Proof: замкнуть single-operation replay - #511
Closed
lemone112 wants to merge 11 commits into
Closed
Conversation
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
WalkthroughPR добавляет каноническое MPFI source sealing, typed boundary errors и operation-owned source snapshots. Arb pipeline и receipt replay используют единый detached snapshot. Source replay разделяет metadata replay и materialization. Proof fast gate включает MPFI-контракты. ChangesSource replay и snapshots
MPFI sealed input
Arb operation snapshot
Receipt replay
Proof fast gate
Estimated code review effort: 5 (Critical) | ~120 minutes Sequence Diagram(s)sequenceDiagram
participant Controller
participant PipelineOperationSnapshot
participant SourceReplay
participant MPFISealing
participant ReceiptVerifier
Controller->>PipelineOperationSnapshot: создать detached operation snapshot
PipelineOperationSnapshot->>SourceReplay: replay source closure
SourceReplay-->>PipelineOperationSnapshot: owned locks, archives и materializations
PipelineOperationSnapshot->>MPFISealing: передать admitted sources и limits
MPFISealing-->>Controller: sealed input и binding identity
ReceiptVerifier->>PipelineOperationSnapshot: повторно получить snapshot-bound coordinates
ReceiptVerifier->>SourceReplay: повторно проверить source closure
SourceReplay-->>ReceiptVerifier: validated replay data
ReceiptVerifier-->>Controller: принять или отклонить evidence
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
Collaborator
Author
|
@coderabbitai review Проверьте текущую голову |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== HEAD =='
git rev-parse HEAD
git status --short
git show -s --format='%H%n%P%n%s' 93c12a7d3ff195253c23498a8913aae56f120eb5
echo '== merge base / changed files =='
base="$(git merge-base 93c12a7d3ff195253c23498a8913aae56f120eb5 origin/main 2>/dev/null || true)"
if [ -n "$base" ]; then
echo "BASE=$base"
git diff --stat "$base" 93c12a7d3ff195253c23498a8913aae56f120eb5
git diff --name-status "$base" 93c12a7d3ff195253c23498a8913aae56f120eb5
else
echo 'No origin/main merge base available; showing commit files.'
git show --stat --oneline --no-renames 93c12a7d3ff195253c23498a8913aae56f120eb5
fi
echo '== candidate files =='
fd -HI -t f . | rg -i '(mpfi|sealed.?input|ustar|archive|closure|proof)'
echo '== focused symbols =='
rg -n -i -C 3 '(SealedInputV1|MPFI|MPFR|USTAR|ustar|materializ|resource.{0,30}limit|limit.{0,30}resource|Build|Receipt)' \
-g '!node_modules' -g '!dist' -g '!build' .Length of output: 199803 🏁 Script executed: #!/bin/bash
set -euo pipefail
commit='93c12a7d3ff195253c23498a8913aae56f120eb5'
echo '== commit and files =='
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$commit"
git show --format='' --name-status --find-renames "$commit"
echo '== patch: proof files =='
git show --format='' --find-renames "$commit" -- proof/region/v1/arb | sed -n '1,2600p'
echo '== module outlines =='
for f in \
proof/region/v1/arb/build/input.py \
proof/region/v1/arb/pipeline.py \
proof/region/v1/arb/provenance.py \
proof/region/v1/arb/receipt.py \
proof/region/v1/arb/build/transport.py
do
if [ -f "$f" ]; then
echo "--- $f"
ast-grep outline "$f" --items all 2>/dev/null || true
fi
done
echo '== input.py =='
cat -n proof/region/v1/arb/build/input.py | sed -n '1,780p'
echo '== pipeline sealing and imports =='
rg -n -C 8 '(^import |^from |def _seal_build_input_bundle_v1|SealedInputV1|canonical_ustar_v1|materialize_admitted_source_files_v1|MPFI)' \
proof/region/v1/arb/pipeline.py
echo '== provenance materialization and source roles =='
rg -n -C 8 '(^import |^from |def materialize_admitted_source_files_v1|def admit|MPFI|archive|role|Source)' \
proof/region/v1/arb/provenance.py
echo '== prohibited dependency search in input/provenance =='
rg -n -i -C 3 '(import .*build|from .*build|import .*receipt|from .*receipt|import .*executor|from .*executor|import .*pipeline|from .*pipeline|run)' \
proof/region/v1/arb/build/input.py proof/region/v1/arb/provenance.pyLength of output: 12152 🏁 Script executed: #!/bin/bash
set -euo pipefail
commit='93c12a7d3ff195253c23498a8913aae56f120eb5'
echo '== complete commit patch =='
git diff --find-renames "${commit}^" "$commit" -- \
proof/region/v1/build/input.py \
proof/region/v1/mpfi/__init__.py \
proof/region/v1/mpfi/input.py \
proof/region/v1/tests/test_mpfi_input.py \
proof/region/v1/arb/tests/test_transport.py \
proof/region/v1/PROTOCOL.md
echo '== shared input module outline and source =='
ast-grep outline proof/region/v1/build/input.py --items all 2>/dev/null || true
cat -n proof/region/v1/build/input.py | sed -n '1,900p'
echo '== MPFI modules outline and source =='
for f in proof/region/v1/mpfi/__init__.py proof/region/v1/mpfi/input.py proof/region/v1/tests/test_mpfi_input.py; do
echo "--- $f"
ast-grep outline "$f" --items all 2>/dev/null || true
cat -n "$f" | sed -n '1,1200p'
done
echo '== imports and forbidden coupling =='
rg -n -C 3 '^(import|from) |(arb|pipeline|receipt|executor|transport|run|build)' \
proof/region/v1/mpfi proof/region/v1/build/input.py
echo '== use sites of MPFI sealing and shared primitives =='
rg -n -C 5 '(seal_mpfi|MPFI.*[Ii]nput|mpfi.*[Ii]nput|canonical_ustar_v1|SealedInputV1|CanonicalInputLimitsV1)' \
proof/region/v1 -g '*.py'Length of output: 176299 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== package initializers and direct imports =='
for f in \
proof/region/v1/build/__init__.py \
proof/region/v1/mpfi/__init__.py \
proof/region/v1/build/input.py \
proof/region/v1/provenance.py
do
if [ -f "$f" ]; then
echo "--- $f"
sed -n '1,180p' "$f"
fi
done
echo '== test runners and inventories =='
fd -HI -t f 'gate\.py|native_gate\.py|test_build\.py|test_.*\.py' proof/region/v1 | sort
rg -n -C 5 '(test_mpfi_input|unittest\.discover|loadTestsFrom|TEST_COUNT|inventory|skip|test_.*\.py)' \
proof/region/v1/tests proof/region/v1/arb/tests \
-g '*.py'
echo '== static import graph from shared input and MPFI input =='
python3 - <<'PY'
import ast
from pathlib import Path
root = Path("proof/region/v1")
for relative in ("build/input.py", "mpfi/input.py", "provenance.py"):
path = root / relative
tree = ast.parse(path.read_text(encoding="utf-8"), filename=str(path))
imports = []
for node in ast.walk(tree):
if isinstance(node, ast.Import):
imports.extend(alias.name for alias in node.names)
