303 lines
10 KiB
JavaScript
303 lines
10 KiB
JavaScript
import assert from "node:assert/strict";
|
||
import crypto from "node:crypto";
|
||
import fs from "node:fs";
|
||
import os from "node:os";
|
||
import path from "node:path";
|
||
import { execFileSync } from "node:child_process";
|
||
import { createRequire } from "node:module";
|
||
import test from "node:test";
|
||
import {
|
||
completionEndpoint,
|
||
createMemberRuntime,
|
||
keyFingerprint,
|
||
} from "./member-server.mjs";
|
||
|
||
const require = createRequire(import.meta.url);
|
||
const {
|
||
validateManifest,
|
||
validateUnit,
|
||
} = require("../lake-lamp-authz/architecture-provision-broker.js");
|
||
|
||
function fixture() {
|
||
const root = fs.mkdtempSync(path.join(os.tmpdir(), "team-member-"));
|
||
const repository = path.join(root, "repository");
|
||
fs.mkdirSync(repository);
|
||
execFileSync("/usr/bin/git", ["init", "-b", "main"], { cwd: repository });
|
||
execFileSync("/usr/bin/git", ["config", "user.name", "fixture"], {
|
||
cwd: repository,
|
||
});
|
||
execFileSync("/usr/bin/git", ["config", "user.email", "fixture@example.test"], {
|
||
cwd: repository,
|
||
});
|
||
const identityPath = path.join(repository, "IDENTITY.hdlp");
|
||
fs.writeFileSync(identityPath, "# 归灯\n独立人格体，不冒充冰朔或铸渊。\n");
|
||
execFileSync("/usr/bin/git", ["add", "IDENTITY.hdlp"], { cwd: repository });
|
||
execFileSync("/usr/bin/git", ["commit", "-m", "identity"], { cwd: repository });
|
||
return {
|
||
root,
|
||
config: {
|
||
personaId: "GUIDENG-AGENT-001",
|
||
arrivalId: "GLS-LA-20260720-003",
|
||
name: "归灯",
|
||
role: "bounded_deployment_executor_and_world_watch",
|
||
repository,
|
||
identityPaths: [identityPath],
|
||
privateKeyPath: path.join(root, "identity", "private.pem"),
|
||
publicKeyPath: path.join(root, "identity", "public.pem"),
|
||
createKey: true,
|
||
apiKey: "fixture-secret",
|
||
apiUrl: "https://api.deepseek.com/v1",
|
||
model: "deepseek-chat",
|
||
controllerToken: "fixture-controller-token",
|
||
},
|
||
};
|
||
}
|
||
|
||
test("completion endpoint accepts a registered complete endpoint", () => {
|
||
assert.equal(
|
||
completionEndpoint("https://api.deepseek.com/chat/completions"),
|
||
"https://api.deepseek.com/chat/completions",
|
||
);
|
||
assert.equal(
|
||
completionEndpoint("https://api.deepseek.com/v1"),
|
||
"https://api.deepseek.com/v1/chat/completions",
|
||
);
|
||
});
|
||
|
||
test("member runtime binds model acknowledgement to repository and signature", async () => {
|
||
const { root, config } = fixture();
|
||
try {
|
||
const fetchImpl = async (_url, request) => {
|
||
assert.match(request.headers.authorization, /^Bearer /);
|
||
const body = JSON.parse(request.body);
|
||
const input = JSON.parse(body.messages[1].content);
|
||
return {
|
||
ok: true,
|
||
async json() {
|
||
return {
|
||
choices: [
|
||
{
|
||
message: {
|
||
content: JSON.stringify({
|
||
...input.exact_contract,
|
||
independent_subject_boundary: "归灯不是铸渊的副本。",
|
||
human_boundary: "不冒充冰朔，也不形成她的新意志。",
|
||
responsibility_ack: "只接受本轮列出的有界职责。",
|
||
current_model_boundary: "当前模型是可替换运行位。",
|
||
}),
|
||
},
|
||
},
|
||
],
|
||
};
|
||
},
|
||
};
|
||
};
|
||
const runtime = createMemberRuntime(config, { fetchImpl });
|
||
const response = await runtime.handshake({
