Jj<dZddlmZddlZddlmcmZddl Z ddl Z ddl m Z ddl mZddlZddlmZddlmZmZmZddlmZmZmZmZej6d"d Zd#d Zd$d Zd%d Zd%d Z d%dZ!d%dZ"d%dZ#d%dZ$d%dZ%d%dZ&d%dZ'd%dZ(d%dZ)d%dZ*d%dZ+d%dZ,d%dZ-d%dZ.d%dZ/d&dZ0d&dZ1d&dZ2d&d Z3d&d!Z4y)'u Tests for the audit hash chain. Every test here must FAIL when the control it names stops working. A green suite that cannot go red proves nothing, which is the failure mode this file exists to avoid — it is the same rule the mutation harness in `scripts/` applies to the F4 controls. ) annotationsN)Path)AnySQLiteDatabase)GENESISAuditEventTypeAuditLog) TamperClasscanonical_event_bytescompute_event_hash verify_chainct|dz S)Nz audit.sqlite3r)tmp_paths 8/home/oem/CyberBrain26-unified/tests/test_audit_chain.pydbr$s (_4 55c idd|ddddd|zdd d d d d d ddddd|ddddddddddddddddddddd}|j||S)zEA minimal chain-shaped record, so tests read as data not as plumbing.event_idaudit_016x event_type tool_called timestampg@TAactorzagent-1agent_idtask_idztask-1modeltoolactionrun-resourcepolicy_decision approval_idresultstartederrorresource_usage_jsonz{} latency_msgnetwork_actionrecorded) memory_writesecurity_alert metadata_jsonstatus)update)seq overridesbases r_rowr5)s  fSJ' m  _s*     I   8       D,  B  2  r  )    t  c! " "# $+ D. KK  Krcg}t}td|dzD]<}t|}||d<||d<t|||d<|d}|j |>|S)z?Build a valid chain of ``count`` records starting from genesis.r2 prev_hash entry_hash)rranger5r append)countrowsprevr2rows r_chainr@Fsp!#D DQ "3iE K.sD9L<  C  Krctdtjddd}tdtjddd}tddd}tddd}||k(}|st j d|fd ||fd t jvst j|rt j|nd d t jvst j|rt j|nd d z}d d|iz}tt j|d}g}|d}d}||k7} | } | r|d} d} | | k7} | } | st j d| fd||ft j|t j|dz}dd|iz}|j|| r_t j d fd  ft j| t j| dz}dd|iz}|j|t j|diz}dd|iz}tt j|dx} x}x}x} x}x} x} } y)uKey order in the source dict must not change the digest. Otherwise two semantically identical records hash differently and a clean log reads as tampered — a false positive that would destroy trust in the signal. r7)alphabeta)r/)rDrC)xy)rFrE==)z%(py0)s == %(py2)sleftright)py0py2zassert %(py4)spy4Nr/r!=)z%(py3)s != %(py6)s)py3py6z%(py8)spy8)z%(py11)s != %(py14)s)py11py14z%(py16)spy16rzassert %(py19)spy19)r5jsondumpsr @pytest_ar_call_reprcompare @py_builtinslocals_should_repr_global_name _safereprAssertionError_format_explanationr;_format_boolop)abrIrJ @py_assert1 @py_format3 @py_format5 @py_assert2 @py_assert5 @py_assert4 @py_assert0 @py_assert10 @py_assert13 @py_assert12 @py_format7 @py_format9 @py_format15 @py_format17 @py_format18 @py_format20s r-test_canonical_bytes_stable_across_dict_orderrtYss Qdjj1a)@ABA Qdjj!a)@ABA !qq!1 2D !"2 3E 5=454455@1_ @@  #@/(:@b@(:b(@@@@ @@@ @@@@@@@@@@(:b@@@(:@@@b@@@@@@@@@@@@@@rc \ddi}t|}ddi}t|}||k(}|s&tjd|fd||fdtjvstj trtj tndtj |tj |dtjvstj trtj tndtj |tj |dz}dd |iz}ttj|d x}x}x}x}}dd i}t|}ddi}t|}||k7}|s&tjd |fd ||fdtjvstj trtj tndtj |tj |dtjvstj trtj tndtj |tj |dz}dd |iz}ttj|d x}x}x}x}}y )aAn integral float must hash as an int, so a SQLite round-trip cannot lie. SQLite has no distinct int/float storage: a value written as ``5.0`` can read back as ``5``. Hashing the raw value would make an untouched record fail re-verification. ng@rG)zP%(py4)s {%(py4)s = %(py0)s(%(py2)s) } == %(py10)s {%(py10)s = %(py6)s(%(py8)s) }r rKrLrMrQrRpy10assert %(py12)spy12Ng@rNzP%(py4)s {%(py4)s = %(py0)s(%(py2)s) } != %(py10)s {%(py10)s = %(py6)s(%(py8)s) }) r rYrZr[r\r]r^r_r`)rd @py_assert3 @py_assert7 @py_assert9rh @py_format11 @py_format13s r)test_canonical_normalises_integral_floatsrks#&sO  ,OsAhO0Eh0OO ,0O OOOO ,0OOOOOOO OOO OOOOOO ,OOOOOO0EOOO0EOOOhOOO0OOOOOOOO"%sO  ,OsAhO0Eh0OO ,0O OOOO ,0OOOOOOO OOO OOOOOO ,OOOOOO0EOOO0EOOOhOOO0OOOOOOOOOrc ddi}t|}ddi}t|}||k7}|s&tjd|fd||fdtjvstj trtj tndtj |tj |dtjvstj trtj tndtj |tj |dz}dd |iz}ttj|d x}x}x}x}}tjtddid}d}||u}|sltjd |fd ||ftj |tj |d z} dd| iz} ttj| d x}x}}y )zL``True`` is a subclass of ``int``; normalising it would silently corrupt it.flagTr7rNr|r rxrzr{Nisz%(py1)s is %(py4)spy1rMassert %(py6)srQ) r rYrZr[r\r]r^r_r`rWloads) rdr}r~rrhrrrjrgrfrns r3test_canonical_does_not_collapse_booleans_into_intsrws."($V  0V6ST+V4I+4VV 04V VVVV 04VVVVVVV VVV VVVVVV 0VVVVVV4IVVV4IVVV+VVV4VVVVVVVV ::+VTN; z*test_golden_link_vector..s71q&&7sz,assert %(py4)s {%(py4)s = %(py0)s(%(py2)s) }all)rKrLrM) r5r rrrYrZr[r\r]r^r_r`r) r?rrgrhrirnrordr}rfs rtest_golden_link_vectorrs q'C W -F v;";" ;"33vv;"77737 77 777777377737777777 7777777rcfttd}|j}d}||u}|stjd|fd||fdt j vstj|rtj|ndtj|tj|dz}dd|iz}ttj|dx}x}}|j}d}||u}|stjd|fd ||fdt j vstj|rtj|ndtj|tj|dz}dd|iz}ttj|dx}x}}|j}d}||u}|stjd|fd ||fdt j vstj|rtj|ndtj|tj|dz}dd|iz}ttj|dx}x}}|j}d}||k(}|stjd |fd ||fdt j vstj|rtj|ndtj|tj|dz}dd|iz}ttj|dx}x}}y) NrwTrz.