# ============================================================ # 智能兜底 P3（高风险场景 S4/S6/S7 + 白名单治理）黄金测试 —— 全部确定性： # fake runner 注入、FakeStore 挂 .checkpoints、白名单文件指 tmp、 # MES 客户端注入 tmp 镜像、bind_identity 绑角色（test_approval_role_policies 先例）。 # 覆盖 P3-DESIGN §8 测试矩阵 H-1..H-21。不依赖真实 node/pi/网络/LLM/MES。 # ============================================================ from __future__ import annotations import contextlib import copy import hashlib import json from pathlib import Path from typing import ClassVar import pytest from server.agent_core import fallback_highrisk, fallback_lane, harness from server.agent_core.providers import reset_provider from server.aps_domain.workflow import execute_confirmed from server.auth.context import IdentityContext, bind_identity, reset_identity from server.contracts import IntentResult from server.state.checkpoints import CheckpointStore from server.state.seed import seed_world DEMO_PRODUCT = "CTRL-A" # demo 世界成品（seed_world APS_SEED_DEMO=1） @pytest.fixture(autouse=True) def _isolate(tmp_path, monkeypatch): """环境隔离：run 目录 / 开关文件 / P3 白名单文件指 tmp；清掉 LLM env。""" monkeypatch.setenv("APS_FALLBACK_DIR", str(tmp_path / "fb")) monkeypatch.setenv("APS_FEATURES_PATH", str(tmp_path / "features.json")) monkeypatch.setenv("APS_FALLBACK_HIGHRISK_PATH", str(tmp_path / "fallback-highrisk.json")) monkeypatch.delenv("LLM_API_KEY", raising=False) monkeypatch.delenv("LLM_BASE_URL", raising=False) monkeypatch.delenv("LLM_MODEL", raising=False) monkeypatch.delenv("LLM_PROVIDER", raising=False) reset_provider() from server.state import checkpoints as _cp_mod from server.state import store as _store_mod kept_scoped = dict(_store_mod._stores) # scoped 仓注册表快照（防跨测试泄漏） kept_cps = dict(_cp_mod._checkpoints) # checkpoint 仓注册表快照（同上） yield _store_mod._stores.clear() _store_mod._stores.update(kept_scoped) _cp_mod._checkpoints.clear() _cp_mod._checkpoints.update(kept_cps) reset_provider() class FakeStore: """与 test_fallback_execute 同款：挂 .checkpoints 注入点；restore 深拷贝整体替换。""" _KIND_TABLE: ClassVar[dict[str, str]] = { "salesOrder": "salesOrders", "material": "materials", "audit": "auditEvents", "importBatch": "importBatches"} def __init__(self, tmp_path: Path): self.data = seed_world() self._counters: dict[str, int] = {} self.tenant_uuid = "platform" self.world_key = "default" self.path = str(tmp_path / "world.json") # get_checkpoints/get_plan_store 取目录用 self.checkpoints = CheckpointStore(str(tmp_path / "checkpoints.json")) def next_id(self, kind: str) -> int: if kind not in self._counters: table = self._KIND_TABLE.get(kind) self._counters[kind] = max( (x.get("id", 0) for x in self.data.get(table, []) if isinstance(x.get("id"), int)), default=0) if table else 0 self._counters[kind] += 1 return self._counters[kind] def save(self) -> None: pass def restore(self, world: dict) -> None: self.data = copy.deepcopy(world) self._counters.clear() def _bind_personal_world(store: FakeStore, user_id: int) -> None: """身份绑定场景下把 FakeStore 注入 scoped 仓注册表（personal-{uid}）。 绑定身份后出卡记录的 worldKey=personal-{uid}，resolve_confirmation_store 会绕过测试仓直接解析 scoped 仓（审计/漂移比对落到别的世界）——注入后 出卡指纹捕获、执行端解析、审计落链全部回到本测试仓。 """ from server.state import store as store_mod store.world_key = f"personal-{user_id}" store_mod._stores[("platform", store.world_key)] = store def _cfg(tmp_path: Path, **kw) -> fallback_lane.FallbackConfig: return fallback_lane.FallbackConfig(pi_home=str(tmp_path / "pi-home"), **kw) def _write_features(tmp_path: Path, features: dict) -> None: (tmp_path / "features.json").write_text( json.dumps({"version": 1, "features": features}, ensure_ascii=False), encoding="utf-8") def _write_whitelist(tmp_path: Path, doc) -> None: path = tmp_path / "fallback-highrisk.json" if isinstance(doc, str): path.write_text(doc, encoding="utf-8") # 损坏形态直接写原文 else: path.write_text(json.dumps(doc, ensure_ascii=False), encoding="utf-8") def _wl_doc(*, s4=True, s6=True, s7=True, s6_intents=None, s6_max=None, s7_roles=("ops", "admin")) -> dict: scenarios = { "S4": {"enabled": s4, "intents": ["flex.simulate_due", "flex.compare", "scenario.compare", "scenario.sensitivity"], "roles": ["planner", "admin"]}, "S6": {"enabled": s6, "intents": list(s6_intents