From c2eebb9654c500f04ade74dd171196f488532cdb Mon Sep 17 00:00:00 2001 From: twentyOne2x Date: Wed, 15 Jul 2026 00:06:33 +0200 Subject: [PATCH] fix: fail closed on missing DB fingerprints --- scripts/leo_turn_execution_manifest.py | 8 ++++++-- scripts/run_leo_direct_claim_handler_suite.py | 7 +++++-- tests/test_leo_turn_execution_manifest.py | 1 + 3 files changed, 12 insertions(+), 4 deletions(-) diff --git a/scripts/leo_turn_execution_manifest.py b/scripts/leo_turn_execution_manifest.py index b497721..3596f9a 100644 --- a/scripts/leo_turn_execution_manifest.py +++ b/scripts/leo_turn_execution_manifest.py @@ -294,6 +294,11 @@ def build_turn_manifest( database_tool_binding = _database_tool_binding(result) fingerprint_before = db_fingerprint_before or {} fingerprint_after = db_fingerprint_after or {} + fingerprint_unchanged = bool( + fingerprint_before.get("fingerprint_sha256") + and fingerprint_after.get("fingerprint_sha256") + and fingerprint_before.get("fingerprint_sha256") == fingerprint_after.get("fingerprint_sha256") + ) missing = _required_missing( behavior=behavior_manifest, calls=calls, @@ -356,8 +361,7 @@ def build_turn_manifest( "database_tool_binding": database_tool_binding, "fingerprint_before": fingerprint_before, "fingerprint_after": fingerprint_after, - "fingerprint_unchanged": fingerprint_before.get("fingerprint_sha256") - == fingerprint_after.get("fingerprint_sha256"), + "fingerprint_unchanged": fingerprint_unchanged, "suite_counts_before_sha256": canonical_sha256(db_counts_before or {}), "suite_counts_after_sha256": canonical_sha256(db_counts_after or {}), "suite_counts_changed": db_counts_changed, diff --git a/scripts/run_leo_direct_claim_handler_suite.py b/scripts/run_leo_direct_claim_handler_suite.py index cd8053f..4ed679d 100755 --- a/scripts/run_leo_direct_claim_handler_suite.py +++ b/scripts/run_leo_direct_claim_handler_suite.py @@ -617,8 +617,11 @@ async def run_suite(): report["db_counts_after"] = after_counts report["db_counts_changed"] = after_counts != before_counts report["db_fingerprint_after"] = after_fingerprint - report["db_fingerprint_unchanged"] = ( - before_fingerprint.get("fingerprint_sha256") == after_fingerprint.get("fingerprint_sha256") + report["db_fingerprint_unchanged"] = bool( + before_fingerprint.get("status") == "ok" + and after_fingerprint.get("status") == "ok" + and before_fingerprint.get("fingerprint_sha256") + == after_fingerprint.get("fingerprint_sha256") ) report["live_behavior_manifest_after"] = behavior_after report["changed_live_profile"] = behavior_before["behavior_sha256"] != behavior_after["behavior_sha256"] diff --git a/tests/test_leo_turn_execution_manifest.py b/tests/test_leo_turn_execution_manifest.py index c74a169..823baf6 100644 --- a/tests/test_leo_turn_execution_manifest.py +++ b/tests/test_leo_turn_execution_manifest.py @@ -168,3 +168,4 @@ def test_database_question_requires_a_stable_full_database_fingerprint() -> None assert value["attribution"]["status"] == "incomplete" assert "database_fingerprint_before" in value["attribution"]["missing_required_bindings"] assert "database_fingerprint_after" in value["attribution"]["missing_required_bindings"] + assert value["canonical_database"]["fingerprint_unchanged"] is False