coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

WARDEN-WP-0033-T03: emit the high-risk data-path artifact

Browse source 
railiance-platform asked for a generated list to consume instead of hand-
maintaining agent-high-risk-boundary. Hand-maintaining it is what let the two
lists drift for four lanes in RISK-F-0009.

19 high-risk lanes, 14 concrete data paths, 5 without a single KV address listed
separately so absence does not read as omission. Carries catalog_revision and a
dirty flag. fields is null where unestablished, never a one-element guess.

The header states plainly that this is an input and not a policy: railiance-
platform owns the deny set and may deny more, less, or dispute a grade. ADR-0002
survives the handoff.

Two CI tests guard staleness, because a consumer applies this to a live control.
Note the immediate consequence of T02: 2 uncovered against a policy they closed
to 0 yesterday.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-21 08:38:13 +02:00
parent c357ce5908
commit 6e1d5201aa
4 changed files with 308 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

31
tests/test_agent_read_boundary_check.py
View file

@ -98,3 +98,34 @@ class TestAgainstTheRealCatalog:
continue
resolved = mod.to_data_path(template)
assert resolved is None or resolved.count("/data/") == 1, entry["id"]
class TestGeneratedArtifact:
"""The artifact railiance-platform consumes (WARDEN-WP-0033-T03).
A consumer applies this to a live deny set, so staleness is the failure that
matters -- a path graded high after the last emit would silently not reach them.
"""
def test_artifact_is_current(self):
import subprocess
result = subprocess.run(
["python3", str(REPO / "scripts" / "emit_high_risk_paths.py"), "--check"],
capture_output=True, text=True, timeout=60,
)
assert result.returncode == 0, (
f"{result.stdout}{result.stderr}\n"
"Re-run scripts/emit_high_risk_paths.py and commit the result."
)
def test_every_concrete_high_risk_lane_is_in_the_artifact(self):
import yaml
catalog = yaml.safe_load((REPO / "registry" / "routing" / "catalog.yaml").read_text())
artifact = yaml.safe_load(
(REPO / "registry" / "generated" / "high-risk-data-paths.yaml").read_text()
)
emitted = {row["id"] for row in artifact["paths"]} | set(artifact["no_concrete_path"] or [])
graded_high = {e["id"] for e in catalog["entries"] if e.get("risk") == "high"}
assert graded_high == emitted, "a high-risk lane is missing from the generated artifact"