#!/usr/bin/env python3 # -*- coding: utf-8 -*- """test_golden_currency_gate.py — R-410's red-proof, shipped as a test. WHAT IT PINS. Until 2026-09-01 `golden_currency_gate.py` matched `EVIDENCE_RE` against `os.listdir` and read nothing inside the directory, so mkdir documentation/tests/golden-9.9.9-2026-01-01 turned the gate GREEN with no bake behind it. That was noticed while the 0.230.0 bake was running — the evidence directory was created BEFORE the bake finished, and the gate would have passed at that moment. **A directory name is a label; `GOLDEN_SHA256=<64 hex>` is a fact only a completed publish produces.** This is the gate's own instrument check: an empty directory must FAIL, a real bake log must PASS, and a log with no sha line must FAIL. Without the last two, "it fails on an empty directory" would be satisfied by a gate that fails on everything. Run: python3 scripts/test_golden_currency_gate.py Exit 0 all pass · 1 a case failed. 2026-09-13: the WAIVER (Scenarios E-H of the task that built it) is tested below in `waiver_cases`, against a synthetic tree through the gate's GOLDEN_GATE_* seam — a valid waiver passes with the advisory PRESENT; an expired one convicts and NAMES the date; a valid one does NOT save an unrecorded golden (R-385); a 15-day, absent-expiry, unparseable, bad-row and empty-reason waiver each return 2; and the R-421 decoy (a file saying only `expires`) returns 2. """ import io import os import shutil import subprocess import sys import tempfile ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__))) GATE = os.path.join(ROOT, "scripts", "golden_currency_gate.py") EVIDENCE_DIR = os.path.join(ROOT, "documentation", "tests") REAL_SHA = "9287f7cef5f13166276e8406005e3f28004004510c5184f1c1c7377f7aafad2e" def run_gate(): p = subprocess.run([sys.executable, GATE], capture_output=True, text=True) return p.returncode, p.stdout + p.stderr def with_dir(name, files): """Context: create documentation/tests// holding `files` (name -> contents), then remove it.""" class _C(object): def __enter__(self): self.path = os.path.join(EVIDENCE_DIR, name) if os.path.exists(self.path): raise SystemExit("refusing to overwrite an existing %s" % self.path) os.makedirs(self.path) for fn, body in files.items(): with io.open(os.path.join(self.path, fn), "w", encoding="utf-8") as fh: fh.write(body) return self.path def __exit__(self, *a): shutil.rmtree(self.path, ignore_errors=True) return False return _C() def main(): if not os.path.isfile(GATE): print("FAIL: the gate script is missing — that is a failure, never a skip") return 1 fails = [] # --- BASELINE: what does the gate say with the tree as it is? ------------------------------ base_rc, base_out = run_gate() print("baseline: gate exit %d" % base_rc) # --- CASE 1: an EMPTY directory with a perfect name must NOT count as a bake ---------------- # Version 9.9.9 is far above any real release, so if it counted, the gate would go GREEN. with with_dir("golden-9.9.9-2026-01-01", {}): rc, out = run_gate() counted = "9.9.9" in out and "NOT counted" not in out.split("9.9.9")[0][-200:] if "newest golden baked : 9.9.9" in out: fails.append("CASE 1: an EMPTY directory was counted as a bake — this is R-410 exactly") elif "NOT counted as bakes" not in out: fails.append("CASE 1: the empty directory was neither counted nor reported; a half-finished " "bake must be VISIBLE, not silently ignored") else: print("CASE 1 ok: an empty golden-9.9.9-2026-01-01/ is rejected and named") _ = counted # --- CASE 2: a directory whose log has NO sha line must NOT count --------------------------- with with_dir("golden-9.9.8-2026-01-01", {"bake.log": "[golden] starting\n[golden] it