test(evidence): harden generation lifecycle boundaries

2026-07-12 05:15:30 +02:00
parent 459ffa0bcd
commit 9e21cce036
7 changed files with 135 additions and 3 deletions
@@ -108,3 +108,32 @@ def test_published_inventory_excludes_staged_and_invalid_newer_directories(tmp_p
    invalid.mkdir()
    (invalid / "PUBLISHED").write_text("2026-01-01T00:00:00Z\n")
    assert store.published_generations() == [first]
+
+
+def test_owned_copy_uses_validated_descriptor_bytes_when_source_is_replaced(tmp_path, monkeypatch):
+    from tht.corpus.models import CanonicalDocument
+    import hashlib
+
+    content = "active bytes"
+    document = CanonicalDocument(
+        document_id="doc:" + "c" * 64, source_id="fs:copy", source_uri="file:///copy",
+        source_fingerprint="sha256:" + "d" * 64,
+        content_hash="sha256:" + hashlib.sha256(content.encode()).hexdigest(),
+        content=content, pipeline_version="evidence-v1",
+    )
+    store = CorpusStore(tmp_path / "corpus")
+    generation = store.stage(CorpusManifest(documents=(document,)), {document.document_id: content})
+    store.publish(generation)
+    source = store.resolve_document(document.document_id)
+    real_read = os.read
+
+    def replace_after_read(fd, size):
+        payload = real_read(fd, size)
+        source.unlink()
+        source.write_text("replacement")
+        return payload
+
+    monkeypatch.setattr(os, "read", replace_after_read)
+    owned = store.materialize_document(document.document_id, tmp_path / "session" / "evidence.md")
+    assert owned.read_text() == content
+    assert hashlib.sha256(owned.read_bytes()).hexdigest() == document.content_hash.removeprefix("sha256:")