Janady13/missionmatch / internal/platform/federated/reachability_gate_test.go

Source identity

Field	Recorded value
Source type	GitHub source
Original record	Janady13/missionmatch / internal/platform/federated/reachability_gate_test.go
Date	Not specified in source
Repository	Janady13/missionmatch
Revision	720d47fae476b0d38477ae4401697d372b1ea2bc
Branch	feature/opportunity-to-outcome
Path or archive member	internal/platform/federated/reachability_gate_test.go
Original SHA-256	705e6733ef9d4006ce954b8a871d3807512d4aa40b2281baee0026a46d106112
Git blob SHA	4001cf24b35cdc842a5fb73a373b238d3921e66c
Reading-copy SHA-256	705e6733ef9d4006ce954b8a871d3807512d4aa40b2281baee0026a46d106112

Original source ↗

Every recorded occurrence

These 14 records contain identical original source bytes. Their paths and revisions remain part of the archive.

Original record	Branch or archive	Revision / identifier	Original location
Janady13/missionmatch / internal/platform/federated/reachability_gate_test.go	feature/opportunity-to-outcome	720d47fae476b0d38477ae4401697d372b1ea2bc	Open original
Janady13/missionmatch / internal/platform/federated/reachability_gate_test.go	collision-deconfliction	4ee5a09972608ed89f8377c6665542d5f450f0a6	Open original
Janady13/missionmatch / internal/platform/federated/reachability_gate_test.go	m5-price-to-win	41000ad30fff4129fdaf5ec84e15ba14c27d4890	Open original
Janady13/missionmatch / internal/platform/federated/reachability_gate_test.go	master	1e9249840a4302ec82e123b9c9cb6f75badea3e4	Open original
Janady13/missionmatch / internal/platform/federated/reachability_gate_test.go	ws8-teaching-loop	c823f0fb6bb2aba0f39001eb6de96f4000d9321f	Open original
Janady13/missionmatch / internal/platform/federated/reachability_gate_test.go	mag-substrate	b82c7100a492dec67dfd1eda6b3f53def859be35	Open original
Janady13/missionmatch / internal/platform/federated/reachability_gate_test.go	time-to-fill-survival	b66e1e505863d4f17741a4b9ede73509e45bd6c6	Open original
Janady13/missionmatch / internal/platform/federated/reachability_gate_test.go	graphrag-foundation	b0ddeb9f633fd138d09309d1a17b7d13bc3a67f7	Open original
Janady13/missionmatch / internal/platform/federated/reachability_gate_test.go	ws9-bench-ingestion	f585a9ef32fa554663ce1fba9a414a54b6e49cf0	Open original
Janady13/missionmatch / internal/platform/federated/reachability_gate_test.go	presentation-readiness	eb574acaa29d71ce4d0f852572e87c275c79fdb7	Open original
Janady13/missionmatch / internal/platform/federated/reachability_gate_test.go	vendor-intelligence	fe9796a19c261951d3f2565206c0c1b5ac294465	Open original
Janady13/missionmatch / internal/platform/federated/reachability_gate_test.go	phase2-connectors	e038d4c687aec16f8bd9bc4d907eea14d91f8704	Open original
Janady13/missionmatch / internal/platform/federated/reachability_gate_test.go	feature/aioe-upgrade	2178e7298d0e5d9af83afa12402fd587f0ba6ed8	Open original
Janady13/missionmatch / internal/platform/federated/reachability_gate_test.go	capture-readiness	bae6af7cb2997e819174a9e9cfff5e16067a1975	Open original

Recovered source transcript

Download complete source text ↓116 lines · 5.2 KB

package federated

// reachability_gate_test.go is the WS8 CI REACHABILITY GATE. It mirrors the intent of the X-Org-ID build tag
// backdoor removal gate (Makefile verify-backdoor): that gate proves a dangerous code path cannot reach a
// release binary; this gate proves NO federated emission path is live when MM_FEDERATED_DP_ENABLED is unset or
// false. Together they are the two negative tests that keep an unsafe path dead by construction, not by
// reviewer vigilance.
//
// With the flag off, three independent emission paths must all be inert:
//
//  1. NewActiveAggregator REFUSES to build (returns ErrDisabled), so no active aggregator, and therefore no
//     Emit path, can even be assembled. This is the hard construction guard.
//  2. SpendGate.Charge returns ErrDisabled and writes NOTHING (no ledger insert, no audit event), so the hard
//     spend gate never persists a release on a disabled deploy.
//  3. The inference client Teach transmits NOTHING while TeachingEnabled is false, so no contents scrubbed
//     craft signal leaves the box.
//
// If any of these started emitting with the flag off, the federated loop would be live in tenant LIVE, which is
// exactly the posture this gate forbids. The point: no federated emission path is reachable when the flag is
// unset.

