from pathlib import Path ROOT = Path(__file__).resolve().parents[2] PENTEST = ROOT / "skills" / "pentest" EXPLOITATION = PENTEST / "playbooks" / "exploitation.md" REPORTING = PENTEST / "playbooks" / "reporting.md" RECEIPT = PENTEST / "templates" / "verification-receipt.yaml" def test_oracle_aware_verification_receipt_template_exists(): text = RECEIPT.read_text(encoding="utf-8") required_fields = [ "schema_version:", "finding_id:", "hypothesis_id:", "state:", "proof_type:", "oracle_kind:", "actual_signal:", "artifacts:", ] for field in required_fields: assert field in text assert "candidate | validated | rejected | escalated" in text assert ( "idempotent_replay | differential | artifact | canary | oast | manual_observation" in text ) def test_playbooks_reference_receipt_template_without_duplication(): exploitation = EXPLOITATION.read_text(encoding="utf-8") reporting = REPORTING.read_text(encoding="utf-8") for text in (exploitation, reporting): assert "templates/verification-receipt.yaml" in text assert "oracle_kind" in text assert "state: validated" in text # Keep the schema canonical in the template instead of duplicating a full YAML block # in playbooks that are loaded into the LLM context. assert exploitation.count("finding_id: FIND-001") == 0 assert reporting.count("finding_id: FIND-001") == 0 def test_task1_keeps_receipt_contract_canonical_and_compact(): # Later reporting tasks may add playbook text; Task 1's bloat guard should only # protect against duplicating the receipt schema outside the canonical template. receipt_bytes = len(RECEIPT.read_bytes()) assert receipt_bytes <= 1200 exploitation = EXPLOITATION.read_text(encoding="utf-8") reporting = REPORTING.read_text(encoding="utf-8") full_schema_markers = [ "finding_id: FIND-001", "command_or_steps: |", 'validated_by: "Violin supervised validation"', ] for marker in full_schema_markers: assert marker not in exploitation assert marker not in reporting