Repository documentation
1.2 test-policy review
- Status: deferred
- Owning queue item: TEST-POLICY-1.2-001
- Completion / archival evidence: Read-only classification on 2026-10-05 of the
50 unreviewed modules the 1.2 restart branch adds under
tests/critical, against the policy inCONTRIBUTING.mdand the October 2026 test audit. Verdicts are recommendations. No test was changed, and none was run for this review.
Scope
The branch adds 54 test modules under tests/critical. Four were reconciled while
restoring the ten modules the audit had deleted or trimmed:
test_accept_reservation_admission, test_accept_runtime_custody,
test_finalize_execution_policy and test_retained_source_cache_trust. The other 50
hold 291 test methods.
| Verdict | Tests | Meaning |
|---|---|---|
| Keep (critical) | 56 | Names a security, custody, tamper, credential, sandbox or data-loss invariant. Usually becomes the subTest table that absorbs merges. |
| Move | 14 | 8 to tests/e2e, 6 to tests/smoke; they drive real receivers, children or Git. |
| Merge | 130 | Repeats another case per phase, option or controller. |
| Drop | 83 | Wire or schema round trip, mock replica, argument or type validation, or internal scheduling shape. |
| Unsure | 8 | The policy does not decide; see the per-module notes. |
The result would be about 70 tests in place of 291. Overlap between the kept cases and existing E2E coverage was not checked.
Repeated patterns
The main finding is per-phase repetition. The audit trimmed BUILD to two critical
tests per module (test_action_build_action, test_action_build_result,
test_command_builder) plus four in e2e/test_action_build_process. The 1.2 modules
repeat the same checks for GENERATE, LINK, PACKAGE and FINALIZE.
- F1, dispatch request checks (wrong worker, phase, predecessor or deadline;
missing, extra or corrupt records):
action_finalize,action_generate_action,action_link,action_package,action_package_workerandaction_link_dependencies. Keep one phase-by-change table, represented byaction_generate_action. - F2, cancellation before storage access or launch: seven copies.
e2e/test_action_build_process::expiry_and_cancellation_interrupt_a_running_childalready covers the shared runner. - F3, record format (round trip, closed envelope, non-canonical bytes, wrong hash,
expiry): about 25 tests across the seven
*_record/*_resultmodules andaction_retained_source. Drop as wire/schema round trips. - F4, rehashed record substitutes another lock, plan, package or input: a real
tamper invariant repeated per phase. Representatives:
action_package_record::substituted_package_authority_refuses_even_when_rehashedfor inputs andaction_generate_result::foreign_input_or_allocation_cannot_rebind…for results. - F5, supervised child limits (reserved environment controls, no launch on bad
input, cancellation, deadline, non-zero exit, output overflow):
action_finalize_process,action_generate_processand parts ofconfigured_generate_worker. Fold intoe2e/test_action_build_processas phase subTests. - F6, authority revoked mid-operation: about 20 tests. Representatives:
action_finalize_grant::file_revocation_stops_running_supervised_childandaction_generate_import::authority_loss_during_fetch…. - F7, corrupt fetched or returned bytes, no remote fallback: about 15 tests.
Representatives:
action_generate_import::last_corrupt_blob_does_not_publish…andaction_retained_source::corrupt_local_blob_does_not_fall_back. - F8, cleanup must not delete a foreign replacement: six copies. Representative:
action_generate_execution::replaced_stage_is_not_deleted…. - F9, command-controller capacity reservation and recheck:
command_acceptor,command_generator,command_linker,command_packager,command_finalizerandregistered_generation.command_packagerandcommand_finalizershare eight test names. Slot accounting is not a security invariant; keep one smoke representative. - F10: the final branch loop in
legacy_release_linerepeatspublished_release_identity::rehashed_record…. - F11/F12, real LINK and GENERATE happy paths:
command_link_dependenciesandcommand_generate_workercontain the other four to seven copies.
Most valuable tests
These drive real processes, receivers or Git and should survive any reduction:
command_link_dependencies::packaging_chain_reopens_all_provider_proofs_in_real_receiver: real build/test/execute, LINK through a receiver subprocess in dependency order, PACKAGE and FINALIZE proof, then refusal of a corrupt provider proof. Move totests/e2e.command_generate_worker(live pool, receiver subprocess, HTTP CAS and child): move totests/e2enext totest_command_build_worker.action_finalize_grant::file_revocation_stops_running_supervised_child.local_accept_handoff: real local commands plus an isolated ACCEPT child; move toe2e/test_configured_accept_worker.legacy_release_line,published_release_identityandrelease_semver_requirement(real Git with a bare remote): move toe2e/test_project_releases.
