feat: establish Quant OS production-80 architecture
This commit is contained in:
@@ -0,0 +1,954 @@
|
||||
import copy
|
||||
import hashlib
|
||||
import json
|
||||
import sys
|
||||
import tempfile
|
||||
import unittest
|
||||
from pathlib import Path
|
||||
|
||||
|
||||
PROJECT = Path(__file__).resolve().parents[1]
|
||||
sys.path.insert(0, str(PROJECT / "src"))
|
||||
|
||||
from quant_os.architecture import validate_architecture
|
||||
from quant_os.evidence.maturity import (
|
||||
MaturityStandardError,
|
||||
_final_assessment_digest,
|
||||
_pre_canary_projection_digest,
|
||||
evaluate_assessment,
|
||||
load_json_object,
|
||||
validate_standard,
|
||||
)
|
||||
|
||||
|
||||
PROFILE = PROJECT / "profiles/production-80/standard.json"
|
||||
ASSESSMENT = PROJECT / "profiles/production-80/current-assessment.json"
|
||||
|
||||
|
||||
class QuantOsMaturityTests(unittest.TestCase):
|
||||
def setUp(self):
|
||||
self.standard = load_json_object(PROFILE)
|
||||
self.assessment = load_json_object(ASSESSMENT)
|
||||
|
||||
@staticmethod
|
||||
def _frozen_subject():
|
||||
return {
|
||||
"candidate_id": "candidate-test-v1",
|
||||
"release_sha256": "1" * 64,
|
||||
"model_sha256": "2" * 64,
|
||||
"dataset_sha256": "3" * 64,
|
||||
"account_scope_id": "broker-account-pseudonym",
|
||||
"material_change_epoch": 0,
|
||||
}
|
||||
|
||||
@staticmethod
|
||||
def _trusted_test_verifier(claim, control, source):
|
||||
trusted = (
|
||||
claim.get("attestation")
|
||||
== {"method": "unit-test-trust-boundary"}
|
||||
and source.is_file()
|
||||
and claim.get("control_id") == control["id"]
|
||||
)
|
||||
return {
|
||||
"trusted": trusted,
|
||||
"trust_environment": "test",
|
||||
"verifier_id": "unit-test-verifier",
|
||||
"issuer_id": "unit-test-issuer",
|
||||
"key_fingerprint_sha256": "9" * 64,
|
||||
"policy_version": "unit-test-policy-v1",
|
||||
}
|
||||
|
||||
def _write_claim(
|
||||
self,
|
||||
root,
|
||||
*,
|
||||
control_id,
|
||||
tier,
|
||||
subject,
|
||||
evidence_type="control_acceptance_evidence",
|
||||
assessment_sha256=None,
|
||||
observed_as_of="2026-06-30",
|
||||
extra=None,
|
||||
):
|
||||
claims = root / "claims"
|
||||
claims.mkdir(exist_ok=True)
|
||||
claim = {
|
||||
"schema_version": "quant-os-evidence-claim/1.0",
|
||||
"claim_id": f"claim-{control_id.lower()}",
|
||||
"control_id": control_id,
|
||||
"tier": tier,
|
||||
"subject": subject,
|
||||
"standard_id": self.standard["standard_id"],
|
||||
"standard_canonical_sha256": self.assessment[
|
||||
"standard_canonical_sha256"
|
||||
],
|
||||
"evidence_type": evidence_type,
|
||||
"authority_class": "unit_test_only",
|
||||
"observed_as_of": observed_as_of,
|
||||
"source_hashes": ["4" * 64],
|
||||
"attestation": {"method": "unit-test-trust-boundary"},
|
||||
}
|
||||
if assessment_sha256 is not None:
|
||||
claim["assessment_sha256"] = assessment_sha256
|
||||
if extra is not None:
|
||||
claim.update(extra)
|
||||
path = claims / f"{control_id.lower()}.json"
|
||||
path.write_text(
|
||||
json.dumps(claim, sort_keys=True),
|
||||
encoding="utf-8",
|
||||
)
|
||||
return {
|
||||
"path": path.relative_to(root).as_posix(),
|
||||
"tier": tier,
|
||||
"sha256": hashlib.sha256(path.read_bytes()).hexdigest(),
|
||||
}
|
||||
|
||||
def _prepare_qualified_assessment(
|
||||
self,
|
||||
root,
|
||||
passing_controls,
|
||||
*,
|
||||
canary_days=10,
|
||||
attestation_kind="qualification",
|
||||
):
|
||||
assessment = copy.deepcopy(self.assessment)
|
||||
subject = self._frozen_subject()
|
||||
assessment["subject"] = subject
|
||||
baseline_profile = load_json_object(
|
||||
PROJECT / "profiles/baseline-60/profile.json"
|
||||
)
|
||||
baseline_root = root / "profiles" / "baseline-60"
|
||||
baseline_root.mkdir(parents=True)
|
||||
(baseline_root / "profile.json").write_text(
|
||||
json.dumps(baseline_profile, sort_keys=True),