import (
	"context"
	"errors"
	"net/http"
	"net/http/httptest"
	"sync/atomic"
	"testing"
	"time"

	"github.com/missionworkforce/missionmatch/internal/platform/config"
	"github.com/missionworkforce/missionmatch/internal/platform/inference"
	"github.com/missionworkforce/missionmatch/internal/platform/scrub"
)

// flagOffConfig is the default in tenant LIVE federated posture: the DP master switch is off. Epsilon and delta
// are present (they are config, not constants) but they never matter while the switch is off.
func flagOffConfig() config.Federated {
	return config.Federated{DPEnabled: false, DPEpsilon: 10, DPDelta: 1e-7}
}

// TestReachabilityGateFlagOffNoActiveAggregator proves the hard construction guard: with the flag off,
// NewActiveAggregator refuses to build and returns ErrDisabled, so no Emit path can be assembled.
func TestReachabilityGateFlagOffNoActiveAggregator(t *testing.T) {
	cfg := flagOffConfig()
	gate := NewSpendGate(cfg, &fakeLedger{}, nil)

	agg, err := NewActiveAggregator(cfg, gate)
	if !errors.Is(err, ErrDisabled) {
		t.Fatalf("flag off NewActiveAggregator must return ErrDisabled, got %v", err)
	}
	if agg != nil {
		t.Fatal("flag off NewActiveAggregator must return a nil aggregator, so no Emit path exists")
	}
}

// TestReachabilityGateFlagOffChargeRefusesAndWritesNothing proves the hard spend gate is inert with the flag
// off: Charge returns ErrDisabled and persists NO ledger row and emits NO audit event, so no release is ever
// recorded on a disabled deploy.
func TestReachabilityGateFlagOffChargeRefusesAndWritesNothing(t *testing.T) {
	cfg := flagOffConfig()
	store := &fakeLedger{}
	au := &fakeAuditor{}
	gate := NewSpendGate(cfg, store, nil)
	gate.auditW = au // observe that no audit event is written either

	rel := Release{ModelVersion: "v1.4.0", ContributingTenantCount: 5, Gaussian: GaussianRelease{NoiseSigma: 2, ClipNorm: 1}}
	_, err := gate.Charge(context.Background(), rel)
	if !errors.Is(err, ErrDisabled) {
		t.Fatalf("flag off Charge must return ErrDisabled, got %v", err)
	}
	if len(store.rows) != 0 || len(store.insertSeen) != 0 {
		t.Fatalf("flag off Charge wrote to the ledger: rows=%d inserts=%d", len(store.rows), len(store.insertSeen))
	}
	if len(au.events) != 0 {
		t.Fatalf("flag off Charge emitted an audit event: %d events", len(au.events))
	}
}

// TestReachabilityGateFlagOffTeachTransmitsNothing proves the inference client transmits NO craft signal while
// TeachingEnabled is false (the federated transmission flag, off in tenant LIVE). It points the client at a
// counting server and asserts a clean, boundary valid signal validates but never reaches the wire, mirroring
// the inference package's own Teach posture test from the federated gate's vantage.
func TestReachabilityGateFlagOffTeachTransmitsNothing(t *testing.T) {
	var transmitted int32
	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
		atomic.AddInt32(&transmitted, 1)
		w.WriteHeader(http.StatusAccepted)
	}))
	defer srv.Close()

	c, err := inference.New(inference.Config{
		BaseURL:         srv.URL,
		Dimension:       384,
		Timeout:         2 * time.Second,
		TeachingEnabled: false, // the in tenant LIVE posture: validate the boundary, transmit nothing
	})
	if err != nil {
		t.Fatalf("inference client: %v", err)
	}

	// Register the version this signal sits on so the scrub boundary accepts it (the same seam the producer uses
	// at init); the boundary refuses any unregistered version, so a test that speaks one must register it.
	scrub.RegisterModelVersion("v1.4.0")
	clean := scrub.TeachingSignal{
		Pattern: "adjacent_skill_substitution_outcome", Band: scrub.BandHigh, Outcome: scrub.OutcomeApproved,
		Observations: 10, Successes: 7, ModelVersion: "v1.4.0",
	}
	if err := c.Teach(context.Background(), clean); err != nil {
		t.Fatalf("a clean signal must pass the boundary: %v", err)
	}
	if atomic.LoadInt32(&transmitted) != 0 {
		t.Fatal("with teaching disabled the signal must not be transmitted, no federated emission path is live")
	}
}