Skip to content

Legacy workflow fixtures: isolate inherited commit signing #357

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
d6g8k5htny-coder wants to merge 1 commit into from
Closed

Legacy workflow fixtures: isolate inherited commit signing #357

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
118 changes: 118 additions & 0 deletions reviews/legacy_fixture_signing_20261006/SCOPE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,118 @@
# Isolate signing on disposable legacy-workflow fixture commits

Dylan Roy — delegated AI engineering. Actual author OpenAI / GPT-6 Astra Pro,
`legacy-fixture-signing-20261006-r11`, pickup Math-#348/6009734461.
Scientific effect **NONE**; source-exposed, organizational-independence credit0.
No author self-merge or change to ordinary repository signing policy.

## Scope and exact predecessor

This is an isolated follow-on to #348 head
`b5c8fe833548a671e4eae9764c15b47acbc5aee4`, NOT a modification of that author's
branch and NOT permission to merge into it. The final route is after the actual
#330/#348 parent integration, current-main residual diff and applicable checks,
then separate eligible integration. Their owners retain their scopes.

The predecessor test file is
`tests/test_legacy_json_workflows.py`, Git blob
`ef2fa58503334d647333922bd688b1dec0023036`, SHA256
`491e5572d01ea693406a6ed482af0baf3a1cc9dbf4c044a5d2fa4afce4f1063d`.
The complete helper `30b1194d606835e785ebfba65e131254776ac84f` and contracts
`349fc3276ce02ba80aecd7ecc897e37349c65007` are unchanged.

The #348 reader's completed review6009308695 recorded one ambient signing
commit timeout in its normal run and an isolated success with signing disabled.
That historical observation is not rewritten as a full successful normal run.
This change addresses the disclosed signing dependency, not the parent's separate
TTY-width repair or #342's automatic-maintenance mechanism.

## Smallest behavioral change

Only the disposable commit inside `LegacyWorkflowTests.case` gains
`-c commit.gpgsign=false`. Git's explicit command configuration overrides the
inherited configuration for that invocation. It is not written into a repository,
home/global configuration, or later command. Normal project commits continue to
follow their signing settings. No signing key, signing agent or user credential
is accessed, created or changed.

All fifteen existing test methods are AST-identical. All module definitions other
than that commit argument and the new `LegacySigningTests` class are unchanged.
The three workflows, protocol helper, 17 measured rejection reports, scientific
checkers/results/manifests and formal sources are not edited. Existing direct
invocation of this test file discovers the two new methods without workflow changes.
The original 15-second commit and 45-second shell limits are unchanged.

Configuration reference: https://git-scm.com/docs/git-config
(`commit.gpgSign` and the ENVIRONMENT paragraph: explicit `git -c` takes precedence
over GIT_CONFIG_COUNT key/value pairs). The repair is command-local, not a global
instruction to disable signed commits.

## Regression is real-process, key-free and fail-closed

The new tests run actual Git and the complete existing fixture, not a mocked
subprocess. Their private child environment removes inherited GIT_* variables,
turns off system/global file reads, and provides a synthetic signing configuration
with commit.gpgsign=true, gpg.format=openpgp and a nonexistent synthetic key label.
The configured signer is an inert local shell script: append one marker and exit17.
It cannot produce a signature. The probe is POSIX-only and explicitly skips elsewhere.

For each active workflow family, a separate interpreter invokes the real
`LegacyWorkflowTests.case`. It must complete the full expected checker inventory,
return success and empty stderr, record exactly one actual fixture commit, and
never invoke the inert signer. Before and after, the inherited signing setting
must still read true. No suppressed exception or empty trace can pass these checks.
A separate positive control commits without the override and must fail after the
real signer child and its exact marker are observed. This proves the hostile
configuration and trace can detect the behavior the fix excludes.

## Actual local execution

CPython3.13.5 / Git2.47.3 / Linux, standard library. Source reconstruction was
checked against native Git identities before import; direct GitHub DNS failed.
This is a selected-source environment, not a full repository checkout.

