test(security): cover rejected package execution

Author: djm81

openspec/changes/fix-categoryless-module-command-squatting/TDD_EVIDENCE.md

@@ -1,69 +1,75 @@
-# TDD evidence: workspace root-command registration
+# TDD evidence: workspace registration isolation
 
-Date: 2026-10-11 (Europe/Berlin). Production baseline: dev `4e7c38c2830f4bc53ffe78eeb0a2bfbabfc711e2`.
-Environment: macOS, CPython 3.13.14, dedicated frozen uv environment.
+Date: 2026-10-11 (Europe/Berlin). Protected baseline: dev
+`4e7c38c2830f4bc53ffe78eeb0a2bfbabfc711e2`. Local environment: macOS, CPython 3.13.14,
+dedicated frozen uv environment. The published PR remains unmerged.
 
-## Failing-before
+## Retained first implementation history
 
-Specification amended before test authoring, including the existing module-grouping requirement and permanent
-core-command authority. Command: `.venv/bin/pytest -q -o addopts='' tests/unit/security/test_module_command_squatting.py`.
-Initial result: four behavioral failures, five passing compatibility controls. The missing-category root is
-registered, all three permanent core roots are extended, and an escaping symlink gains authority in both modes.
-No production code changed. No skips; native hosted authored execution is pending publication.
+Historical authored head `8a03cf5898335f22dc411d75e22ea74d700df0fa` and native RED
+[run 38172950463](https://github.com/nold-ai/specfact-cli/actions/runs/38172950463) preceded the first
+implementation `facb6904843ab38521e8129024fddfa25b38247e`. The original digest was explicitly accepted
+by djm81. That implementation passed 78 focused tests and a fresh full run: 3,298 passed, 11 disclosed
+skips, two dependency deprecation warnings, 328.73 seconds. An unchanged native rerun after stack
+registration passed producer, independent execution and final consumer. This historical evidence does
+not cover the amended mapping or test file and is not reused as current proof.
+
+## Review corrections and valid failing-before evidence
+
+Added specification deltas first for official category roots, rejected-package import isolation,
+effective operator-selected built-ins and reconciliation of shipped categorized routing in disabled mode.
+The first review test invocation had a collection syntax error; subsequent draft category fixtures lacked
+required grouping fields and failed manifest validation before registration. Both are discarded as proof.
+
+Corrected all six category manifests to their valid canonical bundle/group fields and repeated the probes
+before final production edits. Command: `.venv/bin/pytest -q -o addopts=''`
+`tests/unit/security/test_module_command_squatting.py`.
+
+- Against historical implementation facb690: 14 actual assertion/behavior failures, nine passes,
+  zero skips, 1.79 seconds. Twelve category-root cases, import-shadow execution and effective-root
+  compatibility reproduce the remaining gaps.
+- Against protected baseline 4e7c38c, with the existing disabled-grouping bootstrap control also selected:
+  17 actual assertion/behavior failures, seven passes, zero skips, 1.36 seconds. This includes the
+  original missing-category and permanent-core/symlink vulnerabilities.
+
+Signed proposal/test history is rebuilt from protected dev so no production change precedes the current
+native authored boundary. The earlier authored replay 9fef6a3f contains draft fixtures and is superseded;
+its hosted run is not accepted as current proof. Corrected tests must stay byte-identical after native RED.
+
+The amended mapping digest is
+`sha256:a9ba0dfde727a2a82f037212ebe5c6eeacd2574602e7d6ca9e4e3900cbdeb95c`.
+The human owner explicitly approved recording acceptance as djm81 after confirmation that all 14 remaining
+behavior failures will be fixed. The old acceptance is not carried across a changed mapping digest.
 
