coulomb/tenant-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Implement TEN-WP-0011 security layer conformance
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 37s
Details

Browse source 
Engine/PIP declaration is now checkable (layer.yaml plus a Tooling-client
scan). Writes persist a decision record or the published fail-closed
stance, live-lookup freshness is published, events_for is tenant-scoped,
and mutation evidence drains to audit-core from a local outbox without
blocking the mutation.

Sender registration is requested as AUDIT-IN-0002. Boundary-contract
amendment is requested as NET-IN-0002.

Assistant: grok
Assistant-Session: 01a04cea-e5e8-7081-a0fc-808ebbc35fa9
This commit is contained in:
tegwick 2026-08-29 13:02:51 +02:00
parent 80961af91e
commit 672cf4da6e
40 changed files with 2285 additions and 361 deletions
Download patch file Download diff file Expand all files Collapse all files

13
tests/test_guardrail_domain.py
View file

@ -73,9 +73,12 @@ def test_reduced_to_floor_only_ever_reduces():
floor = eur(0)
assert eur(500).reduced_to_floor(floor) == floor
assert eur(0).reduced_to_floor(eur(500)) == eur(0)
assert LimitValue(
kind=LimitKind.ENTITY_COUNT, amount=UNLIMITED
).reduced_to_floor(LimitValue(kind=LimitKind.ENTITY_COUNT, amount=3)).amount == 3
assert (
LimitValue(kind=LimitKind.ENTITY_COUNT, amount=UNLIMITED)
.reduced_to_floor(LimitValue(kind=LimitKind.ENTITY_COUNT, amount=3))
.amount
== 3
)
def test_clamping_across_kinds_is_a_conflict():
@ -186,9 +189,7 @@ def test_override_beats_plan_beats_grouping():
grouping_only = resolve_limit("spend.monthly", tenant=t)
assert grouping_only.provenance is Provenance.GROUPING
with_plan = resolve_limit(
"spend.monthly", tenant=t, plan_limits={"spend.monthly": eur(60_000)}
)
with_plan = resolve_limit("spend.monthly", tenant=t, plan_limits={"spend.monthly": eur(60_000)})
assert with_plan.provenance is Provenance.PLAN
assert with_plan.value.amount == 60_000