226 lines
9.5 KiB
Python
226 lines
9.5 KiB
Python
from __future__ import annotations
|
|
|
|
import json
|
|
import subprocess
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
from scripts import leo_behavior_manifest as manifest
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
|
|
|
|
def _write(path: Path, value: str) -> None:
|
|
path.parent.mkdir(parents=True, exist_ok=True)
|
|
path.write_text(value, encoding="utf-8")
|
|
|
|
|
|
def test_behavior_manifest_is_deterministic_and_never_emits_config_secrets(tmp_path: Path) -> None:
|
|
profile = tmp_path / "profile"
|
|
hermes = tmp_path / "hermes"
|
|
deployment = tmp_path / "deployment"
|
|
_write(
|
|
profile / "config.yaml",
|
|
"""model:
|
|
provider: openrouter
|
|
default: anthropic/claude-sonnet-4-6
|
|
smart_routing: true
|
|
smart_routing_model: google/gemini-2.5-flash
|
|
memory:
|
|
enabled: true
|
|
search: sqlite_fts5
|
|
gateway:
|
|
telegram:
|
|
bot_token: super-secret-token
|
|
""",
|
|
)
|
|
_write(profile / "SOUL.md", "# Leo\n")
|
|
_write(profile / "skills" / "teleo-kb-bridge" / "SKILL.md", "# Bridge\n")
|
|
_write(profile / "plugins" / "leo-db-context" / "__init__.py", "# plugin\n")
|
|
_write(profile / "bin" / "kb_tool.py", "# tool\n")
|
|
_write(profile / "memories" / "USER.md", "private participant fact\n")
|
|
_write(profile / "sessions" / "one.jsonl", '{"private":"conversation"}\n')
|
|
_write(profile / "state.db", "runtime-state")
|
|
_write(hermes / "run_agent.py", "# runtime\n")
|
|
_write(hermes / "agent" / "prompt_builder.py", "# prompts\n")
|
|
_write(deployment / "scripts" / "leo_behavior_manifest.py", "# manifest\n")
|
|
_write(deployment / "scripts" / "leo_tool_trace.py", "# tool trace\n")
|
|
|
|
first = manifest.build_manifest(profile, hermes, deployment)
|
|
second = manifest.build_manifest(profile, hermes, deployment)
|
|
|
|
assert first["behavior_sha256"] == second["behavior_sha256"]
|
|
assert first["model_runtime"]["default_model"] == "anthropic/claude-sonnet-4-6"
|
|
assert first["teleo_infrastructure_runtime"]["source_tree"]["file_count"] == 2
|
|
assert first["components"]["persistent_memory"]["content"]["file_count"] == 1
|
|
encoded = json.dumps(first)
|
|
assert "super-secret-token" not in encoded
|
|
assert "private participant fact" not in encoded
|
|
assert '{"private":"conversation"}' not in encoded
|
|
|
|
|
|
def test_identity_config_rejects_nonboolean_smart_model_routing() -> None:
|
|
with pytest.raises(ValueError, match="smart_model_routing must be boolean"):
|
|
manifest.identity_config_projection({"smart_model_routing": {"route": "untrusted"}})
|
|
|
|
|
|
def test_behavior_manifest_changes_when_a_behavior_layer_changes(tmp_path: Path) -> None:
|
|
profile = tmp_path / "profile"
|
|
hermes = tmp_path / "hermes"
|
|
deployment = tmp_path / "deployment"
|
|
_write(profile / "config.yaml", "model:\n provider: openrouter\n default: model-a\n")
|
|
_write(profile / "SOUL.md", "identity-a\n")
|
|
_write(hermes / "run_agent.py", "runtime\n")
|
|
_write(hermes / "agent" / "prompt_builder.py", "prompts\n")
|
|
_write(deployment / "scripts" / "leo_behavior_manifest.py", "manifest\n")
|
|
_write(deployment / "scripts" / "leo_tool_trace.py", "tool trace\n")
|
|
|
|
before = manifest.build_manifest(profile, hermes, deployment)
|
|
