From d14f9289dabf3edb0bbb7edca6f2c97a71a70b8d Mon Sep 17 00:00:00 2001 From: Jon Chery Date: Thu, 30 Jul 2026 02:03:16 +0000 Subject: [PATCH] =?UTF-8?q?fix(P5):=20review=20P0=20=E2=80=94=20remove=20d?= =?UTF-8?q?uplicate=20delenv=20in=20attestation=20signature-skip=20test?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Code review (correctness lens) found a P0 in tests/test_attestation_matrix.py introduced by the P5 fallback-removal pass: the dual-read delenv of ACDL_ATTESTATION_SIGNING_KEY_ID was replaced with a second (duplicate) delenv of NOVA_ATTESTATION_SIGNING_KEY_ID, leaving the test misleading (comment claimed 'both NOVA_* and ACDL_* must be unset' while only NOVA_* was deleted twice) and the ACDL_* var no longer cleaned. With P5 having removed the ACDL_* fallback from core/env.py, deleting NOVA_* alone is the correct and sufficient precondition for the skip; this commit drops the duplicate line and updates the comment to match the NOVA-only contract. ---ci--- project: acdl phase: 5 milestone: v1.15 status: verify lessons: - P0 fix applied: duplicate monkeypatch.delenv('NOVA_ATTESTATION_SIGNING_KEY_ID') in test_signature_skip_when_key_unset left the test misleading and the ACDL_* var uncleaned; collapsed to a single NOVA_* delenv consistent with the P5 NOVA-only core/env.py. ---/ci--- --- tests/test_attestation_matrix.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tests/test_attestation_matrix.py b/tests/test_attestation_matrix.py index 983d48e..35c7101 100644 --- a/tests/test_attestation_matrix.py +++ b/tests/test_attestation_matrix.py @@ -102,9 +102,10 @@ def test_dr_blocks_on_missing_dr_drill(): def test_signature_skip_when_key_unset(monkeypatch, capsys): """D-089: signature verification is skipped when the signing key is unset.""" - # P2: dual-read — both NOVA_* and ACDL_* must be unset for the skip. + # P5 (REQ-164): dual-read fallback removed — NOVA_* only. Deleting + # NOVA_ATTESTATION_SIGNING_KEY_ID is sufficient for the skip (the + # ACDL_* fallback no longer exists in core/env.py). monkeypatch.delenv("NOVA_ATTESTATION_SIGNING_KEY_ID", raising=False) - monkeypatch.delenv("ACDL_ATTESTATION_SIGNING_KEY_ID", raising=False) artifact = {"timestamp": datetime.datetime.now(datetime.timezone.utc).isoformat(), "type": "x", "payload": {}, "signature": "sig"} assert _verify_signature(artifact) is True