or ["mes.report"]), "roles": ["planner", "admin"]}, "S7": {"enabled": s7, "intents": ["agent.fallback.ops.config.apply", "agent.fallback.policy.update"], "roles": list(s7_roles)}, } if s6_max is not None: scenarios["S6"]["maxItemsPerRun"] = s6_max return {"whitelistVersion": 1, "updatedAt": "2026-09-04T10:00:00", "updatedBy": "test", "scenarios": scenarios} def _intent(query: str, name: str = "unknown", **params) -> IntentResult: return IntentResult(intent=name, params={"query": query, **params}, confidence=0.1, source="LLM") def _fp(world: dict) -> str: return harness.world_fingerprint(world) @contextlib.contextmanager def _as(user_id: int, *roles: str): """bind_identity 绑角色（test_approval_role_policies.py `_as` 先例）。""" token = bind_identity(IdentityContext( user_id, f"user-{user_id}", f"User {user_id}", "platform", roles=tuple(roles))) try: yield finally: reset_identity(token) def _run_dir_of(tmp_path: Path) -> Path: runs = [p for p in (tmp_path / "fb").iterdir() if p.is_dir() and p.name != "pi-home"] assert len(runs) == 1 return runs[0] def _pending_record(confirm_id: str) -> dict: return harness._approval_store.pending[confirm_id] def make_plan_runner(plan_builder, report: str = "status: success\n\n已生成执行计划。"): """propose 段 fake runner：先写 outbox/plan.json，再 stop 报告。""" def runner(task: str, work_dir: Path): run_dir = work_dir.parent plan = plan_builder(run_dir) if plan is not None: (run_dir / "outbox").mkdir(parents=True, exist_ok=True) (run_dir / "outbox" / "plan.json").write_text( json.dumps(plan, ensure_ascii=False), encoding="utf-8") yield {"type": "message_end", "message": {"role": "assistant", "stopReason": "stop", "content": [{"type": "text", "text": report}]}} yield {"type": "agent_end", "messages": []} return runner def _stop_runner(task: str, work_dir: Path): """只产 stop 报告的 fake runner（对账叙事段 / 只读诊断用）。""" yield {"type": "message_end", "message": {"role": "assistant", "stopReason": "stop", "content": [{"type": "text", "text": "status: success\n\n建议人工核对差异项。"}]}} yield {"type": "agent_end", "messages": []} async def _stage(store: FakeStore, tmp_path: Path, runner, query: str = "把这份客户表格导进来"): """propose 出卡辅助：返回 (reply, confirm_id_list)。""" reply = await fallback_lane.propose_reply( store, "s1", _intent(query), runner=runner, config=_cfg(tmp_path)) confirm_ids = [] if reply is not None and getattr(reply, "blocks", None): confirm_ids = [b.props["confirmId"] for b in reply.blocks if getattr(b, "type", "") == "confirm-card"] return reply, confirm_ids def _approve(store: FakeStore, confirm_id: str, *, approve: bool = True, actor: str = "tester") -> str: return execute_confirmed(store, confirm_id, approve=approve, actor=actor) # -- S6 世界与 MES 镜像种子 ---------------------------------------------------- def _seed_s6_world(store: FakeStore, items: list[tuple]) -> None: """items: (wo_id, ext_id, status, progressPct, qtyDone) → workOrders + mesLinks。""" store.data.setdefault("workOrders", []) store.data.setdefault("mesLinks", []) for wo_id, ext_id, status, pct, qty in items: store.data["workOrders"].append({ "id": wo_id, "mesExternalId": ext_id, "status": status, "progressPct": pct, "qtyDone": qty, "productCode": DEMO_PRODUCT}) store.data["mesLinks"].append({ "kind": "dispatch", "woId": wo_id, "externalWoId": ext_id, "idemKey": f"idem-{wo_id}"}) def _seed_mes_mirror(tmp_path: Path, monkeypatch, count: int): """MockMesClient 指 tmp 镜像并造 count 张外部工单（monkeypatch 自动还原，零仓库污染）。""" from server.integrations import mes_stub from server.integrations.mes_stub import MockMesClient client = MockMesClient(tmp_path / "mes_mirror.json") monkeypatch.setattr(mes_stub, "_client", client) for i in range(count): client.create_work_order({"productCode": DEMO_PRODUCT}, idem_key=f"idem-m-{i}") return client # 外部工单号 MES-WO-0001..000n def _s6_plan(items: list[dict]) -> dict: """S6 补录计划：每项一个 frozen mes.report 步（params 内联，track=fixed）。""" return {"planVersion": 1, "scenario": "S6", "goal": "MES 断连补录", "steps": [{"seq": i + 1, "mode": "frozen", "intent": "mes.report", "summary": f"补录工单 {p['woId']}", "params": p, "constraints": {}, "expected": []} for