"""7 维审计评分卡定向测试。 钉住的规则（任何一处改动都必须先改文档再改测试）： - 7 维全部 >=9 才达标；任一维 <9 总体不达标。 - 平均分绝不能作为达标依据：6 维 10 分、1 维 4 分，平均 9.1 分， 总体仍是不达标。 - 未知维记 None 且总体不达标；未知不记 0、不记 10、不估算。 - 夹具/视口替代/代码评审证据记未实测，不算通过。 - 阈值默认值标注 test_default_unapproved；只有调用方显式传入 user_approved 才算已拍板。 - 端点只读：GET /audit-scorecard 不写库、不写账本、不改链头。 """ import http.client import json import os import sys import tempfile import threading import unittest from pathlib import Path try: from cloud.audit_scorecard import ( DEFAULT_THRESHOLDS, build_scorecard, example_scorecard_as_of_2026_10_31) from cloud.auth import AuthStore from cloud.server import create_server except ImportError: sys.path.insert(0, str(Path(__file__).resolve().parents[2])) from cloud.audit_scorecard import ( DEFAULT_THRESHOLDS, build_scorecard, example_scorecard_as_of_2026_10_31) from cloud.auth import AuthStore from cloud.server import create_server def _full_evidence(): return { "delivery_quality": { "first_pass_rate": 0.96, "defect_rate": 0.01, "rework_rate": 0.04, "first_pass_known": True, "defect_known": True, "rework_known": True, "attempts_present": True, "evidence_kind": "real", }, "gate_audit": { "hard_gate_enforced": True, "gate_items_passed": 5, "gate_items_total": 5, "merge_blocked_verified": True, "loop_end_to_end_verified": True, "sampling_misjudgment_rate": 0.0, }, "arch_contract": { "contract_frozen": True, "arch_violations": 0, "directory_violations": 0, "import_violations": 0, "stack_changed_without_approval": False, }, "test_coverage": { "prd_coverage_rate": 1.0, "cross_matrix_coverage_rate": 1.0, "coverage_pct": 0.92, "cross_matrix_kind": "real", "real_pg": True, "real_service": True, "agent_six_complete": True, "lint_items": 0, "mypy_items": 0, "bandit_high": 0, }, "security_ledger": { "ledger_verify_ok": True, "ledger_coverage_rate": 1.0, "branch_protection": "protected", "shell_whitelist_pass_rate": 1.0, "anchor_check_recent": True, }, "cost_quota": { "cost_records_complete": True, "unpriced_as_zero": False, "per_creator_present": True, "quota_cutoff_verified": True, }, "ops_scale": { "ci_green_rate": 1.0, "deploy_success_rate": 1.0, "rollback_drill_done": True, "ha_status": "second_host", "parallel_scale_proven": 40, }, } class ScorecardTestCase(unittest.TestCase): def test_all_nine_passes(self): report = build_scorecard(_full_evidence()) self.assertEqual(report["overall"], "pass") self.assertTrue(report["overall_pass"]) self.assertEqual(len(report["dimensions"]), 7) for dim in report["dimensions"]: self.assertIsNotNone(dim["score"]) self.assertGreaterEqual(dim["score"], 9.0) self.assertEqual(dim["status"], "pass") def test_one_dimension_below_nine_fails_overall(self): ev = _full_evidence() ev["gate_audit"]["hard_gate_enforced"] = False report = build_scorecard(ev) self.assertEqual(report["overall"], "not_pass") self.assertFalse(report["overall_pass"]) gate = [d for d in report["dimensions"] if d["id"] == "gate_audit"][0] self.assertEqual(gate["score"], 4.0) def test_average_91_with_one_four_still_fails(self): # 6 维 10 分、1 维 4 分：平均 9.1 分，总体仍是不达标。 # 构造方式：只让门禁维已知未强制（4.0），其余维满分证据。 ev = _full_evidence() ev["gate_audit"]["hard_gate_enforced"] = False report = build_scorecard(ev) self.assertEqual(report["average_score"], 9.1) self.assertTrue(report["average_is_not_pass_criterion"]) self.assertEqual(report["overall"], "not_pass") self.assertFalse(report["overall_pass"]) def test_unknown_dimension_is_none_and_fails_overall(self): report = build_scorecard({}) self.assertEqual(report["overall"], "not_pass") for dim in report["dimensions"]: self.assertIsNone(dim["score"]) self.assertEqual(dim["status"], "unknown") self.assertTrue(report["missing_items"]) self.assertIsNone(report["average_score"]) def test_unknown_is_not_zero_and_not_ten(self): ev = _full_evidence() ev["delivery_quality"] = {} report = build_scorecard(ev) dim = [d for d in report["dimensions"] if