mathiasandClaude Opus 5.5
a6da93332d
Closes #144 (audit line per tools/call) and #145 (origin/written_by stamped on every model-reachable write, surfaced in brain_query/brain_get). Passed pr-gatekeeper after four rounds of adversarial review, verified by execution: #147 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Mathias <mthbqv@gmail.com>
561 lines
24 KiB
Go
561 lines
24 KiB
Go
// ingestion/internal/mcp/tools_notes_test.go
|
|
package mcp_test
|
|
|
|
import (
|
|
"context"
|
|
"crypto/sha256"
|
|
"encoding/hex"
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/mathiasbq/hyperguild/ingestion/internal/audit"
|
|
"github.com/mathiasbq/hyperguild/ingestion/internal/brainstore"
|
|
"github.com/mathiasbq/hyperguild/ingestion/internal/capture"
|
|
"github.com/mathiasbq/hyperguild/ingestion/internal/capturehttp"
|
|
"github.com/mathiasbq/hyperguild/ingestion/internal/classification"
|
|
"github.com/mathiasbq/hyperguild/ingestion/internal/mcp"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// ---- brain#4: brain_read / brain_edit through the JSON-RPC surface --------
|
|
|
|
func newBrainRepo(t *testing.T) string {
|
|
t.Helper()
|
|
dir := t.TempDir()
|
|
require.NoError(t, os.MkdirAll(filepath.Join(dir, ".git"), 0o755))
|
|
require.NoError(t, os.MkdirAll(filepath.Join(dir, "wiki/homelab/facts"), 0o755))
|
|
require.NoError(t, os.WriteFile(filepath.Join(dir, "wiki/homelab/facts/n.md"),
|
|
[]byte("---\ntitle: 'n'\n---\n\nalpha\nbeta\n"), 0o644))
|
|
require.NoError(t, os.WriteFile(filepath.Join(dir, "CLAUDE.md"), []byte("# rules\n"), 0o644))
|
|
return dir
|
|
}
|
|
|
|
func call(t *testing.T, srv *mcp.Server, name string, args map[string]any) map[string]any {
|
|
t.Helper()
|
|
req := httptest.NewRequest(http.MethodPost, "/mcp", body(t, map[string]any{
|
|
"jsonrpc": "2.0", "id": 1, "method": "tools/call",
|
|
"params": map[string]any{"name": name, "arguments": args},
|
|
}))
|
|
rr := httptest.NewRecorder()
|
|
srv.ServeHTTP(rr, req)
|
|
var resp map[string]any
|
|
require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &resp))
|
|
return resp
|
|
}
|
|
|
|
func TestBrainReadAndEdit_RoundTripThroughJSONRPC(t *testing.T) {
|
|
// The Go functions are tested in internal/notes; this pins the transport,
|
|
// because a tool that works in-process and is unreachable over JSON-RPC
|
|
// is indistinguishable from a working one in a unit test.
|
|
dir := newBrainRepo(t)
|
|
srv := mcp.NewServer(dir, nil, nil, nil)
|
|
|
|
resp := call(t, srv, "brain_read", map[string]any{"path": "wiki/homelab/facts/n.md"})
|
|
require.NotContains(t, resp, "error", "%v", resp["error"])
|
|
|
|
resp = call(t, srv, "brain_edit", map[string]any{
|
|
"path": "wiki/homelab/facts/n.md", "old_str": "beta", "new_str": "BETA",
|
|
})
|
|
require.NotContains(t, resp, "error", "%v", resp["error"])
|
|
|
|
got, err := os.ReadFile(filepath.Join(dir, "wiki/homelab/facts/n.md"))
|
|
require.NoError(t, err)
|
|
// Only the matched bytes change in the body; the one deliberate addition
|
|
// is the editor's provenance stamp (hyperguild#145 — no principal here,
|
|
// so origin: unknown).