%(py2)s {%(py2)s = %(py0)s.intact } is %(py5)sreportrKrLrassert %(py7)spy7z2%(py2)s {%(py2)s = %(py0)s.linkage_ok } is %(py5)sz4%(py2)s {%(py2)s = %(py0)s.integrity_ok } is %(py5)srGz7%(py2)s {%(py2)s = %(py0)s.records_checked } == %(py5)s)rr@intactrYrZr[r\r]r^r_r` linkage_ok integrity_okrecords_checkedrrdrir} @py_format6 @py_format8s rtest_clean_chain_verifiesrs &) $F == D =D    =D      6   6   =   D         $$  $$$$ $$$$$$6$$$6$$$ $$$$$$$$$$   &$& $ &&&& $&&&&&&6&&&6&&& &&&$&&&&&&&  ! !&Q& !Q &&&& !Q&&&&&&6&&&6&&& !&&&Q&&&&&&&rc(td}d|dd<t|}|j}d}||u}|stjd|fd||fdt j vstj|rtj|ndtj|tj|d z}d d |iz}ttj|dx}x}}|j}d}||u}|stjd|fd ||fdt j vstj|rtj|ndtj|tj|d z}d d |iz}ttj|dx}x}}|j}tj}||u}|stjd|fd ||fdt j vstj|rtj|ndtj|dt j vstjtrtjtndtj|dz}dd|iz} ttj| dx}x}}|j}d}||k(}|stjd|fd||fdt j vstj|rtj|ndtj|tj|d z}d d |iz}ttj|dx}x}}y)Ntamperedr7r&FrrrrrrrzW%(py2)s {%(py2)s = %(py0)s.tamper_class } is %(py6)s {%(py6)s = %(py4)s.IN_PLACE_EDIT }r rKrLrMrQrrRrBrGz8%(py2)s {%(py2)s = %(py0)s.first_broken_seq } == %(py5)s)r@rrrYrZr[r\r]r^r_r`r tamper_classr IN_PLACE_EDITfirst_broken_seq r=rrdrir}rrrhrnros r test_chain_detects_in_place_editrs !9D"DGH $ F ==!E!=E !!!!=E!!!!!!6!!!6!!!=!!!E!!!!!!!   '%' % '''' %''''''6'''6''' '''%'''''''   ;+";";; "; ;;;; ";;;;;;;6;;;6;;; ;;;;;;+;;;+;;;";;;;;;;;  " "'a' "a '''' "a''''''6'''6''' "'''a'''''''rc d}d}||z}t|k(}|stjd|fdt|fdtjvstj trtj tndtj |tj |dz}dd|iz}ttj|d x}x}x}}tt}d}||k(}|stjd|fd ||fd tjvstj trtj tnd dtjvstj trtj tndtj |tj |d z}dd|iz}ttj|d x}x}}tt}dh}||k(}|stjd|fd ||fd tjvstj trtj tnd dtjvstj trtj tndtj |tj |d z}dd|iz}ttj|d x}x}}y )aGPin the anchor value. Every writer and every verifier resolves genesis from this constant, so if it changed, both sides would move together and every chain would still verify. Nothing else in the suite would notice. The anchor is what makes a truncated prefix fail, so the value itself has to be asserted. 0rrG)z%(py0)s == (%(py3)s * %(py5)s)r)rKrPrrrRNrrrset) rrYrZr[r\r]r^r_r`rr)rgri @py_assert6rdrnrorhs r test_genesis_is_sixty_four_zerosrsBcBh7h 7h77cB w<2<2 <233ww<2 w< C5 <5    <5      3   3      w   w   <   5       rctd}|d=t}|D]}||d<t|||d<|d}|Dcgc]}|d }}gd}||k(}|sltjd|fd||ftj |tj |d z}d d |iz}t tj|d x}x}}t|} | j} d } | | u}|stjd|fd| | fdtjvstj| rtj | ndtj | tj | dz} tjddzd| iz} t tj| d x} x}} | j} tj }| |u}|stjd|fd| |fdtjvstj| rtj | ndtj | dtjvstjtrtj tndtj |dz}dd|iz}t tj|d x} x}}y cc}w)uA silently bridged chain must still fail — via sequence continuity. This is the laundering the retention rule forbids: