From 9a269bda3cb7060e91f398bc2aea15e9067b0a48 Mon Sep 17 00:00:00 2001 From: yaojingang Date: Tue, 16 Jun 2026 23:14:47 +0800 Subject: [PATCH] Reject duplicate world-class artifact refs --- reports/architecture_maintainability.json | 2 +- reports/architecture_maintainability.md | 2 +- reports/context_budget.json | 12 ++++++------ reports/context_budget.md | 2 +- reports/context_budget_summary.json | 6 +++--- reports/security_trust_report.json | 2 +- reports/security_trust_report.md | 2 +- scripts/world_class_evidence_contract.py | 7 +++++++ tests/verify_world_class_evidence_intake.py | 13 +++++++++++++ 9 files changed, 34 insertions(+), 14 deletions(-) diff --git a/reports/architecture_maintainability.json b/reports/architecture_maintainability.json index 1b14ed1..13f011b 100644 --- a/reports/architecture_maintainability.json +++ b/reports/architecture_maintainability.json @@ -87,7 +87,7 @@ }, { "path": "scripts/world_class_evidence_contract.py", - "lines": 620, + "lines": 627, "kind": "internal-module", "severity": "pass", "recommendation": "Watch this file before adding new responsibilities; extract a helper module when one concern dominates." diff --git a/reports/architecture_maintainability.md b/reports/architecture_maintainability.md index 35a675d..bccbf1b 100644 --- a/reports/architecture_maintainability.md +++ b/reports/architecture_maintainability.md @@ -42,7 +42,7 @@ No near-threshold files found. | `scripts/review_studio_gates.py` | `643` | `internal-module` | `pass` | | `scripts/cross_packager.py` | `638` | `cli-script` | `pass` | | `scripts/build_skill_atlas.py` | `637` | `cli-script` | `pass` | -| `scripts/world_class_evidence_contract.py` | `620` | `internal-module` | `pass` | +| `scripts/world_class_evidence_contract.py` | `627` | `internal-module` | `pass` | | `scripts/render_benchmark_reproducibility.py` | `595` | `cli-script` | `pass` | | `scripts/optimize_description.py` | `585` | `cli-script` | `pass` | diff --git a/reports/context_budget.json b/reports/context_budget.json index 8f66ae9..978a962 100644 --- a/reports/context_budget.json +++ b/reports/context_budget.json @@ -6,15 +6,15 @@ "context_budget_tier": "production", "context_budget_limit": 1000, "skill_body_tokens": 797, - "other_text_tokens": 1063452, + "other_text_tokens": 1063691, "estimated_initial_load_tokens": 990, - "estimated_total_text_tokens": 1064249, - "deferred_resource_tokens": 492676, + "estimated_total_text_tokens": 1064488, + "deferred_resource_tokens": 492741, "deferred_resource_warn_threshold": 120000, "deferred_resource_dirs": [ { "path": "scripts", - "estimated_tokens": 432578, + "estimated_tokens": 432643, "file_count": 137 }, { @@ -36,7 +36,7 @@ "large_deferred_resource_dirs": [ { "path": "scripts", - "estimated_tokens": 432578, + "estimated_tokens": 432643, "file_count": 137 } ], @@ -59,7 +59,7 @@ ], "missing": [], "path": "scripts", - "estimated_tokens": 432578, + "estimated_tokens": 432643, "file_count": 137, "rationale": "Script resources are deterministic deferred tools, not initial-load prompt context." } diff --git a/reports/context_budget.md b/reports/context_budget.md index 0315437..19b3c1f 100644 --- a/reports/context_budget.md +++ b/reports/context_budget.md @@ -2,7 +2,7 @@ | Target | Path | Tier | Limit | Initial | SKILL | Deferred | Resource Governance | Large Deferred Dirs | Quality Density | Unused Dirs | Status | | --- | --- | --- | ---: | ---: | ---: | ---: | --- | --- | ---: | --- | --- | -| root | `.` | `production` | 1000 | 990 | 797 | 492676 | `governed` | scripts:432578 | 131.3 | - | ok | +| root | `.