65 lines
3 KiB
Python
65 lines
3 KiB
Python
|
"""ready.py against the owners' real source (NK-WP-0058-T02): the sibling checkouts locally, the fetched owners in CI.
|
||
|
|
|
||
|
|
Rows E5, C1, C2, C6 and C7 of docs/bounded-execution-contract-table.md. rapp-bounded-executor is private, so its
|
||
|
|
pilot config is replaced by the values the admission and NK-WP-0056 expect; everything else is owner source.
|
||
|
|
"""
|
||
|
|
import importlib.util
|
||
|
|
import json
|
||
|
|
from pathlib import Path
|
||
|
|
|
||
|
|
import pytest
|
||
|
|
import yaml
|
||
|
|
|
||
|
|
REPO = Path(__file__).resolve().parents[3]
|
||
|
|
SIBLINGS = REPO.parent
|
||
|
|
spec = importlib.util.spec_from_file_location('ready_owner', REPO / 'tools/bounded-execution-readiness/ready.py')
|
||
|
|
ready = importlib.util.module_from_spec(spec)
|
||
|
|
spec.loader.exec_module(ready)
|
||
|
|
|
||
|
|
OWNERS = ('railiance-platform', 'informed-decision', 'access-engine')
|
||
|
|
ADMISSION = REPO / 'admissions/BEA-2026-0003.yaml'
|
||
|
|
INSIDE = ready.when('2026-11-05T08:25:00Z')
|
||
|
|
PILOT = {'executor_identity': 'service:nk-bind-executor',
|
||
|
|
'runtime_principal': 'system:serviceaccount:sso:nk-bind-executor',
|
||
|
|
'approver_subjects': {'admin': 'uid=admin,ou=people,dc=netkingdom,dc=local'}}
|
||
|
|
# informed-decision revisions on 2026-11-04 (first pilot attempt): Argo pinned 312ab97e, which predates the
|
||
|
|
# executor's registration; live ran the founder-run release 005709a, which routed net-kingdom-admins to platform-root.
|
||
|
|
ARGO_PIN_2026_11_04, LIVE_2026_11_04 = '312ab97e', '005709a'
|
||
|
|
|
||
|
|
pytestmark = pytest.mark.skipif(not all((SIBLINGS / o / '.git').exists() for o in OWNERS),
|
||
|
|
reason='owner checkouts required (CI: tools/contract-tests/fetch_owners.py)')
|
||
|
|
|
||
|
|
|
||
|
|
def layout(tmp_path, argo_revision=None):
|
||
|
|
root = tmp_path / 'siblings'
|
||
|
|
root.mkdir()
|
||
|
|
for owner in ('informed-decision', 'access-engine'):
|
||
|
|
(root / owner).symlink_to(SIBLINGS / owner)
|
||
|
|
platform = root / 'railiance-platform'
|
||
|
|
platform.mkdir()
|
||
|
|
for part in ('scripts', 'credential-change-requests'):
|
||
|
|
(platform / part).symlink_to(SIBLINGS / 'railiance-platform' / part)
|
||
|
|
app = yaml.safe_load((SIBLINGS / 'railiance-platform' / ready.ARGO_APP).read_text())
|
||
|
|
if argo_revision:
|
||
|
|
app['spec']['source']['targetRevision'] = argo_revision
|
||
|
|
(platform / ready.ARGO_APP).parent.mkdir(parents=True)
|
||
|
|
(platform / ready.ARGO_APP).write_text(yaml.safe_dump(app))
|
||
|
|
config = root / 'rapp-bounded-executor' / ready.RAPP_CONFIG
|
||
|
|
config.parent.mkdir(parents=True)
|
||
|
|
config.write_text(json.dumps(PILOT))
|
||
|
|
return root
|
||
|
|
|
||
|
|
|
||
|
|
def test_owner_sources_hold_the_bounded_execution_contracts(tmp_path):
|
||
|
|
r = ready.run(ADMISSION, 'apr-1', layout(tmp_path), INSIDE)
|
||
|
|
assert r['agent_checks_pass'], r['failures']
|
||
|
|
|
||
|
|
|
||
|
|
@pytest.mark.parametrize('revision, failure', [
|
||
|
|
(ARGO_PIN_2026_11_04, 'executor_registered:pinned'), # an Argo sync would have dropped the registration
|
||
|
|
(LIVE_2026_11_04, 'recipient_is_approver:pinned'), # live routed the memo to platform-root
|
||
|
|
])
|
||
|
|
def test_replay_2026_11_04_from_owner_history(tmp_path, revision, failure):
|
||
|
|
r = ready.run(ADMISSION, 'apr-1', layout(tmp_path, argo_revision=revision), INSIDE)
|
||
|
|
assert failure in r['failures']
|