From 4f24edc3b228faa314f4355b92507c5bbce56bd1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=86=B0=E6=9C=94?= <565183519@qq.com>
Date: Tue, 8 Sep 2026 14:19:15 +0800
Subject: [PATCH] test: harden lighthouse mirror fail-closed checks

---
 .githooks/post-commit                            |  5 +++--
 .../module.lock.hdlp                             |  2 +-
 .../receipts/self-test.hdlp                      | 16 ++++++++++++++++
 .../public_mirror_agent.py                       |  3 ++-
 4 files changed, 22 insertions(+), 4 deletions(-)
 create mode 100644 modules/fifth-domain-lighthouse-sanitized-mirror/receipts/self-test.hdlp

diff --git a/.githooks/post-commit b/.githooks/post-commit
index 681ec6c..25e790f 100755
--- a/.githooks/post-commit
+++ b/.githooks/post-commit
@@ -2,6 +2,7 @@
 canonical='/Volumes/JZAO/HoloLake/persona-runtime/repo-012-main'
 current=$(git rev-parse --show-toplevel 2>/dev/null) || exit 0
 [ "$current" = "$canonical" ] || exit 0
-/usr/bin/python3 "$canonical/server-tools/tcs-mother-root-agent/tcs_mother_root_agent.py" refresh --repo "$canonical" --trigger git-post-commit >/dev/null 2>&1 || true
-/usr/bin/python3 "$canonical/server-tools/fifth-domain-lighthouse-mirror/public_mirror_agent.py" sync-architecture --repo "$canonical" >/dev/null 2>&1 || true
+if /usr/bin/python3 "$canonical/server-tools/tcs-mother-root-agent/tcs_mother_root_agent.py" refresh --repo "$canonical" --trigger git-post-commit >/dev/null 2>&1; then
+  /usr/bin/python3 "$canonical/server-tools/fifth-domain-lighthouse-mirror/public_mirror_agent.py" sync-architecture --repo "$canonical" >/dev/null 2>&1 || true
+fi
 exit 0
diff --git a/modules/fifth-domain-lighthouse-sanitized-mirror/module.lock.hdlp b/modules/fifth-domain-lighthouse-sanitized-mirror/module.lock.hdlp
index 816d058..c0e215e 100644
--- a/modules/fifth-domain-lighthouse-sanitized-mirror/module.lock.hdlp
+++ b/modules/fifth-domain-lighthouse-sanitized-mirror/module.lock.hdlp
@@ -2,7 +2,7 @@ schema: tcs.module-lock/v1
 module_id: TCS-AGENT-SANITIZED-MIRROR-001
 module_source_sha256: 1210b30c7dabc56b8b989763230a3cf56c0fe02a3b409be5f3833dee9853d771
 module_gir_sha256: 0e7b1bbd5f3f8dbc83df6c72e4a1e0532b6f44beed21c8c8315f85cc76096712
-runtime_sha256: cf4b328c308163683595af8c29b7e545c42f831503b1d2667349cbb8ae7d559c
+runtime_sha256: b5c87c3a4d71e5c095e0b4f43c4c26f2b27afde19d972906f383587c7dcdefa4
 mirror_map_sha256: a03b5ba9e06f5fd3f626301305d75add0332ae06948a67c8bcd03c3cab248fe1
 protocol_source_sha256: cf198e7939e4ab70828b74cef8a2b84c2dac2ff262582bb3d5663904d602d71b
 protocol_gir_sha256: 69f1a2a5cfc5ee61bdc2bf2065751d9cc41b9f662b28c35e61b393fd2187e1dc
diff --git a/modules/fifth-domain-lighthouse-sanitized-mirror/receipts/self-test.hdlp b/modules/fifth-domain-lighthouse-sanitized-mirror/receipts/self-test.hdlp
new file mode 100644
index 0000000..8c842e5
--- /dev/null
+++ b/modules/fifth-domain-lighthouse-sanitized-mirror/receipts/self-test.hdlp
@@ -0,0 +1,16 @@
+schema: tcs.module-self-test-receipt/v1
+module_id: TCS-AGENT-SANITIZED-MIRROR-001
+result: PASS
+tests: 7/7
+verified:
+  - committed architecture projection contains no private absolute path
+  - missing persona share decision creates no candidate
+  - private human data requires human consent
+  - sanitization produces quarantine only and never publication
+  - mother acceptance is required before team review
+  - both reviews bind the exact candidate hash and use independent reviewers
+  - replay with changed content and review hash drift are rejected
+repository_regression: node --test 483/483 PASS
+tcs_root_regression: 5/5 PASS
+external_publication: NOT_PERFORMED
+server_deployment: NOT_PERFORMED
diff --git a/server-tools/fifth-domain-lighthouse-mirror/public_mirror_agent.py b/server-tools/fifth-domain-lighthouse-mirror/public_mirror_agent.py
index 322dc25..66290ad 100644
--- a/server-tools/fifth-domain-lighthouse-mirror/public_mirror_agent.py
+++ b/server-tools/fifth-domain-lighthouse-mirror/public_mirror_agent.py
@@ -26,6 +26,7 @@ PRIVATE_VALUE_PATTERNS = [
     ("URL_CREDENTIAL", re.compile(r"(?i)(?:https?|ssh)://[^\s/@:]+:[^\s/@]+@")),
 ]
 PUBLIC_PAYLOAD_KEYS = {"instructions", "input_schema", "output_schema", "examples", "limitations", "dependencies", "license", "compatibility"}
+SAFE_INTEGRITY_KEYS = {"freshness_token"}
 
 
 class MirrorError(RuntimeError):
@@ -95,7 +96,7 @@ def sanitize(value: Any) -> Any:
 
 def contains_private(value: Any) -> bool:
     if isinstance(value, dict):
-        return any(DENIED_KEYS.search(str(key)) or contains_private(item) for key, item in value.items())
+        return any((key not in SAFE_INTEGRITY_KEYS and DENIED_KEYS.search(str(key))) or contains_private(item) for key, item in value.items())
     if isinstance(value, list):
         return any(contains_private(item) for item in value)
     if isinstance(value, str):