Implement lifecycle workspace publication and audit delivery

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
This commit is contained in:
tegwick 2026-10-04 20:17:24 +02:00
parent ee472acc87
commit 5fec7de4cb
21 changed files with 1022 additions and 78 deletions

View file

@ -63,6 +63,21 @@ def test_config_load_does_not_provision_or_read_credentials(tmp_path):
assert all(r['state']=='blocked' for r in runtime.controller.store.outbox())
def test_lifecycle_workspace_requires_separate_explicit_policy_pin(tmp_path):
path, data = config(tmp_path)
assert Runtime.from_file(path).lifecycle is None
data['lifecycle_policy'] = dict(data['policy'])
path.write_text(json.dumps(data))
with pytest.raises(ValueError, match='separate admission'):
Runtime.from_file(path)
data['lifecycle_policy']['package'] = 'informed-decision.lifecycle'
path.write_text(json.dumps(data))
runtime = Runtime.from_file(path)
assert runtime.lifecycle.repository.store is runtime.controller.store
assert runtime.lifecycle.policy is not runtime.controller.policy
assert not runtime.pump.ready()
@pytest.mark.parametrize('fault',['permissions','symlink','unknown-key','relative-store','missing-pin','unsafe-origin'])
def test_unsafe_or_incomplete_config_refused(tmp_path,fault):
path,data=config(tmp_path)