Before adding the command option, both normal and optimized focused runs reported
**two methods / three intended family assertion failures / zero errors**, exit1.
The positive-control method passed; each real fixture commit reached the inert
signer and failed before its checker. After the option, both focused runs passed.

Final whole-file runs on the exact candidate:
- normal: **17/17 OK**, exit0, 86.544s;
- optimized: **17/17 OK**, exit0, 86.968s.

Both retain the prior fifteen methods and their existing whole-shell/PTY behavior;
the new two methods add three family signing-isolation cases and one real signer
positive control. These are not new mathematical tests. Ordinary unittest stderr
is retained; empty stdout agrees, but elapsed-time stderr is not byte-identical.

One earlier full normal run was interrupted by a 180-second external tool deadline
without a completed verdict. Its partial output is retained and not counted as
success or as a repaired test defect. The final two independent runs above
completed with bounded 900-second outer process budgets, no retry inside tests.

Run from the repository root:

```sh
python -B -S tests/test_legacy_json_workflows.py
python -B -O -S tests/test_legacy_json_workflows.py
```

For RED sensitivity, keep this new class but restore only the original fixture
commit argument. Run `LegacySigningTests` in each mode: three intended assertion
failures, zero errors; positive control must still succeed.

## Assurance and integration boundaries

This eliminates the demonstrated inherited signing dependency for this specific
disposable commit. It does not identify every historical timeout, authenticate
normal signed commits, suppress maintenance, repair all fixture environment
contamination, or guarantee operation under hostile templates/hooks/arbitrary Git
settings. The inert OpenPGP-program test is not execution of the original reviewer's
SSH signer or a real key operation.

Fresh applicable hosted checks and one nonauthor engineering review are required.
An existing parent PASS does not review these new bytes. Do not claim local Lean,
a new scientific calculation, numerical certification, full field alignment,
physical Mac installation or whole-program closure. Preserve all prior failures
and exact source/review identities. No protection, sharing or scientific-status
change is part of this follow-on.
92 changes: 91 additions & 1 deletion tests/test_legacy_json_workflows.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,7 +138,7 @@ def case(self,family,label='baseline',mode='normal',fault='',tamper=None):
# Only source authentication is re-bound for this synthetic fixture.
(repo/'tools/legacy_json_contracts.json').write_text(json.dumps(contract))
env=os.environ.copy();env.update({'LEGACY_TRACE':str(trace),'LEGACY_TARGET':label,'LEGACY_MODE':mode,'LEGACY_FAULT':fault,'PYTHONDONTWRITEBYTECODE':'1','PYTHONHASHSEED':'0'})
for cmd in [['git','init','-q'],['git','add','.'],['git','-c','user.name=Fixture','-c','user.email=fixture@example.invalid','commit','-qm','synthetic fixture']]:
for cmd in [['git','init','-q'],['git','add','.'],['git','-c','user.name=Fixture','-c','user.email=fixture@example.invalid','-c','commit.gpgsign=false','commit','-qm','synthetic fixture']]:
subprocess.run(cmd,cwd=repo,check=True,capture_output=True,timeout=15,env=env)
if tamper=='packet':(directory/entry['script']).write_bytes(data+b'\n')
if tamper=='upstream':(repo/'upstream.txt').write_bytes(upstream+b'x')
Expand Down Expand Up @@ -298,6 +298,96 @@ def test_invalid_columns_use_pipe_fallback(self):
self.diagnostic_case(width, columns, optimized)


@unittest.skipUnless(os.name == 'posix', 'synthetic signer probe requires POSIX')
class LegacySigningTests(unittest.TestCase):
"""Exercise real Git with an inert signer, without any real signing key."""