elif isinstance(node, ast.ImportFrom):
imports.append(node.module or "<relative>")
print(f"{path}: {', '.join(imports)}")
PY
echo '== MPFI test references in current commit and parent =='
git grep -n 'test_mpfi_input\|MpfiSourceInputTests' 93c12a7d3ff195253c23498a8913aae56f120eb5 -- proof/region/v1 || trueLength of output: 47787 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== workflow and documented test commands =='
fd -HI -t f .github README.md CONTRIBUTING.md Makefile justfile 2>/dev/null | sort
rg -n -i -C 4 \
'(proof/region/v1|test_mpfi_input|unittest|pytest|arb/tests/gate\.py|test_executor\.py|python3)' \
.github README.md CONTRIBUTING.md Makefile justfile proof \
-g '*.yml' -g '*.yaml' -g '*.md' -g 'Makefile' -g 'justfile' -g '*.sh' -g '*.py' \
2>/dev/null
echo '== all explicit load/discover calls for shared proof tests =='
rg -n -C 5 \
'(discover\(|loadTestsFrom|test_mpfi_input\.py|proof/region/v1/tests)' \
. -g '*.py' -g '*.sh' -g '*.yml' -g '*.yaml' -g 'Makefile' -g 'justfile' \
-g '!node_modules' -g '!target' -g '!dist' -g '!build'
echo '== gate constants and parent comparison =='
sed -n '1,170p' proof/region/v1/arb/tests/gate.py
git diff "${commit:-93c12a7d3ff195253c23498a8913aae56f120eb5}^" \
93c12a7d3ff195253c23498a8913aae56f120eb5 -- \
.github proof/region/v1/arb/tests/gate.py proof/region/v1/tests/test_build.py \
2>/dev/null || trueLength of output: 1405 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== repository root candidates =='
fd -HI -t f . | rg '(^|/)([^/]*\.(ya?ml|md|sh|py)|Makefile|justfile)$' | \
rg -i '(^|/)(\.github/|readme|contributing|makefile|justfile|.*workflow|.*ci|.*test)' | \
sort | sed -n '1,800p'
echo '== every source-level reference to the MPFI test or proof test directory =='
rg -n -i -C 5 \
'(test_mpfi_input|proof/region/v1/tests|arb/tests/gate\.py|python3.*gate\.py|unittest.*discover|unittest\.discover|loadTestsFrom)' \
. \
-g '*.py' -g '*.sh' -g '*.yml' -g '*.yaml' -g '*.md' -g 'Makefile' -g 'justfile' \
-g '!node_modules' -g '!target' -g '!dist' -g '!build'
echo '== gate composition =='
sed -n '1,170p' proof/region/v1/arb/tests/gate.py
sed -n '1,330p' proof/region/v1/tests/test_build.pyLength of output: 25844
Тесты MPFI input не входят в обязательный gate. Из-за этого регрессия в MPFI capability boundary, resource limits или exact-byte USTAR может пройти обязательный Arb gate. Добавьте Остальную целевую поверхность я проверил статически. ✅ Action performedReview finished.
|
Collaborator
Author
|
@coderabbitai review Новая точная голова |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='93c12a7d3ff195253c23498a8913aae56f120eb5'
head='7e78a70d9e8f5650214e1b23f60ca203ef288b13'
echo '== commits =='
git show -s --format='base=%H%nsubject=%s' "$base"
git show -s --format='head=%H%nparents=%P%nsubject=%s' "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'base is ancestor of head'
echo '== incremental files =='
git diff --name-status --find-renames "$base" "$head"
echo '== incremental patch =='
git diff --find-renames --unified=80 "$base" "$head" -- proof/region/v1
echo '== outlines of changed Python files =='
git diff --name-only "$base" "$head" -- 'proof/region/v1/**/*.py' 'proof/region/v1/*.py' |
while IFS= read -r file; do
[ -n "$file" ] || continue
echo "--- $file"
ast-grep outline "$file" --items all 2>/dev/null || true
done
echo '== gate, inventory, and oracle references =='
rg -n -C 8 \
'(test_mpfi_input|exact.?inventory|inventory|outer.?oracle|expectedFailure|expected_failure|skip|TestLoader|loadTestsFrom|discover\(|gate\.py)' \
proof/region/v1 -g '*.py'
echo '== static imports for modified proof modules =='
python3 - <<'PY'
import ast
import subprocess
from pathlib import Path
base = "93c12a7d3ff195253c23498a8913aae56f120eb5"
head = "7e78a70d9e8f5650214e1b23f60ca203ef288b13"
files = subprocess.check_output(
["git", "diff", "--name-only", base, head, "--", "proof/region/v1"],
text=True,
).splitlines()
for name in files:
path = Path(name)
if path.suffix != ".py" or not path.is_file():
continue
tree = ast.parse(path.read_text(encoding="utf-8"), filename=name)
imports = []
for node in ast.walk(tree):
if isinstance(node, ast.Import):
imports.extend(a.name for a in node.names)
elif isinstance(node, ast.ImportFrom):
imports.append("." * node.level + (node.module or ""))
print(f"{name}: {', '.join(imports)}")
PY
echo '== prohibited MPFI-to-Arb imports =='
rg -n -P -C 3 \
'^\s*(from|import)\s+(proof\.region\.v1\.arb|arb(?:\.|\s|$))' \
proof/region/v1/mpfi proof/region/v1/tests/test_mpfi_input.py -g '*.py' || true
echo '== relevant execution/documentation entry points changed or referencing gates =='
rg -n -C 5 \
'(arb/tests/gate\.py|test_mpfi_input|exact.?inventory|outer.?oracle)' \
.github proof README.md Makefile justfile \
-g '*.yml' -g '*.yaml' -g '*.md' -g 'Makefile' -g 'justfile' -g '*.py' \
2>/dev/null || trueLength of output: 89987
Новый exact inventory не выполняется обязательным CI gate. Следовательно, удаление, same-count replacement, Добавьте обязательную CI точку входа для Я не нашёл MPFI→Arb import coupling в этом инкременте. You are interacting with an AI system. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
old='93c12a7d3ff195253c23498a8913aae56f120eb5'
new='7e78a7006ddf3e614d4d4d5d0a5de3751e1654cf'
echo '== Commit range =='
git rev-parse "$old"
git rev-parse "$new"
git log --oneline --decorate "${old}..${new}"
echo '== Changed files =='
git diff --name-status --find-renames "$old" "$new"
echo '== Incremental patch =='
git diff --find-renames --unified=80 "$old" "$new"
echo '== Outline of changed Python files =='
git diff --name-only "$old" "$new" -- '*.py' | while IFS= read -r f; do
echo "--- $f"
ast-grep outline "$f" --items all 2>/dev/null || true
done
echo '== Focused gate and inventory references =='
rg -n -C 12 \
'(inventory|outer.oracle|oracle|anti.vacuum|expectedFailure|skip(Test|If)?|test_mpfi_input|test_executor|discover\(|loadTestsFrom|unittest)' \
proof/region/v1 \
-g '*.py'
echo '== MPFI import boundary after increment =='
for f in proof/region/v1/mpfi/__init__.py proof/region/v1/mpfi/input.py; do
if [ -f "$f" ]; then
echo "--- $f"
sed -n '1,260p' "$f"
fi
doneLength of output: 1739 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== Checked-out revision =='