|
|
assert.Equal(t, "---\ntitle: 'n'\norigin: unknown\n---\n\nalpha\nBETA\n", string(got),
|
|
"only the matched bytes and the provenance stamp may change")
|
|
}
|
|
|
|
func TestBrainEdit_EmptyOldStrErrorNamesRawArgumentBytes(t *testing.T) {
|
|
// hyperguild#115: a session reported "old_str is empty" with an old_str
|
|
// that, on their end, was never empty. The server-side path was
|
|
// unreachable to reproduce (verified separately: a fresh brain_edit call
|
|
// with real content round-trips cleanly), which points at something
|
|
// between a specific client and this call losing the field. The fix this
|
|
// issue actually asked for isn't a behavior change — old_str=="" must
|
|
// still refuse — it's that the refusal should say how many raw argument
|
|
// bytes it received, so "client sent empty" is distinguishable from
|
|
// "server received empty after some hop lost it" without a second
|
|
// session's worth of guessing.
|
|
dir := newBrainRepo(t)
|
|
srv := mcp.NewServer(dir, nil, nil, nil)
|
|
|
|
resp := call(t, srv, "brain_edit", map[string]any{
|
|
"path": "wiki/homelab/facts/n.md", "old_str": "", "new_str": "BETA",
|
|
})
|
|
errMsg, ok := resp["error"].(map[string]any)["message"].(string)
|
|
require.True(t, ok, "%v", resp)
|
|
assert.Contains(t, errMsg, "old_str is empty")
|
|
assert.Contains(t, errMsg, "raw arguments were", "%v", errMsg)
|
|
}
|
|
|
|
func TestBrainEdit_RejectsAnInvalidClaimEnvelopeWrittenViaStringReplace(t *testing.T) {
|
|
// hyperguild#123: brain_write/brain_update both validate the claim
|
|
// envelope (half_life/applies/claim_provenance) before writing —
|
|
// brain_edit didn't, even though it's the one live, model-facing path
|
|
// that can rewrite an existing envelope line directly via raw string
|
|
// replace, no parsing involved. "same rules when a note changes as when
|
|
// it's born" (hyperguild#111's own framing) applies here too.
|
|
dir := newBrainRepo(t)
|
|
note := filepath.Join(dir, "wiki/homelab/facts/n.md")
|
|
require.NoError(t, os.WriteFile(note,
|
|
[]byte("---\ntitle: 'n'\nhalf_life: durable\napplies: universal\nclaim_provenance: asserted\n---\n\nbody\n"), 0o644))
|
|
srv := mcp.NewServer(dir, nil, nil, nil)
|
|
|
|
resp := call(t, srv, "brain_edit", map[string]any{
|
|
"path": "wiki/homelab/facts/n.md", "old_str": "claim_provenance: asserted", "new_str": "claim_provenance: guessed",
|
|
})
|
|
require.Contains(t, resp, "error", "%v", resp)
|
|
|
|
got, err := os.ReadFile(note)
|
|
require.NoError(t, err)
|
|
assert.Contains(t, string(got), "claim_provenance: asserted", "rejected edit must leave the note byte-identical")
|
|
}
|
|
|
|
func TestBrainEdit_RejectsAValueOnlyEditThatBreaksTheEnvelope(t *testing.T) {
|
|
// Found in review: the original gate (touchesClaimEnvelope) checked
|
|
// whether old_str/new_str mention the FIELD NAME — but a minimal diff
|
|
// (the natural shape of any real edit, model-generated or human) can
|
|
// target just the VALUE token and never mention the field name at all.
|
|
// "asserted" -> "guessed" on a claim_provenance line walked straight
|
|
// past the field-name substring check and wrote an invalid enum value
|
|
// with no error — the exact bypass #123 was supposed to close, closed
|
|
// in name only.
