MASON-WP-0013: record the survey, CCR, and founder decision
The ops-mason-survey grant confirmed the existing private-reader lane and the MAS delivery metadata. CCR-2026-0046 and founder decision 9833715e are recorded apart from the disclosure consent. The plan stays reviewed, and the draft catalog route is not activated. Assistant: grok Assistant-Session: 01a16071-5425-78d3-80b4-20fe2ee30f0a
This commit is contained in:
parent
ca5e98d4e4
commit
dee677f226
7 changed files with 378 additions and 165 deletions
|
|
@ -1,6 +1,7 @@
|
|||
"""MASON-WP-0013 and MASON-WP-0014 evidence stays name-only and fail-closed."""
|
||||
|
||||
import importlib.util
|
||||
import json
|
||||
import re
|
||||
import sys
|
||||
from pathlib import Path
|
||||
|
|
@ -97,45 +98,119 @@ def test_mas_teardown_intake_is_residual_and_value_free():
|
|||
assert banned not in lowered
|
||||
|
||||
|
||||
def test_mas_delivery_check_stays_wait_until_metadata_grant():
|
||||
def test_mas_delivery_check_records_metadata_and_sync():
|
||||
workplan = (ROOT / "workplans" / "MASON-WP-0014-mas-tem-relay-smtp.md").read_text()
|
||||
plan = (ROOT / "plans" / "mas-tem-relay-smtp.md").read_text()
|
||||
assert _frontmatter(workplan)["status"] == "proposed"
|
||||
assert _task_status(workplan, "MASON-WP-0014-T04") == "wait"
|
||||
assert "needs_human: true" in workplan
|
||||
assert "0b55e53b-2531-466c-a2f9-282618b183f8" in workplan
|
||||
assert _task_status(workplan, "MASON-WP-0014-T01") == "done"
|
||||
assert _frontmatter(workplan)["status"] == "finished"
|
||||
assert _task_status(workplan, "MASON-WP-0014-T04") == "done"
|
||||
for text in (workplan, plan):
|
||||
flat = _flat(text)
|
||||
assert "no ops-mason-survey grant" in flat
|
||||
assert "token-claude-MASON-WP-0014-T04" in flat
|
||||
assert "ops-mason-survey" in flat
|
||||
assert "current_version=2" in flat
|
||||
assert "SecretSynced" in flat
|
||||
assert "binding name `mas-relay`" in flat
|
||||
assert "MASON-IN-0007" in flat
|
||||
assert "current_version" not in workplan.split("2026-10-21 check", 1)[1]
|
||||
assert "hvs." not in flat
|
||||
|
||||
|
||||
def test_private_reader_stays_draft_without_survey_or_success():
|
||||
def test_private_reader_survey_records_lane_without_approving_apply():
|
||||
workplan = (
|
||||
ROOT / "workplans" / "MASON-WP-0013-reuse-surface-private-source-reader.md"
|
||||
).read_text()
|
||||
plan = (ROOT / "plans" / "reuse-surface-private-source-reader.md").read_text()
|
||||
assert _frontmatter(workplan)["status"] == "proposed"
|
||||
assert _frontmatter(plan)["status"] == "draft"
|
||||
proposal = (
|
||||
ROOT / "builds" / "reuse-surface-private-source-reader" / "catalog-proposal.yaml"
|
||||
).read_text()
|
||||
assert _frontmatter(workplan)["status"] == "finished"
|
||||
assert _frontmatter(plan)["status"] == "reviewed"
|
||||
assert _frontmatter(plan)["approved_by"] is None
|
||||
for task_id in (
|
||||
"MASON-WP-0013-T02",
|
||||
"MASON-WP-0013-T03",
|
||||
"MASON-WP-0013-T04",
|
||||
):
|
||||
assert _task_status(workplan, task_id) == "wait"
|
||||
assert "needs_human: true" in workplan
|
||||
assert "0b55e53b-2531-466c-a2f9-282618b183f8" in workplan
|
||||
assert "does not approve this plan" in _flat(workplan)
|
||||
assert _task_status(workplan, task_id) == "done"
|
||||
flat_plan = _flat(plan)
|
||||
flat_workplan = _flat(workplan)
|
||||
assert "no ops-mason-survey grant" in flat_plan
|
||||
assert "token-claude-MASON-WP-0014-T04" in flat_plan
|
||||
assert "current_version=1" in flat_plan
|
||||
assert "reuse-surface-runtime-eso" in flat_plan
|
||||
assert "workload-kv-read-reuse-surface-runtime-eso" in flat_plan
|
||||