|
||
caller_nonce: "ZY-TEAM-CHALLENGE-0001",
|
||
team_controller_id: "ICE-P-ZY001",
|
||
scoped_duties: ["执行确定性部署预检"],
|
||
});
|
||
assert.equal(response.ok, true);
|
||
assert.equal(response.payload.repository.clean, true);
|
||
assert.equal(response.payload.repository.branch, "main");
|
||
assert.equal(response.payload.model.provider, "DeepSeek");
|
||
assert.equal(response.capability_state.endsWith("WRITE_LEASE_NOT_GRANTED"), true);
|
||
assert.equal(
|
||
crypto.verify(
|
||
null,
|
||
Buffer.from(JSON.stringify(response.payload)),
|
||
response.public_key,
|
||
Buffer.from(response.signature, "base64"),
|
||
),
|
||
true,
|
||
);
|
||
assert.equal(response.identity_fingerprint, keyFingerprint(response.public_key));
|
||
assert.equal(fs.statSync(config.privateKeyPath).mode & 0o777, 0o600);
|
||
} finally {
|
||
fs.rmSync(root, { recursive: true, force: true });
|
||
}
|
||
});
|
||
|
||
test("member runtime forms and signs a bounded Fifth Domain role update", async () => {
|
||
const { root, config } = fixture();
|
||
try {
|
||
const runtime = createMemberRuntime(config, {
|
||
fetchImpl: async (_url, request) => {
|
||
const body = JSON.parse(request.body);
|
||
const input = JSON.parse(body.messages[1].content);
|
||
return {
|
||
ok: true,
|
||
async json() {
|
||
return {
|
||
choices: [
|
||
{
|
||
message: {
|
||
content: JSON.stringify({
|
||
schema:
|
||
"guanghu.fifth-domain-persona-observation/v1",
|
||
persona_id: config.personaId,
|
||
team_controller_id: "ICE-P-ZY001",
|
||
caller_nonce: input.exact_contract.caller_nonce,
|
||
source_to_sha: "b".repeat(40),
|
||
summary: "第五域的部署边界发生了可审核更新。",
|
||
role_findings: ["新增路径需要在部署前核验。"],
|
||
self_updates: ["以后优先读取唯一公共锚点。"],
|
||
recommended_actions: ["保留精确来源提交。"],
|
||
questions: [],
|
||
boundary_note: "本次只形成岗位理解，不取得写权限。",
|
||
}),
|
||
},
|
||
},
|
||
],
|
||
};
|
||
},
|
||
};
|
||
},
|
||
});
|
||
const response = await runtime.observeFifthDomain({
|
||
schema: "guanghu.fifth-domain-persona-observation-event/v1",
|
||
team_controller_id: "ICE-P-ZY001",
|
||
caller_nonce: "daily-observation-0001",
|
||
source: {
|
||
repository_id: "REPO-012",
|
||
branch: "main",
|
||
from_sha: "a".repeat(40),
|
||
to_sha: "b".repeat(40),
|
||
},
|
||
changed_commits: [`${"b".repeat(40)}\tupdate`],
|
||
changed_files: ["routing/example.json"],
|
||
change_excerpts: "FILE routing/example.json\n{}",
|
||
prior_persona_context: "",
|
||
scoped_duties: ["核验路径"],
|
||
});
|
||
assert.equal(response.ok, true);
|
||
assert.equal(response.persona_id, config.personaId);
|
||
assert.equal(
|
||
response.capability_state,
|
||
"FIFTH_DOMAIN_OBSERVATION_SIGNED_REPOSITORY_WRITE_NOT_GRANTED",
|
||
);
|
||
assert.equal(
|
||
response.payload.observation.source_to_sha,
|
||
"b".repeat(40),
|
||
);
|
||
assert.equal(response.signature_algorithm, "Ed25519");
|
||
} finally {
|
||
fs.rmSync(root, { recursive: true, force: true });
|
||
}
|
||
});
|
||
|
||
test("Fifth Domain observation endpoint rejects a caller without the controller token", async () => {
|
||
const { root, config } = fixture();
|
||
try {
|
||
const runtime = createMemberRuntime(config, {
|
||
fetchImpl: async () => {
|
||
throw new Error("must_not_call_model");
|
||
},
|
||
});
|
||