|
||||
encoding="utf-8",
|
||||
)
|
||||
baseline_verification = self._write_claim(
|
||||
root,
|
||||
control_id="BASELINE_60",
|
||||
tier="E3",
|
||||
subject=subject,
|
||||
evidence_type="baseline60_qualification_attestation",
|
||||
extra={
|
||||
"baseline_profile_id": "quant-os-baseline-60",
|
||||
"baseline_profile_canonical_sha256": self.assessment[
|
||||
"baseline_60"
|
||||
]["profile_canonical_sha256"],
|
||||
"gates_passed": 10,
|
||||
"gates_total": 10,
|
||||
"score": 60,
|
||||
},
|
||||
)
|
||||
assessment["baseline_60"] = {
|
||||
"all_gates_passed": True,
|
||||
"gates_passed": 10,
|
||||
"gates_total": 10,
|
||||
"profile_id": "quant-os-baseline-60",
|
||||
"profile_canonical_sha256": self.assessment["baseline_60"][
|
||||
"profile_canonical_sha256"
|
||||
],
|
||||
"verification": baseline_verification,
|
||||
}
|
||||
assessment["observations"] = {
|
||||
"real_qmt_observed": True,
|
||||
"broker_programmatic_confirmation": True,
|
||||
"shadow_trading_days": 60,
|
||||
"canary_trading_days": canary_days,
|
||||
"open_p0": 0,
|
||||
"open_p1": 0,
|
||||
}
|
||||
for control in assessment["controls"]:
|
||||
if (
|
||||
control["id"] in passing_controls
|
||||
and control["id"] != "D6-CANARY"
|
||||
):
|
||||
standard_control = next(
|
||||
item
|
||||
for domain in self.standard["domains"]
|
||||
for item in domain["controls"]
|
||||
if item["id"] == control["id"]
|
||||
)
|
||||
control["status"] = "passed"
|
||||
control["evidence"] = [
|
||||
self._write_claim(
|
||||
root,
|
||||
control_id=control["id"],
|
||||
tier=standard_control["minimum_evidence_tier"],
|
||||
subject=subject,
|
||||
)
|
||||
]
|
||||
if attestation_kind not in {"qualification", "pre_canary"}:
|
||||
raise AssertionError(f"unknown attestation kind {attestation_kind}")
|
||||
assessment["pre_canary_attestation"] = self._write_claim(
|
||||
root,
|
||||
control_id="PRE_CANARY_AUTHORIZATION",
|
||||
tier="E3",
|
||||
subject=subject,
|
||||
evidence_type="pre_canary_authorization_attestation",
|
||||
assessment_sha256=_pre_canary_projection_digest(assessment),
|
||||
observed_as_of="2026-07-01",
|
||||
extra={
|
||||
"authorization_id": (
|
||||
"claim-pre_canary_authorization"
|
||||
),
|
||||
"authorized_at": "2026-07-01",
|
||||
"expires_on": "2026-08-31",
|
||||
"account_scope_id": subject["account_scope_id"],
|
||||
"strategy_ids": [subject["candidate_id"]],
|
||||
"maximum_capital_cny": 100000,
|
||||
"maximum_gross_notional_cny": 80000,
|
||||
"maximum_symbols": 2,
|
||||
"symbol_allowlist": [
|
||||
"000001.XSHE",
|
||||
"600000.XSHG",
|
||||
],
|
||||
"flow_limits": {
|
||||
"maximum_submission_and_cancel_requests_per_second": 2,
|
||||
"maximum_submission_and_cancel_requests_per_day": 50,
|
||||
},
|
||||
"stop_conditions": [
|
||||
"any_risk_data_rule_or_reconciliation_breach",
|
||||
"authorization_expired",
|
||||
"operator_kill_switch",
|
||||
],
|
||||
"no_automatic_scale_up": True,
|
||||
},
|
||||
)
|
||||
if "D6-CANARY" in passing_controls:
|
||||
canary_control = next(
|
||||
control
|
||||
for control in assessment["controls"]
|
||||
if control["id"] == "D6-CANARY"
|
||||
)
|
||||
canary_control["status"] = "passed"
|
||||
canary_control["evidence"] = [
|
||||
self._write_claim(
|
||||
root,
|
||||
control_id="D6-CANARY",
|
||||
tier="E4",
|
||||
subject=subject,
|
||||
evidence_type="controlled_live_canary_observation",
|
||||
observed_as_of="2026-07-15",
|
||||
extra={
|
||||
"pre_canary_authorization_claim_id": (
|
||||
"claim-pre_canary_authorization"
|
||||
),
|
||||
"pre_canary_authorization_sha256": assessment[
|
||||
"pre_canary_attestation"
|
||||
]["sha256"],
|
||||
"canary_started_on": "2026-07-02",
|
||||
"canary_ended_on": "2026-07-15",
|
||||
"trading_days_observed": canary_days,
|
||||
"maximum_capital_cny_observed": 75000,
|
||||
