[ { "file": "scripts/aws_bda_test.py", "line": 126, "name": "test_files_exist", "purpose": "Files exist.", "classification": "internals", "restates": "no", "reason": "Checks packaging, documentation or configured path contract; does not prove runtime product behavior.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_files_exist() -> None:\n for path in (LIB, DEPLOY, TEARDOWN, DOCS):\n if not path.is_file():\n fail(f\"missing {path.relative_to(ROOT)}\")\n else:\n ok(f\"present {path.relative_to(ROOT)}\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_bda_test.py", "line": 134, "name": "test_scripts_are_executable", "purpose": "Scripts are executable.", "classification": "internals", "restates": "no", "reason": "Checks packaging, documentation or configured path contract; does not prove runtime product behavior.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_scripts_are_executable() -> None:\n for path in (DEPLOY, TEARDOWN):\n if not os.access(path, os.X_OK):\n fail(f\"not executable: {path.relative_to(ROOT)}\")\n else:\n ok(f\"executable {path.relative_to(ROOT)}\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_bda_test.py", "line": 142, "name": "test_help", "purpose": "Help.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_help() -> None:\n for path in (DEPLOY, TEARDOWN):\n proc = run([str(path), \"--help\"])\n if proc.returncode != 0:\n fail(f\"{path.name} --help exited {proc.returncode}: {proc.stderr}\")\n continue\n text = proc.stdout + proc.stderr\n if \"--env\" not in text or \"--dry-run\" not in text or \"--project\" not in text or \"--region\" not in text:\n fail(f\"{path.name} --help missing --env/--dry-run/--project/--region\")\n else:\n ok(f\"{path.name} --help\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_bda_test.py", "line": 155, "name": "test_teardown_requires_confirm_and_env", "purpose": "Teardown requires confirm and env.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_teardown_requires_confirm_and_env() -> None:\n proc = run([str(TEARDOWN)])\n text = proc.stdout + proc.stderr\n if proc.returncode == 0:\n fail(\"teardown with no flags should fail\")\n elif \"--confirm\" not in text and \"confirm\" not in text.lower():\n fail(f\"teardown missing confirm complaint: {text}\")\n else:\n ok(\"teardown refuses without --confirm\")\n\n proc = run([str(TEARDOWN), \"--confirm\"])\n text = proc.stdout + proc.stderr\n if proc.returncode == 0:\n fail(\"teardown --confirm without --env should fail\")\n elif \"--env\" not in text and \"env\" not in text.lower():\n fail(f\"teardown missing env complaint: {text}\")\n else:\n ok(\"teardown refuses without typed --env\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_bda_test.py", "line": 175, "name": "test_refuse_prod", "purpose": "Refuse prod.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_refuse_prod() -> None:\n for env_name in (\"prod\", \"production\", \"PROD\", \"Production\"):\n for path in (DEPLOY, TEARDOWN):\n args = [str(path), \"--env\", env_name, \"--dry-run\", \"--account-id\", ACCOUNT]\n if path == TEARDOWN:\n args.insert(3, \"--confirm\")\n proc = run(args)\n text = proc.stdout + proc.stderr\n if proc.returncode == 0:\n fail(f\"{path.name} accepted {env_name}\")\n elif \"prod\" not in text.lower():\n fail(f\"{path.name} {env_name} did not mention prod: {text}\")\n else:\n ok(f\"{path.name} refuses {env_name}\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_bda_test.py", "line": 191, "name": "test_refuse_unknown_env", "purpose": "Refuse unknown env.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_refuse_unknown_env() -> None:\n proc = run(\n [str(DEPLOY), \"--env\", \"staging\", \"--dry-run\", \"--account-id\", ACCOUNT]\n )\n if proc.returncode == 0:\n fail(\"deploy accepted staging\")\n else:\n ok(\"deploy refuses staging (IAM is operator-applied)\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_bda_test.py", "line": 201, "name": "test_dry_run_prints_contract", "purpose": "Dry run prints contract.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_dry_run_prints_contract() -> None:\n proc = run(\n [str(DEPLOY), \"--env\", \"dev\", \"--dry-run\", \"--account-id\", ACCOUNT]\n )\n text = proc.stdout + proc.stderr\n if proc.returncode != 0:\n fail(f\"deploy --dry-run failed: {text}\")\n return\n required = [\n \"POM_VAULT_BDA_BUCKET=pom-vault-bda-dev-123456789012\",\n \"POM_VAULT_BDA_INPUT_PREFIX=bda/input/\",\n \"POM_VAULT_BDA_OUTPUT_PREFIX=bda/output/\",\n \"PROJECT_ARN=\",\n \"PROJECT_STAGE=DEVELOPMENT\",\n \"PROFILE_ARN=arn:aws:bedrock:us-east-2:123456789012:data-automation-profile/us.data-automation-v1\",\n \"POM_VAULT_BDA_REGION=us-east-2\",\n \"openai.gpt-5.6-luna\",\n \"us.openai.gpt-5.6-luna\",\n \"DRY-RUN\",\n ]\n missing = [item for item in required if item not in text]\n if missing:\n fail(f\"deploy --dry-run missing {missing}:\\n{text}\")\n else:\n ok(\"deploy --dry-run prints locked env contract\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_bda_test.py", "line": 228, "name": "test_region_override", "purpose": "Region override.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_region_override() -> None:\n proc = run(\n [\n str(DEPLOY),\n \"--env\",\n \"dev\",\n \"--dry-run\",\n \"--account-id\",\n ACCOUNT,\n \"--region\",\n \"us-west-2\",\n \"--project\",\n \"persynl-dev\",\n ]\n )\n text = proc.stdout + proc.stderr\n if proc.returncode != 0:\n fail(f\"deploy --region override failed: {text}\")\n elif \"POM_VAULT_BDA_REGION=us-west-2\" not in text:\n fail(f\"--region us-west-2 did not stick: {text}\")\n elif \"POM_VAULT_AWS_PROJECT=persynl-dev\" not in text:\n fail(f\"--project did not print: {text}\")\n else:\n ok(\"deploy --region and --project override the defaults\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_bda_test.py", "line": 254, "name": "test_dry_run_does_not_exec_aws", "purpose": "Dry run does not exec aws.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_dry_run_does_not_exec_aws() -> None:\n stub_dir = ROOT / \"scripts\" / \".tmp-bda-test-bin\"\n stub_dir.mkdir(exist_ok=True)\n stub = stub_dir / \"aws\"\n stub.write_text(\n \"#!/usr/bin/env bash\\n\"\n \"echo 'aws stub invoked' >&2\\n\"\n \"exit 97\\n\"\n )\n stub.chmod(0o755)\n env = {\"PATH\": f\"{stub_dir}{os.pathsep}{os.environ.get('PATH', '')}\"}\n try:\n for path, extra in (\n (DEPLOY, []),\n (TEARDOWN, [\"--confirm\"]),\n ):\n proc = run(\n [str(path), \"--env\", \"dev\", *extra, \"--dry-run\", \"--account-id\", ACCOUNT],\n env=env,\n )\n text = proc.stdout + proc.stderr\n if proc.returncode != 0:\n fail(f\"{path.name} --dry-run with aws stub failed: {text}\")\n elif \"aws stub invoked\" in text or proc.returncode == 97:\n fail(f\"{path.name} --dry-run invoked aws\")\n else:\n ok(f\"{path.name} --dry-run did not invoke aws\")\n finally:\n stub.unlink(missing_ok=True)\n try:\n stub_dir.rmdir()\n except OSError:\n pass", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_bda_test.py", "line": 289, "name": "test_ci_blocks_live", "purpose": "Ci blocks live.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_ci_blocks_live() -> None:\n proc = run([str(DEPLOY), \"--env\", \"dev\", \"--account-id\", ACCOUNT])\n text = proc.stdout + proc.stderr\n if proc.returncode == 0:\n fail(\"deploy without --dry-run should refuse under CI\")\n elif \"CI\" not in text:\n fail(f\"CI live refuse missing CI mention: {text}\")\n else:\n ok(\"CI refuses live deploy\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_bda_test.py", "line": 300, "name": "test_source_guards", "purpose": "Source guards.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_source_guards() -> None:\n proc = bash_lib(\"bda_refuse_prod prod; echo reached\")\n if proc.returncode == 0 or \"reached\" in proc.stdout:\n fail(\"bda_refuse_prod prod did not exit\")\n else:\n ok(\"lib refuses prod\")\n\n proc = bash_lib(\"bda_require_confirm 0; echo reached\")\n if proc.returncode == 0:\n fail(\"bda_require_confirm 0 did not exit\")\n else:\n ok(\"lib requires --confirm\")\n\n proc = bash_lib(\n f'bda_derive_names dev {ACCOUNT} us-west-2; '\n 'printf \"%s\\\\n\" \"$BDA_BUCKET\" \"$BDA_PROJECT_NAME\" \"$BDA_PROFILE_ARN\"'\n )\n if proc.returncode != 0:\n fail(f\"bda_derive_names failed: {proc.stderr}\")\n return\n lines = [line for line in proc.stdout.splitlines() if line]\n expected = [\n \"pom-vault-bda-dev-123456789012\",\n \"pom-vault-bda-dev\",\n \"arn:aws:bedrock:us-west-2:123456789012:data-automation-profile/us.data-automation-v1\",\n ]\n if lines != expected:\n fail(f\"derived names {lines} != {expected}\")\n else:\n ok(\"derived names match locked contract\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_bda_test.py", "line": 332, "name": "test_source_policy_has_no_star_bedrock", "purpose": "Source policy has no star bedrock.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_source_policy_has_no_star_bedrock() -> None:\n proc = bash_lib(\n f'bda_derive_names dev {ACCOUNT} us-west-2; bda_dev_inline_policy_json '\n '\"arn:aws:bedrock:us-west-2:123456789012:data-automation-project/example\"'\n )\n if proc.returncode != 0:\n fail(f\"inline policy failed: {proc.stderr}\")\n return\n body = proc.stdout\n if re.search(r'\"bedrock:\\*\"', body):\n fail(\"inline policy grants bedrock:*\")\n elif \"openai.gpt-5.6-luna\" not in body or \"us.openai.gpt-5.6-luna\" not in body:\n fail(\"inline policy missing Luna ARNs\")\n elif \"arn:aws:bedrock:*:123456789012:data-automation-profile/us.data-automation-v1\" not in body:\n fail(\"inline policy missing region-wildcard us.data-automation-v1 (US geo profile authorizes in us-east-1/2)\")\n elif \"generativeField\" in body:\n fail(\"IAM policy should not carry BDA output config\")\n else:\n ok(\"inline policy is least-privilege and includes Luna ARNs\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_bda_test.py", "line": 353, "name": "test_bucket_policy_allows_us_geo_bedrock_source", "purpose": "Bucket policy allows us geo bedrock source.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_bucket_policy_allows_us_geo_bedrock_source() -> None:\n proc = bash_lib(f\"bda_derive_names dev {ACCOUNT} us-west-2; bda_bucket_policy_json\")\n if proc.returncode != 0:\n fail(f\"bucket policy failed: {proc.stderr}\")\n return\n body = proc.stdout\n if \"arn:aws:bedrock:*:123456789012:*\" not in body:\n fail(\"bucket policy missing region-wildcard account SourceArn\")\n elif \"arn:aws:bedrock:*::data-automation-profile/us.data-automation-v1\" not in body:\n fail(\"bucket policy missing account-less US geo profile SourceArn\")\n else:\n ok(\"bucket policy allows US geo Bedrock SourceArn\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_bda_test.py", "line": 367, "name": "test_standard_output_generative_off", "purpose": "Standard output generative off.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_standard_output_generative_off() -> None:\n proc = bash_lib(\"bda_standard_output_json\")\n if proc.returncode != 0:\n fail(f\"standard output json failed: {proc.stderr}\")\n return\n body = proc.stdout\n if '\"generativeField\"' not in body or '\"DISABLED\"' not in body:\n fail(\"standard output must disable generativeField\")\n elif \"blueprint\" in body.lower():\n fail(\"standard output must not mention blueprints\")\n else:\n ok(\"BDA Standard output has generative fields off\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_bda_test.py", "line": 381, "name": "test_scripts_never_touch_supabase", "purpose": "Scripts never touch supabase.", "classification": "internals", "restates": "yes", "reason": "Scans script source for required/forbidden implementation strings; does not exercise the claimed operational restriction.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_scripts_never_touch_supabase() -> None:\n for path in (LIB, DEPLOY, TEARDOWN):\n text = path.read_text()\n lowered = text.lower()\n if \"supabase\" in lowered and \"will not touch supabase\" not in lowered:\n # allow the documented refusal, nothing else\n mentions = [\n line.strip()\n for line in text.splitlines()\n if \"supabase\" in line.lower()\n ]\n bad = [line for line in mentions if \"will not touch\" not in line.lower()]\n if bad:\n fail(f\"{path.name} mentions Supabase beyond the refusal: {bad}\")\n continue\n ok(f\"{path.name} does not touch Supabase\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_bda_test.py", "line": 399, "name": "test_no_terraform_no_futurevault_call", "purpose": "No terraform no futurevault call.", "classification": "internals", "restates": "yes", "reason": "Scans script source for required/forbidden implementation strings; does not exercise the claimed operational restriction.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_no_terraform_no_futurevault_call() -> None:\n for path in (LIB, DEPLOY, TEARDOWN):\n text = path.read_text()\n if re.search(r\"\\bterraform\\s+(apply|plan|init|destroy)\\b\", text, re.I):\n fail(f\"{path.name} invokes terraform\")\n elif \"futurevault.com\" in text.lower():\n fail(f\"{path.name} calls FutureVault\")\n else:\n ok(f\"{path.name} is bash/AWS CLI only\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_bda_test.py", "line": 410, "name": "test_nested_get_status_fixture", "purpose": "Nested get status fixture.", "classification": "mixed", "restates": "partial", "reason": "Checks query literal and separately indexes fixture fields; does not execute the returned query against the fixture.