drop a record and relink everything after it, so every ``prev_hash`` again matches and the digest of every row recomputes. Pointer checking alone passes this. Only a monotonic ``seq`` shows that a record went missing — and if it does not, a purge can quietly launder a finding. rr7r8r9r2)r7rrGz%(py1)s == %(py4)srrrQNFrrrrz1a relinked chain that lost a record must not passz >assert %(py7)srzR%(py2)s {%(py2)s = %(py0)s.tamper_class } is %(py6)s {%(py6)s = %(py4)s.DELETION }r rrrR)r@rr rYrZr^r_r`rrr[r\r]_format_assertmsgrr DELETION)r=r>r?rrjr}rgrfrnrrdrirrrhros r)test_relinked_chain_still_reveals_the_gaprs !9D Q D!K.sD9L< ! # #AeH #0 #y0 #y 0000 #y000 #000y0000000 $ F ==VEV=E !VVV=EVVVVVV6VVV6VVV=VVVEVVV#VVVVVVVV   6+"6"66 "6 6666 "666666666666666 666666+666+666"66666666 $s K ctd}|d=t|}|j}d}||u}|stjd|fd||fdt j vstj|rtj|ndtj|tj|dz}dd |iz}ttj|dx}x}}|j}d}||u}|stjd|fd ||fdt j vstj|rtj|ndtj|tj|dz}dd |iz}ttj|dx}x}}|j}tj}||u}|stjd|fd ||fdt j vstj|rtj|ndtj|d t j vstjtrtjtnd tj|d z}dd|iz} ttj| dx}x}}y)Nrr7Frrrrrrrrr rrrR)r@rrrYrZr[r\r]r^r_r`rrr rrs rtest_chain_detects_deletionrs !9D Q $ F ==!E!=E !!!!=E!!!!!!6!!!6!!!=!!!E!!!!!!!   %%  %%%% %%%%%%6%%%6%%% %%%%%%%%%%   6+"6"66 "6 6666 "666666666666666 666666+666+666"66666666rctd}|d|dc|d<|d<t|}|j}d}||u}|stjd|fd||fdt j vstj|rtj|ndtj|tj|dz}d d |iz}ttj|dx}x}}|j}tj}||u}|stjd|fd ||fdt j vstj|rtj|ndtj|d t j vstjtrtjtnd tj|d z}dd|iz} ttj| dx}x}}y)NrrBr7Frrrrrr)zT%(py2)s {%(py2)s = %(py0)s.tamper_class } is %(py6)s {%(py6)s = %(py4)s.REORDERING }r rrrR)r@rrrYrZr[r\r]r^r_r`rr REORDERINGrs rtest_chain_detects_reorderingrs8 !9DAwQDGT!W $ F ==!E!=E !!!!=E!!!!!!6!!!6!!!=!!!E!!!!!!!   8+"8"88 "8 8888 "888888868886888 888888+888+888"88888888rctddd}t|}|j}d}||u}|stjd|fd||fdt j vstj|rtj|ndtj|tj|dz}d d |iz}ttj|dx}x}}|j}tj}||u}|stjd|fd ||fdt j vstj|rtj|ndtj|d t j vstjtrtjtnd tj|d z}dd|iz} ttj| dx}x}}|j}d}||k(}|stjd|fd||fdt j vstj|rtj|ndtj|tj|dz}d d |iz}ttj|dx}x}}y)u:Removing the first record must break, thanks to the genesis anchor. Without genesis an attacker could lop off the head and present the remainder as a complete history. The break surfaces at the first *surviving* record, which is seq 2 — that is where the dangling ``prev_hash`` becomes visible. rr7NFrrrrrr)z[%(py2)s {%(py2)s = %(py0)s.tamper_class } is %(py6)s {%(py6)s = %(py4)s.PREFIX_TRUNCATION }r rrrRrBrGr)r@rrrYrZr[r\r]r^r_r`rr PREFIX_TRUNCATIONrrs r$test_chain_detects_prefix_truncationrs !9QR=D $ F ==!E!