Dashboard › institutional-transition-lab › Session 0XMMMMwP9ARO
0XMMMMwP9ARO8qn7vPerform a fresh read-only security audit of only the JSON/pin/immutable-snapshot half of issue #4 input verification in /home/byk/Code/institutional-transition-lab. This replaces a reviewer that returned empty twice. Never edit files and never inspect governance record bodies, coding decisions, outcomes, reports, dates, detector output, or source-adjudication scopes.
Scope only:
Do not review regular-file/FIFO/symlink/resource-limit or ZIP/archive mechanics; another reviewer owns those. Primary files are src/institution_lab/governance_adjudication.py and only relevant tests in tests/test_governance_adjudication.py. Review current working copy read-only.
Return substantive evidence, never empty. Findings first, severity ordered, with exact current file:line references and PASS/CONCERN/MUST-FIX/BLOCKED labels. Every defect needs a deterministic regression. If no defects, state PASS and identify tests/probes plus residual risks. End exactly MERGE or DO-NOT-MERGE.
<path>/home/byk/Code/institutional-transition-lab</path> <type>directory</type> <entries> .git/ .github/ .gitignore .lore.md .pytest_cache/ .ruff_cache/ .venv/ AGENTS.md cases/ data/ docs/ node_modules/ package-lock.json package.json PROTOCOL.md pyproject.toml README.md research/ schema/ scripts/ src/ tests/ uv.lock (23 entries) </entries>
Found 100 matches (more matches available)
/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py:
Line 17: from jsonschema import Draft202012Validator, FormatChecker
Line 33: "artifact_sha256",
Line 34: "documents_sha256",
Line 35: "documents_file_sha256",
Line 36: "coding_package_file_sha256",
Line 37: "protocol_sha256",
Line 38: "coding_schema_sha256",
Line 39: "adjudication_schema_sha256",
Line 41: FROZEN_INPUT_PINS = {
Line 44: "artifact_sha256": "1f6be91fcd98e43e99d82d5f274536f6c23616e7e6c711e26324a2cc4b06ef06",
Line 45: "documents_sha256": "d70f7f795847968339a645b6dbd6d4428af6bd6044de44fa2602d4c4343b0ee9",
Line 46: "documents_file_sha256": "2a62ab05687982c112a29f6126227c26c3ff8defc89ca64662753aaf85c3c0ce",
Line 47: "coding_package_file_sha256": (
Line 50: "protocol_sha256": "06d4b3407677fe7fb23046f70164a366db06638e8a29af3daf7661f00d565933",
Line 51: "coding_schema_sha256": ...
Found 100 matches (more matches available)
/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py:
Line 16: FROZEN_INPUT_PINS,
Line 20: canonical_sha256,
Line 24: validate_against_schema,
Line 25: verify_input_manifest,
Line 40: def _write_pinned_cli_inputs(
Line 43: ) -> tuple[dict[str, object], dict[str, Path]]:
Line 46: adjudication_schema_value = {"type": "object"}
Line 49: "input_manifest": tmp_path / "inputs.json",
Line 54: "coding_schema": tmp_path / "coding-schema.json",
Line 55: "adjudication_schema": tmp_path / "adjudication-schema.json",
Line 63: paths["coding_schema"].write_text("{}")
Line 64: paths["adjudication_schema"].write_text(json.dumps(adjudication_schema_value))
Line 71: manifest = {
Line 75: "documents_sha256": canonical_sha256(documents_value),
Line 79: "coding_schema_sha256": file_sha256(paths["coding_schema"]),
Line 80: "adjudication_schema_sha256": ...
Found 15 matches /home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py: Line 3: import argparse Line 129: def _parse_json_object(payload: bytes, label: str) -> dict[str, Any]: Line 131: value = json.loads( Line 209: documents_value = _parse_json_object(documents, "documents") Line 215: coding_package=_parse_json_object(coding_package, "coding package"), Line 216: adjudication_schema=_parse_json_object(adjudication_schema, "adjudication schema"), Line 220: def verify_input_manifest( Line 882: def main() -> None: Line 883: parser = argparse.ArgumentParser(description="Validate frozen governance adjudication") Line 897: args.input_manifest, Line 908: adjudication = _parse_json_object( Line 912: input_manifest = _parse_json_object( Line 913: _read_regular_file(args.input_manifest), Line 917: input_manifest, Line 946: main()
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
1: from __future__ import annotations
2:
3: import argparse
4: import hashlib
5: import io
6: import json
7: import os
8: import stat
9: import tempfile
10: import zipfile
11: from collections import Counter
12: from contextlib import suppress
13: from dataclasses import dataclass
14: from pathlib import Path
15: from typing import Any
16:
17: from jsonschema import Draft202012Validator, FormatChecker
18:
19: from institution_lab.governance_coding import validate_response
20:
21: DECISIONS = {"accept", "revise", "reject", "abstain"}
22: INSTITUTIONAL_CLASSES = {
23: "effective_institutional_change",
24: "announced_institutional_change",
25: "proposal_only",
26: }
27: REVIEWER_TYPES = {"human", "llm", "human_llm_assisted"}
28: REVIEWER_ROLES = {"source_adjudicator", "evidence_auditor", "synthesizer"}
29: RESPONSE_SOURCES = {"luna_a", "luna_b", ...
<path>/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py</path>
<type>file</type>
<content>
620: assert any("reviewer_ids must be unique" in error for error in errors)
621: assert summary["canonicalization_gate"] == "closed"
622:
623:
624: def test_malformed_reviewer_id_does_not_crash_manual_validation() -> None:
625: adjudication = _adjudication()
626: adjudication["records"][0]["reviewer_ids"] = [{"invalid": "reviewer"}]
627:
628: errors, summary = _validate(adjudication)
629:
630: assert any("reviewer_ids must contain non-empty strings" in error for error in errors)
631: assert summary["canonicalization_gate"] == "closed"
632:
633:
634: def test_every_input_pin_is_reverified() -> None:
635: adjudication = _adjudication()
636: adjudication["inputs"]["artifact_sha256"] = "wrong"
637:
638: errors, summary = _validate(adjudication)
639:
640: assert "input pin mismatch: artifact_sha256" in errors
641: assert ...
<path>/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py</path>
<type>file</type>
<content>
848: def test_cli_rejects_duplicate_manifest_keys(
849: tmp_path: Path,
850: monkeypatch: pytest.MonkeyPatch,
851: ) -> None:
852: manifest, paths = _write_pinned_cli_inputs(tmp_path, monkeypatch)
853: _stub_cli_validation(monkeypatch)
854: manifest_text = json.dumps(manifest)
855: paths["input_manifest"].write_text(
856: manifest_text.replace(
857: '"artifact_sha256":',
858: '"artifact_sha256": "forged", "artifact_sha256":',
859: 1,
860: )
861: )
862: paths["summary_json"].write_text('{"canonicalization_gate":"open"}\n')
863:
864: with pytest.raises(ValueError, match="duplicate JSON key: artifact_sha256"):
865: _run_cli(monkeypatch, paths)
866:
867: assert json.loads(paths["summary_json"].read_text())["canonicalization_gate"] == "closed"
868:
869:
870: def test_input_manifest_rejects_non_object() -> None:
871: with ...
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
840: if _paths_alias(outputs[0], outputs[1]):
841: raise ValueError("output paths alias each other")
842:
843:
844: def _atomic_write(path: Path, payload: str) -> None:
845: path.parent.mkdir(parents=True, exist_ok=True)
846: descriptor, temporary_name = tempfile.mkstemp(prefix=f".{path.name}.", dir=path.parent)
847: try:
848: with os.fdopen(descriptor, "w") as destination:
849: destination.write(payload)
850: destination.flush()
851: os.fsync(destination.fileno())
852: os.replace(temporary_name, path)
853: except BaseException:
854: with suppress(FileNotFoundError):
855: os.unlink(temporary_name)
856: raise
857:
858:
859: def _write_failure_reports(summary_json: Path, summary_markdown: Path, error: Exception) -> None:
860: message = str(error)
861: summary = {
862: "schema_version": 1,
863: "canonicalization_gate": ...
Found 26 matches
/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py:
Line 120: def test_adjudication_schema_matches_validator_ontology() -> None:
Line 138: @pytest.mark.parametrize(
Line 142: def test_schema_enforces_uri_and_date_formats(field: str, value: str) -> None:
Line 312: def test_one_abstention_keeps_canonicalization_gate_closed() -> None:
Line 331: @pytest.mark.parametrize("mutation", ["duplicate", "missing"])
Line 374: @pytest.mark.parametrize(
Line 382: def test_source_audit_must_match_complete_frozen_document(field: str, value: object) -> None:
Line 392: @pytest.mark.parametrize(
Line 531: @pytest.mark.parametrize(
Line 634: def test_every_input_pin_is_reverified() -> None:
Line 644: def test_frozen_pins_include_the_versioned_adjudication_schema() -> None:
Line 651: @pytest.mark.parametrize("field", sorted(FROZEN_INPUT_PINS))
Line 652: def test_input_manifest_rejects_self_consistent_substitute(field: ...
<path>/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py</path> <type>file</type> <content> 1: from __future__ import annotations 2: 3: import copy 4: import json 5: import os 6: import subprocess 7: import sys 8: import zipfile 9: from pathlib import Path 10: 11: import pytest 12: 13: from institution_lab import governance_adjudication 14: from institution_lab.governance_adjudication import ( 15: DECISIONS, 16: FROZEN_INPUT_PINS, 17: REQUIRED_INPUT_PINS, 18: REVIEWER_ROLES, 19: REVIEWER_TYPES, 20: canonical_sha256, 21: file_sha256, 22: validate_adjudication, 23: validate_adjudication_fragment, 24: validate_against_schema, 25: verify_input_manifest, 26: ) 27: from institution_lab.governance_coding import ( 28: BODY_PATCH_RELATIONS, 29: CHANGE_STATUSES, 30: DIRECTIONS, 31: EVENT_KINDS, 32: RECORD_CLASSES, 33: RIGHT_KINDS, 34: ) 35: 36: ROOT = Path(__file__).parents[1] 37: MAX_TEST_ARCHIVE_MEMBERS = 256 38: 39: 40: def ...
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
500: errors.append(f"{prefix}: invalid graph edge revision basis")
501: if decision == "accept" and basis != accepted_from:
502: errors.append(f"{prefix}: accept revision basis must equal accepted_from")
503: baseline = _response_for(coding_record, basis) if isinstance(basis, str) else None
504: expected = graph_edge_diff(baseline, final_coding)
505: if revision.get("added") != expected["added"]:
506: errors.append(f"{prefix}: graph_edge_revision.added is not derived")
507: if revision.get("removed") != expected["removed"]:
508: errors.append(f"{prefix}: graph_edge_revision.removed is not derived")
509: return errors
510:
511:
512: def validate_adjudication(
513: adjudication: dict[str, Any],
514: documents: dict[str, Any],
515: coding_package: dict[str, Any],
516: *,
517: verified_pins: dict[str, str],
518: ) -> ...
