mini-openclaw-v2/backend/test_improvement_release.py

"""纠偏第四批 · 改进发布接到真实知识发布入口（BR-51 / AC-57）。

审计（audit.json）确认的偏差模式之一是「只改 `released` 状态或返回一个版本号」就当发布成功。
本测试走**真实执行链**证明发布真的生效：

    卡片草稿 → 隔离评测 → 独立审核发布 v1.0.0 → 真实运行（冻结 v1.0.0）
      → 提出改进候选（指向 v1.1.0 草稿）→ 旧/新对照 → 提交 → 他人审核
      → release（**不提交任何版本号**）→ 真实发布 v1.1.0，覆盖 release 指针
      → 再跑一次：新运行用 v1.1.0；回放第一次运行仍是 v1.0.0

反例同样锁死：客户端自报 `released_ref` 被 422 拒绝；候选指向未经评测的草稿时
发布被 409 拒绝且**不产生**新版本、不改指针；非知识类目标没有真实入口，诚实拒绝而非伪造。

不用注入记录；临时库；不触碰真实数据根。
"""

import os
import tempfile
import unittest
from pathlib import Path
from unittest.mock import patch

from fastapi import FastAPI
from fastapi.testclient import TestClient

from api import prescreen as prescreen_api
from api import project_assistant as api
from api import risk_agent_config as catalog
from services import assistant_store as store
from services import improvements, knowledge_cards, trajectory
from services.assistant_worker import DurableWorker
from services.project_assistant import ProjectAssistantService

PROJECT = "DEMO-B"
BASE = "/api/xingbang/risk-agent/project-assistant"
PRESCREEN = BASE + "/prescreen"
MANAGER = {"X-Xingbang-Demo-Role": "manager"}
REVIEWER = {"X-Xingbang-Demo-Role": "reviewer"}

CARD_ID = "skill.history.repayment"
V1 = "1.0.0"
V2 = "1.1.0"
CARD_CODE = "history.repayment.dependency"

# 自定义 Skill 的发布门禁要求独立测试样本（component_evaluation 的既有规则）
TEST_CASES = [
    {"name": "缺证样本", "values": {"financial.operating_cashflow": None},
     "expected_outputs": {}, "expected_checks": {CARD_CODE: "unknown"}},
    {"name": "已提供样本", "values": {"financial.operating_cashflow": "1200"},
     "expected_outputs": {}, "expected_checks": {CARD_CODE: "pass"}},
]

BASELINE = {"id": "assistant.current", "version": "1.0.0"}
CANDIDATE = {"id": "prescreen.v2", "version": "0.2.0"}


def sample(sample_id, *, baseline_pass=False, candidate_pass=True,
           predicted="2026-09-29T01:00:00+00:00", revealed="2026-09-29T03:00:00+00:00"):
    return {"id": sample_id, "split": "dev", "observed": True,
            "baseline_pass": baseline_pass, "candidate_pass": candidate_pass,
            "predicted_at": predicted, "label_revealed_at": revealed,
            "source_in_dev": False}


def improvement_evaluation():
    """一次独立、无泄漏、结论为 improved 的旧/新对照。"""
    return {"baseline_ref": BASELINE, "candidate_ref": CANDIDATE,
            "dataset_ref": "fixtures/cases/manifest.json", "split_ref": "split.v1",
            "independent": True,
            "samples": [sample("S-1", baseline_pass=False),
                        sample("S-2", baseline_pass=True)]}


class ImprovementReleaseTests(unittest.TestCase):
    def setUp(self):
        self.temp = tempfile.TemporaryDirectory(ignore_cleanup_errors=True)
        self.path = Path(self.temp.name)
        self.service = ProjectAssistantService(self.path / "assistant.sqlite3")
        self.patches = [
            patch.object(api, "service", lambda: self.service),
            patch.object(prescreen_api, "_service", lambda: self.service),
            patch.object(catalog, "DB_PATH", self.path / "catalog.sqlite3"),
            patch.dict(os.environ, {"XINGBANG_AUTH_USERS": "", "XINGBANG_REQUIRE_AUTH": "0",
                                    "XINGBANG_LOCAL_MODEL_URL": "", "XINGBANG_DEMO_ROLE_LOGIN": "1"}),
        ]
        for item in self.patches:
            item.start()
        self.worker = DurableWorker(self.service)
        app = FastAPI()
        app.include_router(api.router)
        app.include_router(prescreen_api.router)
        self.client = TestClient(app)

    def tearDown(self):
        self.worker.stop()
        self.client.close()
        for item in reversed(self.patches):
            item.stop()
        self.temp.cleanup()

