tegwick
8bbd22285e
Close ops-warden's side of the last Partial INTENT criterion (ops-bridge integrates via a stable cert_command). The migration playbook and contract already existed; what was missing was an automated readiness gate before touching tunnel config. T1 — scripts/check_tunnel_cert_readiness.py: read-only preflight that asserts the cert_command path is ready without signing — config/backend, actor inventory + TTL within type max, pubkey exists/parses/not-private, principals present, and optional host-principal deployment (mirrors check_principals_drift). Exit 0/1/2. T2 — opt-in --sign-smoke: runs the cert_command against the local backend and validates identity/principals/TTL of the emitted cert; refuses a vault backend. Window measured from the cert's own valid_from->valid_before so it's timezone-robust (fixes a CEST off-by-2h artifact). integration-marked test + a vault-refusal unit test. T3 — playbook now leads with Step 0 readiness gate; ops-bridge handoff message sent. T4 — SCOPE INTENT row: Partial -> Pilot-ready; known-gaps + SSH-lane list updated. 9 unit + 1 integration test, 209 default passing, lint clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| test_access.py | ||
| test_ca.py | ||
| test_cli.py | ||
| test_config.py | ||
| test_doubles.py | ||
| test_flex_auth_registry.py | ||
| test_integration.py | ||
| test_inventory.py | ||
| test_models.py | ||
| test_policy.py | ||
| test_posture.py | ||
| test_posture_conformance.py | ||
| test_principals_drift.py | ||
| test_proxy.py | ||
| test_routing.py | ||
| test_scorecard.py | ||
| test_tunnel_cert_readiness.py | ||
| test_vault.py | ||