i, p in enumerate(items)]} def _s4_plan(steps: list[dict] | None = None) -> dict: return {"planVersion": 1, "scenario": "S4", "goal": "缺策略沙盒试排", "steps": steps or [{ "seq": 1, "mode": "frozen", "intent": "flex.simulate_due", "summary": "交期探测", "constraints": {}, "params": {"productCode": DEMO_PRODUCT, "quantity": 10}, "expected": [{"sandboxOutput": "乐观/预计/悲观完工时间"}], }]} def _world_write_audits(store: FakeStore) -> list[dict]: return [e for e in store.data.get("auditEvents", []) if e.get("category") == "WORLD_WRITE"] # --------------------------------------------------------------------------- # H-1：白名单文件缺失 → fail-closed 全拒；S6 计划出卡拒绝（显式「白名单文件缺失」） # --------------------------------------------------------------------------- async def test_whitelist_missing_file_denies_all(tmp_path): _write_features(tmp_path, {"fallback": True}) store = FakeStore(tmp_path) fp_before = _fp(store.data) loaded = fallback_highrisk.load_highrisk_whitelist() assert loaded["ok"] is False assert "白名单文件缺失" in loaded["error"] reply, confirm_ids = await _stage( store, tmp_path, make_plan_runner(lambda rd: _s6_plan([{"woId": 1, "progressPct": 50, "track": "fixed"}])), query="MES 连不上了帮我补录") assert confirm_ids == [] # 未生成确认卡 assert "未通过校验" in reply.text assert "白名单文件缺失" in reply.text assert _fp(store.data) == fp_before # 世界零变更 # --------------------------------------------------------------------------- # H-2：白名单 JSON 损坏 → 全拒 + error 显式；S4/S6/S7 计划均拒绝出卡 # --------------------------------------------------------------------------- async def test_whitelist_corrupt_json_denies_all(tmp_path): _write_features(tmp_path, {"fallback": True}) _write_whitelist(tmp_path, "{not a json") store = FakeStore(tmp_path) loaded = fallback_highrisk.load_highrisk_whitelist() assert loaded["ok"] is False assert "JSON 解析失败" in loaded["error"] for plan in ( _s4_plan(), _s6_plan([{"woId": 1, "progressPct": 50, "track": "fixed"}]), {"planVersion": 1, "scenario": "S7", "goal": "x", "steps": [{"seq": 1, "mode": "frozen", "intent": "agent.fallback.policy.update", "params": {"scenario": "S6", "addIntents": ["mes.report"]}, "constraints": {}}]}, ): with pytest.raises(fallback_lane.PlanError, match="JSON 解析失败"): fallback_lane.validate_plan(plan, tmp_path, world=store.data) # --------------------------------------------------------------------------- # H-3：未知场景键 → 整个文件判损坏全拒（不是忽略未知键——与 features.json 相反） # --------------------------------------------------------------------------- def test_whitelist_unknown_scenario_key_denies_all(tmp_path): doc = _wl_doc() doc["scenarios"]["S99"] = {"enabled": True, "intents": [], "roles": ["admin"]} _write_whitelist(tmp_path, doc) loaded = fallback_highrisk.load_highrisk_whitelist() assert loaded["ok"] is False assert "S99" in loaded["error"] assert loaded["grants"] == {} # 全拒，不做局部放行 assert fallback_highrisk.intent_allowed(loaded, "S6", "mes.report") is False # --------------------------------------------------------------------------- # H-4：场景段含未知字段 → 全拒 + error 带 offending key # --------------------------------------------------------------------------- def test_whitelist_unknown_field_denies_all(tmp_path): doc = _wl_doc() doc["scenarios"]["S6"]["backdoor"] = True _write_whitelist(tmp_path, doc) loaded = fallback_highrisk.load_highrisk_whitelist() assert loaded["ok"] is False assert "backdoor" in loaded["error"] # --------------------------------------------------------------------------- # H-5：intents 引用未在 _POWER_MAP 登记的意图 → 全拒 + error 带 intent 名 # --------------------------------------------------------------------------- def test_whitelist_unregistered_intent_denies_all(tmp_path): doc = _wl_doc() doc["scenarios"]["S6"]["intents"] = ["mes.report", "order.explode"] _write_whitelist(tmp_path, doc) loaded = fallback_highrisk.load_highrisk_whitelist() assert loaded["ok"] is False assert "order.explode" in loaded["error"] # --------------------------------------------------------------------------- # H-6：S6.enabled=false → S6 计划拒绝（「未在白名单启用」）；S4 不受影响（场景隔离） # --------------------------------------------------------------------------- async def