"maximum_gross_notional_cny_observed": 60000,
|
||||
"symbols_observed": [
|
||||
"000001.XSHE",
|
||||
"600000.XSHG",
|
||||
],
|
||||
"maximum_submission_and_cancel_requests_per_second_observed": 2,
|
||||
"maximum_submission_and_cancel_requests_per_day_observed": 40,
|
||||
"automatic_scale_up_observed": False,
|
||||
"breach_events": [],
|
||||
"stop_events": [],
|
||||
},
|
||||
)
|
||||
]
|
||||
if attestation_kind == "qualification":
|
||||
assessment["qualification_attestation"] = self._write_claim(
|
||||
root,
|
||||
control_id="QUALIFICATION",
|
||||
tier="E4",
|
||||
subject=subject,
|
||||
evidence_type="production80_promotion_attestation",
|
||||
assessment_sha256=_final_assessment_digest(assessment),
|
||||
observed_as_of="2026-07-16",
|
||||
)
|
||||
return assessment
|
||||
|
||||
def test_profile_is_exactly_weighted_and_current_claim_is_blocked(self):
|
||||
summary = validate_standard(self.standard)
|
||||
self.assertEqual(summary["maximum_score"], 100)
|
||||
self.assertEqual(summary["domain_weight_total"], 100)
|
||||
self.assertEqual(summary["qualification_threshold"], 80)
|
||||
self.assertEqual(summary["domain_count"], 7)
|
||||
self.assertEqual(summary["hard_gate_count"], 21)
|
||||
self.assertEqual(summary["hard_gate_weight_total"], 80)
|
||||
result = evaluate_assessment(
|
||||
self.standard,
|
||||
self.assessment,
|
||||
repository_root=PROJECT,
|
||||
)
|
||||
self.assertEqual(result["raw_score"], 0)
|
||||
self.assertEqual(result["effective_score"], 0)
|
||||
self.assertFalse(result["baseline_60_passed"])
|
||||
self.assertFalse(result["qualified"])
|
||||
self.assertEqual(
|
||||
result["qualification_state"],
|
||||
"BLOCKED_FROM_LIMITED_LIVE",
|
||||
)
|
||||
self.assertTrue(result["hard_gate_failures"])
|
||||
self.assertEqual(
|
||||
set(result["domain_floor_failures"]),
|
||||
{f"D{index}" for index in range(1, 8)},
|
||||
)
|
||||
|
||||
def test_a_pass_without_hashed_evidence_is_rejected(self):
|
||||
assessment = copy.deepcopy(self.assessment)
|
||||
assessment["controls"][0]["status"] = "passed"
|
||||
with self.assertRaisesRegex(
|
||||
MaturityStandardError,
|
||||
"without immutable evidence",
|
||||
):
|
||||
evaluate_assessment(
|
||||
self.standard,
|
||||
assessment,
|
||||
repository_root=PROJECT,
|
||||
)
|
||||
|
||||
def test_all_controls_form_a_test_only_structural_path(self):
|
||||
with tempfile.TemporaryDirectory() as temporary:
|
||||
root = Path(temporary)
|
||||
passing_controls = {
|
||||
control["id"]
|
||||
for domain in self.standard["domains"]
|
||||
for control in domain["controls"]
|
||||
}
|
||||
assessment = self._prepare_qualified_assessment(
|
||||
root,
|
||||
passing_controls,
|
||||
)
|
||||
result = evaluate_assessment(
|
||||
self.standard,
|
||||
assessment,
|
||||
repository_root=root,
|
||||
trusted_evidence_verifier=self._trusted_test_verifier,
|
||||
)
|
||||
self.assertEqual(result["effective_score"], 100)
|
||||
self.assertFalse(result["qualified"])
|
||||
self.assertTrue(result["structurally_eligible"])
|
||||
self.assertTrue(result["final_attestation_verified"])
|
||||
self.assertFalse(result["trusted_attestation_verified"])
|
||||
self.assertTrue(result["test_only"])
|
||||
self.assertTrue(result["canary_authorization_chain_verified"])
|
||||
self.assertEqual(
|
||||
result["qualification_state"],
|
||||
"TEST_ONLY_STRUCTURAL_PASS",
|
||||
)
|
||||
|
||||
def test_exactly_eighty_points_is_a_structural_path_only(self):
|
||||
hard_controls = {
|
||||
control["id"]
|
||||
for domain in self.standard["domains"]
|
||||
for control in domain["controls"]
|
||||
if control["hard_gate"]
|
||||
}
|
||||
with tempfile.TemporaryDirectory() as temporary:
|
||||
root = Path(temporary)
|
||||
assessment = self._prepare_qualified_assessment(
|
||||
root,
|
||||
hard_controls,
|
||||
)
|
||||
result = evaluate_assessment(
|
||||
self.standard,
|
||||
