ops-warden/tests/test_workload_join.py

"""Explicit lane-to-workload join tests (WARDEN-WP-0032 / RMGR-WP-0010-T06)."""
from pathlib import Path
import hashlib
import json

import yaml

from scripts.report_workload_join import build


ROOT = Path(__file__).resolve().parents[1]


def test_repo_catalog_uses_only_explicit_workload_references():
    report = build(ROOT / "registry/routing/catalog.yaml",
                   ROOT / "tests/fixtures/workload-coverage")
    assert report["ok"] is True
    assert len(report["resolved"]) == 4
    assert len(report["unknown"]) == 22
    # 15 since 2026-09-21: the layer-declaration route is repository conformance
    # guidance, not a workload delivery lane, and the two NetKingdom SSO lanes
    # (c374d41) remain provider/control-plane credentials. Lanes added after
    # 2026-09-09 moved the denominator without moving `resolved`; these counts
    # and pep-stance.yaml's classification_coverage measure the same populations
    # and must be updated together. 16 since 2026-10-05: the
    # openbao-structure-survey pointer (WARDEN-WP-0042) is a builder survey
    # under a founder-minted grant, not a workload credential. 17 since
    # 2026-10-08: platform-supplier-credentials (WARDEN-WP-0043) is a generic
    # supplier-account path pattern; concrete consumers keep their own lanes.
    # unknown 22 since 2026-10-09: fluid-telegram-operator (MASON-WP-0005-T06)
    # names fluid-telegram, which has published no workload declaration.
    # not_applicable 18 since 2026-10-10: keycape-client-secret-generate is a
    # per-case generation lane; each case's consumer gets its own entry.
    # not_applicable 22 since 2026-10-17: the four CATALOG-1 draft lanes
    # (nk48 1.3 owner review) are per-case lanes like the one above.
    assert len(report["not_applicable"]) == 23
    assert {row["lane"] for row in report["resolved"]} == {
        "ops-warden-warden-sign-token",
        "issue-core-ingestion-api-key",
        "rapp-qonto-keycape-client",
        "core-hub-forgejo-source-read",  # CCR-2026-0031, 2026-10-03
    }


def test_invalid_exact_deployable_resolves_unknown(tmp_path):
    rapp = tmp_path / "rapp-x" / "declarations"
    rapp.mkdir(parents=True)
    (rapp / "rapp.yaml").write_text(yaml.safe_dump({
        "rapp_id": "rapp-x",
        "workload_identity": {"name": "x"},
        "composition": {"member_repos": [{"deployables": ["api"]}]},
    }))
    catalog_dir = tmp_path / "ops-warden" / "registry" / "routing"
    catalog_dir.mkdir(parents=True)
    catalog = catalog_dir / "catalog.yaml"
    catalog.write_text(yaml.safe_dump({"entries": [{
        "id": "x",
        "workload_ref": {
            "applicability": "applicable",
            "rapp_id": "rapp-x",
            "name": "x",
            "deployable": "missing",
        },
    }]}))
    posture = catalog_dir.parent / "policy"
    posture.mkdir()
    (posture / "security-posture.yaml").write_text("dataclass_floor: {}\n")

    report = build(catalog, tmp_path)
    assert not report["resolved"]
    assert report["unknown"][0]["lane"] == "x"
    assert "deployable" in report["unknown"][0]["reason"]


def test_public_workload_projection_matches_provenance():
    base = ROOT / 'tests/fixtures/workload-coverage'
    provenance = json.loads((base / 'provenance.json').read_text())
    expected = {'rapp-core-hub', 'rapp-issue-core', 'rapp-qonto'}
    assert len(provenance) == len(expected)
    assert {row['repo'] for row in provenance} == expected
    for row in provenance:
        projection = base / row['repo'] / 'declarations/rapp.yaml'
        assert hashlib.sha256(projection.read_bytes()).hexdigest() == row['projection_sha256']