tegwick
4e07d60ff1
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ea3-7939-7b63-8125-699f8b50bedd
289 lines
9.2 KiB
Python
289 lines
9.2 KiB
Python
from __future__ import annotations
|
|
|
|
import copy
|
|
import importlib.util
|
|
import pathlib
|
|
import sys
|
|
|
|
import pytest
|
|
import yaml
|
|
|
|
TOOL_PATH = pathlib.Path(__file__).resolve().parents[1] / "emission_cadence_profile.py"
|
|
SPEC = importlib.util.spec_from_file_location("emission_cadence_profile", TOOL_PATH)
|
|
profile = importlib.util.module_from_spec(SPEC)
|
|
assert SPEC and SPEC.loader
|
|
sys.modules[SPEC.name] = profile
|
|
SPEC.loader.exec_module(profile)
|
|
|
|
|
|
CONTRACT_SCHEMA = {
|
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
"type": "object",
|
|
"required": ["schema_version", "source", "sources"],
|
|
"properties": {
|
|
"schema_version": {"const": "0.1"},
|
|
"source": {"type": "string"},
|
|
"sources": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"required": ["source_id", "event_class", "form"],
|
|
"properties": {
|
|
"event_class": {"type": "string", "minLength": 1},
|
|
"extensions": {
|
|
"type": "object",
|
|
"additionalProperties": {"type": "object"},
|
|
},
|
|
"form": {"enum": ["expected-rate", "heartbeat-or-reconciliation"]},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
|
|
def rare_entry() -> dict:
|
|
return {
|
|
"source_id": "example.audit.deny",
|
|
"event_class": "audit.deny",
|
|
"extensions": {
|
|
"netkingdom": {
|
|
"evidence_class": "load-bearing",
|
|
"rate_monitoring": "forbidden",
|
|
}
|
|
},
|
|
"form": "heartbeat-or-reconciliation",
|
|
"heartbeat": {
|
|
"event_class": "audit.heartbeat",
|
|
"interval": "24h",
|
|
"assertion": "nothing-to-report",
|
|
"missing": "finding",
|
|
},
|
|
"reconciliation": {
|
|
"compare_local": "source_transition_counts.audit.deny",
|
|
"compare_observed": "evidence_counts.audit.deny",
|
|
"divergence": "finding",
|
|
"undrained_local": "lag-not-divergence",
|
|
},
|
|
}
|
|
|
|
|
|
def declaration(*entries: dict) -> dict:
|
|
return {"schema_version": "0.1", "source": "example", "sources": list(entries)}
|
|
|
|
|
|
def report(document: dict, *, load=(), rare=(), attributive=(), schema=CONTRACT_SCHEMA):
|
|
return profile.build_report(
|
|
schema,
|
|
document,
|
|
contract_schema_path="info-tech-canon/schema.json",
|
|
declaration_path="source/cadence.yaml",
|
|
load_bearing=set(load),
|
|
rare_load_bearing=set(rare),
|
|
attributive=set(attributive),
|
|
)
|
|
|
|
|
|
def codes(result: dict) -> set[str]:
|
|
return {item["code"] for item in result["findings"]}
|
|
|
|
|
|
def test_valid_rare_load_bearing_requires_both_positive_controls() -> None:
|
|
result = report(declaration(rare_entry()), rare={"audit.deny"})
|
|
|
|
assert result["contract_valid"] is True
|
|
assert result["conformant"] is True
|
|
assert result["findings"] == []
|
|
|
|
|
|
def test_contract_validation_runs_before_profile() -> None:
|
|
result = report({"source": "example"}, rare={"audit.deny"})
|
|
|
|
assert result["contract_valid"] is False
|
|
assert codes(result) == {"contract-validation-failed"}
|
|
assert "load-bearing-cadence-missing" not in codes(result)
|
|
|
|
|
|
def test_missing_and_mismatched_source_inventory_classes_fail() -> None:
|
|
wrong = rare_entry()
|
|
wrong["extensions"]["netkingdom"]["evidence_class"] = "attributive"
|
|
|
|
missing = report(declaration(), load={"audit.deny"})
|
|
mismatched = report(declaration(wrong), rare={"audit.deny"})
|
|
|
|
assert "load-bearing-cadence-missing" in codes(missing)
|
|
assert "evidence-class-mismatch" in codes(mismatched)
|
|
assert not missing["conformant"]
|
|
assert not mismatched["conformant"]
|
|
|
|
|
|
def test_rare_rate_form_is_rejected_but_not_inferred_from_event_name() -> None:
|
|
rate = {
|
|
"source_id": "example.audit.deny",
|
|
"event_class": "audit.deny",
|
|
"extensions": {
|
|
"netkingdom": {
|
|
"evidence_class": "load-bearing",
|
|
"rate_monitoring": "forbidden",
|
|
}
|
|
},
|
|
"form": "expected-rate",
|
|
"window": "24h",
|
|
"expected_min": 1,
|
|
"drop_below": "finding",
|
|
}
|
|
|
|
del rate["extensions"]["netkingdom"]["rate_monitoring"]
|
|
explicit_rare = report(declaration(rate), rare={"audit.deny"})
|
|
source_says_volume = report(declaration(rate), load={"audit.deny"})
|
|
|
|
assert "rare-form-invalid" in codes(explicit_rare)
|
|
assert "rare-rate-monitoring-not-forbidden" in codes(explicit_rare)
|
|
assert explicit_rare["conformant"] is False
|
|
assert source_says_volume["conformant"] is True
|
|
|
|
|
|
def test_rare_class_requires_heartbeat_and_reconciliation() -> None:
|
|
item = rare_entry()
|
|
del item["heartbeat"]
|
|
