coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Verify exact task metadata baseline and readback
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
codex 2026-10-16 10:48:21 +02:00
parent 5f30ddd90c
commit d870596cc7
8 changed files with 274 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

22
tests/test_task_execution_native_fixture.py
View file

@ -78,6 +78,19 @@ def owner(compiler,bao_dev,tmp_path):
'backend_origin':origin,'cluster_uid':'disposable-fixture-only',
'operations':req['operations'],'operation_deadline':(datetime.now(timezone.utc)+timedelta(seconds=240)).isoformat(),
'backend_budget':{'ttl_seconds':120,'uses':12},'expected_before':'sha256:'+'0'*64,'expected_after':'sha256:'+'1'*64}
# Independently installed synthetic expected state, before any native write.
policy_call=compiler.before_call(plan,1);role_call=compiler.before_call(plan,4)
body=json.loads(role_call.payload)
before=m.encoded({policy_call.path:None,role_call.path:None})
after=m.encoded({policy_call.path:{'cas_required':False,'name':policy_call.path.rsplit('/',1)[1],
'policy':json.loads(policy_call.payload)['policy'],'version':1},role_call.path:{
'alias_name_source':'serviceaccount_uid','bound_service_account_names':body['bound_service_account_names'],
'bound_service_account_namespace_selector':'','bound_service_account_namespaces':body['bound_service_account_namespaces'],
'policies':body['policies'].split(','),'token_bound_cidrs':[],'token_explicit_max_ttl':0,
'token_max_ttl':0,'token_no_default_policy':False,'token_num_uses':0,'token_period':0,
'token_policies':body['policies'].split(','),'token_strictly_bind_ip':False,
'token_ttl':900,'token_type':'default','ttl':900}})
descriptor.update(expected_before=m.tagged(before),expected_after=m.tagged(after))
# Exercise the actual consumer closed descriptor parser as well; source pins,
# grant/expected-state digests remain deliberately synthetic owner fixtures.
from secrets_engine.execution_contract import ExecutionContract
@ -107,7 +120,7 @@ def owner(compiler,bao_dev,tmp_path):
plan=compiler.bind_execution(compiler.compile(req),descriptor,installed)
binding=Binding('SYNTHETIC-APPROVAL-NOT-PRODUCTION',req['request_digest'],req['operation_id'],plan.content_digest)
state=tmp_path/'private-journal';state.mkdir(mode=0o700);journal=Journal(state)
admission=FixtureAdmission(installed,root,identity,process)
admission=FixtureAdmission(installed,before,after,root,identity,process)
native=NativeFixtureAdapter(compiler,plan,journal,binding,admission)
try: yield native,journal,binding,call,compiler,descriptor
finally: journal.close()
@ -140,6 +153,7 @@ def test_native_fixed_grant_metadata_denials_and_confirmed_cleanup(owner):
assert role[1]['data']['bound_service_account_names']==expected['bound_service_account_names']
assert role[1]['data']['bound_service_account_namespaces']==expected['bound_service_account_namespaces']
assert role[1]['data']['token_policies']==expected['policies'].split(',')
assert len(native.verify_metadata())==64
# Root probes native capabilities without spending the limited task token.
for path in ['sys/policies/acl/sibling','auth/kubernetes/role/sibling','secret/data/sibling','auth/token/create','sys/mounts/secret','auth/approle/role/sibling/secret-id']:
status,data=call('POST','sys/capabilities',{'token':native.task.token,'paths':[path]})
@ -152,7 +166,7 @@ def test_native_fixed_grant_metadata_denials_and_confirmed_cleanup(owner):
assert status==400 and data.get('errors') in (['invalid accessor'],['1 error occurred:\n\t* invalid accessor\n\n'])
assert result['confirmed']
assert call('GET','sys/policies/acl/'+native.policy_name)[0]==404
assert journal.observe(binding)['state']=='applying' # native success is not full owner verification
assert journal.observe(binding)['state']=='verified'
with pytest.raises(Refused): native.metadata_call(6)
with pytest.raises(Refused): run_cleanup(journal,binding,native)
@ -261,7 +275,7 @@ def test_nonloopback_estate_origin_is_refused_before_native_transport(owner):
installed=m.encoded(changed)
plan=changed_compiler.bind_execution(changed_compiler.compile(native.meta['request']),changed,installed)
changed_binding=Binding(binding.approval_id,binding.request_digest,binding.operation_id,plan.content_digest)
admission=FixtureAdmission(installed,native.admission.owner_token,native.admission.identity_session,native.admission.server_process)
admission=replace(native.admission,descriptor=installed)
with pytest.raises(Refused):NativeFixtureAdapter(changed_compiler,plan,journal,changed_binding,admission)
@ -294,7 +308,7 @@ def test_proposed_source_grant_never_materializes_even_with_matching_digest(owne
installed=m.encoded(changed_descriptor)
plan=changed_compiler.bind_execution(changed_compiler.compile(native.meta['request']),changed_descriptor,installed)
changed_binding=Binding(binding.approval_id,binding.request_digest,binding.operation_id,plan.content_digest)
admission=FixtureAdmission(installed,native.admission.owner_token,native.admission.identity_session,native.admission.server_process)
admission=replace(native.admission,descriptor=installed)
with pytest.raises(Refused):NativeFixtureAdapter(changed_compiler,plan,journal,changed_binding,admission)
assert call('GET','sys/policies/acl/'+native.policy_name)[0]==404