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
270: if not isinstance(reference, dict):
271: return [f"{path} must be an object"]
272: required = {"source_id", "quote", "field"} if claim else {"source_id", "quote"}
273: if set(reference) != required:
274: return [f"{path} must contain exactly {sorted(required)}"]
275: if claim and reference.get("field") not in CLAIM_FIELDS:
276: return [f"{path}.field is invalid"]
277: source_id = reference.get("source_id")
278: quote = reference.get("quote")
279: if not isinstance(source_id, str) or not source_id:
280: return [f"{path}.source_id must be a non-empty string"]
281: if source_id not in sources:
282: return [f"{path}.source_id is not present in the frozen document: {source_id}"]
283: if not isinstance(quote, str) or not quote:
284: return [f"{path}.quote must be a non-empty string"]
285: if quote not in sources[source_id]:
286: ...
Found 1 matches /home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py: Line 770: def validate_against_schema(adjudication: dict[str, Any], schema: dict[str, Any]) -> list[str]:
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
750: if record_id not in documents_by_id or record_id not in coding_by_id:
751: continue
752: listed_reviewers = record.get("reviewer_ids")
753: if not isinstance(listed_reviewers, list) or not any(
754: isinstance(reviewer_id, str)
755: and reviewer_roles.get(reviewer_id) == "source_adjudicator"
756: for reviewer_id in listed_reviewers
757: ):
758: errors.append(f"record {record_id}: requires a source_adjudicator")
759: errors.extend(
760: _validate_record(
761: record,
762: documents_by_id[record_id],
763: coding_by_id[record_id],
764: reviewer_ids,
765: )
766: )
767: return errors
768:
769:
770: def validate_against_schema(adjudication: dict[str, Any], schema: dict[str, Any]) -> list[str]:
771: validator = Draft202012Validator(schema, format_checker=FormatChecker())
772: return [
773: f"schema ...
Found 8 matches /home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py: Line 661: verify_input_manifest( Line 726: verify_input_manifest(manifest, **paths) Line 773: verify_input_manifest(manifest, **paths) Line 872: verify_input_manifest( Line 897: verify_input_manifest( Line 920: verify_input_manifest( Line 966: verified = verify_input_manifest( /home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py: Line 220: def verify_input_manifest(
?? src/institution_lab/governance_adjudication.py ?? tests/test_governance_adjudication.py
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
1: from __future__ import annotations
2:
3: import argparse
4: import hashlib
5: import io
6: import json
7: import os
8: import stat
9: import tempfile
10: import zipfile
11: from collections import Counter
12: from contextlib import suppress
13: from dataclasses import dataclass
14: from pathlib import Path
15: from typing import Any
16:
17: from jsonschema import Draft202012Validator, FormatChecker
18:
19: from institution_lab.governance_coding import validate_response
20:
21: DECISIONS = {"accept", "revise", "reject", "abstain"}
22: INSTITUTIONAL_CLASSES = {
23: "effective_institutional_change",
24: "announced_institutional_change",
25: "proposal_only",
26: }
27: REVIEWER_TYPES = {"human", "llm", "human_llm_assisted"}
28: REVIEWER_ROLES = {"source_adjudicator", "evidence_auditor", "synthesizer"}
29: RESPONSE_SOURCES = {"luna_a", "luna_b", ...
<path>/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py</path> <type>file</type> <content> 1: from __future__ import annotations 2: 3: import copy 4: import json 5: import os 6: import subprocess 7: import sys 8: import zipfile 9: from pathlib import Path 10: 11: import pytest 12: 13: from institution_lab import governance_adjudication 14: from institution_lab.governance_adjudication import ( 15: DECISIONS, 16: FROZEN_INPUT_PINS, 17: REQUIRED_INPUT_PINS, 18: REVIEWER_ROLES, 19: REVIEWER_TYPES, 20: canonical_sha256, 21: file_sha256, 22: validate_adjudication, 23: validate_adjudication_fragment, 24: validate_against_schema, 25: verify_input_manifest, 26: ) 27: from institution_lab.governance_coding import ( 28: BODY_PATCH_RELATIONS, 29: CHANGE_STATUSES, 30: DIRECTIONS, 31: EVENT_KINDS, 32: RECORD_CLASSES, 33: RIGHT_KINDS, 34: ) 35: 36: ROOT = Path(__file__).parents[1] 37: MAX_TEST_ARCHIVE_MEMBERS = 256 38: 39: 40: def ...
<path>/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py</path>
<type>file</type>
<content>
630: assert any("reviewer_ids must contain non-empty strings" in error for error in errors)
631: assert summary["canonicalization_gate"] == "closed"
632:
633:
634: def test_every_input_pin_is_reverified() -> None:
635: adjudication = _adjudication()
636: adjudication["inputs"]["artifact_sha256"] = "wrong"
637:
638: errors, summary = _validate(adjudication)
639:
640: assert "input pin mismatch: artifact_sha256" in errors
641: assert summary["canonicalization_gate"] == "closed"
642:
643:
644: def test_frozen_pins_include_the_versioned_adjudication_schema() -> None:
645: assert set(FROZEN_INPUT_PINS) == REQUIRED_INPUT_PINS
646: assert FROZEN_INPUT_PINS["adjudication_schema_sha256"] == (
647: "6181f5cb60a0462f83be00be301763daa89f11581e68ee1c46a84e8bf4e5be31"
648: )
649:
650:
651: @pytest.mark.parametrize("field", sorted(FROZEN_INPUT_PINS))
652: def ...