assessment,
|
||||
repository_root=root,
|
||||
trusted_evidence_verifier=self._trusted_test_verifier,
|
||||
)
|
||||
self.assertEqual(result["raw_score"], 80)
|
||||
self.assertEqual(result["effective_score"], 80)
|
||||
self.assertFalse(result["qualified"])
|
||||
self.assertEqual(
|
||||
result["qualification_state"],
|
||||
"TEST_ONLY_STRUCTURAL_PASS",
|
||||
)
|
||||
|
||||
def test_structural_score_cannot_self_attest_without_trusted_verifier(self):
|
||||
hard_controls = {
|
||||
control["id"]
|
||||
for domain in self.standard["domains"]
|
||||
for control in domain["controls"]
|
||||
if control["hard_gate"]
|
||||
}
|
||||
with tempfile.TemporaryDirectory() as temporary:
|
||||
root = Path(temporary)
|
||||
assessment = self._prepare_qualified_assessment(
|
||||
root,
|
||||
hard_controls,
|
||||
)
|
||||
with self.assertRaisesRegex(
|
||||
MaturityStandardError,
|
||||
"trusted evidence verifier",
|
||||
):
|
||||
evaluate_assessment(
|
||||
self.standard,
|
||||
assessment,
|
||||
repository_root=root,
|
||||
)
|
||||
|
||||
def test_pre_canary_requires_a_separate_trusted_authorization(self):
|
||||
pre_canary_controls = {
|
||||
control["id"]
|
||||
for domain in self.standard["domains"]
|
||||
for control in domain["controls"]
|
||||
if control["hard_gate"] and control["id"] != "D6-CANARY"
|
||||
}
|
||||
with tempfile.TemporaryDirectory() as temporary:
|
||||
root = Path(temporary)
|
||||
assessment = self._prepare_qualified_assessment(
|
||||
root,
|
||||
pre_canary_controls,
|
||||
canary_days=0,
|
||||
attestation_kind="pre_canary",
|
||||
)
|
||||
result = evaluate_assessment(
|
||||
self.standard,
|
||||
assessment,
|
||||
repository_root=root,
|
||||
trusted_evidence_verifier=self._trusted_test_verifier,
|
||||
)
|
||||
self.assertEqual(result["raw_score"], 77)
|
||||
self.assertFalse(result["qualified"])
|
||||
self.assertFalse(result["pre_canary_authorized"])
|
||||
self.assertTrue(result["pre_canary_attestation_verified"])
|
||||
self.assertEqual(
|
||||
result["pre_canary_authorization"]["claim_id"],
|
||||
"claim-pre_canary_authorization",
|
||||
)
|
||||
self.assertEqual(
|
||||
result["qualification_state"],
|
||||
"TEST_ONLY_PRE_CANARY_PASS",
|
||||
)
|
||||
|
||||
def test_pre_canary_authorization_survives_running_day_updates(self):
|
||||
pre_canary_controls = {
|
||||
control["id"]
|
||||
for domain in self.standard["domains"]
|
||||
for control in domain["controls"]
|
||||
if control["hard_gate"] and control["id"] != "D6-CANARY"
|
||||
}
|
||||
with tempfile.TemporaryDirectory() as temporary:
|
||||
root = Path(temporary)
|
||||
assessment = self._prepare_qualified_assessment(
|
||||
root,
|
||||
pre_canary_controls,
|
||||
canary_days=0,
|
||||
attestation_kind="pre_canary",
|
||||
)
|
||||
assessment["observations"]["canary_trading_days"] = 5
|
||||
result = evaluate_assessment(
|
||||
self.standard,
|
||||
assessment,
|
||||
repository_root=root,
|
||||
trusted_evidence_verifier=self._trusted_test_verifier,
|
||||
)
|
||||
self.assertTrue(result["pre_canary_attestation_verified"])
|
||||
self.assertEqual(
|
||||
result["qualification_state"],
|
||||
"TEST_ONLY_PRE_CANARY_PASS",
|
||||
)
|
||||
|
||||
def test_expired_pre_canary_authorization_cannot_open_or_continue_canary(self):
|
||||
pre_canary_controls = {
|
||||
control["id"]
|
||||
for domain in self.standard["domains"]
|
||||
for control in domain["controls"]
|
||||
if control["hard_gate"] and control["id"] != "D6-CANARY"
|
||||
}
|
||||
with tempfile.TemporaryDirectory() as temporary:
|
||||
root = Path(temporary)
|
||||
assessment = self._prepare_qualified_assessment(
|
||||
root,
|
||||
pre_canary_controls,
|
||||
canary_days=0,
|
||||
attestation_kind="pre_canary",
|
||||
)
|
||||
assessment["assessed_as_of"] = "2026-09-01"
|
||||
result = evaluate_assessment(
|
||||
self.standard,
|
||||
assessment,
|
||||
