93 lines
7.2 KiB
Python
93 lines
7.2 KiB
Python
from pathlib import Path
|
|
import hashlib,json,re,subprocess,sys
|
|
p=Path(__file__).resolve().parent;r=Path('/home/worsch/ops-warden')
|
|
f=p.parent/'warden-1.3-kernel-fixes-r1'; review=json.loads((p.parent/'warden-1.3-kernel-review-r2/kernel-review-r2.json').read_text())
|
|
w=Path('/tmp/warden-kernel-source-integration-r1')
|
|
base='117fec9241e7b985dfb187b992e173d0a5dc3700'; branch='5abde817775d6304e3cf5a46948717a1606981bf'
|
|
def git(root,*a):return subprocess.check_output(['git','-C',str(root),*a],stderr=subprocess.PIPE,text=True,timeout=60).strip()
|
|
assert git(r,'rev-parse','HEAD')==base
|
|
assert git(r,'rev-parse','warden-1.3-kernel')==branch
|
|
assert git(r,'ls-remote','origin','refs/heads/main').split()[0]==base
|
|
assert not w.exists()
|
|
assert hashlib.sha256((f/'candidate.patch').read_bytes()).hexdigest()=='1a3530a1e469fc03c2c29f1b66fa3ba1904e56bf2abcfb242c7a2ed015fb3e74'
|
|
assert hashlib.sha256((f/'test-isolation-proposal.patch').read_bytes()).hexdigest()=='0f6c46303ec24f337e4190ec84773ccefb4833241233b4b7d56bd1927eba838c'
|
|
original_work=(r/'WORK-RECORDS.md').read_bytes(); original_index=git(r,'ls-files','--stage','--','WORK-RECORDS.md')
|
|
(p/'WORK-RECORDS.md.backup').write_bytes(original_work)
|
|
git(r,'worktree','add','--detach',str(w),branch)
|
|
for file in ['candidate.patch','test-isolation-proposal.patch']:
|
|
git(w,'apply','--check',str(f/file));git(w,'apply',str(f/file))
|
|
for file,want in review['inputs']['candidate_files_verified'].items():
|
|
assert hashlib.sha256((w/file).read_bytes()).hexdigest()==want.split(':')[-1]
|
|
for file,want in review['inputs']['unchanged_pins_verified'].items():
|
|
assert hashlib.sha256((w/file).read_bytes()).hexdigest()==want.split(':')[-1]
|
|
name='workplans/WARDEN-WP-0044-security-case-follow-through.md'
|
|
old=(w/name).read_text();(p/'workplan.preimage.md').write_text(old)
|
|
new=old+"""
|
|
|
|
## T03 source correction and safe-test follow-through — 2026-10-17
|
|
|
|
The reviewed KERNEL-2/3 source now authenticates and parses the actual catalog
|
|
snapshot, checks lane owner/risk/delegation, and resolves each type step's Warden,
|
|
attended or owner dispatch mode. Four proposed attended-change lanes remain
|
|
DRAFT; no lane is promoted and PARAMETER_PINS still contains only 1.1/1.2.
|
|
|
|
Independent review KR1-F1/F2 found cached attended run/rollback/reconcile could
|
|
lose the human/runtime boundary, and actual admission lacked the planner's
|
|
establishing-login checks. The exact successor retains the mode and authenticated
|
|
catalog bytes and repeats caller/session, agent marker and attended-lane checks
|
|
before any journal write or callback on all three operations. Planner and executor
|
|
share active/reviewed login/session-lane validation. Two unresolved Apps session
|
|
lanes correctly remain refused. Integration tests now explicitly disclose all
|
|
fixture authority substitutions; they establish no owner or native authority.
|
|
|
|
The new 19-test regression matrix reproduces 13 failures on its predecessor and
|
|
passes on the candidate. A fresh independent reviewer adds changed-authority and
|
|
catalog-snapshot probes: 90 focused checks and six guarded integration checks
|
|
pass; the combined predecessor comparison has 22 expected failures. Author's
|
|
isolated full suite passes 765 with four integration-marked tests deselected.
|
|
Evidence: Custodian warden-1.3-kernel-fixes-r1 and warden-1.3-kernel-review-r2
|
|
under docs/changes/netkingdom-target-2026-10-17. Original unsuccessful review,
|
|
invalid setup attempts and unknown ambient-lookup outcome are retained.
