test(#832): define receipt challenge replay contracts

packages/mosaic/package.json

@@ -25,7 +25,7 @@
     "lint": "eslint src",
     "typecheck": "tsc --noEmit",
     "test": "vitest run --passWithNoTests && pnpm run test:framework-shell",
-    "test:framework-shell": "python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh"
+    "test:framework-shell": "python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh"
   },
   "dependencies": {
     "@mosaicstack/brain": "workspace:*",

packages/mosaic/src/lease-broker/receipt_challenge_unittest.py

@@ -0,0 +1,131 @@
+#!/usr/bin/env python3
+"""RED-first T26/T29 contract tests for the shipped receipt-challenge path."""
+
+from __future__ import annotations
+
+import importlib.util
+import os
+import tempfile
+import unittest
+from pathlib import Path
+
+
+TOOLS = Path(__file__).parents[2] / "framework/tools/lease-broker"
+DAEMON_PATH = TOOLS / "daemon.py"
+FRAGMENTS_PATH = TOOLS / "normative_fragments.py"
+RECEIPT_PATH = TOOLS / "receipt_challenge.py"
+
+
+def load_module(name: str, path: Path):
+    assert path.is_file(), f"shipped module is missing: {path}"
+    spec = importlib.util.spec_from_file_location(name, path)
+    if spec is None or spec.loader is None:
+        raise RuntimeError(f"unable to load {name}")
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+DAEMON = load_module("lease_broker_receipt_daemon", DAEMON_PATH)
+FRAGMENTS = load_module("lease_broker_normative_fragments", FRAGMENTS_PATH)
+RECEIPTS = load_module("lease_broker_receipt_challenge", RECEIPT_PATH)
+
+
+class ReceiptChallengeTest(unittest.TestCase):
+    def setUp(self) -> None:
+        self.temporary = tempfile.TemporaryDirectory()
+        root = Path(self.temporary.name)
+        os.chmod(root, 0o700)
+        self.broker = DAEMON.Broker(DAEMON.StateStore(root / "state.json"))
+        self.peer = (os.getpid(), os.getuid(), os.getgid())
+        registered = self.broker.handle(self.peer, {
+            "action": "register_anchor",
+            "runtime_generation": 7,
+        })
+        self.session_id = registered["session_id"]
+        self.assertIsInstance(self.session_id, str)
+
+    def tearDown(self) -> None:
+        self.temporary.cleanup()
+
+    def binding(self, compaction_epoch: int, request_epoch: int) -> dict[str, object]:
+        construction = FRAGMENTS.build_payload(
+            manifest_version=1,
+            generator_version="wi5-receipt-test",
+            fragments=[
+                FRAGMENTS.NormativeFragment(
+                    "authority/constitution",
+                    b"Constitution\n",
+                    "b1f7989bf4a3feee87aaf841d3c94385337f12cdbf356e0db33f68edfe535f16",
+                ),
+            ],
+        )
+        self.assertEqual(construction.injectionDecision, "ACCEPTED")
+        self.assertTrue(construction.promotion)
+        return {
+            "compaction_epoch": compaction_epoch,
+            "request_epoch": request_epoch,
+            "h_source": construction.h_source,
+            "h_payload": construction.h_payload,
+            "schema_version": 1,
+        }
+
+    def begin(self, binding: dict[str, object]) -> dict[str, object]:
+        response = self.broker.handle(self.peer, {
+            "action": "begin_verification",
+            "session_id": self.session_id,
+            "runtime_generation": 7,
+            "runtime": "pi",
+            "binding": binding,
+        })
+        self.assertEqual(response["state"], DAEMON.LEASE_PENDING)
+        self.assertIsInstance(response.get("receipt_challenge"), str)
+        self.assertIsInstance(response.get("receipt"), str)
+        return response
+
+    def observe(self, challenge: str, message: str) -> dict[str, object]:
+        return self.broker.handle(self.peer, {
+            "action": "observe_receipt",
+            "session_id": self.session_id,
+            "runtime_generation": 7,
+            "receipt_challenge": challenge,
+            "latest_assistant_message": message,
+        })
+
+    def test_t26_stale_epoch_receipt_cannot_promote_against_shipped_binding(self) -> None:
+        stale = self.begin(self.binding(compaction_epoch=3, request_epoch=8))
+        current = self.begin(self.binding(compaction_epoch=4, request_epoch=9))
+        self.assertNotEqual(stale["receipt_challenge"], current["receipt_challenge"])
+
+        with self.assertRaisesRegex(DAEMON.BrokerFailure, "RECEIPT_MISMATCH"):
+            self.observe(current["receipt_challenge"], stale["receipt"])
+        with self.assertRaisesRegex(DAEMON.BrokerFailure, "INVALID_LEASE_TRANSITION"):
+            self.broker.handle(self.peer, {
+                "action": "promote_lease",
+                "session_id": self.session_id,
+                "runtime_generation": 7,
+                "receipt_challenge": current["receipt_challenge"],
+            })
+
+    def test_t29_altered_model_hash_cannot_promote_against_shipped_binding(self) -> None:
+        cycle = self.begin(self.binding(compaction_epoch=5, request_epoch=10))
+        expected = cycle["receipt"]
+        self.assertIsInstance(expected, str)
+        altered_hash = "f" * 64
+        self.assertNotEqual(altered_hash, cycle["binding"]["h_payload"])
+        altered = expected.replace(cycle["binding"]["h_payload"], altered_hash, 1)
+        self.assertNotEqual(altered, expected)
+
+        with self.assertRaisesRegex(DAEMON.BrokerFailure, "RECEIPT_MISMATCH"):
+            self.observe(cycle["receipt_challenge"], altered)
+        with self.assertRaisesRegex(DAEMON.BrokerFailure, "INVALID_LEASE_TRANSITION"):
+            self.broker.handle(self.peer, {
+                "action": "promote_lease",
+                "session_id": self.session_id,
+                "runtime_generation": 7,
+                "receipt_challenge": cycle["receipt_challenge"],
+            })
+
+
+if __name__ == "__main__":
+    unittest.main()