git rev-parse HEAD
git status --short
echo '== Local and remote refs relevant to PR 511 =='
git branch -a --contains HEAD || true
git show-ref | rg '(^|/)(511|pull|HEAD|main)$|refs/pull/511|93c12a7d3ff195253c23498a8913aae56f120eb5|7e78a7006ddf3e614d4d4d5d0a5de3751e1654cf' || true
echo '== Fetch GitHub pull-request head into a temporary remote-tracking ref =='
git fetch --no-tags origin '+refs/pull/511/head:refs/remotes/origin/pr-511-head' || true
echo '== Candidate PR head =='
if git rev-parse --verify --quiet refs/remotes/origin/pr-511-head >/dev/null; then
git rev-parse refs/remotes/origin/pr-511-head
git show -s --format='commit=%H%nparents=%P%nsubject=%s' refs/remotes/origin/pr-511-head
git merge-base --is-ancestor 93c12a7d3ff195253c23498a8913aae56f120eb5 refs/remotes/origin/pr-511-head && echo 'old commit is an ancestor' || echo 'old commit is not an ancestor'
git diff --name-status --find-renames 93c12a7d3ff195253c23498a8913aae56f120eb5 refs/remotes/origin/pr-511-head
else
echo 'PR head ref is unavailable'
fiLength of output: 2068 🏁 Script executed: #!/bin/bash
set -euo pipefail
old='93c12a7d3ff195253c23498a8913aae56f120eb5'
new='7e78a70d9e8f5650214e1b23f60ca203ef288b13'
echo '== Complete incremental patch =='
git diff --find-renames --unified=120 "$old" "$new" -- \
proof/region/v1/tests/gate.py \
proof/region/v1/tests/test_build.py
echo '== New gate: full file =='
cat -n proof/region/v1/tests/gate.py
echo '== Modified test_build.py: full file =='
cat -n proof/region/v1/tests/test_build.py
echo '== AST maps =='
ast-grep outline proof/region/v1/tests/gate.py --items all
ast-grep outline proof/region/v1/tests/test_build.py --items all
echo '== Static imports and package context =='
for f in \
proof/region/v1/tests/__init__.py \
proof/region/v1/tests/test_mpfi_input.py \
proof/region/v1/tests/test_executor.py \
proof/region/v1/mpfi/input.py \
proof/region/v1/build/input.py
do
if [ -f "$f" ]; then
echo "--- $f"
sed -n '1,300p' "$f"
fi
done
echo '== References to the new gate and exact inventory =='
rg -n -C 8 \
'(proof/region/v1/tests/gate\.py|EXPECTED|INVENTORY|test_mpfi_input|test_executor|expectedFailure|skip(Test|If)?)' \
. \
-g '*.py' -g '*.sh' -g '*.md' -g 'Makefile' -g '*.yml' -g '*.yaml' \
-g '!node_modules' -g '!dist' -g '!build'Length of output: 144017 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== New shared gate, exact source =='
nl -ba proof/region/v1/tests/gate.py
echo '== Outer-oracle and anti-vacuum test bodies =='
sed -n '260,365p' proof/region/v1/tests/test_build.py | nl -ba -v260
echo '== All source-level invocations of shared gate or test_build =='
rg -n -C 6 \
'(proof/region/v1/tests/gate\.py|tests/gate\.py|test_build\.py|ExistingSharedProofGateTests|proof_gate\.(full_suite_v1|inventory_is_exact_v1))' \
. \
-g '*.py' -g '*.sh' -g '*.yml' -g '*.yaml' -g 'Makefile' -g 'justfile' -g '*.md' \
-g '!node_modules' -g '!dist' -g '!build'
echo '== Workflow and CI command candidates =='
fd -HI -t f . .github proof | sort | rg '(\.github/workflows/.*\.(yml|yaml)$|(^|/)(Makefile|justfile|.*\.(sh|ya?ml))$)' | while IFS= read -r f; do
echo "--- $f"
rg -n -C 4 \
'(proof/region/v1|arb/tests/gate\.py|native_gate\.py|runtime_gate\.py|unittest|python3)' \
"$f" || true
done
echo '== Arb gate composition, exact source =='
sed -n '70,152p' proof/region/v1/arb/tests/gate.py | nl -ba -v70Length of output: 1442 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== New shared gate =='
cat -n proof/region/v1/tests/gate.py
echo '== Outer-oracle and anti-vacuum tests =='
cat -n proof/region/v1/tests/test_build.py | sed -n '260,365p'
echo '== All source-level invocations of shared gate or test_build =='
rg -n -C 6 \
'(proof/region/v1/tests/gate\.py|tests/gate\.py|test_build\.py|ExistingSharedProofGateTests|proof_gate\.(full_suite_v1|inventory_is_exact_v1))' \
. \
-g '*.py' -g '*.sh' -g '*.yml' -g '*.yaml' -g 'Makefile' -g 'justfile' -g '*.md' \
-g '!node_modules' -g '!dist' -g '!build'
echo '== Workflow and CI command candidates =='
fd -HI -t f . .github proof | sort | rg '(\.github/workflows/.*\.(yml|yaml)$|(^|/)(Makefile|justfile|.*\.(sh|ya?ml))$)' | while IFS= read -r f; do
echo "--- $f"
rg -n -C 4 \
'(proof/region/v1|arb/tests/gate\.py|native_gate\.py|runtime_gate\.py|unittest|python3)' \
"$f" || true
done
echo '== Arb gate composition =='
sed -n '70,152p' proof/region/v1/arb/tests/gate.py | cat -nLength of output: 29847
Новых замечаний нет.
Проверки отклоняют:
Примечание: указанный hash ✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@proof/region/v1/tests/gate.py`:
- Around line 19-39: Вынесите дублирующиеся хелперы _iter_tests_v1,
_inventory_preimage_v1 и test_inventory_sha256_v1 из обоих gate-модулей в общий
модуль и обновите оба потребителя для их импорта. Оставьте test_count_v1 только
в общем gate-модуле, сохранив независимыми ожидаемые константы и engine-specific
проверки.
In `@proof/region/v1/tests/test_build.py`:
- Around line 345-361: Update test_mpfi_input_contract_cannot_green_by_skipping
to include failing test identifiers and their failure/error text in assertion
messages when validating result.failures and result.errors. Preserve the
existing checks for skipped, expected-failure, and unexpected-success
collections while ensuring a nested MPFI test failure reports its original
diagnostic details.
- Around line 310-343: Publish a public iter_tests_v1 wrapper in gate.py that
delegates to the existing _iter_tests_v1 implementation, then update all
references in test_build.py to use proof_gate.iter_tests_v1 instead of the
private symbol while preserving the current test enumeration behavior.
In `@proof/region/v1/tests/test_mpfi_input.py`:
- Around line 310-335: Move both mpfi_source_input_is_bound_v1 assertions
outside their corresponding assertRaises context managers so they execute after
the expected exception is captured. Preserve the existing cleanup in each
finally block and keep the assertions validating the unbound state for both lock
drift and foreign tree identity cases.
- Around line 79-109: Remove the unused value_mode parameter from
_fixture_release and update every call site, including the fixture invocation
around the referenced lines, to stop passing it. Keep the SourceReleaseLockV1
construction and all other fixture arguments unchanged.
