diff --git a/scripts/validate_evidence_registry.py b/scripts/validate_evidence_registry.py index 3f18776..28372c1 100644 --- a/scripts/validate_evidence_registry.py +++ b/scripts/validate_evidence_registry.py @@ -806,6 +806,10 @@ def validate_append_only_history(previous_value: object, current_value: object) previous_doc = previous_value current_doc = current_value assert isinstance(previous_doc, dict) and isinstance(current_doc, dict) + if current_doc == previous_doc: + # An untouched registry is not a rollback. Only a changed registry has to + # bump the revision, bind the previous head, and append to the history. + return if current_doc["revision"] != previous_doc["revision"] + 1: raise EvidenceRegistryError("registry revision must increase by exactly one") if current_doc["previous_registry_head_sha256"] != previous_doc["registry_head_sha256"]: diff --git a/tests/test_evidence_registry.py b/tests/test_evidence_registry.py index ea7030c..7e1e21d 100644 --- a/tests/test_evidence_registry.py +++ b/tests/test_evidence_registry.py @@ -513,6 +513,25 @@ def test_append_only_revision_binds_previous_head(self) -> None: with self.assertRaisesRegex(registry.EvidenceRegistryError, "previous head"): registry.validate_append_only_history(previous, current) + def test_an_untouched_registry_is_not_a_rollback(self) -> None: + previous = document() + registry.validate_append_only_history(previous, copy.deepcopy(previous)) + + def test_an_untouched_registry_still_has_to_be_valid(self) -> None: + previous = document() + broken = copy.deepcopy(previous) + broken["registry_head_sha256"] = sha("9") + with self.assertRaises(registry.EvidenceRegistryError): + registry.validate_append_only_history(broken, broken) + + def test_a_revision_that_stands_still_while_the_registry_changes_is_refused( + self, + ) -> None: + previous = document() + current = document(previous_registry_head_sha256=sha("9")) + with self.assertRaisesRegex(registry.EvidenceRegistryError, "exactly one"): + registry.validate_append_only_history(previous, current) + def test_only_exact_empty_v1_registry_can_create_the_empty_v2_genesis(self) -> None: previous = { "$schema": "schemas/evidence-registry.schema.json",