tegwick
b7749277fd
Review against security-canon (Mode of Authority, SEC-DSM 1.0.0) showed the draft restated canon rules and invented a parallel taxonomy. Draft-3 imports principal_type and MODE @ SCOPE grants, treats break-glass as an activation, cites SEC-DSM per rule, states the estate identities in canon terms and adds SI-15 (accountable automation: prepare, admit, execute, verify, retain). Founder decisions and rule ids are kept. For agents: tools/security-tools.json and make security-tools list each security tool, the question it answers and whether an agent may run it; a test keeps the index complete. AGENTS.md and CLAUDE.md carry the same quickstart block. Validator migration to grants is T03b. Review record in history/. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 328925@bnt-lap001 Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
34 lines
1.3 KiB
Python
34 lines
1.3 KiB
Python
"""The security tools index stays complete and points at things that exist."""
|
|
import json
|
|
import pathlib
|
|
import re
|
|
|
|
ROOT = pathlib.Path(__file__).resolve().parents[1]
|
|
INDEX = json.loads((ROOT / "tools/security-tools.json").read_text())
|
|
MAKEFILE = (ROOT / "Makefile").read_text()
|
|
TARGETS = set(re.findall(r"^([a-z0-9-]+):", MAKEFILE, re.M))
|
|
|
|
|
|
def test_every_tool_directory_is_indexed_or_explicitly_excluded():
|
|
dirs = {p.name for p in (ROOT / "tools").iterdir() if p.is_dir() and not p.name.startswith(("_", "."))}
|
|
listed = {t["id"] for t in INDEX["tools"]} | set(INDEX["not_security_tools"])
|
|
assert dirs - listed == set(), f"add to tools/security-tools.json: {sorted(dirs - listed)}"
|
|
|
|
|
|
def test_paths_and_standards_exist():
|
|
for tool in INDEX["tools"]:
|
|
assert (ROOT / tool["path"]).is_dir(), tool["id"]
|
|
assert (ROOT / tool["standard"]).is_file(), (tool["id"], tool["standard"])
|
|
|
|
|
|
def test_make_targets_named_in_the_index_exist():
|
|
for tool in INDEX["tools"]:
|
|
for field in ("run", "test"):
|
|
command = tool[field]
|
|
if command.startswith("make "):
|
|
assert command.split()[1] in TARGETS, (tool["id"], command)
|
|
|
|
|
|
def test_agent_permission_is_always_stated():
|
|
allowed = set(INDEX["agent_may_run_values"])
|
|
assert all(tool["agent_may_run"] in allowed for tool in INDEX["tools"])
|