def signing_environment(self, folder):
signer = folder/'inert-signer'
signer.write_text('#!/bin/sh\nprintf "invoked\\n" >> "$LEGACY_SIGN_TRACE"\nexit 17\n')
signer.chmod(0o700)
env = {k:v for k,v in os.environ.items() if not k.startswith('GIT_')}
settings = [('commit.gpgsign', 'true'), ('gpg.format', 'openpgp'),
('gpg.program', str(signer.resolve())),
('user.signingkey', 'synthetic-test-key-not-a-real-key')]
env.update(GIT_CONFIG_NOSYSTEM='1', GIT_CONFIG_GLOBAL=os.devnull,
GIT_CONFIG_COUNT=str(len(settings)),
GIT_TRACE2_EVENT=str((folder/'git-trace.jsonl').resolve()),
LEGACY_SIGN_TRACE=str((folder/'signer.calls').resolve()))
for i,(key,value) in enumerate(settings):
env['GIT_CONFIG_KEY_'+str(i)] = key
env['GIT_CONFIG_VALUE_'+str(i)] = value
return env

def test_disposable_commits_never_invoke_inherited_signer(self):
code = '''
import importlib.util,json,subprocess,sys
from pathlib import Path
p=Path(sys.argv[1])
spec=importlib.util.spec_from_file_location('signing_fixture',p)
m=importlib.util.module_from_spec(spec);spec.loader.exec_module(m)
def configured():
return subprocess.check_output(['git','config','--bool','--get','commit.gpgsign'],text=True).strip()
before=configured()
r,events=m.LegacyWorkflowTests().case(sys.argv[2])
after=configured()
print(json.dumps({'before':before,'after':after,'returncode':r.returncode,
'stderr':r.stderr.decode(),'events':events}))
'''
flags = ['-B','-O','-S'] if sys.flags.optimize else ['-B','-S']
for family in ACTIVE:
with self.subTest(family=family), tempfile.TemporaryDirectory() as td:
folder = Path(td)
env = self.signing_environment(folder)
result = subprocess.run([sys.executable,*flags,'-c',code,
str(Path(__file__).resolve()),family],
cwd=folder,env=env,capture_output=True,timeout=60)
calls = folder/'signer.calls'
called = calls.read_text() if calls.exists() else ''
self.assertEqual(result.returncode,0,
(called,result.stderr.decode(errors='replace')))
self.assertEqual(result.stderr,b'')
report = json.loads(result.stdout)
self.assertEqual(report['returncode'],0,report)
self.assertEqual(report['stderr'],'')
self.assertEqual((report['before'],report['after']),('true','true'))
labels = ['baseline',*ORDERS[family],UNKNOWN[family]]
self.assertEqual(report['events'],[[label,mode] for mode in
['normal','optimized'] for label in labels])
trace = [json.loads(line) for line in
(folder/'git-trace.jsonl').read_text().splitlines() if line]
commits = [e for e in trace if e.get('event')=='start'
and 'commit' in e.get('argv',[])]
self.assertEqual(len(commits),1,'must observe actual fixture commit')
self.assertEqual(called,'','disposable commit invoked inherited signer')

def test_inert_signer_is_reached_when_signing_is_requested(self):
with tempfile.TemporaryDirectory() as td:
folder = Path(td)
env = self.signing_environment(folder)
repo = folder/'positive-control';repo.mkdir()
(repo/'payload').write_text('synthetic positive control\n')
for command in (['git','init','-q'],['git','add','.']):
subprocess.run(command,cwd=repo,env=env,check=True,
capture_output=True,timeout=15)
result = subprocess.run(['git','-c','user.name=Fixture',
'-c','user.email=fixture@example.invalid',
'commit','-qm','signer positive control'],
cwd=repo,env=env,capture_output=True,timeout=15)
self.assertNotEqual(result.returncode,0)
self.assertEqual((folder/'signer.calls').read_text(),'invoked\n')
trace = [json.loads(line) for line in
(folder/'git-trace.jsonl').read_text().splitlines() if line]
self.assertTrue(any(e.get('event')=='child_start' and any(
str(arg)==str((folder/'inert-signer').resolve())
for arg in e.get('argv',[])) for e in trace),
'positive control must observe a real signer child')
configured = subprocess.check_output(
['git','config','--bool','--get','commit.gpgsign'],
cwd=repo,env=env,text=True).strip()
self.assertEqual(configured,'true')


