coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare typed structural evidence without credential success circularity

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 02:42:57 +02:00
parent 247c829569
commit f52c94cd4e
7 changed files with 1094 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

4
tests/test_case_build.py
View file

@ -44,7 +44,7 @@ def test_builds_bundle_naming_case_type_and_acceptance(tmp_path, types_root):
case = _case(tmp_path)
out, log = tmp_path / "bundle", tmp_path / "audit.jsonl"
r = cb.build_from_case(case, _plan(tmp_path, case, types_root), out, types_root=types_root, audit_log=log)
assert r["case"] == "forgejo-netkingdom-oidc" and r["type"] == "oidc-browser-relying-party@1.0"
assert r["case"] == "forgejo-netkingdom-oidc" and r["type"] == yaml.safe_load(case.read_text())["spec"]["type"]
ccrs = {Path(p).name: yaml.safe_load(Path(p).read_text()) for p in r["ccrs"]}
eso = ccrs["CCR-DRAFT-FORGEJO-NETKINGDOM-OIDC-ESO.yaml"]
assert eso["status"] == "proposed" and eso["openbao"]["auth"]["role"] == "external-secrets-keycape-forgejo"
@ -57,7 +57,7 @@ def test_builds_bundle_naming_case_type_and_acceptance(tmp_path, types_root):
assert 'path "platform/data/workloads/keycape/forgejo"' in hcl and '["read"]' in hcl and "forgejo-netkingdom-oidc" in hcl
# token_self_lifecycle: true needs the self stanzas, or the platform applier refuses the file.
assert 'path "auth/token/lookup-self"' in hcl and 'path "auth/token/revoke-self"' in hcl
stanzas = [l for l in hcl.splitlines() if l.startswith("path ")]
stanzas = [line for line in hcl.splitlines() if line.startswith("path ")]
assert len(stanzas) == 3
rollback = yaml.safe_load((out / "rollback.yaml").read_text())
assert rollback["removes_exactly"][-1] == {"kind": "kv_path", "name": "platform/workloads/keycape/forgejo"}