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
840: if _paths_alias(outputs[0], outputs[1]):
841: raise ValueError("output paths alias each other")
842:
843:
844: def _atomic_write(path: Path, payload: str) -> None:
845: path.parent.mkdir(parents=True, exist_ok=True)
846: descriptor, temporary_name = tempfile.mkstemp(prefix=f".{path.name}.", dir=path.parent)
847: try:
848: with os.fdopen(descriptor, "w") as destination:
849: destination.write(payload)
850: destination.flush()
851: os.fsync(destination.fileno())
852: os.replace(temporary_name, path)
853: except BaseException:
854: with suppress(FileNotFoundError):
855: os.unlink(temporary_name)
856: raise
857:
858:
859: def _write_failure_reports(summary_json: Path, summary_markdown: Path, error: Exception) -> None:
860: message = str(error)
861: summary = {
862: "schema_version": 1,
863: "canonicalization_gate": ...
Your prior result was empty. Complete the same read-only JSON/pin/immutable-snapshot security audit now and return substantive evidence or an explicit blocker. Never edit files. Scope remains only: strict JSON parsing for manifest/documents/coding package/adjudication schema; duplicate keys, non-finite values, top-level object/type handling; exact FROZEN_INPUT_PINS identity and pin-first rejection ordering; one-read byte snapshots proving hashed bytes equal parsed/validated bytes; canonical documents hash relation; and narrowly corresponding tests/probes in src/institution_lab/governance_adjudication.py and tests/test_governance_adjudication.py. Do not review filesystem/FIFO/symlink/resource-limit or ZIP mechanics, CLI output writing, governance bodies/codings/outcomes/reports/dates, or source-adjudication scopes. Review the unchanged current working copy. Findings first with exact current file:line evidence and PASS/CONCERN/MUST-FIX/BLOCKED labels; include a deterministic regression for each defect and commands/probes run. Never return empty. End exactly MERGE or DO-NOT-MERGE.
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
500: errors.append(f"{prefix}: invalid graph edge revision basis")
501: if decision == "accept" and basis != accepted_from:
502: errors.append(f"{prefix}: accept revision basis must equal accepted_from")
503: baseline = _response_for(coding_record, basis) if isinstance(basis, str) else None
504: expected = graph_edge_diff(baseline, final_coding)
505: if revision.get("added") != expected["added"]:
506: errors.append(f"{prefix}: graph_edge_revision.added is not derived")
507: if revision.get("removed") != expected["removed"]:
508: errors.append(f"{prefix}: graph_edge_revision.removed is not derived")
509: return errors
510:
511:
512: def validate_adjudication(
513: adjudication: dict[str, Any],
514: documents: dict[str, Any],
515: coding_package: dict[str, Any],
516: *,
517: verified_pins: dict[str, str],
518: ) -> ...
c686c4878409e68b958dd61850a59e9234416d817fc2fa3246fc728d51ebe0a5 src/institution_lab/governance_adjudication.py abf64b5e78a616d53b703dee5291ce7bf23fa9156fe59263a702e01cb8667bc5 tests/test_governance_adjudication.py
/usr/bin/bash: line 1: pytest: command not found
....................... [100%] 23 passed, 55 deselected in 0.15s
manifest True documents True coding package True adjudication schema True NaN ValueError non-finite JSON number: NaN Infinity ValueError non-finite JSON number: Infinity -Infinity ValueError non-finite JSON number: -Infinity
input manifest / nested duplicate: REJECT (duplicate JSON key: key) input manifest / literal NaN: REJECT (non-finite JSON number: NaN) input manifest / top-level array: REJECT (input manifest must be an object) input manifest / exponent overflow: NON-FINITE ACCEPT documents / nested duplicate: REJECT (duplicate JSON key: key) documents / literal NaN: REJECT (non-finite JSON number: NaN) documents / top-level array: REJECT (documents must be an object) documents / exponent overflow: NON-FINITE ACCEPT coding package / nested duplicate: REJECT (duplicate JSON key: key) coding package / literal NaN: REJECT (non-finite JSON number: NaN) coding package / top-level array: REJECT (coding package must be an object) coding package / exponent overflow: NON-FINITE ACCEPT adjudication schema / nested duplicate: REJECT (duplicate JSON key: key) adjudication schema / literal NaN: REJECT (non-finite JSON number: NaN) adjudication schema / top-level array: REJECT (adjudication schema must be an ...
c686c4878409e68b958dd61850a59e9234416d817fc2fa3246fc728d51ebe0a5 src/institution_lab/governance_adjudication.py abf64b5e78a616d53b703dee5291ce7bf23fa9156fe59263a702e01cb8667bc5 tests/test_governance_adjudication.py
................. [100%] 17 passed in 0.12s
Found 40 matches
/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py:
Line 20: canonical_sha256,
Line 75: "documents_sha256": canonical_sha256(documents_value),
Line 111: lambda *_args, **_kwargs: ([], {"canonicalization_gate": "open"}),
Line 222: "summary": {"documents_sha256": "filled-by-test"},
Line 246: "documents_sha256": "0" * 64,
Line 290: "documents_sha256": "0" * 64,
Line 302: from institution_lab.governance_adjudication import canonical_sha256
Line 304: documents_hash = canonical_sha256(documents)
Line 305: package["summary"]["documents_sha256"] = documents_hash
Line 306: adjudication["inputs"]["documents_sha256"] = documents_hash
Line 308: pins["documents_sha256"] = documents_hash
Line 312: def test_one_abstention_keeps_canonicalization_gate_closed() -> None:
Line 328: assert summary["canonicalization_gate"] == "closed"
Line 342: assert summary["canonicalization_gate"] == "closed"
...