=E !!!!=E!!!!!!6!!!6!!!=!!!E!!!!!!!   ?+"?"?? "? ???? "???????6???6??? ??????+???+???"????????  " "'a' "a '''' "a''''''6'''6''' "'''a'''''''rc\td}d|dd<t|}|j}d}||u}|stjd|fd||fdt j vstj|rtj|ndtj|tj|d z}d d |iz}ttj|d x}x}}|j}d }||u}|stjd|fd||fdt j vstj|rtj|ndtj|tj|d z}d d |iz}ttj|d x}x}}y )zA linked chain with an edited field is not the same finding as a broken link. Collapsing both into one boolean hides which attack occurred, which is the whole reason they are two fields. rrr7r&TrrrrrrNFr) r@rrrYrZr[r\r]r^r_r`rr=rrdrir}rrs r2test_linkage_and_integrity_are_reported_separatelyrs  !9D"DGH $ F   $$  $$$$ $$$$$$6$$$6$$$ $$$$$$$$$$   '%' % '''' %''''''6'''6''' '''%'''''''rcptd}d|dd<d|dd<t|}|j}d}||k(}|stjd|fd ||fd t j vstj|rtj|nd tj|tj|d z}d d |iz}ttj|dx}x}}|j}d}||k(}|stjd|fd||fd t j vstj|rtj|nd tj|tj|d z}d d |iz}ttj|dx}x}}y)zRecords after a break inherit an untrustworthy predecessor. Reporting every downstream mismatch would overstate the damage: only the first divergence is a reliable fact. rr7r&z also-tamperedrrBrGrrrrrNr) r@rrrYrZr[r\r]r^r_r`rrs r test_verify_stops_at_first_breakr s !9D"DGH'DGH $ F  " "'a' "a '''' "a''''''6'''6''' "'''a'''''''  ! !&Q& !Q &&&& !Q&&&&&&6&&&6&&& !&&&Q&&&&&&&rcltd}d|dd<d|dd<t|}|j}d}||u}|stjd|fd||fd t j vstj|rtj|nd tj|tj|d z}d d |iz}ttj|dx}x}}|j}d }||u}|stjd|fd||fd t j vstj|rtj|nd tj|tj|d z}d d |iz}ttj|dx}x}}y)zA log that predates the chain must NOT verify as clean. Treating "never chained" as a pass is the failure mode where a green result proves nothing about history it never covered. rNrr9r8FrrrrrrT)z:%(py2)s {%(py2)s = %(py0)s.unverified_premise } is %(py5)s) r@rrrYrZr[r\r]r^r_r`unverified_premisers r!test_unchained_head_is_not_intactrs !9D DGLDGK $ F ==!E!=E !!!!=E!!!!!!6!!!6!!!=!!!E!!!!!!!  $ $,, $ ,,,, $,,,,,,6,,,6,,, $,,,,,,,,,,rc8tg}|j}d}||u}|stjd|fd||fdt j vstj |rtj|ndtj|tj|dz}dd|iz}ttj|dx}x}}|j}d }||k(}|stjd |fd ||fdt j vstj |rtj|ndtj|tj|dz}dd|iz}ttj|dx}x}}y) uLAn empty log is vacuously intact — and the report says it checked nothing.TrrrrrrNrrGr) rrrYrZr[r\r]r^r_r`rrs r+test_empty_log_is_intact_and_checks_nothingr,s " F == D =D    =D      6   6   =   D        ! !&Q& !Q &&&& !Q&&&&&&6&&&6&&& !