coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare reviewed Forgejo consumer ESO scope and truthful recovery records

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 04:09:26 +02:00
parent f52c94cd4e
commit a41312e5a4
8 changed files with 278 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

22
tests/test_case_structure.py
View file

@ -20,6 +20,16 @@ def prepared(tmp_path):
shutil.copytree(ROOT / "builds/case-forgejo-netkingdom-oidc", bundle)
plan = tmp_path / "plan.md"
shutil.copy2(ROOT / "plans/case-forgejo-netkingdom-oidc.md", plan)
# The committed historical bundle mislabels its consumer target keycape.
# Preserve it in the owner checkout; corrected fixture metadata must match
# the current generator rather than weakening the exact structural checker.
rel = "credential-change-requests/CCR-DRAFT-FORGEJO-NETKINGDOM-OIDC-FORGEJO.yaml"
ccr = yaml.safe_load((bundle / rel).read_text())
ccr["target"]["workload"] = "forgejo"
(bundle / rel).write_text(yaml.safe_dump(ccr, sort_keys=False, width=110))
manifest = json.loads((bundle / "manifest.json").read_text())
manifest["files"][rel] = hashlib.sha256((bundle / rel).read_bytes()).hexdigest()
(bundle / "manifest.json").write_text(json.dumps(manifest, indent=1, sort_keys=True)+"\n")
request = structure.prepare(CASE, plan, bundle, allow_unimplemented=True)
return request, plan, bundle
@ -42,7 +52,7 @@ def observations(request):
return tuple(result)
def test_actual_first_case_structure_matches_but_full_execution_guard_drift_remains(
def test_corrected_first_case_fixture_structure_and_full_execution_drift_remain(
prepared,
):
request, _, _ = prepared
@ -322,3 +332,13 @@ def test_constructed_request_closed_identity_and_change_flag(prepared, field, va
forged = replace(request, **{field: value})
with pytest.raises(structure.StructureRefused):
structure.verify(forged, observations(request), lambda *args: True)
def test_historical_bundle_wrong_consumer_target_is_not_grandfathered(tmp_path):
bundle = tmp_path / "historical-bundle"
shutil.copytree(ROOT / "builds/case-forgejo-netkingdom-oidc", bundle)
plan = tmp_path / "plan.md"
shutil.copy2(ROOT / "plans/case-forgejo-netkingdom-oidc.md", plan)
assert yaml.safe_load((bundle / "credential-change-requests/CCR-DRAFT-FORGEJO-NETKINGDOM-OIDC-FORGEJO.yaml").read_text())["target"]["workload"] == "keycape"
with pytest.raises(structure.StructureRefused, match="role or reader binding differs"):
structure.prepare(CASE, plan, bundle, allow_unimplemented=True)