|
|
dir := newBrainRepo(t)
|
|
note := filepath.Join(dir, "wiki/homelab/facts/n.md")
|
|
require.NoError(t, os.WriteFile(note,
|
|
[]byte("---\ntitle: 'n'\nhalf_life: durable\napplies: universal\nclaim_provenance: asserted\n---\n\nbody\n"), 0o644))
|
|
srv := mcp.NewServer(dir, nil, nil, nil)
|
|
|
|
resp := call(t, srv, "brain_edit", map[string]any{
|
|
"path": "wiki/homelab/facts/n.md", "old_str": "asserted", "new_str": "guessed",
|
|
})
|
|
require.Contains(t, resp, "error", "%v", resp)
|
|
|
|
got, err := os.ReadFile(note)
|
|
require.NoError(t, err)
|
|
assert.Contains(t, string(got), "claim_provenance: asserted", "rejected edit must leave the note byte-identical")
|
|
}
|
|
|
|
func TestBrainEdit_RejectsAnOldStrThatCrossesTheClosingFence(t *testing.T) {
|
|
// Found in round-2 review: the position-based gate required old_str to
|
|
// be fully CONTAINED in the extracted frontmatter block (which excludes
|
|
// both "---" fence lines). An old_str disambiguated by extending past
|
|
// the closing fence into the body — a natural choice, since notes.Edit
|
|
// requires old_str to be unique in the file — fails that containment
|
|
// test, so checkClaimEnvelope skips validation entirely while
|
|
// notes.Edit still applies the replace verbatim. Same invalid-enum
|
|
// outcome as the original two bypasses, reached a third way.
|
|
dir := newBrainRepo(t)
|
|
note := filepath.Join(dir, "wiki/homelab/facts/n.md")
|
|
require.NoError(t, os.WriteFile(note,
|
|
[]byte("---\ntitle: 'n'\nhalf_life: durable\napplies: universal\nclaim_provenance: asserted\n---\n\nbody\n"), 0o644))
|
|
srv := mcp.NewServer(dir, nil, nil, nil)
|
|
|
|
resp := call(t, srv, "brain_edit", map[string]any{
|
|
"path": "wiki/homelab/facts/n.md",
|
|
"old_str": "asserted\n---\n\nbody",
|
|
"new_str": "guessed\n---\n\nbody",
|
|
})
|
|
require.Contains(t, resp, "error", "%v", resp)
|
|
|
|
got, err := os.ReadFile(note)
|
|
require.NoError(t, err)
|
|
assert.Contains(t, string(got), "claim_provenance: asserted", "rejected edit must leave the note byte-identical")
|
|
}
|
|
|
|
func TestBrainEdit_RejectsAnEditThatRemovesTheClosingFence(t *testing.T) {
|
|
// Found in round-3 review: checkClaimEnvelope always validates the
|
|
// resulting frontmatter of `after` — but an edit whose new_str drops
|
|
// the closing "---" degrades `after` to "unfenced" in the same call.
|
|
// frontmatterBlock(after) then returns ok=false, frontmatterScalars
|
|
// returns an empty map, and claim.ValidateEnvelope({}) is nil by
|
|
// design (absent fields are valid) — so an invalid enum value lands on
|
|
// disk with zero error, and the note is left permanently unfenced.
|
|
// Structural fix: a note that had a valid fence before the edit must
|
|
// still have one after, or the edit is rejected outright.
|
|
dir := newBrainRepo(t)
|
|
note := filepath.Join(dir, "wiki/homelab/facts/n.md")
|
|
require.NoError(t, os.WriteFile(note,
|
|
[]byte("---\ntitle: 'n'\nhalf_life: durable\napplies: universal\nclaim_provenance: asserted\n---\n\nbody\n"), 0o644))
|
|
srv := mcp.NewServer(dir, nil, nil, nil)
|
|
|
|
resp := call(t, srv, "brain_edit", map[string]any{
|
|
"path": "wiki/homelab/facts/n.md",
|
|
"old_str": "claim_provenance: asserted\n---\n",
|
|
"new_str": "claim_provenance: not-a-real-value\n",
|
|
})
|
|
require.Contains(t, resp, "error", "%v", resp)
|
|
|
|
got, err := os.ReadFile(note)
|
|
require.NoError(t, err)
|
|
assert.Contains(t, string(got), "claim_provenance: asserted\n---\n", "rejected edit must leave the note byte-identical, fence intact")
|
|
}
|
|
|
|
func TestBrainEdit_RejectsAnInvalidEnvelopeOnACRLFFencedNote(t *testing.T) {
|
|
// Found in round-4 review: frontmatterBlock's fence detection matches
|
|
// the literal byte sequence "---\n" / "\n---\n". A note whose fence
|
|
// lines use CRLF ("---\r\n") fails strings.HasPrefix(doc, "---\n") on
|
|
// the BEFORE read, so hadFence is false — not because the fence is
|
|
// missing, but because \r sits in front of every \n. hadFence&&!hasFence
|
|
// can then never fire, frontmatterScalars falls back to an empty map,
|
|
// and claim.ValidateEnvelope({}) is nil by design. No adversarial
|
|
// old_str/new_str crafting needed: encoding alone silently disables the
|
|
// whole envelope check for this note. Zero CRLF-fenced notes exist in
|
|
// the live corpus today, but nothing in the code prevents one.
