From 39b2f8f2c813e94a9c3a122866ce49ae512e19c4 Mon Sep 17 00:00:00 2001 From: Dylan Roy <249851642+d6g8k5htny-coder@users.noreply.github.com> Date: Tue, 6 Oct 2026 04:11:02 -0700 Subject: [PATCH] Legacy replay triggers: cover tools package resolution and test the boundary MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Dylan Roy — delegated AI engineering. Actual author OpenAI / GPT-6 Astra Pro, qs-continuation-legacy-trigger-20261006-r6; pickup Math-#351/6014859323. Isolated five-file amendment atop frozen #351. Adds tools/**, root tools.py and the new regression trigger to all three workflows, plus a separate two-mode test step. Original numerical/protocol steps, helpers, contracts and scientific sources stay byte-identical. Local original15 failures per mode; amended5 methods pass; four removal mutations fail as intended. Source and actual import boundary tests only, not scientific acceptance. Nonauthor review and actual hosted/current-base integration evidence remain required. No self-merge or parent branch mutation. --- .github/workflows/c6-cluster-law.yml | 7 + .github/workflows/far-elder-rate.yml | 7 + .github/workflows/local-pairing.yml | 7 + .../legacy_trigger_coverage_20261006/SCOPE.md | 99 +++++++++++++ tests/test_legacy_workflow_triggers.py | 138 ++++++++++++++++++ 5 files changed, 258 insertions(+) create mode 100644 reviews/legacy_trigger_coverage_20261006/SCOPE.md create mode 100644 tests/test_legacy_workflow_triggers.py diff --git a/.github/workflows/c6-cluster-law.yml b/.github/workflows/c6-cluster-law.yml index ae5bf02b6..3a09eabf6 100644 --- a/.github/workflows/c6-cluster-law.yml +++ b/.github/workflows/c6-cluster-law.yml @@ -8,6 +8,9 @@ name: C6 cluster-law checks - 'tools/legacy_json_replay.py' - 'tools/legacy_json_contracts.json' - 'tests/test_legacy_json_workflows.py' + - 'tools/**' + - 'tools.py' + - 'tests/test_legacy_workflow_triggers.py' workflow_dispatch: permissions: @@ -24,6 +27,10 @@ jobs: - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 with: python-version: '3.11.16' + - name: Check legacy import-resolution trigger coverage + run: | + python -B -S tests/test_legacy_workflow_triggers.py + python -B -O -S tests/test_legacy_workflow_triggers.py - name: Exercise the complete shell rejection contract in both modes env: LEGACY_TEST_FAMILY: 'c6-cluster' diff --git a/.github/workflows/far-elder-rate.yml b/.github/workflows/far-elder-rate.yml index 37c0dd197..5c1665740 100644 --- a/.github/workflows/far-elder-rate.yml +++ b/.github/workflows/far-elder-rate.yml @@ -8,6 +8,9 @@ name: Far elder rate exact controls - 'tools/legacy_json_replay.py' - 'tools/legacy_json_contracts.json' - 'tests/test_legacy_json_workflows.py' + - 'tools/**' + - 'tools.py' + - 'tests/test_legacy_workflow_triggers.py' workflow_dispatch: permissions: @@ -24,6 +27,10 @@ jobs: - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 with: python-version: '3.11.16' + - name: Check legacy import-resolution trigger coverage + run: | + python -B -S tests/test_legacy_workflow_triggers.py + python -B -O -S tests/test_legacy_workflow_triggers.py - name: Exercise the complete shell rejection contract in both modes env: LEGACY_TEST_FAMILY: 'far-elder' diff --git a/.github/workflows/local-pairing.yml b/.github/workflows/local-pairing.yml index 8ea45e746..b21aecefd 100644 --- a/.github/workflows/local-pairing.yml +++ b/.github/workflows/local-pairing.yml @@ -8,6 +8,9 @@ name: Local pairing exact controls - 'tools/legacy_json_replay.py' - 'tools/legacy_json_contracts.json' - 'tests/test_legacy_json_workflows.py' + - 'tools/**' + - 'tools.py' + - 'tests/test_legacy_workflow_triggers.py' workflow_dispatch: permissions: @@ -24,6 +27,10 @@ jobs: - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 with: python-version: '3.11.16' + - name: Check legacy import-resolution trigger coverage + run: | + python -B -S tests/test_legacy_workflow_triggers.py + python -B -O -S tests/test_legacy_workflow_triggers.py - name: Exercise the complete shell rejection