tegwick
0f183d509f
record_evidence keeps decision_resolved_at with the single hub decision, so a matching policy still reaches record-evidence after sync. The draft sets token_max_ttl, token_explicit_max_ttl, and token_no_default_policy from the standard-lane profile. Assistant: grok Assistant-Session: 01a16071-5425-78d3-80b4-20fe2ee30f0a
127 lines
4.5 KiB
Python
127 lines
4.5 KiB
Python
"""The CCR record-evidence gate matches a policy and refuses a different one."""
|
|
|
|
import importlib.util
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
import yaml
|
|
|
|
from ops_mason.ccr_gate import EvidenceRefused, draft_from_plan, record_evidence
|
|
|
|
DECISION_ID = "00000000-0000-4000-8000-000000000001"
|
|
KV_PATH = "platform/workloads/fixture/reader"
|
|
PLATFORM = Path.home() / "railiance-platform"
|
|
|
|
|
|
def _draft(tmp_path: Path) -> dict:
|
|
return draft_from_plan(
|
|
kv_path=KV_PATH,
|
|
plan_ref={
|
|
"repo": "ops-mason",
|
|
"path": "plans/fixture.md",
|
|
"commit": "0123456789abcdef",
|
|
},
|
|
decision_id=DECISION_ID,
|
|
out_dir=tmp_path,
|
|
)
|
|
|
|
|
|
def _evidence(draft: Path) -> list:
|
|
document = yaml.safe_load(draft.read_text(encoding="utf-8"))
|
|
return (document.get("verification") or {}).get("evidence") or []
|
|
|
|
|
|
def _platform_modules():
|
|
def load(name: str, path: Path):
|
|
spec = importlib.util.spec_from_file_location(name, path)
|
|
module = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(module)
|
|
return module
|
|
|
|
return (
|
|
load("credential_change_for_ccr_gate", PLATFORM / "scripts" / "credential-change.py"),
|
|
load("ccr_intake_for_ccr_gate", PLATFORM / "scripts" / "ccr_intake.py"),
|
|
)
|
|
|
|
|
|
def _record(drafted: dict) -> None:
|
|
record_evidence(
|
|
drafted["draft"],
|
|
built_policy=drafted["built_policy"],
|
|
actor="ops-mason",
|
|
kind="metadata_apply",
|
|
result="passed",
|
|
detail=["built policy matched the CCR policy file"],
|
|
)
|
|
|
|
|
|
def _differ(policy_path: Path) -> None:
|
|
policy_path.write_text(
|
|
policy_path.read_text(encoding="utf-8").replace('["read"]', '["create"]', 1),
|
|
encoding="utf-8",
|
|
)
|
|
|
|
|
|
def test_record_evidence_accepts_a_trailing_newline_and_refuses_a_different_policy(tmp_path):
|
|
drafted = _draft(tmp_path)
|
|
policy_path = Path(drafted["policy_file"])
|
|
# The platform generator's text, plus one trailing newline, still matches.
|
|
policy_path.write_text(policy_path.read_text(encoding="utf-8") + "\n", encoding="utf-8")
|
|
|
|
completed = record_evidence(
|
|
drafted["draft"],
|
|
built_policy=drafted["built_policy"],
|
|
actor="ops-mason",
|
|
kind="metadata_apply",
|
|
result="passed",
|
|
detail=["built policy matched the CCR policy file"],
|
|
)
|
|
|
|
assert completed.returncode == 0
|
|
assert "record-evidence" in completed.args
|
|
assert "sync-decision" not in completed.args
|
|
recorded = _evidence(drafted["draft"])
|
|
assert len(recorded) == 1
|
|
assert recorded[0]["kind"] == "metadata_apply"
|
|
assert recorded[0]["result"] == "passed"
|
|
assert "matched the CCR policy file" in recorded[0]["details"][0]
|
|
|
|
_differ(policy_path)
|
|
with pytest.raises(EvidenceRefused, match="record-evidence refused"):
|
|
_record(drafted)
|
|
assert len(_evidence(drafted["draft"])) == 1
|
|
stored = drafted["draft"].read_text(encoding="utf-8")
|
|
assert "sync-decision" not in stored
|
|
assert DECISION_ID in stored
|
|
|
|
|
|
def test_draft_carries_the_standard_lane_token_bounds(tmp_path):
|
|
drafted = _draft(tmp_path)
|
|
cc, intake = _platform_modules()
|
|
profile, _digest = intake.load_profile(PLATFORM / "registry" / "ccr-standard-profile.yaml")
|
|
document = cc.load_yaml(drafted["draft"])
|
|
auth = document["openbao"]["auth"]
|
|
max_ttl = profile["auth"]["max_ttl_seconds"]
|
|
for key in ("ttl", "token_max_ttl", "token_explicit_max_ttl"):
|
|
assert intake.ttl_seconds(auth[key]) == max_ttl
|
|
assert auth["token_no_default_policy"] is profile["auth"]["token_no_default_policy"]
|
|
assert intake.standard_violations(document, profile, drafted["draft"].parent, cc) == []
|
|
|
|
|
|
def test_synced_hub_decision_accepts_a_newline_and_refuses_a_different_policy(tmp_path):
|
|
drafted = _draft(tmp_path)
|
|
document = yaml.safe_load(drafted["draft"].read_text(encoding="utf-8"))
|
|
decision_id = document["state_hub"]["decision_id"]
|
|
document["state_hub"]["decision_api_url"] = f"http://127.0.0.1:8000/decisions/{decision_id}"
|
|
document["state_hub"]["decision_resolved_at"] = "2026-10-18T10:46:17.864665Z"
|
|
drafted["draft"].write_text(yaml.safe_dump(document, sort_keys=False), encoding="utf-8")
|
|
policy_path = Path(drafted["policy_file"])
|
|
policy_path.write_text(policy_path.read_text(encoding="utf-8") + "\n", encoding="utf-8")
|
|
|
|
_record(drafted)
|
|
assert len(_evidence(drafted["draft"])) == 1
|
|
|
|
_differ(policy_path)
|
|
with pytest.raises(EvidenceRefused, match="record-evidence refused"):
|
|
_record(drafted)
|
|
assert len(_evidence(drafted["draft"])) == 1
|