Phase 1: Strategy equivalence and sanity checks #74

Merged

erikinkinen merged 3 commits from 1-strategy-equivalence-and-sanity-checks into main

2026-03-06 10:35:07 +01:00

erikinkinen commented

2026-03-06 10:32:56 +01:00

Owner

Closes #34

Summary

This PR adds Phase 1 strategy equivalence and sanity checks to ensure strategy differences are intentional and stable, without changing runtime behavior.

It introduces a dedicated test suite and documentation updates for:

eager vs lineage target-set differences on canonical simple graphs,
lazy (lazy_invalidate) vs epoch (epoch_indirection) shared direct-target behavior equivalence,
explicit intentional descendant divergence between lazy and epoch strategies,
strategy-local over-revocation soundness checks via the post-revocation oracle.

Scope

Included

New test executable: aes_strategy_equivalence_tests
New test file: tests/strategy_equivalence_tests.cpp
Test coverage for:
- canonical eager/lineage vector comparisons,
- selector normalization determinism,
- lazy/epoch shared direct-target equivalence,
- lazy/epoch repeat determinism,
- intentional lazy vs epoch descendant divergence,
- eager strategy oracle soundness (over_removed_edges == []),
- lazy/epoch no-delete revoke sanity (removed_edges=[], edges_removed=0)
docs/phase1.md updates for #34 equivalence/sanity rules

Explicitly excluded

No production API changes
No runtime logic changes
No event-log version/schema changes

Design intent

The purpose is to lock behavior expectations so strategy differences are treated as deliberate semantics, not regressions.

Eager vs lineage differences are asserted with explicit ordered vectors.
Lazy and epoch are required to match on shared direct-target externally visible behavior.
Lazy vs epoch descendant behavior is pinned as intentionally different.
Over-revocation is guarded with strategy-local oracle soundness checks for eager-delete strategies.

Verification

cmake --build _build --target aes_strategy_equivalence_tests aes_revocation_strategy_tests aes_engine_tests aes_revocation_oracle_tests aes_event_log_replay_tests aes_invalid_event_determinism_tests
ctest --test-dir _build --output-on-failure -R "aes_strategy_equivalence_tests|aes_revocation_strategy_tests|aes_engine_tests|aes_revocation_oracle_tests|aes_event_log_replay_tests|aes_invalid_event_determinism_tests"

All listed tests passed.

Notes for review

Validate canonical expected vectors and order-sensitivity in strategy_equivalence_tests.
Validate strategy-local oracle usage for over-revocation checks.
Validate lazy/epoch shared direct-target parity assertions and explicit descendant divergence assertion.

Closes #34 --- ## Summary This PR adds Phase 1 strategy equivalence and sanity checks to ensure strategy differences are intentional and stable, without changing runtime behavior. It introduces a dedicated test suite and documentation updates for: - eager vs lineage target-set differences on canonical simple graphs, - lazy (`lazy_invalidate`) vs epoch (`epoch_indirection`) shared direct-target behavior equivalence, - explicit intentional descendant divergence between lazy and epoch strategies, - strategy-local over-revocation soundness checks via the post-revocation oracle. --- ## Scope ### Included - New test executable: `aes_strategy_equivalence_tests` - New test file: `tests/strategy_equivalence_tests.cpp` - Test coverage for: - canonical eager/lineage vector comparisons, - selector normalization determinism, - lazy/epoch shared direct-target equivalence, - lazy/epoch repeat determinism, - intentional lazy vs epoch descendant divergence, - eager strategy oracle soundness (`over_removed_edges == []`), - lazy/epoch no-delete revoke sanity (`removed_edges=[]`, `edges_removed=0`) - `docs/phase1.md` updates for #34 equivalence/sanity rules ### Explicitly excluded - No production API changes - No runtime logic changes - No event-log version/schema changes --- ## Design intent The purpose is to lock behavior expectations so strategy differences are treated as deliberate semantics, not regressions. - Eager vs lineage differences are asserted with explicit ordered vectors. - Lazy and epoch are required to match on shared direct-target externally visible behavior. - Lazy vs epoch descendant behavior is pinned as intentionally different. - Over-revocation is guarded with strategy-local oracle soundness checks for eager-delete strategies. --- ## Verification - [x] `cmake --build _build --target aes_strategy_equivalence_tests aes_revocation_strategy_tests aes_engine_tests aes_revocation_oracle_tests aes_event_log_replay_tests aes_invalid_event_determinism_tests` - [x] `ctest --test-dir _build --output-on-failure -R "aes_strategy_equivalence_tests|aes_revocation_strategy_tests|aes_engine_tests|aes_revocation_oracle_tests|aes_event_log_replay_tests|aes_invalid_event_determinism_tests"` All listed tests passed. --- ## Notes for review - Validate canonical expected vectors and order-sensitivity in `strategy_equivalence_tests`. - Validate strategy-local oracle usage for over-revocation checks. - Validate lazy/epoch shared direct-target parity assertions and explicit descendant divergence assertion.