Publish curated ITWorx_MCP_Hub source from 3237e4d8aec312d63d13b4e80664422a7520b5f9

tests/test_contextforge_candidate_recipe.py

@@ -23,6 +23,30 @@ def _hash(data: bytes) -> str:
     return hashlib.sha256(data).hexdigest()
 
 
+def _prior_recipe_receipt_hash(data: bytes) -> str:
+    """Only this Git LF-normalized historical JSON receipt permits CRLF checkout bytes."""
+    normalized = data.replace(b"\r\n", b"\n")
+    if b"\r" in normalized:
+        raise ValueError("unsupported historical receipt newline")
+    return _hash(normalized)
+
+
+def test_prior_recipe_receipt_identity_accepts_only_git_lf_or_crlf_checkout() -> None:
+    import subprocess
+
+    path = "evidence/WP-400/CF_POSTGRES_BINARY_RECIPE.json"
+    blob = subprocess.check_output(["git", "show", "HEAD:" + path], cwd=ROOT)  # noqa: S603,S607 - fixed local Git object
+    assert b"\r" not in blob
+    assert (
+        _prior_recipe_receipt_hash(blob)
+        == _prior_recipe_receipt_hash(blob.replace(b"\n", b"\r\n"))
+        == _hash(blob)
+    )
+    assert _prior_recipe_receipt_hash(blob + b" ") != _hash(blob)
+    with pytest.raises(ValueError, match="unsupported historical receipt newline"):
+        _prior_recipe_receipt_hash(blob.replace(b"\n", b"\r", 1))
+
+
 def _containerfile_fixture() -> bytes:
     return (
         b"FROM base\n"
@@ -134,10 +158,38 @@ dev = ["pytest>=8"]
         "2026-07-01T00:00:00Z"
     )
     assert parsed["tool"]["uv"]["exclude-newer-package"]["pyjwt"] == "2026-10-02T00:00:00Z"
+    for package, version in (
+        ("anyio", "4.14.2"),
+        ("cryptography", "50.0.0"),
+        ("langgraph-sdk", "0.4.4"),
+        ("langgraph", "1.2.3"),
+    ):
+        assert f"{package}=={version}" in parsed["tool"]["uv"]["constraint-dependencies"]
+        assert parsed["tool"]["uv"]["exclude-newer-package"][package] == "2026-10-14T00:00:00Z"
     assert parsed["dependency-groups"]["build-tools"] == list(recipe.BUILD_TOOLS)
     assert "dev" not in parsed["dependency-groups"]
 
 
+@pytest.mark.parametrize(
+    "requirement", ["langgraph<=1.2.0", "langgraph==1.2.0", 'langgraph<=1.2.0","langgraph<=1.2.0']
+)
+def test_runtime_langgraph_compatibility_patch_has_one_exact_source_anchor(
+    requirement: str,
+) -> None:
+    source = (
+        '[project.optional-dependencies]\npostgres=["psycopg[c,binary]>=3.3.4"]\n'
+        f'llmchat=["{requirement}"]\n'
+    )
+    if requirement == "langgraph<=1.2.0":
+        result = recipe.runtime_pyproject(source)
+        assert 'llmchat=["langgraph==1.2.3"]' in result
+        assert 'postgres=["psycopg[binary]>=3.3.4"]' in result
+        assert "langgraph<=1.2.0" in source
+    else:
+        with pytest.raises(recipe.CandidateRecipeError, match="LangGraph compatibility"):
+            recipe.runtime_pyproject(source)
+
+
 def test_runtime_lock_rejects_source_only_postgres_adapter(monkeypatch) -> None:
     manifest = recipe._read_lock_manifest()
     original = recipe._require_file
@@ -399,8 +451,16 @@ def test_frozen_base_evidence_matches_candidate_pins_and_repository_inputs() ->
     assert delta["historicalInputsSha256"] == {
         name: evidence["hubInputsSha256"][name] for name in changed
     }
+    security = json.loads((ROOT / "evidence/WP-400/CF_SECURITY_RECIPE.json").read_text())
+    assert security["schema"] == "itworx.contextforge-security-recipe/v1"
+    assert security["priorRecipeEvidenceHashMode"] == "git-blob-lf"
+    assert security["priorRecipeEvidenceSha256"] == _prior_recipe_receipt_hash(
+        (ROOT / "evidence/WP-400/CF_POSTGRES_BINARY_RECIPE.json").read_bytes()
+    )
+    assert security["historicalInputsSha256"] == delta["candidateInputsSha256"]
+    assert set(security["candidateInputsSha256"]) == changed
     for name, historical_hash in evidence["hubInputsSha256"].items():
-        expected = delta["candidateInputsSha256"].get(name, historical_hash)
+        expected = security["candidateInputsSha256"].get(name, historical_hash)
         assert _hash((ROOT / name).read_bytes()) == expected
     assert delta["finalCandidateBuilt"] is False
     assert delta["policy"] == "psycopg[binary]==3.3.4; hash-locked wheels only"