{
  "schema": "cain42.keystone.reference-tests.v1",
  "note": "Reference tests for the KEYSTONE demo samples, written independently of any fix. Published 2026-11-02 so anyone can re-run them. Not referenced by hash inside the 10-14/10-15 records (those records predate this file).",
  "samples": {
    "forged-token": {
      "path": "tokens.py",
      "title": "A signature check that never checks the signature",
      "reference_test": "from tokens import sign, verify_token\n\n\ndef test_genuine_signature_is_accepted():\n    assert verify_token(\"pay 10\", sign(\"pay 10\"))[\"valid\"] is True\n\n\ndef test_forged_signature_is_rejected():\n    assert verify_token(\"pay 10\", \"0\" * 64)[\"valid\"] is False\n\n\ndef test_signature_for_another_message_is_rejected():\n    assert verify_token(\"pay 1000000\", sign(\"pay 10\"))[\"valid\"] is False\n",
      "reference_test_sha256": "2f5092528a1414004af77d92890b94be945885c1419f3d34851e7d660ce705af"
    },
    "random-accuracy": {
      "path": "metrics.py",
      "title": "A metric that reports a random number as accuracy",
      "reference_test": "from metrics import accuracy\n\n\ndef test_accuracy_is_computed_from_the_data():\n    assert accuracy([1, 0, 1, 1], [1, 1, 1, 1]) == 0.75\n\n\ndef test_all_wrong_is_zero():\n    assert accuracy([0, 0], [1, 1]) == 0.0\n\n\ndef test_same_input_same_answer():\n    assert accuracy([1, 2, 3], [1, 2, 0]) == accuracy([1, 2, 3], [1, 2, 0])\n",
      "reference_test_sha256": "58d23b2815b8a43a98429a1bc9bde3dca8b8f512adf8bc336f5368d552876e3c"
    },
    "timing-leak": {
      "path": "webhook.py",
      "title": "A webhook signature compared with == (timing leak)",
      "reference_test": "import ast\nimport hashlib\nimport hmac\n\nfrom webhook import check_webhook\n\n\ndef test_genuine_signature_is_accepted():\n    sig = hmac.new(b\"k\", b\"{}\", hashlib.sha256).hexdigest()\n    assert check_webhook(b\"k\", b\"{}\", sig) is True\n\n\ndef test_wrong_signature_is_rejected():\n    assert check_webhook(b\"k\", b\"{}\", \"0\" * 64) is False\n\n\ndef test_comparison_is_constant_time():\n    tree = ast.parse(open(\"webhook.py\").read())\n    names = {n.attr for n in ast.walk(tree) if isinstance(n, ast.Attribute)}\n    assert \"compare_digest\" in names\n",
      "reference_test_sha256": "efd2ff535a84c27e0211ca6e7cf17411432a5db9848d3dbe39eb9f20567b07cd"
    },
    "fake-alert": {
      "path": "alerts.py",
      "title": "An alert function that says 'sent' and sends nothing",
      "reference_test": "from alerts import send_alert\n\n\ndef test_an_alert_that_was_not_delivered_does_not_claim_it_was():\n    try:\n        result = send_alert(\"on-call\", \"disk full\")\n    except Exception:\n        return  # refusing loudly is an honest outcome\n    assert result.get(\"status\") != \"sent\"\n",
      "reference_test_sha256": "c4b05ef4892adeac3fa1ba55af9784e9115b2af598dc14000c29431101cb5e99"
    }
  }
}