feat(nono): add isolated evidence harness

2026-08-27 02:23:29 -04:00
parent 4bbd6a6d06
commit 54c20e2012
20 changed files with 3332 additions and 0 deletions
@@ -0,0 +1,57 @@
+from __future__ import annotations
+
+import unittest
+
+from .redaction import RedactionError, assert_no_leaks, redact, scan_for_leaks
+
+
+class RedactionTests(unittest.TestCase):
+    def test_recursive_canary_redaction_across_all_evidence_surfaces(self) -> None:
+        canary = "canary-value-93f1"
+        evidence = {
+            canary + "-key": "key canary",
+            "environment": {"OPENAI_API_KEY": canary, "SAFE_MODE": "on"},
+            "argv": ["--token", canary],
+            "stdout": "output " + canary,
+            "stderr": "error " + canary,
+            "exception": RuntimeError("failed with " + canary),
+            "nested": [{"GITHUB_TOKEN": "another-value"}],
+        }
+        self.assertTrue(scan_for_leaks(evidence, canaries=[canary]))
+        redacted = redact(evidence, canaries=[canary])
+        assert_no_leaks(redacted, canaries=[canary])
+        self.assertEqual(redacted["environment"]["SAFE_MODE"], "on")
+        self.assertNotIn(canary, str(redacted))
+        self.assertIn("[REDACTED]", str(redacted))
+
+    def test_configured_name_pattern_is_precise_for_safe_fields(self) -> None:
+        evidence = {
+            "status": "passed",
+            "provider": "fixture",
+            "tokenCount": 2,
+            "MY_SECRET_ALPHA": "fixture-secret",
+            "message": "MY_SECRET_ALPHA was used",
+        }
+        patterns = [r"(?<![A-Za-z0-9])MY_SECRET_[A-Z]+(?![A-Za-z0-9])"]
+        leaks = scan_for_leaks(evidence, credential_name_patterns=patterns)
+        self.assertIn("MY_SECRET_ALPHA", leaks)
+        self.assertIn("message", leaks)
+        self.assertNotIn("status", leaks)
+        self.assertNotIn("provider", leaks)
+        self.assertNotIn("tokenCount", leaks)
+        cleaned = redact(evidence, credential_name_patterns=patterns)
+        assert_no_leaks(cleaned, credential_name_patterns=patterns)
+        self.assertEqual(cleaned["status"], "passed")
+        self.assertEqual(cleaned["provider"], "fixture")
+        self.assertEqual(cleaned["tokenCount"], 2)
+
+    def test_leak_assertion_rejects_unredacted_summary_material(self) -> None:
+        with self.assertRaises(RedactionError):
+            assert_no_leaks(
+                {"observation": "GITHUB_TOKEN still visible"},
+                canaries=["a-secret-canary"],
+            )
+
+
+if __name__ == "__main__":
+    unittest.main()