|
|
dir := newBrainRepo(t)
|
|
note := filepath.Join(dir, "wiki/homelab/facts/n.md")
|
|
require.NoError(t, os.WriteFile(note,
|
|
[]byte("---\r\ntitle: 'n'\r\nhalf_life: durable\r\napplies: universal\r\nclaim_provenance: asserted\r\n---\r\n\r\nbody\r\n"), 0o644))
|
|
srv := mcp.NewServer(dir, nil, nil, nil)
|
|
|
|
resp := call(t, srv, "brain_edit", map[string]any{
|
|
"path": "wiki/homelab/facts/n.md", "old_str": "asserted", "new_str": "guessed",
|
|
})
|
|
require.Contains(t, resp, "error", "%v", resp)
|
|
|
|
got, err := os.ReadFile(note)
|
|
require.NoError(t, err)
|
|
assert.Contains(t, string(got), "claim_provenance: asserted", "rejected edit must leave the note byte-identical")
|
|
}
|
|
|
|
func TestBrainEdit_RejectsAnInvalidEnvelopeOnABOMPrefixedNote(t *testing.T) {
|
|
// Found in round-5 review: the same "encoding property empties
|
|
// frontmatterScalars's map" mechanism as the CRLF bypass, one layer
|
|
// earlier — a leading UTF-8 BOM (EF BB BF) defeats
|
|
// strings.HasPrefix(doc, "---\n") exactly like CRLF did, before that
|
|
// prefix is even reached. Notepad's default "UTF-8" save and
|
|
// PowerShell's pre-v6 Out-File/Set-Content both emit a BOM, so this is
|
|
// a live, plausible authoring path, not an exotic one — same severity
|
|
// and same one-line cost as the CRLF fix, fixed the same way rather
|
|
// than deferred to hyperguild#138.
|
|
dir := newBrainRepo(t)
|
|
note := filepath.Join(dir, "wiki/homelab/facts/n.md")
|
|
require.NoError(t, os.WriteFile(note,
|
|
[]byte("\xef\xbb\xbf---\ntitle: 'n'\nhalf_life: durable\napplies: universal\nclaim_provenance: asserted\n---\n\nbody\n"), 0o644))
|
|
srv := mcp.NewServer(dir, nil, nil, nil)
|
|
|
|
resp := call(t, srv, "brain_edit", map[string]any{
|
|
"path": "wiki/homelab/facts/n.md", "old_str": "asserted", "new_str": "guessed",
|
|
})
|
|
require.Contains(t, resp, "error", "%v", resp)
|
|
|
|
got, err := os.ReadFile(note)
|
|
require.NoError(t, err)
|
|
assert.Contains(t, string(got), "claim_provenance: asserted", "rejected edit must leave the note byte-identical")
|
|
}
|
|
|
|
func TestBrainEdit_RejectsAFoldedScalarThatHidesAnInvalidValue(t *testing.T) {
|
|
// Found in round-6 review: a different mechanism from the encoding
|
|
// family (rounds 1-6 were all about fence detection; this is the field
|
|
// extractor). old_str="half_life: durable", new_str="half_life:\n
|
|
// garbage-value" turns the field into a YAML block-scalar shape: the
|
|
// top-level line is now "half_life:" with an empty inline value, and
|
|
// the real value lives on the indented continuation line that follows.
