Skip to content

chore(pre-oss): pin inventory SHAs to merged main #584

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
matdev83 merged 1 commit into from
Sep 3, 2026
Merged

chore(pre-oss): pin inventory SHAs to merged main #584

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .kiro/specs/pre-oss-core-slimming/residual-ownership-inventory.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,8 @@

- **Specification**: `pre-oss-core-slimming`
- **Inventory Date**: `2026-09-03`
- **Implementation SHA**: `d2a5b53933d12dc66e03e51914166a5b5fe4520c`
- **Merged-Main Baseline SHA**: `19cdabcb6f469df0783400c8d13f6670a7818e48`
- **Implementation SHA**: `a8c18f35436afcb18570a38d5e6c05d06fe4fccc`
- **Merged-Main Baseline SHA**: `a8c18f35436afcb18570a38d5e6c05d06fe4fccc`
- **Target Full-Closure SDD**: `.kiro/specs/core-feature-ownership-full-closure/`

## Classification Vocabulary
Expand Down
42 changes: 26 additions & 16 deletions tools/kiro/speccheck/residual_ownership_inventory_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -912,6 +912,16 @@ func TestResidualOwnershipInventoryContract_RejectsInvalidTableCellCount(t *test
}
}

// metadataFieldLine renders the exact artifact line for a metadata field so
// tamper tests target one field even when Implementation and Baseline SHAs
// are identical (both pinned to merged main).
// metadataFieldLine renders the exact artifact line for a metadata field so
// tamper tests target one field even when Implementation and Baseline SHAs
// are identical (both pinned to merged main).
func metadataFieldLine(field, sha string) string {
return "- **" + field + "**: `" + sha + "`"
}

// mustLiveInventorySHAs derives the Implementation and Baseline SHAs recorded in
// the live artifact so tamper tests track inventory updates instead of pinning
// stale literal SHAs.
Expand Down Expand Up @@ -951,7 +961,7 @@ func TestResidualOwnershipInventoryContract_RejectsInvalidMetadata(t *testing.T)

t.Run("InvalidImplementationSHA", func(t *testing.T) {
t.Parallel()
tampered := strings.Replace(validContent, implSHA, "not-a-valid-40-char-hex-sha", 1)
tampered := strings.Replace(validContent, metadataFieldLine("Implementation SHA", implSHA), metadataFieldLine("Implementation SHA", "not-a-valid-40-char-hex-sha"), 1)
err := validateResidualOwnershipInventoryContent(tampered)
if err == nil || !strings.Contains(err.Error(), "Implementation SHA") {
t.Fatalf("expected invalid Implementation SHA error, got %v", err)
Expand All @@ -960,7 +970,7 @@ func TestResidualOwnershipInventoryContract_RejectsInvalidMetadata(t *testing.T)

t.Run("InvalidBaselineSHA", func(t *testing.T) {
t.Parallel()
tampered := strings.Replace(validContent, baseSHA, "shortsha", 1)
tampered := strings.Replace(validContent, metadataFieldLine("Merged-Main Baseline SHA", baseSHA), metadataFieldLine("Merged-Main Baseline SHA", "shortsha"), 1)
err := validateResidualOwnershipInventoryContent(tampered)
if err == nil || !strings.Contains(err.Error(), "Merged-Main Baseline SHA") {
t.Fatalf("expected invalid Merged-Main Baseline SHA error, got %v", err)
Expand All @@ -978,7 +988,7 @@ func TestResidualOwnershipInventoryContract_RejectsInvalidMetadata(t *testing.T)

t.Run("TrailingGarbageImplementationSHA", func(t *testing.T) {
t.Parallel()
tampered := strings.Replace(validContent, implSHA+"`", implSHA+"` -- bypass attempt", 1)
tampered := strings.Replace(validContent, metadataFieldLine("Implementation SHA", implSHA), metadataFieldLine("Implementation SHA", implSHA)+" -- bypass attempt", 1)
err := validateResidualOwnershipInventoryContent(tampered)
if err == nil || (!strings.Contains(err.Error(), "Implementation SHA") && !strings.Contains(err.Error(), "trailing garbage")) {
t.Fatalf("expected trailing garbage error for Implementation SHA, got %v", err)
Expand All @@ -987,7 +997,7 @@ func TestResidualOwnershipInventoryContract_RejectsInvalidMetadata(t *testing.T)