test_whitelist_disabled_scenario_refuses_plan(tmp_path): _write_features(tmp_path, {"fallback": True}) _write_whitelist(tmp_path, _wl_doc(s6=False)) store = FakeStore(tmp_path) _seed_s6_world(store, [(9001, "MES-WO-0001", "RUNNING", 0, 0)]) reply, confirm_ids = await _stage( store, tmp_path, make_plan_runner(lambda rd: _s6_plan([{"woId": 9001, "progressPct": 80, "track": "fixed"}])), query="MES 连不上了帮我补录") assert confirm_ids == [] assert "未在白名单启用" in reply.text # 场景隔离：S4 计划照常出卡 reply_s4, confirm_s4 = await _stage( store, tmp_path, make_plan_runner(lambda rd: _s4_plan()), query="这个工艺没有现成策略，帮我试几个思路") assert len(confirm_s4) == 1 assert "沙盒" in reply_s4.blocks[0].props["summary"][-2] \ or any("不改动任何正式数据" in line for line in reply_s4.blocks[0].props["summary"]) # --------------------------------------------------------------------------- # H-7：白名单 ok 但场景 intents 不含该意图 → 整计划拒绝（P2 T-3 语义的白名单版） # --------------------------------------------------------------------------- async def test_p3_intent_not_in_whitelist_refused(tmp_path): _write_features(tmp_path, {"fallback": True}) _write_whitelist(tmp_path, _wl_doc()) # S6.intents 只有 mes.report store = FakeStore(tmp_path) def bad_plan(run_dir: Path) -> dict: return {"planVersion": 1, "scenario": "S6", "goal": "x", "steps": [{"seq": 1, "mode": "frozen", "intent": "mes.dispatch", "params": {"versionId": 1}, "constraints": {}}]} reply, confirm_ids = await _stage( store, tmp_path, make_plan_runner(bad_plan), query="MES 连不上了") assert confirm_ids == [] assert "未通过校验" in reply.text assert "未列入 S6 白名单放行集" in reply.text # --------------------------------------------------------------------------- # H-8：白名单文件缺失时 P2 存量路径零影响（向后兼容核心断言） # --------------------------------------------------------------------------- async def test_p2_scenarios_unaffected_by_whitelist(tmp_path): _write_features(tmp_path, {"fallback": True}) store = FakeStore(tmp_path) # 白名单文件不存在 rows = [{"customerName": "锐扬精密", "productCode": DEMO_PRODUCT, "quantity": 10, "deliveryDate": "2026-09-20", "orderNo": "RY-9001"}] def p2_plan(run_dir: Path) -> dict: return {"planVersion": 1, "scenario": "S3", "goal": "导入订单", "steps": [{"seq": 1, "mode": "frozen", "intent": "import.commit", "summary": "导入订单批 1 行", "params": {"batches": [{"kind": "orders", "rows": rows}]}, "constraints": {"kinds": ["orders"], "maxRows": 500}, "expected": [{"table": "salesOrders", "added": 1}]}]} reply, confirm_ids = await _stage(store, tmp_path, make_plan_runner(p2_plan)) assert len(confirm_ids) == 1 # P2 照常出卡 assert reply.blocks[0].props["action"] == "agent.fallback.execute" assert reply.blocks[0].props["power"] == "P2" # --------------------------------------------------------------------------- # H-9：出卡后白名单变更 → 执行拒绝（双端 sha256 比对）；零写入；DENIED 审计 # --------------------------------------------------------------------------- async def test_whitelist_changed_between_stage_and_execute_denied(tmp_path, monkeypatch): _write_features(tmp_path, {"fallback": True}) _write_whitelist(tmp_path, _wl_doc()) store = FakeStore(tmp_path) _seed_mes_mirror(tmp_path, monkeypatch, 1) _seed_s6_world(store, [(9001, "MES-WO-0001", "RUNNING", 0, 0)]) _reply, confirm_ids = await _stage( store, tmp_path, make_plan_runner(lambda rd: _s6_plan([{"woId": 9001, "progressPct": 80, "track": "fixed"}])), query="MES 连不上了帮我补录") assert len(confirm_ids) == 1 fp_before = _fp(store.data) # 审批窗口内白名单被改（收窄角色——内容变化即指纹变化） changed = _wl_doc() changed["scenarios"]["S6"]["roles"] = ["admin"] _write_whitelist(tmp_path, changed) message = _approve(store, confirm_ids[0]) assert "白名单在审批窗口内已变更" in message assert _fp(store.data) == fp_before # 零写入 audits = [e for e in _world_write_audits(store) if e.get("action") == "agent.fallback.execute"] assert audits[-1]["result"] == "DENIED" # --------------------------------------------------------------------------- # H-10：S4 沙盒计划执行——沙盒函数被调、前后指纹相等、零 WORLD_WRITE、报告生成 # --------------------------------------------------------------------------- async def test_s4_sandbox_plan_executes_with_no_main_writes(tmp_path): _write_features(tmp_path, {"fallback": True}) _write_whitelist(tmp_path, _wl_doc()) store = FakeStore(tmp_path) audits_before = len(store.data.get("auditEvents") or []) reply, confirm_ids = await _stage( store, tmp_path, make_plan_runner(lambda rd: _s4_plan()), query="这个工艺没有现成策略，帮我试几个思路") assert len(confirm_ids) == 1 # 卡片含「不改动任何正式数据」尾行 assert any("不改动任何正式数据" in line for line in reply.blocks[0].props["summary"]) fp_before = _fp(store.data) message = _approve(store, confirm_ids[0]) assert "沙盒试排已完成" in message run_dir = _run_dir_of(tmp_path) # 沙盒函数被调：输出落盘 + execution.jsonl 记录 step_out = run_dir / "outbox" / "sandbox-steps" / "step-1.json" assert step_out.is_file() assert json.loads(step_out.read_text(encoding="utf-8")) # 输出是合法 JSON assert (run_dir / "outbox" / "sandbox-report.md").is_file() assert "未改动任何正式数据" in (run_dir / "outbox" / "sandbox-report.md") \ .read_text(encoding="utf-8") # 前后世界指纹相等（append-only 审计键不影响指纹） assert _fp(store.data) == fp_before exec_audits = [e for e in store.data.get("auditEvents", []) if e.get("action") == "agent.fallback.execute" and e.get("category") == "WORLD_WRITE"] assert exec_audits[-1]["result"] == "SUCCESS" # 执行区间零 WORLD_WRITE（除执行成功总账本身——其动作即 agent.fallback.execute 一条） run_audits = [e for e in store.data.get("auditEvents", [])[audits_before:] if e.get("category") == "WORLD_WRITE"] assert len(run_audits) == 1 # 仅 workflow 分支的成功总账 # --------------------------------------------------------------------------- # H-11：S4 计划混入写意图（import.commit）→ 出卡拒绝 # --------------------------------------------------------------------------- async def test_s4_plan_with_write_intent_refused(tmp_path): _write_features(tmp_path, {"fallback": True}) _write_whitelist(tmp_path, _wl_doc()) store = FakeStore(tmp_path) def bad_plan(run_dir: Path) -> dict: return _s4_plan([{ "seq": 1, "mode": "frozen", "intent": "import.commit", "summary": "x", "constraints": {}, "params": {"batches": []}, "expected": []}]) reply, confirm_ids = await _stage( store, tmp_path, make_plan_runner(bad_plan), query="帮我试几个思路") assert confirm_ids == [] assert "未通过校验" in reply.text assert "未列入 S4 白名单放行集" in reply.text # --------------------------------------------------------------------------- # H-12：S4 步 expected 含世界变化字段 → validate_plan 拒绝（只许 sandboxOutput 形态） # --------------------------------------------------------------------------- async def test_s4_expected_world_change_fields_refused(tmp_path): _write_features(tmp_path, {"fallback": True}) _write_whitelist(tmp_path, _wl_doc()) store = FakeStore(tmp_path) def bad_plan(run_dir: Path) -> dict: return _s4_plan([{ "seq": 1, "mode": "frozen", "intent": "flex.simulate_due", "summary": "x", "constraints": {}, "params": {"productCode": DEMO_PRODUCT, "quantity": 10}, "expected": [{"table": "workOrders", "added": 1}]}]) reply, confirm_ids = await _stage( store, tmp_path, make_plan_runner(bad_plan), query="帮我试几个思路") assert confirm_ids == [] assert "sandboxOutput" in reply.text # --------------------------------------------------------------------------- # H-13：S6 逐笔多卡——3 项 → 3 张独立卡；逐张批准逐笔落账；拒绝第 2 张不影响 1/3 # --------------------------------------------------------------------------- async def test_s6_backlog_per_item_cards(tmp_path, monkeypatch): _write_features(tmp_path, {"fallback": True}) _write_whitelist(tmp_path, _wl_doc()) store = FakeStore(tmp_path) _seed_mes_mirror(tmp_path, monkeypatch, 3) _seed_s6_world(store, [ (9001, "MES-WO-0001", "RUNNING", 0, 0), (9002, "MES-WO-0002", "RUNNING", 0, 0), (9003, "MES-WO-0003", "RUNNING", 0, 0), ]) items = [{"woId": 9001, "progressPct": 80, "track": "fixed"}, {"woId": 9002, "progressPct": 60, "track": "fixed"}, {"woId": 9003, "finish": True, "track": "fixed"}] _reply, confirm_ids = await _stage( store, tmp_path, make_plan_runner(lambda rd: _s6_plan(items)), query="MES 连不上了，今天的报工帮我补一下") assert len(confirm_ids) == 3 # 3 张独立 confirm-card assert len(set(confirm_ids)) == 3 fingerprints = {_pending_record(cid)["params"]["planFingerprint"] for cid in confirm_ids} assert len(fingerprints) == 3 # 独立计划指纹 # 逐张批准 1/3 → 逐笔落账 + 独立 checkpoint 对 msg1 = _approve(store, confirm_ids[0]) msg3 = _approve(store, confirm_ids[2]) assert "执行完成" in msg1 and "执行完成" in msg3 wos = {w["id"]: w