|
|
// frontmatterScalars's indentation guard skips that continuation line
|
|
// outright, so the field reads as present-with-empty-value —
|
|
// present()'s own contract then treats that as absent (a placeholder,
|
|
// not an assertion) — and claim.ValidateEnvelope never sees the
|
|
// invalid value at all. No encoding quirk needed: one ordinary
|
|
// brain_edit call smuggles an out-of-enum value straight past the
|
|
// check the field was supposed to be validated by.
|
|
dir := newBrainRepo(t)
|
|
note := filepath.Join(dir, "wiki/homelab/facts/n.md")
|
|
require.NoError(t, os.WriteFile(note,
|
|
[]byte("---\ntitle: 'n'\nhalf_life: durable\napplies: universal\nclaim_provenance: asserted\n---\n\nbody\n"), 0o644))
|
|
srv := mcp.NewServer(dir, nil, nil, nil)
|
|
|
|
resp := call(t, srv, "brain_edit", map[string]any{
|
|
"path": "wiki/homelab/facts/n.md",
|
|
"old_str": "half_life: durable",
|
|
"new_str": "half_life:\n garbage-value",
|
|
})
|
|
require.Contains(t, resp, "error", "%v", resp)
|
|
|
|
got, err := os.ReadFile(note)
|
|
require.NoError(t, err)
|
|
assert.Contains(t, string(got), "half_life: durable", "rejected edit must leave the note byte-identical")
|
|
}
|
|
|
|
func TestBrainEdit_AllowsAValidClaimEnvelopeEdit(t *testing.T) {
|
|
dir := newBrainRepo(t)
|
|
note := filepath.Join(dir, "wiki/homelab/facts/n.md")
|
|
require.NoError(t, os.WriteFile(note,
|
|
[]byte("---\ntitle: 'n'\nhalf_life: durable\napplies: universal\nclaim_provenance: asserted\n---\n\nbody\n"), 0o644))
|
|
srv := mcp.NewServer(dir, nil, nil, nil)
|
|
|
|
resp := call(t, srv, "brain_edit", map[string]any{
|
|
"path": "wiki/homelab/facts/n.md", "old_str": "half_life: durable", "new_str": "half_life: seasonal",
|
|
})
|
|
require.NotContains(t, resp, "error", "%v", resp)
|
|
|
|
got, err := os.ReadFile(note)
|
|
require.NoError(t, err)
|
|
assert.Contains(t, string(got), "half_life: seasonal")
|
|
}
|
|
|
|
func TestBrainEdit_UnrelatedEditsSkipTheEnvelopeCheckEntirely(t *testing.T) {
|
|
// The gate only engages when old_str/new_str actually mention an
|
|
// envelope field name — an ordinary body edit on a note that happens to
|
|
// carry a valid envelope must not pay for (or be affected by) a check
|
|
// that has nothing to do with it.
|
|
dir := newBrainRepo(t)
|
|
note := filepath.Join(dir, "wiki/homelab/facts/n.md")
|
|
require.NoError(t, os.WriteFile(note,
|
|
[]byte("---\ntitle: 'n'\nhalf_life: durable\napplies: universal\nclaim_provenance: asserted\n---\n\nold body\n"), 0o644))
|
|
srv := mcp.NewServer(dir, nil, nil, nil)
|
|
|
|
resp := call(t, srv, "brain_edit", map[string]any{
|
|
"path": "wiki/homelab/facts/n.md", "old_str": "old body", "new_str": "new body",
|
|
})
|
|
require.NotContains(t, resp, "error", "%v", resp)
|
|
|
|
got, err := os.ReadFile(note)
|
|
require.NoError(t, err)
|
|
assert.Contains(t, string(got), "new body")
|
|
}
|
|
|
|
func TestBrainEditRoot_GovernanceFilesAreNeverEnvelopeChecked(t *testing.T) {
|
|
// CLAUDE.md has no claim-envelope concept at all — the check must be
|
|
// scoped to notes (ScopeNotes), never applied on the governance path.
