897370c6ba
The founder disabled the mount on 2026-11-07. Remove its declaration so a restore cannot recreate it, correct the settled bounded-executor audit delivery name, and record the CCR-2026-0050 founder scope approval without approving the CCR. Open proposed RPF-WP-0075 for the NetKingdom identity secondary and move RPF-WP-0072 to active. Assistant: grok Assistant-Session: 01a1b732-21dc-7ab3-b857-8436973c43a3
65 lines
4 KiB
Python
65 lines
4 KiB
Python
import hashlib
|
|
"""Real CCR schema/applier contract, no credentials or backend invocation."""
|
|
from copy import deepcopy
|
|
import importlib.util
|
|
import json
|
|
from pathlib import Path
|
|
import yaml
|
|
ROOT=Path(__file__).resolve().parents[1]
|
|
spec=importlib.util.spec_from_file_location('signer_ccr',ROOT/'scripts/credential-change.py')
|
|
ccr_module=importlib.util.module_from_spec(spec);spec.loader.exec_module(ccr_module)
|
|
CCR=ROOT/'credential-change-requests/CCR-2026-0050-flex-auth-envelope-signing.yaml'
|
|
|
|
|
|
def test_real_schema_and_apply_refusal():
|
|
ccr,errors,warnings=ccr_module.validate_ccr(CCR)
|
|
assert errors==[]
|
|
assert warnings==['OIDC/Kubernetes bound claim is not confirmed; apply is blocked']
|
|
blockers=ccr_module.applier_readiness_blockers(ccr)
|
|
assert len(blockers)==2
|
|
assert any('status, got proposed' in x for x in blockers)
|
|
assert any('confirmed OpenBao auth binding' in x for x in blockers)
|
|
assert ccr['access_frontdoor']['resolvable'] is False
|
|
# Founder scope approval is recorded from decision 18731e84. The CCR stays
|
|
# proposed until cluster-runtime-storage-owner approves.
|
|
assert ccr['status']=='proposed'
|
|
approvers=set(ccr['review']['required_approvers'])
|
|
for comment in ccr['review']['comments']:
|
|
role=comment['reviewer'].split(' (')[0]
|
|
assert role in approvers and role != 'cluster-runtime-storage-owner'
|
|
assert any(c['reviewer'].startswith('founder') and c['decision']=='approved' for c in ccr['review']['comments'])
|
|
# Pure synthetic candidate only: ensure admitted-pattern scope has no latent
|
|
# schema/applier role/field failures once the real owners eventually approve.
|
|
admitted=deepcopy(ccr);admitted['status']='approved';admitted['openbao']['auth']['bound_claims_confirmed']=True
|
|
assert ccr_module.applier_readiness_blockers(admitted)==[]
|
|
|
|
|
|
def test_generated_read_scope_and_projection_join():
|
|
ccr,_,_=ccr_module.validate_ccr(CCR)
|
|
assert (ROOT/ccr['openbao']['policy_file']).read_text()==ccr_module.generated_policy_hcl(ccr)
|
|
hcl=ccr_module.generated_policy_hcl(ccr)
|
|
assert 'metadata/' not in hcl and 'list' not in hcl and 'create' not in hcl
|
|
assert ccr['openbao']['fields']==['ED25519_PRIVATE_KEY']
|
|
docs=list(yaml.safe_load_all((ROOT/'docs/credential-lane-designs/flex-auth-envelope-signing-native-projection.yaml.proposed').read_text()))
|
|
store=next(x for x in docs if x['kind']=='SecretStore')
|
|
assert store['spec']['provider']['vault']['auth']['kubernetes']['role']==ccr['openbao']['auth']['role']
|
|
external=next(x for x in docs if x['kind']=='ExternalSecret')
|
|
assert external['spec']['data']==[{'secretKey':'seed','remoteRef':{'key':'workloads/flex-auth/envelope-signing','property':'ED25519_PRIVATE_KEY'}}]
|
|
|
|
|
|
def test_native_scope_separates_read_grant_and_unadmitted_execution():
|
|
plan=json.loads((ROOT/'docs/credential-lane-designs/flex-auth-envelope-signing-native-plan.json').read_text())
|
|
assert plan['authority_granted'] is False and plan['status']=='prepared-unapproved'
|
|
assert plan['bootstrap']['expected_version']==0
|
|
assert all(x['disposition'].startswith('pending ') for x in plan['reviews_required'])
|
|
# The plan is the exact artifact the owners reviewed (native plan sha256 in CCR-2026-0050).
|
|
assert hashlib.sha256((ROOT/'docs/credential-lane-designs/flex-auth-envelope-signing-native-plan.json').read_bytes()).hexdigest().startswith('22306d50e082fc35')
|
|
state=plan['protected_adapter']['state']
|
|
assert 'implemented and tested' in state and 'not a native execution approval' in state
|
|
assert 'remain mandatory' in state and 'dev-process gate remains preserved' in state
|
|
assert plan['receipts']['maximum_bytes']==65536
|
|
assert all('platform/' in x['path'] for x in plan['bootstrap']['allowed_native_methods'])
|
|
# 84c529f: Platform creates no storage; the outbox PVC is Access's separate proposal and
|
|
# its provisioning stays with cluster-runtime-storage review.
|
|
resources=plan['requested_scope']['new_resources']
|
|
assert 'Platform creates no storage resources' in resources and 'remain open' in resources
|