76 lines
3 KiB
Python
76 lines
3 KiB
Python
|
"""The default envelope is valid data and faithfully encodes canon A6."""
|
||
|
|
|
||
|
|
from __future__ import annotations
|
||
|
|
|
||
|
|
from emergent_security.constitution import RULE_IDS
|
||
|
|
from emergent_security.model import Outcome
|
||
|
|
|
||
|
|
# Every A6 row of canon v0.8, by decision class id.
|
||
|
|
A6_CLASSES = {
|
||
|
|
"code.edit", "test.add", "test.weaken", "dependency.add", "code.fetch_execute",
|
||
|
|
"data.egress", "git.commit_feature", "git.push_feature", "git.merge_protected",
|
||
|
|
"git.history_rewrite", "ci.add_check", "ci.weaken", "checks.bypass", "policy.edit",
|
||
|
|
"secrets.read", "secrets.write", "credential.reuse_broader", "env.disposable",
|
||
|
|
"agent.delegate", "deploy.internal", "deploy.relied_upon", "iam.change",
|
||
|
|
"data.sensitive", "tenant.cross", "data.delete_irreversible",
|
||
|
|
"tenant.governance_change", "tenant.platform_envelope_change", "audit.disable",
|
||
|
|
"platform.root",
|
||
|
|
}
|
||
|
|
|
||
|
|
# Rows whose base mode is a constitutional deny (canon A6 "DENY" rows).
|
||
|
|
CONSTITUTIONAL_DENY = {
|
||
|
|
"checks.bypass", "policy.edit", "secrets.write", "credential.reuse_broader",
|
||
|
|
"agent.delegate", "tenant.cross", "tenant.governance_change",
|
||
|
|
"tenant.platform_envelope_change", "audit.disable",
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
def test_envelope_validates_cleanly(default_envelope, scales):
|
||
|
|
assert default_envelope.validate(scales) == []
|
||
|
|
|
||
|
|
|
||
|
|
def test_envelope_covers_every_a6_row(default_envelope):
|
||
|
|
assert set(default_envelope.class_ids) == A6_CLASSES
|
||
|
|
|
||
|
|
|
||
|
|
def test_constitutional_denies_are_the_base_mode(default_envelope):
|
||
|
|
denied = {cid for cid in default_envelope.class_ids if default_envelope.row(cid).mode is Outcome.DENY}
|
||
|
|
assert denied == CONSTITUTIONAL_DENY
|
||
|
|
|
||
|
|
|
||
|
|
def test_root_row_only_requests_root_authorization(default_envelope):
|
||
|
|
assert default_envelope.row("platform.root").mode is Outcome.ROOT_AUTHORIZATION_REQUIRED
|
||
|
|
|
||
|
|
|
||
|
|
def test_every_cited_rule_exists(default_envelope):
|
||
|
|
cited = {rule for cid in default_envelope.class_ids for rule in default_envelope.all_rules(cid)}
|
||
|
|
assert cited <= RULE_IDS
|
||
|
|
|
||
|
|
|
||
|
|
def test_applies_only_to_hot_build_l0_outside_tenants(default_envelope):
|
||
|
|
base = {"level": "L0", "temperature": "hot", "phase": "build", "tenant": "none"}
|
||
|
|
assert default_envelope.applies_to(base)
|
||
|
|
for key, other in [("level", "L1"), ("temperature", "warm"), ("phase", "production"), ("tenant", "tenant://acme")]:
|
||
|
|
assert not default_envelope.applies_to({**base, key: other})
|
||
|
|
|
||
|
|
|
||
|
|
def test_validation_reports_broken_rows(scales):
|
||
|
|
from emergent_security.envelope import DefaultEnvelope
|
||
|
|
|
||
|
|
broken = DefaultEnvelope.from_dict(
|
||
|
|
{
|
||
|
|
"id": "envelope://broken",
|
||
|
|
"applies_when": {},
|
||
|
|
"risk_envelope": {"blast_radius": "galaxy"},
|
||
|
|
"classes": [
|
||
|
|
{"id": "a", "mode": "sometimes", "rules": ["C99"]},
|
||
|
|
{"id": "a", "mode": "autonomous", "rules": []},
|
||
|
|
],
|
||
|
|
}
|
||
|
|
)
|
||
|
|
errors = broken.validate(scales)
|
||
|
|
assert any("duplicate class id: a" in e for e in errors)
|
||
|
|
assert any("unknown mode" in e for e in errors)
|
||
|
|
assert any("unknown rule C99" in e for e in errors)
|
||
|
|
assert any("unknown value for blast_radius" in e for e in errors)
|