Freeze SCUM log-source tailing run contract

2026-08-13 14:37:16 +08:00
parent 41c109128d
commit 4f55c71de5
18 changed files with 627 additions and 6 deletions
@@ -208,6 +208,27 @@ func TestValidateSCUMGuardedMutationResultRejectsMultiRowMissingReadbackAndUnsaf
 	}
 }

+func TestValidateSCUMParsedLogBatchResultAcceptsRotationSafeEnvelope(t *testing.T) {
+	result := validatorSCUMParsedLogBatchResult()
+
+	if err := ValidateSCUMParsedLogBatchResult(result); err != nil {
+		t.Fatalf("expected valid parsed log batch result, got %v", err)
+	}
+}
+
+func TestValidateSCUMParsedLogBatchResultRejectsRawLineNetworkMaterialAndLooseBounds(t *testing.T) {
+	result := validatorSCUMParsedLogBatchResult()
+	result.ParserDigest = ""
+	result.FirstCursor.SourceIdentityDigest = `C:\SCUM\Saved\Logs\login.log`
+	result.Events[0].Payload = map[string]any{"rawLine": "2026.08.13: '203.0.113.10 player' logged in"}
+	result.Limits.MaxLineBytes = 1000000
+
+	err := ValidateSCUMParsedLogBatchResult(result)
+	if err == nil || !strings.Contains(err.Error(), "parserDigest") || !strings.Contains(err.Error(), "sourceIdentityDigest") || !strings.Contains(err.Error(), "payload key is unsafe") || !strings.Contains(err.Error(), "payload value is unsafe") || !strings.Contains(err.Error(), "maxLineBytes") {
+		t.Fatalf("expected parsed-log safety violations, got %v", err)
+	}
+}
+
 func TestValidateSCUMCapabilityEvidenceRequiresSafeCurrentServiceIdentity(t *testing.T) {
 	evidence := domain.SCUMCapabilityEvidence{Capability: domain.SCUMDataCapabilityPlayerRead, Status: domain.SCUMCapabilityEvidenceCompatible, Binding: validatorSCUMBinding(), AdapterVersion: "adapter-1", SchemaFingerprint: scumProbeHash, ProbeResultDigest: scumProbeHash, AssetDigests: []string{scumProbeHash}, SafeError: domain.SCUMSafeError{Code: domain.SCUMSafeErrorNone}}
 	if err := ValidateSCUMCapabilityEvidence(evidence); err != nil {
@@ -250,3 +271,39 @@ func validatorSCUMGuardedMutationResult() domain.SCUMGuardedMutationResult {
 	request := validatorSCUMGuardedMutationRequest()
 	return domain.SCUMGuardedMutationResult{RequestID: request.RequestID, JobID: request.JobID, Binding: request.Binding, Status: domain.SCUMTerminalResultSucceeded, Capability: request.Capability, TargetKey: request.TargetKey, TemplateKey: request.TemplateKey, AdapterVersion: request.AdapterVersion, SchemaFingerprint: request.RequiredSchemaFingerprint, AssetDigest: request.AssetDigest, SourceFingerprint: scumProbeHash, TargetIdentityDigest: request.TargetIdentityDigest, ExpectedRowDigest: request.ExpectedRowDigest, ExpectedValueDigest: request.ExpectedValueDigest, ExpectedXMLDigest: request.ExpectedXMLDigest, PatchDigest: request.PatchDigest, BackupEvidenceDigest: request.BackupEvidenceDigest, OfflineEvidenceDigest: request.OfflineEvidenceDigest, DangerConfirmationDigest: request.DangerConfirmationDigest, ReadbackExpectationDigest: request.ReadbackExpectationDigest, ObservedAt: time.Now(), ResultDigest: scumProbeHash, BeforeDigest: scumProbeHash, AfterDigest: scumProbeHash, ReadbackDigest: scumProbeHash, AffectedRows: 1, ReadbackStatus: domain.SCUMMutationReadbackConfirmed, SafeSummary: "confirmed by declared readback", SafeError: domain.SCUMSafeError{Code: domain.SCUMSafeErrorNone}, Limits: request.Bounds}
 }
+
+func validatorSCUMParsedLogBatchResult() domain.SCUMParsedLogBatchResult {
+	cursor := domain.SCUMParsedLogCursor{SourceIdentityDigest: scumProbeHash, StreamGeneration: scumProbeHash, Sequence: 7}
+	return domain.SCUMParsedLogBatchResult{
+		RequestID:      "request-log-1",
+		JobID:          "job-log-1",
+		Binding:        validatorSCUMBinding(),
+		Status:         domain.SCUMTerminalResultSucceeded,
+		SourceKey:      "scum-login-events",
+		StreamKey:      "scum.login",
+		ParserKey:      "scum-login-log-login-parser",
+		ParserVersion:  "scum-login-log-v1",
+		AdapterVersion: "adapter-1",
+		AssetDigest:    scumProbeHash,
+		ParserDigest:   scumProbeHash,
+		ObservedAt:     time.Now(),
+		ResultDigest:   scumProbeHash,
+		FirstCursor:    cursor,
+		LastCursor:     cursor,
+		TailState:      domain.SCUMLogTailRotated,
+		Replay:         true,
+		EventCount:     1,
+		SafeSummary:    "one sanitized login event parsed from declared source",
+		SafeError:      domain.SCUMSafeError{Code: domain.SCUMSafeErrorNone},
+		Limits:         domain.DefaultSCUMParsedLogBatchBounds(),
+		Events: []domain.SCUMParsedLogEvent{{
+			EventType:          "scum.login",
+			OccurredAt:         time.Now(),
+			Cursor:             cursor,
+			LogicalEventDigest: scumProbeHash,
+			EventDigest:        scumProbeHash,
+			PayloadDigest:      scumProbeHash,
+			Payload:            map[string]any{"externalPlayerId": "player-redacted", "displayName": "Known Player", "profileLocalId": "profile-redacted"},
+		}},
+	}
+}