_write(profile / "SOUL.md", "identity-b\n")
|
|
after = manifest.build_manifest(profile, hermes, deployment)
|
|
|
|
assert before["behavior_sha256"] != after["behavior_sha256"]
|
|
assert (
|
|
before["components"]["runtime_identity"]["content"]["sha256"]
|
|
!= after["components"]["runtime_identity"]["content"]["sha256"]
|
|
)
|
|
|
|
|
|
def test_behavior_manifest_hashes_content_behind_symlinks(tmp_path: Path) -> None:
|
|
profile = tmp_path / "profile"
|
|
hermes = tmp_path / "hermes"
|
|
deployment = tmp_path / "deployment"
|
|
target = tmp_path / "deployed-skill.md"
|
|
_write(profile / "config.yaml", "model:\n provider: test\n")
|
|
_write(profile / "SOUL.md", "identity\n")
|
|
_write(target, "version-a\n")
|
|
(profile / "skills").mkdir(parents=True)
|
|
(profile / "skills" / "SKILL.md").symlink_to(target)
|
|
_write(hermes / "run_agent.py", "runtime\n")
|
|
_write(hermes / "agent" / "prompt_builder.py", "prompts\n")
|
|
_write(deployment / "scripts" / "leo_behavior_manifest.py", "manifest\n")
|
|
_write(deployment / "scripts" / "leo_tool_trace.py", "tool trace\n")
|
|
|
|
before = manifest.build_manifest(profile, hermes, deployment)
|
|
_write(target, "version-b\n")
|
|
after = manifest.build_manifest(profile, hermes, deployment)
|
|
|
|
assert before["behavior_sha256"] != after["behavior_sha256"]
|
|
symlinks = after["components"]["procedural_skills"]["content"]["symlinks"]
|
|
assert symlinks[0]["path"] == "skills/SKILL.md"
|
|
assert symlinks[0]["target_fingerprint"]["kind"] == "symlink"
|
|
assert symlinks[0]["target_fingerprint"]["resolved"]["kind"] == "file"
|
|
|
|
|
|
def test_live_handler_harness_excludes_prior_dynamic_state_and_compares_live_fingerprints() -> None:
|
|
source = (ROOT / "scripts" / "run_leo_direct_claim_handler_suite.py").read_text(encoding="utf-8")
|
|
|
|
for directory in ("sessions", "state", "memories"):
|
|
assert f'"{directory}"' in source
|
|
assert '".skills_prompt_snapshot.json"' in source
|
|
assert "build_behavior_manifest" in source
|
|
assert 'report["changed_live_profile"] =' in source
|
|
assert '"changed_live_profile": False' not in source
|
|
|
|
|
|
def test_runtime_source_manifest_covers_nested_executable_sources(tmp_path: Path) -> None:
|
|
profile = tmp_path / "profile"
|
|
hermes = tmp_path / "hermes"
|
|
deployment = tmp_path / "deployment"
|
|
_write(profile / "config.yaml", "model:\n provider: test\n")
|
|
_write(profile / "SOUL.md", "identity\n")
|
|
_write(hermes / "run_agent.py", "runtime\n")
|
|
_write(hermes / "gateway" / "run.py", "gateway-a\n")
|
|
_write(hermes / "tools" / "terminal.py", "terminal-a\n")
|
|
_write(deployment / "scripts" / "leo_tool_trace.py", "trace-a\n")
|
|
_write(deployment / "ansible" / "roles" / "leo" / "tasks" / "main.yml", "---\n")
|
|
|
|
before = manifest.build_manifest(profile, hermes, deployment)
|
|
_write(deployment / "ops" / "new_runtime_helper.py", "helper-b\n")
|
|
after = manifest.build_manifest(profile, hermes, deployment)
|
|
|
|
assert before["hermes_runtime"]["source_tree"]["file_count"] == 3
|
|
assert before["teleo_infrastructure_runtime"]["source_tree"]["file_count"] == 2
|
|
assert after["teleo_infrastructure_runtime"]["source_tree"]["file_count"] == 3
|
|
assert (
|
|
before["teleo_infrastructure_runtime"]["source_tree"]["sha256"]
|
|
