import hashlib import json from datetime import UTC, datetime from pathlib import Path from ops.restore_gcp_generated_postgres_snapshot import DEFAULT_RESTORE_SERVICE_ACCOUNT from ops.verify_gcp_canonical_lifecycle import EXPECTED_BLIND_ROW_IDS from ops.verify_gcp_canonical_lifecycle import verify_lifecycle as _verify_lifecycle from ops.verify_postgres_parity_manifest import REVIEWED_MANIFEST_SQL_SHA256 VERIFY_NOW = datetime(2026, 7, 15, 1, 3, tzinfo=UTC) def verify_lifecycle(**kwargs): return _verify_lifecycle(**kwargs, now=VERIFY_NOW) def write_json(path: Path, payload: dict) -> Path: path.write_text(json.dumps(payload, sort_keys=True) + "\n", encoding="utf-8") return path def sha256(path: Path) -> str: return hashlib.sha256(path.read_bytes()).hexdigest() def lifecycle_receipts(tmp_path: Path) -> dict[str, Path]: target_db = "teleo_clone_current_test" run_id = "gcp-restore-current-test123" healthy_service = { "ActiveState": "active", "SubState": "running", "MainPID": "148735", "NRestarts": "0", } structural_hashes = { kind: {"source": format(index, "x") * 64, "target": format(index, "x") * 64} for index, kind in enumerate( ( "schemas", "columns", "constraints", "indexes", "sequences", "views", "functions", "triggers", "types", "policies", "role_memberships", "object_ownership", "object_acl", ), 1, ) } exact_parity_details = { "source_database": "teleo", "target_database": target_db, "source_table_count": 39, "target_table_count": 39, "source_total_rows": 52167, "target_total_rows": 52167, "table_mismatches": [], "table_hash_problems": [], "structural_hashes": structural_hashes, "required_extension_mismatches": {}, "target_extra_extensions": [], "application_role_mismatches": {}, "target_extra_application_roles": [], "performance": [{"query": "count_claims", "source_ms": 1.0, "target_ms": 2.0, "source_ratio": 0.4}], "performance_problems": [], } source = { "artifact": "vps_canonical_postgres_exported_snapshot", "schema": "livingip.sourceSnapshotReceipt.v2", "receipt_version": 2, "status": "pass", "run_id": "canonical-current-test", "capture_authorization_ref": "codex-delegation:test1234", "source": { "ssh_target": "root@77.42.65.182", "container": "teleo-pg", "database": "teleo", "service": "leoclean-gateway.service", }, "snapshot_exported": True, "snapshot": { "captured_at_utc": "2026-07-15T00:59:00+00:00", "exported_snapshot_id": "00000003-000001A2-1", "txid_snapshot": "100:120:", "wal_lsn": "0/16B6C50", "system_identifier": "7649789040005668902", }, "service_unchanged": True, "source_service": {"before": healthy_service, "after": healthy_service, "unchanged": True}, "production_db_mutated": False, "telegram_send_attempted": False, "dump": {"sha256": "a" * 64}, "manifest": { "sha256": "b" * 64, "manifest_sql_sha256": REVIEWED_MANIFEST_SQL_SHA256, "table_count": 39, "total_rows": 52167, }, "provenance_binding": {"algorithm": "sha256", "payload": {"bound": True}, "sha256": "c" * 64}, } source_path = write_json(tmp_path / "source.json", source) restore = { "artifact": "gcp_generated_postgres_snapshot_restore", "status": "pass", "generated_at_utc": "2026-07-15T00:59:10+00:00", "completed_at_utc": "2026-07-15T00:59:30+00:00", "run_id": run_id, "target_database": target_db, "source": { "capture_receipt": { "sha256": sha256(source_path), "capture_authorization_ref": "codex-delegation:test1234", "provenance_binding_sha256": "c" * 64, "dump_sha256": "a" * 64, "manifest_sha256": "b" * 64, "manifest_sql_sha256": REVIEWED_MANIFEST_SQL_SHA256, "checks": { name: True for name in ( "artifact", "schema", "receipt_version", "status", "snapshot_exported", "service_unchanged", "source_service_healthy", "source_not_mutated", "telegram_not_sent", "run_id", "capture_authorization_ref", "source_identity", "source_database", "snapshot_identity", "dump_sha256", "dump_bytes", "source_manifest_sha256", "manifest_sql_sha256", "source_context_sha256", "table_count", "total_rows", "binding_algorithm", "binding_payload", "binding_sha256", ) }, } }, "execution_contract": { "project": "teleo-501523", "cloudsql_instance": "teleo-pgvector-standby", "host": "10.61.0.3", "private_network": "projects/teleo-501523/global/networks/teleo-staging-net", "compute_instance": "teleo-prod-1", "compute_zone": "europe-west6-a", "restore_service_account": DEFAULT_RESTORE_SERVICE_ACCOUNT, "ssl_server_name": "teleo-pgvector-standby.private.teleo.internal", "ssl_root_cert_sha256": "9" * 64, "source": source["source"], "password_secret": "gcp-teleo-pgvector-standby-postgres-password", "service": "leoclean-gcp-prod-parallel.service", }, "target": { "manifest_sha256": "d" * 64, "connectivity": { "private_connectivity": True, "ssl": True, "sslmode": "verify-full", "ssl_server_name": "teleo-pgvector-standby.private.teleo.internal", "ssl_root_cert_sha256": "9" * 64, "server_identity_verified": True, "server_address": "10.61.0.3", "source_compute": "teleo-prod-1", }, "cloudsql": { "project": "teleo-501523", "instance": "teleo-pgvector-standby", "expected_private_host": "10.61.0.3", "private_network": "projects/teleo-501523/global/networks/teleo-staging-net", "expected_private_network": "projects/teleo-501523/global/networks/teleo-staging-net", "public_ip_disabled": True, "checks": { "instance": True, "state": True, "postgres_16": True, "public_ip_disabled": True, "private_network": True, "expected_private_host": True, "no_non_private_address": True, }, }, "compute": { "project": "teleo-501523", "project_number": "785938879453", "instance": "teleo-prod-1", "instance_id": "123456789", "zone": "europe-west6-a", "expected_private_network": "projects/teleo-501523/global/networks/teleo-staging-net", "network_resource": "projects/123456789/networks/teleo-staging-net", "private_ip": "10.61.0.2", "service_account": DEFAULT_RESTORE_SERVICE_ACCOUNT, "checks": { "project": True, "project_number": True, "expected_network_project": True, "instance": True, "instance_id": True, "zone": True, "network": True, "private_ip": True, "service_account": True, }, }, "connectivity_proof": { "sha256": "f" * 64, "schema": "livingip.gcpPrivatePostgresConnectivity.v2", }, }, "parity": {"status": "pass", "problems": [], "details": exact_parity_details}, "live_service": {"before": healthy_service, "after": healthy_service, "unchanged": True}, } restore_path = write_json(tmp_path / "restore.json", restore) parity = { "artifact": "canonical_postgres_parity_verification", "status": "pass", "completed_at_utc": "2026-07-15T00:59:45+00:00", "scope": "gcp_staging", "problems": [], "source_manifest_sha256": "b" * 64, "target_manifest_sha256": "d" * 64, "connectivity_proof_sha256": "f" * 64, "details": exact_parity_details, "private_connectivity": { "required": True, "proof": { "artifact": "gcp_private_postgres_connectivity", "schema": "livingip.gcpPrivatePostgresConnectivity.v2", "status": "pass", "restore_run_id": run_id, "private_connectivity": True, "public_ip_disabled": True, "target_database": target_db, "source_compute": "teleo-prod-1", "source_compute_instance_id": "123456789", "source_compute_zone": "europe-west6-a", "source_compute_private_ip": "10.61.0.2", "server_address": "10.61.0.3", "sslmode": "verify-full", "ssl_server_name": "teleo-pgvector-standby.private.teleo.internal", "ssl_root_cert_sha256": "9" * 