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_nested_get_status_fixture() -> None:\n proc = bash_lib(\"bda_get_project_status_query\")\n if proc.returncode != 0:\n fail(f\"bda_get_project_status_query failed: {proc.stderr}\")\n return\n query = proc.stdout.strip()\n if query != \"project.status\":\n fail(f\"status query is {query!r}, expected 'project.status'\")\n return\n nested = dotted_query(GET_PROJECT_FIXTURE, query)\n top = dotted_query(GET_PROJECT_FIXTURE, \"status\")\n if nested != \"COMPLETED\":\n fail(f\"nested fixture project.status={nested!r}, expected COMPLETED\")\n elif top is not None:\n fail(\"fixture should not expose top-level status (that is the scout bug)\")\n else:\n ok(\"get-project fixture: project.status=COMPLETED, top-level status is None\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_bda_test.py", "line": 429, "name": "test_development_stage_lookup_fixture", "purpose": "Development stage lookup fixture.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_development_stage_lookup_fixture() -> None:\n proc = bash_lib(\n f'bda_derive_names dev {ACCOUNT} us-west-2; bda_list_dev_project_arn_query'\n )\n if proc.returncode != 0:\n fail(f\"bda_list_dev_project_arn_query failed: {proc.stderr}\")\n return\n query = proc.stdout.strip()\n try:\n arn = apply_list_dev_query(LIST_PROJECTS_FIXTURE, query)\n except AssertionError as exc:\n fail(str(exc))\n return\n live = \"arn:aws:bedrock:us-west-2:123456789012:data-automation-project/liveprojectxx\"\n dev = \"arn:aws:bedrock:us-west-2:123456789012:data-automation-project/devprojectxxx\"\n if arn != dev:\n fail(f\"DEVELOPMENT lookup returned {arn!r}, expected {dev}\")\n elif arn == live:\n fail(\"DEVELOPMENT lookup selected the LIVE project\")\n else:\n ok(\"list fixture: DEVELOPMENT-only query skips same-named LIVE project\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_bda_test.py", "line": 452, "name": "test_scripts_use_nested_status_and_dev_stage", "purpose": "Scripts use nested status and dev stage.", "classification": "internals", "restates": "yes", "reason": "Scans script source for required/forbidden implementation strings; does not exercise the claimed operational restriction.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_scripts_use_nested_status_and_dev_stage() -> None:\n deploy = DEPLOY.read_text()\n teardown = TEARDOWN.read_text()\n lib = LIB.read_text()\n if \"--query 'status'\" in deploy or '--query \"status\"' in deploy:\n fail(\"deploy still queries top-level status\")\n elif \"bda_get_project_status_query\" not in deploy:\n fail(\"deploy does not use bda_get_project_status_query\")\n elif \"--project-stage \\\"$BDA_PROJECT_STAGE\\\"\" not in deploy:\n fail(\"deploy get-data-automation-project missing --project-stage DEVELOPMENT\")\n elif \"--project-stage-filter ALL\" in deploy or \"--project-stage-filter ALL\" in teardown:\n fail(\"scripts still list with --project-stage-filter ALL\")\n elif \"--resource-owner\" in deploy or \"--resource-owner\" in teardown:\n fail(\"list must not pass --resource-owner; combined with --project-stage-filter it is Invalid List filter combination\")\n elif \"--project-type\" in deploy:\n fail(\"create-data-automation-project has no --project-type\")\n elif \"--project-stage-filter \\\"$BDA_PROJECT_STAGE\\\"\" not in deploy:\n fail(\"deploy list missing --project-stage-filter DEVELOPMENT\")\n elif \"--project-stage-filter \\\"$BDA_PROJECT_STAGE\\\"\" not in teardown:\n fail(\"teardown list missing --project-stage-filter DEVELOPMENT\")\n elif \"bda_list_dev_project_arn_query\" not in deploy or \"bda_list_dev_project_arn_query\" not in teardown:\n fail(\"scripts do not use bda_list_dev_project_arn_query\")\n elif \"project.status\" not in lib:\n fail(\"lib missing project.status query\")\n else:\n ok(\"scripts query project.status and constrain lookup to DEVELOPMENT\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_bda_test.py", "line": 480, "name": "test_env_example_lists_project_name_and_role", "purpose": "Env example lists project name and role.", "classification": "internals", "restates": "no", "reason": "Checks packaging, documentation or configured path contract; does not prove runtime product behavior.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_env_example_lists_project_name_and_role() -> None:\n text = ENV_EXAMPLE.read_text()\n if \"POM_VAULT_BDA_PROJECT_NAME=\" not in text:\n fail(\".env.example missing POM_VAULT_BDA_PROJECT_NAME\")\n elif \"POM_VAULT_BDA_ROLE_ARN=\" not in text:\n fail(\".env.example missing POM_VAULT_BDA_ROLE_ARN\")\n else:\n ok(\".env.example lists PROJECT_NAME and ROLE_ARN\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_bda_test.py", "line": 490, "name": "test_docs_name_the_operator_steps", "purpose": "Docs name the operator steps.", "classification": "internals", "restates": "no", "reason": "Checks packaging, documentation or configured path contract; does not prove runtime product behavior.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_docs_name_the_operator_steps() -> None:\n text = DOCS.read_text()\n required = [\n \"./scripts/aws_bda_deploy.sh --env dev\",\n \"./scripts/aws_bda_teardown.sh --env dev --confirm\",\n \"POM_VAULT_BDA_BUCKET\",\n \"PROJECT_ARN\",\n \"PROJECT_STAGE\",\n \"PROFILE_ARN\",\n \"openai.gpt-5.6-luna\",\n \"us.openai.gpt-5.6-luna\",\n \"us-east-2\",\n \"--project\",\n \"--region\",\n \"bedrock:*\",\n \"bda/input/\",\n \"bda/output/\",\n \"pom-vault-bda-dev\",\n ]\n missing = [item for item in required if item not in text]\n if missing:\n fail(f\"docs/aws-bda-chassis.md missing {missing}\")\n else:\n ok(\"docs name locked steps and Luna ids\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_ec2_test.py", "line": 84, "name": "test_files_exist", "purpose": "Files exist.", "classification": "internals", "restates": "no", "reason": "Checks packaging, documentation or configured path contract; does not prove runtime product behavior.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_files_exist() -> None:\n for path in (LIB, DEPLOY, TEARDOWN, DOCS):\n if not path.is_file():\n fail(f\"missing {path.relative_to(ROOT)}\")\n else:\n ok(f\"present {path.relative_to(ROOT)}\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_ec2_test.py", "line": 92, "name": "test_scripts_are_executable", "purpose": "Scripts are executable.", "classification": "internals", "restates": "no", "reason": "Checks packaging, documentation or configured path contract; does not prove runtime product behavior.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_scripts_are_executable() -> None:\n for path in (DEPLOY, TEARDOWN):\n if not os.access(path, os.X_OK):\n fail(f\"not executable: {path.relative_to(ROOT)}\")\n else:\n ok(f\"executable {path.relative_to(ROOT)}\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_ec2_test.py", "line": 100, "name": "test_help", "purpose": "Help.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_help() -> None:\n proc = run([str(DEPLOY), \"--help\"])\n text = proc.stdout + proc.stderr\n if proc.returncode != 0:\n fail(f\"{DEPLOY.name} --help exited {proc.returncode}: {proc.stderr}\")\n elif \"--env\" not in text or \"--dry-run\" not in text or \"--key-name\" not in text or \"--ssh-cidr\" not in text or \"--hostname\" not in text or \"--acme-email\" not in text or \"--project\" not in text or \"--region\" not in text or \"--reuse-eip\" not in text or \"--new-eip\" not in text:\n fail(f\"{DEPLOY.name} --help missing flags\")\n else:\n ok(f\"{DEPLOY.name} --help\")\n\n proc = run([str(TEARDOWN), \"--help\"])\n text = proc.stdout + proc.stderr\n if proc.returncode != 0:\n fail(f\"{TEARDOWN.name} --help exited {proc.returncode}: {proc.stderr}\")\n elif \"--env\" not in text or \"--dry-run\" not in text or \"--keep-eip\" not in text or \"--release-eip\" not in text:\n fail(f\"{TEARDOWN.name} --help missing --env/--dry-run/--keep-eip/--release-eip\")\n else:\n ok(f\"{TEARDOWN.name} --help\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_ec2_test.py", "line": 120, "name": "test_teardown_requires_confirm_and_env", "purpose": "Teardown requires confirm and env.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_teardown_requires_confirm_and_env() -> None:\n proc = run([str(TEARDOWN)])\n text = proc.stdout + proc.stderr\n if proc.returncode == 0:\n fail(\"teardown with no flags should fail\")\n elif \"--confirm\" not in text and \"confirm\" not in text.lower():\n fail(f\"teardown missing confirm complaint: {text}\")\n else:\n ok(\"teardown refuses without --confirm\")\n\n proc = run([str(TEARDOWN), \"--confirm\"])\n text = proc.stdout + proc.stderr\n if proc.returncode == 0:\n fail(\"teardown --confirm without --env should fail\")\n elif \"--env\" not in text and \"env\" not in text.lower():\n fail(f\"teardown missing env complaint: {text}\")\n else:\n ok(\"teardown refuses without typed --env\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_ec2_test.py", "line": 140, "name": "test_refuse_prod", "purpose": "Refuse prod.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_refuse_prod() -> None:\n for env_name in (\"prod\", \"production\", \"PROD\", \"Production\"):\n for path in (DEPLOY, TEARDOWN):\n args = [str(path), \"--env\", env_name, \"--dry-run\", \"--account-id\", ACCOUNT]\n if path == DEPLOY:\n args.extend([\"--key-name\", KEY, \"--ssh-cidr\", CIDR])\n else:\n args.insert(3, \"--confirm\")\n proc = run(args)\n text = proc.stdout + proc.stderr\n if proc.returncode == 0:\n fail(f\"{path.name} accepted {env_name}\")\n elif \"prod\" not in text.lower():\n fail(f\"{path.name} {env_name} did not mention prod: {text}\")\n else:\n ok(f\"{path.name} refuses {env_name}\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_ec2_test.py", "line": 158, "name": "test_refuse_unknown_env", "purpose": "Refuse unknown env.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_refuse_unknown_env() -> None:\n proc = run(\n [\n str(DEPLOY),\n \"--env\",\n \"staging\",\n \"--key-name\",\n KEY,\n \"--ssh-cidr\",\n CIDR,\n \"--dry-run\",\n \"--account-id\",\n ACCOUNT,\n ]\n )\n if proc.returncode == 0:\n fail(\"deploy accepted staging\")\n else:\n ok(\"deploy refuses staging (hosts are operator-built)\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_ec2_test.py", "line": 179, "name": "test_dry_run_prints_contract", "purpose": "Dry run prints contract.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_dry_run_prints_contract() -> None:\n proc = run(deploy_args(\"--dry-run\", \"--account-id\", ACCOUNT))\n text = proc.stdout + proc.stderr\n if proc.returncode != 0:\n fail(f\"deploy --dry-run failed: {text}\")\n return\n required = [\n \"POM_VAULT_EC2_INSTANCE_ID=\",\n \"POM_VAULT_EC2_PUBLIC_IP=\",\n \"POM_VAULT_EC2_REGION=us-east-2\",\n \"POM_VAULT_EC2_INSTANCE_TYPE=t3.small\",\n \"POM_VAULT_EC2_AMI_SSM=/aws/service/canonical/ubuntu/server/26.04/stable/current/amd64/hvm/ebs-gp3/ami-id\",\n \"POM_VAULT_EC2_HOSTNAME=\",\n \"Ubuntu 26.04\",\n \"DRY-RUN\",\n \"t3.small\",\n \"Caddy\",\n \"will not touch Supabase\",\n ]\n missing = [item for item in required if item not in text]\n if missing:\n fail(f\"deploy --dry-run missing {missing}:\\n{text}\")\n else:\n ok(\"deploy --dry-run prints locked env contract\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_ec2_test.py", "line": 205, "name": "test_dry_run_without_key_or_cidr", "purpose": "Dry run without key or cidr.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_dry_run_without_key_or_cidr() -> None:\n proc = run(\n [str(DEPLOY), \"--env\", \"dev\", \"--dry-run\", \"--account-id\", ACCOUNT]\n )\n text = proc.stdout + proc.stderr\n if proc.returncode != 0:\n fail(f\"deploy without --key-name/--ssh-cidr failed: {text}\")\n elif \"POM_VAULT_EC2_KEY_NAME=pom-vault-ec2-dev\" not in text:\n fail(f\"default key name missing: {text}\")\n elif \"\" not in text:\n fail(f\"ssh-cidr should detect on live: {text}\")\n elif \"aws stub invoked\" in text:\n fail(\"dry-run invoked aws\")\n else:\n ok(\"deploy dry-run defaults key pair and defers ssh-cidr detect\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_ec2_test.py", "line": 222, "name": "test_dry_run_does_not_exec_aws", "purpose": "Dry run does not exec aws.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_dry_run_does_not_exec_aws() -> None:\n stub_dir = ROOT / \"scripts\" / \".tmp-ec2-test-bin\"\n stub_dir.mkdir(exist_ok=True)\n stub = stub_dir / \"aws\"\n stub.write_text(\n \"#!/usr/bin/env bash\\n\"\n \"echo 'aws stub invoked' >&2\\n\"\n \"exit 97\\n\"\n )\n stub.chmod(0o755)\n env = {\"PATH\": f\"{stub_dir}{os.pathsep}{os.environ.get('PATH', '')}\"}\n try:\n for path, extra in (\n (DEPLOY, [\"--key-name\", KEY, \"--ssh-cidr\", CIDR]),\n (TEARDOWN, [\"--confirm\"]),\n ):\n proc = run(\n [\n str(path),\n \"--env\",\n \"dev\",\n *extra,\n \"--dry-run\",\n \"--account-id\",\n ACCOUNT,\n ],\n env=env,\n )\n text = proc.stdout + proc.stderr\n if proc.returncode != 0:\n fail(f\"{path.name} --dry-run with aws stub failed: {text}\")\n elif \"aws stub invoked\" in text or proc.returncode == 97:\n fail(f\"{path.name} --dry-run invoked aws\")\n else:\n ok(f\"{path.name} --dry-run did not invoke aws\")\n finally:\n stub.unlink(missing_ok=True)\n try:\n stub_dir.rmdir()\n except OSError:\n pass", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_ec2_test.py", "line": 265, "name": "test_ci_blocks_live", "purpose": "Ci blocks live.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_ci_blocks_live() -> None:\n proc = run(deploy_args(\"--account-id\", ACCOUNT))\n text = proc.stdout + proc.stderr\n if proc.returncode == 0:\n fail(\"deploy without --dry-run should refuse under CI\")\n elif \"CI\" not in text:\n fail(f\"CI live refuse missing CI mention: {text}\")\n else:\n ok(\"CI refuses live deploy\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_ec2_test.py", "line": 276, "name": "test_source_guards", "purpose": "Source guards.