bingshuo/guanghu-ice-heart
Watch
1
0
Fork
You've already forked guanghu-ice-heart
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

test: harden lighthouse mirror fail-closed checks

Browse source
This commit is contained in:
冰朔 2026-09-08 14:19:15 +08:00
commit 4f24edc3b2
4 changed files with 22 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

5
.githooks/post-commit
View file

@ -2,6 +2,7 @@
canonical='/Volumes/JZAO/HoloLake/persona-runtime/repo-012-main' canonical='/Volumes/JZAO/HoloLake/persona-runtime/repo-012-main'
current=$(git rev-parse --show-toplevel 2>/dev/null) || exit 0 current=$(git rev-parse --show-toplevel 2>/dev/null) || exit 0
[ "$current" = "$canonical" ] || exit 0 [ "$current" = "$canonical" ] || exit 0
/usr/bin/python3 "$canonical/server-tools/tcs-mother-root-agent/tcs_mother_root_agent.py" refresh --repo "$canonical" --trigger git-post-commit >/dev/null 2>&1 || true if /usr/bin/python3 "$canonical/server-tools/tcs-mother-root-agent/tcs_mother_root_agent.py" refresh --repo "$canonical" --trigger git-post-commit >/dev/null 2>&1; then
/usr/bin/python3 "$canonical/server-tools/fifth-domain-lighthouse-mirror/public_mirror_agent.py" sync-architecture --repo "$canonical" >/dev/null 2>&1 || true /usr/bin/python3 "$canonical/server-tools/fifth-domain-lighthouse-mirror/public_mirror_agent.py" sync-architecture --repo "$canonical" >/dev/null 2>&1 || true
fi
exit 0 exit 0

2
modules/fifth-domain-lighthouse-sanitized-mirror/module.lock.hdlp
View file

@ -2,7 +2,7 @@ schema: tcs.module-lock/v1
module_id: TCS-AGENT-SANITIZED-MIRROR-001 module_id: TCS-AGENT-SANITIZED-MIRROR-001
module_source_sha256: 1210b30c7dabc56b8b989763230a3cf56c0fe02a3b409be5f3833dee9853d771 module_source_sha256: 1210b30c7dabc56b8b989763230a3cf56c0fe02a3b409be5f3833dee9853d771
module_gir_sha256: 0e7b1bbd5f3f8dbc83df6c72e4a1e0532b6f44beed21c8c8315f85cc76096712 module_gir_sha256: 0e7b1bbd5f3f8dbc83df6c72e4a1e0532b6f44beed21c8c8315f85cc76096712
runtime_sha256: cf4b328c308163683595af8c29b7e545c42f831503b1d2667349cbb8ae7d559c runtime_sha256: b5c87c3a4d71e5c095e0b4f43c4c26f2b27afde19d972906f383587c7dcdefa4
mirror_map_sha256: a03b5ba9e06f5fd3f626301305d75add0332ae06948a67c8bcd03c3cab248fe1 mirror_map_sha256: a03b5ba9e06f5fd3f626301305d75add0332ae06948a67c8bcd03c3cab248fe1
protocol_source_sha256: cf198e7939e4ab70828b74cef8a2b84c2dac2ff262582bb3d5663904d602d71b protocol_source_sha256: cf198e7939e4ab70828b74cef8a2b84c2dac2ff262582bb3d5663904d602d71b
protocol_gir_sha256: 69f1a2a5cfc5ee61bdc2bf2065751d9cc41b9f662b28c35e61b393fd2187e1dc protocol_gir_sha256: 69f1a2a5cfc5ee61bdc2bf2065751d9cc41b9f662b28c35e61b393fd2187e1dc

16
modules/fifth-domain-lighthouse-sanitized-mirror/receipts/self-test.hdlp Normal file
View file

@ -0,0 +1,16 @@
schema: tcs.module-self-test-receipt/v1
module_id: TCS-AGENT-SANITIZED-MIRROR-001
result: PASS
tests: 7/7
verified:
- committed architecture projection contains no private absolute path
- missing persona share decision creates no candidate
- private human data requires human consent
- sanitization produces quarantine only and never publication
- mother acceptance is required before team review
- both reviews bind the exact candidate hash and use independent reviewers
- replay with changed content and review hash drift are rejected
repository_regression: node --test 483/483 PASS
tcs_root_regression: 5/5 PASS
external_publication: NOT_PERFORMED
server_deployment: NOT_PERFORMED

3
server-tools/fifth-domain-lighthouse-mirror/public_mirror_agent.py
View file

@ -26,6 +26,7 @@ PRIVATE_VALUE_PATTERNS = [
("URL_CREDENTIAL", re.compile(r"(?i)(?:https?|ssh)://[^\s/@:]+:[^\s/@]+@")), ("URL_CREDENTIAL", re.compile(r"(?i)(?:https?|ssh)://[^\s/@:]+:[^\s/@]+@")),
] ]
PUBLIC_PAYLOAD_KEYS = {"instructions", "input_schema", "output_schema", "examples", "limitations", "dependencies", "license", "compatibility"} PUBLIC_PAYLOAD_KEYS = {"instructions", "input_schema", "output_schema", "examples", "limitations", "dependencies", "license", "compatibility"}
SAFE_INTEGRITY_KEYS = {"freshness_token"}
class MirrorError(RuntimeError): class MirrorError(RuntimeError):
@ -95,7 +96,7 @@ def sanitize(value: Any) -> Any:
def contains_private(value: Any) -> bool: def contains_private(value: Any) -> bool:
if isinstance(value, dict): if isinstance(value, dict):
return any(DENIED_KEYS.search(str(key)) or contains_private(item) for key, item in value.items()) return any((key not in SAFE_INTEGRITY_KEYS and DENIED_KEYS.search(str(key))) or contains_private(item) for key, item in value.items())
if isinstance(value, list): if isinstance(value, list):
return any(contains_private(item) for item in value) return any(contains_private(item) for item in value)
if isinstance(value, str): if isinstance(value, str):