fix: advance TCS root only for numbered-source changes

This commit is contained in:
冰朔 2026-09-08 13:59:14 +08:00
commit 4a030c15ab
5 changed files with 21 additions and 6 deletions

View file

@ -174,6 +174,8 @@ def refresh(repo: Path, output: Path, pointer: Path, trigger: str) -> dict[str,
return {"outcome": "PASS", "state": "CURRENT_IDEMPOTENT", "source_commit": snapshot["source_commit"], "current_sha256": digest(current_path.read_bytes())}
if previous:
changed = {key for key, value in snapshot["registered_source_hashes"].items() if previous.get("registered_source_hashes", {}).get(key) != value}
if not changed:
return {"outcome":"PASS","state":"CURRENT_NUMBER_NAV_UNCHANGED","source_commit":previous["source_commit"],"observed_repo_head":snapshot["source_commit"],"current_sha256":digest(current_path.read_bytes()),"freshness_token":previous["freshness_token"]}
affected = set(commit_json(repo, snapshot["source_commit"], snapshot["impact"]["path"]).get("affected_paths", []))
if changed and not changed.issubset(affected):
raise RootError("UNADMITTED_NUMBERED_SOURCE_DRIFT:" + ",".join(sorted(changed - affected)))
@ -203,8 +205,10 @@ def status(repo: Path, output: Path, pointer: Path) -> dict[str, Any]:
body = (output / "CURRENT.json").read_bytes()
current = json.loads(body)
head = run(repo, "rev-parse", "HEAD")
valid = digest(body) == p.get("current_sha256") and current.get("freshness_token") == p.get("freshness_token") and current.get("source_commit") == head
return {"outcome":"PASS" if valid else "FAIL","state":"TCS_ROOT_CURRENT_VERIFIED" if valid else "TCS_ROOT_CURRENT_STALE_OR_TAMPERED","source_commit":current.get("source_commit"),"repo_head":head,"current_sha256":digest(body),"freshness_token":current.get("freshness_token"),"current":str(output / "CURRENT.json")}
observed = build(repo, head)
source_equivalent = current.get("registered_source_hashes") == observed.get("registered_source_hashes")
valid = digest(body) == p.get("current_sha256") and current.get("freshness_token") == p.get("freshness_token") and source_equivalent
return {"outcome":"PASS" if valid else "FAIL","state":"TCS_ROOT_CURRENT_VERIFIED" if valid else "TCS_ROOT_CURRENT_STALE_OR_TAMPERED","source_commit":current.get("source_commit"),"repo_head":head,"numbered_sources_equal_head":source_equivalent,"current_sha256":digest(body),"freshness_token":current.get("freshness_token"),"current":str(output / "CURRENT.json")}
def resolve(output: Path, requested: str, kind: str | None) -> dict[str, Any]:

View file

@ -53,6 +53,16 @@ class RootAgentTest(unittest.TestCase):
MODULE.refresh(ROOT, output, pointer, 'negative-test')
self.assertEqual(current.read_bytes(), before)
def test_ordinary_commit_equivalent_sources_do_not_advance_current(self):
with tempfile.TemporaryDirectory() as temp:
base = Path(temp)
output, pointer = base / 'state', base / 'TCS-ROOT.json'
first = MODULE.refresh(ROOT, output, pointer, 'test')
current = json.loads((output / 'CURRENT.json').read_text())
same = MODULE.refresh(ROOT, output, pointer, 'ordinary-commit-test')
self.assertIn(same['state'], ['CURRENT_IDEMPOTENT', 'CURRENT_NUMBER_NAV_UNCHANGED'])
self.assertEqual(json.loads((output / 'CURRENT.json').read_text())['freshness_token'], current['freshness_token'])
if __name__ == '__main__':
unittest.main()