No files found
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
1: from __future__ import annotations
2:
3: import argparse
4: import hashlib
5: import io
6: import json
7: import os
8: import stat
9: import tempfile
10: import zipfile
11: from collections import Counter
12: from contextlib import suppress
13: from dataclasses import dataclass
14: from pathlib import Path
15: from typing import Any
16:
17: from jsonschema import Draft202012Validator, FormatChecker
18:
19: from institution_lab.governance_coding import validate_response
20:
21: DECISIONS = {"accept", "revise", "reject", "abstain"}
22: INSTITUTIONAL_CLASSES = {
23: "effective_institutional_change",
24: "announced_institutional_change",
25: "proposal_only",
26: }
27: REVIEWER_TYPES = {"human", "llm", "human_llm_assisted"}
28: REVIEWER_ROLES = {"source_adjudicator", "evidence_auditor", "synthesizer"}
29: RESPONSE_SOURCES = {"luna_a", "luna_b", ...
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
880:
881:
882: def main() -> None:
883: parser = argparse.ArgumentParser(description="Validate frozen governance adjudication")
884: parser.add_argument("--adjudication", type=Path, required=True)
885: parser.add_argument("--input-manifest", type=Path, required=True)
886: parser.add_argument("--documents", type=Path, required=True)
887: parser.add_argument("--coding-package", type=Path, required=True)
888: parser.add_argument("--artifact", type=Path, required=True)
889: parser.add_argument("--protocol", type=Path, required=True)
890: parser.add_argument("--coding-schema", type=Path, required=True)
891: parser.add_argument("--adjudication-schema", type=Path, required=True)
892: parser.add_argument("--summary-json", type=Path, required=True)
893: parser.add_argument("--summary-markdown", type=Path, required=True)
894: args = ...
<path>/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py</path>
<type>file</type>
<content>
630: assert any("reviewer_ids must contain non-empty strings" in error for error in errors)
631: assert summary["canonicalization_gate"] == "closed"
632:
633:
634: def test_every_input_pin_is_reverified() -> None:
635: adjudication = _adjudication()
636: adjudication["inputs"]["artifact_sha256"] = "wrong"
637:
638: errors, summary = _validate(adjudication)
639:
640: assert "input pin mismatch: artifact_sha256" in errors
641: assert summary["canonicalization_gate"] == "closed"
642:
643:
644: def test_frozen_pins_include_the_versioned_adjudication_schema() -> None:
645: assert set(FROZEN_INPUT_PINS) == REQUIRED_INPUT_PINS
646: assert FROZEN_INPUT_PINS["adjudication_schema_sha256"] == (
647: "6181f5cb60a0462f83be00be301763daa89f11581e68ee1c46a84e8bf4e5be31"
648: )
649:
650:
651: @pytest.mark.parametrize("field", sorted(FROZEN_INPUT_PINS))
652: def ...
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
500: errors.append(f"{prefix}: invalid graph edge revision basis")
501: if decision == "accept" and basis != accepted_from:
502: errors.append(f"{prefix}: accept revision basis must equal accepted_from")
503: baseline = _response_for(coding_record, basis) if isinstance(basis, str) else None
504: expected = graph_edge_diff(baseline, final_coding)
505: if revision.get("added") != expected["added"]:
506: errors.append(f"{prefix}: graph_edge_revision.added is not derived")
507: if revision.get("removed") != expected["removed"]:
508: errors.append(f"{prefix}: graph_edge_revision.removed is not derived")
509: return errors
510:
511:
512: def validate_adjudication(
513: adjudication: dict[str, Any],
514: documents: dict[str, Any],
515: coding_package: dict[str, Any],
516: *,
517: verified_pins: dict[str, str],
518: ) -> ...
<path>/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py</path> <type>file</type> <content> 1: from __future__ import annotations 2: 3: import copy 4: import json 5: import os 6: import subprocess 7: import sys 8: import zipfile 9: from pathlib import Path 10: 11: import pytest 12: 13: from institution_lab import governance_adjudication 14: from institution_lab.governance_adjudication import ( 15: DECISIONS, 16: FROZEN_INPUT_PINS, 17: REQUIRED_INPUT_PINS, 18: REVIEWER_ROLES, 19: REVIEWER_TYPES, 20: canonical_sha256, 21: file_sha256, 22: validate_adjudication, 23: validate_adjudication_fragment, 24: validate_against_schema, 25: verify_input_manifest, 26: ) 27: from institution_lab.governance_coding import ( 28: BODY_PATCH_RELATIONS, 29: CHANGE_STATUSES, 30: DIRECTIONS, 31: EVENT_KINDS, 32: RECORD_CLASSES, 33: RIGHT_KINDS, 34: ) 35: 36: ROOT = Path(__file__).parents[1] 37: MAX_TEST_ARCHIVE_MEMBERS = 256 38: 39: 40: def ...