64, "server_identity_verified": True, "project": "teleo-501523", "cloudsql_instance": "teleo-pgvector-standby", "private_network": "projects/teleo-501523/global/networks/teleo-staging-net", "cloudsql_control_plane_checks": restore["target"]["cloudsql"]["checks"], "compute_identity_checks": restore["target"]["compute"]["checks"], }, }, } parity_path = write_json(tmp_path / "parity.json", parity) required_checks = { name: True for name in ( "exact_blind_prompt_without_ids", "claim_and_sources_retrieved", "discovery_show_evidence_completed", "retrieval_receipts_proven", "private_tls_read_only_target", "generated_database_unchanged", "canonical_counts_unchanged", "database_calls_read_only", "no_database_write", "no_telegram_send", "live_service_unchanged", "live_profile_unchanged", "temporary_profile_removed", ) } reasoning = { "schema": "livingip.gcpGeneratedDbBlindClaimCanary.v1", "status": "pass", "generated_at_utc": "2026-07-15T01:00:00+00:00", "completed_at_utc": "2026-07-15T01:01:00+00:00", "mode": "gcp_generated_db_gatewayrunner_blind_claim_no_send", "source_compute": "teleo-prod-1", "prompt": "Inspect the live claim without me giving you an ID. Do not change the database.", "errors": [], "target_database": target_db, "posted_to_telegram": False, "database_write_attempted": False, "parity_receipt": {"sha256": sha256(parity_path)}, "checks": required_checks, "database_fingerprint_before": {"sha256": "e" * 64}, "database_fingerprint_after": {"sha256": "e" * 64}, "canonical_status_before": {"claims": 1}, "canonical_status_after": {"claims": 1}, "database_identity_before": {"database": target_db}, "database_identity_after": {"database": target_db}, "service_before": healthy_service, "service_after": healthy_service, "temp_profile_absent": True, "temp_profile_removed": True, "outcomes": { "asks_for_user_iteration_before_live": True, "challenges_weak_support": True, "decomposes_the_bundled_legal_claim": True, "does_not_claim_a_database_change": True, "proposes_candidate_claims": True, "uses_only_m3taversal_handle": True, }, "result": { "reply": "The claim is weak; here are grounded, review-first alternatives.", "database_tool_trace": { "schema": "livingip.leoKbToolTrace.v1", "database_tool_call_proven": True, "database_retrieval_receipt_proven": True, "database_tool_calls_read_only": True, "database_tool_call_count": 3, "database_tool_completed_count": 3, "calls": [ { "database_invocations": [{"access_mode": "read_only", "subcommand": subcommand}], "result": { "nonempty": True, "error_detected": False, "row_ids": sorted(EXPECTED_BLIND_ROW_IDS), "row_id_count": len(EXPECTED_BLIND_ROW_IDS), "retrieval_receipt": { "schema": "livingip.teleoKbRetrievalReceipt.v1", "semantic_context_sha256": "1" * 64, "artifact_state_sha256": "2" * 64, "read_consistency_status": "stable_wal_marker", }, }, } for subcommand in ("search", "show", "evidence") ], }, "gateway": { "authorized": True, "handler_invoked": True, "model_free_fallback_used": False, "posted_to_telegram": False, "child_process": { "exitcode": 0, "alive_after_readback": False, "process_group_alive_after_readback": False, "timed_out": False, }, "tool_surface": {"send_message_tool_enabled": False}, }, }, "wrapper_tool_proof": { "all_bound_to_supplied_target": True, "all_completed_successfully": True, "complete_start_end_pairing": True, "database_read_only_required": True, "default_read_only_required": True, "invocations": [ { "database": target_db, "returncode": 