    # ------------------------------------------------------------ 工具
    def call(self, method, path, body=None, headers=MANAGER, root=PRESCREEN):
        return self.client.request(method, root + path, json=body, headers=headers)

    def draft_card(self, version):
        """人工新增一个该组件的新版本草稿（不走模型，故不受模型未配置影响）。"""
        with self.service.connect() as db:
            return knowledge_cards.propose(db, {
                "id": CARD_ID, "version": version, "kind": "skill",
                "name": "核查回款集中依赖", "engine": "required",
                "inputs": ["financial.operating_cashflow"],
                "code": CARD_CODE, "title": "核查回款集中依赖",
                "test_cases": TEST_CASES,
            }, "demo-manager", PROJECT, origin="history_derived", source_event_ids=["event-1"])

    def publish_v1_and_run_once(self):
        """发布 v1.0.0、装配方案并真实跑一次，返回（已发布方案 id, 第一次运行）。"""
        self.draft_card(V1)
        published = self.call("POST", f"/knowledge-candidates/{CARD_ID}/transitions",
                              {"action": "evaluate"}, REVIEWER)
        self.assertEqual(published.status_code, 200, published.text)
        published = self.call("POST", f"/knowledge-candidates/{CARD_ID}/transitions",
                              {"action": "publish"}, headers=REVIEWER)
        self.assertEqual(published.status_code, 200, published.text)
        self.assertEqual(published.json()["version"], V1)

        plan = self.call("POST", f"/projects/{PROJECT}/review-plans", {
            "name": "含历史经验卡的预审方案",
            "skills": ["corporate.consistency", "corporate.cashflow", "corporate.assets",
                       "corporate.coverage", CARD_ID],
            "rules": ["demo.coverage"], "template": "template.ai-pre-review",
            "budget": {"timeout_seconds": 180, "max_tool_calls": 18},
            "audience": ["manager"], "run_kind": "pre_review"})
        self.assertEqual(plan.status_code, 201, plan.text)
        plan_id = plan.json()["component_id"]
        self.assertEqual(self.call("POST", f"/review-plans/{plan_id}/transitions",
                                   {"action": "evaluate"}, REVIEWER).status_code, 200)
        self.assertEqual(self.call("POST", f"/review-plans/{plan_id}/transitions",
                                   {"action": "publish"}, REVIEWER).status_code, 200)
        return plan_id, self.run_with(plan_id)

    def run_with(self, plan_id):
        queued = self.call("POST", f"/projects/{PROJECT}/runs",
                           {"requirement": "核对回款与现金流", "plan_id": plan_id}, root=BASE)
        self.assertIn(queued.status_code, (200, 202), queued.text)
        run_id = queued.json()["id"]
        self.assertTrue(self.worker.process_next(), "队列里应当有一次待执行运行")
        with self.service.connect() as db:
            return store.get(db, "run", run_id)

    @staticmethod
    def checks_of(run, code):
        return [check for step in run["steps"] for check in step.get("findings", [])
                if check.get("code") == code]

    def released_version(self):
        with self.service.connect() as db:
            return store.get(db, "release", CARD_ID)["version_id"]

    def propose_improvement(self, *, target="knowledge", revision_ref=None, actor=MANAGER,
                            source_run_id=None):
        body = {"target": target,
                "target_ref": {"id": CARD_ID, "version": V1},
                "proposed_revision_ref": revision_ref or {"id": CARD_ID, "version": V2},
                "change_summary": "把回款集中依赖的核查口径扩到制造业设备直租",
                "source_run_ids": [source_run_id] if source_run_id else ["run-1"]}
        created = self.call("POST", f"/projects/{PROJECT}/improvements", body, actor)
        self.assertEqual(created.status_code, 201, created.text)
        return created.json()

    def approve(self, candidate, actor=REVIEWER):
        """对照评测 → 提交 → 由**另一位**身份通过审核。"""
        evaluated = self.call("POST", f"/improvements/{candidate['id']}/transitions",
                              {"action": "evaluate", "evaluation": improvement_evaluation()})
        self.assertEqual(evaluated.status_code, 200, evaluated.text)
        self.assertEqual(evaluated.json()["status"], "ready", evaluated.text)
        self.assertEqual(self.call("POST", f"/improvements/{candidate['id']}/transitions",
                                   {"action": "submit"}).status_code, 200)
        approved = self.call("POST", f"/improvements/{candidate['id']}/transitions",
                             {"action": "approve"}, actor)
        self.assertEqual(approved.status_code, 200, approved.text)
        self.assertEqual(approved.json()["status"], "approved")
        return approved.json()

    # ------------------------------------------------------------ AC-57
    def test_release_publishes_the_real_version_and_old_run_still_replays(self):
        plan_id, run_old = self.publish_v1_and_run_once()
        old_refs = {(item["id"], item["version"]) for item in run_old["component_versions"]}
        self.assertIn((CARD_ID, V1), old_refs, "第一次运行应冻结 v1.0.0")
        self.assertEqual(self.released_version(), f"{CARD_ID}@{V1}")

        # 1) 新版本草稿 + 隔离评测（发布门禁，与候选的旧/新对照是两道不同的门）
        self.draft_card(V2)
        evaluated = self.call("POST", f"/knowledge-candidates/{CARD_ID}/transitions",
                              {"action": "evaluate"}, REVIEWER)
        self.assertEqual(evaluated.status_code, 200, evaluated.text)