all went wrong\n"}): rc, out = run_gate() if "newest golden baked : 9.9.8" in out: fails.append("CASE 2: a bake log with no GOLDEN_SHA256 line was counted as a bake") else: print("CASE 2 ok: a log with no GOLDEN_SHA256 line is rejected") # --- CASE 3: a REAL bake log must count, and the gate must read its sha --------------------- # The positive control. Without it, cases 1 and 2 are satisfied by a gate that rejects everything. with with_dir("golden-9.9.7-2026-01-01", {"bake.log": "[golden] upload OK (HTTP 201)\nGOLDEN_VERSION=9.9.7\nGOLDEN_SHA256=%s\n" % REAL_SHA}): rc, out = run_gate() if "newest golden baked : 9.9.7" not in out: fails.append("CASE 3 (POSITIVE CONTROL): a real bake log was NOT counted — the gate now " "rejects everything, which would make cases 1 and 2 meaningless") elif REAL_SHA[:12] not in out: fails.append("CASE 3: the gate counted the bake but did not read its sha") else: print("CASE 3 ok: a real bake log counts, and its sha is read and shown") # --- CASE 4: the tree is left exactly as found ---------------------------------------------- post_rc, _ = run_gate() if post_rc != base_rc: fails.append("CASE 4: the gate's verdict changed after the test cleaned up (%d -> %d) — a test " "that leaves the tree different is not a test" % (base_rc, post_rc)) else: print("CASE 4 ok: the tree is unchanged; the gate's verdict is the same as the baseline") fails += waiver_cases() if fails: print() for f in fails: print("FAIL: %s" % f) return 1 print("\ngolden-currency gate self-test OK — a directory name alone cannot satisfy it (R-410), " "and the waiver is judged on its dates, its row and its direction (2026-09-13)") return 0 # ── THE WAIVER (2026-09-13) — Scenarios E, F, G, H, each with its red-proof ───────────────────── # # These run the gate against a SYNTHETIC tree through the GOLDEN_GATE_* seam (a fake controller # CHANGELOG, a fake evidence dir with a real-shaped bake log, a fake register, a waiver file), so the # verdicts do not depend on what the real controller happens to have released this week. The seam # moves where the gate reads, never what it decides. import datetime import tempfile def run_gate_env(env): e = dict(os.environ) e.update(env) p = subprocess.run([sys.executable, GATE], capture_output=True, text=True, env=e) return p.returncode, p.stdout + p.stderr def synthetic_tree(released, baked, waiver_text, register_rows=("R-468",)): """Build a tree where the CHANGELOG lists `released` (newest first) and one golden `baked` has a real-shaped bake log. Returns (env, tmpdir).""" tmp = tempfile.mkdtemp(prefix="golden-waiver-") ch = os.path.join(tmp, "CHANGELOG.md") with io.open(ch, "w", encoding="utf-8") as fh: for v in released: fh.write("## v%s — synthetic (2026-01-01)\n\nbody\n\n" % v) ev = os.path.join(tmp, "tests") os.makedirs(os.path.join(ev, "golden-%s-2026-01-01" % baked)) with io.open(os.path.join(ev, "golden-%s-2026-01-01" % baked, "bake.log"), "w", encoding="utf-8") as fh: fh.write("[golden] upload OK (HTTP 201)\nGOLDEN_VERSION=%s\nGOLDEN_SHA256=%s\n" % (baked, REAL_SHA)) reg = os.path.join(tmp, "OPEN-ITEMS.md") with io.open(reg, "w", encoding="utf-8") as fh: for r in register_rows: fh.write("| **%s** | synthetic row | READY | CC |\n" % r) wv = os.path.join(tmp, "golden-waiver.yml") if waiver_text is not None: with io.open(wv, "w", encoding="utf-8") as fh: fh.write(waiver_text) env = {"GOLDEN_GATE_CHANGELOG": ch, "GOLDEN_GATE_EVIDENCE_DIR": ev, "GOLDEN_GATE_WAIVER": wv, "GOLDEN_GATE_REGISTER": reg} return env, tmp def waiver(issued, expires, reason="pre-customer development; weekly cadence", row="R-468"): lines = ["# synthetic waiver"] if issued