Per-module verdicts
K = keep, E/S = move to E2E/smoke, M = merge, D = drop, U = unsure.
| Module | Tests | K | E/S | M | D | U |
|---|---|---|---|---|---|---|
| accept_handoff | 7 | 3 | 0 | 3 | 1 | 0 |
| action_finalize | 4 | 0 | 0 | 3 | 1 | 0 |
| action_finalize_authority | 8 | 3 | 0 | 3 | 2 | 0 |
| action_finalize_grant | 7 | 4 | 0 | 3 | 0 | 0 |
| action_finalize_package | 3 | 1 | 0 | 0 | 1 | 1 |
| action_finalize_process | 7 | 0 | 1E | 6 | 0 | 0 |
| action_finalize_record | 8 | 0 | 0 | 4 | 4 | 0 |
| action_finalize_result | 9 | 1 | 0 | 4 | 4 | 0 |
| action_finalize_result_record | 6 | 0 | 0 | 3 | 3 | 0 |
| action_finalize_stages | 7 | 2 | 0 | 2 | 3 | 0 |
| action_finalize_startup | 3 | 1 | 0 | 1 | 0 | 1 |
| action_generate_action | 6 | 3 | 0 | 2 | 1 | 0 |
| action_generate_execution | 11 | 5 | 0 | 3 | 3 | 0 |
| action_generate_import | 7 | 3 | 0 | 1 | 3 | 0 |
| action_generate_process | 5 | 0 | 0 | 5 | 0 | 0 |
| action_generate_record | 9 | 1 | 0 | 3 | 4 | 1 |
| action_generate_result | 9 | 2 | 0 | 3 | 4 | 0 |
| action_generate_source | 7 | 2 | 0 | 3 | 1 | 1 |
| action_link | 5 | 0 | 0 | 4 | 1 | 0 |
| action_link_dependencies | 6 | 0 | 0 | 3 | 2 | 1 |
| action_link_proof | 4 | 0 | 0 | 3 | 1 | 0 |
| action_link_receiver | 2 | 0 | 0 | 1 | 1 | 0 |
| action_link_record | 4 | 0 | 0 | 1 | 3 | 0 |
| action_link_result | 4 | 0 | 0 | 2 | 2 | 0 |
| action_package | 4 | 0 | 0 | 3 | 1 | 0 |
| action_package_record | 6 | 1 | 0 | 2 | 3 | 0 |
| action_package_worker | 4 | 1 | 0 | 3 | 0 | 0 |
| action_retained_source | 15 | 4 | 0 | 5 | 5 | 1 |
| command_acceptor | 9 | 3 | 1S | 5 | 0 | 0 |
| command_finalizer | 8 | 0 | 0 | 6 | 2 | 0 |
| command_generate_worker | 2 | 0 | 1E | 1 | 0 | 0 |
| command_generator | 12 | 1 | 0 | 8 | 2 | 1 |
| command_link_dependencies | 1 | 0 | 1E | 0 | 0 | 0 |
| command_linker | 7 | 0 | 0 | 7 | 0 | 0 |
| command_packager | 10 | 3 | 0 | 4 | 3 | 0 |
| configured_finalize_worker | 3 | 0 | 0 | 0 | 2 | 1 |
| configured_generate_worker | 6 | 1 | 0 | 4 | 1 | 0 |
| explicit_action_inputs | 1 | 0 | 0 | 0 | 1 | 0 |
| finalize_verification | 1 | 0 | 0 | 1 | 0 | 0 |
| finalize_worker | 8 | 2 | 0 | 2 | 4 | 0 |
| generation_ready_queue | 6 | 1 | 2S | 3 | 0 | 0 |
| generation_workspace | 6 | 2 | 0 | 2 | 2 | 0 |
| later_phase_admission | 2 | 1 | 0 | 1 | 0 | 0 |
| legacy_release_line | 1 | 0 | 1E | 0 | 0 | 0 |
| local_accept_handoff | 1 | 0 | 1E | 0 | 0 | 0 |
| local_accept_link_handoff | 4 | 0 | 0 | 3 | 1 | 0 |
| published_release_identity | 2 | 0 | 2E | 0 | 0 | 0 |
| registered_generation | 4 | 0 | 0 | 0 | 4 | 0 |
| release_semver_requirement | 1 | 0 | 1E | 0 | 0 | 0 |
| retained_generation_proof | 3 | 2 | 0 | 1 | 0 | 0 |
| source_transfer_revocation | 1 | 0 | 0 | 1 | 0 | 0 |
| standard_artifact_assembly | 5 | 1 | 0 | 1 | 3 | 0 |
| standard_link_scheduling | 6 | 1 | 2S | 0 | 3 | 0 |
| standard_project_finalizer | 4 | 1 | 1S | 1 | 1 | 0 |
| Total | 291 | 56 | 14 | 130 | 83 | 8 |
Other findings
- Fixtures rebuilt per test: support fixtures are TestCase classes chained up to
six deep (
FinalizeGrant→FinalizeAuthority→FinalizeWorkerInput→PackageWorkerInput→StandardArtifactAssembly→StandardProjectLifecycle), and eachsetUprebuilds the chain. The policy asks for expensive fixtures to be built once per class. - Duplicated setup: each
tests/support/fixtures_test_action_*.pyduplicates thesetUpof its critical module. - Private-state coupling: many tests reach into internals such as
registry._paths,linker._completed,pool._factsandports._execution_evidence. test_explicit_action_inputsclaims a real command-process transport, but its module-level_WORKERscript is never used; the test runs nothing.- Wrong docstrings:
test_later_phase_admission("Shared test fixtures extracted from test_action_admission") andtest_source_transfer_revocation.