From 6d49ed4e30ee277f8c2de419f23c27649de2dfd9 Mon Sep 17 00:00:00 2001 From: Dylan Roy <249851642+d6g8k5htny-coder@users.noreply.github.com> Date: Sun, 18 Oct 2026 16:51:51 -0500 Subject: [PATCH 1/5] fix(query): refuse conflicting repeated portable artifact keys --- src/universal_law_query/stub_verify.py | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/src/universal_law_query/stub_verify.py b/src/universal_law_query/stub_verify.py index 52afd1c..c3b0e53 100644 --- a/src/universal_law_query/stub_verify.py +++ b/src/universal_law_query/stub_verify.py @@ -24,11 +24,16 @@ def load_candidates(root: Path|None=None)->list[dict]: if data.get('scientific_status_authority') is not False: raise SystemExit('REFUSED: candidate bundle must deny scientific authority: '+bundle_path.name) if bundle_path.name=='CANDIDATE_DOWNSTREAM_GATE_STUBS.json': _validate_downstream_snapshot(data) rows.extend(data['artifacts']) - seen=set();out=[] + seen={};out=[] for row in rows: key=row['key'] - if key in seen: continue - seen.add(key);out.append(row) + if key in seen: + # The single-file stub is intentionally repeated in one public bundle. + # Only exact duplicates may be collapsed: conflicting descriptors + # must not evade the later fetch, digest and byte-count checks. + if row!=seen[key]: raise SystemExit('REFUSED: conflicting candidate key: '+str(key)) + continue + seen[key]=row;out.append(row) return out def validate_row(row:dict)->None: From c47c7e243a47ce3c78bd4df8c19321519a7c43c7 Mon Sep 17 00:00:00 2001 From: Dylan Roy <249851642+d6g8k5htny-coder@users.noreply.github.com> Date: Sun, 18 Oct 2026 16:51:53 -0500 Subject: [PATCH 2/5] test(query): preserve identical duplicates and reject conflicting stubs --- tests/test_stub_verify_snapshot.py | 48 ++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) diff --git a/tests/test_stub_verify_snapshot.py b/tests/test_stub_verify_snapshot.py index a90ed20..29116ce 100644 --- a/tests/test_stub_verify_snapshot.py +++ b/tests/test_stub_verify_snapshot.py @@ -150,6 +150,54 @@ def test_duplicate_key_does_not_hide_inconsistent_snapshot(self): with self.assertRaisesRegex(SystemExit, 'REFUSED:.*math_tip'): verifier.load_candidates(self.root) + def test_identical_candidate_duplicates_keep_first_row(self): + original = row('shared') + self.write_bundle( + {'scientific_status_authority': False, + 'artifacts': [original, dict(original)]}, + 'CANDIDATE_PUBLIC_REPLAY_STUBS.json') + self.assertEqual(verifier.load_candidates(self.root), [original]) + + def test_conflicting_candidate_duplicates_in_one_bundle_are_refused(self): + original = row('duplicate') + # Each record is individually well-formed; the conflict must not be + # ignored simply because a valid first occurrence has already been seen. + changes = ( + ('commit', OLDER), ('sha256', '0' * 64), + ('bytes', len(PAYLOAD) + 1), + ('path', 'frontiers/example/another.md'), + ('visibility', 'private')) + for field, value in changes: + with self.subTest(field=field): + conflicting = dict(original) + conflicting[field] = value + self.write_bundle( + {'scientific_status_authority': False, + 'artifacts': [original, conflicting]}, + 'CANDIDATE_PUBLIC_REPLAY_STUBS.json') + with self.assertRaisesRegex( + SystemExit, 'REFUSED: conflicting candidate key: duplicate'): + verifier.load_candidates(self.root) + + def test_conflicting_single_and_bundle_duplicate_refused_before_fetch(self): + original = row('shared') + (self.portable / 'RN_FIXED_REMOTE_REPLAY_STUB.json').write_text( + json.dumps(original), encoding='utf-8') + conflicting = dict(original) + conflicting['sha256'] = '0' * 64 + self.write_bundle( + {'scientific_status_authority': False, + 'artifacts': [conflicting]}, + 'CANDIDATE_PUBLIC_REPLAY_STUBS.json') + fetch = mock.Mock() + with mock.patch.dict(os.environ, {'QUERY_STUB_VERIFY': '1'}), \ + self.assertRaisesRegex( + SystemExit, 'REFUSED: conflicting candidate key: shared'): + verifier.main( + [], load_candidates_fn=lambda: verifier.load_candidates(self.root), + fetch_fn=fetch) + fetch.assert_not_called() + def test_current_checkout_retains_ten_unique_candidate_keys(self): keys = [item['key'] for item in verifier.load_candidates(ROOT)] self.assertEqual(len(keys), 10) From 6d4aed12671ff9e85a1f936daf4a86e55290037b Mon Sep 17 00:00:00 2001 From: Dylan Roy <249851642+d6g8k5htny-coder@users.noreply.github.com> Date: Sun, 18 Oct 2026 16:58:17 -0500 Subject: [PATCH 3/5] fix(query): compare duplicate source contract excluding commentary notes --- src/universal_law_query/stub_verify.py | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/src/universal_law_query/stub_verify.py b/src/universal_law_query/stub_verify.py index c3b0e53..40d16ba 100644 --- a/src/universal_law_query/stub_verify.py +++ b/src/universal_law_query/stub_verify.py @@ -24,14 +24,19 @@ def load_candidates(root: Path|None=None)->list[dict]: if data.get('scientific_status_authority') is not False: raise SystemExit('REFUSED: candidate bundle must deny scientific authority: '+bundle_path.name) if bundle_path.name=='CANDIDATE_DOWNSTREAM_GATE_STUBS.json': _validate_downstream_snapshot(data) rows.extend(data['artifacts']) + # The standalone RN stub is also present in a public bundle with a + # different commentary note. Notes are not consumed by the verifier. + # Every other field, including unknown future fields, must agree. + def verifying_fields(item): + return {name:value for name,value in item.items() if name!='note'} seen={};out=[] for row in rows: key=row['key'] if key in seen: - # The single-file stub is intentionally repeated in one public bundle. - # Only exact duplicates may be collapsed: conflicting descriptors - # must not evade the later fetch, digest and byte-count checks. - if row!=seen[key]: raise SystemExit('REFUSED: conflicting candidate key: '+str(key)) + # Refuse conflicting identities, access or scopes before any fetch; + # preserve the first source annotation for note-only repeats. + if verifying_fields(row)!=verifying_fields(seen[key]): + raise SystemExit('REFUSED: conflicting candidate key: '+str(key)) continue seen[key]=row;out.append(row) return out From 37e6beac80ae879ea179aa884057f039eb1b4970 Mon Sep 17 00:00:00 2001 From: Dylan Roy <249851642+d6g8k5htny-coder@users.noreply.github.com> Date: Sun, 18 Oct 2026 16:58:19 -0500 Subject: [PATCH 4/5] test(query): retain historical note-only repetition; reject scope and unknown conflicts --- tests/test_stub_verify_snapshot.py | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/tests/test_stub_verify_snapshot.py b/tests/test_stub_verify_snapshot.py index 29116ce..cdc77ad 100644 --- a/tests/test_stub_verify_snapshot.py +++ b/tests/test_stub_verify_snapshot.py @@ -158,15 +158,30 @@ def test_identical_candidate_duplicates_keep_first_row(self): 'CANDIDATE_PUBLIC_REPLAY_STUBS.json') self.assertEqual(verifier.load_candidates(self.root), [original]) + def test_note_only_duplicate_is_not_identity_conflict(self): + original = row('shared') + original['note'] = 'Historical standalone commentary; candidate only.' + second = dict(original) + second['note'] = 'Bundle commentary; candidate only.' + self.write_bundle( + {'scientific_status_authority': False, + 'artifacts': [original, second]}, + 'CANDIDATE_PUBLIC_REPLAY_STUBS.json') + # The first annotation is kept; neither annotation is an acceptance. + self.assertEqual(verifier.load_candidates(self.root), [original]) + def test_conflicting_candidate_duplicates_in_one_bundle_are_refused(self): original = row('duplicate') + original['scope'] = 'same declared scope' # Each record is individually well-formed; the conflict must not be # ignored simply because a valid first occurrence has already been seen. changes = ( ('commit', OLDER), ('sha256', '0' * 64), ('bytes', len(PAYLOAD) + 1), ('path', 'frontiers/example/another.md'), - ('visibility', 'private')) + ('visibility', 'private'), + ('scope', 'conflicting scope'), + ('unlisted_future_field', 