feat: enforce branches-only baseline validation in reviewer reports (Closes #325)

Add assess_reviewer_baseline_validation_proof to block test-suite runs in the main checkout and require complete baseline worktree proof when reports claim pre-existing master failures. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-07-07 05:02:07 -04:00
parent 0ae39c231d
commit a47083b9b8
2 changed files with 320 additions and 1 deletions
@@ -24,6 +24,7 @@ from review_proofs import (  # noqa: E402
    ISSUE_SELECTION_CONTINUATION_EXPLICIT,
    ISSUE_SELECTION_REPRESENTED_BY_OPEN_PR,
    assess_author_pr_report,
+    assess_reviewer_baseline_validation_proof,
    assess_capability_evidence,
    assess_capability_proof,
    assess_contradictory_no_pr_claim,
@@ -2160,5 +2161,125 @@ class TestCreateIssueFinalReport(unittest.TestCase):
        self.assertTrue(result["downgraded"])


+class TestReviewerBaselineValidationProof(unittest.TestCase):
+    """Issue #325: baseline validation must use branches/ worktrees."""
+
+    ROOT = "/repo/Gitea-Tools"
+
+    def _good_baseline_proof(self, **overrides):
+        proof = {
+            "worktree_path": f"{self.ROOT}/branches/baseline-master-pr280",
+            "baseline_target_sha": PINNED,
+            "pr_head_sha": OTHER,
+            "baseline_failures": ["tests/test_foo.py::test_bar"],
+            "pr_failures": ["tests/test_foo.py::test_bar"],
+            "failure_signatures_match": True,
+            "clean_before": True,
+            "clean_after": True,
+        }
+        proof.update(overrides)
+        return proof
+
+    def test_main_checkout_test_run_blocks(self):
+        result = assess_reviewer_baseline_validation_proof(
+            validation_runs=[
+                {
+                    "command": "venv/bin/pytest tests/",
+                    "working_directory": self.ROOT,
+                    "project_root": self.ROOT,
+                }
+            ],
+            project_root=self.ROOT,
+        )
+        self.assertFalse(result["proven"])
+        self.assertTrue(result["block"])
+        self.assertTrue(result["violations"])
+
+    def test_branches_worktree_test_run_passes(self):
+        result = assess_reviewer_baseline_validation_proof(
+            validation_runs=[
+                {
+                    "command": "venv/bin/pytest tests/",
+                    "working_directory": f"{self.ROOT}/branches/review-pr-280",
+                    "project_root": self.ROOT,
+                }
+            ],
+            project_root=self.ROOT,
+        )
+        self.assertTrue(result["proven"])
+
+    def test_preexisting_claim_without_baseline_proof_fails(self):
+        result = assess_reviewer_baseline_validation_proof(
+            report_text=(
+                "Validation: full-suite failures are pre-existing on master."
+            ),
+            project_root=self.ROOT,
+        )
+        self.assertFalse(result["proven"])
+        self.assertTrue(result["claims_preexisting"])
+
+    def test_preexisting_claim_with_complete_baseline_proof_passes(self):
+        result = assess_reviewer_baseline_validation_proof(
+            report_text="Failures are pre-existing on master.",
+            baseline_proof=self._good_baseline_proof(),
+            project_root=self.ROOT,
+        )
+        self.assertTrue(result["proven"])
+
+    def test_mismatched_failures_block_preexisting_claim(self):
+        result = assess_reviewer_baseline_validation_proof(
+            report_text="Same as master.",
+            baseline_proof=self._good_baseline_proof(
+                failure_signatures_match=False,
+                pr_failures=["tests/test_other.py::test_other"],
+            ),
+            project_root=self.ROOT,
+        )
+        self.assertFalse(result["proven"])
+
+    def test_report_parsed_main_checkout_cwd_blocks(self):
+        result = assess_reviewer_baseline_validation_proof(
+            report_text=(
+                "- Validation command: venv/bin/pytest tests/\n"
+                f"- Working directory: {self.ROOT}\n"
+            ),
+            project_root=self.ROOT,
+        )
+        self.assertFalse(result["proven"])
+        self.assertTrue(result["block"])
+
+    def test_build_final_report_downgrades_main_checkout_validation(self):
+        report = build_final_report(
+            checkout_proof=_good_checkout(),
+            inventory=_good_inventory(),
+            validation=_good_validation(),
+            contamination=_good_contamination(),
+            identity_eligible=True,
+            merge_performed=False,
+            issue_status_verified=True,
+            capability_evidence=_good_capability_evidence(),
+            sweep=_good_sweep(),
+            live_state=_good_live_state(),
+            role_boundary=_good_role_boundary(),
+            review_mutation=_good_review_mutation(),
+            controller_handoff=_good_handoff(),
+            capability_proof=_good_capability_proof(),
+            sweep_proof=_good_secret_sweep(),
+            worktree_proof={
+                "worktree_path": "/repo/branches/review-feat-issue-224",
+                "porcelain_status": "",
+                "pr_scope_files": ["docs/wiki/Repositories.md"],
+                "scratch_used": True,
+            },
+            report_text=(
+                "- Validation command: venv/bin/pytest tests/\n"
+                f"- Working directory: {self.ROOT}\n"
+            ),
+            project_root=self.ROOT,
+        )
+        self.assertNotEqual(report["grade"], "A")
+        self.assertFalse(report["baseline_validation_proven"])
+
+
 if __name__ == "__main__":
    unittest.main()