bingshuo/guanghu-ice-heart
Watch
1
0
Fork
You've already forked guanghu-ice-heart
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

fix: bind skill reviews to mother and team roots

Browse source
This commit is contained in:
冰朔 2026-09-08 14:21:16 +08:00
commit b9e4938a0f
5 changed files with 31 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

8
server-tools/fifth-domain-lighthouse-mirror/public_mirror_agent.py
View file

@ -209,6 +209,10 @@ def review(event: dict[str, Any], state: Path, kind: str) -> dict[str, Any]:
decision = required_string(event, "decision")
if decision not in {"ACCEPT", "HOLD", "REJECT"}:
raise MirrorError("INVALID_REVIEW_DECISION")
expected_kind = "TCS_MOTHER" if kind == "mother" else "GUANGHU_HUMAN_TEAM"
expected_root = "TCS-MOTHER-LPM-0001" if kind == "mother" else "TCS-0002∞"
if event.get("reviewer_kind") != expected_kind or event.get("reviewer_authority_root") != expected_root:
raise MirrorError("REVIEWER_KIND_OR_AUTHORITY_ROOT_MISMATCH")
candidate = json.loads(candidate_path(state, module_id, contribution_id).read_text())
if event.get("candidate_sha256") != candidate["candidate_sha256"]:
raise MirrorError("CANDIDATE_HASH_MISMATCH")
@ -218,7 +222,8 @@ def review(event: dict[str, Any], state: Path, kind: str) -> dict[str, Any]:
raise MirrorError("MOTHER_ACCEPT_REQUIRED_BEFORE_TEAM_REVIEW")
receipt = {
"schema": f"guanghu.lighthouse-persona-skill-{kind}-review/v1",
"reviewer_kind": "TCS_MOTHER" if kind == "mother" else "GUANGHU_HUMAN_TEAM",
"reviewer_kind": expected_kind,
"reviewer_authority_root": expected_root,
"reviewer_id": reviewer_id,
"module_id": module_id,
"contribution_id": contribution_id,
@ -226,6 +231,7 @@ def review(event: dict[str, Any], state: Path, kind: str) -> dict[str, Any]:
"decision": decision,
"reason_code": event.get("reason_code", "NONE"),
"external_effect": "NONE",
"authentication_state": "LOCAL_STRUCTURAL_ASSERTION_PENDING_SIGNED_PUBLICATION_GATE",
}
atomic_json(state / "reviews" / kind / f"{contribution_id}.json", receipt)
return receipt

27
server-tools/fifth-domain-lighthouse-mirror/test_public_mirror_agent.py
View file

@ -25,6 +25,10 @@ def contribution(**overrides):
return value
def review_event(item, kind, reviewer):
return {"module_id":item["module_id"], "contribution_id":item["contribution_id"], "candidate_sha256":item["candidate_sha256"], "decision":"ACCEPT", "reviewer_id":reviewer, "reviewer_kind":"TCS_MOTHER" if kind == "mother" else "GUANGHU_HUMAN_TEAM", "reviewer_authority_root":"TCS-MOTHER-LPM-0001" if kind == "mother" else "TCS-0002∞"}
class MirrorAgentTest(unittest.TestCase):
def test_architecture_mirror_allowlists_and_has_no_private_path(self):
with tempfile.TemporaryDirectory() as temp:
@ -59,11 +63,10 @@ class MirrorAgentTest(unittest.TestCase):
with tempfile.TemporaryDirectory() as temp:
state = Path(temp)
item = M.prepare_contribution(contribution(), state)
base = {"module_id":item["module_id"],"contribution_id":item["contribution_id"],"candidate_sha256":item["candidate_sha256"],"decision":"ACCEPT"}
with self.assertRaisesRegex(M.MirrorError, "MOTHER_ACCEPT"):
M.review({**base,"reviewer_id":"TEAM-1"}, state, "team")
M.review({**base,"reviewer_id":"MOTHER-1"}, state, "mother")
M.review({**base,"reviewer_id":"TEAM-1"}, state, "team")
M.review(review_event(item, "team", "TEAM-1"), state, "team")
M.review(review_event(item, "mother", "MOTHER-1"), state, "mother")
M.review(review_event(item, "team", "TEAM-1"), state, "team")
record = M.register(item["module_id"], item["contribution_id"], state)
self.assertEqual(record["state"], "ARRIVAL_REGISTERED_LOCAL_NOT_PUBLISHED")
self.assertFalse(record["runtime_enabled"])
@ -72,18 +75,26 @@ class MirrorAgentTest(unittest.TestCase):
with tempfile.TemporaryDirectory() as temp:
state = Path(temp)
item = M.prepare_contribution(contribution(), state)
base = {"module_id":item["module_id"],"contribution_id":item["contribution_id"],"candidate_sha256":item["candidate_sha256"],"decision":"ACCEPT","reviewer_id":"SAME"}
M.review(base, state, "mother")
M.review(base, state, "team")
M.review(review_event(item, "mother", "SAME"), state, "mother")
M.review(review_event(item, "team", "SAME"), state, "team")
with self.assertRaisesRegex(M.MirrorError, "INDEPENDENT_REVIEWERS"):
M.register(item["module_id"], item["contribution_id"], state)
def test_review_command_cannot_change_registered_authority_root(self):
with tempfile.TemporaryDirectory() as temp:
state = Path(temp)
item = M.prepare_contribution(contribution(), state)
event = review_event(item, "mother", "MOTHER-1")
event["reviewer_authority_root"] = "TCS-0002∞"
with self.assertRaisesRegex(M.MirrorError, "AUTHORITY_ROOT"):
M.review(event, state, "mother")
def test_hash_drift_and_replay_rejected(self):
with tempfile.TemporaryDirectory() as temp:
state = Path(temp)
item = M.prepare_contribution(contribution(), state)
with self.assertRaisesRegex(M.MirrorError, "CANDIDATE_HASH"):
M.review({"module_id":item["module_id"],"contribution_id":item["contribution_id"],"candidate_sha256":"0"*64,"decision":"ACCEPT","reviewer_id":"M"}, state, "mother")
M.review({**review_event(item, "mother", "M"), "candidate_sha256":"0"*64}, state, "mother")
with self.assertRaisesRegex(M.MirrorError, "REPLAY"):
M.prepare_contribution(contribution(summary="changed"), state)