coulomb/ops-warden
5
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

CUST-WP-0075: catalog entry core-hub-forgejo-source-read (CCR-2026-0031)

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3
This commit is contained in:
tegwick 2026-10-03 12:55:08 +02:00
parent 88c22d43c9
commit 2f8387cc2f
5 changed files with 121 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

26
tests/test_routing.py
View file

@ -197,6 +197,32 @@ def test_route_find_policy_nexus_source_read_prefers_concrete_lane():
assert matches[0].id == "policy-nexus-forgejo-source-read"
def test_core_hub_source_read_lane_is_eso_only_and_not_resolvable():
"""CCR-2026-0031: ESO is the only consumer, so no operator fetch lane."""
catalog = load_catalog(_repo_catalog())
entry = catalog.get("core-hub-forgejo-source-read")
assert entry is not None and entry.is_active
assert entry.exec_capable is False
assert entry.resolvable is False
assert entry.fetch_command is None
assert entry.lane == "secret"
assert entry.risk == "high"
assert entry.owner_repo == "railiance-platform"
assert entry.path_template == "platform/workloads/core-hub/forgejo-source-read"
assert "role=external-secrets-core-hub-forgejo-source" in entry.auth_method
assert entry.delegation is not None and entry.delegation.mode == "native"
assert entry.canon_ref.endswith("CCR-2026-0031-core-hub-forgejo-source-read.yaml")
def test_route_find_core_hub_source_read_prefers_core_hub_lane():
catalog = load_catalog(_repo_catalog())
matches = catalog.find(
"core hub repo-manager publisher Forgejo private source repository read token",
limit=1,
)
assert matches[0].id == "core-hub-forgejo-source-read"
def test_generic_and_template_lanes_not_resolvable():
catalog = load_catalog(_repo_catalog())
# generic openbao lane has <FIELD>/<path_template>; login lane has <domain>.

3
tests/test_workload_join.py
View file

@ -12,7 +12,7 @@ ROOT = Path(__file__).resolve().parents[1]
def test_repo_catalog_uses_only_explicit_workload_references():
report = build(ROOT / "registry/routing/catalog.yaml", Path.home())
assert report["ok"] is True
assert len(report["resolved"]) == 3
assert len(report["resolved"]) == 4
assert len(report["unknown"]) == 20
# 15 since 2026-09-21: the layer-declaration route is repository conformance
# guidance, not a workload delivery lane, and the two NetKingdom SSO lanes
@ -25,6 +25,7 @@ def test_repo_catalog_uses_only_explicit_workload_references():
"ops-warden-warden-sign-token",
"issue-core-ingestion-api-key",
"rapp-qonto-keycape-client",
"core-hub-forgejo-source-read", # CCR-2026-0031, 2026-10-03
}