.ORGANIZATION} + {"id": 1, "name": p.RULESET_NAME, "source_type": "Repository", "source": p.TARGET_FULL_NAME} ]) with pytest.raises(RulesetGovernanceError, match="foreign"): - p._repository_rulesets() + p._organization_rulesets() monkeypatch.setattr(p, "_gh_api_list", lambda *a: [ - {"id": 1, "name": p.RULESET_NAME, "source_type": "Repository", "source": p.TARGET_FULL_NAME}, - {"id": 2, "name": p.RULESET_NAME, "source_type": "Repository", "source": p.TARGET_FULL_NAME}, + {"id": 1, "name": p.RULESET_NAME, "source_type": "Organization", "source": p.ORGANIZATION}, + {"id": 2, "name": p.RULESET_NAME, "source_type": "Organization", "source": p.ORGANIZATION}, ]) with pytest.raises(RulesetGovernanceError, match="multiple"): p._named_ruleset() @@ -115,52 +132,25 @@ def test_repository_rulesets_and_named(monkeypatch): def test_live(monkeypatch): target = p._target(4) - monkeypatch.setattr(p, "_gh_api", lambda *a, **k: {"id": 4}) + monkeypatch.setattr(p, "_gh_api", lambda *a, **k: live_payload(4)) monkeypatch.setattr(p, "_assert_target_provenance", lambda live, target: None) assert p._live(target)["id"] == 4 -@pytest.mark.parametrize("rules", [[], [{}, {}]]) -def test_active_integration_rejects_rule_count(rules): - with pytest.raises(RulesetGovernanceError, match="one rule"): - p._active_integration_id({"rules": rules}) - - -@pytest.mark.parametrize("checks", [[], [{}, {}]]) -def test_active_integration_rejects_check_count(checks): - live = {"rules": [{"parameters": {"required_status_checks": checks}}]} - with pytest.raises(RulesetGovernanceError, match="one check"): - p._active_integration_id(live) - - -def test_active_integration_id(): - live = {"rules": [{"parameters": {"required_status_checks": [{"integration_id": 15368}]}}]} - assert p._active_integration_id(live) == 15368 - live["rules"][0]["parameters"]["required_status_checks"][0]["integration_id"] = None - with pytest.raises(RulesetGovernanceError, match="positive"): - p._active_integration_id(live) - - -def test_verify_absent_and_unpinned_existing(monkeypatch): +def test_verify_absent_and_states(monkeypatch): monkeypatch.setattr(p, "_named_ruleset", lambda: None) assert p.verify_product_ruleset(manifest()) == "absent" monkeypatch.setattr(p, "_named_ruleset", lambda: {"id": 9}) with pytest.raises(RulesetGovernanceError, match="pin"): p.verify_product_ruleset(manifest()) - - -def test_verify_pinned_missing(monkeypatch): monkeypatch.setattr(p, "_named_ruleset", lambda: None) with pytest.raises(RulesetGovernanceError, match="absent"): p.verify_product_ruleset(manifest(9)) - - -def test_verify_evaluate_active_and_unknown(monkeypatch): monkeypatch.setattr(p, "_named_ruleset", lambda: {"id": 9}) - monkeypatch.setattr(p, "_assert_target_provenance", lambda *a: None) monkeypatch.setattr(p, "_live", lambda t: live_payload(9)) + monkeypatch.setattr(p, "_assert_shape", lambda *a, **k: None) assert p.verify_product_ruleset(manifest(9)) == "evaluate" - monkeypatch.setattr(p, "_live", lambda t: live_payload(9, enforcement="active", integration_id=15368)) + monkeypatch.setattr(p, "_live", lambda t: live_payload(9, enforcement="active")) assert p.verify_product_ruleset(manifest(9)) == "active" bad = live_payload(9) bad["enforcement"] = "disabled" @@ -169,306 +159,312 @@ def test_verify_evaluate_active_and_unknown(monkeypatch): p.verify_product_ruleset(manifest(9)) -def completed(stdout="", returncode=0): - return SimpleNamespace(stdout=stdout, stderr="", returncode=returncode) - - -def test_create_evaluate_success(monkeypatch): +def test_create_evaluate_success_and_settlement(monkeypatch): created = live_payload(11) monkeypatch.setattr(subprocess, "run", lambda *a, **k: completed(json.dumps(created))) assert p._create_evaluate_ruleset()["id"] == 11 - -def test_create_evaluate_success_invalid_json_settles(monkeypatch): monkeypatch.setattr(subprocess, "run", lambda *a, **k: completed("{")) monkeypatch.setattr(p, "_named_ruleset", lambda: {"id": 12}) monkeypatch.setattr(p, "_live", lambda t: live_payload(12)) - monkeypatch.setattr(p, "_assert_target_provenance", lambda *a: None) + monkeypatch.setattr(p, "_assert_shape", lambda *a, **k: None) assert p._create_evaluate_ruleset()["id"] == 12 - -@pytest.mark.parametrize("outcome", ["timeout", "nonzero"]) -def test_create_evaluate_ambiguous_settles(monkeypatch, outcome): - def run(*a, **k): - if outcome == "timeout": - raise subprocess.TimeoutExpired("gh", 30) - return completed("", 1) - monkeypatch.setattr(subprocess, "run", run) + def timeout(*a, **k): + raise subprocess.TimeoutExpired("gh", 30) + monkeypatch.setattr(subprocess, "run", timeout) monkeypatch.setattr(p, "_named_ruleset", lambda: {"id": 13}) monkeypatch.setattr(p, "_live", lambda t: live_payload(13)) - monkeypatch.setattr(p, "_assert_target_provenance", lambda *a: None) assert p._create_evaluate_ruleset()["id"] == 13 - -def test_create_evaluate_ambiguous_without_live_identity(monkeypatch): monkeypatch.setattr(subprocess, "run", lambda *a, **k: completed("", 1)) + monkeypatch.setattr(p, "_named_ruleset", lambda: {"id": 14}) + monkeypatch.setattr(p, "_live", lambda t: live_payload(14)) + assert p._create_evaluate_ruleset()["id"] == 14 + monkeypatch.setattr(p, "_named_ruleset", lambda: None) with pytest.raises(RulesetGovernanceError, match="ambiguous"): p._create_evaluate_ruleset() -def test_bootstrap_pinned_evaluate_and_active(monkeypatch): - calls = [] - monkeypatch.setattr(p, "_assert_current_main", lambda sha: calls.append(sha)) +def test_target_main(monkeypatch): + monkeypatch.setattr(p, "_gh_api", lambda *a, **k: {"object": {"sha": "a" * 40}}) + assert p._target_main_sha() == "a" * 40 + p._assert_target_main("a" * 40) + with pytest.raises(RulesetGovernanceError, match="advanced"): + p._assert_target_main("b" * 40) + monkeypatch.setattr(p, "_gh_api", lambda *a, **k: {"object": {"sha": "bad"}}) + with pytest.raises(RulesetGovernanceError, match="malformed"): + p._target_main_sha() + + +def test_bootstrap_paths(monkeypatch): + checks = [] + monkeypatch.setattr(p, "_assert_current_main", lambda sha: checks.append(sha)) + monkeypatch.setattr(p, "_assert_shape", lambda *a, **k: None) monkeypatch.setattr(p, "_named_ruleset", lambda: {"id": 20}) - monkeypatch.setattr(p, "_assert_target_provenance", lambda *a: None) monkeypatch.setattr(p, "_live", lambda t: live_payload(20)) - assert p.bootstrap_product_ruleset(manifest(20), expected_main_sha="a"*40) == 20 - monkeypatch.setattr(p, "_live", lambda t: live_payload(20, enforcement="active", integration_id=15368)) - assert p.bootstrap_product_ruleset(manifest(20), expected_main_sha="a"*40) == 20 - assert len(calls) == 4 + assert p.bootstrap_product_ruleset(manifest(20), expected_main_sha="a" * 40) == 20 + assert checks == ["a" * 40, "a" * 40] - -def test_bootstrap_pinned_missing(monkeypatch): - monkeypatch.setattr(p, "_assert_current_main", lambda sha: None) monkeypatch.setattr(p, "_named_ruleset", lambda: None) with pytest.raises(RulesetGovernanceError, match="absent"): - p.bootstrap_product_ruleset(manifest(20), expected_main_sha="a"*40) - - -def test_bootstrap_unpinned_existing(monkeypatch): - monkeypatch.setattr(p, "_assert_current_main", lambda sha: None) + p.bootstrap_product_ruleset(manifest(20), expected_main_sha="a" * 40) monkeypatch.setattr(p, "_named_ruleset", lambda: {"id": 21}) with pytest.raises(RulesetGovernanceError, match="pin"): - p.bootstrap_product_ruleset(manifest(), expected_main_sha="a"*40) + p.bootstrap_product_ruleset(manifest(), expected_main_sha="a" * 40) -def test_bootstrap_creates_and_verifies_history(monkeypatch): +def test_bootstrap_create(monkeypatch): seen = [] + target_seen = [] monkeypatch.setattr(p, "_assert_current_main", lambda sha: seen.append(sha)) monkeypatch.setattr(p, "_named_ruleset", lambda: None) + monkeypatch.setattr(p, "_target_main_sha", lambda: "b" * 40) + monkeypatch.setattr(p, "_assert_base_product_workflow", lambda sha: None) + monkeypatch.setattr(p, "_assert_target_main", lambda sha: target_seen.append(sha)) monkeypatch.setattr(p, "_create_evaluate_ruleset", lambda: live_payload(22)) - monkeypatch.setattr(p, "_assert_target_provenance", lambda *a: None) + monkeypatch.setattr(p, "_assert_shape", lambda *a, **k: None) monkeypatch.setattr(p, "_latest_history_version", lambda target: 3) monkeypatch.setattr(p, "_history_version_state", lambda target, version: live_payload(22)) - assert p.bootstrap_product_ruleset(manifest(), expected_main_sha="a"*40) == 22 - assert seen == ["a"*40, "a"*40, "a"*40] + assert p.bootstrap_product_ruleset(manifest(), expected_main_sha="a" * 40) == 22 + assert seen == ["a" * 40, "a" * 40, "a" * 40] + assert target_seen == ["b" * 40, "b" * 40] -def test_decode_workflow(): - text = "name: Product" - payload = { - "type": "file", - "encoding": "base64", - "content": base64.b64encode(text.encode()).decode(), - } +def test_decode_and_base_workflow(monkeypatch): + text = "name: Product\n'Product acceptance'\n'Product metadata-only'\ncancel-in-progress: false\n" + payload = workflow_payload(text) assert p._decode_workflow(payload) == text - with pytest.raises(RulesetGovernanceError, match="base64 file"): - p._decode_workflow({"type": "dir", "encoding": "base64", "content": ""}) + wrapped = dict(payload) + wrapped["content"] = "\n".join(payload["content"][i:i+10] for i in range(0, len(payload["content"]), 10)) + assert p._decode_workflow(wrapped) == text + for bad in ( + {"type": "dir", "encoding": "base64", "content": ""}, + {"type": "file", "encoding": "base64", "content": None}, + {"type": "file", "encoding": "base64", "content": "!"