Merge pull request #6410 from loopx-project/codex/review-b-architecture-health-20261014-0540

Author: huangruiteng

loopx/capabilities/benchmark_toolkit/integrity.py

@@ -13,6 +13,8 @@
 from typing import Any, TypeGuard, cast
 from urllib.parse import urlsplit
 
+from ...control_plane.content_digest import BARE_SHA256_PATTERN as _SHA256_PATTERN
+
 from .environment_access import (
     _heredoc_delimiters,
     authorized_task_environment_probe_count,
@@ -94,7 +96,6 @@
 _EVALUATION_PROTOCOL_OUTPUT_KINDS = frozenset(
     {"score", "validation", "metrics", "summary", "diagnostics"}
 )
-_SHA256_PATTERN = re.compile(r"^[0-9a-f]{64}$")
 
 _DEFAULT_DENIED_ARGUMENT_MARKERS: dict[str, tuple[str, ...]] = {
     "restricted_answer_source_request": (

tests/architecture/test_content_digest_single_owner.py

@@ -158,6 +158,7 @@
     "loopx.capabilities.benchmark_toolkit.behavior_finding",
     "loopx.capabilities.benchmark_toolkit.continuation",
     "loopx.capabilities.benchmark_toolkit.factorial_contrast",
+    "loopx.capabilities.benchmark_toolkit.integrity",
     "loopx.capabilities.benchmark_toolkit.runtime_continuity",
     "loopx.capabilities.benchmark_toolkit.study_projection",
     "loopx.capabilities.content_ops.item_lifecycle",
@@ -208,9 +209,15 @@
     "loopx.presentation.static_site",
 )
 
-# A consumer that hands `re` a pattern this file cannot fold. Pinned empty: folding reads
-# every construction in every consumer today, so adding an entry has to be argued.
-UNREADABLE_CONSUMER_CONSTRUCTIONS: dict[str, str] = {}
+# A consumer that hands `re` a pattern this file cannot fold. Folding reads
+# every construction except the declared marker reader, which is fenced below.
+UNREADABLE_CONSUMER_CONSTRUCTIONS: dict[str, str] = {
+    "loopx.capabilities.benchmark_toolkit.integrity": (
+        "_marker_present matches an escaped caller-supplied filename/token inside "
+        "command text with explicit basename boundaries; it does not validate a "
+        "whole-value digest. Its sole dynamic regex is fenced to that reader."
+    ),
+}
 
 # Reading `.pattern` off the owner and recompiling it states the decision a second time
 # while showing the scan no shape at all. Pinned empty; widening it is a review event.
@@ -1581,3 +1588,49 @@ def test_chat_bundle_source_digest_uses_the_owner_bare_shape() -> None:
     from loopx.presentation import chat_bundle
 
     assert chat_bundle.BARE_SHA256_PATTERN is BARE_SHA256_PATTERN
+
+
+@pytest.mark.parametrize("digest", (*BARE_ACCEPTS, *BARE_REJECTS))
+def test_benchmark_task_authorization_keeps_the_bare_digest_contract(
+    digest: str,
+) -> None:
+    from loopx.capabilities.benchmark_toolkit.integrity import (
+        BENCHMARK_TASK_ENVIRONMENT_ACCESS_SCHEMA_VERSION,
+        _validated_task_environment_access,
+    )
+
+    access = {
+        "schema_version": BENCHMARK_TASK_ENVIRONMENT_ACCESS_SCHEMA_VERSION,
+        "authorization_id": "digest-contract-fixture",
+        "authorization_sha256": digest,
+        "authority": "benchmark_task",
+        "purpose": "task_submission",
+        "namespace": "TASKCAP_",
+        "variable_names": ["TASKCAP_TOKEN"],
+    }
+    if digest in BARE_ACCEPTS:
+        normalized = _validated_task_environment_access(access)
+        assert normalized is not None
+        assert normalized["authorization_sha256"] == digest
+    else:
+        with pytest.raises(
+            ValueError,
+            match="benchmark_task_environment_access_authorization_sha256_invalid",
+        ):
+            _validated_task_environment_access(access)
+
+
+def test_benchmark_dynamic_regex_exemption_stays_in_the_marker_reader() -> None:
+    analysis = _module_of("loopx.capabilities.benchmark_toolkit.integrity")
+    unreadable = [item for item in analysis["constructions"] if not item["readable"]]
+    source = (PACKAGE_ROOT / "capabilities/benchmark_toolkit/integrity.py").read_text(
+        encoding="utf-8"
+    )
+    marker_reader = next(
+        node
+        for node in ast.parse(source).body
+        if isinstance(node, ast.FunctionDef) and node.name == "_marker_present"
+    )
+    assert len(unreadable) == 1, "the marker exception must not hide another matcher"
+    assert marker_reader.lineno <= unreadable[0]["line"] <= marker_reader.end_lineno
+    assert unreadable[0]["construction"] == "search", "not a whole-value reader"

tests/architecture/top_level_module_budget.json

@@ -1,6 +1,6 @@
 {
   "schema": "loopx_top_level_module_budget_v0",
-  "baseline_commit": "9eaacfbf2ff93d5386cee82ddf0847d9c739e78a",
-  "max_top_level_modules": 147,
+  "baseline_commit": "14112f36cfa56400851494e4236c84dd74538069",
+  "max_top_level_modules": 146,
   "allowlist": ["__init__.py", "entrypoint.py", "cli.py"]
 }