From 505a0f63f1bb2f223af43a8b0a726697c58d1179 Mon Sep 17 00:00:00 2001 From: Chris Huber Date: Sun, 21 Jun 2026 19:09:14 -0400 Subject: [PATCH 1/2] Use neutral host tool policy fixtures --- inc/Engine/AI/Tools/HostToolPolicy.php | 2 +- tests/agent-bundle-runner-contract-smoke.php | 2 +- tests/pipeline-tool-policy-snapshot-smoke.php | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/inc/Engine/AI/Tools/HostToolPolicy.php b/inc/Engine/AI/Tools/HostToolPolicy.php index 232ad781b..2a1fe0fe4 100644 --- a/inc/Engine/AI/Tools/HostToolPolicy.php +++ b/inc/Engine/AI/Tools/HostToolPolicy.php @@ -200,7 +200,7 @@ private static function normalizeTransportPolicy( array $policy ): array { } /** - * Unwrap host policy documents embedded in broader runtime/sandbox payloads. + * Unwrap host policy documents embedded in broader runtime payloads. * * @param array $policy Policy candidate. * @return array diff --git a/tests/agent-bundle-runner-contract-smoke.php b/tests/agent-bundle-runner-contract-smoke.php index 80b7804cd..ec02c68ca 100644 --- a/tests/agent-bundle-runner-contract-smoke.php +++ b/tests/agent-bundle-runner-contract-smoke.php @@ -301,7 +301,7 @@ function datamachine_bundle_runner_contains( string $source, string $needle, str putenv( 'DATAMACHINE_HOST_TOOL_POLICY_JSON=' . json_encode( array( - 'schema' => 'homeboy/agent-tool-policy/v1', + 'schema' => 'generic/host-tool-policy/v1', 'default_location' => 'runner', 'tools' => array( 'workspace_grep' => array( 'execution_location' => 'control_plane' ), diff --git a/tests/pipeline-tool-policy-snapshot-smoke.php b/tests/pipeline-tool-policy-snapshot-smoke.php index 71d0fda78..7b997b29d 100644 --- a/tests/pipeline-tool-policy-snapshot-smoke.php +++ b/tests/pipeline-tool-policy-snapshot-smoke.php @@ -544,7 +544,7 @@ function resolve_policy_tools_with_evidence_for_test( array $flow_step_config, a 'allow_only_explicit' => true, 'allow_only' => array( 'alpha_tool', 'beta_tool' ), 'host_tool_policy' => array( - 'schema' => 'homeboy/agent-tool-policy/v1', + 'schema' => 'generic/host-tool-policy/v1', 'default_location' => 'runner', 'tools' => array( 'alpha_tool' => array( 'execution_location' => 'control_plane' ), @@ -562,7 +562,7 @@ function resolve_policy_tools_with_evidence_for_test( array $flow_step_config, a 'apply' => 'propose_only', 'read' => 'workspace', 'tools' => array( - 'schema' => 'homeboy/agent-tool-policy/v1', + 'schema' => 'generic/host-tool-policy/v1', 'default_location' => 'runner', 'tools' => array( 'alpha_tool' => array( 'execution_location' => 'control_plane' ), From 49310393348f145afa345cfde1318483942984e7 Mon Sep 17 00:00:00 2001 From: Chris Huber Date: Sun, 21 Jun 2026 19:20:54 -0400 Subject: [PATCH 2/2] Use neutral runtime vocabulary in policy smoke tests --- tests/agent-bundle-runner-contract-smoke.php | 10 ++-- ...smoke.php => runtime-vocabulary-smoke.php} | 46 +++++++++---------- 2 files changed, 28 insertions(+), 28 deletions(-) rename tests/{boundary-forbidden-names-smoke.php => runtime-vocabulary-smoke.php} (59%) diff --git a/tests/agent-bundle-runner-contract-smoke.php b/tests/agent-bundle-runner-contract-smoke.php index ec02c68ca..6cdb3f5ef 100644 --- a/tests/agent-bundle-runner-contract-smoke.php +++ b/tests/agent-bundle-runner-contract-smoke.php @@ -117,7 +117,7 @@ function datamachine_bundle_runner_contains( string $source, string $needle, str datamachine_bundle_runner_contains( $abilities, "'engine_data_outputs'", 'ability input schema accepts semantic output mappings', $failures, $passes ); datamachine_bundle_runner_contains( $ai_step, "\$payload['tool_recorders']", 'AI step forwards configured tool recorders to the loop', $failures, $passes ); -echo "\n[3] Runner exposes semantic outputs without hiding raw engine data\n"; +echo "\n[3] Runner exposes semantic outputs while preserving raw engine data\n"; require_once $root . '/inc/Core/JobStatus.php'; require_once $root . '/inc/Core/DataPath.php'; require_once $root . '/inc/Engine/AI/Tools/HostToolPolicy.php'; @@ -601,7 +601,7 @@ function datamachine_bundle_runner_contains( string $source, string $needle, str datamachine_bundle_runner_assert( true === ( $scheduled_required_response['success'] ?? null ), 'required outputs do not fail an async scheduled run before completion', $failures, $passes ); datamachine_bundle_runner_assert( array( 'future_result_url' ) === ( $scheduled_required_response['output_diagnostics']['missing_outputs'] ?? null ), 'async scheduled run still exposes missing output diagnostics', $failures, $passes ); -echo "\n[4] WP-CLI wraps the same ability instead of duplicating runner internals\n"; +echo "\n[4] WP-CLI wraps the same ability through the shared runner path\n"; foreach ( array( '@subcommand run-bundle' => 'run-bundle subcommand