0, "subcommand": subcommand, "database_identity": { "transaction_read_only": "on", "default_transaction_read_only": "on", "ssl": True, "sslmode": "verify-full", "ssl_server_name": "teleo-pgvector-standby.private.teleo.internal", "ssl_root_cert_sha256": "9" * 64, "server_identity_verified": True, "server_address": "10.61.0.3", }, } for subcommand in ("search", "show", "evidence") ], }, } reasoning_path = write_json(tmp_path / "reasoning.json", reasoning) reasoning_compute = { "artifact": "gcp_reasoning_compute_attestation", "schema": "livingip.gcpReasoningComputeAttestation.v1", "status": "pass", "generated_at_utc": "2026-07-15T01:01:05+00:00", "restore_run_id": run_id, "target_database": target_db, "reasoning_receipt": { "sha256": sha256(reasoning_path), "schema": reasoning["schema"], "generated_at_utc": reasoning["generated_at_utc"], "completed_at_utc": reasoning["completed_at_utc"], "claimed_source_compute": reasoning["source_compute"], }, "compute": restore["target"]["compute"], "checks": { "schema": True, "status": True, "target_database": True, "source_compute": True, "chronology": True, "no_telegram_send": True, "no_database_write": True, "gce_metadata_identity": True, }, "method": "gce_metadata_server_v1", "mutation": { "cloudsql_changed": False, "compute_changed": False, "database_changed": False, "telegram_message_sent": False, }, } reasoning_compute_path = write_json(tmp_path / "reasoning-compute.json", reasoning_compute) current_source = json.loads(json.dumps(source)) current_source["run_id"] = "canonical-current-postflight" current_source["capture_authorization_ref"] = "codex-delegation:postflight1234" current_source["snapshot"]["captured_at_utc"] = "2026-07-15T01:02:00+00:00" current_source["snapshot"]["exported_snapshot_id"] = "00000003-000001B2-1" current_source_path = write_json(tmp_path / "current-source.json", current_source) source_delta = { "artifact": "vps_canonical_snapshot_postflight_delta", "schema": "livingip.vpsCanonicalSnapshotDelta.v1", "status": "pass", "baseline": { "run_id": "canonical-current-test", "capture_receipt_sha256": sha256(source_path), "manifest_sha256": "b" * 64, "manifest_sql_sha256": REVIEWED_MANIFEST_SQL_SHA256, "capture_authorization_ref": "codex-delegation:test1234", "captured_at_utc": "2026-07-15T00:59:00+00:00", "table_count": 39, "total_rows": 52167, "table_fingerprint_sha256": "d" * 64, "structure_fingerprint_sha256": "e" * 64, }, "current": { "run_id": "canonical-current-postflight", "capture_receipt_sha256": sha256(current_source_path), "manifest_sha256": "b" * 64, "manifest_sql_sha256": REVIEWED_MANIFEST_SQL_SHA256, "capture_authorization_ref": "codex-delegation:postflight1234", "captured_at_utc": "2026-07-15T01:02:00+00:00", "table_count": 39, "total_rows": 52167, "table_fingerprint_sha256": "d" * 64, "structure_fingerprint_sha256": "e" * 64, }, "delta": { "delta_detected": False, "added_tables": [], "removed_tables": [], "changed_tables": [], "changed_structures": [], "total_row_delta": 0, }, } source_delta_path = write_json(tmp_path / "source-delta.json", source_delta) cleanup = { "artifact": "gcp_generated_postgres_snapshot_cleanup", "status": "pass", "generated_at_utc": "2026-07-15T01:01:10+00:00", "completed_at_utc": "2026-07-15T01:01:30+00:00", "run_id": run_id, "target_database": target_db, "database": {"existed_before": True, "clone_database_remaining": 0}, "live_service": {"before": healthy_service, "after": healthy_service, "unchanged": True}, "restore_receipt": {"sha256": sha256(restore_path)}, "execution_contract": restore["execution_contract"], "target": { "cloudsql": restore["target"]["cloudsql"], "compute": restore["target"]["compute"], }, } cleanup_path = write_json(tmp_path / "cleanup.json", cleanup) return { "source_path": source_path, "current_source_path": current_source_path, "source_delta_path": source_delta_path, "restore_path": restore_path, "parity_path": parity_path, "reasoning_path": reasoning_path, "reasoning_compute_path": reasoning_compute_path, "cleanup_path": cleanup_path, } def test_caller_authored_bundle_is_preparation_only_even_when_all_checks_pass(tmp_path: Path) -> None: paths = lifecycle_receipts(tmp_path) result = verify_lifecycle(**paths) assert result["status"] == "prepared_external_attestation_required" assert result["failed_checks"] == [] assert result["checks"]["clone_absent"] is True assert result["current_tier"] == "T2_structural_receipt_bundle" assert result["required_tier"] == "T3_live_private_gcp_staging" assert result["t3_receipt_ready"] is False assert result["accepted_by_this_api"] is False assert "current private GCP staging" not in result["strongest_claim_allowed"] def test_rebound_unreviewed_manifest_sql_digest_fails_closed(tmp_path: Path) -> None: paths = lifecycle_receipts(tmp_path) unreviewed_digest = "f" * 64 source = json.loads(paths["source_path"].read_text()) source["manifest"]["manifest_sql_sha256"] = unreviewed_digest write_json(paths["source_path"], source) current_source = json.loads(paths["current_source_path"].read_text()) current_source["manifest"]["manifest_sql_sha256"] = unreviewed_digest write_json(paths["current_source_path"], current_source) restore = json.loads(paths["restore_path"].read_text()) restore["source"]["capture_receipt"]["sha256"] = sha256(paths["source_path"]) restore["source"]["capture_receipt"]["manifest_sql_sha256"] = unreviewed_digest write_json(paths["restore_path"], restore) delta = json.loads(paths["source_delta_path"].read_text()) delta["baseline"]["capture_receipt_sha256"] = sha256(paths["source_path"]) delta["baseline"]["manifest_sql_sha256"] = unreviewed_digest delta["current"]["capture_receipt_sha256"] = sha256(paths["current_source_path"]) delta["current"]["manifest_sql_sha256"] = unreviewed_digest write_json(paths["source_delta_path"], delta) cleanup = json.loads(paths["cleanup_path"].read_text()) cleanup["restore_receipt"]["sha256"] = sha256(paths["restore_path"]) write_json(paths["cleanup_path"], cleanup) result = verify_lifecycle(**paths) assert result["status"] == "fail" assert "source_delta_manifest_sql_reviewed" in result["failed_checks"] def test_local_parity_or_missing_cleanup_fails_closed(tmp_path: Path) -> None: paths = lifecycle_receipts(tmp_path) parity = json.loads(paths["parity_path"].read_text()) parity["scope"] = "local_restore" write_json(paths["parity_path"], parity) reasoning = json.loads(paths["reasoning_path"].read_text()) reasoning["parity_receipt"]["sha256"] = sha256(paths["parity_path"]) write_json(paths["reasoning_path"], reasoning) cleanup = json.loads(paths["cleanup_path"].read_text()) cleanup["database"]["clone_database_remaining"] = 1 write_json(paths["cleanup_path"], cleanup) result = verify_lifecycle(**paths) assert result["status"] == "fail" assert {"parity_pass", "clone_absent"} <= set(result["failed_checks"]) def test_cleanup_cannot_pass_when_the_named_clone_never_existed(tmp_path: Path) -> None: paths = lifecycle_receipts(tmp_path) cleanup = json.loads(paths["cleanup_path"].read_text()) cleanup["database"]["existed_before"] = False write_json(paths["cleanup_path"], cleanup) result = verify_lifecycle(**paths) assert result["status"] == "fail" assert "clone_absent" in