tegwick
3e537d117f
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0e6f0-a6f6-7b93-9124-55ef584930e2
63 lines
6.9 KiB
Markdown
63 lines
6.9 KiB
Markdown
# Acceptance coverage — 2026-09-28
|
|
|
|
This maps the current repository tests to the obligations in
|
|
[acceptance v0.1](../specs/acceptance-v0.1.md). A listed test is evidence for its
|
|
specific assertion, not completion of the whole criterion. The local suite uses
|
|
disposable keys, fake clocks and loopback HTTP/TLS; it does not prove independent UTC
|
|
accuracy, production admission or native consumer correctness.
|
|
|
|
Test names below are in `tests/test_*.py`; the added protocol, transport,
|
|
attribution and interval sweeps have dedicated files. Parameterized cases count as tests,
|
|
not additional acceptance criteria. The release smoke script is separate from
|
|
pytest and runs against an installed wheel.
|
|
|
|
| ID | Existing local evidence | Uncovered or native obligation; existing owner record |
|
|
| --- | --- | --- |
|
|
| C01 | `test_interval_contains_send_with_asymmetric_delay` changes `time.time` and exercises the injected timer | No complete ±5-minute/zone/wall-step platform matrix; native Windows is unsupported by LinuxTimer. Supported Linux/WSL evidence: 0002-T03, 0004-T02 |
|
|
| C02 | `test_interval_encloses_true_receipt_across_asymmetry_and_drift` sweeps 324 combinations of outbound/inbound delay, processing, authority error, verification delay and timer drift; delayed exchange refusal | A finite deterministic sweep under explicit error assumptions is not measured network or oscillator evidence: 0002-T03, 0004-T02 |
|
|
| C03 | `test_signed_wrong_binding_refuses`, `test_bad_signature`, signed invalid version/number samples, unadmitted and malformed headers, modified uncertainty, signer rotation; wheel smoke refuses wrong key | Finite adversarial cases do not exhaust possible inputs; accepted signing/trust profile: 0002-T02 |
|
|
| C04 | `test_replay_refused`, delayed-exchange refusal, `test_restart_preserves_floor`, `test_new_client_cannot_reset_expired_trust` | Exact replay across process restart and every nonce-timeout interleaving are not separately tested; native lifecycle evidence: 0004-T02 |
|
|
| C05 | `test_authority_refuses_unusable_health`, `test_restart_changes_epoch`, `test_step_at_final_timestamp_latches_refusal`, `test_health_expires_during_sample_preparation`, `test_health_model_refusals`, collector replacement test | Disposable host upstream outage/reboot/recovery and accepted error model: 0005-T02/T05, RAIL-HO-WP-0013 |
|
|
| C06 | `test_lifecycle_during_exchange_refuses[suspend/domain/backward]`; boot-bound admission; 45 elapsed-time cases spanning drift bounds and timer disagreement | Fake timer disruption does not establish real VM suspend/reboot detection or oscillator bounds: 0002-T03, 0004-T02 |
|
|
| C07 | `test_validity_uses_entire_interval` checks entirely valid, not-before overlap and exact expiry | Native signed-artifact semantics and protected-side-effect recheck remain consumer-owned: 0002-T04, 0004-T03 |
|
|
| C08 | Expired-session, delayed-sample and lifecycle refusals; health expiry during preparation | No general offline holdover offered; native loss/age/uncertainty policy evidence: 0004-T02 |
|
|
| C09 | Real TLS positive control and expired/not-yet-valid/wrong-host/untrusted certificate refusals; all five redirect statuses refused without following; wrong signer and changed/revoked trust refusal | Disposable CA tests do not prove production bootstrap or trust distribution. Transport trust acceptance: 0002-T02, 0005-T03 |
|
|
| C10 | No approval/CAS concurrency fixture in this repository | Clock interval checks do not establish atomic consume or check-to-use safety. Consumer native proof: 0002-T04, 0004-T03 |
|
|
| C11 | `test_recording_evidence_preserves_original_event` verifies additive recording-time labels and preservation when merged; disabled, unavailable and expired-clock paths are tested | No historical occurrence translation or calibration-domain proof is implemented here. Audit/consumer contract and native evidence: 0002-T04, 0004-T03 |
|
|
| C12 | No occurrence-ordering test; application clock returns intervals | Overlap/order handling belongs to the consuming event system; audit acceptance: 0002-T04, 0004-T03 |
|
|
| C13 | Signed numeric overflow, units/types, malformed headers/envelopes and nonfinite exponent refusal; strict JSON, HTTP framing, malformed health/policy/helper tests | Coverage is not exhaustive numeric/schema fuzzing. Profile acceptance remains 0002-T02/T03 |
|
|
| C14 | `test_rotation_requires_fresh_client_and_matching_signer`, changed-trust refusal, expired admission and persisted rollback tests | Local file replacement is not distributed revocation; custody visibility deadlines and compromise recovery: 0002-T02, 0005-T03/T05 |
|
|
| C15 | `test_connection_limit_and_capacity_recovery`, HTTP liveness/readiness separation, unexpected status/media/encoding refusals, framing and delayed-exchange tests | Eight held connections and recovery are not sustained-load/SLO proof. Host measurements and alerts: 0004-T02, 0005-T06 |
|
|
| C16 | `tools/wheel_smoke.py` checks installed CLI and signed authority/client HTTP exchange, wrong-key and unhealthy refusal | This is reference integration only. Named native consumer identity/tenant/expiry/CAS migration: 0004-T03 |
|
|
|
|
## Release and dependency evidence
|
|
|
|
`tools/verify_release.py` separately checks byte equality of two builds from
|
|
separate source roots with different file mtimes, packaged/spec schema equality,
|
|
wheel installation into a fresh runtime environment, CLI startup and a signed
|
|
loopback exchange. Build tools are hash-pinned in `tools/build-requirements.txt`;
|
|
runtime dependencies are installed from a hash-bearing export of `uv.lock`.
|
|
The SBOM lists installed runtime distributions and versions, not all platform
|
|
libraries, transitive native-library internals, licenses or vulnerability findings.
|
|
|
|
See [release verification](release-verification.md) for the exact receipt and
|
|
reproduction procedure. No test or artifact publication makes the proposed
|
|
contract adopted. The 0003 closeout is limited to the reference implementation;
|
|
its original task prose is broader than the evidence in several rows above.
|
|
Those unproven native claims remain in existing 0002/0004/0005 records.
|
|
|
|
|
|
## Local gap follow-up
|
|
|
|
The expanded suite passes 167 tests and 4 subtests. The two arithmetic sweep
|
|
tests additionally exercise 324 signed-exchange scenarios and 45 elapsed-time
|
|
scenarios internally; these are not separate pytest counts. The true-time oracle
|
|
uses independent simulated transit/processing/verification time and authority
|
|
error, with ±500ppm simulated timer drift inside the declared 1000ppm allowance.
|
|
This validates containment under that model, not a universal platform drift bound.
|
|
|
|
The nonfinite exponent regression exposed a parser gap: Python JSON parsing can
|
|
turn `1e999` into infinity without invoking the literal-constant callback. The
|
|
parser now rejects nonfinite floats at every nesting level while retaining finite
|
|
JSON numbers. All certificates and keys in the transport tests are disposable;
|
|
TLS verification remains enabled and each refusal checks its certificate reason.
|