}, + ): + with pytest.raises(RulesetGovernanceError): + p._decode_workflow(bad) + + monkeypatch.setattr(p, "_gh_api", lambda *a, **k: payload) + p._assert_base_product_workflow("a" * 40) + bad = workflow_payload("name: Product\n") + monkeypatch.setattr(p, "_gh_api", lambda *a, **k: bad) + with pytest.raises(RulesetGovernanceError, match="acceptance"): + p._assert_base_product_workflow("a" * 40) + + +def test_parse_timestamp(): + assert p._parse_timestamp("2026-09-23T00:00:00Z", field="x").tzinfo is not None + with pytest.raises(RulesetGovernanceError, match="missing"): + p._parse_timestamp(None, field="x") with pytest.raises(RulesetGovernanceError, match="malformed"): - p._decode_workflow({"type": "file", "encoding": "base64", "content": None}) - with pytest.raises(RulesetGovernanceError, match="invalid"): - p._decode_workflow({"type": "file", "encoding": "base64", "content": "!"}) + p._parse_timestamp("no", field="x") -def test_assert_base_product_workflow(monkeypatch): - good = "name: Product\nx: 'Product acceptance'\ny: 'Product metadata-only'\n" - monkeypatch.setattr(p, "_gh_api", lambda *a, **k: { - "type": "file", - "encoding": "base64", - "content": base64.b64encode(good.encode()).decode(), - }) - p._assert_base_product_workflow("a"*40) - bad = "name: Product\n" - monkeypatch.setattr(p, "_gh_api", lambda *a, **k: { - "type": "file", - "encoding": "base64", - "content": base64.b64encode(bad.encode()).decode(), - }) - with pytest.raises(RulesetGovernanceError, match="identities"): - p._assert_base_product_workflow("a"*40) +def test_latest_base_retarget(monkeypatch): + timeline = [ + {"event": "base_ref_changed", "created_at": "2026-09-23T00:00:00Z"}, + {"event": "commented", "created_at": "2026-09-23T00:01:00Z"}, + ] + monkeypatch.setattr(p, "_gh_api_list", lambda *a: timeline) + assert p._latest_base_retarget(5) == datetime(2026, 9, 23, tzinfo=timezone.utc) + monkeypatch.setattr(p, "_gh_api_list", lambda *a: []) + with pytest.raises(RulesetGovernanceError, match="lacks"): + p._latest_base_retarget(5) -def canary_api(head_sha="b"*40, base_sha="a"*40, run_id=77, pr_number=5, *, - pr_state="open", draft=False, base_ref="main", run_name="Product", - run_event="pull_request", run_status="completed", run_conclusion="success", - job_name="Product acceptance", job_status="completed", job_conclusion="success", - app_id=15368, bound=True, check_ok=True): - workflow = "name: Product\nn: 'Product acceptance'\nm: 'Product metadata-only'\n" + monkeypatch.setattr(p, "_gh_api_list", lambda *a: timeline + [ + {"event": "committed", "created_at": "2026-09-23T00:02:00Z"} + ]) + with pytest.raises(RulesetGovernanceError, match="source commit"): + p._latest_base_retarget(5) + + +def canary_api(**overrides): + head_sha = overrides.get("head_sha", "b" * 40) + base_sha = overrides.get("base_sha", "a" * 40) + pr_number = overrides.get("pr_number", 5) + run_id = overrides.get("run_id", 77) + run = { + "name": p.PRODUCT_WORKFLOW_NAME, + "path": p.PRODUCT_WORKFLOW_PATH, + "event": "pull_request", + "head_sha": head_sha, + "status": "completed", + "conclusion": "success", + "run_attempt": 1, + "created_at": "2026-09-23T00:01:00Z", + "pull_requests": [{"number": pr_number, "head": {"sha": head_sha}, "base": {"sha": base_sha}}], + } + run.update(overrides.get("run_overrides", {})) def api(method, endpoint, **kwargs): if endpoint.endswith(f"pulls/{pr_number}"): return { - "state": pr_state, - "draft": draft, + "state": overrides.get("pr_state", "open"), + "draft": overrides.get("draft", False), "head": {"sha": head_sha}, - "base": {"ref": base_ref, "sha": base_sha}, - } - if endpoint.endswith("git/ref/heads/main"): - return {"object": {"sha": base_sha}} - if "contents/.github/workflows/product.yml" in endpoint: - return { - "type": "file", - "encoding": "base64", - "content": base64.b64encode(workflow.encode()).decode(), + "base": {"ref": overrides.get("base_ref", "main"), "sha": base_sha}, } if endpoint.endswith(f"actions/runs/{run_id}"): - return { - "name": run_name, - "event": run_event, - "head_sha": head_sha, - "status": run_status, - "conclusion": run_conclusion, - "check_suite_id": 900, - "pull_requests": [ - { - "number": pr_number if bound else pr_number + 1, - "head": {"sha": head_sha}, - "base": {"sha": base_sha}, - } - ], - } + return run if f"actions/runs/{run_id}/jobs" in endpoint: - return { - "jobs": [ - { - "name": job_name, - "status": job_status, - "conclusion": job_conclusion, - } - ] - } - if "check-runs" in endpoint: - return { - "check_runs": [ - { - "name": p.PRODUCT_CHECK if check_ok else "Other", - "check_suite": {"id": 900}, - "status": "completed", - "conclusion": "success", - "app": {"id": app_id}, - } - ] - } + return {"jobs": overrides.get("jobs", [{"name": p.PRODUCT_CHECK, "status": "completed", "conclusion": "success"}])} raise AssertionError(endpoint) return api +def setup_canary(monkeypatch, **kwargs): + monkeypatch.setattr(p, "_gh_api", canary_api(**kwargs)) + monkeypatch.setattr(p, "_assert_target_main", lambda sha: None) + monkeypatch.setattr(p, "_assert_base_product_workflow", lambda sha: None) + monkeypatch.setattr( + p, + "_latest_base_retarget", + lambda pr: datetime(2026, 9, 23, 0, 0, tzinfo=timezone.utc), + ) + + def test_canary_success(monkeypatch): - monkeypatch.setattr(p, "_gh_api", canary_api()) - assert p._canary_integration_id(pr_number=5, run_id=77) == 15368 + setup_canary(monkeypatch) + assert p._canary_evidence(pr_number=5, run_id=77) == ("a" * 40, "b" * 40) @pytest.mark.parametrize( "kwargs,match", [ - ({}, "positive"), + ({"pr_state": "closed"}, "open"), + ({"draft": True}, "open"), + ({"head_sha": "bad"}, "malformed"), + ({"base_ref": "dev"}, "protected main"), + ({"run_overrides": {"name": "Other"}}, "terminal Product"), + ({"run_overrides": {"path": ".github/workflows/other.yml"}}, "terminal Product"), + ({"run_overrides": {"event": "push"}}, "terminal Product"), + ({"run_overrides": {"status": "queued"}}, "terminal Product"), + ({"run_overrides": {"conclusion": "failure"}}, "terminal Product"), + ({"run_overrides": {"run_attempt": 2}}, "terminal Product"), + ({"run_overrides": {"created_at": "2026-09-22T23:59:00Z"}}, "predates"), + ({"run_overrides": {"pull_requests": []}}, "bound"), + ({"jobs": []}, "uniquely successful"), + ({"jobs": [{"name": p.PRODUCT_CHECK, "status": "completed", "conclusion": "failure"}]}, "uniquely successful"), ], ) -def test_canary_nonpositive(kwargs, match): +def test_canary_rejects(monkeypatch, kwargs, match): + setup_canary(monkeypatch, **kwargs) with pytest.raises(RulesetGovernanceError, match=match): - p._canary_integration_id(pr_number=0, run_id=1) + p._canary_evidence(pr_number=5, run_id=77) -@pytest.mark.parametrize( - "api,match", - [ - (canary_api(pr_state="closed"), "open"), - (canary_api(draft=True), "open"), - (canary_api(head_sha="bad"), "malformed"), - (canary_api(base_ref="dev"), "protected main"), - (canary_api(run_name="Other"), "terminal Product"), - (canary_api(run_event="push"), "terminal Product"), - (canary_api(run_status="queued"), "terminal Product"), - (canary_api(run_conclusion="failure"), "terminal Product"), - (canary_api(bound=False), "bound"), - (canary_api(job_name="Product