coulomb/kings-guard
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Admit source evidence snapshots and harden stream completeness

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06e89-93a2-7aa2-82b3-ce5ccd2682e6
This commit is contained in:
tegwick 2026-09-05 00:42:19 +02:00
parent 824fb1b966
commit 31e9963933
34 changed files with 1057 additions and 122 deletions
Download patch file Download diff file Expand all files Collapse all files

24
tests/test_contracts.py
View file

@ -1,8 +1,8 @@
from helpers import load_pilot, observation_from_fixture
from kings_guard.contracts import PostureLevel, SecurityGenome, as_jsonable
from kings_guard.posture import PostureEvaluator
from helpers import load_pilot, observation_from_fixture
def test_qonto_fixture_loads_a_normalized_genome() -> None:
fixture = load_pilot()
@ -25,6 +25,18 @@ def test_qonto_audit_event_normalizes_to_immune_observation() -> None:
assert observation.deny_reason == "credential_exfil"
def test_qonto_source_identity_and_egress_override_legacy_mapping_hints() -> None:
fixture = load_pilot()
event = dict(fixture.audit_event)
event["identity_binding"] = "key_cape_jwt"
event["egress_destination"] = "qonto-proxy"
observation = observation_from_fixture(fixture, event)
assert observation.identity_binding == "key_cape_jwt"
assert observation.egress_destination == "qonto-proxy"
def test_posture_evaluation_is_jsonable() -> None:
fixture = load_pilot()
observation = observation_from_fixture(fixture)
@ -34,3 +46,11 @@ def test_posture_evaluation_is_jsonable() -> None:
assert payload["assessment"]["posture"] == PostureLevel.INFLAMED.value
assert payload["signals"][0]["signal_kind"] == "posture_hint"
assert payload["assessment"]["stream_completeness"] == "unknown"
def test_explicitly_missing_source_context_does_not_recover_legacy_hints() -> None:
fixture = load_pilot()
event = dict(fixture.audit_event, identity_binding=None, egress_destination=None)
observation = observation_from_fixture(fixture, event)
assert observation.identity_binding is None
assert observation.egress_destination is None