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_source_guards() -> None:\n proc = bash_lib(\"ec2_refuse_prod prod; echo reached\")\n if proc.returncode == 0 or \"reached\" in proc.stdout:\n fail(\"ec2_refuse_prod prod did not exit\")\n else:\n ok(\"lib refuses prod\")\n\n proc = bash_lib(\"ec2_require_confirm 0; echo reached\")\n if proc.returncode == 0:\n fail(\"ec2_require_confirm 0 did not exit\")\n else:\n ok(\"lib requires --confirm\")\n\n proc = bash_lib(\n f'ec2_derive_names dev {ACCOUNT} us-west-2; '\n 'printf \"%s\\\\n\" \"$EC2_NAME\" \"$EC2_SG_NAME\" \"$EC2_ROLE_ARN\" \"$EC2_INSTANCE_TYPE\"'\n )\n if proc.returncode != 0:\n fail(f\"ec2_derive_names failed: {proc.stderr}\")\n return\n lines = [line for line in proc.stdout.splitlines() if line]\n expected = [\n \"pom-vault-ec2-dev\",\n \"pom-vault-ec2-dev\",\n \"arn:aws:iam::123456789012:role/pom-vault-ec2-dev\",\n \"t3.small\",\n ]\n if lines != expected:\n fail(f\"derived names {lines} != {expected}\")\n else:\n ok(\"derived names match locked contract\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_ec2_test.py", "line": 309, "name": "test_eip_reuse_is_default", "purpose": "Eip reuse is default.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_eip_reuse_is_default() -> None:\n proc = run(\n [str(TEARDOWN), \"--env\", \"dev\", \"--confirm\", \"--dry-run\", \"--account-id\", ACCOUNT]\n )\n text = proc.stdout + proc.stderr\n if proc.returncode != 0:\n fail(f\"teardown --dry-run failed: {text}\")\n elif \"would keep Elastic IP\" not in text:\n fail(f\"teardown default should keep EIP: {text}\")\n elif \"would release Elastic IP\" in text:\n fail(f\"teardown default released EIP: {text}\")\n else:\n ok(\"teardown --dry-run keeps Elastic IP by default\")\n\n proc = run(\n [\n str(TEARDOWN),\n \"--env\",\n \"dev\",\n \"--confirm\",\n \"--release-eip\",\n \"--dry-run\",\n \"--account-id\",\n ACCOUNT,\n ]\n )\n text = proc.stdout + proc.stderr\n if proc.returncode != 0:\n fail(f\"teardown --release-eip --dry-run failed: {text}\")\n elif \"would release Elastic IP\" not in text:\n fail(f\"teardown --release-eip should release: {text}\")\n else:\n ok(\"teardown --release-eip dry-run releases Elastic IP\")\n\n proc = run(deploy_args(\"--dry-run\", \"--account-id\", ACCOUNT))\n text = proc.stdout + proc.stderr\n if proc.returncode != 0:\n fail(f\"deploy --dry-run failed: {text}\")\n elif \"Elastic IP reuse tagged\" not in text:\n fail(f\"deploy default should reuse tagged EIP: {text}\")\n else:\n ok(\"deploy --dry-run reuses tagged Elastic IP by default\")\n\n proc = run(deploy_args(\"--new-eip\", \"--dry-run\", \"--account-id\", ACCOUNT))\n text = proc.stdout + proc.stderr\n if proc.returncode != 0:\n fail(f\"deploy --new-eip --dry-run failed: {text}\")\n elif \"Elastic IP --new-eip\" not in text:\n fail(f\"deploy --new-eip missing log: {text}\")\n else:\n ok(\"deploy --new-eip dry-run allocates a new Elastic IP\")\n\n proc = run(\n [\n str(TEARDOWN),\n \"--env\",\n \"dev\",\n \"--confirm\",\n \"--keep-eip\",\n \"--release-eip\",\n \"--dry-run\",\n \"--account-id\",\n ACCOUNT,\n ]\n )\n if proc.returncode == 0:\n fail(\"teardown accepted --keep-eip and --release-eip together\")\n else:\n ok(\"teardown refuses --keep-eip with --release-eip\")\n\n proc = run(deploy_args(\"--reuse-eip\", \"--new-eip\", \"--dry-run\", \"--account-id\", ACCOUNT))\n if proc.returncode == 0:\n fail(\"deploy accepted --reuse-eip and --new-eip together\")\n else:\n ok(\"deploy refuses --reuse-eip with --new-eip\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_ec2_test.py", "line": 386, "name": "test_hostname_requires_acme_email", "purpose": "Hostname requires acme email.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_hostname_requires_acme_email() -> None:\n proc = run(\n deploy_args(\n \"--hostname\",\n \"app.example.com\",\n \"--dry-run\",\n \"--account-id\",\n ACCOUNT,\n )\n )\n if proc.returncode == 0:\n fail(\"deploy --hostname without --acme-email should fail\")\n else:\n ok(\"deploy --hostname requires --acme-email\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_ec2_test.py", "line": 402, "name": "test_caddyfile_http_then_named_site", "purpose": "Caddyfile http then named site.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_caddyfile_http_then_named_site() -> None:\n proc = bash_lib(\"ec2_caddyfile\")\n if proc.returncode != 0:\n fail(f\"ec2_caddyfile failed: {proc.stderr}\")\n return\n body = proc.stdout\n if \":80\" not in body or \"reverse_proxy 127.0.0.1:8080\" not in body:\n fail(\"HTTP Caddyfile missing :80 reverse_proxy\")\n elif \"auto_https\" in body:\n fail(\"HTTP-only Caddyfile should not enable auto_https\")\n else:\n ok(\"HTTP-only Caddyfile is :80 reverse_proxy\")\n\n proc = bash_lib(\"ec2_caddyfile app.example.com ops@example.com\")\n if proc.returncode != 0:\n fail(f\"named Caddyfile failed: {proc.stderr}\")\n return\n body = proc.stdout\n required = [\n \"auto_https disable_redirects\",\n \"email ops@example.com\",\n \"app.example.com {\",\n \":80 {\",\n \"reverse_proxy 127.0.0.1:8080\",\n ]\n missing = [item for item in required if item not in body]\n if missing:\n fail(f\"named Caddyfile missing {missing}\")\n else:\n ok(\"named Caddyfile retries ACME without HTTP redirects\")\n\n proc = bash_lib(\"ec2_caddyfile app.example.com ops@example.com staff.pomvault.com\")\n if proc.returncode != 0:\n fail(f\"staff Caddyfile failed: {proc.stderr}\")\n return\n body = proc.stdout\n if \"staff.pomvault.com {\" not in body or body.count(\"reverse_proxy 127.0.0.1:8080\") < 3:\n fail(\"staff hostname site missing from Caddyfile\")\n else:\n ok(\"Caddyfile reverse-proxies the staff hostname\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_ec2_test.py", "line": 444, "name": "test_user_data_has_caddy_and_deploy_user", "purpose": "User data has caddy and deploy user.", "classification": "mixed", "restates": "partial", "reason": "Checks generated cloud-init output but pins package command order and exact YAML fragments without booting an instance.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_user_data_has_caddy_and_deploy_user() -> None:\n proc = bash_lib(\"ec2_user_data\")\n if proc.returncode != 0:\n fail(f\"ec2_user_data failed: {proc.stderr}\")\n return\n body = proc.stdout\n required = [\n \"caddy\",\n \"- default\",\n \"name: deploy\",\n \"/opt/pomvault\",\n \"WorkingDirectory=/opt/pomvault/server\",\n \"AWS_PROFILE=extract\",\n \"/var/www/.aws/config\",\n \"pom-vault-bda-dev\",\n \"apt-get install -y unzip\",\n \"awscli-exe-linux-x86_64.zip\",\n \"pomvault.service\",\n \"www-data\",\n \"/etc/caddy/Caddyfile\",\n ]\n missing = [item for item in required if item not in body]\n if \"nginx\" in body.lower():\n fail(\"user-data still mentions nginx\")\n elif missing:\n fail(f\"user-data missing {missing}\")\n elif not re.search(r\"(?m)^users:\\n - default\\n - name: deploy\", body):\n fail(\"user-data users: must keep distro default before deploy (EC2 key pair lands on ubuntu)\")\n elif body.find(\"apt-get install -y unzip\") > body.find(\"awscli-exe-linux-x86_64.zip\"):\n fail(\"user-data must install unzip before unpacking the AWS CLI zip\")\n else:\n ok(\"user-data installs Caddy, deploy user, systemd unit\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_ec2_test.py", "line": 478, "name": "test_assume_bda_policy_is_sts_only", "purpose": "Assume bda policy is sts only.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_assume_bda_policy_is_sts_only() -> None:\n proc = bash_lib(\"ec2_assume_bda_policy_json 123456789012\")\n if proc.returncode != 0:\n fail(f\"ec2_assume_bda_policy_json failed: {proc.stderr}\")\n return\n body = proc.stdout\n if \"sts:AssumeRole\" not in body or \"pom-vault-bda-dev\" not in body:\n fail(\"assume-bda policy missing sts:AssumeRole on pom-vault-bda-dev\")\n elif \"bedrock:\" in body:\n fail(\"assume-bda policy must not grant bedrock\")\n else:\n ok(\"instance role assume-bda policy is sts only\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_ec2_test.py", "line": 492, "name": "test_scripts_never_touch_supabase", "purpose": "Scripts never touch supabase.", "classification": "internals", "restates": "yes", "reason": "Scans script source for required/forbidden implementation strings; does not exercise the claimed operational restriction.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_scripts_never_touch_supabase() -> None:\n for path in (LIB, DEPLOY, TEARDOWN):\n text = path.read_text()\n lowered = text.lower()\n if \"supabase\" in lowered and \"will not touch supabase\" not in lowered:\n mentions = [\n line.strip()\n for line in text.splitlines()\n if \"supabase\" in line.lower()\n ]\n bad = [line for line in mentions if \"will not touch\" not in line.lower()]\n if bad:\n fail(f\"{path.name} mentions Supabase beyond the refusal: {bad}\")\n continue\n ok(f\"{path.name} does not touch Supabase\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_ec2_test.py", "line": 509, "name": "test_no_terraform_cfn_futurevault", "purpose": "No terraform cfn futurevault.", "classification": "internals", "restates": "yes", "reason": "Scans script source for required/forbidden implementation strings; does not exercise the claimed operational restriction.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_no_terraform_cfn_futurevault() -> None:\n for path in (LIB, DEPLOY, TEARDOWN):\n text = path.read_text()\n if re.search(r\"\\bterraform\\s+(apply|plan|init|destroy)\\b\", text, re.I):\n fail(f\"{path.name} invokes terraform\")\n elif re.search(r\"\\baws\\s+cloudformation\\b\", text, re.I):\n fail(f\"{path.name} invokes CloudFormation\")\n elif \"futurevault.com\" in text.lower():\n fail(f\"{path.name} calls FutureVault\")\n elif re.search(r'\"bedrock:\\*\"', text) or \"bedrock:*\" in text and \"no bedrock:*\" not in text.lower() and \"grant bedrock:*\" not in text.lower() and \"attach bedrock:*\" not in text.lower() and \"does not attach bedrock:*\" not in text.lower():\n # Allow documented refusals of bedrock:*.\n if \"bedrock:*\" in text:\n refusals = [\n line\n for line in text.splitlines()\n if \"bedrock:*\" in line\n and not any(\n tok in line.lower()\n for tok in (\n \"no bedrock\",\n \"not attach\",\n \"does not attach\",\n \"grant bedrock:*\",\n \"or grant bedrock\",\n )\n )\n ]\n if refusals:\n fail(f\"{path.name} grants bedrock:*: {refusals}\")\n continue\n ok(f\"{path.name} is bash/AWS CLI only\")\n else:\n ok(f\"{path.name} is bash/AWS CLI only\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/aws_ec2_test.py", "line": 544, "name": "test_docs_name_the_operator_steps", "purpose": "Docs name the operator steps.", "classification": "internals", "restates": "no", "reason": "Checks packaging, documentation or configured path contract; does not prove runtime product behavior.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_docs_name_the_operator_steps() -> None:\n text = DOCS.read_text()\n required = [\n \"./scripts/aws_ec2_deploy.sh --env dev\",\n \"./scripts/aws_ec2_teardown.sh --env dev --confirm\",\n \"Ubuntu 26.04\",\n \"t3.small\",\n \"Elastic IP\",\n \"Caddy\",\n \"auto_https disable_redirects\",\n \"/aws/service/canonical/ubuntu/server/26.04/stable/current/amd64/hvm/ebs-gp3/ami-id\",\n \"us-east-2\",\n \"--project\",\n \"--region\",\n \"bedrock:*\",\n \"setup-remote-deploy.sh\",\n \"DEPLOY_HOST\",\n \"pom-vault-ec2-dev\",\n \"--hostname\",\n \"--acme-email\",\n \"--release-eip\",\n \"--new-eip\",\n \"g5-extract-enablement.md\",\n \"AWS_PROFILE=extract\",\n \"/opt/pomvault/server\",\n \"AWS CLI v2\",\n ]\n missing = [item for item in required if item not in text]\n if missing:\n fail(f\"docs/aws-ec2-host.md missing {missing}\")\n else:\n ok(\"docs name locked steps and Ubuntu 26.04\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_inventory_user_files.py", "line": 31, "name": "test_temp_upload_path", "purpose": "Temp upload path.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_temp_upload_path(self) -> None:\n path = \"50f6bfe8-cad0-4a84-a75c-002d584d14d4/temp/1712345678901234567_My Will.pdf\"\n self.assertEqual(mod.parse_original_name(path), \"My Will.pdf\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_inventory_user_files.py", "line": 35, "name": "test_temp_name_keeps_underscores", "purpose": "Temp name keeps underscores.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_temp_name_keeps_underscores(self) -> None:\n path = \"aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa/temp/1_bank_statement_jan.pdf\"\n self.assertEqual(mod.parse_original_name(path), \"bank_statement_jan.pdf\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_inventory_user_files.py", "line": 39, "name": "test_leaf_fallback", "purpose": "Leaf fallback.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_leaf_fallback(self) -> None:\n self.assertEqual(mod.parse_original_name(\"user/docs/deed.pdf\"), \"deed.pdf\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_inventory_user_files.py", "line": 44, "name": "test_files_table_wins", "purpose": "Files table wins.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_files_table_wins(self) -> None:\n guessed, source = mod.guess_type(\n filename=\"random.pdf\",\n mime=\"application/pdf\",\n documented=\"will_trust\",\n )\n self.assertEqual((guessed, source), (\"will_trust\", \"files.document_type\"))", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_inventory_user_files.py", "line": 52, "name": "test_filename_type_key", "purpose": "Filename type key.