metadata-only"), "exactly one"), - (canary_api(job_status="queued"), "not successful"), - (canary_api(job_conclusion="failure"), "not successful"), - (canary_api(check_ok=False), "one exact"), - (canary_api(app_id=0), "positive integration"), - ], -) -def test_canary_rejects(monkeypatch, api, match): - monkeypatch.setattr(p, "_gh_api", api) - with pytest.raises(RulesetGovernanceError, match=match): - p._canary_integration_id(pr_number=5, run_id=77) +def test_canary_nonpositive(): + with pytest.raises(RulesetGovernanceError, match="positive"): + p._canary_evidence(pr_number=0, run_id=1) + + +def test_evaluate_rule_suite(monkeypatch): + base, head = "a" * 40, "b" * 40 + not_before = datetime(2026, 9, 23, tzinfo=timezone.utc) + suite = { + "id": 55, + "repository_id": p.TARGET_REPOSITORY_ID, + "ref": "refs/heads/main", + "before_sha": base, + "after_sha": head, + "pushed_at": "2026-09-23T00:01:00Z", + } + monkeypatch.setattr(p, "_gh_api_list", lambda *a: [suite]) + monkeypatch.setattr(p, "_gh_api", lambda *a, **k: { + "rule_evaluations": [{ + "rule_source": {"id": 30}, + "enforcement": "evaluate", + "rule_type": "workflows", + "result": "pass", + }] + }) + p._assert_evaluate_rule_suite(ruleset_id=30, base_sha=base, head_sha=head, not_before=not_before) + monkeypatch.setattr(p, "_gh_api_list", lambda *a: []) + with pytest.raises(RulesetGovernanceError, match="one exact"): + p._assert_evaluate_rule_suite(ruleset_id=30, base_sha=base, head_sha=head, not_before=not_before) -def test_canary_rejects_stale_base(monkeypatch): - api = canary_api() - def stale(method, endpoint, **kwargs): - if endpoint.endswith("git/ref/heads/main"): - return {"object": {"sha": "c"*40}} - return api(method, endpoint, **kwargs) - monkeypatch.setattr(p, "_gh_api", stale) - with pytest.raises(RulesetGovernanceError, match="current"): - p._canary_integration_id(pr_number=5, run_id=77) + bad_id = dict(suite, id=0) + monkeypatch.setattr(p, "_gh_api_list", lambda *a: [bad_id]) + with pytest.raises(RulesetGovernanceError, match="identity"): + p._assert_evaluate_rule_suite(ruleset_id=30, base_sha=base, head_sha=head, not_before=not_before) + monkeypatch.setattr(p, "_gh_api_list", lambda *a: [suite]) + monkeypatch.setattr(p, "_gh_api", lambda *a, **k: {"rule_evaluations": []}) + with pytest.raises(RulesetGovernanceError, match="PASS"): + p._assert_evaluate_rule_suite(ruleset_id=30, base_sha=base, head_sha=head, not_before=not_before) -def test_activate_success(monkeypatch): - main_calls = [] - live_calls = {"n": 0} - monkeypatch.setattr(p, "_assert_current_main", lambda sha: main_calls.append(sha)) - monkeypatch.setattr(p, "_named_ruleset", lambda: {"id": 30}) - monkeypatch.setattr(p, "_assert_target_provenance", lambda *a: None) - before = live_payload(30) - after = live_payload(30, enforcement="active", integration_id=15368) - def live(target): - live_calls["n"] += 1 - return before if live_calls["n"] <= 2 else after - monkeypatch.setattr(p, "_live", live) - monkeypatch.setattr(p, "_canary_integration_id", lambda **k: 15368) + +def setup_activate(monkeypatch, *, ruleset_id=30, active=False): + before = live_payload(ruleset_id, enforcement="active" if active else "evaluate") + monkeypatch.setattr(p, "_assert_current_main", lambda sha: None) + monkeypatch.setattr(p, "_assert_target_main", lambda sha: None) + monkeypatch.setattr(p, "_named_ruleset", lambda: {"id": ruleset_id}) + monkeypatch.setattr(p, "_live", lambda target: before) + monkeypatch.setattr(p, "_assert_shape", lambda *a, **k: None) + monkeypatch.setattr( + p, + "_latest_base_retarget", + lambda pr: datetime(2026, 9, 23, tzinfo=timezone.utc), + ) + monkeypatch.setattr(p, "_canary_evidence", lambda **k: ("a" * 40, "b" * 40)) + monkeypatch.setattr(p, "_assert_evaluate_rule_suite", lambda **k: None) monkeypatch.setattr(p, "_latest_history_version", lambda target: 4) + return before + + +def test_activate_success(monkeypatch): + before = setup_activate(monkeypatch) + after = live_payload(30, enforcement="active") + reads = iter([before, before, after]) + monkeypatch.setattr(p, "_live", lambda target: next(reads)) monkeypatch.setattr(p, "_gh_api", lambda *a, **k: {}) verified = [] - monkeypatch.setattr(p, "_verify_ruleset_history_transition", lambda *a, **k: verified.append((a, k))) - assert p.activate_product_ruleset( - manifest(30), expected_main_sha="a"*40, canary_pr=5, canary_run_id=77 - ) == 15368 - assert len(main_calls) == 4 - assert verified + monkeypatch.setattr(p, "_verify_ruleset_history_transition", lambda *a, **k: verified.append(1)) + assert p.activate_product_ruleset(manifest(30), expected_main_sha="d"*40, canary_pr=5, canary_run_id=77) == "active" + assert verified == [1] def test_activate_ambiguous_success(monkeypatch): - monkeypatch.setattr(p, "_assert_current_main", lambda sha: None) - monkeypatch.setattr(p, "_named_ruleset", lambda: {"id": 31}) - monkeypatch.setattr(p, "_assert_target_provenance", lambda *a: None) - monkeypatch.setattr(p, "_live", lambda target: live_payload(31)) - monkeypatch.setattr(p, "_canary_integration_id", lambda **k: 15368) - monkeypatch.setattr(p, "_latest_history_version", lambda target: 4) + before = setup_activate(monkeypatch, ruleset_id=31) + monkeypatch.setattr(p, "_live", lambda target: before) def api(*a, **k): raise AmbiguousRulesetWriteError("x") monkeypatch.setattr(p, "_gh_api", api) - after = live_payload(31, enforcement="active", integration_id=15368) - monkeypatch.setattr(p, "_confirm_ambiguous_put", lambda *a, **k: after) - assert p.activate_product_ruleset( - manifest(31), expected_main_sha="a"*40, canary_pr=5, canary_run_id=77 - ) == 15368 + monkeypatch.setattr(p, "_confirm_ambiguous_put", lambda *a, **k: live_payload(31, enforcement="active")) + assert p.activate_product_ruleset(manifest(31), expected_main_sha="d"*40, canary_pr=5, canary_run_id=77) == "active" -def test_activate_requires_pinned(monkeypatch): +def test_activate_rejects(monkeypatch): monkeypatch.setattr(p, "_assert_current_main", lambda sha: None) with pytest.raises(RulesetGovernanceError, match="adoption"): - p.activate_product_ruleset( - manifest(), expected_main_sha="a"*40, canary_pr=1, canary_run_id=1 - ) - + p.activate_product_ruleset(manifest(), expected_main_sha="a"*40, canary_pr=1, canary_run_id=1) -def test_activate_missing_or_active_or_concurrent(monkeypatch): - monkeypatch.setattr(p, "_assert_current_main", lambda sha: None) monkeypatch.setattr(p, "_named_ruleset", lambda: None) with pytest.raises(RulesetGovernanceError, match="absent"): p.activate_product_ruleset(manifest(32), expected_main_sha="a"*40, canary_pr=1, canary_run_id=1) - monkeypatch.setattr(p, "_named_ruleset", lambda: {"id": 32}) - monkeypatch.setattr(p, "_assert_target_provenance", lambda *a: None) - monkeypatch.setattr(p, "_live", lambda target: live_payload(32, enforcement="active", integration_id=15368)) + + setup_activate(monkeypatch, ruleset_id=32, active=True) with pytest.raises(RulesetGovernanceError, match="already active"): p.activate_product_ruleset(manifest(32), expected_main_sha="a"*40, canary_pr=1, canary_run_id=1) - states = iter([live_payload(32), {**live_payload(32), "bypass_actors": [{"actor_id": 1}]}]) - monkeypatch.setattr(p, "_live", lambda target: next(states)) - monkeypatch.setattr(p, "_canary_integration_id", lambda **k: 15368) - monkeypatch.setattr(p, "_latest_history_version", lambda target: 1) + before = setup_activate(monkeypatch, ruleset_id=33) + changed = dict(before) + changed["bypass_actors"] = [{"actor_id": 1}] + reads = iter([before, changed]) + monkeypatch.setattr(p, "_live", lambda target: next(reads)) with pytest.raises(RulesetGovernanceError, match="concurrently"): - p.activate_product_ruleset(manifest(32), expected_main_sha="a"*40, canary_pr=1, canary_run_id=1) + p.activate_product_ruleset(manifest(33), expected_main_sha="a"*40, canary_pr=1, canary_run_id=1) def test_positive_int_and_parse_args(): assert p._positive_int("2") == 2 with pytest.raises(Exception): p._positive_int("0") - args = p._parse_args(["--mode", "validate"]) - assert args.mode == "validate" + assert p._parse_args(["--mode", "validate"]).mode == "validate" def test_main_modes(monkeypatch, tmp_path, capsys): @@ -492,12 +488,12 @@ def test_main_modes(monkeypatch, tmp_path, capsys): p.main(["--manifest", str(path), "--mode", "activate", "--expected-main-sha", "a"*40]) pinned = write_manifest(tmp_path, manifest(44)) - monkeypatch.setattr(p, "activate_product_ruleset", lambda *a, **k: 15368) + monkeypatch.setattr(p, "activate_product_ruleset", lambda *a, **k: "active") assert p.main([ "--manifest", str(pinned), "--mode", "activate", "--expected-main-sha", "a"*40, "--canary-pr", "5", "--canary-run-id", "77", ]) == 0 - assert "integration_id=15368" in capsys.readouterr().out + assert "stage=active" in capsys.readouterr().out def test_cli_success_and_error(monkeypatch, capsys): @@ -519,3 +515,44 @@ def test_main_bootstrap_pinned_skips_adoption_message(monkeypatch, tmp_path, cap monkeypatch.setattr(p, "bootstrap_product_ruleset", lambda *a, **k: 45) assert p.main(["--manifest", str(path), "--mode", "bootstrap", "--expected-main-sha", "a"*40]) == 0 assert "adoption required" not in capsys.readouterr().out + + +def test_bootstrap_rejects_unsupported_pinned_stage(monkeypatch): + monkeypatch.setattr(p, "_assert_current_main", lambda sha: None) + monkeypatch.setattr(p, "_named_ruleset", lambda: {"id": 20}) + bad = live_payload(20) + bad["enforcement"] = "disabled" + monkeypatch.setattr(p, "_live", lambda t: bad) + with pytest.raises(RulesetGovernanceError, match="unsupported"): + p.bootstrap_product_ruleset(manifest(20), expected_main_sha="a"*40) + + +def test_latest_base_retarget_ignores_earlier_commit(monkeypatch): + monkeypatch.setattr(p, "_gh_api_list", lambda *a: [ + {"event": "committed", "created_at": "2026-09-22T23:59:00Z"}, + {"event": "base_ref_changed", "created_at": "2026-09-23T00:00:00Z"}, + ]) + assert p._latest_base_retarget(5) == datetime(2026, 9, 23, tzinfo=timezone.utc) + + +def test_evaluate_rule_suite_skips_unrelated_suite_and_evaluation(monkeypatch): + base, head = "a"*40, "b"*40 + not_before = datetime(2026, 9, 23, tzinfo=timezone.utc) + unrelated = { + "id": 54, "repository_id": 999, "ref": "refs/heads/main", + "before_sha": base, "after_sha": head, "pushed_at": "2026-09-23T00:01:00Z", + } + matching = { + "id": 55, "repository_id": p.TARGET_REPOSITORY_ID, "ref": "refs/heads/main", + "before_sha": base, "after_sha": head, "pushed_at": "2026-09-23T00:01:00Z", + } + monkeypatch.setattr(p, "_gh_api_list", lambda *a: [unrelated, matching]) + monkeypatch.setattr(p, "_gh_api", lambda *a, **k: { + "rule_evaluations": [ + {"rule_source": {"id": 999}, "enforcement": "evaluate", "rule_type": "workflows", "result": "pass"}, + {"rule_source": {"id": 30}, "enforcement": "evaluate", "rule_type": "workflows", "result": "pass"}, + ] + }) + p._assert_evaluate_rule_suite( + ruleset_id=30, base_sha=base, head_sha=head, not_before=not_before + ) From c68107db7dc1b20358613dcdf1cbadc2d8cd6272 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 15:31:07 +0900 Subject: [PATCH 31/45] fix: preserve retarget provenance without synthetic timestamps --- .../reconcile_conceptweave_product_ruleset.py | 33 +++++++++---------- 1 file changed, 15 insertions(+), 18 deletions(-) diff --git a/scripts/ci/reconcile_conceptweave_product_ruleset.py b/scripts/ci/reconcile_conceptweave_product_ruleset.py index dbabce00ea..1a5fb51014 100644 --- a/scripts/ci/reconcile_conceptweave_product_ruleset.py +++ b/scripts/ci/reconcile_conceptweave_product_ruleset.py @@ -367,26 +367,23 @@ def _latest_base_retarget(pr_number: int) -> datetime: "GET", f"repos/{TARGET_FULL_NAME}/issues/{pr_number}/timeline?per_page=100", ) - retargets = [ - item for item in timeline - if _plain_dict(item, field="Product canary timeline event").get("event") - == "base_ref_changed" - ] - if not retargets: - raise RulesetGovernanceError("Product canary lacks a base_ref_changed event") - latest = max( - _parse_timestamp(item.get("created_at"), field="base retarget") - for item in retargets - ) - for item in timeline: + retargets: list[tuple[int, datetime]] = [] + for index, item in enumerate(timeline): event = _plain_dict(item, field="Product canary timeline event") - if event.get("event") != "committed": - continue - created = _parse_timestamp(event.get("created_at"), field="post-retarget commit") - if created > latest: - raise RulesetGovernanceError( - "Product canary has a source commit after its base retarget" + if event.get("event") == "base_ref_changed": + retargets.append( + (index, _parse_timestamp(event.get("created_at"), field="base retarget")) ) + if not retargets: + raise RulesetGovernanceError("Product canary lacks a base_ref_changed event") + latest_index, latest = max(retargets, key=lambda entry: entry[1]) + if any( + _plain_dict(item, field="Product canary timeline event").get("event") == "committed" + for item in timeline[latest_index + 1 :] + ): + raise RulesetGovernanceError( + "Product canary has a source commit after its base retarget" + ) return latest From aa258209a277baa0155b56f5d4e604e4f05e8e97 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 15:31:28 +0900 Subject: [PATCH 32/45] test: reject post-retarget commits without synthetic timestamps --- ...ptweave_product_ruleset_activation_race.py | 24 +++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/tests/test_conceptweave_product_ruleset_activation_race.py b/tests/test_conceptweave_product_ruleset_activation_race.py index 25d390c59e..9be88c9818 100644 --- a/tests/test_conceptweave_product_ruleset_activation_race.py +++ b/tests/test_conceptweave_product_ruleset_activation_race.py @@ -83,3 +83,27 @@ def api(method: str, _endpoint: str, **_kwargs: object) -> dict[str, object]: assert target_checks == 2 assert put_called is False + + +def test_retarget_provenance_rejects_later_commit_without_created_at( + monkeypatch: pytest.MonkeyPatch, +) -> None: + """Committed timeline events have no common created_at field; sequence is authoritative.""" + + monkeypatch.setattr( + p, + "_gh_api_list", + lambda *_args, **_kwargs: [ + { + "event": "base_ref_changed", + "created_at": "2026-09-23T00:00:00Z", + }, + { + "event": "committed", + "sha": "c" * 40, + }, + ], + ) + + with pytest.raises(RulesetGovernanceError, match="source commit"): + p._latest_base_retarget(5) From 28246b1e77ac387273aad63a8bb6746c331d633b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 15:45:24 +0900 Subject: [PATCH 33/45] test(governance): require immutable Product workflow coordinate --- ...weave_product_ruleset_contents_encoding.py | 44 +++++++++++++++++++ 1 file changed, 44 insertions(+) diff --git a/tests/test_conceptweave_product_ruleset_contents_encoding.py b/tests/test_conceptweave_product_ruleset_contents_encoding.py index 34664a5df7..d7bfa4ff2e 100644 --- a/tests/test_conceptweave_product_ruleset_contents_encoding.py +++ b/tests/test_conceptweave_product_ruleset_contents_encoding.py @@ -1,8 +1,27 @@ from __future__ import annotations import base64 +import json +from pathlib import Path + +import pytest from scripts.ci import reconcile_conceptweave_product_ruleset as p +from scripts.ci.reconcile_ruleset_governance import RulesetGovernanceError + + +MANIFEST = Path("config/conceptweave-product-ruleset.json") + + +def workflow_payload(text: str, *, blob_sha: str = "a" * 40) -> dict[str, str]: + """Build one GitHub Contents API workflow response with an immutable blob identity.""" + + return { + "type": "file", + "encoding": "base64", + "content": base64.b64encode(text.encode("utf-8")).decode("ascii"), + "sha": blob_sha, + } def test_decode_workflow_accepts_github_line_wrapped_base64() -> None: @@ -20,3 +39,28 @@ def test_decode_workflow_accepts_github_line_wrapped_base64() -> None: payload = {"type": "file", "encoding": "base64", "content": wrapped} assert p._decode_workflow(payload) == text + + +def test_product_manifest_has_unadopted_workflow_blob_coordinate() -> None: + """Initial owner source must reserve, but never guess, the protected Product blob identity.""" + + manifest = json.loads(MANIFEST.read_text(encoding="utf-8")) + assert "product_workflow_blob_sha" in manifest + assert manifest["product_workflow_blob_sha"] is None + + +def test_base_product_workflow_requires_exact_reviewed_blob_coordinate(monkeypatch) -> None: + """Marker-compatible workflow drift must fail before owner-plane mutation.""" + + text = ( + "name: Product\n" + "'Product acceptance'\n" + "'Product metadata-only'\n" + "cancel-in-progress: false\n" + ) + payload = workflow_payload(text, blob_sha="a" * 40) + monkeypatch.setattr(p, "_gh_api", lambda *args, **kwargs: payload) + + p._assert_base_product_workflow("b" * 