fix(toolshed): accept // seals so C/C++ generated files can be sealed

.github/workflows/ci-nightly.yml

@@ -46,7 +46,7 @@ jobs:
         run: |
           python -m pip install pytest
           # Standalone CI tool tests; skip repo-root conftest.py (imports cuda.pathfinder).
-          python -m pytest -v --noconftest ci/tools/tests
+          python -m pytest -v --noconftest ci/tools/tests toolshed/tests
 
   find-wheels:
     runs-on: ubuntu-latest

toolshed/check_generated_file_seals.py

@@ -17,7 +17,10 @@
 assert GENERATED_FILE_MARKER_FRAGMENT in GENERATED_FILE_SEAL_TOKEN
 _TOKEN_BYTES = GENERATED_FILE_SEAL_TOKEN.encode("ascii")
 _MARKER_REGEX = re.compile(
-    rb"^(?P<prefix>#|\.\.) "
+    # Keep the alternation in sync with the values of _COMMENT_CHARS below:
+    # a prefix that is not matched here can never reach the
+    # expected_comment_prefix() comparison in validate_generated_file_seal().
+    rb"^(?P<prefix>#|\.\.|//) "
     + re.escape(_TOKEN_BYTES)
     + rb" format=(?P<format>[0-9]+); content-sha256=(?P<digest>[0-9a-f]{64})\n$"
 )

toolshed/tests/test_check_generated_file_seals.py

@@ -0,0 +1,93 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+from __future__ import annotations
+
+import hashlib
+import os
+import sys
+
+import pytest
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), ".."))
+from check_generated_file_seals import (
+    _COMMENT_CHARS,
+    _MARKER_REGEX,
+    GENERATED_FILE_SEAL_TOKEN,
+    expected_comment_prefix,
+    validate_generated_file_seal,
+)
+
+BODY = b"placeholder generated content\nsecond line\n"
+
+
+def seal_line(prefix: bytes, content: bytes = BODY, seal_format: int = 1) -> bytes:
+    digest = hashlib.sha256(content).hexdigest().encode("ascii")
+    return b"%s %s format=%d; content-sha256=%s\n" % (
+        prefix,
+        GENERATED_FILE_SEAL_TOKEN.encode("ascii"),
+        seal_format,
+        digest,
+    )
+
+
+def write_sealed(tmp_path, name, prefix, content=BODY):
+    path = tmp_path / name
+    path.write_bytes(seal_line(prefix, content) + content)
+    return path
+
+
+@pytest.mark.agent_authored(model="claude-opus-5")
+@pytest.mark.parametrize("suffix,prefix", sorted(_COMMENT_CHARS.items()))
+def test_every_declared_comment_prefix_validates(tmp_path, suffix, prefix):
+    """A seal written with the prefix _COMMENT_CHARS declares for an extension
+    must validate. `//` did not: the marker regex only accepted `#` and `..`,
+    so every sealed .c/.cpp/.h file was rejected as MALFORMED before its
+    prefix was ever compared."""
+    path = write_sealed(tmp_path, f"generated{suffix}", prefix)
+
+    assert validate_generated_file_seal(str(path), set()) is True
+
+
+@pytest.mark.agent_authored(model="claude-opus-5")
+@pytest.mark.parametrize("prefix", sorted(set(_COMMENT_CHARS.values())))
+def test_marker_regex_accepts_every_declared_prefix(prefix):
+    match = _MARKER_REGEX.fullmatch(seal_line(prefix))
+
+    assert match is not None
+    assert match.group("prefix") == prefix
+
+
+@pytest.mark.agent_authored(model="claude-opus-5")
+def test_wrong_prefix_for_the_extension_is_rejected(tmp_path, capsys):
+    """The prefix must match the extension, not merely be a known prefix."""
+    path = write_sealed(tmp_path, "generated.c", b"#")
+
+    assert validate_generated_file_seal(str(path), set()) is False
+    assert "INVALID generated-file seal comment prefix" in capsys.readouterr().out
+
+
+@pytest.mark.agent_authored(model="claude-opus-5")
+def test_edited_content_is_rejected(tmp_path, capsys):
+    path = write_sealed(tmp_path, "generated.c", b"//")
+    path.write_bytes(path.read_bytes() + b"manually appended\n")
+
+    assert validate_generated_file_seal(str(path), set()) is False
+    assert "Manual changes detected" in capsys.readouterr().out
+
+
+@pytest.mark.agent_authored(model="claude-opus-5")
+def test_unsupported_extension_is_rejected(tmp_path, capsys):
+    path = write_sealed(tmp_path, "generated.txt", b"#")
+
+    assert expected_comment_prefix(str(path)) is None
+    assert validate_generated_file_seal(str(path), set()) is False
+    assert "UNSUPPORTED sealed generated-file extension" in capsys.readouterr().out
+
+
+@pytest.mark.agent_authored(model="claude-opus-5")
+def test_unsealed_file_is_accepted_when_it_was_never_sealed(tmp_path):
+    path = tmp_path / "plain.c"
+    path.write_bytes(BODY)
+
+    assert validate_generated_file_seal(str(path), set()) is True