feat: strengthen BSP and PSP validation and handoff

skills/firmware-lowlevel-psp-development/scripts/psp/test_validate_psp.py

@@ -5,6 +5,7 @@ import hashlib
 import json
 import tempfile
 from pathlib import Path
+from unittest.mock import patch
 
 import validate_psp
 
@@ -16,7 +17,8 @@ def main() -> int:
         (psp / "configs").mkdir(parents=True)
         (psp / "scripts").mkdir()
         (psp / "AiPlugin").mkdir()
-        artifact_root = root / "imgs" / "20260902_1"
+        output_root = root / "outputs"
+        artifact_root = output_root / "CV1841CP-NEW_dualos" / "imgs" / "20260902_1"
         artifact_root.mkdir(parents=True)
         artifact = artifact_root / "boot.bin"
         artifact.write_bytes(b"boot")
@@ -38,6 +40,12 @@ def main() -> int:
         (psp / "AiPlugin" / "profile.json").write_text(
             json.dumps({"EmxSdkVersion": "EmxSdk-1"}), encoding="utf-8"
         )
+        runtime_configs = root / "runtime-configs"
+        runtime_configs.mkdir()
+        (runtime_configs / "invalid.json").write_text("{", encoding="utf-8")
+        (runtime_configs / "invalid.ini").write_text("[", encoding="utf-8")
+        (runtime_configs / "invalid.sh").write_text("if\n", encoding="utf-8")
+        (psp / "AiPlugin" / "configs").symlink_to(runtime_configs, target_is_directory=True)
         (psp / "configs" / "same.json").write_text(
             json.dumps(
                 {
@@ -126,6 +134,15 @@ def main() -> int:
         margin_path = bsp_project / "doc" / "bsp_adaptation" / "validation" / "image_partition_margin_20260902_1.json"
         margin_path.parent.mkdir(parents=True)
         margin_path.write_text(json.dumps(margin), encoding="utf-8")
+        permissions = {
+            "schema_version": 1,
+            "passed": True,
+            "policy": "a+rX",
+            "output_root": str(output_root),
+            "imgs_version_path": str(artifact_root),
+        }
+        permissions_path = margin_path.parent / "output_permissions_20260902_1.json"
+        permissions_path.write_text(json.dumps(permissions), encoding="utf-8")
         handoff.write_text(
             json.dumps(
                 {
@@ -148,6 +165,7 @@ def main() -> int:
                         "completion_marker_seen": True,
                         "imgs_version_path": str(artifact_root),
                         "image_partition_margin_path": str(margin_path),
+                        "output_permissions_path": str(permissions_path),
                     },
                     "artifacts": [
                         {
@@ -160,6 +178,7 @@ def main() -> int:
                     ],
                     "validation": {
                         "image_partition_margin": margin,
+                        "output_permissions": permissions,
                         "hardware": "pending",
                         "owner_acceptance": "pending",
                         "release": "not-authorized",
@@ -188,9 +207,24 @@ def main() -> int:
             expected_sensors=expected_sensors,
         )
         assert result["passed"] is True, result
+        scanned_files = {
+            path.relative_to(psp).as_posix()
+            for path in validate_psp.iter_regular_files(psp)
+        }
+        assert "AiPlugin/configs/invalid.json" not in scanned_files
+        assert "AiPlugin/configs/invalid.ini" not in scanned_files
+        assert "AiPlugin/configs/invalid.sh" not in scanned_files
+        with patch.object(Path, "exists", side_effect=PermissionError(13, "denied")):
+            exists, access_error = validate_psp.probe_path_exists(Path("/target/runtime"))
+        assert exists is False
+        assert access_error is not None and "denied" in access_error
         assert lock.is_file()
         lock_payload = json.loads(lock.read_text(encoding="utf-8"))
         assert lock_payload["image_partition_margin"]["required_margin_bytes"] == 512 * 1024
+        assert lock_payload["output_permissions"]["passed"] is True
+        assert lock_payload["output_permissions"]["evidence_path"] == str(permissions_path)
+        assert output_root.stat().st_mode & 0o555 == 0o555
+        assert artifact.stat().st_mode & 0o444 == 0o444
         assert result["checks"]["configuration_overrides"][0]["allowed"] is True
         assert any("个人或临时目录" in warning for warning in result["warnings"])
         assert any(