contract in both modes env: LEGACY_TEST_FAMILY: 'local-pairing' diff --git a/reviews/legacy_trigger_coverage_20261006/SCOPE.md b/reviews/legacy_trigger_coverage_20261006/SCOPE.md new file mode 100644 index 000000000..bfe44d57f --- /dev/null +++ b/reviews/legacy_trigger_coverage_20261006/SCOPE.md @@ -0,0 +1,99 @@ +# Legacy package-resolution trigger coverage + +Dylan Roy — delegated AI engineering. Actual author OpenAI / GPT-6 Astra Pro, +`qs-continuation-legacy-trigger-20261006-r6`. Pickup Math-#351/6014859323. +Scientific effect **NONE**; organizational-independence credit 0. No self-merge. + +## Finding and isolated scope + +Native #351 discussion_r4191758835 identifies two repository paths which can +change the meaning of `from tools.legacy_json_replay import replay` without +matching any of the three dedicated workflow filters: `tools/__init__.py` and +root `tools.py`. The original helper lives in an implicit namespace package. +An initializer executes on import; a root module can supersede that namespace +and make the submodule import fail. This is missing trigger coverage, not a +claim that the current numerical result is wrong or that a malicious file exists. + +Base: #351 head `18afecd9e505167b6eb1d9457b17ed9aacee6677`. +This proposal changes only three workflows, adds one regression file, and this +scope note. It is stacked to isolate its delta, NOT permission to merge into +#351's or #330's owner branch. Canonical parent adoption stays with that owner. + +Each workflow retains every original path and adds `tools/**`, `tools.py`, and +`tests/test_legacy_workflow_triggers.py`. The broad subtree intentionally runs +these checks for additional tools changes; it does NOT cover root `tools.py`, +which is therefore explicit. A separate step runs the regression in normal and +optimized Python before the existing full-shell protocol tests. No negative +path patterns, new events, permissions, action/runtime pins, job budgets, +production imports, numerical commands, or acceptance contracts are changed. + +The entire original workflow is recovered by removing exactly the three added +path entries and the four-line new step. The original source preflight, +checker/replay invocation, final JSON statement and Git postflight are byte-exact. +All helper/contracts, original tests, scientific inputs/proofs/RESULTS/manifests, +formal code, scientific registers, premises and review history are unchanged. + +## Test-first execution + +Local: CPython 3.13.5, Git 2.47.3, Linux. GitHub clone failed DNS, so the local +worktree is an authenticated three-file source subset, not a full repository. +All original workflow bytes reconstruct their native Git blob identities: + +| Workflow | Original Git blob | +|---|---| +| local-pairing.yml | 8ea45e74672c42687176462e79df33adaf83c98d | +| far-elder-rate.yml | 37c0dd197e3d6c0fd10a172a656b79f496943aa2 | +| c6-cluster-law.yml | ae5bf02b6358c0e83fe8a52b470eb4734536f113 | + +The five-method new suite against the original workflows fails **15 intended +assertions per outer interpreter mode, zero errors**: nine named resolver-path +coverage cases, three missing self-triggers and three missing two-mode steps. +The actual-import method passes even on the predecessor, establishing the +mechanism independently of the repaired configuration. It executes the exact +import line read from each workflow against a synthetic helper in isolated +subprocesses: three families, two child modes, namespace/initializer/root-module +variants, **18 real children per outer run**. Initializers and root modules leave +observable markers; root-module selection also yields the expected package error. +No import/subprocess implementation is mocked. Child environments are private +and remove ambient PYTHON variables; the caller environment is not changed. + +After the 21-line workflow amendment, **5/5 methods pass in each outer mode**. +Four separately copied configuration mutations then reject in both modes with +exactly 3/6/3/3 assertion