tegwick
1945e16685
Replace the gate-house review note with this repository's own declaration: INTENT.md frontmatter, layer.yaml, and a published PEP stance map. SCOPE.md and agent boundary docs now match that layer. The review under history/ identifies the implementation remainder; SECRETS-WP-0008 is the follow-on workplan. SECRETS-IN-0001 is closed. The layer is not contested. Catalog "custody" is a finding: OpenBao owns custody, this engine owns the lifecycle API over it. SSH-CA signing is accepted as a proposed engine API and declined as a Staff lane. Assistant: grok Assistant-Session: 01a04cea-cb33-7c63-bad7-c1b0f9f0076b
117 lines
4.2 KiB
Python
117 lines
4.2 KiB
Python
"""Layer-model conformance (security-layer-model_v0.7 §3.3, §6, §11).
|
|
|
|
The declaration must be this repository's own, machine-readable, and equal to
|
|
the shipped production fail-closed gate. A published stance map that may drift
|
|
from the code is worse than none.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import subprocess
|
|
import sys
|
|
from pathlib import Path
|
|
from types import SimpleNamespace
|
|
|
|
import pytest
|
|
import yaml
|
|
|
|
from secrets_engine.catalog import validate_entry
|
|
from secrets_engine.cli import _require_lane_approval
|
|
from secrets_engine.errors import DecisionError
|
|
|
|
from tests.test_catalog import VALID
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
SCRIPT = ROOT / "scripts" / "check_layer_conformance.py"
|
|
DECL = ROOT / "layer.yaml"
|
|
STANCE = ROOT / "pep-stance.yaml"
|
|
INTENT = ROOT / "INTENT.md"
|
|
|
|
|
|
def _decl() -> dict:
|
|
return yaml.safe_load(DECL.read_text(encoding="utf-8"))
|
|
|
|
|
|
def _stance() -> dict:
|
|
return yaml.safe_load(STANCE.read_text(encoding="utf-8"))
|
|
|
|
|
|
def test_declares_engine_lifecycle_in_its_own_voice():
|
|
assert DECL.exists(), "no layer.yaml — §11 requires a machine-readable declaration"
|
|
data = _decl()
|
|
assert data["repository"] == "secrets-engine"
|
|
assert data["layer"] == "engine"
|
|
assert data["role"] == "lifecycle"
|
|
assert data["declared_by"] == "INTENT.md"
|
|
assert data["decision_surfaces_exposed"] == "none"
|
|
assert data["pep_shaped"] is True
|
|
|
|
|
|
def test_intent_frontmatter_matches_declaration():
|
|
text = INTENT.read_text(encoding="utf-8")
|
|
assert text.startswith("---"), "companion §2 requires INTENT.md frontmatter"
|
|
end = text.find("\n---", 3)
|
|
front = yaml.safe_load(text[3:end])
|
|
assert front["layer"] == "Engine"
|
|
assert front["role"] == "Lifecycle"
|
|
assert front["declaration"] == "layer.yaml"
|
|
assert front["pep_stance"] == "pep-stance.yaml"
|
|
|
|
|
|
def test_checker_passes_on_the_real_tree():
|
|
result = subprocess.run(
|
|
[sys.executable, str(SCRIPT)],
|
|
capture_output=True,
|
|
text=True,
|
|
check=False,
|
|
)
|
|
assert result.returncode == 0, result.stdout + result.stderr
|
|
|
|
|
|
def test_proposed_capabilities_carry_gap_record_fields():
|
|
for cap in _decl()["proposed_capabilities"]:
|
|
for field in ("capability", "intended_owner", "blocked_on", "review", "state"):
|
|
assert cap.get(field), f"{cap.get('id')} missing {field}"
|
|
assert cap["state"] == "unowned-capability"
|
|
assert cap["owner_status"] == "proposed"
|
|
|
|
|
|
def test_stance_map_is_total_over_catalog_stages():
|
|
stance = _stance()["stance"]
|
|
required = {"build", "test", "prod", "unknown"}
|
|
assert required <= set(stance), f"stance not total; missing {required - set(stance)}"
|
|
assert set(stance.values()) <= {"fail_open", "fail_closed"}
|
|
assert stance["prod"] == "fail_closed"
|
|
assert stance["unknown"] == "fail_closed"
|
|
assert _stance()["verdict_caching"] == "none"
|
|
|
|
|
|
def test_published_prod_stance_equals_shipped_fail_closed(monkeypatch):
|
|
"""pep-stance.yaml prod: fail_closed must equal _require_lane_approval."""
|
|
assert _stance()["stance"]["prod"] == "fail_closed"
|
|
entry = validate_entry(dict(VALID, stage="prod", approval={"model": "bootstrap-only"}))
|
|
cfg = SimpleNamespace(hub_url="http://127.0.0.1:8000", bao_addr="http://127.0.0.1:8200")
|
|
monkeypatch.delenv("SECRETS_ENGINE_UNSAFE_DEMO", raising=False)
|
|
with pytest.raises(DecisionError, match="live production remains disabled"):
|
|
_require_lane_approval(cfg, entry, "apply")
|
|
|
|
|
|
def test_build_stage_is_not_the_production_fail_closed_gate(tmp_path, monkeypatch):
|
|
"""build is fail_open relative to access-engine: lane approval still applies."""
|
|
assert _stance()["stance"]["build"] == "fail_open"
|
|
(tmp_path / ".decisions").mkdir()
|
|
(tmp_path / ".decisions" / "x.yaml").write_text(
|
|
"id: x\ntitle: approved\nstatus: resolved\nsuperseded_by: null\n"
|
|
)
|
|
import secrets_engine.cli as cli
|
|
|
|
monkeypatch.setattr(cli, "repo_root", lambda: tmp_path)
|
|
entry = validate_entry(
|
|
dict(
|
|
VALID,
|
|
stage="build",
|
|
path="build/team/thing",
|
|
approval={"model": "decision", "decision_ref": "x"},
|
|
)
|
|
)
|
|
cfg = SimpleNamespace(hub_url="", bao_addr="http://127.0.0.1:8200")
|
|
assert _require_lane_approval(cfg, entry, "apply").id == "x"
|