solpbc.org
personal memory agent
1# SPDX-License-Identifier: AGPL-3.0-only
2# Copyright (c) 2026 sol pbc
3
4from __future__ import annotations
5
6import tomllib
7from pathlib import Path
8from typing import Any
9
10ROOT = Path(__file__).resolve().parents[1]
11EXPECTED_GRAPH_TARGETS = {
12 "x86_64-unknown-linux-gnu",
13 "aarch64-unknown-linux-gnu",
14 "x86_64-unknown-linux-musl",
15 "aarch64-unknown-linux-musl",
16 "aarch64-apple-darwin",
17 "aarch64-apple-ios",
18}
19
20
21def _read_toml(path: Path) -> dict[str, Any]:
22 return tomllib.loads(path.read_text(encoding="utf-8"))
23
24
25def _makefile_block(name: str, next_name: str) -> str:
26 text = (ROOT / "Makefile").read_text(encoding="utf-8")
27 start = text.index(f"\n{name}:")
28 end = text.index(f"\n{next_name}:", start + 1)
29 return text[start:end]
30
31
32def _workspace_member_manifest_paths() -> list[Path]:
33 workspace = _read_toml(ROOT / "core" / "Cargo.toml")
34 members = workspace["workspace"]["members"]
35 assert isinstance(members, list)
36 assert members, "workspace member enumeration must not be empty"
37
38 paths: list[Path] = []
39 for member in members:
40 assert isinstance(member, str)
41 path = ROOT / "core" / member / "Cargo.toml"
42 assert path.is_file(), f"workspace member manifest is missing: {path}"
43 paths.append(path)
44 assert len(paths) == len(members)
45 return paths
46
47
48def _rust_source_paths() -> list[Path]:
49 paths = sorted((ROOT / "core" / "crates").rglob("*.rs"))
50 assert paths, "Rust source enumeration must not be empty"
51 return paths
52
53
54def test_check_rust_deny_recipe_is_version_asserted_locked_and_offline() -> None:
55 block = _makefile_block("check-rust-deny", "audit")
56 required_commands = [
57 "scripts/check_release_preflight.py cargo-deny",
58 "--locked",
59 "--offline",
60 "check bans licenses sources",
61 ]
62
63 assert required_commands
64 for command in required_commands:
65 assert command in block
66
67
68def test_audit_recipe_uses_signed_packet_without_fetch_db() -> None:
69 block = _makefile_block("audit", "skills")
70 required_commands = [
71 "scripts/check_release_preflight.py cargo-deny",
72 "scripts/advisory_mirror_audit.py",
73 "AUDIT_ADVISORY_BUNDLE",
74 "AUDIT_ADVISORY_RECEIPT",
75 "AUDIT_ADVISORY_PUBKEY",
76 "AUDIT_ADVISORY_LOCATOR",
77 "--bundle",
78 "--receipt",
79 "--pubkey",
80 "--locator",
81 ]
82
83 assert required_commands
84 for command in required_commands:
85 assert command in block
86 assert "fetch db" not in block
87
88 # make audit stdout must be exactly the witness JSON; the private locator must never be echoed.
89 preflight_line = next(
90 line
91 for line in block.splitlines()
92 if "check_release_preflight.py cargo-deny" in line
93 )
94 audit_line = next(
95 line
96 for line in block.splitlines()
97 if "scripts/advisory_mirror_audit.py" in line
98 )
99 assert ">&2" in preflight_line
100 assert audit_line.lstrip("\t").startswith("@")
101
102
103def test_release_candidate_driver_binds_policy_before_artifact_construction() -> None:
104 driver_text = (ROOT / "scripts" / "release_candidate_driver.py").read_text(
105 encoding="utf-8"
106 )
107 release_text = (ROOT / "scripts" / "release.sh").read_text(encoding="utf-8")
108 policy_call = "policy_run = svc.prepare_policy(root, env)"
109 build_call = "svc.build_local_dist(root, include_models)"
110 inspected_commands = [policy_call, build_call]
111
112 assert inspected_commands, "release rail command enumeration must not be empty"
113 assert policy_call in driver_text
114 assert build_call in driver_text
115 assert driver_text.index(policy_call) < driver_text.index(build_call)
116 assert "make audit" not in release_text
117
118
119def test_ci_summary_names_only_established_evidence_classes() -> None:
120 block = _makefile_block("ci", "verify")
121 summary_start = block.index("All CI checks passed; evidence classes:")
122 summary = block[summary_start:]
123 expected_lines = [
124 "All CI checks passed; evidence classes:",
125 " GNU-host checks: fmt, MSRV, clippy, tests, dependency policy",
126 " iOS cross-target canary: check-rust-ios",
127 ]
128
129 assert expected_lines
130 for line in expected_lines:
131 assert line in summary
132 lower_summary = summary.lower()
133 assert "advis" not in lower_summary
134 assert "release" not in lower_summary
135 assert "artifact" not in lower_summary
136 assert "native-host" not in lower_summary
137
138
139def test_deny_toml_models_supported_graph_and_unknown_git_policy() -> None:
140 deny = _read_toml(ROOT / "core" / "deny.toml")
141 targets = deny["graph"]["targets"]
142 sources = deny["sources"]
143
144 assert isinstance(targets, list)
145 assert len(targets) == len(EXPECTED_GRAPH_TARGETS)
146 assert set(targets) == EXPECTED_GRAPH_TARGETS
147 assert sources["unknown-git"] == "deny"
148 assert sources["allow-git"] == ["https://github.com/solpbc/spl-rust"]
149
150
151def test_workspace_forbids_unsafe_and_members_inherit_lints() -> None:
152 workspace = _read_toml(ROOT / "core" / "Cargo.toml")
153 member_paths = _workspace_member_manifest_paths()
154
155 assert workspace["workspace"]["lints"]["rust"]["unsafe_code"] == "forbid"
156 assert member_paths
157 for path in member_paths:
158 member = _read_toml(path)
159 assert member["lints"]["workspace"] is True
160
161
162def test_member_manifests_do_not_shadow_workspace_unsafe_floor() -> None:
163 member_paths = _workspace_member_manifest_paths()
164
165 assert member_paths
166 for path in member_paths:
167 member = _read_toml(path)
168 rust_lints = member.get("lints", {}).get("rust", {})
169 assert "unsafe_code" not in rust_lints, path
170
171
172def test_core_crates_have_zero_unsafe_inventory() -> None:
173 paths = _rust_source_paths()
174 hits: list[str] = []
175
176 assert paths
177 for path in paths:
178 lines = path.read_text(encoding="utf-8").splitlines()
179 for line_number, line in enumerate(lines, 1):
180 if "unsafe" in line:
181 hits.append(f"{path.relative_to(ROOT)}:{line_number}:{line.strip()}")
182
183 assert not hits, "\n".join(hits)
184
185
186def test_core_crates_do_not_allow_unsafe_code() -> None:
187 paths = _rust_source_paths()
188 hits: list[str] = []
189
190 assert paths
191 for path in paths:
192 lines = path.read_text(encoding="utf-8").splitlines()
193 for line_number, line in enumerate(lines, 1):
194 if "allow(unsafe_code)" in line:
195 hits.append(f"{path.relative_to(ROOT)}:{line_number}:{line.strip()}")
196
197 assert not hits, "\n".join(hits)