← back to Dw Five Field Step0
Require unambiguous live SKU provenance
e63b94f6a932e29ace35f4d0e3b34d33c2909829 · 2026-08-29 06:39:19 -0700 · Steve Abrams
Files touched
M sku_guard.pyM test/test_sku_guard.pyM verification/e2e-proof.json
Diff
commit e63b94f6a932e29ace35f4d0e3b34d33c2909829
Author: Steve Abrams <steve@designerwallcoverings.com>
Date: Sat Aug 29 06:39:19 2026 -0700
Require unambiguous live SKU provenance
---
sku_guard.py | 21 +++++++++++----------
test/test_sku_guard.py | 24 ++++++++++++++++++++++++
verification/e2e-proof.json | 4 ++--
3 files changed, 37 insertions(+), 12 deletions(-)
diff --git a/sku_guard.py b/sku_guard.py
index 9c47cc1..905ddc0 100644
--- a/sku_guard.py
+++ b/sku_guard.py
@@ -3,7 +3,6 @@
import re
ASCII_SKU = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._/-]*$", re.ASCII)
-NON_SAMPLE_UNIT = re.compile(r"-(?:roll|yard|panel)$", re.IGNORECASE | re.ASCII)
SAMPLE_SUFFIX = re.compile(r"-sample$", re.IGNORECASE | re.ASCII)
@@ -29,23 +28,23 @@ def validate_dw_sku(candidate, lane, live_variants):
target_base = target[:-7]
if target_base != target_base.upper():
return {"ok": False, "reason": "noncanonical-sample-base", "basis": None}
- trusted = set()
+ trusted = []
for variant in live_variants:
if not isinstance(variant, dict) or str(variant.get("option1") or "").strip().lower() == "sample":
continue
live_sku = _strict_sku(variant.get("sku"))
- if live_sku:
- live_base = NON_SAMPLE_UNIT.sub("", live_sku)
- if live_base == live_base.upper():
- trusted.add(live_base)
- if target_base in trusted:
+ if live_sku and live_sku == live_sku.upper():
+ trusted.append(live_sku)
+ if len(trusted) != 1:
+ return {"ok": False, "reason": "ambiguous-live-non-sample-identity", "basis": None}
+ if target_base == trusted[0]:
return {"ok": True, "reason": "derived-from-live-non-sample", "basis": "live-variant"}
return {"ok": False, "reason": "sample-base-not-live", "basis": None}
if lane == "build-roll":
if target != target.upper():
return {"ok": False, "reason": "noncanonical-roll-base", "basis": None}
- trusted = set()
+ trusted = []
for variant in live_variants:
if not isinstance(variant, dict):
continue
@@ -54,8 +53,10 @@ def validate_dw_sku(candidate, lane, live_variants):
if live_sku and is_sample and SAMPLE_SUFFIX.search(live_sku):
live_base = SAMPLE_SUFFIX.sub("", live_sku)
if live_base == live_base.upper():
- trusted.add(live_base)
- if target in trusted:
+ trusted.append(live_base)
+ if len(trusted) != 1:
+ return {"ok": False, "reason": "ambiguous-live-sample-identity", "basis": None}
+ if target == trusted[0]:
return {"ok": True, "reason": "recovered-from-live-sample", "basis": "live-sample-variant"}
return {"ok": False, "reason": "roll-base-not-live-sample", "basis": None}
diff --git a/test/test_sku_guard.py b/test/test_sku_guard.py
index 002b81c..c1f7627 100644
--- a/test/test_sku_guard.py
+++ b/test/test_sku_guard.py
@@ -30,6 +30,16 @@ class SkuGuardTests(unittest.TestCase):
])
self.assertTrue(result["ok"])
+ def test_unit_like_text_is_preserved_as_exact_sku_identity(self):
+ for suffix in ["ROLL", "YARD", "PANEL"]:
+ base = f"ART-{suffix}"
+ self.assertTrue(validate_dw_sku(f"{base}-Sample", "add-sample", [
+ {"sku": base, "option1": "Roll"},
+ ])["ok"])
+ self.assertFalse(validate_dw_sku("ART-Sample", "add-sample", [
+ {"sku": base, "option1": "Roll"},
+ ])["ok"])
+
def test_rejects_coercion_unicode_controls_whitespace_and_unknown_lane(self):