'unexpected distinct value')) for field, value in changes: with self.subTest(field=field): conflicting = dict(original) From 5d6b7c2164de3de00044949b661d84d5d9dabdb5 Mon Sep 17 00:00:00 2001 From: Dylan Roy <249851642+d6g8k5htny-coder@users.noreply.github.com> Date: Sun, 18 Oct 2026 17:32:07 -0500 Subject: [PATCH 5/5] fix(query): compare duplicate JSON values with exact types --- src/universal_law_query/stub_verify.py | 13 +++++++- tests/test_stub_verify_snapshot.py | 42 ++++++++++++++++++++++++++ 2 files changed, 54 insertions(+), 1 deletion(-) diff --git a/src/universal_law_query/stub_verify.py b/src/universal_law_query/stub_verify.py index 40d16ba..be39e83 100644 --- a/src/universal_law_query/stub_verify.py +++ b/src/universal_law_query/stub_verify.py @@ -29,13 +29,24 @@ def load_candidates(root: Path|None=None)->list[dict]: # Every other field, including unknown future fields, must agree. def verifying_fields(item): return {name:value for name,value in item.items() if name!='note'} + def same_json_value(left, right): + # JSON booleans and numbers are distinct even though Python says + # True == 1 == 1.0. Compare types recursively, including future keys. + if type(left) is not type(right): return False + if isinstance(left, dict): + return left.keys()==right.keys() and all( + same_json_value(left[key],right[key]) for key in left) + if isinstance(left, list): + return len(left)==len(right) and all( + same_json_value(a,b) for a,b in zip(left,right)) + return left==right seen={};out=[] for row in rows: key=row['key'] if key in seen: # Refuse conflicting identities, access or scopes before any fetch; # preserve the first source annotation for note-only repeats. - if verifying_fields(row)!=verifying_fields(seen[key]): + if not same_json_value(verifying_fields(row),verifying_fields(seen[key])): raise SystemExit('REFUSED: conflicting candidate key: '+str(key)) continue seen[key]=row;out.append(row) diff --git a/tests/test_stub_verify_snapshot.py b/tests/test_stub_verify_snapshot.py index cdc77ad..715e375 100644 --- a/tests/test_stub_verify_snapshot.py +++ b/tests/test_stub_verify_snapshot.py @@ -213,6 +213,48 @@ def test_conflicting_single_and_bundle_duplicate_refused_before_fetch(self): fetch_fn=fetch) fetch.assert_not_called() + def test_duplicate_json_type_collisions_refused_before_fetch(self): + # JSON distinguishes true, 1 and 1.0; Python dict equality does not. + # Unknown nested future fields are identity-bearing, except 'note'. + changes = ( + ('integer_vs_boolean', 1, True), + ('integer_vs_float', 1, 1.0), + ('nested_integer_vs_boolean', + {'items': [{'ordinal': 1}]}, + {'items': [{'ordinal': True}]}), + ) + for name, left, right in changes: + with self.subTest(name=name): + original = row('typed') + original['unlisted_future_field'] = left + conflicting = dict(original) + conflicting['unlisted_future_field'] = right + self.write_bundle( + {'scientific_status_authority': False, + 'artifacts': [original, conflicting]}, + 'CANDIDATE_PUBLIC_REPLAY_STUBS.json') + fetch = mock.Mock() + with mock.patch.dict(os.environ, {'QUERY_STUB_VERIFY': '1'}), \ + self.assertRaisesRegex( + SystemExit, 'REFUSED: conflicting candidate key: typed'): + verifier.main( + [], load_candidates_fn=lambda: verifier.load_candidates(self.root), + fetch_fn=fetch) + fetch.assert_not_called() + + def test_duplicate_bool_byte_count_does_not_equal_integer(self): + original = row('typed-size') + original['bytes'] = 1 + conflicting = dict(original) + conflicting['bytes'] = True + self.write_bundle( + {'scientific_status_authority': False, + 'artifacts': [original, conflicting]}, + 'CANDIDATE_PUBLIC_REPLAY_STUBS.json') + with self.assertRaisesRegex( + SystemExit, 'REFUSED: conflicting candidate key: typed-size'): + verifier.load_candidates(self.root) + def test_current_checkout_retains_ten_unique_candidate_keys(self): keys = [item['key'] for item in verifier.load_candidates(ROOT)] self.assertEqual(len(keys), 10)