40, expected_blob_sha="a" * 40) + with pytest.raises(RulesetGovernanceError, match="blob"): + p._assert_base_product_workflow("b" * 40, expected_blob_sha="c" * 40) From fe3f45247c62ccbe1bddc93858af44e59375318a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 18:50:22 +0900 Subject: [PATCH 34/45] fix(governance): bind Product workflow blob identity --- .../reconcile_conceptweave_product_ruleset.py | 25 +++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/scripts/ci/reconcile_conceptweave_product_ruleset.py b/scripts/ci/reconcile_conceptweave_product_ruleset.py index 1a5fb51014..4aba20d18d 100644 --- a/scripts/ci/reconcile_conceptweave_product_ruleset.py +++ b/scripts/ci/reconcile_conceptweave_product_ruleset.py @@ -59,7 +59,8 @@ def load_product_manifest(path: Path) -> dict[str, Any]: "required_check", "forbidden_check", } - if set(root) != expected_keys: + blob_keys = expected_keys | {"product_workflow_blob_sha"} + if set(root) != expected_keys and set(root) != blob_keys: raise RulesetGovernanceError("Product manifest has an unexpected key set") expected = { "schema_version": 1, @@ -77,6 +78,15 @@ def load_product_manifest(path: Path) -> dict[str, Any]: ruleset_id = root["ruleset_id"] if ruleset_id is not None and (type(ruleset_id) is not int or ruleset_id <= 0): raise RulesetGovernanceError("Product manifest ruleset_id must be null or positive") + if "product_workflow_blob_sha" in root: + workflow_blob_sha = root["product_workflow_blob_sha"] + if workflow_blob_sha is not None and ( + type(workflow_blob_sha) is not str + or not GIT_SHA_RE.fullmatch(workflow_blob_sha.lower()) + ): + raise RulesetGovernanceError( + "Product manifest product_workflow_blob_sha must be null or a Git SHA" + ) return root @@ -329,13 +339,24 @@ def _decode_workflow(payload: dict[str, Any]) -> str: raise RulesetGovernanceError("Product workflow content is invalid UTF-8 base64") from exc -def _assert_base_product_workflow(base_sha: str) -> None: +def _assert_base_product_workflow( + base_sha: str, + *, + expected_blob_sha: str | None = None, +) -> None: """Require protected main to contain the reviewed non-cancellable Product workflow.""" payload = _gh_api( "GET", f"repos/{TARGET_FULL_NAME}/contents/{PRODUCT_WORKFLOW_PATH}?ref={base_sha}", ) + if expected_blob_sha is not None: + normalized_expected = expected_blob_sha.lower() + actual_blob_sha = str(payload.get("sha") or "").lower() + if not GIT_SHA_RE.fullmatch(normalized_expected) or actual_blob_sha != normalized_expected: + raise RulesetGovernanceError( + "protected-base Product workflow blob does not match reviewed coordinate" + ) text = _decode_workflow(payload) for fragment in ( "name: Product", From d42ba5a341d2b3bf378259fbfdd4a78affe6eb2a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 18:52:03 +0900 Subject: [PATCH 35/45] fix(governance): reserve Product workflow blob coordinate --- config/conceptweave-product-ruleset.json | 1 + 1 file changed, 1 insertion(+) diff --git a/config/conceptweave-product-ruleset.json b/config/conceptweave-product-ruleset.json index 34c12c565c..2cbb25cee4 100644 --- a/config/conceptweave-product-ruleset.json +++ b/config/conceptweave-product-ruleset.json @@ -4,6 +4,7 @@ "target_branch": "main", "ruleset_name": "ConceptWeave Product acceptance", "ruleset_id": null, + "product_workflow_blob_sha": null, "required_check": "Product acceptance", "forbidden_check": "Product metadata-only" } From 7a627f3e9c564bcf7ce2f826b57c1b6ef8d1ebae Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 18:52:43 +0900 Subject: [PATCH 36/45] test(governance): cover Product blob manifest validation --- ...eptweave_product_ruleset_contents_encoding.py | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/tests/test_conceptweave_product_ruleset_contents_encoding.py b/tests/test_conceptweave_product_ruleset_contents_encoding.py index d7bfa4ff2e..8482bf1520 100644 --- a/tests/test_conceptweave_product_ruleset_contents_encoding.py +++ b/tests/test_conceptweave_product_ruleset_contents_encoding.py @@ -49,6 +49,20 @@ def test_product_manifest_has_unadopted_workflow_blob_coordinate() -> None: assert manifest["product_workflow_blob_sha"] is None +def test_product_manifest_validates_optional_workflow_blob_coordinate(tmp_path: Path) -> None: + """Reviewed manifests may reserve null or pin one exact Git blob SHA, never malformed data.""" + + loaded = p.load_product_manifest(MANIFEST) + assert loaded["product_workflow_blob_sha"] is None + + bad = dict(loaded) + bad["product_workflow_blob_sha"] = "not-a-git-sha" + path = tmp_path / "bad-product-manifest.json" + path.write_text(json.dumps(bad), encoding="utf-8") + with pytest.raises(RulesetGovernanceError, match="blob_sha"): + p.load_product_manifest(path) + + def test_base_product_workflow_requires_exact_reviewed_blob_coordinate(monkeypatch) -> None: """Marker-compatible workflow drift must fail before owner-plane mutation.""" @@ -64,3 +78,5 @@ def test_base_product_workflow_requires_exact_reviewed_blob_coordinate(monkeypat p._assert_base_product_workflow("b" * 40, expected_blob_sha="a" * 40) with pytest.raises(RulesetGovernanceError, match="blob"): p._assert_base_product_workflow("b" * 40, expected_blob_sha="c" * 40) + with pytest.raises(RulesetGovernanceError, match="blob"): + p._assert_base_product_workflow("b" * 40, expected_blob_sha="bad") From e1d525557cc7e5edfd66ea3f8e3d22cf0a425ab8 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 21:51:25 +0900 Subject: [PATCH 37/45] test(governance): require reviewed Product blob before bootstrap --- ...eptweave_product_ruleset_bootstrap_race.py | 93 ++++++++++++++++++- 1 file changed, 90 insertions(+), 3 deletions(-) diff --git a/tests/test_conceptweave_product_ruleset_bootstrap_race.py b/tests/test_conceptweave_product_ruleset_bootstrap_race.py index 111c0ddc67..7811f19d8a 100644 --- a/tests/test_conceptweave_product_ruleset_bootstrap_race.py +++ b/tests/test_conceptweave_product_ruleset_bootstrap_race.py @@ -1,12 +1,14 @@ from __future__ import annotations +import base64 + import pytest from scripts.ci import reconcile_conceptweave_product_ruleset as p from scripts.ci.reconcile_ruleset_governance import RulesetGovernanceError -def _manifest() -> dict[str, object]: +def _manifest(blob_sha: object = "f" * 40) -> dict[str, object]: return { "schema_version": 1, "target_repository": p.TARGET_FULL_NAME, @@ -15,9 +17,44 @@ def _manifest() -> dict[str, object]: "ruleset_id": None, "required_check": p.PRODUCT_CHECK, "forbidden_check": p.METADATA_ONLY_CHECK, + "product_workflow_blob_sha": blob_sha, } +def _workflow_payload(blob_sha: str) -> dict[str, object]: + text = ( + "name: Product\n" + "x: 'Product acceptance'\n" + "y: 'Product metadata-only'\n" + "concurrency:\n" + " cancel-in-progress: false\n" + ) + return { + "type": "file", + "encoding": "base64", + "content": base64.b64encode(text.encode()).decode(), + "sha": blob_sha, + } + + +def _prepare_bootstrap(monkeypatch: pytest.MonkeyPatch, *, target_main: str) -> list[bool]: + created = [False] + monkeypatch.setattr(p, "_assert_current_main", lambda _sha: None) + monkeypatch.setattr(p, "_named_ruleset", lambda: None) + monkeypatch.setattr(p, "_target_main_sha", lambda: target_main) + monkeypatch.setattr(p, "_assert_target_main", lambda _sha: None) + monkeypatch.setattr(p, "_assert_shape", lambda *_args, **_kwargs: None) + monkeypatch.setattr(p, "_latest_history_version", lambda _target: 1) + monkeypatch.setattr(p, "_history_version_state", lambda _target, _version: {"id": 91}) + + def create_evaluate_ruleset() -> dict[str, int]: + created[0] = True + return {"id": 91} + + monkeypatch.setattr(p, "_create_evaluate_ruleset", create_evaluate_ruleset) + return created + + def test_bootstrap_rechecks_protected_main_immediately_before_create(monkeypatch): expected = "a" * 40 target_main = "b" * 40 @@ -37,8 +74,12 @@ def create_evaluate_ruleset(): monkeypatch.setattr(p, "_assert_current_main", assert_current_main) monkeypatch.setattr(p, "_named_ruleset", lambda: None) monkeypatch.setattr(p, "_target_main_sha", lambda: target_main) - monkeypatch.setattr(p, "_assert_base_product_workflow", lambda sha: None) - monkeypatch.setattr(p, "_assert_target_main", lambda sha: None) + monkeypatch.setattr( + p, + "_assert_base_product_workflow", + lambda _sha, **_kwargs: None, + ) + monkeypatch.setattr(p, "_assert_target_main", lambda _sha: None) monkeypatch.setattr(p, "_create_evaluate_ruleset", create_evaluate_ruleset) with pytest.raises(RulesetGovernanceError, match="advanced"): @@ -46,3 +87,49 @@ def create_evaluate_ruleset(): assert current_main_checks == [expected, expected] assert created is False + + +def test_bootstrap_rejects_null_product_blob_before_create( + monkeypatch: pytest.MonkeyPatch, +) -> None: + """A staged null coordinate must never authorize evaluate-policy creation.""" + + target_main = "b" * 40 + created = _prepare_bootstrap(monkeypatch, target_main=target_main) + monkeypatch.setattr( + p, + "_assert_base_product_workflow", + lambda _sha, **_kwargs: None, + ) + + with pytest.raises(RulesetGovernanceError, match="blob"): + p.bootstrap_product_ruleset( + _manifest(None), + expected_main_sha="a" * 40, + ) + + assert created == [False] + + +def test_bootstrap_rejects_marker_compatible_product_blob_drift_before_create( + monkeypatch: pytest.MonkeyPatch, +) -> None: + """Markers are insufficient when protected Product bytes differ from review.""" + + target_main = "b" * 40 + reviewed_blob = "c" * 40 + live_blob = "d" * 40 + created = _prepare_bootstrap(monkeypatch, target_main=target_main) + monkeypatch.setattr( + p, + "_gh_api", + lambda *_args, **_kwargs: _workflow_payload(live_blob), + ) + + with pytest.raises(RulesetGovernanceError, match="blob"): + p.bootstrap_product_ruleset( + _manifest(reviewed_blob), + expected_main_sha="a" * 40, + ) + + assert created == [False] From fdbe09abb9079638098de92f5a40575d0696b675 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 23 Sep 2026 21:52:01 +0900 Subject: [PATCH 38/45] test(governance): bind Product blob through activation --- ...ptweave_product_ruleset_activation_race.py | 155 +++++++++++++++++- 1 file changed, 152 insertions(+), 3 deletions(-) diff --git a/tests/test_conceptweave_product_ruleset_activation_race.py b/tests/test_conceptweave_product_ruleset_activation_race.py index 9be88c9818..6865bd5fdf 100644 --- a/tests/test_conceptweave_product_ruleset_activation_race.py +++ b/tests/test_conceptweave_product_ruleset_activation_race.py @@ -1,5 +1,6 @@ from __future__ import annotations +import base64 from datetime import datetime, timezone import pytest @@ -8,7 +9,7 @@ from scripts.ci.reconcile_ruleset_governance import RulesetGovernanceError -def _manifest(ruleset_id: int) -> dict[str, object]: +def _manifest(ruleset_id: int, blob_sha: object = "f" * 40) -> dict[str, object]: return { "schema_version": 1, "target_repository": p.TARGET_FULL_NAME, @@ -17,15 +18,74 @@ def _manifest(ruleset_id: int) -> dict[str, object]: "ruleset_id": ruleset_id, "required_check": p.PRODUCT_CHECK, "forbidden_check": p.METADATA_ONLY_CHECK, + "product_workflow_blob_sha": blob_sha, } -def _live(ruleset_id: int) -> dict[str, object]: +def _live(ruleset_id: int, *, enforcement: str = "evaluate") -> dict[str, object]: return { "id": ruleset_id, "source_type": "Organization", "source": p.ORGANIZATION, - **p._desired(enforcement="evaluate"), + **p._desired(enforcement=enforcement), + } + + +def _prepare_activation( + monkeypatch: pytest.MonkeyPatch, + *, + ruleset_id: int, +) -> tuple[list[bool], list[bool]]: + canary_called = [False] + put_called = [False] + state = {"enforcement": "evaluate"} + + monkeypatch.setattr(p, "_assert_current_main", lambda _sha: None) + monkeypatch.setattr(p, "_assert_target_main", lambda _sha: None) + monkeypatch.setattr(p, "_named_ruleset", lambda: {"id": ruleset_id}) + monkeypatch.setattr( + p, + "_live", + lambda _target: _live(ruleset_id, enforcement=state["enforcement"]), + ) + monkeypatch.setattr( + p, + "_latest_base_retarget", + lambda _pr: datetime(2026, 9, 23, 0, 0, tzinfo=timezone.utc), + ) + + def canary_evidence(**_kwargs: object) -> tuple[str, str]: + canary_called[0] = True + return "a" * 40, "b" * 40 + + monkeypatch.setattr(p, "_canary_evidence", canary_evidence) + monkeypatch.setattr(p, "_assert_evaluate_rule_suite", lambda **_kwargs: None) + monkeypatch.setattr(p, "_latest_history_version", lambda _target: 4) + monkeypatch.setattr(p, "_verify_ruleset_history_transition", lambda *_args, **_kwargs: None) + + def api(method: str, _endpoint: str, **_kwargs: object) -> dict[str, object]: + if method == "PUT": + put_called[0] = True + state["enforcement"] = "active" + return {} + + monkeypatch.setattr(p, "_gh_api", api) + return canary_called, put_called + + +def _workflow_payload(blob_sha: str) -> dict[str, object]: + text = ( + "name: Product\n" + "x: 'Product acceptance'\n" + "y: 'Product metadata-only'\n" + "concurrency:\n" + " cancel-in-progress: false\n" + ) + return { + "type": "file", + "encoding": "base64", + "content": base64.b64encode(text.encode()).decode(), + "sha": blob_sha, } @@ -85,6 +145,95 @@ def api(method: str, _endpoint: str, **_kwargs: object) -> dict[str, object]: assert put_called is False +def test_activation_rejects_null_product_blob_before_canary_or_put( + monkeypatch: pytest.MonkeyPatch, +) -> None: + """Activation cannot consume canary evidence until Product source is pinned.""" + + canary_called, put_called = _prepare_activation(monkeypatch, ruleset_id=31) + + with pytest.raises(RulesetGovernanceError, match="blob"): + p.activate_product_ruleset( + _manifest(31, None), + expected_main_sha="d" * 40, + canary_pr=5, + canary_run_id=77, + ) + + assert canary_called == [False] + assert put_called == [False] + + +def test_canary_admission_rejects_marker_compatible_product_blob_drift( + monkeypatch: pytest.MonkeyPatch, +) -> None: + """The exact reviewed Product blob is part of canary admission, not just markers.""" + + reviewed_blob = "c" * 40 + live_blob = "d" * 40 + base_sha = "a" * 40 + head_sha = "b" * 40 + + def api(method: str, endpoint: str, **_kwargs: object) -> dict[str, object]: + if endpoint.endswith("pulls/5"): + return { + "state": "open", + "draft": False, + "head": {"sha": head_sha}, + "base": {"ref": "main", "sha": base_sha}, + } + if f"contents/{p.PRODUCT_WORKFLOW_PATH}" in endpoint: + return _workflow_payload(live_blob) + raise AssertionError((method, endpoint)) + + monkeypatch.setattr(p, "_gh_api", api) + monkeypatch.setattr(p, "_assert_target_main", lambda _sha: None) + monkeypatch.setattr( + p, + "_latest_base_retarget", + lambda _pr: datetime(2026, 9, 23, 0, 0, tzinfo=timezone.utc), + ) + + with pytest.raises(RulesetGovernanceError, match="blob"): + p._canary_evidence( + pr_number=5, + run_id=77, + expected_blob_sha=reviewed_blob, + ) + + +def test_activation_revalidates_product_blob_immediately_before_put( + monkeypatch: pytest.MonkeyPatch, +) -> None: + """A Product source drift after canary evidence must abort before active PUT.""" + + reviewed_blob = "c" * 40 + _canary_called, put_called = _prepare_activation(monkeypatch, ruleset_id=32) + blob_checks: list[tuple[str, object]] = [] + + def assert_product_blob( + base_sha: str, + *, + expected_blob_sha: str | None = None, + ) -> None: + blob_checks.append((base_sha, expected_blob_sha)) + if expected_blob_sha == reviewed_blob: + raise RulesetGovernanceError("protected-base Product workflow blob drifted") + + monkeypatch.setattr(p, "_assert_base_product_workflow", assert_product_blob) + + with pytest.raises(RulesetGovernanceError, match="blob"): + p.activate_product_ruleset( + _manifest(32, reviewed_blob), + expected_main_sha="d" * 40, + canary_pr=5, + canary_run_id=77, + ) + + assert blob_checks + assert put_called == [False] + + def test_retarget_provenance_rejects_later_commit_without_created_at( monkeypatch: pytest.MonkeyPatch, ) -> None: From 8128ec228ee89b5b39dd66b43faf2fe5129c1f22 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 24 Sep 2026 01:47:59 +0900 Subject: [PATCH 39/45] test(governance): align mutation fixtures with Product blob --- tests/test_conceptweave_product_ruleset_reconciliation.py | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/tests/test_conceptweave_product_ruleset_reconciliation.py b/tests/test_conceptweave_product_ruleset_reconciliation.py index 47739535ed..d917831aea 100644 --- a/tests/test_conceptweave_product_ruleset_reconciliation.py +++ b/tests/test_conceptweave_product_ruleset_reconciliation.py @@ -16,7 +16,7 @@ ) -def manifest(ruleset_id=None): +def manifest(ruleset_id=None, blob_sha="f" * 40): return { "schema_version": 1, "target_repository": p.TARGET_FULL_NAME, @@ -25,6 +25,7 @@ def