repository_root=root,
|
||||
trusted_evidence_verifier=self._trusted_test_verifier,
|
||||
)
|
||||
self.assertFalse(
|
||||
result["pre_canary_authorization_valid_as_of_assessment"]
|
||||
)
|
||||
self.assertEqual(
|
||||
result["pre_canary_authorization"]["validity_status"],
|
||||
"expired",
|
||||
)
|
||||
self.assertFalse(result["canary_running"])
|
||||
self.assertEqual(
|
||||
result["qualification_state"],
|
||||
"TEST_ONLY_PRE_CANARY_EXPIRED",
|
||||
)
|
||||
|
||||
def test_completed_canary_chain_survives_authorization_expiry(self):
|
||||
hard_controls = {
|
||||
control["id"]
|
||||
for domain in self.standard["domains"]
|
||||
for control in domain["controls"]
|
||||
if control["hard_gate"]
|
||||
}
|
||||
with tempfile.TemporaryDirectory() as temporary:
|
||||
root = Path(temporary)
|
||||
assessment = self._prepare_qualified_assessment(
|
||||
root,
|
||||
hard_controls,
|
||||
)
|
||||
assessment["assessed_as_of"] = "2026-09-01"
|
||||
final_link = assessment["qualification_attestation"]
|
||||
final_path = root / final_link["path"]
|
||||
final_claim = json.loads(final_path.read_text(encoding="utf-8"))
|
||||
final_claim["assessment_sha256"] = _final_assessment_digest(
|
||||
assessment
|
||||
)
|
||||
final_path.write_text(
|
||||
json.dumps(final_claim, sort_keys=True),
|
||||
encoding="utf-8",
|
||||
)
|
||||
final_link["sha256"] = hashlib.sha256(
|
||||
final_path.read_bytes()
|
||||
).hexdigest()
|
||||
result = evaluate_assessment(
|
||||
self.standard,
|
||||
assessment,
|
||||
repository_root=root,
|
||||
trusted_evidence_verifier=self._trusted_test_verifier,
|
||||
)
|
||||
self.assertFalse(
|
||||
result["pre_canary_authorization_valid_as_of_assessment"]
|
||||
)
|
||||
self.assertTrue(result["canary_authorization_chain_verified"])
|
||||
self.assertTrue(result["structurally_eligible"])
|
||||
self.assertEqual(
|
||||
result["qualification_state"],
|
||||
"TEST_ONLY_STRUCTURAL_PASS",
|
||||
)
|
||||
|
||||
def test_canary_observation_must_stay_within_authorized_hard_caps(self):
|
||||
hard_controls = {
|
||||
control["id"]
|
||||
for domain in self.standard["domains"]
|
||||
for control in domain["controls"]
|
||||
if control["hard_gate"]
|
||||
}
|
||||
mutations = (
|
||||
(
|
||||
"capital",
|
||||
{"maximum_capital_cny_observed": 100001},
|
||||
"authorized capital caps",
|
||||
),
|
||||
(
|
||||
"gross_notional",
|
||||
{"maximum_gross_notional_cny_observed": 80001},
|
||||
"authorized capital caps",
|
||||
),
|
||||
(
|
||||
"symbol",
|
||||
{"symbols_observed": ["300001.XSHE"]},
|
||||
"authorized symbol caps",
|
||||
),
|
||||
(
|
||||
"flow",
|
||||
{
|
||||
"maximum_submission_and_cancel_requests_per_second_observed": 3
|
||||
},
|
||||
"authorized flow caps",
|
||||
),
|
||||
(
|
||||
"automatic_scale_up",
|
||||
{"automatic_scale_up_observed": True},
|
||||
"automatic scale-up",
|
||||
),
|
||||
)
|
||||
for name, mutation, expected in mutations:
|
||||
with self.subTest(name=name), tempfile.TemporaryDirectory() as temporary:
|
||||
root = Path(temporary)
|
||||
assessment = self._prepare_qualified_assessment(
|
||||
root,
|
||||
hard_controls,
|
||||
)
|
||||
canary = next(
|
||||
control
|
||||
for control in assessment["controls"]
|
||||
if control["id"] == "D6-CANARY"
|
||||
)
|
||||
evidence = canary["evidence"][0]
|
||||
path = root / evidence["path"]
|
||||
claim = json.loads(path.read_text(encoding="utf-8"))
|
||||
claim.update(mutation)
|
||||
path.write_text(
|
||||
json.dumps(claim, sort_keys=True),
|
||||
encoding="utf-8",
|
||||
)
|
||||
evidence["sha256"] = hashlib.sha256(
|
||||
path.read_bytes()
|
||||
).hexdigest()
|
||||
with self.assertRaisesRegex(
|
||||
MaturityStandardError,
|
||||
expected,
|
||||
):
|
||||
evaluate_assessment(
|
||||
self.standard,
|
||||
assessment,
|
||||
repository_root=root,
|
||||
trusted_evidence_verifier=(
|
||||
