coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Execute task-plan catalogue validation from verified source bytes

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13690-09e0-7cd1-964b-ec83cdbcd348
This commit is contained in:
codex 2026-10-13 20:55:05 +02:00
parent 7c79293831
commit b98d17c09f
5 changed files with 139 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

49
tests/test_task_execution_plan.py
View file

@ -144,3 +144,52 @@ def test_oidc_role_body_reuses_owner_auth_payload_and_existing_mount(compiler):
assert call.path=='auth/netkingdom/role/synthetic-operator-workload-kv-read'
assert role['role_type']=='oidc' and role['policies']=='workload-kv-read-issue-core-runtime'
assert role['bound_claims']==source['openbao']['auth']['bound_claims']
def test_cached_catalogue_code_cannot_replace_verified_source(compiler, monkeypatch):
import secrets_engine.catalog as catalogue
expected = compiler.proposal()
def stale_validator(*args, **kwargs):
raise AssertionError('cached code differs from the pinned source')
monkeypatch.setattr(catalogue, 'validate_entry', stale_validator)
assert compiler.proposal() == expected
def test_cached_catalogue_dependency_cannot_replace_verified_source(compiler, monkeypatch):
import secrets_engine.catalog as catalogue
expected = compiler.proposal()
def stale_redactor(*args, **kwargs):
raise AssertionError('cached dependency differs from the pinned source')
monkeypatch.setattr(catalogue, 'looks_secret', stale_redactor)
assert compiler.proposal() == expected
def test_cached_validator_cannot_admit_invalid_pinned_catalogue(compiler, monkeypatch):
import secrets_engine.catalog as catalogue
accepted = catalogue.validate_entry(yaml.safe_load(compiler.catalog.read_text()), source='fixture')
data = yaml.safe_load(compiler.catalog.read_text())
del data['rotation']
compiler.catalog.write_text(yaml.safe_dump(data))
compiler = repin(compiler, compiler.catalog)
monkeypatch.setattr(catalogue, 'validate_entry', lambda *a, **kw: accepted)
with pytest.raises(m.Refused):
compiler.proposal()
@pytest.mark.parametrize('invalid', [False, True])
def test_snapshot_modules_removed_without_replacing_ambient_modules(compiler, invalid):
import secrets_engine.catalog
before = {k: v for k, v in sys.modules.items() if k.startswith('secrets_engine')}
if invalid:
compiler.catalog.write_text('id: incomplete\n')
compiler = repin(compiler, compiler.catalog)
with pytest.raises(m.Refused):
compiler.proposal()
else:
compiler.proposal()
assert {k: v for k, v in sys.modules.items() if k.startswith('secrets_engine')} == before
assert not any(k.startswith('_platform_catalogue_') for k in sys.modules)