live = [{"sku": "ABC", "option1": "Roll"}]
for candidate in [None, "", "None", "null", 12345, " ABC-Sample", "ABC\nDEF-Sample", "straße-Sample", "abc-Sample"]:
@@ -41,6 +51,20 @@ class SkuGuardTests(unittest.TestCase):
self.assertFalse(validate_dw_sku("ABC-Sample", "add-sample", [{"sku": "ABC-Sample", "option1": "Sample"}])["ok"])
self.assertFalse(validate_dw_sku("ABC", "build-roll", [{"sku": "ABC-Sample", "option1": "Roll"}])["ok"])
+ def test_rejects_duplicate_or_conflicting_live_identities(self):
+ for live in [
+ [{"sku": "AAA", "option1": "Roll"}, {"sku": "BBB", "option1": "Roll"}],
+ [{"sku": "AAA", "option1": "Roll"}, {"sku": "AAA", "option1": "Roll"}],
+ ]:
+ self.assertEqual(validate_dw_sku("AAA-Sample", "add-sample", live)["reason"],
+ "ambiguous-live-non-sample-identity")
+ for live in [
+ [{"sku": "AAA-Sample", "option1": "Sample"}, {"sku": "BBB-Sample", "option1": "Sample"}],
+ [{"sku": "AAA-Sample", "option1": "Sample"}, {"sku": "AAA-Sample", "option1": "Sample"}],
+ ]:
+ self.assertEqual(validate_dw_sku("AAA", "build-roll", live)["reason"],
+ "ambiguous-live-sample-identity")
+
if __name__ == "__main__":
unittest.main()
diff --git a/verification/e2e-proof.json b/verification/e2e-proof.json
index 6a4ca3e..b6234d3 100644
--- a/verification/e2e-proof.json
+++ b/verification/e2e-proof.json
@@ -6,11 +6,11 @@
"ticket": "TK-10956-block-invented-skus-before-five-field-va",
"build_identity": "git parent b51daf4 plus owned Cycle 15 diff",
"checks": [
- {"verdict":"PASS","boundary":"identity validation","command":"python3 -m unittest discover -s test -p 'test_*.py'","assertions":"sample targets derive from fetched live non-sample variants; roll targets derive from fetched live sample variants; unrelated worklist values and malformed identities fail"},
+ {"verdict":"PASS","boundary":"identity validation","command":"python3 -m unittest discover -s test -p 'test_*.py'","assertions":"sample and roll targets derive from exactly one fetched live variant by exact transformation; unrelated worklist values, suffix guesses, duplicate/conflicting identities, and malformed inputs fail"},
{"verdict":"PASS","boundary":"pre-write ordering","command":"static source assertion","assertions":"validate_dw_sku call and fail-closed return precede Shopify variant POST"},
{"verdict":"PASS","boundary":"syntax/diff","command":"python3 -m py_compile sku_guard.py bulk-fivefield-exec.py && git diff --check","assertions":"modules compile and diff is clean"}
],
- "negative_checks": ["self-authorizing worklist candidate", "unrelated sequential candidate", "blank/literal-null/coercible candidate", "Unicode or control characters", "missing or malformed live variant provenance", "wrong lane suffix"],
+ "negative_checks": ["self-authorizing worklist candidate", "unrelated sequential candidate", "blank/literal-null/coercible candidate", "Unicode or control characters", "missing or malformed live variant provenance", "wrong lane suffix", "Roll/Yard/Panel suffix inference", "duplicate or conflicting live identities"],
"side_effects": "none; no DB, Shopify, provider, customer-facing, schedule, restart, deploy, or send action",
"cleanup": "pycache files are ignored and removed after the test",
"verdict": "PASS for the local pre-write boundary"
← 1726ebd Anchor SKU guard to live variants
·
back to Dw Five Field Step0
·
auto-data-snapshot: 2026-08-29T09:43:04 (1 data files) — out 7610d0b →