- Around line 486-519: Update test_source_input_owner_has_no_engine_dependency
to read source_path once into a local text variable and reuse it for both
ast.parse and _imported_module_names. Add explicit parentheses around the mixed
and/or condition that identifies __import__ calls and import_module attributes,
preserving the current matching semantics and resolving Ruff RUF021.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 1b552d8e-1f56-44ad-a324-a6513d8f05a4
📒 Files selected for processing (8)
proof/region/v1/PROTOCOL.mdproof/region/v1/arb/tests/test_transport.pyproof/region/v1/build/input.pyproof/region/v1/mpfi/__init__.pyproof/region/v1/mpfi/input.pyproof/region/v1/tests/gate.pyproof/region/v1/tests/test_build.pyproof/region/v1/tests/test_mpfi_input.py
Comment on lines
+310
to
+343
| def test_exact_inventory_rejects_a_missing_mpfi_input_contract(self) -> None: | ||
| suite = proof_gate.full_suite_v1() | ||
| without_mpfi_input = unittest.TestSuite( | ||
| test | ||
| for test in proof_gate._iter_tests_v1(suite) | ||
| if not test.id().startswith("test_mpfi_input.") | ||
| ) | ||
|
|
||
| self.assertLess( | ||
| proof_gate.test_count_v1(without_mpfi_input), | ||
| proof_gate.test_count_v1(suite), | ||
| ) | ||
| self.assertFalse(proof_gate.inventory_is_exact_v1(without_mpfi_input)) | ||
|
|
||
| def test_exact_inventory_rejects_same_count_contract_replacement(self) -> None: | ||
| class ReplacementTest(unittest.TestCase): | ||
| def test_replacement(self) -> None: | ||
| pass | ||
|
|
||
| suite = proof_gate.full_suite_v1() | ||
| tests = tuple(proof_gate._iter_tests_v1(suite)) | ||
| replaced = next( | ||
| test for test in tests if test.id().startswith("test_mpfi_input.") | ||
| ) | ||
| replacement = unittest.defaultTestLoader.loadTestsFromTestCase(ReplacementTest) | ||
| same_count_replacement = unittest.TestSuite( | ||
| (*tuple(test for test in tests if test is not replaced), replacement) | ||
| ) | ||
|
|
||
| self.assertEqual( | ||
| proof_gate.test_count_v1(same_count_replacement), | ||
| proof_gate.test_count_v1(suite), | ||
| ) | ||
| self.assertFalse(proof_gate.inventory_is_exact_v1(same_count_replacement)) |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value
Обращение к приватному proof_gate._iter_tests_v1 нарушает границу модуля.
Строки 314, 330 и 350 используют приватный символ другого модуля. gate.py уже публикует test_count_v1, test_inventory_sha256_v1 и inventory_is_exact_v1, но не публикует перечисление тестов. Переименование приватной функции сломает три теста без предупреждения.
Опубликуйте в gate.py явную функцию перечисления и используйте её.
♻️ Предлагаемое изменение
Добавьте в proof/region/v1/tests/gate.py:
def iter_tests_v1(suite: unittest.TestSuite) -> Iterator[unittest.TestCase]:
"""Публичное перечисление: oracle в другом модуле не зависит от приватного имени."""
return _iter_tests_v1(suite)Затем в test_build.py:
- for test in proof_gate._iter_tests_v1(suite)
+ for test in proof_gate.iter_tests_v1(suite)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@proof/region/v1/tests/test_build.py` around lines 310 - 343, Publish a public
iter_tests_v1 wrapper in gate.py that delegates to the existing _iter_tests_v1
implementation, then update all references in test_build.py to use
proof_gate.iter_tests_v1 instead of the private symbol while preserving the
current test enumeration behavior.
Comment on lines
+345
to
+361
| def test_mpfi_input_contract_cannot_green_by_skipping(self) -> None: | ||
| suite = unittest.defaultTestLoader.discover( | ||
| str(proof_gate.TEST_DIRECTORY), | ||
| pattern="test_mpfi_input.py", | ||
| ) | ||
| test_ids = tuple(test.id() for test in proof_gate._iter_tests_v1(suite)) | ||
| result = unittest.TestResult() | ||
|
|
||
| suite.run(result) | ||
|
|
||
| self.assertTrue(test_ids) | ||
| self.assertEqual(result.testsRun, len(test_ids)) | ||
| self.assertFalse(result.skipped) | ||
| self.assertFalse(result.failures) | ||
| self.assertFalse(result.errors) | ||
| self.assertFalse(result.expectedFailures) | ||
| self.assertFalse(result.unexpectedSuccesses) |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win
Вложенный запуск набора скрывает причину отказа.
Строка 353 запускает весь test_mpfi_input.py внутри одного теста. Строки 358-361 проверяют только пустоту коллекций. При падении любого MPFI-теста отчёт покажет AssertionError: [...] is not false, а не исходную ошибку. Диагностика потребует ручного повторного запуска.
Включите в сообщение об отказе идентификаторы тестов и текст ошибок.
♻️ Предлагаемое изменение
self.assertTrue(test_ids)
self.assertEqual(result.testsRun, len(test_ids))
- self.assertFalse(result.skipped)
- self.assertFalse(result.failures)
- self.assertFalse(result.errors)
- self.assertFalse(result.expectedFailures)
- self.assertFalse(result.unexpectedSuccesses)
+ self.assertEqual(
+ [test.id() for test, _reason in result.skipped],
+ [],
+ )
+ self.assertEqual(
+ [(test.id(), trace) for test, trace in result.failures + result.errors],
+ [],
+ )
+ self.assertEqual(
+ [test.id() for test, _trace in result.expectedFailures],
+ [],
+ )
+ self.assertEqual(
+ [test.id() for test in result.unexpectedSuccesses],
+ [],
+ )📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| def test_mpfi_input_contract_cannot_green_by_skipping(self) -> None: | |
| suite = unittest.defaultTestLoader.discover( | |
| str(proof_gate.TEST_DIRECTORY), | |
| pattern="test_mpfi_input.py", | |
| ) | |
| test_ids = tuple(test.id() for test in proof_gate._iter_tests_v1(suite)) | |
| result = unittest.TestResult() | |
| suite.run(result) | |
| self.assertTrue(test_ids) | |
| self.assertEqual(result.testsRun, len(test_ids)) | |
| self.assertFalse(result.skipped) | |
| self.assertFalse(result.failures) | |
| self.assertFalse(result.errors) | |
| self.assertFalse(result.expectedFailures) | |
| self.assertFalse(result.unexpectedSuccesses) | |
| def test_mpfi_input_contract_cannot_green_by_skipping(self) -> None: | |
| suite = unittest.defaultTestLoader.discover( | |
| str(proof_gate.TEST_DIRECTORY), | |
| pattern="test_mpfi_input.py", | |
| ) | |
| test_ids = tuple(test.id() for test in proof_gate._iter_tests_v1(suite)) | |
| result = unittest.TestResult() | |
| suite.run(result) | |
| self.assertTrue(test_ids) | |
| self.assertEqual(result.testsRun, len(test_ids)) | |
| self.assertEqual( | |
| [test.id() for test, _reason in result.skipped], | |
| [], | |
| ) | |
| self.assertEqual( | |
| [(test.id(), trace) for test, trace in result.failures + result.errors], | |
| [], | |
| ) | |
| self.assertEqual( | |
| [test.id() for test, _trace in result.expectedFailures], | |
| [], | |
| ) | |
| self.assertEqual( | |
| [test.id() for test in result.unexpectedSuccesses], | |
| [], | |
| ) |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@proof/region/v1/tests/test_build.py` around lines 345 - 361, Update
test_mpfi_input_contract_cannot_green_by_skipping to include failing test
identifiers and their failure/error text in assertion messages when validating
result.failures and result.errors. Preserve the existing checks for skipped,
expected-failure, and unexpected-success collections while ensuring a nested
MPFI test failure reports its original diagnostic details.