 ## Passing-after
 
-Command: `.venv/bin/pytest -q -o addopts='' tests/unit/security/test_module_command_squatting.py
-tests/unit/specfact_cli/registry/test_module_packages.py tests/unit/registry/test_category_groups.py
-tests/integration/test_category_group_routing.py`. Result: 78 passed, zero skips, 6.80 seconds.
-All four reproduced failures now pass; explicit legacy, non-project sources, categorized routes and built-in
-loading remain functional. Tests and mapping are unchanged from the signed authored boundary.
-
-The first replay contained an unsigned planning ancestor. It was rejected during signature readback and the
-whole authored history was rebuilt with signatures; the new authored head is
-`8a03cf5898335f22dc411d75e22ea74d700df0fa`, tree `fc791df54e922e4a41f73161b5e878a8519acc5a`.
-Earlier head/run identities are superseded; hosted RED and final validation must bind to the new ancestry.
-
-## Local independent gates
-
-Frozen delivery and uv lock checks, all three security audits, dependency-trust register, license gate and
-strict module signatures pass. No dependency versions changed; only project version metadata changed.
-Strict PyPI-ahead: 0.55.7 > 0.55.4; all four version sources agree. BasedPyright: zero errors, the same
-1,522 baseline warnings; Ruff passes, Bandit blocking findings are absent, Semgrep has zero current/baseline
-findings. Final signed publication and current-head hosted execution remain pending.
-
-## Hosted authored RED
-
-[Native run 38172950463](https://github.com/nold-ai/specfact-cli/actions/runs/38172950463) binds to signed
-head `8a03cf5898335f22dc411d75e22ea74d700df0fa`. Its authored plan passes at test-authored maturity;
-the RED report passes at red maturity with no reconciliation findings, retaining two actual failing security
-selectors. The producer job is intentionally failed because the tests reproduce the vulnerable baseline.
-Final implementation must preserve those tests, mapping and authored ancestor and pass its independent consumer.
-
-## Review and full-suite corrections
-
-The first full run found two stale test assumptions: an external tmp_path labeled builtin was expected to
-register permanent core roots, and the version assertion still expected 0.55.6. The bootstrap control now
-uses the actual bound built-in root; the version assertion retains equality across all sources at 0.55.7.
-No security guard or assertion was disabled. The corrected bootstrap/version/security selection passes
-35 tests. The full fresh rerun passes: `hatch run smart-test-force --level full`, 3,298 passed, 11 reported skips, two dependency deprecation warnings, 328.73 seconds on local CPython 3.13.14. No security control is skipped. Explicit skip reasons are retained in local JUnit; hosted Python 3.11–3.13 and required checks remain independent.
-
-Changed-Python review covers module_packages.py, the new security controls, both affected existing test
-files, setup.py and both version __init__ files. Independent merged-baseline review and candidate review each
-contain five warnings and five information findings, zero errors and zero new findings. New security tests
-are clean. Narrow baseline exception: existing importer/public-discovery naming flags, typed dependency
-parser duplication, deliberate exception propagation/None-preserving branches, and unrelated release-fixture
-style suggestions are unchanged outside the registration fix. Renaming public discovery APIs or refactoring
-those parser/test boundaries would widen this security patch. Their existing advice remains recorded;
-no analyzer rule, threshold, suppression, evidence source or required gate was weakened.
-
-## Review regression boundary (2026-10-11)
-
-Before production edits, added scenarios and selected executable cases for official category root claims,
-rejected-package import shadowing, effective operator-selected discovery roots and existing categorized
-routing in disabled grouping mode. The first test invocation had a collection syntax error and provides
-no behavior evidence; corrected collection then produced 14 actual failures, nine passes, zero skips in
-2.74 seconds on the unchanged implementation head facb6904843ab38521e8129024fddfa25b38247e.
-The twelve category-root cases, import-shadow execution and effective-root compatibility fail as expected.
-The approved mapping 903945b4 is historical; the amended mapping requires fresh human acceptance before
-native authored/final claims. No prior acceptance is carried across a changed digest.
+The corrected security and registry/category-routing/bootstrap selection passes 99 tests, zero skips,
+two existing dependency warnings, 7.58 seconds. Rejected packages are excluded before schema, bridge,
+protocol, active-import and category-mount side effects. All six official category root names are denied
+to project packages in both modes. Core command authority uses effective operator-selected discovery;
+other built-in integrity exemptions remain bound to the running package tree. Removed flat bundle shims
+are not restored. Native current-head RED/final and a fresh full suite remain pending.
+
+## Independent gates and limits
+
+The first implementation passed frozen delivery/uv lock, all three security audits, trust register,
+license gate and strict module signatures; no dependency payload changed. All four project version
+sources agree at 0.55.7. Strict PyPI-ahead was 0.55.7 > 0.55.4. BasedPyright reported zero errors and
+1,522 baseline warnings; Ruff, Semgrep and blocking Bandit findings were clean. The expanded candidate
+must rerun applicable gates. No skip, threshold, signature check, fixture pin or acceptance requirement is
+weakened. A new test type warning was fixed through a typed monkeypatch path replacement, without suppression.
+
+First-implementation broad review and independent merged-baseline review each contained five warnings,
+five information findings and zero errors, with zero new findings. Narrow unchanged-baseline exceptions
+covered public discovery naming, typed parser duplication, deliberate propagation/None branches and unrelated
+release-fixture styles. Expanded code review must verify that no new findings remain; current tests are clean.
+
+## Exact atomic selector correction
+
+The released provider requires each selected RED node to fail and exact non-parameterized node identities.
+Run 38175451297 is discarded because positive-only controls passed in RED and parameter expansions did not
+match the declared node IDs. The accepted mapping digest and selector names remain unchanged. Each exact
+case now checks a rejected workspace/external boundary together with its supported counterpart; the same
+assertions run in RED and final, without stage flags or artificial failure. Parameter combinations execute
+inside the selected case, with isolated registries and monkeypatch contexts. Full independent tests also
+retain all six root names and both modes. Corrected native proof and final-head gates remain pending.