|
|
srv, _, _, _ := govServer(t)
|
|
|
|
resp := authCall(t, srv, "Bearer "+capStaticTok, "brain_edit_root", map[string]any{
|
|
"path": "CLAUDE.md", "old_str": "# rules", "new_str": "half_life: durable",
|
|
})
|
|
require.NotContains(t, resp, "error", "%v", resp)
|
|
}
|
|
|
|
func TestBrainEdit_RefusesGovernanceFilesFromTheModelFacingTool(t *testing.T) {
|
|
dir := newBrainRepo(t)
|
|
srv := mcp.NewServer(dir, nil, nil, nil)
|
|
|
|
resp := call(t, srv, "brain_edit", map[string]any{
|
|
"path": "CLAUDE.md", "old_str": "# rules", "new_str": "# rewritten",
|
|
})
|
|
require.Contains(t, resp, "error", "brain_edit must not reach CLAUDE.md")
|
|
|
|
got, err := os.ReadFile(filepath.Join(dir, "CLAUDE.md"))
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "# rules\n", string(got))
|
|
}
|
|
|
|
func TestBrainEditRoot_RefusedWithoutTheLocalStaticPrincipal(t *testing.T) {
|
|
// No principal in context is the model-facing case (and the default in
|
|
// this test server): the privileged door must stay shut.
|
|
dir := newBrainRepo(t)
|
|
srv := mcp.NewServer(dir, nil, nil, nil)
|
|
|
|
resp := call(t, srv, "brain_edit_root", map[string]any{
|
|
"path": "CLAUDE.md", "old_str": "# rules", "new_str": "# rewritten",
|
|
})
|
|
require.Contains(t, resp, "error")
|
|
|
|
got, err := os.ReadFile(filepath.Join(dir, "CLAUDE.md"))
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "# rules\n", string(got), "governance file must be untouched")
|
|
}
|
|
|
|
func TestBrainGet_CannotReachSessionTranscripts(t *testing.T) {
|
|
// Pre-existing hole, not introduced here: api.ReadNote resolves any
|
|
// brain-relative path and parseFrontmatter returns the WHOLE file as body
|
|
// when there is no frontmatter fence. archive/ holds verbatim Claude
|
|
// session transcripts (up to 500 KB) that BM25 never indexes, so they are
|
|
// invisible to search and trivially readable by path — and CLAUDE.md
|
|
// documents the layout.
|
|
dir := newBrainRepo(t)
|
|
require.NoError(t, os.MkdirAll(filepath.Join(dir, "archive/claude-sessions/koala"), 0o755))
|
|
require.NoError(t, os.WriteFile(
|
|
filepath.Join(dir, "archive/claude-sessions/koala/session-1.md"),
|
|
[]byte("verbatim transcript with tool output\n"), 0o644))
|
|
|
|
srv := mcp.NewServer(dir, nil, nil, nil)
|
|
resp := call(t, srv, "brain_get", map[string]any{"path": "archive/claude-sessions/koala/session-1.md"})
|
|
|
|
require.Contains(t, resp, "error", "brain_get must not read outside knowledge/ and wiki/")
|
|
assert.NotContains(t, string(mustJSON(t, resp)), "verbatim transcript")
|
|
}
|
|
|
|
func TestBrainGet_StillReadsNotes(t *testing.T) {
|
|
dir := newBrainRepo(t)
|
|
srv := mcp.NewServer(dir, nil, nil, nil)
|
|
|
|
resp := call(t, srv, "brain_get", map[string]any{"path": "wiki/homelab/facts/n.md"})
|
|
assert.NotContains(t, resp, "error", "%v", resp["error"])
|
|
}
|
|
|
|
func mustJSON(t *testing.T, v any) []byte {
|
|
t.Helper()
|
|
b, err := json.Marshal(v)
|
|
require.NoError(t, err)
|
|
return b
|
|
}
|
|
|
|
// ---- hyperguild#97: a governance rewrite must be observed, not just gated ----
|
|
|
|
// govSink captures audit records. Governance edits are rare, so the whole
|
|
// history is kept and asserted on rather than sampled.