Collaborator
Author
|
@coderabbitai review Пожалуйста, проверь incremental diff на commit |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='5b10da657e382433ad6bf377fef93cb6a10c3ce8'
echo '== requested commit =='
if ! git cat-file -e "${head}^{commit}" 2>/dev/null; then
git fetch --no-tags origin '+refs/pull/511/head:refs/remotes/origin/pr-511-head' || true
fi
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
base="$(git rev-parse "${head}^")"
echo "base=${base}"
echo '== incremental files =='
git diff --name-status --find-renames "$base" "$head"
echo '== incremental patch: relevant files =='
git diff --find-renames --unified=100 "$base" "$head" -- \
.github/workflows \
proof/region/v1/tests \
proof/region/v1/mpfi \
proof/region/v1/build \
proof/region/v1/PROTOCOL.md
echo '== changed Python outlines =='
git diff --name-only "$base" "$head" -- '*.py' |
while IFS= read -r file; do
[ -n "$file" ] || continue
echo "--- $file"
ast-grep outline "$file" --items all 2>/dev/null || true
done
echo '== workflow proof invocations =='
fd -HI -t f .github/workflows |
while IFS= read -r file; do
echo "--- $file"
rg -n -C 6 \
'(proof/region/v1|tests/gate\.py|test_mpfi_input|unittest|PYTHONOPTIMIZE|python)' \
"$file" || true
done
echo '== exact-suite and anti-vacuum implementation =='
for file in \
proof/region/v1/tests/gate.py \
proof/region/v1/tests/test_build.py \
proof/region/v1/tests/test_mpfi_input.py \
proof/region/v1/mpfi/input.py \
proof/region/v1/build/input.py
do
if [ -f "$file" ]; then
echo "--- $file"
rg -n -C 8 \
'(EXPECTED|inventory|allowlist|skip|expectedFailure|unexpectedSuccess|discover\(|loadTestsFrom|seal_mpfi|SealedInputV1|Build|Receipt|Pipeline|Executor)' \
"$file" || true
fi
done
echo '== source-input imports and direct build-authority references =='
python3 - <<'PY'
import ast
from pathlib import Path
for name in ("proof/region/v1/mpfi/input.py", "proof/region/v1/build/input.py"):
path = Path(name)
if not path.is_file():
continue
tree = ast.parse(path.read_text(encoding="utf-8"), filename=name)
imports = []
for node in ast.walk(tree):
if isinstance(node, ast.Import):
imports.extend(alias.name for alias in node.names)
elif isinstance(node, ast.ImportFrom):
imports.append("." * node.level + (node.module or ""))
print(f"{name}:")
for module in imports:
print(f" {module}")
PY
rg -n -P -C 4 \
'^\s*(from|import)\s+.*(arb|pipeline|transport|executor|receipt|run)|\b(BuildAuthority|Receipt|Executor|Pipeline)\b' \
proof/region/v1/mpfi proof/region/v1/build/input.py -g '*.py' || true
echo '== all references to shared proof gate =='
rg -n -C 5 \
'(proof/region/v1/tests/gate\.py|tests\.gate|full_suite_v1|inventory_is_exact_v1|test_mpfi_input)' \
. -g '*.py' -g '*.sh' -g '*.yml' -g '*.yaml' -g 'Makefile' -g 'justfile' -g '*.md' \
-g '!node_modules' -g '!dist' -g '!build'Length of output: 64260 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='5b10da657e382433ad6bf377fef93cb6a10c3ce8'
base="$(git rev-parse "${head}^")"
echo '== Arb mandatory gate: complete source =='
cat -n proof/region/v1/arb/tests/gate.py
echo '== Incremental Arb gate patch =='
git diff --unified=120 "$base" "$head" -- proof/region/v1/arb/tests/gate.py
echo '== Gate test bodies =='
cat -n proof/region/v1/arb/tests/test_build_recipe.py
echo '== Mandatory workflow commands =='
fd -HI -t f . .github/workflows | sort |
while IFS= read -r file; do
echo "--- $file"
rg -n -C 8 \
'(arb/tests/gate\.py|proof/region/v1|python[0-9]*|PYTHONOPTIMIZE|unittest)' \
"$file" || true
done
echo '== All local invocations of the Arb gate =='
rg -n -C 6 \
'(arb/tests/gate\.py|gate\.main\(\)|run_exact_suite_v1|full_suite_v1)' \
. -g '*.py' -g '*.sh' -g '*.yml' -g '*.yaml' -g 'Makefile' -g 'justfile' -g '*.md' \
-g '!node_modules' -g '!dist' -g '!build'
echo '== Gate API call sites and test discovery patterns =='
rg -n -C 5 \
'(SHARED_FAST_TEST_PATTERNS_V1|EXPECTED_SKIPS|EXPECTED_TEST_INVENTORY_SHA256|discover\(|loadTestsFrom|skip|expectedFailure|unexpectedSuccess|testsRun)' \
proof/region/v1/arb/tests -g '*.py'
echo '== Source-input direct imports and name references =='
sed -n '1,270p' proof/region/v1/mpfi/input.py
rg -n -P -C 4 \
'^\s*(from|import)\s+.*(arb|pipeline|transport|executor|receipt|run)|\b(BuildAuthority|SourceBoundArbControllerV1|Receipt|Executor|Pipeline)\b' \
proof/region/v1/mpfi/input.py proof/region/v1/build/input.py -g '*.py' || true
echo '== Source-input dependency closure: direct importing modules =='
python3 - <<'PY'
import ast
from pathlib import Path
for name in ("proof/region/v1/mpfi/input.py", "proof/region/v1/build/input.py"):
path = Path(name)
tree = ast.parse(path.read_text(encoding="utf-8"), filename=name)
print(f"--- {name}")
for node in tree.body:
if isinstance(node, ast.Import):
for alias in node.names:
print("import", alias.name)
elif isinstance(node, ast.ImportFrom):
print("from", "." * node.level + (node.module or ""))
PY
echo '== Current tree status at requested commit =='
git diff --check "$base" "$head"Length of output: 95082
Новых замечаний нет.
✅ Action performedReview finished.
