Janady13/missionmatch / internal/platform/scrub/scrub_test.go

Source identity

Field	Recorded value
Source type	GitHub source
Original record	Janady13/missionmatch / internal/platform/scrub/scrub_test.go
Date	Not specified in source
Repository	Janady13/missionmatch
Revision	720d47fae476b0d38477ae4401697d372b1ea2bc
Branch	feature/opportunity-to-outcome
Path or archive member	internal/platform/scrub/scrub_test.go
Original SHA-256	3a8864e859f6edac5e85384f6eb9dbc8edb8f49772568e723a9509d09649fa8d
Git blob SHA	9324fd7b19b6fc7f57b950c8ab570194f967231e
Reading-copy SHA-256	3a8864e859f6edac5e85384f6eb9dbc8edb8f49772568e723a9509d09649fa8d
Original source ↗
Recovered source transcript

Download complete source text ↓157 lines · 8.7 KB
package scrub

import (
	"strings"
	"testing"
)

// TestValidAbstractSignalPasses proves a contents free craft signal is accepted.
func TestValidAbstractSignalPasses(t *testing.T) {
	RegisterModelVersion("v1.0.0")
	b, err := Marshal(TeachingSignal{
		Pattern: "adjacent_skill_substitution_outcome", Band: BandMedium, Outcome: OutcomeApproved,
		Observations: 40, Successes: 31, ModelVersion: "v1.0.0",
	})
	if err != nil {
		t.Fatalf("a valid abstract signal must pass the boundary: %v", err)
	}
	if err := Validate(b); err != nil {
		t.Fatalf("Validate rejected its own Marshal output: %v", err)
	}
}

// TestClientFactsAreRefused is the core safety test: every shape of a client fact must be refused at the
// boundary. If any of these passes, a tenant's contents could reach the shared inference plane.
func TestClientFactsAreRefused(t *testing.T) {
	leaks := map[string]string{
		"uuid org":                            `{"pattern":"adjacent_skill_substitution_outcome","band":"medium","outcome":"approved","observations":1,"successes":1,"model_version":"11111111-1111-1111-1111-111111111111"}`,
		"uuid anywhere":                       `{"pattern":"adjacent_skill_substitution_outcome","band":"high","outcome":"approved","observations":1,"successes":1,"model_version":"v1.0.0 / a1b2c3d4-e5f6-7890-abcd-ef1234567890"}`,
		"email":                               `{"pattern":"adjacent_skill_substitution_outcome","band":"high","outcome":"approved","observations":1,"successes":1,"model_version":"jane.doe@agency.gov"}`,
		"free text smuggled in pattern":       `{"pattern":"candidate Jane Doe TS SCI resume text leaked here as a label","band":"high","outcome":"approved","observations":1,"successes":1,"model_version":"v1.0.0"}`,
		"unknown extra field (smuggled fact)": `{"pattern":"adjacent_skill_substitution_outcome","band":"high","outcome":"approved","observations":1,"successes":1,"model_version":"v1.0.0","candidate_id":"abc"}`,
		"impossible counts":                   `{"pattern":"adjacent_skill_substitution_outcome","band":"high","outcome":"approved","observations":1,"successes":9,"model_version":"v1.0.0"}`,
		"band out of vocabulary":              `{"pattern":"adjacent_skill_substitution_outcome","band":"0.873211","outcome":"approved","observations":1,"successes":1,"model_version":"v1.0.0"}`,
		"outcome out of vocabulary":           `{"pattern":"adjacent_skill_substitution_outcome","band":"high","outcome":"hired Jane at Org X","observations":1,"successes":1,"model_version":"v1.0.0"}`,
	}
	for name, raw := range leaks {
		if err := Validate([]byte(raw)); err == nil {
			t.Errorf("BOUNDARY BREACH: %q passed Validate but carries a client fact or escapes the vocabulary", name)
		}
	}
}

// TestMarshalRefusesToEmitALeak proves the convenience path cannot bypass the boundary: a model version
// that is actually a UUID (a client org id) is refused at Marshal, not just at Validate.
func TestMarshalRefusesToEmitALeak(t *testing.T) {
	if _, err := Marshal(TeachingSignal{
		Pattern: "clearance_gap_override_outcome", Band: BandLow, Outcome: OutcomeRejected,
		Observations: 2, Successes: 0, ModelVersion: "11111111-1111-1111-1111-111111111111",
	}); err == nil {
		t.Fatal("Marshal emitted a payload whose model_version is a UUID (a client fact)")
	}
}

// TestEmptyModelVersionIsRefused proves a craft signal that does not name its scoring contract is
// refused: model_version is required, a signal must always tie to the engine version that produced it.
func TestEmptyModelVersionIsRefused(t *testing.T) {
	raw := `{"pattern":"adjacent_skill_substitution_outcome","band":"high","outcome":"approved","observations":1,"successes":1,"model_version":""}`
	if err := Validate([]byte(raw)); err == nil {
		t.Fatal("a signal with an empty model_version passed the boundary, the scoring contract is unnamed")
	}
}

