coulomb/ops-warden
5
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

Routing: named client rotation outranks keycape-client-secret-generate

Browse source 
Activation made the generic generate lane win the reported rapp-qonto rotation
need (test_plan regression). Narrow its keywords and title to case-specific
terms, give rapp-qonto-keycape-client its secret/rotation keywords, and add a
two-way routing regression test.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 427672@bnt-lap001
Assistant-Session: a0a2367e-4697-440c-a4e5-9713c009f6d8
This commit is contained in:
tegwick 2026-10-10 13:23:13 +02:00
parent 1f3ecf5d49
commit e70dfa6d02
2 changed files with 16 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

10
tests/test_routing.py
View file

@ -149,6 +149,16 @@ def test_keycape_client_secret_generate_is_owner_native_and_never_proxied():
assert e.risk == "high" and e.rotation is not None
def test_named_client_rotation_outranks_generic_generate_lane():
"""Activating keycape-client-secret-generate must not capture a named client's
rotation need; it is first-generation only and refuses an existing path."""
catalog = load_catalog(_repo_catalog())
assert catalog.find("rotate rapp-qonto client secret")[0].id == "rapp-qonto-keycape-client"
assert catalog.find("mint-secret for a security case, generated in custody")[0].id == (
"keycape-client-secret-generate"
)
def test_route_find_vault_token_ops_warden_prefers_broker_lane():
catalog = load_catalog(_repo_catalog())
matches = catalog.find("VAULT_TOKEN ops-warden warden sign", limit=3)