mirror of
https://github.com/saymrwulf/proof-aware-crypto-tooling-agent.git
synced 2026-09-03 19:53:43 +00:00
mrwulf
d937a94382
Found by the entry-13 12->13 rehearsal: build_attestation emitted subject/environment/replay/certificates but NO scope — the profile's guarantees/exclusions/deployment_constraints (which carry a repo's known_status scoped-claim wording and known_exclusions) reached only the claim card, never the published leaf. So the round-6 requirement that entry 13's LEAF carry its scoped attestation text was unmet by the code; a reviewer who checked the claim card saw the wording that the leaf did not contain. Added a 'scope' block (guarantees/exclusions/deployment_constraints) to the leaf; pure text, safe to publish, validator is additive. Two provider tests assert the block exists and that a repo's known_status/known_exclusions reach it. Suite 115 passed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
90 lines
3.6 KiB
Python
90 lines
3.6 KiB
Python
from pathlib import Path
|
|
import sys
|
|
|
|
sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "provider" / "src"))
|
|
|
|
from pacta.config import RepoConfig
|
|
from pacta.signing import generate_ed25519_keypair
|
|
from pacta_provider.discovery import discover_toolchains
|
|
from pacta_provider.service import build_attestation
|
|
|
|
|
|
def test_provider_discovery_finds_env_script(tmp_path):
|
|
root = tmp_path / "toolchains" / "aeneas-toolchain"
|
|
lean = root / "aeneas" / "backends" / "lean"
|
|
lean.mkdir(parents=True)
|
|
(lean / "lakefile.lean").write_text("", encoding="utf-8")
|
|
(root / "env.sh").write_text(
|
|
'SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"\n'
|
|
'export AENEAS_HOME="$SCRIPT_DIR/aeneas"\n',
|
|
encoding="utf-8",
|
|
)
|
|
candidates = discover_toolchains([tmp_path], max_depth=5)
|
|
assert candidates
|
|
assert candidates[0].lean_project_dir == lean
|
|
|
|
|
|
def test_provider_builds_signed_attestation_for_fixture(tmp_path):
|
|
private_key = tmp_path / "provider.key"
|
|
public_key = tmp_path / "provider.pub"
|
|
generate_ed25519_keypair(private_key, public_key)
|
|
repo = RepoConfig(
|
|
name="dalek-ed25519-verified",
|
|
url="https://github.com/saymrwulf/dalek-ed25519-verified.git",
|
|
kind="ed25519",
|
|
verification_dir="verification",
|
|
verified_backend="serial/u64",
|
|
certificates=["CurveFieldProofs.fieldImplementation", "CurveFieldProofs.edwardsImplementation"],
|
|
axiom_imports=["Proofs.FieldMain", "Proofs.EdMain"],
|
|
expected_axioms=[],
|
|
)
|
|
attestation = build_attestation(
|
|
repo,
|
|
Path("tests/fixtures/mini-ed25519-verified"),
|
|
provider="local-test-provider",
|
|
private_key=private_key,
|
|
public_key=public_key,
|
|
timeout=30,
|
|
log_dir=tmp_path / "logs",
|
|
)
|
|
assert attestation["signature"]["status"] == "signed"
|
|
assert attestation["certificates"][0]["status"] == "proven"
|
|
# The leaf carries its own scope block (review round 6): the
|
|
# profile's guarantees/exclusions/deployment_constraints must reach
|
|
# the published leaf, not only the claim card.
|
|
assert "scope" in attestation
|
|
for key in ("guarantees", "exclusions", "deployment_constraints"):
|
|
assert key in attestation["scope"]
|
|
|
|
|
|
def test_attestation_scope_carries_repo_known_status_and_exclusions(tmp_path):
|
|
# A repo's known_status (scoped-claim wording) and known_exclusions
|
|
# must land in the leaf's scope block. Regression for the entry-13
|
|
# requirement that the leaf itself carry its scoped attestation text.
|
|
private_key = tmp_path / "provider.key"
|
|
public_key = tmp_path / "provider.pub"
|
|
generate_ed25519_keypair(private_key, public_key)
|
|
repo = RepoConfig(
|
|
name="dalek-ed25519-verified",
|
|
url="https://github.com/saymrwulf/dalek-ed25519-verified.git",
|
|
kind="ed25519",
|
|
verification_dir="verification",
|
|
verified_backend="serial/u64",
|
|
certificates=["CurveFieldProofs.fieldImplementation"],
|
|
axiom_imports=["Proofs.FieldMain"],
|
|
expected_axioms=[],
|
|
known_status="SCOPE MARKER: mechanized model only, not the deployed verifier.",
|
|
known_exclusions=["EXCLUSION MARKER: side-channel resistance"],
|
|
)
|
|
attestation = build_attestation(
|
|
repo,
|
|
Path("tests/fixtures/mini-ed25519-verified"),
|
|
provider="local-test-provider",
|
|
private_key=private_key,
|
|
public_key=public_key,
|
|
timeout=30,
|
|
log_dir=tmp_path / "logs",
|
|
)
|
|
scope = attestation["scope"]
|
|
assert any("SCOPE MARKER" in c for c in scope["deployment_constraints"])
|
|
assert any("EXCLUSION MARKER" in e for e in scope["exclusions"])
|