coulomb/informed-decision
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare authenticated lifecycle runtime and production release candidate

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
This commit is contained in:
tegwick 2026-10-04 21:40:19 +02:00
parent f3b71b1521
commit 4f546ae3b1
41 changed files with 2598 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

16
tools/smoke_container.py
View file

@ -20,6 +20,7 @@ def main():
parser=argparse.ArgumentParser(description=__doc__)
parser.add_argument('--image',required=True)
parser.add_argument('--receipt',type=Path,required=True)
parser.add_argument('--workload',action='store_true',help='exercise the separate private workload listener')
args=parser.parse_args()
prefix='infd-proof-'+uuid.uuid4().hex[:12]
volumes=[];containers=[];checks=[]
@ -89,6 +90,17 @@ assert s.submission(d.id)['state']=='unresolved'
'package':'container.fixture','version':'v1','package_digest':'sha256:'+'a'*64,
'caller_token_file':'/configuration/caller-token'},
'audit':{'origin':'http://127.0.0.1:18084','sender_token_file':'/configuration/audit-token'}}
if args.workload:
config['lifecycle_policy']={**config['policy'],'package':'container.lifecycle.fixture'}
config['lifecycle_delivery']=True
config['workload_api']={'token_review':{'origin':'https://127.0.0.1:18443',
'ca_file':'/configuration/absent-ca','token_file':'/configuration/caller-token'},
'lifecycle_callers_file':'/configuration/lifecycle-callers.json',
'intake':{'secret_file':'/configuration/absent-requester',
'submitters_file':'/configuration/intake-submitters.json',
'groups_file':'/configuration/review-groups.json'}}
for name in ('lifecycle-callers.json','intake-submitters.json','review-groups.json'):
(fixture/name).write_text('{}')
(fixture/'runtime.json').write_text(json.dumps(config))
for file in fixture.iterdir():file.chmod(0o444)
data=volume('data');backup=volume('backup')
@ -102,6 +114,10 @@ assert s.submission(d.id)['state']=='unresolved'
checks.append('private config/database modes enforced; package installer absent')
command(first,"import urllib.request,urllib.error\nfor path,status in [('/readyz',503),('/review?memo_id=missing',401)]:\n try: urllib.request.urlopen('http://127.0.0.1:8080'+path)\n except urllib.error.HTTPError as e: assert e.code==status\n else: raise AssertionError(path)")
checks.append('configured review refuses anonymous access and reports audit-unready status')
if args.workload:
command(first,"import urllib.request,urllib.error\nfor port,path,status in [(8081,'/v1/decisions',401),(8081,'/v1/memos',405),(8081,'/review',404),(8080,'/v1/decisions',404)]:\n try: urllib.request.urlopen('http://127.0.0.1:'+str(port)+path)\n except urllib.error.HTTPError as e: assert e.code==status\n else: raise AssertionError(path)")
checks.append('private listener refuses anonymous lifecycle access and exposes no browser routes')
checks.append('public listener exposes no private workload route')
command(first,"from informed_decision.container import single_writer\ntry:\n with single_writer('/data/private'): pass\nexcept ValueError: pass\nelse: raise AssertionError('second writer admitted')")
checks.append('a second writer cannot acquire the active evidence volume')
command(first,seed)