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_filename_type_key(self) -> None:\n guessed, source = mod.guess_type(\n filename=\"dave_tax_return_2024.pdf\",\n mime=\"application/pdf\",\n documented=None,\n )\n self.assertEqual((guessed, source), (\"tax_return\", \"filename\"))", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_inventory_user_files.py", "line": 60, "name": "test_filename_synonym_will", "purpose": "Filename synonym will.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_filename_synonym_will(self) -> None:\n guessed, source = mod.guess_type(\n filename=\"Last Will.pdf\",\n mime=\"application/pdf\",\n documented=None,\n )\n self.assertEqual((guessed, source), (\"will_trust\", \"filename\"))", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_inventory_user_files.py", "line": 68, "name": "test_will_does_not_match_william", "purpose": "Will does not match william.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_will_does_not_match_william(self) -> None:\n guessed, source = mod.guess_type(\n filename=\"william-notes.pdf\",\n mime=\"application/pdf\",\n documented=None,\n )\n self.assertEqual((guessed, source), (\"other\", \"default\"))", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_inventory_user_files.py", "line": 76, "name": "test_image_mime", "purpose": "Image mime.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_image_mime(self) -> None:\n guessed, source = mod.guess_type(\n filename=\"scan.bin\",\n mime=\"image/jpeg\",\n documented=None,\n )\n self.assertEqual((guessed, source), (\"family_photo\", \"mime\"))", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_inventory_user_files.py", "line": 84, "name": "test_longest_type_wins", "purpose": "Longest type wins.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_longest_type_wins(self) -> None:\n guessed, _source = mod.guess_type(\n filename=\"credit_card_statement.pdf\",\n mime=\"application/pdf\",\n documented=None,\n )\n self.assertEqual(guessed, \"credit_card_statement\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_inventory_user_files.py", "line": 94, "name": "test_keys_off_email_and_auth_id", "purpose": "Keys off email and auth id.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_keys_off_email_and_auth_id(self) -> None:\n rec = mod.build_object(\n {\n \"storage_object_id\": \"11111111-1111-1111-1111-111111111111\",\n \"storage_path\": \"50f6bfe8-cad0-4a84-a75c-002d584d14d4/temp/9_will.pdf\",\n \"path_auth_user_id\": \"50f6bfe8-cad0-4a84-a75c-002d584d14d4\",\n \"owner_email\": \"dave@example.com\",\n \"auth_user_id\": \"50f6bfe8-cad0-4a84-a75c-002d584d14d4\",\n \"storage_metadata\": {\"mimetype\": \"application/pdf\", \"size\": 2048},\n \"file_name\": None,\n \"document_type\": None,\n \"document_name\": None,\n }\n )\n self.assertEqual(rec[\"owner_email\"], \"dave@example.com\")\n self.assertEqual(rec[\"auth_user_id\"], \"50f6bfe8-cad0-4a84-a75c-002d584d14d4\")\n self.assertEqual(rec[\"original_name\"], \"will.pdf\")\n self.assertEqual(rec[\"mime\"], \"application/pdf\")\n self.assertEqual(rec[\"size\"], 2048)\n self.assertEqual(rec[\"storage_path\"].endswith(\"will.pdf\"), True)\n self.assertEqual(rec[\"guessed_type\"], \"will_trust\")\n self.assertNotIn(\"Dave\", json.dumps(rec))\n self.assertNotIn(\"display_name\", rec)", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_inventory_user_files.py", "line": 118, "name": "test_files_row_enriches_name_mime_type", "purpose": "Files row enriches name mime type.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_files_row_enriches_name_mime_type(self) -> None:\n rec = mod.build_object(\n {\n \"storage_path\": \"bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb/temp/1_x.bin\",\n \"owner_email\": \"shannon@example.com\",\n \"auth_user_id\": \"bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb\",\n \"file_user_id\": \"bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb\",\n \"file_name\": \"Cedar-deed.pdf\",\n \"mime_type\": \"application/pdf\",\n \"file_size\": 99,\n \"document_type\": \"property_deed\",\n \"document_name\": \"Cedar Street deed\",\n \"storage_metadata\": {},\n }\n )\n self.assertEqual(rec[\"original_name\"], \"Cedar-deed.pdf\")\n self.assertEqual(rec[\"guessed_type\"], \"property_deed\")\n self.assertEqual(rec[\"guessed_type_source\"], \"files.document_type\")\n self.assertEqual(rec[\"document_title\"], \"Cedar Street deed\")\n self.assertEqual(rec[\"size\"], 99)", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_inventory_user_files.py", "line": 139, "name": "test_missing_email_still_emits_auth_id", "purpose": "Missing email still emits auth id.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_missing_email_still_emits_auth_id(self) -> None:\n rec = mod.build_object(\n {\n \"storage_path\": \"cccccccc-cccc-cccc-cccc-cccccccccccc/temp/1_note.pdf\",\n \"owner_email\": None,\n \"auth_user_id\": None,\n \"path_auth_user_id\": \"cccccccc-cccc-cccc-cccc-cccccccccccc\",\n \"storage_metadata\": {},\n }\n )\n self.assertIsNone(rec[\"owner_email\"])\n self.assertEqual(rec[\"auth_user_id\"], \"cccccccc-cccc-cccc-cccc-cccccccccccc\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_inventory_user_files.py", "line": 154, "name": "test_empty_objects_is_valid_file", "purpose": "Empty objects is valid file.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_empty_objects_is_valid_file(self) -> None:\n inventory = mod.build_inventory(objects=[], files_table_present=False)\n self.assertEqual(inventory[\"version\"], 1)\n self.assertEqual(inventory[\"bucket\"], \"user-files\")\n self.assertFalse(inventory[\"bytes_copied\"])\n self.assertEqual(inventory[\"object_count\"], 0)\n self.assertEqual(inventory[\"objects\"], [])\n self.assertEqual(inventory[\"files_table_present\"], False)", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_inventory_user_files.py", "line": 163, "name": "test_sort_and_write_roundtrip", "purpose": "Sort and write roundtrip.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_sort_and_write_roundtrip(self) -> None:\n inventory = mod.build_inventory(\n objects=[\n {\n \"storage_path\": \"a/temp/1_b.pdf\",\n \"owner_email\": \"b@example.com\",\n \"auth_user_id\": \"aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa\",\n \"path_auth_user_id\": \"aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa\",\n \"storage_metadata\": {\"mimetype\": \"application/pdf\", \"size\": 1},\n },\n {\n \"storage_path\": \"a/temp/1_a.pdf\",\n \"owner_email\": \"a@example.com\",\n \"auth_user_id\": \"aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaab\",\n \"path_auth_user_id\": \"aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaab\",\n \"storage_metadata\": {\"mimetype\": \"application/pdf\", \"size\": 2},\n },\n ],\n files_table_present=True,\n generated_at=\"2026-08-18T00:00:00Z\",\n )\n self.assertEqual(\n [row[\"owner_email\"] for row in inventory[\"objects\"]],\n [\"a@example.com\", \"b@example.com\"],\n )\n with tempfile.TemporaryDirectory() as tmp:\n path = Path(tmp) / \"user-files-inventory.json\"\n mod.write_inventory(path, inventory)\n loaded = json.loads(path.read_text())\n self.assertEqual(loaded[\"object_count\"], 2)\n self.assertEqual(oct(path.stat().st_mode & 0o777), \"0o600\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_inventory_user_files.py", "line": 197, "name": "test_output_is_outside_dropped_schema", "purpose": "Output is outside dropped schema.", "classification": "internals", "restates": "no", "reason": "Checks packaging, documentation or configured path contract; does not prove runtime product behavior.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_output_is_outside_dropped_schema(self) -> None:\n path = mod.default_output_path()\n self.assertEqual(path.name, \"user-files-inventory.json\")\n self.assertIn(\"g5-file-retention\", path.parts)\n self.assertNotEqual(path.suffix, \".sql\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_rematerialize_user_files.py", "line": 53, "name": "test_bucket_plus_inventory_path", "purpose": "Bucket plus inventory path.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_bucket_plus_inventory_path(self) -> None:\n path = f\"{DAVE_AUTH}/temp/9_will.pdf\"\n self.assertEqual(\n mod.storage_key_for(\"user-files\", path),\n f\"user-files/{path}\",\n )", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_rematerialize_user_files.py", "line": 60, "name": "test_strips_leading_slash", "purpose": "Strips leading slash.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_strips_leading_slash(self) -> None:\n self.assertEqual(\n mod.storage_key_for(\"user-files\", \"/a/b.pdf\"),\n \"user-files/a/b.pdf\",\n )", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_rematerialize_user_files.py", "line": 68, "name": "test_quote_preserves_slashes_encodes_spaces", "purpose": "Quote preserves slashes encodes spaces.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_quote_preserves_slashes_encodes_spaces(self) -> None:\n url = mod.storage_object_url(\n \"http://127.0.0.1:54321\",\n \"user-files/x/My Will.pdf\",\n )\n self.assertEqual(\n url,\n \"http://127.0.0.1:54321/storage/v1/object/user-files/x/My%20Will.pdf\",\n )\n self.assertIn(\"/user-files/x/\", url)\n self.assertNotIn(\" \", url)", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_rematerialize_user_files.py", "line": 80, "name": "test_quote_reserved_characters", "purpose": "Quote reserved characters.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_quote_reserved_characters(self) -> None:\n url = mod.storage_object_url(\n \"http://127.0.0.1:54321\",\n \"user-files/x/tax#2024?draft.pdf\",\n )\n self.assertEqual(\n url,\n \"http://127.0.0.1:54321/storage/v1/object/user-files/x/tax%232024%3Fdraft.pdf\",\n )", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_rematerialize_user_files.py", "line": 90, "name": "test_download_object_uses_encoded_url", "purpose": "Download object uses encoded url.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_download_object_uses_encoded_url(self) -> None:\n seen: dict[str, str] = {}\n\n class Resp:\n def read(self) -> bytes:\n return b\"%PDF-1.1\\n\"\n\n def __enter__(self) -> \"Resp\":\n return self\n\n def __exit__(self, *args: object) -> bool:\n return False\n\n def fake_urlopen(req: urllib.request.Request, timeout: int = 60) -> Resp:\n seen[\"url\"] = req.get_full_url()\n return Resp()\n\n orig = urllib.request.urlopen\n urllib.request.urlopen = fake_urlopen # type: ignore[method-assign]\n try:\n data = mod.download_object(\n \"http://127.0.0.1:54321\",\n \"service-role-key\",\n \"user-files/x/My Will.pdf\",\n )\n finally:\n urllib.request.urlopen = orig # type: ignore[method-assign]\n self.assertEqual(data, b\"%PDF-1.1\\n\")\n self.assertEqual(\n seen[\"url\"],\n \"http://127.0.0.1:54321/storage/v1/object/user-files/x/My%20Will.pdf\",\n )", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_rematerialize_user_files.py", "line": 125, "name": "test_document_title_wins", "purpose": "Document title wins.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_document_title_wins(self) -> None:\n self.assertEqual(\n mod.item_title(\n {\n \"document_title\": \"Cedar Street deed\",\n \"original_name\": \"deed.pdf\",\n \"storage_path\": \"x/temp/1_deed.pdf\",\n }\n ),\n \"Cedar Street deed\",\n )", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_rematerialize_user_files.py", "line": 137, "name": "test_original_name_then_leaf", "purpose": "Original name then leaf.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_original_name_then_leaf(self) -> None:\n self.assertEqual(\n mod.item_title({\"original_name\": \"My Will.pdf\", \"storage_path\": \"x/y\"}),\n \"My Will.pdf\",\n )\n self.assertEqual(mod.item_title({\"storage_path\": \"x/temp/1_note.pdf\"}), \"1_note.pdf\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_rematerialize_user_files.py", "line": 146, "name": "test_published_guessed_type", "purpose": "Published guessed type.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_published_guessed_type(self) -> None:\n self.assertEqual(\n mod.resolve_document_type(\"bank_statement\", PUBLISHED),\n (\"bank_statement\", \"guessed_type\"),\n )", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_rematerialize_user_files.py", "line": 152, "name": "test_will_trust_alias", "purpose": "Will trust alias.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_will_trust_alias(self) -> None:\n self.assertEqual(\n mod.resolve_document_type(\"will_trust\", PUBLISHED),\n (\"will\", \"gen1_alias\"),\n )", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_rematerialize_user_files.py", "line": 158, "name": "test_property_deed_alias", "purpose": "Property deed alias.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_property_deed_alias(self) -> None:\n self.assertEqual(\n mod.resolve_document_type(\"property_deed\", PUBLISHED),\n (\"deed\", \"gen1_alias\"),\n )", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_rematerialize_user_files.py", "line": 164, "name": "test_unknown_falls_back", "purpose": "Unknown falls back.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_unknown_falls_back(self) -> None:\n self.assertEqual(\n mod.resolve_document_type(\"family_photo\", PUBLISHED),\n (\"any_document\", \"default\"),\n )\n self.assertEqual(\n mod.resolve_document_type(\"other\", PUBLISHED),\n (\"any_document\", \"gen1_alias\"),\n )", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_rematerialize_user_files.py", "line": 188, "name": "test_auth_id_wins", "purpose": "Auth id wins.