Audit batch 5: I-9, I-12, I-14, N-1..N-12, single-task wire single-transaction

This commit is contained in:
host committed 2026-11-04 18:02:23 +00:00
1 parent cdac8039b3
commit 2adc605373
7 files changed
+1349 -440

No files matched your search

+25 -20
View File
@@ -98,6 +98,25 @@ def _tier_dropped_reason(raw_entry):
return "unrecognised tier entry (expected string or dict)"
def _empty_report(warnings, tiers, dropped, unknown, gateway):
"""无效策略的空报告(审计批 5,N-10:纯结构整理,行为不变)。
dry_run_policy_document 的两处早期返回(非对象文档、解析
出空策略)原来各写一遍同样的 dict 骨架,只有 warnings 不同;
抽成助手后各处只传不同项。传入的列表按引用进报告(与原来
直接写字面量时同一语义),不拷贝。
"""
return {
"valid": False, "blocked": True, "version": None,
"content_fingerprint": None,
"global_mode": None, "global_mode_source": None,
"tiers": tiers, "dropped_tiers": dropped,
"unknown_tiers": unknown, "warnings": warnings,
"would_activate": [], "would_shadow": [], "would_off": [],
"gateway": gateway,
}
def dry_run_policy_document(data, env_mode_override=None,
gateway_model=None):
"""Dry-run one merged policy document (pure, no IO).
@@ -118,17 +137,10 @@ def dry_run_policy_document(data, env_mode_override=None,
if gateway_model else "env_unset"),
"tiers": {}}
if not isinstance(data, dict):
return {
"valid": False, "blocked": True, "version": None,
"content_fingerprint": None,
"global_mode": None, "global_mode_source": None,
"tiers": tiers_report, "dropped_tiers": dropped,
"unknown_tiers": unknown,
"warnings": ["policy document is not an object; "
"the loader would ignore it entirely"],
"would_activate": [], "would_shadow": [], "would_off": [],
"gateway": _gw,
}
return _empty_report(
["policy document is not an object; "
"the loader would ignore it entirely"],
tiers_report, dropped, unknown, _gw)
raw_tiers = data.get("tiers")
if isinstance(raw_tiers, dict):
for name in sorted(raw_tiers):
@@ -142,15 +154,8 @@ def dry_run_policy_document(data, env_mode_override=None,
"policy is unusable (no usable tiers, or global mode "
"outside off/shadow/active); the loader would ignore it "
"entirely and workers would keep the worker default")
return {
"valid": False, "blocked": True, "version": None,
"content_fingerprint": None,
"global_mode": None, "global_mode_source": None,
"tiers": tiers_report, "dropped_tiers": dropped,
"unknown_tiers": unknown, "warnings": warnings,
"would_activate": [], "would_shadow": [], "would_off": [],
"gateway": _gw,
}
return _empty_report(
warnings, tiers_report, dropped, unknown, _gw)
global_mode = policy.mode
global_source = "policy"
if env_mode_override: