Source identity
| Field | Recorded value |
|---|---|
| Source type | GitHub source |
| Original record | Janady13/missionmatch / internal/integration/megamind_integration_test.go |
| Date | Not specified in source |
| Repository | Janady13/missionmatch |
| Revision | 720d47fae476b0d38477ae4401697d372b1ea2bc |
| Branch | feature/opportunity-to-outcome |
| Path or archive member | internal/integration/megamind_integration_test.go |
| Original SHA-256 | b855a8bdc2d0e2677dbf974753d5edc0bf6968d9f343b18d5ddf68101b111526 |
| Git blob SHA | ee4fb0e05b3e5df5ea7f3798c602e2e74661aacb |
| Reading-copy SHA-256 | b855a8bdc2d0e2677dbf974753d5edc0bf6968d9f343b18d5ddf68101b111526 |
Recovered source transcript
Download complete source text ↓105 lines · 5.1 KB
//go:build integration
package integration
import (
"context"
"errors"
"os"
"testing"
"time"
"github.com/missionworkforce/missionmatch/internal/modules/matching/engine"
"github.com/missionworkforce/missionmatch/internal/platform/inference"
"github.com/missionworkforce/missionmatch/internal/platform/scrub"
)
// megamindClient builds a client to the live MEGAMIND inference plane, or skips the test when the plane
// is not configured (MM_MEGAMIND_URL unset), the same pattern the DB integration tests use.
func megamindClient(t *testing.T) *inference.Client {
t.Helper()
url := os.Getenv("MM_MEGAMIND_URL")
if url == "" {
t.Skip("MM_MEGAMIND_URL unset; skipping the live inference plane test")
}
// THE BEARER IS SENT, because the gateway requires one on every route except the health check.
//
// These tests carried no token and still passed, which only worked because MM_MEGAMIND_URL happened to
// point at port 8090, a token INJECTING reverse proxy that sits in front of the real gateway and adds the
// credential on the caller's behalf. Pointed at a gateway directly, every call returned 401. So the suite
// was proving that the proxy authenticates, not that the client does, and it could not be run against any
// gateway that is not behind that proxy, which includes the staging one.
c, err := inference.New(inference.Config{BaseURL: url, EmbedModel: "all-minilm", Dimension: 384,
Timeout: 60 * time.Second, Token: os.Getenv("MM_MEGAMIND_TOKEN")})
if err != nil {
t.Fatalf("inference client: %v", err)
}
return c
}
// TestMegamindReachableAnd384 proves Phase 0: the inference plane is reachable and its embeddings are
// exactly 384 wide, the width the candidates.resume_embedding and skills.embedding columns require.
func TestMegamindReachableAnd384(t *testing.T) {
c := megamindClient(t)
ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
defer cancel()
if err := c.Health(ctx); err != nil {
t.Fatalf("MEGAMIND health: %v", err)
}
res, err := c.Embed(ctx, []string{"TS/SCI cleared cloud security engineer", "Kubernetes"})
if err != nil {
t.Fatalf("Embed: %v", err)
}
if len(res.Embeddings) != 2 {
t.Fatalf("want 2 vectors, got %d", len(res.Embeddings))
}
for i, v := range res.Embeddings {
if len(v) != 384 {
t.Fatalf("vector %d has width %d, the column is vector(384)", i, len(v))
}
}
}
// TestMegamindTeachBoundaryLive proves the gateway independently enforces the scrub boundary: a clean
// craft signal is accepted, a signal carrying a client fact is refused server side.
func TestMegamindTeachBoundaryLive(t *testing.T) {
c := megamindClient(t)
c2, _ := inference.New(inference.Config{BaseURL: os.Getenv("MM_MEGAMIND_URL"), Dimension: 384,
Timeout: 20 * time.Second, TeachingEnabled: true, Token: os.Getenv("MM_MEGAMIND_TOKEN")})
_ = c
ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
defer cancel()
// THE VERSION IS READ FROM THE ENGINE, NEVER WRITTEN AS A LITERAL. This line said "v1.0.0" and the engine
// has been frozen at v1.4.0 for some time, so the signal named a scoring contract the teaching boundary no
// longer accepts and the gateway correctly refused it. The test had been WRONG rather than the boundary,
// and it never said so because it only runs when MM_MEGAMIND_URL is set and nothing had set it. A test
// gated on an optional environment variable does not fail, it disappears.
//
// Reading engine.ModelVersion means the next freeze cannot rot this test the way v1.4.0 rotted it.
clean := scrub.TeachingSignal{Pattern: "adjacent_skill_substitution_outcome", Band: scrub.BandMedium, Outcome: scrub.OutcomeApproved, Observations: 40, Successes: 31, ModelVersion: engine.ModelVersion}
if err := c2.Teach(ctx, clean); err != nil {
t.Fatalf("the gateway should accept a clean craft signal on the current contract %s: %v", engine.ModelVersion, err)
}
// A client fact never even leaves the client (scrub.Marshal refuses it), proving the boundary holds
// before transmission.
//
// THE REFUSAL REASON IS ASSERTED, not merely the fact of a refusal. The planted fact is a UUID in
// ModelVersion, which is the only field a leak can be planted in, since the signal carries no free text
// channel by design. That means an unregistered version and a client fact would BOTH refuse this payload,
// and a bare "err != nil" check could pass for the wrong reason and report a leak detector that never ran.
// scrub.Validate scans for markers FIRST, before the version allowlist, so ErrClientFactLeak is the
// reason that must come back, and requiring it by name is what makes this assertion mean anything.
leak := scrub.TeachingSignal{Pattern: "adjacent_skill_substitution_outcome", Band: scrub.BandMedium, Outcome: scrub.OutcomeApproved, Observations: 1, Successes: 1, ModelVersion: "11111111-1111-1111-1111-111111111111"}
err := c2.Teach(ctx, leak)
if err == nil {
t.Fatal("a client fact must be refused at the boundary, never transmitted")
}
if !errors.Is(err, scrub.ErrClientFactLeak) {
t.Errorf("the refusal must be the CLIENT FACT check, got %v. Any other reason means the leak detector "+
"did not run and this assertion proves nothing.", err)
}
}