|
|
type govSink struct {
|
|
entries []capture.AuditEntry
|
|
outcomes []capture.AuditOutcome
|
|
recErr error
|
|
}
|
|
|
|
func (s *govSink) Reserve(context.Context, classification.Level) (capture.AuditOutcome, error) {
|
|
return capture.AuditCentral, nil
|
|
}
|
|
|
|
func (s *govSink) Record(_ context.Context, e capture.AuditEntry, o capture.AuditOutcome) error {
|
|
s.entries = append(s.entries, e)
|
|
s.outcomes = append(s.outcomes, o)
|
|
return s.recErr
|
|
}
|
|
|
|
type govNotifier struct {
|
|
msgs []string
|
|
err error
|
|
}
|
|
|
|
func (n *govNotifier) Notify(_ context.Context, msg string) error {
|
|
n.msgs = append(n.msgs, msg)
|
|
return n.err
|
|
}
|
|
|
|
// govServer wires capture (which is what re-derives the static principal) plus
|
|
// the #97 observer, and returns the brain dir so the test can read the file.
|
|
func govServer(t *testing.T) (*mcp.Server, string, *govSink, *govNotifier) {
|
|
t.Helper()
|
|
dir := newBrainRepo(t)
|
|
cfg, err := classification.Load(dir)
|
|
require.NoError(t, err)
|
|
svc := capture.NewService(brainstore.New(dir), capFakeTracker{}, cfg, audit.NewSlogSink(nil))
|
|
|
|
srv := mcp.NewServer(dir, nil, nil, nil)
|
|
srv.WithCapture(svc, nil, capStaticTok, "local-cli", capturehttp.NewOriginResolver(nil))
|
|
sink, notifier := &govSink{}, &govNotifier{}
|
|
srv.WithGovernanceObserver(sink, notifier)
|
|
return srv, dir, sink, notifier
|
|
}
|
|
|
|
// authCall is call() with an Authorization header, so the static principal is
|
|
// present and brain_edit_root's gate opens.
|
|
func authCall(t *testing.T, srv *mcp.Server, authz, name string, args map[string]any) map[string]any {
|
|
t.Helper()
|
|
req := httptest.NewRequest(http.MethodPost, "/mcp", body(t, map[string]any{
|
|
"jsonrpc": "2.0", "id": 1, "method": "tools/call",
|
|
"params": map[string]any{"name": name, "arguments": args},
|
|
}))
|
|
if authz != "" {
|
|
req.Header.Set("Authorization", authz)
|
|
}
|
|
rr := httptest.NewRecorder()
|
|
srv.ServeHTTP(rr, req)
|
|
var resp map[string]any
|
|
require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &resp))
|
|
return resp
|
|
}
|
|
|
|
func sha256hex(s string) string {
|
|
sum := sha256.Sum256([]byte(s))
|
|
return hex.EncodeToString(sum[:])
|
|
}
|
|
|
|
func TestBrainEditRoot_RecordsAnAuditEntryNamingPrincipalPathAndBothHashes(t *testing.T) {
|
|
// The gate proves a rewrite was ALLOWED. Only a record proves one HAPPENED
|
|
// — and brain-sync will commit it within 15 minutes authored `brain-sync`,
|
|
// so git history cannot tell it apart from routine note traffic.