for w in store.data["workOrders"]} assert wos[9001]["progressPct"] == 80 assert wos[9003]["status"] == "COMPLETED" # 第 2 张拒绝 → 不影响 1/3 已落账结果 msg2 = _approve(store, confirm_ids[1], approve=False) assert "已驳回" in msg2 assert wos[9002]["progressPct"] == 0 # 未落账 assert wos[9001]["progressPct"] == 80 # 已补的就是事实 # 每张批准的卡独立 checkpoint 对（审计 rationale 含 cpAfter） exec_audits = [e for e in _world_write_audits(store) if e.get("action") == "agent.fallback.execute"] assert len([e for e in exec_audits if e["result"] == "SUCCESS"]) == 2 assert all(e["rationale"].get("cpAfter") for e in exec_audits if e["result"] == "SUCCESS") # --------------------------------------------------------------------------- # H-14：S6 单轮上限——maxItemsPerRun=2，清单 3 项 → 只出 2 卡 + 文案显式声明截断 # --------------------------------------------------------------------------- async def test_s6_backlog_over_max_items_truncated(tmp_path, monkeypatch): _write_features(tmp_path, {"fallback": True}) _write_whitelist(tmp_path, _wl_doc(s6_max=2)) store = FakeStore(tmp_path) _seed_mes_mirror(tmp_path, monkeypatch, 3) _seed_s6_world(store, [ (9001, "MES-WO-0001", "RUNNING", 0, 0), (9002, "MES-WO-0002", "RUNNING", 0, 0), (9003, "MES-WO-0003", "RUNNING", 0, 0), ]) items = [{"woId": w, "progressPct": 50, "track": "fixed"} for w in (9001, 9002, 9003)] reply, confirm_ids = await _stage( store, tmp_path, make_plan_runner(lambda rd: _s6_plan(items)), query="MES 连不上了帮我补录") assert len(confirm_ids) == 2 # 只出 2 卡 assert "剩余 1 笔" in reply.text # 截断显式声明 assert "单轮上限 2" in reply.text # --------------------------------------------------------------------------- # H-15：补录项非法（woId 不存在 / progressPct=120）→ 逐项校验失败不出卡 + 显式原因 # --------------------------------------------------------------------------- async def test_s6_backlog_item_invalid_refused(tmp_path): _write_features(tmp_path, {"fallback": True}) _write_whitelist(tmp_path, _wl_doc()) store = FakeStore(tmp_path) _seed_s6_world(store, [(9001, "MES-WO-0001", "RUNNING", 0, 0)]) reply1, ids1 = await _stage( store, tmp_path, make_plan_runner(lambda rd: _s6_plan([{"woId": 9999, "progressPct": 50, "track": "fixed"}])), query="MES 连不上了帮我补录") assert ids1 == [] assert "不存在" in reply1.text reply2, ids2 = await _stage( store, tmp_path, make_plan_runner(lambda rd: _s6_plan([{"woId": 9001, "progressPct": 120, "track": "fixed"}])), query="MES 连不上了帮我补录") assert ids2 == [] assert "[0,100]" in reply2.text # --------------------------------------------------------------------------- # H-16：恢复后对账——报告结论正确 + manifest 证据冻结 + ALGO_RUN 审计 + 世界零变更 # --------------------------------------------------------------------------- async def test_s6_reconcile_report_and_evidence_frozen(tmp_path, monkeypatch): _write_features(tmp_path, {"fallback": True}) _write_whitelist(tmp_path, _wl_doc()) store = FakeStore(tmp_path) _seed_s6_world(store, [ (9101, "MES-WO-0001", "RUNNING", 50, 5), (9102, "MES-WO-0002", "RUNNING", 50, 5), ]) monkeypatch.setattr(fallback_lane, "_probe_mes_connectivity", lambda: "ok") snapshots = { "MES-WO-0001": {"id": "MES-WO-0001", "status": "RUNNING", "progressPct": 50, "qtyDone": 5}, # MATCH "MES-WO-0002": {"id": "MES-WO-0002", "status": "COMPLETED", "progressPct": 100, "qtyDone": 10}, # DRIFT } monkeypatch.setattr(fallback_lane, "_fetch_external_wo", lambda ext_id: snapshots.get(ext_id)) fp_before = _fp(store.data) reply = await fallback_lane.propose_reply( store, "s1", _intent("MES 恢复了，对一下账", p3Scenario="S6", p3Action="reconcile"), runner=_stop_runner, config=_cfg(tmp_path)) assert reply is not None assert "一致 1" in reply.text and "漂移 1" in reply.text run_dir = _run_dir_of(tmp_path) report = (run_dir / "outbox" / "reconcile-report.md").read_text(encoding="utf-8") assert "| MES-WO-0001 | 9101 | MATCH |" in report assert "| MES-WO-0002 | 9102 | DRIFT |" in report # manifest 含外部响应 sha256（证据链冻结点） manifest = json.loads((run_dir / "outbox" / "reconcile-manifest.json") .read_text(encoding="utf-8")) assert len(manifest["items"]) == 2 for item in manifest["items"]: payload = (run_dir / item["path"]).read_text(encoding="utf-8") assert hashlib.sha256(payload.encode("utf-8")).hexdigest() == item["sha256"] # ALGO_RUN 