tegwick
e62763cba9
Per-actor issuance profile in the inventory contract: optional `extensions` allow-list (LocalCA -O clear + -O <ext>; Vault explicit extensions map) and `max_ttl_hours` ceiling enforced against --ttl overrides. Actors without these fields keep backend defaults. agt-custodian: principal agt-custodian, 12h TTL/ceiling, permit-pty only (no agent/port/X11 forwarding, no user-rc), no source-address (unstable workstation egress). Ceremony routing lane agt-custodian-ssh-cert: supervisor issues from the operator account; the agent cannot self-issue. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 605711@bnt-lap001 Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61
83 lines
3.6 KiB
Python
83 lines
3.6 KiB
Python
"""Explicit lane-to-workload join tests (WARDEN-WP-0032 / RMGR-WP-0010-T06)."""
|
|
from pathlib import Path
|
|
import hashlib
|
|
import json
|
|
|
|
import yaml
|
|
|
|
from scripts.report_workload_join import build
|
|
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
|
|
|
|
def test_repo_catalog_uses_only_explicit_workload_references():
|
|
report = build(ROOT / "registry/routing/catalog.yaml",
|
|
ROOT / "tests/fixtures/workload-coverage")
|
|
assert report["ok"] is True
|
|
assert len(report["resolved"]) == 4
|
|
assert len(report["unknown"]) == 22
|
|
# 15 since 2026-09-21: the layer-declaration route is repository conformance
|
|
# guidance, not a workload delivery lane, and the two NetKingdom SSO lanes
|
|
# (c374d41) remain provider/control-plane credentials. Lanes added after
|
|
# 2026-09-09 moved the denominator without moving `resolved`; these counts
|
|
# and pep-stance.yaml's classification_coverage measure the same populations
|
|
# and must be updated together. 16 since 2026-10-05: the
|
|
# openbao-structure-survey pointer (WARDEN-WP-0042) is a builder survey
|
|
# under a founder-minted grant, not a workload credential. 17 since
|
|
# 2026-10-08: platform-supplier-credentials (WARDEN-WP-0043) is a generic
|
|
# supplier-account path pattern; concrete consumers keep their own lanes.
|
|
# unknown 22 since 2026-10-09: fluid-telegram-operator (MASON-WP-0005-T06)
|
|
# names fluid-telegram, which has published no workload declaration.
|
|
# not_applicable 18 since 2026-10-10: keycape-client-secret-generate is a
|
|
# per-case generation lane; each case's consumer gets its own entry.
|
|
# not_applicable 22 since 2026-10-17: the four CATALOG-1 draft lanes
|
|
# (nk48 1.3 owner review) are per-case lanes like the one above.
|
|
assert len(report["not_applicable"]) == 23
|
|
assert {row["lane"] for row in report["resolved"]} == {
|
|
"ops-warden-warden-sign-token",
|
|
"issue-core-ingestion-api-key",
|
|
"rapp-qonto-keycape-client",
|
|
"core-hub-forgejo-source-read", # CCR-2026-0031, 2026-10-03
|
|
}
|
|
|
|
|
|
def test_invalid_exact_deployable_resolves_unknown(tmp_path):
|
|
rapp = tmp_path / "rapp-x" / "declarations"
|
|
rapp.mkdir(parents=True)
|
|
(rapp / "rapp.yaml").write_text(yaml.safe_dump({
|
|
"rapp_id": "rapp-x",
|
|
"workload_identity": {"name": "x"},
|
|
"composition": {"member_repos": [{"deployables": ["api"]}]},
|
|
}))
|
|
catalog_dir = tmp_path / "ops-warden" / "registry" / "routing"
|
|
catalog_dir.mkdir(parents=True)
|
|
catalog = catalog_dir / "catalog.yaml"
|
|
catalog.write_text(yaml.safe_dump({"entries": [{
|
|
"id": "x",
|
|
"workload_ref": {
|
|
"applicability": "applicable",
|
|
"rapp_id": "rapp-x",
|
|
"name": "x",
|
|
"deployable": "missing",
|
|
},
|
|
}]}))
|
|
posture = catalog_dir.parent / "policy"
|
|
posture.mkdir()
|
|
(posture / "security-posture.yaml").write_text("dataclass_floor: {}\n")
|
|
|
|
report = build(catalog, tmp_path)
|
|
assert not report["resolved"]
|
|
assert report["unknown"][0]["lane"] == "x"
|
|
assert "deployable" in report["unknown"][0]["reason"]
|
|
|
|
|
|
def test_public_workload_projection_matches_provenance():
|
|
base = ROOT / 'tests/fixtures/workload-coverage'
|
|
provenance = json.loads((base / 'provenance.json').read_text())
|
|
expected = {'rapp-core-hub', 'rapp-issue-core', 'rapp-qonto'}
|
|
assert len(provenance) == len(expected)
|
|
assert {row['repo'] for row in provenance} == expected
|
|
for row in provenance:
|
|
projection = base / row['repo'] / 'declarations/rapp.yaml'
|
|
assert hashlib.sha256(projection.read_bytes()).hexdigest() == row['projection_sha256']
|