45 lines
2.2 KiB
Markdown
45 lines
2.2 KiB
Markdown
|
# Hub-extension conformance
|
||
|
|
|
||
|
|
`hub_core.conformance` is the reusable Tier 2/3 harness scaffold for contract
|
||
|
|
version 0.1.0. It drives only public HTTP ports, so a FastAPI `TestClient`, an
|
||
|
|
`httpx.Client`, or another compatible target can be used without importing the
|
||
|
|
runtime implementation.
|
||
|
|
|
||
|
|
The harness mutates its target. Run it against a disposable instance or a
|
||
|
|
dedicated test namespace:
|
||
|
|
|
||
|
|
```bash
|
||
|
|
hub-core api --host 127.0.0.1 --port 8010
|
||
|
|
hub-core conformance --base-url http://127.0.0.1:8010
|
||
|
|
hub-core conformance --base-url http://127.0.0.1:8010 --json
|
||
|
|
```
|
||
|
|
|
||
|
|
## Implemented profile
|
||
|
|
|
||
|
|
| ID | Tier | Automated evidence |
|
||
|
|
| --- | --- | --- |
|
||
|
|
| C1 | 2 | Packaged descriptor, manifest, and catalog validate against Draft 2020-12 schemas |
|
||
|
|
| C3 | 2 | Runtime health probe returns healthy |
|
||
|
|
| C4 | 2 | Repeated manifest registration is reported as a duplicate |
|
||
|
|
| C5 | 2 | Cataloged progress/interaction events are accepted; wrong-family and unknown events are rejected |
|
||
|
|
| C6 | 2 | Contract and scenario fixtures reject secret-shaped keys, credentialed database URLs, and private keys |
|
||
|
|
| C8 | 2 | Registry response propagates the request correlation identifier |
|
||
|
|
| F2 | 3 | Progress and interaction fixture events appear only in their respective projections |
|
||
|
|
| F3 | 3 | Authority fixtures appear in projections with declared rebuild sources and provenance hashes |
|
||
|
|
|
||
|
|
The projection scenario is shipped in the wheel as
|
||
|
|
`fixtures/projection-rebuild.json`. Correlation and time fields are generated
|
||
|
|
per run, allowing the harness to identify its own evidence without relying on
|
||
|
|
global row counts.
|
||
|
|
|
||
|
|
## Deliberately open checks
|
||
|
|
|
||
|
|
C2 registry resolution, C7 raw-port configuration policy, C9 dependency-aware
|
||
|
|
readiness, C10 version negotiation, F1 registry audit history, F4 `/api/v2`
|
||
|
|
consumer smokes, F5 MCP projection binding, F6 policy fail-closed behavior, F7
|
||
|
|
telemetry rejection, and F8 migration metadata isolation require ports or
|
||
|
|
absorption slices that are not part of the T04 minimal vertical. Tenant
|
||
|
|
isolation also remains open because the 0.1 runtime has no tenant identity or
|
||
|
|
authorization context yet. These gaps must not be interpreted as passing; the
|
||
|
|
harness reports only the implemented profile above.
|