tegwick
9b705ec62c
T07 generates a CCR policy through the platform generator and refuses record-evidence unless the built policy matches the CCR file. T06 stays wait on the open founder decision after a fresh can-i of yes, yes, yes. Assistant: grok Assistant-Session: 01a16071-5425-78d3-80b4-20fe2ee30f0a
72 lines
2.4 KiB
Python
72 lines
2.4 KiB
Python
"""The CCR record-evidence gate matches a policy and refuses a different one."""
|
|
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
import yaml
|
|
|
|
from ops_mason.ccr_gate import EvidenceRefused, draft_from_plan, record_evidence
|
|
|
|
DECISION_ID = "00000000-0000-4000-8000-000000000001"
|
|
KV_PATH = "platform/workloads/fixture/reader"
|
|
|
|
|
|
def _draft(tmp_path: Path) -> dict:
|
|
return draft_from_plan(
|
|
kv_path=KV_PATH,
|
|
plan_ref={
|
|
"repo": "ops-mason",
|
|
"path": "plans/fixture.md",
|
|
"commit": "0123456789abcdef",
|
|
},
|
|
decision_id=DECISION_ID,
|
|
out_dir=tmp_path,
|
|
)
|
|
|
|
|
|
def _evidence(draft: Path) -> list:
|
|
document = yaml.safe_load(draft.read_text(encoding="utf-8"))
|
|
return (document.get("verification") or {}).get("evidence") or []
|
|
|
|
|
|
def test_record_evidence_accepts_a_trailing_newline_and_refuses_a_different_policy(tmp_path):
|
|
drafted = _draft(tmp_path)
|
|
policy_path = Path(drafted["policy_file"])
|
|
# The platform generator's text, plus one trailing newline, still matches.
|
|
policy_path.write_text(policy_path.read_text(encoding="utf-8") + "\n", encoding="utf-8")
|
|
|
|
completed = record_evidence(
|
|
drafted["draft"],
|
|
built_policy=drafted["built_policy"],
|
|
actor="ops-mason",
|
|
kind="metadata_apply",
|
|
result="passed",
|
|
detail=["built policy matched the CCR policy file"],
|
|
)
|
|
|
|
assert completed.returncode == 0
|
|
assert "record-evidence" in completed.args
|
|
assert "sync-decision" not in completed.args
|
|
recorded = _evidence(drafted["draft"])
|
|
assert len(recorded) == 1
|
|
assert recorded[0]["kind"] == "metadata_apply"
|
|
assert recorded[0]["result"] == "passed"
|
|
assert "matched the CCR policy file" in recorded[0]["details"][0]
|
|
|
|
policy_path.write_text(
|
|
policy_path.read_text(encoding="utf-8").replace('["read"]', '["create"]', 1),
|
|
encoding="utf-8",
|
|
)
|
|
with pytest.raises(EvidenceRefused, match="record-evidence refused"):
|
|
record_evidence(
|
|
drafted["draft"],
|
|
built_policy=drafted["built_policy"],
|
|
actor="ops-mason",
|
|
kind="metadata_apply",
|
|
result="passed",
|
|
detail=["built policy matched the CCR policy file"],
|
|
)
|
|
assert len(_evidence(drafted["draft"])) == 1
|
|
stored = drafted["draft"].read_text(encoding="utf-8")
|
|
assert "sync-decision" not in stored
|
|
assert DECISION_ID in stored
|