审计 rationale 含 manifestSha256 recon_audits = [e for e in store.data.get("auditEvents", []) if e.get("action") == "agent.fallback.reconcile"] assert recon_audits and recon_audits[-1]["category"] == "ALGO_RUN" assert recon_audits[-1]["rationale"]["manifestSha256"] assert recon_audits[-1]["rationale"]["domain"] == 2 assert _fp(store.data) == fp_before # 对账纯读：世界零变更 # --------------------------------------------------------------------------- # H-17：probe 仍 failed → 不产对账报告，如实回复「尚未恢复」 # --------------------------------------------------------------------------- async def test_s6_reconcile_blocked_while_still_down(tmp_path, monkeypatch): _write_features(tmp_path, {"fallback": True}) _write_whitelist(tmp_path, _wl_doc()) store = FakeStore(tmp_path) _seed_s6_world(store, [(9101, "MES-WO-0001", "RUNNING", 50, 5)]) monkeypatch.setattr(fallback_lane, "_probe_mes_connectivity", lambda: "failed") fp_before = _fp(store.data) reply = await fallback_lane.propose_reply( store, "s1", _intent("MES 恢复了，对一下账", p3Scenario="S6", p3Action="reconcile"), runner=_stop_runner, config=_cfg(tmp_path)) assert reply is not None assert "尚未恢复" in reply.text assert not (tmp_path / "fb").exists() \ or not any((tmp_path / "fb").iterdir()) # 未建 run 目录 assert _fp(store.data) == fp_before # --------------------------------------------------------------------------- # H-18：非运维角色物理不可见——propose 返回 None（零 run 目录、零审计） # --------------------------------------------------------------------------- async def test_s7_non_ops_role_invisible(tmp_path): _write_features(tmp_path, {"fallback": True}) _write_whitelist(tmp_path, _wl_doc(s7_roles=("ops", "admin"))) store = FakeStore(tmp_path) audits_before = len(store.data.get("auditEvents") or []) with _as(42, "planner"): reply = await fallback_lane.propose_reply( store, "s1", _intent("帮我看下服务日志有没有异常", p3Scenario="S7"), runner=_stop_runner, config=_cfg(tmp_path)) assert reply is None # 物理不可见（走原话术） assert not (tmp_path / "fb").exists() \ or not any((tmp_path / "fb").iterdir()) # 零 run 目录 assert len(store.data.get("auditEvents") or []) == audits_before # 零审计 # --------------------------------------------------------------------------- # H-19：ops 身份只读诊断——inbox/ops/ 四文件 + 脱敏断言 + P1 草稿语义 # --------------------------------------------------------------------------- async def test_s7_ops_readonly_diagnostics(tmp_path, monkeypatch): _write_features(tmp_path, {"fallback": True}) _write_whitelist(tmp_path, _wl_doc()) store = FakeStore(tmp_path) # 预埋含敏感键的日志行 home = tmp_path / "home" (home / "logs").mkdir(parents=True) (home / "logs" / "server.log").write_text( "INFO startup ok\nERROR auth failed token=abc123secret\nINFO done\n", encoding="utf-8") monkeypatch.setenv("APS_HOME", str(home)) fp_before = _fp(store.data) with _as(7, "ops"): reply = await fallback_lane.propose_reply( store, "s1", _intent("帮我看下服务日志和配置有没有异常"), runner=_stop_runner, config=_cfg(tmp_path)) assert reply is not None # P1 草稿报告语义 assert "草稿" in reply.text run_dir = _run_dir_of(tmp_path) ops_dir = run_dir / "inbox" / "ops" for name in ("logs-tail.md", "config-snapshot.md", "health.md", "integrations.md"): assert (ops_dir / name).is_file(), name logs_tail = (ops_dir / "logs-tail.md").read_text(encoding="utf-8") assert "***REDACTED***" in logs_tail # 脱敏生效 assert "abc123secret" not in logs_tail snapshot = (ops_dir / "config-snapshot.md").read_text(encoding="utf-8") assert "features.json" in snapshot assert "fallback-highrisk.json" in snapshot # 白名单裁决投影 assert _fp(store.data) == fp_before # 诊断只读：世界零变更 # --------------------------------------------------------------------------- # H-20：S7 改配置 P3 双人审批链——部分批准 → SOD 拒绝 → 异人二批 → 原子替换 # --------------------------------------------------------------------------- async def test_s7_config_apply_p3_dual_approval_flow(tmp_path): _write_features(tmp_path, {"fallback": True, "orders": True}) _write_whitelist(tmp_path, _wl_doc()) store = FakeStore(tmp_path) _bind_personal_world(store, 1) new_doc = {"version": 1, "features": {"fallback": True, "orders": False}} def s7_plan(run_dir: Path) -> dict: return {"planVersion": 