// TestUnregisteredModelVersionIsRefused proves a non empty but unregistered model_version is refused the
// same way an unknown Pattern is: it signals the scoring contract drifted out from under the signal.
func TestUnregisteredModelVersionIsRefused(t *testing.T) {
	raw := `{"pattern":"adjacent_skill_substitution_outcome","band":"high","outcome":"approved","observations":1,"successes":1,"model_version":"v9.9.9"}`
	if err := Validate([]byte(raw)); err == nil {
		t.Fatal("a signal with an unregistered model_version passed the boundary, a drifted version must be refused")
	}
}

// TestRegisteredModelVersionPasses proves the allow list seam works: once a caller registers a version,
// a signal on that version crosses the boundary. The producer calls RegisterModelVersion(engine.ModelVersion).
func TestRegisteredModelVersionPasses(t *testing.T) {
	RegisterModelVersion("v1.4.0")
	b, err := Marshal(TeachingSignal{
		Pattern: "reranker_label_agreement", Band: BandHigh, Outcome: OutcomeApproved,
		Observations: 12, Successes: 11, ModelVersion: "v1.4.0",
	})
	if err != nil {
		t.Fatalf("a signal on a registered model_version must pass the boundary: %v", err)
	}
	if err := Validate(b); err != nil {
		t.Fatalf("Validate rejected a registered model_version: %v", err)
	}
}

// TestNoFreeTextChannel proves the signal has no string field that can hold arbitrary contents: an
// overlong value in any string field is refused.
func TestNoFreeTextChannel(t *testing.T) {
	long := strings.Repeat("x", maxFieldLen+1)
	if _, err := Marshal(TeachingSignal{
		Pattern: "adjacent_skill_substitution_outcome", Band: BandHigh, Outcome: OutcomeApproved,
		Observations: 1, Successes: 1, ModelVersion: long,
	}); err == nil {
		t.Fatal("an overlong string field passed the boundary, the channel is not contents free")
	}
}

// TestAllowEgressAcceptsPublicClassesWithCleanPayload proves the four public classes may leave the
// local plane when the payload carries no private data marker. This is the outbound half of the
// boundary: only public solicitation and knowledge text may reach an external inference backend.
func TestAllowEgressAcceptsPublicClassesWithCleanPayload(t *testing.T) {
	clean := []byte("Contract opportunity: data engineering support services for a federal agency, NAICS 541512, response due in 30 days.")
	for _, class := range []EgressClass{ClassPublicKnowledge, ClassPublicDataSummary, ClassOntologySuggest, ClassRequirementNormalize} {
		if err := AllowEgress([]Provenance{ProvenancePublicCache}, class, clean); err != nil {
			t.Errorf("public class %q with clean public text must be allowed to egress: %v", class, err)
		}
	}
}

// TestAllowEgressRefusesUnknownClass proves the gate fails closed: a class outside the four public
// classes cannot leave the machine, no matter how innocuous the payload looks.
func TestAllowEgressRefusesUnknownClass(t *testing.T) {
	if err := AllowEgress([]Provenance{ProvenancePublicCache}, EgressClass("CANDIDATE_MATCH"), []byte("anything")); err == nil {
		t.Fatal("an egress class outside the public allow list must fail closed to the local plane")
	}
	if err := AllowEgress([]Provenance{ProvenancePublicCache}, EgressClass(""), []byte("anything")); err == nil {
		t.Fatal("an empty egress class must fail closed to the local plane")
	}
}

// TestAllowEgressRefusesPrivateMarkers is the core outbound safety test: even under a permitted class,
// a payload still carrying a private data marker (a tenant or candidate uuid, an email, a phone number)
// is refused, so an accidental leak is caught at the boundary rather than at OpenAI.
func TestAllowEgressRefusesPrivateMarkers(t *testing.T) {
	forbidden := map[string]string{
		"tenant or candidate uuid": "normalize this scope for candidate 11111111-1111-1111-1111-111111111111",
		"email":                    "the point of contact is jane.doe@agency.gov for this notice",
		"phone":                    "call the incumbent program manager at (571) 555-0148 for details",
	}
	for name, payload := range forbidden {
		if err := AllowEgress([]Provenance{ProvenancePublicCache}, ClassRequirementNormalize, []byte(payload)); err == nil {
			t.Errorf("BOUNDARY BREACH: %q was allowed to egress but carries a private data marker", name)
		}
	}
}

// TestContentHashIsStableAndHidesContent proves the audit hash is a stable fingerprint that never
// embeds the content, so an external call can be audited by hash and byte count, never by content.
func TestContentHashIsStableAndHidesContent(t *testing.T) {
	h1 := ContentHash([]byte("public solicitation notice text"))
	h2 := ContentHash([]byte("public solicitation notice text"))
	if h1 != h2 {
		t.Fatal("content hash must be stable for identical payloads")
	}
	if len(h1) != 64 {
		t.Fatalf("expected a sha256 hex digest of 64 characters, got %d", len(h1))
	}
	if strings.Contains(h1, "public") || strings.Contains(h1, "notice") {
		t.Fatal("content hash must not embed the content it fingerprints")
	}
	if ContentHash([]byte("different notice")) == h1 {
		t.Fatal("different content must produce a different hash")
	}
}