<path>/home/byk/Code/institutional-transition-lab</path> <type>directory</type> <entries> .git/ .github/ .gitignore .lore.md .pytest_cache/ .ruff_cache/ .venv/ AGENTS.md cases/ data/ docs/ node_modules/ package-lock.json package.json PROTOCOL.md pyproject.toml README.md research/ schema/ scripts/ src/ tests/ uv.lock (23 entries) </entries>
M pyproject.toml M uv.lock ?? .lore.md ?? AGENTS.md ?? cases/review/oss-governance-adjudication-v1.inputs.json ?? cases/review/oss-governance-adjudication-v1/ ?? schema/governance-adjudication-v1.schema.json ?? src/institution_lab/governance_adjudication.py ?? tests/test_governance_adjudication.py
Found 15 matches
/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py:
Line 16: FROZEN_INPUT_PINS,
Line 83: monkeypatch.setattr(governance_adjudication, "FROZEN_INPUT_PINS", dict(manifest))
Line 645: assert set(FROZEN_INPUT_PINS) == REQUIRED_INPUT_PINS
Line 646: assert FROZEN_INPUT_PINS["adjudication_schema_sha256"] == (
Line 651: @pytest.mark.parametrize("field", sorted(FROZEN_INPUT_PINS))
Line 654: **FROZEN_INPUT_PINS,
Line 720: "institution_lab.governance_adjudication.FROZEN_INPUT_PINS",
Line 721: {k: manifest[k] for k in FROZEN_INPUT_PINS},
Line 760: "institution_lab.governance_adjudication.FROZEN_INPUT_PINS",
Line 761: {k: manifest[k] for k in FROZEN_INPUT_PINS},
Line 894: monkeypatch.setattr(governance_adjudication, "FROZEN_INPUT_PINS", dict(manifest))
Line 917: monkeypatch.setattr(governance_adjudication, "FROZEN_INPUT_PINS", dict(manifest))
Line 976: assert verified == ...
Found 14 matches /home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py: Line 332: def test_record_ids_must_match_frozen_documents_exactly_once(mutation: str) -> None: Line 382: def test_source_audit_must_match_complete_frozen_document(field: str, value: object) -> None: Line 634: def test_every_input_pin_is_reverified() -> None: Line 644: def test_frozen_pins_include_the_versioned_adjudication_schema() -> None: Line 652: def test_input_manifest_rejects_self_consistent_substitute(field: str) -> None: Line 683: def test_input_manifest_rejects_changed_file_bytes( Line 729: def test_input_manifest_rejects_files_not_from_pinned_artifact( Line 776: def test_cli_validates_the_same_bytes_it_verifies( Line 848: def test_cli_rejects_duplicate_manifest_keys( Line 870: def test_input_manifest_rejects_non_object() -> None: Line 883: def test_input_manifest_rejects_duplicate_artifact_members( Line 908: def ...
Found 1 matches /home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py: Line 770: def validate_against_schema(adjudication: dict[str, Any], schema: dict[str, Any]) -> list[str]:
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
760: _validate_record(
761: record,
762: documents_by_id[record_id],
763: coding_by_id[record_id],
764: reviewer_ids,
765: )
766: )
767: return errors
768:
769:
770: def validate_against_schema(adjudication: dict[str, Any], schema: dict[str, Any]) -> list[str]:
771: validator = Draft202012Validator(schema, format_checker=FormatChecker())
772: return [
773: f"schema {'.'.join(str(part) for part in error.absolute_path) or '<root>'}: "
774: f"{error.message}"
775: for error in sorted(validator.iter_errors(adjudication), key=lambda item: list(item.path))
776: ]
777:
778:
779: def render_markdown(adjudication: dict[str, Any], summary: dict[str, Any]) -> str:
780: lines = [
781: "# OSS governance adjudication v1",
782: "",
783: f"Canonicalization gate: **{summary['canonicalization_gate']}**",
784: "",
785: "## ...
......................... [100%] 25 passed, 53 deselected in 0.22s
c686c4878409e68b958dd61850a59e9234416d817fc2fa3246fc728d51ebe0a5 src/institution_lab/governance_adjudication.py abf64b5e78a616d53b703dee5291ce7bf23fa9156fe59263a702e01cb8667bc5 tests/test_governance_adjudication.py M pyproject.toml M uv.lock ?? .lore.md ?? AGENTS.md ?? cases/review/oss-governance-adjudication-v1.inputs.json ?? cases/review/oss-governance-adjudication-v1/ ?? schema/governance-adjudication-v1.schema.json ?? src/institution_lab/governance_adjudication.py ?? tests/test_governance_adjudication.py
adjudication-derived.json adjudication-records-final.json check-fragments-base-1558.ts check-fragments-base.ts check-fragments-head.ts check-fragments-patch.ts craft-configuration.md institutional-transition-adjudication-9642983578 itl-zip-audit-venv pytest-of-byk terraform-issues-19-21.json terraform-prs-27-28.json uv-b355373a86df036a.lock uv-cache
Traceback (most recent call last):
File "<stdin>", line 9, in <module>
File "<frozen importlib._bootstrap_external>", line 1023, in exec_module
File "<frozen importlib._bootstrap>", line 488, in _call_with_frames_removed
File "/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py", line 72, in <module>
@dataclass(frozen=True)
~~~~~~~~~^^^^^^^^^^^^^
File "/home/byk/.local/share/uv/python/cpython-3.13.11-linux-x86_64-gnu/lib/python3.13/dataclasses.py", line 1295, in wrap
return _process_class(cls, init, repr, eq, order, unsafe_hash,
frozen, match_args, kw_only, slots,
weakref_slot)
File "/home/byk/.local/share/uv/python/cpython-3.13.11-linux-x86_64-gnu/lib/python3.13/dataclasses.py", line 997, in _process_class
and _is_type(type, cls, dataclasses, dataclasses.KW_ONLY,
~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
_is_kw_only))):
...
input manifest: {"nested":{"key":1,"key":2}} -> REJECT ValueError: duplicate JSON key: key
input manifest: {"value":NaN} -> REJECT ValueError: non-finite JSON number: NaN
input manifest: [] -> REJECT ValueError: input manifest must be an object
input manifest: exponent overflow -> NON-FINITE ACCEPT
documents: {"nested":{"key":1,"key":2}} -> REJECT ValueError: duplicate JSON key: key
documents: {"value":NaN} -> REJECT ValueError: non-finite JSON number: NaN
documents: [] -> REJECT ValueError: documents must be an object
documents: exponent overflow -> NON-FINITE ACCEPT
coding package: {"nested":{"key":1,"key":2}} -> REJECT ValueError: duplicate JSON key: key
coding package: {"value":NaN} -> REJECT ValueError: non-finite JSON number: NaN
coding package: [] -> REJECT ValueError: coding package must be an object
coding package: exponent overflow -> NON-FINITE ACCEPT
adjudication schema: {"nested":{"key":1,"key":2}} -> REJECT ValueError: duplicate JSON key: key
adjudication schema: ...
