tegwick
ebd8e49aff
Reuse the gated-executor approval pattern: ssh-keygen -Y signatures over exact bytes, verified against a runtime-unwritable allowed_signers anchor with a fixed namespace per purpose. load_trust now refuses responder trust without a founder admission; the KeyCape selector preflight gains --admission for one exact, bounded recovery attempt. WP14 re-pointed to CUST-WP-0082-T06 and split founder key admission into human-gated T04; WP15 T04 now requires the signed admission. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 809600@bnt-lap001 Assistant-Session: 40ba228f-c8a0-4ec9-bb29-3129951afdc4
21 lines
820 B
Python
21 lines
820 B
Python
"""Synthetic founder admission anchor for every test; never a verification bypass."""
|
|
import subprocess
|
|
|
|
import pytest
|
|
|
|
from tests.signature_support import FOUNDER, admission_anchor
|
|
|
|
|
|
@pytest.fixture(scope='session')
|
|
def founder_key(tmp_path_factory):
|
|
return admission_anchor(tmp_path_factory.mktemp('founder-admission'))
|
|
|
|
|
|
@pytest.fixture(autouse=True)
|
|
def founder_anchor(founder_key, monkeypatch):
|
|
import secrets_engine.founder_admission as admission
|
|
monkeypatch.setenv('SECRETS_ENGINE_ADMISSION_ANCHOR', str(founder_key['anchor']))
|
|
# Tests run as the anchor's owner; keep the mode-bit half of the rule.
|
|
real_rule = admission._writable_by_runtime
|
|
monkeypatch.setattr(admission, '_writable_by_runtime', lambda info: bool(info.st_mode & 0o022))
|
|
return {**founder_key, 'real_rule': real_rule}
|