coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

feat: complete local layer model v0.7 conformance work
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06eaf-3425-7f92-a0c2-bb4aa4faebe4
This commit is contained in:
tegwick 2026-09-05 01:19:48 +02:00
parent 89b117f640
commit 00145d705e
13 changed files with 279 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

21
tests/test_proxy.py
View file

@ -590,6 +590,27 @@ def test_access_agent_high_risk_raw_stream_refused(tmp_path, monkeypatch):
assert "agent read-boundary" in r.output.lower() or "risk=high" in r.output.lower()
def test_access_issued_agent_subject_refuses_raw_stream_without_legacy_marker(
tmp_path, monkeypatch
):
"""WP-0034 T02: the issued KeyCape subject is sufficient for exit 7."""
_proxy_env(monkeypatch, tmp_path)
monkeypatch.setenv("VAULT_TOKEN", "caller-token")
monkeypatch.delenv("WARDEN_AGENT_ID", raising=False)
monkeypatch.setenv(
"WARDEN_POLICY_SUBJECT", "service:codex:railiance-platform"
)
r = runner.invoke(
app,
[
"access", "railiance-backup-offsite-lane",
"--fetch", "--unsafe-stdout",
],
)
assert r.exit_code == 7, r.output
assert "service:codex:railiance-platform" in r.output
def test_access_agent_high_risk_fingerprint_allowed(tmp_path, monkeypatch):
"""Agents may use --fingerprint on high-risk lanes (no raw value)."""
_proxy_env(monkeypatch, tmp_path)