failures and zero errors: remove root-module coverage, +remove subtree coverage, remove the test's trigger, or remove its optimized +invocation. Valid old paths and unrelated-path negatives are retained. All three +YAML documents parse and every run block passes `bash -n`; the product test itself +uses only the standard library, not the auxiliary YAML inspection dependency. + +From the repository root: + +```sh +python -B -S tests/test_legacy_workflow_triggers.py +python -B -O -S tests/test_legacy_workflow_triggers.py +``` + +## Evidence and integration boundaries + +The test uses a deliberately restricted reader for the actual positive, +single-quoted path lists, and literal/subtree patterns. It rejects unsupported +syntax rather than claiming to implement GitHub's full YAML/glob evaluator. +These checks establish configured coverage and real Python import behavior; +they do NOT constitute a hosted changed-path-only scheduling experiment, a +hostile-source sandbox, an exhaustive import-dependency audit, or a theorem. +GitHub's own changed-file/diff limits remain. Arbitrary future loader hooks, +root standard-library shadows and installed dependencies are outside this fix. + +Full original legacy tests and source-authenticated numerical replays were not +executed locally. Actual dedicated and applicable general hosted checks on the +published candidate, a bounded nonauthor delta review, and an explicit owner +adoption/reconciliation are still required. No earlier #330/#351 review transfers +to changed YAML merely because the numerical block is preserved. Keep the native +finding open until its actual source/review disposition is satisfied. A stacked +success is not a current-main integration receipt. Parent and later #348/signing +branches must not be overwritten; reconcile their real ordering and source. + +Primary technical references consulted 2026-10-06: +- https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax + (`on..paths`, diff limits, literal and `**` path patterns). +- https://docs.python.org/3.13/reference/import.html + (regular/namespace packages and submodule import resolution). diff --git a/tests/test_legacy_workflow_triggers.py b/tests/test_legacy_workflow_triggers.py new file mode 100644 index 000000000..296bd0893 --- /dev/null +++ b/tests/test_legacy_workflow_triggers.py @@ -0,0 +1,138 @@ +"""Named legacy import-resolution triggers; real imports, not a GitHub scheduler. + +The loader below intentionally accepts only these workflows' simple, positive, +single-quoted path lists and literal/prefix/** patterns. Unsupported syntax fails +rather than pretending to implement the general GitHub glob/YAML language. +Synthetic helper bodies demonstrate resolution only, not numerical correctness. +""" +from pathlib import Path +import os +import re +import subprocess +import sys +import tempfile +import unittest + +ROOT = Path(__file__).resolve().parents[1] +SELF = 'tests/test_legacy_workflow_triggers.py' +FAMILIES = { + 'local-pairing.yml': 'frontiers/local_pairing_20260930', + 'far-elder-rate.yml': 'frontiers/far_elder_rate_20260930', + 'c6-cluster-law.yml': 'frontiers/c6_cluster_law_20260929', +} +STEP = ( + ' - name: Check legacy import-resolution trigger coverage\n' + ' run: |\n' + ' python -B -S ' + SELF + '\n' + ' python -B -O -S ' + SELF + '\n' +) + + +def workflow_text(name): + return (ROOT / '.github' / 'workflows' / name).read_text(encoding='utf-8') + + +def trigger_paths(text): + start = "'on':\n pull_request:\n paths:\n" + if text.count(start) != 1: + raise ValueError('expected one plain pull-request path list') + rows = text.split(start, 1)[1].split(' workflow_dispatch:\n', 1) + if len(rows) != 2: + raise ValueError('expected workflow-dispatch after path list') + found = [] + for line in rows[0].splitlines(): + match = re.fullmatch(r" - '([^']+)'", line) + if not match or match[1].startswith('!'): + raise ValueError('unsupported path-list syntax') + pattern = match[1] + plain = pattern[:-3] if pattern.endswith('/**') else pattern + if any(c in plain for c in '*?