#!/usr/bin/env python3 """Exercise a candidate against a labelled disposable local PostgreSQL container. No native credentials or cluster access. Requires psycopg on the host. Keeps only a JSON receipt; deletes only the receiver and database schema it creates. """ import argparse from concurrent.futures import ThreadPoolExecutor from datetime import datetime, timezone import json from pathlib import Path import subprocess import time import uuid import psycopg def run(argv, **kwargs): return subprocess.run(argv, check=True, capture_output=True, text=True, **kwargs).stdout def main(): p = argparse.ArgumentParser(description=__doc__) p.add_argument('--image', required=True) p.add_argument('--postgres-container', required=True) p.add_argument('--postgres-port', type=int, required=True) p.add_argument('--receipt', type=Path, required=True) a = p.parse_args() pg = json.loads(run(['docker', 'inspect', a.postgres_container]))[0] assert pg['Config']['Labels'].get('hfact.task') == 'audit-release-20260911', 'local test fixture required' suffix = uuid.uuid4().hex[:12] schema = 'release_' + suffix name = 'audit-release-check-' + suffix dsn = f'postgresql://postgres:local-test-only@127.0.0.1:{a.postgres_port}/audit_core' registry = [{'name': n, 'tokens': [n+'-fixture'], 'sources': [n], 'tenants': ['tenant:platform'], 'may_write': True, 'may_read': False, 'evidence_kind': 'load-bearing', 'secret_policy': 'redact'} for n in ['approval-engine', 'informed-decision']] registry.append({'name':'independent-reader','tokens':['reader-fixture'],'sources':['*'], 'tenants':['*'],'may_write':False,'may_read':True}) proof = {'image': a.image, 'native_credentials_used': False, 'checks': {}, 'started_at': datetime.now(timezone.utc).isoformat()} created = False def request(method, path, token='', body=None): # Values here are local synthetic fixtures, never native credentials. payload=json.dumps({'method':method,'path':path,'token':token,'body':body}) code='''import json,sys,urllib.request,urllib.error x=json.load(sys.stdin); b=x['body'] r=urllib.request.Request('http://127.0.0.1:8080'+x['path'],method=x['method'],data=json.dumps(b).encode() if b is not None else None,headers={'Content-Type':'application/json','Authorization':'Bearer '+x['token'],'Idempotency-Key':b['id'] if b else ''}) try: with urllib.request.urlopen(r,timeout=15) as f: print(json.dumps([f.status,json.load(f)])) except urllib.error.HTTPError as e: print(json.dumps([e.code,json.load(e)])) ''' return json.loads(run(['docker','exec','-i',name,'python','-c',code],input=payload)) def event(sender, suffix): return {'id':suffix,'source':sender,'type':'factory.custody-check', 'subject':'synthetic-release-check','tenant':'tenant:platform','correlation_id':'release-'+suffix, 'occurred_at':datetime.now(timezone.utc).isoformat(), 'data':{'synthetic':True,'auth_token':'fixture-must-be-redacted'}} try: run(['docker','run','-d','--name',name,'--network','container:'+a.postgres_container, '--read-only','--tmpfs','/tmp','--cap-drop','ALL','--security-opt','no-new-privileges', '-e','AUDIT_CORE_DATABASE_URL=postgresql://postgres:local-test-only@127.0.0.1:5432/audit_core', '-e','AUDIT_CORE_DATABASE_SCHEMA='+schema,'-e','AUDIT_CORE_REQUIRE_CUSTODY_CLASS=operational', '-e','AUDIT_CORE_SENDERS='+json.dumps(registry),a.image]) created = True for _ in range(50): try: status,body=request('GET','/readyz') if status==200: break except (subprocess.CalledProcessError, ValueError): time.sleep(.2) else: raise AssertionError('receiver readiness timed out') proof['checks']['operational_ready']=body['custody_class']=='operational' assert proof['checks']['operational_ready'] uid=run(['docker','exec',name,'id','-u']).strip(); assert uid=='10001' proof['checks']['nonroot_readonly']=True for sender in ['approval-engine','informed-decision']: e=event(sender,sender+'-'+suffix); token=sender+'-fixture' assert request('POST','/v1/events',token,e)[0]==202 assert request('POST','/v1/events',token,e)[0]==200 assert request('POST','/v1/events',token,dict(e,source='sibling'))[0]==400 assert request('POST','/v1/events',token,dict(e,tenant='tenant:sibling'))[0]==400 for path in ['/v1/events/'+e['id'],'/v1/events?correlation_id=fixture','/v1/stats','/v1/integrity','/v1/dead-letters','/v1/secret-findings','/v1/stream-findings']: assert request('GET',path,token)[0]==403, path status,stored=request('GET','/v1/events/'+e['id'],'reader-fixture') assert status==200 and 'fixture-must-be-redacted' not in json.dumps(stored) with psycopg.connect(dsn) as c: assert c.execute(f'SELECT count(*) FROM {schema}.events WHERE event_id=%s',(e['id'],)).fetchone()[0]==1 proof['checks'][sender]={'accepted':202,'duplicate':200,'wrong_source':400,'wrong_tenant':400,'read_routes_denied':7,'independent_read':200,'redacted':True,'stored_once':True} e=event('approval-engine','shutdown-'+suffix) with psycopg.connect(dsn,autocommit=True) as lock, ThreadPoolExecutor() as pool: lock.execute('SELECT pg_advisory_lock(%s)',(0xA0D17007,)) pending=pool.submit(request,'POST','/v1/events','approval-engine-fixture',e) for _ in range(100): if lock.execute("SELECT count(*) FROM pg_locks WHERE locktype='advisory' AND NOT granted").fetchone()[0]: break time.sleep(.05) else: raise AssertionError('in-flight database write not observed') stop=pool.submit(run,['docker','stop','--timeout','10',name]) time.sleep(.5) lock.execute('SELECT pg_advisory_unlock(%s)',(0xA0D17007,)) try: pending.result() except subprocess.CalledProcessError: pass # Lost acknowledgement requires retry. stop.result() code=int(run(['docker','inspect',name,'--format','{{.State.ExitCode}}']).strip()); assert code==0, code with psycopg.connect(dsn) as c: assert c.execute(f'SELECT count(*) FROM {schema}.events WHERE event_id=%s',(e['id'],)).fetchone()[0]==1 run(['docker','start',name]) for _ in range(50): try: if request('GET','/readyz')[0]==200: break except subprocess.CalledProcessError: pass time.sleep(.2) assert request('POST','/v1/events','approval-engine-fixture',e)[0]==200 status,integrity=request('GET','/v1/integrity','reader-fixture') assert status==200 and integrity['intact'] and integrity['events']==3 proof['checks']['sigterm']={'exit_code':code,'inflight_committed_once':True,'restart_retry_duplicate':True,'chain_intact':True} proof['status']='passed' finally: if created: run(['docker','rm','-f',name]) with psycopg.connect(dsn) as c: c.execute(f'DROP SCHEMA IF EXISTS {schema} CASCADE') proof['own_fixture_cleanup']=True with a.receipt.open('x') as f: json.dump(proof,f,indent=2); f.write('\n') print(json.dumps(proof,indent=2)) if __name__=='__main__': main()