        # 2) 改进候选：对照 → 提交 → 他人审核 → 发布（**请求体不含任何版本号**）
        candidate = self.propose_improvement(source_run_id=run_old["id"])
        self.approve(candidate)
        released = self.call("POST", f"/improvements/{candidate['id']}/transitions",
                             {"action": "release"}, REVIEWER)
        self.assertEqual(released.status_code, 200, released.text)
        body = released.json()
        self.assertEqual(body["status"], "released")
        # 版本引用由服务端从真实发布结果产生
        self.assertEqual(body["released_ref"], {"id": CARD_ID, "version": V2})

        # 3) 发布真的生效：release 指针被覆盖，不可变版本已落库
        self.assertEqual(self.released_version(), f"{CARD_ID}@{V2}")
        with self.service.connect() as db:
            versions = {row["id"] for row in store.listing(db, "component_version")}
        self.assertIn(f"{CARD_ID}@{V2}", versions, "必须真的写入不可变组件版本")

        # 4) 新运行使用新版本（同一个已发布方案，无需重装）
        run_new = self.run_with(plan_id)
        new_refs = {(item["id"], item["version"]) for item in run_new["component_versions"]}
        self.assertIn((CARD_ID, V2), new_refs, "新运行必须取到新版本")
        new_checks = self.checks_of(run_new, CARD_CODE)
        self.assertEqual(len(new_checks), 1, "新版本必须真的产生核查项")
        self.assertEqual(new_checks[0]["basis_ids"], [f"{CARD_ID}@{V2}"])

        # 5) 旧运行仍可回放，且冻结的版本没有被新发布改写
        with self.service.connect() as db:
            replayed = trajectory.replay(db, PROJECT, run_old["id"])
            reread = store.get(db, "run", run_old["id"])
        step = next(item for item in replayed["steps"]
                    if (item["component_ref"] or {}).get("id") == CARD_ID)
        self.assertEqual(step["component_ref"]["version"], V1,
                         "旧运行回放必须仍是发布前的版本")
        self.assertEqual({(item["id"], item["version"]) for item in reread["component_versions"]},
                         old_refs, "旧运行的冻结版本不得被新发布改写")
        self.assertTrue(replayed["read_only"])

    def test_client_supplied_version_is_rejected_and_changes_nothing(self):
        """自报 `released_ref` 不得让候选变成已发布，也不得凭空造出组件版本。"""
        candidate = self.propose_improvement()
        self.approve(candidate)

        forged = self.call("POST", f"/improvements/{candidate['id']}/transitions",
                           {"action": "release",
                            "released_ref": {"id": CARD_ID, "version": "9.9.9"}}, REVIEWER)
        self.assertEqual(forged.status_code, 422, forged.text)
        self.assertEqual(forged.json()["error"]["code"], "INVALID_REQUEST")

        with self.service.connect() as db:
            stored = store.get(db, improvements.KIND, candidate["id"])
            versions = {row["id"] for row in store.listing(db, "component_version")}
        self.assertEqual(stored["status"], "approved", "拒绝后候选状态不得前进")
        self.assertIsNone(stored["released_ref"])
        self.assertNotIn(f"{CARD_ID}@9.9.9", versions)

    def test_release_keeps_the_previous_version_when_the_draft_was_not_evaluated(self):
        """未过隔离评测的草稿不得被发布；失败时保留旧版（发布不是"改状态"）。"""
        _, run_old = self.publish_v1_and_run_once()
        self.assertEqual(self.released_version(), f"{CARD_ID}@{V1}")
        self.draft_card(V2)                      # 只建草稿，**不做**隔离评测

        candidate = self.propose_improvement(source_run_id=run_old["id"])
        self.approve(candidate)
        refused = self.call("POST", f"/improvements/{candidate['id']}/transitions",
                            {"action": "release"}, REVIEWER)
        self.assertEqual(refused.status_code, 409, refused.text)
        self.assertEqual(refused.json()["error"]["code"], "IMPROVEMENT_NOT_VALIDATED")

        self.assertEqual(self.released_version(), f"{CARD_ID}@{V1}", "发布失败必须保留旧版")
        with self.service.connect() as db:
            versions = {row["id"] for row in store.listing(db, "component_version")}
            stored = store.get(db, improvements.KIND, candidate["id"])
        self.assertNotIn(f"{CARD_ID}@{V2}", versions, "未评测的版本不得落库")
        self.assertEqual(stored["status"], "approved", "失败时候选状态不得前进")

    def test_unsupported_target_is_refused_instead_of_faked(self):
        """题库/编排尚无真实发布入口：诚实拒绝，不用改状态冒充发布。"""
        candidate = self.propose_improvement(target="question_profile")
        self.approve(candidate)
        refused = self.call("POST", f"/improvements/{candidate['id']}/transitions",
                            {"action": "release"}, REVIEWER)
        self.assertEqual(refused.status_code, 409, refused.text)
        self.assertIn("尚无真实发布入口", refused.json()["error"]["message"])
        with self.service.connect() as db:
            stored = store.get(db, improvements.KIND, candidate["id"])
        self.assertNotEqual(stored["status"], "released")
        self.assertIsNone(stored["released_ref"])


if __name__ == "__main__":
    unittest.main()