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_auth_id_wins(self) -> None:\n matched, reason = mod.match_owner(\n {\n \"auth_user_id\": DAVE_AUTH,\n \"owner_email\": \"other@example.com\",\n },\n by_auth=self.by_auth,\n by_email=self.by_email,\n no_account_emails=self.no_account,\n )\n self.assertIsNone(reason)\n self.assertEqual(matched.person_id, DAVE_PERSON)", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_rematerialize_user_files.py", "line": 201, "name": "test_email_fallback", "purpose": "Email fallback.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_email_fallback(self) -> None:\n matched, reason = mod.match_owner(\n {\"auth_user_id\": None, \"owner_email\": \"Dave@Example.com\"},\n by_auth=self.by_auth,\n by_email=self.by_email,\n no_account_emails=self.no_account,\n )\n self.assertIsNone(reason)\n self.assertEqual(matched.email, \"dave@example.com\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_rematerialize_user_files.py", "line": 211, "name": "test_never_keys_off_display_name", "purpose": "Never keys off display name.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_never_keys_off_display_name(self) -> None:\n matched, reason = mod.match_owner(\n {\"auth_user_id\": None, \"owner_email\": None, \"display_name\": \"Dave\"},\n by_auth=self.by_auth,\n by_email=self.by_email,\n no_account_emails=self.no_account,\n )\n self.assertIsNone(matched)\n self.assertEqual(reason, \"missing_owner\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_rematerialize_user_files.py", "line": 221, "name": "test_person_without_account", "purpose": "Person without account.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_person_without_account(self) -> None:\n matched, reason = mod.match_owner(\n {\"owner_email\": \"guest@seed.persynl.invalid\"},\n by_auth=self.by_auth,\n by_email=self.by_email,\n no_account_emails=self.no_account,\n )\n self.assertIsNone(matched)\n self.assertEqual(reason, \"no_account\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_rematerialize_user_files.py", "line": 231, "name": "test_unknown_owner", "purpose": "Unknown owner.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_unknown_owner(self) -> None:\n _, reason = mod.match_owner(\n {\n \"auth_user_id\": \"ffffffff-ffff-ffff-ffff-ffffffffffff\",\n \"owner_email\": \"nobody@example.com\",\n },\n by_auth=self.by_auth,\n by_email=self.by_email,\n no_account_emails=self.no_account,\n )\n self.assertEqual(reason, \"owner_not_found\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_rematerialize_user_files.py", "line": 245, "name": "test_verified_death_and_free", "purpose": "Verified death and free.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_verified_death_and_free(self) -> None:\n self.assertEqual(\n mod.owner_skip_reason(owner(verified_death=True)),\n \"verified_death\",\n )\n self.assertEqual(\n mod.owner_skip_reason(owner(status=\"disabled\")),\n \"account_disabled\",\n )\n self.assertEqual(\n mod.owner_skip_reason(owner(account_type=\"free_read_only\")),\n \"not_full_account\",\n )\n self.assertIsNone(mod.owner_skip_reason(owner()))", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_rematerialize_user_files.py", "line": 262, "name": "test_empty_objects_valid", "purpose": "Empty objects valid.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_empty_objects_valid(self) -> None:\n parsed = mod.parse_inventory(\n {\n \"version\": 1,\n \"bucket\": \"user-files\",\n \"object_count\": 0,\n \"objects\": [],\n }\n )\n self.assertEqual(parsed[\"objects\"], [])\n self.assertEqual(parsed[\"bucket\"], \"user-files\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_rematerialize_user_files.py", "line": 274, "name": "test_rejects_other_version", "purpose": "Rejects other version.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_rejects_other_version(self) -> None:\n with self.assertRaises(ValueError):\n mod.parse_inventory({\"version\": 2, \"bucket\": \"user-files\", \"objects\": []})", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_rematerialize_user_files.py", "line": 309, "name": "test_dry_run_owner_file", "purpose": "Dry run owner file.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_dry_run_owner_file(self) -> None:\n result = self._run(\n {\n \"auth_user_id\": EMILY_AUTH,\n \"owner_email\": \"emily@example.com\",\n \"storage_path\": f\"{EMILY_AUTH}/temp/1_My Will.pdf\",\n \"original_name\": \"My Will.pdf\",\n \"guessed_type\": \"will_trust\",\n }\n )\n self.assertEqual(result[\"status\"], \"would_attach\")\n self.assertEqual(result[\"person_id\"], EMILY_PERSON)\n self.assertEqual(result[\"document_type\"], \"will\")\n self.assertEqual(\n result[\"storage_key\"],\n f\"user-files/{EMILY_AUTH}/temp/1_My Will.pdf\",\n )\n self.assertNotIn(\"Dave\", json.dumps(result))", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_rematerialize_user_files.py", "line": 328, "name": "test_free_account_fails_closed", "purpose": "Free account fails closed.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_free_account_fails_closed(self) -> None:\n result = self._run(\n {\n \"auth_user_id\": FRANK_AUTH,\n \"owner_email\": \"frank@example.com\",\n \"storage_path\": f\"{FRANK_AUTH}/temp/1_note.pdf\",\n }\n )\n self.assertEqual(result[\"status\"], \"failed\")\n self.assertEqual(result[\"reason\"], \"not_full_account\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_rematerialize_user_files.py", "line": 339, "name": "test_missing_owner_fails", "purpose": "Missing owner fails.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_missing_owner_fails(self) -> None:\n result = self._run({\"storage_path\": \"orphan/temp/1.pdf\"})\n self.assertEqual(result[\"status\"], \"failed\")\n self.assertEqual(result[\"reason\"], \"missing_owner\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_rematerialize_user_files.py", "line": 344, "name": "test_attach_uses_hasher_and_callback_shape", "purpose": "Attach uses hasher and callback shape.", "classification": "mixed", "restates": "no", "reason": "Confirms missing database yields failure through injected dependencies; callback assertions also pin collaborator arguments.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_attach_uses_hasher_and_callback_shape(self) -> None:\n def hasher(storage_key: str) -> tuple[str, int, str]:\n self.assertTrue(storage_key.startswith(\"user-files/\"))\n return \"ab\" * 32, 12, \"application/pdf\"\n\n # Without a db, live attach cannot run; hasher is only reached after\n # owner + type checks when dry_run is false.\n result = self._run(\n {\n \"auth_user_id\": EMILY_AUTH,\n \"owner_email\": \"emily@example.com\",\n \"storage_path\": f\"{EMILY_AUTH}/temp/1_stmt.pdf\",\n \"guessed_type\": \"bank_statement\",\n },\n dry_run=False,\n hasher=hasher,\n )\n self.assertEqual(result[\"status\"], \"failed\")\n self.assertEqual(result[\"reason\"], \"missing_db\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_rematerialize_user_files.py", "line": 364, "name": "test_two_paths_same_sha_second_run", "purpose": "Two paths same sha second run.", "classification": "mixed", "restates": "partial", "reason": "Production orchestration runs, but the fake attach callback implements blob deduplication and item creation itself. Counts partly validate the fake rather than real SQL storage.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_two_paths_same_sha_second_run(self) -> None:\n sha = \"ab\" * 32\n blobs: list[dict] = []\n items: list[dict] = []\n documents: list[dict] = []\n mappings: list[dict] = []\n\n def lookup(bucket: str, storage_path: str) -> dict | None:\n return mod.find_existing_mapping(\n bucket=bucket,\n storage_path=storage_path,\n mappings=mappings,\n )\n\n def attacher(**kwargs) -> dict:\n existing = lookup(kwargs[\"bucket\"], kwargs[\"storage_path\"])\n if existing:\n return {\n \"already_attached\": True,\n \"item_id\": existing[\"item_id\"],\n \"blob_id\": existing[\"blob_id\"],\n \"visible\": True,\n }\n blob = next((row for row in blobs if row[\"sha256\"] == kwargs[\"sha\"]), None)\n if blob is None:\n blob = {\"id\": f\"blob-{len(blobs) + 1}\", \"sha256\": kwargs[\"sha\"]}\n blobs.append(blob)\n item_id = f\"item-{len(items) + 1}\"\n items.append({\"id\": item_id, \"blob_id\": blob[\"id\"]})\n documents.append({\"item_id\": item_id, \"document_type\": kwargs[\"document_type\"]})\n mappings.append(\n {\n \"bucket\": kwargs[\"bucket\"],\n \"storage_path\": kwargs[\"storage_path\"],\n \"blob_id\": blob[\"id\"],\n \"item_id\": item_id,\n }\n )\n return {\n \"already_attached\": False,\n \"item_id\": item_id,\n \"blob_id\": blob[\"id\"],\n \"visible\": True,\n }\n\n def hasher(_storage_key: str) -> tuple[str, int, str]:\n return sha, 12, \"application/pdf\"\n\n path_a = {\n \"auth_user_id\": EMILY_AUTH,\n \"owner_email\": \"emily@example.com\",\n \"storage_path\": f\"{EMILY_AUTH}/temp/1_will.pdf\",\n \"original_name\": \"will.pdf\",\n \"guessed_type\": \"will_trust\",\n }\n path_b = {\n \"auth_user_id\": EMILY_AUTH,\n \"owner_email\": \"emily@example.com\",\n \"storage_path\": f\"{EMILY_AUTH}/temp/2_will copy.pdf\",\n \"original_name\": \"will copy.pdf\",\n \"guessed_type\": \"will_trust\",\n }\n first = self._run(path_a, dry_run=False, hasher=hasher, lookup=lookup, attacher=attacher)\n second = self._run(path_b, dry_run=False, hasher=hasher, lookup=lookup, attacher=attacher)\n counts = (len(blobs), len(items), len(documents), len(mappings))\n rerun_a = self._run(path_a, dry_run=False, hasher=hasher, lookup=lookup, attacher=attacher)\n rerun_b = self._run(path_b, dry_run=False, hasher=hasher, lookup=lookup, attacher=attacher)\n self.assertEqual(first[\"status\"], \"attached\")\n self.assertEqual(first[\"item_id\"], \"item-1\")\n self.assertEqual(first[\"blob_id\"], \"blob-1\")\n self.assertEqual(second[\"status\"], \"attached\")\n self.assertEqual(second[\"item_id\"], \"item-2\")\n self.assertEqual(second[\"blob_id\"], \"blob-1\")\n self.assertEqual(counts, (1, 2, 2, 2))\n self.assertEqual(rerun_a[\"status\"], \"already_attached\")\n self.assertEqual(rerun_a[\"item_id\"], \"item-1\")\n self.assertEqual(rerun_b[\"status\"], \"already_attached\")\n self.assertEqual(rerun_b[\"item_id\"], \"item-2\")\n self.assertEqual(\n (len(blobs), len(items), len(documents), len(mappings)),\n counts,\n )", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_rematerialize_user_files.py", "line": 449, "name": "test_identity_is_bucket_and_path_not_sha", "purpose": "Identity is bucket and path not sha.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_identity_is_bucket_and_path_not_sha(self) -> None:\n mappings = [\n {\n \"bucket\": \"user-files\",\n \"storage_path\": \"a/one.pdf\",\n \"blob_id\": \"blob-1\",\n \"item_id\": \"item-1\",\n }\n ]\n self.assertEqual(\n mod.find_existing_mapping(\n bucket=\"user-files\",\n storage_path=\"a/one.pdf\",\n mappings=mappings,\n )[\"item_id\"],\n \"item-1\",\n )\n self.assertIsNone(\n mod.find_existing_mapping(\n bucket=\"user-files\",\n storage_path=\"a/two.pdf\",\n mappings=mappings,\n )\n )", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_rematerialize_user_files.py", "line": 476, "name": "test_quotes_title_and_uses_create_item_mine", "purpose": "Quotes title and uses create item mine.", "classification": "internals", "restates": "yes", "reason": "Checks generated SQL for chosen writer calls, INSERT fragments and absence of extract text; does not execute it to prove quoting, visibility or deduplication.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_quotes_title_and_uses_create_item_mine(self) -> None:\n sql = mod.attach_sql(\n owner_id=EMILY_PERSON,\n title=\"O'Hara will\",\n sha=\"ab\" * 32,\n mime=\"application/pdf\",\n size=4,\n storage_key=\"user-files/x/temp/1.pdf\",\n document_type=\"will\",\n bucket=\"user-files\",\n storage_path=\"x/temp/1.pdf\",\n )\n self.assertIn(\"create_item_mine\", sql)\n self.assertIn(\"INSERT INTO blob\", sql)\n self.assertIn(\"INSERT INTO document\", sql)\n self.assertIn(\"INSERT INTO rematerialize_object\", sql)\n self.assertIn(\"can_see_item\", sql)\n self.assertIn(\"O'Hara will\", sql)\n self.assertIn(\"WHERE sha256 =\", sql)\n self.assertNotIn(\"OR b.sha256\", sql)\n self.assertNotIn(\"supersede_document_slice\", sql)\n self.assertNotIn(\"extract\", sql.lower())", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_rematerialize_user_files.py", "line": 501, "name": "test_input_is_retention_inventory", "purpose": "Input is retention inventory.", "classification": "internals", "restates": "no", "reason": "Checks packaging, documentation or configured path contract; does not prove runtime product behavior.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_input_is_retention_inventory(self) -> None:\n self.assertEqual(mod.DEFAULT_INPUT.name, \"user-files-inventory.json\")\n self.assertIn(\"g5-file-retention\", mod.DEFAULT_INPUT.parts)", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_seed_contracts.py", "line": 16, "name": "test_explicit_reference", "purpose": "Explicit reference.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_explicit_reference(self):\n self.assertEqual(refs.invalid_references(\"SELECT 'person:' || person_id::text, 'person:11111111-1111-4111-8111-111111111111';\"), [])", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_seed_contracts.py", "line": 19, "name": "test_nickname_rejected", "purpose": "Nickname rejected.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_nickname_rejected(self):\n self.assertEqual(refs.invalid_references(\"INSERT INTO entity VALUES ('person:frank');\"), ['person:frank'])", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_seed_contracts.py", "line": 22, "name": "test_comments_are_not_seed_references", "purpose": "Comments are not seed references.