!= after["teleo_infrastructure_runtime"]["source_tree"]["sha256"]
|
|
)
|
|
|
|
|
|
def test_git_state_marks_untracked_files_dirty(tmp_path: Path) -> None:
|
|
subprocess.run(["git", "init", "-q", str(tmp_path)], check=True)
|
|
subprocess.run(["git", "-C", str(tmp_path), "config", "user.email", "test@example.com"], check=True)
|
|
subprocess.run(["git", "-C", str(tmp_path), "config", "user.name", "Test"], check=True)
|
|
_write(tmp_path / "tracked.py", "tracked\n")
|
|
subprocess.run(["git", "-C", str(tmp_path), "add", "tracked.py"], check=True)
|
|
subprocess.run(["git", "-C", str(tmp_path), "commit", "-qm", "fixture"], check=True)
|
|
|
|
assert manifest.git_state(tmp_path)["worktree_clean"] is True
|
|
_write(tmp_path / "untracked.py", "untracked\n")
|
|
state = manifest.git_state(tmp_path)
|
|
|
|
assert state["worktree_clean"] is False
|
|
assert len(str(state["status_sha256"])) == 64
|
|
|
|
|
|
def test_identity_runtime_omits_secret_values_but_pins_semantic_model_settings(tmp_path: Path) -> None:
|
|
profile = tmp_path / "profile"
|
|
hermes = tmp_path / "hermes"
|
|
deployment = tmp_path / "deployment"
|
|
config = """model:
|
|
provider: fixture
|
|
default: identity-v1
|
|
max_tokens: 512
|
|
gateway:
|
|
telegram:
|
|
bot_token: token-a
|
|
botToken: camel-token-a
|
|
provider:
|
|
apiKey: camel-api-key-a
|
|
transport:
|
|
endpoint: https://fixture-user:fixture-password-a@example.invalid/v1
|
|
headers: ['Authorization: Bearer fixture-header-a']
|
|
tools:
|
|
allowed: [identity_readback]
|
|
identity_runtime:
|
|
network_send_enabled: false
|
|
database_write_enabled: false
|
|
allowed_tools: [identity_readback]
|
|
"""
|
|
_write(profile / "config.yaml", config)
|
|
_write(profile / "skills" / "identity" / "SKILL.md", "identity\n")
|
|
_write(profile / "plugins" / "identity" / "__init__.py", "BOUNDARY = True\n")
|
|
_write(profile / "bin" / "identity.py", "READ_ONLY = True\n")
|
|
_write(hermes / "run_agent.py", "runtime\n")
|
|
_write(hermes / "agent" / "prompt_builder.py", "prompts\n")
|
|
for name in (
|
|
"leo_behavior_manifest.py",
|
|
"leo_identity_manifest.py",
|
|
"leo_identity_profile.py",
|
|
"run_leo_identity_reconstruction_canary.py",
|
|
):
|
|
_write(deployment / "scripts" / name, f"# {name}\n")
|
|
|
|
before = manifest.build_manifest(profile, hermes, deployment)
|
|
_write(
|
|
profile / "config.yaml",
|
|
config.replace("token-a", "token-b")
|
|
.replace("camel-api-key-a", "camel-api-key-b")
|
|
.replace("fixture-password-a", "fixture-password-b")
|
|
.replace("fixture-header-a", "fixture-header-b"),
|
|
)
|
|
secret_rotated = manifest.build_manifest(profile, hermes, deployment)
|
|
_write(profile / "config.yaml", config.replace("max_tokens: 512", "max_tokens: 1024"))
|
|
model_changed = manifest.build_manifest(profile, hermes, deployment)
|
|
|
|
assert before["behavior_sha256"] != secret_rotated["behavior_sha256"]
|
|
assert before["identity_runtime_sha256"] == secret_rotated["identity_runtime_sha256"]
|
|
assert before["identity_runtime_sha256"] != model_changed["identity_runtime_sha256"]
|
|
encoded = json.dumps(before)
|
|
assert "token-a" not in encoded
|
|
assert "camel-token-a" not in encoded
|
|
assert "camel-api-key-a" not in encoded
|
|
assert "fixture-password-a" not in encoded
|
|
assert "fixture-header-a" not in encoded
|