|
|
srv, dir, sink, _ := govServer(t)
|
|
|
|
resp := authCall(t, srv, "Bearer "+capStaticTok, "brain_edit_root", map[string]any{
|
|
"path": "CLAUDE.md", "old_str": "# rules", "new_str": "# rewritten",
|
|
})
|
|
require.NotContains(t, resp, "error", "%v", resp["error"])
|
|
|
|
require.Len(t, sink.entries, 1, "exactly one audit record per governance rewrite")
|
|
e := sink.entries[0]
|
|
assert.Equal(t, "local-cli", e.Principal)
|
|
assert.Contains(t, e.Items, "CLAUDE.md", "the record must name what was rewritten")
|
|
|
|
joined := strings.Join(e.SecurityEvents, " ")
|
|
assert.Contains(t, joined, sha256hex("# rules\n"), "before-hash must be recorded")
|
|
assert.Contains(t, joined, sha256hex("# rewritten\n"), "after-hash must be recorded")
|
|
assert.NotZero(t, e.Timestamp)
|
|
|
|
got, err := os.ReadFile(filepath.Join(dir, "CLAUDE.md"))
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "# rewritten\n", string(got))
|
|
}
|
|
|
|
func TestBrainEditRoot_NotifiesWithPathAndHashesButNeverContent(t *testing.T) {
|
|
srv, _, _, notifier := govServer(t)
|
|
|
|
resp := authCall(t, srv, "Bearer "+capStaticTok, "brain_edit_root", map[string]any{
|
|
"path": "CLAUDE.md", "old_str": "# rules", "new_str": "# rewritten",
|
|
})
|
|
require.NotContains(t, resp, "error", "%v", resp["error"])
|
|
|
|
require.Len(t, notifier.msgs, 1)
|
|
msg := notifier.msgs[0]
|
|
assert.Contains(t, msg, "CLAUDE.md")
|
|
assert.Contains(t, msg, "local-cli")
|
|
assert.Contains(t, msg, sha256hex("# rules\n"))
|
|
assert.Contains(t, msg, sha256hex("# rewritten\n"))
|
|
|
|
// The notification travels to a phone through a third-party topic. A hash
|
|
// identifies a rewrite; the bytes would leak whatever was written.
|
|
assert.NotContains(t, msg, "# rewritten", "no file content in the notification body")
|
|
assert.NotContains(t, msg, "# rules")
|
|
}
|
|
|
|
func TestBrainEditRoot_RefusedProducesNoRecordNoNotificationNoWrite(t *testing.T) {
|
|
srv, dir, sink, notifier := govServer(t)
|
|
|
|
// No Authorization header → no static principal → the gate stays shut.
|
|
resp := authCall(t, srv, "", "brain_edit_root", map[string]any{
|
|
"path": "CLAUDE.md", "old_str": "# rules", "new_str": "# rewritten",
|
|
})
|
|
require.Contains(t, resp, "error")
|
|
|
|
assert.Empty(t, sink.entries, "a refusal is not a rewrite — recording one would cry wolf")
|
|
assert.Empty(t, notifier.msgs)
|
|
got, err := os.ReadFile(filepath.Join(dir, "CLAUDE.md"))
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "# rules\n", string(got))
|
|
}
|
|
|
|
func TestBrainEditRoot_FailedEditProducesNoRecordNoNotification(t *testing.T) {
|
|
// Authorised but no match: the door opened and nothing went through it.
|
|
srv, _, sink, notifier := govServer(t)
|
|
|
|
resp := authCall(t, srv, "Bearer "+capStaticTok, "brain_edit_root", map[string]any{
|
|
"path": "CLAUDE.md", "old_str": "absent-from-the-file", "new_str": "x",
|
|
})
|
|
require.Contains(t, resp, "error")
|
|
|
|
assert.Empty(t, sink.entries)
|
|
assert.Empty(t, notifier.msgs)
|
|
}
|
|
|
|
func TestBrainEdit_OnOrdinaryNotesIsNotAudited(t *testing.T) {
|
|
// The decided asymmetry (#97): note edits are covered by git history, which
|
|
// carries the same before/after bytes with a diff. Governance files get the
|
|
// extra trail because they change what later agents obey, not because they
|
|
// are harder to reconstruct.
|
|
srv, _, sink, notifier := govServer(t)
|
|
|
|
resp := authCall(t, srv, "Bearer "+capStaticTok, "brain_edit", map[string]any{
|
|
"path": "wiki/homelab/facts/n.md", "old_str": "beta", "new_str": "BETA",
|
|
})
|
|
require.NotContains(t, resp, "error", "%v", resp["error"])
|
|
|
|
assert.Empty(t, sink.entries, "note edits must not fill the governance audit trail")
|
|
assert.Empty(t, notifier.msgs)
|
|
}
|