|
Collaborator
Author
|
@coderabbitai review Финальный delta на commit |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='4ebc290c068ffee471d23e00ca2ec4dbb194e157'
if ! git cat-file -e "${head}^{commit}" 2>/dev/null; then
git fetch --no-tags origin '+refs/pull/511/head:refs/remotes/origin/pr-511-head' || true
fi
echo '== Requested commit =='
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
base="$(git rev-parse "${head}^")"
echo "base=$base"
echo '== Incremental changed files =='
git diff --name-status --find-renames "$base" "$head"
echo '== Incremental patch =='
git diff --find-renames --unified=120 "$base" "$head" -- \
.github/workflows \
proof/region/v1/tests \
proof/region/v1/mpfi \
proof/region/v1/build \
proof/region/v1/arb/tests
echo '== Changed Python structure =='
git diff --name-only "$base" "$head" -- '*.py' |
while IFS= read -r file; do
[ -n "$file" ] || continue
echo "--- $file"
ast-grep outline "$file" --items all 2>/dev/null || true
done
echo '== Mandatory workflow commands =='
fd -HI -t f .github/workflows |
while IFS= read -r file; do
echo "--- $file"
rg -n -C 8 \
'(proof/region/v1/arb/tests/gate\.py|proof/region/v1/tests/gate\.py|PYTHONOPTIMIZE|python[0-9]*|unittest)' \
"$file" || true
done
echo '== Mandatory gate composition and anti-vacuum checks =='
for file in \
proof/region/v1/arb/tests/gate.py \
proof/region/v1/arb/tests/test_build_recipe.py \
proof/region/v1/tests/gate.py \
proof/region/v1/tests/test_build.py \
proof/region/v1/tests/test_mpfi_input.py
do
if [ -f "$file" ]; then
echo "--- $file"
rg -n -C 8 \
'(test_mpfi_input|fixture|import.guard|import_guard|allowlist|skip|expectedFailure|unexpectedSuccess|inventory|duplicate|empty|full_suite_v1|run_exact_suite_v1)' \
"$file" || true
fi
done
echo '== Import boundary of MPFI source input =='
python3 - <<'PY'
import ast
from pathlib import Path
for name in ("proof/region/v1/mpfi/input.py", "proof/region/v1/build/input.py"):
path = Path(name)
if not path.is_file():
continue
tree = ast.parse(path.read_text(encoding="utf-8"), filename=name)
print(f"--- {name}")
for node in tree.body:
if isinstance(node, ast.Import):
for alias in node.names:
print(f"import {alias.name}")
elif isinstance(node, ast.ImportFrom):
print(f"from {'.' * node.level}{node.module or ''}")
PY
rg -n -P -C 4 \
'^\s*(from|import)\s+.*(arb|pipeline|transport|executor|receipt|run)|\b(BuildAuthority|SourceBoundArbControllerV1|Receipt|Executor|Pipeline)\b' \
proof/region/v1/mpfi/input.py proof/region/v1/build/input.py -g '*.py' || true
echo '== Diff whitespace check =='
git diff --check "$base" "$head"Length of output: 24963 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='4ebc290c068ffee471d23e00ca2ec4dbb194e157'
base="$(git rev-parse "${head}^")"
echo '== Workflow files and mandatory proof invocations =='
fd -HI -t f . .github/workflows | sort |
while IFS= read -r file; do
echo "--- $file"
rg -n -C 10 \
'(proof/region/v1/arb/tests/gate\.py|proof/region/v1/tests/gate\.py|PYTHONOPTIMIZE|python[0-9]*|unittest)' \
"$file" || true
done
echo '== Arb mandatory gate: source =='
cat -n proof/region/v1/arb/tests/gate.py
echo '== Gate-focused tests: relevant sections =='
for file in \
proof/region/v1/arb/tests/test_build_recipe.py \
proof/region/v1/tests/gate.py \
proof/region/v1/tests/test_build.py \
proof/region/v1/tests/test_mpfi_input.py
do
if [ -f "$file" ]; then
echo "--- $file"
rg -n -C 10 \
'(test_mpfi_input|allowlist|skip|expectedFailure|unexpectedSuccess|inventory|duplicate|empty|full_suite_v1|run_exact_suite_v1)' \
"$file" || true
fi
done
echo '== MPFI source-input imports =='
python3 - <<'PY'
import ast
from pathlib import Path
for name in ("proof/region/v1/mpfi/input.py", "proof/region/v1/build/input.py"):
path = Path(name)
tree = ast.parse(path.read_text(encoding="utf-8"), filename=name)
print(f"--- {name}")
for node in tree.body:
if isinstance(node, ast.Import):
for alias in node.names:
print(f"import {alias.name}")
elif isinstance(node, ast.ImportFrom):
print(f"from {'.' * node.level}{node.module or ''}")
PY
echo '== Prohibited source-input dependency references =='
rg -n -P -C 4 \
'^\s*(from|import)\s+.*(arb|pipeline|transport|executor|receipt|run)|\b(BuildAuthority|SourceBoundArbControllerV1|Receipt|Executor|Pipeline)\b' \
proof/region/v1/mpfi/input.py proof/region/v1/build/input.py -g '*.py' || true
echo '== Final delta integrity =='
git diff --check "$base" "$head"Length of output: 38541
Новых замечаний нет.
Тесты не выполнялись. Проверка была статической. You are interacting with an AI system. |
lemone112
force-pushed
the
agent/mpfi-source-materialization
branch
from
August 1, 2026 11:11
57c4817 to
dda9e73
Compare
lemone112
force-pushed
the
agent/mpfi-source-materialization
branch
from
August 1, 2026 14:08
dda9e73 to
7155024
Compare
lemone112
force-pushed
the
agent/mpfi-build-closure
branch
from
August 1, 2026 14:17
4ebc290 to
e588d43
Compare
Collaborator
Author
|
@coderabbitai review |
✅ Action performedReview finished.
|
Collaborator
Author
|
@coderabbitai review |
✅ Action performedReview finished.
|
lemone112
changed the title
There was a problem hiding this comment.
Actionable comments posted: 5
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
proof/region/v1/arb/tests/test_build_identity_v2.py (1)
34-47: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick winСвяжите
_POLICY_FIELDSс координатамиDockerBuildPolicyV1.
DockerBuildPolicyV1является подклассомtuple, а неdataclassилиNamedTuple. Поэтому используйте имена параметровDockerBuildPolicyV1.__new__безcls. Иначе новое поле может потеряться в_policy_with, а тест мутаций останется зелёным.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@proof/region/v1/arb/tests/test_build_identity_v2.py` around lines 34 - 47, Свяжите `_POLICY_FIELDS` с именами параметров `DockerBuildPolicyV1.__new__`, исключив параметр `cls`, вместо ручного дублирования списка. Проверьте, что `_policy_with` использует этот источник полей, чтобы любые новые поля `DockerBuildPolicyV1` автоматически учитывались и не терялись в тестах мутаций.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@proof/region/v1/arb/tests/test_receipt.py`:
- Around line 397-427: Rename the loop tuple variable select in the targets
iteration to a non-conflicting name, and update its uses within the loop while
preserving the existing behavior and the imported select.select call.
- Around line 938-948: Update the preimage construction in the test around
ArbComparatorPreimagesV1 to locate the build_identity field by dataclass field
name rather than assuming index 5 or a fixed range of 10 fields. Import
dataclasses.fields if needed, derive the field list from
pipeline.ArbComparatorPreimagesV1, preserve the existing build_identity
preimage, and forge all other positions while retaining the uniqueness
assertion.
In `@proof/region/v1/mpfi/input.py`:
- Around line 73-91: Вынесите проверку значения и вызов _fail для
source_lock_identity из try/except в явный поток после безопасного получения
свойства. Не допускайте, чтобы except Exception перехватывал
MpfiSourceInputErrorV1, поднятый внутри проверки; сохраните преобразование
неожиданных ошибок доступа к admitted_sources.source_lock_identity в
FOREIGN_SOURCE_CAPABILITY.
In `@proof/region/v1/provenance.py`:
- Around line 585-598: Remove the quotes from the return annotation of the
SourceReleaseLockV1.parse classmethod, changing it to the unquoted
SourceReleaseLockV1 annotation to resolve Ruff UP037 and match the existing
annotation style.
In `@proof/region/v1/tests/test_mpfi_input.py`:
- Around line 306-318: Remove the cached_lock_identity assignment and both
lock.__dict__ identity restoration operations from the test cleanup; in the
finally block around seal_mpfi_source_input_v1, restore only
lock.sources[0].version to original_version.