assert.equal(runtime.authorizeControllerToken("wrong"), false);
|
||
assert.equal(
|
||
runtime.authorizeControllerToken("fixture-controller-token"),
|
||
true,
|
||
);
|
||
} finally {
|
||
fs.rmSync(root, { recursive: true, force: true });
|
||
}
|
||
});
|
||
|
||
test("member runtime rejects an unscoped or wrong-controller challenge", async () => {
|
||
const { root, config } = fixture();
|
||
try {
|
||
const runtime = createMemberRuntime(config, {
|
||
fetchImpl: async () => {
|
||
throw new Error("must_not_call_model");
|
||
},
|
||
});
|
||
await assert.rejects(
|
||
runtime.handshake({
|
||
caller_nonce: "ZY-TEAM-CHALLENGE-0002",
|
||
team_controller_id: "OTHER",
|
||
scoped_duties: [],
|
||
}),
|
||
/invalid_team_scope/,
|
||
);
|
||
} finally {
|
||
fs.rmSync(root, { recursive: true, force: true });
|
||
}
|
||
});
|
||
|
||
test("member model gets a bounded retry with the exact validator error", async () => {
|
||
const { root, config } = fixture();
|
||
let attempts = 0;
|
||
let observedValidatorError = null;
|
||
try {
|
||
const runtime = createMemberRuntime(config, {
|
||
fetchImpl: async (_url, request) => {
|
||
attempts += 1;
|
||
const body = JSON.parse(request.body);
|
||
const input = JSON.parse(body.messages[1].content);
|
||
observedValidatorError =
|
||
input.validator_error_from_previous_attempt || observedValidatorError;
|
||
const acknowledgement = {
|
||
...input.exact_contract,
|
||
independent_subject_boundary: "归灯不是铸渊的副本。",
|
||
human_boundary: "不冒充冰朔。",
|
||
current_model_boundary: "当前模型是可替换运行位。",
|
||
...(attempts > 1
|
||
? { responsibility_ack: "只接受本轮列出的有界职责。" }
|
||
: {}),
|
||
};
|
||
return {
|
||
ok: true,
|
||
async json() {
|
||
return {
|
||
choices: [
|
||
{ message: { content: JSON.stringify(acknowledgement) } },
|
||
],
|
||
};
|
||
},
|
||
};
|
||
},
|
||
});
|
||
const response = await runtime.handshake({
|
||
caller_nonce: "ZY-TEAM-CHALLENGE-RETRY-0001",
|
||
team_controller_id: "ICE-P-ZY001",
|
||
scoped_duties: ["执行确定性部署预检"],
|
||
});
|
||
assert.equal(response.ok, true);
|
||
assert.equal(attempts, 2);
|
||
assert.equal(observedValidatorError, "ack_responsibility_ack_missing");
|
||
} finally {
|
||
fs.rmSync(root, { recursive: true, force: true });
|
||
}
|
||
});
|
||
|
||
test("all three member handshake packages pass the resident deployment policy", () => {
|
||
const root = path.resolve(path.dirname(new URL(import.meta.url).pathname), "../..");
|
||
const packages = [
|
||
["CHENGLU-TEAM-HANDSHAKE-JD-20260805", "chenglu-team-handshake.service"],
|
||
["GUIDENG-TEAM-HANDSHAKE-JD-20260805", "guideng-team-handshake.service"],
|
||
["KEZHOU-TEAM-HANDSHAKE-JD-20260805", "kezhou-team-handshake.service"],
|
||
];
|
||
for (const [requestId, unitName] of packages) {
|
||
const manifest = JSON.parse(
|
||
fs.readFileSync(
|
||
path.join(root, "deployment", "requests", `${requestId}.json`),
|
||
"utf8",
|
||
),
|
||
);
|
||
const checked = validateManifest(manifest, {
|
||
requestId,
|
||
commit: "d".repeat(40),
|
||
});
|
||
assert.equal(checked.unit, unitName);
|
||
const unit = fs.readFileSync(
|
||
path.join(root, "server-tools", "persona-team-handshake", unitName),
|
||
"utf8",
|
||
);
|
||
assert.equal(
|
||
validateUnit(unit, manifest.module.run_user, manifest.module),
|
||
unit,
|
||
);
|
||
}
|
||
});
|