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_comments_are_not_seed_references(self):\n self.assertEqual(refs.invalid_references(\"-- old 'person:frank'\\nSELECT 'person:' || id;\"), [])", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_seed_contracts.py", "line": 25, "name": "test_checker_exit_status", "purpose": "Checker exit status.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_checker_exit_status(self):\n with tempfile.TemporaryDirectory() as d:\n p = Path(d) / 'seed.sql'\n p.write_text(\"SELECT 'person:frank';\")\n result = subprocess.run(['python3', str(ROOT / 'scripts/check-seed-person-refs.py'), str(p)], capture_output=True)\n self.assertNotEqual(result.returncode, 0)\n self.assertIn(b'explicit person uuid', result.stderr)", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_seed_contracts.py", "line": 35, "name": "test_serial_policy_cannot_be_overridden", "purpose": "Serial policy cannot be overridden.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_serial_policy_cannot_be_overridden(self):\n with tempfile.TemporaryDirectory() as d:\n go = Path(d) / 'go'\n go.write_text('#!/bin/sh\\nprintf \"%s\\\\n\" \"$@\"\\n')\n go.chmod(0o755)\n env = {**os.environ, 'PATH': d + ':' + os.environ['PATH'], 'GOFLAGS': '',\n 'LOCAL_INTEGRATION_TESTS': '1', 'CI': 'true',\n 'BEDROCK_BDA_ENABLE': '0', 'BEDROCK_LLM_ENABLE': '0'}\n cmd = ['bash', str(ROOT / 'scripts/test-go-race.sh')]\n result = subprocess.run(cmd, env=env, capture_output=True, text=True)\n self.assertEqual(result.returncode, 0, result.stderr)\n self.assertEqual(result.stdout.splitlines(), ['test', '-race', '-count=1', '-p', '1', './...'])\n self.assertEqual(subprocess.run(cmd + ['-p', '4'], env=env, capture_output=True).returncode, 2)\n env['GOFLAGS'] = '-run=Nothing'\n self.assertEqual(subprocess.run(cmd, env=env, capture_output=True).returncode, 2)", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_seed_contracts.py", "line": 53, "name": "test_original_rows_must_survive_but_fixture_history_may_grow", "purpose": "Original rows must survive but fixture history may grow.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_original_rows_must_survive_but_fixture_history_may_grow(self):\n with tempfile.TemporaryDirectory() as d:\n psql = Path(d) / 'psql'\n psql.write_text('#!/bin/sh\\nprintf \"%s\\\\n\" \"$TEST_PSQL_ROWS\"\\n')\n psql.chmod(0o755)\n env = {**os.environ, 'PATH': d + ':' + os.environ['PATH'],\n 'PGHOST': '127.0.0.1', 'PGPORT': '54922', 'PGDATABASE': 'postgres',\n 'PGUSER': 'postgres', 'TEST_PSQL_ROWS': 'seed-id|original-hash'}\n state = str(Path(d) / 'state.json')\n cmd = ['python3', str(ROOT / 'scripts/check-seed-state.py')]\n self.assertEqual(subprocess.run(cmd + ['snapshot', state], env=env, capture_output=True).returncode, 0)\n env['TEST_PSQL_ROWS'] += '\\nfixture-id|retained-history'\n self.assertEqual(subprocess.run(cmd + ['verify', state], env=env, capture_output=True).returncode, 0)\n env['TEST_PSQL_ROWS'] = 'seed-id|changed-hash'\n self.assertEqual(subprocess.run(cmd + ['verify', state], env=env, capture_output=True).returncode, 1)\n env['TEST_PSQL_ROWS'] = ''\n self.assertEqual(subprocess.run(cmd + ['verify', state], env=env, capture_output=True).returncode, 1)\n env['PGHOST'] = 'remote.example'\n self.assertEqual(subprocess.run(cmd + ['snapshot', state + '.remote'], env=env, capture_output=True).returncode, 2)", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_seed_contracts.py", "line": 75, "name": "test_temp_batches_preserve_each_sources_include_directory", "purpose": "Temp batches preserve each sources include directory.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_temp_batches_preserve_each_sources_include_directory(self):\n spec = importlib.util.spec_from_file_location('seed_runner', ROOT / 'scripts/seed_local.py')\n runner = importlib.util.module_from_spec(spec)\n spec.loader.exec_module(runner)\n with tempfile.TemporaryDirectory() as d:\n base = Path(d)\n sources = []\n for name in ('death pack', 'heir pack'):\n directory = base / name\n directory.mkdir()\n (directory / 'check.sql').write_text('SELECT 1;\\n')\n source = directory / 'seed.sql'\n source.write_text(\"BEGIN;\\n\\\\ir check.sql\\nCOMMIT;\\n\")\n sources.append(source)\n # This generated psql batch is an owned protocol: include paths\n # must still open correctly after run_sql moves it to /tmp.\n batch = base / 'elsewhere' / 'batch.sql'\n batch.parent.mkdir()\n batch.write_text(runner.stitch_sql(sources, label='test-seed'))\n paths = [Path(shlex.split(line[len('\\\\ir '):])[0])\n for line in batch.read_text().splitlines() if line.startswith('\\\\ir ')]\n self.assertEqual(paths, [p.parent / 'check.sql' for p in sources])\n for path in paths:\n self.assertTrue(path.is_absolute())\n self.assertEqual(path.read_text(), 'SELECT 1;\\n')", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_staff_bootstrap.py", "line": 75, "name": "test_posts_only_email_to_bootstrap_rpc", "purpose": "Posts only email to bootstrap rpc.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_posts_only_email_to_bootstrap_rpc(self) -> None:\n proc = self.run_script(\"--email\", \"ada@example.com\")\n self.assertEqual(proc.returncode, 0, proc.stderr)\n self.assertEqual(proc.stdout.strip(), f\"First Lead: {PERSON}\")\n self.assertEqual(len(self.server.seen), 1)\n seen = self.server.seen[0]\n self.assertEqual(seen[\"path\"], \"/rest/v1/rpc/bootstrap_first_lead\")\n self.assertEqual(json.loads(seen[\"body\"]), {\"p_email\": \"ada@example.com\"})\n self.assertEqual(seen[\"apikey\"], \"test-service-key\")\n self.assertEqual(seen[\"authorization\"], \"Bearer test-service-key\")", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_staff_bootstrap.py", "line": 86, "name": "test_refusal_prints_message_and_exits_1", "purpose": "Refusal prints message and exits 1.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_refusal_prints_message_and_exits_1(self) -> None:\n self.server.mode = \"refuse\"\n proc = self.run_script(\"--email\", \"ada@example.com\")\n self.assertEqual(proc.returncode, 1)\n self.assertEqual(proc.stderr.strip(), \"staff already exist\")\n self.assertNotIn(\"First Lead:\", proc.stdout)", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_staff_bootstrap.py", "line": 93, "name": "test_missing_url_or_key_exits_1_without_request", "purpose": "Missing url or key exits 1 without request.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_missing_url_or_key_exits_1_without_request(self) -> None:\n secret = \"super-secret-service-key\"\n port = self.server.server_address[1]\n cases = (\n {\"SUPABASE_SERVICE_ROLE_KEY\": secret},\n {\"SUPABASE_URL\": f\"http://127.0.0.1:{port}\"},\n )\n for extra in cases:\n self.server.seen = []\n env = os.environ.copy()\n env.pop(\"SUPABASE_URL\", None)\n env.pop(\"SUPABASE_SERVICE_ROLE_KEY\", None)\n env.update(extra)\n proc = subprocess.run(\n [sys.executable, str(SCRIPT), \"--email\", \"ada@example.com\"],\n env=env,\n capture_output=True,\n text=True,\n check=False,\n )\n self.assertEqual(proc.returncode, 1, proc.stderr)\n self.assertEqual(self.server.seen, [])\n self.assertNotIn(secret, proc.stdout)\n self.assertNotIn(secret, proc.stderr)\n self.assertNotIn(\"First Lead:\", proc.stdout)", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_staff_bootstrap.py", "line": 119, "name": "test_missing_url_prints_clear_message", "purpose": "Missing url prints clear message.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_missing_url_prints_clear_message(self) -> None:\n secret = \"super-secret-service-key\"\n self.server.seen = []\n env = os.environ.copy()\n env.pop(\"SUPABASE_URL\", None)\n env[\"SUPABASE_SERVICE_ROLE_KEY\"] = secret\n proc = subprocess.run(\n [sys.executable, str(SCRIPT), \"--email\", \"ada@example.com\"],\n env=env,\n capture_output=True,\n text=True,\n check=False,\n )\n self.assertEqual(proc.returncode, 1)\n self.assertEqual(\n proc.stderr.strip(),\n \"SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY are required\",\n )\n self.assertNotIn(\"Traceback\", proc.stderr)\n self.assertNotIn(\"ValueError\", proc.stderr)\n self.assertEqual(self.server.seen, [])\n self.assertNotIn(secret, proc.stdout)\n self.assertNotIn(secret, proc.stderr)\n self.assertNotIn(\"First Lead:\", proc.stdout)", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "scripts/test_staff_bootstrap.py", "line": 144, "name": "test_missing_email_exits_nonzero", "purpose": "Missing email exits nonzero.", "classification": "behavior", "restates": "no", "reason": "Asserts function results, CLI outputs/refusals or emitted requests against independent fixture expectations.", "execution_notes": "Python test function; not executed. Fixture/CLI dependencies vary; AWS harness is designed for stubbed/dry-run checks.", "evidence": "def test_missing_email_exits_nonzero(self) -> None:\n proc = self.run_script()\n self.assertNotEqual(proc.returncode, 0)\n self.assertEqual(self.server.seen, [])", "confidence": "reviewed assertions", "framework": "Python" }, { "file": "product/persynl-physical-data-model/test_catalog_metadata.py", "line": 121, "name": "main fixture harness", "purpose": "Validates catalog metadata generation, published mappings, lock-text guards, migration immutability, and invalid ontology fixtures.", "classification": "mixed", "restates": "partial", "reason": "Combines real generator/invalid-input behavior with hard-coded catalog and generated SQL structure checks. Kept as one monolithic declared harness, not one row per assertion.", "execution_notes": "Direct Python entrypoint; requires ontology dependencies. Not included in npm test. Not executed.", "evidence": "def main() -> None:\n failures: list[str] = []\n\n lint_seed(ONTOLOGY_DIR)\n insurance = load_yaml(ONTOLOGY_DIR / \"insurance.yaml\")\n banned_sources = {\n (\"medicare_beneficiary_id\", \"policy.medicare\", \"document\", \"medicare_card\"),\n (\"member_id\", \"policy.health\", \"document\", \"id_card\"),\n }\n for prop in insurance[\"properties\"]:\n for src in prop.get(\"sources\") or []:\n pair = (\n prop[\"key\"],\n prop[\"domain_class_key\"],\n src.get(\"kind\"),\n src.get(\"key\"),\n )\n if pair in banned_sources:\n failures.append(\n \"full card number source still authored: \"\n + \"/\".join(str(part) for part in pair)\n )\n\n historic_hash = hashlib.sha256(\n METADATA_MIGRATION_HISTORIC.read_bytes()\n ).hexdigest()\n if historic_hash != HISTORIC_METADATA_SHA256:\n failures.append(\n \"historic metadata migration sha256 drifted: \" + historic_hash\n )\n\n kind_data, _kind_sql = GEN.emit_document_kinds(ONTOLOGY_DIR)\n facts, _doc_keys, _stats = GEN.build_catalog(ONTOLOGY_DIR)\n seed_a = GEN.write_metadata_seed_sql(facts, kind_data)\n seed_b = GEN.write_metadata_seed_sql(facts, kind_data)\n if seed_a != seed_b:\n failures.append(\"metadata seed SQL is not deterministic\")\n live_seed = METADATA_SEED.read_text(encoding=\"utf-8\")\n if live_seed != GEN.wrap_seed_txn(seed_a):\n failures.append(\n \"catalog-metadata-seed.sql does not match generator output\"\n )\n if \"\\nbegin;\\n\" not in live_seed or not live_seed.rstrip().endswith(\"commit;\"):\n failures.append(\"standalone metadata seed lacks begin/commit wrap\")\n if re.search(r\"^begin;|^commit;\", seed_a, re.M):\n failures.append(\"embedded metadata block carries its own transaction\")\n\n for needle in (\n \"base_catalog_version_id\",\n \"v2-2026-09-17\",\n \"v2-2026-07-22\",\n \"refusing to reseed an existing version\",\n \"catalog metadata mirror\",\n ):\n if needle not in seed_a:\n failures.append(f\"metadata seed missing {needle!r}\")\n\n # Locks run inside DO blocks, publication -> catalog -> onto, and no\n # top-level PERFORM or SHARE helper path survives.\n if \"PERFORM public._g6_lock_published_kind_publication\" in seed_a:\n failures.append(\"SHARE helper path reintroduced in publication block\")\n if \"FOR SHARE\" in seed_a:\n failures.append(\"SHARE -> UPDATE upgrade path in publication block\")\n pub_lock = seed_a.find(\n \"FROM document_kind_publication WHERE status = 'published' FOR UPDATE\"\n )\n cat_lock = seed_a.find(\n \"FROM catalog_version WHERE status = 'published' FOR UPDATE\"\n )\n onto_lock = seed_a.find(\n \"FROM onto_version WHERE status = 'published' FOR UPDATE\"\n )\n if not (0 <= pub_lock < cat_lock < onto_lock):\n failures.append(\n \"publication lock order is not publication -> catalog -> onto\"\n )\n for m in re.finditer(r\"^PERFORM \", seed_a, re.M):\n failures.append(\"top-level PERFORM outside DO block\")\n\n # Each FOR UPDATE lock must abort on zero rows: a row another\n # publisher superseded re-checks as not-published under READ\n # COMMITTED, and proceeding unlocked is the bug this guards.\n for tbl in (\n \"document_kind_publication\",\n \"catalog_version\",\n \"onto_version\",\n ):\n if not re.search(\n r\"PERFORM 1 FROM \" + tbl\n + r\"\\s+WHERE status = 'published' FOR UPDATE;\\s+\"\n + r\"IF NOT FOUND THEN\\s+RAISE EXCEPTION 'stale publication state[^']*'\"\n + r\"\\s+USING ERRCODE = '40001';\",\n seed_a,\n ):\n failures.append(f\"{tbl} lock lacks IF NOT FOUND -> 40001 guard\")\n\n # Metadata publication clones base definitions/sources verbatim and\n # overlays metadata only: no generated-source reseed may reach\n # fact_definition_source, and drift guards must be present.\n for needle in (\n \"FROM fact_definition_source s\\n JOIN fact_definition fd_old\",\n \"Overlay reviewed metadata columns onto the cloned rows\",\n \"diverge from published base\",\n \"base mappings preserved verbatim\",\n \"refusing to overwrite\",\n ):\n if needle not in seed_a:\n failures.append(f\"metadata seed missing clone/drift-guard {needle!r}\")\n if re.search(\n r\"_catalog_source_seed s\\s+join catalog_version\", seed_a, re.I\n ):\n failures.append(\"generated sources are reseeded, not cloned\")\n\n # Curated guard compares cloned onto values against the BASE catalog\n # (fd_old), never the new version's fd -- otherwise every legitimate\n # second-version list update would be refused.