#!/usr/bin/env python3 """write_canonical 接受通道对 muse-example 真实库的故障注入测试。 覆盖先审后入主链的机械不变量： - 接受原子性：事务中断不留半提交（正文/归因/决策要么全有要么全无）； - command_id 重放幂等：同一命令第二次执行不重复写正文、决策； - revision CAS：旧 expected_revision 拒绝，正文不被旧候选覆盖； - 先审后入兜底：semantic_status 非 passed 的候选一律不得接受； - 机械隔离：评测/诊断候选 DB 级拒绝。 测试数据用 unittest-commit- 前缀隔离；example_user_decision 是 append-only 表， 清理时短暂禁用其防删触发器（try/finally 保证恢复）。 跑法（需 Tailscale 内网可达 muse-example）： .venv/bin/python .claude/skills/decide-candidate/scripts/test_write_canonical_db.py """ from __future__ import annotations import hashlib import pathlib import sys import uuid from typing import Any from unittest import mock SCRIPT_DIR = pathlib.Path(__file__).resolve().parent SKILLS_DIR = SCRIPT_DIR.parents[1] for path in (SCRIPT_DIR, SKILLS_DIR / "access-database" / "scripts"): if str(path) not in sys.path: sys.path.insert(0, str(path)) from db import connect # noqa: E402 import write_canonical # noqa: E402 from write_canonical import ConflictError, accept, discard # noqa: E402 SUFFIX = uuid.uuid4().hex[:10] WORK_TITLE = f"unittest-commit-{SUFFIX}" _command_ids: list[str] = [] _candidate_ids: list[int] = [] _work_id: int | None = None def _sha(text: str) -> str: return hashlib.sha256(text.encode("utf-8")).hexdigest() def _cleanup() -> None: """物理清理测试行；append-only 决策表短暂禁用防删触发器，finally 恢复。""" if _work_id is None: return with connect() as conn: try: conn.execute( "ALTER TABLE example_user_decision DISABLE TRIGGER trg_example_user_decision_append_only") try: if _candidate_ids: conn.execute( "DELETE FROM example_user_decision WHERE candidate_id = ANY(%s)", (_candidate_ids,)) if _command_ids: conn.execute( "DELETE FROM muse_content_command_log WHERE command_id = ANY(%s)", (_command_ids,)) conn.execute( "DELETE FROM muse_content_block_source_attribution WHERE work_id=%s", (_work_id,)) conn.execute("DELETE FROM muse_content_block WHERE work_id=%s", (_work_id,)) conn.execute("DELETE FROM muse_content_chapter WHERE work_id=%s", (_work_id,)) if _candidate_ids: conn.execute( "DELETE FROM example_candidate WHERE id = ANY(%s)", (_candidate_ids,)) conn.execute("DELETE FROM muse_content_work WHERE id=%s", (_work_id,)) conn.commit() finally: conn.execute( "ALTER TABLE example_user_decision ENABLE TRIGGER trg_example_user_decision_append_only") conn.commit() except Exception: conn.rollback() raise def _setup_work_and_chapter() -> int: global _work_id with connect() as conn: work_id = conn.execute( "INSERT INTO muse_content_work(owner_user_id, title, status, creator) " "VALUES (1,%s,'writing','unittest') RETURNING id", (WORK_TITLE,)).fetchone()[0] conn.execute( "INSERT INTO muse_content_chapter(work_id, title, order_no, creator) " "VALUES (%s,'测试章',1,'unittest')", (work_id,)) conn.commit() _work_id = work_id return work_id def _insert_candidate(work_id: int, *, body: str, version: str, run_type: str = "production", state: str = "passed", semantic_status: str | None = "passed", semantic_sha: str | None = None) -> int: """直接造一个 Shadow 候选行（测试夹具，不经 persist_writer_execution）。""" sha = _sha(body) if semantic_status == "passed" and semantic_sha is None: semantic_sha = _sha("semantic-report:" + sha) with connect() as conn: candidate_id = conn.execute( "INSERT INTO example_candidate(work_id, target_chapter, run_id, attempt, run_type, " "candidate_version, candidate_sha256, candidate_body, quality_policy_version, mode, " "source_role, state, acceptance_eligible, semantic_status, semantic_report_sha256, creator) " "VALUES (%s,1,%s,1,%s,%s,%s,%s,'writer-production-v1','continuation','writer',%s," "TRUE,%s,%s,'unittest') RETURNING id", (work_id, f"unittest-commit-run-{SUFFIX}-{version}", run_type, version, sha, body, state, semantic_status, semantic_sha)).fetchone()[0] conn.commit() _candidate_ids.append(candidate_id) return candidate_id def _command_id(tag: str) -> str: cid = f"unittest-commit-{tag}-{SUFFIX}" _command_ids.append(cid) return cid def _block_revision(work_id: int) -> int: with connect(readonly=True) as conn: row = conn.execute( "SELECT COALESCE(MAX(b.revision),0) FROM muse_content_block b " "JOIN muse_content_chapter c ON b.chapter_id=c.id AND c.deleted=false " "WHERE c.work_id=%s AND c.order_no=1 AND b.deleted=false", (work_id,)).fetchone() return int(row[0]) def _candidate_state(candidate_id: int) -> str: with connect(readonly=True) as conn: return conn.execute( "SELECT state FROM example_candidate WHERE id=%s", (candidate_id,)).fetchone()[0] def _decision_count(candidate_id: int) -> int: with connect(readonly=True) as conn: return int(conn.execute( "SELECT COUNT(*) FROM example_user_decision WHERE candidate_id=%s", (candidate_id,)).fetchone()[0]) def test_accept_atomic_and_replay_idempotent(work_id: int) -> None: body = f"测试正文第一版 {SUFFIX}" candidate_id = _insert_candidate(work_id, body=body, version="1") command_id = _command_id("accept-1") result = accept(candidate_id, rationale="unittest", expected_revision=0, command_id=command_id) assert result["status"] == "accepted", result assert result["revision"] == 1 assert _block_revision(work_id) == 1 assert _candidate_state(candidate_id) == "accepted" assert _decision_count(candidate_id) == 1 # 同一 command_id 重放：不重复写正文、不新增决策 replay = accept(candidate_id, rationale="unittest", expected_revision=1, command_id=command_id) assert replay["status"] == "already_applied", replay assert _block_revision(work_id) == 1 assert _decision_count(candidate_id) == 1 with connect(readonly=True) as conn: block_rows = int(conn.execute( "SELECT COUNT(*) FROM muse_content_block WHERE work_id=%s AND deleted=false", (work_id,)).fetchone()[0]) attribution_rows = int(conn.execute( "SELECT COUNT(*) FROM muse_content_block_source_attribution WHERE work_id=%s AND deleted=false", (work_id,)).fetchone()[0]) assert block_rows == 1 and attribution_rows == 1, (block_rows, attribution_rows) def test_stale_expected_revision_rejected(work_id: int) -> None: body = f"测试正文第二版 {SUFFIX}" candidate_id = _insert_candidate(work_id, body=body, version="2") # 当前正文块已在 revision=1；拿旧期望 0 接受必须拒绝，且正文不变 try: accept(candidate_id, rationale="unittest", expected_revision=0, command_id=_command_id("accept-stale")) raise AssertionError("旧 expected_revision 必须被拒绝") except AssertionError: raise except ConflictError as exc: assert "REVISION_CONFLICT" in str(exc) assert _block_revision(work_id) == 1, "拒绝后正文不得变化" assert _candidate_state(candidate_id) == "passed", "拒绝后候选保持 passed 待人工处理" # 正确期望 1 → 接受成 revision 2（旧候选不能覆盖新正文的顺序保证） ok = accept(candidate_id, rationale="unittest", expected_revision=1, command_id=_command_id("accept-v2")) assert ok["status"] == "accepted" and ok["revision"] == 2 assert _block_revision(work_id) == 2 def test_semantic_backstop(work_id: int) -> None: # 机械 passed 但语义缺失/未过：DB 兜底拒绝 no_semantic = _insert_candidate(work_id, body=f"无语义证据 {SUFFIX}", version="3", semantic_status=None, semantic_sha=None) failed_semantic = _insert_candidate(work_id, body=f"语义未过 {SUFFIX}", version="4", semantic_status="failed") for cid in (no_semantic, failed_semantic): try: accept(cid, rationale="unittest", expected_revision=_block_revision(work_id), command_id=_command_id(f"accept-nosem-{cid}")) raise AssertionError("未过语义审查的候选不得接受") except AssertionError: raise except ConflictError as exc: assert "语义审查" in str(exc), str(exc) assert _candidate_state(no_semantic) == "passed" assert _candidate_state(failed_semantic) == "passed" # discard 不受语义兜底限制（丢弃是安全操作） dropped = discard(failed_semantic, rationale="unittest", command_id=_command_id("discard-failed-semantic")) assert dropped["status"] == "discarded" assert _candidate_state(failed_semantic) == "discarded" def test_non_production_rejected(work_id: int) -> None: eval_candidate = _insert_candidate(work_id, body=f"评测候选 {SUFFIX}", version="5", run_type="eval") try: accept(eval_candidate, rationale="unittest", expected_revision=_block_revision(work_id), command_id=_command_id("accept-eval")) raise AssertionError("评测候选不得接受") except AssertionError: raise except ConflictError as exc: assert "eval" in str(exc) assert _candidate_state(eval_candidate) == "passed" def test_interrupted_accept_leaves_no_half_commit(work_id: int) -> None: """事务后半段注入故障：正文/归因/命令/决策全部回滚，候选保持 passed。""" body = f"中断测试正文 {SUFFIX}" candidate_id = _insert_candidate(work_id, body=body, version="6") revision_before = _block_revision(work_id) def _explode(*_args, **_kwargs): raise RuntimeError("injected-fault: 决策归档前崩溃") command_id = _command_id("accept-interrupted") with mock.patch.object(write_canonical, "_refresh_work_metrics", side_effect=_explode): try: accept(candidate_id, rationale="unittest", expected_revision=revision_before, command_id=command_id) raise AssertionError("注入故障必须中止接受") except AssertionError: raise except RuntimeError as exc: assert "injected-fault" in str(exc) # 半提交检查：正文 revision 不变、无归因新增、命令日志未落（整事务回滚）、决策为 0 assert _block_revision(work_id) == revision_before, "中断不得改变正文" assert _decision_count(candidate_id) == 0, "中断不得留下决策" assert _candidate_state(candidate_id) == "passed", "中断后候选必须保持 passed" with connect(readonly=True) as conn: logged = conn.execute( "SELECT COUNT(*) FROM muse_content_command_log WHERE command_id=%s", (command_id,)).fetchone()[0] assert logged == 0, "命令日志随事务回滚，重放仍可执行" # 中断后用同一 command_id 重试仍可成功（幂等键未被污染） retried = accept(candidate_id, rationale="unittest", expected_revision=revision_before, command_id=command_id) assert retried["status"] == "accepted" assert _block_revision(work_id) == revision_before + 1 def test_dry_run_writes_nothing(work_id: int) -> None: body = f"试跑正文 {SUFFIX}" candidate_id = _insert_candidate(work_id, body=body, version="7") revision_before = _block_revision(work_id) result = accept(candidate_id, rationale="unittest", expected_revision=revision_before, command_id=_command_id("accept-dry"), dry_run=True) assert result["status"] == "dry_run_ok" assert _block_revision(work_id) == revision_before assert _candidate_state(candidate_id) == "passed" assert _decision_count(candidate_id) == 0 def main() -> None: work_id = _setup_work_and_chapter() tests = ( ("accept 原子性与重放幂等", test_accept_atomic_and_replay_idempotent), ("旧 expected_revision 拒绝", test_stale_expected_revision_rejected), ("语义兜底拒绝", test_semantic_backstop), ("非生产候选拒绝", test_non_production_rejected), ("中断不留半提交", test_interrupted_accept_leaves_no_half_commit), ("dry-run 不落库", test_dry_run_writes_nothing), ) try: for name, test in tests: test(work_id) print(f"PASS: {name}") print("PASS：write_canonical 真实库故障注入测试全部通过") finally: _cleanup() if __name__ == "__main__": main()