&&&Q&&&&&&&rc"td}|djdt|}|j}d}||u}|st j d|fd||fdt jvst j|rt j|ndt j|t j|dz}d d |iz}tt j|d x}x}}|j}tj}||u}|st j d|fd ||fdt jvst j|rt j|ndt j|d t jvst jtrt jtnd t j|dz}dd|iz} tt j| d x}x}}y )z;A record with no sequence number has an undefined position.rr7r2FrrrrrrN)zV%(py2)s {%(py2)s = %(py0)s.tamper_class } is %(py6)s {%(py6)s = %(py4)s.MISSING_LINK }r rrrR)r@poprrrYrZr[r\r]r^r_r`rr MISSING_LINKrs r(test_missing_seq_is_reported_not_skippedr4s, !9DGKK $ F ==!E!=E !!!!=E!!!!!!6!!!6!!!=!!!E!!!!!!!   :+":":: ": :::: ":::::::6:::6::: ::::::+:::+:::"::::::::rct|}|jtjd|jtjd|jtjd|j }|Dcgc]}|d }}gd}||k(}|slt j d|fd||ft j|t j|d z}d d |iz}tt j|d x}x}}|d d}|tk(}|st j d|fd|tft j|dtjvst jtrt jtnddz} dd| iz} tt j| d x}}|dd}|d d}||k(}|slt j d|fd||ft j|t j|d z}d d |iz}tt j|d x}x}}|j} | }|j} d} | | u}|st j d|fd| | fdtjvst j|rt j|ndt j| t j|t j| t j| dz}dd|iz}tt j|d x} x}x} x}} y cc}w)zEach write continues from the current head rather than from genesis. A second producer starting at genesis orphans everything before it, and the gap reads as a clean start instead of the break it is. rbr!rcrr2)r7rBrrGrrrrQNrr8)z%(py1)s == %(py3)sr)rrPzassert %(py5)srr7r9Trzg%(py6)s {%(py6)s = %(py4)s {%(py4)s = %(py2)s {%(py2)s = %(py0)s.verify_chain }() }.intact } is %(py9)sauditrKrLrMrQpy9assert %(py11)srS)r recordr TOOL_CALLED chain_rowsrYrZr^r_r`rr[r\r]rr)rrr=rrjr}rgrfrn @py_format4rrdrh @py_assert8r~ @py_format10 @py_format12s r"test_append_does_not_restart_chainrDs* RLE LL++CL8 LL++CL8 LL++CL8    D" #AeH #0 #y0 #y 0000 #y000 #000y0000000 7; * 7 **** 7*** ******7***7******* 7; 847<#88 #8 8888 #8888 888#88888888   .  .  & &.$. &$ .... &$......5...5... ... ... &...$........ $s Mcvt|}tdD]&}|jtjd|(|j }|}|j }d}||u}|stjd|fd||fdtjvstj|rtj|ndtj|tj|tj|tj|dz}d d |iz} ttj| d x}x}x}x}}|j5} | j!d d d d |j } | j }d } || u}|stjd|fd|| fdtjvstj| rtj| ndtj|tj| dz} dd| iz}ttj|d x}x}} | j"}t$j&}||u}|stjd|fd||fdtjvstj| rtj| ndtj|dtjvstjt$rtjt$ndtj|dz}dd|iz}ttj|d x}x}}| j(}d} || k(}|stjd|fd|| fdtjvstj| rtj| ndtj|tj| dz} dd| iz}ttj|d x}x}} y #1swYxYw)zAThe chain must catch an edit made directly in SQL, below the API.rr"rTrrrrrrSNz5UPDATE audit_events SET result='tampered' WHERE seq=2Frrrrrrr rrrRrBrGr)r r:rr rrrrYrZr[r\r]r^r_r` transactionexecuterr rr)rrirdr}rhrr~rr connectionrrirrrnros r+test_persisted_chain_detects_a_tampered_rowrVs RLE 1XD ^//$qc CD   .  .  & &.$. &$ .... &$......5...5... ... ... &...$.......  TZRST   !F ==!E!=E !!!!=E!!!!!!6!!!6!!!=!!!E!!!!!!!   ;+";";; "; ;;;; ";;;;;;;6;;;6;;; ;;;;;;+;;;+;;;";;;;;;;;  " "'a' "a '''' "a''''''6'''6''' "'''a''''''' TTs P..P8cBt|}tjdz }|jtjd|j 5}|j d|fddd|jtjd|j}|j}d}||u}|stjd|fd ||fd tjvstj|rtj|nd tj|tj|d z}d d |iz} ttj | dx}x}}|j#tj|j%D cgc]} | j&dk(s| } } t)| } d} | | k(}|s tjd|fd| | fdtjvstjt(rtjt(nddtjvstj| rtj| ndtj| tj| dz}tj*ddzd|iz}ttj |dx} x}} | d}|j,} d} | | k(}|stjd|fd| | ftj|tj| tj| dz}dd|iz}ttj |dx}x} x}} | dj.d}d}||u} | sltjd| fd||ftj|tj|d z}d!d"|iz}ttj |dx}x} }y#1swYxYwcc} w)#u$Retention is a deadline and must not be refused — but it must not be silent. When the chain is already broken, the purge writes a chained event naming what it removed. That event cannot be deleted without breaking the chain that names it, so the finding outlives the rows. oldr/UPDATE audit_events SET timestamp=? WHERE seq=1Nznew-1Frrbeforerrrnowchain_range_purgedr7rGrrmarkersrzpurge must leave a markerz >assert %(py8)srRrpurged_over_unexplained_breakz.%(py3)s {%(py3)s = %(py1)s.result } == %(py6)srrPrQrchain_intact_before_purgerrrrQ)r timerr rrrrrrYrZr[r\r]r^r_r` prune_expired_load_persistedr!rrr&metadata)rrrrrrdrir}rrerrgrhrnrorjrfs r'test_prune_records_the_range_it_removedr fs RLE ))+* *C LL++EL:  VZLsfUV LL++GL<    !F ==!E!=E !!!!=E!!!!!!6!!!6!!!=!!!E!!!!!!! DIIK(//1VQQXXAU5UqVGV w<919<1 999<199999939993999999w999w999<999199999999999 1:?:  ? ??  ? ????  ????:??? ??? ???????? 1:  : ;DuD ;u DDDD ;uDDD ;DDDuDDDDDDDVVWsPP3PPc > t|}|jtjd|jtjdt jdz }|j 5}|j d|fddlm}ddlm }t|j d j}||jDcic]\}}|| c}}|} |j d || ft|j d j} || jDcic]\}}|| c}}| } |j d | | fd d d |j} | } | j}d}||u}|stj d|fd||fdt#j$vstj&|rtj(|ndtj(| tj(| tj(|tj(|dz}dd|iz}t+tj,|d x} x} x}x}}|j/t j|j1Dcgc]}|j2dk(s|}}t5|}d}||k(}|stj d|fd||fdt#j$vstj&t4rtj(t4nddt#j$vstj&|rtj(|ndtj(|tj(|dz}dd|iz}t+tj,|d x}x}}|d}|j6}d}||k(}|stj d|fd ||ftj(|tj(|tj(|d!z}dd|iz}t+tj,|d x}x}x}}|dj8d"}d} || u}|sltj d|fd#|| ftj(|tj(| d$z}d%d&|iz}t+tj,|d x}x}} y cc}}wcc}}w#1swYxYwcc}w)'u1An unbroken chain purged by retention is recorded as a clean removal. Ageing a record means changing its timestamp, and timestamp is hashed — so the chain has to be relinked afterwards. That is not a contrivance: it is exactly what the absence of any "edit a stored record" API is for. agedrfreshrrr)r)r z&SELECT * FROM audit_events WHERE seq=1z=UPDATE audit_events SET prev_hash=?, entry_hash=? WHERE seq=1z&SELECT * FROM audit_events WHERE seq=2z=UPDATE audit_events SET prev_hash=?, entry_hash=? WHERE seq=2NTrrrrrrSrrr7rGrrrrrrRpurgedrrrrrrrQ)r rr rrrr'cyberbrain26.security_plane.audit.chainrr rfetchoneitemsrrrYrZr[r\r]r^r_r`rrr!rr&r)rrrrGcehrow1kvh1row2h2rdr}rhrr~rrr rrgrirnrorjrfs r'test_clean_prune_records_a_clean_markerrs RLE LL++FL; LL++GL< ))+* *C   Z =v   J&&'OPYY[\ 4::<041a!Q$0! 