tegwick
d7f4ebcfe0
c374d41added net-kingdom-lldap-bind-credential and net-kingdom-privacyidea-admin-token as `risk: high` and did not re-run the emitter, so registry/generated/high-risk-data-paths.yaml still described the catalog at0fae090. railiance-platform consumes that file instead of hand-maintaining its deny list, and it has been reading a census two lanes short since 2026-08-23. This is precisely the drift WARDEN-WP-0033-T03 built the guard for — a lane graded high after the last emit silently failing to reach the consumer. The guard fired; nothing had acted on it. The deny list itself does not move: both lanes are blocked on their OpenBao path being published, so they land in `no_concrete_path` and concrete_path_count stays 14. What changes is the count the consumer sees — 23 high-risk lanes, two of which have no address yet. That is the honest signal and the reason the bucket is listed rather than omitted. check_agent_read_boundary.py still reports 0 uncovered. The workload-join census moves 9 -> 11 not-applicable: both lanes are provider/control-plane credentials rather than workload delivery lanes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YWBMovyFoy9RRrfL7zKvPJ Assistant: claude-code Assistant-Model: opus Assistant-Process: 4014535@bnt-lap001 Assistant-Session: d0036016-73e8-4da1-8e47-563e3ab39a3c
54 lines
1.9 KiB
Python
54 lines
1.9 KiB
Python
"""Explicit lane-to-workload join tests (WARDEN-WP-0032 / RMGR-WP-0010-T06)."""
|
|
from pathlib import Path
|
|
|
|
import yaml
|
|
|
|
from scripts.report_workload_join import build
|
|
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
|
|
|
|
def test_repo_catalog_uses_only_explicit_workload_references():
|
|
report = build(ROOT / "registry/routing/catalog.yaml", Path.home())
|
|
assert report["ok"] is True
|
|
assert len(report["resolved"]) == 3
|
|
assert len(report["unknown"]) == 17
|
|
# 11 since WARDEN-WP-0033: the two NetKingdom SSO lanes (c374d41) are
|
|
# provider/control-plane credentials, not workload delivery lanes.
|
|
assert len(report["not_applicable"]) == 11
|
|
assert {row["lane"] for row in report["resolved"]} == {
|
|
"ops-warden-warden-sign-token",
|
|
"issue-core-ingestion-api-key",
|
|
"rapp-qonto-keycape-client",
|
|
}
|
|
|
|
|
|
def test_invalid_exact_deployable_resolves_unknown(tmp_path):
|
|
rapp = tmp_path / "rapp-x" / "declarations"
|
|
rapp.mkdir(parents=True)
|
|
(rapp / "rapp.yaml").write_text(yaml.safe_dump({
|
|
"rapp_id": "rapp-x",
|
|
"workload_identity": {"name": "x"},
|
|
"composition": {"member_repos": [{"deployables": ["api"]}]},
|
|
}))
|
|
catalog_dir = tmp_path / "ops-warden" / "registry" / "routing"
|
|
catalog_dir.mkdir(parents=True)
|
|
catalog = catalog_dir / "catalog.yaml"
|
|
catalog.write_text(yaml.safe_dump({"entries": [{
|
|
"id": "x",
|
|
"workload_ref": {
|
|
"applicability": "applicable",
|
|
"rapp_id": "rapp-x",
|
|
"name": "x",
|
|
"deployable": "missing",
|
|
},
|
|
}]}))
|
|
posture = catalog_dir.parent / "policy"
|
|
posture.mkdir()
|
|
(posture / "security-posture.yaml").write_text("dataclass_floor: {}\n")
|
|
|
|
report = build(catalog, tmp_path)
|
|
assert not report["resolved"]
|
|
assert report["unknown"][0]["lane"] == "x"
|
|
assert "deployable" in report["unknown"][0]["reason"]
|