coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0058-T02 done: per-row contract tests (E7, E9, C4, C5) and the coverage table
All checks were successful
Bounded-execution contracts / contracts (push) Successful in 1m43s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Ingress: each owner's NetworkPolicies admit the executor pod (small evaluator, synthetic cases).
Custody names: KeyCape client secret (C4) and audit sender (C5) agree across net-kingdom,
railiance-platform and audit-core. E7: one LLDAP digest for the executor tool and the server.
95 tests pass in a CI-like layout.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0
This commit is contained in:
tegwick 2026-11-06 00:23:52 +01:00
parent 79f14ce50a
commit 80d280a340
6 changed files with 272 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

22
docs/bounded-execution-contract-table.md
View file

@ -509,3 +509,25 @@ The agent's default context can read NetworkPolicies in `sso`, `approval-engine`
`15df0e3`, `.forgejo/workflows/packaging.yaml`). The run fetches its own tarball with the run's automatic
repository-scoped token, clones net-kingdom and railiance-platform anonymously at `main`, and fails on any skip.
That covers E8 (ceiling), E9 (egress) and R2 (config, exit codes), on push and nightly.
### Coverage by row (2026-11-06)
| Row | Contract test | Runs in |
| --- | --- | --- |
| E1 | `tests/test_executor_lanes.py`: `executor-lanes.py contract()` compares role, KV path, fields, auth shape and the policy file text with CCR-2026-0058/0059 | net-kingdom contract CI |
| E2, E3 | `tools/contract-tests/tests/test_exercises.py::test_t19`: KeyCape binary from the pinned image, approval-engine source | net-kingdom contract CI |
| E4 | `bounded-executor/tests/test_approval_request.py` against informed-decision's intake code | net-kingdom contract CI |
| E5, C6, C7, O1 | `tools/bounded-execution-readiness/tests/test_ready_owner_sources.py`, with both 2026-11-04 states replayed from history | net-kingdom contract CI |
| E6 | `test_exercises.py::test_t15`: audit-core ingestion and sender scope | net-kingdom contract CI |
| E7 | `tools/contract-tests/tests/test_lldap_tool.py`: one LLDAP digest for the executor tool and the server | net-kingdom contract CI |
| E8, R2 | rapp `tests/test_packaging.py`: ceiling, config and exit codes against net-kingdom | rapp packaging CI |
| E9 | `tools/contract-tests/tests/test_ingress.py`: each owner's ingress admits the executor; rapp tests the egress | both |
| R1 | the executor's `source` preflight check in the pinned image (`make preflight`) | before each window |
| C1 | `tests/test_executor_lanes.py` runs railiance-platform's real helper modules | net-kingdom contract CI |
| C2, C3 | the readiness check: `case_type_bytes_match_broker`, `case_materialized` | net-kingdom contract CI |
| C4, C5 | `tools/contract-tests/tests/test_custody_names.py` | net-kingdom contract CI |
| O2–O4, F1, F2 | `tools/bounded-execution-run/tests/test_bx.py` (lane child silent, window always closed); conventions in T07 | net-kingdom contract CI |
Not covered from source: OpenBao's ingress (rapp-openbao is private) and live drift from source, such as the
approval-engine policy that was live but not in its file. The readiness preflight Job catches unreachable endpoints
before a window, and T07 and O1 cover the drift.