[]{}!'): + raise ValueError('unsupported path pattern') + found.append(pattern) + if not found or len(found) != len(set(found)): + raise ValueError('empty or duplicate path list') + return found + + +def covered(patterns, path): + # Only literal names or whole subtrees, as validated by trigger_paths. + return any(path.startswith(p[:-2]) if p.endswith('/**') else path == p + for p in patterns) + + +class LegacyTriggerTests(unittest.TestCase): + def test_package_and_root_module_changes_are_covered(self): + for name in FAMILIES: + paths = trigger_paths(workflow_text(name)) + for path in ('tools/__init__.py', 'tools.py', 'tools/nested/input.py'): + with self.subTest(workflow=name, path=path): + self.assertTrue(covered(paths, path), 'resolver change lacks replay trigger') + + def test_original_paths_and_new_regression_remain_covered(self): + for name, packet in FAMILIES.items(): + paths = trigger_paths(workflow_text(name)) + for path in (packet + '/checker.py', '.github/workflows/' + name, + 'tools/legacy_json_replay.py', 'tools/legacy_json_contracts.json', + 'tests/test_legacy_json_workflows.py', SELF): + with self.subTest(workflow=name, path=path): + self.assertTrue(covered(paths, path), 'consumed or regression path is uncovered') + for path in ('README.md', 'unrelated/tools.py', 'tools_extra/file.py'): + with self.subTest(workflow=name, unrelated=path): + self.assertFalse(covered(paths, path), 'unexpected unrelated trigger') + + def test_new_checks_run_in_both_modes_before_existing_replay(self): + for name in FAMILIES: + text = workflow_text(name) + with self.subTest(workflow=name): + self.assertEqual(text.count(STEP), 1, 'missing exact two-mode trigger-test step') + self.assertLess(text.index(STEP), text.index( + ' - name: Exercise the complete shell rejection contract in both modes\n')) + + def test_original_import_actually_uses_both_resolver_inputs(self): + for name in FAMILIES: + lines = [s.strip() for s in workflow_text(name).splitlines() + if s.strip().startswith('from tools.')] + self.assertEqual(lines, ['from tools.legacy_json_replay import replay']) + program = lines[0] + "\nprint(replay())\n" + for flags in (['-B', '-S'], ['-B', '-O', '-S']): + for variant in ('namespace', 'initializer', 'root-module'): + with self.subTest(workflow=name, flags=flags, variant=variant), \ + tempfile.TemporaryDirectory() as directory: + root = Path(directory) + (root / 'tools').mkdir() + (root / 'tools/legacy_json_replay.py').write_text( + "def replay(): return 'SYNTHETIC_HELPER'\n", encoding='utf-8') + if variant != 'namespace': + target = ('tools/__init__.py' if variant == 'initializer' + else 'tools.py') + (root / target).write_text( + "from pathlib import Path\n" + "Path('resolver.marker').write_text('executed')\n", + encoding='utf-8') + # Private process environment; do not alter caller configuration. + env = {k: v for k, v in os.environ.items() if not k.startswith('PYTHON')} + child = subprocess.run([sys.executable, *flags, '-'], input=program.encode(), + cwd=root, env=env, capture_output=True, timeout=10) + marker = root / 'resolver.marker' + self.assertEqual(marker.exists(), variant != 'namespace') + if marker.exists(): + self.assertEqual(marker.read_text(), 'executed') + if variant == 'root-module': + self.assertEqual(child.returncode, 1) + self.assertEqual(child.stdout, b'') + self.assertIn(b'ModuleNotFoundError', child.stderr) + self.assertIn(b"'tools' is not a package", child.stderr) + else: + self.assertEqual((child.returncode, child.stdout, child.stderr), + (0, b'SYNTHETIC_HELPER\n', b'')) + + def test_limited_path_reader_rejects_unsupported_syntax(self): + template = "'on':\n pull_request:\n paths:\n%s workflow_dispatch:\n" + for rows in (" - '!tools.py'\n", " - tools.py\n", + " - 'tools.*'\n", " - 'tools.py'\n - 'tools.py'\n", ''): + with self.subTest(rows=rows), self.assertRaises(ValueError): + trigger_paths(template % rows) + + +if __name__ == '__main__': + unittest.main()