补充Clang Hook参数边界与报告来源组合校验

Author: loong10k

crates/codeguard-cli/tests/hook_failed_write_options.rs

@@ -74,6 +74,7 @@ fn every_registered_checker_configuration_is_inert_after_failed_write() {
         "--rustsec-db",
         "--pip-audit-tool",
         "--go-tool",
+        "--clang-tool",
         "--zig-tool",
         "--erl-tool",
         "--swift-tool",
@@ -125,6 +126,9 @@ fn failed_write_still_rejects_ownership_and_malformed_arguments() {
         vec![("--owner", "agent")],
         vec![("--lease-token", "token")],
         vec![("--go-tool", "relative")],
+        vec![("--clang-tool", "relative")],
+        vec![("--clang-tool", "/missing"), ("--clang-tool", "/other")],
+        vec![("--standard", "c17")],
         vec![("--npm-version", "")],
         vec![("--npm-version", oversized.as_str())],
         vec![("--go-tool", "/missing"), ("--go-tool", "/other")],
@@ -152,3 +156,17 @@ fn confirmed_edit_reports_selected_go_failure_without_ignoring_it() {
     );
     assert!(!p.0.join(".codeguard").exists());
 }
+
+#[test]
+fn confirmed_edit_rejects_repair_only_clang_option_before_execution() {
+    let p = Project::new();
+    let marker = p.0.join("clang-ran");
+    let tool = p.0.join("clang");
+    fs::write(&tool, format!("#!/bin/sh\ntouch '{}'\nexit 99\n", marker.display())).unwrap();
+    fs::set_permissions(&tool, fs::Permissions::from_mode(0o700)).unwrap();
+    let out = p.invoke(&[("--clang-tool", tool.to_str().unwrap())], "confirmed");
+    assert_eq!(out.status.code(), Some(2), "{out:?}");
+    assert!(out.stdout.is_empty(), "{out:?}");
+    assert!(!marker.exists());
+    assert!(!p.0.join(".codeguard").exists());
+}

rulepacks/production_acceptance_plan_v1.json

@@ -264,12 +264,12 @@
     "crates/codeguard-cli/src/c_family_documentation_hook_feedback.rs": "1383e431164354baa5fa409b6e7f1663350b749f609a2036c29e6c91def1044b",
     "crates/codeguard-cli/src/hook_execute_command.rs": "ef5e584e315bad8f3b2a1b6aa9b5d05dd4cf3fa84ba23a02b7dff5397664850e",
     "crates/codeguard-cli/tests/c_family_documentation_hook.rs": "00d91adc6dd94d585aa2719c99bee71ae04e182839acc76264e634d2bac71940",
-    "schemas/hook-execution-feedback-v0.30.schema.json": "496687f6ed4fd4fb2f48ed65a94871b9b3f3c984cc85cc7e2b29cf23175aaa2b",
-    "tests/c_family_documentation_hook_schema.py": "1706a828a290c1fc38a16f59404e60fcbc66343093eaa6402d7b4dc04bcfdebb",
-    "tests/acceptance/c-family-documentation-hook.md": "0fe7b1c2c70d1ba5c700295498fb12e68efcc475acdaf50a3040b66e7f81cbdf",
+    "schemas/hook-execution-feedback-v0.30.schema.json": "2b77786ade6bd6148ec54534a4b7761ac41f00d6d6119f1e95ea9d59f2f3b4d3",
+    "tests/c_family_documentation_hook_schema.py": "7952a67c0052b993ec8281d50c7eb4a35f897756101b09d377bb5b19d9e5a1da",
+    "tests/acceptance/c-family-documentation-hook.md": "b485ed377737804c72222ee93daf5aade73c6ec46987ef2e7bc73ac2aa32eb50",
     "tests/acceptance/evidence/c-family-documentation-hook-default.json": "418e39790d61b891cca7885c66c9e311ab33dbbdd836bc3241cae0c11b0b9244",
     "tests/acceptance/evidence/c-family-documentation-hook-wasm.json": "d4b7b4806d9786280f7d4f3f60f47cd9e7e2882d839e43b7044d96fcef454698",
-    "tests/acceptance/evidence/c-family-documentation-hook-schema.json": "dfef8141c030d5256c3bea6537261673448671676a616adf0c4e2acca8d07c08"
+    "tests/acceptance/evidence/c-family-documentation-hook-schema.json": "a7e733a30ea12e3aa1fac96e634c94b049ca313b93a4282e6d3971c046656218"
   },
   "languages": [
     {