input manifest: parse accepted; canonicalization rejected -> ValueError: Out of range float values are not JSON compliant: inf documents: parse accepted; canonicalization rejected -> ValueError: Out of range float values are not JSON compliant: inf coding package: parse accepted; canonicalization rejected -> ValueError: Out of range float values are not JSON compliant: inf adjudication schema: parse accepted; canonicalization rejected -> ValueError: Out of range float values are not JSON compliant: inf c686c4878409e68b958dd61850a59e9234416d817fc2fa3246fc728d51ebe0a5 src/institution_lab/governance_adjudication.py abf64b5e78a616d53b703dee5291ce7bf23fa9156fe59263a702e01cb8667bc5 tests/test_governance_adjudication.py
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
30: REQUIRED_INPUT_PINS = {
31: "workflow_run_id",
32: "artifact_id",
33: "artifact_sha256",
34: "documents_sha256",
35: "documents_file_sha256",
36: "coding_package_file_sha256",
37: "protocol_sha256",
38: "coding_schema_sha256",
39: "adjudication_schema_sha256",
40: }
41: FROZEN_INPUT_PINS = {
42: "workflow_run_id": 33063470968,
43: "artifact_id": 9642983578,
44: "artifact_sha256": "1f6be91fcd98e43e99d82d5f274536f6c23616e7e6c711e26324a2cc4b06ef06",
45: "documents_sha256": "d70f7f795847968339a645b6dbd6d4428af6bd6044de44fa2602d4c4343b0ee9",
46: "documents_file_sha256": "2a62ab05687982c112a29f6126227c26c3ff8defc89ca64662753aaf85c3c0ce",
47: "coding_package_file_sha256": (
48: "14644759f53071adfe1173d4e25bb01931b8c1591fa8a48295dbd0556a754769"
49: ),
50: "protocol_sha256": ...
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
890: parser.add_argument("--coding-schema", type=Path, required=True)
891: parser.add_argument("--adjudication-schema", type=Path, required=True)
892: parser.add_argument("--summary-json", type=Path, required=True)
893: parser.add_argument("--summary-markdown", type=Path, required=True)
894: args = parser.parse_args()
895: inputs = [
896: args.adjudication,
897: args.input_manifest,
898: args.documents,
899: args.coding_package,
900: args.artifact,
901: args.protocol,
902: args.coding_schema,
903: args.adjudication_schema,
904: ]
905: outputs = [args.summary_json, args.summary_markdown]
906: _validate_output_paths(inputs=inputs, outputs=outputs)
907: try:
908: adjudication = _parse_json_object(
909: _read_regular_file(args.adjudication),
910: "adjudication",
911: )
912: input_manifest = _parse_json_object(
913: ...
<path>/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py</path>
<type>file</type>
<content>
630: assert any("reviewer_ids must contain non-empty strings" in error for error in errors)
631: assert summary["canonicalization_gate"] == "closed"
632:
633:
634: def test_every_input_pin_is_reverified() -> None:
635: adjudication = _adjudication()
636: adjudication["inputs"]["artifact_sha256"] = "wrong"
637:
638: errors, summary = _validate(adjudication)
639:
640: assert "input pin mismatch: artifact_sha256" in errors
641: assert summary["canonicalization_gate"] == "closed"
642:
643:
644: def test_frozen_pins_include_the_versioned_adjudication_schema() -> None:
645: assert set(FROZEN_INPUT_PINS) == REQUIRED_INPUT_PINS
646: assert FROZEN_INPUT_PINS["adjudication_schema_sha256"] == (
647: "6181f5cb60a0462f83be00be301763daa89f11581e68ee1c46a84e8bf4e5be31"
648: )
649:
650:
651: @pytest.mark.parametrize("field", sorted(FROZEN_INPUT_PINS))
652: def ...
................. [100%] 17 passed in 0.13s
Found 4 matches /home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py: Line 776: def test_cli_validates_the_same_bytes_it_verifies( Line 864: with pytest.raises(ValueError, match="duplicate JSON key: artifact_sha256"): Line 871: with pytest.raises(ValueError, match="input manifest must be an object"): Line 955: def test_canonical_sha256_rejects_non_finite_numbers(value: float) -> None:
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
508: errors.append(f"{prefix}: graph_edge_revision.removed is not derived")
509: return errors
510:
511:
512: def validate_adjudication(
513: adjudication: dict[str, Any],
514: documents: dict[str, Any],
515: coding_package: dict[str, Any],
516: *,
517: verified_pins: dict[str, str],
518: ) -> tuple[list[str], dict[str, Any]]:
519: errors: list[str] = []
520: if adjudication.get("transition_dates_excluded") is not True:
521: errors.append("transition_dates_excluded must be true")
522: if adjudication.get("outcome_data_used") is not False:
523: errors.append("outcome_data_used must be false")
524: inputs = adjudication.get("inputs")
525: if not isinstance(inputs, dict):
526: inputs = {}
527: errors.append("inputs must be an object")
528: for pin in sorted(REQUIRED_INPUT_PINS):
529: if inputs.get(pin) != ...
