From 357140af3d43939a1fa4d99b9300b11410d324c9 Mon Sep 17 00:00:00 2001 From: matdev83 Date: Thu, 3 Sep 2026 19:30:02 +0200 Subject: [PATCH] chore(pre-oss): pin inventory SHAs to merged main, field-anchored tamper tests --- .../residual-ownership-inventory.md | 4 +- .../residual_ownership_inventory_test.go | 42 ++++++++++++------- 2 files changed, 28 insertions(+), 18 deletions(-) diff --git a/.kiro/specs/pre-oss-core-slimming/residual-ownership-inventory.md b/.kiro/specs/pre-oss-core-slimming/residual-ownership-inventory.md index 807c4e93..1776174a 100644 --- a/.kiro/specs/pre-oss-core-slimming/residual-ownership-inventory.md +++ b/.kiro/specs/pre-oss-core-slimming/residual-ownership-inventory.md @@ -4,8 +4,8 @@ - **Specification**: `pre-oss-core-slimming` - **Inventory Date**: `2026-09-03` -- **Implementation SHA**: `d2a5b53933d12dc66e03e51914166a5b5fe4520c` -- **Merged-Main Baseline SHA**: `19cdabcb6f469df0783400c8d13f6670a7818e48` +- **Implementation SHA**: `a8c18f35436afcb18570a38d5e6c05d06fe4fccc` +- **Merged-Main Baseline SHA**: `a8c18f35436afcb18570a38d5e6c05d06fe4fccc` - **Target Full-Closure SDD**: `.kiro/specs/core-feature-ownership-full-closure/` ## Classification Vocabulary diff --git a/tools/kiro/speccheck/residual_ownership_inventory_test.go b/tools/kiro/speccheck/residual_ownership_inventory_test.go index 9a8d67bc..211ce992 100644 --- a/tools/kiro/speccheck/residual_ownership_inventory_test.go +++ b/tools/kiro/speccheck/residual_ownership_inventory_test.go @@ -912,6 +912,16 @@ func TestResidualOwnershipInventoryContract_RejectsInvalidTableCellCount(t *test } } +// metadataFieldLine renders the exact artifact line for a metadata field so +// tamper tests target one field even when Implementation and Baseline SHAs +// are identical (both pinned to merged main). +// metadataFieldLine renders the exact artifact line for a metadata field so +// tamper tests target one field even when Implementation and Baseline SHAs +// are identical (both pinned to merged main). +func metadataFieldLine(field, sha string) string { + return "- **" + field + "**: `" + sha + "`" +} + // mustLiveInventorySHAs derives the Implementation and Baseline SHAs recorded in // the live artifact so tamper tests track inventory updates instead of pinning // stale literal SHAs. @@ -951,7 +961,7 @@ func TestResidualOwnershipInventoryContract_RejectsInvalidMetadata(t *testing.T) t.Run("InvalidImplementationSHA", func(t *testing.T) { t.Parallel() - tampered := strings.Replace(validContent, implSHA, "not-a-valid-40-char-hex-sha", 1) + tampered := strings.Replace(validContent, metadataFieldLine("Implementation SHA", implSHA), metadataFieldLine("Implementation SHA", "not-a-valid-40-char-hex-sha"), 1) err := validateResidualOwnershipInventoryContent(tampered) if err == nil || !strings.Contains(err.Error(), "Implementation SHA") { t.Fatalf("expected invalid Implementation SHA error, got %v", err) @@ -960,7 +970,7 @@ func TestResidualOwnershipInventoryContract_RejectsInvalidMetadata(t *testing.T) t.Run("InvalidBaselineSHA", func(t *testing.T) { t.Parallel() - tampered := strings.Replace(validContent, baseSHA, "shortsha", 1) + tampered := strings.Replace(validContent, metadataFieldLine("Merged-Main Baseline SHA", baseSHA), metadataFieldLine("Merged-Main Baseline SHA", "shortsha"), 1) err := validateResidualOwnershipInventoryContent(tampered) if err == nil || !strings.Contains(err.Error(), "Merged-Main Baseline SHA") { t.Fatalf("expected invalid Merged-Main Baseline SHA error, got %v", err) @@ -978,7 +988,7 @@ func TestResidualOwnershipInventoryContract_RejectsInvalidMetadata(t *testing.T) t.Run("TrailingGarbageImplementationSHA", func(t *testing.T) { t.Parallel() - tampered := strings.Replace(validContent, implSHA+"`", implSHA+"` -- bypass attempt", 1) + tampered := strings.Replace(validContent, metadataFieldLine("Implementation SHA", implSHA), metadataFieldLine("Implementation SHA", implSHA)+" -- bypass attempt", 1) err := validateResidualOwnershipInventoryContent(tampered) if err == nil || (!strings.Contains(err.Error(), "Implementation SHA") && !strings.Contains(err.Error(), "trailing garbage")) { t.Fatalf("expected trailing garbage error for Implementation SHA, got %v", err) @@ -987,7 +997,7 @@ func TestResidualOwnershipInventoryContract_RejectsInvalidMetadata(t *testing.T) t.Run("TrailingGarbageBaselineSHA", func(t *testing.T) { t.Parallel() - tampered := strings.Replace(validContent, baseSHA+"`", baseSHA+"` trailing bypass", 1) + tampered := strings.Replace(validContent, metadataFieldLine("Merged-Main Baseline SHA", baseSHA), metadataFieldLine("Merged-Main Baseline SHA", baseSHA)+" trailing bypass", 1) err := validateResidualOwnershipInventoryContent(tampered) if err == nil || (!strings.Contains(err.Error(), "Merged-Main Baseline SHA") && !strings.Contains(err.Error(), "trailing garbage")) { t.Fatalf("expected trailing garbage error for Merged-Main Baseline SHA, got %v", err) @@ -1254,8 +1264,8 @@ func TestResidualOwnershipInventoryContract_ValidatesSHAIdentity(t *testing.T) { tampered := strings.Replace( validContent, - implSHA, - notAncestorSHA, + metadataFieldLine("Implementation SHA", implSHA), + metadataFieldLine("Implementation SHA", notAncestorSHA), 1, ) err = validateSHAIdentity(root, tampered) @@ -1268,8 +1278,8 @@ func TestResidualOwnershipInventoryContract_ValidatesSHAIdentity(t *testing.T) { t.Parallel() tampered := strings.Replace( validContent, - implSHA, - "0000000000000000000000000000000000000000", + metadataFieldLine("Implementation SHA", implSHA), + metadataFieldLine("Implementation SHA", "0000000000000000000000000000000000000000"), 1, ) err := validateSHAIdentity(root, tampered) @@ -1288,8 +1298,8 @@ func TestResidualOwnershipInventoryContract_ValidatesSHAIdentity(t *testing.T) { if len(parentSHA) == 40 { tampered := strings.Replace( validContent, - implSHA, - parentSHA, + metadataFieldLine("Implementation SHA", implSHA), + metadataFieldLine("Implementation SHA", parentSHA), 1, ) if err := validateSHAIdentity(root, tampered); err != nil { @@ -1304,8 +1314,8 @@ func TestResidualOwnershipInventoryContract_ValidatesSHAIdentity(t *testing.T) { // Replace baseline SHA with non-baseline SHA tampered := strings.Replace( validContent, - baseSHA, - "0000000000000000000000000000000000000000", + metadataFieldLine("Merged-Main Baseline SHA", baseSHA), + metadataFieldLine("Merged-Main Baseline SHA", "0000000000000000000000000000000000000000"), 1, ) err := validateSHAIdentity(root, tampered) @@ -1431,8 +1441,8 @@ func TestResidualOwnershipInventoryContract_RejectsDivergedBaseline(t *testing.T // 2. If metadata specifies origin/main SHA (commit B) when main and origin/main diverge, validateSHAIdentity must reject it liveImplSHA, liveBaseSHA := mustLiveInventorySHAs(t, validContent) - tampered := strings.Replace(validContent, liveBaseSHA, commitB, 1) - tampered = strings.Replace(tampered, liveImplSHA, commitA, 1) + tampered := strings.Replace(validContent, metadataFieldLine("Merged-Main Baseline SHA", liveBaseSHA), metadataFieldLine("Merged-Main Baseline SHA", commitB), 1) + tampered = strings.Replace(tampered, metadataFieldLine("Implementation SHA", liveImplSHA), metadataFieldLine("Implementation SHA", commitA), 1) err = validateSHAIdentity(repo, tampered) if err == nil { @@ -1443,8 +1453,8 @@ func TestResidualOwnershipInventoryContract_RejectsDivergedBaseline(t *testing.T } // 3. When metadata specifies local main SHA (commit A), validateSHAIdentity accepts it - correctContent := strings.Replace(validContent, liveBaseSHA, commitA, 1) - correctContent = strings.Replace(correctContent, liveImplSHA, commitA, 1) + correctContent := strings.Replace(validContent, metadataFieldLine("Merged-Main Baseline SHA", liveBaseSHA), metadataFieldLine("Merged-Main Baseline SHA", commitA), 1) + correctContent = strings.Replace(correctContent, metadataFieldLine("Implementation SHA", liveImplSHA), metadataFieldLine("Implementation SHA", commitA), 1) if err := validateSHAIdentity(repo, correctContent); err != nil { t.Fatalf("expected validateSHAIdentity to accept local main baseline: %v", err) }