tegwick
7a2373ae4c
SCOPE.md now matches the commands that run. E4 and R4 fail known-bad fixtures in process, and the cadence register schedules nothing. Assistant: grok Assistant-Session: 01a10450-dda4-7253-91a9-b8dccb2f0173
47 lines
2.2 KiB
Python
47 lines
2.2 KiB
Python
from whitehat_security.cadence import register
|
|
from whitehat_security.e4 import E4Observation, e4_calibration, evaluate as evaluate_e4
|
|
from whitehat_security.r4 import R4Case, evaluate as evaluate_r4, r4_calibration
|
|
|
|
|
|
def test_e4_known_bad_is_a_finding_and_reachability_is_not():
|
|
assert evaluate_e4(E4Observation("auth", authenticated=True)).outcome == "finding"
|
|
assert evaluate_e4(E4Observation("reach", reachable_only=True)).outcome == "pass"
|
|
assert evaluate_e4(
|
|
E4Observation("refresh", refreshed_outside_authority=True)
|
|
).outcome == "aborted"
|
|
|
|
|
|
def test_e4_calibration_fails_known_bad_before_trusting_a_pass():
|
|
report = e4_calibration()
|
|
assert report["known_bad_failed_first"] is True
|
|
assert report["outcome"] == "pass"
|
|
assert report["evidence_class"] == "fixture"
|
|
assert {item["outcome"] for item in report["known_bad"]} == {"finding", "aborted"}
|
|
assert {item["outcome"] for item in report["known_good"]} == {"pass"}
|
|
|
|
|
|
def test_r4_incomplete_inventory_is_not_a_pass():
|
|
result = evaluate_r4(R4Case("partial", "R4-A", horizon_elapsed=True, recovered=False))
|
|
assert result.outcome == "inconclusive"
|
|
destroyed = evaluate_r4(R4Case("key-only", "R4-B", key_destroyed=True))
|
|
assert destroyed.outcome == "inconclusive"
|
|
|
|
|
|
def test_r4_calibration_fails_known_bad_before_trusting_a_pass():
|
|
report = r4_calibration()
|
|
assert report["known_bad_failed_first"] is True
|
|
assert report["outcome"] == "pass"
|
|
assert {item["outcome"] for item in report["known_bad"]} == {"finding"}
|
|
assert {item["outcome"] for item in report["known_good"]} == {"pass"}
|
|
assert {item["outcome"] for item in report["inconclusive"]} == {"inconclusive"}
|
|
|
|
|
|
def test_cadence_register_schedules_nothing():
|
|
record = register()
|
|
assert record["scheduled_live_runs"] is False
|
|
families = {item["family"]: item for item in record["families"]}
|
|
assert set(families) == {"E2", "E3", "E4", "P1/P2", "R4", "ASM T-01..T-10"}
|
|
assert all(item["scheduled"] is False for item in families.values())
|
|
assert families["E3"]["declared_interval"] == "24h"
|
|
assert families["E4"]["declared_interval"] is None
|
|
assert families["R4"]["live_owner"] is None
|