---
Outside diff comments:
In `@proof/region/v1/arb/tests/test_build_identity_v2.py`:
- Around line 34-47: Свяжите `_POLICY_FIELDS` с именами параметров
`DockerBuildPolicyV1.__new__`, исключив параметр `cls`, вместо ручного
дублирования списка. Проверьте, что `_policy_with` использует этот источник
полей, чтобы любые новые поля `DockerBuildPolicyV1` автоматически учитывались и
не терялись в тестах мутаций.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 5f56b2a6-f994-48c8-9584-0da7991fa567
📒 Files selected for processing (19)
proof/region/v1/PROTOCOL.mdproof/region/v1/arb/pipeline.pyproof/region/v1/arb/receipt.pyproof/region/v1/arb/tests/gate.pyproof/region/v1/arb/tests/test_build_identity_v2.pyproof/region/v1/arb/tests/test_build_recipe.pyproof/region/v1/arb/tests/test_pipeline.pyproof/region/v1/arb/tests/test_receipt.pyproof/region/v1/arb/tests/test_transport.pyproof/region/v1/build/input.pyproof/region/v1/build/transport.pyproof/region/v1/mpfi/__init__.pyproof/region/v1/mpfi/input.pyproof/region/v1/provenance.pyproof/region/v1/region_proof_protocol.pyproof/region/v1/tests/test_build.pyproof/region/v1/tests/test_mpfi_input.pyproof/region/v1/tests/test_mpfi_source_lock.pyproof/region/v1/tests/test_source_lock.py
Comment on lines
+73
to
+91
| try: | ||
| source_lock_identity = admitted_sources.source_lock_identity | ||
| if ( | ||
| type(source_lock_identity) is not bytes | ||
| or len(source_lock_identity) != 32 | ||
| or source_lock_identity == bytes(32) | ||
| or source_lock_identity != source_lock.identity | ||
| ): | ||
| _fail( | ||
| MpfiSourceInputReasonV1.FOREIGN_SOURCE_CAPABILITY, | ||
| "admitted_sources", | ||
| ) | ||
| except Exception: | ||
| # Exact type не делает retained capability неуязвимой к post-admission | ||
| # подмене; ordinary hostile failure обязан остаться typed rejection. | ||
| _fail( | ||
| MpfiSourceInputReasonV1.FOREIGN_SOURCE_CAPABILITY, | ||
| "admitted_sources", | ||
| ) |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win
Вынесите typed rejection из блока try.
_fail на строках 81-84 поднимает MpfiSourceInputErrorV1. Этот класс наследует ValueError, поэтому except Exception на строке 85 перехватывает его и повторяет _fail. Сейчас результат совпадает, потому что reason и field одинаковы. Если позже вы добавите другой reason внутри блока try, он будет молча заменён на FOREIGN_SOURCE_CAPABILITY. Сделайте поток управления явным.
♻️ Предлагаемое изменение
try:
source_lock_identity = admitted_sources.source_lock_identity
- if (
- type(source_lock_identity) is not bytes
- or len(source_lock_identity) != 32
- or source_lock_identity == bytes(32)
- or source_lock_identity != source_lock.identity
- ):
- _fail(
- MpfiSourceInputReasonV1.FOREIGN_SOURCE_CAPABILITY,
- "admitted_sources",
- )
+ bound = (
+ type(source_lock_identity) is bytes
+ and len(source_lock_identity) == 32
+ and source_lock_identity != bytes(32)
+ and source_lock_identity == source_lock.identity
+ )
except Exception:
# Exact type не делает retained capability неуязвимой к post-admission
# подмене; ordinary hostile failure обязан остаться typed rejection.
_fail(
MpfiSourceInputReasonV1.FOREIGN_SOURCE_CAPABILITY,
"admitted_sources",
)
+ if not bound:
+ _fail(
+ MpfiSourceInputReasonV1.FOREIGN_SOURCE_CAPABILITY,
+ "admitted_sources",
+ )📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| try: | |
| source_lock_identity = admitted_sources.source_lock_identity | |
| if ( | |
| type(source_lock_identity) is not bytes | |
| or len(source_lock_identity) != 32 | |
| or source_lock_identity == bytes(32) | |
| or source_lock_identity != source_lock.identity | |
| ): | |
| _fail( | |
| MpfiSourceInputReasonV1.FOREIGN_SOURCE_CAPABILITY, | |
| "admitted_sources", | |
| ) | |
| except Exception: | |
| # Exact type не делает retained capability неуязвимой к post-admission | |
| # подмене; ordinary hostile failure обязан остаться typed rejection. | |
| _fail( | |
| MpfiSourceInputReasonV1.FOREIGN_SOURCE_CAPABILITY, | |
| "admitted_sources", | |
| ) | |
| try: | |
| source_lock_identity = admitted_sources.source_lock_identity | |
| bound = ( | |
| type(source_lock_identity) is bytes | |
| and len(source_lock_identity) == 32 | |
| and source_lock_identity != bytes(32) | |
| and source_lock_identity == source_lock.identity | |
| ) | |
| except Exception: | |
| # Exact type не делает retained capability неуязвимой к post-admission | |
| # подмене; ordinary hostile failure обязан остаться typed rejection. | |
| _fail( | |
| MpfiSourceInputReasonV1.FOREIGN_SOURCE_CAPABILITY, | |
| "admitted_sources", | |
| ) | |
| if not bound: | |
| _fail( | |
| MpfiSourceInputReasonV1.FOREIGN_SOURCE_CAPABILITY, | |
| "admitted_sources", | |
| ) |
🧰 Tools
🪛 Ruff (0.16.0)
[warning] 85-85: Do not catch blind exception: Exception
(BLE001)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@proof/region/v1/mpfi/input.py` around lines 73 - 91, Вынесите проверку
значения и вызов _fail для source_lock_identity из try/except в явный поток
после безопасного получения свойства. Не допускайте, чтобы except Exception
перехватывал MpfiSourceInputErrorV1, поднятый внутри проверки; сохраните
преобразование неожиданных ошибок доступа к
admitted_sources.source_lock_identity в FOREIGN_SOURCE_CAPABILITY.
Collaborator
Author
|
@coderabbitai review Проверьте текущую голову |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='bd7ddbaafa3698571f3843a4e9757b31e31f5d69'
if ! git cat-file -e "${head}^{commit}" 2>/dev/null; then
git fetch --no-tags origin '+refs/pull/511/head:refs/remotes/origin/pr-511-head' || true
fi
echo '== requested commit =='
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
base="$(git rev-parse "${head}^")"
echo "base=$base"
echo '== changed files =='
git diff --name-status --find-renames "$base" "$head"
echo '== incremental patch =='
git diff --find-renames --unified=100 "$base" "$head" -- \
.github/workflows \
proof/region/v1/arb/tests \
proof/region/v1/tests \
proof/region/v1/mpfi \
proof/region/v1/build \
proof/region/v1/provenance.py \
proof/region/v1/arb
echo '== changed Python outlines =='
git diff --name-only "$base" "$head" -- '*.py' |
while IFS= read -r file; do
[ -n "$file" ] || continue
echo "--- $file"
ast-grep outline "$file" --items all 2>/dev/null || true
done
echo '== relevant symbols in changed files =='
git diff --name-only "$base" "$head" -- |
while IFS= read -r file; do
case "$file" in
*.py)
echo "--- $file"
rg -n -C 8 \
'(preimage|Preimage|index|typed|MpfiSourceInputErrorV1|MpfiSourceInputReasonV1|Error|fixture|inventory|SHA256|test_mpfi_input|skip|expectedFailure|unexpectedSuccess)' \
"$file" || true
;;
esac
done
echo '== mandatory workflow and gate composition =='
for file in .github/workflows/arb.yml proof/region/v1/arb/tests/gate.py proof/region/v1/arb/tests/test_build_recipe.py proof/region/v1/tests/test_build.py; do
if [ -f "$file" ]; then
echo "--- $file"
rg -n -C 10 \
'(arb/tests/gate\.py|PYTHONOPTIMIZE|test_mpfi_input|SHARED_FAST_TEST_PATTERNS_V1|inventory|SHA256|skip|expectedFailure|unexpectedSuccess|full_suite_v1)' \
"$file" || true
fi
done
echo '== MPFI source-input direct import graph and prohibited references =='
python3 - <<'PY'
import ast
from pathlib import Path
for name in ("proof/region/v1/mpfi/input.py", "proof/region/v1/build/input.py"):
path = Path(name)
if not path.is_file():
continue
tree = ast.parse(path.read_text(encoding="utf-8"), filename=name)
print(f"--- {name}")
for node in tree.body:
if isinstance(node, ast.Import):
for alias in node.names:
print(f"import {alias.name}")
elif isinstance(node, ast.ImportFrom):
print(f"from {'.' * node.level}{node.module or ''}")
PY
rg -n -P -C 4 \
'^\s*(from|import)\s+.*(arb|pipeline|transport|executor|receipt|run)|\b(BuildAuthority|SourceBoundArbControllerV1|Receipt|Executor|Pipeline)\b' \
proof/region/v1/mpfi/input.py proof/region/v1/build/input.py -g '*.py' || true
echo '== diff integrity =='
git diff --check "$base" "$head"Length of output: 213304
Новых замечаний нет.