` | `production` | 1000 | 990 | 797 | 492741 | `governed` | scripts:432643 | 131.3 | - | ok | | complex-release-orchestrator | `examples/complex-release-orchestrator/generated-skill` | `production` | 1000 | 790 | 718 | 1657 | `not-required` | - | 164.6 | - | ok | | governed-incident-command | `examples/governed-incident-command/generated-skill` | `production` | 1000 | 760 | 658 | 1030 | `not-required` | - | 171.1 | - | ok | diff --git a/reports/context_budget_summary.json b/reports/context_budget_summary.json index 787f4b9..0276590 100644 --- a/reports/context_budget_summary.json +++ b/reports/context_budget_summary.json @@ -8,11 +8,11 @@ "budget_limit": 1000, "initial_tokens": 990, "skill_body_tokens": 797, - "deferred_resource_tokens": 492676, + "deferred_resource_tokens": 492741, "large_deferred_resource_dirs": [ { "path": "scripts", - "estimated_tokens": 432578, + "estimated_tokens": 432643, "file_count": 137 } ], @@ -35,7 +35,7 @@ ], "missing": [], "path": "scripts", - "estimated_tokens": 432578, + "estimated_tokens": 432643, "file_count": 137, "rationale": "Script resources are deterministic deferred tools, not initial-load prompt context." } diff --git a/reports/security_trust_report.json b/reports/security_trust_report.json index 58ab11a..cf13a71 100644 --- a/reports/security_trust_report.json +++ b/reports/security_trust_report.json @@ -23,7 +23,7 @@ "interactive_script_count": 0, "package_hash_scope": "source-contract-without-generated-reports", "package_hash_file_count": 228, - "package_sha256": "c2ad60de7b1e3d70021ec9e0169a8f8c8c860ff830a434baba2ce44e2530069e" + "package_sha256": "2646b8f6692f6f51b8cb8dcc3007f05348033c6de1aa1d850e85199489e3c336" }, "failures": [], "warnings": [], diff --git a/reports/security_trust_report.md b/reports/security_trust_report.md index 493da8c..f4d4b36 100644 --- a/reports/security_trust_report.md +++ b/reports/security_trust_report.md @@ -16,7 +16,7 @@ - Interactive scripts: `0` - Package hash scope: `source-contract-without-generated-reports` - Package hash files: `228` -- Package SHA256: `c2ad60de7b1e3d70021ec9e0169a8f8c8c860ff830a434baba2ce44e2530069e` +- Package SHA256: `2646b8f6692f6f51b8cb8dcc3007f05348033c6de1aa1d850e85199489e3c336` ## Failures diff --git a/scripts/world_class_evidence_contract.py b/scripts/world_class_evidence_contract.py index f9c184d..a50e949 100644 --- a/scripts/world_class_evidence_contract.py +++ b/scripts/world_class_evidence_contract.py @@ -258,6 +258,7 @@ def validate_artifact_refs( add_error(errors, isinstance(refs, list) and len(refs) > 0, "artifact_refs must contain at least one reference") required_paths = REQUIRED_REAL_ARTIFACT_PATHS.get(str(payload.get("evidence_key", "")), set()) observed_paths: set[str] = set() + seen_artifact_paths: set[str] = set() stats = { "artifact_ref_count": len(refs) if isinstance(refs, list) else 0, "artifact_existing_count": 0, @@ -287,6 +288,12 @@ def validate_artifact_refs( errors.append(f"artifact_refs[{index}].path {path_error}") continue rel = rel_path(resolved, root) + add_error( + errors, + rel not in seen_artifact_paths, + f"artifact_refs[{index}].path must not duplicate another artifact reference", + ) + seen_artifact_paths.add(rel) if rel in DISALLOWED_REAL_ARTIFACTS: errors.append(f"artifact_refs[{index}].path must not reference raw local telemetry logs") if not resolved.exists() or not resolved.is_file(): diff --git a/tests/verify_world_class_evidence_intake.py b/tests/verify_world_class_evidence_intake.py index 4c0fa2c..ee9d081 100644 --- a/tests/verify_world_class_evidence_intake.py +++ b/tests/verify_world_class_evidence_intake.py @@ -301,6 +301,19 @@ def assert_external_contract_artifact_validation() -> None: template_expected=False, ) assert provider_valid["status"] == "pass", provider_valid + provider_duplicate_ref = provider_artifact_submission(skill_root) + provider_duplicate_ref["artifact_refs"].append(dict(provider_duplicate_ref["artifact_refs"][0])) + provider_duplicate_result = validate_payload( + provider_duplicate_ref, + provider_entry, + path=skill_root / "evidence" / "world_class" / "submissions" / "provider-holdout.json", + root=skill_root, + template_expected=False, + ) + assert provider_duplicate_result["status"] == "fail", provider_duplicate_result + assert any("must not duplicate another artifact reference" in error for error in provider_duplicate_result["errors"]), ( + provider_duplicate_result["errors"] + ) provider_wrong_filename = validate_payload( provider_artifact_submission(skill_root), provider_entry,