Retain bounded native probe failure diagnostics before cleanup
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
codex 2026-09-11 12:37:29 +02:00
parent 426a0d5829
commit aaa4b8e686
3 changed files with 47 additions and 5 deletions

View file

@ -17,6 +17,13 @@ import native_factory_acceptance as native
class Contracts(unittest.TestCase):
def test_failure_diagnostic_discards_unrecognized_content(self):
fixture={'error':'secret-like-unrecognized-content','child_error':'native_accept_duplicate_not_observed',
'phase':'lost-receipt','observed_http_statuses':[400],'Authorization':'must-never-be-retained'}
self.assertEqual(native.failure_diagnostic(json.dumps(fixture).encode()),
{'child_error':'native_accept_duplicate_not_observed','phase':'lost-receipt','observed_http_statuses':[400]})
self.assertEqual(native.failure_diagnostic(b'non-json secret-like text'),{'error':'probe_diagnostic_unavailable'})
def test_jobs_do_not_read_operator_credentials_and_refuse_additive_egress(self):
result=subprocess.CompletedProcess([],0,b'{"items":[{"metadata":{"name":"existing-allow"}}]}',b'')
with patch.object(native,'receiver_check',return_value={}),patch.object(native,'command',return_value=result) as cmd,patch.object(native,'bao',side_effect=AssertionError('no OpenBao call permitted')):