tegwick
672cf4da6e
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 37s
Engine/PIP declaration is now checkable (layer.yaml plus a Tooling-client scan). Writes persist a decision record or the published fail-closed stance, live-lookup freshness is published, events_for is tenant-scoped, and mutation evidence drains to audit-core from a local outbox without blocking the mutation. Sender registration is requested as AUDIT-IN-0002. Boundary-contract amendment is requested as NET-IN-0002. Assistant: grok Assistant-Session: 01a04cea-e5e8-7081-a0fc-808ebbc35fa9
68 lines
2.4 KiB
Python
68 lines
2.4 KiB
Python
"""TEN-WP-0011-T01/T02: layer declaration and published PEP stance."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import importlib.util
|
|
import subprocess
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
import yaml
|
|
|
|
from tenant_engine.stance import published_stance, shipped_stance
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
SCRIPT = ROOT / "scripts" / "check_layer_conformance.py"
|
|
|
|
|
|
def _run(*args: str) -> subprocess.CompletedProcess[str]:
|
|
return subprocess.run([sys.executable, str(SCRIPT), *args], capture_output=True, text=True)
|
|
|
|
|
|
def test_layer_yaml_declares_engine_pip():
|
|
data = yaml.safe_load((ROOT / "layer.yaml").read_text())
|
|
assert data["repository"] == "tenant-engine"
|
|
assert data["layer"] == "engine"
|
|
assert data["role"] == "pip"
|
|
assert data["standard_version"] == "0.7"
|
|
assert data["tooling_contacts"] == []
|
|
assert data["pep_stance"] == "pep-stance.yaml"
|
|
assert data["pip_claims"] == "pip-claims.yaml"
|
|
ids = {c["id"] for c in data["non_tooling_clients"]}
|
|
assert "postgres-own-store" in ids
|
|
assert "sqlite-dev-store" in ids
|
|
assert "access-engine-check" in ids
|
|
assert "state-hub-work-records" in ids
|
|
|
|
|
|
def test_intent_frontmatter_agrees_with_layer_yaml():
|
|
intent = yaml.safe_load((ROOT / "INTENT.md").read_text().split("---", 2)[1])
|
|
decl = yaml.safe_load((ROOT / "layer.yaml").read_text())
|
|
assert str(intent["layer"]).lower() == str(decl["layer"]).lower()
|
|
assert str(intent["role"]).lower() == str(decl["role"]).lower()
|
|
|
|
|
|
def test_checker_passes_on_the_real_tree():
|
|
result = _run()
|
|
assert result.returncode == 0, result.stderr + result.stdout
|
|
|
|
|
|
def test_checker_catches_an_undeclared_openbao_client(tmp_path, monkeypatch):
|
|
spec = importlib.util.spec_from_file_location("check_layer_conformance", SCRIPT)
|
|
module = importlib.util.module_from_spec(spec)
|
|
assert spec.loader is not None
|
|
spec.loader.exec_module(module)
|
|
|
|
fake_src = tmp_path / "src" / "tenant_engine"
|
|
fake_src.mkdir(parents=True)
|
|
(fake_src / "vault.py").write_text("import hvac\n")
|
|
monkeypatch.setattr(module, "SRC", fake_src)
|
|
hits = module.scan()
|
|
assert hits
|
|
assert any(h[1] == "hvac" for h in hits)
|
|
|
|
|
|
def test_published_stance_equals_shipped_behaviour():
|
|
assert published_stance() == shipped_stance()
|
|
assert set(shipped_stance()) == {"unset", "unreachable", "non_allow", "unknown"}
|
|
assert set(shipped_stance().values()) == {"fail_closed"}
|