self._trusted_test_verifier
|
||||
),
|
||||
)
|
||||
|
||||
def test_canary_breach_must_link_to_fail_closed_stop_event(self):
|
||||
hard_controls = {
|
||||
control["id"]
|
||||
for domain in self.standard["domains"]
|
||||
for control in domain["controls"]
|
||||
if control["hard_gate"]
|
||||
}
|
||||
with tempfile.TemporaryDirectory() as temporary:
|
||||
root = Path(temporary)
|
||||
assessment = self._prepare_qualified_assessment(
|
||||
root,
|
||||
hard_controls,
|
||||
)
|
||||
canary = next(
|
||||
control
|
||||
for control in assessment["controls"]
|
||||
if control["id"] == "D6-CANARY"
|
||||
)
|
||||
evidence = canary["evidence"][0]
|
||||
path = root / evidence["path"]
|
||||
claim = json.loads(path.read_text(encoding="utf-8"))
|
||||
claim["breach_events"] = [
|
||||
{
|
||||
"breach_id": "breach-1",
|
||||
"condition": (
|
||||
"any_risk_data_rule_or_reconciliation_breach"
|
||||
),
|
||||
"observed_on": "2026-07-08",
|
||||
"stop_event_id": "missing-stop",
|
||||
}
|
||||
]
|
||||
path.write_text(
|
||||
json.dumps(claim, sort_keys=True),
|
||||
encoding="utf-8",
|
||||
)
|
||||
evidence["sha256"] = hashlib.sha256(
|
||||
path.read_bytes()
|
||||
).hexdigest()
|
||||
with self.assertRaisesRegex(
|
||||
MaturityStandardError,
|
||||
"not linked to an authorized stop",
|
||||
):
|
||||
evaluate_assessment(
|
||||
self.standard,
|
||||
assessment,
|
||||
repository_root=root,
|
||||
trusted_evidence_verifier=self._trusted_test_verifier,
|
||||
)
|
||||
|
||||
def test_canary_breach_with_fail_closed_stop_event_is_accepted(self):
|
||||
hard_controls = {
|
||||
control["id"]
|
||||
for domain in self.standard["domains"]
|
||||
for control in domain["controls"]
|
||||
if control["hard_gate"]
|
||||
}
|
||||
with tempfile.TemporaryDirectory() as temporary:
|
||||
root = Path(temporary)
|
||||
assessment = self._prepare_qualified_assessment(
|
||||
root,
|
||||
hard_controls,
|
||||
)
|
||||
canary = next(
|
||||
control
|
||||
for control in assessment["controls"]
|
||||
if control["id"] == "D6-CANARY"
|
||||
)
|
||||
evidence = canary["evidence"][0]
|
||||
path = root / evidence["path"]
|
||||
claim = json.loads(path.read_text(encoding="utf-8"))
|
||||
claim["breach_events"] = [
|
||||
{
|
||||
"breach_id": "breach-1",
|
||||
"condition": (
|
||||
"any_risk_data_rule_or_reconciliation_breach"
|
||||
),
|
||||
"observed_on": "2026-07-08",
|
||||
"stop_event_id": "stop-1",
|
||||
}
|
||||
]
|
||||
claim["stop_events"] = [
|
||||
{
|
||||
"stop_event_id": "stop-1",
|
||||
"condition": (
|
||||
"any_risk_data_rule_or_reconciliation_breach"
|
||||
),
|
||||
"triggered_on": "2026-07-08",
|
||||
"trading_stopped": True,
|
||||
"automatic_resume": False,
|
||||
}
|
||||
]
|
||||
path.write_text(
|
||||
json.dumps(claim, sort_keys=True),
|
||||
encoding="utf-8",
|
||||
)
|
||||
evidence["sha256"] = hashlib.sha256(
|
||||
path.read_bytes()
|
||||
).hexdigest()
|
||||
final_link = assessment["qualification_attestation"]
|
||||
final_path = root / final_link["path"]
|
||||
final_claim = json.loads(final_path.read_text(encoding="utf-8"))
|
||||
final_claim["assessment_sha256"] = _final_assessment_digest(
|
||||
assessment
|
||||
)
|
||||
final_path.write_text(
|
||||
json.dumps(final_claim, sort_keys=True),
|
||||
encoding="utf-8",
|
||||
)
|
||||
final_link["sha256"] = hashlib.sha256(
|
||||
final_path.read_bytes()
|
||||
).hexdigest()
|
||||
result = evaluate_assessment(
|
||||
self.standard,
|
||||
assessment,
|
||||
repository_root=root,
|
||||
trusted_evidence_verifier=self._trusted_test_verifier,
|
||||
)
|
||||
self.assertTrue(result["canary_authorization_chain_verified"])
|
||||
self.assertEqual(
|
||||
result["canary_observation"]["breach_event_count"],
|
||||
1,
|
||||
)
|
||||
self.assertEqual(
|
||||
result["canary_observation"]["stop_event_count"],
|
||||
1,
|
||||
)
|
||||
self.assertEqual(
|
||||