Тесты не выполнялись. Проверка была статической. ✅ Action performedReview finished.
|
Collaborator
Author
|
@coderabbitai review Проверьте текущую голову |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='6cd4f1b'
if ! git rev-parse --verify --quiet "${head}^{commit}" >/dev/null; then
git fetch --no-tags origin '+refs/pull/511/head:refs/remotes/origin/pr-511-head' || true
fi
echo '== requested commit =='
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
base="$(git rev-parse "${head}^")"
echo "base=$base"
echo '== incremental files =='
git diff --name-status --find-renames "$base" "$head"
echo '== incremental patch =='
git diff --find-renames --unified=120 "$base" "$head"
echo '== changed Python outlines =='
git diff --name-only "$base" "$head" -- '*.py' |
while IFS= read -r file; do
[ -n "$file" ] || continue
echo "--- $file"
ast-grep outline "$file" --items all 2>/dev/null || true
done
echo '== DockerBuildPolicyV1 and _POLICY_FIELDS definitions and uses =='
rg -n -C 12 \
'class\s+DockerBuildPolicyV1\b|def\s+__new__\b|_POLICY_FIELDS\b|DockerUserModeV1|policy.*identity|identity.*policy|canonical' \
proof/region/v1/build proof/region/v1/arb proof/region/v1/tests \
-g '*.py'
echo '== focused transport source =='
transport_file="$(fd -HI -t f '^transport\.py$' proof/region/v1/build | head -n 1 || true)"
if [ -n "$transport_file" ]; then
cat -n "$transport_file" | sed -n '1,420p'
fi
echo '== tests that cover DockerBuildPolicyV1 fields and identity =='
rg -n -C 8 \
'DockerBuildPolicyV1|_POLICY_FIELDS|DockerUserModeV1|policy.*identity|identity.*policy' \
proof/region/v1 -g 'test_*.py'
echo '== mandatory MPFI proof-gate static composition =='
for file in \
.github/workflows/arb.yml \
proof/region/v1/arb/tests/gate.py \
proof/region/v1/arb/tests/test_build_recipe.py \
proof/region/v1/tests/test_mpfi_input.py
do
if [ -f "$file" ]; then
echo "--- $file"
rg -n -C 8 \
'(arb/tests/gate\.py|PYTHONOPTIMIZE|test_mpfi_input|SHARED_FAST_TEST_PATTERNS_V1|inventory|allowlist|skip|expectedFailure|unexpectedSuccess|full_suite_v1)' \
"$file" || true
fi
done
echo '== source-input authority boundary =='
python3 - <<'PY'
import ast
from pathlib import Path
for name in ("proof/region/v1/mpfi/input.py", "proof/region/v1/build/input.py"):
path = Path(name)
if not path.is_file():
continue
tree = ast.parse(path.read_text(encoding="utf-8"), filename=name)
print(f"--- {name}")
for node in tree.body:
if isinstance(node, ast.Import):
for alias in node.names:
print(f"import {alias.name}")
elif isinstance(node, ast.ImportFrom):
print(f"from {'.' * node.level}{node.module or ''}")
PY
rg -n -P -C 3 \
'^\s*(from|import)\s+.*(arb|pipeline|transport|executor|receipt|run)|\b(BuildAuthority|SourceBoundArbControllerV1|Receipt|Executor|Pipeline)\b' \
proof/region/v1/mpfi/input.py proof/region/v1/build/input.py -g '*.py' || true
echo '== diff integrity =='
git diff --check "$base" "$head"Length of output: 174031 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='6cd4f1b'
base="$(git rev-parse "${head}^")"
echo '== commit =='
git show -s --format='commit=%H%nparent=%P%nsubject=%s' "$head"
echo '== changed files =='
git diff --name-status --find-renames "$base" "$head"
echo '== exact incremental patch =='
git diff --find-renames --unified=80 "$base" "$head"
echo '== changed test source =='
git diff --name-only "$base" "$head" -- '*.py' |
while IFS= read -r file; do
[ -n "$file" ] || continue
echo "--- $file"
cat -n "$file" | sed -n '1,150p'
rg -n -C 12 \
'_POLICY_FIELDS\b|def _policy_with\b|def _policy_mutants\b|test_every_admitted_policy_mutation' \
"$file" || true
done
echo '== constructor parameters, public properties, and policy test field set =='
python3 - <<'PY'
import ast
import inspect
import sys
from pathlib import Path
root = Path("proof/region/v1")
sys.path.insert(0, str(root))
from build import transport
parameters = tuple(
name
for name in inspect.signature(transport.DockerBuildPolicyV1.__new__).parameters
if name != "cls"
)
properties = tuple(
name
for name, member in vars(transport.DockerBuildPolicyV1).items()
if isinstance(member, property)
)
print("constructor_parameters=", parameters)
print("public_properties=", properties)
print("same_order_and_set=", parameters == properties)
test_path = root / "arb/tests/test_build_identity_v2.py"
tree = ast.parse(test_path.read_text(encoding="utf-8"), filename=str(test_path))
for node in tree.body:
if isinstance(node, ast.Assign) and any(
isinstance(target, ast.Name) and target.id == "_POLICY_FIELDS"
for target in node.targets
):
print("policy_fields_assignment_ast=", ast.dump(node.value, include_attributes=False))
PY
echo '== no whitespace errors =='
git diff --check "$base" "$head"Length of output: 15653
Новых замечаний нет.
Я не выполнял тесты. Попытка import-based inspection не выполнилась из-за Python 3.9 в sandbox: этот runtime не содержит You are interacting with an AI system. |
…n' into agent/mpfi-build-closure # Conflicts: # proof/region/v1/arb/pipeline.py # proof/region/v1/tests/test_build.py
…n' into agent/mpfi-build-closure
This was referenced Aug 1, 2026
Collaborator
Author
|
Этот replay/source-closure-срез поглощён терминальным PR #514 (base |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Срез
Причина
Замороженные Python-объекты всё ещё могут быть испорчены через
__dict__. Ранее можно было отравить вложенный cached identity, восстановить его во время source replay и получить ложное принятие evidence. Также source-coordinate wire существовал в нескольких расходящихся копиях.Проверка
git diff --checkчист; генерируемые__pycache__удалены.Ограничение доставки
Локальные Python-проверки пройдены. Rust workspace gate также пройден локально:
cargo test --workspace --locked, форматирование, clippy с-D warningsи intra-doc проверка. Реальный disposable VM/Docker gate не заявлен пройденным и остаётся внешним CI-gate; PR намеренно draft.Summary by CodeRabbit
Новые возможности
0700.Исправления