1, "scenario": "S7", "goal": "关闭订单功能", "steps": [{"seq": 1, "mode": "frozen", "intent": "agent.fallback.ops.config.apply", "summary": "替换 features.json", "params": {"file": "features.json", "content": new_doc}, "constraints": {}}]} with _as(1, "admin"): reply, confirm_ids = await _stage( store, tmp_path, make_plan_runner(s7_plan), query="帮我看下配置，把订单功能关掉") assert len(confirm_ids) == 1 cid = confirm_ids[0] block = reply.blocks[0] assert block.props["power"] == "P3" assert block.props["action"] == "agent.fallback.ops.config.apply" # contentSha256/beforeSha256 由编排器机器再生成（不信 Pi 申报） pending = _pending_record(cid) assert pending["params"]["contentSha256"] == \ fallback_highrisk.canonical_sha256(new_doc) assert pending["params"]["beforeSha256"] # 第一次批准 → 部分批准（不执行） with _as(1, "admin"): msg1 = _approve(store, cid) assert "第一重确认已记录" in msg1 features_now = json.loads((tmp_path / "features.json").read_text(encoding="utf-8")) assert features_now["features"]["orders"] is True # 未执行 # 同人二批 → SOD 拒绝 with _as(1, "admin"): msg2 = _approve(store, cid) assert "二次审批必须由另一名用户完成" in msg2 # 不同用户二批 → executionGrant 签发 → 原子替换 + .bak + 双人审计 with _as(2, "admin"): msg3 = _approve(store, cid) assert "原子替换" in msg3 replaced = json.loads((tmp_path / "features.json").read_text(encoding="utf-8")) assert replaced["features"]["orders"] is False assert list(tmp_path.glob("features.json.bak-*")) # 旧文件备份存在 audits = [e for e in _world_write_audits(store) if e.get("action") == "agent.fallback.ops.config.apply"] assert audits[-1]["result"] == "SUCCESS" assert audits[-1]["power"] == "P3" assert audits[-1]["rationale"]["grantId"] assert len(audits[-1]["rationale"]["approvals"]) == 2 assert audits[-1]["rationale"]["beforeSha256"] \ != audits[-1]["rationale"]["afterSha256"] # --------------------------------------------------------------------------- # H-21：改白名单走确认卡——编排器再生成完整文档 + 原子写 + .bak + 漂移拒绝 # --------------------------------------------------------------------------- async def test_policy_update_writes_whitelist_via_card(tmp_path): _write_features(tmp_path, {"fallback": True}) initial = _wl_doc(s6=False, s6_intents=[]) _write_whitelist(tmp_path, initial) store = FakeStore(tmp_path) _bind_personal_world(store, 1) def policy_plan(run_dir: Path) -> dict: return {"planVersion": 1, "scenario": "S7", "goal": "开放 S6 补录", "steps": [{"seq": 1, "mode": "frozen", "intent": "agent.fallback.policy.update", "summary": "S6 加 mes.report 并启用", "params": {"scenario": "S6", "addIntents": ["mes.report"], "enabled": True}, "constraints": {}}]} with _as(1, "admin"): reply, confirm_ids = await _stage( store, tmp_path, make_plan_runner(policy_plan), query="帮我把 mes.report 加进 S6 白名单") assert len(confirm_ids) == 1 cid = confirm_ids[0] assert reply.blocks[0].props["power"] == "P2" # 改白名单 = P2 管理动作 # 编排器再生成完整文档（Pi 只产 diff 声明） document = _pending_record(cid)["params"]["document"] assert document["scenarios"]["S6"]["enabled"] is True assert "mes.report" in document["scenarios"]["S6"]["intents"] assert document["scenarios"]["S4"]["enabled"] is True # 其余场景原样保留 with _as(1, "admin"): message = _approve(store, cid) assert "白名单已更新" in message loaded = fallback_highrisk.load_highrisk_whitelist() assert loaded["ok"] is True assert fallback_highrisk.intent_allowed(loaded, "S6", "mes.report") is True assert list(tmp_path.glob("fallback-highrisk.json.bak-*")) # 旧文件备份 audits = [e for e in _world_write_audits(store) if e.get("action") == "agent.fallback.policy.update"] assert audits[-1]["result"] == "SUCCESS" assert audits[-1]["rationale"]["beforeSha256"] \ != audits[-1]["rationale"]["afterSha256"] # 漂移拒绝：出卡后手改文件 → 执行拒绝 with _as(1, "admin"): _reply2, ids2 = await _stage( store, tmp_path, make_plan_runner(policy_plan), query="帮我把 mes.report 加进 S6 白名单") assert len(ids2) == 1 tampered = fallback_highrisk.load_highrisk_whitelist()["doc"] tampered["updatedBy"] = "hand-edit" # 绕开确认卡的手改（破窗行为） _write_whitelist(tmp_path, tampered) with _as(1, "admin"): message2 = _approve(store, ids2[0]) assert "漂移" in message2 audits2 = [e for e in _world_write_audits(store) if e.get("action") == "agent.fallback.policy.update"] assert audits2[-1]["result"] == "DENIED"