assert "Q1:" in flat_plan and "Q2:" in flat_plan and "Q3:" in flat_plan
|
||||
assert "9833715e-a22a-45c0-ab6c-881f0f4f1a0e" in flat_workplan
|
||||
assert "CCR-2026-0046" in flat_workplan
|
||||
assert "4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52" in flat_workplan
|
||||
assert "RPF-WP-0058-T05" in flat_workplan
|
||||
assert "not an ops-mason success publication" in flat_workplan
|
||||
assert "reviewed_present" in flat_workplan
|
||||
assert "status: draft" in proposal
|
||||
assert "not-activated" in proposal
|
||||
assert "warden_executes: false" in proposal
|
||||
|
||||
|
||||
def test_reader_survey_entry_point_is_metadata_only(tmp_path, capsys):
|
||||
catalog = tmp_path / "catalog.yaml"
|
||||
catalog.write_text("version: 1\nentries: []\n")
|
||||
token = "hvs.SYNTHETICgrantTOKENvalue0123456789"
|
||||
calls = []
|
||||
eso = "workload-kv-read-reuse-surface-runtime-eso"
|
||||
writer = "workload-kv-read-reuse-surface-runtime"
|
||||
|
||||
def runner(argv, env):
|
||||
calls.append(argv)
|
||||
assert env["BAO_TOKEN"] == token
|
||||
pos = [a for a in argv[1:] if not a.startswith("-")]
|
||||
assert not (pos[:1] == ["kv"] and "get" in pos and "metadata" not in pos)
|
||||
assert pos[:2] != ["kv", "get"]
|
||||
assert not any("/data/" in a for a in pos)
|
||||
key = tuple(pos)
|
||||
if key == ("token", "lookup"):
|
||||
body = {"data": {"policies": ["default", "ops-mason-survey"],
|
||||
"display_name": "token-claude-MASON-WP-0014-T04", "ttl": 1000,
|
||||
"id": token}}
|
||||
elif key == ("secrets", "list"):
|
||||
body = {"platform/": {"type": "kv", "options": {"version": "2"}}}
|
||||
elif key == ("auth", "list"):
|
||||
body = {"kubernetes/": {"type": "kubernetes"}}
|
||||
elif key == ("policy", "list"):
|
||||
body = [eso, writer]
|
||||
elif key == ("list", "auth/kubernetes/role"):
|
||||
body = ["reuse-surface-runtime-eso"]
|
||||
elif key == ("read", "auth/kubernetes/role/reuse-surface-runtime-eso"):
|
||||
body = {"data": {"token_policies": [eso],
|
||||
"bound_service_account_names": ["reuse-surface-eso"],
|
||||
"bound_service_account_namespaces": ["reuse"],
|
||||
"audience": "openbao"}}
|
||||
elif key == ("policy", "read", eso):
|
||||
return 0, (
|
||||
'path "platform/data/workloads/reuse/reuse-surface/forgejo-source-read" '
|
||||
'{ capabilities = ["read"] }\n'
|
||||
), ""
|
||||
elif key == ("policy", "read", writer):
|
||||
return 0, 'path "platform/data/workloads/reuse/reuse-surface/runtime-secrets" { capabilities = ["read"] }\n', ""
|
||||
elif key == ("kv", "metadata", "get",
|
||||
"platform/workloads/reuse/reuse-surface/forgejo-source-read"):
|
||||
body = {"data": {"current_version": 1, "created_time": "2026-10-15T00:00:00Z",
|
||||
"updated_time": "2026-10-15T00:00:00Z", "custom_metadata": {}}}
|
||||
elif key == ("kv", "list", "platform/workloads/reuse/reuse-surface"):
|
||||
body = ["forgejo-source-read"]
|
||||
else:
|
||||
return 2, "", "No value found"
|
||||
return 0, json.dumps(body), ""
|
||||
|
||||
rc = survey.main(
|
||||
[*READER_ARGS, "--catalog", str(catalog)],
|
||||
runner=runner,
|
||||
environ={"BAO_TOKEN": token, "BAO_ADDR": "http://127.0.0.1:18200"},
|
||||
)
|
||||
out = capsys.readouterr().out
|
||||
assert rc == 0
|
||||
assert "token-claude-MASON-WP-0014-T04" in out
|
||||
assert "platform/workloads/reuse/reuse-surface/forgejo-source-read" in out
|
||||
assert "current_version=1" in out
|
||||
assert "no stanza covers" in out
|
||||
assert token not in out
|
||||
assert any(
|
||||
[a for a in argv[1:] if not a.startswith("-")][:3] == ["kv", "metadata", "get"]
|
||||
for argv in calls
|
||||
)
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue