test(af02): make future authority transition phase-aware

Merged
TH
1mo ago
+28-7

Summary

Repair the AF-02 canonical verifier test harness so the frozen future-authority fixture remains valid after Stack A1 activates tools/af02-verifier/src/replay.rs.

Canonical base at branch creation:

main: 1892f895d2ec1592ecdeb3c17e2696b41aa197c7

Exact candidate head:

9b9a25e164f651d6a5179c8258737d731b9e9d81

Root cause

PR #89 activates the planning-frozen future authority path:

tools/af02-verifier/src/replay.rs

The existing A0 regression frozen_future_verifier_path_is_known_but_never_executed always models that path as an added future authority. Once replay.rs exists in the checked-out candidate merge tree, the production base gate correctly classifies it as existing canonical authority and rejects mutation with:

canonical-base AF-02 authority is immutable under the A0 gate; dedicated precanonical strengthening is required: tools/af02-verifier/src/replay.rs

This made the verifier's own test harness phase-incompatible even though the production gate behavior remained fail-closed and correct.

Repair

Change only tools/af02-verifier/tests/base_gate_t025.rs so the regression is phase-aware:

  • before replay.rs exists in canonical base, continue proving a planning-frozen future authority addition is classified as FUTURE_AUTHORITY_ADDITION_VERIFIED and candidate code is never executed;
  • after replay.rs exists, prove the same path is now immutable canonical authority and candidate modification is rejected fail-closed.

No production verifier logic is weakened or changed.

Authority boundary

This candidate changes no:

  • product source;
  • workflow;
  • AF-02 schema or policy;
  • enforcement inventory;
  • resource limits;
  • candidate execution boundary;
  • ruleset;
  • Cargo dependency or lockfile.

The production base_gate.rs remains unchanged. Existing canonical authority remains immutable.

Qualification boundary

This is a dedicated canonical test/verifier strengthening required before dependent A1 work can qualify. Any self-protection failure from the current canonical base-controlled gate must remain recorded as a failure and must not be relabeled as PASS. Merge eligibility requires fresh exact-head non-self-referential CI/security/oracle/assurance evidence, current ruleset truth, reviewer truth, zero unresolved substantive findings, and an exact expected-head merge guard.

After canonicalization, PR #89 must be updated to the new canonical base without rebase/force-push and must rerun exact-head qualification. No prior #89 CI or review evidence is reusable.

Summary by cubic

Makes the AF-02 verifier test for the frozen future authority path phase-aware: before tools/af02-verifier/src/replay.rs exists in the canonical base it verifies the addition is accepted as a future authority, and after it exists it verifies modifying it is rejected as immutable canonical authority and that candidate code never executes. This keeps the test harness compatible with the upcoming activation of that file without changing production verifier logic.

Summary by CodeRabbit

  • Tests
    • Expanded verification coverage for authority-path transitions.
    • Added checks for both newly introduced and already established authority paths.
    • Improved validation of immutable baseline behavior and confirmed that unapproved candidate code is not executed during verification.