amadan
release: test that bind asks the healthy history about the staged bytes, not the manifest
Final review triage (Task 4): a healthy-history manifest sha256 with other bytes staged must be refused at bind. The surviving mutant IsHealthy(v.sha) now fails this test.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+23
−0
internal/release/proofgate_test.go+23 −0
diff --git a/internal/release/proofgate_test.go b/internal/release/proofgate_test.go| index 0621cdaf1..5cf68faaf 100644 |
| --- a/internal/release/proofgate_test.go |
| +++ b/internal/release/proofgate_test.go |
| @@ -271,6 +271,29 @@ func TestProofBindingRefusesStagedBytesThatDiffer(t *testing.T) { |
| } |
| } |
| +// Final review triage (Task 4): the healthy history admits the manifest's |
| +// sha256, but the staged file holds other bytes. bind must ask the history |
| +// about the staged hash, not the manifest's, so the build is refused. |
| +func TestProofHealthyManifestWithOtherStagedBytesIsRefused(t *testing.T) { |
| + e := newProofEnv(t) |
| + e.requireDev(t) |
| + if err := RecordHealthy(e.bake, "bab", "console", HealthyBuild{SHA256: e.newSHA, Version: "new", How: "settle", At: e.clock}); err != nil { |
| + t.Fatal(err) |
| + } |
| + stale := []byte("not the shipped bytes") |
| + if err := StageArtifact(e.opt, "bab", "new", "console", stale); err != nil { |
| + t.Fatal(err) |
| + } |
| + out := e.pass(t, e.store) |
| + if e.live() != "old" || !strings.Contains(out, "not pointed live") { |
| + t.Fatalf("live = %q, printed %q; want old and the binding refusal", e.live(), out) |
| + } |
| + r, _ := ReadRefusal(e.bake, proofHost) |
| + if r == nil || r.Kind != RefusalNotProven || !strings.Contains(r.Reason, etagOf(stale)) || !strings.Contains(r.Reason, e.newSHA) { |
| + t.Fatalf("refusal = %+v, want a not-proven record naming the staged and manifest hashes", r) |
| + } |
| +} |
| + |
| func TestProofMissIsCachedThirtySeconds(t *testing.T) { |
| e := newProofEnv(t) |
| e.requireDev(t) |