coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare receipt-bound audit E2 third attempt

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02991-be07-7bb3-8b6d-e9701b5621de
This commit is contained in:
tegwick 2026-08-22 23:23:48 +02:00
parent 0525e632d7
commit 96d6781036
12 changed files with 440 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

41
tests/test_audit_core_runner.py
View file

@ -84,3 +84,44 @@ def test_retry_invocation_fixture_set_is_declared_and_distinct():
assert fixtures <= set(engagement["fixture_ids"])
assert fixtures.isdisjoint(previous["fixture_ids"])
assert engagement["engagement_id"] != previous["engagement_id"]
def test_report_uses_supplied_authorization_id():
args = Namespace(
engagement_id="WH-ENG-EXAMPLE",
authorization_id="operator-session-example",
target_revision="sha256:" + "a" * 64,
)
report = runner.build_report(
args,
started="2026-08-22T22:00:00Z",
outcome="pass",
attempted_operations=9,
results=[],
limitations=[],
)
assert report["authorization_id"] == "operator-session-example"
assert report["engagement_id"] == "WH-ENG-EXAMPLE"
assert report["attempted_operations"] == 9
def test_third_attempt_fixtures_are_new_and_complete():
previous = json.loads(
Path("engagements/2026-08-22-audit-core-e2-02.json").read_text()
)
engagement = json.loads(
Path("engagements/2026-08-22-audit-core-e2-03.json").read_text()
)
args = Namespace(
tenant_a="tenant:trial:whitehat-a-20260822-03",
tenant_b="tenant:trial:whitehat-b-20260822-03",
event_a="whitehat-e2-event-a-20260822-03",
event_b="whitehat-e2-event-b-20260822-03",
absent_event="whitehat-e2-absent-20260822-03",
forged_event="whitehat-e2-forged-b-20260822-03",
correlation="whitehat-e2-correlation-20260822-03",
)
fixtures = runner.invocation_fixture_ids(args)
assert fixtures <= set(engagement["fixture_ids"])
assert fixtures.isdisjoint(previous["fixture_ids"])
assert engagement["engagement_id"] != previous["engagement_id"]

36
tests/test_platform_custody_adapter.py
View file

@ -15,6 +15,7 @@ from whitehat_security.platform_custody import (
broker_from_receipt,
contract_digest,
digest,
finalize_run_report,
interface_artifacts,
load_schemas,
resource_names,
@ -381,3 +382,38 @@ def test_cleanup_receipt_must_match_lease():
bad = cleanup_receipt(bound, projection)
bad["lease_id"] = "custody:" + "0" * 32
validate_cleanup_receipt(bad, projection=projection, contract=bound)
def test_finalized_report_is_bound_to_cleanup_receipt():
bound = contract()
projection = projection_receipt(bound)
cleanup = cleanup_receipt(bound, projection)
report = {
"engagement_id": bound["engagement_id"],
"target": bound["target"]["id"],
"target_revision": bound["target"]["image_digest"],
"credential_revocation": "pending orchestrator cleanup",
"cleanup": "pending",
}
finalized = finalize_run_report(
report, projection=projection, cleanup=cleanup, contract=bound
)
assert finalized["credential_revocation"].startswith("revoked by railiance-platform")
assert projection["receipt_id"] in finalized["cleanup"]
def test_finalized_report_refuses_wrong_engagement():
bound = contract()
projection = projection_receipt(bound)
cleanup = cleanup_receipt(bound, projection)
with pytest.raises(AuthorizationError, match="report engagement"):
finalize_run_report(
{
"engagement_id": "WH-ENG-WRONG",
"target": "audit-core",
"target_revision": bound["target"]["image_digest"],
},
projection=projection,
cleanup=cleanup,
contract=bound,
)