Source identity
| Field | Recorded value |
|---|---|
| Source type | GitHub source |
| Original record | Janady13/missionmatch / internal/platform/scrub/binding_sites_test.go |
| Date | Not specified in source |
| Repository | Janady13/missionmatch |
| Revision | 720d47fae476b0d38477ae4401697d372b1ea2bc |
| Branch | feature/opportunity-to-outcome |
| Path or archive member | internal/platform/scrub/binding_sites_test.go |
| Original SHA-256 | c8618c2cbcee04d42cd117f1bfb17674538800dda2e10e0f8067b309394f29c8 |
| Git blob SHA | 32097d869b84c18624858ca928e291be97b6d201 |
| Reading-copy SHA-256 | c8618c2cbcee04d42cd117f1bfb17674538800dda2e10e0f8067b309394f29c8 |
Recovered source transcript
Download complete source text ↓200 lines · 9.0 KB
package scrub
import (
"os"
"path/filepath"
"regexp"
"strings"
"testing"
)
// THE BINDING SITE INVENTORY, ratified 28 July 2026.
//
// Provenance is bound AT ORIGIN by migration 0081: a DEFAULT supplies it, a CHECK bounds it, and a trigger
// overwrites any value on insert and refuses any change on update. The point of that design is that
// fabricating provenance should require touching a NAMED LOCATION that someone reviews, rather than typing
// a constant at a call site.
//
// This test is what makes that claim checkable. It enumerates every place provenance can be bound, asserts
// the migration actually binds each one, and FAILS if a provenance constant appears anywhere it should not,
// which is how a future call time declaration gets caught the day it is written rather than at an audit.
// bindingSites is the closed inventory. A table gains provenance ONLY by being added here and to the
// migration together, which is the reviewable moment this whole design exists to create.
var bindingSites = map[string]Provenance{
"sam_opportunities": ProvenancePublicCache,
"opportunity_records": ProvenancePublicCache,
"opportunity_documents": ProvenanceTenantUpload,
"opportunity_document_chunks": ProvenanceTenantUpload,
"opportunity_scope_items": ProvenanceTenantRecord,
"candidates": ProvenanceTenantRecord,
}
func repoRoot(t *testing.T) string {
t.Helper()
// This package sits at internal/platform/scrub, so the root is three levels up.
root, err := filepath.Abs("../../..")
if err != nil {
t.Fatalf("resolve repo root: %v", err)
}
return root
}
// readMigration returns EVERY migration that binds provenance, concatenated.
//
// It read only 0081 at first, and kept passing after 0082 moved the binding for opportunity_documents and
// opportunity_document_chunks from a per table constant to a per source mapping. A test that passes while
// blind to the file doing the work is the failure mode this whole suite exists to prevent, so the set is
// enumerated and each file is REQUIRED to exist: deleting one fails the test rather than shrinking it.
func readMigration(t *testing.T) string {
t.Helper()
files := []string{
"0081_provenance_at_origin.sql",
"0082_provenance_by_source.sql",
}
var all strings.Builder
for _, f := range files {
b, err := os.ReadFile(filepath.Join(repoRoot(t), "db", "migrations", f))
if err != nil {
t.Fatalf("the origin binding migration %s is missing, which means provenance is no longer bound "+
"at origin the way this suite believes: %v", f, err)
}
all.Write(b)
all.WriteString("\n")
}
return all.String()
}
// THE SOURCE TO PROVENANCE MAPPING IS ASSERTED HERE, because 0082 made it the thing that decides whether a
// document may leave the local plane. Two properties matter and both are checked:
//
// the PUBLIC sources are exactly the two intended ones, so widening the set is a visible diff here
// the default is the RESTRICTIVE one, so a source_type nobody has thought of yet is private
func TestDocumentProvenanceMappingIsNarrowAndFailsClosed(t *testing.T) {
sql := readMigration(t)
if !strings.Contains(sql, "WHEN NEW.source_type IN ('sam_attachment', 'url_import') THEN 'public_cache'") {
t.Fatal("the public source mapping is not the expected pair. If a source was added, add it here too " +
"and say why in the commit, because every source in that list can reach an external model.")
}
if !strings.Contains(sql, "ELSE 'tenant_upload'") {
t.Fatal("the mapping no longer defaults to tenant_upload. A permissive default here is a disclosure, " +
"not an inconvenience.")