d["id"] == "delivery_quality"][0] self.assertIsNone(dim["score"]) self.assertNotEqual(dim["score"], 0) self.assertNotEqual(dim["score"], 10) def test_fixture_evidence_is_untested_not_pass(self): ev = _full_evidence() ev["test_coverage"]["cross_matrix_kind"] = "viewport_substitute" report = build_scorecard(ev) dim = [d for d in report["dimensions"] if d["id"] == "test_coverage"][0] self.assertIsNone(dim["score"]) self.assertEqual(dim["status"], "unknown") self.assertTrue(dim["untested_items"]) self.assertEqual(report["overall"], "not_pass") def test_conditional_verdict_is_not_pass(self): ev = _full_evidence() ev["gate_audit"]["audit_verdict"] = "conditional" report = build_scorecard(ev) dim = [d for d in report["dimensions"] if d["id"] == "gate_audit"][0] self.assertIsNone(dim["score"]) self.assertTrue(dim["untested_items"]) def test_threshold_defaults_are_unapproved(self): for entry in DEFAULT_THRESHOLDS.values(): self.assertEqual(entry["source"], "test_default_unapproved") report = build_scorecard(_full_evidence()) self.assertEqual(report["thresholds_source"], "test_default_unapproved") def test_user_approved_thresholds_change_source_only(self): th = {k: {"value": v["value"], "source": "user_approved"} for k, v in DEFAULT_THRESHOLDS.items()} report = build_scorecard(_full_evidence(), thresholds=th) self.assertEqual(report["thresholds_source"], "user_approved") self.assertEqual(report["overall"], "pass") def test_example_current_state_is_not_pass_and_not_estimated(self): # 示例是系统用当前真实状态证据算出来的，不是上一轮判断分。 report = example_scorecard_as_of_2026_10_31() self.assertEqual(report["overall"], "not_pass") self.assertFalse(report["overall_pass"]) # 时效标注：示例卡是 2026-10-31 快照，不是当前系统得分。 self.assertEqual(report["evidence_as_of"], "2026-10-31") self.assertEqual(report["evidence_kind"], "historical_example_snapshot") self.assertTrue(report["not_current_system_score"]) self.assertEqual(report["thresholds_source"], "test_default_unapproved") # 至少有一维是未知（None），且总体不达标不靠平均分。 self.assertTrue(any(d["score"] is None for d in report["dimensions"])) class ScorecardEndpointTestCase(unittest.TestCase): def setUp(self): self.tmp = tempfile.TemporaryDirectory() self.db_path = os.path.join(self.tmp.name, "control.db") self.auth = AuthStore(self.db_path) self.owner_id, self.owner_key = self.auth.create_user("owner") self.server = create_server(self.db_path, "127.0.0.1", 0) self.port = self.server.server_address[1] self.thread = threading.Thread( target=self.server.serve_forever, daemon=True) self.thread.start() def tearDown(self): self.server.shutdown() self.server.server_close() self.thread.join(timeout=5) try: self.auth.conn.close() except Exception: pass self.tmp.cleanup() def _req(self, method, path, key=None): conn = http.client.HTTPConnection("127.0.0.1", self.port, timeout=10) hdrs = {} if key is not None: hdrs["X-API-Key"] = key try: conn.request(method, path, headers=hdrs) resp = conn.getresponse() data = resp.read() finally: conn.close() try: parsed = json.loads(data.decode("utf-8")) if data else None except ValueError: parsed = None return resp.status, parsed def test_endpoint_requires_auth(self): status, _ = self._req("GET", "/audit-scorecard") self.assertEqual(status, 401) def test_endpoint_is_readonly_and_not_pass_on_main_base(self): status, report = self._req("GET", "/audit-scorecard", key=self.owner_key) self.assertEqual(status, 200) self.assertEqual(len(report["dimensions"]), 7) self.assertEqual(report["overall"], "not_pass") self.assertTrue(report["average_is_not_pass_criterion"]) self.assertEqual(report["thresholds_source"], "test_default_unapproved") # 只读：端点调用前后，库里不产生评分卡表（本端点不写库）。 import sqlite3 conn = sqlite3.connect(self.db_path) try: tables = {r[0] for r in conn.execute( "SELECT name FROM sqlite_master WHERE type='table'")} finally: conn.close() self.assertNotIn("audit_scorecard", tables)