declared', 'AgentAbilities::runAgentBundle' => 'CLI calls ability callback', @@ -633,9 +633,9 @@ function datamachine_bundle_runner_contains( string $source, string $needle, str datamachine_bundle_runner_contains( $abilities . $runner . $ai_step, $needle, $label, $failures, $passes ); } -echo "\n[6] Boundary stays generic\n"; -foreach ( array( 'DataMachine\\Core\\Database\\Agents', 'DataMachine\\Core\\Database\\Flows', 'DataMachine\\Core\\Database\\Pipelines' ) as $forbidden ) { - datamachine_bundle_runner_assert( false === strpos( $runner, $forbidden ), "runtime runner does not require caller-facing {$forbidden}", $failures, $passes ); +echo "\n[6] Runner stays host-neutral\n"; +foreach ( array( 'DataMachine\\Core\\Database\\Agents', 'DataMachine\\Core\\Database\\Flows', 'DataMachine\\Core\\Database\\Pipelines' ) as $runner_dependency ) { + datamachine_bundle_runner_assert( false === strpos( $runner, $runner_dependency ), "runtime runner uses shared ability access instead of {$runner_dependency}", $failures, $passes ); } if ( $failures ) { diff --git a/tests/boundary-forbidden-names-smoke.php b/tests/runtime-vocabulary-smoke.php similarity index 59% rename from tests/boundary-forbidden-names-smoke.php rename to tests/runtime-vocabulary-smoke.php index 583c76317..b1fdf5ada 100644 --- a/tests/boundary-forbidden-names-smoke.php +++ b/tests/runtime-vocabulary-smoke.php @@ -1,8 +1,8 @@ '/wp-site-generator/i', 'wpsg' => '/\bwpsg\b/i', 'codebox' => '/(?:wp[-_ ]?)?codebox/i', @@ -81,13 +81,13 @@ function datamachine_boundary_is_allowed_file( string $relative_path ): bool { ); $violations = array(); -$production_inc_violations = array(); +$runtime_source_violations = array(); $iterator = new RecursiveIteratorIterator( new RecursiveCallbackFilterIterator( new RecursiveDirectoryIterator( $root, FilesystemIterator::SKIP_DOTS ), function ( SplFileInfo $file ) use ( $root ): bool { - $relative_path = datamachine_boundary_relative_path( $root, $file->getPathname() ); - return ! $file->isDir() || ! datamachine_boundary_is_excluded_dir( $relative_path ); + $relative_path = datamachine_runtime_vocab_relative_path( $root, $file->getPathname() ); + return ! $file->isDir() || ! datamachine_runtime_vocab_is_excluded_dir( $relative_path ); } ) ); @@ -98,9 +98,9 @@ function ( SplFileInfo $file ) use ( $root ): bool { } $path = $file->getPathname(); - $relative_path = datamachine_boundary_relative_path( $root, $path ); + $relative_path = datamachine_runtime_vocab_relative_path( $root, $path ); - if ( __FILE__ === $path || datamachine_boundary_is_allowed_file( $relative_path ) ) { + if ( __FILE__ === $path || datamachine_runtime_vocab_is_allowed_file( $relative_path ) ) { continue; } @@ -109,36 +109,36 @@ function ( SplFileInfo $file ) use ( $root ): bool { continue; } - foreach ( $forbidden_patterns as $label => $pattern ) { + foreach ( $host_specific_patterns as $label => $pattern ) { if ( preg_match( $pattern, $contents ) ) { $violations[] = "{$relative_path} contains {$label}"; if ( 'codebox' === $label && str_starts_with( $relative_path, 'inc/' ) ) { - $production_inc_violations[] = "{$relative_path} contains {$label}"; + $runtime_source_violations[] = "{$relative_path} contains {$label}"; } } } } -datamachine_boundary_assert( array() === $production_inc_violations, 'production inc files have no Codebox vocabulary', $failures, $passes ); -datamachine_boundary_assert( array() === $violations, 'first-party source has no downstream runtime names outside explicit harness/generated allowlists', $failures, $passes ); +datamachine_runtime_vocab_assert( array() === $runtime_source_violations, 'runtime source uses host-neutral vocabulary', $failures, $passes ); +datamachine_runtime_vocab_assert( array() === $violations, 'first-party source uses host-neutral vocabulary outside explicit harness/generated allowlists', $failures, $passes ); -if ( ! empty( $production_inc_violations ) ) { - echo "\nProduction inc boundary mentions:\n"; - foreach ( $production_inc_violations as $violation ) { +if ( ! empty( $runtime_source_violations ) ) { + echo "\nRuntime source host-specific mentions:\n"; + foreach ( $runtime_source_violations as $violation ) { echo " - {$violation}\n"; } } if ( ! empty( $violations ) ) { - echo "\nForbidden boundary mentions:\n"; + echo "\nHost-specific mentions:\n"; foreach ( $violations as $violation ) { echo " - {$violation}\n"; } } if ( ! empty( $failures ) ) { - echo "\nBoundary forbidden names smoke failed (" . count( $failures ) . " failure(s)).\n"; + echo "\nRuntime vocabulary smoke failed (" . count( $failures ) . " failure(s)).\n"; exit( 1 ); } -echo "\nBoundary forbidden names smoke passed ({$passes} assertions).\n"; +echo "\nRuntime vocabulary smoke passed ({$passes} assertions).\n";