coulomb/approval-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Publish and pin the verified schema-v5 approval candidate

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-10 19:35:05 +02:00
parent be1a388a84
commit c8f85c6d76
6 changed files with 172 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

24
tests/test_deploy_manifest.py
View file

@ -8,6 +8,7 @@ kind of property a test can hold and prose cannot.
from __future__ import annotations
import json
import re
from pathlib import Path
@ -15,7 +16,7 @@ from approval_engine.store import LATEST_SCHEMA_VERSION
ROOT = Path(__file__).resolve().parents[1]
MANIFEST = ROOT / "deploy" / "approval-engine.yaml"
RELEASE_RECORD = ROOT / "docs" / "image-scan-2026-09-06.md"
RELEASE_RECORD = ROOT / "docs" / "evidence" / "2026-09-10-human-control-image.json"
DEPLOY_README = ROOT / "deploy" / "README.md"
IMAGE_LINE = re.compile(r"^\s*image:\s*(\S+)\s*$", re.MULTILINE)
@ -78,28 +79,23 @@ def test_pinned_image_schema_drift_is_acknowledged():
The checks above hold that migrate and serve run the *same* code. They
cannot see that both run *old* code: a v3 image migrating to 3 and serving
3 is perfectly self-consistent while this repository has moved to 4. That
3 is perfectly self-consistent while this repository has moved to 5. That
reads as healthy and is the more dangerous shape, because the failure is an
assumption ("the deployment records principal_type") rather than an error.
So when the manifest still pins the artifact the release record describes,
the record's schema version must either match this repository or the
runbook must say plainly that the pin is behind. Prose alone loses that;
The release record must describe the exact pinned artifact and its verified
schema. That version must either match this repository or the runbook must
say plainly that the pin is behind. Prose alone loses that;
the test makes stating it the cheaper option.
"""
refs = image_refs()
assert refs, "no image references found"
pinned = refs[0].split("@", 1)[-1]
record = RELEASE_RECORD.read_text(encoding="utf-8")
if pinned not in record:
return # a newer artifact is pinned; this record no longer describes it
versions = {
int(v) for v in re.findall(r"LATEST_SCHEMA_VERSION\s*=\s*(\d+)", record)
}
assert len(versions) == 1, f"release record states {versions or 'no'} schema versions"
recorded = versions.pop()
record = json.loads(RELEASE_RECORD.read_text(encoding="utf-8"))
assert pinned == record["image"]["digest"], "release evidence must describe the pinned image"
recorded = record["image"]["schema_version"]
assert record["container_verification"]["schema_version"] == recorded
if recorded == LATEST_SCHEMA_VERSION:
return