is not None: lines.append("issued: %s" % issued) if expires is not None: lines.append("expires: %s" % expires) if reason is not None: lines.append("reason: %s" % reason) if row is not None: lines.append("register_row: %s" % row) return "\n".join(lines) + "\n" def waiver_cases(): fails = [] today = datetime.date.today() d = lambda n: (today + datetime.timedelta(days=n)).isoformat() BEHIND = (["9.9.9", "9.9.8", "9.9.7"], "9.9.7") # released 9.9.9, golden 9.9.7: two behind UNRECORDED = (["9.9.9", "9.9.7"], "9.9.8") # golden 9.9.8 has no heading (R-385) def check(label, released_baked, wtext, want_rc, must=(), must_not=(), rows=("R-468",)): env, tmp = synthetic_tree(released_baked[0], released_baked[1], wtext, rows) try: rc, out = run_gate_env(env) finally: shutil.rmtree(tmp, ignore_errors=True) bad = [m for m in must if m not in out] + ["NOT expected: " + m for m in must_not if m in out] if rc != want_rc or bad: fails.append("%s: rc=%d (wanted %d) %s\n%s" % (label, rc, want_rc, bad, out[-900:])) else: print("%s ok" % label) # BASELINE for the synthetic tree — behind, no waiver: convicted exactly as before this change. check("CASE 5 (baseline, behind, no waiver -> 1)", BEHIND, None, 1, must=("GOLDEN CURRENCY GATE FAILED", "2 release(s) behind")) # E — a valid waiver turns the conviction into a LOUD advisory, exit 0. check("CASE 6 (E: valid waiver, behind -> ADVISORY, 0)", BEHIND, waiver(d(0), d(13)), 0, must=("ADVISORY", "WAIVED", "R-468", d(13), "2 release(s) behind", "OK (WAIVED)"), must_not=("GOLDEN CURRENCY GATE FAILED",)) # F — the same waiver, expired: red again, and the reader learns it RAN OUT. check("CASE 7 (F: expired waiver, behind -> 1, names the date)", BEHIND, waiver(d(-10), d(0)), 1, must=("GOLDEN CURRENCY GATE FAILED", "EXPIRED on %s" % d(0))) check("CASE 7b (F: waiver expired yesterday -> 1)", BEHIND, waiver(d(-10), d(-1)), 1, must=("EXPIRED on %s" % d(-1),)) # G — a valid waiver never saves an UNRECORDED golden (R-385). check("CASE 8 (G: valid waiver, UNRECORDED golden -> 1)", UNRECORDED, waiver(d(0), d(13)), 1, must=("UNRECORDED", "DOES NOT COVER THIS", "R-385")) # H — a waiver that tries to be permanent, or is malformed, is INCONCLUSIVE — never 0. check("CASE 9 (H: 15-day waiver -> 2)", BEHIND, waiver(d(0), d(15)), 2, must=("MALFORMED", "hard limit is 14")) check("CASE 9b (H: exactly 14 days is the limit and PASSES)", BEHIND, waiver(d(0), d(14)), 0, must=("ADVISORY",)) check("CASE 10 (H: absent expiry -> 2)", BEHIND, waiver(d(0), None), 2, must=("MALFORMED", "expires")) check("CASE 11 (H: unparseable expiry -> 2)", BEHIND, waiver(d(0), "next week"), 2, must=("MALFORMED", "expires")) check("CASE 12 (H: register row does not exist -> 2)", BEHIND, waiver(d(0), d(13), row="R-999999"), 2, must=("MALFORMED", "R-999999", "does not exist")) check("CASE 12b (H: empty reason -> 2)", BEHIND, waiver(d(0), d(13), reason=""), 2, must=("MALFORMED", "reason")) # THE DECOY (R-421): a file at the right path saying only `expires` must not pass. check("CASE 13 (DECOY: a file containing only the word `expires` -> 2)", BEHIND, "expires\n", 2, must=("MALFORMED",), must_not=("ADVISORY", "OK (WAIVED)")) # A malformed waiver is refused EVEN WHEN the golden is current — it must not lie there as cover. check("CASE 14 (malformed waiver, golden CURRENT -> still 2)", (["9.9.9"], "9.9.9"), waiver(d(0), d(30)), 2, must=("MALFORMED",)) # An expired waiver with a current golden: OK, but the expiry is NAMED. check("CASE 15 (expired waiver, golden current -> 0 with a note)", (["9.9.9"], "9.9.9"), waiver(d(-10), d(-1)), 0, must=("expired on %s" % d(-1), "golden currency gate OK")) return fails sys.exit(main())