item["reconciliation"] = {"divergence": "ignored"}
|
|
|
|
result = report(declaration(item), rare={"audit.deny"})
|
|
|
|
assert {
|
|
"rare-heartbeat-missing",
|
|
"rare-reconciliation-missing",
|
|
"reconciliation-divergence-not-finding",
|
|
} <= codes(result)
|
|
|
|
|
|
def test_attributive_coverage_is_advisory_by_default() -> None:
|
|
result = report(declaration(), attributive={"audit.allow"})
|
|
|
|
assert result["conformant"] is True
|
|
assert result["summary"] == {"must": 0, "should": 1}
|
|
assert codes(result) == {"attributive-cadence-missing"}
|
|
|
|
|
|
def test_duplicate_event_classes_and_inventory_conflict_fail() -> None:
|
|
result = report(
|
|
declaration(rare_entry(), copy.deepcopy(rare_entry())),
|
|
rare={"audit.deny"},
|
|
attributive={"audit.deny"},
|
|
)
|
|
|
|
assert "duplicate-event-class" in codes(result)
|
|
assert "inventory-class-conflict" in codes(result)
|
|
assert result["conformant"] is False
|
|
|
|
|
|
def test_expected_rate_load_bearing_has_positive_threshold_and_finding() -> None:
|
|
rate = {
|
|
"source_id": "example.audit.decision",
|
|
"event_class": "audit.decision",
|
|
"extensions": {
|
|
"netkingdom": {
|
|
"evidence_class": "load-bearing",
|
|
"rate_monitoring": "forbidden",
|
|
}
|
|
},
|
|
"form": "expected-rate",
|
|
"window_seconds": 0,
|
|
"expected_min": 0,
|
|
"drop_below": "log",
|
|
}
|
|
|
|
result = report(declaration(rate), load={"audit.decision"})
|
|
|
|
assert {
|
|
"rate-window-invalid",
|
|
"expected-min-invalid",
|
|
"rate-drop-not-finding",
|
|
} <= codes(result)
|
|
|
|
|
|
# Integration uses the owner artifact directly; never vendor a generic schema.
|
|
UPSTREAM = pathlib.Path(__file__).resolve().parents[4] / "info-tech-canon"
|
|
SCHEMA_PATH = UPSTREAM / "infospace/schemas/emission-cadence.schema.yaml"
|
|
|
|
|
|
@pytest.fixture
|
|
def upstream_schema():
|
|
if not SCHEMA_PATH.is_file():
|
|
pytest.skip("InfoTechCanon checkout required for contract integration")
|
|
return yaml.safe_load(SCHEMA_PATH.read_text())
|
|
|
|
|
|
def canonical_document():
|
|
document = declaration(rare_entry())
|
|
document["declaration_id"] = "example.audit"
|
|
return document
|
|
|
|
|
|
def test_published_contract_and_namespaced_overlay(upstream_schema):
|
|
document = canonical_document()
|
|
assert report(document, rare={"audit.deny"}, schema=upstream_schema)["conformant"]
|
|
document["sources"][0]["evidence_class"] = "load-bearing"
|
|
assert not report(document, rare={"audit.deny"}, schema=upstream_schema)[
|
|
"contract_valid"
|
|
]
|
|
|
|
|
|
def test_published_contract_does_not_substitute_for_profile(upstream_schema):
|
|
document = canonical_document()
|
|
del document["sources"][0]["reconciliation"]
|
|
result = report(document, rare={"audit.deny"}, schema=upstream_schema)
|
|
assert result["contract_valid"]
|
|
assert "rare-reconciliation-missing" in codes(result)
|
|
assert not result["conformant"]
|
|
|
|
|
|
def test_duplicate_source_ids_fail_even_with_distinct_event_classes(upstream_schema):
|
|
document = canonical_document()
|
|
other = copy.deepcopy(document["sources"][0])
|
|
other["event_class"] = "audit.revocation"
|
|
document["sources"].append(other)
|
|
result = report(
|
|
document, rare={"audit.deny", "audit.revocation"}, schema=upstream_schema
|
|
)
|
|
assert result["contract_valid"]
|
|
assert "duplicate-source-id" in codes(result)
|
|
assert not result["conformant"]
|
|
|
|
|
|
def test_should_policy_and_cli(tmp_path, capsys):
|
|
schema = tmp_path / "schema.json"
|
|
document = tmp_path / "declaration.yaml"
|
|
import json
|
|
|
|
schema.write_text(json.dumps(CONTRACT_SCHEMA))
|
|
document.write_text(json.dumps(declaration()))
|
|
args = [
|
|
str(document),
|
|
"--contract-schema",
|
|
str(schema),
|
|
"--attributive",
|
|
"audit.allow",
|
|
]
|
|
assert profile.main(args) == 0
|
|
assert profile.main(args + ["--fail-on-should"]) == 1
|
|
schema.write_text('{"type": "invalid"}')
|
|
assert profile.main(args) == 1
|
|
assert "contract-schema-invalid" in capsys.readouterr().out
|
|
|
|
|
|
@pytest.mark.parametrize("window", ["PT0S", "P0D", "PT00H00M00S"])
|
|
def test_published_contract_zero_duration_is_not_a_positive_profile_window(
|
|
upstream_schema, window
|
|
):
|
|
document = canonical_document()
|
|
entry = document["sources"][0]
|
|
entry.pop("heartbeat")
|
|
entry.pop("reconciliation")
|
|
entry.update(
|
|
form="expected-rate", window=window, expected_min=1, drop_below="finding"
|
|
)
|
|
result = report(document, load={"audit.deny"}, schema=upstream_schema)
|
|
assert result["contract_valid"]
|
|
assert "rate-window-invalid" in codes(result)
|
|
assert not result["conformant"]
|