test: exercise WSL storage refusal and profile ciphertext safety (#62) #102

Merged

kilo merged 2 commits from issue-62-platform-reception into develop

2026-10-26 18:41:34 +00:00

kilo commented

2026-10-26 18:16:00 +00:00

Member

Scope

Refs #62 (keep open). Bounded platform/storage/profile reception slice: synthetic WSL topology scenarios, explicit non-Linux refusal, future-schema safe refusal, and the operator-profile ciphertext safety contract, with the G13 matrix and migration documentation aligned to the exercised evidence level. No real WSL/Windows/macOS host, real profile/key/ciphertext, release, publication or live task.

Changes

tests/test_sqlite_store.py: WSL shapes via the established synthetic mount-table harness — 9p (WSL2 DrvFS) and drvfs (WSL1) refuse with UnsupportedSQLiteConfiguration instead of a quiet unsafe fallback; WSL-native ext4 passes the same gate as native Linux. Non-Linux runtimes (win32/darwin) refuse validate_local_storage explicitly. A database announcing a newer-than-supported schema version refuses at startup with records and announced version preserved unchanged.
tests/test_operator_profile.py: ciphertext safety contract with a fake sops executable and synthetic ciphertext — failed decryption (nonzero exit/key unavailable) leaves the profile byte-identical including mtime; corrupt decrypted output (empty, non-JSON, wrong types, excessive nesting) refuses safely with byte and mtime preservation; output exceeding the documented 4 MiB decrypted bound (exercised by a 4 MiB + 1 fixture) refuses safely with byte and mtime preservation; successful plaintext and SOPS loads are read-only; diagnostics stay fixed messages that never contain values.
docs/architecture/successor.md: G13 matrix rows updated — SQLite state and operator profile now name the exercised synthetic evidence; the stale MI row reflects the #55 retained-reference consumer; the trust/profile row states the required TRUSTED_DEVELOPMENT facts (HOME-readable Codex auth, no production secrets in task identity, unverified native egress, explicit trust choice, no broader-profile fallback); the WSL row separates synthetic storage distinctions from real-platform unknowns.
docs/architecture/migration.md: new "Platform, Storage And Profile Reception (G13)" section with the exact accepted native filesystem set, refused WSL shapes, profile read-only contract, trust labeling and cleanup ownership.

Review remediation

Review ordinal 1 (REQUEST_CHANGES, one P3) found the oversized decrypted-output bound unexercised and corrupt cases not asserting mtime. Remediated in 66eae9bd by exercising the 4 MiB + 1 bound and asserting mtime on corrupt cases; the doc/PR claims now match the exercised set exactly.

Not claimed (issue remains open)

Real WSL/Windows/macOS execution, Windows install/signing, real encrypted-profile/key migration, producer version matrix cells beyond the bounded recommendation/reference contracts, uninstall tooling, release/publication.

Validation

make check: 1516 passed, 85 skipped, 106 subtests; format/lint/basedpyright/import-linter/secret-scan/diff gates pass.
make package-check: reproducible sdist/wheel, isolated install, CLI replay/export and installed smoke checks pass.
New tests: 13 (WSL refusal ×2, WSL-native acceptance, non-Linux refusal ×2, future-schema refusal, ciphertext preservation, corrupt output ×4 with mtime, oversized output bound, read-only loading).

Base 038da8be9c4d07e3ccc92c107862125f979a5c47; head 66eae9bd2b9337ce9f8c29608baac7b0dc37c34c.

## Scope Refs #62 (keep open). Bounded platform/storage/profile reception slice: synthetic WSL topology scenarios, explicit non-Linux refusal, future-schema safe refusal, and the operator-profile ciphertext safety contract, with the G13 matrix and migration documentation aligned to the exercised evidence level. No real WSL/Windows/macOS host, real profile/key/ciphertext, release, publication or live task. ## Changes - `tests/test_sqlite_store.py`: WSL shapes via the established synthetic mount-table harness — `9p` (WSL2 DrvFS) and `drvfs` (WSL1) refuse with `UnsupportedSQLiteConfiguration` instead of a quiet unsafe fallback; WSL-native `ext4` passes the same gate as native Linux. Non-Linux runtimes (`win32`/`darwin`) refuse `validate_local_storage` explicitly. A database announcing a newer-than-supported schema version refuses at startup with records and announced version preserved unchanged. - `tests/test_operator_profile.py`: ciphertext safety contract with a fake `sops` executable and synthetic ciphertext — failed decryption (nonzero exit/key unavailable) leaves the profile byte-identical including mtime; corrupt decrypted output (empty, non-JSON, wrong types, excessive nesting) refuses safely with byte and mtime preservation; output exceeding the documented 4 MiB decrypted bound (exercised by a 4 MiB + 1 fixture) refuses safely with byte and mtime preservation; successful plaintext and SOPS loads are read-only; diagnostics stay fixed messages that never contain values. - `docs/architecture/successor.md`: G13 matrix rows updated — SQLite state and operator profile now name the exercised synthetic evidence; the stale MI row reflects the #55 retained-reference consumer; the trust/profile row states the required `TRUSTED_DEVELOPMENT` facts (HOME-readable Codex auth, no production secrets in task identity, unverified native egress, explicit trust choice, no broader-profile fallback); the WSL row separates synthetic storage distinctions from real-platform unknowns. - `docs/architecture/migration.md`: new "Platform, Storage And Profile Reception (G13)" section with the exact accepted native filesystem set, refused WSL shapes, profile read-only contract, trust labeling and cleanup ownership. ## Review remediation Review ordinal 1 (REQUEST_CHANGES, one P3) found the oversized decrypted-output bound unexercised and corrupt cases not asserting mtime. Remediated in `66eae9bd` by exercising the 4 MiB + 1 bound and asserting mtime on corrupt cases; the doc/PR claims now match the exercised set exactly. ## Not claimed (issue remains open) Real WSL/Windows/macOS execution, Windows install/signing, real encrypted-profile/key migration, producer version matrix cells beyond the bounded recommendation/reference contracts, uninstall tooling, release/publication. ## Validation - `make check`: 1516 passed, 85 skipped, 106 subtests; format/lint/basedpyright/import-linter/secret-scan/diff gates pass. - `make package-check`: reproducible sdist/wheel, isolated install, CLI replay/export and installed smoke checks pass. - New tests: 13 (WSL refusal ×2, WSL-native acceptance, non-Linux refusal ×2, future-schema refusal, ciphertext preservation, corrupt output ×4 with mtime, oversized output bound, read-only loading). Base `038da8be9c4d07e3ccc92c107862125f979a5c47`; head `66eae9bd2b9337ce9f8c29608baac7b0dc37c34c`.

kilo added 1 commit

2026-10-26 18:16:00 +00:00