schemas/hook-execution-feedback-v0.30.schema.json

@@ -1226,6 +1226,82 @@
               }
             }
           }
+        },
+        {
+          "if": {
+            "properties": {
+              "checker_id": {
+                "const": "c.clang.documentation"
+              }
+            }
+          },
+          "then": {
+            "properties": {
+              "documentation_standard": {
+                "const": "c11"
+              },
+              "documentation_rule_source": {
+                "const": "native_clang_warning"
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "checker_id": {
+                "const": "c.clang.documentation_structure"
+              }
+            }
+          },
+          "then": {
+            "properties": {
+              "documentation_standard": {
+                "const": "c11"
+              },
+              "documentation_rule_source": {
+                "const": "codeguard_structural_policy"
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "checker_id": {
+                "const": "cpp.clang.documentation"
+              }
+            }
+          },
+          "then": {
+            "properties": {
+              "documentation_standard": {
+                "const": "c++17"
+              },
+              "documentation_rule_source": {
+                "const": "native_clang_warning"
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "checker_id": {
+                "const": "cpp.clang.documentation_structure"
+              }
+            }
+          },
+          "then": {
+            "properties": {
+              "documentation_standard": {
+                "const": "c++17"
+              },
+              "documentation_rule_source": {
+                "const": "codeguard_structural_policy"
+              }
+            }
+          }
         }
       ]
     },

tests/acceptance/c-family-documentation-hook.md

@@ -6,4 +6,6 @@ Hook接受显式绝对--clang-tool，按稳定任务首次报告核验原工具
 
 默认/WASM显式实际Apple Clang21双语言回归各1通过，涵盖两类任务原工具复检、修复后消失、错误工具拒绝和可编辑Markdown不执行。内部当前报告投影回归核验源码变更、过期、收据篡改及任务身份伪造；默认/WASM均实际通过。相邻默认Hook执行/失败编辑/Claude协议回归34通过、3条件原生测试忽略，不冒充已安装宿主。
 
-公开报告归档在evidence/c-family-documentation-hook-default.json、c-family-documentation-hook-wasm.json；开发schema校验脚本绑定测试源码摘要，24份实际摘要/拒绝反馈通过及6类伪造反例拒绝。详细契约准确性、完整项目配置、自动编辑检查、可信关闭/复发、跨平台/独立精度和发行继续未完成。66完成/288待完成、228核心blocked与grammar0/32资格不变。
+公开报告归档在evidence/c-family-documentation-hook-default.json、c-family-documentation-hook-wasm.json；开发schema校验脚本绑定测试源码摘要，24份实际摘要/拒绝反馈通过及8类伪造反例拒绝。详细契约准确性、完整项目配置、自动编辑检查、可信关闭/复发、跨平台/独立精度和发行继续未完成。66完成/288待完成、228核心blocked与grammar0/32资格不变。
+
+参数边界补充：默认/WASM hook_failed_write_options各4通过。失败写入携带Clang配置不启动工具、不初始化工作区；确认编辑拒绝repair_ready专用Clang参数；相对路径、重复Clang配置及标准覆盖拒绝。报告协议按checker_id绑定C11/C++17与原生警告/自有结构来源，合法字段的错误组合不能通过。

tests/acceptance/evidence/c-family-documentation-hook-schema.json

@@ -2,6 +2,6 @@
   "evidence_kind": "development_c_documentation_hook_schema",
   "qualification": "not_granted",
   "reports_valid": 24,
-  "negative_cases_rejected": 6,
+  "negative_cases_rejected": 8,
   "schemas_valid": 508
 }

tests/acceptance/evidence/production-acceptance-plan/all.json

@@ -28,6 +28,11 @@
     forged=copy.deepcopy(sample);forged['local_feedback'][field]=value;negative.append(forged)
 forged=copy.deepcopy(sample);forged['local_feedback']['documentation_input_current']=False;negative.append(forged)
 forged=copy.deepcopy(sample);forged['local_feedback']['event_persisted']=False;negative.append(forged)
+for field,value in [
+    ('documentation_standard', 'c11' if sample['local_feedback']['documentation_standard']=='c++17' else 'c++17'),
+    ('documentation_rule_source', 'native_clang_warning' if sample['local_feedback']['documentation_rule_source']=='codeguard_structural_policy' else 'codeguard_structural_policy'),
+]:
+    forged=copy.deepcopy(sample);forged['local_feedback'][field]=value;negative.append(forged)
 for forged in negative:assert list(validator.iter_errors(forged))
 result={'evidence_kind':'development_c_documentation_hook_schema','qualification':'not_granted','reports_valid':count,'negative_cases_rejected':len(negative),'schemas_valid':len(schemas)}
 (root/'tests/acceptance/evidence/c-family-documentation-hook-schema.json').write_text(json.dumps(result,indent=2)+'\n')