ORDERS={'local-pairing':['M1','M2','M3','M4'],'far-elder':['M1','M2','M3','M4'],'c6-cluster':['pins-not-critical','wrong-pin-hessian','drop-sigma-jacobian','three-extra-points','shear-drop-cubic','s-bound-constant','cross-term-not-small','window-closed','index-sign']}
# BASELINES inserted below from native RESULTS, independently hash-bound above.
BASELINES = {'c6-cluster': '{\n "groups": [\n "NF",\n "RS",\n "EX",\n "BD",\n "EU",\n "SH",\n "TW",\n "LG"\n ],\n "ledger": {\n "cross_term_exponent": "9/2",\n "hadamard_row_factors": {\n "3": 6,\n "4": 8\n },\n "soft_slice_exponent": 3,\n "ui_tail": "1/(M-1)"\n },\n "mathematical_acceptance": false,\n "object": "CL-C6-CLUSTER-LAW-20260929-v1.2",\n "passed": true,\n "q2_terms": 12,\n "schema": 1,\n "scientific_effect": "NONE",\n "scope": "exact identities, exact configurations and exponent bookkeeping only",\n "typed_window": {\n "family_size": 201720,\n "typed_in_window": 2590\n }\n}\n', 'far-elder': '{\n "checks": {\n "B1_barrier_polynomial": {\n "info": {\n "K": "22",\n "R": "1/11",\n "grid_points_in_ball": 1793,\n "lambda": "2"\n },\n "passed": true\n },\n "B2_algebra_and_constants": {\n "info": {\n "L=1": {\n "a_L": "1/4",\n "c_L": "1/48"\n },\n "L=2": {\n "a_L": "1/2",\n "c_L": "1/12"\n },\n "L=24": {\n "a_L": "1",\n "c_L": "1/3"\n },\n "L=4": {\n "a_L": "1",\n "c_L": "1/3"\n }\n },\n "passed": true\n },\n "I1_split_integral": {\n "info": {\n "q=2,u=1/100": "149/1000000",\n "q=2,u=1/4": "5/64",\n "q=2,u=1/9": "25/1458",\n "q=4,u=1/100": "299999999/4000000000000",\n "q=4,u=1/4": "767/16384",\n "q=4,u=1/9": "9841/1062882"\n },\n "passed": true\n },\n "I2_exponent_ledger": {\n "info": {\n "count exponent": "5/3",\n "inverse moment threshold": "-5/3",\n "u^2 exponent of ell": "2/3"\n },\n "passed": true\n },\n "N1_near_consistency": {\n "info": {\n "6*sqrt(6 c_L) < 12 for c_L <= 1/3": true\n },\n "passed": true\n }\n },\n "object": "CL-FAR-ELDER-RATE-20260930-v1",\n "passed": true,\n "scientific_effect": "NONE"\n}\n', 'local-pairing': '{\n "checks": {\n "I0_I3_identities": {\n "info": 144,\n "passed": true\n },\n "N1_n0_grid": {\n "info": {\n "n0_points_with_U_hypothesis": 0,\n "n0_typed_grid_points": 135\n },\n "passed": true\n },\n "P1_path_cases": {\n "info": {\n "cases": {\n "U": 2160,\n "V": 4680,\n "V_at_other_root": 2160\n },\n "min_margin": "1/1200",\n "samples": 6840\n },\n "passed": true\n },\n "P2_elder_witness": {\n "info": {\n "Z1_squared": "15/8",\n "n": 2,\n "saddle_height": "-7/32",\n "u0": "-3/4",\n "vertical_line_constant": true\n },\n "passed": true\n }\n },\n "object": "CL-LOCAL-PAIRING-20260930-v1",\n "passed": true,\n "scientific_effect": "NONE"\n}\n'}
Expand Down
Loading