48 lines
5.5 KiB
Markdown
48 lines
5.5 KiB
Markdown
|
# Acceptance coverage — 2026-09-28
|
||
|
|
|
||
|
|
This maps the current repository tests to the obligations in
|
||
|
|
[acceptance v0.1](../specs/acceptance-v0.1.md). A listed test is evidence for its
|
||
|
|
specific assertion, not completion of the whole criterion. The local suite uses
|
||
|
|
disposable keys, fake clocks and loopback HTTP; it does not prove independent UTC
|
||
|
|
accuracy, production admission or native consumer correctness.
|
||
|
|
|
||
|
|
Test names below are in `tests/test_clock.py`, `tests/test_authority.py`, and
|
||
|
|
`tests/test_health.py` unless otherwise noted. Parameterized cases count as tests,
|
||
|
|
not additional acceptance criteria. The release smoke script is separate from
|
||
|
|
pytest and runs against an installed wheel.
|
||
|
|
|
||
|
|
| ID | Existing local evidence | Uncovered or native obligation; existing owner record |
|
||
|
|
| --- | --- | --- |
|
||
|
|
| C01 | `test_interval_contains_send_with_asymmetric_delay` changes `time.time` and exercises the injected timer | No complete ±5-minute/zone/wall-step platform matrix; native Windows is unsupported by LinuxTimer. Supported Linux/WSL evidence: 0002-T03, 0004-T02 |
|
||
|
|
| C02 | `test_interval_contains_send_with_asymmetric_delay`; `test_lifecycle_during_exchange_refuses[delay]` | One deterministic asymmetric-delay case, not property-based interval coverage or measured network guarantees: 0002-T03, 0004-T02 |
|
||
|
|
| C03 | `test_signed_wrong_binding_refuses`, `test_bad_signature`, `test_rotation_requires_fresh_client_and_matching_signer`; wheel smoke refuses wrong key | No exhaustive version/header/modified-uncertainty matrix; accepted signing/trust profile: 0002-T02 |
|
||
|
|
| C04 | `test_replay_refused`, delayed-exchange refusal, `test_restart_preserves_floor`, `test_new_client_cannot_reset_expired_trust` | Exact replay across process restart and every nonce-timeout interleaving are not separately tested; native lifecycle evidence: 0004-T02 |
|
||
|
|
| C05 | `test_authority_refuses_unusable_health`, `test_restart_changes_epoch`, `test_step_at_final_timestamp_latches_refusal`, `test_health_expires_during_sample_preparation`, `test_health_model_refusals`, collector replacement test | Disposable host upstream outage/reboot/recovery and accepted error model: 0005-T02/T05, RAIL-HO-WP-0013 |
|
||
|
|
| C06 | `test_lifecycle_during_exchange_refuses[suspend/domain/backward]`; boot-bound admission behavior | Fake timer disruption does not establish real VM suspend/reboot detection or oscillator bounds: 0002-T03, 0004-T02 |
|
||
|
|
| C07 | `test_validity_uses_entire_interval` checks entirely valid, not-before overlap and exact expiry | Native signed-artifact semantics and protected-side-effect recheck remain consumer-owned: 0002-T04, 0004-T03 |
|
||
|
|
| C08 | Expired-session, delayed-sample and lifecycle refusals; health expiry during preparation | No general offline holdover offered; native loss/age/uncertainty policy evidence: 0004-T02 |
|
||
|
|
| C09 | Wrong signer and changed/revoked trust refusal; wheel smoke requires explicit disposable loopback admission | No real invalid-date TLS bootstrap or redirect-server integration test in this suite. Transport trust acceptance: 0002-T02, 0005-T03 |
|
||
|
|
| C10 | No approval/CAS concurrency fixture in this repository | Clock interval checks do not establish atomic consume or check-to-use safety. Consumer native proof: 0002-T04, 0004-T03 |
|
||
|
|
| C11 | `attribution.py` emits recording-time evidence; no direct attribution test | No historical occurrence translation or calibration-domain proof is implemented here. Audit/consumer contract and native evidence: 0002-T04, 0004-T03 |
|
||
|
|
| C12 | No occurrence-ordering test; application clock returns intervals | Overlap/order handling belongs to the consuming event system; audit acceptance: 0002-T04, 0004-T03 |
|
||
|
|
| C13 | `test_strict_json`, `test_http_framing_refused`, `test_malformed_health_is_stable_http_refusal`, `test_bad_policy_refuses`, `test_helper_failures_are_sanitized` | Coverage is not exhaustive numeric/schema fuzzing. Profile acceptance remains 0002-T02/T03 |
|
||
|
|
| C14 | `test_rotation_requires_fresh_client_and_matching_signer`, changed-trust refusal, expired admission and persisted rollback tests | Local file replacement is not distributed revocation; custody visibility deadlines and compromise recovery: 0002-T02, 0005-T03/T05 |
|
||
|
|
| C15 | `test_connection_limit_and_capacity_recovery`, HTTP liveness/readiness separation, framing and delayed-exchange tests | Eight held connections and recovery are not sustained-load/SLO proof. Host measurements and alerts: 0004-T02, 0005-T06 |
|
||
|
|
| C16 | `tools/wheel_smoke.py` checks installed CLI and signed authority/client HTTP exchange, wrong-key and unhealthy refusal | This is reference integration only. Named native consumer identity/tenant/expiry/CAS migration: 0004-T03 |
|
||
|
|
|
||
|
|
## Release and dependency evidence
|
||
|
|
|
||
|
|
`tools/verify_release.py` separately checks byte equality of two builds from
|
||
|
|
separate source roots with different file mtimes, packaged/spec schema equality,
|
||
|
|
wheel installation into a fresh runtime environment, CLI startup and a signed
|
||
|
|
loopback exchange. Build tools are hash-pinned in `tools/build-requirements.txt`;
|
||
|
|
runtime dependencies are installed from a hash-bearing export of `uv.lock`.
|
||
|
|
The SBOM lists installed runtime distributions and versions, not all platform
|
||
|
|
libraries, transitive native-library internals, licenses or vulnerability findings.
|
||
|
|
|
||
|
|
See [release verification](release-verification.md) for the exact receipt and
|
||
|
|
reproduction procedure. No test or artifact publication makes the proposed
|
||
|
|
contract adopted. The 0003 closeout is limited to the reference implementation;
|
||
|
|
its original task prose is broader than the evidence in several rows above.
|
||
|
|
Those unproven native claims remain in existing 0002/0004/0005 records.
|