manifest(ruleset_id=None): "ruleset_id": ruleset_id, "required_check": p.PRODUCT_CHECK, "forbidden_check": p.METADATA_ONLY_CHECK, + "product_workflow_blob_sha": blob_sha, } @@ -221,7 +222,7 @@ def test_bootstrap_create(monkeypatch): monkeypatch.setattr(p, "_assert_current_main", lambda sha: seen.append(sha)) monkeypatch.setattr(p, "_named_ruleset", lambda: None) monkeypatch.setattr(p, "_target_main_sha", lambda: "b" * 40) - monkeypatch.setattr(p, "_assert_base_product_workflow", lambda sha: None) + monkeypatch.setattr(p, "_assert_base_product_workflow", lambda sha, **kwargs: None) monkeypatch.setattr(p, "_assert_target_main", lambda sha: target_seen.append(sha)) monkeypatch.setattr(p, "_create_evaluate_ruleset", lambda: live_payload(22)) monkeypatch.setattr(p, "_assert_shape", lambda *a, **k: None) @@ -318,7 +319,7 @@ def api(method, endpoint, **kwargs): def setup_canary(monkeypatch, **kwargs): monkeypatch.setattr(p, "_gh_api", canary_api(**kwargs)) monkeypatch.setattr(p, "_assert_target_main", lambda sha: None) - monkeypatch.setattr(p, "_assert_base_product_workflow", lambda sha: None) + monkeypatch.setattr(p, "_assert_base_product_workflow", lambda sha, **kwargs: None) monkeypatch.setattr( p, "_latest_base_retarget", @@ -402,6 +403,7 @@ def setup_activate(monkeypatch, *, ruleset_id=30, active=False): before = live_payload(ruleset_id, enforcement="active" if active else "evaluate") monkeypatch.setattr(p, "_assert_current_main", lambda sha: None) monkeypatch.setattr(p, "_assert_target_main", lambda sha: None) + monkeypatch.setattr(p, "_assert_base_product_workflow", lambda sha, **kwargs: None) monkeypatch.setattr(p, "_named_ruleset", lambda: {"id": ruleset_id}) monkeypatch.setattr(p, "_live", lambda target: before) monkeypatch.setattr(p, "_assert_shape", lambda *a, **k: None) From a1628e75dc056098f4ea2d03ec799f2026025e84 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 24 Sep 2026 01:49:23 +0900 Subject: [PATCH 40/45] fix(governance): enforce reviewed Product blob at mutations --- .../reconcile_conceptweave_product_ruleset.py | 44 +++++++++++++++++-- 1 file changed, 41 insertions(+), 3 deletions(-) diff --git a/scripts/ci/reconcile_conceptweave_product_ruleset.py b/scripts/ci/reconcile_conceptweave_product_ruleset.py index 4aba20d18d..675a2007c6 100644 --- a/scripts/ci/reconcile_conceptweave_product_ruleset.py +++ b/scripts/ci/reconcile_conceptweave_product_ruleset.py @@ -90,6 +90,22 @@ def load_product_manifest(path: Path) -> dict[str, Any]: return root +def _reviewed_product_workflow_blob(manifest: dict[str, Any]) -> str: + """Return the immutable reviewed Product workflow coordinate required for mutation.""" + + workflow_blob_sha = manifest.get("product_workflow_blob_sha") + if type(workflow_blob_sha) is not str: + raise RulesetGovernanceError( + "Product mutation requires reviewed Product workflow blob coordinate" + ) + normalized = workflow_blob_sha.lower() + if not GIT_SHA_RE.fullmatch(normalized): + raise RulesetGovernanceError( + "Product mutation requires reviewed Product workflow blob coordinate" + ) + return normalized + + def _target(ruleset_id: int) -> RulesetTarget: """Build the exact organization-owned Product ruleset identity.""" @@ -308,10 +324,18 @@ def bootstrap_product_ruleset( raise RulesetGovernanceError( f"Product ruleset exists as id={named.get('id')}; pin it before mutation" ) + reviewed_blob_sha = _reviewed_product_workflow_blob(manifest) target_main_sha = _target_main_sha() - _assert_base_product_workflow(target_main_sha) + _assert_base_product_workflow( + target_main_sha, + expected_blob_sha=reviewed_blob_sha, + ) _assert_current_main(expected_main_sha) _assert_target_main(target_main_sha) + _assert_base_product_workflow( + target_main_sha, + expected_blob_sha=reviewed_blob_sha, + ) created = _create_evaluate_ruleset() ruleset_id = created.get("id") target = _target(ruleset_id) @@ -408,7 +432,12 @@ def _latest_base_retarget(pr_number: int) -> datetime: return latest -def _canary_evidence(*, pr_number: int, run_id: int) -> tuple[str, str]: +def _canary_evidence( + *, + pr_number: int, + run_id: int, + expected_blob_sha: str | None = None, +) -> tuple[str, str]: """Prove exact current-base Product success after a source-neutral base retarget.""" if pr_number <= 0 or run_id <= 0: @@ -425,7 +454,10 @@ def _canary_evidence(*, pr_number: int, run_id: int) -> tuple[str, str]: if base.get("ref") != TARGET_BRANCH: raise RulesetGovernanceError("Product canary does not target protected main") _assert_target_main(base_sha) - _assert_base_product_workflow(base_sha) + _assert_base_product_workflow( + base_sha, + expected_blob_sha=expected_blob_sha, + ) retargeted_at = _latest_base_retarget(pr_number) run = _gh_api("GET", f"repos/{TARGET_FULL_NAME}/actions/runs/{run_id}") @@ -555,11 +587,13 @@ def activate_product_ruleset( if first.get("enforcement") == "active": raise RulesetGovernanceError("Product ruleset is already active; use verify") _assert_shape(first, target, enforcement="evaluate") + reviewed_blob_sha = _reviewed_product_workflow_blob(manifest) retargeted_at = _latest_base_retarget(canary_pr) base_sha, head_sha = _canary_evidence( pr_number=canary_pr, run_id=canary_run_id, + expected_blob_sha=reviewed_blob_sha, ) _assert_evaluate_rule_suite( ruleset_id=pinned_id, @@ -579,6 +613,10 @@ def activate_product_ruleset( _assert_shape(second, target, enforcement="evaluate") _assert_current_main(expected_main_sha) _assert_target_main(base_sha) + _assert_base_product_workflow( + base_sha, + expected_blob_sha=reviewed_blob_sha, + ) history_verified = False try: From a1af52d7bf2fcb5dfd27790961faf62651b16510 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 24 Sep 2026 05:45:19 +0900 Subject: [PATCH 41/45] test(governance): cover Product blob mutation validation --- ...eptweave_product_ruleset_bootstrap_race.py | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/tests/test_conceptweave_product_ruleset_bootstrap_race.py b/tests/test_conceptweave_product_ruleset_bootstrap_race.py index 7811f19d8a..82ae04e5a4 100644 --- a/tests/test_conceptweave_product_ruleset_bootstrap_race.py +++ b/tests/test_conceptweave_product_ruleset_bootstrap_race.py @@ -1,6 +1,7 @@ from __future__ import annotations import base64 +import json import pytest @@ -133,3 +134,21 @@ def test_bootstrap_rejects_marker_compatible_product_blob_drift_before_create( ) assert created == [False] + + +def test_load_manifest_accepts_staged_legacy_shape_without_blob(tmp_path) -> None: + """The staged loader still accepts the pre-coordinate reviewed manifest shape.""" + + legacy = _manifest() + legacy.pop("product_workflow_blob_sha") + path = tmp_path / "manifest.json" + path.write_text(json.dumps(legacy), encoding="utf-8") + + assert p.load_product_manifest(path) == legacy + + +def test_reviewed_product_blob_rejects_malformed_string_coordinate() -> None: + """Mutation validation rejects a string that is not an immutable Git blob SHA.""" + + with pytest.raises(RulesetGovernanceError, match="blob"): + p._reviewed_product_workflow_blob(_manifest("not-a-git-sha")) From 1a6ddce2d02df50dddeb81450ff05cb9778c94a9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 24 Sep 2026 10:46:21 +0900 Subject: [PATCH 42/45] test(governance): prove post-blob protected ref drift --- ...ptweave_product_ruleset_activation_race.py | 50 ++++++++++++++++ ...eptweave_product_ruleset_bootstrap_race.py | 59 +++++++++++++++++++ 2 files changed, 109 insertions(+) diff --git a/tests/test_conceptweave_product_ruleset_activation_race.py b/tests/test_conceptweave_product_ruleset_activation_race.py index 6865bd5fdf..21777a0818 100644 --- a/tests/test_conceptweave_product_ruleset_activation_race.py +++ b/tests/test_conceptweave_product_ruleset_activation_race.py @@ -256,3 +256,53 @@ def test_retarget_provenance_rejects_later_commit_without_created_at( with pytest.raises(RulesetGovernanceError, match="source commit"): p._latest_base_retarget(5) + + +@pytest.mark.parametrize("drifted_ref", ["owner", "target"]) +def test_activation_rechecks_both_protected_refs_after_final_blob_read( + monkeypatch: pytest.MonkeyPatch, + drifted_ref: str, +) -> None: + """A ref that advances during final blob validation must block active PUT.""" + + ruleset_id = 33 + expected_main = "d" * 40 + base_sha = "a" * 40 + reviewed_blob = "c" * 40 + _canary_called, put_called = _prepare_activation(monkeypatch, ruleset_id=ruleset_id) + state = {"owner": expected_main, "target": base_sha} + blob_checks = 0 + + def assert_current_main(expected: str) -> None: + if state["owner"] != expected: + raise RulesetGovernanceError(".github protected main advanced") + + def assert_target_main(expected: str) -> None: + if state["target"] != expected: + raise RulesetGovernanceError("ConceptWeave protected main advanced") + + def assert_product_blob( + checked_base_sha: str, + *, + expected_blob_sha: str | None = None, + ) -> None: + nonlocal blob_checks + assert checked_base_sha == base_sha + assert expected_blob_sha == reviewed_blob + blob_checks += 1 + state[drifted_ref] = "e" * 40 + + monkeypatch.setattr(p, "_assert_current_main", assert_current_main) + monkeypatch.setattr(p, "_assert_target_main", assert_target_main) + monkeypatch.setattr(p, "_assert_base_product_workflow", assert_product_blob) + + with pytest.raises(RulesetGovernanceError, match="advanced"): + p.activate_product_ruleset( + _manifest(ruleset_id, reviewed_blob), + expected_main_sha=expected_main, + canary_pr=5, + canary_run_id=77, + ) + + assert blob_checks == 1 + assert put_called == [False] diff --git a/tests/test_conceptweave_product_ruleset_bootstrap_race.py b/tests/test_conceptweave_product_ruleset_bootstrap_race.py index 82ae04e5a4..0e40b1f5b7 100644 --- a/tests/test_conceptweave_product_ruleset_bootstrap_race.py +++ b/tests/test_conceptweave_product_ruleset_bootstrap_race.py @@ -152,3 +152,62 @@ def test_reviewed_product_blob_rejects_malformed_string_coordinate() -> None: with pytest.raises(RulesetGovernanceError, match="blob"): p._reviewed_product_workflow_blob(_manifest("not-a-git-sha")) + + +@pytest.mark.parametrize("drifted_ref", ["owner", "target"]) +def test_bootstrap_rechecks_both_protected_refs_after_final_blob_read( + monkeypatch: pytest.MonkeyPatch, + drifted_ref: str, +) -> None: + """A ref that advances during final blob validation must block evaluate POST.""" + + expected_main = "a" * 40 + target_main = "b" * 40 + reviewed_blob = "c" * 40 + state = {"owner": expected_main, "target": target_main} + blob_checks = 0 + created = False + + def assert_current_main(expected: str) -> None: + if state["owner"] != expected: + raise RulesetGovernanceError(".github protected main advanced") + + def assert_target_main(expected: str) -> None: + if state["target"] != expected: + raise RulesetGovernanceError("ConceptWeave protected main advanced") + + def assert_product_blob( + base_sha: str, + *, + expected_blob_sha: str | None = None, + ) -> None: + nonlocal blob_checks + assert base_sha == target_main + assert expected_blob_sha == reviewed_blob + blob_checks += 1 + if blob_checks == 2: + state[drifted_ref] = "e" * 40 + + def create_evaluate_ruleset() -> dict[str, int]: + nonlocal created + created = True + return {"id": 91} + + monkeypatch.setattr(p, "_assert_current_main", assert_current_main) + monkeypatch.setattr(p, "_named_ruleset", lambda: None) + monkeypatch.setattr(p, "_target_main_sha", lambda: target_main) + monkeypatch.setattr(p, "_assert_target_main", assert_target_main) + monkeypatch.setattr(p, "_assert_base_product_workflow", assert_product_blob) + monkeypatch.setattr(p, "_create_evaluate_ruleset", create_evaluate_ruleset) + monkeypatch.setattr(p, "_assert_shape", lambda *_args, **_kwargs: None) + monkeypatch.setattr(p, "_latest_history_version", lambda _target: 1) + monkeypatch.setattr(p, "_history_version_state", lambda _target, _version: {"id": 91}) + + with pytest.raises(RulesetGovernanceError, match="advanced"): + p.bootstrap_product_ruleset( + _manifest(reviewed_blob), + expected_main_sha=expected_main, + ) + + assert blob_checks == 2 + assert created is False From 97acdfeef0830d56c7b9b78226fec53de791ee8f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 24 Sep 2026 14:48:27 +0900 Subject: [PATCH 43/45] fix(governance): close post-blob protected-ref race --- scripts/ci/reconcile_conceptweave_product_ruleset.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/scripts/ci/reconcile_conceptweave_product_ruleset.py b/scripts/ci/reconcile_conceptweave_product_ruleset.py index 675a2007c6..b2ea768f5b 100644 --- a/scripts/ci/reconcile_conceptweave_product_ruleset.py +++ b/scripts/ci/reconcile_conceptweave_product_ruleset.py @@ -336,6 +336,8 @@ def bootstrap_product_ruleset( target_main_sha, expected_blob_sha=reviewed_blob_sha, ) + _assert_current_main(expected_main_sha) + _assert_target_main(target_main_sha) created = _create_evaluate_ruleset() ruleset_id = created.get("id") target = _target(ruleset_id) @@ -617,6 +619,8 @@ def activate_product_ruleset( base_sha, expected_blob_sha=reviewed_blob_sha, ) + _assert_current_main(expected_main_sha) + _assert_target_main(base_sha) history_verified = False try: From 04414c5e30ba6aed2bf3d82268b356c6d6b1ad84 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 24 Sep 2026 18:48:12 +0900 Subject: [PATCH 44/45] test(governance): align bootstrap ref revalidation expectations --- tests/test_conceptweave_product_ruleset_reconciliation.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/test_conceptweave_product_ruleset_reconciliation.py b/tests/test_conceptweave_product_ruleset_reconciliation.py index d917831aea..8c266bedff 100644 --- a/tests/test_conceptweave_product_ruleset_reconciliation.py +++ b/tests/test_conceptweave_product_ruleset_reconciliation.py @@ -229,8 +229,8 @@ def test_bootstrap_create(monkeypatch): monkeypatch.setattr(p, "_latest_history_version", lambda target: 3) monkeypatch.setattr(p, "_history_version_state", lambda target, version: live_payload(22)) assert p.bootstrap_product_ruleset(manifest(), expected_main_sha="a" * 40) == 22 - assert seen == ["a" * 40, "a" * 40, "a" * 40] - assert target_seen == ["b" * 40, "b" * 40] + assert seen == ["a" * 40, "a" * 40, "a" * 40, "a" * 40] + assert target_seen == ["b" * 40, "b" * 40, "b" * 40] def test_decode_and_base_workflow(monkeypatch): From 1e8da05d5b0851da212b3e340e7085fb1de550ce Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Thu, 24 Sep 2026 23:04:09 +0900 Subject: [PATCH 45/45] test(governance): prove supported ConceptWeave canary event --- ...eptweave_product_ruleset_reconciliation.py | 32 +++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/tests/test_conceptweave_product_ruleset_reconciliation.py b/tests/test_conceptweave_product_ruleset_reconciliation.py index 8c266bedff..3c9b42a56e 100644 --- a/tests/test_conceptweave_product_ruleset_reconciliation.py +++ b/tests/test_conceptweave_product_ruleset_reconciliation.py @@ -305,9 +305,17 @@ def api(method, endpoint, **kwargs): return { "state": overrides.get("pr_state", "open"), "draft": overrides.get("draft", False), + "created_at": overrides.get("pr_created_at", "2026-09-22T23:00:00Z"), "head": {"sha": head_sha}, "base": {"ref": overrides.get("base_ref", "main"), "sha": base_sha}, } + if endpoint.endswith(f"commits/{head_sha}"): + return { + "sha": head_sha, + "files": [{"filename": "src/lib.rs"}], + "stats": {"total": 1}, + "commit": {"committer": {"date": "2026-09-23T00:00:30Z"}}, + } if endpoint.endswith(f"actions/runs/{run_id}"): return run if f"actions/runs/{run_id}/jobs" in endpoint: @@ -317,7 +325,16 @@ def api(method, endpoint, **kwargs): def setup_canary(monkeypatch, **kwargs): + head_sha = kwargs.get("head_sha", "b" * 40) monkeypatch.setattr(p, "_gh_api", canary_api(**kwargs)) + monkeypatch.setattr( + p, + "_gh_api_list", + lambda *a: [ + {"event": "committed", "sha": head_sha}, + {"event": "commented"}, + ], + ) monkeypatch.setattr(p, "_assert_target_main", lambda sha: None) monkeypatch.setattr(p, "_assert_base_product_workflow", lambda sha, **kwargs: None) monkeypatch.setattr( @@ -327,6 +344,21 @@ def setup_canary(monkeypatch, **kwargs): ) +def test_canary_supported_synchronize_accepts_open_draft(monkeypatch): + setup_canary(monkeypatch, draft=True) + assert p._canary_evidence(pr_number=5, run_id=77) == ("a" * 40, "b" * 40) + + +def test_canary_supported_synchronize_does_not_require_base_retarget(monkeypatch): + setup_canary(monkeypatch) + monkeypatch.setattr( + p, + "_latest_base_retarget", + lambda pr: (_ for _ in ()).throw(AssertionError("base retarget is not supported canary evidence")), + ) + assert p._canary_evidence(pr_number=5, run_id=77) == ("a" * 40, "b" * 40) + + def test_canary_success(monkeypatch): setup_canary(monkeypatch) assert p._canary_evidence(pr_number=5, run_id=77) == ("a" * 40, "b" * 40)