<path>/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py</path> <type>file</type> <content> 1: from __future__ import annotations 2: 3: import copy 4: import json 5: import os 6: import subprocess 7: import sys 8: import zipfile 9: from pathlib import Path 10: 11: import pytest 12: 13: from institution_lab import governance_adjudication 14: from institution_lab.governance_adjudication import ( 15: DECISIONS, 16: FROZEN_INPUT_PINS, 17: REQUIRED_INPUT_PINS, 18: REVIEWER_ROLES, 19: REVIEWER_TYPES, 20: canonical_sha256, 21: file_sha256, 22: validate_adjudication, 23: validate_adjudication_fragment, 24: validate_against_schema, 25: verify_input_manifest, 26: ) 27: from institution_lab.governance_coding import ( 28: BODY_PATCH_RELATIONS, 29: CHANGE_STATUSES, 30: DIRECTIONS, 31: EVENT_KINDS, 32: RECORD_CLASSES, 33: RIGHT_KINDS, 34: ) 35: 36: ROOT = Path(__file__).parents[1] 37: MAX_TEST_ARCHIVE_MEMBERS = 256 38: 39: 40: def ...
CLI result: input manifest mismatch: documents_file_sha256 verify_input_manifest hook calls: 0
Found 1 matches /home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py: Line 106: def _stub_cli_validation(monkeypatch: pytest.MonkeyPatch) -> None:
<path>/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py</path>
<type>file</type>
<content>
100: ):
101: arguments.extend((f"--{name.replace('_', '-')}", str(paths[name])))
102: monkeypatch.setattr(sys, "argv", arguments)
103: governance_adjudication.main()
104:
105:
106: def _stub_cli_validation(monkeypatch: pytest.MonkeyPatch) -> None:
107: monkeypatch.setattr(governance_adjudication, "validate_against_schema", lambda *_: [])
108: monkeypatch.setattr(
109: governance_adjudication,
110: "validate_adjudication",
111: lambda *_args, **_kwargs: ([], {"canonicalization_gate": "open"}),
112: )
113: monkeypatch.setattr(
114: governance_adjudication,
115: "render_markdown",
116: lambda *_: "gate: open\n",
117: )
118:
119:
120: def test_adjudication_schema_matches_validator_ontology() -> None:
121: schema = json.loads((ROOT / "schema/governance-adjudication-v1.schema.json").read_text())
122: coding = ...
Found 26 matches
/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py:
Line 20: canonical_sha256,
Line 75: "documents_sha256": canonical_sha256(documents_value),
Line 76: "documents_file_sha256": file_sha256(paths["documents"]),
Line 222: "summary": {"documents_sha256": "filled-by-test"},
Line 246: "documents_sha256": "0" * 64,
Line 247: "documents_file_sha256": "1" * 64,
Line 290: "documents_sha256": "0" * 64,
Line 291: "documents_file_sha256": "1" * 64,
Line 302: from institution_lab.governance_adjudication import canonical_sha256
Line 304: documents_hash = canonical_sha256(documents)
Line 305: package["summary"]["documents_sha256"] = documents_hash
Line 306: adjudication["inputs"]["documents_sha256"] = documents_hash
Line 308: pins["documents_sha256"] = documents_hash
Line 431: from institution_lab.governance_adjudication import canonical_sha256
Line 433: documents_hash = ...
c686c4878409e68b958dd61850a59e9234416d817fc2fa3246fc728d51ebe0a5 src/institution_lab/governance_adjudication.py abf64b5e78a616d53b703dee5291ce7bf23fa9156fe59263a702e01cb8667bc5 tests/test_governance_adjudication.py ?? src/institution_lab/governance_adjudication.py ?? tests/test_governance_adjudication.py
Date: September 9, 2026 * 🟡 (04:56) Git working tree status showed modified files `pyproject.toml` and `uv.lock`; untracked files/directories `.lore.md`, `AGENTS.md`, `cases/review/oss-governance-adjudication-v1.inputs.json`, `cases/review/oss-governance-adjudication-v1/`, `schema/governance-adjudication-v1.schema.json`, `src/institution_lab/governance_adjudication.py`, and `tests/test_governanc…
Date: September 9, 2026 * 🟡 (04:51) Source inspection found `canonical_sha256()` at `src/institution_lab/governance_adjudication.py:80-87` serializes with `json.dumps(..., sort_keys=True, separators=(",", ":"), allow_nan=False)` and returns the SHA-256 digest; this rejects already-materialized non-finite floats during canonicalization. * 🟡 (04:51) Source inspection found `_parse_json_object()` …
* 🔴 (04:29) User stated the audit must remain read-only and files must never be edited. * 🔴 (04:29) User stated responses must never be empty. * 🟡 (04:29) [requested-review] User requested completion of the same JSON/pin/immutable-snapshot security audit against the unchanged current working copy, requiring findings first with exact current `file:line` evidence and `PASS`/`CONCERN`/`MUST-FIX`/…
Date: Sep 9, 2026 * 🟡 (04:11) Additional audit evidence from `src/institution_lab/governance_adjudication.py:512-534`: `validate_adjudication()` accepts `verified_pins`; compares every key in `REQUIRED_INPUT_PINS` between `adjudication["inputs"]` and `verified_pins` at lines 524-530; computes `canonical_sha256(documents)` at line 531; and requires `coding_package["summary"]["documents_sha256"]` …
Date: Sep 9, 2026 * 🔴 [requested-security-audit] (04:03) User requested a fresh, substantive, read-only security audit of only the JSON/pin/immutable-snapshot half of issue #4 input verification in `/home/byk/Code/institutional-transition-lab`; this replaces a reviewer that returned empty twice. * 🔴 [enforced-read-only] (04:03) User directed that files must never be edited and that the current …