t.Run("TrailingGarbageBaselineSHA", func(t *testing.T) {
t.Parallel()
tampered := strings.Replace(validContent, baseSHA+"`", baseSHA+"` trailing bypass", 1)
tampered := strings.Replace(validContent, metadataFieldLine("Merged-Main Baseline SHA", baseSHA), metadataFieldLine("Merged-Main Baseline SHA", baseSHA)+" trailing bypass", 1)
err := validateResidualOwnershipInventoryContent(tampered)
if err == nil || (!strings.Contains(err.Error(), "Merged-Main Baseline SHA") && !strings.Contains(err.Error(), "trailing garbage")) {
t.Fatalf("expected trailing garbage error for Merged-Main Baseline SHA, got %v", err)
Expand Down Expand Up @@ -1254,8 +1264,8 @@ func TestResidualOwnershipInventoryContract_ValidatesSHAIdentity(t *testing.T) {

tampered := strings.Replace(
validContent,
implSHA,
notAncestorSHA,
metadataFieldLine("Implementation SHA", implSHA),
metadataFieldLine("Implementation SHA", notAncestorSHA),
1,
)
err = validateSHAIdentity(root, tampered)
Expand All @@ -1268,8 +1278,8 @@ func TestResidualOwnershipInventoryContract_ValidatesSHAIdentity(t *testing.T) {
t.Parallel()
tampered := strings.Replace(
validContent,
implSHA,
"0000000000000000000000000000000000000000",
metadataFieldLine("Implementation SHA", implSHA),
metadataFieldLine("Implementation SHA", "0000000000000000000000000000000000000000"),
1,
)
err := validateSHAIdentity(root, tampered)
Expand All @@ -1288,8 +1298,8 @@ func TestResidualOwnershipInventoryContract_ValidatesSHAIdentity(t *testing.T) {
if len(parentSHA) == 40 {
tampered := strings.Replace(
validContent,
implSHA,
parentSHA,
metadataFieldLine("Implementation SHA", implSHA),
metadataFieldLine("Implementation SHA", parentSHA),
1,
)
if err := validateSHAIdentity(root, tampered); err != nil {
Expand All @@ -1304,8 +1314,8 @@ func TestResidualOwnershipInventoryContract_ValidatesSHAIdentity(t *testing.T) {
// Replace baseline SHA with non-baseline SHA
tampered := strings.Replace(
validContent,
baseSHA,
"0000000000000000000000000000000000000000",
metadataFieldLine("Merged-Main Baseline SHA", baseSHA),
metadataFieldLine("Merged-Main Baseline SHA", "0000000000000000000000000000000000000000"),
1,
)
err := validateSHAIdentity(root, tampered)
Expand Down Expand Up @@ -1431,8 +1441,8 @@ func TestResidualOwnershipInventoryContract_RejectsDivergedBaseline(t *testing.T

// 2. If metadata specifies origin/main SHA (commit B) when main and origin/main diverge, validateSHAIdentity must reject it
liveImplSHA, liveBaseSHA := mustLiveInventorySHAs(t, validContent)
tampered := strings.Replace(validContent, liveBaseSHA, commitB, 1)
tampered = strings.Replace(tampered, liveImplSHA, commitA, 1)
tampered := strings.Replace(validContent, metadataFieldLine("Merged-Main Baseline SHA", liveBaseSHA), metadataFieldLine("Merged-Main Baseline SHA", commitB), 1)
tampered = strings.Replace(tampered, metadataFieldLine("Implementation SHA", liveImplSHA), metadataFieldLine("Implementation SHA", commitA), 1)

err = validateSHAIdentity(repo, tampered)
if err == nil {
Expand All @@ -1443,8 +1453,8 @@ func TestResidualOwnershipInventoryContract_RejectsDivergedBaseline(t *testing.T
}

// 3. When metadata specifies local main SHA (commit A), validateSHAIdentity accepts it
correctContent := strings.Replace(validContent, liveBaseSHA, commitA, 1)
correctContent = strings.Replace(correctContent, liveImplSHA, commitA, 1)
correctContent := strings.Replace(validContent, metadataFieldLine("Merged-Main Baseline SHA", liveBaseSHA), metadataFieldLine("Merged-Main Baseline SHA", commitA), 1)
correctContent = strings.Replace(correctContent, metadataFieldLine("Implementation SHA", liveImplSHA), metadataFieldLine("Implementation SHA", commitA), 1)
if err := validateSHAIdentity(repo, correctContent); err != nil {
t.Fatalf("expected validateSHAIdentity to accept local main baseline: %v", err)
}
Expand Down