openspec/changes/fix-categoryless-module-command-squatting/requirements-proof/review-evidence.json

@@ -1,6 +1,9 @@
 {
   "schema_version": "1",
-  "decision": "pending",
+  "decision": "accepted",
+  "reviewer_id": "djm81",
+  "reviewer_role": "repository-owner",
+  "recorded_at": "2026-10-11T21:05:54.512555+00:00",
   "reference": "https://github.com/nold-ai/specfact-cli/pull/719",
   "mapping_digest": "sha256:a9ba0dfde727a2a82f037212ebe5c6eeacd2574602e7d6ca9e4e3900cbdeb95c"
 }

tests/unit/registry/test_category_groups.py

@@ -54,12 +54,30 @@ def test_bootstrap_with_category_grouping_enabled_registers_group_commands() ->
     )
 
 
-def test_bootstrap_with_category_grouping_disabled_still_has_no_flat_shims() -> None:
-    """Flat bundle shims are not registered even when SPECFACT_CATEGORY_GROUPING_ENABLED is false."""
+def test_bootstrap_with_category_grouping_disabled_still_has_no_flat_shims(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    """Disabled grouping preserves category policy and cannot install a workspace category root."""
+    from specfact_cli.registry import module_packages
+
+    builtin_packages = module_packages.discover_package_metadata(module_packages.get_modules_root(), source="builtin")
+    workspace_root = tmp_path / ".specfact" / "modules"
+    hostile = workspace_root / "hostile"
+    (hostile / "src").mkdir(parents=True)
+    (hostile / "module-package.yaml").write_text(
+        "name: hostile\nversion: '0.1.0'\ncommands: [project]\ncategory: project\n"
+        "bundle: specfact-project\nbundle_group_command: project\nbundle_sub_command: project\n"
+    )
+    (hostile / "src" / "app.py").write_text("import typer\napp = typer.Typer()\n")
+    project_packages = module_packages.discover_package_metadata(workspace_root, source="project")
+    monkeypatch.setattr(module_packages, "discover_all_package_metadata", lambda: builtin_packages + project_packages)
+    monkeypatch.setattr(module_packages, "read_modules_state", dict)
     with patch.dict(os.environ, {"SPECFACT_CATEGORY_GROUPING_ENABLED": "false"}, clear=False):
         register_builtin_commands()
         rebuild_root_app_from_registry()
     names = [name for name, _ in CommandRegistry.list_commands_for_help()]
+    assert "project" not in names, "Workspace native category roots remain reserved in disabled grouping"
+    assert {"init", "module", "upgrade"}.issubset(names)
     forbidden_flat = {
         "analyze",
         "drift",