4 KaQSW J&&'OPYY[\ 4::<041a!Q$0" 5 KbRTX ' .   .  .  & &.$. &$ .... &$......5...5... ... ... &...$....... DIIK(//1VQQXXAU5UqVGV w<1<1 <133ww<1 1:(:  ((  (((( (((:((( (((((((((( 1:  : ;CtC ;t CCCC ;tCCC ;CCCtCCCCCCC#1 1%  6Ws85AT  T AT 9 T T 'T<T T  Tc  t|}|jtjd|jtjd|j t|}|j }|}|j }d}||u}|s2tjd|fd||fdtjvstjtrtjtnddtjvstj|rtj|ndtj|tj|tj|tj|tj|d z}d d |iz} ttj| d x}x}x}x}x}}t|}|j}|}d } || k(}|stjd|fd|| fdtjvstjtrtjtnddtjvstj|rtj|ndtj|tj|tj|tj| dz} dd| iz}ttj|d x}x}x}x}} d} g}tj}|j }|} |sd}|} | | v}|s'ddtjvstjtrtjtndtj|tj|dz}|j#||s+ddtj|iz}|j#|tj$|diz}tjd|fd| | ftj| |dz}dd|iz}ttj|d x} x}x} x}x}x}}y )u``clear()`` destroys what the chain exists to protect; that must be stated. It cannot be reported afterwards — there is nothing left to verify — so the honest thing is for the method to say so rather than look like a no-op. rbrrcTr)z%(py9)s {%(py9)s = %(py7)s {%(py7)s = %(py5)s {%(py5)s = %(py3)s {%(py3)s = %(py0)s(%(py1)s) }.verify_chain }() }.intact } is %(py12)sr r)rKrrPrrrr{zassert %(py14)srTNrrG)zc%(py7)s {%(py7)s = %(py5)s {%(py5)s = %(py3)s {%(py3)s = %(py0)s(%(py1)s) }.count }() } == %(py10)s)rKrrPrrryrzr{zNOT a chain operationrz?%(py9)s {%(py9)s = %(py7)s {%(py7)s = %(py5)s.clear }.__doc__ })rrrz%(py12)sr7)in)z%(py1)s in (%(py15)s))rpy15zassert %(py17)spy17)r rr rclearrrrYrZr[r\r]r^r_r`r<__doc__r;ra)rrrgrirr @py_assert11rkrrprrrjr}r @py_format14 @py_format16rrs r.test_clear_is_documented_as_severing_the_chainr$s RLE LL++CL8 LL++CL8 KKM B<5< $ $5 $ &5 & - -55 - 5555 -55555585558555555B555B555<555 $555 &555 -55555555555 B<$<  $  $1$ 1 $$$$ 1$$$$$$8$$$8$$$$$$B$$$B$$$<$$$ $$$ $$$1$$$$$$$ "Dx~~D~'='=D'=D'=DD "D DDDDDDDxDDDxDDD~DDD'=DDDD'=DDDDDDDDDDDD "DDD "DDDDDDDDr)rrreturnr)r2intr3rr%zdict[str, Any])r<r&r%zlist[dict[str, Any]])r%None)rrr%r')5r  __future__rbuiltinsr[_pytest.assertion.rewrite assertionrewriterYrWrpathlibrtypingrpytest$cyberbrain26.data_plane.sqlite_storer!cyberbrain26.security_plane.auditrr r rr r r rfixturerr5r@rtrrrrrrrrrrrrrrrrrrr rr$rrrr3s#  ? 66: &A$ PM M 8"' ( !7<79 ( ( ' - '; /$ ( E2*DZEr