result["qualification_state"],
|
||||
"TEST_ONLY_STRUCTURAL_PASS",
|
||||
)
|
||||
|
||||
def test_final_path_cannot_skip_pre_canary_history(self):
|
||||
hard_controls = {
|
||||
control["id"]
|
||||
for domain in self.standard["domains"]
|
||||
for control in domain["controls"]
|
||||
if control["hard_gate"]
|
||||
}
|
||||
with tempfile.TemporaryDirectory() as temporary:
|
||||
root = Path(temporary)
|
||||
assessment = self._prepare_qualified_assessment(
|
||||
root,
|
||||
hard_controls,
|
||||
)
|
||||
assessment["pre_canary_attestation"] = None
|
||||
result = evaluate_assessment(
|
||||
self.standard,
|
||||
assessment,
|
||||
repository_root=root,
|
||||
trusted_evidence_verifier=self._trusted_test_verifier,
|
||||
)
|
||||
self.assertFalse(result["qualified"])
|
||||
self.assertFalse(result["canary_authorization_chain_verified"])
|
||||
self.assertEqual(
|
||||
result["qualification_state"],
|
||||
"PENDING_PRE_CANARY_HISTORY",
|
||||
)
|
||||
|
||||
def test_canary_claim_must_reference_pre_authorization_hash(self):
|
||||
hard_controls = {
|
||||
control["id"]
|
||||
for domain in self.standard["domains"]
|
||||
for control in domain["controls"]
|
||||
if control["hard_gate"]
|
||||
}
|
||||
with tempfile.TemporaryDirectory() as temporary:
|
||||
root = Path(temporary)
|
||||
assessment = self._prepare_qualified_assessment(
|
||||
root,
|
||||
hard_controls,
|
||||
)
|
||||
canary = next(
|
||||
control
|
||||
for control in assessment["controls"]
|
||||
if control["id"] == "D6-CANARY"
|
||||
)
|
||||
evidence = canary["evidence"][0]
|
||||
path = root / evidence["path"]
|
||||
claim = json.loads(path.read_text(encoding="utf-8"))
|
||||
claim["pre_canary_authorization_sha256"] = "8" * 64
|
||||
path.write_text(json.dumps(claim, sort_keys=True), encoding="utf-8")
|
||||
evidence["sha256"] = hashlib.sha256(path.read_bytes()).hexdigest()
|
||||
with self.assertRaisesRegex(
|
||||
MaturityStandardError,
|
||||
"does not reference the verified authorization",
|
||||
):
|
||||
evaluate_assessment(
|
||||
self.standard,
|
||||
assessment,
|
||||
repository_root=root,
|
||||
trusted_evidence_verifier=self._trusted_test_verifier,
|
||||
)
|
||||
|
||||
def test_standard_hash_drift_rejects_old_assessment(self):
|
||||
standard = copy.deepcopy(self.standard)
|
||||
standard["domains"][0]["controls"][0]["acceptance"] += " changed"
|
||||
with self.assertRaisesRegex(
|
||||
MaturityStandardError,
|
||||
"canonical hash does not match",
|
||||
):
|
||||
evaluate_assessment(
|
||||
standard,
|
||||
self.assessment,
|
||||
repository_root=PROJECT,
|
||||
)
|
||||
|
||||
def test_boolean_verifier_cannot_issue_a_qualification(self):
|
||||
hard_controls = {
|
||||
control["id"]
|
||||
for domain in self.standard["domains"]
|
||||
for control in domain["controls"]
|
||||
if control["hard_gate"]
|
||||
}
|
||||
with tempfile.TemporaryDirectory() as temporary:
|
||||
root = Path(temporary)
|
||||
assessment = self._prepare_qualified_assessment(
|
||||
root,
|
||||
hard_controls,
|
||||
)
|
||||
with self.assertRaisesRegex(
|
||||
MaturityStandardError,
|
||||
"attestation is not trusted",
|
||||
):
|
||||
evaluate_assessment(
|
||||
self.standard,
|
||||
assessment,
|
||||
repository_root=root,
|
||||
trusted_evidence_verifier=lambda *_args: True,
|
||||
)
|
||||
|
||||
def test_repository_cannot_accept_a_fake_production_registry(self):
|
||||
hard_controls = {
|
||||
control["id"]
|
||||
for domain in self.standard["domains"]
|
||||
for control in domain["controls"]
|
||||
if control["hard_gate"]
|
||||
}
|
||||
|
||||
def fake_production_verifier(*_args):
|
||||
return {
|
||||
"trusted": True,
|
||||
"trust_environment": "production",
|
||||
"verifier_id": "forged-local-verifier",
|
||||
"issuer_id": "forged-local-issuer",
|
||||
"key_fingerprint_sha256": "7" * 64,
|
||||
"policy_version": "forged-v1",
|
||||
