tegwick
c43afd46a7
- bounded-executor/prepare_admission.py: the live admission from the pilot example, pins read from the image's commit, window <= 2 h (audit-core's declared bound), validated. - executor-lanes.py window-open/window-close: CCR-2026-0058's window-scoped write role, created for one admitted open window under attended platform-admin and deleted afterwards (idempotent). - security-cases/nk-bind-executor-approval.yaml: the case of record, proposed (founder acceptance). - docs/evidence/2026-11-04-nk56-t15-audit-sender: 8 checks against audit-core 876c3f6. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 523928@bnt-lap001 Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350
55 lines
2.5 KiB
Python
55 lines
2.5 KiB
Python
"""Live pilot admission preparation (NK-WP-0056-T06)."""
|
|
from __future__ import annotations
|
|
|
|
import datetime as dt
|
|
import hashlib
|
|
import importlib.util
|
|
import json
|
|
import pathlib
|
|
import subprocess
|
|
import sys
|
|
import tempfile
|
|
import unittest
|
|
|
|
HERE = pathlib.Path(__file__).resolve().parent
|
|
spec = importlib.util.spec_from_file_location("prepare_admission", HERE.parent / "prepare_admission.py")
|
|
P = importlib.util.module_from_spec(spec)
|
|
sys.modules["prepare_admission"] = P
|
|
spec.loader.exec_module(P)
|
|
START = dt.datetime(2026, 11, 5, 9, 0, tzinfo=dt.UTC)
|
|
|
|
|
|
@unittest.skipUnless((P.REPO / ".git").exists(), "needs a git checkout (CI tests a source tarball)")
|
|
class Prepare(unittest.TestCase):
|
|
def setUp(self):
|
|
self.commit = subprocess.run(["git", "-C", str(P.REPO), "rev-parse", "HEAD"], capture_output=True,
|
|
text=True, check=True).stdout.strip()
|
|
|
|
def test_pins_the_commits_content_and_is_valid(self):
|
|
doc = P.prepare("BEA-2026-0099", self.commit, START, 2)
|
|
spec = doc["spec"]
|
|
self.assertEqual(spec["window"], {"not_before": "2026-11-05T09:00:00Z", "not_after": "2026-11-05T11:00:00Z"})
|
|
self.assertEqual(spec["plan"]["source"]["commit"], self.commit[:12])
|
|
for f in spec["plan"]["source"]["files"]:
|
|
blob = subprocess.run(["git", "-C", str(P.REPO), "show", f"{self.commit}:{f['path']}"],
|
|
capture_output=True, check=True).stdout
|
|
self.assertEqual(f["sha256"], hashlib.sha256(blob).hexdigest())
|
|
report = P.bea.evaluate(doc, json.loads(P.bea.SCHEMA.read_text()), as_of=START)
|
|
self.assertTrue(report["valid"], report["findings"])
|
|
|
|
def test_refusals(self):
|
|
with tempfile.TemporaryDirectory() as tmp:
|
|
out = pathlib.Path(tmp) / "a.yaml"
|
|
out.write_text("exists")
|
|
with self.assertRaises(SystemExit):
|
|
P.main(["--id", "BEA-2026-0099", "--commit", self.commit, "--not-before", "2026-11-05T09:00:00Z",
|
|
"--out", str(out)])
|
|
with self.assertRaises(SystemExit):
|
|
P.main(["--id", "BEA-2026-0099", "--commit", self.commit, "--not-before", "2026-11-05T09:00:00Z",
|
|
"--hours", "3", "--out", str(pathlib.Path(tmp) / "b.yaml")])
|
|
self.assertEqual(P.main(["--id", "BEA-2026-0099", "--commit", "0" * 40, "--not-before",
|
|
"2026-11-05T09:00:00Z", "--out", str(pathlib.Path(tmp) / "c.yaml")]), 4)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|