result["failed_checks"] def test_mismatched_source_or_reasoning_receipt_fails_closed(tmp_path: Path) -> None: paths = lifecycle_receipts(tmp_path) restore = json.loads(paths["restore_path"].read_text()) restore["source"]["capture_receipt"]["sha256"] = "0" * 64 write_json(paths["restore_path"], restore) reasoning = json.loads(paths["reasoning_path"].read_text()) reasoning["checks"]["claim_and_sources_retrieved"] = False write_json(paths["reasoning_path"], reasoning) result = verify_lifecycle(**paths) assert result["status"] == "fail" assert {"source_receipt_hash_bound", "reasoning_required_checks"} <= set(result["failed_checks"]) def test_hand_authored_reasoning_boole_without_producer_evidence_fail(tmp_path: Path) -> None: paths = lifecycle_receipts(tmp_path) reasoning = json.loads(paths["reasoning_path"].read_text()) reasoning.pop("result") reasoning.pop("wrapper_tool_proof") write_json(paths["reasoning_path"], reasoning) result = verify_lifecycle(**paths) assert result["status"] == "fail" assert "reasoning_producer_evidence" in result["failed_checks"] assert result["reasoning_producer_checks"]["tool_trace"] is False def test_reasoning_compute_attestation_must_bind_live_metadata(tmp_path: Path) -> None: paths = lifecycle_receipts(tmp_path) attestation = json.loads(paths["reasoning_compute_path"].read_text()) attestation["compute"]["instance_id"] = "999999999" write_json(paths["reasoning_compute_path"], attestation) result = verify_lifecycle(**paths) assert result["status"] == "fail" assert "reasoning_compute_identity_bound" in result["failed_checks"] def test_project_owner_shaped_service_account_cannot_pass_preparation(tmp_path: Path) -> None: paths = lifecycle_receipts(tmp_path) project_owner = "project-owner@teleo-501523.iam.gserviceaccount.com" restore = json.loads(paths["restore_path"].read_text()) restore["target"]["compute"]["service_account"] = project_owner restore["execution_contract"]["restore_service_account"] = project_owner write_json(paths["restore_path"], restore) attestation = json.loads(paths["reasoning_compute_path"].read_text()) attestation["compute"]["service_account"] = project_owner write_json(paths["reasoning_compute_path"], attestation) cleanup = json.loads(paths["cleanup_path"].read_text()) cleanup["target"]["compute"]["service_account"] = project_owner cleanup["execution_contract"]["restore_service_account"] = project_owner cleanup["restore_receipt"]["sha256"] = sha256(paths["restore_path"]) write_json(paths["cleanup_path"], cleanup) result = verify_lifecycle(**paths) assert result["status"] == "fail" assert "restore_compute_contract" in result["failed_checks"] def test_source_postflight_must_be_newer_than_cleanup_completion(tmp_path: Path) -> None: paths = lifecycle_receipts(tmp_path) cleanup = json.loads(paths["cleanup_path"].read_text()) cleanup["completed_at_utc"] = "2026-07-15T02:00:00+00:00" write_json(paths["cleanup_path"], cleanup) result = verify_lifecycle(**paths) assert result["status"] == "fail" assert "source_postflight_after_lifecycle" in result["failed_checks"] def test_parity_must_retain_exact_structure_roles_rows_and_performance(tmp_path: Path) -> None: paths = lifecycle_receipts(tmp_path) parity = json.loads(paths["parity_path"].read_text()) parity["details"]["structural_hashes"].pop("constraints") parity["details"]["application_role_mismatches"] = {"kb_apply": {"missing": True}} parity["details"]["performance"] = [] write_json(paths["parity_path"], parity) reasoning = json.loads(paths["reasoning_path"].read_text()) reasoning["parity_receipt"]["sha256"] = sha256(paths["parity_path"]) write_json(paths["reasoning_path"], reasoning) result = verify_lifecycle(**paths) assert result["status"] == "fail" assert "parity_exact_evidence" in result["failed_checks"] assert result["parity_evidence_checks"]["structural_hashes"] is False assert result["parity_evidence_checks"]["roles"] is False assert result["parity_evidence_checks"]["performance"] is False def test_reasoning_must_retrieve_expected_claim_sources_and_preserve_handle(tmp_path: Path) -> None: paths = lifecycle_receipts(tmp_path) reasoning = json.loads(paths["reasoning_path"].read_text()) for call in reasoning["result"]["database_tool_trace"]["calls"]: call["result"]["row_ids"] = [] call["result"]["row_id_count"] = 0 reasoning["result"]["reply"] = "Cory found a weak claim and two sources." write_json(paths["reasoning_path"], reasoning) result = verify_lifecycle(**paths) assert result["status"] == "fail" assert "reasoning_producer_evidence" in result["failed_checks"] assert result["reasoning_producer_checks"]["expected_claim_and_sources_retrieved"] is False assert result["reasoning_producer_checks"]["reply_uses_only_m3taversal_handle"] is False def test_reasoning_wrapper_must_authenticate_the_cloudsql_server(tmp_path: Path) -> None: paths = lifecycle_receipts(tmp_path) reasoning = json.loads(paths["reasoning_path"].read_text()) for invocation in reasoning["wrapper_tool_proof"]["invocations"]: invocation["database_identity"]["sslmode"] = "require" invocation["database_identity"]["server_identity_verified"] = False write_json(paths["reasoning_path"], reasoning) result = verify_lifecycle(**paths) assert result["status"] == "fail" assert "reasoning_producer_evidence" in result["failed_checks"] assert result["reasoning_producer_checks"]["wrapper_invocations"] is False def test_lifecycle_requires_restore_parity_reasoning_cleanup_chronology(tmp_path: Path) -> None: paths = lifecycle_receipts(tmp_path) cleanup = json.loads(paths["cleanup_path"].read_text()) cleanup["generated_at_utc"] = "2026-07-15T00:58:00+00:00" write_json(paths["cleanup_path"], cleanup) result = verify_lifecycle(**paths) assert result["status"] == "fail" assert "lifecycle_chronology" in result["failed_checks"] def test_source_delta_requires_real_fingerprints_and_consistent_no_delta(tmp_path: Path) -> None: paths = lifecycle_receipts(tmp_path) delta = json.loads(paths["source_delta_path"].read_text()) delta["baseline"].pop("table_fingerprint_sha256") delta["current"]["total_rows"] += 1 write_json(paths["source_delta_path"], delta) result = verify_lifecycle(**paths) assert result["status"] == "fail" assert {"source_delta_baseline_shape", "source_delta_current_shape", "source_delta_consistent"} <= set( result["failed_checks"] ) def test_detected_source_delta_requires_exact_row_arithmetic(tmp_path: Path) -> None: paths = lifecycle_receipts(tmp_path) delta = json.loads(paths["source_delta_path"].read_text()) delta["delta"]["delta_detected"] = True delta["delta"]["changed_tables"] = [{"table": "public.claims"}] delta["delta"]["total_row_delta"] = 99 write_json(paths["source_delta_path"], delta) result = verify_lifecycle(**paths) assert result["status"] == "fail" assert "source_delta_consistent" in result["failed_checks"] def test_postflight_source_requires_structured_healthy_service(tmp_path: Path) -> None: paths = lifecycle_receipts(tmp_path) current = json.loads(paths["current_source_path"].read_text()) current["source_service"]["before"]["ActiveState"] = "failed" current["source_service"]["after"]["ActiveState"] = "failed" write_json(paths["current_source_path"], current) delta = json.loads(paths["source_delta_path"].read_text()) delta["current"]["capture_receipt_sha256"] = sha256(paths["current_source_path"]) write_json(paths["source_delta_path"], delta) result = verify_lifecycle(**paths) assert result["status"] == "fail" assert "current_source_pass" in result["failed_checks"] def test_unchanged_but_inactive_service_cannot_pass_t3(tmp_path: Path) -> None: paths = lifecycle_receipts(tmp_path) restore = json.loads(paths["restore_path"].read_text()) restore["live_service"]["before"]["ActiveState"] = "failed" restore["live_service"]["after"]["ActiveState"] = "failed" write_json(paths["restore_path"], restore) cleanup = json.loads(paths["cleanup_path"].read_text()) cleanup["restore_receipt"]["sha256"] = sha256(paths["restore_path"]) write_json(paths["cleanup_path"], cleanup) result = verify_lifecycle(**paths) assert result["status"] == "fail" assert "restore_service_healthy_unchanged" in result["failed_checks"] def test_historical_but_monotonic_receipts_cannot_claim_current_t3(tmp_path: Path) -> None: paths = lifecycle_receipts(tmp_path) result = _verify_lifecycle(**paths, now=datetime(2026, 7, 15, 3, 0, tzinfo=UTC)) assert result["status"] == "fail" assert "source_postflight_fresh" in result["failed_checks"] assert result["postflight_age_seconds"] > result["max_postflight_age_seconds"] def test_fresh_postflight_cannot_mask_historical_gcp_lifecycle(tmp_path: Path) -> None: paths = lifecycle_receipts(tmp_path) source = json.loads(paths["source_path"].read_text()) source["snapshot"]["captured_at_utc"] = "2026-07-12T00:59:00+00:00" write_json(paths["source_path"], source) restore = json.loads(paths["restore_path"].read_text()) restore["generated_at_utc"] = "2026-07-12T00:59:10+00:00" restore["completed_at_utc"] = "2026-07-12T00:59:30+00:00" restore["source"]["capture_receipt"]["sha256"] = sha256(paths["source_path"]) write_json(paths["restore_path"], restore) parity = json.loads(paths["parity_path"].read_text()) parity["completed_at_utc"] = "2026-07-12T00:59:45+00:00" write_json(paths["parity_path"], parity) reasoning = json.loads(paths["reasoning_path"].read_text()) reasoning["generated_at_utc"] = "2026-07-12T01:00:00+00:00" reasoning["completed_at_utc"] = "2026-07-12T01:01:00+00:00" reasoning["parity_receipt"]["sha256"] = sha256(paths["parity_path"]) write_json(paths["reasoning_path"], reasoning) attestation = json.loads(paths["reasoning_compute_path"].read_text()) attestation["generated_at_utc"] = "2026-07-12T01:01:05+00:00" attestation["reasoning_receipt"]["sha256"] = sha256(paths["reasoning_path"]) attestation["reasoning_receipt"]["generated_at_utc"] = reasoning["generated_at_utc"] attestation["reasoning_receipt"]["completed_at_utc"] = reasoning["completed_at_utc"] write_json(paths["reasoning_compute_path"], attestation) cleanup = json.loads(paths["cleanup_path"].read_text()) cleanup["generated_at_utc"] = "2026-07-12T01:01:10+00:00" cleanup["completed_at_utc"] = "2026-07-12T01:01:30+00:00" cleanup["restore_receipt"]["sha256"] = sha256(paths["restore_path"]) write_json(paths["cleanup_path"], cleanup) delta = json.loads(paths["source_delta_path"].read_text()) delta["baseline"]["captured_at_utc"] = "2026-07-12T00:59:00+00:00" delta["baseline"]["capture_receipt_sha256"] = sha256(paths["source_path"]) write_json(paths["source_delta_path"], delta) result = verify_lifecycle(**paths) assert result["checks"]["source_postflight_fresh"] is True assert result["checks"]["lifecycle_chronology"] is True assert result["status"] == "fail" assert {"gcp_lifecycle_fresh", "lifecycle_span_bounded"} <= set(result["failed_checks"])