}
|
||||
|
||||
with tempfile.TemporaryDirectory() as temporary:
|
||||
root = Path(temporary)
|
||||
assessment = self._prepare_qualified_assessment(
|
||||
root,
|
||||
hard_controls,
|
||||
)
|
||||
with self.assertRaisesRegex(
|
||||
MaturityStandardError,
|
||||
"production verifier registry is not implemented",
|
||||
):
|
||||
evaluate_assessment(
|
||||
self.standard,
|
||||
assessment,
|
||||
repository_root=root,
|
||||
trusted_evidence_verifier=fake_production_verifier,
|
||||
)
|
||||
|
||||
def test_hard_gates_cannot_make_the_published_threshold_unattainable(self):
|
||||
standard = copy.deepcopy(self.standard)
|
||||
soft_control = next(
|
||||
control
|
||||
for domain in standard["domains"]
|
||||
for control in domain["controls"]
|
||||
if control["id"] == "D1-REDUNDANCY"
|
||||
)
|
||||
soft_control["hard_gate"] = True
|
||||
with self.assertRaisesRegex(
|
||||
MaturityStandardError,
|
||||
"hard-gate weights must exactly equal",
|
||||
):
|
||||
validate_standard(standard)
|
||||
|
||||
def test_hash_drift_is_rejected(self):
|
||||
assessment = copy.deepcopy(self.assessment)
|
||||
assessment["controls"][0]["status"] = "passed"
|
||||
assessment["controls"][0]["evidence"] = [
|
||||
{
|
||||
"path": "profiles/production-80/standard.json",
|
||||
"tier": "E4",
|
||||
"sha256": "0" * 64,
|
||||
}
|
||||
]
|
||||
with self.assertRaisesRegex(MaturityStandardError, "hash drift"):
|
||||
evaluate_assessment(
|
||||
self.standard,
|
||||
assessment,
|
||||
repository_root=PROJECT,
|
||||
)
|
||||
|
||||
def test_architecture_is_valid_and_forbidden_import_is_detected(self):
|
||||
current = validate_architecture(PROJECT / "src/quant_os")
|
||||
self.assertTrue(current["ok"], current["violations"])
|
||||
self.assertEqual(current["scope"], "new_namespace_only")
|
||||
self.assertEqual(current["package_root"], "src/quant_os")
|
||||
self.assertEqual(
|
||||
current["migration_state"],
|
||||
"transitioning_from_quant60_legacy",
|
||||
)
|
||||
with tempfile.TemporaryDirectory() as temporary:
|
||||
root = Path(temporary)
|
||||
for layer in current["layers"]:
|
||||
(root / layer).mkdir()
|
||||
(root / layer / "__init__.py").write_text("", encoding="utf-8")
|
||||
(root / "research" / "bad.py").write_text(
|
||||
"from quant_os.execution import submit\n",
|
||||
encoding="utf-8",
|
||||
)
|
||||
(root / "research" / "bad_relative.py").write_text(
|
||||
"from ..execution import submit\n",
|
||||
encoding="utf-8",
|
||||
)
|
||||
(root / "research" / "bad_from_root.py").write_text(
|
||||
"from quant_os import execution\n",
|
||||
encoding="utf-8",
|
||||
)
|
||||
(root / "control" / "bad_vendor.py").write_text(
|
||||
"from xtquant import xttrader\n",
|
||||
encoding="utf-8",
|
||||
)
|
||||
(root / "research" / "bad_legacy.py").write_text(
|
||||
"from quant60.experiment import run\n"
|
||||
"from adapters.jqdata_local import load\n"
|
||||
"from platforms.qlib_runner import main\n",
|
||||
encoding="utf-8",
|
||||
)
|
||||
(root / "architecture.py").write_text(
|
||||
"from .research import train\n",
|
||||
encoding="utf-8",
|
||||
)
|
||||
(root / "bad_root.py").write_text("", encoding="utf-8")
|
||||
(root / "unregistered").mkdir()
|
||||
(root / "unregistered" / "__init__.py").write_text(
|
||||
"",
|
||||
encoding="utf-8",
|
||||
)
|
||||
invalid = validate_architecture(root)
|
||||
self.assertFalse(invalid["ok"])
|
||||
reasons = [item["reason"] for item in invalid["violations"]]
|
||||
self.assertEqual(reasons.count("forbidden_dependency"), 4)
|
||||
self.assertIn("vendor_sdk_outside_adapter", reasons)
|
||||
self.assertIn("legacy_dependency_escape", reasons)
|
||||
self.assertIn("unregistered_layer_package", reasons)
|
||||
self.assertIn("unregistered_root_module", reasons)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
unittest.main()
|
||||
Reference in New Issue
Block a user