\n guard = re.search(\n r\"Curated-vocabulary guard(.*?)END \\$\\$;\", seed_a, re.S\n )\n if not guard:\n failures.append(\"curated-vocabulary guard block missing\")\n else:\n g = guard.group(1)\n if \"fd_old\" not in g or \"cv_old.version_label = 'v2-2026-07-22'\" not in g:\n failures.append(\"curated guard does not join the base catalog\")\n if re.search(r\"JOIN catalog_version cv ON cv.id = ov\", g):\n failures.append(\"curated guard joined the NEW catalog again\")\n\n # Successor probe: a second-version list change must publish.\n probe = GEN.write_successor_probe_sql(\n facts, kind_data,\n base_label=\"v2-2026-09-17\",\n new_label=\"v3-2099-01-01\",\n )\n for needle in (\n \"BEGIN;\",\n \"ROLLBACK;\",\n \"probe_second_version_value\",\n \"cv_old.version_label = 'v2-2026-09-17'\",\n \"ov_new.version_label = 'v3-2099-01-01'\",\n \"second-version list update did not land\",\n ):\n if needle not in probe:\n failures.append(f\"successor probe missing {needle!r}\")\n if \"v2-2026-07-22\" in probe:\n failures.append(\"successor probe leaked the legacy base label\")\n probe_facts = metadata_facts(probe)\n mutated_rows = [\n r for r in probe_facts\n if \"probe_second_version_value\" in (r.get(\"enum_values\") or [])\n ]\n if len(mutated_rows) != 1:\n failures.append(\"successor probe did not mutate exactly one closed list\")\n if \"probe_second_version_value\" in seed_a:\n failures.append(\"probe mutation leaked into the real metadata seed\")\n\n # Refusal probe: pre-diverges a published onto row, then runs the real\n # block; the curated guard must raise 'refusing to overwrite'.\n refusal = GEN.write_refusal_probe_sql(\n facts, kind_data,\n base_label=\"v2-2026-09-17\",\n new_label=\"v3-2099-01-01\",\n )\n for needle in (\n \"BEGIN;\",\n \"ROLLBACK;\",\n \"probe_curated_divergence\",\n \"ov.status = 'published'\",\n \"refusing to overwrite\",\n \"cv_old.version_label = 'v2-2026-09-17'\",\n ):\n if needle not in refusal:\n failures.append(f\"refusal probe missing {needle!r}\")\n if \"probe_curated_divergence\" in seed_a:\n failures.append(\"refusal divergence leaked into the real metadata seed\")\n\n # Probe label footgun: default metadata labels re-run the initial\n # migration's version pair and must be refused before generation.\n for probe_args in (\n [\"--successor-probe\", \"p.sql\"],\n [\"--refusal-probe\", \"p.sql\"],\n [\"--successor-probe\", \"p.sql\", \"--metadata-base-version\", \"v2-2026-09-17\"],\n ):\n try:\n argv = sys.argv\n sys.argv = [\"generate-catalog-seed.py\"] + probe_args\n GEN.main()\n except SystemExit:\n pass\n else:\n failures.append(f\"probe with default labels not refused: {probe_args}\")\n finally:\n sys.argv = argv\n\n rows = metadata_facts(seed_a)\n by_key = {}\n for row in rows:\n by_key.setdefault(row[\"fact_key\"], []).append(row)\n\n # Closed family: dep_subtype on account.depository only.\n dep = by_key.get(\"dep_subtype\")\n if not dep or len(dep) != 1 or dep[0].get(\"enum_policy\") != \"closed\":\n failures.append(\"dep_subtype is not exactly one closed row\")\n elif dep[0][\"entity_type_subtype\"] != \"account.depository\":\n failures.append(\"dep_subtype expanded beyond account.depository\")\n elif dep[0].get(\"enum_aliases\", {}).get(\"mmkt\") != \"money_market\":\n failures.append(\"dep_subtype missing approved mmkt alias\")\n\n # account.* families share one authored row: reviewed metadata inherits\n # uniformly to all 10 expanded domains (explicit audit decision).\n # acct_ownership_form is not here: round 3 (M3) retires it, because Persynl\n # never stores the legal ownership form from any source.\n for key, policy in (\n (\"acct_status\", \"closed\"),\n (\"acct_type\", \"open\"),\n ):\n scoped = by_key.get(key, [])\n if len(scoped) != 10 or any(\n r.get(\"enum_policy\") != policy for r in scoped\n ):\n failures.append(\n f\"{key}: expected 10 uniform {policy} rows, got \"\n f\"{len(scoped)}\"\n )\n\n # policy.common expands to 27 targets for the shared closed families.\n for key in (\"policy_status\", \"premium_frequency\", \"payment_method\"):\n scoped = by_key.get(key, [])\n if len(scoped) != 27 or any(\n r.get(\"enum_policy\") != \"closed\" for r in scoped\n ):\n failures.append(f\"{key}: expected 27 closed policy.common rows\")\n\n # Reminder scope is the four approved fields only.\n reminder_keys = {\n r[\"fact_key\"]\n for r in rows\n if r.get(\"reminder_eligible\") is True\n }\n if reminder_keys != {\n \"acct_status\",\n \"policy_status\",\n \"premium_frequency\",\n \"payment_method\",\n }:\n failures.append(f\"reminder_eligible scope drifted: {sorted(reminder_keys)}\")\n\n # Closed list payload sanity: cancelled alias, unclaimed choice.\n acct_status = [\n r for r in by_key[\"acct_status\"] if r.get(\"enum_policy\") == \"closed\"\n ][0]\n if \"unclaimed_property\" not in acct_status.get(\"enum_values\", []):\n failures.append(\"acct_status missing unclaimed_property choice\")\n policy_status = by_key[\"policy_status\"][0]\n if policy_status.get(\"enum_aliases\", {}).get(\"cancelled\") != \"canceled\":\n failures.append(\"policy_status missing cancelled alias\")\n\n # Deferred family stays untouched: no authored enum metadata.\n disp = by_key.get(\"disposition_intent\", [])\n if any(\n r.get(\"enum_policy\") or r.get(\"enum_labels\") or r.get(\"enum_aliases\")\n for r in disp\n ):\n failures.append(\"disposition_intent gained deferred-family metadata\")\n\n # Presentation metadata on approved member-copy rows only.\n balance = [\n r for r in by_key.get(\"acct_balance\", [])\n if r.get(\"display_label\") == \"Balance\"\n ]\n if len(balance) != 10 or any(\n r.get(\"unit\") is not None or r.get(\"display_group\") != \"value\"\n for r in balance\n ):\n failures.append(\"acct_balance presentation rows malformed\")\n if any(r.get(\"display_label\") for r in by_key.get(\"acct_nickname\", [])):\n failures.append(\"unreviewed row gained display_label\")\n\n # Fixture runs never write the historic migration or the live seed.\n # The forward block is a temp file: fill it, then check it.\n frozen_migration = METADATA_MIGRATION_HISTORIC.read_bytes()\n frozen_seed = METADATA_SEED.read_bytes()\n with tempfile.TemporaryDirectory() as tmp:\n tmp_path = Path(tmp)\n root = copy_ontology(tmp_path / \"ontology\")\n out_sql = tmp_path / \"catalog-seed.sql\"\n meta_sql = tmp_path / \"meta.sql\"\n mig = tmp_path / \"20269999000000_g6_fact_catalog_metadata.sql\"\n mig.write_text(\n \"-- test fixture\\n\"\n + GEN.METADATA_BEGIN\n + \"\\n-- STALE_FIXTURE_MARKER\\n\"\n + GEN.METADATA_END\n + \"\\nCOMMIT;\\n\",\n encoding=\"utf-8\",\n )\n run_generator(\n root,\n out_sql,\n extra=[\n \"--metadata-seed\",\n str(meta_sql),\n \"--metadata-migration\",\n str(mig),\n ],\n )\n if not meta_sql.is_file() or meta_sql.read_text() != GEN.wrap_seed_txn(seed_a):\n failures.append(\"fixture --metadata-seed output mismatch\")\n if not GEN.metadata_migration_block_matches(seed_a, mig):\n failures.append(\"filled temp forward block does not match generated seed\")\n if \"STALE_FIXTURE_MARKER\" in mig.read_text(encoding=\"utf-8\"):\n failures.append(\"filled temp forward block left stale contents\")\n check = subprocess.run(\n [\n sys.executable,\n str(GENERATOR),\n \"--ontology\",\n str(root),\n \"--output\",\n str(out_sql),\n \"--diff-against\",\n str(CATALOG_SEED),\n \"--check-metadata-migration\",\n str(mig),\n ],\n check=False,\n capture_output=True,\n text=True,\n cwd=str(HERE),\n )\n if check.returncode != 0:\n failures.append(\n \"filled temp forward block failed --check-metadata-migration:\\n\"\n + check.stdout\n + check.stderr\n )\n if METADATA_MIGRATION_HISTORIC.read_bytes() != frozen_migration:\n failures.append(\"fixture generator rewrote historic metadata migration\")\n if METADATA_SEED.read_bytes() != frozen_seed:\n failures.append(\"fixture generator rewrote live metadata seed\")\n\n # --metadata-migration fills a new file's delimiters only.\n with tempfile.TemporaryDirectory() as tmp:\n tmp_path = Path(tmp)\n mig = tmp_path / \"20269999000000_g6_fact_catalog_metadata.sql\"\n mig.write_text(\n \"-- test fixture\\n\"\n + GEN.METADATA_BEGIN\n + \"\\n-- STALE_FIXTURE_MARKER\\n\"\n + GEN.METADATA_END\n + \"\\nCOMMIT;\\n\",\n encoding=\"utf-8\",\n )\n run_generator(\n ONTOLOGY_DIR,\n tmp_path / \"catalog-seed.sql\",\n extra=[\"--metadata-migration\", str(mig)],\n )\n if not GEN.metadata_migration_block_matches(seed_a, mig):\n failures.append(\"--metadata-migration did not fill new file\")\n if \"STALE_FIXTURE_MARKER\" in mig.read_text(encoding=\"utf-8\"):\n failures.append(\"--metadata-migration left stale contents\")\n if METADATA_MIGRATION_HISTORIC.read_bytes() != frozen_migration:\n failures.append(\"--metadata-migration on a new file rewrote live migration\")\n\n # --check-metadata-migration fails on a stale block.\n with tempfile.TemporaryDirectory() as tmp:\n tmp_path = Path(tmp)\n mig = tmp_path / \"stale.sql\"\n mig.write_text(\n GEN.METADATA_BEGIN + \"\\n-- stale\\n\" + GEN.METADATA_END + \"\\n\",\n encoding=\"utf-8\",\n )\n proc = subprocess.run(\n [\n sys.executable,\n str(GENERATOR),\n \"--ontology\",\n str(ONTOLOGY_DIR),\n \"--output\",\n str(tmp_path / \"catalog-seed.sql\"),\n \"--diff-against\",\n str(CATALOG_SEED),\n \"--check-metadata-migration\",\n str(mig),\n ],\n check=False,\n capture_output=True,\n text=True,\n cwd=str(HERE),\n )\n if proc.returncode == 0:\n failures.append(\"stale --check-metadata-migration passed\")\n\n # Bad fixtures: one lint rule violation each.\n bad_cases = [\n (\n \"enum_policy on non-enum\",\n \"acct_status\",\n lambda p: p.update(value_kind=\"text\"),\n \"only allowed when value_kind=enum\",\n ),\n (\n \"enum_labels missing a token\",\n \"acct_status\",\n lambda p: p[\"enum_labels\"].pop(\"closed\"),\n \"enum_labels\",\n ),\n (\n \"enum_aliases targets unknown token\",\n \"acct_status\",\n lambda p: p.setdefault(\"enum_aliases\", {}).update(\n {\"bogus\": \"not_a_state\"}\n ),\n \"enum_aliases\",\n ),\n (\n \"enum_aliases shadows canonical token\",\n \"acct_status\",\n lambda p: p.setdefault(\"enum_aliases\", {}).update(\n {\"open\": \"closed\"}\n ),\n \"enum_aliases\",\n ),\n (\n \"enum_domains rejected as unknown field\",\n \"acct_status\",\n lambda p: p.update(\n enum_domains=[\"account.depository\", \"account.investment\"]\n ),\n \"enum_domains\",\n ),\n (\n \"unit on a non-number\",\n \"acct_status\",\n lambda p: p.update(unit=\"usd\"),\n \"unit\",\n ),\n (\n \"unknown display_group\",\n \"acct_status\",\n lambda p: p.update(display_group=\"billing\"),\n \"display_group\",\n ),\n (\n \"non-positive display_rank\",\n \"acct_status\",\n lambda p: p.update(display_rank=0),\n \"display_rank\",\n ),\n (\n \"unknown icon_key\",\n \"acct_status\",\n lambda p: p.update(icon_key=\"bank\"),\n \"icon_key\",\n ),\n (\n \"empty display_label\",\n \"acct_status\",\n lambda p: p.update(display_label=\" \"),\n \"display_label\",\n ),\n (\n \"bad enum_policy value\",\n \"acct_status\",\n lambda p: p.update(enum_policy=\"locked\"),\n \"enum_policy\",\n ),\n ]\n for name, target, mutator, needle in bad_cases:\n with tempfile.TemporaryDirectory() as tmp:\n root = copy_ontology(Path(tmp) / \"ontology\")\n mutate_prop(root, \"financial.yaml\", target, mutator)\n try:\n expect_lint_failure(root, needle)\n except SystemExit as exc:\n failures.append(f\"bad fixture {name}: {exc}\")\n\n # Merge divergence: same (key, domain) in two files with different\n # presentation metadata fails closed.\n with tempfile.TemporaryDirectory() as tmp:\n root = copy_ontology(Path(tmp) / \"ontology\")\n mutate_prop(\n root,\n \"financial.yaml\",\n \"acct_institution_name\",\n lambda p: p.update(display_rank=11),\n )\n # Author the same identity on a second file with different metadata.