}
// source_type must be immutable, or a row could be inserted as an upload and relabelled an attachment,
// laundering a customer's document into the public class after the fact.
if !strings.Contains(sql, "source_type is immutable on") {
t.Fatal("source_type is no longer immutable, so provenance can be changed indirectly by changing " +
"what it derives from")
}
}
// Every site in the inventory must actually be bound by the migration: the column, the CHECK that pins it
// to one value, and the trigger that makes it born rather than chosen.
func TestEveryBindingSiteIsBoundByTheMigration(t *testing.T) {
sql := readMigration(t)
for table, want := range bindingSites {
if !strings.Contains(sql, "ALTER TABLE "+table+" ADD COLUMN IF NOT EXISTS provenance") {
t.Errorf("%s: no provenance column is added by the migration", table)
}
if !strings.Contains(sql, "CHECK (provenance = '"+string(want)+"')") {
t.Errorf("%s: the CHECK does not pin provenance to %s, so the row could be born wrong", table, want)
}
trigger := "CREATE TRIGGER trg_" + table + "_provenance BEFORE INSERT OR UPDATE ON " + table
if !strings.Contains(sql, trigger) {
t.Errorf("%s: no BEFORE INSERT OR UPDATE trigger, so a writer could CHOOSE its provenance and "+
"the default would not stop it", table)
}
if !strings.Contains(sql, "provenance_is_born_not_chosen('"+string(want)+"')") {
t.Errorf("%s: the trigger does not stamp %s", table, want)
}
}
}
// The migration must not bind a table that is NOT in the inventory. A silent addition is exactly the kind
// of change this inventory exists to force into the open.
func TestMigrationBindsNothingOutsideTheInventory(t *testing.T) {
sql := readMigration(t)
re := regexp.MustCompile(`CREATE TRIGGER trg_([a-z_]+)_provenance`)
for _, m := range re.FindAllStringSubmatch(sql, -1) {
table := m[1]
if _, ok := bindingSites[table]; !ok {
t.Errorf("the migration binds provenance on %q, which is not in the binding site inventory. "+
"Add it here deliberately or remove it there.", table)
}
}
}
// THE ONE THAT CATCHES A REGRESSION. A provenance constant must not appear in application code outside this
// package. Its presence means somebody is DECLARING provenance rather than reading it from the row, which
// is the design this redesign removed.
func TestNoProvenanceConstantIsDeclaredInApplicationCode(t *testing.T) {
root := repoRoot(t)
// The constants themselves live here, and the tests in this package necessarily name them.
skipDir := filepath.Join(root, "internal", "platform", "scrub")
needle := regexp.MustCompile(`scrub\.Provenance(PublicCache|CuratedCard|TenantUpload|TenantRecord)\b`)
var offenders []string
for _, dir := range []string{"cmd", "internal"} {
_ = filepath.Walk(filepath.Join(root, dir), func(path string, info os.FileInfo, err error) error {
if err != nil || info.IsDir() {
return nil
}
if strings.HasPrefix(path, skipDir) || !strings.HasSuffix(path, ".go") {
return nil
}
// Test files may name a constant to build a fixture; production code may not.
if strings.HasSuffix(path, "_test.go") {
return nil
}
b, rerr := os.ReadFile(path)
if rerr != nil {
return nil
}
if needle.Match(b) {
rel, _ := filepath.Rel(root, path)
offenders = append(offenders, rel)
}
return nil
})
}
if len(offenders) > 0 {
t.Fatalf("provenance is DECLARED in application code at %v.\n"+
"Provenance is bound at origin and must be READ from the stored row, never named as a constant "+
"by the code composing a payload. If one of these genuinely needs a literal, that is a design "+
"change and belongs in migration 0081 and this inventory, not at a call site.", offenders)
}
}
// POSITIVE CONTROL on this inventory, required by the continuation protocol. If the detector cannot find a
// constant that is definitely there, the test above proves nothing and would pass an empty repository.
func TestBindingSiteDetectorPositiveControl(t *testing.T) {
needle := regexp.MustCompile(`scrub\.Provenance(PublicCache|CuratedCard|TenantUpload|TenantRecord)\b`)
planted := []byte("meta, err := ai.AllowExternal(\"x\", scrub.ProvenancePublicCache, class, payload)")
if !needle.Match(planted) {
t.Fatal("positive control FAILED: the detector cannot see a declared provenance constant, so the " +
"regression test above is not actually testing anything")
}
clean := []byte("meta, err := ai.AllowExternal(\"x\", j.provs, class, payload)")
if needle.Match(clean) {
t.Fatal("positive control FAILED: the detector flags a payload that correctly reads provenance " +
"from the row, which would make the test unusable")
}
}
// The vocabulary in code and the vocabulary in the migration must be the same set, or a value could be
// storable that the gate has never heard of, which fails closed but confusingly.
func TestCodeAndMigrationVocabulariesAgree(t *testing.T) {
sql := readMigration(t)
for _, p := range []Provenance{ProvenancePublicCache, ProvenanceTenantUpload, ProvenanceTenantRecord} {
if !strings.Contains(sql, "'"+string(p)+"'") {
t.Errorf("provenance %q exists in code but is never bound by the migration", p)
}
}
// curated_card is deliberately NOT bound by a table trigger yet: knowledge cards are curated through
// the operator only curation path and do not have a provenance column. Recorded so its absence reads as
// a decision rather than an omission.
if strings.Contains(sql, "'curated_card'") {
t.Log("curated_card is now bound by the migration; update this test's note")
}
}