vignette/scripts/test_g7_runtime_evidence.py

"""Tests for the metadata-only G7 runtime evidence sampler."""

from __future__ import annotations

import copy
import importlib.util
import json
import sys
import unittest
from pathlib import Path
from unittest import mock


RUNNER_PATH = Path(__file__).with_name("capture-g7-runtime-evidence.py")


def load_runner():
    spec = importlib.util.spec_from_file_location("g7_runtime_evidence", RUNNER_PATH)
    if spec is None or spec.loader is None:
        raise RuntimeError("G7 runtime evidence sampler could not be loaded")
    module = importlib.util.module_from_spec(spec)
    sys.modules[spec.name] = module
    spec.loader.exec_module(module)
    return module


def snapshot() -> dict[str, object]:
    return {
        "schema_version": "vignette.voice-runtime.v1",
        "scope": "single_api_worker",
        "privacy_boundary": "metadata_only_no_audio_transcript_or_session_ids",
        "reset_supported": False,
        "limits": {
            "max_utterance_audio_bytes": 10 * 1024 * 1024,
            "streaming_event_queue_max_items": 32,
            "uvicorn_ws_max_queue": 4,
        },
        "process": {
            "worker_instance_id": "a" * 24,
            "pid": 1,
            "platform": "linux",
            "started_at_utc": "2026-08-07T00:00:00Z",
            "uptime_seconds": 100.0,
            "rss_bytes": 50_000_000,
            "peak_rss_bytes": 55_000_000,
            "cpu_user_seconds": 3.0,
            "cpu_system_seconds": 1.0,
            "threads": 4,
            "open_file_descriptors": 12,
        },
        "counters": {
            "active_websockets": 0,
            "websocket_high_water": 2,
            "websockets_opened_total": 5,
            "active_streaming_provider_sessions": 0,
            "streaming_provider_session_high_water": 1,
            "streaming_provider_sessions_opened_total": 4,
            "route_audio_buffer_bytes": 0,
            "route_audio_buffer_high_water_bytes": 64000,
            "audio_bytes_received_total": 200000,
            "audio_overflow_rejections_total": 0,
            "streaming_event_queue_items": 0,
            "streaming_event_queue_high_water_items": 3,
            "streaming_event_queue_saturation_total": 0,
            "streaming_event_queue_wait_seconds_total": 0.0,
            "provider_finalize_total": 4,
            "provider_abort_total": 0,
            "provider_fallback_total": 0,
            "websocket_error_total": 0,
        },
    }


class G7RuntimeEvidenceTests(unittest.TestCase):
    @classmethod
    def setUpClass(cls) -> None:
        cls.runner = load_runner()

    def test_capture_keeps_one_worker_and_metadata_only_high_water(self) -> None:
        payload = snapshot()
        calls = 0

        def fetch(**_kwargs):
            nonlocal calls
            calls += 1
            return copy.deepcopy(payload)

        evidence = self.runner.capture_evidence(
            url="https://api.example.test/admin/voice-runtime",
            cookie_name="sid",
            cookie_value="secret",
            cookie_env="TEST_COOKIE",
            samples=2,
            interval_seconds=1.0,
            timeout_seconds=5.0,
            fetch=fetch,
            sleep=lambda _seconds: None,
        )

        self.assertEqual(2, calls)
        self.assertEqual("passed", evidence["status"])
        self.assertEqual(2, evidence["samples_completed"])
        self.assertEqual(2, evidence["high_water"]["websocket_high_water"])
        serialized = str(evidence)
        self.assertNotIn("secret", serialized)
        self.assertFalse(evidence["cookie_value_logged"])

    def test_public_fetch_uses_browser_compatible_user_agent(self) -> None:
        captured_request = None

        class Response:
            status = 200

            def __enter__(self):
                return self

            def __exit__(self, *_args):
                return False

            def read(self, _limit):
                return json.dumps(snapshot()).encode("utf-8")

        def urlopen(request, **_kwargs):
            nonlocal captured_request
            captured_request = request
            return Response()

        with mock.patch.object(self.runner.urllib.request, "urlopen", urlopen):
            result = self.runner.fetch_snapshot(
                url="https://api.example.test/admin/voice-runtime",
                cookie_name="sid",
                cookie_value="secret",
                timeout_seconds=5.0,
            )

        self.assertEqual("vignette.voice-runtime.v1", result["schema_version"])
        self.assertIsNotNone(captured_request)
        headers = {
            name.lower(): value for name, value in captured_request.header_items()
        }
        self.assertEqual(self.runner._BROWSER_UA, headers["user-agent"])
        self.assertEqual("application/json", headers["accept"])

    def test_worker_drift_fails_closed(self) -> None:
        first = snapshot()
        second = copy.deepcopy(first)
        second["process"]["worker_instance_id"] = "b" * 24
        values = iter((first, second))

        with self.assertRaisesRegex(
            self.runner.EvidenceFailure, "runtime_worker_drift"
        ):
            self.runner.capture_evidence(
                url="https://api.example.test/admin/voice-runtime",
                cookie_name="sid",
                cookie_value="secret",
                cookie_env="TEST_COOKIE",
                samples=2,
                interval_seconds=1.0,
                timeout_seconds=5.0,
                fetch=lambda **_kwargs: next(values),
                sleep=lambda _seconds: None,
            )

    def test_forbidden_fields_and_bad_bounds_are_rejected(self) -> None:
        unsafe = snapshot()
        unsafe["session_id"] = "forbidden"
        with self.assertRaisesRegex(self.runner.EvidenceFailure, "forbidden_field"):
            self.runner.validate_snapshot(unsafe)
        for samples, interval, expected in (
            (0, 1.0, "sample_count"),
            (1, float("nan"), "sample_interval"),
            (7200, 2.0, "capture_window"),
        ):
            with self.subTest(expected=expected):
                with self.assertRaisesRegex(self.runner.EvidenceFailure, expected):
                    self.runner.validate_capture_bounds(samples, interval)


if __name__ == "__main__":
    unittest.main()