\n dup = load_yaml(root / \"people.yaml\")\n dup[\"properties\"].append(\n {\n \"key\": \"acct_institution_name\",\n \"domain_class_key\": \"account.depository\",\n \"label\": \"Institution name dup\",\n \"value_kind\": \"text\",\n \"display_rank\": 12,\n \"resolution_strategy\": \"latest\",\n \"release_gate\": \"mvp\",\n \"shape\": \"attribute\",\n \"sensitivity\": \"normal\",\n \"section\": \"dup\",\n \"sources\": [{\"kind\": \"non_document\", \"key\": \"manual\", \"rank\": 1}],\n }\n )\n (root / \"people.yaml\").write_text(\n yaml.safe_dump(dup, sort_keys=False, allow_unicode=True),\n encoding=\"utf-8\",\n )\n try:\n expect_lint_failure(root, \"divergent\")\n except SystemExit as exc:\n failures.append(f\"merge divergence fixture: {exc}\")\n\n if failures:\n raise SystemExit(\n \"catalog metadata fixture failures:\\n\" + \"\\n\".join(failures)\n )\n print(\"catalog metadata fixtures ok\")", "confidence": "reviewed representative checks; grouped harness", "framework": "Python script" }, { "file": "product/persynl-physical-data-model/test_document_kinds.py", "line": 196, "name": "main fixture harness", "purpose": "Validates document-kind generation determinism, coverage, clarification choices, target mappings and invalid ontology refusal.", "classification": "mixed", "restates": "partial", "reason": "Combines real generator/invalid-input behavior with hard-coded catalog and generated SQL structure checks. Kept as one monolithic declared harness, not one row per assertion.", "execution_notes": "Direct Python entrypoint; requires ontology dependencies. Not included in npm test. Not executed.", "evidence": "def main() -> None:\n failures: list[str] = []\n\n data = lint_document_kinds(ONTOLOGY_DIR)\n launch = [\n k\n for k in data[\"kinds\"]\n if k[\"status\"] == \"published\" and k[\"menu_status\"] == \"launch\"\n ]\n if len(launch) != LAUNCH_KIND_COUNT:\n failures.append(f\"live launch count {len(launch)}\")\n labels = [k[\"label\"] for k in launch]\n if len(labels) != len(set(labels)):\n failures.append(\"duplicate launch labels\")\n\n seed_a = GEN.write_kind_seed_sql(data)\n seed_b = GEN.write_kind_seed_sql(data)\n if seed_a != seed_b:\n failures.append(\"kind seed SQL is not deterministic\")\n live_seed = KIND_SEED.read_text(encoding=\"utf-8\")\n if live_seed != seed_a:\n failures.append(\"document-kind-seed.sql does not match generator output\")\n seed_09 = GEN.write_kind_seed_sql(data, \"v2-2026-09-17\")\n if not GEN.kind_migration_block_matches(papers_edition(seed_09), KIND_MIGRATION):\n failures.append(\"0205 kind block does not match the papers edition of the 09-17-bound seed\")\n if \"'v2-2026-09-17'\" not in GEN.kind_migration_inner(KIND_MIGRATION):\n failures.append(\"0203 kind block missing v2-2026-09-17\")\n if GEN.kind_migration_block_matches(seed_a, KIND_MIGRATION_V1):\n failures.append(\"historical 20261122 must stay mapping_revision 1 and not match current seed\")\n if GEN.kind_migration_block_matches(seed_a, KIND_MIGRATION_R2):\n failures.append(\"historical r2 must not match the current kind seed\")\n if \"foreign_ownership_structure\" in CATALOG_SEED.read_text(encoding=\"utf-8\"):\n failures.append(\"catalog-seed.sql published foreign_ownership_structure\")\n bare = subprocess.run(\n [sys.executable, str(GENERATOR), \"--kind-bind-label\", \"v2-2026-09-17\"],\n check=False,\n capture_output=True,\n text=True,\n cwd=str(HERE),\n )\n if bare.returncode == 0:\n failures.append(\"--kind-bind-label without --kind-migration exited 0\")\n\n frozen_kinds = snapshot_frozen_kind_migrations()\n with tempfile.TemporaryDirectory() as tmp:\n root = Path(tmp) / \"ontology\"\n copy_ontology(root)\n # 0205 is the papers edition. The live yaml says documents (#318).\n kind_yaml = root / \"document-kinds.yaml\"\n kind_yaml.write_text(papers_edition(kind_yaml.read_text(encoding=\"utf-8\")), encoding=\"utf-8\")\n out_sql = Path(tmp) / \"catalog-seed.sql\"\n kind_seed = Path(tmp) / \"document-kind-seed.sql\"\n result = run_generator(\n root,\n out_sql,\n extra=[\n \"--kind-seed\", str(kind_seed),\n \"--check-kind-migration\", str(KIND_MIGRATION),\n \"--kind-bind-label\", \"v2-2026-09-17\",\n ],\n )\n diff = result[\"diff\"]\n if diff.get(\"added\") or diff.get(\"removed\") or diff.get(\"changed\"):\n failures.append(f\"temp generator fact identity drifted vs committed seed: {diff}\")\n stats = result[\"stats\"]\n if stats.get(\"document_kind_launch_count\") != LAUNCH_KIND_COUNT:\n failures.append(f\"temp generator launch count {stats.get('document_kind_launch_count')}\")\n if stats.get(\"document_type_count\") != 300:\n failures.append(f\"temp generator document_type_count {stats.get('document_type_count')}\")\n for label in frozen_kind_migrations_rewritten(frozen_kinds):\n failures.append(f\"default fixture generator rewrote {label}\")\n if not kind_seed.is_file():\n failures.append(\"fixture --kind-seed was not written\")\n if KIND_SEED.read_text(encoding=\"utf-8\") != live_seed:\n failures.append(\"fixture generator rewrote live document-kind-seed.sql\")\n\n with tempfile.TemporaryDirectory() as tmp:\n tmp_path = Path(tmp)\n same = tmp_path / \"catalog-seed.sql\"\n shutil.copyfile(CATALOG_SEED, same)\n mutated = same.read_text(encoding=\"utf-8\")\n if \"$catalog_facts$\" not in mutated or \"legal_full_name\" not in mutated:\n failures.append(\"catalog-seed.sql missing identity probe string\")\n else:\n same.write_text(\n mutated.replace(\"legal_full_name\", \"legal_full_name_MUTATED\", 1),\n encoding=\"utf-8\",\n )\n result = run_generator(\n ONTOLOGY_DIR,\n same,\n extra=[\"--kind-seed\", str(tmp_path / \"kinds.sql\")],\n diff_against=same,\n )\n for label in frozen_kind_migrations_rewritten(frozen_kinds):\n failures.append(\n f\"live-ontology generator rewrote {label} without --kind-migration\"\n )\n changed = (\n result[\"diff\"].get(\"added\", 0)\n + result[\"diff\"].get(\"removed\", 0)\n + result[\"diff\"].get(\"changed\", 0)\n )\n if changed == 0:\n failures.append(\n \"--diff-against compared the overwritten seed to itself (expected a real diff)\"\n )\n\n with tempfile.TemporaryDirectory() as tmp:\n tmp_path = Path(tmp)\n mig = tmp_path / \"20269999000000_g6_document_kind_catalog.sql\"\n shutil.copyfile(KIND_MIGRATION_V1, mig)\n text = mig.read_text(encoding=\"utf-8\")\n begin = text.find(GEN.KIND_BEGIN)\n end = text.find(GEN.KIND_END)\n mig.write_text(text[:begin] + GEN.KIND_BEGIN + \"\\n-- stale\\n\" + GEN.KIND_END + text[end + len(GEN.KIND_END) :], encoding=\"utf-8\")\n result = run_generator(\n ONTOLOGY_DIR,\n tmp_path / \"catalog-seed.sql\",\n extra=[\n \"--kind-seed\",\n str(tmp_path / \"kinds.sql\"),\n \"--kind-migration\",\n str(mig),\n ],\n )\n for label in frozen_kind_migrations_rewritten(frozen_kinds):\n failures.append(f\"--kind-migration on a new file rewrote {label}\")\n if not GEN.kind_migration_block_matches(seed_a, mig):\n failures.append(\"opt-in --kind-migration did not fill the new file\")\n if \"stale\" in mig.read_text(encoding=\"utf-8\"):\n failures.append(\"opt-in --kind-migration left stale delimited contents\")\n\n with tempfile.TemporaryDirectory() as tmp:\n root = Path(tmp) / \"ontology\"\n copy_ontology(root)\n mutated = load_yaml(root / \"document-kinds.yaml\")\n for kind in mutated[\"kinds\"]:\n if kind[\"key\"] == \"bank_account\":\n kind[\"clarification_options\"].append(\n {\n \"id\": \"will\",\n \"label\": \"Will\",\n \"document_type_key\": \"will\",\n \"include_any\": [\"last will\"],\n \"exclude_any\": [],\n }\n )\n dump_kinds(root, mutated)\n expect_lint_failure(root, \"is not a target of this kind\")\n\n with tempfile.TemporaryDirectory() as tmp:\n root = Path(tmp) / \"ontology\"\n copy_ontology(root)\n mutated = load_yaml(root / \"document-kinds.yaml\")\n for kind in mutated[\"kinds\"]:\n if kind[\"key\"] == \"investment_account\":\n kind[\"targets\"].append(\n {\n \"key\": \"bank_statement\",\n \"member_target_label\": \"Bank statement\",\n \"include_any\": [],\n \"exclude_any\": [],\n \"classifier_hint\": \"\",\n }\n )\n dump_kinds(root, mutated)\n expect_lint_failure(root, \"maps to multiple launch kinds\")\n\n with tempfile.TemporaryDirectory() as tmp:\n root = Path(tmp) / \"ontology\"\n copy_ontology(root)\n mutated = load_yaml(root / \"document-kinds.yaml\")\n mutated[\"kinds\"].append(\n {\n \"key\": \"draft_extra\",\n \"group_key\": \"other\",\n \"worksheet_id\": \"Z99\",\n \"label\": \"Draft extra\",\n \"description\": \"Must not count as a launch row.\",\n \"classifier_hint\": \"\",\n \"sort_order\": 9999,\n \"status\": \"draft\",\n \"menu_status\": \"launch\",\n \"targets\": [],\n \"clarification_options\": [\n {\n \"id\": \"unsure\",\n \"label\": \"Unsure\",\n \"document_type_key\": None,\n \"include_any\": [],\n \"exclude_any\": [],\n }\n ],\n }\n )\n dump_kinds(root, mutated)\n still = lint_document_kinds(root)\n draft_launch = [\n k\n for k in still[\"kinds\"]\n if k[\"status\"] == \"published\" and k[\"menu_status\"] == \"launch\"\n ]\n if len(draft_launch) != LAUNCH_KIND_COUNT:\n failures.append(\"draft launch kind changed published launch count\")\n\n with tempfile.TemporaryDirectory() as tmp:\n root = Path(tmp) / \"ontology\"\n copy_ontology(root)\n mutated = load_yaml(root / \"document-kinds.yaml\")\n mutated[\"hidden\"] = [row for row in mutated[\"hidden\"] if row[\"document_type_key\"] != \"photo\"]\n dump_kinds(root, mutated)\n expect_lint_failure(root, \"active types missing kind mapping or hidden row\")\n\n with tempfile.TemporaryDirectory() as tmp:\n root = Path(tmp) / \"ontology\"\n copy_ontology(root)\n mutated = load_yaml(root / \"document-kinds.yaml\")\n for kind in mutated[\"kinds\"]:\n if kind[\"key\"] == \"drivers_license_or_state_id\":\n for option in kind[\"clarification_options\"]:\n if option[\"id\"] == \"state_id\":\n option[\"document_type_key\"] = \"driver_license\"\n dump_kinds(root, mutated)\n expect_lint_failure(root, \"canonical option id must equal document_type_key\")\n\n for kind_key, option_id in REQUIRED_UNTYPED_OPTIONS.items():\n sibling = REQUIRED_UNTYPED_SIBLING[kind_key]\n with tempfile.TemporaryDirectory() as tmp:\n root = Path(tmp) / \"ontology\"\n copy_ontology(root)\n mutated = load_yaml(root / \"document-kinds.yaml\")\n for kind in mutated[\"kinds\"]:\n if kind[\"key\"] == kind_key:\n kind[\"clarification_options\"] = [\n option\n for option in kind[\"clarification_options\"]\n if option.get(\"id\") != option_id\n ]\n dump_kinds(root, mutated)\n expect_lint_failure(root, f\"missing required untyped option {option_id}\")\n with tempfile.TemporaryDirectory() as tmp:\n root = Path(tmp) / \"ontology\"\n copy_ontology(root)\n mutated = load_yaml(root / \"document-kinds.yaml\")\n for kind in mutated[\"kinds\"]:\n if kind[\"key\"] == kind_key:\n for option in kind[\"clarification_options\"]:\n if option.get(\"id\") == option_id:\n option[\"document_type_key\"] = sibling\n dump_kinds(root, mutated)\n expect_lint_failure(\n root, f\"option {option_id}: document_type_key must be null\"\n )\n\n overlap = {\"brokerage_statement\", \"annuity_statement\", \"annuity_contract\"}\n owners: dict[str, list[str]] = {}\n for kind in data[\"kinds\"]:\n if kind[\"status\"] == \"published\" and kind[\"menu_status\"] == \"launch\":\n for target in kind[\"targets\"]:\n owners.setdefault(target[\"key\"], []).append(kind[\"key\"])\n for tkey, kinds in owners.items():\n if len(kinds) > 1 and tkey not in overlap:\n failures.append(f\"undeclared overlap {tkey} {kinds}\")\n if tkey in overlap and len(kinds) < 2:\n failures.append(f\"allowed overlap {tkey} only on {kinds}\")\n\n retirement = next(k for k in data[\"kinds\"] if k[\"key\"] == \"retirement_account\")\n if \"annuity_contract\" not in {t[\"key\"] for t in retirement[\"targets\"]}:\n failures.append(\"M03 missing annuity_contract\")\n id_owners = [\n k[\"key\"]\n for k in data[\"kinds\"]\n if any(t[\"key\"] == \"id_card\" for t in k[\"targets\"])\n ]\n if id_owners != [\"insurance_card\"]:\n failures.append(f\"id_card owners {id_owners}\")\n\n p01 = next(k for k in data[\"kinds\"] if k[\"key\"] == \"drivers_license_or_state_id\")\n p01_opts = {o[\"id\"]: o for o in p01[\"clarification_options\"]}\n if p01_opts[\"state_id\"][\"document_type_key\"] != \"state_id\":\n failures.append(\"state_id option must carry document_type_key state_id\")\n p02 = next(k for k in data[\"kinds\"] if k[\"key\"] == \"passport\")\n p02_opts = {o[\"id\"]: o for o in p02[\"clarification_options\"]}\n if p02_opts[\"passport_card\"][\"document_type_key\"] != \"passport_card\":\n failures.append(\"passport_card option must carry document_type_key passport_card\")\n if p01_opts[\"unsure\"][\"document_type_key\"] is not None:\n failures.append(\"unsure option must be untyped\")\n if \"driver_license\" not in p01_opts:\n failures.append(\"P01 missing driver_license option\")\n\n for kind_key, option_id in REQUIRED_UNTYPED_OPTIONS.items():\n kind = next(k for k in data[\"kinds\"] if k[\"key\"] == kind_key)\n if kind.get(\"status\") != \"published\" or kind.get(\"menu_status\") != \"launch\":\n failures.append(f\"{kind_key} required-untyped row is not published launch\")\n continue\n opts = {o[\"id\"]: o for o in kind[\"clarification_options\"]}\n if option_id not in opts:\n failures.append(f\"{kind_key} missing untyped option {option_id}\")\n continue\n if opts[option_id].get(\"document_type_key\") is not None:\n failures.append(f\"{kind_key}.{option_id} must be untyped\")\n sibling = REQUIRED_UNTYPED_SIBLING[kind_key]\n if opts[option_id].get(\"document_type_key\") == sibling:\n failures.append(f\"{kind_key}.{option_id} aliases {sibling}\")\n\n if failures:\n raise SystemExit(\"document-kind fixture failures:\\n\" + \"\\n\".join(failures))\n print(\n \"document-kind fixtures ok: \"\n \"coverage, overlap, missing target, ambiguity, draft exclusion, \"\n \"untyped alias, determinism, generator --diff-against\"\n )", "confidence": "reviewed representative checks; grouped harness", "framework": "Python script" }, { "file": "scripts/tap-check.sh", "line": 33, "name": "clean TAP passes", "purpose": "Accept a TAP stream whose plan matches passing results.", "classification": "behavior", "restates": "no", "reason": "Feeds synthetic TAP output to the actual protocol checker and tests its exit status.", "execution_notes": "Run with --self-test; not executed.", "confidence": "reviewed", "framework": "Shell" }, { "file": "scripts/tap-check.sh", "line": 38, "name": "plan mismatch fails", "purpose": "Reject a TAP stream with fewer results than its plan.", "classification": "behavior", "restates": "no", "reason": "Feeds synthetic TAP output to the actual protocol checker and tests its exit status.", "execution_notes": "Run with --self-test; not executed.", "confidence": "reviewed", "framework": "Shell" }, { "file": "scripts/tap-check.sh", "line": 43, "name": "not ok fails", "purpose": "Reject a TAP stream with a failing assertion.", "classification": "behavior", "restates": "no", "reason": "Feeds synthetic TAP output to the actual protocol checker and tests its exit status.", "execution_notes": "Run with --self-test; not executed.", "confidence": "reviewed", "framework": "Shell" } ]