|
|
|
|
A separate reviewed test-only fix stubs ambient OpenBao identity in access CLI
|
|
unit tests and adds a synthetic sentinel regression which fails before any
|
|
subprocess can launch on the predecessor; 26 access/helper checks pass. The real
|
|
production helper is unchanged. The first old review's unisolated launches may
|
|
have invoked ambient `bao token lookup`; remote reach/success remain unknown,
|
|
with no secret displayed. This patch does not erase that adverse outcome.
|
|
|
|
Explicit remaining safe-test work is retained in this live T03 scope, owned by
|
|
ops-warden: replace or wrap the ordinary unit-test entry path with allowlisted
|
|
environment/empty synthetic HOME and guarded subprocess/network execution,
|
|
including nested validator children. Completion requires representative access
|
|
and case tests to refuse token-file/environment and live provider access under
|
|
synthetic negative controls while permitted local fixtures remain usable. Until
|
|
then use the preserved isolated review runner, not the ambient `make test` path.
|
|
No credential lookup, live investigation or rotation is authorized by this note.
|
|
T03 remains progress; contained sessions, authenticated owner provenance,
|
|
materialization, exact type acknowledgment/pin and first native case remain open.
|
|
"""
|
|
assert re.findall(r'```task\n.*?```',old,re.S)==re.findall(r'```task\n.*?```',new,re.S)
|
|
(w/name).write_text(new)
|
|
# Repeat the independently reviewed focused cases with an empty allowlisted HOME.
|
|
probe=p.parent/'warden-1.3-kernel-review-r2/reviewer-probes.py'
|
|
(w/'tests/test_review_r2_independent.py').write_bytes(probe.read_bytes())
|
|
home=p/'test-home';home.mkdir()
|
|
env={'HOME':str(home),'PATH':'/usr/bin:/bin','PYTHONDONTWRITEBYTECODE':'1','PYTHONPATH':'/tmp/warden-kernel-review-r2/guard:'+str(w/'src'),'LANG':'C.UTF-8'}
|
|
with (p/'focused-tests.txt').open('w') as log:
|
|
result=subprocess.run(['/tmp/warden-kernel-review-r1/final/.venv/bin/python','-B','-m','pytest','-q','-p','no:cacheprovider','tests/test_review_r2_independent.py','tests/test_case_attended_boundary.py','tests/test_case_admission_modes.py','tests/test_access.py','tests/test_openbao_caller.py'],cwd=w,env=env,stdout=log,stderr=subprocess.STDOUT,timeout=120)
|
|
assert result.returncode==0,'guarded focused tests failed; preserve worktree'
|
|
paths=[*review['inputs']['candidate_files_verified'],'tests/test_access.py',name]
|
|
git(w,'diff','--check')
|
|
run=subprocess.run(['git','-C',str(w),'add','--',*paths],capture_output=True,text=True);assert run.returncode==0
|
|
run=subprocess.run(['git','-C',str(w),'commit','--only','-m','fix(case): preserve attended authority at dispatch and validate session lanes','--',*paths],capture_output=True,text=True,timeout=240)
|
|
(p/'commit.json').write_text(json.dumps({'exit_code':run.returncode,'stdout':run.stdout,'stderr':run.stderr},indent=2)+'\n')
|
|
assert run.returncode==0,'normal commit refused'
|
|
head=git(w,'rev-parse','HEAD')
|
|
assert set(git(w,'diff-tree','--no-commit-id','--name-only','-r',head).splitlines())==set(paths)
|
|
assert git(r,'rev-parse','HEAD')==base and git(r,'ls-remote','origin','refs/heads/main').split()[0]==base
|
|
assert (r/'WORK-RECORDS.md').read_bytes()==original_work and git(r,'ls-files','--stage','--','WORK-RECORDS.md')==original_index
|
|
git(r,'merge','--ff-only',head)
|
|
assert (r/'WORK-RECORDS.md').read_bytes()==original_work and git(r,'ls-files','--stage','--','WORK-RECORDS.md')==original_index
|
|
(p/'integration.json').write_text(json.dumps({'status':'integrated-source-not-published','base':base,'draft_branch':branch,'head':head,'paths':paths,'unchanged_original_workplan_tasks':4,'ambient_owner_dirt_preserved':True,'catalog_promotion':False,'PARAMETER_PINS_changed':False,'native_action':False,'test_result':(p/'focused-tests.txt').read_text()},indent=2)+'\n')
|
|
print(json.dumps({'status':'integrated','head':head,'paths':len(paths),'focused_tests':'passed','native_action':False}))
|