Harden controller review and runtime gates

This commit is contained in:
2026-09-22 10:37:06 -04:00
parent 68e2f63e9a
commit 6d08fddac1
10 changed files with 199 additions and 90 deletions
+9 -35
View File
@@ -1,43 +1,17 @@
from pathlib import Path
import os
import subprocess
import tempfile
import runpy
import unittest
SCRIPT = Path(__file__).resolve().parents[1] / "scripts/nq-review"
REVIEW = runpy.run_path(str(Path(__file__).resolve().parents[1] / "scripts/nq-review"))
HEAD = "a" * 40
class ReviewLauncherTests(unittest.TestCase):
def test_pins_head_and_model_in_worktree(self):
with tempfile.TemporaryDirectory() as directory:
root = Path(directory)
repo = root / "repo"
repo.mkdir()
subprocess.run(["git", "init", "-q", str(repo)], check=True)
subprocess.run(["git", "-C", str(repo), "config", "user.email", "test@example.invalid"], check=True)
subprocess.run(["git", "-C", str(repo), "config", "user.name", "Test"], check=True)
(repo / "README").write_text("initial\n")
subprocess.run(["git", "-C", str(repo), "add", "README"], check=True)
subprocess.run(["git", "-C", str(repo), "commit", "-qm", "initial"], check=True)
head = subprocess.check_output(["git", "-C", str(repo), "rev-parse", "HEAD"], text=True).strip()
prompt = root / "review.txt"
prompt.write_text("Review this change.")
stub = root / "claude"
stub.write_text("#!/bin/sh\nprintf '%s\\n' \"$PWD\" \"$@\"\n")
stub.chmod(0o700)
env = os.environ.copy()
env["CLAUDE_BIN"] = str(stub)
result = subprocess.run([str(SCRIPT), str(repo), head, head, str(prompt)], env=env, text=True, capture_output=True)
self.assertEqual(result.returncode, 0, result.stderr)
self.assertIn(str(repo), result.stdout)
self.assertIn("--model\nclaude-sonnet-5", result.stdout)
self.assertIn("--effort\nhigh", result.stdout)
self.assertIn(head, result.stdout)
result = subprocess.run([str(SCRIPT), str(repo), head, "HEAD~1", str(prompt)], env=env, text=True, capture_output=True)
self.assertNotEqual(result.returncode, 0)
def test_exact_head_verdict(self):
self.assertEqual(REVIEW["verdict"](f"REVIEWED_HEAD: {HEAD}\nREVIEW_VERDICT: APPROVED\n", HEAD), "APPROVED")
with self.assertRaisesRegex(RuntimeError, "one verdict"):
REVIEW["verdict"](f"REVIEWED_HEAD: {'b' * 40}\nREVIEW_VERDICT: APPROVED\n", HEAD)
with self.assertRaisesRegex(RuntimeError, "one verdict"):
REVIEW["verdict"](f"REVIEWED_HEAD: {HEAD}\nREVIEW_VERDICT: APPROVED\nREVIEW_VERDICT: CHANGES_REQUIRED\n", HEAD)
if __name__ == "__main__":
unittest.main()